41 Commits

Include renames

Author	SHA1	Message	Date
morluto	bbe2bcc979	refactor: remove legacy seams and consolidate resource ownership (#10349)	2026-11-13 04:45:16 -05:00
3 people	7aca4cef64	feat(audit): report what a shipped app exposes to static analysis (#8525) ... * feat(audit): report what a shipped app exposes to static analysis Adds `audit_release_exposure` and `rea audit-release-exposure` to report source maps, Electron fuse implications, extractable payloads, debug information, build metadata, and credential markers. Checks carry stable IDs, observations, statuses, and fixed remediation, while incomplete and unassessed checks remain visible without implying a security verdict. Credential findings include only rule IDs and locations. The CLI supports `--fail_on` severity thresholds and exits 3 when an exposed check meets the threshold. * fix(audit): keep incomplete coverage unknown across text, fuses, Go flags and cancellation Probe files with unrecognized names as text, keep undecided fuse slices unknown, forward opaque container coverage, read paths from Go build flags, and compare inventoried digests before accepting owner facts. Keep typed cleanup failures and attach the partial report when a later owner is cancelled. Pin the verifier's @electron/fuses version and move the tests to the named contract family. * fix(audit): match package members by source spelling and close remaining coverage gaps Reopen package members by their source spelling and keep caller path traversal in directory reads. Parse quoted and attached Go build flags, bind a native image fuse read to its own digest, and keep reader resources and the audit's partial report when cleanup or cancellation combine failures. * fix(release-exposure): bind package members by ordinal and follow named map references Package members were matched to container entries by sourcePath, which is not unique in a PyInstaller executable, through a queue that only moved when a member was reopened. Bind by container-relative path and duplicate ordinal, the numbering inventory uses, so read order cannot change which bytes a member gets. A sourceMappingURL naming a file without a map extension was ignored. Local targets are now examined as maps whatever their name, and a target already scanned as plain text leaves coverage unknown. * fix(release-exposure): match data: source map scheme case-insensitively URL schemes are case-insensitive, so an inline declaration such as //# sourceMappingURL=DATA:application/json;base64,... was routed to the local-reference path, which ignores scheme URLs. Its embedded sources were silently dropped and source_map_sources reported not_observed. * fix(release-exposure): normalize declared map targets and count unreached ones A sourceMappingURL that decodes to a decomposed name (cafe%CC%81.json) never matched the inventoried member, whose logical path is NFC, so the map was scanned as ordinary text and its sourcesContent went uncounted. Map-target lookups now use an NFC key on both the record and lookup side; the declared URL is left as written. A declared map target that is never reached is now counted as a skipped map, so the source-map checks read as unknown coverage instead of not_observed. * fix(release-exposure): recover indexed leaves after any map format failure An indexed map whose one leaf has malformed mappings (such as AA) threw a format failure that only recovered leaves for unsupported sections, so a valid sibling leaf with sourcesContent was dropped and javascript.source_map_sources read unknown instead of exposed. Leaves are now recovered for any format failure, with the envelope parse guarded so invalid JSON still falls through to the unparsed count. A nested package that inventory recognized but did not expand was probed as a plain binary and left the source-map checks at not_observed. It now marks coverage unknown and records a limitation. Reader tests assert the javascript.source_map_sources status for the NFC map-name cases as well. * fix(release-exposure): count an unexpanded nested package as a readable member An unencrypted nested package that inventory recognized but did not expand is still a member its parent package already read. Count it as readable so packaging.extractable_payload reports exposed, while its own contents keep coverage unknown. * fix(release-exposure): bound the indexed leaf fallback by decoder limits The fallback walk after a map format failure expanded every section and built a full ancestor path per leaf, so a map refused for nesting depth could still allocate far past the decoder budgets. Walk only to the 64-level section depth and the shared record budget, keeping leaf maps without materializing section paths. * fix(release-exposure): collect UNC roots from Go flag paths A flag such as -I\\buildhost\sdk\include matched none of the path roots in GO_FLAG_PATH, so a network path that was the only one in complete build info left go.build_paths at not_observed. Accept \\host\share roots alongside the slash-rooted, dot-relative and drive-letter forms. * fix(release-exposure): keep Electron undecided without positive proof The desktop owner names Electron only from an ASAR layout, so an asar: false build has no candidate. A complete scan with no candidate was reported as not_electron, which outranks unresolved and safe fuse outcomes and hid them as not_applicable. Leave the family unknown unless the fuse holder rules Electron out: an app bundle with no Electron Framework, or a directory with complete coverage whose native images were all read and hold no sentinel. A directory with no native image is not proof, so its fuse checks now report unknown. * fix(release-exposure): decode wide text members before scanning A member's kind bypassed the NUL guard, so a UTF-16 plist was decoded as UTF-8, matched nothing and still counted as scanned. A directory holding only that member reported text.credential_markers as not_observed. Decode by byte order mark at one boundary instead. UTF-16 is scanned in either byte order, and inline maps read the same text. UTF-32 and NULs no mark explains count as skipped, whatever the member's kind. A binary plist keeps its raw scan. Unnamed members with a mark now reach the scanner, and the plist decoder shares the same mark detection. * fix(release-exposure): follow file: URL source map declarations The scheme guard in noteLocalMapReference returned on every URL scheme, so a declaration such as file:///release/debug.json was dropped with the remote ones. A member without a .map name was then scanned as ordinary text and javascript.source_map_sources reported not_observed. Convert file: URLs with fileURLToPath and record them in mapTargets through the same step as relative declarations. A target that is never reached, or that was already scanned as text, counts as skipped, and so does a malformed file: URL. A file: URL names one absolute location, so a .map target outside the inventory stays unassessed rather than being trusted by its name. Remote schemes stay ignored. * fix(release-exposure): match backslash-relative Go flag paths GO_FLAG_PATH accepted dot-relative roots only with a forward slash, so `-I..\sdk\include` and `-I.\sdk` produced no path and go.build_paths came back not_observed. Accept either separator after the dots. The CLI acceptance test now expects unknown for electron.run_as_node on a directory with no native images, matching the service. * fix(release-exposure): keep fuses unknown on incomplete inventory A directory inventory that stops at an acquisition limit never reports the images it did not reach, so the native image sample has no omission and safe fuses on an included helper settled to not_observed even though scan coverage was unknown. Treat unknown coverage like a truncated sample until the Electron executable is accounted for. A selected native file is that executable, so it keeps its decided fuse result. * fix(release-exposure): decode binary plists before scanning A binary plist stores each string as ASCII or UTF-16BE. Scanning the raw bytes as UTF-8 missed any string the encoder kept in UTF-16, such as one with a non-ASCII character, and still counted the member as fully scanned, so text.credential_markers read not_observed. Decode through the plist owner and scan its strings, dictionary keys and data. A plist that cannot be decoded keeps its raw bytes in the scan and counts as skipped, so coverage stays unknown. * fix(release-exposure): keep UTF-8 members that hold a NUL Any NUL in a member's first 512 bytes made the decoder give up, so a script with a literal NUL in a string never reached the credential or inline-map checks. An exposed marker in it read as unknown, and --fail_on high exited 0. Validity alone cannot tell wide text from UTF-8, since ASCII in UTF-16 is valid UTF-8. Treat a header that is an eighth or more NUL bytes as wide text and anything not UTF-8 as undecoded, and scan the rest. The docs now separate BOM-marked UTF-16, which is scanned, from wide text with no byte order mark, which is not. * fix(audit): scan every string a binary plist stores The plist scan read only the decoded value, which drops objects the root no longer references and entries a later duplicate key replaced. Those bytes still ship, but the audit marked the scan complete, so a credential stored there read as not observed and --fail_on high exited 0. Read strings, keys and data from the object table instead. A stored object that cannot be read leaves the member unassessed, and a total byte budget bounds table entries that overlap to repeat the same text. * fix(audit): keep packaged native images from ruling out Electron The applicability check only looked at the "native images" omission. An Electron executable inside a compressed .NET or PyInstaller member is recorded under "packaged native images", so a directory whose on-disk hosts had no fuse sentinel read as not Electron and all four fuse checks as not applicable. Treat that omission as an unread image too. * fix(audit): keep readable plist text when one object is unreadable Throwing on one unreadable stored object discarded every string already decoded, so a UTF-16BE credential beside a truncated unused object was lost: the raw bytes that replaced it cannot match NUL-separated text. Return the decoded text with complete false instead, and keep the raw bytes in the scan beside it so ASCII in the unread object is still seen. The member stays unassessed. Text past the budget ends the same way. * fix(audit): read escaped inline maps and extensionless SEA entries A data URL may percent-escape its base64 payload, so a map such as one padded with %3D did not decode and the audit counted no embedded source map. Decode the escapes before reading the base64. A directory walk classed a SEA entry by its code path, so a main script whose code path names no script was never scanned as JavaScript and its inline map went unseen. Class it by the role the SEA metadata gives it. * fix(audit): check plist text against the budget before decoding it decodeBinaryPlistText decoded each stored object before comparing its size with the remaining budget, and it keeps going after an object is rejected so later text is still read. A plist under the input limit could repeat a large range through overlapping table entries and force gigabytes of decoding that the audit then discarded. Separate finding a stored payload from decoding it, so a range past the remaining budget is rejected without allocating its text. Earlier text and the incomplete result stay as they were. * fix(audit): count a packaged PE with an unread header as a native image A package member whose PE signature lies beyond the 4 KiB probe recorded only a PDB failure. The image was neither read nor listed under packaged native images, so a directory whose on-disk hosts had no fuse sentinel read as not Electron and all four fuse checks as not applicable. Count it as a packaged native image, the omission that keeps the question open, and keep probing it for text as before. * fix(audit): keep cleanup-incomplete errors from composed readers A desktop, fuse, Go or Rust failure became a string on that check, so an error with unfinished cleanup lost its resources and live bindings while the audit reported success, and the MCP handler does not close the service after each request. Treat unfinished cleanup like cancellation: stop the remaining owners and return the error with the partial audit. When the owner attached its own partial, keep the error and replace the partial, so cleanup stays attributed. * fix(audit): keep safe fuses unknown past a packaged native image The fuse check counted sampled-out images as possibly unread but not native images inside a package. A complete directory scan with a safe-fuse image on disk, no ASAR hint, and an unopened packaged image reported the four Electron checks as not_observed, although the Electron executable could be that image. The fuse check, the Go and Rust checks, and the Electron rule-out each decided this for themselves and had drifted apart. Move the decision to one domain predicate, nativeImagesMayBeUnread, and use it in all three. A hinted executable that was read still settles the check. * fix(audit): settle fuses only on an identified host, and read Bun and HTML maps A retained helper set electron_executable_included because the rank marks every .exe or extensionless sibling of resources/app.asar. With more than four siblings, or an inventory that stopped early, safe fuses on a helper reported not_observed while the host went unread. Rank stays a sampling hint. The check now settles only on an executable named as the host, or when inventory was complete and every executable that could be the host was sampled. A Bun sourcemap region is named .bunmap, so its role was lost and a complete audit reported no source maps. Carry the region role from the reader's metadata into the member view, in the expanded and unexpanded paths, and treat it as a JavaScript map so an unparsable region stays unresolved, not a debug companion. An HTML member was scanned as text but its inline scripts were never checked for source maps. The HTML owner now returns each body, the reader examines it like a script file, and bodies past the owner's limit count as skipped. * fix(audit): charge map reads to the count before opening the member An oversized or unreadable .map returned before readSourceMap counted it, so the allowance of 32 never ran out. An unexpanded .NET or PyInstaller package could then decompress every listed map member, about 1 MiB each, up to the 4,096 entry cap. The count bounds reads, so examineMap now reserves the slot before it opens the member. A map past the count is skipped unopened, and a linker map past it is still settled from its bounded prefix. An inline data: map is already in memory and keeps its charge at the point it is parsed. * fix(audit): examine scripts HTML loads whatever they are called isJavaScriptMember knows a script by its suffix or an assigned kind, and the reader dropped the script references the HTML owner parses. An extensionless main loaded by <script src="main"> was scanned as ordinary text, so a complete inventory reported javascript.source_map_sources not_observed with shipped sources in its inline map. The reader now resolves each JavaScript script reference against the page and its base href, and a local target without a JavaScript name is examined as a script when reached. A target read before its HTML file, never reached, or not placeable on disk counts as a skipped map, so the check stays unknown. * fix(audit): charge sibling map reads to the map count Every generic .map beside a selected file got a full 1 MiB read and a parse, with no cumulative bound, so the 4,096-entry listing allowed about 4 GiB of reading for one small selection. Move the slot rule into chargeMapRead, which examineMap and sibling classification now share. Past the count a sibling reads only the header: a linker map is still identified, and one that may be a source map stays a skipped companion. * fix(audit): report cleanup failures raised by member reads A close failure during an embedded-package probe, member read or inventory reaches the shared read filter as an ordinary reader failure. The filter kept only cancellation and integrity, so the member became a skipped read, inspect succeeded, and the retained descriptor was reported nowhere. MCP does not close the service after each request, so no caller saw it. Propagate any failure that carries cleanup, whatever its reason, so it reaches releaseExposureFailure and the audit reports its retained resources. * fix(audit): charge unsuccessful text reads to the byte allowance An oversized, undecodable, or failed text read left textBytes unchanged, so every member got the full per-member budget and the cumulative allowance did not bound what a package decompressed. Count the bytes member reads produce and charge them whatever the read yields. An oversized file on disk still costs only its probe. * fix(audit): bound the paths kept for HTML script targets A base href is copied into every script target it resolves, so a page under the text member allowance could retain hundreds of megabytes of paths. Charge each new target's resolved path to a byte allowance and leave targets past it unassessed. * fix(audit): keep examining a page loaded as a script as HTML A script element naming an .html member promoted that member to a script, and the text pass then chose one reading. The page's own script elements were never read, so an inline map in it was lost and a shipped sourcesContent went unreported. Run the script reading and the HTML reading independently, and list the script target allowance among the cases that leave source map coverage undecided. * fix(audit): detect credential markers that end in a hyphen The Google, GitLab, and Slack rules allow a hyphen in the token but ended on a word boundary, so a token ending in a hyphen at the rule's minimum length was missed and the audit reported the check as not observed. Open-ended rules now take the whole token, and the fixed-length Google rule checks the full token alphabet after its last character. * fix(audit): confirm FAT identity for probed package members The package probe treated a decoded FAT table as a universal Mach-O. A JVM class past the 4 KiB probe shares the FAT magic, so its truncated prefix decoded as a table, the member counted as an unread native image, and Electron could not be ruled out of a complete scan. Pass the member's declared size to the sniff and take identity from classifyFatContainerEvidence. A member with no usable size, or with slices past the probe, stays counted as possibly native. * fix(audit): admit binary plists in package member probes A package member's probe judged text by its own NUL test, which accepted byte order marks but not the binary plist signature decodeMemberText also reads. A PyInstaller executable shipping a binary Localizable.strings was rejected without a scan or a skipped count, so a UTF-16BE private key marker inside it could report not_observed. Name the encodings that explain their own NULs in one predicate, and move the plist fixture builders to module scope. * fix(audit): locate Go findings only in images that retain build paths The exposed decision required non-empty paths, but the locations took every image whose build info read. An image with no paths was named as a source of the leak beside the one that had them. One predicate now decides both. * fix(audit): keep completed findings when member cleanup fails A descriptor close failure aborts the member scan, and the scan's state was dropped with it, so the caller got a typed cleanup failure and no report. Source maps already counted and credential hits already collected were lost. The reader now hands the service what it assembled, with coverage unknown and a limitation saying so, alongside the failure. The service runs that scan through its existing stopped-audit path: no later owner runs, and the report goes on the error as its partial observation. * fix(audit): keep coverage unknown for nested ASARs in package hosts A member of a PyInstaller or .NET host reaches the binary probe as a plain file. An ASAR among them has a NUL-bearing header, so the probe dropped it with no traversal and no omission, and source map checks could read not_observed with complete coverage. Ask the ASAR owner's signature probe, and record a match as a nested package that was not expanded, as inventory-classified ones already are. * fix(audit): let native format facts outrank member names examineMember tried the name-based text and map routes first, so a PE an owner identified inside an ASAR, named payload.json, was read as text. Its CodeView path and the packaged-native omission were both lost, and native.pdb_path read not_applicable. Route an owner-established native format to the native probe first, and count an encrypted one as a packaged native image for the same reason. * fix(audit): report relative paths given to compiler path flags go.build_paths only kept rooted paths, so retained build settings like CGO_CFLAGS=-Iprivate-sdk read not_observed even though the setting names a directory. Take the relative argument of a C compiler path flag, attached or in the next field. Scope this to compiler settings, because Go's own tools use the same letters for non-paths such as -B gobuildid and -T 0x1000. * test(javascript): expect retained text on SVG inline scripts The SVG test from main predates this branch's inlineScripts text field, so each side passed alone and only their merge failed. * fix(audit): keep an unresolved Electron host's fuses unknown fuseCheck decided from whatever outcomes the images reported, so a host with no fuse answer read not_observed as soon as any other image in the directory reported safe fuses. Pass the images named as the host into the report and leave a check unknown when one of them has no answer for it. Other images stay free to have no fuses, because helpers in a real Electron install have none. * fix(audit): bound the paths kept for local source map targets noteMapTarget kept every declared target resolved against its member's directory, so a short URL under a long directory could retain far more than the script's own size, with no cumulative limit. Add the allowance noteScriptTarget already has. A target past it stays unassessed and counts as a skipped map, and is never read. * fix(audit): borrow the audit's scope admission for inventory inspect holds resources.run for the whole audit, and inventoryArtifact entered the same scope again. With failed cleanup pending from another audit, the inner run waits for a drain that waits for the outer run. Add inventoryArtifactInScope, which takes the caller's admission. * fix(audit): run the exposure verifier's commands under supervision The verifier launched npm and the CLI with raw execFile and then removed its temporary tree, so a timed-out child could outlive the tree it was using. Use the shared verifier commands and close them before removing the tree. Their exit error carries stdout on its snapshot, so the audit's exit-code branch reads it from there. * fix(audit): read relative -L paths and split flag arguments The relative-path reader handled C compiler settings only, so a directory kept through Go's own linker flag, such as -ldflags='-L private-sdk -s -w', reported go.build_paths as not_observed. A quoted flag and argument also reached it as one field. The separating space stayed on the argument, which reported rooted paths twice and kept a leading space on relative ones. Give -ldflags its own pattern that matches only -L, so -B gobuildid and -T 0x1000 stay ignored, and consume the separator in the flag patterns. * fix(audit): keep embedded leaves beside schema-invalid map fields The reader recovers independent indexed leaves only after a SourceMapFormatFailure, but inspectSourceMap let the schema's ZodError through. A sibling with mappings "!", a section with a bad offset or a root with a bad field skipped recovery, so a valid leaf with sourcesContent reported javascript.source_map_sources as unknown. Normalize schema rejection in SourceMapFormat, which owns these parses, so every structural failure reaches consumers as a format failure. The message is unchanged, and the codec and web fetcher already map both cases to the same result. * fix(audit): keep packaged executables' own packages unknown examinePackagedBinary counted a native image inside a package and moved on, while only on-disk images reached the embedded-package probes. An ASAR carrying a PyInstaller, Bun, Node SEA or .NET executable with a source map therefore scanned complete and reported javascript.source_map_sources as not_observed. Run the same classifier on packaged images. The probes read carrier offsets from a file, so the member's bytes stay in a temporary file for the probe alone. A detected package keeps member coverage unknown, as a nested ASAR does, and an image past one file's total byte allowance stays unprobed and unknown. A plain native member leaves coverage intact. * fix(audit): read an app's sampled images for fuses A .app target sent only the bundle candidate to the fuse reader, which resolves to the outer Electron Framework. A sidecar with RunAsNode enabled was never read, so the check reported not_observed in the app view while the directory view reported exposed. Send the bundle candidate first and then the sampled native images. An image whose digest matches the bundle's read is skipped, so the framework is not read twice. A sidecar's safe fuses cannot settle the outer framework, so a bundle read with no answer for a fuse keeps that check unknown. * fix(audit): read a Node shebang as script identity The path classifier gives an extensionless executable a resource kind, so a script such as bin/runner with a `#!/usr/bin/env node` header was scanned as text without its inline maps being examined or counted. A complete inventory then reported no shipped sources for it. The probe holds the first bytes a member reader sees, so establish the identity there. The script keeps the usual outcomes: a map that is read counts, and one past an allowance or undecodable stays unknown. * fix(audit): keep linker strings out of Go build paths Reading `-X 'main.usage=-L level'` as a library directory made go.build_paths report `level`, so a plain string could fail an audit under --fail_on low. Read the optional package selector once, before the setting's first flag, and keep the argument of -X attached to it, so a string it sets is never scanned as another option. * fix(audit): keep a failed probe directory removal owned A packaged image's probe copies the member's full bytes into a temporary directory. When removing it failed, the error became an ordinary unreadable probe: the audit could still succeed, nothing could retry the removal, and the client heard nothing about the leftover bytes. Hold the directory in the reader's resource scope, so close retries it, and report the unfinished cleanup without replacing a primary failure. * fix(audit): keep a declared .map from reading as a linker map A script's sourceMappingURL=assets.map was dropped because the name already looked like a map. A malformed assets.map then settled as a linker map, so both source-map checks read not_observed and native.debug_companions reported an exposure the release does not ship. Keep a generic .map name as a declared target and read it as a JavaScript map, in either scan order, so it stays unresolved. * test(audit): rethrow typed errors from release exposure checks A failed Result was rewrapped in a plain Error, which dropped its type, cause and cleanup details from the test output. * fix(audit): match companions by member identity, not spelling An ASAR member's location is relative, and a declared map target is absolute, so a malformed assets.map read before z.js stayed a linker companion. The examined-map lookup, which is normalized, then returned early, leaving both source-map checks not_observed. Index companions by memberLocationKey and keep each reported spelling under it. Spellings stay distinct because symlinks can make them differ. * fix(audit): retract only guessed linker maps on a declaration A script declaring sourceMappingURL=symbols.pdb after the scan reached symbols.pdb removed the shipped PDB from the companion list, because a late declaration retracted any companion. native.debug_companions could then read not_observed. Keep name-identified companions in their own set, and retract only maps that were read as non-JSON and guessed to be linker maps. * fix(audit): record an unfollowed map link as skipped The directory and ASAR readers do not follow links, so a symlinked app.js.map dropped out before any map counter moved. Its target was scanned as plain text, and both source-map checks read not_observed. Count a link that names a map as skipped wherever entries reach the audit, and mark it examined so a declaration does not count it twice. * fix(audit): read relative paths in Go compiler and assembler flags A binary built with -gcflags=-I private-sdk keeps that setting, but relative parsing covered only C compiler settings and -ldflags, so the directory dropped out of go.build_paths. Give -gcflags and -asmflags their own path options, taken from what go tool compile and go tool asm document, and strip the package selector as -ldflags does. The assembler's -D defines a symbol, so it is not one. * docs(audit): state the packaged image read allowance Packaged ELF, Mach-O and PE images are read in full and copied to a temporary file, sharing one max_file_bytes allowance, but the docs and coverage.allowances still said only a PE gets more than a header read. Name the allowance and the copies in docs/release-exposure.md, RELEASE_EXPOSURE_ALLOWANCES and the max_file_bytes description. * docs(audit): say how go.build_paths treats rooted -X values A rooted -X value cannot be told from a file path, so the audit reports it. State that, and why, so the rule is a contract rather than a side effect of how flags are scanned. * fix(audit): keep a declared sibling map out of the linker guess When the selected file declared a sibling map, the sibling classifier never consulted the declaration. A malformed assets.map then read as a linker map and raised native.debug_companions. Leave a declared sibling to the unreached-target accounting, as members already are, so it stays an unresolved source map. * fix(audit): keep undecodable Go and Rust metadata unknown Unsupported meant two things: a container this reader does not handle, and metadata the image holds in a form the reader cannot decode, such as a compressed .dep-v0 section. Both read as not_applicable, so an image that carries metadata reported that the check did not apply. Mark the second case on the format failure and carry it on AnalysisUnsupportedTargetError, so the audit records a failed read and stays unknown. The tools' own errors and messages do not change. * fix(audit): keep coverage unknown for a PE header past the probe A packaged member whose PE signature lies beyond the probe prefix stayed unclassified, so the embedded-package probe never ran and coverage stayed complete. A map inside such an image then read as not_observed. Record the member as an unexamined package where it is already marked as a possible native image. * fix(audit): read the scripts of a standalone SVG An SVG can carry a script with an inline source map, but only .html and .htm members reached the script owner, so such a file left every map counter at zero and javascript.source_map_sources read not_observed. Treat .svg as a script-bearing page. htmlArtifactReferences already reads SVG script elements, so this adds no parsing. * fix(audit): keep every possible host when no name picks one out With no named Electron host, every sibling ranks alike and electron_host_paths stayed empty, so one image's safe fuses settled the checks even when another possible host reported none. Keep all sampled candidates as hosts in that case, so a candidate without fuses leaves the checks unknown. * fix(audit): read a text-named native member by its bytes A PE member called payload.json took the text route, so it reached no native probe, and its CodeView path and packaged-native uncertainty were lost. Decide from the bytes the text read already loaded, so real text costs no extra read and the map and text allowances stay as they were. * fix(audit): let a map or script read identify a native member A package lists names without formats, so a PE called payload.js.map took the map route and never reached a native probe. Its CodeView path was lost, and with nothing counted as failed, native.pdb_path could read not_applicable. A PE at a declared script or map target was lost the same way, because declaration overrode the route. Decide from the bytes the route already read, in the map route as in the text route, and keep the listed kind for a promoted script target. Real text and maps cost no extra read, so those allowances are unchanged. * fix(audit): name a symlinked sibling debug companion Selecting an executable skipped every symlink beside it before the name check, so an app.pdb link left no companion path and no skip count, and native.debug_companions read not_observed. Selecting the directory reports the same link. Check the name first. The map branch already needs a regular file, so no link is followed. * fix(audit): keep map coverage unknown for a linked script A link named app.js to an extensionless payload was skipped as a link, and its target was read as plain text with no map directives parsed. An inline map there left no parsed or skipped count, so javascript.source_map_sources read not_observed. Only links with a map name were counted. Count a link under any name that can declare a map, the set an unread member already uses. It stays one omission when a page or a directive also names it. The target is still not followed. * fix(audit): keep a declared JavaScript map beside a selected file unknown A local sourceMappingURL with a JavaScript map name such as app.js.map was dropped on the assumption that it would be examined as a member. When the selection is a file, sibling .js.map files are never read, so the declared map left javascript.source_map_sources not_observed while the same target spelled as a file: URL left it unknown. Record every local target so an unreached one counts as skipped. * fix(audit): read paths a C compiler forwards to the linker CGO flags can hand linker options through -Wl,a,b or -Xlinker a. The compiler flag parser saw -Wl,-L,private-sdk as one field and missed the relative library directory, so go.build_paths reported not_observed. Split forwarded options out before reading paths and read them with the linker's own path options (-L, -T, --library-path, --script). This also stops -Xlinker -Bsymbolic from being read as the compiler's -B prefix. * fix(audit): read forwarded linker options by their linker meaning The forwarded linker flag pattern read -Ttext=0x400000 as a script path named text=0x400000, and it ignored -I, so -Xlinker -Ilib/ld-custom.so lost the interpreter path the compiler flag pattern found before the split. Exclude the -T section and segment address options (bss, data, text, text-segment, rodata-segment, ldata-segment) and read -I and --dynamic-linker as paths. * fix(audit): split Go flags as Go does and read external linker flags Go splits a flag value with quoted.Split: a field that starts with a quote runs to the matching quote, and any other quote is a literal character. The reader stripped every quote, so CGO_CFLAGS -I"/home/O'Neil/include" reported /home/ONeil/include, while cc was given the directory "/home/O'Neil/include", quotes included. -ldflags kept -extldflags values with the Go linker flags, where only -L counts, so -extldflags=-Lprivate-sdk reported no path. The values are now read as the C compiler driver reads them, including -Wl, and -Xlinker forwarding. A package member named payload.json or payload.js.map that holds an ASAR took the text or map route, which checked only native signatures, so the nested archive was scanned as text and coverage read complete. The route's own read now recognizes the ASAR signature as well, and the nested package leaves coverage unknown. * fix(audit): keep a named script beside a selected HTML file unknown A script element whose target had a JavaScript name such as app.js was dropped on the assumption that it would be examined as a member. When the selection is an HTML file, sibling scripts are never read, so a sibling holding an inline map left javascript.source_map_sources not_observed while the same target named app left it unknown. Record every local script target so an unreached one counts as skipped. * fix(audit): read a retained -pgo setting as one profile path `-pgo file` names a single profile, and under -trimpath Go keeps only its file name, so the flag readers dropped values such as `private-training.pgo` and split paths with spaces or commas. Report the value whole, skipping `auto` and `off`. * fix(audit): read -extldflags paths as the external linker splits them With -ldflags set to -extldflags '-L "/srv/private sdk"', the outer flag reader could not match the path behind the inner quote, and the external reader kept only relative paths, so go.build_paths read not_observed. Read each -extldflags value once, as go tool link splits it with quoted.Split, and collect rooted and relative paths from those same arguments. The rest of the setting is read as before. * fix(audit): read the Go linker's other path options go.build_paths read only -L as a Go linker path option, so a retained -ldflags='-tmpdir=private-obj -s -w' reported no path and --fail_on low missed the directory. Read every option `go tool link -h` documents as taking a directory, path or file: -I, -L, -benchmarkprofile, -capturehostobjs, -cpuprofile, -fipso, -importcfg, -memprofile, -o, -r and -tmpdir. -extld, -extar and -libgcc name a program or `none`, so only their rooted values count. * fix(audit): keep a quoted Go argument whole goFields already reads -L "/tmp/private - sdk" as two arguments, but each field was then split again before every whitespace-led dash, so go.build_paths reported /tmp/private instead of the retained directory. Split again only a field that begins with a flag, after any package selector, as a quoted "-L dir -s -w" does. Any other field is one argument and is kept whole, in -ldflags, -extldflags and CGO flags. * fix(audit): keep coverage unknown for an unread packaged image When a listed package member is a native image but its first read fails, examinePackagedBinary returned before probePackagedImage could mark its possible embedded package unexamined. Coverage stayed complete and javascript.source_map_sources could report not_observed for a payload nobody read. Mark member coverage unknown wherever a native member goes unread, including an encrypted one, as an image the probe could not read already does, and say so in the limitations. * fix(audit): read rooted Go tool path arguments whole `-L "/tmp/private,sdk"` and `-L=/tmp/a=b` name one directory, so a `,` or `=` in a documented path flag's argument is literal. `-trimpath` keeps its prefix=replacement structure. * fix(audit): count an unread packaged member once * fix(audit): keep trimpath rewrites and directory fields apart from selectors * fix(audit): keep a .map unsettled once a declaration was discarded * fix(audit): skip env option arguments when reading a Node shebang * fix(audit): keep companion coverage unresolved for a generic .map link * fix(audit): count a dropped linker-map guess as a skipped companion * fix(audit): read env settings after -- in a Node shebang * fix(audit): route a selected native image named .map by its format A directly selected or listed native image has no package format, so examineMember skipped its native-first branch and sent a file such as release.map through map routing. Its bytes then became a linker-map guess and marked native.debug_companions exposed. Native format now outranks the name for every member, packaged or not. * fix(audit): read forwarded -rpath and -rpath-link as linker paths A cgo build with CGO_LDFLAGS=-Wl,-rpath,private-runtime kept the relative directory, but the forwarded linker parser only knew -L, -T, -I, --library-path, --dynamic-linker and --script, so go.build_paths reported not_observed. Add -rpath and -rpath-link to the same parser, in the attached, = and next-field forms. Loader-expanded values such as $ORIGIN/../lib and @loader_path/Frameworks name no build-host directory and stay unreported. * fix(audit): read each entry of a forwarded linker search list -rpath and -rpath-link take a colon-separated search list. The loader token filter tested the whole list, so -Wl,-rpath,$ORIGIN:/opt/private-runtime dropped /opt/private-runtime along with $ORIGIN, and the rooted-path pass cannot see an entry that follows a colon. Split each search list into its entries and drop only the loader-expanded ones. * fix(audit): expand loader tokens only in a linker search list The runtime loader expands $ORIGIN and @loader_path only in a -rpath or -rpath-link search list. The token filter also ran on the argument of -T, -L and -I, so -Wl,-T,$ORIGIN.ld dropped a literal linker script path and a complete read could report go.build_paths as not observed. Search list entries keep the filter; every other linker path argument is kept as is. * fix(audit): count a .map link beside a selected file as a skipped companion The sibling scan skipped any .map entry that was not a regular file, so a symlink such as symbols.map -> payload beside a selected executable left debug companion coverage at not observed. The reader never follows links, so the linker map such a link may name is unread, not absent. Count a generic .map sibling link as a skipped companion without following it, as noteUnfollowedMapLink already does inside a selected directory. * fix(audit): split a linker search list only for an ELF image Only the ELF linker reads a -rpath or -rpath-link argument as a colon-separated list. The Mach-O linker stores each -rpath argument as one directory, so -Wl,-rpath,@loader_path/lib:extra is a single loader-relative entry, yet it was split and extra was reported as a build path. Carry the native image format into the Go flag reader and split search lists only for ELF; other formats read the whole argument as one entry. * fix(audit): expand only the image loader's runtime tokens A runtime search path token is expanded only by the loader of the image's format. The ELF loader expands $ORIGIN, $LIB and $PLATFORM; dyld expands @executable_path, @loader_path and @rpath. Each is literal text to the other loader, so -Wl,-rpath,$ORIGIN:/opt/private-runtime on a Mach-O image names a literal directory, yet it was dropped and go.build_paths reported not_observed. Pick the token set from the native image format; the PE loader reads no search list, so it expands none. * fix(audit): keep a declared .map link beside a selected script a source map The sibling scan counted any .map symlink as a skipped debug companion before checking whether the selected script declared it as its source map. classifySiblingMap already excludes a declared target that is a regular file, so a declared symbols.map link added a false unknown to debug_companions. Apply the declared-target check before either file-type branch; noteUnreachedTargets still counts the unread map as skipped. * fix(audit): byte-check members whose kind is only an inventory path role Inventory gives a packaged member a role from its name, such as resource for payload.json or source-map for payload.map. The packaged-format guard treated any kind other than "file" as owner-stated, so a nested ASAR an ASAR lists under one of those names skipped signature recognition and cleared coverage. Track whether the package owner stated the kind (Bun sourcemap region, SEA main script) and only skip the byte check then. * fix(audit): read Go's linker -r setting as a runtime search list go tool link -r sets the ELF dynamic linker search path, dir1:dir2:..., which the linker writes to RUNPATH. It was read as one whole path, so a release built with -ldflags='-r=$ORIGIN/../lib' reported the loader-relative entry as a build path and go.build_paths as exposed. Read -r entry by entry with the same image-loader-aware split and token filter a forwarded -rpath uses: ELF splits at ':' and drops $ORIGIN entries; Mach-O keeps the argument as one directory. * fix(audit): keep a selected package executable's native carrier format A directly selected PyInstaller executable named release.map recorded the package format as its member format, even though its ELF or PE carrier was already recognized. examineMember then missed the native-first branch and treated the executable as a linker map, reporting a debug companion. Forward the native carrier format for the selected file, as listed members already do. * fix(audit): keep coverage unknown for an unread unclassified member A packaged member with no format of its own, such as a PyInstaller payload.bin, recorded only a skipped text member when its read failed before the header. Member coverage then stayed complete, though the member could be a native image or carry a nested package. Leave coverage unknown and say which member could not be read, as an unread native member already does. * fix(audit): keep ASAR header admission distinct from max_file_bytes A directory holding an ASAR whose header exceeds the header admission was reported as a file-size refusal with max_file_bytes advice, which cannot fix it. Report the header admission as its own bound instead. * fix(audit): thread the shared ASAR header admission into release exposure createReleaseExposureService built ReleaseExposureReader with no admission, so its inventory and every reopened ASAR reader stayed on the 16 MiB default and ignored REA_ASAR_MAX_HEADER_BYTES and asar.max_header_bytes. Resolve the admission in the composition with runtimeAsarHeaderAdmission, as the Electron and V8 observation providers do, and pass it to both inventoryArtifactInScope calls, the reopened container readers, and the nested ASAR signature probe. The refusal now names the setting that can raise it instead of claiming there is no runtime override. * fix(audit): keep a nested ASAR probe stopped at the admission undecided The release exposure reader treated an ASAR signature probe that stopped at the header admission as "not an ASAR". A packaged member such as payload.json holding an ASAR whose JSON starts past asar.max_header_bytes was then read as plain text, its inner maps went unread, and javascript.source_map_sources could stay not_observed. A probe that reaches the admission limit, or runs out of a prefix read after its extents parse, now marks package coverage unknown and records a limitation, while the member is still examined as text. * fix(cli): parse audit-release-exposure --max-file-bytes as a decimal token Main now requires every numeric CLI option to admit decimal tokens and reject 0x10 and 1e3 (tests/boundary/cli/cliDecimalArguments.test.ts). Wrap the release exposure maxFileBytes option in cliDecimalField like the other maxFileBytes options, so the domain field keeps its bounds and default. * docs(specs): add the release exposure audit specification Add spec.md, plan.md and tasks.md under docs/specs/artifacts/release-exposure/ as docs/development/documentation.md requires for a new feature, and list them in docs/specs/README.md. The existing guide at docs/release-exposure.md keeps describing current behavior and its route is unchanged. * fix(audit): bind unpacked ASAR member reads to their inventoried digests A selected ASAR is captured and checked against its inventoried digest, which binds packed members. An unpacked member is read from its .unpacked companion on disk instead, and readContainerMember and readEntryBytes never compared those bytes with the member digest inventory recorded, so a companion replaced between inventory and the scan was accepted. readContainerMember now passes the member's inventoried digest for unpacked entries, and readStreamBounded hashes the full stream, draining past the read allowance when needed, and fails with "ASAR member changed before interpretation", which surfaces as an artifact_changed error like the container check. A regression test replaces a companion after inventory. The guide, spec, plan and tasks describe the binding. * fix(audit): let stated JavaScript roles outrank a .map name isDeclaredMap() routed any member whose name ended in .map to map handling before the owner's stated role or a page's script declaration was considered. A Node SEA main script at boot.map, which the SEA reader marks as javascript, and a .map script an HTML file loads both became linker-map guesses, so their inline maps were never read and native.debug_companions was reported exposed. An owner-stated source-map role or a declared map target still makes a member a map. Otherwise a stated javascript kind or a script target now wins, and only then does the .map suffix, or the inventory path role that repeats it, decide. Regression tests cover both cases, and the guide notes that a SEA main script is read as a script whatever it is called. * fix(audit): keep coverage unknown when a packaged text member fails to read A compressed member named as text, such as payload.json in an unexpanded PyInstaller host, can fail inflation before any header is returned. The .bin case already leaves member coverage unknown because an unread header may hide a nested image or package, but examineTextMember() only counted the member as skipped text, so otherwise complete coverage stayed complete and package-dependent checks could settle. An unread packaged member whose kind its package did not state now goes through noteUnreadBinary(), which counts it as skipped text, marks coverage unknown, and records the limitation. A regression test corrupts the zlib stream of payload.json in a CArchive host and checks the intact member keeps coverage complete. The guide describes the rule. * fix(audit): keep the unpacked ASAR digest check inside the read allowance ea87cf8 made readStreamBounded hash an unpacked ASAR companion to its end so it could compare against the inventoried digest, which drained the stream past the read allowance. A 1 GiB unpacked module was read in full for a 4 KiB header probe and again for a package probe, and a companion that grew after inventory had no byte limit on that path. readStreamBounded now stops at the allowance as every other member read does, and compares the digest only when the member ended within the allowance. A companion past the allowance stays over_allowance without a digest verification. A test counts the bytes each scan read pulls from an 8 MiB companion. The guide and spec state the bound. * fix(audit): read a script target whose bytes are a source map as a map 1d3f89f let a stated javascript kind or an HTML script target outrank a .map name, so an HTML `<script src="main.map">` that points at a valid source map with sourcesContent was read only as a script. Its sources were never counted and javascript.source_map_sources could miss an exposed finding. A script role says how a member is loaded, not what its bytes hold. A .map member or loaded script whose text parses as a source map, a JSON object with version and mappings, sources, or sections, is now read as a source map. Anything else is still read as a script, so a SEA main script named boot.map and a .map script carrying an inline map keep reaching examineInlineMaps. A regression test covers the map case, and the guide states the rule. * fix(audit): retract a linker-map guess when a page loads the map as a script noteScriptTarget() returned early for a target already read, counting its source-map coverage as skipped but leaving any linker-map guess the first read recorded. When a directory or ASAR listed a non-JSON app.map before the index.html that loads it with <script src="app.map">, app.map stayed in native.debug_companions and the result depended on enumeration order. noteMapTarget() already retracted such a guess for a late map declaration. A late script declaration now retracts the guess too, and still counts the script as skipped because it was never examined as JavaScript. A test covers the directory and ASAR order, and the guide states the outcome. * fix(audit): respect script and native identity for sibling linker maps classifySiblingMap() guessed a linker map for any sibling .map whose bytes could not begin a JSON object. A sibling boot.map that a selected index.html loads with <script src="boot.map">, or an ELF image named release.map beside a selected executable, was therefore reported in native.debug_companions. scanSiblings() now skips a sibling that is a script target as well as a map target, leaving noteUnreachedTargets() to count it, and classifySiblingMap() records no guess when sniffNativeFormat() recognizes the header. Tests cover both cases and the guide states the outcome. * fix(audit): read a script-loaded map from the text that recognized it scriptHoldsMap() recognizes a .map or script target as a source map from decodeMemberText(), which honors a UTF-16 byte order mark, but readScriptAsMap() then passed the raw bytes to readSourceMap(), which reads UTF-8. A BOM-marked UTF-16 main.map loaded by <script src="main.map"> failed the second parse and its prefix became a linker-map guess. readScriptAsMap() now hands the decoded text to readSourceMapText(), which readSourceMap() also uses for byte input, so both stages read the same text. A test covers a UTF-16 map with embedded sources. * fix(release-exposure): honor byte order marks in binary plist data A binary plist data object holding BOM-marked UTF-16 text was decoded as UTF-8, so credential markers in it went unmatched while coverage still read complete. Decode such payloads with the encoding their mark declares, and leave coverage incomplete for UTF-32, which no reader scans. * fix(audit): keep an unprobed package member past the text allowance unknown Once the cumulative text allowance was spent, examineTextMember() counted a packaged member named like text, such as payload.json in a .NET or PyInstaller bundle, as skipped text without reading its header. Coverage stayed complete even though the member could be a native image or a nested ASAR, while the same bytes named payload.bin kept coverage unknown. An unexpanded package member whose kind the owner did not state now leaves coverage unknown with a limitation when the allowance skips it, the same uncertainty an unread .bin member carries. No extra read is made, so the allowance still bounds what is opened. A test covers an ASAR with an embedded source map named payload.json after sixteen full text members. * fix(release-exposure): require a read host for every Electron layout A directory with several resources/app.asar layouts counted one named host as fuse coverage for all of them. Track host coverage per layout so safe fuses stay unknown when a whole layout's possible hosts were dropped from the native image sample. * fix(release-exposure): keep a .map script past the target allowance unassessed When HTML script references spent the resolved-path allowance, a later .map script target was dropped without its script role, so its JavaScript bytes settled as a linker-map guess and debug_companions reported an exposure. A refused script target now sets mapTargetsDiscarded, the same flag a refused map target sets, so a later .map stays unassessed instead of becoming companion evidence. * fix(release-exposure): read a Node shebang as script in any text member A selected or listed text file such as runner.txt that starts with a Node shebang went straight to the text reader, which never gave it a JavaScript role, so its inline map went unread and source_map_sources read not_observed. The text reader now takes the role from the bytes it read, so every route into it sees the shebang, and the probed-text path no longer sets the role itself. * fix(release-exposure): exclude Go search lists by position, not by value compilerPaths dropped every literal path whose text equalled a forwarded -rpath or -rpath-link list, so CGO_LDFLAGS=-Wl,-L,$ORIGIN -Wl,-rpath,$ORIGIN lost the literal -L directory and go.build_paths read not_observed. The literal flags are now read with each search list option and its argument removed by position, and the search lists are still read entry by entry. * fix(release-exposure): keep a probed Node launcher's role past the allowance The probe recognized a Node shebang but handed the text reader the member without its JavaScript role. Once earlier text spent the shared allowance, the text reader returned before reading the header again, so an extensionless launcher added no skipped map and both source-map checks read not_observed instead of unknown. The probe now passes the role it found. * fix(release-exposure): decode a map in the encoding its byte order mark names The map reader, its prefix check and the sibling classifier decoded map bytes as UTF-8, so a generic symbols.map holding BOM-marked UTF-16 source map JSON failed to parse and its prefix read as a linker map: a spurious debug companion and source_map_sources not_observed. Map bytes are now decoded by their byte order mark at that boundary, and a UTF-32 map, which this reader does not decode, stays unresolved. * fix(release-exposure): keep a lone dash inside a quoted Go path argument splitGoField split a quoted field before every whitespace-led dash, so the retained -ldflags '-s "-L=/tmp/private - sdk" -w' read the dash inside the directory as a new flag and goPaths reported /tmp/private. A quoted field now splits only before a dash that begins a flag, so a dash followed by a space stays part of the path. * fix(release-exposure): choose possible Electron hosts within each layout The named-or-possible host choice ran across every kept image, so a named a/a.exe removed the unnamed b/launcher.exe of a second ASAR layout from electron_host_paths, and its unresolved fuses no longer held electron.run_as_node at unknown. Each layout now chooses its own named or possible hosts, and the sets are combined. * fix(release-exposure): read a relative compiler --sysroot as a build path The compiler path flag list had no --sysroot, and the rooted-path fallback cannot see a relative operand, so CGO_LDFLAGS=--sysroot=private-sdk left go.build_paths at not_observed. --sysroot is now a compiler path flag, attached with = or given as the next field. * fix(release-exposure): recognize Windows Electron layouts by the owner's path The desktop owner gives each file a native local_path, such as C:\ship\App\resources\app.asar on Windows, and desktopPathConventions only splits on /, so every ASAR basis was skipped: host ranking and electron_host_paths stayed empty and a named host with no sentinel let a safe helper read electron.run_as_node as not_observed. Each basis now carries whether the owner's slash-separated path is an ASAR layout, and the layout folders read a Windows absolute path with Windows separators on any host. * fix(release-exposure): read a Bun module by its JavaScript loader An extensionless Bun contents member such as $bunfs/root/release carries loader_name js, but ownerStatedKind kept only the sourcemap region, so the member was never read as a script and its inline map went unseen. Give a Bun contents region the javascript role for the js, jsx, ts and tsx loaders, as SEA main scripts get it. * fix(release-exposure): read a Node shebang .map as a script An undeclared `.map` was routed as a source or linker map before its first bytes were checked, so a Node script named `runner.map` recorded a linker-map companion and never had its inline map read. When the map read of an undeclared `.map` starts with a Node shebang, its map slot is returned and the text reader examines it as JavaScript, so its inline map is parsed and no companion is reported. * Detect full-length GitHub refresh tokens Narrow github.token to gh[opus]_ with 36 characters and give ghr_ its own 76-character github.refresh_token rule, with a test. * fix(release-exposure): bind a negative package probe to the inventoried image An on-disk native image whose embedded-package probe finds nothing clears member coverage, so it now hashes the probed descriptor and compares it with the inventoried digest before accepting absent. A replacement after inventory fails as a changed member instead of reporting complete coverage. * fix(release-exposure): let an app bundle read settle only its own layout An app target, an app-bundle fuse read or a sampled selected executable used to mark the Electron executable as included for every ASAR layout, so safe outer fuses reported not_observed even when a nested Electron app's host was never read. Those reads now settle only their own layout; every other discovered layout still needs its own host read, so an omitted nested host keeps fuse checks unknown. * fix(release-exposure): honor a Node shebang before guessing a sibling linker map A sibling .map beside the selected file that starts with a Node shebang is a script, as it already is for a member .map, so classifySiblingMap no longer records it as a linker-map debug companion. * fix(release-exposure): name a bundle's own layout by the owner's path The settled layout set joined the caller's bundle spelling with Contents, so a selected /tmp/App.app missed the owner's resolved /private/tmp/App.app/Contents layout and safe fuse checks fell to unknown. Each archive basis now carries the owner's relative layout folder, and the bundle's own layout is the one whose relative folder is Contents, looked up by the owner's resolved folder. * fix(release-exposure): read file-valued linker options as build paths LINKER_PATH_FLAG listed --script but not the other linker options that read a file, so -extldflags=-Wl,--version-script=private-versions.map left go.build_paths not_observed. --version-script, --dynamic-list and --retain-symbols-file now read their operand as a path, attached or in the next field. * fix(release-exposure): count a macOS bundle's framework and MacOS hosts in its layout A .app layout resolves to its Contents folder, but its hosts are Contents/MacOS/* and the Electron framework binary under Contents/Frameworks, so per-layout host ranking and fuse coverage dropped them and one bundle's safe fuses could settle another bundle. Those images now belong to the bundle's layout, with the framework binary ranked as its host. * fix(release-exposure): keep a bundle's launcher out of its fuse hosts A macOS bundle's Electron Framework binary carries its fuses. When it is among a layout's named hosts, it is now the layout's only fuse host; the MacOS launcher beside it is still sampled but no longer leaves safe fuse checks undecided when it has no sentinel. * fix(release-exposure): keep an undecided PE package member out of linker maps An unexpanded package member named .map whose PE signature lies past the retained prefix fell through to noteUnreadMap, which read its MZ prefix as a linker map and reported native.debug_companions exposed with complete coverage. The map route now records the same undecided-PE uncertainty the binary route does, so the member stays unexamined and coverage unknown. * fix(release-exposure): scan the text of an undecided PE map member A packaged .map member whose MZ header is undecided returned before its fully read bytes reached the credential scanner, so a PEM key in it read as unknown instead of exposed. Scan bytes read in full before returning, while still keeping PE coverage undecided. * fix(release-exposure): keep an oversized text member's undecided PE header A packaged text member past the per-member allowance keeps only its prefix, so an MZ header whose PE signature lies further in returned null and the text route dropped the native and package uncertainty. Note the undecided header as the map and binary routes do. * fix(release-exposure): join Electron layouts by caller path and keep partial discovery unknown The desktop owner resolves its root, so a target selected through a symlinked parent got canonical local_paths that never matched the audit's caller-spelled images, and the named host dropped out of electron_host_paths. Rebase owner paths under the canonical root onto the selected path. When discovery stopped after it found one Electron layout, the basis list was treated as exhaustive. Report the layouts as incomplete so safe fuses on the listed host stay unknown. * fix(release-exposure): keep Electron hosts under a trailing-slash selection Join the rebased archive path with appendCallerPath so a selected `/work/app/` yields `/work/app/resources/app.asar`, whose layout folder matches the inventoried executables' parent. * fix(release-exposure): keep maps unassessed for unread text past the allowance A text-named member such as `runner.txt` can start with a Node shebang. Once the text allowance is spent its header is not read either, so count every unread member that could hold a script as a skipped map instead of trusting the filename-derived role. * fix(release-exposure): keep an unread packaged map member undecided When a packaged map member yields no header (a failed read or no map slot), its name is no evidence of its format. Route it through noteUnreadBinary, as the text route does, so a member that may be a native image or package keeps coverage unknown. * fix(release-exposure): keep an undecided sibling PE header out of linker-map guesses A sibling .map past the map allowance keeps only its probe, so an MZ header whose PE signature lies further in is undecided. Share the undecided-PE test with packaged members and count such a sibling as a skipped companion instead of guessing a linker map. * fix(release-exposure): keep possible fuse hosts when no ASAR layout names one Without an ASAR basis no image is ranked, so no image counted as a fuse host and one image's safe fuses could settle a sentinel-less sibling. While the desktop family is undecided and no layout names a host, treat every sampled image as a possible host. * fix(release-exposure): keep images outside a found ASAR layout as possible fuse hosts An asar: false build beside a discovered ASAR layout gets no basis, so its executables were never fuse hosts and the layout's safe fuses could settle a sentinel-less image in the other build. When no name picks out a host outside the found layouts, treat every sampled image there as a possible host, as the no-layout case already does while the family is undecided. * fix(release-exposure): keep a dropped host outside a found ASAR layout unread An asar: false build beside a found ASAR layout names no host, so an executable outside every layout that the native-image sample dropped may be that build's unread fuse host. Coverage no longer counts as proven when such an image was inventoried but not sampled. * fix(release-exposure): read Go build-path response files named in compiler and linker flags A CGO setting such as `-Wl,@/tmp/private-link.rsp` or `-Xlinker @/tmp/private-link.rsp` names a response file the linker reads options from, and a bare `@FILE` is read by the compiler driver. Report the file's path, relative or rooted like other path arguments, without opening it. An option's own value, such as `-install_name @rpath/libx.dylib`, and dyld runtime tokens are not response files. * fix(release-exposure): keep a dropped host outside an ASAR layout unread whatever its name The guard for a sampled-out host beside a found ASAR layout ruled images out by filename, so an asar: false host named like `b/My.App` was missed and safe fuses from the sampled layout settled the installation. Every inventoried native image outside the found layouts that the sample dropped now keeps the fuse checks unknown. * fix(release-exposure): keep maps unassessed for an unreadable extensionless launcher An unclassified file whose initial header probe fails, such as an extensionless `runner` that became unreadable after inventory, may carry a Node shebang and a map directive. The probe failure now leaves its maps unassessed, as an unread `runner.js` or packaged member does, instead of counting the file as holding no script. * fix(release-exposure): read a response file named like a dyld token `-Wl,@rpath/private-link.rsp` names a linker response file, not a dyld runtime path, so dropping every `@rpath` or `@loader_path` argument hid it. A dyld token is now skipped only as the value of an option that takes one, such as `-install_name` or `-dylib_file`. * fix(release-exposure): keep the partial member scan on ordinary cancellation A scan cancelled after some members were examined reported its partial scan only when cleanup also failed, so a clean cancellation dropped the recovered source-map and credential observations. A cancelled scan now hands its assembled facts to the interrupted-scan visitor with unknown coverage and a cancellation limitation, and the caller still receives the cancellation error carrying that partial audit. * docs(release-exposure): describe the partial report kept when the member scan is cancelled Since the member scan keeps what it examined on ordinary cancellation, the status guide no longer says that cancelling the scan returns no partial report. It now describes the partial observation and limits the no-report case to cancellation before the scan can be assembled. * fix(release-exposure): keep maps unassessed when a text header is cut short A text-named member read with one or two bytes of the text allowance left returns only `#` or `#!`, which cannot establish a Node shebang, so `runner.txt` kept its non-script role and its unexamined inline map was treated as absent. A partial or missing header that could still start a shebang line now leaves the member's maps unassessed, as an unread member's do once the allowance is spent. * fix(release-exposure): keep dotted executables as possible hosts in ASAR layouts Inside an ASAR layout, a sibling whose name had a dot and no `.exe` suffix, such as `my.app`, was neither ranked for the native sample nor counted as a possible Electron host. With shared libraries filling the sample, that image could be dropped while the layout still counted its host as read, so safe fuses on a helper reported `run_as_node` as not observed. A dotted sibling that is not named like a shared library is now sampled after plain siblings and counted as a possible host. * fix(release-exposure): split env -S shebangs on unquoted blanks only The env shebang reader split the whole line on spaces before handling -S, so a launcher such as `#!/usr/bin/env -S NODE_OPTIONS='--conditions development' node` named `development'` as its program and its maps were never assessed. An -S operand now takes the rest of the line and is split the way GNU env -S splits it: single and double quotes, backslash escapes, \_ and \c, and a leading # comment. A string env itself rejects, such as an unterminated quote, runs no program. * fix(release-exposure): keep owner facts completed before cancellation When a Go, Rust, fuse or desktop owner finished its Evidence and then saw cancellation, completeProviderEvidence returned that Evidence as the error's partial observation, but the audit only kept the error and substituted a not-run fact, so a recovered Go build path or Rust package list reported unknown. Each owner's Evidence-to-fact reading now lives in one function used for both a successful read and a completed partial, so the partial passes the same schema and inventory digest checks before its fact is kept. Later owners still do not run. * fix(release-exposure): keep env -S programs named by a variable unassessed `env -S` expands `${NAME}` from the environment, so a launcher such as `#!/usr/bin/env -S ${NODE_BIN}` may run Node, but the shebang reader kept the placeholder as the program name and treated the file as plain text, reporting its inline map as absent. The env splitter now marks fields that expand a variable, and a program whose name holds one leaves the shebang undecided: the member's maps count as unassessed, and a `.map` companion with such a header is not taken as a linker map. Quoted or escaped `${` stays literal, and a resolved basename such as `${DIR}/bin/deno` still decides. * fix(release-exposure): keep the ASAR header admission for selected files A directly selected app.asar whose header exceeds asar.max_header_bytes now returns the typed header admission refusal and its recovery, as the directory scan already does, instead of a generic partial report. * fix(release-exposure): keep a map member with a variable env -S program unassessed An undeclared `runner.map` whose `env -S` program is `${NODE_BIN}` may run Node, so `examineMapMember` now treats an undecided `nodeShebang` result as an unassessed map and companion, as `classifySiblingMap` already does, rather than falling through to a linker-map guess. * fix(release-exposure): read a forwarded -Map linker map path splitForwardedLinkerFlags hands -Wl,-Map=private-link.map to the linker side, but LINKER_PATH_FLAG had no Map entry, so the relative map path was dropped and go.build_paths read not_observed. Add Map to the file-valued linker options so -Map=FILE and -Map FILE are both reported. * fix(release-exposure): count unread text in undecided map branches An oversized .map whose shebang names its program with an unresolved variable, or a package member with an undecided PE header, returned before counting its unscanned text, so credential markers could read not_observed. Count any non-bytes read as skipped text in both branches. * fix(audit): bound map reads and preserve linker paths * fix(audit): retain unread package uncertainty * fix(audit): retain ambiguous linker operands * fix(audit): preserve compiler path separators * fix(audit): retain distinct linker map occurrences * fix(audit): apply map declarations to their exact source path A declaration recorded only its NFC lookup key, so every member or sibling sharing that key took the declared JavaScript-map route. On a normalization-sensitive filesystem an unrelated linker map spelled in another form lost its companion evidence when the declaring script was scanned first. Record the resolved spellings each declaration writes and treat only an exact match as declared. Another spelling in the bucket is read as an undeclared map; when no declared spelling is reached, its linker-map guess stays unresolved coverage rather than companion evidence. * fix(audit): keep partial inventory from settling fuse-host coverage When a directory read found ASAR layouts but the inventory stopped early, a separate asar: false build outside those layouts may never have been listed. Only sampled-then-dropped images counted as a possible missed host, so reading every found layout's host reported safe fuses as not_observed for the whole selection. In limitNativeSample, treat an incomplete inventory as a possible missed host outside the found layouts unless the read root is itself a found layout, where host identity already settles coverage. * fix(audit): apply script targets to their exact source path A page's script element was recorded only by its NFC lookup key, so on a normalization-sensitive filesystem a distinct file spelled in another normalization form inherited the JavaScript role. An unrelated linker map such as café.map beside a loaded café.map was never classified and debug companion coverage could settle as not observed. Keep the resolved spellings each page wrote under the lookup key, as map declarations already do, and give the script role only to a member or sibling whose exact path a page loaded. * fix(audit): keep partial inventory uncertain beside a root ASAR layout When the read root was itself a found ASAR layout, an incomplete inventory was trusted to have listed every possible fuse host. A second asar: false build under a subdirectory names no layout and sits outside the root layout, so an inventory that stopped after the root host could miss its launcher and still report the root's safe fuses as not_observed. The same launcher, once listed, already kept the result unknown. Drop the root-layout exemption in limitNativeSample so any incomplete inventory beside a found layout keeps fuse-host coverage unknown. A complete inventory that lists only the named host still settles. * fix(audit): read the linker's --just-symbols file operand A Go build that forwarded -Wl,--just-symbols=private.syms through -extldflags or CGO_LDFLAGS kept the relative symbol file in its build settings, but the forwarded linker matcher knew only the short -R spelling. Complete metadata then reported go.build_paths as not_observed while the equivalent -R build was exposed. Add --just-symbols to the linker options that read a file. Only -R turns into -rpath when given a directory, so the $ORIGIN ambiguity check stays on the short spelling. * fix(audit): anchor expanded package members to the selected path An inventory-expanded package member reports its location relative to the selected path, such as app.asar/boot.map, but its lookup identity resolved that location against the process working directory. An on-disk page loading app.asar/boot.map, or an absolute file: map declaration into the archive, resolved under the selected root, so the declaration never matched the member it named. A script target with an inline map then settled as a linker map, and a declared map stayed skipped. Resolve every member lookup and declaration base against the selected path, and keep the reported location as written. Linker-map retraction compares the same anchored spelling. * fix(audit): read GCC's -I- include barrier as an option CGO_CFLAGS=-I- is GCC's include barrier, the same as --include-barrier, not -I with the directory "-". The compiler path matcher read it as a build path, so a Go binary retaining it reported go.build_paths exposed. Skip that exact field before path matching. * fix(audit): keep packaged-image uncertainty after reading the host A native image stored inside a package is never opened by a fuse reader, so reading the Electron host on disk does not settle its fuses. Count the packaged omission toward a partial fuse sample on its own, so safe host implications stay unknown instead of not_observed while a packaged image is unread. * fix(audit): require every named host in a layout to be sampled An ASAR layout can name more than one host, such as `a/a.exe` beside `a/electron.exe`. The sample counted the layout as read when any one named host was kept, so dropping the other still reported the Electron executable as included and let safe fuses from the sampled images settle run_as_node as not_observed. Count a layout as read only when every host it could have was sampled, reusing the named-host selection the fuse reducer already applies. * fix(audit): keep a layout-less bundle read from settling partial inventory A bundle with no ASAR layout, such as an asar: false build, counted its framework read as covering the Electron host even when inventory stopped early or the sample dropped an image. A nested build's host could sit in the part never listed, so the root framework settled RunAsNode as not_observed. Apply the same incomplete-inventory guard the layout branch uses to the bundle read. * fix(audit): read the linker's --sysroot directory operand A Go ELF build that forwarded -Wl,--sysroot=private-sdk through -extldflags or CGO_LDFLAGS kept the relative sysroot in its build settings, but the forwarded linker matcher did not know the option. Complete metadata then reported go.build_paths as not_observed, while the compiler-owned --sysroot was already recognized. Add --sysroot to the linker options that take a path, so the -Wl comma form, the -Wl = form and both -Xlinker forms are read. * test(audit): group Deno boundary regressions * fix(audit): preserve Go linker file operands * fix(audit): track script completion per source occurrence * refactor(audit): give Go path parsing one semantic owner * refactor(audit): preserve map roles at the parsing boundary * refactor(audit): consume toolchain operands once --------- Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>	2026-11-11 09:57:55 -05:00
morluto	8a2eb4ab61	fix(source-maps): preserve decoder lifecycle facts (#10069) ... * fix(source-maps): preserve decoder lifecycle facts * fix(source-maps): preserve preparation failure on cancellation * fix(source-maps): retain preparation and retry cleanup facts	2026-11-11 18:36:02 +08:00
morluto	3c4be703cd	test: consolidate JavaScript and provider fixture coverage	2026-11-10 16:32:53 -05:00
morluto	cb4e5cfbff	feat(analysis): make resource budgets recoverable across CLI and MCP (#9706) ... * refactor(analysis): centralize resource budgets and recovery facts * feat(analysis): expose ASAR and Ghidra runtime admission controls * feat(artifacts): expose reader admission and preserve limited recognition * feat(javascript): expose recoverable semantic precision budgets * feat(web): add recoverable source-map budgets and compact retained views * feat(web): make historical capture decoding budgets recoverable * fix(desktop): enforce selected view policies across capture and export * feat(runtime): make Frida and LLDB retention budgets selectable * feat(native): expose diagnostic budgets and preserve exhaustion causes * feat(managed): expose recoverable snapshot and representation budgets * feat(metadata): make Go and Rust inspection budgets recoverable * feat(wasm): expose representation and producer admissions * feat(evm): expose per-call worker resource budgets * feat(android): make resource and string-pool omissions recoverable * feat(producers): expose command and recorded-capture budgets * docs(analysis): record recovery contracts and integrated validation * fix(docs): link calibration oracle from published verification pages * fix(docs): restore desktop task anchors and receipt links * test(analysis): align fixtures with selectable budget contracts * fix(analysis): remove source-location projector dependency cycle * test(analysis): refresh budget recovery and verifier regressions * test(analysis): preserve format and publication recovery expectations * test(windows): align conformance with owned runtime admission * fix(desktop): preserve selected alias kinds in exported state * test(analysis): align provider fixtures with recoverable budgets * test(desktop): validate emitted alias metadata structurally * fix(ghidra): classify bounded Windows endpoint refusals * test(cli): assert selectable artifact admission recovery * fix(cli): preserve capture provenance in environment builds	2026-11-10 05:11:20 -05:00
Rishikesh Gowda K K	891371e738	fix(objdump): reflect observed launch failure in discovery availability (#9051) ... * fix(objdump): reflect observed launch failure in discovery availability Distinguish a statically registered standalone command from an executable whose launch has failed in the active server session. Discovery leaves unprobed commands optimistically available, reports an observed launch failure as provider_unavailable with the command remediation, keeps the tool callable for retries, and clears the failure after a subsequent successful launch. Fixes #8826. * test(reverse): verify overlapping command launch dispatch ordering * test(reverse): unblock gated test workers before awaiting service closure * test(reverse): bound lifecycle acknowledgement and join launched workers * fix(reverse): distinguish host capacity exhaustion from command launch failures * fix(reverse): preserve host capacity across Linux process ownership preparation * fix(reverse): exclude process ownership admission failures from command launch state * fix(reverse): preserve Darwin process ownership preparation error across command launch * fix(reverse): disambiguate cleanup declaration in provider observation * fix(reverse): preserve command deadline timeout during Darwin ownership preparation * fix(reverse): isolate Darwin baseline ps errors and provide platform-aware admission guidance * fix(reverse): rely on typed baseline admission failures and use owning repair formatter in tests * test(reverse): use owning formatters for process ownership remediation assertions * fix(reverse): restrict Linux ownership prerequisite remediation to missing ps and preserve system error codes * fix(reverse): retain typed process ownership prerequisite with preserved error codes * fix(reverse): remove unvalidated error label fallbacks and keep admission tags out of system_code * fix(reverse): keep Windows native runner failures out of command-launch state * fix(process): preserve current_process_unreported refusal in Linux provider readiness * fix(process): distinguish no-code ps failure from missing ps and cover rizin launch failure * fix(windows): classify process_spawn host-control rejections as RuntimeControlUnavailableError	2026-11-09 17:39:34 +08:00
morluto	352a846127	test: reduce brittle assertions and test-only runtime paths (#9289) ... * test: focus assertions on behavioral evidence Prune redundant and wording-coupled checks while retaining diagnostic, parser, recovery, and cleanup coverage. * refactor: remove test-only wrappers and duplicate checks Exercise production operations through test fixtures, remove unused adapters, and keep managed-member uncertainty guidance under its existing owner. * test: focus process validation on diagnostic facts * refactor: remove test-only runtime helpers Move semantic evidence fixture setup out of runtime and remove unused Windows settle recovery helpers while checking configured defaults independently. * test: focus artifact diagnostics on format facts * test: verify retained cleanup guidance delivery	2026-11-08 02:02:31 +08:00
morluto	110932cd5e	test: clarify source map and worker diagnostics	2026-11-08 00:08:18 +08:00
morluto	721dd3d1aa	fix(javascript): preserve selected inputs and completed source evidence	2026-10-26 17:39:29 +08:00
morluto	be698d4761	test: verify assertion contracts and the production evaluation gate	2026-10-25 08:27:16 +08:00
morluto	760d9f6019	fix(source-maps): retain primary failures through cleanup retries	2026-10-25 08:25:17 +08:00
morluto	d56a25e64f	fix(sourcemaps): bind cleanup status to remaining codec owners	2026-10-24 03:10:43 +08:00
morluto	ee0ad17a1a	test(sourcemaps): verify shared nested map admission	2026-10-24 02:35:36 +08:00
morluto	ccba355fa9	fix(javascript): preserve map boundaries and loader provenance ... Share embedded-map version admission and derive indexed overlap from represented mappings. Carry createRequire filename bases through worker facts and graph identity. Select factory export bindings at each bundler owner. Validated accepted and malformed source maps through real CLI and stdio MCP codec workflows; verified loader and esbuild graph output against Node runtime controls. Rebased consumer checks passed. Fixes #6803 Fixes #6614 Fixes #6798 Fixes #6797	2026-10-24 01:00:14 +08:00
morluto	9066444f6b	fix(source-maps): reuse admitted source URL identities	2026-10-24 00:01:19 +08:00
morluto	5f702dd6cc	fix(parsers): preserve format boundaries and query occurrence identity ... Normalize parsed facts at their owning boundaries across PE exports and certificates, ELF section names, GPU bundles, IL2CPP generic types, dyld slice selection, source maps, environment replay, and JavaScript mapped arguments. Preserve partial facts and explicit unsupported cases; clarify the corresponding documentation. Validation: 831 affected tests passed with one existing skip across 23 files; build, typecheck/lint, documentation, formatting, and 2133-file test discovery passed. Format controls are synthetic; real Unity, GPU, and ARM-device execution is unverified. Fixes #6709 Fixes #6688 Fixes #6719 Fixes #6718 Fixes #6704 Fixes #6703 Fixes #6692 Fixes #6723 Fixes #6687 Fixes #6726 Fixes #6696 Fixes #6691 Fixes #6727	2026-10-23 22:01:16 +08:00
morluto	ba7c3dafab	fix(browser): reject overlapping indexed source maps ... Fixes #6562	2026-10-23 18:07:46 +08:00
Ammar JamilandClaude Opus 5.5	0d5c7b6d79	fix(windows): report missing native launch controls as unavailable capabilities (#6277) ... * fix(windows): report missing native launch controls as unavailable capabilities An admitted Windows native artifact may predate the optional protocol stdin or Job Object memory limit controls. WindowsOwnedProcess correctly refused such launches, but threw a plain Error, so providers projected the refusal as execution_failure with generic `rea doctor` advice and left the package remedy in nested diagnostics. Introduce RuntimeControlUnavailableError as the shared owner of expected host-control refusals. PrivateRuntimeRootUnavailableError and the new WindowsNativeControlUnavailableError (which records the missing control) extend it, and the six provider adapters that hand-built the same AnalysisCapabilityUnavailableError now project any subtype through one helper. The refusal still precedes every native launch. Fixes #6050 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor(errors): drop capability imports superseded by the shared helper Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-23 01:41:25 +08:00
郭立 Guo Li	7590b50801	perf(schema): reduce retained integer validator allocations (#4360) ... Construct integer formats directly while preserving bounds, refinements, metadata and current shared schema owners. Keep Incur-dependent CLI numeric coercion declarations unchanged. Verify canonical advertisements, 126 numeric boundary cases, 974 actual CLI parser cases, broad source tests and real public-artifact SDK workflows. Record 72 normal tasks and 12 separate owned-inspector heap diagnostics with whole-family resource bounds; distinguish SDK spans and asymmetric audit overhead. Generate numerical report sections from receipts and reject stale tables through documentation conformance checks. Closes #6236. Current-head CI and Greptile pass; actionable review findings are addressed. Codex review was unavailable due repository usage limits.	2026-10-22 05:11:08 +00:00
3 people	0155b89953	fix(browser): name web-bundle budgets and recover web deadlines (#6036) ... * fix(browser): name web-bundle budgets and recover web deadlines Name the existing heap, per-script, and total web-bundle phases, and reject a per-script deadline above the total. Promote capture, CDP command, source-map decode, and source-map fetch deadlines at today's defaults. Name DevTools timeoutMs, and state that discovery, cleanup grace, byte budgets, and Electron hook retention have no runtime override. Refs #5910 Co-authored-by: morluto <morluto@users.noreply.github.com> * fix(browser): apply selected web deadlines to the owning phase Keep HTTP and browser-socket discovery on the fixed discovery deadline so a short command_timeout_ms starts at the handshake. Apply scenario command_timeout_ms to launch startup and the primary connect session, and keep service-worker restoration on the fixed 5000 ms grace. Omit command_timeout_ms from recovery text when the operation does not accept it. Co-authored-by: morluto <morluto@users.noreply.github.com> * fix(browser): retain scenario commands that finish after their deadline A timed-out scenario command stays owned so cleanup can close a late browser or context and restore a mutation that lands after the deadline. Child storage replies use that deadline, scenario recovery names command_timeout_ms in the capture JSON, and the session test connection implements beginCleanupGrace. Co-authored-by: morluto <morluto@users.noreply.github.com> * fix(browser): keep child command timeouts as the public failure A nested command such as Page.enable that is delivered but never answered was stored as protocol_error, hiding the command name, selected deadline, and recovery. Store the typed timeout and assert that public error. Co-authored-by: morluto <morluto@users.noreply.github.com> * fix(browser): keep runtime cleanup on the fixed grace Switch runtime restoration to the cleanup grace before the first send so a short command_timeout_ms cannot fail an otherwise successful observation. Stop advertising command_timeout_ms on list_browser_targets, which never bounds a post-discovery command. Co-authored-by: morluto <morluto@users.noreply.github.com> * test(browser): prove a short command deadline cannot fail runtime cleanup Drive restoration through the runtime fixture. A cleanup command that outlives command_timeout_ms still succeeds, and a stalled restoration names the fixed 5000 ms grace. Co-authored-by: morluto <morluto@users.noreply.github.com> * fix(browser): name the effective source-map decode deadline codecBudgetLimitation reported a fixed 20-second deadline after a caller selected decode_timeout_ms. Result and Evidence limitations now name that effective millisecond deadline. Co-authored-by: morluto <morluto@users.noreply.github.com> * fix(browser): separate handshake and target-attach deadlines A browser-level Target.attachToTarget no longer shares the WebSocket handshake budget. Blocked service-worker attachment keeps discovery on its fixed deadline and applies command_timeout_ms to the later handshake and attach. Co-authored-by: morluto <morluto@users.noreply.github.com> * fix(browser): name the web-bundle resource each runtime exhausts Bun ignores the V8 old-space flag. A Windows Job reports the process commit limit, and other Bun hosts no longer suggest raising max_heap_mb. Co-authored-by: morluto <morluto@users.noreply.github.com> * fix(browser): cite the browser-socket discovery message budget WebSocket discovery enforces the 64 MiB protocol budget. Timeout recovery no longer advertises the 8 MiB HTTP document budget. Co-authored-by: morluto <morluto@users.noreply.github.com> * fix(browser): bound the blocked service-worker check before discovery The first registration check has its own fixed 10s deadline. Discovery, handshake, and Target.attachToTarget stay on their separate deadlines. Co-authored-by: morluto <morluto@users.noreply.github.com> * fix(browser): name the operand that stopped web-bundle admission Host heap pressure no longer claims the fixed result budget is exhausted. A Windows Bun allocation before the commit limit still names that limit. Co-authored-by: morluto <morluto@users.noreply.github.com> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: morluto <morluto@users.noreply.github.com>	2026-10-22 05:47:38 +08:00
Diya	3dbe314ada	fix(javascript): preserve source-map preparation capability errors (#6149)	2026-10-22 04:24:31 +08:00
morluto	2b2e362a00	fix(javascript): retain partial indexed source map facts ... Share section classification across declaration analysis and mapping parsing. Preserve external URLs, malformed section reasons, section paths and safe sibling declarations without fetching nested maps. Refs #5466. All 50 focused tests passed, including real CLI and stdio MCP regressions; typecheck and lint passed.	2026-10-20 22:18:23 +08:00
morluto	a4dbb36d8e	fix(javascript): retain uncertainty for missing source map mappings ... Share the required mappings field contract and retain readable declarations across malformed indexed leaves while marking graph coverage partial. Refs #5469.	2026-10-20 19:54:33 +08:00
morluto	be20ac3740	fix(source-maps): preserve failure priority and cancellation provenance	2026-10-20 17:18:20 +08:00
Riley Gramlich	3f80b75708	fix(source-maps): keep sources when sourcesContent length differs (#2873) ... ECMA-426 DecodeSourceMapSources reads a content slot only while its index is within sourcesContent, so a shorter array leaves trailing sources without content and a longer array adds no sources. Local application analysis and browser collection rejected any length mismatch and dropped every original from the map. The content helper now checks only entry types. Browser collection drops its separate check because the leaf schema already validates every supplied entry, and the raw records are still budgeted before parsing. Fixes #2821	2026-10-13 23:52:47 +08:00
Yann Roberto	1016c96e6b	fix(source-maps): accept omitted names during browser collection (#2831)	2026-10-13 22:17:09 +08:00
morluto	3ae826ceba	fix(javascript): share source-map resolution and preserve path uncertainty	2026-10-13 13:48:24 +08:00
Ysopwnable	172407787f	fix(windows): preserve transient runtime admission failures (#2467) ... Fixes #2257. Thanks to @chqcjq for the native self-test retry diagnosis in #2266. Preserve retry disposition through analysis workflows. Native warm admission requires exact sharing/lock codes and affirmative pre-allocation evidence; cleanup ownership takes precedence. No automatic retry or new analysis cache. Verified with real Windows 11 CLI, same-connection SDK MCP normal/conflict/recovery, the Windows native verifier, 99 focused tests and static/docs gates. Official npm 11.16.0 launcher sources were the application input. No IDA or Ghidra engine was used for this change. Win32 5 was not reproduced; no resolution claim for #1701/#2196. Performance measurements and limits are recorded in experiments/analysis-efficiency/windows-runtime-retry.md.	2026-10-13 11:42:54 +08:00
morluto	f64790bfc3	refactor(javascript): reuse validated source-map decoding ... Pass typed map objects into the codec and reuse validated TraceMap instances for regular and indexed lookups. Remove whole-map serialization, duplicate leaf decoding, an array-copy wrapper, and the unused offset-validation mode in artifact declaration collection. Validation: source-map and browser consumer suites (126 tests), declaration tests, and artifact reconstruction boundaries pass. Section overlap checks and raw source declarations remain intact.	2026-10-12 04:33:38 +08:00
morlutoandhhang	14935e4d47	fix(javascript): preserve package and source-map boundary identity (#1939) ... * fix(javascript): preserve bare package specifier suffixes * fix(javascript): resolve ESM package self references * fix(javascript): recover retained prefixed source maps * test(javascript): cover suffixed ESM self references * fix(javascript): retain legacy ESM package suffix behavior * fix(javascript): reject legacy ESM directory and extension fallback * refactor(javascript): consolidate package resolution and workflow coverage * fix(javascript): report exact ESM package subpath misses * fix(javascript): compare parsed names for ESM self references * refactor(javascript): parse bare package requests once * fix(javascript): derive ESM dependency lookup from package URLs --------- Co-authored-by: hhang <169027046+xu91102@users.noreply.github.com>	2026-10-12 04:09:17 +08:00
cyanseek	898d5096f9	perf(javascript): index source-map ignore lists per leaf (#1905)	2026-10-12 01:01:33 +08:00
xeropresenceandmorluto	66c21572de	fix(bun): report the real runtime and enforce worker memory budgets on Windows (#1730) ... * fix(bun): report the real runtime and enforce worker memory budgets on Windows Under Bun, REA recorded Node/V8 identity it did not observe and its JavaScript helper processes ran without a memory bound, because Bun ignores the V8 heap flags REA passes. Source-map trace Evidence claimed runtime node-v8 with Bun's synthetic V8 heap limit (the decoder then rejected that limit, so trace_web_source_location always failed), analysis resource failures reported heap limits Bun does not enforce, the HAR decoder claimed a fixed 192 MiB heap, and doctor reported Bun's Node.js compatibility version as the Node version. Identify the runtime once from process.versions. Source-map reports record id bun with the Bun and Node.js compatibility versions and a null v8_heap_limit_bytes; the decoder checks the heap budget only for V8 reports and rejects a report from a runtime other than the launching one. The analysis worker reports a null heap limit under Bun, HAR limitations and failures omit heap sizes under Bun, and the doctor node check reports Bun and passes when its Node.js compatibility version is supported. On Windows under Bun, each helper's owned Job Object now carries a commit limit of its heap budget plus a measured 512 MiB Bun runtime reserve (704 MiB for the codec and HAR decoder, 1536 MiB for the default analyzer). The native addon accepts an optional page-aligned job memory limit on process_spawn, verifies it by readback, associates a private completion port before the child is created, and reports a sticky memoryLimitReached and peak job commit on each poll; inspect reports jobMemoryLimit. A requested limit with an artifact lacking the control refuses the launch, and non-Windows launchers refuse a limit. Reaching the limit is classified by the job notification rather than Bun's exit status: the analyzer fails the current source with a memory resource failure reporting worker_process_memory_limit_bytes, the codec returns a memory resource failure, and the HAR decoder returns its memory failure with process_memory_limit_bytes. Bun source-map Evidence records process_memory_limit_bytes, verified against the launcher. Node.js launches and outputs are unchanged. * fix(windows): drain memory notifications after observing exit --------- Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>	2026-10-11 19:20:00 +08:00
morluto	aa257ea4b1	fix(browser): decode source-map response framing ... Share the ECMA-426 JSON parse view across fetched maps and local point tracing while retaining exact response text, bytes, and digest. Handle BOM and HTTP newline variants without treating unterminated prefixes as valid JSON. Validation: 89 source-map tests passed; source/runtime build and check:fast passed. Real Chrome 154 CLI and stdio MCP browser verification passed on macOS ARM64.	2026-10-11 07:29:51 +08:00
morluto	d1235fadc9	fix(providers): retain worker cleanup owners through shutdown ... Validation: integrated changes passed formatting, typecheck, lint, resolved module-boundary verification and git diff --check. Tests and real-provider workflows were not run.	2026-10-11 00:03:21 +08:00
morluto	ad59531a96	refactor: remove forwarding exports and redundant aliases	2026-10-09 22:46:09 +08:00
3 people	65a809a0da	fix(process): avoid cold ownership helper deadline exhaustion (#1139) ... * fix(process): avoid cold ownership helper deadline exhaustion Fixes #1137. * test(process): fix cold ownership test deadlines and cleanup * fix(process): isolate Swift cache overrides and retain diagnostics * test(electron): assert blank path rejection without trim assumptions --------- Co-authored-by: Chris <Chis@RICH-13918M.local> Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>	2026-10-09 07:18:07 +08:00
morluto	0a0174b9ac	fix(browser): validate and bound source-map evidence	2026-10-09 06:32:10 +08:00
morluto	f983c718c3	fix(browser): bound aggregate source-map decoding before expansion	2026-10-09 05:15:23 +08:00
morluto	63cf28fd8f	fix(process): preserve partial evidence and verify detached cleanup (#1011) ... * test(ci): allow transport delivery in source identity regression * fix(process): preserve partial evidence and verify detached cleanup * fix(process): scope Linux token sweeps by stable process identity * fix(process): retain environment permission failure codes * fix(process): wait for signaled processes before verifying cleanup * fix(process): verify sampled detached groups during cleanup * fix(electron): preserve prelaunch identities through cleanup * fix(process): retry growing Darwin process table snapshots * fix(process): retain compatibility with saved v3 capture evidence * fix(process): migrate saved v3 captures during reconstruction verification * fix(process): preserve cancellation during Darwin helper compilation * fix(process): propagate cancellation through ownership baselines * perf(javascript): cache canonical export comparison sort keys * fix(process): cancel provider ownership preparation before spawn * fix(process): isolate native compiler waiter cancellation	2026-10-08 04:46:46 +08:00
morluto	c7530f9a81	perf(javascript): reduce analysis and source-map work (#955) ... * perf(javascript): reduce semantic traversal overhead * perf(source-maps): reuse validated regular map rows	2026-10-07 20:33:35 +08:00
ysopwnable	f430c416c7	feat(browser): trace captured website source-map locations (#897) ... * refactor(browser): share captured-script acquisition boundaries Reuse stable capture/source acquisition and identity validation for module and source-map analysis. Preserve host I/O, malformed input, unavailable source and digest mismatch diagnostics. Refs #851 Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis) Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing) * feat(browser): trace captured website source-map locations Refs #851. Preserve selected capture/map byte identity, duplicate mappings and embedded source evidence through the pinned upstream codec. Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis) Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing) * test(browser): verify source-map artifacts and synchronize generated contracts Cover byte-preserving map reads and actionable filesystem constraints. Refresh generated public schemas and metadata on current main. Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis) Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing) * fix(browser): preserve inert source-map URL context The selected URL is local codec context and grants no transport authority. Preserve its reported text and verify normal/userinfo contexts through real public interfaces, alongside independent manifest byte identity. Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis) Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)	2026-10-07 16:21:18 +08:00