A plain `rea --version` reached loadCliRuntime with no command name, so
selectCliRegistration returned undefined and the complete CLI, with every
registrar and its schemas, loaded only for Incur to print the version.
selectCliRegistrations now returns the registrars an invocation needs:
none for a standalone --version, one for a recorded command, and
undefined when the complete CLI must answer. Combined flags, help and
shell completion keep the complete CLI.
Ported from #4083 onto main's lazy registration loader.
Co-authored-by: jianghh <3232826884@qq.com>
Every counted-baseline change edited scripts/verify/architecture-guard-baselines.json, so PRs touching unrelated guards conflicted there. Each guard now keeps its baseline in scripts/verify/baselines/<guard-key>.json with paths sorted by code unit; --shrink-baselines rewrites, and deletes a guard's file when its last count is removed, and the guard rejects unsorted files and files that name no counted guard.
* refactor(verify): give the native verifiers' roots to VerifierFixture
* fix(verify): report every nested JEB cleanup failure reason
* test(verify): give the isolated ADB verifier runs the fixture owner it now imports
* feat(javascript): make the member-mutation work allowance a runtime setting
The member-mutation alias-state allowance from #11144 was a fixed constant, so a refused source could not be admitted without a code change.
Register javascript.member_mutation_alias_states (default 524288, 1 to 8388608 alias states) with the launch seed REA_JAVASCRIPT_MEMBER_MUTATION_ALIAS_STATES. The application, web bundle and reference-source boundaries resolve it from the accepted operation snapshot and launch environment, refuse a malformed seed before analysis, and send it to the workers with each source. A refusal names the setting, its effective value, source and range, and the recovery; worker parents rebuild it from the allowance they sent.
Refs #8294
* fix(javascript): keep the setting and recovery of a refused web script
A web bundle script refused by the member-mutation allowance kept only its reason and reported limits, so the public unknown lost the setting, value, source and recovery. Carry the refusal's structured limit and remediation on the per-script result and its javascript_analysis unknown, grouping scripts only when that recovery agrees. Assert structured limit facts and the owning formatter's recovery instead of fixed wording.
* fix(browser): keep only registered setting limits on a refused web script
* feat(javascript): keep syntax facts for a source whose member-mutation phase is refused (#11187)
* feat(javascript): keep syntax facts for a source whose member-mutation phase is refused
A source refused by the member-mutation work allowance during static analysis lost every fact, so the application graph counted it as skipped. Reference-source import failed outright on such a file.
Checkpoint the parser, comment and text facts the static owner can still state, with parse status partial, examination not-examined and refused_phase member-mutations, before reporting the refusal; the semantic phase is not started because it indexes the same mutations. Reference-source import keeps the file's declaration-level imports and records that its CommonJS require calls were not examined.
Refs #8294
* test(javascript): compare the reference-source refusal with its owning formatter
* feat(javascript): keep a refused web script's parse and text facts
A captured script whose member-mutation phase was refused lost every fact in analyze_web_bundle, so it was neither counted as parsed nor kept its vendor markers.
The analyzer now returns the script as unavailable with partial facts: refused phase, parse status and the inferences read from script text alone. Findings gathered before the refusal are dropped, because they may have read an incomplete mutation index. The worker parent states the refusal and its setting recovery from the allowance it sent, through the same helper the isolated analyzer uses for every unavailable script. The bundle counts the script as parsed, keeps its text inferences, and its javascript_analysis unknown carries refused_phase.
Refs #8294
* chore(mcp): record the member-mutation setting in the advertised summary
* fix(javascript): rebuild a parked source worker when the member-mutation allowance changes
A worker parked on a resource scope was reused when heap, timeout and precision matched, but its requests carry the allowance it was built with. After update_analysis_settings accepted a new allowance, the next analysis on that scope kept the old one.
The reuse check now compares the allowance's value and source, so a changed setting gets a worker built with it. The web bundle worker already takes the allowance per script.
* refactor(verify): give the remaining verifiers' roots to VerifierFixture
* fix(verify): let the loader-relocation supervisor dispose itself so a retried stop can observe its exit
* test(verify): give the isolated bridge-sources and packaged-wasm runs the fixture owner they now import
* test(verify): observe the Bun and Go verifier roots where VerifierFixture loads them
* refactor: report NativeAOT, Interface Builder and owned-MCP output limits through the shared limit owners
* refactor(errors): carry a parser's required value on its limit reference and in adjustable-budget refusals (#11201)
* fix(android): keep the JADX output-limit refusal's retained process output
* refactor(native): name PE and native-export allowances in the BinaryResourceFailure limit (#11253)
PeImportLimitFailure, PeLoadConfigLimitFailure and NativeExportLimitFailure kept a parallel `limit` field beside the LimitRef their BinaryResourceFailure base already carries (named only "structure"). The allowance name now lives in the LimitRef, consumers read it with binaryResourceAllowance against the parser's exported allowance list, and the three subclasses are removed. The local-limit-error-class guard also counts limit subclasses of BinaryResourceFailure.
* fix(verify): recognize the ownership ps inventory from the process owner's arguments
* fix(verify): match the recorded-crash ps inventory against REA's fixed ps locations
* fix(javascript): report version-comparison coverage unknown when a source graph cannot tell
* refactor(javascript): name the unavailable-graph coverage mapping once
* fix(javascript): give the version change graph and its edges the same unknown coverage
* fix(javascript): report export-shape comparison coverage unknown when a source graph cannot tell (#11218)
* fix(javascript): report export-shape comparison coverage unknown when a source graph cannot tell
* test(javascript): keep unknown export-shape coverage beside a truncated projection
* fix(javascript): read runtime-reconciliation input coverage once and report unknown when a static graph cannot tell (#11230)
* fix(javascript): read runtime-reconciliation input coverage once and report unknown when a static graph cannot tell
* fix(javascript): keep a known input truncation beside unknown reconciliation coverage
* fix(javascript): report export-shape source omission counts unknown when a side has no projection (#11261)
compare_export_shapes reported left/right_omitted_fields and omitted_property_coverage as 0 for a side whose export selection recovered no return-shape projection (missing, ambiguous or unavailable), while the sibling source_omitted_variants already reported null. Add Known<T> (src/domain/known.ts) and read each side's source coverage once through it; the counts are now null (unknown) with a limitation naming why. The runtime-reconciliation graph's omission sum and its parallel 'omissions known' flag become one Known<number> via sumKnownCounts (no output change).
compare_managed_members reported partial when a side's member inspection was unavailable or when selected-scope agreement could not be established, and verify_managed_native_boundaries reported partial when the boundary inspection was unavailable. Both now fold their inputs with joinCoverageStatus, so unknown wins beside a known gap. The status enums gain unknown (additive).
* refactor(mcp): register service-backed tools through one contract binding loop
registerContractTools registers every bound contract from the registry through the shared Evidence or retained-summary handler its binding selects, and refuses a binding that names no registered contract. createServer declares the bindings by exact contract name; 41 per-tool register files are deleted.
* refactor(mcp): bind service-backed tools from one shared table and make each binding select one handler
serviceToolBindings owns the binding of every service-backed contract, keyed by its service; createServer and the MCP tests bind from it, so tests exercise the production handler kind, admission and dependencies. A binding can no longer carry both run and summary. The Go real-binary workflow follows the new registration owners.
* test(mcp): assert binding exclusivity with type-level checks that hold under every checker
* refactor(mcp): derive every advertised tool through one owner
The server's registration and tools/list rewrite, catalog identity and the
Copilot verifier each assembled the advertised description, input and
output schema themselves. src/contracts/advertisedTool.ts now owns that
composition; served environment catalogs (MCP listing and card) go through
the same owner's dialect projection, keeping argument descriptions.
* test(mcp): pin each remaining environment dialect violation to its query union
* test(support): copy isolated-repository scripts with their runtime import closure
* fix(test): resolve package imports to the file Node loads in the import closure
* test(rizin): expect closeAll to abort in-flight starts and cancel TTY validation with a real signal
* fix(process): relay a caller abort dispatched while the start registered its listener
Fail visibly with a dispatcher hint and exit status 1 when the compiled command registry is executed directly. Reuse the existing argv/module identity owner for both entry modules and preserve normal imports and supported dispatch.
Fixes#10762.
Builds on #10766.
Co-authored-by: 2SinceJuly <202121119+2SinceJuly@users.noreply.github.com>
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
summary.json held every advertised pattern's site list and every tool's
schema digests in one file. Each new path-taking tool appended to the
shared path pattern's list, so concurrent tool PRs conflicted on it, and
updating it required a local build.
Each tool's digests and patterns now live in
scripts/verify/advertised-schemas/tools/<tool>.json. The check still prints
aggregated review lines such as "N tool schemas gained pattern /.../", and
on failure also prints the expected contents of each missing or stale file
so a PR can commit them from CI output without building. --update-summary
writes those files and deletes summaries of removed tools. The existing
summary was split into per-tool files from its recorded data.
Fixes#11189
Admit ELF machine 94 as the canonical Xtensa family through Ghidra's header-selected import. Share generic-header exclusions between static target types and live CLI/MCP summaries, preserving ELF-only format constraints and other providers' decline paths.
Fixes#10765.
Adapted from #10774.
Co-authored-by: Josh <joshuakrishna21@gmail.com>
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
* fix(contracts): refuse empty address and procedure selectors in the contracts
* refactor(cli): project decompile from its contract with --file-offset as an alternative selector (#10756)
* refactor(cli): project search from its contracts with --kind choosing the operation (#10761)
* refactor(cli): project search from its contracts with --kind choosing the operation
* fix(cli): check operation choices' option rules and bind errors to the selected contract
* test(cli): group operation-choice checks in their own block
* refactor(cli): project decompile-all from its contract onto a native session target (#10778)
* refactor(cli): project decompile-all from its contract onto a native session target
* refactor(cli): project native Mach-O, Swift and native UI commands from their contracts
* fix(cli): read search, decompile-all and native utility contracts from their groups so startup stays lazy
* test(cli): drop the empty-selector admission mismatches the contracts now refuse
* refactor(native): report bounded string reads that stop at their allowance as decode limits
* fix(verify): count generic and multi-line plain-Error limit classes
* test(mcp): check advertised schemas against a portable dialect in every profile
* fix(mcp): re-emit advertised patterns in a portable regex grammar
* fix(mcp): present discover_tools input through the selected profile
The hot-cold catalog registered discover_tools directly with the SDK, so
the default compact input profile still advertised its canonical schema,
including page-size defaults clients apply on their own (#5322). Route
every listed input schema, transport discovery included, through one
server-owned presentation, and pass the selected presentation to the
deferred server, which serves recorded tool schemas but not discovery.
* fix(mcp): keep the Evidence union on described borrowed inputs
borrowEvidenceInput installed its advertised projection on one schema
instance. A call site's .describe() rebuilds the schema from its
definition, so match_native_functions advertised left and right as
unconstrained values in every input profile. Install the projection in
the borrowed parser's constructor so derived schemas keep it, for both
borrowed inputs and borrowed arrays.
* fix(mcp): validate advertised dialect by selected profile
* fix(mcp): preserve schema widening through references
* feat(mcp): project compact input schemas into the portable advertised dialect
One projection (advertisedDialectProjection.ts) owns the compact input
advertisement: one type per node, items on every array, string literals
as enums, oneOf widened to anyOf, allOf merged, tuples as element unions,
exclusive bounds made inclusive, and every keyword outside the dialect
dropped. Each rewrite is exact or widening; server validation is
unchanged. The root description and sentences for dropped cross-field
constraints move to the tool description, which Codex and Zed keep.
The compact baseline falls to nullable values only (29), which the
dialect cannot express without narrowing an input. The gateway shape
repairs (typeArrayItemUnions, hasGatewayIncompatibleShape), the second
dependentRequired-to-prose copy and the strict-gateway test denylist are
removed; the dialect checker gates the inline presentation instead.
* feat(mcp): omit output schemas from tools/list by default
No surveyed model API reads an output schema, MCP client validators
repeat REA's own result validation, and complete output schemas were
about 92% of the default tools/list. REA_MCP_OUTPUT_SCHEMA_PROFILE now
resolves to off through one owner (resolveMcpOutputSchemaProfile);
compact and full remain selectable. structuredContent is still
delivered, and the deferred server serves both off and full from the
recorded catalog with the matching recorded identity.
Tests and artifact verifiers that validate results against complete
advertised output contracts select full explicitly.
* docs: describe omitted output schemas as the default in README translations
* fix(mcp): select schemas in verification workflows
* fix(mcp): refuse zero-padded repeat bounds and record host-specific path patterns
* fix(mcp): keep projected schemas permissive
* fix(mcp): keep references valid when presentation widens their targets
* fix(mcp): keep a single union branch's closure scoped to its properties
* fix(mcp): select complete output schemas in the Electron verifier
* fix(mcp): select complete output schemas in standalone verifier probes
* fix(mcp): keep an allOf member's tuple tail with its own positions
* fix(mcp): relax references into negations and conditionals presentation may remove
* refactor(contracts): declare root discriminators as typed schema annotations
* test(mcp): select the borrowed Evidence contract from its family
* fix(mcp): keep astral literals and dynamic references widening in every mode
* fix(mcp): omit astral literals and relax untracked references when presentation widens
* fix(mcp): select complete output schemas in every verifier transport
* fix(mcp): read reference pointers by schema position, not segment spelling
* fix(mcp): protect references into collapsing boolean unions and keep referencing branches out of the collapse
* fix(mcp): keep reduced schemas open when their root admits names by pattern
* test(mcp): keep the reduced-schema pattern case outside the size-limited block
* fix(mcp): omit patterns whose classes name astral characters
* fix(mcp): decide union collapse and pointer protection from canonical branches
* docs(mcp): document non-u astral matching and pin BMP agreement across V8 modes
* fix(mcp): keep prototype-named properties as own properties in the dialect projection
* test(mcp): select full output schemas in packet and signal schema checks
* test(mcp): expect the advertised base64 schema to omit the unbounded pad-bit probe
* fix(mcp): protect references into unevaluated keywords lost evaluation removes
* fix(mcp): validate the doctor probe reply against the canonical output contract (#10655)
* fix(mcp): validate the doctor probe reply against the canonical output contract
* test(mcp): replay doctor probe validation under every output profile
* test(mcp): accept typed-branch nullable unions in the advertised dialect (#10649)
* test(mcp): select full output schemas in HTTP session workflows
* fix(mcp): emit stack-safe classes with non-ASCII members and protect draft-07 reference siblings
* fix(mcp): protect references into literal siblings of relaxed draft-07 references
* feat(mcp): omit output schemas from tools/list by default (#10646)
* feat(mcp): omit output schemas from tools/list by default
No surveyed model API reads an output schema, MCP client validators
repeat REA's own result validation, and complete output schemas were
about 92% of the default tools/list. REA_MCP_OUTPUT_SCHEMA_PROFILE now
resolves to off through one owner (resolveMcpOutputSchemaProfile);
compact and full remain selectable. structuredContent is still
delivered, and the deferred server serves both off and full from the
recorded catalog with the matching recorded identity.
Tests and artifact verifiers that validate results against complete
advertised output contracts select full explicitly.
* fix(mcp): select schemas in verification workflows
* fix(mcp): select complete output schemas in the Electron verifier
* fix(mcp): select complete output schemas in standalone verifier probes
* fix(mcp): select complete output schemas in every verifier transport
* test(mcp): select full output schemas in packet and signal schema checks
* fix(mcp): validate the doctor probe reply against the canonical output contract (#10655)
* fix(mcp): validate the doctor probe reply against the canonical output contract
* test(mcp): replay doctor probe validation under every output profile
* test(mcp): accept typed-branch nullable unions in the advertised dialect (#10649)
* test(mcp): select full output schemas in HTTP session workflows
* fix(mcp): keep the Evidence union on described borrowed inputs (#10597)
* fix(mcp): keep the Evidence union on described borrowed inputs
borrowEvidenceInput installed its advertised projection on one schema
instance. A call site's .describe() rebuilds the schema from its
definition, so match_native_functions advertised left and right as
unconstrained values in every input profile. Install the projection in
the borrowed parser's constructor so derived schemas keep it, for both
borrowed inputs and borrowed arrays.
* test(mcp): select the borrowed Evidence contract from its family
* docs(mcp): admit baseline growth only for restored contract declarations
* fix(mcp): state reduced multi-type properties as typed branches, not type lists
The reduced fallback derived a property's types and emitted them as a type
list, which Gemini, Moonshot and Ark reject. A property whose canonical
schema is anyOf string and number therefore traded a typed union for a
rejected construct when the inline projection fell back. Emit one type, or
anyOf typed branches, so [T, null] becomes the dialect's nullable union.
* feat(mcp)!: retire the full schema profiles and declare complete observations as a typed annotation (#10718)
* refactor(mcp): declare complete observations as a typed annotation applied only on the wire
* test(mcp): compare complete-observation declarations with their owning text
* refactor(schema): couple Zod checks with their JSON Schema constraint keywords (#10725)
* refactor(schema): couple Zod checks with their JSON Schema constraint keywords
* refactor(schema): declare pattern approximations and object output roots as typed annotations (#10754)
* refactor(schema): declare pattern approximations and object output roots as typed annotations
* fix(schema): refuse pattern declarations JSON Schema cannot state
* test(schema): select guided_workflows from its contract family
* feat(mcp)!: retire the full input and output schema profiles (#10841)
* feat(mcp)!: retire the full input and output schema profiles
The compact input presentation is now the only advertised input schema, and
output schemas are either omitted (`off`, the default) or bounded
(`compact`). Catalog identity, the build-recorded digests and the recorded
startup catalog collapse to those presentations: two digest profiles instead
of six, one recorded catalog instead of two, and no input dialect baseline.
Tests and verifiers that validated replies against listed full output
schemas now validate against the canonical output contract, which REA
already enforces server-side; tests that asserted canonical input
restrictions read the canonical input schema instead of a full listing.
BREAKING CHANGE: `REA_MCP_INPUT_SCHEMA_PROFILE=full` and
`REA_MCP_OUTPUT_SCHEMA_PROFILE=full` are refused at startup and by `rea setup`
with a configuration error naming the setting. Remove the setting from the
client registration (or rerun setup with `REA_MCP_INPUT_SCHEMA_PROFILE=compact`
/ `REA_MCP_OUTPUT_SCHEMA_PROFILE=compact`). `REA_MCP_INPUT_SCHEMA_PROFILE`
still accepts `compact`. Server-side validation is unchanged.
* test(mcp): validate replies against canonical output contracts at every listed-schema reader
tools/list omits output schemas by default, so fixtures, verifiers and the
Android analysis runners that read a listed outputSchema now bind the
canonical contract instead. connectLocalToolsMcp and advertisedMcpToolSchemas
hand the SDK a definition carrying the canonical output schema, so the SDK
client and caller-supplied validators check every successful reply.
* test(mcp): resolve Android runners' output contracts from the selected repository
The Android efficiency runners imported the canonical output-schema helper from the harness checkout while --repository selects the revision under test. Import it from the selected repository, as the runners already do for the SDK and Ajv.
* test(mcp): let Android runners compare revisions before the canonical output helper
A selected revision without scripts/lib/canonical-output-schema.mjs could not start the Android runners. Choose the output contracts in one harness helper: the selected revision's canonical contracts when it has them, otherwise its listed schemas under the full output profile it still supports.
* fix(scripts): keep caller launch settings when the real Hopper verifier builds its server environment
The verifier deleted REA_VERIFY_SERVER_COMMAND and REA_VERIFY_SERVER_ARGS_JSON from process.env itself before reading them, so a caller selecting an installed REA command silently ran the checkout's dist/main.js. Copy the environment, as main does, so only the child's environment changes.
* test(mcp): validate whole replies against canonical output contracts wherever a listed definition is held
tools/list omits output schemas by default and the full output profile is gone, so tests that handed the SDK a listed definition no longer checked complete replies. Attach the canonical output schema with withCanonicalOutputSchema at every held REA tool definition. Environment-served tools (not REA contracts), and the deferred-runtime and doctor tests that exercise per-profile listings, keep their listed definitions.
* test(mcp): record the advertised catalog summary without the retired full profiles
Retiring the full input and output profiles leaves only the compact input and compact output listings, so the summary drops the full-profile digests and every pattern only the full listings carried. Regenerated with npm run verify:advertised-schemas -- --update-summary.
* fix(verify): check the ESP lanes' RISC-V toolchain through the shared prerequisite before allocating
* test(verify): require the ESP compiler probe to generate RISC-V code
* fix(guards): refuse a counted-baseline file that is not in its written order
* test(guards): decide the baseline file's rewrite or refusal in its owner and cover it
* ci(guards): run the architecture guards in the pre-push check
* docs(limits): name lint as the numeric-limit check's owner
* ci(lint): cache the numeric-limit check by every file its restart-field scan reads
* test(mcp): compile advertised patterns with the regex engines clients run
List the built package's tools over stdio in every input, output and
catalog profile and compile each distinct advertised regular expression
with V8 (plain, u, v), Go regexp (RE2), C++ RE2, Python re, and Rust regex
and fancy-regex through the Rust jsonschema crate. A refusal names the
engine, its error, and each tool, schema path and profile.
The Python engines are pinned, hash-checked wheels; Go is the host
toolchain with GOTOOLCHAIN=local. A missing engine is reported as not
verified, and REA_REQUIRE_SCHEMA_ENGINES=1 makes it a failure.
The pattern owner now also reports patternProperties keys, which clients
compile as well.
Refs #10830
* test(mcp): run schema engine helpers and listings under the process owner
* test(mcp): load advertised schemas in the validators clients build (#10983)
* test(mcp): load advertised schemas in the validators clients build
Build a validator for every distinct advertised input and output schema
with the Rust jsonschema crate's defaults, which check the declared draft's
meta-schema and formats and compile every subschema. --complete adds Python
jsonschema's check_schema, which jsonschema.validate runs in Python clients;
it takes several seconds, so it is opt-in.
Refusals are grouped by reason, so one shared pattern that breaks many
schemas is reported once with its sites.
Ajv strict mode and OpenAI strict mode are documented as not covered, with
the reasons.
Refs #10830
* ci(mcp): require the client schema engines on every code change (#10984)
* ci(mcp): require the client schema engines on every code change
Run scripts/verify-advertised-schemas.mjs at the end of the build job, after
its artifacts upload, with REA_REQUIRE_SCHEMA_ENGINES=1 so a missing engine
fails rather than passes. Go is the runner's toolchain; the Python engines
install into a virtual environment cached by the requirements file's digest
and interpreter version. Full qualification adds --complete.
Refs #10830
* test(ci): require the client schema engine step in code builds
* test(mcp): record a reviewable summary of the advertised catalog (#10985)
* test(mcp): record a reviewable summary of the advertised catalog
Commit scripts/verify/advertised-schemas/summary.json: each advertised
pattern with the tool schemas that carry it, and a digest of every tool's
schema per input or output profile. The advertised schema check compares it
with the packaged listings it already makes and fails on any difference,
printing lines such as '119 tool schemas gained pattern /.../', so a change
that reaches many tools at once is visible in review.
--update-summary regenerates it.
Refs #10830
* docs(release): check the packed catalog with client engines before publishing (#10986)
* docs(release): check the packed catalog with client engines before publishing
Add a pre-publish step to the release guide: install the packed candidate
into an empty prefix and run verify-advertised-schemas.mjs against it with
--package-root, requiring the RE2 (Go regexp and C++ RE2) and Rust (regex,
fancy-regex and jsonschema) engines. CI checks each commit's build; this
covers the archive that will be published.
Refs #10830
* docs(release): check the exact qualified archive and clean up afterwards
* test(mcp): regenerate the advertised catalog summary from current main
* feat(artifacts): name the integrity check for stable, selected and provider artifact sources
* fix(browser): keep the reader's integrity check on captured web read errors
* refactor(coverage): give the complete/partial/unknown status one owner and ratchet local completeness enums
* fix(verify): count chained local completeness enums and exclude detail levels
* fix(javascript): keep source-to-bundle coverage unknown when an input's coverage is unknown (#11162)
* fix(javascript): refuse member-mutation work beyond a fixed allowance
Member-mutation indexing retained every scheduled alias state until its query finished, with no bound on the phase. Conditional self-selections before one member write (#8294) multiplied those states until the worker heap was exhausted.
Charge each scheduled alias state to a per-phase work meter. Past 524,288 states the phase is refused with a resource_constraint that names the fixed work allowance. The application and web bundle workers carry the reported limit to the parent, which rebuilds the refusal with that allowance instead of heap advice.
Refs #8294#6127#6344#7170#7510#8298
* test(javascript): prove the member-mutation meter spans the phase
* refactor(cli): project core native commands with open_binary target options
A session target's opening fields may now be caller paths, admitted
resolved and passed on as the caller spelled them, and a union of text
forms such as the provider selector renders as one argv token.
nativeTarget declares a native executable opened with open_binary's
format, architecture, entry point and provider fields, plus the snapshot
where a command loads one. runDirectOnTarget runs an operation on that
target through runDirectAnalysis, with Evidence delivery when declared.
Eleven core native commands are now derived from their contracts. Their
inputs are admitted by the service's contract parse, which replaces the
CLI's copies of the byte-pattern and data-type selector checks.
inspect-native-dispatch-metadata now exposes the contract's Objective-C
class import address fields.
* fix(cli): read core native contracts from their contract groups so startup stays lazy
* refactor(cli): project procedure-references and inspect-native-api with named selector options (#10738)
* refactor(cli): project procedure-references and inspect-native-api with named selector options
A contract projection may let the caller give a positional selector with
a named option instead, for values that begin with a dash. The positional
becomes optional; equal values agree (native addresses by identity), and
different values, or neither for a required field, are refused before the
target is opened. selectCliAnalysisSelector owns that rule and returns a
Result; resolveCliAnalysisSelector remains for the hand-written core
binary commands.
procedure-references and inspect-native-api are now derived from their
contracts on the native session target, which completes the core native
family.
* fix(cli): refuse empty named and positional selectors before opening the target
* refactor(cli): project inspect, xrefs, trace, function and instructions from their contracts (#10747)
The five core binary commands are derived from their contracts on the
native session target with the snapshot option, using named selector
options for the procedure, address and query.
A selector projection may require a selector the contract lets the MCP
caller omit: xrefs' address defaults to Hopper's cursor, which a one-shot
CLI command does not have. A selector names one object, so neither
spelling may be empty, as before, even where the contract's text admits
it.
open_binary's pairing rules now refuse an unpaired --target-format,
--architecture or --entry-point for inspect before the target is opened,
naming the CLI key.
* fix(cli): read core binary contracts from their contract groups so startup stays lazy
* refactor(setup): take the platform in client configuration readers and the setup write path
ClientRegistrationEnvironment, ClientConfigurationFiles and SupportedClients take a required platform (before defaulted parameters). Setup's configure, inspect and alignment entry points take the setup host's platform and pass it through every layer read, ownership check and the Cordis serializer, which now aliases Windows environment names by the selected platform instead of the running host. Host file operations in ClientConfigPath, ClientConfigurationPublication, JsonFiles and rea mcp add read HOST_PLATFORM explicitly.
* fix(setup): keep private-profile modes on the host when setup selects another platform
