* fix(desktop): output-directory admission agrees with SafeOutputTree for #9291
* fix(desktop): admit build export and witness folders through planOutputTree
Main now owns new-or-empty folder admission in planOutputTree, so the
separate admitNewOrEmptyOutputDirectory check is superseded. Keep the
remaining parts of #9291 on that owner:
- export_build_environment plans the caller's directory before running
export-desktop-application in the build computer.
- planOutputTree refuses a folder, or the nearest existing ancestor of an
absent one, that the host cannot write, so check_build_task refuses it at
the seed instead of after the recording ends.
- writeOutputTree creates missing parents through SafeOutputTree's
createParents, which maps a file or denied parent to a destination
refusal, instead of a raw mkdir before admission.
Restore main's withheld-copy test, which this design leaves unchanged.
* fix(desktop): require a readable parent where publication syncs it
SafeOutputTree.commit opens the output folder's parent read-only to sync
it, so a write-only parent passed admission and failed only at
publication. planOutputTree now also requires read access on that parent
when it already exists.
---------
Co-authored-by: Phon <twilyt1@proton.me>
A plain `rea --version` reached loadCliRuntime with no command name, so
selectCliRegistration returned undefined and the complete CLI, with every
registrar and its schemas, loaded only for Incur to print the version.
selectCliRegistrations now returns the registrars an invocation needs:
none for a standalone --version, one for a recorded command, and
undefined when the complete CLI must answer. Combined flags, help and
shell completion keep the complete CLI.
Ported from #4083 onto main's lazy registration loader.
Co-authored-by: jianghh <3232826884@qq.com>
Every counted-baseline change edited scripts/verify/architecture-guard-baselines.json, so PRs touching unrelated guards conflicted there. Each guard now keeps its baseline in scripts/verify/baselines/<guard-key>.json with paths sorted by code unit; --shrink-baselines rewrites, and deletes a guard's file when its last count is removed, and the guard rejects unsorted files and files that name no counted guard.
* refactor(verify): give the native verifiers' roots to VerifierFixture
* fix(verify): report every nested JEB cleanup failure reason
* test(verify): give the isolated ADB verifier runs the fixture owner it now imports
* feat(javascript): make the member-mutation work allowance a runtime setting
The member-mutation alias-state allowance from #11144 was a fixed constant, so a refused source could not be admitted without a code change.
Register javascript.member_mutation_alias_states (default 524288, 1 to 8388608 alias states) with the launch seed REA_JAVASCRIPT_MEMBER_MUTATION_ALIAS_STATES. The application, web bundle and reference-source boundaries resolve it from the accepted operation snapshot and launch environment, refuse a malformed seed before analysis, and send it to the workers with each source. A refusal names the setting, its effective value, source and range, and the recovery; worker parents rebuild it from the allowance they sent.
Refs #8294
* fix(javascript): keep the setting and recovery of a refused web script
A web bundle script refused by the member-mutation allowance kept only its reason and reported limits, so the public unknown lost the setting, value, source and recovery. Carry the refusal's structured limit and remediation on the per-script result and its javascript_analysis unknown, grouping scripts only when that recovery agrees. Assert structured limit facts and the owning formatter's recovery instead of fixed wording.
* fix(browser): keep only registered setting limits on a refused web script
* feat(javascript): keep syntax facts for a source whose member-mutation phase is refused (#11187)
* feat(javascript): keep syntax facts for a source whose member-mutation phase is refused
A source refused by the member-mutation work allowance during static analysis lost every fact, so the application graph counted it as skipped. Reference-source import failed outright on such a file.
Checkpoint the parser, comment and text facts the static owner can still state, with parse status partial, examination not-examined and refused_phase member-mutations, before reporting the refusal; the semantic phase is not started because it indexes the same mutations. Reference-source import keeps the file's declaration-level imports and records that its CommonJS require calls were not examined.
Refs #8294
* test(javascript): compare the reference-source refusal with its owning formatter
* feat(javascript): keep a refused web script's parse and text facts
A captured script whose member-mutation phase was refused lost every fact in analyze_web_bundle, so it was neither counted as parsed nor kept its vendor markers.
The analyzer now returns the script as unavailable with partial facts: refused phase, parse status and the inferences read from script text alone. Findings gathered before the refusal are dropped, because they may have read an incomplete mutation index. The worker parent states the refusal and its setting recovery from the allowance it sent, through the same helper the isolated analyzer uses for every unavailable script. The bundle counts the script as parsed, keeps its text inferences, and its javascript_analysis unknown carries refused_phase.
Refs #8294
* chore(mcp): record the member-mutation setting in the advertised summary
* fix(javascript): rebuild a parked source worker when the member-mutation allowance changes
A worker parked on a resource scope was reused when heap, timeout and precision matched, but its requests carry the allowance it was built with. After update_analysis_settings accepted a new allowance, the next analysis on that scope kept the old one.
The reuse check now compares the allowance's value and source, so a changed setting gets a worker built with it. The web bundle worker already takes the allowance per script.
* refactor(verify): give the remaining verifiers' roots to VerifierFixture
* fix(verify): let the loader-relocation supervisor dispose itself so a retried stop can observe its exit
* test(verify): give the isolated bridge-sources and packaged-wasm runs the fixture owner they now import
* test(verify): observe the Bun and Go verifier roots where VerifierFixture loads them
* docs(javascript): record pushed effect invalidation for semantic reads
Record the decision that recorded member effects and eval rebinding invalidate reads through one effect log owner instead of 32 reader-side checks, with the slice order, per-slice corpus measurement and stop conditions.
* docs(javascript): require invalidation to reach dependent cached values
* docs(javascript): record the rejected global-reference fold and its measurements
* docs(adr): record per-target cache invalidation as measured and declined
* refactor: report NativeAOT, Interface Builder and owned-MCP output limits through the shared limit owners
* refactor(errors): carry a parser's required value on its limit reference and in adjustable-budget refusals (#11201)
* fix(android): keep the JADX output-limit refusal's retained process output
* refactor(native): name PE and native-export allowances in the BinaryResourceFailure limit (#11253)
PeImportLimitFailure, PeLoadConfigLimitFailure and NativeExportLimitFailure kept a parallel `limit` field beside the LimitRef their BinaryResourceFailure base already carries (named only "structure"). The allowance name now lives in the LimitRef, consumers read it with binaryResourceAllowance against the parser's exported allowance list, and the three subclasses are removed. The local-limit-error-class guard also counts limit subclasses of BinaryResourceFailure.
* fix(verify): recognize the ownership ps inventory from the process owner's arguments
* fix(verify): match the recorded-crash ps inventory against REA's fixed ps locations
* fix(javascript): report version-comparison coverage unknown when a source graph cannot tell
* refactor(javascript): name the unavailable-graph coverage mapping once
* fix(javascript): give the version change graph and its edges the same unknown coverage
* fix(javascript): report export-shape comparison coverage unknown when a source graph cannot tell (#11218)
* fix(javascript): report export-shape comparison coverage unknown when a source graph cannot tell
* test(javascript): keep unknown export-shape coverage beside a truncated projection
* fix(javascript): read runtime-reconciliation input coverage once and report unknown when a static graph cannot tell (#11230)
* fix(javascript): read runtime-reconciliation input coverage once and report unknown when a static graph cannot tell
* fix(javascript): keep a known input truncation beside unknown reconciliation coverage
* fix(javascript): report export-shape source omission counts unknown when a side has no projection (#11261)
compare_export_shapes reported left/right_omitted_fields and omitted_property_coverage as 0 for a side whose export selection recovered no return-shape projection (missing, ambiguous or unavailable), while the sibling source_omitted_variants already reported null. Add Known<T> (src/domain/known.ts) and read each side's source coverage once through it; the counts are now null (unknown) with a limitation naming why. The runtime-reconciliation graph's omission sum and its parallel 'omissions known' flag become one Known<number> via sumKnownCounts (no output change).
* fix(verify): run the native-calls hardened-runtime check in the artifact CLI environment
* fix(verify): give the native-calls get-task-allow copy its dSYM
compare_managed_members reported partial when a side's member inspection was unavailable or when selected-scope agreement could not be established, and verify_managed_native_boundaries reported partial when the boundary inspection was unavailable. Both now fold their inputs with joinCoverageStatus, so unknown wins beside a known gap. The status enums gain unknown (additive).
* refactor(mcp): register service-backed tools through one contract binding loop
registerContractTools registers every bound contract from the registry through the shared Evidence or retained-summary handler its binding selects, and refuses a binding that names no registered contract. createServer declares the bindings by exact contract name; 41 per-tool register files are deleted.
* refactor(mcp): bind service-backed tools from one shared table and make each binding select one handler
serviceToolBindings owns the binding of every service-backed contract, keyed by its service; createServer and the MCP tests bind from it, so tests exercise the production handler kind, admission and dependencies. A binding can no longer carry both run and summary. The Go real-binary workflow follows the new registration owners.
* test(mcp): assert binding exclusivity with type-level checks that hold under every checker
inspect_release_exposure kept the first eight scan limitations and dropped the rest with no count, at the collector and at two merge points that prepend a reason. Add boundedList/BoundedListCollector (src/domain/boundedList.ts), which always carry the omitted count, and report it as a 'limitations' coverage.omitted entry. A counted constant-maximum-slice guard keeps new .slice(0, MAX) copies from appearing outside the owner.
* refactor(mcp): derive every advertised tool through one owner
The server's registration and tools/list rewrite, catalog identity and the
Copilot verifier each assembled the advertised description, input and
output schema themselves. src/contracts/advertisedTool.ts now owns that
composition; served environment catalogs (MCP listing and card) go through
the same owner's dialect projection, keeping argument descriptions.
* test(mcp): pin each remaining environment dialect violation to its query union
Contracts declare availability: "standalone" or { host: <feature> }, and CapabilityInventory interprets the declaration once through one feature table, replacing 39 per-name branches. HOST_RESTRICTED_FEATURES moves to the contracts layer.
utf8HeadExcerpt and utf8TailExcerpt now return ExcerptText, a branded string. compactStringIdentityKey takes NotExcerpt<T>, so passing a display excerpt where an identity key is expected is a compile error (covered by an @ts-expect-error test). Two consumers that re-derived truncation by comparing an excerpt with its source (environment replay metadata, rizin frame history) read the helper's truncated fact instead.
* docs(native): scope function-matching complete-within-inputs to supplied inventories
* docs(native): say partial covers unresolved as well as unpaired rows
* test(support): copy isolated-repository scripts with their runtime import closure
* fix(test): resolve package imports to the file Node loads in the import closure
* test(rizin): expect closeAll to abort in-flight starts and cancel TTY validation with a real signal
* fix(process): relay a caller abort dispatched while the start registered its listener
Fail visibly with a dispatcher hint and exit status 1 when the compiled command registry is executed directly. Reuse the existing argv/module identity owner for both entry modules and preserve normal imports and supported dispatch.
Fixes#10762.
Builds on #10766.
Co-authored-by: 2SinceJuly <202121119+2SinceJuly@users.noreply.github.com>
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
summary.json held every advertised pattern's site list and every tool's
schema digests in one file. Each new path-taking tool appended to the
shared path pattern's list, so concurrent tool PRs conflicted on it, and
updating it required a local build.
Each tool's digests and patterns now live in
scripts/verify/advertised-schemas/tools/<tool>.json. The check still prints
aggregated review lines such as "N tool schemas gained pattern /.../", and
on failure also prints the expected contents of each missing or stale file
so a PR can commit them from CI output without building. --update-summary
writes those files and deletes summaries of removed tools. The existing
summary was split into per-tool files from its recorded data.
Fixes#11189
Admit ELF machine 94 as the canonical Xtensa family through Ghidra's header-selected import. Share generic-header exclusions between static target types and live CLI/MCP summaries, preserving ELF-only format constraints and other providers' decline paths.
Fixes#10765.
Adapted from #10774.
Co-authored-by: Josh <joshuakrishna21@gmail.com>
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
* fix(contracts): refuse empty address and procedure selectors in the contracts
* refactor(cli): project decompile from its contract with --file-offset as an alternative selector (#10756)
* refactor(cli): project search from its contracts with --kind choosing the operation (#10761)
* refactor(cli): project search from its contracts with --kind choosing the operation
* fix(cli): check operation choices' option rules and bind errors to the selected contract
* test(cli): group operation-choice checks in their own block
* refactor(cli): project decompile-all from its contract onto a native session target (#10778)
* refactor(cli): project decompile-all from its contract onto a native session target
* refactor(cli): project native Mach-O, Swift and native UI commands from their contracts
* fix(cli): read search, decompile-all and native utility contracts from their groups so startup stays lazy
* test(cli): drop the empty-selector admission mismatches the contracts now refuse
Scenario planning and plan Evidence take a required platform. Host file operations (target resolution, output trees, Windows spelling lookup, executable checks, native snapshot admission), the Linux distribution read and the process CLI adapter read HOST_PLATFORM explicitly. ByteEntropyService takes an optional platform seam, so its Windows casing test injects win32 instead of stubbing process.platform. src/application no longer reads process.platform or process.arch.
morluto