{ "schemaVersion": 1, "repository": "morluto/rea", "version": "6.5.0", "base": "a56f7bb668ab23fec8d33f7af353ac7ed2fe1895", "target": "cbc0e97c29b8dcb3d6ff96eb3af9e0f519a22345", "commits": [ { "sha": "0ecf3f2438ec96a6b543942869808018e8d84452", "subject": "perf(mcp): keep Playwright and type-only imports off MCP startup (#1691)", "body": "perf(mcp): keep Playwright and type-only imports off MCP startup (#1691)\n\n* fix(build): emit no runtime imports for type-only bindings\n\nUnder verbatimModuleSyntax, an import whose specifiers all carry inline\n`type` modifiers compiles to `import {} from \"...\"`, a side-effect import\nthat still resolves and evaluates the module. 78 compiled modules carried\none, including `import {} from \"playwright-core\"` in the browser scenario\nsession, which loaded Playwright's module graph at MCP startup.\n\nUse top-level `import type` for these bindings and enable oxlint's\ntypescript/no-import-type-side-effects rule so the pattern cannot return.\n\nRefs #1685\n\nCo-Authored-By: Claude Opus 5.5 \n\n* perf(mcp): load Playwright when a scenario launches, not at startup\n\nThe browser scenario and Electron active providers are constructed before\nthe stdio server serves, and both bound Playwright's launchers at module\nload. Resolve `chromium` and `_electron` from playwright-core when a\ncapture opens instead, as the web module resolver already does.\n\nMCP startup now resolves 1,312 modules (4,902 resolutions) instead of\n1,598 (6,076) before reading the first request, and no longer loads\nplaywright-core. Provider construction, the tool catalog, and capability\ninventory are unchanged.\n\nA boundary test spawns the stdio server, initializes, lists tools, and\nasserts playwright-core and isomorphic-git were not resolved; the CLI\nprobe now exercises the real launch path to prove detection.\n\nCloses #1685\n\nCo-Authored-By: Claude Opus 5.5 \n\n---------\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["a56f7bb668ab23fec8d33f7af353ac7ed2fe1895"], "authors": [ { "name": "Kaoru0822", "email": "aisakamimaki@gmail.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [1691] }, { "sha": "57c5acac2e13fd7f0e3832bc147c7ceda8c314f2", "subject": "docs(setup): confirm published 6.4.0 client support", "body": "docs(setup): confirm published 6.4.0 client support\n\nVerify all 17 automatic client IDs through isolated npm package dry runs and confirm the OpenCode configuration directory override. Replace obsolete npm 6.3.0 warnings with the verified release checkpoint.\n\nFixes #1650.\n", "parents": ["0ecf3f2438ec96a6b543942869808018e8d84452"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "4353089c670070ef918f88f7b131ed240feb83dd", "subject": "style(website): kbd, install-node width and nested collapsible indentation (#1699)", "body": "style(website): kbd, install-node width and nested collapsible indentation (#1699)\n\nStyle keys, cap the Get started Node.js help section at the lede\nwidth, and indent open .evidence-details content with a subtle left\nborder so nested collapsibles step in at any depth.\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["57c5acac2e13fd7f0e3832bc147c7ceda8c314f2"], "authors": [ { "name": "Kaoru0822", "email": "aisakamimaki@gmail.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [1699] }, { "sha": "13e03e94363a007353fcb5dfedec764de12fc927", "subject": "perf(evidence): fuse streamed JSON token handling (#1694)", "body": "perf(evidence): fuse streamed JSON token handling (#1694)\n\nFuse upstream JSON parsing, scalar packing, heap admission, and value assembly into synchronous token stages while retaining asynchronous file reads and existing capacity, cancellation, decoding, identity, and typed-error semantics. Declare stream-chain 4.2.6 directly.\n\nValidation: 30 focused tests; check:fast, Knip and formatting; actual Flameox paired full-content oracles; real Linux evidence replay and Windows source-built package/Ghidra snapshot recovery; final-head CI 31/31 success.\n\nRefs #1065, #1680.", "parents": ["4353089c670070ef918f88f7b131ed240feb83dd"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [1694] }, { "sha": "5f4c7ff6df0735d5a4461b5d0e6f2e466b888be0", "subject": "perf(tests): reuse stateless workflows and immutable fixtures", "body": "perf(tests): reuse stateless workflows and immutable fixtures\n", "parents": ["13e03e94363a007353fcb5dfedec764de12fc927"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "a82d14e4db4dca989ffa2e7dbe78fd43551da256", "subject": "perf(cli): defer command-specific modules until dispatch", "body": "perf(cli): defer command-specific modules until dispatch\n", "parents": ["5f4c7ff6df0735d5a4461b5d0e6f2e466b888be0"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "d3088c3795f6c37cb3b6aec0bb0c371dd0640ee8", "subject": "perf(javascript): reuse collected callable identities for returns", "body": "perf(javascript): reuse collected callable identities for returns\n", "parents": ["a82d14e4db4dca989ffa2e7dbe78fd43551da256"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "693ed332b58d05192f55b8192d2c0c4bc4f4824a", "subject": "perf(tests): remove timed output and synchronize browser fixtures", "body": "perf(tests): remove timed output and synchronize browser fixtures\n", "parents": ["d3088c3795f6c37cb3b6aec0bb0c371dd0640ee8"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "29ff887f6558cf00c0d6392889b890ed8a702a6f", "subject": "perf(domain): avoid duplicate readiness bundle validation", "body": "perf(domain): avoid duplicate readiness bundle validation\n\nAvoid reparsing the already validated Evidence bundle in readiness reports; retain semantic ID, graph and manifest authentication. Reuse canonical digest ownership and remove an unused verifier temporary directory.\n\nRefs #1065.", "parents": ["693ed332b58d05192f55b8192d2c0c4bc4f4824a"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [1707] }, { "sha": "01762b10c6a40370996e6dfa3a96ffcb27148f97", "subject": "perf(tests): consolidate TypeScript dialect producer checks", "body": "perf(tests): consolidate TypeScript dialect producer checks\n", "parents": ["29ff887f6558cf00c0d6392889b890ed8a702a6f"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "8be7ad496c9a52a9986c4d3f6596de279b52df7e", "subject": "docs(website): highlight the setup guide on the homepage (#1714)", "body": "docs(website): highlight the setup guide on the homepage (#1714)\n\nShow the hero's Setup guide link as a secondary button and add a link\nto the step-by-step setup guide under the Set up REA panel.\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["01762b10c6a40370996e6dfa3a96ffcb27148f97"], "authors": [ { "name": "Kaoru0822", "email": "aisakamimaki@gmail.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [1714] }, { "sha": "d9b4ae182d60dfd7fd5ba5bb539716413cbfdca6", "subject": "fix(native): retain failed command cleanup owners", "body": "fix(native): retain failed command cleanup owners\n\nRetain failed native command owners through both xcrun resolution and command capture. Retry all owned cleanup failures before new commands and after consumers join their launched work at close; preserve partial output and every resource diagnostic.\n\nRefs #740.", "parents": ["8be7ad496c9a52a9986c4d3f6596de279b52df7e"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [1713] }, { "sha": "91f6840c35e99e5f23612920d790a30d324ac115", "subject": "ci: parallelize native verification and share test artifacts", "body": "ci: parallelize native verification and share test artifacts\n", "parents": ["d9b4ae182d60dfd7fd5ba5bb539716413cbfdca6"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "966dc3acde2880a0f94b2658e2a02180d505cafa", "subject": "perf(evidence): reuse authenticated file snapshots during session import (#1721)", "body": "perf(evidence): reuse authenticated file snapshots during session import (#1721)\n\nSeal file-backed MCP imports at the session boundary while preserving mutable\nordinary file reads. Validate internally constructed ledger candidates directly\nwith the existing immutable bundle constructor.\n\nAssisted-by: Suika (gensokyo-skills:suika-scatter-gather-planning)", "parents": ["91f6840c35e99e5f23612920d790a30d324ac115"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [1721] }, { "sha": "3f4ea3218929baba0c30c2cb7eb7e7a829a1fc21", "subject": "ci: reduce macOS runner contention", "body": "ci: reduce macOS runner contention\n", "parents": ["966dc3acde2880a0f94b2658e2a02180d505cafa"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "092de8f4b336b537579bd48d7d30135b7114371d", "subject": "perf(snapshot): restore large legacy caches within live memory bounds", "body": "perf(snapshot): restore large legacy caches within live memory bounds\n\nStream legacy snapshot cache rows independently, authenticate complete Evidence once, and restore exact immutable payloads without assembling duplicate full graphs. Preserve the existing file format, provenance, resource admission, cancellation and cache export isolation.\n\nVerified through real Linux SDK MCP import of the original 83 MB Ghidra snapshot and full 41 MB bundle hash, actual Windows CLI/MCP PE recovery and the installed Windows large-file decoder boundary, focused tests and static checks.\n\nFixes #1680. Refs #1065.", "parents": ["3f4ea3218929baba0c30c2cb7eb7e7a829a1fc21"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [1716] }, { "sha": "e36c82becdd613787bcc59903f8b5fe14eb2f105", "subject": "fix(artifacts): preserve emitted ZIP entry identity", "body": "fix(artifacts): preserve emitted ZIP entry identity\n\nReject duplicate ZIP filenames before an emitted entry source lookup can be overwritten. Preserve valid repeated enumeration, case-distinct paths and typed inventory path failures.\n\nCloses #1725. Related: #1480.", "parents": ["092de8f4b336b537579bd48d7d30135b7114371d"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [1726] }, { "sha": "844fa52772c1533f7358a71a764da780503775a3", "subject": "fix(evaluation): authenticate delivered Evidence citations", "body": "fix(evaluation): authenticate delivered Evidence citations\n\nAuthenticate completed successful REA Evidence records for citation accounting and shared fixture grading. Preserve genuine structured and complete text-only delivery, including authenticated inventory substeps.\n\nCloses #1728.", "parents": ["e36c82becdd613787bcc59903f8b5fe14eb2f105"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [1734] }, { "sha": "21650455a9c90a26e725c3505a3c17054cc4516c", "subject": "fix(evidence): normalize unknown revisions and preserve mutation intent (#1733)", "body": "fix(evidence): normalize unknown revisions and preserve mutation intent (#1733)\n\nNormalize generated revision fields before hashing and retain complete typed\ncreation/update requests in a shared mutation Evidence producer. Keep imported\nrevision authentication and canonical persisted identity/digests unchanged.\n\nFixes #1723\nFixes #1724\n\nAssisted-by: Suika (gensokyo-skills:suika-scatter-gather-planning)", "parents": ["844fa52772c1533f7358a71a764da780503775a3"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [1733] }, { "sha": "81dc64e3cd13dc8bfcac8898386717ece9721da1", "subject": "fix(managed): distinguish .NET Standard targets from runtimes", "body": "fix(managed): distinguish .NET Standard targets from runtimes\n\nPreserve .NET Standard as an API compatibility target while leaving the runtime family unknown unless independent markers identify it. Keep real DLL metadata and existing runtime-marker precedence intact.\n\nCloses #1736.\n\nCo-authored-by: AC ", "parents": ["21650455a9c90a26e725c3505a3c17054cc4516c"], "authors": [ { "name": "Alex", "email": "ac1982@users.noreply.github.com", "user": { "login": "ac1982", "__typename": "User" } }, { "name": "AC", "email": "ac@fabtek.cn", "user": { "login": "ac1982", "__typename": "User" } } ], "pullRequests": [1743] }, { "sha": "062723e44e937c1e1df865e9ae16184b41e70ae8", "subject": "fix(browser): retain effective source-map response urls", "body": "fix(browser): retain effective source-map response urls\n\nPreserve source-map response identity and legacy omission, admit identities before body reading, and retain completed results and cleanup causes within the existing output budget. Price fixed envelopes once.\n\nCloses #1729.\nCloses #1738.\n\nCo-authored-by: allisaid ", "parents": ["81dc64e3cd13dc8bfcac8898386717ece9721da1"], "authors": [ { "name": "clyde", "email": "curruptdwastaken@gmail.com", "user": { "login": "evenafterallisaid", "__typename": "User" } } ], "pullRequests": [1742] }, { "sha": "6ff4d4a0500e5f9fb7601e1c5ae5dbbd85796d91", "subject": "docs: celebrate 80,000 GitHub stars 🎉 (#1752)", "body": "docs: celebrate 80,000 GitHub stars 🎉 (#1752)\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["062723e44e937c1e1df865e9ae16184b41e70ae8"], "authors": [ { "name": "Kaoru0822", "email": "aisakamimaki@gmail.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [1752] }, { "sha": "953a0ce5bd3a8b44051eb9c16d8c9a20cad29e7c", "subject": "docs(i18n): celebrate 80,000 GitHub stars in translated READMEs (#1758)", "body": "docs(i18n): celebrate 80,000 GitHub stars in translated READMEs (#1758)\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["6ff4d4a0500e5f9fb7601e1c5ae5dbbd85796d91"], "authors": [ { "name": "Kaoru0822", "email": "aisakamimaki@gmail.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [1758] }, { "sha": "e5699d23b173bbd0b68e3ab177d0b7583d6df345", "subject": "fix(mcp): cancel evidence imports before session mutation", "body": "fix(mcp): cancel evidence imports before session mutation\n\nPropagate request cancellation through immutable JSON bundle reading and\ncheck it before committing session state. Preserve failed-close ownership.\n\nFixes #1746\n\nAssisted-by: Suika (gensokyo-skills:suika-scatter-gather-planning)", "parents": ["953a0ce5bd3a8b44051eb9c16d8c9a20cad29e7c"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [1755] }, { "sha": "857a1b7b04da4488db2b224c270ad78998c6b6c7", "subject": "fix(process): aggregate incomplete trace-spec diagnostics", "body": "fix(process): aggregate incomplete trace-spec diagnostics\n\nSummarize incomplete trace-specification pair declarations with exact counts and the first undeclared pair. Preserve complete pair coverage, successful Evidence and independent validation errors; remove temporary pair-scan copies and sorting.\n\nCloses #1753.", "parents": ["e5699d23b173bbd0b68e3ab177d0b7583d6df345"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [1756] }, { "sha": "58e91e14bd5659dd57acbb91e56b5fc6a6963c80", "subject": "fix(setup): preserve unrelated Hermes YAML line formatting", "body": "fix(setup): preserve unrelated Hermes YAML line formatting\n\nPreserve unrelated long YAML scalars when editing an existing Hermes configuration.\n\nCo-authored-by: Zayd ", "parents": ["857a1b7b04da4488db2b224c270ad78998c6b6c7"], "authors": [ { "name": "zayd / cold", "email": "zaydkhan3@gmail.com", "user": { "login": "zaydiscold", "__typename": "User" } }, { "name": "Zayd", "email": "iam@zayd.wtf", "user": null } ], "pullRequests": [1754] }, { "sha": "713db4dc2665c964707cb0e937e8794cbe73534e", "subject": "fix(process): align capture Evidence provider admission", "body": "fix(process): align capture Evidence provider admission\n\nUse the canonical current and supported legacy process-provider rule for authenticated capture Evidence at both CLI and MCP admission boundaries. Preserve successful Evidence and distinguish provider input errors from digest authentication failures.\n\nCloses #1757.", "parents": ["58e91e14bd5659dd57acbb91e56b5fc6a6963c80"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [1760] }, { "sha": "6d5d71fab5e135c687f7aa2f797da19b4c2a1c1e", "subject": "fix(javascript): index repeated graph observations before final sorting", "body": "fix(javascript): index repeated graph observations before final sorting\n\nRetain stable live nodes and observation arrays while avoiding quadratic\ncollection rebuilds. Preserve duplicate handling and canonical output.\n\nFixes #1748\n\nAssisted-by: Suika (gensokyo-skills:suika-scatter-gather-planning)", "parents": ["713db4dc2665c964707cb0e937e8794cbe73534e"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [1759] }, { "sha": "cf692072b56903b60426e4b301b3c48fd31ee0fd", "subject": "fix(ida): declare GUI navigation for attached legacy analysis (#1764)", "body": "fix(ida): declare GUI navigation for attached legacy analysis (#1764)\n\nAttached IDA mode always uses the legacy 1.4 producer, whose\ndisassemble_function jumps to the function and whose decompile_function\nopens or reuses a pseudocode view whenever an IDA window is active.\nSession discovery still advertised may_show_ui: false for every\noperation.\n\nDeclare the UI effect for the attached operations that reach those\ntools: pseudocode, assembly, raw function instructions and the function\ndossier. Headless operations and the other attached operations keep\nfalse. A conformance check now compares each declaration with the\nupstream tools the operation actually calls.\n\nFixes #1712\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["6d5d71fab5e135c687f7aa2f797da19b4c2a1c1e"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [1764] }, { "sha": "e8528cedcdfb1ca1d769304afdc353936e8e0d70", "subject": "fix(hopper): let failed one-shot commands exit while retaining a lease (#1763)", "body": "fix(hopper): let failed one-shot commands exit while retaining a lease (#1763)\n\n* fix(hopper): let failed one-shot commands exit while retaining a lease\n\nA Hopper target lease retained after unconfirmed cleanup kept its\nlistening socket referenced, so a one-shot CLI emitted its final\ncleanup_incomplete result but never exited, and its live lease rejected\nevery retry for the same target as already open.\n\nUnreference the lease listener. A live MCP process still holds the\nlease for as long as it runs; a completed CLI exits with status 1, and\nthe stale socket it leaves is recovered by the next acquirer.\n\nFixes #1751\n\nCo-Authored-By: Claude Opus 5.5 \n\n* test(hopper): remove only this test's stale lease sockets\n\nCo-Authored-By: Claude Opus 5.5 \n\n---------\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["cf692072b56903b60426e4b301b3c48fd31ee0fd"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [1763] }, { "sha": "40b37aeee10e89d85ee8b7747cbdcd3ad1a34db4", "subject": "ci: balance test shards and reuse package download caches", "body": "ci: balance test shards and reuse package download caches\n", "parents": ["e8528cedcdfb1ca1d769304afdc353936e8e0d70"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "4daea941bfeeb426886f2d048aed7f3cb2dbf97b", "subject": "fix(cli): retry retained browser scenario cleanup", "body": "fix(cli): retry retained browser scenario cleanup\n\nRetry retained browser scenario cleanup before the one-shot CLI exits. Preserve primary failures, partial observations and completed Evidence when shutdown fails.\n\nCloses #1771.", "parents": ["40b37aeee10e89d85ee8b7747cbdcd3ad1a34db4"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [1773] }, { "sha": "914ba833ded5f8604345de4e4f6d306de0a38c4e", "subject": "fix(javascript): report JSON status for imported package manifests", "body": "fix(javascript): report JSON status for imported package manifests\n\nUse the existing JSON-text status checker for explicit package.json imports while retaining separate package-metadata validity. Preserve malformed/unavailable status and partial facts after cancellation.\n\nCo-authored-by: Immanuel Tikhonov <122638311+immanuwell@users.noreply.github.com>", "parents": ["4daea941bfeeb426886f2d048aed7f3cb2dbf97b"], "authors": [ { "name": "Immanuel Tikhonov", "email": "122638311+immanuwell@users.noreply.github.com", "user": { "login": "immanuwell", "__typename": "User" } } ], "pullRequests": [1740] }, { "sha": "ae95e68ba5fa95cf2ec0453b50ffd217cabf5359", "subject": "fix(apktool): run Windows batch launchers through cmd.exe (#1777)", "body": "fix(apktool): run Windows batch launchers through cmd.exe (#1777)\n\nOn Windows, Node refuses to spawn .bat and .cmd files without a shell\n(CVE-2024-27980), so REA_APKTOOL_COMMAND pointing at Chocolatey's\napktool.bat or a java -jar wrapper failed its version probe with EINVAL,\nreported as \"did not report a usable version\".\n\nMove Ghidra's conservative cmd.exe invocation (no AutoRun, no delayed\nexpansion, every token quoted, interpreter metacharacters rejected) into\nsrc/process/WindowsBatchCommand.ts. Ghidra keeps its error type, wording\nand length limit. apktool now uses it for both the version probe and the\ndecode run when the launcher is a batch file on Windows. A launcher that\ncmd.exe would reinterpret reports launcher_unsupported (not_configured)\nwith remediation instead of version_unresolved.\n\nFixes #1774\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["914ba833ded5f8604345de4e4f6d306de0a38c4e"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [1777] }, { "sha": "a4dd4e8e8700ce350e1a0c612ebd61b91ca5e585", "subject": "perf(cli): defer command-specific analysis implementations", "body": "perf(cli): defer command-specific analysis implementations\n\nLoad application and Electron workflow implementations only when their commands execute. Keep command schemas and catalog registration eager, and extend the startup import boundary to cover the deferred services.\n", "parents": ["ae95e68ba5fa95cf2ec0453b50ffd217cabf5359"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "ff57b75e226028767b86aa3d4271c2c2f56342db", "subject": "test: bound CLI validation subprocess concurrency", "body": "test: bound CLI validation subprocess concurrency\n\nRun the 22 malformed process scenarios in pairs instead of starting 22 compiled CLI runtimes simultaneously. Retain every CLI/MCP error assertion and the no-launch check, and document nested subprocess limits.\n", "parents": ["a4dd4e8e8700ce350e1a0c612ebd61b91ca5e585"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "a2d3338e90a3a11385e2f63bedaa9750612f8719", "subject": "feat(website): add multilingual editions and translation workflow", "body": "feat(website): add multilingual editions and translation workflow\n", "parents": ["ff57b75e226028767b86aa3d4271c2c2f56342db"], "authors": [ { "name": "N0zoM1z0", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [1779] }, { "sha": "a956275d8d0249c16dad282a3fb5d7da48fb2d6f", "subject": "fix(website): clarify translated terminology and RTL flows", "body": "fix(website): clarify translated terminology and RTL flows\n", "parents": ["a2d3338e90a3a11385e2f63bedaa9750612f8719"], "authors": [ { "name": "N0zoM1z0", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [1779] }, { "sha": "d981a58d7f5344c3ab2117b6384aece4d1c35480", "subject": "fix(website): incorporate multilingual contributor refinements", "body": "fix(website): incorporate multilingual contributor refinements\n\nAdapt CJK font stacks, original copy-button label restoration, accessibility wording and Traditional Chinese onboarding improvements from PR #1737. Protect the complete APK filename and correct setup terminology.\n\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>\n", "parents": ["a956275d8d0249c16dad282a3fb5d7da48fb2d6f"], "authors": [ { "name": "N0zoM1z0", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } } ], "pullRequests": [1779] }, { "sha": "c9136eef716aa8d32e0301189fbf5a511ff62d5d", "subject": "fix(docs): validate translated README website destinations", "body": "fix(docs): validate translated README website destinations\n\nUse the website language inventory when comparing README links. Accept the matching localized page while retaining checks for wrong locales, changed destinations, fragments and query parameters.\n", "parents": ["d981a58d7f5344c3ab2117b6384aece4d1c35480"], "authors": [ { "name": "N0zoM1z0", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [1779] }, { "sha": "6e38529333a7a0704690a087c7cb054fb7385d25", "subject": "test(docs): type README drift scenarios as fixed pairs", "body": "test(docs): type README drift scenarios as fixed pairs\n", "parents": ["c9136eef716aa8d32e0301189fbf5a511ff62d5d"], "authors": [ { "name": "N0zoM1z0", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [1779] }, { "sha": "0bdc7a40ac171a05971b287f2aab0376e2f14358", "subject": "fix(ida): wait out a transient busy worker health in headless sessions (#1778)", "body": "fix(ida): wait out a transient busy worker health in headless sessions (#1778)\n\n* test(ida): expect a transient busy worker health to be waited out\n\n* fix(ida): wait out a transient busy worker health before reading identity\n\n* docs(ida): record the verified macOS arm64 headless workflow and the busy-health wait\n\n* test(ida): pin the busy wait deadline, cause and reported tool, and assert clean release\n\n* fix(ida): repeat only a tool-name-shaped busy tool and keep the wait in its own module\n\n* test(ida): drive the busy wait with a virtual clock and pin its bound and cancellation\n\n* fix(ida): stop the busy wait at its deadline without another read and honour a late abort\n\n* docs(ida): state when the busy wait times out, cancels or reports an unknown tool", "parents": ["6e38529333a7a0704690a087c7cb054fb7385d25"], "authors": [ { "name": "Mykola Dementiev", "email": "nikolay-dementiev@users.noreply.github.com", "user": { "login": "nikolay-dementiev", "__typename": "User" } } ], "pullRequests": [1778] }, { "sha": "aaeadf2d4c4e3f0d0581af2dca33c5bfdc2bcb0e", "subject": "fix(cli): await browser scenario cleanup on interrupts", "body": "fix(cli): await browser scenario cleanup on interrupts\n\nTranslate browser scenario CLI interrupts into cancellation and await owned provider cleanup. Preserve authenticated observations and cancelled steps with conventional exit codes 130/143.\n\nRefs #1771.", "parents": ["0bdc7a40ac171a05971b287f2aab0376e2f14358"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [1780] }, { "sha": "42951bbbbe8d98ebde1783450d130fdddb5ba889", "subject": "test: reuse identical JavaScript analysis fixtures", "body": "test: reuse identical JavaScript analysis fixtures\n", "parents": ["aaeadf2d4c4e3f0d0581af2dca33c5bfdc2bcb0e"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "85ccef34de1cddcf71037ccea93acdf709f94965", "subject": "test: reuse validators for identical MCP schemas", "body": "test: reuse validators for identical MCP schemas\n", "parents": ["42951bbbbe8d98ebde1783450d130fdddb5ba889"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "817aef406861c2ce3f87ad3c912ea6c235bcdf12", "subject": "fix(apple): validate build-version tool records within cmdsize (#1784)", "body": "fix(apple): validate build-version tool records within cmdsize (#1784)", "parents": ["85ccef34de1cddcf71037ccea93acdf709f94965"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [1784] }, { "sha": "e365f3715f0e9856218f0b2878bfe2144c821d9a", "subject": "fix(javascript): bound self-alias mutation paths that never prune", "body": "fix(javascript): bound self-alias mutation paths that never prune\n\nDetect unprunable repeated self-alias prefixes at the JavaScript mutation owner, record conservative escape effects, and reuse settled repeated-prefix checks. Preserve finite-path precision and deeper-write uncertainty.\n\nRefs #1665.\n\nCo-authored-by: Martin Klein <36695017+flitzrrr@users.noreply.github.com>", "parents": ["817aef406861c2ce3f87ad3c912ea6c235bcdf12"], "authors": [ { "name": "Martin Klein", "email": "36695017+flitzrrr@users.noreply.github.com", "user": { "login": "flitzrrr", "__typename": "User" } } ], "pullRequests": [1767] }, { "sha": "e4027e4afccc6316cd9cfc27c7b0427e66ceb91f", "subject": "feat(update): update Bun global installations (#1735)", "body": "feat(update): update Bun global installations (#1735)\n\n* feat(update): update Bun global installations\n\n`rea update` only recognized npm global installations and looked up\nreleases with `npm view`, so a `bun add --global rea-agents` install on a\nmachine without npm failed with `spawn npm ENOENT`.\n\nDetect the running package inside Bun's global directory\n(BUN_INSTALL_GLOBAL_DIR, $BUN_INSTALL/install/global,\n$XDG_CACHE_HOME/.bun/install/global, ~/.bun/install/global), resolve the\nlatest release with `bun info`, install with\n`bun add --global --ignore-scripts`, then verify the installed entry point\nand plan integration maintenance exactly as for npm.\n\nBun commands run inside the owning global directory with\nBUN_INSTALL_GLOBAL_DIR pinned, so the caller's current project is never\nselected. A global directory without package.json is not treated as an\nowned installation: Bun then installs into the nearest ancestor project.\nnpm installations keep their existing commands and messages.\n\n* fix(update): gate Bun self-updates on supported CLI versions\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["e365f3715f0e9856218f0b2878bfe2144c821d9a"], "authors": [ { "name": "xeropresence", "email": "3128949+xeropresence@users.noreply.github.com", "user": { "login": "xeropresence", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [1735] }, { "sha": "6bcfeb0e55a6fcc3ed586e5744f2aa1c270cac31", "subject": "test(cli): cache subprocess compilation within each worker", "body": "test(cli): cache subprocess compilation within each worker\n", "parents": ["e4027e4afccc6316cd9cfc27c7b0427e66ceb91f"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "262efe6c54d8f179e9f9515d96025871ae45806a", "subject": "test(native): skip the DMG EACCES diagnostic as root (#1584)", "body": "test(native): skip the DMG EACCES diagnostic as root (#1584)", "parents": ["6bcfeb0e55a6fcc3ed586e5744f2aa1c270cac31"], "authors": [ { "name": "Aravind Rao", "email": "135997804+rekcilyssup@users.noreply.github.com", "user": { "login": "rekcilyssup", "__typename": "User" } } ], "pullRequests": [1584] }, { "sha": "41544fb952aef84fcf6ff5d9a5284cf2b2985053", "subject": "perf(javascript): skip the repeated-prefix scan on first capture visits (#1789)", "body": "perf(javascript): skip the repeated-prefix scan on first capture visits (#1789)\n\nReview follow-up. Only a capture already on the alias chain can repeat a prefix, so a first visit no longer slices and serializes every suffix of its path.", "parents": ["262efe6c54d8f179e9f9515d96025871ae45806a"], "authors": [ { "name": "Martin Klein", "email": "36695017+flitzrrr@users.noreply.github.com", "user": { "login": "flitzrrr", "__typename": "User" } } ], "pullRequests": [1789] }, { "sha": "e90acaea674f5f7f9f17ea472104afdc1422ada6", "subject": "fix(update): resolve Bun global directories before changing cwd", "body": "fix(update): resolve Bun global directories before changing cwd\n", "parents": ["41544fb952aef84fcf6ff5d9a5284cf2b2985053"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "044c0a92d5c86faa9965669680935d4f552977b1", "subject": "test: reuse application analysis across comparison directions", "body": "test: reuse application analysis across comparison directions\n\nReuse immutable source graphs for both export comparison orientations and obtain rest-argument seeds from the existing public CLI Evidence. Retain all direction-specific assertions while removing nine repeated application analyses.\n\nValidation: 75 focused tests; covered locations and hit status unchanged across all 1137 source files in controlled before/after coverage runs. Comparison file execution fell from 19.2s to 15.3s locally. Static and generated-document checks passed.\n", "parents": ["e90acaea674f5f7f9f17ea472104afdc1422ada6"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "8fa11751eaab94eaa5b8de8c1ecd143ef0066cd6", "subject": "ci: reuse portable build cache in native package jobs", "body": "ci: reuse portable build cache in native package jobs\n\nTransfer the build job Turbo cache to the four native package runners within the same workflow. Keep the normal build, prepack, pack, fresh installation, updater, and Inspector verification commands. Native artifacts and dependencies remain host-local.\n\nValidation: actionlint 1.7.7, check:ci and docs:check passed. A fresh independent checkout restored 1124 byte-identical files from 1.64 MB of compile/skills cache in 163 ms; a source change invalidated compile and skills entries. Full package and real Node Inspector verifiers passed on macOS arm64. Cross-platform CI timing remains to be measured.\n", "parents": ["044c0a92d5c86faa9965669680935d4f552977b1"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "a077e81becd430708e8e273484c503108c5613db", "subject": "chore(scripts): merge duplicate node:fs import in scan-todos (#1790)", "body": "chore(scripts): merge duplicate node:fs import in scan-todos (#1790)\n\nUpdate scan-todos.mjs", "parents": ["8fa11751eaab94eaa5b8de8c1ecd143ef0066cd6"], "authors": [ { "name": "Nik1313132", "email": "156576604+Nik1313132@users.noreply.github.com", "user": { "login": "Nik1313132", "__typename": "User" } } ], "pullRequests": [1790] }, { "sha": "ce845ba428e9b23d6b74eae1e25e17c37532adac", "subject": "fix(javascript): preserve and resolve complete source-map URLs (#1788)", "body": "fix(javascript): preserve and resolve complete source-map URLs (#1788)\n\nKeep line-comment URL declarations intact and percent-decode local URL paths\nonce, preserving raw Evidence identity and artifact-root confinement.\n\nFixes #1781. Fixes #1782.\n\nAssisted-by: Suika (gensokyo-skills:suika-scatter-gather-planning)", "parents": ["a077e81becd430708e8e273484c503108c5613db"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [1788] }, { "sha": "12c416005f9d2abf438f4df4447972424d781b65", "subject": "feat(javascript): recover code-split bundles from multiple inputs (#1686)", "body": "feat(javascript): recover code-split bundles from multiple inputs (#1686)\n\n* feat(javascript): recover code-split bundles from multiple inputs\n\nrecover_javascript_sources accepted a single path, and\nvalidateModuleSet bound every module's provenance to that one snapshot.\nA code-split app (runtime + chunks, or an Electron main/preload/renderer\nset) had to be recovered one file per call, and modules recovered alone\ncould not resolve imports across chunks: cross-chunk require(id)\nreferences stayed as numeric ids with property reads.\n\nAdd an optional additional_paths input. The listed files are\nconcatenated, in order after path, into the single engine snapshot, so\none Wakaru run sees every module and cross-chunk imports resolve.\nvalidateModuleSet's single-snapshot binding is unchanged. Module\nprovenance is attributed back to the input file its first extraction\nrange starts in, with byte ranges rebased to that file's own offsets;\na module whose ranges cross an input boundary keeps the concatenated\nsnapshot identity and offsets, recorded as an explicit limitation.\nSingle-path behavior is byte-for-byte unchanged (one segment,\noffset 0).\n\nFixes #1605\n\n* fix(javascript): preserve source identity in multi-input recovery\n\n---------\n\nCo-authored-by: JingHao-Leon \nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["ce845ba428e9b23d6b74eae1e25e17c37532adac"], "authors": [ { "name": "JingHao-Leon", "email": "102573344+JingHao-Leon@users.noreply.github.com", "user": { "login": "JingHao-Leon", "__typename": "User" } }, { "name": "JingHao-Leon", "email": "w15909130000@gmail.com", "user": null }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [1686] }, { "sha": "a00c34dcb155e5993bda8ad0f51bf3b13e289760", "subject": "ci: reuse portable Turbo outputs across verification runs", "body": "ci: reuse portable Turbo outputs across verification runs\n", "parents": ["12c416005f9d2abf438f4df4447972424d781b65"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "847a1a3f25f69e1b3808fb0a53e5f1415a7ed058", "subject": "test: share native keyed archive integer fixture generation", "body": "test: share native keyed archive integer fixture generation\n", "parents": ["a00c34dcb155e5993bda8ad0f51bf3b13e289760"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "3ad5782dfdc8864879a887dc63fef682ffeb5839", "subject": "fix(javascript): honor package exports before sibling files", "body": "fix(javascript): honor package exports before sibling files\n\nResolve package exports before sibling-file fallback, preserve explicit export blocking, and retain precise CommonJS package self-reference behavior and caller provenance.\n\nFixes #1761.\n\nCo-authored-by: Yann Roberto <165009858+shoyann@users.noreply.github.com>", "parents": ["847a1a3f25f69e1b3808fb0a53e5f1415a7ed058"], "authors": [ { "name": "Yann Roberto", "email": "165009858+shoyann@users.noreply.github.com", "user": { "login": "shoyann", "__typename": "User" } } ], "pullRequests": [1762] }, { "sha": "951c2aae3be1c357df9f23558d8c09680e64c2cb", "subject": "fix(native): raise default PE resource entry budget to 16384 (#1703)", "body": "fix(native): raise default PE resource entry budget to 16384 (#1703)\n\ninspect-pe-resources rejected stock Windows resource images because their\ntables exceed the 4096-entry default. Windows 11 25H2 SystemResources\nmeasures imageres.dll.mun at 6476 examined entries, shell32.dll.mun at 5903\nand wmploc.DLL.mun at 5440, so the default budget now admits each of them\nwith headroom while the maximum stays 65536. The independent 8 MiB metadata\nbudget still bounds allocation, and exceeding any budget still fails without\npartial results.\n\nThe stable filesystem boundary test now emits a 6476-entry table through a\nlarger fixture section and asserts that the default budgets report complete\ncoverage, covering stock-image scale without a real Windows file.", "parents": ["3ad5782dfdc8864879a887dc63fef682ffeb5839"], "authors": [ { "name": "Jason Cat", "email": "jasonbuildai@gmail.com", "user": { "login": "JasonBuildAI", "__typename": "User" } } ], "pullRequests": [1703] }, { "sha": "ba7df3f0f7ee63e6350d5fbdddc8ed945a6b141d", "subject": "perf(ci): share bytecode across fresh Apple artifact subprocesses", "body": "perf(ci): share bytecode across fresh Apple artifact subprocesses\n", "parents": ["951c2aae3be1c357df9f23558d8c09680e64c2cb"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "40d9c7b836a3aca5d589c0a65c7d02b3ea5cd36b", "subject": "test(native): skip the EACCES directory diagnostic as root (#1394)", "body": "test(native): skip the EACCES directory diagnostic as root (#1394)\n\nRoot bypasses the mode-0 file permission this test relies on, so\ninventory succeeds and the expected EACCES failure never occurs. Match\nthe root guard used by the other permission-dependent boundary tests.\n\n\nClaude-Session: https://claude.ai/code/session_01XPY2GmufMNGQKoEgRUx1pd\n\nCo-authored-by: Claude ", "parents": ["ba7df3f0f7ee63e6350d5fbdddc8ed945a6b141d"], "authors": [ { "name": "Marnix Pluim", "email": "marnixjaap@gmail.com", "user": { "login": "marnixpluim", "__typename": "User" } }, { "name": "Claude", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [1394] }, { "sha": "3a17882cc469515e562df9ecc7d154f30a5a9205", "subject": "fix(javascript): retain unbound CommonJS semantic imports", "body": "fix(javascript): retain unbound CommonJS semantic imports\n\nCollect unbound literal CommonJS dependencies at the semantic module-link owner, retain null binding names and source provenance, and avoid duplicate links for calls already represented by bindings or re-exports. Preserve distinct nested calls, shadowing exclusions, dynamic binding uncertainty, and existing static asset references.\n\nFixes #1793.", "parents": ["40d9c7b836a3aca5d589c0a65c7d02b3ea5cd36b"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [1799] }, { "sha": "d412def7225a556e6d2140176dc9ab4bd34af0f3", "subject": "fix(setup): register a stable launcher when run through bunx (#1731)", "body": "fix(setup): register a stable launcher when run through bunx (#1731)\n\nSetup run through bunx or bun x registered the bin inside bun's temporary\npackage cache. Detect bun's package-runner launch from npm_command=exec\nwith a bun user agent and register the pinned bunx launcher, wrapped in\ncmd.exe on Windows like the npx launcher. Doctor, update maintenance and\nuninstall recognize it as REA-owned, and setup's printed commands name\nthe runner that launched it.\n\nRead the runner variables case-insensitively on Windows, where the CLI\nenvironment snapshot upper-cases variable names and setup run through\nnpx also fell back to the cache path.\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["3a17882cc469515e562df9ecc7d154f30a5a9205"], "authors": [ { "name": "xeropresence", "email": "3128949+xeropresence@users.noreply.github.com", "user": { "login": "xeropresence", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [1731] }, { "sha": "66c21572defc97fe277cad49d3173bd4073d1f58", "subject": "fix(bun): report the real runtime and enforce worker memory budgets on Windows (#1730)", "body": "fix(bun): report the real runtime and enforce worker memory budgets on Windows (#1730)\n\n* fix(bun): report the real runtime and enforce worker memory budgets on Windows\n\nUnder Bun, REA recorded Node/V8 identity it did not observe and its JavaScript helper processes ran without a memory bound, because Bun ignores the V8 heap flags REA passes. Source-map trace Evidence claimed runtime node-v8 with Bun's synthetic V8 heap limit (the decoder then rejected that limit, so trace_web_source_location always failed), analysis resource failures reported heap limits Bun does not enforce, the HAR decoder claimed a fixed 192 MiB heap, and doctor reported Bun's Node.js compatibility version as the Node version.\n\nIdentify the runtime once from process.versions. Source-map reports record id bun with the Bun and Node.js compatibility versions and a null v8_heap_limit_bytes; the decoder checks the heap budget only for V8 reports and rejects a report from a runtime other than the launching one. The analysis worker reports a null heap limit under Bun, HAR limitations and failures omit heap sizes under Bun, and the doctor node check reports Bun and passes when its Node.js compatibility version is supported.\n\nOn Windows under Bun, each helper's owned Job Object now carries a commit limit of its heap budget plus a measured 512 MiB Bun runtime reserve (704 MiB for the codec and HAR decoder, 1536 MiB for the default analyzer). The native addon accepts an optional page-aligned job memory limit on process_spawn, verifies it by readback, associates a private completion port before the child is created, and reports a sticky memoryLimitReached and peak job commit on each poll; inspect reports jobMemoryLimit. A requested limit with an artifact lacking the control refuses the launch, and non-Windows launchers refuse a limit.\n\nReaching the limit is classified by the job notification rather than Bun's exit status: the analyzer fails the current source with a memory resource failure reporting worker_process_memory_limit_bytes, the codec returns a memory resource failure, and the HAR decoder returns its memory failure with process_memory_limit_bytes. Bun source-map Evidence records process_memory_limit_bytes, verified against the launcher. Node.js launches and outputs are unchanged.\n\n* fix(windows): drain memory notifications after observing exit\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["d412def7225a556e6d2140176dc9ab4bd34af0f3"], "authors": [ { "name": "xeropresence", "email": "3128949+xeropresence@users.noreply.github.com", "user": { "login": "xeropresence", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [1730] }, { "sha": "ed084b3dbb13ec9dee1adc8f5b76e784b52c00bb", "subject": "fix(process): observe already-due trailing callbacks before settling the capture journal (#1700)", "body": "fix(process): observe already-due trailing callbacks before settling the capture journal (#1700)\n\nA stalled event loop can leave the settle wake-up and a trailing observation\ncallback due at the same resume. The earlier wake-up runs first, declares\nsilence, and the capture becomes immutable before the trailing callback\nappends its observation.\n\nDrain the loop turn after the quiet sleep so timer and poll callbacks that\nwere already due run before silence is judged, and cover the stalled-loop\ncase with a deterministic regression test.\n\nFixes #1697", "parents": ["66c21572defc97fe277cad49d3173bd4073d1f58"], "authors": [ { "name": "Jason Cat", "email": "jasonbuildai@gmail.com", "user": { "login": "JasonBuildAI", "__typename": "User" } } ], "pullRequests": [1700] }, { "sha": "0153b4d95bdf38eddee91d5ce08181030fb955b4", "subject": "perf(test): batch compatible client profile lifecycles", "body": "perf(test): batch compatible client profile lifecycles\n\nKeep individual dry-run and scoped doctor checks for all eight profile cases. Share approved setup, idempotency, and uninstall for compatible roots; isolate Devin XDG and default OpenCode environments.\n\nReduce fresh CLI launches from 41 to 26. A bounded Flameox comparison measured 16.3s before and 12.0s after. All 40 focused client tests, static checks, and test discovery pass.\n", "parents": ["ed084b3dbb13ec9dee1adc8f5b76e784b52c00bb"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "e4407dbed5dc24851f47532f5e3d75d5627d3e7d", "subject": "feat(ghidra): admit bounded PSP ELF through installed Allegrex (#1599)", "body": "feat(ghidra): admit bounded PSP ELF through installed Allegrex (#1599)\n\n* feat(ghidra): admit bounded PSP ELF through installed Allegrex\n\nBuild on merged generic MIPS without weakening its policy. Bind caller-installed processor files into the analysis profile, check them again before launch, force and verify PSP language selection, retain limitations, and extend the public CLI/MCP verifier with source-owned PSP and target-switching checks. Local actual focused Vitest: 102 passed, one existing permission skip. Hosted static and real-provider results are pending.\n\n* fix(ghidra): validate PSPSDK ABI records in PSP admission\n\n* test(ghidra): bind PSP ABI verification to snapshot profiles\n\n* test(ghidra): declare independent PSP ABI reader contract\n\n* test(ghidra): retain the PSP fixture discriminated type\n\n* test(ghidra): contextually type PSP metadata as the MIPS target variant\n\n* test(ghidra): keep carved firmware checks scoped to generic MIPS fixtures\n\n* style(ghidra): format PSP language-override guard\n\n* style(test): format PSP language override regressions\n\n* fix(ghidra): bound PSP extension enumeration before allocation\n\n---------\n\nCo-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["0153b4d95bdf38eddee91d5ce08181030fb955b4"], "authors": [ { "name": "Jay-Alexander Elliot", "email": "10952625+jaelliot@users.noreply.github.com", "user": { "login": "jaelliot", "__typename": "User" } }, { "name": "github-actions[bot]", "email": "41898282+github-actions[bot]@users.noreply.github.com", "user": { "login": "github-actions[bot]", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [1599] }, { "sha": "ffaf2c12f1793c7c451e66dc09c3074544a4c086", "subject": "feat(wasm): inspect local artifacts with WABT (#1533)", "body": "feat(wasm): inspect local artifacts with WABT (#1533)\n\n* feat(wasm): inspect local artifacts with WABT\n\n* fix(wasm): preserve custom names and failed cleanup ownership\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["e4407dbed5dc24851f47532f5e3d75d5627d3e7d"], "authors": [ { "name": "Thang Luu", "email": "thangldw@gmail.com", "user": { "login": "thangldw", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [1533] }, { "sha": "2e223300375101558f90b6e78ef9612c55626673", "subject": "fix(build): preserve resource controls in strict Turbo tasks (#1809)", "body": "fix(build): preserve resource controls in strict Turbo tasks (#1809)", "parents": ["ffaf2c12f1793c7c451e66dc09c3074544a4c086"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [1809] }, { "sha": "031d7781f0f6c99e5f14e67f56cb89a88d6af3eb", "subject": "fix(build): preserve LF text checkouts on Windows (#1807)", "body": "fix(build): preserve LF text checkouts on Windows (#1807)\n\nPin text checkouts to LF so Git for Windows with core.autocrlf=true\ndoes not make the repository formatting gate fail on a clean clone.\nKeep command fixtures in CRLF and retain automatic binary detection.", "parents": ["2e223300375101558f90b6e78ef9612c55626673"], "authors": [ { "name": "CmsChase", "email": "haoran20100322@outlook.com", "user": { "login": "CmsChase", "__typename": "User" } } ], "pullRequests": [1807] }, { "sha": "cdd9fe716774c9e5abd121b70e9fd5e1eb91d2b8", "subject": "feat(native): expose typed incoming references at exact addresses (#1715)", "body": "feat(native): expose typed incoming references at exact addresses (#1715)", "parents": ["031d7781f0f6c99e5f14e67f56cb89a88d6af3eb"], "authors": [ { "name": "Arthas", "email": "29607505+bugstan@users.noreply.github.com", "user": { "login": "bugstan", "__typename": "User" } } ], "pullRequests": [1715] }, { "sha": "a8a9c4d8173b63fb42d343a8ca043927970ea4ce", "subject": "fix(mcp): express inspect_analysis_view selector constraints in the contract schema (#1705)", "body": "fix(mcp): express inspect_analysis_view selector constraints in the contract schema (#1705)\n\nThe item view advertised its four selector alternatives independently of the\nselected collection, while collection-specific constraints lived only in a\nsuperRefine that does not survive JSON Schema conversion. Clients validating\nagainst tools/list could not discover that modules accept only path/node_id\nand sections/symbols accept only index/name.\n\nReplace the refined object with a discriminated union on collection so the\nconverted draft-2020-12 schema rejects the same combinations the MCP server\nrejects. Runtime selection semantics are unchanged.\n\nFixes #1695\n\nCo-authored-by: Saim Shafique ", "parents": ["cdd9fe716774c9e5abd121b70e9fd5e1eb91d2b8"], "authors": [ { "name": "Saim Shafique", "email": "msaimshafique4664@gmail.com", "user": { "login": "sx4im", "__typename": "User" } }, { "name": "Saim Shafique", "email": "sx4imm@gmail.com", "user": null } ], "pullRequests": [1705] }, { "sha": "0a6b46d5b0299f76c0d268f7b70395f9b6fbd68e", "subject": "test(ci): stabilize JADX recovery and ignore generated reports (#1668)", "body": "test(ci): stabilize JADX recovery and ignore generated reports (#1668)", "parents": ["a8a9c4d8173b63fb42d343a8ca043927970ea4ce"], "authors": [ { "name": "You Wish", "email": "29498139+Y0UW1SH@users.noreply.github.com", "user": { "login": "Y0UW1SH", "__typename": "User" } } ], "pullRequests": [1668] }, { "sha": "b2da21abe11ac43a4cc24b233bd52ce10995e4a1", "subject": "test(evidence): cover workflow question whitespace normalization (#1739)", "body": "test(evidence): cover workflow question whitespace normalization (#1739)", "parents": ["0a6b46d5b0299f76c0d268f7b70395f9b6fbd68e"], "authors": [ { "name": "林桉", "email": "161032298+014-code@users.noreply.github.com", "user": { "login": "014-code", "__typename": "User" } } ], "pullRequests": [1739] }, { "sha": "f2150eb9a7ed76748238009ca6666efa52de5271", "subject": "feat(harmony): project HarmonyOS package inventory evidence (#1447)", "body": "feat(harmony): project HarmonyOS package inventory evidence (#1447)\n\n* feat(harmony): project HarmonyOS package inventory evidence\n\nFirst HarmonyOS increment from #1431: HAP, HSP, and App Pack roots are\nclassified through the hardened ZIP reader and projected into an\nexecution-free application graph with packaging-model hints, exact\ncomponent paths and hashes, App Pack children by path, runtime-family\nhints, and path-based N-API bridge hypotheses. HarmonyOS .har stays\nunclassified by suffix because .har also names HTTP Archive JSON.\n\nAdds the project_harmony_application_graph tool (CLI and MCP), synthetic\ncomposition coverage, a pinned real-package verify lane, and docs.\n\n* refactor(domain): share application graph projection scaffolding\n\nThe HarmonyOS projection mirrors the Android and Apple projections by\ndesign, which pushed jscpd duplication over its 2.5 percent budget.\nExtract the identical pieces (inventory input schema, projected\ncomponent schema and occurrence flattening, bridge candidate schema\nfactory, coverage assembly, comparator, canonical digest) into\ndomain/mobileApplicationGraphProjection.ts and route all three\nprojections plus the composition fixtures through it. Duplication drops\nfrom 2.52 to 2.49 percent with no behavior change: projection ids,\nclassifications, and limitations are byte-identical.\n\n* fix(harmony): address review, stable app-pack roots, and rotated fixture\n\n- rebased onto main; the shared projection scaffolding now keeps main's\n nativeRuntimeConvention loop and the harmony runtime families adopt the\n same react-native/flutter/unity path conventions\n- the .app App Pack suffix is now a root-input rule only (verified ZIP\n magic in classifyRootFormat and BinaryTargetResolver); nested .app ZIP\n members inside other packages keep the generic zip classification, with\n a regression test, so existing inventories do not change\n- the signing limitation now states that an empty signing list does not\n mean unsigned because packaging-tool signatures live in the ZIP signing\n block, and the app-pack root rule is disclosed as suffix-based\n- repinned the real-package fixture to the current VHome 2.6.14-beta asset\n after the upstream deleted v5.0.111-beta and replaced the v2.6.14-beta\n asset within hours; the pin records both observed digests\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["b2da21abe11ac43a4cc24b233bd52ce10995e4a1"], "authors": [ { "name": "BaaRai", "email": "130491490+BaaRai@users.noreply.github.com", "user": { "login": "BaaRai", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [1447] }, { "sha": "30787297d49bf93e67f62a9ec42f896188d57a20", "subject": "fix(managed): charge retained member facts instead of decoding bounds (#1768)", "body": "fix(managed): charge retained member facts instead of decoding bounds (#1768)\n\n* fix(managed): charge retained member facts instead of decoding bounds\n\ninspect_managed_members returned no types or methods for ordinary\nassemblies: Newtonsoft.Json 13.0.3 (netstandard2.0, 705 KB) exceeded\nthe 64 MiB representation budget. Each method body reserved 256 bytes\nper IL byte and each signature 256 bytes per blob byte before decoding,\nand those worst-case bounds were never returned, so the budget scaled\nwith total IL size rather than with the retained output. The final\nprojection admission also charged every decoded string at six bytes per\ncharacter and every scalar at 32 bytes, about eight times its JSON size.\n\nBound IL, exception-clause and signature decoding with a transient\nadmission that does not consume capacity, then reserve the decoded body\nor signature that is actually retained. Projection admission now\ncharges the exact UTF-8 JSON bytes of decoded strings, keys and scalars;\nescaped and multibyte text still counts at its encoded size.\n\nNewtonsoft.Json now yields 496 types, 4185 methods and 18846 call\nedges. Assemblies whose retained facts exceed the budget, such as the\n2.3 MB System.Private.ServiceModel 4.7.0, remain unavailable.\n\n* fix(managed): bound concurrent decoding and count JSON bytes in place\n\nReview follow-up. A method's IL bound and its exception-section bounds\nwere each checked against the same remaining capacity although their\nbookkeeping is live at the same time, so 40 MiB of IL plus 40 MiB of\nexception clauses passed a 64 MiB budget. Transient admissions now\naccumulate until the method body or signature is built, and reserve\nrespects bounds that are still live.\n\nProjection admission also serialized each decoded string to measure it,\nwhich could allocate about six times a near-limit string before the\ncheck. It now counts the exact escaped UTF-8 bytes without building the\nJSON text.\n\n* fix(managed): admit derived call and field edges as they are built\n\nReview follow-up. Released IL bounds no longer stand in for the call and field-access records that edges() derives from anchors. Each record is now admitted before the graph grows further, so a crafted assembly cannot materialize the whole derived graph before the representation guard fails.\n\n* fix(managed): admit derived caller names before building them\n\nReview follow-up. The caller name of call and field-access records was interpolated per anchor before any admission saw it. It is now built once per method, after its exact JSON size, counted from the type and member names, has been admitted.", "parents": ["f2150eb9a7ed76748238009ca6666efa52de5271"], "authors": [ { "name": "Martin Klein", "email": "36695017+flitzrrr@users.noreply.github.com", "user": { "login": "flitzrrr", "__typename": "User" } } ], "pullRequests": [1768] }, { "sha": "f178bf1c00139e1b7fe2d14fcfe1f558fe08fbe2", "subject": "perf(test): reuse CLI boundary worker module graphs", "body": "perf(test): reuse CLI boundary worker module graphs\n\nShare CLI boundary module evaluation in bounded forks while preserving fresh command instances and child processes. Keep module-mocked cleanup tests and source/compiled product catalog verification isolated, and update focused artifact selection.\n\nFlameox full cohort with V8 coverage: 102.8s to 96.6s; 290 passed and two existing skips. Statement, function and branch coverage maps and hit sets match across all 1,153 source files. After syncing main, 75 focused tests, typecheck, lint, docs checks and formatting pass; all 834 test files are discovered exactly once.\n", "parents": ["30787297d49bf93e67f62a9ec42f896188d57a20"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "ef5f9aa2d7769b32d9f88211812ae11456a88267", "subject": "perf(test): reuse the CI scope Git baseline", "body": "perf(test): reuse the CI scope Git baseline\n\nCopy a pristine repository into each case-owned workspace instead of repeating init, add, commit and rev-parse for 47 identical baselines. Keep every scenario mutation and real planner invocation, with seed cleanup owned by the file.\n", "parents": ["f178bf1c00139e1b7fe2d14fcfe1f558fe08fbe2"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "43dafb5abe60ee21be4f6a6b6de482cd7a5bab0a", "subject": "perf(test): share stdio analysis for comparison fixtures", "body": "perf(test): share stdio analysis for comparison fixtures\n\nProduce two comparison scenarios through the existing real MCP session while retaining fresh CLI comparisons, all authored source variants and native execution oracles. Keep the capture-lifetime case as a complete CLI analysis-to-comparison journey.\n\nValidation: 92 tests pass with identical source coverage maps and hit sets across 1,156 files. The covered two-file cohort improved locally from 40.6s to 35.4s including the Git baseline optimization. Typecheck, lint and formatting pass.\n", "parents": ["ef5f9aa2d7769b32d9f88211812ae11456a88267"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "76e4153d346b14ef194222bbeef240cf8a16dc99", "subject": "perf(mcp): reduce Windows startup module resolution (#1814)", "body": "perf(mcp): reduce Windows startup module resolution (#1814)\n\nperf(mcp): bundle internal modules to reduce Windows startup I/O", "parents": ["43dafb5abe60ee21be4f6a6b6de482cd7a5bab0a"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [1814] }, { "sha": "91f843bf38b0e4ec8576f41f3140488b4ee8ff32", "subject": "fix(artifacts): mark Windows host executables by extension (#1823)", "body": "fix(artifacts): mark Windows host executables by extension (#1823)\n\nWindows has no POSIX execute bit; Node reports file modes from the\nread-only attribute alone, so every host file, including PE images,\nreported `executable: false` while the same occurrence reported\n`artifact_kind: executable`. Derive the host executable marking once:\nPOSIX permission bits stay authoritative, and Windows marks regular\nfiles with the CreateProcess/cmd launchable extensions.\n\nFixes #1819\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["76e4153d346b14ef194222bbeef240cf8a16dc99"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [1823] }, { "sha": "6ac5c36503492d3b6da4fcf2a5dee87aff60fc8c", "subject": "fix(javascript): follow bundler namespace interop for Electron APIs (#1827)", "body": "fix(javascript): follow bundler namespace interop for Electron APIs (#1827)\n\n* fix(javascript): follow bundler namespace interop for Electron APIs\n\nRolldown/tsdown emit `let electron = require(\"electron\"); electron =\n__toESM(electron);` and esbuild/tsc emit `__toESM(require(\"electron\"))`\nor `__importStar(require(\"electron\"))` for namespace imports. The\nreassignment or the helper call hid the Electron origin, so bundled\nmain processes reported zero BrowserWindows and preloads.\n\nLocally declared, never reassigned interop helpers recognized by name\nnow pass the module through, and a binding's rewrap of its own value is\nnot treated as a reassignment. Other writes stay unresolved.\n\nFixes #1802\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(javascript): require emitted interop helper definitions\n\nOnly trust an interop helper name when it has a single program-scope\nfunction definition, and state that helper bodies are not evaluated.\n\nCo-Authored-By: Claude Opus 5.5 \n\n---------\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["91f843bf38b0e4ec8576f41f3140488b4ee8ff32"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [1827] }, { "sha": "0b4ce83618bb800627264ae6221e2e35140417b5", "subject": "fix(windows): retain failed native inspection ownership (#1826)", "body": "fix(windows): retain failed native inspection ownership (#1826)", "parents": ["6ac5c36503492d3b6da4fcf2a5dee87aff60fc8c"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [1826] }, { "sha": "ed1519ddee02739f57136e356786f64c7f74fed0", "subject": "fix(managed): report ExportedType rows in managed member inspection (#1828)", "body": "fix(managed): report ExportedType rows in managed member inspection (#1828)\n\n* fix(managed): report ExportedType rows in managed member inspection\n\nFacade assemblies such as System.Runtime.dll provide their types only\nthrough ExportedType rows (type forwarders), which member inspection\nnever read, so they reported complete coverage with no types. Report\neach row as declared with its flags, forwarder bit, TypeDefId hint, and\nimplementation token, and record invalid or null implementation coded\nindexes as partial coverage. Comparisons now state that exported types\nare not compared when either side has them.\n\nFixes #1812\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(managed): read earlier member Evidence without exported types\n\nMember Evidence recorded before ExportedType rows were read omits the\nfield. Parse it as null (not examined) instead of rejecting it, and\nstate in comparisons that such an observation's exported types are\nunknown.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(managed): leave exported types unknown when metadata is unavailable\n\nCo-Authored-By: Claude Opus 5.5 \n\n---------\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["0b4ce83618bb800627264ae6221e2e35140417b5"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [1828] }, { "sha": "5876779013726964deef748120c48f5fa0155546", "subject": "docs: celebrate 90,000 GitHub stars 🎉 (#1858)", "body": "docs: celebrate 90,000 GitHub stars 🎉 (#1858)\n\nUpdate the star milestone in the English README and all 18 translated\nREADMEs, keeping each locale's number formatting.\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["ed1519ddee02739f57136e356786f64c7f74fed0"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [1858] }, { "sha": "ee5275cd9fae8db64f945a0c8b59e1c19ac402c3", "subject": "fix(artifacts): count a changed partial-inventory root once (#1854)", "body": "fix(artifacts): count a changed partial-inventory root once (#1854)\n\nWhen partial inventories omitted node details, the root got an unknown\navailability row and the differing manifest root digests appended a\nsecond, changed content row, so one logical path was counted as both\nchanged and unknown. Fold the manifest content change into an existing\nunknown or changed root row instead, keeping its dimensions, occurrence\nand artifact identities, and citations; contradiction and presence rows\nare left as they are.\n\nFixes #1844\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["5876779013726964deef748120c48f5fa0155546"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [1854] }, { "sha": "069308bbe6d73b1d87038b43c9121658325042a9", "subject": "fix(hopper): preserve startup failures and recover denied launches", "body": "fix(hopper): preserve startup failures and recover denied launches\n\nPreserve the primary Hopper startup failure and launcher diagnostics while retaining resources when cleanup cannot be confirmed. Reauthenticate matching external application sessions before document cleanup, keep the Python bridge available for bounded reconnects, and expose the provider-owned Hopper startup deadline.\n\nReal headless Linux Hopper semantic analysis and 65 focused configuration, handshake, cleanup, and bridge tests passed. macOS authorization/crash causes and saved-HOP behavior require their own real-provider verification.\n\nRefs #1808\n\nCo-authored-by: N0zoM1z0 <161784452+N0zoM1z0@users.noreply.github.com>\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>", "parents": ["ee5275cd9fae8db64f945a0c8b59e1c19ac402c3"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "N0zoM1z0", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } } ], "pullRequests": [1817] }, { "sha": "1f531fc257f71731624cbd6b595208adacf59108", "subject": "fix(managed): decode generic, array, fnptr, and modifier signatures (#1835)", "body": "fix(managed): decode generic, array, fnptr, and modifier signatures (#1835)\n\n* fix(managed): decode generic, array, fnptr, and modifier signatures\n\nMember signatures using GENERICINST, ARRAY, FNPTR, CMOD_REQD/CMOD_OPT,\nor TYPEDBYREF were reported as unsupported, leaving their types unknown\nand turning otherwise complete inspections partial. Decode them with an\nexplicit stack so nested signatures stay recursion-free, keep encoded\nTypeDefOrRefOrSpec values, and report malformed shapes as malformed.\n\nFixes #1832\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(managed): bound array rank before rendering dimensions\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(managed): keep modifier order and reject non-method fnptr headers\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(managed): reject corrupt fnptr flags and misplaced typed references\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(managed): decode signature elements by grammar position\n\nTrack whether each element is a field type, return type, parameter,\nnested Type, or pointee. VOID is valid only as a return type or\npointee, TYPEDBYREF only as a return type or parameter, and BYREF only\nat the top of a return type, parameter, or ref field; other placements\nare malformed. Function pointer items are parsed as a return type then\nparameters, and generic arguments as Types.\n\nCo-Authored-By: Claude Opus 5.5 \n\n---------\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["069308bbe6d73b1d87038b43c9121658325042a9"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [1835] }, { "sha": "cf7477eb4642bc07228fa33ccc4c87656e6e3003", "subject": "fix(hopper): wait for late bridges during cleanup (#1866)", "body": "fix(hopper): wait for late bridges during cleanup (#1866)", "parents": ["1f531fc257f71731624cbd6b595208adacf59108"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [1866] }, { "sha": "37a9eb9d65a088209f962e5094f6bc67eacbbaf9", "subject": "fix(javascript): preserve namespace re-export relationships (#1833)", "body": "fix(javascript): preserve namespace re-export relationships (#1833)\n\n* fix(javascript): preserve namespace re-export relationships\n\n* fix(javascript): exclude erased namespace type exports", "parents": ["cf7477eb4642bc07228fa33ccc4c87656e6e3003"], "authors": [ { "name": "Yann Roberto", "email": "165009858+shoyann@users.noreply.github.com", "user": { "login": "shoyann", "__typename": "User" } } ], "pullRequests": [1833] }, { "sha": "ca11162d027a0d3e3b5a65a54825b00d5689fb80", "subject": "perf(browser): parse captured module URLs once per lookup (#1829)", "body": "perf(browser): parse captured module URLs once per lookup (#1829)\n\nCo-authored-by: Shayan Ali <217162076+shayanxcyber@users.noreply.github.com>", "parents": ["37a9eb9d65a088209f962e5094f6bc67eacbbaf9"], "authors": [ { "name": "Shayan Ali", "email": "shayan.ali8799@gmail.com", "user": { "login": "shayanxcyber", "__typename": "User" } }, { "name": "Shayan Ali", "email": "217162076+shayanxcyber@users.noreply.github.com", "user": { "login": "shayanxcyber", "__typename": "User" } } ], "pullRequests": [1829] }, { "sha": "554cb45f7ff967884c9d1fdf706c20803d76a6df", "subject": "fix(managed): bound transient CIL by decoded instruction count (#1822)", "body": "fix(managed): bound transient CIL by decoded instruction count (#1822)\n\nfix(managed): charge transient CIL by decoded instructions", "parents": ["ca11162d027a0d3e3b5a65a54825b00d5689fb80"], "authors": [ { "name": "jhuang-tw", "email": "77732008+jhuang-tw@users.noreply.github.com", "user": { "login": "jhuang-tw", "__typename": "User" } } ], "pullRequests": [1822] }, { "sha": "d3e9ee5505251f760666bb8e1e6c295b6d6aedb2", "subject": "fix(ida): report a procedure IDA cannot resolve as invalid input (#1785)", "body": "fix(ida): report a procedure IDA cannot resolve as invalid input (#1785)\n\n* test(ida): expect a missing procedure to be reported as invalid input\n\n* test(ida): name the invalid_request code and its category for a missing procedure\n\n* fix(ida): report a procedure IDA cannot resolve as invalid input\n\n* test(ida): pin the missing-procedure issue shape and the lookups that stay unreadable\n\n* fix(ida): treat a lookup answer for another query as a producer fault\n\n* test(ida): expect an argument-independent issue path and pin legacy error replies and escaping\n\n* fix(ida): report a missing procedure without naming an argument path\n\n* test(ida): expect provider-derived selectors to stay producer faults in composed workflows\n\n* fix(ida): keep provider-derived procedure selectors out of the caller's input errors\n\n* test(ida): cover session forwarding, parameter hygiene and structured derived-node errors\n\n* docs(ida): describe when procedure resolution blames the caller", "parents": ["554cb45f7ff967884c9d1fdf706c20803d76a6df"], "authors": [ { "name": "Mykola Dementiev", "email": "nikolay-dementiev@users.noreply.github.com", "user": { "login": "nikolay-dementiev", "__typename": "User" } } ], "pullRequests": [1785] }, { "sha": "7e2f79ab45a23ab844f89fb93c9cdf202230c73f", "subject": "fix(setup): retain symlinked data roots during uninstall (#1821)", "body": "fix(setup): retain symlinked data roots during uninstall (#1821)", "parents": ["d3e9ee5505251f760666bb8e1e6c295b6d6aedb2"], "authors": [ { "name": "Yann Roberto", "email": "165009858+shoyann@users.noreply.github.com", "user": { "login": "shoyann", "__typename": "User" } } ], "pullRequests": [1821] }, { "sha": "bcd350c365030a5d210208c0a8dc238302c43303", "subject": "fix(artifacts): preserve physical ZIP member identities (#1865)", "body": "fix(artifacts): preserve physical ZIP member identities (#1865)\n\nBind each ZIP occurrence independently of its filename so engine metadata\ninspection can read repeated resources without replacing retained sources.\nKeep logical-path collision checks in artifact inventory.\n\nCloses #1860\n\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>", "parents": ["7e2f79ab45a23ab844f89fb93c9cdf202230c73f"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "factory-droid[bot]", "email": "138933559+factory-droid[bot]@users.noreply.github.com", "user": { "login": "factory-droid[bot]", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } } ], "pullRequests": [1865] }, { "sha": "96547d373fcdc672058b29774d6c634f4e9cc1bd", "subject": "docs: sync French, Indonesian and Italian READMEs with English (#1861)", "body": "docs: sync French, Indonesian and Italian READMEs with English (#1861)\n\nAdd the missing Bun update documentation (bun add --global install\nvariant, Bun 1.2.17 version requirement, bunx one-off command), the\nmissing WASM artifact table row, and the IDA provider mention (fr).\nAlso fix small translation issues: it Quick start heading, approvale\ntypo, fr moteur précis/filières wording.\n\nCo-authored-by: peter-research ", "parents": ["bcd350c365030a5d210208c0a8dc238302c43303"], "authors": [ { "name": "Peter", "email": "304086198+peter-research@users.noreply.github.com", "user": { "login": "peter-research", "__typename": "User" } }, { "name": "peter-research", "email": "peter-research@users.noreply.github.com", "user": { "login": "peter-research", "__typename": "User" } } ], "pullRequests": [1861] }, { "sha": "fb94d9dde0ccda83ae520ac6fb22b1d283562cf3", "subject": "fix(errors): stop recommending retries for non-retryable failures (#1869)", "body": "fix(errors): stop recommending retries for non-retryable failures (#1869)\n\n* fix(errors): stop recommending retries for non-retryable failures\n\nUnreadable output and provider adapter failures project retryable=false,\nbut their standard message and remediation said \"Retry once\", so a\nfirmware run whose expected report was never published told callers to\nrepeat a non-retryable operation. Point those failures at `rea doctor`\nand the reported details instead, leaving retryability decided once by\nthe projected error code.\n\nFixes #1855\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(errors): align Hopper remote failure guidance with retryability\n\nCo-Authored-By: Claude Opus 5.5 \n\n---------\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["96547d373fcdc672058b29774d6c634f4e9cc1bd"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [1869] }, { "sha": "ea40f717b26392000f989a8b500f6774b5e85091", "subject": "fix(windows): bring the real Windows Ghidra verifiers up to date (#1863)", "body": "fix(windows): bring the real Windows Ghidra verifiers up to date (#1863)", "parents": ["fb94d9dde0ccda83ae520ac6fb22b1d283562cf3"], "authors": [ { "name": "pablodiazjorge", "email": "102741971+pablodiazjorge@users.noreply.github.com", "user": { "login": "pablodiazjorge", "__typename": "User" } } ], "pullRequests": [1863] }, { "sha": "efbc25fbea1b6ade2a284a4916644c791f83bf49", "subject": "fix(android): preserve executable static initializer evidence (#1876)", "body": "fix(android): preserve executable static initializer evidence (#1876)\n\nReturn the exact static initializer disassembly before Java projection can\nlose field assignments. Retain byte limits and representation markers, and\nverify fully folded and mixed initialization through the real CLI/MCP lane.\n\nCloses #1846\n\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>", "parents": ["ea40f717b26392000f989a8b500f6774b5e85091"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "factory-droid[bot]", "email": "138933559+factory-droid[bot]@users.noreply.github.com", "user": { "login": "factory-droid[bot]", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } } ], "pullRequests": [1876] }, { "sha": "fa9a7e5ec026c5a4e8426f0f36c2c4555be9c9f0", "subject": "fix(evidence): reject NUL bytes in subject and snapshot paths (#1873)", "body": "fix(evidence): reject NUL bytes in subject and snapshot paths (#1873)\n\nEvidence subject local_path and analysis-snapshot subject path accepted\nany string, so a caller-supplied inline Evidence record could carry a NUL\nbyte into the observation and bundle output even though every other\nselected-path boundary already refuses it. Both fields now use the shared\nNUL-free local-path schema: the snapshot path keeps its nonempty rule,\nand the Evidence local_path stays free to be empty because network\ncapture Evidence uses an empty path as a deliberate sentinel.\n\nlocalPath.ts now exports the NUL-free base schema separately so the\nnonempty rule is composed rather than duplicated; the advertised pattern\nand minLength for existing localPathStringSchema consumers are unchanged.\n\nValidation: new unit cases reject a NUL local_path and snapshot path while\nadmitting an empty Evidence path and an ordinary path; domain suite\n126 files / 1704 tests pass, evidence bundle and retained-evidence MCP\nboundaries pass, localToolContracts NUL harness passes, toolSchemaValidity\npasses with a regenerated catalog, typecheck, oxlint, oxfmt.", "parents": ["efbc25fbea1b6ade2a284a4916644c791f83bf49"], "authors": [ { "name": "Dery Ferdika", "email": "114888155+DeryFerd@users.noreply.github.com", "user": { "login": "DeryFerd", "__typename": "User" } } ], "pullRequests": [1873] }, { "sha": "29d2624b3475586356c27f518bf6b823030268fb", "subject": "fix(ghidra): report progress while startup is pending (#1877)", "body": "fix(ghidra): report progress while startup is pending (#1877)\n\nForward Ghidra startup waiting observations through the existing progress reporter. Count emitted MCP status notifications and omit the unknown total to keep progress strictly increasing.\n\nVerified with focused tests, type/lint/docs checks, packaging and actual installed Windows timeout/recovery workflows. Native first-query speed and large-target memory remain open under #1065.\n\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>", "parents": ["fa9a7e5ec026c5a4e8426f0f36c2c4555be9c9f0"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } } ], "pullRequests": [1877] }, { "sha": "d3e83b089943e2941dace3546a068a59bd0a335e", "subject": "fix(test): wait for Hopper reconnect listener readiness (#1885)", "body": "fix(test): wait for Hopper reconnect listener readiness (#1885)\n\nThe socket path exists after bind but before listen. Wait up to two seconds\nfor the initial connection on ConnectionRefusedError, closing each failed\nsocket. Propagate other errors and keep reconnect attempts immediate.\nPreserve authentication, lost replies, expiry, cleanup and thread assertions.\n\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>", "parents": ["29d2624b3475586356c27f518bf6b823030268fb"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "factory-droid[bot]", "email": "138933559+factory-droid[bot]@users.noreply.github.com", "user": { "login": "factory-droid[bot]", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } } ], "pullRequests": [1885] }, { "sha": "7c207c79512f6baa70f4ed9d7d5334ab2d62f3ac", "subject": "feat(native): admit raw binaries with caller-supplied architecture and entry (#1868)", "body": "feat(native): admit raw binaries with caller-supplied architecture and entry (#1868)\n\n* feat(native): admit raw binaries with caller-supplied architecture and entry\n\n* fix(native): honor raw-binary preparation and entry identity\n\n* fix(ghidra): stream raw snapshot attestation with cancellation\n\n* fix(native): preserve and validate raw lifecycle entries\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["d3e83b089943e2941dace3546a068a59bd0a335e"], "authors": [ { "name": "Matt Van Horn", "email": "mvanhorn@users.noreply.github.com", "user": { "login": "mvanhorn", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [1868] }, { "sha": "499ac180115de7c9de3f1adc55159ffa6e9bb40e", "subject": "fix(web): reject NUL bytes in web tool local path inputs", "body": "fix(web): reject NUL bytes in web tool local path inputs\n\nFour web tools accepted caller-selected local paths as plain strings, so\na NUL byte passed contract validation and reached filesystem calls. The\nservices only checked isAbsolute, and isAbsolute admits a NUL, so the\nfailure surfaced later as a raw ERR_INVALID_ARG_VALUE instead of a named\ninput constraint. Every other local-input tool already refuses NUL through\nthe shared local-path schema, and the existing OS-invalid-local-input\nharness covers those but not these web tools.\n\ninspect_web_network_capture.capture_path, export_web_scripts.capture_path\nand output_directory, trace_web_source_location.manifest_path and\nsource_map.path, and trace_web_module_imports.manifest_path and\nimport_map.path now use localPathStringSchema. Each field already required\na nonempty string, so the advertised pattern and minLength stay the same\nand only the NUL refusal is added.\n\nValidation: a new schema test rejects NUL in all seven fields while\naccepting ordinary absolute paths; the four tools are added to the\nOS-invalid-local-input harness and reject NUL through the real advertised\nMCP contracts; typecheck, oxlint, oxfmt, and toolSchemaValidity with a\nregenerated catalog. Two webScriptExport boundary cases fail identically\nwith and without this change on this Windows host (symlink EPERM and\nprivate-runtime-root authority), so they are environmental.\n", "parents": ["7c207c79512f6baa70f4ed9d7d5334ab2d62f3ac"], "authors": [ { "name": "DeryFerd", "email": "deryferdikao125@gmail.com", "user": { "login": "DeryFerd", "__typename": "User" } } ], "pullRequests": [1899] }, { "sha": "b5b73019f946e5edc0df506c9f8f4bb28afa6590", "subject": "test(web): remove duplicate path schema cases", "body": "test(web): remove duplicate path schema cases\n", "parents": ["499ac180115de7c9de3f1adc55159ffa6e9bb40e"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "23d50ea3bec186b4459d36c04854a92276accdf1", "subject": "fix(managed): bind row budget charges to metadata identities (#1897)", "body": "fix(managed): bind row budget charges to metadata identities (#1897)\n\nCharge fixed row bookkeeping once per table and row within an admitted\nmetadata layout. Repeated owner lookups no longer permanently consume\ncapacity for temporary cursors; distinct rows and failed admissions retain\nthe existing representation limit and typed failure behavior.\n\nVerify repeated local attribute-constructor lookups through public CLI\nmetadata/member inspection and preserve the remaining capacity guards.\n\nCloses #1878\n\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>", "parents": ["7c207c79512f6baa70f4ed9d7d5334ab2d62f3ac"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "factory-droid[bot]", "email": "138933559+factory-droid[bot]@users.noreply.github.com", "user": { "login": "factory-droid[bot]", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } } ], "pullRequests": [1897] }, { "sha": "38539a2f4a522243d6fc369ae34ef30e2a2f80cc", "subject": "fix(process): retain owned command cleanup diagnostics (#1907)", "body": "fix(process): retain owned command cleanup diagnostics (#1907)\n\nPreserve per-member verification failures and sweep uncertainty across\nsupervisor stop and owned-command failures. Report the observed token\nmismatch with its PID coordinates instead of implying PID reuse.\n\nKeep unresolved ownership unsignaled and retain the supervisor for a later\nverified stop. Exercise cancellation, timeout and cleanup revalidation with\nsource-owned process fixtures and cooperative settlement.\n\nCloses #1856\n\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>", "parents": ["23d50ea3bec186b4459d36c04854a92276accdf1"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "factory-droid[bot]", "email": "138933559+factory-droid[bot]@users.noreply.github.com", "user": { "login": "factory-droid[bot]", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } } ], "pullRequests": [1907] }, { "sha": "898d5096f94fe1ed3ea7d091455e638cc7d23bfd", "subject": "perf(javascript): index source-map ignore lists per leaf (#1905)", "body": "perf(javascript): index source-map ignore lists per leaf (#1905)", "parents": ["38539a2f4a522243d6fc369ae34ef30e2a2f80cc"], "authors": [ { "name": "cyanseek", "email": "cyanseek@outlook.com", "user": { "login": "cyanseek", "__typename": "User" } } ], "pullRequests": [1905] }, { "sha": "176941700118cc33c86e07373cd6950f30548386", "subject": "fix(firmware): name missing extractor dependencies in partial extraction (#1879)", "body": "fix(firmware): name missing extractor dependencies in partial extraction (#1879)\n\nUnblob reports a missing external extractor as an\nExtractorDependencyNotFoundReport nested inside a chunk or multi-file\nreport, and normalizeUnblobReport forwarded that value verbatim into\ndiagnostics as { input_path, report }. A caller that reached partial\ncoverage therefore had to decode the raw producer report to learn which\nextractor was absent and at which stage, even though the report already\nnames the dependencies.\n\nExtraction diagnostics now normalize those entries: the named\ndependencies are collected from the report and any nested value, the\nproducing handler is recorded as the stage, and the original report stays\nretained for provenance. Entries without a dependency report keep their\nprevious shape.\n\nValidation: FirmwareReports unit cases cover the chunk-nested and\nmulti-file-nested dependency reports and the retained raw report;\nfirmware suite passes; typecheck, oxlint and oxfmt on changed files. Real\nUnblob extraction is unverified here because it needs the external\nextractor stack.", "parents": ["898d5096f94fe1ed3ea7d091455e638cc7d23bfd"], "authors": [ { "name": "Dery Ferdika", "email": "114888155+DeryFerd@users.noreply.github.com", "user": { "login": "DeryFerd", "__typename": "User" } } ], "pullRequests": [1879] }, { "sha": "9b3e59804db71072ed023f109342f96063c57b45", "subject": "fix(javascript): prove namespace interop before attributing Electron APIs (#1857)", "body": "fix(javascript): prove namespace interop before attributing Electron APIs (#1857)\n\n* fix(javascript): prove Electron module namespace conversion\n\n* refactor(javascript): share AST child field metadata\n\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>\n\n* fix(javascript): retain destructured intrinsic writes\n\nShare one pattern-target walker across lexical definitions, member mutation\ntracking and Electron identity writes. Keep overwritten globals unresolved\nwithout treating property keys or shadowed locals as global replacements.\n\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>\n\n* fix(javascript): preserve intrinsic projections and fresh target identity\n\nResolve known mutators through static binding projections and prove stable\nidentifier chains to fresh literals before widening unknown mutation targets.\nKeep reassigned, uninitialized and member-projected targets conservative.\nCover both review regressions through source tests and inert CLI/MCP fixtures.\n\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>\n\n* fix(javascript): retain fresh function and class target identity\n\nRecognize stable local function, undecorated class and RegExp targets before\nwidening intrinsic mutations. Keep decorated classes opaque because their\nbinding value can be replaced, and preserve class-initialization writes.\nCover fresh targets and replacement decorators in inert CLI/MCP fixtures.\n\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>\n\n* fix(javascript): preserve intrinsic alias capture timing\n\nValidate each alias read after initialization and retain the original function capture across copies. Share declaration initializer facts with RPC and Electron analysis, including class declarations used for fresh-target identity. Accept single-statement control blocks while keeping lexical roles and added operations checked. Cover the capture regressions through inert source and public CLI/MCP workflows.\n\n* fix(javascript): respect hoisted fresh function declarations\n\nFunction declarations provide fresh targets before their textual position. Retain initialization-order checks for variable and class values, including aliases. Cover the reviewed regression with source controls and the public CLI/MCP fixture.\n\n* fix(javascript): preserve proven interop result projections\n\n* fix(javascript): retain stable declarations and bound intrinsic writes\n\nKeep repeated variable declarations with one unconditional initializer while\nrejecting assignments, conditional initialization and multiple values.\nNormalize known intrinsic calls, aliases and bound argument prefixes at the\nsemantic owner, retaining opaque targets without tainting unused bindings or\nfresh local objects. Cover both regressions through source and CLI/MCP tests.\n\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>\n\n* fix(javascript): retain bound intrinsic mutation effects\n\n* fix(javascript): preserve bound receivers for intrinsic invocation\n\n* fix(javascript): prove generic binding and invocation effects\n\n* fix(javascript): retain Reflect set receiver effects\n\n---------\n\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["176941700118cc33c86e07373cd6950f30548386"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "factory-droid[bot]", "email": "138933559+factory-droid[bot]@users.noreply.github.com", "user": { "login": "factory-droid[bot]", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [1857] }, { "sha": "7a0140b4aa43276368058ab98826b77e040ea14f", "subject": "fix(android): bound inline search Evidence with retained inventory provenance (#1890)", "body": "fix(android): bound inline search Evidence with retained inventory provenance (#1890)\n\nFocused and zero-match search_android_classes responses embedded every\nexamined class name: JadxSession records each raw list_classes page into\nobserved calls, those calls ride into Evidence raw_result on the\nregistration path, and the complete inline Evidence is serialized into\nevery tool response (issue #1850: 382,435 bytes for one match).\n\nWhen the server session retains Evidence, record the complete raw-call\nrecord first, then deliver a summary Evidence that keeps the pagination\naudit (totals, offsets, page sizes, elided item counts), the unchanged\nnormalized matches and truthful coverage metadata, and links the\nretained complete inventory by Evidence ID. Sessions without retention\nkeep the complete inline delivery, so complete CLI JSON output is\nunchanged and no provenance is discarded.\n\n🤖 Generated with AI assistance (disclosure voluntary per repo policy)", "parents": ["9b3e59804db71072ed023f109342f96063c57b45"], "authors": [ { "name": "akushonkamen", "email": "74654766+akushonkamen@users.noreply.github.com", "user": { "login": "akushonkamen", "__typename": "User" } } ], "pullRequests": [1890] }, { "sha": "0b7fc40eeef03b06de08d886572c2862331d8947", "subject": "fix(contracts): mark foreign execution and device mutation destructive (#1904)", "body": "fix(contracts): mark foreign execution and device mutation destructive (#1904)\n\nMCP annotations derived destructiveHint only from mayDiscardData, so tools\nthat run the analysis target or a caller-selected executable\n(capture_process_scenario, observe_native_calls) and tools that change an\nattached Android device (install/uninstall/push/start/stop) advertised\ndestructiveHint: false.\n\nAdd explicit executesForeignCode and mutatesDevice effect flags, audit them\nacross all 170 tool effect records, and derive\ndestructiveHint = mayDiscardData || executesForeignCode || mutatesDevice.\nreadOnlyHint semantics are unchanged.\n\nHopper/Ghidra metadata writers (set_address_name, set_addresses_names,\nset_bookmark, set_comment, set_inline_comment, annotate_native_function)\ncan replace or clear existing analyst names and comments, so they now\ndeclare mayDiscardData as well.\n\nA contract test pins the destructive set and requires every tool whose\ndescription mentions running, launching, executing, starting, installing or\nuninstalling to declare one of the new flags or carry a reasoned exception,\nso wording and effects cannot silently drift. The binary_session effects\noutput schema carries the new flags.", "parents": ["7a0140b4aa43276368058ab98826b77e040ea14f"], "authors": [ { "name": "Lluís Ariño", "email": "lluisalfons.arino@urv.cat", "user": { "login": "larinyo", "__typename": "User" } } ], "pullRequests": [1904] }, { "sha": "e4ac7bbfc2f8c631ba1c60f507d85253e122d4c8", "subject": "fix: order remaining outputs independently of host locale (#1867)", "body": "fix: order remaining outputs independently of host locale (#1867)\n\n* fix: order remaining outputs independently of host locale\n\nString.prototype.localeCompare without a pinned collation follows the\nhost's ICU default locale, so the same input could be ordered differently\non different machines. 614fb768 moved canonical domain projections to\ncompareUnicodeCodePoints; provider, application, catalog, and setup\norderings still used locale collation.\n\nOrder every remaining source site by Unicode code point, including Mach-O\nsymbols, firmware extraction paths, ASAR entries (previously pinned to\n\"en\" collation), evidence ID sets, browser and Electron target, script,\nand resource inventories, reconstruction obligations, capability and\nprovider listings, and setup environment details.\n\nThe current tool and prompt catalog names order identically under both\ncomparators, so the catalog identity digest is unchanged.\n\n* fix(artifacts): order ASAR entries by their portable path\n\n@electron/asar lists host-spelled paths, so code-point order over the raw\nspelling still differed by host: \"a\\b\" sorts after \"a0\" on Windows while\n\"a/b\" sorts before it on POSIX. Pair each listing with its portable\narchive path once, order by that path, and keep the host spelling for\n@electron/asar calls and adapter keys.", "parents": ["0b7fc40eeef03b06de08d886572c2862331d8947"], "authors": [ { "name": "Itoje Dollar", "email": "163161978+dollarsmoney@users.noreply.github.com", "user": { "login": "dollarsmoney", "__typename": "User" } } ], "pullRequests": [1867] }, { "sha": "097f0d54afceb3ce61dbaa24dd6736658d1fce06", "subject": "perf(javascript): skip nested callables during fingerprint traversal (#1871)", "body": "perf(javascript): skip nested callables during fingerprint traversal (#1871)", "parents": ["e4ac7bbfc2f8c631ba1c60f507d85253e122d4c8"], "authors": [ { "name": "cyanseek", "email": "cyanseek@outlook.com", "user": { "login": "cyanseek", "__typename": "User" } } ], "pullRequests": [1871] }, { "sha": "e8491e023a255f790ae9850225084d7495e9ade0", "subject": "fix(artifacts): mark Windows launchable files as host executables (#1824)", "body": "fix(artifacts): mark Windows launchable files as host executables (#1824)\n\nHost-file occurrences derived `executable` from POSIX execute bits, which\nWindows never reports, so every Windows host file (including PE .exe\nimages classified as executable) reported `executable: false`.\n\nDerive the fact once through hostExecutable: POSIX hosts keep the execute\nbits; Windows marks regular files with the extensions it launches directly\n(.exe, .com, .bat, .cmd), without reading the ambient PATHEXT.\n\nFixes #1819\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["097f0d54afceb3ce61dbaa24dd6736658d1fce06"], "authors": [ { "name": "Itoje Dollar", "email": "163161978+dollarsmoney@users.noreply.github.com", "user": { "login": "dollarsmoney", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [1824] }, { "sha": "d28b41ea4e93bb4c4d360a3bf2291ca83bb2b378", "subject": "feat(javascript): resolve exact package import aliases (#1862)", "body": "feat(javascript): resolve exact package import aliases (#1862)\n\n* feat(javascript): resolve exact package import aliases\n\nResolve exact #alias specifiers against the importer's enclosing\npackage.json imports map using the shared condition, array, and null\ntarget selection. Nested packages keep their own maps; missing keys,\nexplicit nulls, and out-of-scope aliases report a precise reason.\nWildcard, recursive, and external-package import targets remain\nunresolved.\n\n* fix(javascript): keep nested import aliases in CLI graphs\n\nBound nested #alias requires produce application-graph require edges\nfrom the enclosing package. Node reports MODULE_NOT_FOUND when a nested\npackage.json has no imports field, without inheriting the ancestor map.\n\n* fix(javascript): resolve literal package import keys before path admission\n\n* fix(javascript): preserve import keys and invalid-target fallback\n\n* fix(javascript): preserve unmatched package target arrays\n\n* fix(javascript): retain package target refusal evidence\n\n* test(browser): match real verifier startup budget\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["e8491e023a255f790ae9850225084d7495e9ade0"], "authors": [ { "name": "Matt Van Horn", "email": "mvanhorn@users.noreply.github.com", "user": { "login": "mvanhorn", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [1862] }, { "sha": "9d8e42bdd6f1bf8a984da1e06e1d76a1dbb9a7ed", "subject": "fix(javascript): follow actual receivers in nested intrinsic calls (#1912)", "body": "fix(javascript): follow actual receivers in nested intrinsic calls (#1912)\n\nConsume arguments per generic function invocation rather than property-chain\ndepth. Preserve the callable receiver through call/apply, Reflect.apply and\nbound invocation. Cover nested mutations and fresh targets through source\nanalysis and inert production CLI/MCP fixtures.\n\nFixes #1909.\n\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["d28b41ea4e93bb4c4d360a3bf2291ca83bb2b378"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "factory-droid[bot]", "email": "138933559+factory-droid[bot]@users.noreply.github.com", "user": { "login": "factory-droid[bot]", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [1912] }, { "sha": "486b56724c4eaba50719177bcb9eae84d6907297", "subject": "fix(browser): compare only observed HTTP response facts", "body": "fix(browser): compare only observed HTTP response facts\n", "parents": ["9d8e42bdd6f1bf8a984da1e06e1d76a1dbb9a7ed"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "1dfb933e47db0156cf1cb61f28715b81e740c57b", "subject": "fix(javascript): share TypeScript emitted import resolution", "body": "fix(javascript): share TypeScript emitted import resolution\n", "parents": ["486b56724c4eaba50719177bcb9eae84d6907297"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "bb508134efbba392a404b651d6ec05be8b7eac1e", "subject": "fix(setup): verify independently selected skill destinations", "body": "fix(setup): verify independently selected skill destinations\n", "parents": ["1dfb933e47db0156cf1cb61f28715b81e740c57b"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "f598bab488e38c378d69346fa3c106f9e18529ed", "subject": "fix(apple): preserve ARM64E X1 architecture identity", "body": "fix(apple): preserve ARM64E X1 architecture identity\n", "parents": ["bb508134efbba392a404b651d6ec05be8b7eac1e"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "2976fac30d4088c1f1ba383261eb3eff5e95bce6", "subject": "test(architecture): consolidate import boundary verification", "body": "test(architecture): consolidate import boundary verification\n", "parents": ["f598bab488e38c378d69346fa3c106f9e18529ed"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "369cd3dfdc47709cc34d01c50f645a885c70ded7", "subject": "fix(javascript): normalize package URLs before array selection (#1916)", "body": "fix(javascript): normalize package URLs before array selection (#1916)", "parents": ["2976fac30d4088c1f1ba383261eb3eff5e95bce6"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [1916] }, { "sha": "a95795c6ed3cb149e03460f4c818ad12e0c670d9", "subject": "fix(managed): resolve member ownership through pointer tables (#1886)", "body": "fix(managed): resolve member ownership through pointer tables (#1886)\n\nCo-authored-by: LouisChen <3361008+chqcjq@users.noreply.github.com>", "parents": ["369cd3dfdc47709cc34d01c50f645a885c70ded7"], "authors": [ { "name": "LouisChen", "email": "65096591@qq.com", "user": { "login": "chqcjq", "__typename": "User" } }, { "name": "LouisChen", "email": "3361008+chqcjq@users.noreply.github.com", "user": { "login": "chqcjq", "__typename": "User" } } ], "pullRequests": [1886] }, { "sha": "f8513a42dc44451a621127f06edde5d38bc93f69", "subject": "fix(javascript): keep TypeScript substitution out of runtime paths", "body": "fix(javascript): keep TypeScript substitution out of runtime paths\n", "parents": ["a95795c6ed3cb149e03460f4c818ad12e0c670d9"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "6407718f3020a34cc087163492e3f9a465e2e841", "subject": "test(managed): use the current attribute fixture contract", "body": "test(managed): use the current attribute fixture contract\n", "parents": ["f8513a42dc44451a621127f06edde5d38bc93f69"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "dfe31172ca0a090be3f40bc134f54d69c08e31d8", "subject": "fix(test): audit static Wasm and Harmony tool wording (#1917)", "body": "fix(test): audit static Wasm and Harmony tool wording (#1917)\n\nAccount for explicit nonexecution wording in the existing tool-effects audit.\nWABT validates and decompiles the module; Harmony projects inventory Evidence.\nRetain declared effects and stale-exception checks.\n\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["6407718f3020a34cc087163492e3f9a465e2e841"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "factory-droid[bot]", "email": "138933559+factory-droid[bot]@users.noreply.github.com", "user": { "login": "factory-droid[bot]", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [1917] }, { "sha": "601814ed0e4a0c57d6e045da0e6cf8ee2f29bb7f", "subject": "fix(hopper): preserve observed process failures across requests (#1927)", "body": "fix(hopper): preserve observed process failures across requests (#1927)\n\n* fix(hopper): preserve observed process failures across requests\n\n* test(hopper): consolidate retained cleanup and recover failed helper fixtures\n\n* docs(hopper): clarify first-use demo prompt and startup recovery", "parents": ["dfe31172ca0a090be3f40bc134f54d69c08e31d8"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [1927] }, { "sha": "c32d84622fb3952823c6cfc25c557aec08c1788c", "subject": "test(clients): verify native Claude Code integration on Windows (#1926)", "body": "test(clients): verify native Claude Code integration on Windows (#1926)\n\nThe Claude Code client lane asserted POSIX, although nothing in it depends\non it. Remove the assertion, tell Windows users to select claude.exe when\nthe default command cannot be spawned (npm installs put only a claude.cmd\nshim on PATH), and record 2.1.296 as verified on native Windows in\ndocs/testing.md.\n\nFixes #1923\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["601814ed0e4a0c57d6e045da0e6cf8ee2f29bb7f"], "authors": [ { "name": "pablodiazjorge", "email": "102741971+pablodiazjorge@users.noreply.github.com", "user": { "login": "pablodiazjorge", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [1926] }, { "sha": "0485cd3bce29c977bae05a4fdce5436f3e3d7913", "subject": "fix(javascript): preserve graphs within parent capacity (#1921)", "body": "fix(javascript): preserve graphs within parent capacity (#1921)\n\nReserve the next sequential static checkpoint using its protocol size and\nexisting retained-expansion accounting instead of 80% of the parent budget.\nPreserve total/live heap protections and explain parent admission failures\nwith effective capacity, retention estimates and usable retained facts.\n\nFixes #1911\n\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>", "parents": ["c32d84622fb3952823c6cfc25c557aec08c1788c"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "factory-droid[bot]", "email": "138933559+factory-droid[bot]@users.noreply.github.com", "user": { "login": "factory-droid[bot]", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } } ], "pullRequests": [1921] }, { "sha": "fb43dd9716fe113effa14a03b603b72ca7d9097c", "subject": "fix(managed): honor metadata ExtraData before table decoding (#1893)", "body": "fix(managed): honor metadata ExtraData before table decoding (#1893)\n\nCo-authored-by: LouisChen <3361008+chqcjq@users.noreply.github.com>\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["0485cd3bce29c977bae05a4fdce5436f3e3d7913"], "authors": [ { "name": "LouisChen", "email": "65096591@qq.com", "user": { "login": "chqcjq", "__typename": "User" } }, { "name": "LouisChen", "email": "3361008+chqcjq@users.noreply.github.com", "user": { "login": "chqcjq", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [1893] }, { "sha": "b07e54a10e66319d90815313fae93350257e1655", "subject": "docs(readme): remove CI status badge", "body": "docs(readme): remove CI status badge\n", "parents": ["fb43dd9716fe113effa14a03b603b72ca7d9097c"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "3298219d8cd905897ec9a96bf639602a273d4a9b", "subject": "docs(readme): remove CI badges from translations", "body": "docs(readme): remove CI badges from translations\n", "parents": ["b07e54a10e66319d90815313fae93350257e1655"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "3b490a743fd56a8a27b1356f7b2d1284db8848ef", "subject": "test(apple): consolidate keyed archive integer verification (#1933)", "body": "test(apple): consolidate keyed archive integer verification (#1933)", "parents": ["3298219d8cd905897ec9a96bf639602a273d4a9b"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [1933] }, { "sha": "d0edeec1009f1149956ee2a95dc5941aff8f78b5", "subject": "test(native): skip the inaccessible-directory diagnostic as root (#1900)", "body": "test(native): skip the inaccessible-directory diagnostic as root (#1900)\n\nThe artifact directory diagnostic makes a bundle member unreadable with\nmode 000 and expects inventory_artifact to report its path and EACCES.\nRoot ignores the mode, so the read succeeds and the test fails when the\nsuite runs as uid 0 (for example in a container). Skip it there with the\nsame process.getuid?.() === 0 condition the DMG EACCES diagnostic uses.", "parents": ["3b490a743fd56a8a27b1356f7b2d1284db8848ef"], "authors": [ { "name": "Lluís Ariño", "email": "lluisalfons.arino@urv.cat", "user": { "login": "larinyo", "__typename": "User" } } ], "pullRequests": [1900] }, { "sha": "0b2aa6953123ef006a1fa9d4651552b7f18eeb70", "subject": "Merge remote-tracking branch 'origin/main' into codex/pr-1899-remove-duplicate-schema-test", "body": "Merge remote-tracking branch 'origin/main' into codex/pr-1899-remove-duplicate-schema-test\n", "parents": [ "b5b73019f946e5edc0df506c9f8f4bb28afa6590", "d0edeec1009f1149956ee2a95dc5941aff8f78b5" ], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "b6651cb99fba8fec3fd3efcb6794ae32b8a1525d", "subject": "fix(javascript): retain completed facts through cancellation (#1934)", "body": "fix(javascript): retain completed facts through cancellation (#1934)", "parents": ["0b2aa6953123ef006a1fa9d4651552b7f18eeb70"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [1934] }, { "sha": "72489a9445299f695d793f004fed88e1bac0a557", "subject": "fix(javascript): report available parent result budget in coverage limits (#1915)", "body": "fix(javascript): report available parent result budget in coverage limits (#1915)\n\n* fix(javascript): size the future static reserve by remaining sources\n\nThe parent reserved 80% of its result budget for future static facts\nwhenever any source remained, so one tiny later file could discard an\nearlier file's completed semantic graph. Reserve at most one bounded\nstatic checkpoint's retained size per remaining source, within the same\nshared pool, so many remaining sources keep the previous protection.\nParent-budget rejections now report the effective admission budget and\nexplain that the CLI/MCP process heap, not max_heap_mb, bounds them.\n\nRefs #1911\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(javascript): make parent budget remediation and its test runtime-aware\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(javascript): suggest a concrete parent heap size in remediation\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(javascript): let parent budget rejections state their retained facts\n\nCo-Authored-By: Claude Opus 5.5 \n\n---------\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["b6651cb99fba8fec3fd3efcb6794ae32b8a1525d"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [1915] }, { "sha": "0f4992fb9e5bfe1fafe75c35b7f20ad411595573", "subject": "perf(ghidra): compile bundle activator with bridge scripts (#1931)", "body": "perf(ghidra): compile bundle activator with bridge scripts (#1931)\n\nInclude the no-op OSGi lifecycle class in the packaged source bundle so\nGhidra does not generate and compile an extra activator afterward.\nCheck the selected activator in the real packaged Windows verifier.\n\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>", "parents": ["72489a9445299f695d793f004fed88e1bac0a557"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } } ], "pullRequests": [1931] }, { "sha": "d802304c542b20bc86e22cc492718e89a8a5579b", "subject": "fix(install): describe automatic setup and guard truncated downloads (#1902)", "body": "fix(install): describe automatic setup and guard truncated downloads (#1902)\n\n* fix(install): describe automatic setup and guard truncated downloads\n\nThe help text said the installer only installs the CLI and that\n`rea setup` must be run separately, but the installer starts\n`rea setup` interactively whenever a terminal is available. Describe\nthat behaviour and the --no-setup/--no-prompt opt-out.\n\nWrap the installer body in `main` and call it on the last line, so a\ntruncated `curl | bash` download fails to parse instead of executing a\npartial script. Behaviour is otherwise unchanged.\n\nAdd an installer scenario that runs a copy truncated right after the\nnpm install line and requires that it prints nothing and never invokes\nnpm; it fails against the previous script.\n\nValidation: bash -n, shellcheck 0.10.0, installScript boundary tests.\n\n* fix(install): require the closing token before running main\n\nWrapping the installer in main() kept a truncated download from running\na partial body, but the last line was a bare `main \"$@\"`. If the piped\ndownload stopped right after `main` (or `main `), bash saw a complete\ncommand at EOF and ran main with no positional parameters. Under the\ndocumented `curl ... | bash -s -- --dry-run` (or --version / --no-setup)\npath that silently dropped the caller's flags, so a dry run could resolve\nthe latest release, run npm, and start setup.\n\nThe call now sits in a brace group:\n\n {\n main \"$@\"\n exit $?\n }\n\nBash does not run the group until it has read the closing brace, so\nevery truncation inside it is a syntax error and nothing executes; a\ntruncation before the group leaves only function definitions. A comment\nin install.sh records why the bare call is not enough.\n\nValidation: a new boundary test pipes install.sh to `bash -s --\n--dry-run` truncated at every byte offset from the end of main() to EOF\nand asserts that npm and the rea binary are never invoked; offsets\ninside the group must exit non-zero with a bash parse error and no\nstdout, offsets before it must print nothing, and the complete group\nmust finish the dry run. Reproduced the original bug by cutting the old\nscript after `main`: the dry run invoked npm install. `bash -n` and\nshellcheck 0.11.0 are clean.\n\n* fix(install): wrap the whole script in the truncation guard\n\nThe previous guard only wrapped the final `main \"$@\"` invocation, so the\npreamble streamed on the `curl ... | bash` path before any incomplete\ncompound command was open. A download cut off right after the bytes\n`set` reached EOF with a complete, argument-less `set`, which prints every\nshell variable, so inherited tokens could reach stdout.\n\nThe brace group now opens on line 2, directly after the shebang, and\ncloses on the last line, enclosing `set -euo pipefail`, the constants, the\nfunctions and the final `main \"$@\"` / `exit $?`. Bash must therefore read\nthe whole file before running anything; any earlier cut is a syntax error\nat EOF. `set -euo pipefail` still applies inside the group (checked\nmanually for `false`, an unbound variable, and a failing function body),\nand shellcheck 0.11.0 and `bash -n` are clean.\n\nThe truncation test now pipes every prefix of install.sh, from byte 0 to\nEOF (about 6,100 cuts, run 16 at a time with a minimal environment that\nincludes a sentinel variable), into `bash -s -- --dry-run`. Before the\ngroup opens it must exit quietly; inside the group it must fail with a\nsyntax error; in every case stdout stays empty and neither npm nor rea is\ninvoked. Only the complete script performs the dry run.", "parents": ["0f4992fb9e5bfe1fafe75c35b7f20ad411595573"], "authors": [ { "name": "Lluís Ariño", "email": "lluisalfons.arino@urv.cat", "user": { "login": "larinyo", "__typename": "User" } } ], "pullRequests": [1902] }, { "sha": "e59db2f5deefb1c5e74f01e19631f6d75cfaa25a", "subject": "fix(session): verify retained client liveness on open fast path", "body": "fix(session): verify retained client liveness on open fast path\n\nVerify retained provider operation health before reusing the same target and profile. Retire failed Hopper clients through existing owned cleanup, preserve healthy reuse and cancellation, and start replacement children lazily on the next query.\n\nRefs #1719. Actual headless Linux Hopper child-death/reopen recovery and 85 related tests passed against the current-main merge tree; Ghidra/IDA liveness and the historical snapshot report remain outside this verification.\n\nCo-authored-by: sx4im \nCo-authored-by: N0zoM1z0 <161784452+N0zoM1z0@users.noreply.github.com>\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>", "parents": ["d802304c542b20bc86e22cc492718e89a8a5579b"], "authors": [ { "name": "Saim Shafique", "email": "msaimshafique4664@gmail.com", "user": { "login": "sx4im", "__typename": "User" } }, { "name": "sx4im", "email": "sx4im@users.noreply.github.com", "user": { "login": "sx4im", "__typename": "User" } }, { "name": "N0zoM1z0", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } } ], "pullRequests": [1776] }, { "sha": "12ee785e5e61132898adecf9424ce6706a2e754a", "subject": "feat(website): follow the system dark mode and fix small-screen text (#1894)", "body": "feat(website): follow the system dark mode and fix small-screen text (#1894)\n\n* fix(website): keep text inside small screens and tidy small type and spacing\n\nFrom a layout audit of the built pages:\n\n- Long terminal prompts and code-header buttons wrap instead of being cut\n off at 320px (WCAG 1.4.10).\n- Headings and table cells break long words, so the 1.4.12 text-spacing\n test no longer widens pages past 320px.\n- Header and footer links get a 24px minimum height (2.5.8).\n- Labels that rendered under 12px now render at 12px or more, and inline\n code never drops under 0.75rem.\n- The home page's hero and definition rows share one column gap and align\n on the first baseline, and stacked boxes share one corner size.\n- Highlight chips get room around the text, and the active run in a step\n listing is one band instead of a box per line.\n\nColors are unchanged.\n\n🤖 Generated with Claude Code (Sonnet 5.5) 🦊\n\n* feat(website): follow the system dark mode\n\nThe site was light only, so a reader with a dark system still got a white\npage. Add one prefers-color-scheme: dark block to the stylesheet that swaps\nthe six color variables to Catppuccin Mocha (MIT) and overrides the fixed\ncolors that would break on a dark page: selection, buttons, tinted\nhighlights, flow nodes and arrows, and a visible border on the agent\nterminal.\n\nAdd a dark theme-color tag beside the light one in the page template and\nthe 17 pages, and a Dark column to the style guide's color table.\n\nLight colors are unchanged. The SVG figures follow in the next commit; the\nblog page's inline strokes, the dinosaur game and the social card are left\nas they are.\n\n🤖 Generated with Claude Code (Sonnet 5.5) 🦊\n\n* feat(website): give the five SVG figures a dark scheme\n\nPages load the figures with , so page CSS cannot reach inside them.\nEach figure now carries its own @media (prefers-color-scheme: dark) block\nof attribute-selector overrides that map every light color to a Catppuccin\nMocha color, with one shared map across all five. No markup, labels,\nshapes or positions change, and nothing uses !important.\n\nFour figures also paint a mantle canvas so \"Open figure\" works on its own;\nanalyst-thinking.svg stays transparent, since it sits on the page rather\nthan in a figure box.\n\n🤖 Generated with Claude Code (Sonnet 5.5) 🦊\n\n* chore(website): refresh translation source references\n\nThe theme-color tags move the page lines that the catalogs cite, so\npython3 scripts/website.py translations extract rewrites the source\nreferences in messages.pot and the 18 PO files. No message text changes.\nThe same run moves the \"Main navigation\" entry to its new position in each\ncatalog.\n\n🤖 Generated with Claude Code (Sonnet 5.5) 🦊\n\n* fix(website): keep inline step highlights inline\n\nThe full-width band for the active step now applies only to code-step\nblocks. The inline parameter highlights in the dx-ball and th04\nsignatures stay inline again.\n\n🤖 Generated with Claude Code (Opus 5.5) 🦊\n\n* test(website): check every page offers light and dark theme colors\n\nEach authored reading page, and its built copy in every language,\nmust carry one theme-color tag for light and one for dark. The\nstylesheet must keep its dark color scheme block. On the commit before\ndark mode, this test fails on every page.\n\n🤖 Generated with Claude Code (Opus 5.5) 🦊\n\n* fix(website): draw the dinosaur game in the page colors\n\nIn dark mode the game box turned dark, but the game still drew with\nits light colors, so the dinosaur, cacti and text fell to about 2:1\ncontrast. The canvas now reads five colors from CSS variables on\n.dino-stage. Light values are the old ones, so light mode draws the\nsame pixels. Dark values are Catppuccin Mocha: 8.3:1 for the\ndinosaur, 7.9:1 for cacti and text, 7.6:1 for the crash color.\n\nThe moved lines in dino-demo.js shift the translation catalog\nreferences, so the catalogs are refreshed too (reference comments\nonly).\n\n🤖 Generated with Claude Code (Opus 5.5) 🦊\n\n* fix(website): recolor the Touhou flywheel arrows in dark mode\n\nThe inline flywheel SVG on the Touhou article hard-codes its stroke\ncolors, so on the dark page its connectors fell to about 2:1. Two\ndark-only rules map those strokes to the page accent and muted colors\n(7.8:1 and 7.4:1). Light mode is unchanged.\n\n🤖 Generated with Claude Code (Opus 5.5) 🦊\n\n* fix(website): redraw the dinosaur game when the system theme changes\n\nThe canvas reads its colors only when it draws, so an idle, paused or\ncrashed game kept the old palette after a theme switch. Each demo now\nredraws on a prefers-color-scheme change.\n\nThe added lines shift the translation catalog references, so the\ncatalogs are refreshed too (reference comments only).\n\n🤖 Generated with Claude Code (Opus 5.5) 🦊\n\n---------\n\nCo-authored-by: Claude Sonnet 5.5 \nCo-authored-by: Claude Opus 5.5 ", "parents": ["e59db2f5deefb1c5e74f01e19631f6d75cfaa25a"], "authors": [ { "name": "Cassie_Fox", "email": "249835913+CassieFox23@users.noreply.github.com", "user": { "login": "CassieFox23", "__typename": "User" } }, { "name": "Claude Sonnet 5.5", "email": "sonnet@cassie-pc", "user": null }, { "name": "Claude Opus 5.5", "email": "opus@cassie-pc", "user": null } ], "pullRequests": [1894] }, { "sha": "9878bb7296c13c2b4838be76f6128e5fc31eda3c", "subject": "feat(ghidra): apply validated analyzer overrides before analysis", "body": "feat(ghidra): apply validated analyzer overrides before analysis\n\nApply caller-selected analyzer opt-outs before Ghidra analysis, reject unknown or ineffective names, and commit raw/header imports to the same analyzer profile. Use supported x86 raw compiler specs and cover the real analyzer/readback and raw workflows.\n\nAdopts the original implementation from #1800 with validated corrections. Refs #1783, #1836.\n\nCo-authored-by: akushonkamen <74654766+akushonkamen@users.noreply.github.com>\nCo-authored-by: N0zoM1z0 <161784452+N0zoM1z0@users.noreply.github.com>\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>", "parents": ["12ee785e5e61132898adecf9424ce6706a2e754a"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "akushonkamen", "email": "74654766+akushonkamen@users.noreply.github.com", "user": { "login": "akushonkamen", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } } ], "pullRequests": [1913] }, { "sha": "0d8b728d2470a9b51239d61986944bacaf9a8708", "subject": "docs(agents): require related brittleness cleanup in bug fixes", "body": "docs(agents): require related brittleness cleanup in bug fixes\n", "parents": ["9878bb7296c13c2b4838be76f6128e5fc31eda3c"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "85c1d2587a7d42c6e2108405c802fe7f7b046c15", "subject": "feat(javascript): analyze selected application sources", "body": "feat(javascript): analyze selected application sources\n\nAnalyze exact selected sources in first-request order before unrelated\nstatic scopes, preserving full artifact identity and byte verification.\nRetain selection in CLI/MCP Evidence and summaries, with explicit unknowns\nand partial coverage for unselected sources. Keep default full analysis.\n\nFixes #1848\n\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>", "parents": ["0d8b728d2470a9b51239d61986944bacaf9a8708"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "factory-droid[bot]", "email": "138933559+factory-droid[bot]@users.noreply.github.com", "user": { "login": "factory-droid[bot]", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } } ], "pullRequests": [1944] }, { "sha": "14935e4d470be318fdee442d279d6acb7d441119", "subject": "fix(javascript): preserve package and source-map boundary identity (#1939)", "body": "fix(javascript): preserve package and source-map boundary identity (#1939)\n\n* fix(javascript): preserve bare package specifier suffixes\n\n* fix(javascript): resolve ESM package self references\n\n* fix(javascript): recover retained prefixed source maps\n\n* test(javascript): cover suffixed ESM self references\n\n* fix(javascript): retain legacy ESM package suffix behavior\n\n* fix(javascript): reject legacy ESM directory and extension fallback\n\n* refactor(javascript): consolidate package resolution and workflow coverage\n\n* fix(javascript): report exact ESM package subpath misses\n\n* fix(javascript): compare parsed names for ESM self references\n\n* refactor(javascript): parse bare package requests once\n\n* fix(javascript): derive ESM dependency lookup from package URLs\n\n---------\n\nCo-authored-by: hhang <169027046+xu91102@users.noreply.github.com>", "parents": ["85c1d2587a7d42c6e2108405c802fe7f7b046c15"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "hhang", "email": "169027046+xu91102@users.noreply.github.com", "user": { "login": "xu91102", "__typename": "User" } } ], "pullRequests": [1939] }, { "sha": "c2cf7dcb86e11350214f82e5c51de7ca6ee3d27a", "subject": "fix(managed): index attribute constructor owners once per layout (#1943)", "body": "fix(managed): index attribute constructor owners once per layout (#1943)\n\nEach CustomAttribute whose constructor is a local MethodDef scanned the\nTypeDef table to find the declaring type, so inspect_managed_artifact did\nO(attributes x types) row decoding. A 584 KB assembly with 16,000 types\nand 16,000 such attributes blocked for about 38 s.\n\nBuild a first-match owner index once per metadata layout. Already-owned\nlist positions are skipped, so overlapping malformed method lists keep\ntheir previous first-match owner in near-linear time. The index is\ncharged to the decode budget, and a build failure is cached like the\nmember pointer lookup.\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["14935e4d470be318fdee442d279d6acb7d441119"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [1943] }, { "sha": "0ae38e1e31414c67a3be09231d208f0726c035f8", "subject": "fix(ida): preserve non-x86 call edges and workflow uncertainty (#1906)", "body": "fix(ida): preserve non-x86 call edges and workflow uncertainty (#1906)\n\n* test(ida): expect callee edges from the call graph on non-x86 targets\n\n* fix(ida): read callee edges from the call graph on non-x86 targets\n\n* test(ida): pin address order of call graph additions\n\n* docs(ida): describe the call graph source for non-x86 callees\n\n* test(ida): pin the x86 baseline, the call graph reader and its failure modes\n\n* fix(ida): check the call graph root, scope truncation to the root and degrade without callgraph\n\n* test(ida): expect managed PE off the x86 path, possible-truncation wording and a complete ARM64 traversal\n\n* fix(ida): keep managed PE and x86 reads off the call graph path and qualify truncation\n\n* test(ida): answer only expected leaf roots and assert the requested call graph roots\n\n* test(ida): expect a call graph the producer cannot give consistently to fail the callee read\n\n* fix(ida): fail the callee read when the call graph cannot be obtained consistently\n\n* fix(ida): preserve call edge authority and workflow uncertainty\n\n* fix(ida): preserve explicit root call graph caps\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["c2cf7dcb86e11350214f82e5c51de7ca6ee3d27a"], "authors": [ { "name": "Mykola Dementiev", "email": "nikolay-dementiev@users.noreply.github.com", "user": { "login": "nikolay-dementiev", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [1906] }, { "sha": "7cdb7981c3612bc42bd0153fddd9c33b639918ed", "subject": "fix(apktool): name host requirements in configuration refusals (#1946)", "body": "fix(apktool): name host requirements in configuration refusals (#1946)\n\nA missing apktool launcher projected the generic \"unavailable for the\ncurrent target\" message and remediation, leaving the actual reason only\nin details.reason. A relative REA_APKTOOL_COMMAND escaped as UNKNOWN\nbecause command selection ran before the try that maps configuration\nfailures.\n\nResolve the selection inside that try for both execution and\navailability, and pass the refusal reason as userMessage, as JADX and\nthe adapters fixed in #1224 do.\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["0ae38e1e31414c67a3be09231d208f0726c035f8"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [1946] }, { "sha": "1449e8e05138bf0c86d5fe6f4c93122b4b93b2b1", "subject": "fix(mcp): provide native evidence paging continuation", "body": "fix(mcp): provide native evidence paging continuation\n\nSupply schema-validated inspect_analysis_view arguments after completed native function Evidence is recorded and exceeds MCP delivery capacity. Preserve the full canonical result and its provenance. Verify exact source paging, export and following-call usability through real Ghidra stdio MCP.\n\nFixes #1849\n\nCo-authored-by: Minghang Chamling <133689405+cold-atom@users.noreply.github.com>\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>", "parents": ["7cdb7981c3612bc42bd0153fddd9c33b639918ed"], "authors": [ { "name": "Minghang Chamling", "email": "133689405+cold-atom@users.noreply.github.com", "user": { "login": "cold-atom", "__typename": "User" } }, { "name": "factory-droid[bot]", "email": "138933559+factory-droid[bot]@users.noreply.github.com", "user": { "login": "factory-droid[bot]", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } } ], "pullRequests": [1910] }, { "sha": "52e76c5d39b58d1685bb5e22bd40d19524dfa2cb", "subject": "fix(managed): share first-match member ownership indexes", "body": "fix(managed): share first-match member ownership indexes\n\nResolve fields, methods, and attribute constructors through one budgeted index per layout. Preserve malformed-list first-match ownership without per-member TypeDef scans; remove the superseded lookup implementations.\n\nValidate pointer identity and malformed ranges through production parsers, including a 40,000-type/method case and allocation admission. Managed source tests and CLI/MCP pointer acceptance pass. Refs #1953.\n", "parents": ["1449e8e05138bf0c86d5fe6f4c93122b4b93b2b1"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "c42232f566d55fe7191763649755148c768eef9f", "subject": "fix(adb): share actionable provider configuration refusals", "body": "fix(adb): share actionable provider configuration refusals\n\nCatch binary selection failures at the adapter boundary and share the domain error projection with apktool. Missing and relative adb paths now report capability_unavailable with host configuration guidance in both message and remediation.\n\nValidation: ADB/apktool provider suites and public CLI refusal suites pass. No connected-device behavior changed or verified. Refs #1952.\n", "parents": ["52e76c5d39b58d1685bb5e22bd40d19524dfa2cb"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "f64790bfc32db330b2be5bdff61af555a9d26067", "subject": "refactor(javascript): reuse validated source-map decoding", "body": "refactor(javascript): reuse validated source-map decoding\n\nPass typed map objects into the codec and reuse validated TraceMap instances for regular and indexed lookups. Remove whole-map serialization, duplicate leaf decoding, an array-copy wrapper, and the unused offset-validation mode in artifact declaration collection.\n\nValidation: source-map and browser consumer suites (126 tests), declaration tests, and artifact reconstruction boundaries pass. Section overlap checks and raw source declarations remain intact.\n", "parents": ["c42232f566d55fe7191763649755148c768eef9f"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "09b68285166bef2b7633402c8adf7eb25823b47e", "subject": "fix(process): cancel run-token reads during sampling", "body": "fix(process): cancel run-token reads during sampling\n\nPropagate the sample AbortSignal through readProcessRunId to host environment inspection so cancellation can settle a blocked ownership-token read.\n\nValidation: ownership and capture lifecycle suites pass, including an abort-waiting host regression. Native provider runtime behavior was not exercised.\n", "parents": ["f64790bfc32db330b2be5bdff61af555a9d26067"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "3d8313598785359c424d7305f503cb69fc8639a6", "subject": "fix(reference): verify symlink identity around target reads", "body": "fix(reference): verify symlink identity around target reads\n\nBracket symlink target observation with the identity captured during enumeration. Report replacements and disappearing links as changed, and keep cancellation and I/O mapping at one owner boundary.\n\nRemove duplicate target-error wrappers and unreachable external-target handling. Validation: reference reader filesystem suite passes, including deterministic replacement during observation.\n", "parents": ["09b68285166bef2b7633402c8adf7eb25823b47e"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "dc303a8ee8a2ceaae37e4da4ac4ed64035793d59", "subject": "test(javascript): classify artifact workflows as boundary tests", "body": "test(javascript): classify artifact workflows as boundary tests\n\nMove the six JavaScript application suites that read production artifacts or launch compiled analysis workers out of composition. Focused test planning now prepares their runtime prerequisites instead of treating them as source-only tests.\n\nValidation: all six relocated suites and adjacent artifact/reference suites pass (70 tests across eight files); discovery finds every test exactly once.\n", "parents": ["3d8313598785359c424d7305f503cb69fc8639a6"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "12fa8fd9f986dbd4ff58165c3ec71a46dc8a8a3b", "subject": "fix(ida): recover cleanup after worker sessions are reaped", "body": "fix(ida): recover cleanup after worker sessions are reaped\n\nAccept the supervisor absent-session response only for the owned session, then independently verify session and private-input absence before releasing the workspace. Keep failed inventory verification retryable without resending a completed close.\n\nValidation: 59 focused source tests passed, including live private-input peers, unavailable inventory, and mismatched session IDs. Real IDA engine behavior remains unverified. Fixes #1710.\n", "parents": ["dc303a8ee8a2ceaae37e4da4ac4ed64035793d59"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "c2b56e3e1c9619beab15de8e1f200422473caf30", "subject": "test: classify filesystem and process workflows by boundary", "body": "test: classify filesystem and process workflows by boundary\n\nMove artifact inventory, application projection, runtime reconciliation, and TODO scanner suites into their real boundary lanes. Extract Hopper process/socket cleanup cases while keeping injected session cleanup cases in composition.\n\nValidation: all 56 focused tests passed; discovery finds all 876 test files exactly once. Test assertions and provider verification scope are unchanged.\n", "parents": ["12fa8fd9f986dbd4ff58165c3ec71a46dc8a8a3b"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "a82e37c8065cc200a0ca3e14e7c4f85e4e468580", "subject": "fix(browser): retain module resolver cleanup ownership", "body": "fix(browser): retain module resolver cleanup ownership\n\nSerialize resolution with shutdown, retain the owned browser after close failures, and retry cleanup before another launch. Wire cleanup through the shared service and CLI/MCP lifecycles, preserving primary failures and completed native reports alongside cleanup diagnostics.\n\nSeparate the browser resolution workflow from lifecycle ownership. Validation: seven resolver source tests, eleven application tests, MCP shutdown retry, public CLI parity, and full static/architecture checks passed. Real Chromium behavior remains unverified.\n", "parents": ["c2b56e3e1c9619beab15de8e1f200422473caf30"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "918713af376e307ecf24d75e6a0dd9d1b544545b", "subject": "fix(artifacts): bind directory reads to captured file state", "body": "fix(artifacts): bind directory reads to captured file state\n\nCapture exact filesystem identity and nanosecond timestamps, validate descriptor/path state before and after streaming, and enforce the captured byte count. Bound growing files to their captured size plus one byte using precise positional reads; keep unrepresentable display sizes explicitly unknown.\n\nReuse the captured-state comparison around Apple assetutil and retain existing reader cleanup ownership. Validation: focused reader and affected consumer suites, full static/architecture checks, and a compiled directory-read probe on Bun 1.3.14 passed. Includes same-size mutation, growth, truncation, cancellation, FIFO replacement, cleanup retry, ZIP identity forgery, ASAR and Mach-O coverage.\n", "parents": ["a82e37c8065cc200a0ca3e14e7c4f85e4e468580"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "804c287e441dcaa3876429f026ac89f6482f9699", "subject": "test: classify filesystem application workflows as boundaries", "body": "test: classify filesystem application workflows as boundaries\n", "parents": ["918713af376e307ecf24d75e6a0dd9d1b544545b"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "5ba1642a7d891a60493b2195e55149b0f3197fb4", "subject": "test: strengthen archive and resource cleanup assertions", "body": "test: strengthen archive and resource cleanup assertions\n\nReplace duplicate path-helper checks with real ZIP inventory coverage and replace global memory sampling with bounded-chunk assertions while retaining 64 MiB digest coverage. Await artifact client cleanup, preserve Hopper lease ownership during teardown, and expose typed application failures.\n", "parents": ["804c287e441dcaa3876429f026ac89f6482f9699"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "5e219de44134d34f5a07a9cd1911fb2295bf1d88", "subject": "feat(ghidra): admit soft-float MIPS32r2 ELF with integer-register float storage (#1949)", "body": "feat(ghidra): admit soft-float MIPS32r2 ELF with integer-register float storage (#1949)\n\n* feat(ghidra): admit soft-float MIPS32r2 ELF with integer-register float storage\n\nSoft-float o32 executables (Linux kernel builds, bare-metal firmware) were\nrefused because their ABI flags record declares no CPR1 and FP ABI 3.\nGhidra's MIPS32 compiler specifications model only hard-float o32, so typed\nfloat/double signatures (DWARF) would be bound to $f12/$f14/$f0 and the\ndecompiler loses the real dataflow: `return sel ? a : b` decompiled to\n`return in_f0;`, and callers passed phantom FPU inputs.\n\nAdmit ELF32 ET_EXEC o32 MIPS32r2 targets whose ABI record declares soft-float\nwith no CPR1, and commit `mips_soft_float_storage: o32-integer-registers-v1`\nin their analysis profile only (hard-float profile digests are unchanged).\nReaGhidraMipsSoftFloat.java runs after auto-analysis and, for each function\nwith a float/double formal type, either keeps the types with the storage\nGhidra's o32 model assigns to a same-size integer (pair alignment, stack\nspill), or, for auto-parameters such as hidden struct-return pointers, swaps\nfloat types for same-size integers under dynamic storage. No function is left\non hard-float storage. The report is written last; the provider client\nrequires it exactly when the profile commits the policy and refuses the\nsession before any operation otherwise.\n\nVerification: real Ghidra 12.1.4 lane (verify:ghidra:mips) now builds\nhard- and soft-float fixtures in both byte orders and checks exact\nparameter/return storage through inspect_native_api, caller constants,\nsnapshot profile and Evidence outcome; test:fast, verify:package and an\ninstalled-tarball soft-float run pass.\n\n* fix(ghidra): model soft-float MIPS as a prototype for every typed callable\n\nReview feedback on #1949: rewriting storage per Function left external\nfunctions and indirect calls through typed function pointers on Ghidra's\nhard-float o32 prototype, which still read $f12/$f14/$f0 while the session\nreported success. A negative control confirms it: without the change,\n`(*rea_mips_soft_callback)(8.5f, 9.5f, sel)` decompiles to\n`(*rea_mips_soft_callback)(in_f12, in_f14, sel)`.\n\nReaGhidraMipsSoftFloat.java now derives a `__rea_soft_float` prototype from\nthe program's own default o32 model (encoded, float pentries and\nfloat-consuming rules removed, so byte-order-specific aggregate rules and the\nhidden struct-return pointer are kept), installs it as a specification\nextension, and assigns it with dynamic storage to every non-thunk function,\nexternal function and function-pointer definition whose formal types use\nfloat or double. Thunks follow their targets. Float types are kept\neverywhere, so the integer-retype fallback is removed. The script fails\nwithout writing its report if the derived prototype or any reassigned\nfunction still uses an FPU register.\n\nThe policy becomes `o32-soft-float-prototype-v1` with a\n{functions, definitions} report. The soft-float fixture adds an indirect\ncall through a typed pointer; the real-Ghidra lane requires its constants\nwith no FPU inputs and the struct return's `float scale` in $a1.\n\n* test(ghidra): pin ODDSPREG acceptance for soft-float MIPS ABI records\n\nReview on #1949 suggested requiring flags1 == 0 for soft-float, since MIPS_AFL_FLAGS1_ODDSPREG names CPR1 registers. GCC 5.2 kernel modules, LLVM/Rust firmware and Clang -msoft-float objects all record flags1 = 1 with FP ABI soft-float: it is the MIPS32 o32 toolchain default and selects nothing without CPR1. Keep accepting it, say why at the check, and test that soft-float with ODDSPREG is admitted while any other general flag is refused.", "parents": ["5ba1642a7d891a60493b2195e55149b0f3197fb4"], "authors": [ { "name": "Aurelio Bernal", "email": "aurelio@bernalr.com", "user": { "login": "AurelioB", "__typename": "User" } } ], "pullRequests": [1949] }, { "sha": "290d301ec770955f313c2d48678ed0ae3b9f8a73", "subject": "feat(ghidra): admit relocatable MIPS32r2 ELF objects (#1950)", "body": "feat(ghidra): admit relocatable MIPS32r2 ELF objects (#1950)\n\n* feat(ghidra): admit soft-float MIPS32r2 ELF with integer-register float storage\n\nSoft-float o32 executables (Linux kernel builds, bare-metal firmware) were\nrefused because their ABI flags record declares no CPR1 and FP ABI 3.\nGhidra's MIPS32 compiler specifications model only hard-float o32, so typed\nfloat/double signatures (DWARF) would be bound to $f12/$f14/$f0 and the\ndecompiler loses the real dataflow: `return sel ? a : b` decompiled to\n`return in_f0;`, and callers passed phantom FPU inputs.\n\nAdmit ELF32 ET_EXEC o32 MIPS32r2 targets whose ABI record declares soft-float\nwith no CPR1, and commit `mips_soft_float_storage: o32-integer-registers-v1`\nin their analysis profile only (hard-float profile digests are unchanged).\nReaGhidraMipsSoftFloat.java runs after auto-analysis and, for each function\nwith a float/double formal type, either keeps the types with the storage\nGhidra's o32 model assigns to a same-size integer (pair alignment, stack\nspill), or, for auto-parameters such as hidden struct-return pointers, swaps\nfloat types for same-size integers under dynamic storage. No function is left\non hard-float storage. The report is written last; the provider client\nrequires it exactly when the profile commits the policy and refuses the\nsession before any operation otherwise.\n\nVerification: real Ghidra 12.1.4 lane (verify:ghidra:mips) now builds\nhard- and soft-float fixtures in both byte orders and checks exact\nparameter/return storage through inspect_native_api, caller constants,\nsnapshot profile and Evidence outcome; test:fast, verify:package and an\ninstalled-tarball soft-float run pass.\n\n* fix(ghidra): model soft-float MIPS as a prototype for every typed callable\n\nReview feedback on #1949: rewriting storage per Function left external\nfunctions and indirect calls through typed function pointers on Ghidra's\nhard-float o32 prototype, which still read $f12/$f14/$f0 while the session\nreported success. A negative control confirms it: without the change,\n`(*rea_mips_soft_callback)(8.5f, 9.5f, sel)` decompiles to\n`(*rea_mips_soft_callback)(in_f12, in_f14, sel)`.\n\nReaGhidraMipsSoftFloat.java now derives a `__rea_soft_float` prototype from\nthe program's own default o32 model (encoded, float pentries and\nfloat-consuming rules removed, so byte-order-specific aggregate rules and the\nhidden struct-return pointer are kept), installs it as a specification\nextension, and assigns it with dynamic storage to every non-thunk function,\nexternal function and function-pointer definition whose formal types use\nfloat or double. Thunks follow their targets. Float types are kept\neverywhere, so the integer-retype fallback is removed. The script fails\nwithout writing its report if the derived prototype or any reassigned\nfunction still uses an FPU register.\n\nThe policy becomes `o32-soft-float-prototype-v1` with a\n{functions, definitions} report. The soft-float fixture adds an indirect\ncall through a typed pointer; the real-Ghidra lane requires its constants\nwith no FPU inputs and the struct return's `float scale` in $a1.\n\n* test(ghidra): pin ODDSPREG acceptance for soft-float MIPS ABI records\n\nReview on #1949 suggested requiring flags1 == 0 for soft-float, since MIPS_AFL_FLAGS1_ODDSPREG names CPR1 registers. GCC 5.2 kernel modules, LLVM/Rust firmware and Clang -msoft-float objects all record flags1 = 1 with FP ABI soft-float: it is the MIPS32 o32 toolchain default and selects nothing without CPR1. Keep accepting it, say why at the check, and test that soft-float with ODDSPREG is admitted while any other general flag is refused.\n\n* feat(ghidra): admit relocatable MIPS32r2 ELF objects\n\nLinux MIPS kernel modules (.ko) and other ELF32 o32 MIPS32r2 ET_REL objects\nwere refused by the Ghidra MIPS lane. Ghidra's ELF loader already places each\nallocated section and applies REL relocations; this admits ET_REL alongside\nET_EXEC (ET_DYN and PRX stay refused) under its own support lane,\n`elf32-rel-o32-arch32r2-standard-v1`, so executable targets keep theirs.\nRelocatable sessions carry limitations: addresses are analysis coordinates,\nundefined symbols live in Ghidra's EXTERNAL block, and HI16 relocations report\nPARTIAL because Ghidra applies them with their paired LO16.\n\nVerification: new `verify:ghidra:mips-relocatable` real-Ghidra lane builds\n-c -G0 objects in both byte orders plus a soft-float -mlong-calls module\nvariant. GNU readelf supplies sections, symbols and REL entries; every\nrelocation in an allocated section must encode S + A in the loaded word\n(S from Ghidra placement, A from original bytes), with HI16/LO16 checked as\nthe effective address each LO16 forms, and coverage of a shared HI16, a LO16\ncarry, external code/data and R_MIPS_32 is asserted. The executable lane,\nunit suites pass, and on 30 real .ko files 54,972 relocations matched (93 reference empty sections and are not checkable).\n\n* fix(ghidra): verify every MIPS HI16 and archive-typed soft-float externals\n\nReview feedback on #1950:\n\n- The relocation oracle kept one pending HI16, so a second HI16 before the\n LO16 that resolves both overwrote the first, and unrelated relocations\n cleared it; the earlier site's high half and carry were never compared\n with S + A. Every HI16 now waits for the next LO16 of its symbol, which\n checks all of them; later LO16s reuse those HI16s, and a HI16 left\n unresolved at a section end fails. On 30 real soft-float kernel modules,\n 24 contain several HI16s per LO16; all 54,972 placed relocations match.\n- External callees with float prototypes: the relocatable fixture now calls\n powf, whose prototype Ghidra's C library archive applies by name. Every\n variant must decompile `powf(1.5,2.5)` without FPU inputs, and the\n soft-float module variant must report that __rea_soft_float covered it\n (with the external step removed it decompiles as `powf(param_1,param_2)`).\n `-fno-builtin` keeps the call from being folded.\n\nAlso updates the module variant's expected soft-float policy to\n`o32-soft-float-prototype-v1`.\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["5e219de44134d34f5a07a9cd1911fb2295bf1d88"], "authors": [ { "name": "Aurelio Bernal", "email": "aurelio@bernalr.com", "user": { "login": "AurelioB", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [1950] }, { "sha": "eb97da33881e3d1472d97a7d788ee35944fb6b07", "subject": "fix(artifacts): retain ASAR resources through cleanup failures", "body": "fix(artifacts): retain ASAR resources through cleanup failures\n\nGive snapshot capture, header admission, packed members, and container streams one file-handle owner. Serialize adoption with reader shutdown, retain failed closes for retry, and remove snapshots only after descriptor cleanup succeeds.\n\nCover unread members, pending opens, zero-byte members, and paired format/cleanup failures. Keep intentionally unrecoverable test fixtures hygienic and strengthen managed identity and process cleanup-authority expectations.\n\nValidation: full npm run check; 99 targeted tests and temporary-directory hygiene; exact discovery of 877 test files. No real vendor-provider verification was performed.\n", "parents": ["290d301ec770955f313c2d48678ed0ae3b9f8a73"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "7d92d93a550f3be221d7cf1da07c37ea1770e922", "subject": "fix(managed): share first-match member list ownership (#1955)", "body": "fix(managed): share first-match member list ownership (#1955)\n\nInventory attribute lookups and the members inspector each interpreted\nTypeDef member-list ownership. The members lookup binary-searched ordered\nranges but fell back to a per-member scan of every type when malformed\nlists were unordered, which was quadratic (8 s for 100,000 types).\n\nBoth now use firstMatchListOwners, one near-linear first-match index over\none-based list positions. Remove the ordered/fallback split and the\nproduction declaringType scan, which remains only as the test oracle. The\ninventory reserves only its retained index.\n\nCo-authored-by: Claude Opus 5.5 \nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["eb97da33881e3d1472d97a7d788ee35944fb6b07"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [1955] }, { "sha": "39418ea173763ca55d4f116992ee903bcaeb1898", "subject": "fix(adb): share host configuration refusals with apktool (#1954)", "body": "fix(adb): share host configuration refusals with apktool (#1954)\n\nThe ADB provider, which the apktool provider mirrors, had the same two\ndefects: a relative REA_ADB_PATH escaped as UNKNOWN because selection\nran before the try that maps configuration failures, and a missing adb\nbinary projected generic target advice instead of its reason.\n\nMove the configuration-failure-to-refusal mapping into one\nproviderConfigurationRefusal helper used by both providers, resolve the\nADB selection inside the mapped try, and share the CLI refusal assertion.\n\nCo-authored-by: Claude Opus 5.5 \nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["7d92d93a550f3be221d7cf1da07c37ea1770e922"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [1954] }, { "sha": "c2407689cb04df082e8db0b6afa8f8d022f6bcd1", "subject": "fix(setup): preserve skill files and report rollback failures", "body": "fix(setup): preserve skill files and report rollback failures\n\nTrack attempted writes, preserve original content and modes from one regular-file observation, and continue rollback after individual failures. Return tagged failure details and retained backup paths through setup.\n\nValidation: setup filesystem and recovery tests, combined compile/typecheck/lint/format/metadata/architecture checks. Filesystem fault injection covers backup, ambiguous publication, and rollback failures.\n", "parents": ["39418ea173763ca55d4f116992ee903bcaeb1898"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "2260887f2092be6a3d9c79509e4ae4a3e52fce7f", "subject": "fix(artifacts): close mounted directory resources before DMG detach", "body": "fix(artifacts): close mounted directory resources before DMG detach\n\nWait for directory operations, close owned streams and traversal handles, and retain the mounted reader when cleanup fails so close can retry before detach. Consolidate stable-artifact filesystem regressions into the boundary suite.\n\nValidation: 35 artifact tests and temporary-directory hygiene, including real hdiutil diagnostics. Directory-close and traversal races use injected faults.\n", "parents": ["c2407689cb04df082e8db0b6afa8f8d022f6bcd1"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "c002b89e2d8130a3c07e25e5fd604876be18c703", "subject": "fix(snapshot): bind replayed subjects to the selected target path", "body": "fix(snapshot): bind replayed subjects to the selected target path\n\nRebind display paths only for matching artifact identities in primitive and composed replay. Preserve semantic Evidence IDs, payloads, and historical snapshot provenance. Classify snapshot filesystem workflows as boundary tests.\n\nValidation: cache, direct workflow, MCP replay, and Evidence tests; combined checks and temporary-directory hygiene. Provider interactions are simulated for replay verification.\n", "parents": ["2260887f2092be6a3d9c79509e4ae4a3e52fce7f"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "a8d4984404b611e60b88bc42289c0ba07eee4578", "subject": "fix(browser): preserve uncertainty in malformed network observations", "body": "fix(browser): preserve uncertainty in malformed network observations\n\nRequire observed request method and initiator metadata instead of inventing defaults. Preserve valid redirect history while excluding later events for malformed reused IDs. Keep unavailable or invalid encoded lengths unknown and retain valid zero values.\n\nValidation: 57 CDP boundary tests plus temporary-directory hygiene and combined checks. Protocol events come from the fake CDP server; no live browser verification is claimed.\n", "parents": ["c002b89e2d8130a3c07e25e5fd604876be18c703"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "108b5f94254281639badd25b1f448cca35dc89a2", "subject": "fix(native): reject ambiguous otool load-command framing", "body": "fix(native): reject ambiguous otool load-command framing\n\nValidate Mach command counts, byte totals, scalar uniqueness, section counts, and build-tool counts before claiming exhaustive evidence. Preserve raw output in typed parsing failures and distinguish dylib commands from the dynamic loader. Correct inconsistent handcrafted fixtures and label their provenance.\n\nValidation: 38 native tests, combined checks, and temporary-directory hygiene. Multiline dylib-name ambiguity was reproduced with the host Apple otool; regression workflows use captured output and injected command runners.\n", "parents": ["a8d4984404b611e60b88bc42289c0ba07eee4578"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "beb80a07bafc0847600eb635e0323068a386c811", "subject": "test(cli): consolidate schema coverage and assert input refusals", "body": "test(cli): consolidate schema coverage and assert input refusals\n\nRemove 30 redundant truthy-JSON schema checks. Validate advertised groups and property parity across every primary command, retain required-field checks, and assert structured malformed-input errors. Exercise JEB positional validation rather than an unknown flag.\n\nValidation: 13 public CLI adapter tests, combined checks, and temporary-directory hygiene. Host configuration refusal coverage from main is preserved.\n", "parents": ["108b5f94254281639badd25b1f448cca35dc89a2"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "9eee709f0cc4064808579c225814898a475ca388", "subject": "fix(wasm): accept unpadded WABT section rows (#1963)", "body": "fix(wasm): accept unpadded WABT section rows (#1963)\n\n* fix(wasm): accept unpadded WABT section rows\n\nWABT 1.0.42 right-aligns section names in a nine-column field. DataCount\nfills that field, so its objdump row has no leading whitespace. Accept\nthat legal row. Header recognition, the required field shape, and section\nrange checks still reject malformed output.\n\nFixes #1956\n\n* fix(ci): refresh MIPS expectations and Windows test paths\n\nAssert admitted soft-float ABI metadata and its committed storage policy through the public target resolver, retain FP64 rejection, and point the curated Windows lane at the moved filesystem reconstruction tests.\n\nValidation: reproduced all four prior failures; 97 focused tests and check:ci pass. Native Windows and real Ghidra execution were not performed locally.\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["beb80a07bafc0847600eb635e0323068a386c811"], "authors": [ { "name": "Nithilan Kumaran", "email": "126580000+sathariels@users.noreply.github.com", "user": { "login": "sathariels", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [1963] }, { "sha": "1d4c4eb0308b4cb5761a91533edeb33fcfb442f2", "subject": "fix(adb): reject unsafe host file names when pulling one device file (#1962)", "body": "fix(adb): reject unsafe host file names when pulling one device file (#1962)\n\npull_adb_file derived its host file name from the last path segment of a\ncaller-supplied device path and joined it to the output directory without\nchecking that the name is usable on the host. A device path ending in a\nseparator, a dot segment, a control character, a Windows reserved device\nname, a trailing dot or space, or a ':' alternate-data-stream marker could\nresolve to an unexpected host path or fail opaquely after the transfer.\n\nThe single-file path now derives the name with POSIX semantics and refuses\nany non-portable segment as invalid_request before creating a directory or\nrunning adb pull. This matches the package path's pending host-name policy\nand never renames a device-reported file.\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["9eee709f0cc4064808579c225814898a475ca388"], "authors": [ { "name": "Dery Ferdika", "email": "114888155+DeryFerd@users.noreply.github.com", "user": { "login": "DeryFerd", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [1962] }, { "sha": "b777e5d4d8a7b60edad7d5c0eaa56408a4b3f610", "subject": "fix(wasm): preserve debug module names in WABT output (#1967)", "body": "fix(wasm): preserve debug module names in WABT output (#1967)\n\n* fix(wasm): preserve debug module names in WABT output\n\n* fix(native): accept otool dylib-use options\n\nPreserve modern dylib options while requiring one encoding metadata row and retaining duplicate and multiline-output checks. Share field parsing between preservation and validation.\n\nVerify delayed dylibs through real macOS CLI/MCP workflows and refresh the high-address golden with the provider's -h -l capture. Validated 85 focused native tests, npm run check, and verify:macos-bundle on macOS arm64.\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["1d4c4eb0308b4cb5761a91533edeb33fcfb442f2"], "authors": [ { "name": "Arthas", "email": "29607505+bugstan@users.noreply.github.com", "user": { "login": "bugstan", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [1967] }, { "sha": "f1924cf9c1910d5d29d11e7bf634b51af8d738cf", "subject": "fix(plist): decode formatted XML dictionary keys", "body": "fix(plist): decode formatted XML dictionary keys\n", "parents": ["b777e5d4d8a7b60edad7d5c0eaa56408a4b3f610"], "authors": [ { "name": "Aliciawque", "email": "166712943+Aliciawque@users.noreply.github.com", "user": { "login": "Aliciawque", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "9c8511409c0706f9979c2b68dd56aaaf9f21e191", "subject": "fix(analysis): preserve relationship coverage across evidence and replay", "body": "fix(analysis): preserve relationship coverage across evidence and replay\n\nSeparate observed relationship coverage from general provider caveats. Authenticate and replay coverage without changing legacy Evidence IDs; expose unknown and capped relationship sets through CLI/MCP graphs and traces.\n\nValidated focused domain, snapshot, IDA/Ghidra boundary, MCP, schema, package and static checks. Provider fixtures establish contract behavior; licensed engine behavior was not reverified.\n", "parents": ["f1924cf9c1910d5d29d11e7bf634b51af8d738cf"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "dcfc5d403ac997c2b08bee4753e57a1a4a8a8538", "subject": "fix(setup): retain regular-file cleanup ownership through workflows", "body": "fix(setup): retain regular-file cleanup ownership through workflows\n\nThread the existing resource scope through skill and client configuration reads. Keep failed-close handles owned, wait for admitted reads, and surface unresolved cleanup alongside doctor, uninstall and update results.\n\nValidated focused setup/doctor/update and filesystem boundary checks, temporary-file hygiene, packaged setup/update/uninstall workflows, and static checks. No external provider installation was performed.\n", "parents": ["9c8511409c0706f9979c2b68dd56aaaf9f21e191"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "74d7da6ced0f869936ee0316b00616931b088066", "subject": "fix(artifacts): preserve ZIP identities and partial managed metadata", "body": "fix(artifacts): preserve ZIP identities and partial managed metadata\n\nReject malformed UTF-8 ZIP filenames at the decoding boundary while retaining CP437, Unicode Path overrides and leading U+FEFF. Preserve valid CustomAttribute parent and value facts when constructor identity is invalid, with an explicit partial-coverage issue.\n\nValidated ZIP integrity and filesystem-provider workflows, managed producer cases, temporary-file hygiene, package and static checks. Removed the superseded producer-only invalid-constructor regression.\n", "parents": ["dcfc5d403ac997c2b08bee4753e57a1a4a8a8538"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "264615059ce6c89badcc7288e8c67bb8dd1ce0dd", "subject": "refactor(mcp): trust validated inputs and tighten contract fixtures", "body": "refactor(mcp): trust validated inputs and tighten contract fixtures\n\nRemove repeated MCP input parsing after the SDK has validated named contracts. Reject unmodeled fixture operations and locate prompt contracts by name so unrelated catalog ordering cannot select a contract.\n\nValidated focused browser, Electron, runtime-observation and MCP workflow tests, advertised schemas, packaged MCP and static checks. Application-boundary validation remains in place.\n", "parents": ["74d7da6ced0f869936ee0316b00616931b088066"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "55b61485e9f7568b69597eef8696ff6abfe53cfd", "subject": "fix(adb): preserve device paths and prevent destination collisions", "body": "fix(adb): preserve device paths and prevent destination collisions\n\nInterpret device paths once as POSIX paths and apply only the selected host's filename constraints. Preserve original PM paths and diagnostics, reject duplicate destinations before pulls, and use exact-name filesystem reservations to detect case and Unicode aliases without guessing volume rules.\n\nConsolidate failed-package cleanup ownership and strengthen no-output assertions. Validated 44 provider fixture tests, 47 filename/parser tests, six compiled CLI tests, static/docs checks, and package checks. No Android hardware was used.\n", "parents": ["264615059ce6c89badcc7288e8c67bb8dd1ce0dd"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "0677468877465c8dfbe25c72f142a7b5bc8a3212", "subject": "fix(android): preserve decoded values and duplicate class inventories", "body": "fix(android): preserve decoded values and duplicate class inventories\n\nParse Apktool YAML and XML at the producer boundary, preserving scalar spelling, XML text and partial string coverage. Retain repeated JADX inventory rows with explicit duplicate-name counts and lookup ambiguity. Make the Apktool verifier report cleanup failures.\n\nValidation: parser, provider and JADX fixture boundary tests; typecheck, lint and documentation checks. Real Apktool and JADX engines were not exercised.\n\nRefs #1978\n", "parents": ["55b61485e9f7568b69597eef8696ff6abfe53cfd"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "8bd5ba2d234cbd9a5bb9dd5daeaa191c3a1cad24", "subject": "fix(native): clarify Mach-O offset origins and reject partial ELF tables", "body": "fix(native): clarify Mach-O offset origins and reject partial ELF tables\n\nExpose the selected Mach-O slice and its container offset, derive that identity once, and map entrypoint and nonempty segment Evidence to container coordinates. Reject relocation sections whose byte length is not divisible by the entry size instead of silently accepting a floored count.\n\nValidation: native parser and selected-architecture boundaries, actual public CLI and stdio MCP on a compiled universal Mach-O, and a pyelftools 0.33 malformed-table probe. Full Linux pwntools bridge verification was unavailable on this host.\n\nRefs #1973\n", "parents": ["0677468877465c8dfbe25c72f142a7b5bc8a3212"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "7285e15839a4fecf9940683699b781a60ccc4775", "subject": "fix(workflows): retain staged output ownership and cancellation semantics", "body": "fix(workflows): retain staged output ownership and cancellation semantics\n\nGive atomic Evidence and snapshot writes an explicit resource owner, preserve primary failures and completed publication receipts, and retry retained staging cleanup at the owning lifecycle. Verify inode identity before publishing or deleting; unknown path disappearance remains a cleanup failure. Keep snapshot admission reusable when a session closes and reopens.\n\nConsolidate JavaScript source-scope classification so cancellation cannot fabricate failures for unselected files. Classify configuration failures as invalid input. Remove stale assertions and reuse shared test cleanup ownership.\n\nValidation: 266 focused tests before final ownership tightening, 108 affected tests afterward, static and documentation checks, actual invalid-configuration CLI behavior, and isolated test temporary-directory hygiene.\n\nRefs #1968\n", "parents": ["8bd5ba2d234cbd9a5bb9dd5daeaa191c3a1cad24"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "89f5e489adac69af2937fabc1a5ba283191d630a", "subject": "test(native): replay complete dylib-use provider output", "body": "test(native): replay complete dylib-use provider output\n\nReplay the complete real Apple dylib-use output through the native provider boundary and retain rejection of an empty repeated options field. Align skill-install Result assertions and CDP initiator prerequisites with current contracts. The producing parser fix is already retained from main.\n\nRefs #1970\n\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>", "parents": ["7285e15839a4fecf9940683699b781a60ccc4775"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "factory-droid[bot]", "email": "138933559+factory-droid[bot]@users.noreply.github.com", "user": { "login": "factory-droid[bot]", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } } ], "pullRequests": [1972] }, { "sha": "1f17ac82282dfda1ae2dc87d99e66a8a039c0259", "subject": "feat(target): explain static WASM inspection after native rejection", "body": "feat(target): explain static WASM inspection after native rejection\n\nExplain recognized WASM v1 native-admission rejection with an exact call to the existing static inspection tool and its caller-supplied WABT prerequisites. Preserve selected paths, explicit raw-binary choices, typed missing-tool outcomes and connection usability.\n\nRefs #1852\n\nCo-authored-by: SII-YDD <38822679+SII-YDD@users.noreply.github.com>\nCo-authored-by: Ysopwnable <161784452+N0zoM1z0@users.noreply.github.com>\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>", "parents": ["89f5e489adac69af2937fabc1a5ba283191d630a"], "authors": [ { "name": "SII-YDD", "email": "38822679+SII-YDD@users.noreply.github.com", "user": { "login": "SII-YDD", "__typename": "User" } }, { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "factory-droid[bot]", "email": "138933559+factory-droid[bot]@users.noreply.github.com", "user": { "login": "factory-droid[bot]", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } } ], "pullRequests": [1872] }, { "sha": "6395e8d3007d5ee453477460e7ee1c51cff76be0", "subject": "perf(mcp)!: compact repeated session discovery facts (#1988)", "body": "perf(mcp)!: compact repeated session discovery facts (#1988)\n\nGroup repeated session tool availability and provider capability facts, preserve complete named contracts and ordered limitations, and remove duplicate catalog descriptors. Update consumers and migration guidance.\n\nValidated by all 31 CI jobs, focused source checks, and actual Claude Code/Linux Hopper/native Windows Ghidra small-target workflows on the current integration tree.\n\nRefs #723.\n\nBREAKING CHANGE: binary_session no longer includes server_identity.catalog.tools; tool_availability and provider capabilities use grouped facts documented in docs/mcp-contracts.md.\n\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>", "parents": ["1f17ac82282dfda1ae2dc87d99e66a8a039c0259"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } } ], "pullRequests": [1988] }, { "sha": "e9fe6437a7da381f0aa5aa77571dcf03317122e7", "subject": "feat(ghidra): admit verified MIPS16 shared ELF images", "body": "feat(ghidra): admit verified MIPS16 shared ELF images\n\nAdmit the verified ELF32 o32 MIPS32r2 MIPS16 shared-image profile after complete source load and relocation inspection. Preserve caller-selected bytes, pin the endian-matched language, and report per-address decoder context. Refuse unverified relocation shapes with explicit reasons.\n\nVerified on Linux x64 with Ghidra 12.1.4: eight source-owned public CLI/MCP controls, original-artifact instruction/pseudocode/export replay, snapshot restore and owned cleanup. 152 integrated focused tests, static checks and documentation checks passed.\n\nFixes #1851\n\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>", "parents": ["6395e8d3007d5ee453477460e7ee1c51cff76be0"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "factory-droid[bot]", "email": "138933559+factory-droid[bot]@users.noreply.github.com", "user": { "login": "factory-droid[bot]", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } } ], "pullRequests": [1991] }, { "sha": "f28f3382836f8dd8629c25b1bf5455d29b28d41d", "subject": "fix(targets): remove path advice for format refusals", "body": "fix(targets): remove path advice for format refusals\n\nReadable executable format refusals report their source format reason and an unsupported-target category instead of misleading missing-path advice. Preserve actual path/permission errors, WASM static recovery, and native target source inspection.\n\nVerified on Linux x64 through actual CLI/fresh stdio MCP: three NE/LE/LX controls, exact canonical projection parity, unchanged bytes, responsiveness and a missing-path control. 103 focused tests across nine files, full static gate and generated documentation passed.\n\nFixes #1979\nRefs #1852\n\nCo-authored-by: Ha1baraA11 <243105435+Ha1baraA11@users.noreply.github.com>\nCo-authored-by: Ysopwnable <161784452+N0zoM1z0@users.noreply.github.com>\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>", "parents": ["e9fe6437a7da381f0aa5aa77571dcf03317122e7"], "authors": [ { "name": "Ha1baraA1", "email": "243105435+Ha1baraA11@users.noreply.github.com", "user": { "login": "Ha1baraA11", "__typename": "User" } }, { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "factory-droid[bot]", "email": "138933559+factory-droid[bot]@users.noreply.github.com", "user": { "login": "factory-droid[bot]", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } } ], "pullRequests": [1987] }, { "sha": "a149d183efd08b0ad7c2a35c99f2394d905621d5", "subject": "feat(managed): select declaring types in inspect_managed_members", "body": "feat(managed): select declaring types in inspect_managed_members\n\nSelect exact declaring types before managed signatures and CIL bodies are decoded, preserving caller choices in CLI/MCP Evidence. Keep unmatched names and selected coverage explicit; comparisons and graphs retain unknowns outside their observed scope. Reuse existing metadata ownership/accounting and advertise unique selections through the actual SDK Schema.\n\nValidated with 229 focused tests across 21 files, 11 managed conformance controls, fullstatic/docs checks and real Linux CLI and fresh MCP inspection of two unchanged DLLs. All 118 selected CIL hashes matched original PE-mapped bytes; result/caller-argument parity and unmatched controls passed. Full artifact/native-boundary metadata is complete; whole-assembly members retain the unchanged 64 MiB resource constraint. No target code executes.\n\nRefs #1878\n\nCo-authored-by: skared <190618464+skoodster@users.noreply.github.com>\nCo-authored-by: Claude Opus 5.5 \nCo-authored-by: Ysopwnable <161784452+N0zoM1z0@users.noreply.github.com>\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>", "parents": ["f28f3382836f8dd8629c25b1bf5455d29b28d41d"], "authors": [ { "name": "skoodster", "email": "snookiewookie00@gmail.com", "user": { "login": "skoodster", "__typename": "User" } }, { "name": "skared", "email": "190618464+skoodster@users.noreply.github.com", "user": { "login": "skoodster", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } }, { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "factory-droid[bot]", "email": "138933559+factory-droid[bot]@users.noreply.github.com", "user": { "login": "factory-droid[bot]", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } } ], "pullRequests": [1706] }, { "sha": "43f9c39dfbdfaa6e5bc260b037a506cd1f56fe6d", "subject": "fix(setup): configure an empty Hermes config.yaml (#1983)", "body": "fix(setup): configure an empty Hermes config.yaml (#1983)\n\n* fix(setup): treat an empty Hermes config.yaml as a new document\n\nYAML parses an empty file to null, so Hermes configuration was checked\nas an object before the shared empty-file rule and rejected. Setup then\nfailed its readback gate for a zero-byte config.yaml, although a missing\nfile is configured and the Hermes serializer already writes a fresh\ndocument for empty original text. Apply the empty-file rule before the\nHermes YAML parse, as #1117 did for JSON clients.\n\n* test(setup): configure an empty Hermes config.yaml\n\nConfigure zero-byte and newline-only config.yaml files through the\nreal filesystem workflow, then read the registration back as aligned.", "parents": ["a149d183efd08b0ad7c2a35c99f2394d905621d5"], "authors": [ { "name": "Vinícius Andrade", "email": "95101505+viniciusdsandrade@users.noreply.github.com", "user": { "login": "viniciusdsandrade", "__typename": "User" } } ], "pullRequests": [1983] }, { "sha": "0d11f71e0dc5cf95d3bea093355f7edc09089a68", "subject": "fix(managed): admit ReadyToRun images built for non-Windows hosts (#1985)", "body": "fix(managed): admit ReadyToRun images built for non-Windows hosts (#1985)\n\nReadyToRun images compiled for Linux, macOS or the BSDs store the COFF machine XORed with IMAGE_FILE_MACHINE_NATIVE_OS_OVERRIDE (dotnet/runtime src/coreclr/inc/pedecoder.h). Every framework assembly in a Linux .NET install has machine 0xFD1D, so target admission and the managed PE reader rejected them as an unsupported architecture.\n\nDecode the PE machine once in src/domain/peMachine.ts, replacing the two duplicated switches, and accept an OS override only on images with a CLI directory.", "parents": ["43f9c39dfbdfaa6e5bc260b037a506cd1f56fe6d"], "authors": [ { "name": "Jeremy Levartovsky", "email": "140487034+JayOfTheKeyboard@users.noreply.github.com", "user": { "login": "JayOfTheKeyboard", "__typename": "User" } } ], "pullRequests": [1985] }, { "sha": "4b653fe6ad1d25a2d9a69d5e93610380c0c09a34", "subject": "fix(native): accept universal binaries with LIB64 x86_64 slices (#1982)", "body": "fix(native): accept universal binaries with LIB64 x86_64 slices (#1982)\n\n* fix(native): apply printed lipo capability bits to CPU subtypes\n\nlipo -detailed_info prints a slice's capability byte separately from its\nsymbolic subtype: CPU_SUBTYPE_LIB64 for x86_64 and ppc64, and other bits\nas hex. Only the arm64e pointer-auth form was applied, so a LIB64 x86_64\nslice normalized to subtype 3 while its FAT entry carries 0x80000003,\nand slice validation rejected the universal binary as an integrity\nmismatch. Fold the printed capability byte into the subtype code.\n\n* fix(native): leave lipo CPU subtypes unknown without capability bits\n\nThe lipo shipped with macOS 26 prints an empty capabilities line for\nx86_64 slices whose FAT capability byte is 0x80 as well as 0x00, so a\nsymbolic subtype alone does not identify the slice's CPU subtype. The\nparser assumed no capability bits and still reported subtype 3 for\nLIB64 slices, which made universal applications such as Sublime Text\nfail slice validation. Report the subtype code as unknown when lipo\nprints no capability byte, as arm64e already does; slice validation\nthen relies on the remaining physical facts.\n\n* test(native): cover printed and blank lipo capability bits\n\nFold CPU_SUBTYPE_LIB64 and hex capability bytes into x86_64 subtype\ncodes, and keep the code unknown for the blank capabilities line that\nmacOS 26 lipo prints.\n\n* test(native): match a LIB64 x86_64 slice with blank lipo capabilities\n\nRead a universal image whose x86_64 FAT entry carries 0x80000003 while\nlipo reports CPU_SUBTYPE_X86_ALL with a blank capabilities line, as\nmacOS 26 lipo does, and expect both slices instead of an integrity\nfailure.\n\n* fix(native): compare named lipo subtype bits without capability bytes\n\nA blank capabilities line leaves the subtype code unknown, and slice\nmatching then skipped the subtype entirely. A FAT entry whose named\nsubtype differs, such as CPU_SUBTYPE_ARM64_V8 recorded by lipo as\nCPU_SUBTYPE_ARM64_ALL, was accepted. Keep comparing the complete\nsubtype when lipo printed its capability byte, and otherwise compare\nthe subtype bits its record names.\n\n* test(native): share LIB64 slice reader setup\n\nRead the LIB64 universal fixture through one helper that takes the\nx86_64 subtype lipo reports, so further cases reuse the same image and\nlipo record. The existing expectation is unchanged.\n\n* test(native): reject a blank-capability lipo subtype naming other bits\n\nWith the capabilities line blank, a lipo record naming\nCPU_SUBTYPE_X86_64_H for the x86_64 LIB64 slice still disagrees with\nthe FAT entry's subtype bits and fails slice validation.", "parents": ["0d11f71e0dc5cf95d3bea093355f7edc09089a68"], "authors": [ { "name": "Vinícius Andrade", "email": "95101505+viniciusdsandrade@users.noreply.github.com", "user": { "login": "viniciusdsandrade", "__typename": "User" } } ], "pullRequests": [1982] }, { "sha": "1febc22907f1cc8035dd1450616233121bd7f19d", "subject": "fix(wasm): inspect modules whose custom section names contain NUL (#1981)", "body": "fix(wasm): inspect modules whose custom section names contain NUL (#1981)\n\n* fix(wasm): frame custom section names at their displayed NUL\n\nwasm-objdump prints a custom section name with printf's %.*s, so an\nembedded NUL ends the displayed name, as it does for module names.\nThe section row was compared with the complete name decoded from WAT,\nso a valid module whose custom section name contains U+0000 failed\ninspection with \"WABT custom-section header does not match decoded\nWAT\". Compare the row with the displayed prefix instead.\n\n* test(wasm): cover NUL-terminated custom section names\n\nFrame the real objdump golden with a decoded custom section name that\ncontinues after a NUL, and keep rejecting a displayed prefix that\ndiffers from the decoded name.\n\n* test(wasm): verify a NUL-containing custom section name with real WABT\n\nAdd a custom section named \"visible\\0hidden\" to the real-tool custom\nname fixture. WABT 1.0.42 decodes it as an escaped WAT name and\ndisplays \"visible\" in wasm-objdump, so the verifier expects that\ndescription through the compiled CLI and MCP.\n\n* refactor(wasm): share WABT's NUL-terminated name display\n\nModule-name preamble lines and custom-section rows each truncated the\ndecoded name at its first NUL. Keep that display rule in one helper so\nboth framings follow the same producer behavior. Output is unchanged.", "parents": ["4b653fe6ad1d25a2d9a69d5e93610380c0c09a34"], "authors": [ { "name": "Vinícius Andrade", "email": "95101505+viniciusdsandrade@users.noreply.github.com", "user": { "login": "viniciusdsandrade", "__typename": "User" } } ], "pullRequests": [1981] }, { "sha": "eaf88aca2af2b8ad7a277c09d0b45f6e2de8ac4a", "subject": "test(ghidra): require pending multi-HI16 coverage in the real MIPS relocatable lane (#1974)", "body": "test(ghidra): require pending multi-HI16 coverage in the real MIPS relocatable lane (#1974)\n\n* test(ghidra): require pending multi-HI16 coverage in the real MIPS relocatable lane\n\nPost-merge review on #1950: the relocation oracle exposes coverage.multiple_hi16, but the real-Ghidra lane never required it, and Clang's C output never produces a LO16 that resolves several pending HI16s. Ghidra's loader could therefore mishandle that stream while the lane still passed, although most GCC-built kernel modules checked contain it.\n\nThe relocatable fixture adds an assembly block with two lui %hi(rea_mips_rel_carry); LLVM's relocation sort then leaves one HI16 pending until a later LO16 that resolves it together with another HI16, including the carry. The lane now requires multiple_hi16: false on the previous fixture, true for all three variants (LE, BE, soft-float module) on real Ghidra 12.1.4.\n\n* test(ghidra): make the MIPS multi-HI16 fixture independent of relocation sorting\n\nReview on #1974: the block used two %lo of rea_mips_rel_carry, a symbol with other %lo uses, so the relocation stream depended on the assembler's HI16/LO16 sort. Clang 21 happened to leave a HI16 pending; Clang 17 (per review) and GNU as 2.45 (checked here: HI@4 LO@8 HI@0 LO@10) pair each HI16 with its own LO16, so multiple_hi16 stays false and the lane fails.\n\nUse a dedicated symbol with two %hi and exactly one %lo. Any assembler that orders each HI16 before a matching LO16 must then emit both HI16s ahead of that single LO16: Clang 21 gives HI@0 HI@4 LO@8, GNU as 2.45 gives HI@4 HI@0 LO@8. The real-Ghidra lane passes for LE, BE and the soft-float module variant with multiple_hi16 true.", "parents": ["1febc22907f1cc8035dd1450616233121bd7f19d"], "authors": [ { "name": "Aurelio Bernal", "email": "aurelio@bernalr.com", "user": { "login": "AurelioB", "__typename": "User" } } ], "pullRequests": [1974] }, { "sha": "976c2c083eee1fdd9e89a1a720f768a6ee6df277", "subject": "fix(contracts): reject OS-invalid local paths in binary and artifact tools (#1925)", "body": "fix(contracts): reject OS-invalid local paths in binary and artifact tools (#1925)\n\n* fix(contracts): reject OS-invalid local paths in binary and artifact tools\n\nEnforce localPathStringSchema across inspect_pe_resources,\ninspect_binary_layout, inspect_recorded_crash, inspect_wasm_artifact,\nand inspect_evm_interface input schemas to reject embedded NUL bytes at\nthe contract boundary instead of failing later during filesystem\noperations.\n\nAdd corresponding acceptance test cases to the advertised MCP contracts\nmatrix in localToolContracts.test.ts.\n\nSigned-off-by: Vinícius DS Andrade <95101505+viniciusdsandrade@users.noreply.github.com>\n\n* style(contracts): wrap pe resources path description under print width\n\nWrap the inspectPeResourcesInputSchema path property description to keep lines within the 80-column oxfmt limit.\n\nSigned-off-by: Vinícius DS Andrade <95101505+viniciusdsandrade@users.noreply.github.com>\n\n---------\n\nSigned-off-by: Vinícius DS Andrade <95101505+viniciusdsandrade@users.noreply.github.com>", "parents": ["eaf88aca2af2b8ad7a277c09d0b45f6e2de8ac4a"], "authors": [ { "name": "Vinícius Andrade", "email": "95101505+viniciusdsandrade@users.noreply.github.com", "user": { "login": "viniciusdsandrade", "__typename": "User" } } ], "pullRequests": [1925] }, { "sha": "ed6af7eb8cf052c52fec8bfdc5d509377cb30a1a", "subject": "fix(call-path): preserve relationship coverage from analysis (#2001)", "body": "fix(call-path): preserve relationship coverage from analysis (#2001)\n\nForward observed relationship coverage into function Evidence and use its typed completeness when searching call paths. Preserve contextual limitations, legacy fallback, provenance, and unknown outcomes.\n\nAvoid argument-spread exhaustion on large valid limitation lists. Cover the public MCP producer/consumer chain, metadata tampering, terminal and unreachable coverage, and large-list capacity.\n\nRelated to #1964; separate get_call_graph and trace_call_path work is not included. AI-assisted with Hermes (Nous Research).", "parents": ["976c2c083eee1fdd9e89a1a720f768a6ee6df277"], "authors": [ { "name": "Dmitry Khanukov", "email": "10838655+khanukov@users.noreply.github.com", "user": { "login": "khanukov", "__typename": "User" } } ], "pullRequests": [2001] }, { "sha": "091cb81fc3ca2b8ec96df7a534934388a6b882cd", "subject": "fix(process): report the Swift compiler outcome with bounded diagnostics (#1999)", "body": "fix(process): report the Swift compiler outcome with bounded diagnostics (#1999)\n\n* fix(process): report the Swift compiler outcome with bounded diagnostics\n\n* fix(process): keep a signaled compiler's null exit code", "parents": ["ed6af7eb8cf052c52fec8bfdc5d509377cb30a1a"], "authors": [ { "name": "pablo", "email": "194239734+jimpablo@users.noreply.github.com", "user": { "login": "jimpablo", "__typename": "User" } } ], "pullRequests": [1999] }, { "sha": "adde8a80921b199ddd7105998f3760d345b468fc", "subject": "fix(native): reject required otool fields truncated before their value (#1995)", "body": "fix(native): reject required otool fields truncated before their value (#1995)\n\n* fix(native): reject required otool fields truncated before their value\n\n#1967 let requireUniqueField count a label at end of line so an empty\ndylib-use options row is present. That applied to every required field,\nso truncated output such as a bare vmaddr, vmsize, uuid or entryoff line\npassed the presence check while parseField dropped it, and the value\nsilently became null.\n\nLet parseField decide which labeled line carries a value: the single\nmatching line must parse as that field. The empty options row remains\nthe only valueless field parseField admits.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(native): admit the empty segname of Mach-O object files\n\nMH_OBJECT files put their sections in one segment whose name is empty,\nand otool -l prints it as a bare segname label. Requiring a value for\nevery scalar field rejected valid object-file output as unreadable.\n\nLet parseField admit an empty segname like the empty dylib-use options\nrow, and keep projecting an empty or absent segment name as \"unknown\",\nas main did.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(native): admit all-NUL Mach-O section names\n\nAn all-NUL section_64.sectname prints as a bare sectname label, like an\nempty segname. Admit it in parseField and keep projecting the empty name\nas \"unknown\", as main did.\n\nCo-Authored-By: Claude Opus 5.5 \n\n---------\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["091cb81fc3ca2b8ec96df7a534934388a6b882cd"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [1995] }, { "sha": "f889a69fb9efe42dd0120c96ff44b4298c1c7c6c", "subject": "fix(build): resolve rolldown from the npm registry in package-lock.json (#1986)", "body": "fix(build): resolve rolldown from the npm registry in package-lock.json (#1986)\n\nThe rolldown 1.2.12 entry resolved from mirrors.cloud.tencent.com while\nevery other entry uses registry.npmjs.org, so npm ci failed in\nenvironments that can reach the npm registry but not that mirror.\nVersion and integrity are unchanged.\n\n\nClaude-Session: https://claude.ai/code/session_01Q3rXQaLacJ7gNBRkp7DovF\n\nCo-authored-by: Claude ", "parents": ["adde8a80921b199ddd7105998f3760d345b468fc"], "authors": [ { "name": "balkan16", "email": "57933796+balkan16@users.noreply.github.com", "user": { "login": "balkan16", "__typename": "User" } }, { "name": "Claude", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [1986] }, { "sha": "aada0ca8126bf14c60750a4ccd4a79667770a1e4", "subject": "fix(evidence): validate closure projections and browser body coverage", "body": "fix(evidence): validate closure projections and browser body coverage\n\nShare ledger status, coverage, reports, graphs, Evidence links and closure commitments between the producer and readiness validation. Preserve limitation-driven unknown results and reject stale or inconsistent projections.\n\nDistinguish malformed CDP response envelopes from unavailable JSON payload shapes. Validate required encoding flags and preserve partial request facts.\n\nValidation: 116 focused tests, static and architecture checks, documentation checks. Browser regression coverage uses controlled CDP responses.\n", "parents": ["f889a69fb9efe42dd0120c96ff44b4298c1c7c6c"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "b5ededd0f9c28d0f696a205103066928117368ee", "subject": "fix(providers): retain native parsing and compiler failure diagnostics", "body": "fix(providers): retain native parsing and compiler failure diagnostics\n\nParse otool field occurrences once and reject valueless required fields while retaining empty dylib options. Preserve compiler exit outcomes and stderr through capture errors and nested Ghidra causes, with explicit UTF-8 truncation after redaction.\n\nStrengthen provider failure assertions and document the manual Ghidra 12.1.4 macOS x64 decompiler build using upstream instructions.\n\nValidation: focused producer tests, nine fake-compiler preparation and cancellation tests, temporary-directory hygiene, static and documentation checks. No real Swift or Ghidra compilation was run locally.\n", "parents": ["aada0ca8126bf14c60750a4ccd4a79667770a1e4"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "e19879328a11fe38b49b6b133a8ebde908ea980e", "subject": "refactor: prune obsolete provider and verification code", "body": "refactor: prune obsolete provider and verification code\n\nRemove unused imports, private inferred types, superseded limit constants and a duplicate MCP assertion. Preserve intentional field omissions while deleting unused local bindings.\n\nValidation: typecheck, lint, formatting, unused-code and architecture checks pass. Runtime behavior is unchanged.\n", "parents": ["b5ededd0f9c28d0f696a205103066928117368ee"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "6611bcf6e86630c775c24e6afa00d7239c64e70e", "subject": "test(android): verify duplicate class inventory behavior on empty discovery queries (#1984)", "body": "test(android): verify duplicate class inventory behavior on empty discovery queries (#1984)\n\nAssert that search_android_classes preserves duplicate class-name rows and reports duplicate_names when querying with an empty string on an APK reporting duplicated class inventories.", "parents": ["e19879328a11fe38b49b6b133a8ebde908ea980e"], "authors": [ { "name": "Vinícius Andrade", "email": "95101505+viniciusdsandrade@users.noreply.github.com", "user": { "login": "viniciusdsandrade", "__typename": "User" } } ], "pullRequests": [1984] }, { "sha": "d93fbda390c6b8b2741c552bd194b50c3e08e0c1", "subject": "perf(cli): bundle runtime entries to reduce Windows startup I/O (#1996)", "body": "perf(cli): bundle runtime entries to reduce Windows startup I/O (#1996)\n\nBundle ordinary CLI and output entries to reduce Windows module filesystem resolution while preserving source URLs, lazy loading and worker resources. Keep release identity in its shared owning module.\n\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>", "parents": ["6611bcf6e86630c775c24e6afa00d7239c64e70e"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } } ], "pullRequests": [1996] }, { "sha": "87b9793c53caf70a9f3a516214856899ca2d7cf8", "subject": "fix(javascript): trace wrapped Electron IPC paths in large bundles (#1874)", "body": "fix(javascript): trace wrapped Electron IPC paths in large bundles (#1874)\n\nCo-authored-by: David <17119984+fengdwx@users.noreply.github.com>", "parents": ["d93fbda390c6b8b2741c552bd194b50c3e08e0c1"], "authors": [ { "name": "David", "email": "fengdwx@163.com", "user": { "login": "fengdwx", "__typename": "User" } }, { "name": "David", "email": "17119984+fengdwx@users.noreply.github.com", "user": { "login": "fengdwx", "__typename": "User" } } ], "pullRequests": [1874] }, { "sha": "b38429cb6a0de8f4bb5ae01633e24abe2d7cde46", "subject": "fix(native): preserve universal Mach-O container identity", "body": "fix(native): preserve universal Mach-O container identity\n\nKeep FAT container format distinct from selected slice architecture through target admission, Evidence, snapshots, and CLI/MCP lifecycle results. Preserve native, Hopper, Ghidra, extraction, and dylib routing for the Mach-O family.\n\nReject selected FAT ranges overlapping their table or too short for a Mach-O header. Replace empty-slice fixtures with in-bounds executable headers and cover thin, universal, single-slice, FAT64, and swapped containers.\n\nValidation: static and architecture checks, generated docs, targeted producer and public MCP tests. Provider routing uses controlled fixtures; no live Hopper, IDA, JADX, or Ghidra analysis was performed for this change.\n", "parents": ["87b9793c53caf70a9f3a516214856899ca2d7cf8"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "5dfb9d050c2cc44a61b183dae765bef4d22a53b7", "subject": "fix(analysis)!: scope call-graph caveats to their observed relationships", "body": "fix(analysis)!: scope call-graph caveats to their observed relationships\n\nReturn deduplicated execution caveats once and preserve provider-owned relationship diagnostics and completeness on graph nodes. Keep complete relationship reads exhaustive despite contextual caveats, including portable call-path reconstruction.\n\nPreserve omitted diagnostic fields in historical Evidence and bind reported diagnostics into semantic identity. Revise graph workflow and Ghidra adapter profiles so old cached representations cannot replay under the new contracts.\n\nRemove stale duplicate-lookup test claims and redundant fixture validation. Prune million-entry duplicate cases while retaining argument-stack and deep-chain regressions; bounded Flameox captures identified validation and canonical hashing costs.\n\nValidation: static and architecture checks, generated docs, 364 focused tests before pruning, 21 call-path tests after pruning, public MCP schema validation and targeted profile tests. Real engine behavior was not locally exercised.\n\nBREAKING CHANGE: get_call_graph normalized_result now contains { graph, limitations }; traversal-depth groups are under graph.\n", "parents": ["b38429cb6a0de8f4bb5ae01633e24abe2d7cde46"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "edf46248f2a44b4e5776518489fee09d0fc4516b", "subject": "fix(targets): project invalid raw-binary loads as caller input (#2004)", "body": "fix(targets): project invalid raw-binary loads as caller input (#2004)\n\n* fix(targets): project invalid raw-binary loads as caller input\n\n* fix(targets): name real load options and cover DOS COM kind pairing", "parents": ["5dfb9d050c2cc44a61b183dae765bef4d22a53b7"], "authors": [ { "name": "pablo", "email": "194239734+jimpablo@users.noreply.github.com", "user": { "login": "jimpablo", "__typename": "User" } } ], "pullRequests": [2004] }, { "sha": "b8fab7429771bb17a7ca0297661de3c9935212af", "subject": "fix(javascript): preserve execution and invocation provenance", "body": "fix(javascript): preserve execution and invocation provenance\n\nKeep direct empty bridge objects observed, reject unexecuted initializers,\ninvalidate modified bootstrap tables and Electron identities, and retain\nselection predicates through symbolic values and wrapper paths. Track lexical\nbinding identity and completed activation boundaries without leaking analysis\norder into earlier reads.\n\nSeparate wrapper invocation provenance from the underlying IPC source range\nso repeated registrations remain ambiguous through transfer and graph joins.\nUse the same offered transfer budget for module preflight and final writing.\n\nIndex static literal properties once instead of rescanning every member. Keep\nthe original 10,001-member capacity fixture; Flameox confirmed the repeated\nlookup cost and the optimized fixture completes in under one second locally.\nPrune the stale compact-schema tool inventory assertion and update the public\ncall-graph registration expectation to its declared result envelope.\n\nValidation: build, check, docs:check, 83 focused tests, 10 Electron identity\nacceptance cases, 2 full-scale finding-capacity cases, and 7 compact-schema\ntransport tests. No real Electron runtime execution is claimed.\n", "parents": ["edf46248f2a44b4e5776518489fee09d0fc4516b"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "42b0ed126df7d5b908ac369715378d5e519051b7", "subject": "fix(javascript): retain guards without duplicating observed IPC calls", "body": "fix(javascript): retain guards without duplicating observed IPC calls\n\nInclude enclosing control-flow predicates when deciding whether symbolic\nwrapper facts can be reported without guards. Preserve the guarded paths\nand unresolved coverage instead of inventing unconditional exposures or\nchannel pairing candidates.\n\nKeep fully observed renderer transmissions singular when tracing an exposed\ncallback. Distinct wrapper registrations still retain invocation identities.\nThis fixes the Electron package baseline's doubled transmission count.\n\nValidation: check; 43 exact source and public CLI/MCP tests; existing artifact,\nextraction, Electron analysis and routed-analysis verifier against the built\nCLI. Installed-package platform coverage remains with CI.\n", "parents": ["b8fab7429771bb17a7ca0297661de3c9935212af"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "2ff850de68dc9b05c6faf2bbfd26d56bc2d5d27c", "subject": "fix(session): attribute selected-provider capabilities to the resolved identity (#2013)", "body": "fix(session): attribute selected-provider capabilities to the resolved identity (#2013)\n\nProfile resolution gives Ghidra and Hopper a concrete version, but the\nselected candidate's capabilities and the session route kept the\nprovider's static identity with a null version. binary_session therefore\ngrouped capability sets under a different identity than the binding and\nthe selected candidate.\n\nThe registry now rebinds the selected provider's capabilities to the\nresolved identity once, on the binding, and the route uses them. Evidence\nprovenance already compensated downstream by substituting the profile\nidentity; that repair is removed because the route now carries the\nresolved identity.\n\nFixes #2009\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["42b0ed126df7d5b908ac369715378d5e519051b7"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2013] }, { "sha": "64b71b180a88a2df1b0b61e803c1c322ee59c5e1", "subject": "docs: clarify ownership and interpretation boundaries", "body": "docs: clarify ownership and interpretation boundaries\n", "parents": ["2ff850de68dc9b05c6faf2bbfd26d56bc2d5d27c"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "880a603fe89db2132fd05a35b33a8c459673beda", "subject": "feat(mcp): derive an API surface view from retained web network captures (#1891)", "body": "feat(mcp): derive an API surface view from retained web network captures (#1891)\n\n* feat(mcp): derive an API surface view from retained web network captures\n\n* fix(mcp): fail closed on sensitive parents and budget api-surface path expansion\n\n* fix(mcp): keep recorded api-surface paths and budget only templated segments\n\n* fix(mcp): read api-surface paths only from canonical URLs and charge new values once\n\n* fix(mcp): reject authority-less api-surface URLs and key groups by rule positions\n\n* fix(mcp): label api-surface confidence from all groups and cap transient path memory\n\n* fix(mcp): budget api-surface dedup sets and narrow detail outputs\n\nCharge retained deduplication sets before allocation, advertise only\neach analysis operation's summary from its detail output, and document\nthat any templated group makes every API-surface page inferred.\n\n* fix(mcp): bound api-surface path text and record limitations\n\nCharge retained literal path copies before allocation, publish only\nvalid media-type essences, and deduplicate examined record limitations\nonto the view.\n\n* fix(mcp): keep api-surface refusals and path splits inside the reply budget\n\nSensitive-parent refusals now use the token sensitive_values_unretained so declared literals are not echoed. A later path split is charged against bytes already retained, and the published example includes the HAR record limitation with its matching digest.\n\n* fix(mcp): budget api-surface method text before group keys\n\nCharge method and origin text against the reply budget before the group key is serialized. Document that samples merge only when method, origin, and exact segment rules match.\n\n* fix(mcp): bound api-surface copies and control-character authorities\n\nReject authorities containing a tab or newline so WHATWG cannot move userinfo into the recorded path. Charge four path copies, two method and origin copies, and each distinct content type against bytes already retained.\n\n* fix(mcp): preflight combined api-surface group charges\n\nTotal path, method, origin, and segment charges before retaining a new group. Track content types in a set so distinct MIME essences are not compared quadratically.\n\n* fix(mcp): charge api-surface content-type sets on first use\n\nCreate the per-group content-type set when the first essence is retained, and charge it before allocation. Groups with no content type no longer keep an empty set.\n\n* refactor(analysis): centralize API-surface ownership and admission\n\nOwn grouping, deduplication, and combined retained/temporary resource admission in one accumulator. Charge fixed group storage before allocation and materialize only the requested page.\n\nShare recorded URL parsing between capture redaction and projection, preserving source paths and excluding ambiguous credential fields. Cover resource admission invariants and the compiled HAR-to-view workflow.\n\n* fix(analysis): admit capture schema clone before parsing\n\n* fix(javascript): share Electron mutation proof with wrapped calls\n\n* test(mcp): align graph and catalog checks with current contracts\n\n* fix(analysis): admit and validate portable capture views\n\n---------\n\nCo-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>\nCo-authored-by: Cursor Agent \nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["64b71b180a88a2df1b0b61e803c1c322ee59c5e1"], "authors": [ { "name": "Matt Van Horn", "email": "mvanhorn@users.noreply.github.com", "user": { "login": "mvanhorn", "__typename": "User" } }, { "name": "Matt Van Horn", "email": "455140+mvanhorn@users.noreply.github.com", "user": { "login": "mvanhorn", "__typename": "User" } }, { "name": "Cursor Agent", "email": "cursoragent@cursor.com", "user": { "login": "cursoragent", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [1891] }, { "sha": "04089d5bec11d6e0411e7c35d0168bbae63d7e7d", "subject": "test(clients): verify native Gemini CLI integration on Windows (#1936)", "body": "test(clients): verify native Gemini CLI integration on Windows (#1936)\n\n* test(clients): verify native Gemini CLI integration on Windows\n\nThe Gemini CLI client lane asserted POSIX. On Windows it also needs the npm install's JavaScript entry point, because only a gemini.cmd shim reaches PATH, and two setup-plan checks compared paths with a hard-coded slash. Remove the assertion, run a selected .js, .mjs or .cjs entry point under the verifier's Node, build those prefixes with path.sep, name the entry point in the Windows preflight error, and record 0.63.0 as verified on native Windows in docs/testing.md.\n\nFixes #1935\n\n* test(clients): resolve the selected Gemini CLI entry point once\n\nThe preflight runs from the caller's directory and the client run from the disposable workspace, so a relative REA_VERIFY_GEMINI_COMMAND passed the preflight and then failed with Cannot find module. Resolve a selected JavaScript entry point to an absolute path before both launches.", "parents": ["880a603fe89db2132fd05a35b33a8c459673beda"], "authors": [ { "name": "pablodiazjorge", "email": "102741971+pablodiazjorge@users.noreply.github.com", "user": { "login": "pablodiazjorge", "__typename": "User" } } ], "pullRequests": [1936] }, { "sha": "d9d2a173819ce8e2e7f09eb584ec6ff7b4ee3480", "subject": "feat(setup): register DeepSeek Harness through setup, doctor and uninstall (#1929)", "body": "feat(setup): register DeepSeek Harness through setup, doctor and uninstall (#1929)\n\n* feat(setup): register DeepSeek Harness through setup, doctor and uninstall\n\nDeepSeek Harness registers MCP clients through a Cordis YAML patch\nsequence in the home patch rather than a server table, so setup could\nnot configure it and users had to append the documented entry by hand.\n\nAdd a dsh client: the home patch $DSH_HOME/cordis.patch.yml\n(~/.dsh/cordis.patch.yml when unset) is parsed as a patch list, the REA\nentry owns the stable rea-mcp id, and setup appends or replaces exactly\nthat entry while preserving unrelated patches and comments in place.\nDoctor reports the registration through the same entry, and uninstall\nremoves it, dropping insert operations it emptied. Skill destinations\nfollow ~/.agents/skills ($DSH_AGENTS_HOME/skills when configured), the\nhome the rest of the client machinery already uses.\n\nFixes #1839\n\n* fix(setup): carry environment and identity validation into DSH registrations\n\nAddress review: the DSH entry discarded discovered provider overrides;\nconfig.env is now emitted and retained like the other dialects. An entry\ncarrying the rea-mcp id under a wrong or missing package name, or\nduplicated entries, reads back as absent so setup rewrites exactly one\ncanonical entry instead of reporting unchanged. Doctor now requires\nserverName rea and stdio transport before calling a DSH registration\naligned, and the Harness skill identifier in the docs matches the\ninstalled reverse-engineer-anything skill.\n\n* fix(setup): apply Cordis patch order and collapse DSH registrations\n\nAddress review: a later direct { id, config } operation replaces the\nrow's config under the native patch DSL, so the registration view now\napplies patches in order instead of only reading insert operations;\ndoctor reports the effective command rather than the inserted one.\nSetup rewrites exactly one canonical entry: duplicate id-matching rows\ncollapse to the first, direct patches to the entry are dropped from the\ndocument and from the edited YAML, and uninstall removes them with the\nentry. The client-location test fixture now clears DSH_HOME and\nDSH_AGENTS_HOME so a developer environment cannot point the suite at\nreal Harness homes.\n\n* fix(setup): repair direct-only registrations and preserve Cordis entry state\n\nSerialize now edits the first insertion carrying rea-mcp in place, so a\ngrouped entry keeps its scope, neighbors, and comments instead of moving\nto a fresh root-level insertion, and later carrying insertions and direct\npatches collapse away. Entry-level disabled state projects into the\nregistration the doctor and setup compare, so a disabled row reads as\nstale and the repair re-enables it. A direct-only registration no longer\nsuppresses the canonical insert append, and an update retains the\nregistration environment. Duplicate entries collapse across operations,\nnot only within one.\n\n* fix(setup): preserve Harness row state through identity and refresh repairs\n\nA wrong-package row still reads back as a server record carrying its\nenvironment and caller fields, projected with a package marker the\nalignment path treats as stale, instead of vanishing and dropping\nconfig.env from the repair. A direct Cordis patch without a preceding\ninsertion configures nothing, so a direct-only registration reads as\nabsent even when its config matches and the repair appends the insert.\nCaller-owned config fields beyond the REA-owned keys, such as the cwd\nthe native verifier sets, survive a refresh instead of being silently\ndropped.\n\n* fix(setup): preserve Cordis tags and collapse aligned Harness rows\n\nA refresh rebuilt Harness config from parsed values, so a caller !!js\nexpression was written back as a literal. Owned keys are now overlaid on\nthe winning config node and other nodes stay in place. Two already-aligned\nrea-mcp insertions read as stale, so setup collapses them to one row, and\nthe bundled skill lists dsh with the other clients.\n\n* fix(setup): drop the unused DSH configuration type\n\nKnip reports DshConfigurationFormat as an unused export. The format union\ndoes not depend on that alias.\n\n* fix(setup): keep Harness env tags and comment-only patches\n\nA refresh replaced the whole env map, so a caller !!js value was written\nback as a literal. Environment entries now stay in place unless the value\nchanged. A comment-only cordis.patch.yml parses as an empty patch list and\nkeeps those comments when the registration is appended. Docs describe\nplain rea uninstall, which scans supported clients and has no --client flag.\n\n* fix(setup): own Harness rows by entry id and expression state\n\nUninstall removes a rea-mcp row even when the launcher is stale or the\npatch never established a server record. A non-boolean disabled value,\nincluding a Cordis expression, reads as stale. Expression text on a known\nenvironment setting is not validated as a literal path, so a refresh can\nkeep the tag.\n\n* fix(setup): collapse aliased Harness insertions\n\nAn anchored insert followed by an alias parses as two rea-mcp rows, but\nthe YAML edit kept the alias, so readback stayed duplicated and setup\nrestored the file. Aliases that resolve to the owned entry are now\ndropped, including an alias of the entry inside one insert. Aliases of\nother patches stay.\n\n* fix(setup): resolve aliased Harness lists and config maps\n\nAn insert value that aliases another entry list still loaded a second\nrea-mcp row after the operation-level alias collapse. That alias is now\ndropped once the anchored list is rewritten. A config: *cfg map is\nresolved and cloned before the refresh, so a caller !!js field on the\naliased map is not rewritten as a plain literal.\n\n* fix(setup): follow Harness aliases for ids, lists, and env tags\n\nAn insert alias whose anchor is not another insert is copied so\nunrelated rows stay while the owned row is rewritten. An aliased\nentry id is resolved before ownership checks, and an environment alias\nof an unchanged !!js scalar is left in place.\n\n* fix(setup): keep aliased Harness env maps through uninstall\n\nAn env alias is cloned before a refresh so tagged values are not rebuilt\nas literals, and expression-key scans follow aliases before path checks.\nInsert aliases that carry REA are recorded before uninstall empties their\nanchor, so the later alias is dropped instead of dangling.\n\n* fix(setup): follow root Harness aliases and mark dsh as main-only\n\nWinning-config walks resolve a root alias before patch order, so a replayed direct config's !!js env is not validated as a literal path. Root aliases that own rea-mcp are recorded before uninstall empties their anchor. An insert whose only owned member is an external alias is cloned so Cordis tags survive. Docs state dsh is not in npm 6.4.0.\n\n* fix(setup): keep rows behind inert Harness aliases\n\nA root alias whose anchor is not a loaded operation is copied and only the owned row is edited, so unrelated rows stay active. Entry id aliases become a scalar before their anchor patch is dropped. Root-alias ownership follows insert-list aliases, so a replay is removed instead of dangling after uninstall.\n\n* refactor(setup): centralize Cordis source ownership\n\n* fix(javascript): share Electron mutation proof with wrapped calls\n\n* test(mcp): align graph and catalog checks with current contracts\n\n* fix(setup): separate Cordis ownership from editability\n\n* docs: clarify ownership and interpretation boundaries\n\n* fix(setup): preserve Cordis applicability and caller metadata\n\n---------\n\nCo-authored-by: Cursor Agent \nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["04089d5bec11d6e0411e7c35d0168bbae63d7e7d"], "authors": [ { "name": "BaaRai", "email": "130491490+BaaRai@users.noreply.github.com", "user": { "login": "BaaRai", "__typename": "User" } }, { "name": "Cursor Agent", "email": "cursoragent@cursor.com", "user": { "login": "cursoragent", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [1929] }, { "sha": "c0904b4c1aabfccf2f0ab12f44960a0a1fbbbfae", "subject": "fix(javascript): apply loader-owned module lookup rules", "body": "fix(javascript): apply loader-owned module lookup rules\n\nKeep relative ESM imports exact, restrict Node legacy probes to .js/.json/.node, and treat empty package main as absent. Stop Node package-main lookup before nested package reinterpretation, while retaining generic artifact inference.\n\nReplace stale recursive and .cjs probe expectations. Verify CLI and MCP graph results against real Node 24 runtime controls, including exact suffixes, index fallback, and nested package main refusal.\n\nRefs #2020, #2021, #2022\n", "parents": ["d9d2a173819ce8e2e7f09eb584ec6ff7b4ee3480"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "ee50ed121e38cc6e1a2ff0dc8b789f15f71c5402", "subject": "fix(sourcemaps)!: preserve nullable source declarations", "body": "fix(sourcemaps)!: preserve nullable source declarations\n\nAccept absent map-level sourcesContent and preserve null source-name slots alongside known originals and aligned content. Represent unnamed local declarations explicitly, retain leaf-local and flattened indices, and preserve declared indexed-section order across consumers.\n\nAccount for added indices before browser output allocation. Accept legacy retained rows without indices. Consolidate public CLI/MCP source-map fixtures and update the stale named-source-only assertion.\n\nBREAKING CHANGE: Browser source-map original and mapping rows expose null for unavailable source names instead of inventing an unknown-source string. New index fields are optional when reading older retained evidence.\n\nRefs #2023, #2024\n", "parents": ["c0904b4c1aabfccf2f0ab12f44960a0a1fbbbfae"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "9f67e44e5d451d705bae9a579ad9802d5c9f097c", "subject": "fix(javascript): preserve loader-specific package ancestry", "body": "fix(javascript): preserve loader-specific package ancestry\n\nRequire a package directory for bare ESM imports. Continue CommonJS root and subpath lookup through ancestor packages after ordinary misses, while keeping exports authority, unavailable metadata, and failed nonempty main entrypoints terminal.\n\nCarry failed-main ownership in the internal resolution result and retain the nearest local miss after exhausting ancestors. Consolidate package selection at its owning boundary and qualify loader differences with real Node 24, CLI, and MCP regressions.\n", "parents": ["ee50ed121e38cc6e1a2ff0dc8b789f15f71c5402"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "bd74c7af2bec952c2eea7a17feedd05e6675b719", "subject": "test(sourcemaps): assert semantic evidence and actual output admission", "body": "test(sourcemaps): assert semantic evidence and actual output admission\n\nReplace stale closed-property expectations with assertions for the evidence under test. Verify compiler coordinates and declaration indices separately in the real-browser workflow.\n\nConsolidate duplicate 50000-map admission cases and derive admission from exact serialized bytes rather than IP-address-specific output shapes. Retain capacity, omission, and aggregate-byte coverage. A bounded Flameox CPU profile completed in about 1.4 seconds and showed no producer bottleneck; targeted admission and real Chrome CLI/MCP verification pass.\n", "parents": ["9f67e44e5d451d705bae9a579ad9802d5c9f097c"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "a1b5d51a8dfb7fff6272d91270c16b95555c2643", "subject": "feat(go): inspect embedded binary build metadata (#1363)", "body": "feat(go): inspect embedded binary build metadata (#1363)\n\n* feat(go): inspect embedded binary build metadata\n\n* fix(go): preserve byte metadata and validate container mappings\n\n* fix(go): support moduleless legacy build metadata\n\nRecognize optional module string headers in declared zero-filled memory while rejecting ambiguous and unmapped pointers. Preserve the original module-pointer field as the zero-byte source anchor.\n\nClassify initial symlink-loop and overlong-path failures as invalid input, with CLI and MCP regressions.\n\n* fix(go): reject undersized PE optional headers\n\n* fix(native): stabilize ELF memory checks and clean up exec wrappers\n\nUse existing parent/group/run-token ownership for caller-selected Python launchers, which can exec through a shell or prlimit. Add cancellation regressions for the valid wrapper and wrong-parent/token cases.\n\nReplace the timing-dependent 30,000-section memory workload with a valid 32 MiB padded ELF under a 64 MiB address-space limit. Check the same image successfully through CLI and MCP before requiring a typed memory failure, preserving the production timeout and all error assertions.\n\nValidation: npm run check and check:fast passed; 61 focused tests passed including Go CLI/MCP and session snapshots. Real decoder probes with pinned packages passed on Python 3.12.3 and 3.12.14. The full local ELF verifier is blocked by this container's procps/process-ownership boundary; the exact pushed head requires GitHub's real-binary-layout lane.\n\n* test: repair Electron fixtures and stabilize catalog startup checks\n\nDeclare Electron imports in option, preload override, and path-resolution fixtures after upstream began requiring proven API provenance. Retain all option and preload assertions and adjust exact source ranges for the added import line.\n\nUse the existing bounded acceptance timeout for the cold catalog lifecycle test instead of a separate 15-second ceiling. This retains the coverage allowance and all catalog, error, and cleanup assertions without retries.\n\nValidation: npm run check, final check:fast, formatting and diff checks passed. Source path regression and Go boundary/MCP/service checks passed. All 20 Go CLI cases and both supported-host runtime cases passed on rerun; two macOS-only cases skipped on Linux. A prior contended local run timed out once in a Go CLI diagnostic; that case passed on rerun. Electron process-boundary verification is blocked locally by procps namespace inspection and requires fresh CI.\n\n* test(mcp): isolate nested schema references between tool contracts\n\nClear Ajv's non-meta schema registry after each root, including compilation failures. Disabling root registration alone leaves nested IDs available to later tools and can let a dangling reference pass the catalog gate.\n\nAdd regressions for leakage after successful and failed compilation while retaining shared meta-schema validators. The regression failed before the fix; all 11 schema cases and full npm run check pass. Reviewed independently.\n\n* test(ci): align Go effects and source-map verification contracts\n\nAudit the Go inspector wording as static metadata inspection. Assert retained source declaration indexes in BOM reconstruction and the compiler-derived nested-map oracle. Keep a 45,000-map admission control below the 32 MiB output budget and the 50,000-map overflow case above it with the expanded representation.\n\nValidation: reproduced all four failing assertions, then passed 120 focused tests and the final admission suite. npm run check and real Chrome 154 / esbuild 0.25.10 source-map verification passed, including all four nested-map scenarios and verified process lineage.\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["bd74c7af2bec952c2eea7a17feedd05e6675b719"], "authors": [ { "name": "You Wish", "email": "29498139+Y0UW1SH@users.noreply.github.com", "user": { "login": "Y0UW1SH", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [1363] }, { "sha": "d0249282c64882329a6acab8f3b477552da53499", "subject": "docs(install): explain Claude Code upfront tool loading on third-party endpoints (#2029)", "body": "docs(install): explain Claude Code upfront tool loading on third-party endpoints (#2029)\n\nClaude Code turns MCP tool search off when ANTHROPIC_BASE_URL points to a\nnon-first-party host, so every REA tool definition is sent with every\nrequest. On main at 04089d5be the forwarded names, descriptions and input\nschemas measure about 496 KB (~120k tokens) with the full profile and about\n290 KB (~68k tokens) with the compact profile. When Claude Code assumes a\nsmaller window than the model has, as with `deepseek-v4-flash` without the\n`[1m]` suffix, autocompact thrashes because compaction cannot remove tool\ndefinitions.\n\nDocument the window, tool-search and compact-profile remedies, and that\nDeepSeek's Anthropic API does not list `tool_reference` blocks.\n\nRefs #2019\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["a1b5d51a8dfb7fff6272d91270c16b95555c2643"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2029] }, { "sha": "4a4d36f881861bbab3c734b0dd459f805766caec", "subject": "fix(evidence): retain unreadable PE and Darwin process facts", "body": "fix(evidence): retain unreadable PE and Darwin process facts\n\nDistinguish absent CLI directories from unreadable directory counts and truncated slots while preserving known PE headers and readable CLI data.\n\nRetain environment-entry coverage in the Darwin parser and classify restricted empty, unavailable and ambiguous environments at the native boundary. Keep cleanup fail-closed; code-signing flags do not establish ownership.\n\nValidation: 116 managed source tests, 13 ownership tests, native Swift parser probe and two live Darwin run-token tests; build, static checks and docs checks pass. Restricted-flag cases use parser fixtures; no real restricted capture is claimed. Related to #2035.\n", "parents": ["d0249282c64882329a6acab8f3b477552da53499"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "b7f563e15f854061dc1507896181b7b24ac3b5f0", "subject": "test: strengthen public input and module lookup controls", "body": "test: strengthen public input and module lookup controls\n\nIncorporate the independent query-bearing ESM and cjs-only directory cases from #2031 and #2032 into existing Node-backed CLI/MCP tests. Their production patches are already superseded on main.\n\nMake invalid Swift-symbol validation prove it precedes artifact access, and bound the test child so failures retain output before the outer test deadline. Clarify that network API content types project only the type/subtype essence.\n\nValidation: module lookup CLI/MCP and native demangle CLI tests pass. A bounded Flameox reproduction passed in under one second; the CI timeout was not reproduced and no provider hang fix is claimed.\n\nCo-authored-by: hhang <169027046+xu91102@users.noreply.github.com>\n", "parents": ["4a4d36f881861bbab3c734b0dd459f805766caec"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "hhang", "email": "169027046+xu91102@users.noreply.github.com", "user": { "login": "xu91102", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "21eff3bae10f58711a35ad44f86e9f96f9bb4790", "subject": "fix(setup): preserve Cordis ownership across uncertain patch structure", "body": "fix(setup): preserve Cordis ownership across uncertain patch structure\n\nSeparate stable registration ownership from setup editability. Keep group-owned rows removable, retain expression-backed structures without edits, and reject malformed literal patches before setup writes. Preserve foreign rows and backups during uninstall.\n\nCorrect stale alias fixtures to use valid Harness patch rows and remove redundant alias coverage. Validation: 78 configuration boundary tests, 6 public setup/uninstall CLI tests, full static checks, and docs checks passed. Harness behavior was verified from pinned source; no real Harness runtime verification is claimed.\n", "parents": ["b7f563e15f854061dc1507896181b7b24ac3b5f0"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "0d78c99c11efee66570772efe6eb88dfd0e1c694", "subject": "docs: celebrate 110,000 GitHub stars 🎉 (#2042)", "body": "docs: celebrate 110,000 GitHub stars 🎉 (#2042)\n\nUpdate the star milestone in the English README and all 18 translated\nREADMEs, keeping each locale's number formatting.\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["21eff3bae10f58711a35ad44f86e9f96f9bb4790"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2042] }, { "sha": "538f8cc7224dba44b728cf6c000920f911957fc4", "subject": "docs(cli): add a managed assembly inspection workflow (#2037)", "body": "docs(cli): add a managed assembly inspection workflow (#2037)", "parents": ["0d78c99c11efee66570772efe6eb88dfd0e1c694"], "authors": [ { "name": "Alessandro Costa", "email": "108879955+sandr01@users.noreply.github.com", "user": { "login": "sandr01", "__typename": "User" } } ], "pullRequests": [2037] }, { "sha": "1c64fe3eff48679c6880f42d2f0a4af46686ade7", "subject": "fix(session): invalidate snapshots before metadata write dispatch", "body": "fix(session): invalidate snapshots before metadata write dispatch\n\nStop cached metadata replay before a provider write starts, including while its reply is pending or fails after applying the mutation. Keep snapshot import and export disabled until the target is reopened.\n\nValidate failed replies, conflicting provider identity, and overlapping reads through the shared session boundary.\n", "parents": ["538f8cc7224dba44b728cf6c000920f911957fc4"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "6fb3a345fe952b8e8f59221aec993acc37ccbf31", "subject": "fix(analysis): preserve producer identity and partial evidence", "body": "fix(analysis): preserve producer identity and partial evidence\n\nReconcile Mach-O UUID observations without hiding malformed or conflicting sources. Require source-map identity digests to be supported by consistent observations. Keep truncated Android manifests as partial raw evidence, validate WABT section framing, and reject missing JEB inventories or error-marked success replies.\n\nConsolidate native UUID parsing and simplify capacity and malformed-input fixtures. Focused source and public workflow checks pass, including native arm64e inspection and real WABT framing probes; a successful real JEB GUI project opening remains unverified.\n", "parents": ["1c64fe3eff48679c6880f42d2f0a4af46686ade7"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "48c352b6bfa34c820a530272cd36600158c37b1e", "subject": "fix(cli): reuse firmware and web module input constraints", "body": "fix(cli): reuse firmware and web module input constraints\n\nDerive extraction limits and web module fields from the shared contracts. Reject empty or NUL-containing local paths before CLI path resolution, preserve firmware relative-path handling, and apply the advertised extraction defaults.\n\nValidate advertised JSON Schemas with Ajv and check the registered parser defaults; prune redundant schema-shape and description assertions.\n", "parents": ["6fb3a345fe952b8e8f59221aec993acc37ccbf31"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "e55ef7213515ba204c3d88a4487b4ee6a2773b06", "subject": "fix(runtime)!: preserve unknown debugger attachment state", "body": "fix(runtime)!: preserve unknown debugger attachment state\n\nKeep omitted discovery attachment state as null through Node, browser, Electron, and reconciliation evidence. Report the uncertainty while retaining Node observation unless discovery explicitly marks the target attached. Reject worker TargetInfo records missing the required boolean with partial coverage.\n\nValidate omitted and explicit states through provider, CLI, and MCP boundaries and real Node 24 Inspector workflows. Consolidate Electron regression coverage into the existing list-and-inspect workflow.\n\nBREAKING CHANGE: attached fields in JavaScript runtime, browser, and Electron target discovery and inspection results may be null when discovery does not report attachment state.\n", "parents": ["48c352b6bfa34c820a530272cd36600158c37b1e"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "783fcb06a4bd0444be214822fed60a3786932782", "subject": "test(javascript): consolidate module lookup regressions (#2031)", "body": "test(javascript): consolidate module lookup regressions (#2031)\n\nfix(javascript): resolve relative ESM URLs as exact files\n\nCo-authored-by: hhang <169027046+xu91102@users.noreply.github.com>", "parents": ["e55ef7213515ba204c3d88a4487b4ee6a2773b06"], "authors": [ { "name": "hhang", "email": "17309584214@163.com", "user": { "login": "xu91102", "__typename": "User" } }, { "name": "hhang", "email": "169027046+xu91102@users.noreply.github.com", "user": { "login": "xu91102", "__typename": "User" } } ], "pullRequests": [2031] }, { "sha": "83a4445f440fab978ad9376b4260acae3f5fb189", "subject": "test(sourcemap): consolidate source map regressions (#2034)", "body": "test(sourcemap): consolidate source map regressions (#2034)\n\nfix(sourcemap): retain named originals beside unknown source names\n\nCo-authored-by: hhang <169027046+xu91102@users.noreply.github.com>", "parents": ["783fcb06a4bd0444be214822fed60a3786932782"], "authors": [ { "name": "hhang", "email": "17309584214@163.com", "user": { "login": "xu91102", "__typename": "User" } }, { "name": "hhang", "email": "169027046+xu91102@users.noreply.github.com", "user": { "login": "xu91102", "__typename": "User" } } ], "pullRequests": [2034] }, { "sha": "3bcc68c037e9415c78093cb286069c1fcca6a2f8", "subject": "fix(evidence): enforce managed identity and cancel bundle reads", "body": "fix(evidence): enforce managed identity and cancel bundle reads\n\nValidate managed reconstruction through the shared artifact and MVID scope boundary, including known/unknown identity contradictions. Forward MCP comparison cancellation into both bundle reads and consolidate pre-cancel coverage.\n\nVerified managed graph/reconstruction and filesystem/MCP cancellation workflows. A controlled missing-signal mutation reads 130 chunks instead of the expected one; cancellation leaves the session unchanged and retry succeeds.\n", "parents": ["83a4445f440fab978ad9376b4260acae3f5fb189"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "3bdc8730bd98e073522bcb8ba86527be402c0cbe", "subject": "fix(adb): preserve directory identities and share byte capture", "body": "fix(adb): preserve directory identities and share byte capture\n\nUse Android 8-compatible batched find/stat with NUL-framed names and raw symlink targets. Preserve malformed or invalid UTF-8 records as partial evidence with exact source bytes. List hidden direct children without synthetic navigation entries.\n\nShare process byte capture with UTF-8 callers and screenshots, removing duplicate timeout and cancellation supervision. Verified 35 focused process, ADB, CLI and MCP tests; compatibility checked against AOSP Oreo sources. Live Android device/emulator verification was not run.\n", "parents": ["3bcc68c037e9415c78093cb286069c1fcca6a2f8"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "69e097a8ca256ab97ee4b2883739447784a5f90e", "subject": "fix(scripts, install): honor test:fast \"without build\" promise and orient Node.js engine mismatches (#2026)", "body": "fix(scripts, install): honor test:fast \"without build\" promise and orient Node.js engine mismatches (#2026)\n\n* fix(scripts): defer dist/ imports in verifier helpers so test:fast runs without build\n\nTwo helpers under scripts/lib/ reached into ../../dist/ at module load even\nthough the top-level import was only needed by one of their exports. That\nturned mocked, dist-free tests into failing tests under `npm run test:fast`,\nwhich docs/testing.md § test scripts explicitly promises runs \"without build\":\n\n- tests/conformance/providers/hopper/realHopperSemantic.test.ts only calls\n requireCurrentDocument and resolveFixtureProcedure (both mock-only), but\n scripts/lib/real-hopper-semantic.mjs eagerly imported\n requireFunctionDossierOracle from dist/application/RealHopperAssertions.js.\n Moved the dist-dependent dossier oracle into a lazy loader called from\n verifyRealHopperFixture, which is where it is actually used (against the\n real Hopper bridge, after build:cached).\n\n- tests/evaluation/package/packagePlatformDiagnostics.test.ts only uses\n assertLinuxPackageProviderFailure, which depends on `json`, but\n scripts/lib/verify-package-core.mjs eagerly re-exported helpers from\n mcp-verifier-results.mjs, which in turn pulls four dist/ modules. Moved\n that import into verifyCompleteToolCatalog (the only consumer in this\n file). Downstream scripts (verify-recorded-crash.mjs, verify-package-mcp.mjs,\n verify-windows-package.mjs) are unaffected because they already run after\n build:cached.\n\nReproduction before fix:\n rm -rf dist && npm run test:fast → 2 failed (both import-time errors)\n\nReproduction after fix:\n rm -rf dist && npm run test:fast → 388 passed, 4924 tests, 0 failed\n npm run build:cached && npm run test:fast → 388 passed, 4924 tests, 0 failed\n\nCo-Authored-By: Claude Opus 4.7 \n\n* fix(install): orient Node.js version mismatch failures with actionable remediation\n\ninstall.sh previously told operators \"use Node.js 22.x (>=22.19), 24.x (>=24.11),\nor 26+\" without saying how to install one. The curl|bash onboarding path then\nleft the operator to guess between nvm, fnm, n, Volta, system packages, or\nnodejs.org — a lookup that bounces across search engines for a first-time user.\n\nReplace the one-line failure with a block that:\n- Names the detected Node.js version (so the operator confirms it is theirs).\n- Shows the three most common install paths (nvm, fnm, direct tarball).\n- Pins the Node.js release line (24) that satisfies the engine, so copy-paste\n commands produce a supported runtime instead of whichever \"latest\" is on top.\n- Maps uname -m / uname -s to the Node.js tarball label pair for this host\n (e.g. darwin/arm64, linux/x64), so the operator can grab the right archive\n from https://nodejs.org/dist/latest-v24.x/ without a second lookup.\n\nVerified with four Node.js versions (24.18 compatible, 25.9/20.11 outside the\nsupported ranges, 22.18 below the minor floor) that remediation triggers only\non real mismatches and names the host labels correctly. shellcheck install.sh\nand npm run check:fast remain clean.\n\nCo-Authored-By: Claude Opus 4.7 \n\n---------\n\nCo-authored-by: Claude Opus 4.7 ", "parents": ["3bdc8730bd98e073522bcb8ba86527be402c0cbe"], "authors": [ { "name": "astralyx0129", "email": "astralyx0129@gmail.com", "user": { "login": "astralyx0129", "__typename": "User" } }, { "name": "Claude Opus 4.7", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2026] }, { "sha": "4573e8cf35de822bfc5feabcc89ec3717c247c8c", "subject": "fix(ghidra): recover stale clients on same-target reopen (#2014)", "body": "fix(ghidra): recover stale clients on same-target reopen (#2014)\n\n* fix(ghidra): recover stale clients on same-target reopen\n\n* test(ghidra): allow supervised shutdown in health regression\n\n* fix(ghidra): read process exit without diagnostic snapshots\n\nHealth and startup exit checks called the supervisor snapshot, which\nconcatenates retained launcher output only to read the exit code.\n\n* test(adb): align fixtures with literal output and directory commands\n\n---------\n\nCo-authored-by: Cursor Agent \nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["69e097a8ca256ab97ee4b2883739447784a5f90e"], "authors": [ { "name": "lyly", "email": "lyclance921@gmail.com", "user": { "login": "lyly-bonbon", "__typename": "User" } }, { "name": "Cursor Agent", "email": "cursoragent@cursor.com", "user": { "login": "cursoragent", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2014] }, { "sha": "6bae774328724403255590aa2ddad4d7a2aa727f", "subject": "fix(evidence): authenticate identities and retain extraction provenance", "body": "fix(evidence): authenticate identities and retain extraction provenance\n\nAuthenticate residual unknown IDs against their immutable identity fields. Permit valid empty ZIP extraction manifests and join firmware child provenance to parent-owned chunk and multi-file reports without inventing missing source ranges.\n\nValidated with focused identity, archive, cleanup, and firmware normalization tests. Firmware joins were checked against the pinned Unblob producer; no real Unblob extraction was run.\n", "parents": ["4573e8cf35de822bfc5feabcc89ec3717c247c8c"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "966f7cc84b4a8bb0043641cb64d7a7aaf8715e05", "subject": "fix(browser): preserve body API provenance through script export", "body": "fix(browser): preserve body API provenance through script export\n\nLabel new captured response bytes as Playwright body API results and retain the possibility of a credentialed follow-up load. Preserve legacy representations and source limitations through export without treating body-origin uncertainty as missing event coverage.\n\nValidated source and filesystem boundary tests plus real Chrome CLI and MCP network workflows covering binary, compressed, empty, unfinished, and same-URL responses and profile cleanup.\n", "parents": ["6bae774328724403255590aa2ddad4d7a2aa727f"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "e4532b537663026c3e5b784380eecd009c959a36", "subject": "fix(javascript): preserve TypeScript loader and dependency semantics", "body": "fix(javascript): preserve TypeScript loader and dependency semantics\n\nShare loader selection across static findings and module relationships: CTS static imports and re-exports use CommonJS lookup while dynamic imports retain ESM lookup. Retain runtime import-equals dependencies, bindings, and exported names; do not resolve require file-URL strings as local artifacts. Restore import-map descriptions in CLI help.\n\nValidated resolver and semantic tests, application reconstruction boundaries, and CLI help. Installed TypeScript NodeNext emission and Node require behavior were checked independently. Refs #2056, #2057, #2058, #2053.\n", "parents": ["966f7cc84b4a8bb0043641cb64d7a7aaf8715e05"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "d8c76b629639bda4405afa9ae2f7676b694f2f10", "subject": "fix(io): retain cleanup ownership and honor cancellation", "body": "fix(io): retain cleanup ownership and honor cancellation\n\nKeep failed JSON read handles in the existing server resource scope and fail admission until cleanup succeeds. Thread cancellation through every process CLI input read and replace timer-driven cancellation checks with a shared first-read gate.\n\nClassify authenticated standalone Evidence as wrong-kind input while preserving tampered-record integrity failures and actionable messages across ledger, CLI, and MCP consumers. Record unrelated CS_RESTRICT process neighbors as unverified without weakening related-process ownership checks. Update stale ADB fixtures for the actual shell protocol.\n\nValidated focused CLI, MCP, filesystem, ownership, and error projection tests; static, docs, and duplication gates pass. The host-level CS_RESTRICT load reproduction was not run. Refs #2050, #2035, #2064.\n", "parents": ["e4532b537663026c3e5b784380eecd009c959a36"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "4a5aec8ad6d54444b2a2c2313fbc506b17ff91aa", "subject": "docs: add responsible-use disclaimer", "body": "docs: add responsible-use disclaimer\n", "parents": ["d8c76b629639bda4405afa9ae2f7676b694f2f10"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "d864ad54717d92fe4b512ce1170717d9904c1f00", "subject": "fix(docs): synchronize disclaimer links across translations", "body": "fix(docs): synchronize disclaimer links across translations\n", "parents": ["4a5aec8ad6d54444b2a2c2313fbc506b17ff91aa"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "fa87dd2aac3eaeb49875c54e93ec18c98cc92e4d", "subject": "docs: shorten responsible-use notices across languages", "body": "docs: shorten responsible-use notices across languages\n", "parents": ["d864ad54717d92fe4b512ce1170717d9904c1f00"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "e9970855ba16ba711816ac30212c5ca17ae085cd", "subject": "fix(evidence): preserve trace uncertainty and partial provider observations", "body": "fix(evidence): preserve trace uncertainty and partial provider observations\n\nDistinguish an unresolved goal from an exhausted call graph and preserve provider failures through cancellation. Retain completed IDA replies and post-operation identity observations as partial Evidence without claiming a verified final binding. Remove source-wide bundler cache-name heuristics and stale expectations.\n", "parents": ["fa87dd2aac3eaeb49875c54e93ec18c98cc92e4d"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "98d8470d36cfbf7cd25820a4ed430aebae20c0c5", "subject": "fix(io): consolidate managed snapshots and retain cleanup ownership", "body": "fix(io): consolidate managed snapshots and retain cleanup ownership\n\nReuse managed snapshot admission and hashing in sequential path comparisons, retaining caller paths and completed inspection Evidence on later failure. Preserve exact failed-close owners alongside typed read and cancellation failures, and retry them through caller-owned resource scopes. Require canonical Hopper lease identities, remove signed offset coercion, and repair stale setup cleanup expectations that failed CI.\n", "parents": ["e9970855ba16ba711816ac30212c5ca17ae085cd"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "9b780c47bca039939dd5f73b78541f3ea566a7dd", "subject": "fix(browser): isolate script URLs with empty query or fragment (#2074)", "body": "fix(browser): isolate script URLs with empty query or fragment (#2074)", "parents": ["98d8470d36cfbf7cd25820a4ed430aebae20c0c5"], "authors": [ { "name": "xin zhuang", "email": "65798732+1052326311@users.noreply.github.com", "user": { "login": "1052326311", "__typename": "User" } } ], "pullRequests": [2074] }, { "sha": "d4e8ef74999666cdb735b49eb8fea367f8f86489", "subject": "fix(ghidra): retain launcher command outcome in launch failure diagnostics (#2011)", "body": "fix(ghidra): retain launcher command outcome in launch failure diagnostics (#2011)\n\n* fix(ghidra): retain launcher command outcome in launch failure diagnostics\n\nGhidra headless launch failures surfaced only the GhidraLaunchError name\nand a generic message, dropping the launcher command's exit code/signal\nand JVM stderr. Retain the failed command outcome on GhidraLaunchError in\nthe shared captured-output envelope and project it as launch_outcome in\nthe session failure_cause, mirroring the compiler_outcome diagnostics.\n\nFixes #1992\n\n* test(ghidra): skip POSIX JVM fixture tests on Windows\n\nThe bin/java fixture is an extensionless POSIX shell script handed to\nexecFile, which Windows cannot execute. Follow the repo pattern\n(test.skipIf) so the suite is a named Windows skip.", "parents": ["9b780c47bca039939dd5f73b78541f3ea566a7dd"], "authors": [ { "name": "Saim Shafique", "email": "msaimshafique4664@gmail.com", "user": { "login": "sx4im", "__typename": "User" } } ], "pullRequests": [2011] }, { "sha": "b3dec005bcb89b5afe6e0aa41e5251f8a3a31de7", "subject": "test(hopper): align startup fixtures with cleanup and lease contracts", "body": "test(hopper): align startup fixtures with cleanup and lease contracts\n\nInspect the typed primary startup failure retained by aggregate cleanup errors. Materialize isolated targets before real lease acquisition so launcher scenarios reach the behavior under test. Repairs the Linux shard and Windows curated test failures without weakening cleanup retention coverage.\n", "parents": ["d4e8ef74999666cdb735b49eb8fea367f8f86489"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "75a4a14fa05d352762ffaefd3cd2e16515842b03", "subject": "fix(artifacts): compare package signatures without ASCII folding (#2069)", "body": "fix(artifacts): compare package signatures without ASCII folding (#2069)", "parents": ["b3dec005bcb89b5afe6e0aa41e5251f8a3a31de7"], "authors": [ { "name": "xin zhuang", "email": "65798732+1052326311@users.noreply.github.com", "user": { "login": "1052326311", "__typename": "User" } } ], "pullRequests": [2069] }, { "sha": "974f11d010570c0a18423cd1cc93e9a5203df1b6", "subject": "docs: clarify responsible use and preserve third-party notices (#2082)", "body": "docs: clarify responsible use and preserve third-party notices (#2082)\n\nShip the responsible-use statement, third-party attribution records and\npreserved license texts in npm packages. Clarify historical-version and\nchannel coverage without changing existing licenses or installation behavior.\n\nAssisted-by: Eiki (gensokyo-skills:eiki-rule-review)\nAssisted-by: Aya (gensokyo-skills:aya-source-investigation)", "parents": ["75a4a14fa05d352762ffaefd3cd2e16515842b03"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [2082] }, { "sha": "79156e5bed1d72b83ade0483246f457b337b7e59", "subject": "test(cli): preserve Windows runtime paths and failure diagnostics", "body": "test(cli): preserve Windows runtime paths and failure diagnostics\n\nSupply the system root and temporary directory in isolated Windows CLI environments, while preserving explicit caller overrides. Include captured command output in web acceptance exit-code failures so startup and codec errors remain diagnosable.\n", "parents": ["974f11d010570c0a18423cd1cc93e9a5203df1b6"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "d1dcebce2c0820469ed63e33497a14258971b710", "subject": "fix(evidence): preserve literal keys and response body ownership", "body": "fix(evidence): preserve literal keys and response body ownership\n\nRetain exact empty and computed literal keys in JavaScript observations. Bind CDP response bodies to request occurrences, account for late responses, and validate the target after final progress callbacks.\n", "parents": ["79156e5bed1d72b83ade0483246f457b337b7e59"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "0d5033ad12e12abe78fc3c0ba81622b410d22aa1", "subject": "fix(checks): order artifact-backed lint after compilation", "body": "fix(checks): order artifact-backed lint after compilation\n\nPrevent import resolution from racing with dist cleanup in build-backed gates while retaining the source-only fast check.\n", "parents": ["d1dcebce2c0820469ed63e33497a14258971b710"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "07b36c148946f46b99a4ce04e55726e97d0ee03a", "subject": "fix(mcp): keep prompt completion within ready provider sessions", "body": "fix(mcp): keep prompt completion within ready provider sessions\n\nAvoid lazy provider startup for document and procedure completion. Propagate MCP cancellation through completers, cancel lookups during session transitions, and share provider result projection with ordinary operations. Cover cold, starting, warm, queued, cancelled, and closed sessions through MCP composition and provider boundaries.\n", "parents": ["0d5033ad12e12abe78fc3c0ba81622b410d22aa1"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "c22111eca2c4bc84a084f12711f405b3e7422a40", "subject": "fix(process): return private runtime ownership at allocation", "body": "fix(process): return private runtime ownership at allocation\n\nUse POSIX mkdtemp owner-only allocation directly instead of adding a fallible permission rewrite and rollback before returning the cleanup owner. Respect restrictive umasks, assert privacy and real scratch access, and align provider documentation.\n", "parents": ["07b36c148946f46b99a4ce04e55726e97d0ee03a"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "621cee192d582c87ca3d254d4cb22c9d209d3aea", "subject": "test(mcp): ready providers before live prompt completion checks (#2137)", "body": "test(mcp): ready providers before live prompt completion checks (#2137)\n\n07b36c148 made document and procedure completion read only from an\nalready-started provider client. Two checks still completed right after\nopening a target, so they observed an empty cold result:\n\n- promptCompletion.test.ts used a fixture client without executeIfReady\n and never ran an ordinary operation, so the composite provider had not\n created a client yet.\n- The packaged MCP smoke expected live completions on non-Linux hosts\n immediately after open_binary, before current_document started Hopper.\n\nBoth now assert the cold result is empty, ready the provider through an\nordinary operation, and then assert the unchanged live candidates.\n\nFixes #2123\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["c22111eca2c4bc84a084f12711f405b3e7422a40"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2137] }, { "sha": "abc8c6dadf4f11b67de1cc2ee96bb55047416d71", "subject": "fix(wasm): preserve leading BOM in custom section names (#2102)", "body": "fix(wasm): preserve leading BOM in custom section names (#2102)", "parents": ["621cee192d582c87ca3d254d4cb22c9d209d3aea"], "authors": [ { "name": "xin zhuang", "email": "65798732+1052326311@users.noreply.github.com", "user": { "login": "1052326311", "__typename": "User" } } ], "pullRequests": [2102] }, { "sha": "fe4b94a661054cef7603a3f07aae71f1df0a701a", "subject": "test(mcp): align completion checks with provider readiness", "body": "test(mcp): align completion checks with provider readiness\n\nExercise cold and warm completion through ordinary provider operations. Bind fixture observations to the selected analysis profile so the warm-up call satisfies session validation, and make package completion candidates explicit with useful failure diagnostics.\n", "parents": ["abc8c6dadf4f11b67de1cc2ee96bb55047416d71"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "672bdea21fd943688e081d209a993e234c45507f", "subject": "fix(target): recognize binary plists by magic under any extension (#2133)", "body": "fix(target): recognize binary plists by magic under any extension (#2133)\n\nTarget resolution admitted a property list only when its name ended in\n.plist, so keyed archives with other extensions (for example .archive)\nwere rejected as an unsupported binary format before any plist tool ran.\nClassify bplist00 bytes as a plist, as the artifact inventory already does.\n\nFixes #2129\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["fe4b94a661054cef7603a3f07aae71f1df0a701a"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2133] }, { "sha": "60259a91d9a58cbd313ad7f3d321acc2deb65d2e", "subject": "fix(managed): validate CLI type selections with the member contract (#2125)", "body": "fix(managed): validate CLI type selections with the member contract (#2125)\n\n`inspect-managed-members --type` accepted repeated and empty names that\nthe MCP contract rejects. The provider's contract parse then threw, and\nthe CLI reported execution_failure with advice to run `rea doctor`.\nReuse the contract's type_names schema so the CLI rejects them as a\nvalidation error on --type.\n\nFixes #2121\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["672bdea21fd943688e081d209a993e234c45507f"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2125] }, { "sha": "5190843f8f09ac17cbf79561bd1f708c509cda78", "subject": "fix(setup): name each skill directory in the uninstall summary (#2118)", "body": "fix(setup): name each skill directory in the uninstall summary (#2118)\n\nUninstall checks every skill destination but labeled each result only as\n\"skill\" (or \"Claude Code skill\"), so a retained or failed destination\ncould not be located. Label each result with the directory it refers to.\n\nFixes #2111\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["60259a91d9a58cbd313ad7f3d321acc2deb65d2e"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2118] }, { "sha": "4f46eac453965efde3bc782aebfeec198551afc4", "subject": "ci: narrow native-host lane selection and reuse build caches (#2131)", "body": "ci: narrow native-host lane selection and reuse build caches (#2131)\n\n* ci: narrow native-host lane selection and reuse build caches\n\nUnowned src/ and bridge/ files no longer fall back to the full baseline.\nThey run the Linux suite plus the Linux x64 installed-package/Inspector\nbaseline. New apple and package scopes own the Apple artifact lane, the\npackage matrix and the Windows curated lane, including the test files those\nlanes invoke. Manual-only verifier entrypoints run static checks and the\nLinux suite. CHANGELOG, SECURITY, GitHub templates and the native Windows\nREADME are documentation-only.\n\nPull requests omit the macOS x64 package host unless labelled ci:full.\nThe Windows and Apple lanes restore the shared Turbo build cache, the\nWindows lane drops its duplicate typecheck, and the Linux suite uses six\nshards. Main pushes keep the full baseline.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* ci: match package script entrypoints against scope globs\n\nScript-only package.json edits resolved their entrypoint with literal\nequality, so glob-owned verifiers such as scripts/verify/apple/** and\nscripts/verify/inspector/** fell back to the full baseline instead of\nselecting their owning lane.\n\nCo-Authored-By: Claude Opus 5.5 \n\n---------\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["5190843f8f09ac17cbf79561bd1f708c509cda78"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2131] }, { "sha": "315973259732544a597b8b17d25c69735910e72e", "subject": "fix(cli): report an invalid REA_LOG_LEVEL as configuration (#2140)", "body": "fix(cli): report an invalid REA_LOG_LEVEL as configuration (#2140)\n\ncreateCli parsed REA_LOG_LEVEL with a throwing schema, so an invalid or\nuppercase value crashed every command, including doctor and --help, with\na ZodError stack trace. Parse it into a ConfigurationError result and have\nthe executable print the same configuration message as the MCP adapter\nand exit 1 before building the CLI.\n\nFixes #2135\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["4f46eac453965efde3bc782aebfeec198551afc4"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2140] }, { "sha": "58fb372071e56da9c5df0e37593ee3f0da6b64bc", "subject": "feat(analysis): add opt-in retained inventory and WASM views (#2122)", "body": "feat(analysis): add opt-in retained inventory and WASM views (#2122)\n\nAdd opt-in retained inventory and WASM Evidence views with exact nested output contracts and a small static WASM descriptor. Preserve old complete CLI/MCP workflows, producer choices, original authenticated Evidence and cleanup ownership.\n\nValidated with real public applications, genuine old Evidence migration, 123 focused assertions, 11 synchronized description checks and 42 installed-package WABT cases. Detailed generated experiment JSON stays outside the final tree; concise findings and reproduction inputs remain. Main-existing completion/package CI failures are separately attributed and left unchanged.\n\nRefs #2016\n\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>", "parents": ["315973259732544a597b8b17d25c69735910e72e"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "factory-droid[bot]", "email": "138933559+factory-droid[bot]@users.noreply.github.com", "user": { "login": "factory-droid[bot]", "__typename": "User" } } ], "pullRequests": [2122] }, { "sha": "df2c08b546d4f40103e11b8b31dbfc3d41ee687b", "subject": "fix(jeb): confine an invalid REA_JEB_MCP_URL to the JEB tools (#2145)", "body": "fix(jeb): confine an invalid REA_JEB_MCP_URL to the JEB tools (#2145)\n\nJebProvider throws when REA_JEB_MCP_URL fails endpoint validation, and the\ncomposition built it eagerly for the CLI and every MCP connection. A\nmalformed value, or http://localhost:8425/mcp, therefore crashed every CLI\ncommand with a stack trace and failed every MCP connection with an\ninternal server error. The composition now parses the endpoint first and,\nwhen it is unusable, returns a JEB port that reports not_configured\navailability and a ConfigurationError naming REA_JEB_MCP_URL.\n\nFixes #2143\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["58fb372071e56da9c5df0e37593ee3f0da6b64bc"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2145] }, { "sha": "90e37f4152990be721784006a820a3794920213c", "subject": "fix(managed): report malformed PE layouts as invalid input (#2194)", "body": "fix(managed): report malformed PE layouts as invalid input (#2194)\n\n* fix(managed): report malformed PE layouts as invalid input\n\nreadManagedPeLayout raises ManagedReaderFailure for DOS, COFF and section\nheader failures such as section data past EOF. Those escaped the managed\ninspectors, so ManagedStaticProvider wrapped them as ProviderAdapterError\nand the CLI and MCP reported execution_failure with advice to run rea\ndoctor. Map format failures to an invalid_format input issue carrying the\nreader's detail, as inspect-pe-resources and inspect-go-binary do.\n\nFixes #2191\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(managed): route unmappable PE layouts through one input error\n\ninspect-managed-native-boundaries caught a layout-level ManagedReaderFailure\nitself and returned an empty malformed inspection with exit 0, while the\nother managed operations now report the same bytes as invalid input. Let\nthe layout failure reach the provider's invalid_format mapping; metadata\nfailures after a readable layout still return malformed coverage.\n\nCo-Authored-By: Claude Opus 5.5 \n\n---------\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["df2c08b546d4f40103e11b8b31dbfc3d41ee687b"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2194] }, { "sha": "51367cae6f4e6ef9b9dcb28dc21fe6c92d1dd6f8", "subject": "fix(setup): name structural problems in client configurations (#2154)", "body": "fix(setup): name structural problems in client configurations (#2154)\n\nA client configuration that parses but whose root or MCP server table is\nnot an object (for example {\"mcpServers\": null} or []) made setup print a\nraw Zod issue dump and made uninstall claim the file was not valid JSON.\nparseClientConfiguration now raises a ClientConfigurationShapeError naming\nthe root or the servers key, which setup reports as the malformed detail\nand uninstall reports instead of a syntax error.\n\nFixes #2152\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["90e37f4152990be721784006a820a3794920213c"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2154] }, { "sha": "d35035780a643e38301b8eaea03f01bb506e9df9", "subject": "fix(setup): remove emptied skill directories on uninstall (#2182)", "body": "fix(setup): remove emptied skill directories on uninstall (#2182)\n\n* fix(setup): remove emptied skill directories on uninstall\n\nUninstall removes only the managed skill files so user files survive,\nbut it left every emptied reverse-engineer-anything directory and its\nreferences/ subdirectory behind. After the ownership manifest is removed,\nremove the managed directories deepest first with a non-recursive rmdir,\nwhich keeps any directory that still holds user files.\n\nFixes #2159\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(setup): report emptied skill directories that cannot be removed\n\nOnly a directory that still holds user files, is already absent, or is no\nlonger a directory is kept silently. Any other rmdir failure, such as a\nparent that denies deletion, now fails the skill item with the directory\npath instead of reporting the skill as removed.\n\nCo-Authored-By: Claude Opus 5.5 \n\n---------\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["51367cae6f4e6ef9b9dcb28dc21fe6c92d1dd6f8"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2182] }, { "sha": "7c9c1ebdb77662f6276ef2f7250e7df414bd03ca", "subject": "fix(mcp): keep shared optional providers open across discarded probes (#2205)", "body": "fix(mcp): keep shared optional providers open across discarded probes (#2205)\n\nstartMcpTransport loads optional observation providers once per process\nand passes them to every server instance the SDK constructs. Each\ninstance's closeProviders also closed the shared browser scenario\nprovider, so when the SDK discarded a server/discover probe instance for a\nlegacy initialize, every later capture_browser_scenario call failed with\n\"Browser scenario provider is closing.\" Server instances no longer close\nthe caller-supplied provider; the transport returns\ncloseOptionalProviders and process shutdown closes it once.\n\nFixes #2195\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["d35035780a643e38301b8eaea03f01bb506e9df9"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2205] }, { "sha": "0b7145361ec02d27260eb1f5bc0be955c9374a96", "subject": "feat(wasm): add opt-in first-call summary delivery (#2193)", "body": "feat(wasm): add opt-in first-call summary delivery (#2193)\n\nAdd explicit first-call WASM summary delivery while preserving omitted/complete MCP requests, CLI output, original Evidence identity and provider inputs. Reuse exact retained export views and schema-based capability discovery.\n\nNine paired public SDK comparisons and ten actual Codex CLI answers preserve selected facts and source references. Record token reductions alongside mixed latency and unverified final resource-counter conditions. Current-main integration passes seven relevant WASM MCP workflows, a fresh real-WABT SQLite workflow and required static gates. Refs #2016.\n\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>", "parents": ["7c9c1ebdb77662f6276ef2f7250e7df414bd03ca"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "factory-droid[bot]", "email": "138933559+factory-droid[bot]@users.noreply.github.com", "user": { "login": "factory-droid[bot]", "__typename": "User" } } ], "pullRequests": [2193] }, { "sha": "4a4ae9b2b9712f7ac16f2d23c71b5c29b0c23d2f", "subject": "feat: add Frida instrumentation support (#1359)", "body": "feat: add Frida instrumentation support (#1359)\n\n* feat: add Frida instrumentation support\n\n* fix: resolve Frida CI checks\n\n* test: cover Frida contract validation branches\n\n* docs: link Frida instrumentation guide\n\n* fix(frida): handle cancellation cleanup safely\n\n* fix(frida): address PR review findings\n\n* fix(frida): preserve resume and message observations\n\n* fix(ci): use canonical registry for rolldown\n\n* fix(frida): declare foreign code effects\n\n* fix(frida): retain failed startup resources for cleanup retries\n\nKeep failed startup session and spawn handles owned until detach, resume,\nand remote lease cleanup complete. Serialize retries and release each\nremote reference once. Await CLI provider cleanup while preserving the\nprimary failure and any completed observations.\n\nAdd regressions for retained startup resources, concurrent cleanup,\nshared remote leases, and CLI cleanup outcomes.\n\nValidation: 41 focused tests pass on the PR head and its latest-main\nintegration; serial static and docs checks pass. Real Linux Frida 17.23.2\nworkflows and the native spawn/controlled-failure cleanup probe pass.\n\nAssisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)\n\n---------\n\nCo-authored-by: N0zoM1z0 <1705004398@qq.com>", "parents": ["0b7145361ec02d27260eb1f5bc0be955c9374a96"], "authors": [ { "name": "Daniel Gonçalves Araujo", "email": "47118053+dandgabr@users.noreply.github.com", "user": { "login": "dandgabr", "__typename": "User" } }, { "name": "N0zoM1z0", "email": "1705004398@qq.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [1359] }, { "sha": "10400fdb57e4226c5ce15af17968a664f35498ce", "subject": "fix(ida): thin the selected FAT slice into the private headless input (#2201)", "body": "fix(ida): thin the selected FAT slice into the private headless input (#2201)\n\nUniversal Mach-O admission reported the selected slice architecture while the IDA provider's private input copy handed the whole FAT container to upstream idalib, which then picked its own slice (x86_64 for /bin/cat) while Evidence labeled the session arm64. FAT parsing now exports the selected slice's byte range as universalSlice, and the private input copy writes exactly those bytes: the whole source digest still anchors the copy against admission-time changes, and the thinned result anchors the post-operation identity check.\n\nThin targets keep the whole-file copy, and mach-o-universal remains the container format across Evidence, snapshots, and provider routing.\n\nValidation: typecheck, oxlint (no new warnings), oxfmt, and targeted vitest runs — ida adapters 12 files/116 tests, domain and services projects 60 files/736 tests, ghidra/hopper behavior 2 files/50 tests, filesystem and universal-extraction boundary 2 files/49 tests, native signature MCP 1 file/2 tests, plus a new thinning suite (5 tests, red before the fix: 3 failed). The thinned product was verified byte-identical to the `clang -arch arm64` input of a `lipo -create` universal fixture. Controlled fixtures only; no live IDA analysis was performed for this change.\n\nCloses #2139", "parents": ["4a4ae9b2b9712f7ac16f2d23c71b5c29b0c23d2f"], "authors": [ { "name": "akushonkamen", "email": "74654766+akushonkamen@users.noreply.github.com", "user": { "login": "akushonkamen", "__typename": "User" } } ], "pullRequests": [2201] }, { "sha": "7ae3c50a9d49c480035855de9fcc4484befacd92", "subject": "docs: correct drift and reorganize English guides (#2207)", "body": "docs: correct drift and reorganize English guides (#2207)\n\nPut setup, developer commands, MCP replies, and investigation recipes before\nclient details and implementation references. Preserve existing guide anchors,\nexamples, provenance, partial-result recovery, and provider restrictions.\n\nCorrect verified documentation drift, synchronize the Ghidra capability\nwording, and regenerate metadata for skill version 40. Keep uncertain platform\nand lifecycle findings unchanged. Refs #2156.\n\nValidation: 56 focused tests, check:fast, docs:check, VitePress production build,\nformat and link/example checks. Real isolated CLI/MCP probes cover Ghidra,\nNativeAOT, HAR, cancellation, Chrome, large ELF delivery, native type limits,\nand the new JS/managed/process/setup recipes. Heavy work uses two CPUs;\na resource-heavy DOM probe was stopped and replaced by a smaller real CDP\npayload-limit control. Windows, macOS GUI, ADB, and the full CI matrix were\nnot executed.\n\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>", "parents": ["10400fdb57e4226c5ce15af17968a664f35498ce"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "factory-droid[bot]", "email": "138933559+factory-droid[bot]@users.noreply.github.com", "user": { "login": "factory-droid[bot]", "__typename": "User" } } ], "pullRequests": [2207] }, { "sha": "e4d3e1399d9cd4932653e7015a1bf8589e56029d", "subject": "feat(flutter): identify Dart snapshot builds and inspect AOT payloads by pure APK parsing (#1582)", "body": "feat(flutter): identify Dart snapshot builds and inspect AOT payloads by pure APK parsing (#1582)\n\n* feat(flutter): identify Dart snapshot builds by pure APK parsing\n\nAdd a flutter-provider family with one operation, identify_flutter_build,\nthat reads an APK's lib//libapp.so and libflutter.so through the\nhardened ZIP reader and reports build facts as observations:\n\n- The Dart VM snapshot hash, read 20 bytes after every snapshot magic\n (f5f5dcdc). The vm and isolate sections are cross-checked: agreeing\n sections collapse to one snapshot_hash, disagreeing sections keep every\n candidate with snapshot_hash null and partial coverage.\n- Per-ABI library digests and byte sizes, plus the engine library's GNU\n build-id note and any labeled 'Dart VM version' or Android clang/LLVM\n toolchain strings, verbatim; release builds without a version string\n report null rather than a guess.\n- The APK is digested before parsing so Evidence binds the observation to\n the exact input, and a target with no libapp.so reports not-detected\n with complete coverage.\n\nThe scanner is streaming with explicit pending-magic and rescan\nbookkeeping, so chunk boundaries cannot double-count or drop sections, and\nmagic-free streams never accumulate. No engine, no external lookups: the\nhash-to-SDK mapping stays with external datasets by design.\n\nVerified against Flutter Gallery 2.9.2 (112 MB, three ABIs): every ABI\nreports the same agreeing hash 65817c30a78bb44c3dc3771876b6010a from two\nsections, per-ABI build-ids, and the clang toolchain line; a plain\naapt2-built APK reports not-detected with complete coverage. Scanner\ngoldens come from the same libraries. READMEs carry the new 'Flutter apps'\nrow in every supported language.\n\n* feat(flutter): inspect Dart AOT snapshots through the ELF symbol table\n\nAdd inspect_dart_aot to the flutter family: for one ABI's libapp.so it\nlocates the four _kDart*Snapshot* symbols through the ELF dynamic symbol\ntable (ELF32 and ELF64 little-endian, bounds-checked reads; a payload\nwithout exported symbols is refused), reports each section's offset and\nsize, validates data-section headers (magic, kind, length; instructions\nsections honestly report nulls for the fields their layout does not\ncarry), and projects a bounded string pool from the isolate data section:\ndistinct package: source URIs (the app's dependency inventory), dart: SDK\nURIs, and identifier-shaped tokens, each with counts, bounds, and partial\ncoverage when truncated.\n\nThe string pool is labeled as a byte-pattern projection, not deserialized\ncluster semantics: typed class and function recovery remains an\nSDK-specific parser, which the snapshot hash now unlocks. The ABI is\ncaller-selected with a deterministic default (arm64-v8a, x86_64, then\nfirst available).\n\nVerified against Flutter Gallery 2.9.2: all four symbols on both ELF64\n(arm64-v8a) and ELF32 (armeabi-v7a) images, header validation, hash\nagreement with identify_flutter_build, and a 756 package: / 201 dart:\nURI pool from the isolate data section; goldens in DartElf.test.ts come\nfrom the same libraries.\n\n* fix(flutter): own snapshots, bound image reads, and preserve cancellation\n\nMirror the ownership bar the maintainers applied across the merged JEB,\nADB, and Apktool PRs:\n\n- Copy the admitted APK into a provider-owned, read-only snapshot (EXCL\n create, chmod 0400) before digesting and parsing; every later read uses\n the snapshot, so a concurrently modified original cannot mix into one\n observation. The result reports the snapshot's byte size and digest.\n- Retain failed snapshot-root cleanup in a provider set and retry it on\n close(), throwing an aggregate error when a root is still owned; root\n removal is injectable so the retention is testable.\n- Allocate the AOT image buffer at exactly the declared library size\n before reading (bounded before allocation, not concat-after-stream),\n keep the 256 MiB ceiling, and check cancellation between digest and\n stream chunks through a captured abort reason.\n- Accept APK paths containing spaces (covered by a fixture test) and\n escape the ABI pattern's dash for v-mode regex compatibility.\n\nAlso add tests for cleanup retention with close retry and for\ncancellation before any snapshot root is created.\n\n* docs(flutter): cover the Italian README with the Flutter row\n\nThe Italian translation landed between the merged feature PRs; its table\nnow carries every merged row plus this one, keeping its documentation-link\nset identical to README.md.\n\n* fix(flutter): make the ABI pattern portable for v-mode validators\n\nUse a hex-escaped hyphen in the ABI character class, matching the form\nthe ADB portability fix uses, so clients compiling advertised schemas in\nunicodeSets mode accept the inspect_dart_aot input schema.\n\n* refactor(flutter): reuse shared harnesses and deduplicate the vertical\n\nThe duplicate-detection gate (jscpd, 2.5% threshold) tipped to 2.51% with\nthe flutter files added. Reuse the existing machinery instead of repeating\nit:\n\n- FlutterBuildAnalysisService delegates to executeProviderOperation, the\n shared admission/Evidence composition, instead of restating its body.\n- The CLI registers both commands from one table-driven spec.\n- Boundary tests use the shared serveCli and assertAdvertisedMcpContracts\n harnesses rather than hand-rolled equivalents.\n- The provider test consolidates the four payload-shape cases into one\n table-driven case; the service test uses one admission table and\n distinct phrasings.\n\nDuplicate lines fall from 2.51% to 2.48%, back under the gate.\n\n* fix(flutter): address review findings from real-app verification\n\nCassieFox23 verified the PR against three real F-Droid Flutter apps and\na control app, and found five gaps. All are fixed and re-verified against\ncone (info.tangential.cone), one of the tested apps:\n\n- Build-id: the scanner now reads the descriptor length from the note\n header instead of assuming 20 bytes, so 8-byte ids from older\n toolchains parse; the schema accepts 8-128 hex characters. Verified\n against cone's readelf-reported ids on all three ABIs.\n- Compiler line: the toolchain capture bound rises from 200 to 500\n characters, keeping cone's 262-character clang line verbatim.\n- Zero-byte libapp.so: the extraction target is created before streaming,\n so an empty entry yields a clean unsupported_target refusal for\n inspect_dart_aot and elf_header_valid: false with partial coverage for\n identify_flutter_build, instead of a raw ENOENT with code UNKNOWN.\n- Truncated library: identify_flutter_build marks fewer than two snapshot\n sections as partial coverage with a limitation naming the count, and a\n missing ELF magic gets its own limitation.\n- Docs: the default ABI preference now matches the code exactly\n (arm64-v8a, x86_64, x86, armeabi-v7a, then the rest alphabetically).\n\nAlso: every test that read the author's /tmp/opencode goldens now builds\na self-contained synthetic ELF64 image with dynsym, four snapshot\nsymbols, two snapshot sections, and a string pool, so the suite runs\nanywhere; the verify lane now requires a present hex build-id per ABI\ninstead of accepting null.\n\n* fix(flutter): address the Codex review findings\n\nEight findings, all applied:\n\n- P1: SnapshotHashScanner keeps candidates in a Set (no quadratic\n Array.includes) with a 64-distinct-hash cap, so a hostile payload of\n magic+hash records cannot stall the scan or bloat the response.\n- P1: projectStringPool stops admitting new distinct entries once each\n category reaches twice its projection bound and reports\n collectionCapped; allocation and sorting now track the response, not\n the payload.\n- P2: ZIP reader rejections during entry iteration or entry streaming\n map into the typed error algebra (cancellation vs input refusal)\n instead of escaping as unhandled exceptions in both operations.\n- P2: magic_valid now marks coverage only for the *Data symbols; a\n complete four-symbol image with valid data magics reports complete\n coverage (the instruction symbols intentionally lack the magic).\n- P2: the MCP server closes the Flutter provider during shutdown, so a\n retained snapshot root is retried and reported, not leaked.\n- P2: LabeledStringScanner commits matches only when a printable run is\n delimiter-terminated; the carry grows to 600 bytes so a 500-character\n toolchain line survives any chunk boundary untruncated.\n- P2: both Flutter tool effects declare writesFilesystem: true; the\n owned APK snapshot and extracted libapp.so are temporary writes.\n- P2: the verify lane asserts every ABI agrees on exactly one snapshot\n hash instead of discarding the computed set.\n\n* fix(flutter): address the second Codex review round\n\nNine findings on the first-round fixes:\n\n- P1: identify_flutter_build enforces a cumulative extraction budget\n (768 MiB) across every library entry, not just per library, so an APK\n with many ABIs cannot stream an unbounded total.\n- P1: a single NUL-free printable run stops materializing at 1024 bytes\n and marks the pool capped, so an adversarial one-run section cannot\n allocate unbounded strings.\n- P1: ELF cString bounds the NUL-terminator scan to the name maximum\n plus one, so malformed symbol tables cannot scan the whole image per\n entry.\n- P2: mapReaderFailure distinguishes ArtifactReaderFailure texts —\n budget/limit rejections map to resource constraints, integrity\n failures (CRC/overlap/signature) to their own input refusal — instead\n of collapsing all reader failures into one message.\n- P2: the labeled-string carry is cleared when a delimiter commits a\n run, so consecutive toolchain lines are never concatenated.\n- P2: string-pool counts are renamed *_count_at_least and documented as\n lower bounds, because capped collection discards values beyond twice\n the projection bound.\n- P2: inspect_dart_aot marks hash disagreements, non-pair source counts,\n and candidate-cap saturation as partial coverage.\n- P2: only valid lowercase-hex hash records count as snapshot sources;\n complete magic records with non-hex fields do not inflate agreement.\n- P2: the per-entry size refusal in inspect_dart_aot moves after ABI\n selection, so an oversized unselected ABI no longer refuses a small\n request.\n\n* fix(flutter): address the third Codex review round\n\nFive findings:\n\n- P2: the owned snapshot revalidates the source after the copy (size,\n mtime, inode), so an in-place replacement or swap mid-copy refuses\n the observation instead of publishing mixed bytes.\n- P2: a failed ZipArtifactReader close retains the snapshot root for\n close() retry instead of silently swallowing the descriptor leak,\n in both operations.\n- P2: snapshot headers are parsed within their symbol bounds and a\n symbol smaller than the 16-byte header reports magic_valid false,\n so trailing-image bytes can no longer fake a valid data section.\n- P2: the verify lane counts provider.close() cleanup failures as\n lane failures instead of certifying a run with retained roots.\n- P2: LabeledStringScanner reports toolchain_capped when further\n distinct matching lines are observed past the 4-line projection;\n identify marks such results partial with a naming limitation.\n\n* fix(flutter): address rounds three and four of the Codex review\n\nRound three (one missed finding) plus round four (five findings):\n\n- P2: the GNU build-id note descriptor size is decoded from all four\n bytes of the little-endian field, rejecting nonzero high bytes\n instead of masking them to 16 bits.\n- P1: the Flutter MCP handlers route through createContractToolHandler\n and the session's analysisAdmission, so close_binary and snapshot\n operations drain in-flight Flutter calls instead of racing them.\n- P2: the owned-snapshot copy is a streamed, abort-checked write (no\n copyFile), so cancellation stops the write promptly while the\n source-identity revalidation (size, mtime, inode) still guards\n against mid-copy replacement.\n- P2: identify marks any snapshot_hash_sources value other than exactly\n two as partial, matching the inspection path's pair requirement.\n- P2: the verify lane refuses to run without --apk (exit 2) instead of\n printing a false-green pass, and the engine check requires every\n libapp-carrying ABI to have a present libflutter with a valid hex\n build-id rather than filtering missing engines away vacuously.\n\n* fix(flutter): address the fifth Codex review round\n\nSix findings plus the upstream duplication baseline:\n\n- P2: the flutter-provider kind reports available in the capability\n inventory, so binary_session no longer lists always-registered\n Flutter tools as provider_missing.\n- P2: printable runs that exceed the 1024-byte cap are discarded at\n their delimiter instead of emitting their truncated prefix as a\n fabricated observation.\n- P2: ELF symbols must fit inside the file-backed portion of their\n PT_LOAD segment (p_filesz), so addresses in gaps or BSS are refused\n instead of accepting unrelated bytes.\n- P2: the build-id carry spans the complete 80-byte maximum note\n (16-byte header + 64-byte descriptor) so chunk-boundary splits\n cannot drop the first byte.\n- P2: the labeled-string carry is sized for the toolchain pattern's\n true 605-byte maximum, not the previous 600.\n- P2: the AOT completeness predicate requires exactly two sources and\n one candidate unconditionally, so zero-source images with valid data\n magics report partial instead of complete.\n\nAlso: the shared ELF fixture builder and snapshot-section helper moved\nto a dedicated FlutterTestFixtures module, eliminating cross-file test\nduplication; jscpd now passes at 2.50% while main sits at 2.52%.\n\n* fix(flutter): address the sixth Codex review round\n\nFive findings:\n\n- P2: snapshot-hash scanning is bounded to the exported data symbols'\n byte ranges, so decoy or stale magic/hash sequences elsewhere in the\n image cannot inflate source counts or contribute candidates.\n- P2: labeled-string runs longer than the carry bound are rejected\n instead of truncated, preventing a regex prefix from being published\n as a verbatim source string.\n- P2: the AOT image reread checks cancellation between file reads and\n before the synchronous parsing stage, so a cancelled caller cannot\n receive a success from a completed 256 MiB read.\n- P2: the verify lane requires exactly two snapshot sources per ABI,\n matching the provider's pair requirement, instead of accepting any\n count >= 2.\n- P2: ELF section and program header entry sizes are validated against\n the class-defined minimum widths before walking either table, so\n undersized entries cannot cause field reads to cross into\n neighboring bytes.\n\n* fix(flutter): address the seventh Codex review round\n\nSix findings:\n\n- P2: data-symbol ranges are deduplicated by offset and size, so aliased\n symbols mapping to the same bytes are scanned once and the result\n marks partial coverage with a limitation naming the shared range.\n- P2: openEntrySafely forwards return/throw to the underlying Readable's\n iterator, so an early for-await exit closes the ZIP entry stream and\n releases its producer instead of leaking a backpressured pipe.\n- P2: inspect_dart_aot now reports snapshot_hash_candidates and\n snapshot_hash_sources alongside snapshot_hash, so a null hash from\n conflicting evidence is distinguishable from missing hash data.\n- P2: overlong printable runs only set toolchain_capped when they begin\n with a recognized label prefix (Dart VM version: or Android (); other\n long strings such as license text are skipped without marking partial.\n- P2: readElfSymbol falls back to PT_DYNAMIC/DT_SYMTAB when section\n headers are absent (e_shnum 0, ET_DYN), so stripped Flutter libraries\n with exported snapshot symbols are no longer refused; the dynamic\n table is bounded by DT_STRSZ, DT_SYMENT, and the image end.\n- P2: the verify lane exercises inspect_dart_aot for every ABI carrying\n libapp.so, not just the preferred default.\n\n* fix(flutter): address the eighth Codex review round\n\nFive findings:\n\n- P2: each data-symbol range gets a fresh SnapshotHashScanner so the\n carry from one noncontiguous slice cannot fabricate a record spanning\n into the next; results are aggregated after scanning.\n- P2: dynsym name lookups are bounded to the linked string table —\n st_name offsets outside the table and terminators beyond it are\n rejected instead of reading unrelated payload bytes as symbol names,\n in both the section-header and PT_DYNAMIC paths.\n- P2: identify_flutter_build routes its reader.entries and reader.open\n calls through the same collectEntriesSafely and openEntrySafely\n wrappers as inspect_dart_aot, so malformed ZIPs surface as input\n refusals instead of AnalysisProtocolError.\n- P2: mapReaderFailure recognizes ArtifactReaderFailure texts carrying\n a cancelled reason, mapping them to AnalysisCancelledError instead\n of AnalysisInputError.\n- P2: the cumulative extraction cap is enforced inside the chunk loop,\n not after each library completes, so refusal happens before the\n remaining bytes are streamed and hashed.\n\n* fix(flutter): harden streaming, sizes, and cancellation after self-review\n\nFour issues found in a systematic self-audit across all bug classes\nfrom eight Codex rounds:\n\n- createReadStream in both the digest function and the owned-snapshot\n copy now receives the AbortSignal directly, so cancellation aborts\n the filesystem read at the source instead of waiting for the next\n chunk to arrive on a slow filesystem.\n- The owned snapshot enforces a 2 GiB APK-level size cap before any\n copy I/O, so a path pointing at an enormous file is refused before\n disk usage grows.\n- identify_flutter_build preflights the sum of declared entry sizes\n against the 768 MiB cumulative budget, refusing before any ZIP\n extraction when the declared total already exceeds it.\n- The LabeledStringScanner triple result() call is collapsed to a\n single invocation (the previous code called result() three times in\n the emission, relying on end() being idempotent).\n\nNo behavior change for valid inputs; all 36 tests, check:fast, and\nthe cone verify lane pass unchanged.\n\n* fix(flutter): require structurally parseable ELF headers for complete coverage\n\nCassieFox23's third corrupt-header case: an ELF with valid magic but\nzeroed section/program header offsets passes the 4-byte magic check\nand the byte scanner still finds hash patterns in the data sections,\nso identify_flutter_build reports complete coverage for a structurally\nbroken file.\n\nThe elf_header_valid check now also verifies beyond the magic:\ne_type must be a known value (ET_REL/ET_EXEC/ET_DYN), at least one\nof e_shoff/e_phoff must be non-zero, and at least one of\ne_shnum/e_phnum must be non-zero. A file with valid magic but zeroed\nstructure reports partial coverage with the existing ELF-magic\nlimitation.\n\n* fix(flutter): validate ELF and snapshot coverage\n\nShare bounded ELF header parsing between identification and inspection. Accumulate headers across ZIP chunks and validate table entry widths and extents before claiming complete identification coverage.\n\nBind AOT hashes to the exported VM and isolate headers, validate stored snapshot lengths including the magic bytes, and preserve partial evidence for missing, malformed, aliased, or overlapping data headers.\n\nPreserve native stream cancellations and APK resource constraints across both operations. Bound snapshot copies while streaming and retain useful input-failure diagnostics and lower-bound count wording.\n\nValidation: 72 focused tests; check:fast; check including formatting; docs:check; test discovery; jscpd; real cone APK and non-Flutter control on Linux. Verified CLI/MCP parity for valid and corrupted ELF headers and AOT inspection across three ABIs. Native Windows and macOS were not run.\n\n* fix(flutter): unify artifact ownership and bound ELF evidence\n\n* fix(flutter): preserve ELF provenance and partial coverage\n\nRead GNU build IDs only from bounded ELF note ranges and retain conflicting candidates. Preserve source versus owned storage failures and honor cancellation through parsing and final cleanup.\n\nSeparate snapshot structure from string-pool coverage. Verify every Gallery ABI with digest-bound engine labels and URI counts, and document the supported snapshot-kind layout.\n\n---------\n\nCo-authored-by: REA Contributor \nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["7ae3c50a9d49c480035855de9fcc4484befacd92"], "authors": [ { "name": "Quentin Limo", "email": "85309073+3QL@users.noreply.github.com", "user": { "login": "3QL", "__typename": "User" } }, { "name": "REA Contributor", "email": "contributor@rea.tools", "user": null }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [1582] }, { "sha": "51d6c87cdbf5f11eaf3cb1862befe704a81827c5", "subject": "feat(clients): register ZCode during setup (#1564)", "body": "feat(clients): register ZCode during setup (#1564)\n\n* feat(clients): register ZCode during setup\n\n- SupportedClients: zcode definition (~/.zcode/cli/config.json, format\n zcode, personal skills at ~/.zcode/skills)\n- ClientConfigurationDocument: zcode dialect reads/writes the nested\n mcp.servers table; withClientServers now tolerates a missing outer\n table for fresh documents\n- docs: add ZCode to the supported-clients table with configuration notes\n- tests: zcodeClientConfiguration.test.ts (path resolution, nested\n upsert, fresh/empty configs, uninstall)\n\nVerified: tsc --noEmit clean; vitest run\ntests/boundary/filesystem/zcodeClientConfiguration.test.ts 6/6.\n\n* fix(clients): preserve ZCode fallback servers and honor enable flag\n\nReview follow-up (#1564), two integration gaps:\n\n- ZCode reads the user-scope ~/.agents/mcp.json fallback only while the\n native .zcode config defines no servers at all, with no merging. Setup\n now copies the fallback's mcpServers entries into the native table when\n writing the first native server, so registrations that only live in\n the fallback keep loading; the fallback file is left untouched. A\n malformed fallback fails setup closed (configure and preflight)\n instead of being silently suppressed.\n- ZCode disables a server with \"enable\": false on its entry, which the\n generic status parsing (disabled/enabled) did not recognize: doctor\n reported such a registration as aligned although ZCode never starts\n it. The ZCode dialect now treats enable: false as disabled (state\n stale) and setup rewrites the entry on rerun.\n\nDocs describe both behaviors; the bundled REA skill's supported client\nlist includes zcode.\n\nVerified: tsc --noEmit clean; vitest run\ntests/boundary/filesystem/zcodeClientConfiguration.test.ts 10/10;\nnpm run check:fast green; npm run verify:test-discovery 733 files.\n\n* fix(clients): reject non-regular ZCode fallback files before reading\n\nResolve the fallback through the client-config transaction path and the\nregular-file admission before parsing it, so a FIFO or other non-regular\nfile at ~/.agents/mcp.json fails setup closed instead of blocking the\nread indefinitely. Directory and FIFO fallback cases are covered in\ntests, and the preflight remediation names unreadable fallbacks too.\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["e4d3e1399d9cd4932653e7015a1bf8589e56029d"], "authors": [ { "name": "Iven Koo", "email": "73214171+IvenKooLab@users.noreply.github.com", "user": { "login": "IvenKooLab", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [1564] }, { "sha": "bfa805decf83744bd3ecb0d1402667cf3ed5c3b2", "subject": "feat(clients): register Trae during setup (#1573)", "body": "feat(clients): register Trae during setup (#1573)\n\n* feat(clients): register Trae during setup\n\n- SupportedClients: trae definition (VS Code-style user directory,\n User/mcp.json, format json)\n- Trae documents mcpServers as the top-level server table with\n command/args/env and stdio as the default transport; it has no\n personal skills directory, so setup skips the skill copy\n- tests: traeClientConfiguration.test.ts (per-platform user directory\n resolution, upsert preserving unrelated settings, fresh/empty\n configs, uninstall)\n\nVerified: tsc --noEmit clean; vitest run\ntests/boundary/filesystem/traeClientConfiguration.test.ts 6/6.\n\n* fix(clients): install Trae's personal REA skill\n\nReview follow-up (#1573): the Trae Skills documentation lists global\nskills under ~/.trae/skills on macOS/Linux and %userprofile%/.trae/skills\non Windows, so the definition now carries that skillPath and setup\ninstalls the bundled skill copy there. The installation docs no longer\nclaim Trae has no personal skills directory, and the bundled REA\nskill's supported client list includes trae.\n\nVerified: tsc --noEmit clean; vitest run\ntests/boundary/filesystem/traeClientConfiguration.test.ts 7/7.\n\n* docs(clients): qualify Trae configuration path evidence\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["51d6c87cdbf5f11eaf3cb1862befe704a81827c5"], "authors": [ { "name": "Iven Koo", "email": "73214171+IvenKooLab@users.noreply.github.com", "user": { "login": "IvenKooLab", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [1573] }, { "sha": "109769319a4a3a5f85e8a43bb419d04aefff66a4", "subject": "feat(clients): register Qoder CLI during setup (#1572)", "body": "feat(clients): register Qoder CLI during setup (#1572)\n\n* feat(clients): register Qoder CLI during setup\n\n- SupportedClients: qoder definition (~/.qoder/settings.json, format\n json, QODER_CONFIG_DIR override honored)\n- Qoder CLI documents mcpServers as the user-scope server table with\n command/args/env and stdio as the default transport; no personal\n skills directory is documented, so setup skips the skill copy\n- tests: qoderClientConfiguration.test.ts (path resolution and\n QODER_CONFIG_DIR override, upsert preserving unrelated settings,\n fresh/empty configs, uninstall)\n\nVerified: tsc --noEmit clean; vitest run\ntests/boundary/filesystem/qoderClientConfiguration.test.ts 6/6.\n\n* fix(clients): install Qoder CLI's personal REA skill\n\nReview follow-up (#1572): the Qoder CLI Skills documentation lists\n~/.qoder/skills/{skill-name}/SKILL.md with automatic discovery, so the\ndefinition now carries skillPath following Qoder's configuration\nlocation (QODER_CONFIG_DIR honored) and setup installs the bundled\nskill copy there. The installation docs no longer claim Qoder has no\npersonal skills directory, and the bundled REA skill's supported\nclient list includes qoder.\n\nVerified: tsc --noEmit clean; vitest run\ntests/boundary/filesystem/qoderClientConfiguration.test.ts 7/7.\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["bfa805decf83744bd3ecb0d1402667cf3ed5c3b2"], "authors": [ { "name": "Iven Koo", "email": "73214171+IvenKooLab@users.noreply.github.com", "user": { "login": "IvenKooLab", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [1572] }, { "sha": "86de439ba4c9297f721abc60c715fe30fb6ff3df", "subject": "fix(frida): name the argument each Frida input error rejects (#2217)", "body": "fix(frida): name the argument each Frida input error rejects (#2217)\n\nFrida session lookups, script lookups, unreadable script files and the\ninstrument-with-frida PID and script checks returned invalid_request with\nno issues, while the remediation told callers to correct the listed\narguments. Attach the session_id, script_id, path, target or script issue\nwith the reason so CLI and MCP callers can see what to fix.\n\nFixes #2213\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["109769319a4a3a5f85e8a43bb419d04aefff66a4"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2217] }, { "sha": "ae412654d5947f3841c191e92f3ad6b73d6f894b", "subject": "docs: preserve the native guide title anchor (#2224)", "body": "docs: preserve the native guide title anchor (#2224)\n\nKeep the former native-ui-and-dispatch-investigation fragment after the\npage title was changed in #2207. The old and current fragments resolve to\nthe same heading position in the generated page.\n\nValidation: VitePress production build, generated-document checks, format\nand link checks, and real Chrome navigation to both fragments.\nRefs #2156.\n\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>", "parents": ["86de439ba4c9297f721abc60c715fe30fb6ff3df"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "factory-droid[bot]", "email": "138933559+factory-droid[bot]@users.noreply.github.com", "user": { "login": "factory-droid[bot]", "__typename": "User" } } ], "pullRequests": [2224] }, { "sha": "c9aecde580d26d4e7745c2623a4efa327a27367e", "subject": "fix(frida): reject an unreadable script file before starting a session (#2211)", "body": "fix(frida): reject an unreadable script file before starting a session (#2211)\n\n* fix(frida): reject an unreadable script file before starting a session\n\nThe shared instrument_with_frida workflow started the Frida session, which\nattaches or spawns the target, before the provider read a file script\nsource. A missing script file then failed loadScript with a bare\ninvalid_request, and session cleanup resumed the paused spawn, so the\ntarget ran without instrumentation. Check that the selected file is a\nreadable regular file first and report the path, or access_denied for\nEACCES/EPERM, before any device effect.\n\nFixes #2209\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(frida): let cancellation win over the script file check\n\nAn already-aborted request with an unreadable file source returned the\ninput or access-denied error instead of AnalysisCancelledError. Check the\nsignal before the script file preflight and again after it, so file\nsources keep the existing cancellation semantics.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* refactor(frida): keep the pre-start checks out of instrument\n\nCo-Authored-By: Claude Opus 5.5 \n\n---------\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["ae412654d5947f3841c191e92f3ad6b73d6f894b"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2211] }, { "sha": "7711b0000592aa80c7b0412004150313f78feabc", "subject": "fix(apple): preflight XML plist nesting before keyed archive decoding (#2161)", "body": "fix(apple): preflight XML plist nesting before keyed archive decoding (#2161)\n\n* fix(apple): preflight XML plist nesting before keyed archive decoding\n\ninspect_keyed_archive documented a 128-level nesting limit, but the XML\nplist path reached recursive decoding before any depth check: plist and\nthe prototype-key traversal in parseXmlPropertyList recurse once per\nnesting level, so a ~75 KiB, 3000-level XML plist exhausted the call\nstack and reported Maximum call stack size exceeded instead of the\nbounded-resource limit that shallower over-limit documents (129, 200)\nalready produced. The CLI classified both as truncated, so no crash or\nclassification bypass was involved; the diagnostic was the defect.\n\nReject excessive nesting in parseXmlPropertyList before any recursive\npass, using the projection's own limit (MAX_PLIST_DEPTH) so the error is\nidentical to the one projectPlistValue raises: callers keep the\nlimit/truncated classification with no error-handler translation. Depth\ncounts values the way the projection does - container members nest one\nlevel deeper, dictionary keys name members rather than nesting, and a\nself-closing element is the value at its own level - so the guard\nrejects exactly the documents the projection rejected, at the same\nboundary, and every in-limit document decodes unchanged. The guard sits\nat the shared decoder boundary, so Interface Builder, app Info.plist\nresolution and native inspect_plist gain the same deterministic limit;\nthe binary plist path keeps its existing expansion preflight.\n\nBinary plist behavior, ordinary XML decode, __proto__ omission counting,\nand archive digest/Evidence provenance are unchanged. OpenStep\nautodetection is untouched by this guard, as the existing Interface\nBuilder preflight also scopes its depth check to XML.\n\nRegression coverage: decoder unit tests at and just past the limit for\ndictionary and array nesting with self-closing and opaque markup,\nmodule tests through decodeKeyedArchiveBytes including a valid\nNSKeyedArchiver XML envelope at the limit, a production-boundary test\nthrough inspectBundleKeyedArchive, and the compiled public CLI\nreporting code truncated / reason limit for a 3000-level plist.\n\n* fix(apple): check XML nesting against parsed element structure\n\nReuse the iterative XML decoder document for depth preflight and prototype-key lookup. Bound recursive plist wrappers alongside dictionaries and arrays without interpreting markup inside attributes or DOCTYPE declarations as values.\n\nValidated with 104 focused tests including compiled CLI, MCP prototype-key, and Interface Builder coverage; npm run check and verify:test-discovery passed. No real-provider verification was run.\n\n---------\n\nCo-authored-by: Zburgers \nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["c9aecde580d26d4e7745c2623a4efa327a27367e"], "authors": [ { "name": "nakshatra k", "email": "95270855+Zburgers@users.noreply.github.com", "user": { "login": "Zburgers", "__typename": "User" } }, { "name": "Zburgers", "email": "Zburgers@users.noreply.github.com", "user": { "login": "Zburgers", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2161] }, { "sha": "b1bf4a70d44191348ca20a91a52fb663da4daed0", "subject": "fix(setup): name invalid client config shape errors clearly (#2157)", "body": "fix(setup): name invalid client config shape errors clearly (#2157)\n\n* fix(setup): name invalid client config shape errors clearly\n\nSetup was dumping raw Zod issues for non-object roots or server tables,\nand uninstall always claimed the file was not valid JSON. Report the\nstructural problem instead, and reserve parse failures for real syntax errors.\n\nFixes #2152\n\nCo-authored-by: Cursor \n\n* fix(setup): preserve client configuration record validation\n\nKeep descriptive shape errors while retaining Zod record validation and its own-property copy. Reject tagged YAML objects before setup or uninstall writes and prevent inherited JSONC properties from fabricating client registrations.\n\nAdd production-boundary regressions for tagged YAML roots and server tables, plus inherited Cursor and OpenCode settings. All 91 focused tests, npm run check, verify:test-discovery, verify:package, and npm pack --dry-run passed.\n\n---------\n\nCo-authored-by: Beqa Ksovreli \nCo-authored-by: Cursor \nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["7711b0000592aa80c7b0412004150313f78feabc"], "authors": [ { "name": "BeqaKs", "email": "91750923+BeqaKs@users.noreply.github.com", "user": { "login": "BeqaKs", "__typename": "User" } }, { "name": "Beqa Ksovreli", "email": "beqa@Beqas-Macbook-Pro-2.local", "user": null }, { "name": "Cursor", "email": "cursoragent@cursor.com", "user": { "login": "cursoragent", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2157] }, { "sha": "ac6ef95e12335bdc054ccaaa96c32474cf8789ea", "subject": "docs: define contribution scope and simplify proposal forms", "body": "docs: define contribution scope and simplify proposal forms\n\nDefine REA contribution scope and fail closed on unresolved integration boundaries.\n\nMake proposal forms easier to complete with structured choices, explicit unknowns, and optional technical details; welcome exploratory drafts while retaining maintainer review before integration.", "parents": ["b1bf4a70d44191348ca20a91a52fb663da4daed0"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [2229] }, { "sha": "94153f1c757e07a6d092e00903aa8b125d4a0afa", "subject": "fix(uninstall): label YAML configuration syntax failures correctly", "body": "fix(uninstall): label YAML configuration syntax failures correctly\n\nReport malformed Hermes and DeepSeek Harness documents as YAML. Carry the\ncompiled setup/uninstall diagnostics coverage from #2153 onto the existing\nvalidation from #2157, including unchanged files and no backup writes.\nAdd malformed YAML scenarios for both clients.\n\nValidation: 174 focused tests, npm run check, test discovery, package\nverification, and npm pack --dry-run.\n\nCo-authored-by: Jax367 <239124526+Jax367@users.noreply.github.com>\n", "parents": ["ac6ef95e12335bdc054ccaaa96c32474cf8789ea"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "Jax367", "email": "239124526+Jax367@users.noreply.github.com", "user": { "login": "Jax367", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "428eee00fdd0406cdf2b734c9ea14a2bb02da279", "subject": "ci: keep validation fresh and preserve failed-shard reports (#2210)", "body": "ci: keep validation fresh and preserve failed-shard reports (#2210)\n\nRun the existing README consistency and Python producer guards from their\nCI owners. Execute full local validation fresh while preserving cached\npreparation, and permit scoped reuse of earlier portable build entries.\n\nCollect failed-shard diagnostics before enforcing success and publish\ncompact, portable timing history only after a complete successful merge.\nPreserve installer truncation failure across supported Bash versions.\n\nKeep cancellation tests focused on the called MCP tool, observe server\nprogress before timing target readiness, and retain delayed-startup,\ncancellation, cleanup, and live follow-up request assertions.\n\nValidation: all 32 CI jobs and the separate Go lane passed; 935 files,\n9,630 cases, 9,544 passed, 86 skipped, zero failed. Controlled regressions\nand fault/restoration probes are recorded in PR #2210.\n\nRefs #2190.\n\nAssisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)", "parents": ["94153f1c757e07a6d092e00903aa8b125d4a0afa"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [2210] }, { "sha": "1770f38cfc6cbe87491d0de8b8730c305c5cf8ea", "subject": "test(native): verify real PE and DOS entry views", "body": "test(native): verify real PE and DOS entry views\n\nRecord real Ghidra/MCP and Codex CLI verification of shipped ShareX native PE and FreeDOS DOS MZ entry views. Preserve original Evidence provenance, separate run-specific references from facts, and reject stale/colliding producer identities or unsupported model claims.\n\nSixteen focused experiment regression cases, original public-reply/transcript replays, and CI run 38273269072 pass for head 0667f7cb7c85f134311c7470ff4ee99ef9cc45f4. No production API/default change or general native speedup claim; final resource counters remain unknown. Continues #2016.\n\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>", "parents": ["428eee00fdd0406cdf2b734c9ea14a2bb02da279"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "factory-droid[bot]", "email": "138933559+factory-droid[bot]@users.noreply.github.com", "user": { "login": "factory-droid[bot]", "__typename": "User" } } ], "pullRequests": [2216] }, { "sha": "0baad58e606f12a8dc6cef06253f85350378e5b1", "subject": "feat(ghidra): admit RISC-V ELF analysis through a pinned generic lane (#2151)", "body": "feat(ghidra): admit RISC-V ELF analysis through a pinned generic lane (#2151)\n\n* feat(ghidra): admit RISC-V ELF analysis through a pinned generic lane\n\nRefs #2063.\n\nRecognize `EM_RISCV` (243) as a provider-neutral family that carries its own ELF\nfacts, and bound the first Ghidra lane to little-endian `ET_EXEC` images that\ndeclare the double-float ABI, pinned to `RISCV:LE:32:default` or\n`RISCV:LE:64:default` with the `gcc` compiler specification.\n\nGhidra 12.1.4 is not reliable without the pin: its `riscv.opinion` pins\n`variant=\"default\"` for the 64-bit constraint and leaves the 32-bit constraint\nwith the comment that the loader \"must choose between 'default' and 'AndeStar'\nvariants\". Measured on the installed release tree, a source-owned generic RV32\nELF with no Andes declaration imports as `RISCV:LE:32:AndeStar_v5:gcc`, while\nRV64 resolves to `RISCV:LE:64:default:gcc`. The lane therefore states the\nlanguage per width and refuses any caller-selected processor outside it instead\nof inheriting the header guess.\n\nRefusals name the declaration rather than falling back to a guessed profile:\nbig-endian images (Ghidra 12.1.4 ships no big-endian RISC-V language),\nnon-`ET_EXEC` images, `EF_RISCV_RVE`, `EF_RISCV_TSO`, and every float ABI other\nthan double, which the pinned generic compiler specifications model. The raw\ne_flags bits stay in Evidence as declarations, not as instruction semantics.\n\nFamily recognition now has one owner for the ELF-metadata families:\n`ELF_METADATA_ARCHITECTURES`, `isElfMetadataArchitecture`, and\n`HeaderArchitecture` replace ten `Exclude` sites that\nwould each have needed a second hand-edited member. `ghidraPinnedLanguage` is\nthat owner for the import commitment: the session readback previously re-derived\nonly the MIPS pin, so a profile committing any second pinned language failed with\na language-mismatch error before the bridge started.\n\nHopper and IDA refuse RISC-V by name, matching the MIPS wording. Caller-supplied\nraw-binary entry keeps its existing four-family list; this lane is ELF-header\nadmission only.\n\nVerification on macOS 15.7.7 arm64, Node 24.18.0, Ghidra 12.1.4 PUBLIC and JDK\n21.0.12.1, with the host decompiler built from the release sources for\n`os/mac_arm_64`: `npm run check` passes; `npm run test:fast` passes 396 test\nfiles; `npm run verify:test-discovery` discovers all 917 test files exactly once.\nSource-owned RV32 and RV64 double-float `ET_EXEC` fixtures complete\n`rea analyze --provider ghidra` and `rea decompile rea_riscv_entry`, committing\n`RISCV:LE:32:default` and `RISCV:LE:64:default` with `language_selection:\nprovider-pinned-v1`; the soft-float RV64 shape is refused with the named\nfloat-ABI reason, and the full refusal matrix including the RV32 and\nwidth-mismatch shapes is covered by unit tests. No `verify:ghidra:riscv` lane\nscript is included in this change; the runs above were performed manually against\nthe installed engine. Fork pull requests receive no CI check runs, so the\nreal-provider scope above is the evidence available for review.\n\n* fix(ghidra): bound the RISC-V lane by declared flags and document it\n\nAddress review feedback on #2151.\n\n`e_flags` bits outside `EF_RISCV_RVC | EF_RISCV_FLOAT_ABI` are now refused with\nthe offending value named, so a reserved or newer producer declaration cannot\nenter the verified generic lane by falling through the RVE, TSO and float-ABI\nchecks.\n\nAdmission reads `e_type` only, so the refusal text no longer calls `ET_EXEC`\nstatic: a fixed-address declaration does not establish static linkage, and\n`PT_INTERP` and dynamic dependencies are not inspected. The session records that\nboundary as a limitation rather than inferring a load model.\n\nAdd `docs/ghidra-riscv.md` in the shape of the MIPS lane guide (admission\nboundary, refusal table, why the language is pinned per class, Evidence fields,\nand what the fixtures do not establish), and correct\n`docs/firmware-analysis.md`, which still told users that MIPS and RISC-V\ndecompilation had not been added.\n\nVerification after the change: `npm run check` and `npm run docs:check` pass; the\nRISC-V module tests pass (17 lane cases plus 9 parser cases); on Ghidra 12.1.4\nwith JDK 21.0.12.1 the RV32 and RV64 double-float fixtures still analyze and\ndecompile with `RISCV:LE:32:default` / `RISCV:LE:64:default` and\n`language_selection: provider-pinned-v1`, the soft-float fixture is still refused\nby name, and the new linkage limitation appears in the emitted Evidence.\n\n* fix(ghidra): align RISC-V pinning with admission\n\nReuse the complete lane admission boundary when selecting a language, retain unsigned unsupported flag bits in diagnostics, and derive float ABI metadata from the source declaration.\n\n* test(ghidra): verify RISC-V CLI and MCP workflows\n\nBuild source-owned RV32/RV64 fixtures with Clang and LLD, establish independent ELF and symbol facts with LLVM readelf, and verify real provider evidence, instruction bytes, calls, decompilation, schema projections, snapshot replay, refusal diagnostics, source immutability and cleanup.\n\nVerified on macOS ARM64 with Ghidra 12.1.4, JDK 21 and LLVM/LLD 23.1.2. Dynamic linkage, big-endian, Andes and RVE/TSO workflows remain unverified; ISA attributes are not inspected.\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["1770f38cfc6cbe87491d0de8b8730c305c5cf8ea"], "authors": [ { "name": "The one -Niu", "email": "912906590@qq.com", "user": { "login": "NIU-123370", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2151] }, { "sha": "7724edbdd3fa0acd94c8210a30dceba501fcdbe8", "subject": "fix(process): report single empty settlement observation as unverifiable (#2232)", "body": "fix(process): report single empty settlement observation as unverifiable (#2232)\n\nobserveSettlement classified a group as alive_at_deadline when the settlement\nbudget expired after one empty observation, though no live member was ever\nseen. Track observed liveness and return unverifiable when the deadline ends\nobservation with only empty rounds. The two-consecutive-empty rule for\nquiesced is unchanged, and the cleanup_outcome projection for non-quiesced\nsettlements stays cleaned.\n\nFixes #2170.", "parents": ["0baad58e606f12a8dc6cef06253f85350378e5b1"], "authors": [ { "name": "Saim Shafique", "email": "msaimshafique4664@gmail.com", "user": { "login": "sx4im", "__typename": "User" } } ], "pullRequests": [2232] }, { "sha": "85c5477930d504cfd8b72334b48255d8e746a85e", "subject": "docs(readiness): align required stage identifier and checks with evaluator (#2200)", "body": "docs(readiness): align required stage identifier and checks with evaluator (#2200)", "parents": ["7724edbdd3fa0acd94c8210a30dceba501fcdbe8"], "authors": [ { "name": "Luis Araya", "email": "35828647+Totopo27@users.noreply.github.com", "user": { "login": "Totopo27", "__typename": "User" } } ], "pullRequests": [2200] }, { "sha": "d80b55e11bc47c6f999dac7dcb8382219d65739a", "subject": "fix(adb): preserve existing bugreport archives (#2221)", "body": "fix(adb): preserve existing bugreport archives (#2221)\n\n* fix(adb): preserve existing bugreport archives\n\n* fix(adb): retain bugreports after publication failure\n\nRecord acquired archive facts before publishing, preserve the staging archive when the exclusive copy fails, and keep retained evidence out of automatic cleanup. Reuse the same observation through publication and digest failures.\n\nAdd a real-filesystem ENOSPC regression covering error projection, existing evidence, subsequent collection and provider shutdown. Verified 96 focused tests, static checks and docs on macOS with simulated ADB; no real-device verification.\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["85c5477930d504cfd8b72334b48255d8e746a85e"], "authors": [ { "name": "Lucien", "email": "164857476+dakjdakd@users.noreply.github.com", "user": { "login": "dakjdakd", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2221] }, { "sha": "8e004522f232ec698c77536235853088a851e6b5", "subject": "docs: define performance priorities for analysis workflows (#2245)", "body": "docs: define performance priorities for analysis workflows (#2245)\n\nSet agent tokens and context first, analysis time second, and CPU and memory\nthird while preserving correctness, Evidence and existing contracts.\n\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>", "parents": ["d80b55e11bc47c6f999dac7dcb8382219d65739a"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "factory-droid[bot]", "email": "138933559+factory-droid[bot]@users.noreply.github.com", "user": { "login": "factory-droid[bot]", "__typename": "User" } } ], "pullRequests": [2245] }, { "sha": "59be866719e8fe8ec060515044d427a3b0a57649", "subject": "fix(ghidra): encode Java probe output as UTF-8 (#2206)", "body": "fix(ghidra): encode Java probe output as UTF-8 (#2206)\n\n* fix(ghidra): encode Java probe output as UTF-8\n\n* fix(ghidra): preserve Unicode Java homes across supported JDKs\n\n* test(ghidra): verify snapshot rejection without matching prose\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["8e004522f232ec698c77536235853088a851e6b5"], "authors": [ { "name": "Ha1baraA1", "email": "243105435+Ha1baraA11@users.noreply.github.com", "user": { "login": "Ha1baraA11", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2206] }, { "sha": "8cbd57cafaf1cfacbe832bae593589cf211442ef", "subject": "fix(website): prioritize getting started across language editions", "body": "fix(website): prioritize getting started across language editions\n", "parents": ["59be866719e8fe8ec060515044d427a3b0a57649"], "authors": [ { "name": "N0zoM1z0", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [2250] }, { "sha": "d96550f2f61647ffa150597de73363fa90c4e169", "subject": "ci: summarize static checks and retain complete reports (#2242)", "body": "ci: summarize static checks and retain complete reports (#2242)\n\nKeep static feedback concise while retaining complete diagnostic reports,\nvisible lint errors, module-boundary checks, and the 3% duplication gate.\nUpload complete reports after static failures and restore their outputs\nfrom Turbo caches. Preserve unambiguous, checkout-relative clone locations.\n\nBind both lint caches to the website, documentation configuration and\nexperiment sources actually scanned by oxlint, including ignore policy.\nGuard this ownership by comparing live checker discovery with resolved\nTurbo inputs. A real website syntax error now invalidates a cached pass.\n\nValidation: full current-head CI and the separate Go lane passed. Seven\nreal-checker regressions passed; failure-status and stale-report mutations\nwere rejected, and restored source passed. Actual Turbo restored both\nreports byte-for-byte; full static/docs/workflow checks passed.\n\nCloses #2238.\nRefs #2190.\n\nAssisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)", "parents": ["8cbd57cafaf1cfacbe832bae593589cf211442ef"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [2242] }, { "sha": "ad08510a113d7a9b8d92fb1e385757880e469869", "subject": "refactor(evm): bind offline analysis through a static descriptor", "body": "refactor(evm): bind offline analysis through a static descriptor\n\nBind existing EVM CLI/MCP metadata and the legacy service factory through one static descriptor, and register the same selected service that owns cleanup. Preserve original names, schemas, inputs/full defaults, configuration, Evidence and injection identity.\n\nVerified exact SDK catalog/fact parity across six real EVM pairs, 59 actual EVM CLI/MCP cases, six real cross-domain workflows, six actual Codex CLI fact/reference/lifecycle trials and relevant local checks. CI run 38283026233 succeeds for exact head d999d9874bf59c3c8486bac9b2c867a4a6a9121d. No token reduction from wiring or fully qualified resource claim; final counters remain unknown. Continues #2016.\n\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>", "parents": ["d96550f2f61647ffa150597de73363fa90c4e169"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "factory-droid[bot]", "email": "138933559+factory-droid[bot]@users.noreply.github.com", "user": { "login": "factory-droid[bot]", "__typename": "User" } } ], "pullRequests": [2261] }, { "sha": "11fe5a13f8aee87d0c0e036a9f497407e085fe48", "subject": "fix(native): retain failed pwntools process and runtime cleanup (#1708)", "body": "fix(native): retain failed pwntools process and runtime cleanup (#1708)\n\n* fix(native): retain failed pwntools process and runtime cleanup\n\nKeep failed worker/debugger cleanup owners and their private files until\nverified process shutdown and successful directory removal. Retry cleanup\nbefore another inspection and expose shutdown through the shared services,\nCLI and MCP server. Serialize acquisition without delaying cancellation of\nqueued callers, and preserve primary diagnostics when CLI cleanup fails.\n\nThe original decoder reproduction left a live owned Node child with its\nruntime deleted and no retained cleanup owner; the regression now verifies\nretention, admission blocking, retries and eventual process/file cleanup.\n\nValidation: 10 lifecycle/public CLI/MCP tests, 20 service tests, test\ndiscovery 814/814, build:cached and full check including architecture guards.\nActual POSIX process/filesystem boundaries used injected Node workers on\nmacOS; real Linux pwntools/GDB provider parsing was not exercised.\n\n* test(native): verify retained recorded-crash cleanup lifecycle\n\n* fix(native): finalize diagnostic cleanup before publishing results\n\n* fix(native): retire decoder stages before reading runtime evidence\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["ad08510a113d7a9b8d92fb1e385757880e469869"], "authors": [ { "name": "Yijie Lu", "email": "115929844+1NormalGuy@users.noreply.github.com", "user": { "login": "1NormalGuy", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [1708] }, { "sha": "2e45b4d7a5b3228fe8b283def6f047797561bee1", "subject": "fix(ci): stop aggregate jobs when verification is cancelled", "body": "fix(ci): stop aggregate jobs when verification is cancelled\n", "parents": ["11fe5a13f8aee87d0c0e036a9f497407e085fe48"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "ec2d251c0ad8382e0665546be5ec8f5f1c175962", "subject": "fix(adb): count UTF-8 bytes in logcat total_bytes (#2212)", "body": "fix(adb): count UTF-8 bytes in logcat total_bytes (#2212)\n\n* fix(adb): count UTF-8 bytes in logcat total_bytes\n\nread_adb_logcat assigned the decoded stdout string's UTF-16 code-unit\nlength to total_bytes, undercounting non-ASCII dumps (a 37-byte CJK line\nreported 33). Measure the UTF-8 byte length instead, matching the field's\nbyte-unit contract and the repo's Buffer.byteLength convention.\n\nFixes #2175\n\n* fix(adb): count raw captured bytes in logcat total_bytes\n\nCarry the pre-decode stdout byte length through runAdb so malformed\nUTF-8 (replaced by U+FFFD on decode) still reports the true captured\nbyte count instead of the re-encoded replacement size.", "parents": ["2e45b4d7a5b3228fe8b283def6f047797561bee1"], "authors": [ { "name": "Saim Shafique", "email": "msaimshafique4664@gmail.com", "user": { "login": "sx4im", "__typename": "User" } } ], "pullRequests": [2212] }, { "sha": "f941968eb1860dd41efc2a5201b35cecca42301d", "subject": "fix(ci): allow cold Chrome startup in runtime fixtures", "body": "fix(ci): allow cold Chrome startup in runtime fixtures\n\nLet the fixture lifecycle own CDP readiness with the same 60-second startup deadline as the broader browser verifier. Return the discovered port to both consumers and clean up failed startup before returning a lease.\n\nValidation: five startup/cleanup boundary tests, npm run check, and real Chrome 154 runtime and source-map CLI/MCP verifiers passed on macOS arm64. Hosted Linux verification follows the push.\n", "parents": ["ec2d251c0ad8382e0665546be5ec8f5f1c175962"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "47a51b08f4d79f808c1b74de79c3852aa853df53", "subject": "fix(process): add an opt-in Swift module cache (#2252)", "body": "fix(process): add an opt-in Swift module cache (#2252)\n\n* fix(process): add an opt-in Swift module cache\n\nSigned-off-by: Charan Rathore <180254320+charan-rathore@users.noreply.github.com>\n\n* fix(process): preserve caller-owned Swift module caches\n\nFold the complementary implementation from #2260 into the earlier #2252 proposal, retaining the original contribution history.\n\nCo-authored-by: NIU-123370 <191000457+NIU-123370@users.noreply.github.com>\n\n* fix(process): bypass xcrun lookup for explicit Swift toolchains\n\n---------\n\nSigned-off-by: Charan Rathore <180254320+charan-rathore@users.noreply.github.com>\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>\nCo-authored-by: NIU-123370 <191000457+NIU-123370@users.noreply.github.com>", "parents": ["f941968eb1860dd41efc2a5201b35cecca42301d"], "authors": [ { "name": "Charan Rathore", "email": "180254320+charan-rathore@users.noreply.github.com", "user": { "login": "charan-rathore", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "NIU-123370", "email": "191000457+NIU-123370@users.noreply.github.com", "user": { "login": "NIU-123370", "__typename": "User" } } ], "pullRequests": [2252] }, { "sha": "fd985dbc5b9435918732c0cc1825060af2a3a47e", "subject": "fix(apple): join recognized keys from NIBArchive field maps (#2248)", "body": "fix(apple): join recognized keys from NIBArchive field maps (#2248)\n\n* fix(apple): join recognized keys from NIBArchive field maps\n\ninspect-asset-catalog returned no resource-key matches for a decoded\nNIBArchive resource whose recognized image key is present in the archive. The\nNIBArchive projection groups an object's decoded fields under the node's\nnibValues attribute beside the class, label and ID it derives from the same\narchive, while the AppKit keyed-archive parser flattens the same fields onto\nthe node. The catalog join read only the top level, so a recognized NSImageName\non a decoded resource produced no row, and the empty-catalog limitation still\nclaimed resource keys were reported as unmatched.\n\nRead an archive object's fields from both shapes, and give the namespace one\nowner by exporting NIB_VALUES_ATTRIBUTE from the projection that writes it.\nThe recognized-field set stays in the catalog analysis, which owns that\ncontract.\n\nVerified with 5 focused catalog tests, check:fast and verify:test-discovery on\nmacOS arm64, and through the public CLI against the reported NIBArchive\nfixture. The keyed-archive control keeps its existing row, and a NIBArchive\nwith only an unrecognized title still produces none. The ibtool-dependent\nnative hierarchy lane requires full Xcode and was unavailable here.\n\n* fix(apple): normalize resource keys at the NIBArchive producer\n\nFold the complementary implementation from #2256 into the earlier #2248 proposal, retaining the original contribution history.\n\nCo-authored-by: Thang Luu <76550342+thangldw@users.noreply.github.com>\n\n* fix(apple): restrict catalog joins to parsed resource nodes\n\n---------\n\nCo-authored-by: 吴佳浩 \nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>\nCo-authored-by: Thang Luu <76550342+thangldw@users.noreply.github.com>", "parents": ["47a51b08f4d79f808c1b74de79c3852aa853df53"], "authors": [ { "name": "吴佳浩Alben", "email": "35291372+XiaoBinGan@users.noreply.github.com", "user": { "login": "XiaoBinGan", "__typename": "User" } }, { "name": "吴佳浩", "email": "wujiahao@supremind.com", "user": null }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "Thang Luu", "email": "76550342+thangldw@users.noreply.github.com", "user": { "login": "thangldw", "__typename": "User" } } ], "pullRequests": [2248] }, { "sha": "916ac97bf9f7b976982e438ceb856a9692576cb1", "subject": "fix(cli): retain browser and Inspector input correction details (#2230)", "body": "fix(cli): retain browser and Inspector input correction details (#2230)\n\nReuse the shared safe issue projection for all six CLI validation boundaries\nand cover malformed inputs, credential safety, and parser diagnostics.\n\nFixes morluto/rea#2180\n\nDeveloped with assistance from OpenAI Codex.", "parents": ["fd985dbc5b9435918732c0cc1825060af2a3a47e"], "authors": [ { "name": "No BS AI", "email": "144746926+369Apps@users.noreply.github.com", "user": { "login": "369Apps", "__typename": "User" } } ], "pullRequests": [2230] }, { "sha": "aeee5074d124414239b6dd440dc79c26bcbd58a4", "subject": "feat(sqlite): inspect offline snapshots with selective evidence (#2271)", "body": "feat(sqlite): inspect offline snapshots with selective evidence (#2271)\n\nAdd offline SQLite database/WAL inspection through the shared CLI/MCP.\n\nUse compact inventory, selected-table schema, exact ordered columns and\nbounded row samples while preserving source identity and lossless values.\nRetain completed Evidence through late cancellation and private-root cleanup\nfailures, bound concurrent inspections, and recheck journal validity after\nacquisition. Reuse prepared CI runtime artifacts across supported Node lines.\n\nCo-authored-by: Y0UW1SH <29498139+Y0UW1SH@users.noreply.github.com>\nAssisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)", "parents": ["916ac97bf9f7b976982e438ceb856a9692576cb1"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "Y0UW1SH", "email": "29498139+Y0UW1SH@users.noreply.github.com", "user": { "login": "Y0UW1SH", "__typename": "User" } } ], "pullRequests": [2271] }, { "sha": "0043d9b134c0a353e8bf85c0bde4492275f1f720", "subject": "fix(browser): report mismatched event family selection as unknown in capture comparison (#2239)", "body": "fix(browser): report mismatched event family selection as unknown in capture comparison (#2239)\n\n* fix(browser): report mismatched event family selection as unknown in capture comparison\n\n* fix(browser): retain selected event families and unknown coverage\n\nFold the complementary implementation from #2253 into the earlier #2239 proposal, retaining the original contribution history.\n\nCo-authored-by: itsF4LCON <107556180+itsF4LCON@users.noreply.github.com>\n\n---------\n\nCo-authored-by: LouisChen <3361008+chqcjq@users.noreply.github.com>\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>\nCo-authored-by: itsF4LCON <107556180+itsF4LCON@users.noreply.github.com>", "parents": ["aeee5074d124414239b6dd440dc79c26bcbd58a4"], "authors": [ { "name": "LouisChen", "email": "65096591@qq.com", "user": { "login": "chqcjq", "__typename": "User" } }, { "name": "LouisChen", "email": "3361008+chqcjq@users.noreply.github.com", "user": { "login": "chqcjq", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "itsF4LCON", "email": "107556180+itsF4LCON@users.noreply.github.com", "user": { "login": "itsF4LCON", "__typename": "User" } } ], "pullRequests": [2239] }, { "sha": "e20994a8ea10609d420e958bd8a1268b0bcd8899", "subject": "fix(ghidra): keep JVM warnings out of LaunchSupport output (#1698)", "body": "fix(ghidra): keep JVM warnings out of LaunchSupport output (#1698)\n\n* fix(ghidra): keep JVM warnings out of LaunchSupport output\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(ghidra): retain LaunchSupport warnings in session diagnostics\n\n* fix(ghidra): select helper logging flags by observed JVM identity\n\n* fix(ghidra): preserve diagnostics through typed failure projection\n\n---------\n\nCo-authored-by: Claude Opus 5.5 \nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["0043d9b134c0a353e8bf85c0bde4492275f1f720"], "authors": [ { "name": "Petru101", "email": "43178362+Petru101@users.noreply.github.com", "user": { "login": "Petru101", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [1698] }, { "sha": "0365454a573eb52c7089320fd74bfd4a673b78ae", "subject": "docs(agents): require brittleness review before resolving threads", "body": "docs(agents): require brittleness review before resolving threads\n", "parents": ["e20994a8ea10609d420e958bd8a1268b0bcd8899"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "bb266226707135ad9f181e6c3afd6af0ef62fb22", "subject": "fix(cli): retain correction details across adjacent browser commands (#2294)", "body": "fix(cli): retain correction details across adjacent browser commands (#2294)\n\n* fix(cli): retain correction details across browser commands\n\nFold the complementary implementation from #2247 into the earlier #2230 proposal, retaining the original contribution history.\n\nCo-authored-by: LouisChen <3361008+chqcjq@users.noreply.github.com>\n\n* fix(browser): retain diagnostics from the selected input branch\n\n* fix(cli): recognize incomplete browser scenarios by their owned fields\n\n---------\n\nCo-authored-by: LouisChen <3361008+chqcjq@users.noreply.github.com>", "parents": ["0365454a573eb52c7089320fd74bfd4a673b78ae"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "LouisChen", "email": "3361008+chqcjq@users.noreply.github.com", "user": { "login": "chqcjq", "__typename": "User" } } ], "pullRequests": [2294] }, { "sha": "f76163c2467db623f9de0bda757c9d8610ca9565", "subject": "feat(evm): add retained interface summary delivery (#2308)", "body": "feat(evm): add retained interface summary delivery (#2308)\n\nAdd opt-in EVM MCP summary delivery and retained/portable function and text views. Keep existing complete defaults, provider arguments and original full Evidence identities and records usable. Require retention before selected analysis; preserve inferred candidates, nulls, diagnostics, provenance and explicit unknowns.\n\nVerify old schemas, historical Evidence migration, 64 focused feature checks, 30 affected MCP checks after latest-main rebase, 59 real EVM CLI/MCP cases and six shared-domain artifact workflows. Repeated SDK delivery is smaller; all real model trials and mixed token/time outcomes, limitation failures and resource qualification gaps remain documented without a uniform performance claim.\n\nRefs #2016\n\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>", "parents": ["bb266226707135ad9f181e6c3afd6af0ef62fb22"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "factory-droid[bot]", "email": "138933559+factory-droid[bot]@users.noreply.github.com", "user": { "login": "factory-droid[bot]", "__typename": "User" } } ], "pullRequests": [2308] }, { "sha": "d1aaeee400e0d9911d5c53339ca3ac42dccbbba3", "subject": "feat(ida): support optional native IDA Free MCP in attached mode (#1544)", "body": "feat(ida): support optional native IDA Free MCP in attached mode (#1544)\n\nAdd an explicit attached native IDA MCP compatibility profile while preserving the legacy and headless workflows. Keep recorded input identity, complete source observations and the user's open GUI database. Batch unique callee lookups, conservatively prefilter literal strings, preserve Unicode matching and unavailable caller coverage, and require distinct-function switching in native verification.\n\nVerified with Windows IDA Pro 9.3 and the native MCP plugin built from c9d15d98e8a143fc74f6e14037c48f63889b6d6c with a loopback listener. Production CLI/MCP and an unchanged Windows whoami.exe passed. Windows IDA Free was not used. No personal paths or license registration information are included.\n\nValidation: 200 focused tests, static and documentation checks, architecture guards and discovery passed. Historical same-main warm task measurements improved from 675 to 317 ms; response token estimates fell from 16618 to 11509. Fresh-start, overall CPU and memory improvement were not established. Detailed scope is in experiments/analysis-efficiency/ida-native-windows.md.\n\nCo-authored-by: imissapixel <140405963+imissapixel@users.noreply.github.com>\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>\nCo-authored-by: N0zoM1z0 <161784452+N0zoM1z0@users.noreply.github.com>", "parents": ["f76163c2467db623f9de0bda757c9d8610ca9565"], "authors": [ { "name": "Fernando Pereira", "email": "140405963+imissapixel@users.noreply.github.com", "user": { "login": "imissapixel", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "N0zoM1z0", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [1544] }, { "sha": "a97b713f740932339a5f1036ad2213168c421270", "subject": "test(mcp): fix three MCP boundary suites on native Windows (#2312)", "body": "test(mcp): fix three MCP boundary suites on native Windows (#2312)\n\n* test(mcp): fix three MCP boundary suites on native Windows\n\n* test(mcp): report unavailable root symlink coverage as a skip\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["d1aaeee400e0d9911d5c53339ca3ac42dccbbba3"], "authors": [ { "name": "pablodiazjorge", "email": "102741971+pablodiazjorge@users.noreply.github.com", "user": { "login": "pablodiazjorge", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2312] }, { "sha": "b123b2e51cc7d6d2157525664be2df88fb1ba3bd", "subject": "perf(evidence): authenticate and seal imported bundles in one pass", "body": "perf(evidence): authenticate and seal imported bundles in one pass\n\nReuse the immutable domain parser at the file boundary instead of rebuilding and revalidating an already authenticated bundle. Existing filesystem and integrity regressions pass (27 tests); a 4 MiB parsing probe preserves immutable output and reduces repeated validation work.\n", "parents": ["a97b713f740932339a5f1036ad2213168c421270"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "cecc6ecbffe84689a173d1634f342e046b0c8ceb", "subject": "fix(process): preserve invalid runtime path selections as input errors", "body": "fix(process): preserve invalid runtime path selections as input errors\n\nClassify unresolvable and unusable executable or working-directory selections before launch, retaining field paths, attempted candidates and OS diagnostics. Preserve tagged analysis errors through capture lifecycle handling. Replace duplicate missing-path source assertions with public CLI/MCP regression coverage and retain distinct permission, file-kind and PATH checks.\n", "parents": ["b123b2e51cc7d6d2157525664be2df88fb1ba3bd"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "23971376158e7815edcbe6c04a8df7c9504650dc", "subject": "fix(setup): honor config roots and display terminal dry-run plans", "body": "fix(setup): honor config roots and display terminal dry-run plans\n\nNormalize empty XDG config homes once for configuration writers and registration readers. Render the resolved plan for terminal dry runs while preserving structured output. Cover registration placement and a real PTY dry run, including absence of configuration writes.\n", "parents": ["cecc6ecbffe84689a173d1634f342e046b0c8ceb"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "02cedc37961a5d230b134f330c148322cd04bf37", "subject": "fix(readiness): validate stage evidence references once", "body": "fix(readiness): validate stage evidence references once\n\nCollect stage and check references at their owning stage boundary before evaluating required checks. Emit one missing-reference finding per stage and Evidence ID, including stages with no supplied checks, while preserving independent failed checks and cross-stage identity. The 21 readiness tests pass.\n", "parents": ["23971376158e7815edcbe6c04a8df7c9504650dc"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "221c85648108e9846d9920b0964dafa7f108d581", "subject": "fix(browser): preserve attached service-worker policies and ownership", "body": "fix(browser): preserve attached service-worker policies and ownership\n", "parents": ["02cedc37961a5d230b134f330c148322cd04bf37"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "570c40cde55d31e455ef9bc484b7b908658ded58", "subject": "fix(cli): preserve failure semantics across full-output formats", "body": "fix(cli): preserve failure semantics across full-output formats\n", "parents": ["221c85648108e9846d9920b0964dafa7f108d581"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "f611d8ce722cd36345e9ff83b9669ef2e7fe57a9", "subject": "feat(captures): inspect recorded packets with bounded TShark delivery (#2318)", "body": "feat(captures): inspect recorded packets with bounded TShark delivery (#2318)\n\nInspect selected fields in existing captures through shared CLI/MCP Evidence.\nPage matching frames without changing dissection or two-pass read coverage;\nretain failed descriptor/process cleanup ownership and reject excess admission.\n\nVerified with real TShark 4.0.17 and 4.2.2, public Wireshark recordings,\nowned HTTP application traffic, real CLI/MCP workflows and schema checks.\n\nCo-authored-by: Olorinm <59321404+Olorinm@users.noreply.github.com>\nAssisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)", "parents": ["570c40cde55d31e455ef9bc484b7b908658ded58"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "Olorinm", "email": "59321404+Olorinm@users.noreply.github.com", "user": { "login": "Olorinm", "__typename": "User" } } ], "pullRequests": [2318] }, { "sha": "c9fed50691ae014890e91a72534773d2fb58ce44", "subject": "fix(targets): recognize Windows headers after short DOS stubs", "body": "fix(targets): recognize Windows headers after short DOS stubs\n\nObserve MZ header declarations and signature uncertainty at the domain boundary, then reuse those facts in bounded target resolution, inventory, and Go PE parsing. Preserve DOS relocation ownership and fail closed when the relevant bytes remain unexamined.\n\nValidation: 59 domain tests, 130 target/Go boundary tests, and public CLI inspection of a clang/lld-link PE DLL with a short DOS header. Fixes #2172.\n", "parents": ["f611d8ce722cd36345e9ff83b9669ef2e7fe57a9"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "7fb097d72c9931dd5dfae481ad2b9d3bb6029f15", "subject": "fix(go): accept file-backed unmapped Mach-O debug segments", "body": "fix(go): accept file-backed unmapped Mach-O debug segments\n\nValidate unmapped segment file ranges without adding virtual mappings or fallback metadata addresses. Keep mapped-segment bounds and reject build-info sections declared in unmapped segments.\n\nValidation: real unstripped Go 1.26.5 Darwin arm64 and amd64 artifacts passed CLI/MCP oracle, Evidence, source-range and unchanged-byte checks. Retained malformed-input regressions; removed the weaker synthetic acceptance test. Full cross-platform verifier not run. Fixes #2167.\n", "parents": ["c9fed50691ae014890e91a72534773d2fb58ce44"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "8d4d631606c701aac150cf009d3b80ae4a7ae7d5", "subject": "fix(apple): decode UIKit keyed-archive outlet connections", "body": "fix(apple): decode UIKit keyed-archive outlet connections\n\nSelect authoritative connection fields by runtime class in a shared owner used by keyed archives and NIBArchive projection. Preserve archive identities, endpoint relationships and coverage, and replace duplicate synthetic outlet assertions with a rooted public CLI fixture.\n\nValidation: compiled CLI acceptance against the issue-sourced rooted UIKit fixture and 41 filesystem tests. Native UIKit framework validation was not rerun. Fixes #2177.\n", "parents": ["7fb097d72c9931dd5dfae481ad2b9d3bb6029f15"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "ed485a3dc8cc3a4baf8cabe01acb7aa0490b73b3", "subject": "fix(artifacts): compare leaf inventories using explicit coverage", "body": "fix(artifacts): compare leaf inventories using explicit coverage\n\nClassify coverage once at inventory production and require it in current outputs. Normalize older retained Evidence at the inventory parser, reject inconsistent page statuses, and remove comparison heuristics over limitation prose.\n\nValidation: public CLI-to-MCP plist comparison, changed-behavior and unknowns workflow; boundary checks for legacy Evidence, partial coverage, page disagreement, content and executable changes; generated docs checks. Fixes #2173.\n", "parents": ["8d4d631606c701aac150cf009d3b80ae4a7ae7d5"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "1c37914306b3ff257d7a0360f11c9bf2a3f2cac7", "subject": "fix(javascript): retain wrapped isolated-world bridge exposures", "body": "fix(javascript): retain wrapped isolated-world bridge exposures\n\nShare contextBridge argument ownership between direct and wrapped analysis, seed intact isolated-world calls, and preserve dynamic world IDs and conditional metadata as unknown. Keep callee evaluation scoped to each invocation.\n\nValidation: 99 focused source tests and bundled isolated-world acceptance through dedicated and generic CLI routes. Removed duplicate literal source regression in favor of public workflow coverage. Fixes #2174.\n", "parents": ["ed485a3dc8cc3a4baf8cabe01acb7aa0490b73b3"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "c339f9ebe7bd1f30608d6ccb7175da523dd3c485", "subject": "fix(setup): ignore empty home directory selections", "body": "fix(setup): ignore empty home directory selections\n\nSkip empty home environment values while preserving nonempty caller selections and platform precedence. Setup, doctor, and uninstall now use the same fallback home instead of writing relative paths in the current directory.\n\nValidation: focused home tests and the public setup/doctor/uninstall lifecycle under Node 24.18. Package verification and pack dry run are included in the integrated gate.\n\nFixes #2325\n", "parents": ["1c37914306b3ff257d7a0360f11c9bf2a3f2cac7"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "921bb9575505065f6cfd57b14d97d80d0f238546", "subject": "fix(artifacts): distinguish Java classes from universal Mach-O", "body": "fix(artifacts): distinguish Java classes from universal Mach-O\n\nClassify FAT containers using shared architecture, range, and observed slice-header facts rather than the CAFEBABE signature alone. Preserve typed unsupported and malformed reasons, reject malformed sibling slices consistently, and remove repeated range parsing in consumers.\n\nValidation: valid small and large JVM classes in public JAR/ZIP inspection, four FAT width/byte-order controls, and focused executable/Mach-O boundary tests. The class fixtures were checked with JDK javap; no new JVM analysis capability is advertised.\n\nThe Apple selection and Hopper readers retain their existing parsing because they also own oversized-count diagnostics, reserved fields, streaming final-size validation, or source freshness that the shared header result does not represent.\n\nRepresentative public mixed-ZIP inventory probe, four fresh processes with an already warm filesystem cache: first process elapsed 626.8 -> 548.3 ms, CPU 740 -> 740 ms, sampled family peak RSS 375.5 -> 345.4 MiB. Subsequent three-process medians: elapsed 767.2 -> 454.0 ms, CPU 890 -> 640 ms, peak RSS 368.7 -> 346.2 MiB. Estimated output tokens 2310 -> 2292. Concurrent load was uncontrolled, so these observations do not establish a speed improvement. Whole-agent task tokens and schema/call overhead were not measured.\n\nFixes #2317\n", "parents": ["c339f9ebe7bd1f30608d6ccb7175da523dd3c485"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "5ab0cbb48ea5a4f11542eac44479b9af48f1dabd", "subject": "fix(javascript): resolve bundled exports by binding identity", "body": "fix(javascript): resolve bundled exports by binding identity\n\nIdentify the factory exports parameter through the existing semantic binding owner, including renamed and minified Webpack parameters. Reject nested targets, bare alias rebinding, and shadowed identifiers. Prune the duplicated source happy path after validating the public CLI workflow.\n\nValidation: public analyze-javascript-application CLI acceptance and focused semantic traversal/module-index tests.\n\nFixes #2171\n", "parents": ["921bb9575505065f6cfd57b14d97d80d0f238546"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "c89972c8777d0114566fe76a060849a18bdd2659", "subject": "fix(adb): evaluate the full activity start report", "body": "fix(adb): evaluate the full activity start report\n\nEvaluate stdout and stderr together, giving hard errors and non-ok wait statuses precedence over an attempted Starting line. Retain raw streams and typed partial launch facts when Activity Manager refuses or times out; retain successful raw output too.\n\nValidation: parser/provider tests and public MCP app/activity starts through a fake executable at the real process boundary. Real Android device behavior was not verified; device-reported timeout remains distinct from a host deadline.\n\nFixes #2225\n", "parents": ["5ab0cbb48ea5a4f11542eac44479b9af48f1dabd"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "049132ab43fa962d31774f2b258c15a71217148b", "subject": "fix(evidence): preserve call coverage in function comparisons", "body": "fix(evidence): preserve call coverage in function comparisons\n\nTreat missing, partial, unknown, and unresolved call coverage as insufficient for call-set equality. Combine IDA caller/callee coverage without losing either explanation and recheck source coverage when verifying historical comparisons.\n\nScope generated function-comparison unknowns with optional typed comparison/dimension facts, preserving legacy IDs and revision digests when absent. Keep unrelated dimensions conclusive, explicit dependencies applicable, and ambiguous function identity unknown. A confirmed change for matched functions remains a failure even if calls are incomplete.\n\nValidation: function/reconstruction/residual-unknown and bundle tests, recorded IDA protocol regression, public MCP comparison/verification, and advertised SDK JSON Schema checks. Real IDA provider execution was not verified.\n\nFixes #2222\n", "parents": ["c89972c8777d0114566fe76a060849a18bdd2659"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "b7169c8b747cbc032913b31f008a3b81c77b6219", "subject": "fix(electron): attribute unresolved paths to selected inputs", "body": "fix(electron): attribute unresolved paths to selected inputs\n\nResolve each caller-selected Electron path once at the application boundary, collect field-specific failures with original causes, and pass canonical paths directly to the provider. Update direct provider consumers and route the real verifier through the shared application workflow.\n\nValidation: public CLI/MCP invalid-path acceptance, canonicalization boundary, provider tests, and cancellation/cleanup checks. Live Electron launch was not verified. This does not address the separate Playwright launch-rejection crash in #2269.\n\nFixes #2272\n", "parents": ["049132ab43fa962d31774f2b258c15a71217148b"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "fd9588089d089e7cb02d12178e34407d6f889f22", "subject": "fix(dev): preserve command arguments in exclusive runners", "body": "fix(dev): preserve command arguments in exclusive runners\n\nUse the existing pinned cross-spawn dependency at the command-spawn boundary instead of forcing every Windows executable and argument vector through cmd.exe. Preserve native executable arguments while retaining PATH/PATHEXT and command-shim support.\n\nValidation: public runner argv and lock/cancellation tests passed on POSIX. Windows-only tests cover an executable path with spaces, bare node, npm, and the local turbo shim; native Windows execution remains unverified.\n\nFixes #2319\n", "parents": ["b7169c8b747cbc032913b31f008a3b81c77b6219"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "ac57c88efe64c3125850b54d3d833227e6b8ec51", "subject": "fix(formats): preserve high bits in Windows signature checks", "body": "fix(formats): preserve high bits in Windows signature checks\n\nDecode MZ and Windows signature bytes without ASCII high-bit masking. Move malformed signature cases into the shared Go diagnostics fixtures so provider, compiled CLI, and MCP workflows cover NE, LE, LX, and PE lookalikes; remove the superseded provider-only cases.\n\nValidation: runtime build, check:ci, and focused DOS/Go/target/CLI/MCP tests. Windows-only reference-import cases await CI.\n", "parents": ["fd9588089d089e7cb02d12178e34407d6f889f22"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "8224aeba9dd41f29ea6f8ef7ad7efa3f45fd4a6e", "subject": "test(cli): align reference import failure envelopes", "body": "test(cli): align reference import failure envelopes\n\nExpect ok:false and the preserved error payload in full-output mode, including Windows unsupported-host failures. Retain plain JSON, selected-path, remediation, permission, logging, and source-preservation coverage.\n\nValidation: focused compiled CLI output and reference-import tests; Windows-only cases await CI.\n", "parents": ["ac57c88efe64c3125850b54d3d833227e6b8ec51"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "4dd44ddf16c810c4bcaa16e0bdb3b09bfcb4e33a", "subject": "test(ida): expect direction in combined call coverage", "body": "test(ida): expect direction in combined call coverage\n\nKeep the ARM64 dossier boundary assertion aligned with caller/callee coverage ownership while preserving unknown coverage, diagnostics, and observed callee assertions.\n\nValidation: recorded IDA protocol and callee relationship boundary tests (22 passed). Live IDA was not exercised.\n", "parents": ["8224aeba9dd41f29ea6f8ef7ad7efa3f45fd4a6e"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "3ee6ff43c1696a5a5269bd4aa5de72f7e5f40627", "subject": "test(mcp): preserve coverage in unchanged function fixtures", "body": "test(mcp): preserve coverage in unchanged function fixtures\n\nCarry the source relationship coverage into the synthetic counterpart used by public function comparison and reconstruction verification. Keep missing coverage unresolved rather than weakening comparison completeness.\n", "parents": ["4dd44ddf16c810c4bcaa16e0bdb3b09bfcb4e33a"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "7b15762d09acf3d4ffb937f55ec1b54e7db5fbfa", "subject": "fix(reference): report sloppy scripts, PHP, C# and enclosing Git facts (#1770)", "body": "fix(reference): report sloppy scripts, PHP, C# and enclosing Git facts (#1770)\n\n* fix(reference): report sloppy scripts, PHP, C# and enclosing Git facts\n\nImporting the source/ subtree of a legacy PHP and C# checkout produced\nfour wrong or missing facts:\n\n- Babel's unambiguous mode parses a module first and keeps its\n strict-mode recovery errors after falling back to a script, so a valid\n sloppy-mode `delete messages;` was reported as a parse failure and the\n semantic IR marked the file as parser-recovered. Parsing now goes\n through one owner that re-parses such a script as a script.\n- .php and .cs files had no language; they are now detected as PHP and\n C# (detection only, no parsing).\n- A root without its own .git was reported as having no version\n control even inside a checkout. The adapter now resolves the nearest\n enclosing repository, as Git does, and reports `none` only when no\n ancestor has one.\n- The CLI recorded importer_version as null although the package\n version is known.\n\n* fix(reference): keep module strictness and classify C# and PHP as source\n\nReview follow-up. `.mjs` and `.mts` files are modules by extension, but\nthe script fallback re-parsed them in sloppy mode and erased real\nstrict-mode errors. The parser boundary now owns the extension rule,\nparses explicit modules as modules and applies the fallback only when\nthe mode is ambiguous; the require-binding analysis uses the same rule.\n\n`.cs` and `.php` received a language but stayed classified as unknown,\nso source-to-bundle comparison dropped them. Both are now source\nextensions, like the other detected languages.\n\n* fix(reference): honor package module scope and keep unknown-mode strict errors\n\nReview follow-up. A `.js` file under a package.json with `\"type\":\n\"module\"` is an ES module, but it went through the script fallback that\nerases strict-mode errors. The import now reads each in-inventory\npackage.json and parses `.js` files in a module scope as modules. Other\n`.js` and `.ts` sources keep an unknown mode, because bundlers treat them\nas modules without that field: they are no longer forced to script, and\nerrors that only the module parse reports are kept as an entry limitation.\n\n* fix(reference): bound package scopes and keep application parsing unchanged\n\nReview follow-up.\n- `.cjs` files parse as scripts, so module-only strict errors no longer\n become limitations on CommonJS trees. `.cts` keeps an unknown mode\n because TypeScript compiles ES import syntax there.\n- An unreadable or linked package.json now bounds the module scope with\n an unknown type instead of letting an outer `\"type\": \"module\"` apply.\n- The application pipeline parses as on main again. Its module-only\n strict errors keep a source partial; package-mode handling stays in the\n reference importer.\n\n* refactor(reference): keep unmarked module modes unknown instead of resolving package scope\n\nReview follow-up. Resolving Node package scope for `.js` kept pulling in\nmore of Node's lookup semantics (require bindings, excluded or\ndirectory-named manifests). Only extensions now select a mode: `.mjs`\nand `.mts` parse as modules and `.cjs` as scripts. Every other source\nkeeps an unknown mode, so module-only strict errors stay visible as an\nentry limitation instead of being dropped or asserted. This matches the\nrequire-binding analysis, which also treats unmarked paths as unknown.", "parents": ["3ee6ff43c1696a5a5269bd4aa5de72f7e5f40627"], "authors": [ { "name": "Martin Klein", "email": "36695017+flitzrrr@users.noreply.github.com", "user": { "login": "flitzrrr", "__typename": "User" } } ], "pullRequests": [1770] }, { "sha": "ea2f94d4de2241306158fecdd75f96cd34566694", "subject": "fix(wasm): stop appending WABT remediation to unrelated runtime-root failures (#2084)", "body": "fix(wasm): stop appending WABT remediation to unrelated runtime-root failures (#2084)\n\ninspect_wasm_artifact's configuration-phase error handler assumed every\nnon-OwnedCommandFailure thrown before the artifact phase was about WABT\ntool/directory resolution, and unconditionally appended \"Supply WABT 1.0.42\nvia absolute REA_WABT_BIN_DIRECTORY; REA does not install tools.\" to the\nreason. WabtArtifactProvider.inspect() also allocates its PrivateRuntimeRoot\nduring the configuration phase, so a PrivateRuntimeRootUnavailableError (the\nWindows native-authority capability, unrelated to WABT) got the same false\nremediation glued onto its own already-correct message, misdirecting anyone\ntroubleshooting a correctly-configured WABT install toward re-checking WABT\ninstead of the real blocker.\n\nClassify PrivateRuntimeRootUnavailableError before the generic\nconfiguration-phase branch, matching the existing convention already used\nin JavaScriptAnalysisWorker.ts and SourceMapCommand.ts: surface it as its\nown AnalysisCapabilityUnavailableError with no userMessage override, letting\nits own message stand.\n\nVerified against a real WABT 1.0.42 Windows release (hash-checked against\nGitHub release metadata) and a real compiled .wasm module: before the fix,\n`reason` read \"REA Windows native controls are unavailable: ENOENT: ...\nSupply WABT 1.0.42 ...\" even with a fully correct REA_WABT_BIN_DIRECTORY;\nafter, `reason` reports only the real cause.", "parents": ["7b15762d09acf3d4ffb937f55ec1b54e7db5fbfa"], "authors": [ { "name": "Hill Patel", "email": "hillpatel.0710@gmail.com", "user": { "login": "STiFLeR7", "__typename": "User" } } ], "pullRequests": [2084] }, { "sha": "5f79c852af8e53a56f58266a9dcf84314c197164", "subject": "docs(ghidra): verified macOS arm64 native decompiler build recipe (#2112)", "body": "docs(ghidra): verified macOS arm64 native decompiler build recipe (#2112)\n\ndocs(ghidra): verify and document the macOS arm64 native decompiler build\n\nCo-authored-by: hub ", "parents": ["ea2f94d4de2241306158fecdd75f96cd34566694"], "authors": [ { "name": "nKOxxx", "email": "98685501+nKOxxx@users.noreply.github.com", "user": { "login": "nKOxxx", "__typename": "User" } }, { "name": "hub", "email": "arestheagent@gmail.com", "user": null } ], "pullRequests": [2112] }, { "sha": "91b8f587cd495c509946e69076525eb19dc1ca65", "subject": "feat(signals): decode recordings with bounded sigrok output (#2339)", "body": "feat(signals): decode recordings with bounded sigrok output (#2339)\n\nDecode caller-selected protocols from existing recordings through shared\nCLI/MCP Evidence. Page literal output lines after complete decoding;\npreserve explicit full output, source identity and failed cleanup ownership.\n\nVerified real sigrok-cli 0.7.2 workflows, published UART/SPI/I2C recordings,\nindependent UART values, selector limits, SDK schemas and cleanup regressions.\n\nCo-authored-by: Olorinm <59321404+Olorinm@users.noreply.github.com>\nAssisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)", "parents": ["5f79c852af8e53a56f58266a9dcf84314c197164"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "Olorinm", "email": "59321404+Olorinm@users.noreply.github.com", "user": { "login": "Olorinm", "__typename": "User" } } ], "pullRequests": [2339] }, { "sha": "6ce5903e7a37252156ec847c4c8874410a4d8f3f", "subject": "test(javascript): verify CommonJS file URL boundaries via CLI and MCP (#2061)", "body": "test(javascript): verify CommonJS file URL boundaries via CLI and MCP (#2061)\n\n* fix(javascript): keep CommonJS file URL strings unresolved\n\n* test(mcp): align completion checks with warm provider state\n\n* test(javascript): remove superseded file URL resolver coverage\n\n---------\n\nCo-authored-by: hhang <169027046+xu91102@users.noreply.github.com>", "parents": ["91b8f587cd495c509946e69076525eb19dc1ca65"], "authors": [ { "name": "hhang", "email": "17309584214@163.com", "user": { "login": "xu91102", "__typename": "User" } }, { "name": "hhang", "email": "169027046+xu91102@users.noreply.github.com", "user": { "login": "xu91102", "__typename": "User" } } ], "pullRequests": [2061] }, { "sha": "86fab11fbe000a04c0810699419e99e50476e424", "subject": "fix(javascript): preserve import-equals declaration and export evidence (#2062)", "body": "fix(javascript): preserve import-equals declaration and export evidence (#2062)\n\n* fix(javascript): retain TypeScript import-equals dependencies\n\n* test(mcp): align completion checks with warm provider state\n\n* fix(javascript): propagate require origins through exported aliases\n\n* fix(javascript): normalize equivalent CTS binding origins\n\n---------\n\nCo-authored-by: hhang <169027046+xu91102@users.noreply.github.com>", "parents": ["6ce5903e7a37252156ec847c4c8874410a4d8f3f"], "authors": [ { "name": "hhang", "email": "17309584214@163.com", "user": { "login": "xu91102", "__typename": "User" } }, { "name": "hhang", "email": "169027046+xu91102@users.noreply.github.com", "user": { "login": "xu91102", "__typename": "User" } } ], "pullRequests": [2062] }, { "sha": "d59ab6d977d5b9376af2fdd141b4f65460bb9a9f", "subject": "fix(javascript): bound value evaluation through nested closure aliases (#1941)", "body": "fix(javascript): bound value evaluation through nested closure aliases (#1941)\n\n* fix(javascript): bound value evaluation through nested closure aliases\n\nA closure that aliases a binding from its enclosing scope evaluates that\nbinding once live and once at its own capture point. The capture cannot\norder a binding declared in another function, so it fell back to a second\nlive evaluation. Only primitive results were kept, so every level of\nnesting doubled the work: 20 nested closures over a non-constant value\ntook about 14 s, and a 443 KB generated wrapper reached the 300 s\nanalysis timeout.\n\nKeep a live binding value when no caller could change it: no alias cycle\ncloses on or above the binding and the expression depth budget was not\nreached. Bindings on a cycle are still re-evaluated, so their values and\nreasons are unchanged.\n\nFound while building a source-owned reproduction for #1847; that report's\nworker heap exhaustion is a separate, already closed defect.\n\n* fix(javascript): keep the expression depth budget for retained values\n\nReusing a retained composite value from any depth let a chain of wrappers\n(s1 = {x: s0}, s2 = {x: s1}, ...) nest past the expression depth budget:\n300 wrappers produced a 299-level value where the budget stops at 86, the\nserialized IR grew quadratically, and 3,000 wrappers overflowed the stack\nin JSON.stringify.\n\nRecord the expression depth at which each caller-independent value was\nderived and reuse it only at that depth or shallower. A deeper reader\nderives the value again and reaches the budget exactly as before. Closure\naliases read their outer binding at one depth on both paths, so nested\nclosures stay linear.", "parents": ["86fab11fbe000a04c0810699419e99e50476e424"], "authors": [ { "name": "Naema Mohmed Farah", "email": "94893024+ranmori@users.noreply.github.com", "user": { "login": "ranmori", "__typename": "User" } } ], "pullRequests": [1941] }, { "sha": "af29247a7873ba8badec204a4a59f9a2b3a880b6", "subject": "fix: honor empty URL query and fragment markers (#2091)", "body": "fix: honor empty URL query and fragment markers (#2091)\n\nURL.search and URL.hash are empty for both a missing component and an explicit empty one, so endpoint and origin checks were accepting URLs the callers meant to reject.\n\nCo-authored-by: Cursor ", "parents": ["d59ab6d977d5b9376af2fdd141b4f65460bb9a9f"], "authors": [ { "name": "Faheem Ahmad", "email": "fisforfaheem@gmail.com", "user": { "login": "fisforfaheem", "__typename": "User" } }, { "name": "Cursor", "email": "cursoragent@cursor.com", "user": { "login": "cursoragent", "__typename": "User" } } ], "pullRequests": [2091] }, { "sha": "85e124253ac93dd443be6bbcee0939d525b90d4e", "subject": "feat(server): frame analysis-target content as untrusted data (#1908)", "body": "feat(server): frame analysis-target content as untrusted data (#1908)\n\n* feat(server): frame analysis-target content as untrusted data\n\nStrings, decompiled code, page text, scripts, captures and logs returned\nby REA originate from the analysed target, which can embed text aimed at\nthe agent. Nothing marked that content, so a prompt injection inside a\nbinary or page could steer the agent toward tools that run code.\n\n- Server instructions now state that target-derived tool output is data,\n never instructions, and that any request in it to run, install,\n download or send something is a prompt-injection attempt to report.\n- Tool contracts declare returnsTargetContent. It is on by default; only\n seven tools whose results hold REA session state or caller-supplied\n values (binary_session, close_binary, export_evidence_bundle,\n record_unknown, update_unknown, inspect_adb_client,\n inspect_apktool_client) are audited exceptions, so new tools start\n marked.\n- Successful results of marked tools carry\n _meta.provenance = { untrusted_content: true, source: \"analysis_target\" }.\n content and structuredContent are unchanged, and the response budget\n accounts for the fixed marker bytes.\n\nTests cover the encoding and budget accounting, the audited exception\nlist against the contract catalog, and an in-memory MCP client that sees\nthe instructions and the marker on a marked tool but not on\nbinary_session.\n\n* fix(server): mark failed target-content results as untrusted too\n\nThe untrusted provenance marker was attached only on the success branch\nof ToolResultDelivery, but failures can carry target-derived text as\nwell: error messages, captured output, and partial observations such as\nthe terminal frames a failed capture_process_scenario retains in\npartial_observation. A host gating later process or device actions on the\nmarker would have treated an adversarial error payload as trusted.\n\nEvery error path in src/server now carries the failing tool's provenance:\n- toErrorToolResult and toRecordedPartialErrorToolResult take the tool's\n target-content flag explicitly, so each caller is audited by the type\n checker; toCallToolResult, toEvidenceToolResult (recording failure), the\n response-budget error that replaces an oversized success, and the\n Electron partial-evidence path pass contract.returnsTargetContent.\n- Admission failures in runAdmittedToolOperation resolve the flag from the\n tool name through the new toolReturnsTargetContent, the same predicate\n the contract metadata uses; unknown names stay marked.\n- The transport's oversized-error replacement keeps the original's marker\n and counts it in its budget check, matching the projected error.\n- Errors the MCP SDK builds itself (input validation, thrown handlers) are\n marked in the transport for target-content tools only.\n\nError encoding accounts for the marker bytes exactly as success encoding\ndoes. docs/mcp-contracts.md now states that error results carry the\nmarker. Tests cover marked and unmarked error results, the\ncapture_process_scenario partial-observation errors in-process and over\nthe SDK transport, the recorded partial-evidence path, the budget\nreplacement, the oversized-error replacement, and SDK validation errors\nfor a marked and a content-free tool.\n\n* fix(contracts): mark session status, close and client probes as target content\n\nThe content-free exception set was audited against successful results\nonly. Now that failures carry the marker too, every exception was\nre-audited against its error paths with one question: can the result\ninclude text produced by an external process, provider or device, or\nstored content REA did not author?\n\nRemoved from TARGET_CONTENT_FREE_TOOLS:\n- close_binary: a failed provider cleanup (GhidraClient cleanup error via\n createGhidraDiagnostics) projects the launcher's captured stdout and\n stderr, which can contain target-derived log text.\n- binary_session: capability status reports runtime unavailability as the\n provider error message (ProviderAdapterError and similar), and the\n provider candidate and Android availability diagnostics include probe\n output such as the apktool stderr excerpt.\n- inspect_adb_client: the success result carries the version and\n installed path parsed from `adb version` stdout, and a failed probe\n keeps a stderr_excerpt.\n- inspect_apktool_client: the success result carries the first line of\n the launcher's `--version` output, and a failed probe keeps a\n stderr_excerpt.\n- update_unknown: the new revision carries forward the stored question\n and domain, which an imported evidence bundle can supply; list_unknowns\n and get_evidence_bundle already return that data marked.\n\nThe set now holds only export_evidence_bundle (path, byte and record\ncounts; failures are filesystem, cancellation, or a fixed integrity\nmessage) and record_unknown (the caller's input plus REA-computed ids\nand digests; registry errors project only a reason code).\n\nThe conformance test pins the reduced set and asserts each removed tool\nis marked. Tests that used binary_session as the unmarked example now use\nrecord_unknown. docs/mcp-contracts.md lists the remaining exceptions and\nwhy the removed tools stay marked.\n\n* fix(contracts): include target-content policy in the catalog identity\n\ncreateToolCatalog() and CATALOG_IDENTITY.tools projected every\nclient-visible contract field except returnsTargetContent. Because the\nuntrusted-content framing left schemas, effects, prompts, CLI names and\nthe package version unchanged, a same-version MCP process started before\nthe update digested equal to the new server and binary_session reported\nit aligned although it never emits _meta.provenance.\n\nProject the flag as returns_target_content in both the digested tool\ncatalog and CATALOG_IDENTITY.tools, and export createCatalogDigests so a\nboundary test proves that toggling the flag on one tool changes the\ntools and combined digests.", "parents": ["af29247a7873ba8badec204a4a59f9a2b3a880b6"], "authors": [ { "name": "Lluís Ariño", "email": "lluisalfons.arino@urv.cat", "user": { "login": "larinyo", "__typename": "User" } } ], "pullRequests": [1908] }, { "sha": "5c2956587a1b0d431f72e10df07a1a6363fa066c", "subject": "fix(apple): preserve slice identity and macOS boundary diagnostics (#1772)", "body": "fix(apple): preserve slice identity and macOS boundary diagnostics (#1772)\n\n* fix(artifacts): name CPU_SUBTYPE_ARM64E_X1 Mach-O slices arm64e\n\nmacOS 27 system binaries such as /bin/ls carry a third FAT slice with\ncpusubtype 0x8000000c. The SDK defines subtype 12 as\nCPU_SUBTYPE_ARM64E_X1, and CPU_SUBTYPE_HAS_ARM64E puts it in the arm64e\nfamily. architectureName knew only subtype 2, so it named the slice\narm64, lipoNameMatches rejected lipo's arm64e.x1 name, and\ninspect-artifact /bin/ls failed with integrity_mismatch.\n\nThe arm64e.x1 test fixture now uses the real subtype. It fails without\nthis change.\n\nRefs #1168, #1765\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(artifacts): classify en-GB hdiutil verify refusals as format failures\n\nhdiutil follows AppleLanguages. With en-GB it writes \"image not\nrecognised\", and verifyFailureReason matched only the US spelling, so a\nfile that is not a disk image got the reason unavailable. Both spellings\nnow give format. Other languages still give unavailable.\n\nRefs #1765\n\nCo-Authored-By: Claude Opus 5.5 \n\n* test(process): read the full process table in the lifecycle cleanup check\n\nThe check ran ps -axo command= with the Node default maxBuffer of 1 MiB.\nOn a host with 1905 processes, the output is 1.52 MB, and the test failed\nwith \"stdout maxBuffer length exceeded\".\n\nRefs #1765\n\nCo-Authored-By: Claude Opus 5.5 \n\n* test(process): bound cleanup observations to sampled descendants\n\n* fix(apple): retain CPU subtype identity during dylib resolution\n\n* test(process): retain OS PIDs for descendant observations\n\n---------\n\nCo-authored-by: David Lee \nCo-authored-by: Claude Opus 5.5 \nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["85e124253ac93dd443be6bbcee0939d525b90d4e"], "authors": [ { "name": "David Lee", "email": "dhl84@users.noreply.github.com", "user": { "login": "dhl84", "__typename": "User" } }, { "name": "David Lee", "email": "davidlee@Dav3Book-Pro-M4-Max.local", "user": null }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [1772] }, { "sha": "7bc57e1e64915a26c32f89fb53d0321193a37160", "subject": "test(apple): skip ibtool-compiled NIB tests when Xcode ibtool is unavailable (#2070)", "body": "test(apple): skip ibtool-compiled NIB tests when Xcode ibtool is unavailable (#2070)\n\nCommand Line Tools install the /usr/bin/ibtool and xcrun shims without ibtool itself, so the existing /usr/bin/ibtool existence guard never skipped the storyboard test, and the native NIB hierarchy suite had no guard. On a Command Line Tools-only macOS host these seven tests failed at fixture compilation. Probe xcrun --find ibtool once and use it for both suites.", "parents": ["5c2956587a1b0d431f72e10df07a1a6363fa066c"], "authors": [ { "name": "TonyWu", "email": "75903587+TonyWu2333@users.noreply.github.com", "user": { "login": "TonyWu2333", "__typename": "User" } } ], "pullRequests": [2070] }, { "sha": "1dd20ce1ff4ab66c74350929577e753aa17a9006", "subject": "test(analysis): verify real preset snapshot and cleanup boundaries (#2349)", "body": "test(analysis): verify real preset snapshot and cleanup boundaries (#2349)\n\nVerify existing caller-selected Ghidra profiles and immutable JSON snapshot boundaries through real CLI/MCP workflows on GNU true and shipped jq. Preserve exact task facts, profile/source identity, original snapshot records and existing defaults; require actual stored query entries and scoped headless launch evidence.\n\nExercise pending startup cancellation with production token/native start-identity inspection, recovery under the selected target, controlled real permission cleanup failure, retained ownership and restored-permission close retry. Independently confirm recovered socket/root cleanup. Preserve failed observer assumptions, source fingerprints, measured scope and final-resource counter unknowns. No general fast preset, product API change or new performance claim.\n\nRefs #2016\n\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>", "parents": ["7bc57e1e64915a26c32f89fb53d0321193a37160"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "factory-droid[bot]", "email": "138933559+factory-droid[bot]@users.noreply.github.com", "user": { "login": "factory-droid[bot]", "__typename": "User" } } ], "pullRequests": [2349] }, { "sha": "81cca2e0e3ebd98c21f41d7ad63d6a00e4cbc3f9", "subject": "fix(analysis): expose provider image base (#2083)", "body": "fix(analysis): expose provider image base (#2083)", "parents": ["1dd20ce1ff4ab66c74350929577e753aa17a9006"], "authors": [ { "name": "The one -Niu", "email": "912906590@qq.com", "user": { "login": "NIU-123370", "__typename": "User" } } ], "pullRequests": [2083] }, { "sha": "c59fbf5e9c3b856d042f02cb18ad4de077eaeab5", "subject": "fix(artifacts): bound archive decompression by source size (#2144)", "body": "fix(artifacts): bound archive decompression by source size (#2144)\n\n* fix(artifacts): bound archive decompression by source size\n\nA ZIP/APK/IPA/MSIX member is attacker-controlled and can expand far\nbeyond the archive that carries it. Inventory hashed every member to EOF\nand extraction wrote every member with no ceiling, so a ~2 MiB archive\ncould drive ~30 s of CPU during inventory and ~150 s plus 2 GiB of disk\nwrites during extraction.\n\nA fixed per-entry byte cap is the wrong shape: it rejects legitimately\nlarge members inside large packages. The ceiling instead scales with the\narchive's own size (500x, with a 256 MiB floor), so large packages keep a\nproportionally large budget while a small archive cannot amplify into\nunbounded work. The cumulative declared size is charged from the central\ndirectory before any entry is decompressed, and zip.js already verifies\nstreamed output against each declaration, so the check is exact and\ncovers both inventory and extraction through the shared reader.\n\n* fix(artifacts): own decompression accounting per traversal\n\n* test(artifacts): verify declared ZIP output enforcement\n\n---------\n\nCo-authored-by: baron ", "parents": ["81cca2e0e3ebd98c21f41d7ad63d6a00e4cbc3f9"], "authors": [ { "name": "Dery Ferdika", "email": "114888155+DeryFerd@users.noreply.github.com", "user": { "login": "DeryFerd", "__typename": "User" } }, { "name": "baron", "email": "richstyles@gmail.com", "user": { "login": "baron", "__typename": "User" } } ], "pullRequests": [2144] }, { "sha": "fdd8f826023c568937d237c2f97d855de283a9b8", "subject": "fix(browser): compare PNG IHDR bytes without ASCII folding (#2099)", "body": "fix(browser): compare PNG IHDR bytes without ASCII folding (#2099)\n\n* fix(browser): compare PNG IHDR bytes without ASCII folding\n\nScreenshot checks already compare the PNG signature as raw bytes, then decoded the chunk type with an encoding that maps high-bit bytes onto IHDR.\n\nCo-authored-by: Cursor \n\n* fix(browser): satisfy the strict index check in the IHDR test\n\nCo-authored-by: Cursor \n\n* refactor(browser): share byte-faithful PNG header facts\n\n---------\n\nCo-authored-by: Cursor \nCo-authored-by: REA preparation lane ", "parents": ["c59fbf5e9c3b856d042f02cb18ad4de077eaeab5"], "authors": [ { "name": "Faheem Ahmad", "email": "fisforfaheem@gmail.com", "user": { "login": "fisforfaheem", "__typename": "User" } }, { "name": "Cursor", "email": "cursoragent@cursor.com", "user": { "login": "cursoragent", "__typename": "User" } }, { "name": "REA preparation lane", "email": "rea-preparation@localhost", "user": null } ], "pullRequests": [2099] }, { "sha": "8fc2043eb8bcedbf34dce064f977e455438635d6", "subject": "fix(mcp): preserve target provenance on retained partial errors", "body": "fix(mcp): preserve target provenance on retained partial errors\n", "parents": ["fdd8f826023c568937d237c2f97d855de283a9b8"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "ae8051302b5834322fa00cfa31c968ae74ab6ed9", "subject": "test(evm): verify real worker cancellation and cleanup recovery (#2404)", "body": "test(evm): verify real worker cancellation and cleanup recovery (#2404)\n\nVerify unchanged real EVMole worker replies through compiled CLI and stdio MCP, including late SDK cancellation, permission-induced retained cleanup failure/retry, preserved malformed-input diagnostics and a healthy real SQLite WASM peer. Add launcher receipts to prove blocked retries do not start another EVM worker.\n\nPreserve production contracts/defaults and explicit frozen-runtime/platform/measurement boundaries. Final head cf558a0661eb29bda932242abc3687b1860428e7 passes all 36 CI checks (run38313631216); manual final review and related real Factory rerun pass. Raw artifacts and receipts remain outside Git.\n\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>", "parents": ["8fc2043eb8bcedbf34dce064f977e455438635d6"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "factory-droid[bot]", "email": "138933559+factory-droid[bot]@users.noreply.github.com", "user": { "login": "factory-droid[bot]", "__typename": "User" } } ], "pullRequests": [2404] }, { "sha": "3b0ea590fcc876fa017946f4cec009d653f02b38", "subject": "fix(native): honor Mach-O chained pointer locations and library ordinals (#1709)", "body": "fix(native): honor Mach-O chained pointer locations and library ordinals (#1709)\n\n* fix(native): honor Mach-O chained pointer locations and library ordinals\n\nWalk declared page starts and next links before decoding chained pointers,\npreserving plain pointers between fixups, zero-offset rebases, and known\nfacts in malformed chains. Interpret positive dylib ordinals with dyld's\nspecial-ordinal cutoff so valid dependency provenance is retained.\n\nGive the Swift verification fixture an explicit module name so link-mode\nfilenames do not produce invalid identifiers.\n\nValidation: 46 focused regressions; pre-fix reproductions in an isolated\ncopy; real macOS CLI/MCP verification of 10 compiled Objective-C/Swift,\narm64/arm64e, chained/legacy and symbols/stripped fixture variants.\n\n* perf(native): reuse parsed Mach-O chain membership\n\n* test(native): validate parsed-chain repair against local gates\n\n* test(native): pin chained fixup page failure provenance\n\n* fix(native): bound parsed chained page facts and metadata\n\n* test(server): pin shared partial Evidence provenance\n\n---------\n\nCo-authored-by: baron ", "parents": ["ae8051302b5834322fa00cfa31c968ae74ab6ed9"], "authors": [ { "name": "Yijie Lu", "email": "115929844+1NormalGuy@users.noreply.github.com", "user": { "login": "1NormalGuy", "__typename": "User" } }, { "name": "baron", "email": "richstyles@gmail.com", "user": { "login": "baron", "__typename": "User" } } ], "pullRequests": [1709] }, { "sha": "653067d799591ce2b8fdc84e99c160ac17e2860f", "subject": "fix(javascript): resolve module-relative Worker URL references (#2104)", "body": "fix(javascript): resolve module-relative Worker URL references (#2104)\n\n* fix(javascript): resolve module-relative Worker URL references\n\n* fix(javascript): validate Worker URL paths independently of suffixes\n\n* fix(javascript): preserve directory-form Worker URL paths\n\n* fix(javascript): unwrap type assertions in Worker URL references\n\n* fix(javascript): validate Worker bindings before URL resolution\n\n* fix(javascript): leave drive-letter Worker URLs unresolved\n\nUse WHATWG file URL parsing before pathname decoding to detect drive-letter\nforms whose resource identity depends on the unmodeled source URL scheme.\nPreserve encoded and ordinary relative pipe paths, and cover false matches\nthrough the compiled CLI and resolver boundary tests.\n\n* fix(javascript): preserve Worker URL identity boundaries\n\nRecognize known Worker bindings before filtering callee spellings so ESM\naliases and transparent constructor wrappers reach URL analysis. Keep\nroot-relative module URLs unknown without a modeled runtime base root.\n\nIndex direct source-local global writes with the shared mutation collector\nbefore promoting URL and browser Worker constructors. Preserve lexical\nshadowing and unrelated property identities, and exercise all three review\nregressions through the compiled CLI.\n\n* fix(javascript): invalidate mutated import.meta URL bases\n\nTrack source-local import.meta writes alongside ambient global writes so\nWorker URL expressions keep an unknown base after a possible URL mutation.\nTag the identity roots independently and cover direct mutation and unrelated\nproperty cases through the compiled CLI.\n\n* fix(javascript): close Worker URL identity and pathname gaps\n\nResolve ambient object identities before appending written properties, and\nretain possible source-local aliases across rebinding. Reuse intrinsic\ninvocation handling for aliased and bound mutators, array spreads, and\ntransparent TypeScript wrappers while preserving Electron write semantics.\n\nKeep malformed-percent nested Worker URL pathnames unknown because the base\nscheme is unavailable and Node rejects these file URLs. Preserve tolerant\nHTML URL handling, valid escapes, and query/fragment evidence.\n\nCover the new cases and unrelated writes through the compiled CLI with\nexisting-file decoys. All 591 targeted tests and npm run check pass.\n\n* fix(javascript): bound alias expansion and classify Worker paths\n\nJoin ambient identity projections instead of enumerating alias histories.\nMemoize repeated value and provenance queries while preserving capture,\ndepth, and cycle-dependent uncertainty.\n\nKeep Node Worker string arguments unresolved without filesystem or cwd\ncontext, and admit qualified global URL constructors through identity checks.\n\nValidate three 40-level alias branch shapes through the compiled CLI,\n925 source tests, 25 CLI/boundary tests, and the full npm run check gate.\n\n* fix(server): preserve partial Evidence target-content provenance\n\nPass the exact named contract returnsTargetContent flag through the shared partial-Evidence error delivery path introduced by the shortlist integration.\n\nExercise successful and failed recording through in-memory MCP for marked and unmarked contracts, preserving source payload and original failures. Observe both shared-handler emission and wire delivery so the SDK error-marker fallback cannot hide omissions. Suppressing the flag fails exactly the two marked cases.\n\nValidation: check:fast, check, 736 semantic tests, 29 MCP transport/error tests and six compiled static Worker CLI journeys pass. No live target/provider execution or hosted publication.\n\n* fix(javascript): structurally share semantic dependency proofs\n\n---------\n\nCo-authored-by: baron ", "parents": ["3b0ea590fcc876fa017946f4cec009d653f02b38"], "authors": [ { "name": "Yann Roberto", "email": "165009858+shoyann@users.noreply.github.com", "user": { "login": "shoyann", "__typename": "User" } }, { "name": "baron", "email": "richstyles@gmail.com", "user": { "login": "baron", "__typename": "User" } } ], "pullRequests": [2104] }, { "sha": "dc038d16bba9046afd28970de9c47f6259a43524", "subject": "fix(apple): preserve archive signatures and metadata byte identity", "body": "fix(apple): preserve archive signatures and metadata byte identity\n", "parents": ["653067d799591ce2b8fdc84e99c160ac17e2860f"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "f43fc0247527aebb8efc7d9db04276fe2d489323", "subject": "fix(javascript): distinguish file URL paths from query identity", "body": "fix(javascript): distinguish file URL paths from query identity\n", "parents": ["dc038d16bba9046afd28970de9c47f6259a43524"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "82cfcee19f18b0eeae9a330ba04e0411cdf85225", "subject": "feat(managed): add retained metadata overview and pages (#2413)", "body": "feat(managed): add retained metadata overview and pages (#2413)\n\nAdd caller-selected managed metadata summaries and original collection pages while preserving complete CLI/MCP defaults and previous-runtime Evidence. Real SDK replies shrink substantially; actual Codex token/latency results remain mixed and are documented without a token-saving claim.\n\nValidated focused SDK/domain tests, full static/docs checks, real two-assembly repeated workflows and portable old Evidence, real SQLite WASM, and all exact-head CI checks. Raw experimental artifacts remain private.\n\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>", "parents": ["f43fc0247527aebb8efc7d9db04276fe2d489323"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "factory-droid[bot]", "email": "138933559+factory-droid[bot]@users.noreply.github.com", "user": { "login": "factory-droid[bot]", "__typename": "User" } } ], "pullRequests": [2413] }, { "sha": "951b095e11adf9faa9c4a27e212260060aa6b095", "subject": "fix(browser): bound CDP discovery response size and lifetime", "body": "fix(browser): bound CDP discovery response size and lifetime\n", "parents": ["82cfcee19f18b0eeae9a330ba04e0411cdf85225"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "d8ceb3f276a65c181b146f68c0729ff4b6f9fa61", "subject": "fix(artifacts): preserve inventory uncertainty in application projections", "body": "fix(artifacts): preserve inventory uncertainty in application projections\n", "parents": ["951b095e11adf9faa9c4a27e212260060aa6b095"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "9435c7aae279ba184937c0dfeb713fd574ba3f29", "subject": "fix(artifacts): reject malformed serialized keys and integer values", "body": "fix(artifacts): reject malformed serialized keys and integer values\n", "parents": ["d8ceb3f276a65c181b146f68c0729ff4b6f9fa61"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "f09bb8a99773f79c7306b8799c86f856fe2c0d4b", "subject": "fix(browser): redact encoded declared secrets consistently", "body": "fix(browser): redact encoded declared secrets consistently\n", "parents": ["9435c7aae279ba184937c0dfeb713fd574ba3f29"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "34a4bb6508006fa113463ef20ed799a2994e9ee8", "subject": "fix(elf): centralize fixed header validation across consumers", "body": "fix(elf): centralize fixed header validation across consumers\n\nValidate ELF identification/header versions and declared header bounds at the shared owner. Reuse parsed facts in target selection, Go, Dart and MIPS readers while preserving their stricter format policies and x32 support.\n\nRepair synthetic ELF fixtures and remove a superseded Go error-text assertion. Validation: 74 source tests, 202 filesystem/Go/MIPS boundary tests, typecheck and lint. No new real-provider claims.\n", "parents": ["f09bb8a99773f79c7306b8799c86f856fe2c0d4b"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "9a18251426f891e6a24856b715ef8002ab8b9610", "subject": "feat(mcp): add opt-in paging for retained unknown heads", "body": "feat(mcp): add opt-in paging for retained unknown heads\n\nKeep complete default delivery and exact filters. Select stable ID pages at the ledger owner before cloning, return filtered totals and continuation offsets, and preserve detached records through the shared session port.\n\nValidate public MCP paging, safe-integer edges, snapshot replay and converted JSON Schemas. Document the bounded Flameox workflow comparison and its token/CPU/latency measurement limits; no real model performance claim.\n", "parents": ["34a4bb6508006fa113463ef20ed799a2994e9ee8"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "ebc22d99d62225505c0a84f6e39823ba4ef2f829", "subject": "fix(native): retain signature snapshot cleanup ownership", "body": "fix(native): retain signature snapshot cleanup ownership\n\nUse the shared resource scope and private runtime root for signature snapshots. Retain failed file-handle/root cleanup, preserve primary failures alongside cleanup diagnostics, and wait for binding operations during client close before retrying owned resources.\n\nValidate root cleanup failure, blocked retry, repeated client close and in-flight acquisition. Existing provider/MCP/CLI tests and the real Darwin codesign ancestor-swap case pass. Dedicated native file-handle close-failure injection remains unverified.\n", "parents": ["9a18251426f891e6a24856b715ef8002ab8b9610"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "c462a4ebd3a10e59253bcf38353a0914b176738b", "subject": "fix(scripts): pass MCP callTool timeouts as request options (#2387)", "body": "fix(scripts): pass MCP callTool timeouts as request options (#2387)\n\n@modelcontextprotocol/client 2.3.1 declares callTool(params, options).\nThree verifiers still used the v1 shape callTool(params, undefined,\n{ timeout }), so the third argument was dropped and those calls ran\nunder the SDK's 60 s default instead of the 150-180 s they request.\nPass the options second.", "parents": ["ebc22d99d62225505c0a84f6e39823ba4ef2f829"], "authors": [ { "name": "Aurelio Bernal", "email": "aurelio@bernalr.com", "user": { "login": "AurelioB", "__typename": "User" } } ], "pullRequests": [2387] }, { "sha": "37b7550ecc916acc8619fa72e5c05af45702733f", "subject": "fix(ida): preserve native coverage and verify returned values (#2324)", "body": "fix(ida): preserve native coverage and verify returned values (#2324)\n\nReject native callee successes without an explicit truncation marker while preserving provider failure reasons. Verify positive procedure inventory/search and function-result parity in the real-provider lane; support independent string/xref oracles and label their absence as unverified.\n\nVerified with Windows IDA Pro 9.3: eight normal production CLI/MCP checks passed, and six real-provider response-fault cases reproduced old false positives and validated the correction. Windows IDA Free was not used. No personal paths or license registration information are included.\n\nRepair inconsistent complete-file Ghidra test probe sizes after the shared ELF-header validation change, deriving sizes from the fixture buffers. Reproduced the three failures before the correction; 115 related installation/doctor and ELF tests pass afterward. Runtime parsing and installation behavior are unchanged; no real-Ghidra verification is claimed.\n\n207 focused IDA tests and static/documentation checks passed. Automated review completed on d1e0b1095 without findings. CI run 38327862093 passed all 36 jobs, including Windows, all six test shards, coverage/timing, and real Apple CLI/MCP workflows.\n\nFollow-up to #1544.", "parents": ["c462a4ebd3a10e59253bcf38353a0914b176738b"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [2324] }, { "sha": "ee87111009ace2ca4ef82c9aef09c82a37ca55f7", "subject": "test(perf): distinguish Codex tool context and token accounting (#2416)", "body": "test(perf): distinguish Codex tool context and token accounting (#2416)\n\nAdd optional owned Codex tool/usage capture and exact-name discovery experiments while preserving default ephemeral trials and all REA public APIs. Retain scoped managed and actual Android results, mixed outcomes, source identities and resource unknowns.\n\nSix semantic Python tests, full checked pre-push, byte-identical own-file rebase verification, manual review and all 39 exact-head CI checks pass. Historical main fixture failures and their independent repair remain documented; measured source/runtime pins are unchanged.\n\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>", "parents": ["37b7550ecc916acc8619fa72e5c05af45702733f"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "factory-droid[bot]", "email": "138933559+factory-droid[bot]@users.noreply.github.com", "user": { "login": "factory-droid[bot]", "__typename": "User" } } ], "pullRequests": [2416] }, { "sha": "4f4f6cd7b5d7a400b90772a138d7b9f942c2a556", "subject": "test(evm): verify static descriptor bindings before use (#2427)", "body": "test(evm): verify static descriptor bindings before use (#2427)\n\nVerify the static EVM descriptor operation, CLI command, factory and input/output schema bindings with compiler-backed negative assignability checks. Prove SDK duplicate registration and invalid target input fail before provider invocation, preserving named bindings and separate lazy owners.\n\nValidated complete supported single-thread typecheck, focused12 SDK/composition cases plus a targeted2-case provider-spy rerun, static checks, checked pre-push, manual review and all exact-head CI checks. Production behavior/defaults and provider identity remain unchanged. Dynamic third-party module admission and ABI negotiation remain deferred.\n\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>", "parents": ["ee87111009ace2ca4ef82c9aef09c82a37ca55f7"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "factory-droid[bot]", "email": "138933559+factory-droid[bot]@users.noreply.github.com", "user": { "login": "factory-droid[bot]", "__typename": "User" } } ], "pullRequests": [2427] }, { "sha": "eeba61826c1cd1c7be70f011fda0537baadd4179", "subject": "test(reference): scope cleanup faults to the owned source file (#2430)", "body": "test(reference): scope cleanup faults to the owned source file (#2430)\n\nScope source-file cleanup fault injection without poisoning enclosing Git\nmetadata reads. Cover both environments and verify that the retained native\nhandle stays live through retry, then closes successfully.\n\nCloses #2428.\n\nAssisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)", "parents": ["4f4f6cd7b5d7a400b90772a138d7b9f942c2a556"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [2430] }, { "sha": "4773c152bc5f299fa682575bb8d1efea7587c7bc", "subject": "feat(website): add a persistent light and dark theme switch", "body": "feat(website): add a persistent light and dark theme switch\n", "parents": ["eeba61826c1cd1c7be70f011fda0537baadd4179"], "authors": [ { "name": "N0zoM1z0", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [2432] }, { "sha": "ca2d15b3ee965bd7ab27204cdf4b96b117d148c1", "subject": "test(perf): observe owned counters at payload completion", "body": "test(perf): observe owned counters at payload completion\n\nAdd opt-in, owned payload-completion cgroup witnesses without changing default receipts, terminal-counter semantics, resource limits, or REA public APIs. Preserve unknown and nonzero outcomes; verify ownership, observer capacity, cleanup, and actual SDK/model workflows.\n\nValidation: eleven Python semantic tests, supported full-project typecheck and lint, controlled Linux failure/cancellation/capacity probes, real managed/WASM/Android SDK and Codex runs, and all 39 exact-head CI checks. Curated evidence retains mixed timings and whole-scope uncertainty.\n\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>", "parents": ["4773c152bc5f299fa682575bb8d1efea7587c7bc"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "factory-droid[bot]", "email": "138933559+factory-droid[bot]@users.noreply.github.com", "user": { "login": "factory-droid[bot]", "__typename": "User" } } ], "pullRequests": [2431] }, { "sha": "f254f5ac2b804b353a711264bb178f43fdf07867", "subject": "feat(android): add opt-in package summaries and retained manifest views", "body": "feat(android): add opt-in package summaries and retained manifest views\n\nAdd explicit package summary delivery and exact retained manifest pages while preserving complete MCP defaults, one-shot CLI output, provider requests, source identity and session lifetime. Return distinct linked Evidence and preserve partial/null facts; reject unavailable retention before engine work.\n\nValidation: 27 relevant SDK/domain/Android boundary checks, focused test-only correction rerun, full supported compiler/lint and docs checks, real NewPipe SDK pairs, authentic old Evidence continuation, four actual Codex trials with failures/regressions retained, and all 39 exact-head CI checks. Package replies shrink 119,527 to 8,659 bytes; no model-token or time gain is established.\n\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>", "parents": ["ca2d15b3ee965bd7ab27204cdf4b96b117d148c1"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "factory-droid[bot]", "email": "138933559+factory-droid[bot]@users.noreply.github.com", "user": { "login": "factory-droid[bot]", "__typename": "User" } } ], "pullRequests": [2438] }, { "sha": "a2d8b94dd50dab8d966239dd63ab84718aa8b4b4", "subject": "feat(fiddler): inspect native SAZ captures", "body": "feat(fiddler): inspect native SAZ captures\n\nInspect bounded recorded raw HTTP/XML SAZ archives and page retained capture Evidence. Preserve exact stored bytes and provenance, validate ZIP/XML integrity, and require an enforceable decoder memory bound.\n\nVerified 356 real recorded sessions against independent byte and metadata oracles, public CLI/MCP parity, retained pages, and related interface checks. Current Fiddler Everywhere GUI and non-Linux producer workflows remain unverified.\n\nCo-authored-by: zahhak <1792039+zahhak@users.noreply.github.com>\nCo-authored-by: N0zoM1z0 <161784452+N0zoM1z0@users.noreply.github.com>", "parents": ["f254f5ac2b804b353a711264bb178f43fdf07867"], "authors": [ { "name": "Ilian Iliev", "email": "iliev.net@gmail.com", "user": { "login": "zahhak", "__typename": "User" } }, { "name": "zahhak", "email": "1792039+zahhak@users.noreply.github.com", "user": { "login": "zahhak", "__typename": "User" } }, { "name": "N0zoM1z0", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [2409] }, { "sha": "bb154d1067b0fc250452b7d468d0b0523031a16f", "subject": "feat(browser): inspect retained aioquic qlog JSON captures", "body": "feat(browser): inspect retained aioquic qlog JSON captures\n\nInspect bounded offline aioquic1.5.0 JSON qlog0.3 and page retained event/transport facts with explicit trace and stream selectors. Preserve producer coordinates, exact numeric lexemes, global pre-selection fact scope and endpoint declaration uncertainty.\n\nVerified four real HTTP/3 recordings with an independent interval oracle, public CLI/MCP/schema parity, auth exclusions, source-deletion views and actual decoder heap exhaustion. Unverified producer platforms and qlog-specific lifecycle induction remain documented.\n\nCo-authored-by: LuisTaffelli <86675342+LuisTaffelli@users.noreply.github.com>\nCo-authored-by: N0zoM1z0 <161784452+N0zoM1z0@users.noreply.github.com>", "parents": ["a2d8b94dd50dab8d966239dd63ab84718aa8b4b4"], "authors": [ { "name": "Luis", "email": "86675342+LuisTaffelli@users.noreply.github.com", "user": { "login": "LuisTaffelli", "__typename": "User" } }, { "name": "N0zoM1z0", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [2277] }, { "sha": "23de4f77c74dd299d45cab880c36321d802b21fe", "subject": "perf(flutter): add opt-in retained AOT summary and string pages", "body": "perf(flutter): add opt-in retained AOT summary and string pages\n\nAdd explicit MCP Dart AOT summary delivery and exact retained string-pool pages while preserving complete defaults, CLI behavior, ABI selection, original Evidence identity, partial coverage and lower bounds.\n\nReal LocalSend SDK replies shrink 92.05% with approximately unchanged SDK time. Two actual Codex pairs preserve all selected facts and reduce total input 48.75% / 42.38%, uncached input 33.63% / 42.52%, and task time 23.95% / 30.30%; all client errors/repeated calls remain counted. Preserve old portable Evidence and the real CLI complete result after rebasing onto SAZ/qlog main. Curated results keep measured and integration runtime pins separate; raw artifacts stay outside Git.\n\nRefs #2016.\n\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>", "parents": ["bb154d1067b0fc250452b7d468d0b0523031a16f"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "factory-droid[bot]", "email": "138933559+factory-droid[bot]@users.noreply.github.com", "user": { "login": "factory-droid[bot]", "__typename": "User" } } ], "pullRequests": [2455] }, { "sha": "172407787f1842dedbcd27b5385177595f786ce4", "subject": "fix(windows): preserve transient runtime admission failures (#2467)", "body": "fix(windows): preserve transient runtime admission failures (#2467)\n\nFixes #2257. Thanks to @chqcjq for the native self-test retry diagnosis in #2266.\n\nPreserve retry disposition through analysis workflows. Native warm admission requires exact sharing/lock codes and affirmative pre-allocation evidence; cleanup ownership takes precedence. No automatic retry or new analysis cache.\n\nVerified with real Windows 11 CLI, same-connection SDK MCP normal/conflict/recovery, the Windows native verifier, 99 focused tests and static/docs gates. Official npm 11.16.0 launcher sources were the application input. No IDA or Ghidra engine was used for this change. Win32 5 was not reproduced; no resolution claim for #1701/#2196. Performance measurements and limits are recorded in experiments/analysis-efficiency/windows-runtime-retry.md.", "parents": ["23de4f77c74dd299d45cab880c36321d802b21fe"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [2467] }, { "sha": "a6efa4fcefeffcf5ff5310b8154988b4be30c349", "subject": "test(mcp): reuse advertised schema in inventory check (#2469)", "body": "test(mcp): reuse advertised schema in inventory check (#2469)\n\nReuse the current advertised binary_session definition for real SDK reply\nvalidation while preserving all inventory assertions and the 10-second deadline.\nAvoid initializing validators for unrelated tools in this correctness check.\n\nCloses #2453.\n\nAssisted-by: Reimu (gensokyo-skills:reimu-incident-triage)", "parents": ["172407787f1842dedbcd27b5385177595f786ce4"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [2469] }, { "sha": "a86deecac5fa8434a4f50482f86b0c6ab486a936", "subject": "fix: align MCP archive contracts and documentation (#2478)", "body": "fix: align MCP archive contracts and documentation (#2478)\n\nReuse the domain ZIP format list for session schemas, verify full Harmony\nCLI/MCP lifecycles, and correct native view guidance and audited docs drift.\nRefresh locked dependency notices and gate inventory/provenance consistency,\nincluding notice inputs in the cached documentation gate.\n\nFixes #2454\n\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>", "parents": ["a6efa4fcefeffcf5ff5310b8154988b4be30c349"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "factory-droid[bot]", "email": "138933559+factory-droid[bot]@users.noreply.github.com", "user": { "login": "factory-droid[bot]", "__typename": "User" } } ], "pullRequests": [2478] }, { "sha": "4303dcdcf68af4d71d777ffff75cbd4f17a8877d", "subject": "fix(native): name the retained pwntools process group in cleanup resources (#2281)", "body": "fix(native): name the retained pwntools process group in cleanup resources (#2281)\n\nWhen a pwntools or pwndbg stage cannot confirm that its owned process\ngroup stopped, the cleanup_incomplete result listed only the run ID and\nruntime directory, although a descendant can still be live. Add the\nretained supervisor's pid and process-group coordinates, as\nOwnedCommand reports for a non-transferred cleanup failure.\n\nFixes #2274\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["a86deecac5fa8434a4f50482f86b0c6ab486a936"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2281] }, { "sha": "2c7240cf9d8231e16ad01de7678af9dbd01bab46", "subject": "perf(native): run independent Mach-O slice commands concurrently (#2466)", "body": "perf(native): run independent Mach-O slice commands concurrently (#2466)\n\ninspect_macho launched otool, nm, two dyld_info reads, dwarfdump and\nvtool one at a time. Each launch also resolves the tool through\n`xcrun --find`, so a warm call spent about 350 ms in eight serial\nsupervised launches. The slice commands only read the selected\nartifact, so launch them together. Every launch still settles before\nthe result, and declared order still fixes provenance and which\nfailure is reported.\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["4303dcdcf68af4d71d777ffff75cbd4f17a8877d"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2466] }, { "sha": "bb540826d65316c164d2de8ba4ef10f81a8ad073", "subject": "fix(artifacts): retry transient DMG verification refusals", "body": "fix(artifacts): retry transient DMG verification refusals\n", "parents": ["2c7240cf9d8231e16ad01de7678af9dbd01bab46"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "b045df100e1489e08a36d6ff04cea7feecf1332c", "subject": "fix(update): share parsed client activation with maintenance", "body": "fix(update): share parsed client activation with maintenance\n", "parents": ["bb540826d65316c164d2de8ba4ef10f81a8ad073"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "042dcaa1ee66f1b8668f08b193f38ab01bceaacb", "subject": "perf(evidence): reuse authenticated unknown mutation snapshots", "body": "perf(evidence): reuse authenticated unknown mutation snapshots\n", "parents": ["b045df100e1489e08a36d6ff04cea7feecf1332c"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "45984a4319c8b6dcf2b03e969fbd4330c8432394", "subject": "test(perf): verify existing SQLite column selection on QGIS data (#2489)", "body": "test(perf): verify existing SQLite column selection on QGIS data (#2489)\n\nVerify existing SQLite column selection on pinned QGIS application data. Preserve complete requested schema and exact typed sample facts, all failed/repeated trials and mixed timing results; add reproducible corpus/question/grader and an isolated per-tool driver approval entry.\n\nExisting controls reduce model input in both corrected pairs; no production/API/default/cache change is justified. Real CLI/MCP parity, independent SQLite binding, current-main SDK comparison and relevant checks pass. Ref #2016.\n\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>", "parents": ["bb540826d65316c164d2de8ba4ef10f81a8ad073"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "factory-droid[bot]", "email": "138933559+factory-droid[bot]@users.noreply.github.com", "user": { "login": "factory-droid[bot]", "__typename": "User" } } ], "pullRequests": [2489] }, { "sha": "fa4b8288655188426222773ead2ccbdaf76334fd", "subject": "fix(cli): normalize empty Windows profile before imports (#2482)", "body": "fix(cli): normalize empty Windows profile before imports (#2482)\n\nFollow-up to #2345; thanks to @gefrezim for the import-time home lookup diagnosis.\n\nNormalize only an empty Windows USERPROFILE before runtime dependency imports, preserving all nonempty caller selections. Reuse the existing public setup dry-run regression in the Windows curated CI lane. No additional filesystem query, engine call, cache or retry.\n\nVerified real Windows Node 24.18.0 CLI unset/empty/selected-profile controls, setup dry-run home selection and unchanged configuration, and baseline/candidate SDK stdio MCP catalogue parity. Nine related tests and static/docs checks passed. No IDA or Ghidra engine was used. Scoped resource observations and measurement limits are recorded in experiments/analysis-efficiency/windows-empty-profile.md.\n\nFixed the review finding and original CI package-scope ownership failure. Current-head CI is green; the unrelated MCP identity timeout passed on a failed-job rerun without changing its code or timeout. Current-head review completed with no further findings.", "parents": ["45984a4319c8b6dcf2b03e969fbd4330c8432394"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [2482] }, { "sha": "c74142e6bdcd9e43ede7472b1554d9347c44aa1c", "subject": "chore: sync main for ownership audit fixes", "body": "chore: sync main for ownership audit fixes\n", "parents": [ "042dcaa1ee66f1b8668f08b193f38ab01bceaacb", "fa4b8288655188426222773ead2ccbdaf76334fd" ], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "a73a55f53cc2b2e5b7618effe6ecb5cee6e0cee2", "subject": "fix(artifacts): preserve decode coverage and cleanup ownership", "body": "fix(artifacts): preserve decode coverage and cleanup ownership\n", "parents": ["c74142e6bdcd9e43ede7472b1554d9347c44aa1c"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "9581e067ad306aab842024e47f2dd18ac8056859", "subject": "feat(pcap): add bounded capture summaries through CLI and MCP", "body": "feat(pcap): add bounded capture summaries through CLI and MCP\n\nSummarize saved Wireshark4.x captures with enforced native resource limits, serialized admission, stable snapshot verification and retained fact/text pages. Preserve complete inventories within resource budgets and source uncertainty; report cleanup failure with partial Evidence and retained ownership.\n\nVerified six recorded corpora /13026 packets with independent Scapy/Python oracles, real CLI/MCP/schema parity,60 SNI names,132 DNS addresses and1000 URIs. Real TShark CI now exercises summary/paging. Actual Windows/Bun Wireshark remains unverified; macOS capture requires a separate enforceable-bound decision.\n\nCo-authored-by: 3QL <85309073+3QL@users.noreply.github.com>\nCo-authored-by: N0zoM1z0 <161784452+N0zoM1z0@users.noreply.github.com>", "parents": ["c74142e6bdcd9e43ede7472b1554d9347c44aa1c"], "authors": [ { "name": "Quentin Limo", "email": "85309073+3QL@users.noreply.github.com", "user": { "login": "3QL", "__typename": "User" } }, { "name": "N0zoM1z0", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [2340] }, { "sha": "d867136cecbf4a8c0eea90897bc9a33341eb582c", "subject": "chore: sync main after artifact ownership audit", "body": "chore: sync main after artifact ownership audit\n", "parents": [ "a73a55f53cc2b2e5b7618effe6ecb5cee6e0cee2", "9581e067ad306aab842024e47f2dd18ac8056859" ], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "c105391db53e2e2ab8b8624d5f3870c14aae3637", "subject": "fix(hopper): stop Linux demo children when the REA owner exits (#2499)", "body": "fix(hopper): stop Linux demo children when the REA owner exits (#2499)\n\nBind the owned demo helper to REA's private stdin stream and unwind child\ncleanup on EOF during startup or analysis. Verify graceful and SIGKILL owner\nexit through real CLI/MCP workflows and preserve unrelated processes.\n\nAssisted-by: Reimu (gensokyo-skills:reimu-incident-triage)", "parents": ["d867136cecbf4a8c0eea90897bc9a33341eb582c"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [2499] }, { "sha": "acf75e6700ace28bb1db25e54e56673ac15e0ed3", "subject": "fix(evidence): reject unsupported metadata before authentication", "body": "fix(evidence): reject unsupported metadata before authentication\n\nClose persisted Evidence, bundle, profile and unknown record shapes so parsing cannot silently remove caller metadata before checking semantic identity. Keep constructor provider projection explicit and JSON payload fields open.\n\nExercise actual MCP export/import with independent record and manifest mutations, unchanged state after rejection, and a valid round trip. Prune duplicate source assertions. Validation: focused domain/CLI/MCP/filesystem checks, converted JSON Schemas, docs and typecheck/lint.\n", "parents": ["c105391db53e2e2ab8b8624d5f3870c14aae3637"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "10935b7b1136accab2a43b308ab380749da0f7ae", "subject": "fix(process): reject deep trace cycles without recursive expansion", "body": "fix(process): reject deep trace cycles without recursive expansion\n\nUse iterative cycle detection, memoized reachability and compact unordered-group membership. Preserve declaration diagnostics on cyclic input while skipping checks requiring a valid partial order. Report duplicate group declarations once instead of repeating pair errors.\n\nReplace redundant source cycle/missing-pair assertions with public CLI/MCP coverage including 6000 events, dense not-before constraints and a large unordered group. Validate acyclic branching and mixed relation semantics. Document bounded Flameox CPU/latency gains and higher observed peak memory; agent/model costs remain unmeasured.\n", "parents": ["acf75e6700ace28bb1db25e54e56673ac15e0ed3"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "8b181716aca2cb467be499cba226abfb5ae19141", "subject": "fix(install): honor redirected setup diagnostics", "body": "fix(install): honor redirected setup diagnostics\n\nRequire terminal stderr before launching the automatic setup wizard, matching the CLI's interactive admission rule. Print the manual setup command when diagnostics are redirected.\n\nExercise a real PTY with stderr redirected to a fixture file and verify the installed command is not launched for setup. Installer lane: 33 tests passed; targeted regression, typecheck/lint and npm pack dry-run passed. Full package verifier was not run under the requested focused-check resource policy.\n", "parents": ["10935b7b1136accab2a43b308ab380749da0f7ae"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "7a2cd1ea0a63e8c44166860b7ee9c7a1aa43492b", "subject": "fix(domain): preserve derived byte counts and uncertain identity", "body": "fix(domain): preserve derived byte counts and uncertain identity\n", "parents": ["8b181716aca2cb467be499cba226abfb5ae19141"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "1447fd2f990c5d9820337dfd4b8a170f8cad17cd", "subject": "fix(evaluation): share completed transcript facts across graders", "body": "fix(evaluation): share completed transcript facts across graders\n", "parents": ["7a2cd1ea0a63e8c44166860b7ee9c7a1aa43492b"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "16f5ded4468d7100d3640f874f33ddbaa953a787", "subject": "test(cli): consolidate development runner workflow coverage", "body": "test(cli): consolidate development runner workflow coverage\n", "parents": ["1447fd2f990c5d9820337dfd4b8a170f8cad17cd"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "63e796d50ea323ae8dcfef80f86c8154bb106790", "subject": "fix(process): bound retained trace ordering state", "body": "fix(process): bound retained trace ordering state\n\nProve total orders with Kahn traversal and use ranks; stream forward and reverse reachability for general partial orders instead of retaining every closure. Aggregate unordered conflicts by declaration while preserving missing-pair counts and independent malformed-input diagnostics.\n\nValidation: 33 focused trace domain and CLI/MCP boundary tests passed. Six bounded Flameox executions preserved answer digests and cycle rejection; combined median peak RSS fell from 391.13 to 127.72 MiB. General partial-order traversal costs more CPU; the experiment records that tradeoff. Full suite and real-provider lanes were not run.\n", "parents": ["16f5ded4468d7100d3640f874f33ddbaa953a787"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "3c57e1a8b21b379fca55032d177078e1d8426e64", "subject": "fix(artifacts): authenticate file subjects across provider and view boundaries", "body": "fix(artifacts): authenticate file subjects across provider and view boundaries\n\nNarrow WASM and EVM execution ports to file subjects and preserve supplied subject types at the shared execution factory. Authenticate format with path and digest before recording or projecting Evidence, using the existing WASM identity owner in both consumers.\n\nValidation: focused WASM/EVM service and public MCP workflows passed, including malformed provider subjects and self-contained retained Evidence with contradictory format. Global typecheck/lint and documentation checks passed. Real WABT/Evmole execution and the full suite were not run.\n", "parents": ["63e796d50ea323ae8dcfef80f86c8154bb106790"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "1f7f808c4f3bb5eca6b13bcc71d5cceb2ace6614", "subject": "fix(reconstruction): resolve latest verifier observations without input-order bias", "body": "fix(reconstruction): resolve latest verifier observations without input-order bias\n\nGroup observations by exact normalized instant, retaining arbitrary fractional precision and offset equivalence. Coalesce equivalent assessments and all supporting Evidence; report conflicting latest assessments as unknown with verifier-result-ambiguous. Use the same instant comparison for freshness and future checks.\n\nReplace first-input-wins coverage with permutation, provenance, offset, sub-millisecond ordering, and future-clock regressions, including the public MCP workflow. Validation: focused reconstruction/offset tests and MCP workflow passed; converted JSON Schema validation, typecheck/lint, and docs checks passed. Full suite and real-provider lanes were not run.\n", "parents": ["3c57e1a8b21b379fca55032d177078e1d8426e64"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "2187e16f149a7a7b512a4cb45d5f468cc04091fe", "subject": "fix(ghidra): derive installation admission from Java property semantics", "body": "fix(ghidra): derive installation admission from Java property semantics\n", "parents": ["1f7f808c4f3bb5eca6b13bcc71d5cceb2ace6614"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "ec0b081371f118e6e5e042fbef3479359c672ddb", "subject": "fix(filesystem): enforce symlink and decoded-text admission", "body": "fix(filesystem): enforce symlink and decoded-text admission\n", "parents": ["2187e16f149a7a7b512a4cb45d5f468cc04091fe"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "1991542e59f64d46269b3ff942be77a5ff06e88f", "subject": "test(pcap): run the missing-path refusal only where captures are admitted (#2510)", "body": "test(pcap): run the missing-path refusal only where captures are admitted (#2510)\n\nOn hosts without an enforceable native bound (macOS), the provider refuses\ninspect_pcap_capture with capability_unavailable before it touches the\npath, which the unsupported-boundary test in the same file pins. The\nmissing-path test expected invalid_request on every host, so it always\nfailed on macOS while Linux and Windows CI stayed green.\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["1f7f808c4f3bb5eca6b13bcc71d5cceb2ace6614"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2510] }, { "sha": "bb96afdbe32f5318d57fcb00099191c5a7712f53", "subject": "fix(pcap): name the host tool to configure in capability refusals (#2507)", "body": "fix(pcap): name the host tool to configure in capability refusals (#2507)\n\n* fix(pcap): name the host tool to configure in capability refusals\n\nMissing or misconfigured tshark/capinfos, the unsupported macOS capture\nboundary and an unusable Linux prlimit were projected with the generic\n\"unavailable for the current target; choose another target\" advice, even\nfor inspect_pcap_client, which has no target. Route tool refusals through\none pcapToolUnavailable owner that names REA_TSHARK_COMMAND and\nREA_CAPINFOS_COMMAND, give host-boundary refusals their own reason, and\nkeep the private workspace refusal's retryable flag like WABT and source\nmaps do.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* test(pcap): cover the Linux prlimit refusal guidance\n\nCo-Authored-By: Claude Opus 5.5 \n\n---------\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["1991542e59f64d46269b3ff942be77a5ff06e88f"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2507] }, { "sha": "73dd8d6ed5b2b6c705001898521f849a50a2e9fd", "subject": "Merge remote-tracking branch 'origin/main'", "body": "Merge remote-tracking branch 'origin/main'\n", "parents": [ "ec0b081371f118e6e5e042fbef3479359c672ddb", "bb96afdbe32f5318d57fcb00099191c5a7712f53" ], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "3ae826ceba6f25b08bce50bcb51001209bc16b57", "subject": "fix(javascript): share source-map resolution and preserve path uncertainty", "body": "fix(javascript): share source-map resolution and preserve path uncertainty\n", "parents": ["73dd8d6ed5b2b6c705001898521f849a50a2e9fd"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "91886982fccc50a9f7f31d4f320b25ffbcff35af", "subject": "docs: celebrate 170,000 GitHub stars 🎉 (#2462)", "body": "docs: celebrate 170,000 GitHub stars 🎉 (#2462)", "parents": ["3ae826ceba6f25b08bce50bcb51001209bc16b57"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [2462] }, { "sha": "18d56f5321c3c5d5be40c19bcb0a0f2b25c2d459", "subject": "test(ghidra): restore complete installation fixtures across CI boundaries", "body": "test(ghidra): restore complete installation fixtures across CI boundaries\n\nDeclare application.java.min=21 at the four synthetic installation producers so profile, PSP, lifecycle and MCP workflows exercise their intended paths under fail-closed Java admission. Keep missing-bound refusal coverage intact and format the two Ghidra tests rejected by the CI static lane.\n\nValidation: all 82 tests across the 11 failing CI files passed; 66 Ghidra admission, doctor and snapshot tests passed, including missing Java bounds. No production admission policy changed. Full suite and real Ghidra lanes were not run.\n", "parents": ["91886982fccc50a9f7f31d4f320b25ffbcff35af"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "e1cd292aa6e8f5f13441d408c66126782c8dbb0d", "subject": "fix(adb): admit canonical device states and preserve malformed output", "body": "fix(adb): admit canonical device states and preserve malformed output\n", "parents": ["18d56f5321c3c5d5be40c19bcb0a0f2b25c2d459"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "1b953021eadf4cac09e20be388d79536903633b3", "subject": "fix(javascript): centralize module syntax and separate erased type dependencies", "body": "fix(javascript): centralize module syntax and separate erased type dependencies\n", "parents": ["e1cd292aa6e8f5f13441d408c66126782c8dbb0d"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "26bffb94bf80355c35e22a98a8fc629c6210307e", "subject": "perf(evidence): reuse authenticated comparisons through aggregation", "body": "perf(evidence): reuse authenticated comparisons through aggregation\n", "parents": ["1b953021eadf4cac09e20be388d79536903633b3"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "18831491cfb5cb98abbffce0cb04dae12a90fe28", "subject": "fix(ci): ignore generated website translation staging (#2511)", "body": "fix(ci): ignore generated website translation staging (#2511)\n\nIgnore generator-owned website translation staging output while preserving authored lint errors and complete diagnostics.\n\nVerified with a real checker regression, a production translation build, complete coverage, developer/CI regression checks and native lanes.\n\nFixes #2508", "parents": ["18d56f5321c3c5d5be40c19bcb0a0f2b25c2d459"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [2511] }, { "sha": "141d2095f5c6faaf2d3c9b81b0f0f992cacec79c", "subject": "test(hopper): repair Linux demo setup and native verification (#2638)", "body": "test(hopper): repair Linux demo setup and native verification (#2638)\n\n* fix(verification): align Linux Hopper setup lane with current contracts\n\n* fix(verification): retain orphan checks on clean Linux runners\n\n* fix(verification): detect Hopper through alternate launcher paths\n\n* fix(verification): report identified Hopper leaks before proc errors\n\n* fix(verification): distinguish Hopper string recognition from byte fidelity\n\n* fix(verification): report full literal decoding coverage explicitly\n\n---------\n\nCo-authored-by: Luis Taffelli <86675342+LuisTaffelli@users.noreply.github.com>", "parents": ["18831491cfb5cb98abbffce0cb04dae12a90fe28"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "Luis Taffelli", "email": "86675342+LuisTaffelli@users.noreply.github.com", "user": { "login": "LuisTaffelli", "__typename": "User" } } ], "pullRequests": [2638] }, { "sha": "7017c4d68cab49aed998283e09069d9d791e1b0b", "subject": "fix(artifacts): read every ZIP package family extraction is asked to open (#2493)", "body": "fix(artifacts): read every ZIP package family extraction is asked to open (#2493)\n\nextract_artifact carried its own copy of the ZIP package format list with five\nof the eight members the domain owner declares, and used it both as the guard\nthat refuses a format without an extraction reader and as the selector for the\nreader itself. A .hap, .hsp or App Pack target was therefore refused with\n\"Artifact format has no extraction reader\" even though the next branch builds a\nZipArtifactReader for exactly those formats, while inventory_artifact classifies\nthe same path through the owner and reads it.\n\nImport isZipPackageFormat from the domain owner and delete the duplicate list\nand its predicate, removing the second representation instead of reconciling it.\nThe reader branch now narrows to ZipPackageFormat, which is what the\nZipArtifactReader constructor already requires.\n\nVerified with 41 boundary extraction, ZIP integrity and detection tests,\ncheck:fast and verify:test-discovery on macOS arm64. Reverting only the source\nchange fails exactly the three added families and leaves the zip control green.\n\nCo-authored-by: 吴佳浩 ", "parents": ["141d2095f5c6faaf2d3c9b81b0f0f992cacec79c"], "authors": [ { "name": "吴佳浩Alben", "email": "35291372+XiaoBinGan@users.noreply.github.com", "user": { "login": "XiaoBinGan", "__typename": "User" } }, { "name": "吴佳浩", "email": "wujiahao@supremind.com", "user": null } ], "pullRequests": [2493] }, { "sha": "650237efb01b3c4a154799dbbedb2af1084f2312", "subject": "fix(setup): pin Hopper's macOS publisher identity before install (#2481)", "body": "fix(setup): pin Hopper's macOS publisher identity before install (#2481)\n\nThe macOS installer accepted any bundle that passed `codesign --verify`\nand whose `Info.plist` said `com.cryptic-apps.hopper-web-4`. An ad-hoc\nsigned bundle with that identifier satisfies both, so a substituted DMG\ncould be copied to ~/Applications and launched.\n\nVerify a pinned code requirement instead, covering the sealed bundle\nidentifier and the signing team together, and report a distinct\n`publisher_verification_failed` code so a vendor key change is not\nconfused with a corrupt package.", "parents": ["7017c4d68cab49aed998283e09069d9d791e1b0b"], "authors": [ { "name": "The one -Niu", "email": "912906590@qq.com", "user": { "login": "NIU-123370", "__typename": "User" } } ], "pullRequests": [2481] }, { "sha": "5f0f25ad617c42f3166dd06c46ab3c4b11f2de0e", "subject": "Merge remote-tracking branch 'origin/main'", "body": "Merge remote-tracking branch 'origin/main'\n", "parents": [ "26bffb94bf80355c35e22a98a8fc629c6210307e", "650237efb01b3c4a154799dbbedb2af1084f2312" ], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "f6775a36694a6a9c620f4248638e8056a6cbcb66", "subject": "fix(setup): preserve current recovery snapshots and decoding failures", "body": "fix(setup): preserve current recovery snapshots and decoding failures\n", "parents": ["5f0f25ad617c42f3166dd06c46ab3c4b11f2de0e"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "60f771a11e9889ce69cce6ad631b6b186ac742dd", "subject": "fix(apple): limit already-loaded reuse to rpath dependencies (#2292)", "body": "fix(apple): limit already-loaded reuse to rpath dependencies (#2292)\n\n* fix(apple): limit already-loaded reuse to rpath dependencies\n\ndyld reuses an already-loaded image by install name only for @rpath/\ndependencies (Loader.cpp:802-816) and evaluates other dependency forms\nagainst their expanded path for each loader. When multiple images in\ndifferent directories depend on @loader_path/ libraries sharing an\ninstall name, checking loaded images before candidate expansion caused\nsubsequent loaders to bind to the first loaded image's copy or appear\nresolved when their own copy was absent.\n\nLimit byInstallName registration and lookup to install names that start\nwith @rpath/, leaving caller-relative and literal dependencies to expand\nand evaluate their own candidate paths.\n\nSigned-off-by: Vinícius DS Andrade <95101505+viniciusdsandrade@users.noreply.github.com>\n\n* test(apple): verify loader_path dependencies across isolated directories\n\nAssert that multiple images depending on @loader_path/ libraries with\nthe same install name do not reuse already-loaded images across loaders.\nWhen the second loader's helper is absent, its candidate path is absent\nand dyld reports required-load-unresolved; when both helpers exist, each\nloader resolves to its own directory.\n\nSigned-off-by: Vinícius DS Andrade <95101505+viniciusdsandrade@users.noreply.github.com>\n\n---------\n\nSigned-off-by: Vinícius DS Andrade <95101505+viniciusdsandrade@users.noreply.github.com>", "parents": ["650237efb01b3c4a154799dbbedb2af1084f2312"], "authors": [ { "name": "Vinícius Andrade", "email": "95101505+viniciusdsandrade@users.noreply.github.com", "user": { "login": "viniciusdsandrade", "__typename": "User" } } ], "pullRequests": [2292] }, { "sha": "d73ed6fce24f6d1372c80319cd41d29d66666159", "subject": "fix(domain): preserve retryable capability failures through redaction (#2494)", "body": "fix(domain): preserve retryable capability failures through redaction (#2494)\n\nredactExplicitFailure rebuilds each typed failure field by field so explicit\nliterals are removed while the projected code stays the same. The rebuild for\nAnalysisCapabilityUnavailableError carried providerId, operation, reason and\nuserMessage but not retryable, and the constructor defaults that field to false.\nRedacting a transient capability failure therefore made it permanent and changed\nthe remediation shown to the caller.\n\nPass the field through with the same conditional-spread shape used for\nuserMessage. The constructor recomputes retryable from cleanupIncomplete, and\ncleanup is already part of the reconstructed context, so a value that was true\nbefore redaction stays true and a false value stays absent.\n\nVerified with 66 error projection, access-denied, redaction and capture-failure\ntests, check:fast and verify:test-discovery on macOS arm64. The regression test\nfailed with \"expected false to be true\" before the change.\n\nCo-authored-by: 吴佳浩 ", "parents": ["60f771a11e9889ce69cce6ad631b6b186ac742dd"], "authors": [ { "name": "吴佳浩Alben", "email": "35291372+XiaoBinGan@users.noreply.github.com", "user": { "login": "XiaoBinGan", "__typename": "User" } }, { "name": "吴佳浩", "email": "wujiahao@supremind.com", "user": null } ], "pullRequests": [2494] }, { "sha": "f6556ad2bc102d80223f5b434136f546dbd2bbab", "subject": "fix(pcap): order evidence ties by code point instead of host locale (#2509)", "body": "fix(pcap): order evidence ties by code point instead of host locale (#2509)\n\nThe pcap summary sorted equal-count endpoints and protocol stacks with\nString#localeCompare, and Flutter build inspection sorted APK ABI\ndirectory names the same way. localeCompare follows the host's ICU\nlocale, so the same capture produced differently ordered Evidence on\ndifferent hosts: under da_DK \"aarp\" sorts after \"zz\", under lt_LT\n\"syslog\" sorts before \"ssdp\", and every locale puts \"fe80::1\" before\n\"fe80:1::1\". Use the repository's compareUnicodeCodePoints, as the\nother Evidence producers already do.\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["d73ed6fce24f6d1372c80319cd41d29d66666159"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2509] }, { "sha": "12303812a8d70f198c99c7aeb0df3aaa8166543c", "subject": "fix(evidence): admit bundle imports across session transitions (#2303)", "body": "fix(evidence): admit bundle imports across session transitions (#2303)", "parents": ["f6556ad2bc102d80223f5b434136f546dbd2bbab"], "authors": [ { "name": "Rohit Ghumare", "email": "48523873+rohitg00@users.noreply.github.com", "user": { "login": "rohitg00", "__typename": "User" } } ], "pullRequests": [2303] }, { "sha": "1a1b67c8885e9ff33f7a06ed2e027ebfdb83e084", "subject": "fix(javascript): preserve POSIX runtime path case on Windows (#2422)", "body": "fix(javascript): preserve POSIX runtime path case on Windows (#2422)\n\nUse POSIX path semantics for recorded POSIX roots when reconciling runtime Evidence on Windows. Preserve Windows mapping behavior and cover implicit and explicit file roots through the reconciliation service.\n\nAssisted-by: OpenAI GPT-6 \n\nCo-authored-by: Aurantium-47 <280805072+Aurantium-47@users.noreply.github.com>", "parents": ["12303812a8d70f198c99c7aeb0df3aaa8166543c"], "authors": [ { "name": "Aurantium", "email": "3550271410@qq.com", "user": { "login": "Aurantium-47", "__typename": "User" } }, { "name": "Aurantium-47", "email": "280805072+Aurantium-47@users.noreply.github.com", "user": { "login": "Aurantium-47", "__typename": "User" } } ], "pullRequests": [2422] }, { "sha": "c6acd19b6d842699ab807d9526dc762c743686f4", "subject": "fix(ida): stop the private input of a universal Mach-O at the end of the selected slice (#2291)", "body": "fix(ida): stop the private input of a universal Mach-O at the end of the selected slice (#2291)\n\n* test(ida): expect the private input of a universal Mach-O to end at the selected slice\n\nCover a universal file larger than one read chunk with another slice after the selected one, for both a middle slice and the first slice.\n\n* fix(ida): stop the private input of a universal Mach-O at the end of the selected slice\n\nA read chunk that starts after the slice produced a negative end offset, and Buffer.subarray counts a negative bound from the end, so the head of the following slice was written to the private input and its digest.", "parents": ["1a1b67c8885e9ff33f7a06ed2e027ebfdb83e084"], "authors": [ { "name": "Mykola Dementiev", "email": "nikolay-dementiev@users.noreply.github.com", "user": { "login": "nikolay-dementiev", "__typename": "User" } } ], "pullRequests": [2291] }, { "sha": "2c6a4fac4ff3477ac14f3d780894c5b390880607", "subject": "fix(process): accept a trace identifier the comparison result can represent (#2488)", "body": "fix(process): accept a trace identifier the comparison result can represent (#2488)\n\nThe trace specification owns the declared identifier vocabulary and the\ncomparison result echoes those identifiers verbatim into raw_trace[].event_id,\nmatched_variant and diagnostic event_ids. The result module restated the shared\nIDENTIFIER_PATTERN by hand with a 64-character cap, so a specification with a\nlonger identifier validated and then its own comparison result failed to parse:\ncompareProcessTraces threw a raw ZodError at the caller instead of returning a\ncomparison.\n\nExport the identifier schema from the specification as the single owner and\nreuse it in the evaluation module, removing the capped copy. IDENTIFIER_PATTERN\nhas no length bound and every other consumer uses it unbounded, so the\nduplicate was the outlier. Removing the bound rather than adding one keeps the\nadvertised trace_spec input contract unchanged; identifiers of 64 characters or\nfewer behave exactly as before.\n\nVerified with 48 process tests, 24 boundary CLI/MCP trace tests, check:fast and\nverify:test-discovery on macOS arm64. The regression test failed with the\nZodError before the change and passes after it.\n\nCo-authored-by: 吴佳浩 ", "parents": ["c6acd19b6d842699ab807d9526dc762c743686f4"], "authors": [ { "name": "吴佳浩Alben", "email": "35291372+XiaoBinGan@users.noreply.github.com", "user": { "login": "XiaoBinGan", "__typename": "User" } }, { "name": "吴佳浩", "email": "wujiahao@supremind.com", "user": null } ], "pullRequests": [2488] }, { "sha": "ab62ee9dcf98e4717d0b3445330f7cfdfe50c9f4", "subject": "fix(windows): preserve caller affinity only within one processor group (#2202)", "body": "fix(windows): preserve caller affinity only within one processor group (#2202)\n\n* fix(windows): preserve caller affinity only within one processor group\n\n`spawnProcess` read the caller's affinity mask and applied it to the\nsuspended child unconditionally. A mask names processors relative to one\nprocessor group, and Windows assigns each new process to a group of its\nown choosing, so on hosts with more than 64 logical processors the child\nis often placed in another group. `SetProcessAffinityMask` then rejects\nthe mask with ERROR_INVALID_PARAMETER (87) and the spawn fails, making\nevery owned provider process start intermittently on such hosts.\n\nAffinity is a nicety, not an authority or isolation control, so it is now\napplied only when the caller and the suspended child both occupy the same\nsingle processor group. A child placed in another group keeps that group's\ndefault affinity and the spawn proceeds. Job Object membership,\nkill-on-owner-close policy, owner normalization and priority preservation\nare unchanged, and the mask failure remains fatal within a shared group,\nwhere it is not expected.\n\nSingle-group hosts, including every host with 64 or fewer logical\nprocessors, are unaffected: `GetProcessGroupAffinity` reports one group\nfor both processes and the same mask is applied as before.\n\nThe optional process-boundary fixture gains an `affinity` observation,\nand the native verification lane asserts that an owned spawn succeeds and\nthat the child's mask matches the caller's whenever both share a single\ngroup.\n\nFixes #2181\n\nCo-Authored-By: Claude Opus 5 \n\n* fix(windows): refuse to widen a pinned caller's affinity across groups\n\nAddresses review feedback on the first commit.\n\nAn unconstrained caller loses nothing when Windows places an owned child\nin another processor group, so that spawn proceeds with the group's\ndefault. A caller deliberately pinned to fewer processors than its group\nholds is a different case: silently accepting the default would hand the\nprovider tree the whole group, which `docs/installation.md` tells\noperators to rely on affinity to prevent. Such a spawn now fails naming\nthe constraint instead. `GetProcessAffinityMask` already reports the\ngroup's active set, which distinguishes the two without another query.\n\nSelecting the caller's group at creation through\nPROC_THREAD_ATTRIBUTE_GROUP_AFFINITY was tried first and rejected:\n`CreateProcessW` fails with ERROR_INVALID_PARAMETER on a host with a\nsingle processor group, both alongside PROC_THREAD_ATTRIBUTE_JOB_LIST and\non its own, so it cannot carry the ordinary path.\n\nThe boundary fixture's affinity observation now reports a process id's\nown mask rather than its own, because a separate probe process is\nassigned its own group and cannot stand in for the process that spawns\nthe child. Masks and the group's active set cross as fixed-width\nhexadecimal strings: a mask can set bits above the safe-integer range,\nwhere `JSON.parse` would round two different masks to one value.\n\nThe verification lane asserts the mask is inherited exactly when caller\nand child share a group, and otherwise that the caller was unconstrained.\n\nCo-Authored-By: Claude Opus 5 \n\n* docs(windows): record what owned-process affinity does not preserve\n\nA mask covering its group's whole active set does not distinguish a\ncaller the system placed in that group from one that selected the group\ndeliberately, so an owned child can still be placed elsewhere with its\nprocessor count bounded and its group placement lost. Treating that case\nas constrained instead is not available: on a multi-group host an\nordinary process is assigned a group by the system and its mask is that\ngroup's active set, so refusing it would fail every owned spawn there.\n\nCo-Authored-By: Claude Opus 5 \n\n---------\n\nCo-authored-by: Claude Opus 5 ", "parents": ["2c6a4fac4ff3477ac14f3d780894c5b390880607"], "authors": [ { "name": "Stefano Rizzello", "email": "rizzellostefano@gmail.com", "user": { "login": "Rinkia", "__typename": "User" } }, { "name": "Claude Opus 5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2202] }, { "sha": "68ecf3df8c666fdbe1ced8089c64340af614d1c3", "subject": "fix(browser): exclude sensitive binary lengths from historical captures (#2477)", "body": "fix(browser): exclude sensitive binary lengths from historical captures (#2477)\n\nCo-authored-by: chAngE <172472630+chAng-L19@users.noreply.github.com>", "parents": ["ab62ee9dcf98e4717d0b3445330f7cfdfe50c9f4"], "authors": [ { "name": "chAngE", "email": "2815456271@qq.com", "user": { "login": "chAng-L19", "__typename": "User" } }, { "name": "chAngE", "email": "172472630+chAng-L19@users.noreply.github.com", "user": { "login": "chAng-L19", "__typename": "User" } } ], "pullRequests": [2477] }, { "sha": "e74e4e951bf59c42b25779b45d1c7b8dde6b618f", "subject": "fix(screenshot): reject invalid PNG header dimensions (#2472)", "body": "fix(screenshot): reject invalid PNG header dimensions (#2472)", "parents": ["68ecf3df8c666fdbe1ced8089c64340af614d1c3"], "authors": [ { "name": "Rudy Mizrahi Celekli", "email": "47457359+rudycelekli@users.noreply.github.com", "user": { "login": "rudycelekli", "__typename": "User" } } ], "pullRequests": [2472] }, { "sha": "6a04f922e16ad4d171ba0c07e32238efdaf43e2d", "subject": "fix(javascript): parse explicit CommonJS wrapper syntax (#2475)", "body": "fix(javascript): parse explicit CommonJS wrapper syntax (#2475)", "parents": ["e74e4e951bf59c42b25779b45d1c7b8dde6b618f"], "authors": [ { "name": "Rudy Mizrahi Celekli", "email": "47457359+rudycelekli@users.noreply.github.com", "user": { "login": "rudycelekli", "__typename": "User" } } ], "pullRequests": [2475] }, { "sha": "a07ceaec36346a7c73e66efe35c8af4654029c84", "subject": "fix(config): reject NUL bytes in Hopper loader arguments (#2474)", "body": "fix(config): reject NUL bytes in Hopper loader arguments (#2474)", "parents": ["6a04f922e16ad4d171ba0c07e32238efdaf43e2d"], "authors": [ { "name": "Rudy Mizrahi Celekli", "email": "47457359+rudycelekli@users.noreply.github.com", "user": { "login": "rudycelekli", "__typename": "User" } } ], "pullRequests": [2474] }, { "sha": "55e21a2eece0b624d80ada774c9055ac5a025875", "subject": "Merge remote-tracking branch 'origin/main'", "body": "Merge remote-tracking branch 'origin/main'\n", "parents": [ "f6775a36694a6a9c620f4248638e8056a6cbcb66", "a07ceaec36346a7c73e66efe35c8af4654029c84" ], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "fe8d0bdd36fe12bc0836468d1a702a34fbdc219b", "subject": "fix(android): reject malformed UTF-8 at the JADX protocol boundary", "body": "fix(android): reject malformed UTF-8 at the JADX protocol boundary\n", "parents": ["55e21a2eece0b624d80ada774c9055ac5a025875"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "b953f96c0aae27e1876c317a8f7db1d6f292b8ff", "subject": "fix(ghidra): share Java properties semantics with PSP extension admission", "body": "fix(ghidra): share Java properties semantics with PSP extension admission\n", "parents": ["fe8d0bdd36fe12bc0836468d1a702a34fbdc219b"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "d9e9fb2273543caab4eb21d896c33d462ada6971", "subject": "fix(process): use monotonic time for provider execution budgets", "body": "fix(process): use monotonic time for provider execution budgets\n", "parents": ["b953f96c0aae27e1876c317a8f7db1d6f292b8ff"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "6bd2b28161411f70ed5dc72e42c2736a1aab758b", "subject": "fix(browser): keep elapsed capture timing independent of wall-clock changes", "body": "fix(browser): keep elapsed capture timing independent of wall-clock changes\n", "parents": ["d9e9fb2273543caab4eb21d896c33d462ada6971"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "7fc0b5ec9c2532bbf789d7783b7a0cab6fc054d8", "subject": "fix(mcp): join owned doctor shutdown without signaling saved PIDs", "body": "fix(mcp): join owned doctor shutdown without signaling saved PIDs\n", "parents": ["6bd2b28161411f70ed5dc72e42c2736a1aab758b"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "9049dbaf0c3df32357419f9899965df2b611f493", "subject": "fix(process): preserve monotonic capture timing and observed wall dates", "body": "fix(process): preserve monotonic capture timing and observed wall dates\n", "parents": ["7fc0b5ec9c2532bbf789d7783b7a0cab6fc054d8"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "e7882b34f4ac4a26f903c5f49264acc2c19bb562", "subject": "fix(artifacts): honor cancellation at the output publication boundary", "body": "fix(artifacts): honor cancellation at the output publication boundary\n", "parents": ["9049dbaf0c3df32357419f9899965df2b611f493"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "15463bdbe605b9dd11da5dbba031f99cd1ec9190", "subject": "fix(adb): count requested permissions that the device marks restricted (#2359)", "body": "fix(adb): count requested permissions that the device marks restricted (#2359)\n\nAndroid 10 and 11 print restricted entries of the requested-permissions\nlist as \"NAME: restricted=true\". The parser took the first such line as\nthe end of the list, so the count stopped there while coverage still\nread complete.\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["55e21a2eece0b624d80ada774c9055ac5a025875"], "authors": [ { "name": "Jin", "email": "a3239737781@gmail.com", "user": { "login": "huiq777", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2359] }, { "sha": "b9ee921560dcf4590c2b13a1cc92c49c93e10675", "subject": "fix(process): preserve nested path identities during normalization (#2468)", "body": "fix(process): preserve nested path identities during normalization (#2468)", "parents": ["15463bdbe605b9dd11da5dbba031f99cd1ec9190"], "authors": [ { "name": "Rudy Mizrahi Celekli", "email": "47457359+rudycelekli@users.noreply.github.com", "user": { "login": "rudycelekli", "__typename": "User" } } ], "pullRequests": [2468] }, { "sha": "9c34c091b3b8c47f8bd18d6f0321efde2dedb92a", "subject": "feat(captures): discover installed protocol and field definitions (#2496)", "body": "feat(captures): discover installed protocol and field definitions (#2496)\n\n* feat(captures): discover installed protocol and field definitions\n\n* test(captures): isolate the direct glossary oracle profile\n\n* test(captures): accept padded kernel limit reports\n\n* fix(captures): detach every retained glossary column\n\n* fix(captures): describe every field discovery CLI option\n\n* fix(captures): retain discovery operation across cleanup retries\n\n---------\n\nCo-authored-by: N0zoM1z0 <161784452+N0zoM1z0@users.noreply.github.com>", "parents": ["b9ee921560dcf4590c2b13a1cc92c49c93e10675"], "authors": [ { "name": "Olorin", "email": "59321404+Olorinm@users.noreply.github.com", "user": { "login": "Olorinm", "__typename": "User" } }, { "name": "N0zoM1z0", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [2496] }, { "sha": "4276aaf18bb607cdd0182280f76cf50fcd110c3c", "subject": "feat(signals): discover installed decoders and option help (#2487)", "body": "feat(signals): discover installed decoders and option help (#2487)\n\n* feat(signals): discover installed decoders and selected option help\n\n* fix(signals): bound retained discovery data and preserve resource failures\n\n* fix(signals): complete CLI help and portable decoder patterns\n\n* test(signals): verify case-insensitive decoder help queries\n\n* fix(signals): retain discovery operation across cleanup retries", "parents": ["9c34c091b3b8c47f8bd18d6f0321efde2dedb92a"], "authors": [ { "name": "Olorin", "email": "59321404+Olorinm@users.noreply.github.com", "user": { "login": "Olorinm", "__typename": "User" } } ], "pullRequests": [2487] }, { "sha": "20f51d7286b1759e42f99c0512c73230052dda86", "subject": "fix(native): name the ownership helper prerequisite in command failures (#2506)", "body": "fix(native): name the ownership helper prerequisite in command failures (#2506)\n\n* fix(native): name the ownership helper prerequisite in command failures\n\nEvery supervised native command launch needs the Darwin process-ownership\nhelper. When that helper cannot be compiled (relative REA_DARWIN_SWIFTC_PATH,\nmissing SDKROOT, a missing compiler, or an SDK/compiler mismatch), the\nrunner reduced the typed DarwinProcessOwnershipInspectionError to a bare\n`io` failure. inspect_macho then reported `execution_failure` with no hint,\nand inspect_artifact on any universal Mach-O said only \"lipo could not\nenumerate universal Mach-O slices\".\n\nThe runner now keeps the inspection message as the failure's `detail` at\nthe launch boundary and carries it through xcrun resolution. The native\nprovider adds it to its diagnostics and the slice reader appends it to its\nmessage, matching what the SQLite and capture providers already report.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* test(native): cover the provider's ownership helper diagnostics\n\nCo-Authored-By: Claude Opus 5.5 \n\n---------\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["4276aaf18bb607cdd0182280f76cf50fcd110c3c"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2506] }, { "sha": "6a05248d464387c0ce4ec1577b4c1b24d3d355c7", "subject": "perf(frida): evict captured messages without copying the whole queue (#2628)", "body": "perf(frida): evict captured messages without copying the whole queue (#2628)\n\nOnce a Frida session reached its 16 MiB capture budget, every new message\nevicted the oldest one with Array#shift, re-serialized it to recover its\nbyte charge, and searched and spliced its per-script array. Each of\nthose is linear in the retained messages, so with about 188k small\nmessages retained the cost per message rose from 0.14 µs to 32 µs and\ncapped the main thread at roughly 31k messages per second, which a\nhooked hot function can exceed.\n\nKeep both queues as head-offset FIFOs that compact once half their slots\nare evicted, and record each message's charge when it is admitted.\nArrival order already makes the globally oldest message the oldest one\nof its script, so per-script eviction becomes a head check. Eviction is\nnow amortized O(1) at about 0.14 µs per message; retained messages,\ntheir order and the truncation flag are unchanged.\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["20f51d7286b1759e42f99c0512c73230052dda86"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2628] }, { "sha": "e802441bce7674f18c847c2763ba6297809d5eff", "subject": "Merge remote-tracking branch 'origin/main'", "body": "Merge remote-tracking branch 'origin/main'\n", "parents": [ "e7882b34f4ac4a26f903c5f49264acc2c19bb562", "6a05248d464387c0ce4ec1577b4c1b24d3d355c7" ], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "eaa961658578522cecfbba7c7be1acf1c64da65a", "subject": "fix(javascript): preserve cancellation through recovery publication cleanup", "body": "fix(javascript): preserve cancellation through recovery publication cleanup\n", "parents": ["e802441bce7674f18c847c2763ba6297809d5eff"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "ed881c6d2ef6a8adba0c2a241ebc9ab4603b7868", "subject": "fix(progress): measure delivery intervals with a monotonic clock", "body": "fix(progress): measure delivery intervals with a monotonic clock\n", "parents": ["eaa961658578522cecfbba7c7be1acf1c64da65a"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "bf34d0d2fc3cc22076f49d682e74a0b71aa1db18", "subject": "perf(native): add opt-in Mach-O summary delivery and retained pages (#2634)", "body": "perf(native): add opt-in Mach-O summary delivery and retained pages (#2634)\n\n* perf(native): add opt-in Mach-O summary delivery and retained pages\n\ninspect_macho returns every import and export inline. For VS Code's\nElectron Framework one MCP call carries 2.5 MB of text (about 828k o200k\ntokens), and the same again as structuredContent; the MCP response\nbudget admits it. Agents asking for slice identity, UUID or dependency\ncounts paid that cost on every first call.\n\nAdd the established opt-in detail selection: omitted or complete keeps\nthe existing complete result and Evidence identity, while summary\nretains the complete Evidence and returns slice identity with\nper-collection returned/total/exhaustive counts (956 tokens).\ninspect_analysis_view kind macho pages the original rows of any\ncollection or the command provenance, repeating the producer's own\ntotal and exhaustive flag so page exhaustion is never read as absence.\n\nDelivery detail never reaches the native tools or the source Evidence\nID: registerEvidenceTools gains a parametersForEvidence hook, so the\nsummary's parent is the same Evidence as a complete call.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(mcp): refuse unretainable summary delivery before analysis\n\nA server without Evidence retention (a fixed analysis source) ran the\ncomplete inspect_macho or inspect_artifact analysis for detail summary\nand only then refused it in summarizeRetainedAnalysis, paying the very\ncost summary delivery exists to avoid. registerEvidenceTools gains a\npreflight hook; both registrations check retention there, as the WASM,\nEVM, managed, pcap and capture handlers already do before dispatch.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(native): keep whole rows in Mach-O architecture and segment pages\n\nThe page item union listed plain-object row arrays, and zod returns the\nfirst union member that parses while dropping unknown keys. Entrypoint\nrows declare only file_offset, so every architecture and segment row\n(which also carry a numeric file_offset) matched it and lost its name,\nCPU fields, permissions and sections. Rows now use exact key sets, and\nimports/exports share one member. The MCP test pages every facet of a\nreal /bin/ls and compares it with the unparsed complete rows.\n\nCo-Authored-By: Claude Opus 5.5 \n\n---------\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["e802441bce7674f18c847c2763ba6297809d5eff"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2634] }, { "sha": "ded199abcde611a0ba4739ecb536e0ede0075670", "subject": "Merge remote-tracking branch 'origin/main'", "body": "Merge remote-tracking branch 'origin/main'\n", "parents": [ "ed881c6d2ef6a8adba0c2a241ebc9ab4603b7868", "bf34d0d2fc3cc22076f49d682e74a0b71aa1db18" ], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "c923fb0dc9462e302b84a15770131ff899f89455", "subject": "fix(javascript): retain compiler-dependent module resolution facts", "body": "fix(javascript): retain compiler-dependent module resolution facts\n\nCompare import and require outcomes for static TypeScript references when compiler options are unknown. Preserve branch facts through worker IR and both graph projections; retain declaration fallbacks as candidates without changing explicitly selected paths.\n\nValidation: 210 focused resolver and semantic tests; 21 production-boundary and source-extension tests. A bounded 2,000-reference probe adds about 16–17 ms wall time for dual resolution; full task token costs and real compiled application behavior remain unmeasured.\n", "parents": ["ded199abcde611a0ba4739ecb536e0ede0075670"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "b955b825fc002a4bb408f2910b78768c566c2cd1", "subject": "fix(artifacts): retain read cleanup ownership through CLI and MCP shutdown", "body": "fix(artifacts): retain read cleanup ownership through CLI and MCP shutdown\n\nKeep failed stable-read handles and WABT runtime roots under retryable resource scopes. Preserve cancellation causes and primary errors, close the same service instances bound to MCP tools, and consolidate CLI operation/cleanup projection.\n\nValidation: fast typecheck and lint, cached runtime build, docs checks, SDK schema validation, focused service and real-file cleanup tests, CLI cleanup regressions, and MCP lifecycle/shutdown workflows. Provider process fixtures simulate engine output; real WABT and Linux EVM execution are not established by this pass.\n", "parents": ["c923fb0dc9462e302b84a15770131ff899f89455"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "c7a890d12987d9b2d496119c1fbf1a88c0fc298e", "subject": "fix(javascript): preserve unknown module-alias provenance", "body": "fix(javascript): preserve unknown module-alias provenance\n\nReplace the implicit local-provenance fallback with explicit locally constructed values. Keep opaque results, parameters and caught values unknown; follow assignment and sequence results while retaining exact module aliases. Clarify that alias provenance does not represent transitive data taint.\n\nValidation: 26 focused provenance/module-link tests, 135 semantic and graph-builder tests, six application module-relationship boundary tests, and the fast typecheck/lint gate.\n", "parents": ["b955b825fc002a4bb408f2910b78768c566c2cd1"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "9cf49c7a784ace9b79e4b4c1022c9fbf2b3f77e1", "subject": "fix(snapshot): classify non-object roots as invalid content (#2685)", "body": "fix(snapshot): classify non-object roots as invalid content (#2685)\n\nCo-authored-by: jiangjiang248 <237556902+jiangjiang248@users.noreply.github.com>", "parents": ["c923fb0dc9462e302b84a15770131ff899f89455"], "authors": [ { "name": "jiangjiang248", "email": "jiangjiang248@gmail.com", "user": { "login": "jiangjiang248", "__typename": "User" } }, { "name": "jiangjiang248", "email": "237556902+jiangjiang248@users.noreply.github.com", "user": { "login": "jiangjiang248", "__typename": "User" } } ], "pullRequests": [2685] }, { "sha": "67c7a24e60cc59191283977642055cd59a84b043", "subject": "Merge remote-tracking branch 'origin/main'", "body": "Merge remote-tracking branch 'origin/main'\n", "parents": [ "c7a890d12987d9b2d496119c1fbf1a88c0fc298e", "9cf49c7a784ace9b79e4b4c1022c9fbf2b3f77e1" ], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "a0317cf732b3addefad5ac3b234db1e044e3351d", "subject": "fix(ci): align FAT fixtures and consolidate duplicated workflow helpers", "body": "fix(ci): align FAT fixtures and consolidate duplicated workflow helpers\n\nDeclare the synthetic 4 KiB Mach-O slice alignment accurately while preserving the IDA thinning scenario. Share web cleanup aggregation and process-trace fixture facts instead of duplicating them across consumers and tests; keep the 3% duplication threshold unchanged.\n\nValidation: npm run check:ci, test discovery, and 42 focused IDA, process-trace, web workflow and cleanup boundary tests. Duplication falls from 3.01% to 2.99%.\n", "parents": ["67c7a24e60cc59191283977642055cd59a84b043"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "11f1d952e79241b507e47c690eed00e0d5ffda30", "subject": "ci: raise duplication threshold to 3.5 percent", "body": "ci: raise duplication threshold to 3.5 percent\n", "parents": ["a0317cf732b3addefad5ac3b234db1e044e3351d"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "11f8b7625788d747eaadd59af6efdf88587ed058", "subject": "fix(apktool): accept --no-strings CLI option (#2707)", "body": "fix(apktool): accept --no-strings CLI option (#2707)", "parents": ["11f1d952e79241b507e47c690eed00e0d5ffda30"], "authors": [ { "name": "Avocado", "email": "headmastereggy@gmail.com", "user": { "login": "HeadmasterEggy", "__typename": "User" } } ], "pullRequests": [2707] }, { "sha": "b69d20a300dba57783a810146f25dacb69f9b8a4", "subject": "fix(captures): name the violated HAR schema constraint (#2708)", "body": "fix(captures): name the violated HAR schema constraint (#2708)\n\nHAR validation reported only the AJV keyword, so a capture missing\n`log.version` failed with \"HAR schema validation failed: required.\" and\nthe caller could not tell which property to supply. Include AJV's\nconstraint message, which names the missing property, expected type, or\npattern without restating captured values.\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["11f8b7625788d747eaadd59af6efdf88587ed058"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2708] }, { "sha": "96fc84f1fb7c8bc69f66cd899896f4de9061fead", "subject": "fix(native): select one slice when universal Mach-O slices share a CPU type (#2040)", "body": "fix(native): select one slice when universal Mach-O slices share a CPU type (#2040)\n\n* fix(native): select one slice when universal Mach-O slices share a CPU type\n\nOn macOS 27 most system binaries are universal files whose slices share\nCPU_TYPE_ARM64: arm64e + arm64e.x1 (Calculator, TextEdit), x86_64 + arm64e +\narm64e.x1 (/bin/ls), or arm64 + arm64e.x1 (ShortcutDroplet). Target admission\nnames slices by CPU family, so these targets have availableArchitectures\n[\"arm64\"] while the file holds two arm64 slices.\n\ninspect_macho read that family count as a slice count and ran otool, nm,\ndyld_info, dwarfdump and vtool without -arch. ShortcutDroplet failed with\n\"Malformed otool load-command output\" (40 load commands against ncmds 20).\nCalculator reported both slices' imports (4138 instead of 2069), nm's\n\"(for architecture ...)\" header lines as exports, and no selected slice.\nselectArchitecture now also filters when lipo lists more than one slice. Its\npreference is unchanged: the family name, then arm64e, then the first\narm64e..\n\ninspect_native_dispatch_metadata matched FAT slices by CPU type only and\nrefused /bin/ls and TextEdit as \"Ambiguous FAT architecture slice\".\nselectMachoSlice now ranks slices of the requested CPU type by base subtype in\nthe same order: arm64 (0, then 1) or x86_64 (3), then arm64e (2), then other\nvariants such as arm64e.x1 in FAT table order. It reports ambiguity only when\nthe top-ranked slices share a subtype.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(native): share Mach-O slice preference across inspections\n\n* chore: preserve upstream process capture test during merge\n\n---------\n\nCo-authored-by: Claude Opus 5.5 \nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["b69d20a300dba57783a810146f25dacb69f9b8a4"], "authors": [ { "name": "Hemanth Rayudu", "email": "rayuduhemanth6@gmail.com", "user": { "login": "hemanthrayuduu", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2040] }, { "sha": "c02fb0ea8055f98def2b12ad557aed0faefd3639", "subject": "fix(native): rank Mach-O slices by parsed CPU subtype", "body": "fix(native): rank Mach-O slices by parsed CPU subtype\n", "parents": ["96fc84f1fb7c8bc69f66cd899896f4de9061fead"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "0c7f4dfbd9c1975eeedfecd96debb2e4263012d0", "subject": "ci: separate fast feedback from full qualification", "body": "ci: separate fast feedback from full qualification\n\nScope main pushes from a successful ancestor so canceled runs cannot hide changes. Keep the complete portable suite in fast feedback and move coverage plus Intel macOS to hourly, manual, explicit-full, and release qualification. Let qualification finish independently of superseded feedback.\n\nBind publication to full qualification at its exact revision and publish the verified tarball after checking workflow identity, version, and SHA-256. Keep trusted cache writers and reject incomplete merged test inventories.\n\nValidation: 151 focused CI tests; typecheck/lint; actionlint 1.7.7; knip; all 1044 files discovered; bounded blob/merge smoke; macOS package verifier with retention and cleanup; npm pack dry run. Native Linux/ARM/Windows and remote workflow execution remain CI verification.\n", "parents": ["c02fb0ea8055f98def2b12ad557aed0faefd3639"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "db3c9f084bacad34f620ba678924564e20f441f9", "subject": "fix(ci): keep cancellation ownership in the calling workflow", "body": "fix(ci): keep cancellation ownership in the calling workflow\n\nRemove redundant ref-based concurrency from reusable provider and website workflows. Their old groups could cancel qualification from another CI tier even though the callers used separate groups. Disposable hosted jobs now inherit caller scheduling; direct manual dispatches remain independent.\n\nValidate every called CI workflow has no independent cancellation group. Validation: 100 focused scope/gate tests and actionlint 1.7.7.\n", "parents": ["0c7f4dfbd9c1975eeedfecd96debb2e4263012d0"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "e05d3399f19f25fdf04285a02b293418256b26dc", "subject": "test(javascript): expect unknown parameter provenance", "body": "test(javascript): expect unknown parameter provenance\n", "parents": ["db3c9f084bacad34f620ba678924564e20f441f9"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "52d4ce6ced1c3b6ae7570a5df7f4499cd65a1182", "subject": "fix(apple): derive dyld environment findings from each traced slice (#2733)", "body": "fix(apple): derive dyld environment findings from each traced slice (#2733)\n\nderiveFindings looked up each traced root's slice again by architecture\nname. A universal executable with arm64e and arm64e.x1 slices reports\nboth as \"arm64e\", so both roots resolved to the first slice: a later\nslice's LC_DYLD_ENVIRONMENT produced no finding, or the first slice's\ncommand was reported twice. The per-slice dyld_environment arrays were\nalready correct.\n\ntraceDylibLoading already has the exact slice when it records a root, so\npass it to deriveFindings instead of re-deriving it from the name. The\npublic roots and findings shapes are unchanged.\n\nFixes #2661\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["e05d3399f19f25fdf04285a02b293418256b26dc"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2733] }, { "sha": "0cf224e76214abbcf47274aa936d1b5cad28db2f", "subject": "fix(javascript): retain distinct chunk registration callback metadata (#2737)", "body": "fix(javascript): retain distinct chunk registration callback metadata (#2737)\n\nCo-authored-by: LouisChen <3361008+chqcjq@users.noreply.github.com>", "parents": ["52d4ce6ced1c3b6ae7570a5df7f4499cd65a1182"], "authors": [ { "name": "LouisChen", "email": "65096591@qq.com", "user": { "login": "chqcjq", "__typename": "User" } }, { "name": "LouisChen", "email": "3361008+chqcjq@users.noreply.github.com", "user": { "login": "chqcjq", "__typename": "User" } } ], "pullRequests": [2737] }, { "sha": "d13c9f840d36a321a56917e75c48afcb8d72920e", "subject": "ci: reduce redundant compatibility and qualification work", "body": "ci: reduce redundant compatibility and qualification work\n\nSelect SQLite compatibility by explicit source, fixture, lifecycle, and script ownership while retaining every version in full qualification. Share the canonical scope inventory between planning and the required gate.\n\nReuse recent exact-SHA full qualification only for hourly schedules, with trusted successful-run metadata and receipts. Force a daily refresh, reject stale original runs even after retries, and never renew proof from reused validation.\n\nReport attempt-specific queue, execution, and matched step timing in a separate completion workflow using trusted default-branch code and read-only API access. Preserve raw metadata and unknown timings without delaying validation or publication.\n\nValidation: 177 focused tests; typecheck/lint; knip; actionlint 1.7.7; all 1046 tests discovered; live 37-job API report smoke. Remote workflow scheduling and real-provider matrices remain CI verification.\n", "parents": ["0cf224e76214abbcf47274aa936d1b5cad28db2f"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "9928f357fb9c420e6384e155d74586dfe37d4533", "subject": "fix(artifacts): read ASCII control bytes in legacy ZIP names as ASCII (#2365)", "body": "fix(artifacts): read ASCII control bytes in legacy ZIP names as ASCII (#2365)\n\n* fix(artifacts): read ASCII control bytes in legacy ZIP names as ASCII\n\nZIP names without the UTF-8 flag were decoded with zip.js's CP437 table,\nwhich maps bytes 0x01-0x1F and 0x7F to IBM PC display glyphs. A folder\nzipped on macOS with a custom icon therefore listed and extracted\n`Folder/Icon\\r` as `Folder/Icon♪`, a name that is not in the archive and\ndiffers from REA's directory inventory of the same folder. Tabs became `○`\nand DEL became `⌂`.\n\nDecode legacy names in REA's existing decodeText hook with the Unicode\nCP437 mapping that Python's zipfile also uses: bytes below 0x80 as ASCII,\nand the upper half with the same table zip.js uses.\n\nWindows file names cannot contain U+0001-U+001F, so a Windows extraction\ndestination now refuses such a path with a typed path failure before\ncreating anything, as it already does for ':'.\n\n* test(artifacts): check extracted legacy ZIP control names on disk\n\nThe control-name cases checked only the logical path that inventory\nreports. Extraction writes through SafeOutputTree, so a change that\nrenamed the extracted files would still pass those cases.\n\nExtract `Icon\\r` and `é\\t\\u007F.a`, then compare the reported\nrelative_path, the directory listing, and the file contents. The new\ncases skip on Windows, which refuses these names.\nsafeOutputTree.test.ts covers that refusal.", "parents": ["d13c9f840d36a321a56917e75c48afcb8d72920e"], "authors": [ { "name": "Chaoqi", "email": "136579807+Chaoqi31@users.noreply.github.com", "user": { "login": "Chaoqi31", "__typename": "User" } } ], "pullRequests": [2365] }, { "sha": "ab02f3c8d665ead35391c94db74cd0fb0cfed0ed", "subject": "ci: reduce reporter fan-out and preserve shard history", "body": "ci: reduce reporter fan-out and preserve shard history\n", "parents": ["9928f357fb9c420e6384e155d74586dfe37d4533"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "6c816af11975e8e801adb2924c4e3c116c72ebba", "subject": "fix(managed): preserve negative zero in CIL operands (#2437)", "body": "fix(managed): preserve negative zero in CIL operands (#2437)", "parents": ["ab02f3c8d665ead35391c94db74cd0fb0cfed0ed"], "authors": [ { "name": "Harly", "email": "1211074765@qq.com", "user": { "login": "fisHarly0", "__typename": "User" } } ], "pullRequests": [2437] }, { "sha": "f8e95799f941e9e55e0d47841896b401bab67d29", "subject": "fix(artifacts): preserve NIB field and class identities (#2106)", "body": "fix(artifacts): preserve NIB field and class identities (#2106)", "parents": ["6c816af11975e8e801adb2924c4e3c116c72ebba"], "authors": [ { "name": "Yijie Lu", "email": "115929844+1NormalGuy@users.noreply.github.com", "user": { "login": "1NormalGuy", "__typename": "User" } } ], "pullRequests": [2106] }, { "sha": "fe496bd1cf589938c372646ddef8ca9701417bf0", "subject": "docs(website): add essay on reverse engineering models", "body": "docs(website): add essay on reverse engineering models\n\nAdd an English review draft connecting Touhou reconstruction evidence with model specialization, repository knowledge and feedback-driven learning. Preserve model attribution and historical verification scope in supporting notes, and translate the new Blog listing for all existing editions.\n\nValidation: website.py check, focused formatting checks, and 32 Chromium cases covering both preview paths, light/dark themes, responsive layouts, translated indexes and no-JavaScript reading.\n", "parents": ["f8e95799f941e9e55e0d47841896b401bab67d29"], "authors": [ { "name": "N0zoM1z0", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [2732] }, { "sha": "8583a190c0178374132c888622d693fed1f88a18", "subject": "fix(website): keep omitted language selectors free of whitespace", "body": "fix(website): keep omitted language selectors free of whitespace\n\nIndent the optional language selector with its value so a nonindexable draft does not generate a line containing only spaces. Indexed-page markup is unchanged.\n\nValidation: website.py check passes all 12 maintenance regressions; synchronization changes only the draft header blank line.\n", "parents": ["fe496bd1cf589938c372646ddef8ca9701417bf0"], "authors": [ { "name": "N0zoM1z0", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [2732] }, { "sha": "ca07373e44e19e0c8357ac49e460c90d87fcc22c", "subject": "docs(website): improve model essay transitions and narrative flow", "body": "docs(website): improve model essay transitions and narrative flow\n\nConnect the reconstruction cases to the questions about specialization, retrieval and feedback-driven search. Replace fragmented sentence sequences with explicit causal links and smooth the progression into oracle design and the proposed comparison.\n\nValidation: website.py check, formatting, preserved source links and evidence figures, and eight desktop/mobile light/dark layout checks at both preview paths.\n", "parents": ["8583a190c0178374132c888622d693fed1f88a18"], "authors": [ { "name": "N0zoM1z0", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [2732] }, { "sha": "806ff575676e447c7ba349b6fd185e6e8e02ee5d", "subject": "docs(website): use straight quotes in model essay", "body": "docs(website): use straight quotes in model essay\n\nNormalize the three quoted phrases to straight English quotation marks. Website checks and formatting pass; the local preview serves the revised punctuation.\n", "parents": ["ca07373e44e19e0c8357ac49e460c90d87fcc22c"], "authors": [ { "name": "N0zoM1z0", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [2732] }, { "sha": "b06751b703181527a320226c4ab7e4cecd5dcea0", "subject": "docs(website): simplify reconstruction evidence in model essay", "body": "docs(website): simplify reconstruction evidence in model essay\n\nExplain each case through the obstacle, useful hypothesis and verified result. Remove byte totals, relocation counts and trial counts from the main narrative; preserve commit references and the constant-value example that explains the oracle defect. Make the experiment table and compiler terminology easier to follow.\n\nValidation: website.py check, formatting, preserved source links, and eight article layout checks across both preview paths and light/dark themes.\n", "parents": ["806ff575676e447c7ba349b6fd185e6e8e02ee5d"], "authors": [ { "name": "N0zoM1z0", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [2732] }, { "sha": "3d78a57043eb6b92812c71bcb6d83753c3d48036", "subject": "docs(website): publish model essay in all supported languages", "body": "docs(website): publish model essay in all supported languages\n", "parents": ["b06751b703181527a320226c4ab7e4cecd5dcea0"], "authors": [ { "name": "N0zoM1z0", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [2732] }, { "sha": "f1f5582ce84f54e529826fef7af3e201f52248d9", "subject": "fix(website): clarify translated evidence and runtime observations", "body": "fix(website): clarify translated evidence and runtime observations\n", "parents": ["3d78a57043eb6b92812c71bcb6d83753c3d48036"], "authors": [ { "name": "N0zoM1z0", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [2732] }, { "sha": "ec3db374574060fcc4fa6b215fceaea1bd4ca3f3", "subject": "fix(native): preserve literal line breaks in signing identifiers (#2107)", "body": "fix(native): preserve literal line breaks in signing identifiers (#2107)\n\n* fix(native): preserve literal line breaks in signing identifiers\n\n* fix(native): infer codesign framing without a matching path", "parents": ["f1f5582ce84f54e529826fef7af3e201f52248d9"], "authors": [ { "name": "Yijie Lu", "email": "115929844+1NormalGuy@users.noreply.github.com", "user": { "login": "1NormalGuy", "__typename": "User" } } ], "pullRequests": [2107] }, { "sha": "2995ec6910ead327829378f5ab1b9172ecce33fc", "subject": "fix(ghidra): resolve file offsets in decompile (#2101)", "body": "fix(ghidra): resolve file offsets in decompile (#2101)\n\n* fix(native): expose loaded image bases in overviews\n\n* test(ghidra): retain resources when verifier cleanup fails\n\n* docs(ghidra): spell out file-offset address mapping\n\n* fix(ci): separate and retry NativeAOT dependency restoration\n\n* fix(test): resolve CI script file URLs on Windows\n\n* fix(native): retain conflict observations and actionable CLI guidance\n\n* fix(fixtures): keep NativeAOT retry logs credential-safe\n\n* fix(fixtures): redact authenticated URLs at diagnostic creation\n\n* fix(ghidra): restrict source-coordinate observations to decompilation\n\n* fix(cli): identify conflicting file-offset selectors accurately\n\n* fix(ghidra): bind file offsets to admitted target sources\n\n* fix(ghidra): preserve resolved file-offset failure context\n\n* test(ghidra): verify ELF address and file-offset round trips\n\n* test(nativeaot): align diagnostic regressions with fixture host support", "parents": ["ec3db374574060fcc4fa6b215fceaea1bd4ca3f3"], "authors": [ { "name": "记得吃中饭", "email": "17373302683@163.com", "user": { "login": "Zhong-fan", "__typename": "User" } } ], "pullRequests": [2101] }, { "sha": "747e7299141cec0b03774c427f579889d5088d20", "subject": "test(release): validate only the selected preflight job", "body": "test(release): validate only the selected preflight job\n\nScope the steps schema to the release job whose preflight is executed, allowing unrelated reusable-workflow jobs such as qualification. Preserve all four valid and invalid metadata execution checks.\n\nReproduced on main ec3db3745: 35 passed, 4 failed. After the fix: 104 release and CI boundary tests pass; check:fast and format:check pass.\n", "parents": ["2995ec6910ead327829378f5ab1b9172ecce33fc"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "3af8f847f0e35843f51622a136165dd6ee12cdd0", "subject": "ci: fix PR metadata triggers and defer expensive runner work", "body": "ci: fix PR metadata triggers and defer expensive runner work\n", "parents": ["747e7299141cec0b03774c427f579889d5088d20"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "f0f09950f34d96e3b1c62fd04821af5e301f80c7", "subject": "ci: finish main validation and balance complete test costs", "body": "ci: finish main validation and balance complete test costs\n", "parents": ["3af8f847f0e35843f51622a136165dd6ee12cdd0"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "9f3f392eb8fe81060b44941ed754521984def3bd", "subject": "ci: bound core job execution time", "body": "ci: bound core job execution time\n\nLimit classification to five minutes, static/build/docs/report jobs to ten minutes, and each portable shard to thirty minutes. The saved successful-job sample peaked at 392 seconds per shard and 61 seconds for other core jobs, leaving generous setup and coverage headroom. Runner queue waiting is unaffected.\n", "parents": ["f0f09950f34d96e3b1c62fd04821af5e301f80c7"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "bd2c202dd930548194cdbc55c27a797f22279db9", "subject": "fix(ci): reject incomplete verification plans", "body": "fix(ci): reject incomplete verification plans\n", "parents": ["9f3f392eb8fe81060b44941ed754521984def3bd"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "c8d861f9764f8c07f0925dae0c6451de85fffd6a", "subject": "ci: scope timing helpers to portable verification", "body": "ci: scope timing helpers to portable verification\n", "parents": ["bd2c202dd930548194cdbc55c27a797f22279db9"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "fa0a9b2d328a07d8ec2924dc224d51c620981dcc", "subject": "ci: observe affected-owner test plans against full results", "body": "ci: observe affected-owner test plans against full results\n", "parents": ["c8d861f9764f8c07f0925dae0c6451de85fffd6a"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "490a285070268aee0ecd50001b9a9a83c1e313f0", "subject": "ci: reuse current-run builds across provider lanes", "body": "ci: reuse current-run builds across provider lanes\n", "parents": ["fa0a9b2d328a07d8ec2924dc224d51c620981dcc"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "fb28ec1537e2d02aaca96325483c849c5c8ade6f", "subject": "test(apple): keep the same-named slice dyld fixture openable on x64 hosts (#2755)", "body": "test(apple): keep the same-named slice dyld fixture openable on x64 hosts (#2755)\n\nAdd a plain x86_64 slice to the dyld fixture while retaining both same-named arm64e slices and their independent environment assertions.\n\nThe original fixture was rejected by real x64 CLI admission before tracing. The contributing PR's complete Linux CI run passes all 30 jobs, including the portable suite. Codex and Greptile reviews completed without findings; no unresolved threads remain.\n\nThis restores the main test baseline needed for #2635. The change is limited to test data and preserves the original author's contribution.\n\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>", "parents": ["490a285070268aee0ecd50001b9a9a83c1e313f0"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } } ], "pullRequests": [2755] }, { "sha": "c95315d2ce365dd7a31aa67c8c13f4a99f209ced", "subject": "fix(cli): reject unterminated output filter slices (#2315)", "body": "fix(cli): reject unterminated output filter slices (#2315)", "parents": ["fb28ec1537e2d02aaca96325483c849c5c8ade6f"], "authors": [ { "name": "Liu Jie", "email": "maxazure@gmail.com", "user": { "login": "maxazure", "__typename": "User" } } ], "pullRequests": [2315] }, { "sha": "1dd6c2dff9252c27838589590e07f809a9b1ff42", "subject": "fix(setup): resolve DeepSeek Harness home overrides (#2461)", "body": "fix(setup): resolve DeepSeek Harness home overrides (#2461)", "parents": ["c95315d2ce365dd7a31aa67c8c13f4a99f209ced"], "authors": [ { "name": "Guangqi Zhang", "email": "2065586050@qq.com", "user": { "login": "saya-ch", "__typename": "User" } } ], "pullRequests": [2461] }, { "sha": "68ecdcd7a130806a03067fbfcce5ee90c70b968f", "subject": "fix(reference): preserve directory intent when resolving source imports (#2770)", "body": "fix(reference): preserve directory intent when resolving source imports (#2770)\n\nKeep directory requests from becoming unresolved or pointing at sibling files\nwhen constructing reference-source dependency graphs. Canonicalize index\ncandidates and preserve directory intent while retaining ordinary lookup rules.\n\nConstraint: Preserve current TypeScript candidate objects and exact-before-Unicode lookup\nRejected: Reorder all file probes before index probes | Changes ordinary CommonJS candidate priority\nConfidence: high\nScope-risk: narrow\nTested: Public CLI regression fails on base; focused reference and resolver suites pass; npm run check\nNot-tested: Full suite on refreshed base; earlier full run had 12 baseline-reproduced failures", "parents": ["1dd6c2dff9252c27838589590e07f809a9b1ff42"], "authors": [ { "name": "Shenrui Ma", "email": "115921185+Shenrui-Ma@users.noreply.github.com", "user": { "login": "Shenrui-Ma", "__typename": "User" } } ], "pullRequests": [2770] }, { "sha": "f90382756d4625d2a50b0cf6a4c30de038289b9a", "subject": "fix(native): keep bounded trace edges and depth consistent (#2758)", "body": "fix(native): keep bounded trace edges and depth consistent (#2758)", "parents": ["68ecdcd7a130806a03067fbfcce5ee90c70b968f"], "authors": [ { "name": "Iven Koo", "email": "73214171+IvenKooLab@users.noreply.github.com", "user": { "login": "IvenKooLab", "__typename": "User" } } ], "pullRequests": [2758] }, { "sha": "cd2ad1f24084e68910e4ceab4a33e1b88998ebe7", "subject": "fix(artifacts): report malformed ZIP archives as format failures (#2683)", "body": "fix(artifacts): report malformed ZIP archives as format failures (#2683)\n\n* fix(artifacts): report malformed ZIP archives as format failures\n\nzip.js signals archive faults (missing end-of-central-directory record,\nunrecognized format, overlapping members, corrupt member data,\nunsupported compression) as plain Errors. ZipArtifactReader passed them\nthrough untyped, so the artifact provider's fallback reported every one\nas `io` with no detail and told the caller to \"check file access\".\n\nType these faults at the ZIP reader boundary: structural and data\ncorruption become `format` failures and unsupported archive features\nbecome `unavailable`, each carrying the zip.js reason as detail. This\ncovers enumeration, the getData rejection, and the WritableStream abort\npath that delivers corrupt-data errors first.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* test(artifacts): share the ZIP inventory failure assertion\n\nCo-Authored-By: Claude Opus 5.5 \n\n---------\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["f90382756d4625d2a50b0cf6a4c30de038289b9a"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2683] }, { "sha": "f974353c329ebfa58ba5f268078da30952a82ec0", "subject": "fix(javascript): keep paths after __dirname inside the source directory (#2366)", "body": "fix(javascript): keep paths after __dirname inside the source directory (#2366)\n\nNode's path.join does not reset at an absolute segment, so\npath.join(__dirname, '/preload.js') is /preload.js. The static path\nprojection skipped the __dirname anchor and joined the remaining parts,\nwhich turned that common spelling into the root path /preload.js. In an\napp whose main script lives in src/, the BrowserWindow preload was then\nreported not-found, or resolved to an unrelated preload.js at the artifact\nroot, and the utilityProcess.fork target was never resolved. String\nconcatenation had the same defect: path.dirname(__filename) +\n'/preload.js' projected to /preload.js, and __dirname + '/preload.js'\nstayed unknown.\n\nA source directory now contributes \".\" to a join, so path.join(__dirname)\nprojects to \".\" like path.resolve(__dirname). A concatenation that starts\nwith __dirname or the source file's dirname keeps text that begins with a\nseparator inside that directory; other text extends the directory's own\nname and stays unknown. The empty-string projection of\npath.dirname(__filename), which produced the wrong concatenation, is\nremoved, so a bare path.dirname(__filename) is unknown like a bare\n__dirname.", "parents": ["cd2ad1f24084e68910e4ceab4a33e1b88998ebe7"], "authors": [ { "name": "Chaoqi", "email": "136579807+Chaoqi31@users.noreply.github.com", "user": { "login": "Chaoqi31", "__typename": "User" } } ], "pullRequests": [2366] }, { "sha": "eeeb4ca379a948109542e66a8d0adb3998f6f60d", "subject": "fix(javascript): preserve container ownership for getter mutations (#2765)", "body": "fix(javascript): preserve container ownership for getter mutations (#2765)", "parents": ["f974353c329ebfa58ba5f268078da30952a82ec0"], "authors": [ { "name": "To3akaRin", "email": "131595336+To3akaRin@users.noreply.github.com", "user": { "login": "To3akaRin", "__typename": "User" } } ], "pullRequests": [2765] }, { "sha": "a8b50ea147ab3aaa2870160481e09403c3310ea0", "subject": "refactor(firmware): split verification into staged functions (#2713)", "body": "refactor(firmware): split verification into staged functions (#2713)\n\nRefactor firmware verifier into staged functions\n\nRestructure scripts/verify/firmware/analysis.mjs for readability without changing behavior.\r\n\r\n- Move prerequisite checks into checkPrerequisites()\r\n- Split the main flow into stageCli, stageMcp, stageExt4 and stageGhidra\r\n- Extract timeouts and size limits into named constants\r\n- Rename cli/call helpers to runCli/callTool\r\n\r\nChecks, order of operations, error messages and env vars are unchanged.\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["eeeb4ca379a948109542e66a8d0adb3998f6f60d"], "authors": [ { "name": "Shreyansh Jain", "email": "136733716+ShreyanshJain105@users.noreply.github.com", "user": { "login": "ShreyanshJain105", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2713] }, { "sha": "fcfa5b7e88e2251359950d3fcca8a1ae61dc6814", "subject": "fix(artifacts): distinguish JVM classes from universal Mach-O files (#2327)", "body": "fix(artifacts): distinguish JVM classes from universal Mach-O files (#2327)\n\n* test(artifacts): reproduce JVM class inventory misclassification\n\n* fix(artifacts): validate FAT declarations before classifying executables\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["a8b50ea147ab3aaa2870160481e09403c3310ea0"], "authors": [ { "name": "Jeongwan Jeon", "email": "jjw@jjw.kr", "user": { "login": "jeonjw85", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2327] }, { "sha": "d85374496965a8a997e1d13e98a27ff5e5ca1077", "subject": "fix: preserve process identities in pwntools cleanup errors (#2284)", "body": "fix: preserve process identities in pwntools cleanup errors (#2284)\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["fcfa5b7e88e2251359950d3fcca8a1ae61dc6814"], "authors": [ { "name": "Jeongwan Jeon", "email": "jjw@jjw.kr", "user": { "login": "jeonjw85", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2284] }, { "sha": "2f3dee3fcf65813d6daf7c3209d921451c160ddb", "subject": "test(javascript): verify Windows path case and load scope (#2635)", "body": "test(javascript): verify Windows path case and load scope (#2635)\n\nSelect the Windows curated lane for edits to the shared runtime path matcher and its workflow suite. Strengthen the existing POSIX/Windows mapping controls with matching basis, coherent target/script coordinates, caller spelling and static load-state assertions.\n\nFollow-up to #2422; thanks to @Aurantium-47 for identifying the recorded-path grammar issue.\n\nVerified with actual Windows 11 x64, official Node 24.18.0 and production CLI/MCP workflows using published npm 11.16.0 module Evidence. Four exact/mismatched implicit/explicit mapping cases pass with unchanged normalized hashes. The capture provider was Node Inspector; no IDA, Ghidra or Electron GUI verification is claimed.\n\n230 focused tests, all eight CI static tasks, architecture guards and documentation checks pass after rebasing onto main fb28ec153. The unrelated release-checkpoint and dyld fixture corrections were integrated from upstream; no patches to those files are included here. Final Windows MCP replay at e6e86946d preserves all four normalized hashes, with no owned Node processes remaining. Resource probes ran serially at BelowNormal priority with one CPU and 512 MiB Node heaps; calls took 251–620 ms and the sampled process-family working-set sum peaked at 499,380,224 bytes. Source pins, provenance and measurement limits are recorded in experiments/analysis-efficiency/windows-posix-reconciliation.md.\n\nAll 34 jobs in current-head CI run 38391921571 passed, including the Windows capability/package lane, all six portable test shards, JavaScript recovery and the required aggregate. Current-head Codex and Greptile reviews are clean; both prior scope-selection findings were fixed and resolved.", "parents": ["d85374496965a8a997e1d13e98a27ff5e5ca1077"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [2635] }, { "sha": "8823c55b0ce325cf9edb7d2f9aadaf39db4e8f31", "subject": "feat(ghidra): decode Swift String literals in function dossiers (#2049)", "body": "feat(ghidra): decode Swift String literals in function dossiers (#2049)\n\n* feat(ghidra): decode Swift String literals in function dossiers\n\nSwift passes a String as two words. Small literals keep their UTF-8 bytes\ninside those words, and immortal large literals keep a count plus a pointer\nto their bytes biased by 32. Ghidra creates no data reference for either, so\nanalyze_function reported no strings for Swift code.\n\nOn AArch64 programs that contain Swift metadata, the Ghidra bridge now runs\nconstant propagation over the function and decodes register pairs where\nSwift consumes a String: consecutive argument registers at calls and tail\ncalls, x0 and x1 at returns, and both registers of one STP. Large literals\nmust resolve to terminated bytes inside one initialized block that is not\nexecutable. A pair whose registers both come from conditional selects is\nskipped, because Ghidra forks each select without correlating the\ncondition and could otherwise pair words from different cases.\n\nDecoded values are a derivation from the ABI layout rather than observed\nreferences, so they appear in a new optional swift_string_literals field\nwith their source instruction, registers and raw words, and in a matching\ninspect_analysis_view facet. referenced_strings is unchanged.\n\nRefs #2030\n\n* fix(ghidra): bound Swift literal reads and compare decoded strings\n\nLarge immortal literals are measured against the remaining heap before\nallocation, and a failed fit stays visible as a limitation. The canonical\nempty string is kept. Small and large literals now require matching\naddress nullability, and function comparison treats decoded literals as\nstring evidence without equating a missing record to an empty one.\n\n* fix(ghidra): budget Swift literal decoding and tighten use sites\n\nLarge literals now draw on one heap budget per dossier, measured once\nbefore decoding, instead of a separate check per literal. A literal that\ndoes not fit is listed in a new swift_string_literal_omissions field\nwith its address, byte length and reason, so consumers read omissions\nfrom structured data rather than from limitation text.\n\nstrings_names comparison checks referenced strings and names first and\nreports a change there even when Swift literal coverage differs; it\nreturns unknown only when those facts match and literal coverage is\nabsent on one side or partial.\n\nA computed jump counts as a tail call only when it has no resolved\ntarget inside the function, so jump tables no longer qualify, and a\nreturn requires a RETURN p-code operation, so traps no longer qualify.\n\nDecoded literals keep control characters, which Swift strings may\ncontain and JSON escapes. The Swift verifier builds the literal fixture\nfor arm64 on any Mac host and now also covers the empty string and a\nliteral containing a tab.\n\n* fix(ghidra): charge escaped JSON and follow copied selects\n\nThe Swift literal budget now charges the worst case per UTF-8 byte: UTF-16\ntext, six escaped JSON characters held in Gson's growing buffer and in the\nreturned String, and the UTF-8 bytes written to the socket. Literals made\nof control characters can no longer exceed the reserved heap.\n\nA jump counts as a tail call only when every resolved target lies outside\nthe function. The conditional select check follows register copies back\nto their definition, so selects copied into argument registers are\nrecognized like selects written there directly.\n\nstrings_names reports a change when both dossiers decoded different\nliterals at the same use site, even when either side has omissions; it\nreturns unknown only when no such use site disagrees.\n\n* fix(ghidra): bound literal records and trace selects across branches\n\nEvery Swift literal record now pays a fixed cost against the dossier\nbudget in addition to its text, so many empty or small literals are\nbounded as well. The first record that does not fit is kept as an\nomission and decoding stops there, which keeps the omission record\nitself bounded; omissions now describe small or large literals.\n\nThe conditional select check searches every predecessor path for the\nreaching definitions, following register copies, so selects made\nbefore a branch into the use block are recognized.\n\nA dossier records Swift literals and their omissions together. Coverage\nreads omissions first, and strings_names compares every use site that\nneither side omitted: a decoded literal is known where it was recorded,\nand an absence is known only in a dossier whose decoding examined every\nuse site.\n\n* fix(ghidra): stop every flow at the literal budget and route omissions\n\nEnding one flow from the evaluator leaves other queued flows running, so\nthe budget now records a shared stop that every flow checks before it\nexamines another instruction. A record that exceeds the budget is routed\nby that capacity result rather than by whether text was decoded, so a\nsmall literal over budget becomes an omission instead of a literal.\n\nWhen coverage is partial, the per site comparison keeps each literal's\nrepresentation as well as its value, matching the full strings_names\nprojection.\n\n* fix(ghidra): keep unresolved Swift tail-call sites unknown\n\n---------\n\nCo-authored-by: Cursor Agent \nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["2f3dee3fcf65813d6daf7c3209d921451c160ddb"], "authors": [ { "name": "Omisakin Joshua", "email": "117924167+thefolahan@users.noreply.github.com", "user": { "login": "thefolahan", "__typename": "User" } }, { "name": "Cursor Agent", "email": "cursoragent@cursor.com", "user": { "login": "cursoragent", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2049] }, { "sha": "ec4f4ddc588a564b75d69249b4ebbe4d4051c792", "subject": "fix(ghidra): read UTF-8 signed language definitions (#2772)", "body": "fix(ghidra): read UTF-8 signed language definitions (#2772)\n\nBuffer#toString kept a leading UTF-8 byte order mark as U+FEFF, so the\nstrict XML parser rejected a valid .ldefs file as content outside the root\nelement and aborted the whole language catalog read. XML 1.0 section 4.3.3\ndefines the mark as an encoding signature; decode with TextDecoder, which\nconsumes it. Malformed XML is still rejected.\n\nFixes #2533\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["8823c55b0ce325cf9edb7d2f9aadaf39db4e8f31"], "authors": [ { "name": "yasshmittal", "email": "yash.mittal@op.iitg.ac.in", "user": { "login": "yasshmittal", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2772] }, { "sha": "84cf7791a881e5b16a0288600fbc8d48d494ef01", "subject": "fix(call-path): keep caller-only unknown coverage from blocking not_found (#2371)", "body": "fix(call-path): keep caller-only unknown coverage from blocking not_found (#2371)\n\n* fix(call-path): keep caller-only unknown coverage from blocking not_found\n\nbuild_call_path expands only callee edges, so relationship coverage that\nis unknown solely because callers are unobservable (the modern headless\nIDA profile) no longer marks the searched callee closure incomplete.\nThe caller caveat stays visible in limitations, and callee-side unknowns\nstill yield unknown. Fixes #2322.\n\n* test(call-path): cover IDA-capped callees beside unknown callers\n\nGreptile review noted the poll-timing coverage only exercised unknown\ncallees, leaving the partial callees IDA returns at its 500-result cap\nuntested. Add the combined unknown-callers/partial-callees case:\nisCallerOnlyUnknownCoverage must stay false and buildCallPath must keep\nsearch_scope.exhaustive false, so a future change cannot silently report\nnot_found when IDA has omitted callees.", "parents": ["ec4f4ddc588a564b75d69249b4ebbe4d4051c792"], "authors": [ { "name": "Saim Shafique", "email": "msaimshafique4664@gmail.com", "user": { "login": "sx4im", "__typename": "User" } } ], "pullRequests": [2371] }, { "sha": "1ca5fd38b4833ac3fe6213a55e5abfd426228266", "subject": "fix(cli)!: keep a selected JSON null in --filter-output output (#2333)", "body": "fix(cli)!: keep a selected JSON null in --filter-output output (#2333)\n\ncreateCliResultOutput rendered an explicit null selected by\n--filter-output as the empty document {}, the same output it uses when\nthe selection has no value at all. On the streamed JSON/JSONL path,\na consumer could not distinguish a selected null from a missing field.\n\nWrite a selected null as null in streamed JSON and JSONL. This also\npreserves an unfiltered top-level null. The {} fallback stays for\nundefined, functions and symbols. The --full-output envelope already\ncarried data: null for a selected null. The --token-count path still\nhands results that fit the formatted-string limit back to Incur and\nprints 0 for a selected null. Other formats and Incur-owned result\npaths are unchanged.\n\nConsumers must accept JSON null for a present null and distinguish it\nfrom a missing selection. Use --full-output if an object envelope is\nrequired. Keeping the old shared {} representation would continue\nhiding this distinction.\n\n\nClaude-Session: https://claude.ai/code/session_019TTGAv6fe859ebbCLLfLHP\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["84cf7791a881e5b16a0288600fbc8d48d494ef01"], "authors": [ { "name": "Jack Liang", "email": "130693642+Jackmeson1@users.noreply.github.com", "user": { "login": "Jackmeson1", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2333] }, { "sha": "36132d3e1770c8b69f86c86821d2c872234e370a", "subject": "fix(managed): classify 32-bit-preferred assemblies as platform neutral (#2342)", "body": "fix(managed): classify 32-bit-preferred assemblies as platform neutral (#2342)\n\nThe CLI header's 32BITREQUIRED and 32BITPREFERRED bits are one two-bit\nfield. Reading 32BITREQUIRED on its own reported Prefer32Bit assemblies\n(flags 0x00020003) as x86-only with requires_32bit true, and left\nanycpu-prefer-32 reachable only through the reserved combination.\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["1ca5fd38b4833ac3fe6213a55e5abfd426228266"], "authors": [ { "name": "Jin", "email": "a3239737781@gmail.com", "user": { "login": "huiq777", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2342] }, { "sha": "d3a55720fc4aac8f9d2c5f5a4c9f20cdf5594d8e", "subject": "fix(setup): keep Hermes config numbers as written (#2368)", "body": "fix(setup): keep Hermes config numbers as written (#2368)\n\nSetup and uninstall re-printed every number in an existing Hermes\nconfig.yaml from a JavaScript number. Hermes reads the file as YAML 1.1\nwith exact integers, so a Discord channel ID lost its low digits, an\noctal mode such as 0600 became 600, and 0.0000001 became 1e-7, which\nYAML 1.1 does not define as a float. Two IDs that round to the same\ndouble were also rejected as duplicate keys, so setup could not\nregister at all.\n\nHermes YAML parsing and editing move to HermesConfigurationYaml. A parsed\nnumber is written with its source spelling while that spelling still\nreads as the node's value, the rule yaml's own boolean tag follows, and\ntwo keys are duplicates only when both their value and their spelling\nmatch. Parsed values stay JavaScript numbers.", "parents": ["36132d3e1770c8b69f86c86821d2c872234e370a"], "authors": [ { "name": "Chaoqi", "email": "136579807+Chaoqi31@users.noreply.github.com", "user": { "login": "Chaoqi31", "__typename": "User" } } ], "pullRequests": [2368] }, { "sha": "f63674cac0329aa3ed76234b31cf8a3536ac07d0", "subject": "docs(browser): clarify attach coverage and Chromium setup (#2287)", "body": "docs(browser): clarify attach coverage and Chromium setup (#2287)\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["d3a55720fc4aac8f9d2c5f5a4c9f20cdf5594d8e"], "authors": [ { "name": "Danish Rafie Ekaputra", "email": "155859586+0xRafie@users.noreply.github.com", "user": { "login": "0xRafie", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2287] }, { "sha": "0ca70e121c43db41d02c5afb6439e15cbf335289", "subject": "fix(ghidra): pre-create the launch-support config directory (#2470)", "body": "fix(ghidra): pre-create the launch-support config directory (#2470)\n\n* fix(ghidra): pre-create the launch-support config directory\n\nGhidra's launch support resolves its JDK before the headless run starts and\npersists that choice under `/ghidra/`. Inside REA's\nprivate runtime a child JVM cannot create those directories, so the first\nWindows Ghidra query aborted at ghidra.launch.AppConfig.saveJavaHome with:\n\n java.io.IOException: Failed to create directory:\n ...\\config\\ghidra\\ghidra_12.1.4_PUBLIC\n at ghidra.launch.AppConfig.saveJavaHome(AppConfig.java:145)\n at LaunchSupport.findJavaHome(LaunchSupport.java:210)\n\nLaunchSupport then fell back to its interactive prompt, read EOF, and reported\n\"JDK 21+ (64-bit) could not be found and must be manually chosen!\", so the\nprovider failed with \"Ghidra exited before bridge startup\" even though\n`rea doctor` reported a valid Ghidra installation and JDK.\n\nCreate the release directory while this process still owns the runtime, leaving\nGhidra only a file write inside it. The release coordinate comes from the\ninstallation's Ghidra/application.properties (application.version plus\napplication.release.name) with the extraction directory name as a fallback. On\nWindows each level goes through the native private-runtime owner, which opens\nevery existing component and creates only the final one.\n\nVerified on Windows x64 with Ghidra 12.1.4, a 64-bit Temurin JDK 21, and REA's\npackaged native addon: `rea inspect --provider ghidra` and the\nequivalent MCP `binary_overview` call both complete and report 21 segments,\n1436 procedures, and 2761 strings. Windows Ghidra remains read-only P0; this\nchange does not extend that boundary.\n\n* style(ghidra): format launch configuration regressions\n\n* fix(ghidra): reuse Java Properties parsing for launch release identity\n\n---------\n\nCo-authored-by: AbdulAzizShanShi <441650742@QQ.COM>\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["f63674cac0329aa3ed76234b31cf8a3536ac07d0"], "authors": [ { "name": "AbdulAzizWang", "email": "95555196+AbdulAzizWang@users.noreply.github.com", "user": { "login": "AbdulAzizWang", "__typename": "User" } }, { "name": "AbdulAzizShanShi", "email": "441650742@QQ.COM", "user": { "login": "AbdulAzizShanShi", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2470] }, { "sha": "03ab521db3330493372dd47ab858fc142feea5b9", "subject": "fix(process): resolve POSIX backslash basenames through PATH (#2471)", "body": "fix(process): resolve POSIX backslash basenames through PATH (#2471)\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["0ca70e121c43db41d02c5afb6439e15cbf335289"], "authors": [ { "name": "Rudy Mizrahi Celekli", "email": "47457359+rudycelekli@users.noreply.github.com", "user": { "login": "rudycelekli", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2471] }, { "sha": "43738bec579fc69bab084bffa964916d43d43ed1", "subject": "fix(targets): retain unsupported PE machine in diagnostics (#2448)", "body": "fix(targets): retain unsupported PE machine in diagnostics (#2448)\n\nAssisted-by: OpenAI GPT-6 \n\nCo-authored-by: Aurantium-47 <280805072+Aurantium-47@users.noreply.github.com>", "parents": ["03ab521db3330493372dd47ab858fc142feea5b9"], "authors": [ { "name": "Aurantium", "email": "3550271410@qq.com", "user": { "login": "Aurantium-47", "__typename": "User" } }, { "name": "Aurantium-47", "email": "280805072+Aurantium-47@users.noreply.github.com", "user": { "login": "Aurantium-47", "__typename": "User" } } ], "pullRequests": [2448] }, { "sha": "8e6f37e2a0873ac21ebcc889c27839bfcb7552ca", "subject": "fix(formats): preserve high bits in remaining magic-byte checks (#2384)", "body": "fix(formats): preserve high bits in remaining magic-byte checks (#2384)\n\n* fix(formats): preserve high bits in remaining magic-byte checks\n\nNode's \"ascii\" decoder masks the high bit, so byte-for-byte signature\ncomparisons accepted lookalikes such as CD DA (\"MZ\" | 0x80) or a\nhigh-bit \"bplist00\"/\"NIBArchive\" header. ac57c88ef fixed this for the\nshared DOS/MZ reader; apply the same latin1 decoding to the remaining\nsignature checks: NativeAOT and Windows native loader MZ/PE, binary\nplist and NIBArchive detection, and PNG IHDR checks.\n\nDisplay-name decodes (section and metadata stream names) are unchanged.\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \n\n* style(windows): format signature admission regressions\n\n---------\n\nCo-authored-by: Claude Opus 5.5 (1M context) \nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["43738bec579fc69bab084bffa964916d43d43ed1"], "authors": [ { "name": "Lucas LSMO", "email": "luskoliveira@protonmail.com", "user": { "login": "lusknchars", "__typename": "User" } }, { "name": "Claude Opus 5.5 (1M context)", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2384] }, { "sha": "e0bd31c18c84fc406ad1c1fe412bc9018ede44ec", "subject": "fix(ghidra): bound the Java version probe output (#2361)", "body": "fix(ghidra): bound the Java version probe output (#2361)\n\nThe Java version probe captured its output with maxBuffer set to Infinity, so a\nchatty or hostile JVM selected as the Ghidra launcher could grow the captured\nstdout/stderr without limit and exhaust REA's memory during installation\ndiscovery. Bound the capture to 1 MiB, matching the budget already used for\nother Java listings. A probe that exceeds the budget yields no observation and\nis reported through the existing failed-probe path, the same one the Java check\nalready uses whenever the probe cannot produce an observation.\n\nCo-authored-by: Claude Code ", "parents": ["8e6f37e2a0873ac21ebcc889c27839bfcb7552ca"], "authors": [ { "name": "Dery Ferdika", "email": "114888155+DeryFerd@users.noreply.github.com", "user": { "login": "DeryFerd", "__typename": "User" } }, { "name": "Claude Code", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2361] }, { "sha": "5f8af4ee5f615e97f343d70d91a74568d0ec9fbd", "subject": "feat(ida): resolve containing procedures and report the admitted program as the document (#2374)", "body": "feat(ida): resolve containing procedures and report the admitted program as the document (#2374)\n\n* test(mcp): expect trace_feature to report references the provider truncated\n\nA provider that reports a capped xrefs read makes the trace truncated with a residual unknown for that target. An explicit complete report and a provider that reports nothing leave the trace as before.\n\n* fix(mcp): report references a provider truncated in trace_feature\n\nExecutions gain an optional flag for a capped xrefs read, set by the IDA adapter from the upstream cap. trace_feature marks the trace truncated with a residual unknown for that target only when the provider reports a truncation; a provider that reports nothing keeps its previous result. The trace_feature workflow profile is revised so earlier results are not replayed.\n\n* refactor(ida): report reference truncation whenever the runner observed an xrefs cap\n\n* test(mcp): cover session forwarding, per-target state, native reports and failures of the trace coverage\n\n* test(mcp): format the session forwarding test\n\n* test(ida): expect headless IDA to resolve containing procedures from lookups and segment facts\n\nCover positive and negative containment, segment boundaries including addresses above 2^53, failures of the lookup and of the segment survey, cancellation, input validation and the admitted program as the only document.\n\n* test(ida): expect feature tracing and address context to work on headless IDA\n\nRun trace_feature, including a capped reference read, and inspect_address_context with and without an explicit document through the IDA session client.\n\n* test(mcp): expect trace_feature availability to follow the search operations it calls\n\n* fix(mcp): derive trace_feature availability from the search operations it calls\n\n* feat(ida): resolve containing procedures and report the admitted program as the document\n\nThe modern headless profile resolves an address through the function lookup and, when no function contains it, tells a mapped address from an unmapped one using the database-scoped minimal survey. A survey that is missing, truncated or inconsistent fails the read. list_documents reports the single admitted program. The attached profiles do not declare either operation.\n\n* docs(ida): describe containing procedures, the admitted document and truncated feature traces\n\n* test(ida): verify containing procedures, the admitted document and feature tracing on real IDA\n\n* docs(testing): list the headless IDA workflows the real lane verifies\n\n* test(ida): make each survey failure case isolate a single defect\n\n* test(ida): pin large addresses, segment order, document identity, attached refusals and each trace_feature prerequisite\n\n* test(mcp): expect a repeated reference source to be resolved once in trace_feature\n\n* fix(mcp): resolve the containing procedure of a repeated reference source once\n\n* test(ida): trace the fixture procedure and derive probe addresses from its facts in the real lane\n\n* test(process): format processCaptureLifecycle.test.ts after the merge\n\n* test(ida): declare the alignment each synthetic universal slice offset satisfies\n\n* refactor(ida): move the real lane's feature trace assertions into a helper\n\n* test(ida): expect the real lane's feature trace check to accept references to every matched address\n\n* fix(ida): check each trace reference against its own matched address in the real lane\n\n* test(ida): pin that the new operations reject a document other than the admitted program\n\n* refactor(ida): move the real lane's mapped non-function probe into a helper\n\n* test(ida): expect the real lane's mapped data probe to skip strings inside functions\n\n* fix(ida): try the target's strings in order for the mapped non-function probe\n\n* test(ida): declare the real lane helper types for the verifier tests\n\n* test(ida): expect the real lane to reject a listed string that resolves as unmapped\n\n* fix(ida): fail the real lane when a listed string resolves as unmapped", "parents": ["e0bd31c18c84fc406ad1c1fe412bc9018ede44ec"], "authors": [ { "name": "Mykola Dementiev", "email": "nikolay-dementiev@users.noreply.github.com", "user": { "login": "nikolay-dementiev", "__typename": "User" } } ], "pullRequests": [2374] }, { "sha": "2a61deafc632079d10c572bc09e99233826516a3", "subject": "fix(adb): report the device state when a push cannot probe the path (#2354)", "body": "fix(adb): report the device state when a push cannot probe the path (#2354)\n\nA push without overwrite read any unclassified failure of its existence\nprobe as an existing path, so an offline or unauthorized device was\nreported as \"the device path already exists\". With overwrite it pushed\nafter a probe that had not established anything. The probe's own\nrefusal is now returned in both cases.\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["5f8af4ee5f615e97f343d70d91a74568d0ec9fbd"], "authors": [ { "name": "Jin", "email": "a3239737781@gmail.com", "user": { "login": "huiq777", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2354] }, { "sha": "4ea24f97670bebf8ca053179ca0dc5009e6f6a28", "subject": "fix(ida): retain private input after ambiguous open (#1845)", "body": "fix(ida): retain private input after ambiguous open (#1845)\n\nfix(ida): retain private input after unverified open", "parents": ["2a61deafc632079d10c572bc09e99233826516a3"], "authors": [ { "name": "jhuang-tw", "email": "77732008+jhuang-tw@users.noreply.github.com", "user": { "login": "jhuang-tw", "__typename": "User" } } ], "pullRequests": [1845] }, { "sha": "928b4d5fe4523e3226aeb865f105e3f711bc8ed3", "subject": "fix(plist): decode formatted XML dictionary keys (#1843)", "body": "fix(plist): decode formatted XML dictionary keys (#1843)\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["4ea24f97670bebf8ca053179ca0dc5009e6f6a28"], "authors": [ { "name": "Aliciawque", "email": "166712943+Aliciawque@users.noreply.github.com", "user": { "login": "Aliciawque", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [1843] }, { "sha": "d2e16b2a4998818be5f29219467b97cc15ae8061", "subject": "fix(sqlite): attribute unknown column selections to columns (#2774)", "body": "fix(sqlite): attribute unknown column selections to columns (#2774)\n\nEvery worker \"selection\" rejection was projected onto the table argument,\nincluding an exact column name that does not exist in an existing table.\nGive column rejections their own worker reason and map each input reason\nto the caller argument it requires correcting. Table rejections keep the\ntable path.\n\nFixes #2613\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["928b4d5fe4523e3226aeb865f105e3f711bc8ed3"], "authors": [ { "name": "yasshmittal", "email": "yash.mittal@op.iitg.ac.in", "user": { "login": "yasshmittal", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2774] }, { "sha": "df04f99df018e205138490557d46068adcc4ccad", "subject": "fix(readiness): deduplicate stage-level missing-evidence findings (#2203)", "body": "fix(readiness): deduplicate stage-level missing-evidence findings (#2203)\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["d2e16b2a4998818be5f29219467b97cc15ae8061"], "authors": [ { "name": "Luis Araya", "email": "35828647+Totopo27@users.noreply.github.com", "user": { "login": "Totopo27", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2203] }, { "sha": "91830f1e0e68232e991902b0fa7617651d2eee15", "subject": "feat(managed): name the declaring type of call and field targets (#2163)", "body": "feat(managed): name the declaring type of call and field targets (#2163)\n\n* feat(managed): name the declaring type of call and field targets\n\nCall edges named external targets by member name alone (Join, ToJson,\nWriteAllText), and method-spec edges had no name at all, so an analyst could\nnot tell which library a method calls or find every use of a type without a\ndecompiler. Field accesses through MemberRefs had no name either.\n\nName each TypeDef, TypeRef, and generic-instantiation TypeSpec once, in the\nnamespace-qualified form TypeDef full_name uses, and add member_refs\nparent_name, call_edges target_declaring_type, and field_accesses\nfield_declaring_type. A method-spec target reports the generic method it\ninstantiates. Fields, member references, methods, and method specs now\nresolve through one token-keyed MemberCore lookup instead of three maps.\nEvidence recorded before these fields reads them as null.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(managed): validate spec blobs and member kinds before naming targets\n\nAddress review findings on declaring-type naming:\n\n- A generic instantiation must name a TypeDef or TypeRef, so a TypeSpec\n base is reported as malformed instead of followed. Naming no longer\n recurses.\n- TypeSpec and MethodSpec instantiation blobs are decoded with the\n member-signature grammar. Malformed blobs and out-of-range TypeDef rows\n are reported against their owning row and make coverage partial.\n- A MethodSpec reads both columns. An invalid Method coded index is\n reported; a readable Method keeps its name beside a malformed\n instantiation.\n- MemberCore carries its signature kind, so a field operand is named only\n by a field or field-signature MemberRef. This replaces the token-table\n guard.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(managed): validate MethodSpec arity and report unsupported spec blobs\n\n- A MethodSpec now checks that its method signature is generic and that\n the instantiation supplies as many type arguments as it declares. A\n non-generic target, a field reference, or a count mismatch is reported\n as invalid-row; the readable method keeps its name.\n- Unsupported TypeSpec and MethodSpec forms raise an owner-scoped\n unsupported-signature issue instead of reading as an intentional\n unknown.\n- MethodSpec reading moves to ManagedMethodSpecs.ts, and its tests get\n their own describe block.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(managed): reject non-method signature headers and invalid TypeRef scopes\n\nThe method signature header reader now owns the calling-convention rule\nthat only FNPTR applied: FIELD, LOCAL_SIG, PROPERTY, and GENERICINST\nheaders, the reserved bit, and EXPLICITTHIS without HASTHIS are malformed.\nA MethodSpec whose method has a PROPERTY header is no longer accepted as a\ngeneric method, and member signatures with such headers no longer decode\nas methods.\n\nThe type-name lookup validates a TypeRef's ResolutionScope coded index and\nreports an out-of-range scope as invalid-row, keeping the readable name.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(managed): hold member rows to MethodDefSig and FieldSig headers\n\nMethod signature headers are now checked in context. MethodDef and\nMemberRef rows accept only the MethodDefSig/MethodRefSig headers: DEFAULT,\nVARARG, or GENERIC with DEFAULT. FNPTR keeps the unmanaged conventions\ncompilers emit for function pointers. A field signature must be exactly\nFIELD, so a flagged FIELD header is malformed and never names a field.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(managed): accept MethodSpec arity only from a fully decoded signature\n\nThe arity check read only the target's signature header, so a truncated\ngeneric method signature passed. Under type selection a MethodDef target\noutside the selection is never decoded elsewhere, so coverage stayed\ncomplete. The arity now comes from a transient full decode, and only a\ndecoded method signature supplies it. signature() keeps its raw length\nand digest around the shared decodeSignature.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* perf(managed): decode each MethodSpec target signature once\n\nedgeTargets caches the generic arity, including a failed decode, by\ntarget method token, so many instantiations of one generic method share\na single signature decode. Unity.InputSystem has 472 distinct MethodSpecs\nover about 133 target methods.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(managed): validate spec type operands and transitive reference scopes\n\n* fix(managed): retain readable names when a scope row is unreadable\n\n* test(managed): pin owner-scoped spec operand and scope-chain checks\n\ne59217c83 validates spec type operands inside specSignature, so a\nmalformed generic TypeSpec base is now invalid-row under its owning\nTypeSpec row; the three stale expectations follow that. New cases cover\na TypeSpec argument and a MethodSpec argument that name a missing TypeRef,\nand a TypeRef whose ResolutionScope names itself. The scope cases move to\ntheir own describe block.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(managed): keep field targets from naming MethodSpecs\n\nA MethodSpec over a field-signature MemberRef inherited kind \"field\", so\nan ldsfld on that MethodSpec published a field name and declaring type\nfor malformed IL. A MethodSpec now borrows its target's name only when\nthe target is not a field; the arity check still reports it.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(managed): reuse owner-decoded signatures for MethodSpec arity\n\nMemberRef signatures, and MethodDef signatures in the type selection, are\nalready fully decoded, but the MethodSpec arity check decoded them again\nand admitted a second transient allocation, which could exhaust the\nbudget. MemberCore now carries the owner's genericArity, and only a target\nnothing decoded, such as an unselected MethodDef, falls back to the raw\nsignature. signatureGenericArity is the one rule for both paths.\n\nCo-Authored-By: Claude Opus 5.5 \n\n---------\n\nCo-authored-by: Claude Opus 5.5 \nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["df04f99df018e205138490557d46068adcc4ccad"], "authors": [ { "name": "Nelglor", "email": "nadagrava@gmail.com", "user": { "login": "Nelglor", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2163] }, { "sha": "352c46aa7567afcd142524e5f583379c27a1075d", "subject": "fix(javascript): keep CommonJS require file URLs unresolved (#2077)", "body": "fix(javascript): keep CommonJS require file URLs unresolved (#2077)\n\n* fix(javascript): keep CommonJS require file URLs unresolved\n\nrequire(\"file:///dep.cjs\") was reported as a resolved dependency of\nthe inventoried dep.cjs although Node rejects the string with\nMODULE_NOT_FOUND. The shared module-specifier resolver decoded file URLs\nbefore the declared CommonJS loader semantics.\n\nFile-URL decoding now applies only to non-require module specifiers, so a\nCommonJS file URL reports external with its declared string and source\nevidence preserved. ESM file URLs and ordinary relative require paths\nkeep their established lookup.\n\n* test(javascript): consolidate CommonJS file URL public workflow coverage\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["91830f1e0e68232e991902b0fa7617651d2eee15"], "authors": [ { "name": "Aravind Rao", "email": "135997804+rekcilyssup@users.noreply.github.com", "user": { "login": "rekcilyssup", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2077] }, { "sha": "9c14999efd94ae04bfaf6532a74613b7a914810c", "subject": "feat(ghidra): support raw NMOS 6502 analysis (#2079)", "body": "feat(ghidra): support raw NMOS 6502 analysis (#2079)\n\n* feat(ghidra): admit raw NMOS 6502 analysis\n\n* test(ghidra): require verified POSIX verifier cleanup\n\n* test(ghidra): verify 6502 low-memory raw imports\n\n* docs(skill): document raw NMOS 6502 support\n\n* fix(ghidra): preserve requested Windows raw source paths\n\n* docs(ghidra): include raw 6502 in Windows installation scope\n\n* test(ghidra): verify Windows raw junction rejection through CLI and MCP\n\n* fix(validation): make fixtures portable and preserve explicit Codex home\n\n* fix(ghidra): attest raw mapping state and address space\n\n* fix(ghidra): align diagnostics and regression groups\n\n* fix(ghidra): bind raw attestation to language address space\n\n* chore(ghidra): avoid verifier insertion conflict\n\n* docs(ghidra): align linked raw admission guides\n\n* fix(ghidra): retain 6502 verifier workspace on failure\n\n* test(ghidra): isolate Windows authority doctor fixture\n\n* fix(binary): re-admit Windows raw paths on session reopen\n\n* test(binary): require fresh provider execution after path change\n\n* Constrain 6502 to raw lifecycle and snapshot targets\n\n* Bypass saved reads for unadmitted Windows paths\n\n* Guard direct CLI snapshot replay on Windows paths\n\n* fix(snapshot): gate Windows Ghidra replay on native admission\n\n* fix(snapshot): constrain nested 6502 subjects to raw images\n\n* test: make dyld slice fixtures portable", "parents": ["352c46aa7567afcd142524e5f583379c27a1075d"], "authors": [ { "name": "记得吃中饭", "email": "17373302683@163.com", "user": { "login": "Zhong-fan", "__typename": "User" } } ], "pullRequests": [2079] }, { "sha": "cdc41fc86c440317160652c1000fe8b082ba76f1", "subject": "fix(managed): classify ReadyToRun images without ILONLY as modern .NET (#2075)", "body": "fix(managed): classify ReadyToRun images without ILONLY as modern .NET (#2075)\n\n* fix(managed): classify ReadyToRun images without ILONLY as modern .NET\n\ncrossgen2 clears COMIMAGE_FLAGS_ILONLY and sets IL_LIBRARY on ReadyToRun output. inspect_managed_artifact checked the clear ILONLY flag before the ReadyToRun signature, so real ReadyToRun assemblies were reported as runtime_family mixed-clr-native and implementation cpp-cli-mixed, and cil-and-ready-to-run was unreachable for crossgen2 output. Check the ReadyToRun signature first; a clear ILONLY flag without it still reports mixed CLR/native code.\n\n* test(managed): exhaust capacity through inspected assembly references\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["9c14999efd94ae04bfaf6532a74613b7a914810c"], "authors": [ { "name": "TonyWu", "email": "75903587+TonyWu2333@users.noreply.github.com", "user": { "login": "TonyWu2333", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2075] }, { "sha": "97dc6581f45adfe5fcaa9c98e77e7dc6bc423a6e", "subject": "fix(dotnet): name the instruction when a CIL operand leaves the method body (#2697)", "body": "fix(dotnet): name the instruction when a CIL operand leaves the method body (#2697)\n\nThe decoder already reports \"Instruction X at IL offset N leaves method\nbody\" when an operand's computed end passes the IL body, but only after\nthe operand was read. Operand readers use Buffer reads, so an operand\ncut off by the body end threw a RangeError first. The catch-all stored\nNode's message (\"Attempt to access memory outside buffer bounds\" or an\noffset RangeError) as body.issue, dropping the instruction and offset.\nA body ending in a lone 0xFE two-byte opcode prefix failed the same way.\n\nTreat a RangeError from the operand read as the operand leaving the body\nso the existing diagnostic applies, and check the second opcode byte\nbefore reading it. Malformed status, partial coverage and earlier\ndecoded instructions are unchanged.\n\nFixes #2677\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["cdc41fc86c440317160652c1000fe8b082ba76f1"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2697] }, { "sha": "ece15ed6a18122f95e59d7d9f8bf9f0d3589f9f6", "subject": "fix(electron): identify each unresolved scenario path (#2279)", "body": "fix(electron): identify each unresolved scenario path (#2279)\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["97dc6581f45adfe5fcaa9c98e77e7dc6bc423a6e"], "authors": [ { "name": "xin zhuang", "email": "65798732+1052326311@users.noreply.github.com", "user": { "login": "1052326311", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2279] }, { "sha": "e46bed73f190484984c42efcb6fae0ccc42da4ee", "subject": "fix(managed): decode the CIL no. prefix (#2241)", "body": "fix(managed): decode the CIL no. prefix (#2241)\n\nThe CIL opcode table held five of the six ECMA-335 prefix opcodes and\nomitted no. (FE 19 , III.2.2). A method body using it was\nreported as malformed with \"Unsupported CIL opcode 0xfe19\", losing its\ninstruction counts and normalized IL digest.\n\nDecode it with its one-byte check mask and treat it as a prefix, so it\nshares an instruction boundary with the opcode it modifies.\n\n\nClaude-Session: https://claude.ai/code/session_012pRGskbPGjT444CgJfuhhj\n\nCo-authored-by: Claude Fable 5.1 ", "parents": ["ece15ed6a18122f95e59d7d9f8bf9f0d3589f9f6"], "authors": [ { "name": "Angelo Perez", "email": "102934797+Angelopgit@users.noreply.github.com", "user": { "login": "Angelopgit", "__typename": "User" } }, { "name": "Claude Fable 5.1", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2241] }, { "sha": "11268fe241a86fde0b462270dd8708934c74ab06", "subject": "perf(artifacts): share sealed inventory and report in inspect_artifact (#2690)", "body": "perf(artifacts): share sealed inventory and report in inspect_artifact (#2690)\n\ninspect_artifact parsed a fresh inventory and inspection report but left\nboth mutable, so each later Evidence boundary cloned and re-digested the\ncomplete payload: createArtifactInspection re-authenticated the nested\ninventory Evidence, createAnalysisExecution re-parsed the report, and\nrecordEvidence re-authenticated the outer Evidence.\n\nSeal both exclusively owned values with freezeJsonSnapshot so those\nboundaries take the existing immutable-snapshot path. Output is\nbyte-identical.\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["e46bed73f190484984c42efcb6fae0ccc42da4ee"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2690] }, { "sha": "59d33a2733ce50ed0ac3d0371b4b646237d33619", "subject": "fix(native): keep lipo path echoes out of FAT records (#2605)", "body": "fix(native): keep lipo path echoes out of FAT records (#2605)\n\n* fix(native): keep lipo path echoes out of FAT records\n\nParse FAT records only after separating the exact echoed operand path. Pass the same lipo operand at all three consumers and cover multiline paths through parser, slice-reader and compiled CLI regressions.\n\n* fix(native): use parsed lipo framing for container offsets\n\n* test(native): use explicit FAT fixtures for CLI regressions", "parents": ["11268fe241a86fde0b462270dd8708934c74ab06"], "authors": [ { "name": "FengCi", "email": "119940611+FengCi0@users.noreply.github.com", "user": { "login": "FengCi0", "__typename": "User" } } ], "pullRequests": [2605] }, { "sha": "c44d17fd3c4c71b86fcae401d9ff1088b4e27170", "subject": "fix(pwntools): let callers widen the artifact input bound (#2486)", "body": "fix(pwntools): let callers widen the artifact input bound (#2486)\n\n* fix(pwntools): let callers widen the artifact input bound\n\nThe pwntools adapters rejected every artifact over 32 MiB before any\nanalysis ran, and nothing in configuration, environment, CLI or MCP\ncould raise that bound, so real recorded core dumps stayed unanalyzable.\n\nResolve the bound from REA_PWNTOOLS_MAX_INPUT_BYTES in front of the\nshipped default. An absent value keeps 32 MiB, and a value outside\n1..1073741824 bytes is refused as unusable provider configuration before\nthe artifact is read instead of falling back silently.\n\n* fix(pwntools): name the bound variable in its own refusal\n\nAn unusable REA_PWNTOOLS_MAX_INPUT_BYTES travelled through the shared\nengine-absence helper, which always stamped configuration_key\nREA_PWNTOOLS_PYTHON, so a caller following that field was pointed at the\nPython executable instead of the bound it had just set. The guide also\ndescribed the refusal as an invalid request while the decoder reports\nprovider_unavailable.\n\nLet the failure context carry the key under review and pass the bound's\nown name at that call site, then state the code callers actually receive\nin the guide. Assert the key on the projected rejection so the engine\ndefault and the bound override each stay attributed to the right setting.\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["59d33a2733ce50ed0ac3d0371b4b646237d33619"], "authors": [ { "name": "The one -Niu", "email": "912906590@qq.com", "user": { "login": "NIU-123370", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2486] }, { "sha": "cae7620b77ec2893c944197603cc9158e2224930", "subject": "fix(apple): report a recognized connector that cannot name its owner (#2484)", "body": "fix(apple): report a recognized connector that cannot name its owner (#2484)\n\n* fix(apple): report a connector that cannot name its owner as an omission\n\nA connector is recognized by class name and then dropped by an early\n`continue` when its owner cannot be resolved. Nothing recorded the drop, so\nconnection coverage derived `complete` with `examined: 0` and `omitted: 0`\nfor a connector that was present, recognized and discarded.\n\nBoth producers of that coverage contract are affected and are changed\ntogether, because they share the facet and the reason value:\n\n- the keyed-archive parser records the drop as `unresolvedConnections` and\n reports it through the `connections:` facet, the document\n `connection_count` and the graph omission total;\n- the NIBArchive projection in the artifact adapter recorded nothing at all,\n and the projected dictionary carried no trace of the dropped connector for\n a downstream consumer to find. Its count is taken where the connector is\n discarded and plumbed through the same per-document omission channel that\n already carries incomplete hierarchies, so the reason follows the cause.\n\nAn unresolved source cannot be represented as a connection at all, because\nconnection identity requires a non-empty source; that is unlike an unresolved\ndestination, which the graph already retains as an unresolved edge.\n`connection_limit_reached` stays reserved for connections dropped by the hard\ncap and `serialized_view_hierarchy_incomplete` for hierarchy omissions.\n\n`connection_count` also includes the unresolved connectors. That field already\ncounts connectors the parser recognized but could not emit, because\nconnections dropped by the hard cap are counted there too, so unresolved\nconnectors follow the existing rule rather than a new one.\n\nVerified with 98 focused Interface Builder and catalog tests, check:fast and\nverify:test-discovery on macOS arm64, and through the public CLI: a rooted\narchive holding one ownerless UIRuntimeOutletConnection reported complete with\nexamined 0 and omitted 0 before this change and reports partial with the reason\nconnection_unresolved and omitted 1 after it.\n\n* fix(apple): count ownerless NIBArchive connectors and keep the limit reason\n\nGreptile found two defects in the NIBArchive half of this change.\n\nThe document summary was left unchanged, so the same recognized connector\ncounted as one in a keyed archive and zero in a NIBArchive. The dictionary\nparser only sees connectors that were projected, so the omission recorded\nwhere the connector was dropped is added to the matching document here.\n\nThe facet reason was overwritten unconditionally, so a NIBArchive holding both\na connection dropped by the limit and an ownerless connector reported\nconnection_unresolved and lost the cause a higher limit could recover. The\nexisting reason is kept when the graph already named one, which is the\nprecedence the keyed-archive producer applies.\n\nVerified with `npm run test:focused` over the bundle suite (42 passed, 1\nskipped), `npm run lint` (0 errors) and `npm run check:fast` on macOS arm64.\nReverting the reason precedence alone fails only the limit case; reverting the\ndocument count fails the count assertion in both cases.\n\nThe new case moved into its own describe block because the enclosing callback\ncrossed the repository's max-lines-per-function bound otherwise.\n\n---------\n\nCo-authored-by: 吴佳浩 ", "parents": ["c44d17fd3c4c71b86fcae401d9ff1088b4e27170"], "authors": [ { "name": "吴佳浩Alben", "email": "35291372+XiaoBinGan@users.noreply.github.com", "user": { "login": "XiaoBinGan", "__typename": "User" } }, { "name": "吴佳浩", "email": "wujiahao@supremind.com", "user": null } ], "pullRequests": [2484] }, { "sha": "5eb296649d2cd53b0bb74df7b3d8081e964e027d", "subject": "fix(native): refuse inspect_signature on non-Mach-O targets (#2262)", "body": "fix(native): refuse inspect_signature on non-Mach-O targets (#2262)\n\n* fix(native): refuse inspect_signature on non-Mach-O targets\n\nThis provider's signature inspection covers Mach-O code signatures only.\nOn a xar pkg, codesign's \"code object is not signed\" verdict cannot see\nthe archive-level signature layer, so a signed or invalidly-signed package\nwas reported as signed:false with \"Artifact is not signed.\" Match the\nexisting inspect_macho/list_architectures gate and report\ncapability_unavailable instead of an unsigned claim for a layer that was\nnever evaluated.\n\nGenerated with [Devin](https://devin.ai)\n\nCo-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>\n\n* test(native): scope the signature-gate comment to this provider\n\nGenerated with [Devin](https://devin.ai)\n\nCo-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>\n\n* fix(native): align signature capability discovery with Mach-O support\n\nBind inspect_signature availability to Mach-O targets in capability discovery and align the public tool description.\n\nSource inspection and git diff --check; tests/builds/typechecks/CI reruns skipped at explicit user request.\n\n---------\n\nCo-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["cae7620b77ec2893c944197603cc9158e2224930"], "authors": [ { "name": "Mason", "email": "aznikline@gmail.com", "user": { "login": "aznikline", "__typename": "User" } }, { "name": "Devin", "email": "158243242+devin-ai-integration[bot]@users.noreply.github.com", "user": { "login": "devin-ai-integration[bot]", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2262] }, { "sha": "84ec40f1af8ea7d74b757d7b50b391aec8482f8a", "subject": "fix(browser): distinguish SVG links from HTML XLink attributes (#2480)", "body": "fix(browser): distinguish SVG links from HTML XLink attributes (#2480)\n\n* fix(browser): respect SVG desc and title HTML integration points\n\n* fix(browser): preserve moved SVG XLink destinations\n\n* fix(browser): bound concurrent SVG identity reads", "parents": ["5eb296649d2cd53b0bb74df7b3d8081e964e027d"], "authors": [ { "name": "xingzhou", "email": "zhang.guiping@xydigit.com", "user": { "login": "zhangguiping-xydt", "__typename": "User" } } ], "pullRequests": [2480] }, { "sha": "dd4bfed6141efcb57aef81cf653962272efdf866", "subject": "fix(javascript): keep ASAR-named files without an ASAR header opaque (#2347)", "body": "fix(javascript): keep ASAR-named files without an ASAR header opaque (#2347)\n\nInventory expands an ASAR-named filesystem file only when its bytes are\nan ASAR. JavaScript reconstruction expanded it on the suffix alone, so\na directory holding any other file named *.asar failed the whole\nanalysis with an invalid ASAR header.\n\nCo-authored-by: Claude Opus 5.5 \nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["84ec40f1af8ea7d74b757d7b50b391aec8482f8a"], "authors": [ { "name": "Jin", "email": "a3239737781@gmail.com", "user": { "login": "huiq777", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2347] }, { "sha": "003707f712d06e49b84a48e04d58b50f9a097469", "subject": "fix(verification): align Linux Hopper setup lane with current contracts (#1942)", "body": "fix(verification): align Linux Hopper setup lane with current contracts (#1942)\n\n* fix(verification): align Linux Hopper setup lane with current contracts\n\n* fix(verification): retain orphan checks on clean Linux runners\n\n* fix(verification): detect Hopper through alternate launcher paths\n\n* fix(verification): report identified Hopper leaks before proc errors\n\n* fix(verification): distinguish Hopper string recognition from byte fidelity\n\n* fix(verification): report full literal decoding coverage explicitly\n\n* test(verification): require a clean host before orphan checks\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["dd4bfed6141efcb57aef81cf653962272efdf866"], "authors": [ { "name": "Luis", "email": "86675342+LuisTaffelli@users.noreply.github.com", "user": { "login": "LuisTaffelli", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [1942] }, { "sha": "48b92e1be1110fd200cc6d2fd0cdf7c6e2f9e21a", "subject": "fix(go): classify JVM class files instead of universal Mach-O for CAFEBABE bytes (#2458)", "body": "fix(go): classify JVM class files instead of universal Mach-O for CAFEBABE bytes (#2458)\n\n* test(go): pin JVM class files as unsupported Go images\n\nThe regression fails on main: readGoBinaryImage(javaClassFile()) reports\n\"Universal/fat Mach-O containers require selecting a thin slice\" for a\nJVM class file whose bytes 4..7 are minor/major version, not nfat_arch.\n\n* fix(go): classify JVM class files instead of universal Mach-O\n\nRoute the four FAT magics through the shared readFatContainerHeader and\nclassifyFatContainerIdentity facts added for the same disambiguation in\nthe artifact and target lanes (921bb9575). Keep the thin-slice failure\nonly when the container identity is confirmed Mach-O; a JVM class file\nnow falls through to the generic only-ELF/PE/thin-Mach-O failure.\n\n* test(go): pin universal Mach-O thin-slice failure with FAT fixtures\n\nCover the kept behavior with the repository's own fatImage/machoImage\nbuilders (narrow and FAT64 tables) so the regression also proves real\nuniversal containers keep the slice-selection failure.\n\n* test(go): cover little-endian FAT magics in the universal container control\n\n* fix(go): require positive universal Mach-O identity\n\nRequire positive Mach-O identity before reporting a universal thin-slice remedy; malformed FAT-shaped bytes are not proof. Add the JVM constant-pool CPU lookalike to the existing fixture control.\n\nSource inspection and git diff --check; tests/builds/typechecks/CI reruns skipped at explicit user request.\n\n* fix(go): retain malformed FAT header diagnostics\n\nPreserve the owning FAT header parser reason for malformed headers while requiring positive Mach-O proof before the universal-slice remedy.\n\nSource inspection and git diff --check only. Tests, builds and typechecks skipped by explicit user request. GitHub review writes paused globally.\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["003707f712d06e49b84a48e04d58b50f9a097469"], "authors": [ { "name": "Joshwong1908", "email": "136307740+Joshwong1908@users.noreply.github.com", "user": { "login": "Joshwong1908", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2458] }, { "sha": "dea770d5d9e4af92bc3fa6a8ffad9ff414f6e4e6", "subject": "fix(javascript): retain getter receivers through local aliases (#2778)", "body": "fix(javascript): retain getter receivers through local aliases (#2778)\n\n* fix(javascript): retain getter receivers through local aliases\n\n* fix(javascript): resolve projected private getter receivers\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["48b92e1be1110fd200cc6d2fd0cdf7c6e2f9e21a"], "authors": [ { "name": "To3akaRin", "email": "131595336+To3akaRin@users.noreply.github.com", "user": { "login": "To3akaRin", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2778] }, { "sha": "6637161e0272513ccc11c33aa6d8915bce6171ac", "subject": "fix(ghidra): warn when callee/caller reads stop at a truncated function body (#2360)", "body": "fix(ghidra): warn when callee/caller reads stop at a truncated function body (#2360)\n\nprocedure_callees and procedure_callers returned a bare address list, so an\ninferred no-return call that truncates Ghidra's function body silently dropped\nreal edges (fixes #2326). Wrap both views in the function-observation envelope\nwith noReturnCallLimitations, matching procedure_info, procedure_assembly,\nprocedure_pseudo_code, read_function_instructions, and analyze_function\n(precedent: 69a8b3a95). Version the boundary-observation contract to\nghidra-terminal-call-limitations-v2 so older snapshots cannot replay\nunqualified results.\n\nValidation: red->green unit test for the envelope requirement, MCP boundary\nevidence test extended for both views (limitations retained through Evidence\nand snapshot replay), 8 harness test files + ghidra behavior tests green,\ncheck:fast, docs:check, verify:test-discovery green. Real Ghidra host lane\nunavailable here (no Ghidra installed); Java change mirrors the existing\nprocedureInfo call pattern.", "parents": ["dea770d5d9e4af92bc3fa6a8ffad9ff414f6e4e6"], "authors": [ { "name": "Saim Shafique", "email": "msaimshafique4664@gmail.com", "user": { "login": "sx4im", "__typename": "User" } } ], "pullRequests": [2360] }, { "sha": "117bd23dd5084a0a15286d749a46bf1f7bc8fadb", "subject": "test(clients): verify Qwen Code on native Windows (#2103)", "body": "test(clients): verify Qwen Code on native Windows (#2103)\n\nCo-authored-by: AICodeLion <190163814+AICodeLion@users.noreply.github.com>\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["6637161e0272513ccc11c33aa6d8915bce6171ac"], "authors": [ { "name": "AICodeLion", "email": "2401112573@stu.pku.edu.cn", "user": { "login": "AICodeLion", "__typename": "User" } }, { "name": "AICodeLion", "email": "190163814+AICodeLion@users.noreply.github.com", "user": { "login": "AICodeLion", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2103] }, { "sha": "9e019ad27dbad078122f87a9bb41ff6d8687d217", "subject": "feat(clients): register Factory Droid during setup (#2309)", "body": "feat(clients): register Factory Droid during setup (#2309)", "parents": ["117bd23dd5084a0a15286d749a46bf1f7bc8fadb"], "authors": [ { "name": "Danish Rafie Ekaputra", "email": "155859586+0xRafie@users.noreply.github.com", "user": { "login": "0xRafie", "__typename": "User" } } ], "pullRequests": [2309] }, { "sha": "811bd9f6353748d01023260681f138fdf81313c9", "subject": "docs(contributing): explain Windows native prerequisites for source checkouts (#2295)", "body": "docs(contributing): explain Windows native prerequisites for source checkouts (#2295)", "parents": ["9e019ad27dbad078122f87a9bb41ff6d8687d217"], "authors": [ { "name": "Jose Camargo", "email": "aml.camargo@hotmail.com", "user": { "login": "jcamargos", "__typename": "User" } } ], "pullRequests": [2295] }, { "sha": "5dd2ce3125b0c7918bffe99011ccacbba6592853", "subject": "fix(ida): let one-shot commands exit after retaining cleanup (#1841)", "body": "fix(ida): let one-shot commands exit after retaining cleanup (#1841)\n\n* fix(ida): let one-shot commands exit after retaining cleanup\n\nWhen a headless IDA request outlives timeoutMs (for example idb_open on\na large binary still running auto-analysis), REA cannot prove the\nworker stopped and correctly retains the upstream connection and\nprivate workspace. The retained stdio child and its pipes stayed\nreferenced, so a one-shot CLI printed its cleanup_incomplete result and\nthen never exited, keeping the supervisor, worker and database alive.\n\nDetach the retained connection's child process and pipes from the event\nloop when cleanup fails. A long-lived MCP server can still retry\nthrough the retained connection; a one-shot CLI exits with status 1,\nand the supervisor observes end of input.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(ida): report an unverified upstream worker after failed cleanup\n\nUpstream ida-pro-mcp spawns headless workers in their own session and\ndeliberately leaves them running when its supervisor exits, so neither\na retained connection nor REA exiting proves that a timed-out worker\nstopped. When cleanup fails before the owned worker's release is\nconfirmed, the cleanup diagnostics now name its private session and\nstate that it may still be running until it finishes and reaches its\nidle timeout. Failures after a confirmed release, or before any open\nwas attempted, do not report a worker.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(ida): name the inventory sessions that block worker release\n\nWhen idb_close confirmed the requested worker gone but the follow-up\ninventory still found a different peer on the private input, the\nupstream_worker diagnostic named the released session and could\nmisdirect manual cleanup. Record the session ids of the inventory\nentries that actually blocked release and report those; fall back to\nthe requested private session only when no inventory evidence exists\n(an incomplete open or an unanswered request). The field becomes\nsession_ids, since more than one entry can block release.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(ida): keep blocker evidence and backend in cleanup diagnostics\n\nThe release diagnostic reset its observed blockers on every close, so a\nretry whose inventory was unavailable fell back to the already-released\nsession; and it kept only session ids, describing a blocking GUI\nsession with detached-worker guidance.\n\nBlocker evidence is now replaced only by a successful inventory, and\nthe diagnostic becomes upstream_sessions with each session's id and\nbackend, with guidance that distinguishes workers from GUI sessions.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(ida): stop naming a worker after its close was confirmed\n\nWhen idb_close confirmed the requested worker's release but the\nfollowing inventory failed, no blocker evidence existed yet and the\ndiagnostic fell back to the confirmed-absent worker. After a confirmed\nclose the diagnostic now reports an empty session list, meaning any\nremaining same-input sessions are unknown.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* test(ida): group cleanup diagnostic cases in their own suite\n\nThe added cases pushed the reaped-worker describe block past the\n150-line limit enforced by lint:built.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(ida): keep ownership and pre-close peers in cleanup diagnostics\n\nBlocking sessions dropped the parsed ownership fact, so an external\nunowned worker looked the same as REA's own; and recovery inventory\nrecorded same-input peers only when the requested worker was missing,\nso a peer seen beside it was lost if the following close failed.\n\nEach reported session now carries owned (null when no inventory has\nreported it), and recovery records every same-input session until a\nlater successful inventory replaces that evidence.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(ida): drop a confirmed worker from retained cleanup blockers\n\nRecovery inventory now records the requested worker beside any peers,\nso once idb_close confirmed its release a failing follow-up inventory\nstill reported it as unreleased. Remove the confirmed session from the\nretained blockers at close confirmation and keep the remaining peers.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* test(ida): retry cleanup through a detached stdio connection\n\nThe retry coverage used a recording connection whose detach() only\ncounts calls, so it could not show that detaching keeps a retained\nconnection usable. Run a real stdio supervisor in a long-lived host,\nfail the first post-close inventory, and require the retry through the\nsame detached connection to confirm release and remove the workspace.\nThe test fails if detach() destroys the pipes instead of unref-ing them.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(ida): close the stdio supervisor in failed retry tests\n\nMerge main and give its new IdaNativeProtocol connection double the\nrequired detach() method. The real-stdio retry test now closes its\nconnection in an unconditional teardown, so a failing assertion cannot\nleave the supervisor waiting on stdin.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* test(ida): share the cleanup diagnostic expectation in session tests\n\nRepeated upstream_sessions assertions and the unrelated live peer\nliteral pushed repository duplication over the jscpd threshold. Build\nthe expected diagnostic with one helper and reuse one peer constant.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* test(ida): distinguish observed ownership from unreported input bindings\n\n* fix(ida): keep requested-ID conflicts in recovery cleanup\n\nRecovery inventory kept only same-input entries, unlike the startup and\npost-close filters. After an explicitly rejected open, an entry under\nthe requested session ID on another input was dropped, so cleanup could\nclose the connection, remove the private workspace and report success\nwhile that session stayed registered. Match the requested ID as well so\nthe entry is retained as a blocker and cleanup stays incomplete.\n\nAlso split the cleanup diagnostics suite under the lint:built function\nlength limit, and make two startup-inventory fixtures pass a defined\nsession id so the test file typechecks.\n\nCo-Authored-By: Claude Opus 5.5 \n\n---------\n\nCo-authored-by: Xingchuan Ma \nCo-authored-by: Claude Opus 5.5 \nCo-authored-by: morluto ", "parents": ["811bd9f6353748d01023260681f138fdf81313c9"], "authors": [ { "name": "Max", "email": "68940212+AS9929@users.noreply.github.com", "user": { "login": "AS9929", "__typename": "User" } }, { "name": "Xingchuan Ma", "email": "xingchuan.ma@msn.com", "user": null }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } }, { "name": "morluto", "email": "morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [1841] }, { "sha": "c6503edfc4afdc0de6812ba3f7cd0909df5555f7", "subject": "ci: pin GitHub Actions to full commit SHAs (#1901)", "body": "ci: pin GitHub Actions to full commit SHAs (#1901)\n\n* ci: pin GitHub Actions to full commit SHAs\n\nReplace every third-party `uses: owner/repo@vN` reference in\n.github/workflows with the 40-character commit SHA that the tag\ncurrently resolves to, keeping the exact release as a trailing comment.\nEach pin was checked with `git ls-remote --tags`: the floating major tag\nand the commented release dereference to the same commit. Local\nreusable workflows are unchanged.\n\nRe-pin reactivecircus/android-emulator-runner from the SHA of the\nannotated `v2` tag object (4c44018e) to the commit it points to\n(a421e438, v2.38.0); Actions resolves both, but only the commit SHA is\nan immutable reference that tooling can compare with the release.\n\nUpdate the Windows Ghidra workflow trust-boundary test to require\nSHA-pinned setup-node and upload-artifact references instead of the\nprevious floating tags.\n\nValidation: actionlint v1.7.7 (-shellcheck= -pyflakes=, as in CI), YAML\nparse of all workflows, no remaining unpinned third-party `uses:`, and\nthe workflow boundary/conformance tests.\n\n* style(ci): format action identity assertion\n\nRetain formatting edits produced before the user stopped validation.\n\nSource inspection and git diff --check only. Tests, builds and typechecks skipped by explicit user request. GitHub review writes paused globally.\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["5dd2ce3125b0c7918bffe99011ccacbba6592853"], "authors": [ { "name": "Lluís Ariño", "email": "lluisalfons.arino@urv.cat", "user": { "login": "larinyo", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [1901] }, { "sha": "a4b8e9ccee50f83bfb72d7ad33db6962c9befa72", "subject": "feat(ghidra): admit recordless legacy MIPS32 ELFs with a pinned 32-bit language (#1898)", "body": "feat(ghidra): admit recordless legacy MIPS32 ELFs with a pinned 32-bit language (#1898)\n\n* feat(ghidra): admit recordless legacy MIPS32 ELFs with a pinned 32-bit language\n\nFirmware built with pre-ABI-flags GNU toolchains declares EF_MIPS_ARCH_32\nwith an unspecified ABI field and no PT_MIPS_ABIFLAGS record. The lane\nrefused them before provider selection, and Ghidra's own header\nauto-selection picks a 64-bit R6 language for exactly these files.\n\nAdmit ELF32 ET_EXEC headers with EF_MIPS_ARCH_32 or EF_MIPS_ARCH_32R2,\nan unspecified ABI field, EF_MIPS_ABI2 clear and no observed ABI flags\nrecord. o32 is recorded as an inferred analysis assumption\n(mips_abi_basis), floating-point ABI semantics stay unverified, and the\nexisting refusals (FP64, NAN2008, ASEs, machine variants, ELF64) are\nunchanged. The profile pins -processor MIPS::32:default through a\nprovider-pinned-v1 selection the bridge-reported language_id is checked\nagainst after import; a caller-selected REA_GHIDRA_LANGUAGE_ID still\nwins. The lane identity is versioned\nelf32-exec-arch32-legacy-pinned-v1.\n\nverify:ghidra:mips gains a recordless legacy round for both byte orders\nthat strips the ABI record declarations from a real mips32 fixture,\nchecks REA's interpretation against GNU readelf, asserts the pinned\nlanguage after import and the retained assumption limitations through a\nsnapshot round-trip.\n\nFixes #1620\n\n* fix(ghidra): require an inspected absence for the recordless MIPS lane\n\nAddress review: undefined ABI flags means the record was not inspected,\nnot that none exists. Only an inspected absence (null) establishes the\nrecordless legacy admission; a merely unobserved record keeps its\nspecific refusal. Also document the legacy admission and its pinned\nlanguage in the MIPS provider guide.\n\n* fix(ghidra): tighten the recordless MIPS admission boundaries\n\nAddress review: a recordless-looking header whose ABI-record inspection\nleft declaration sources unexamined (carved ELF with a partial section\ntable and no program-header record) no longer establishes the recordless\nadmission; it is refused with the inspection limitation retained. An\nEF_MIPS_ARCH_32 header that declares an ABI is refused rather than\nrelabeled through the 32R2 declared-ABI lane.\n\n* fix(ghidra): reject EF_MIPS_ABI_ON32 from the recordless MIPS lane\n\nAddress review: bit 0x40 declares the old n32 ABI. A recordless header\ncarrying it was admitted with the inferred-o32 assumption even though\nthe header itself declares n32; the recordless shape now requires the\nbit clear and refuses it with a specific constraint.\n\n* fix(ghidra): keep recordless relocatable MIPS objects off the legacy lane\n\nThe recordless admission now requires ET_EXEC: the lane and its\nverification cover executable firmware images, and a recordless ET_REL\nobject must stay on the declared-ABI path instead of inheriting the\ninferred-o32 assumption under an executable lane id. The ABI-record\nrequirement paragraph is scoped to the declared-ABI lane so it no longer\ncontradicts the recordless admission documented above it.\n\n* fix(ghidra): name the ET_EXEC scope for recordless objects and probe the legacy lane\n\nA recordless relocatable object is not an incomplete inspection, so its\nrefusal now names the ET_EXEC scope of the legacy admission instead of\nclaiming unavailable ABI headers remain unknown. The recordless legacy\nverifier round reads the probe pair and applies the full assertMipsProbe\noracle like the standard round, and its report keeps the independent\nGNU readelf receipt beside the fixture facts.\n\n* fix(ghidra): retain the concrete ELF32 legacy compiler pin\n\n* fix(ghidra): bind legacy profiles to fully admitted targets\n\n---------\n\nCo-authored-by: BaaRai \nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["c6503edfc4afdc0de6812ba3f7cd0909df5555f7"], "authors": [ { "name": "BaaRai", "email": "130491490+BaaRai@users.noreply.github.com", "user": { "login": "BaaRai", "__typename": "User" } }, { "name": "BaaRai", "email": "baarai@users.noreply.github.com", "user": { "login": "BaaRai", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [1898] }, { "sha": "9958754f6c2002dad39de6a64519af332b81244d", "subject": "fix(process): preserve discovery ownership across cleanup retries (#2643)", "body": "fix(process): preserve discovery ownership across cleanup retries (#2643)\n\nBind retained descriptors and runtime resources to their admitting operation until cleanup succeeds, then rebind newly admitted work. Verify failed retries, successful recovery, shutdown and CLI projection.\n\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>", "parents": ["a4b8e9ccee50f83bfb72d7ad33db6962c9befa72"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } } ], "pullRequests": [2643] }, { "sha": "5d12a0b4b6137f025d9aa88cf001dc2a68c28b8a", "subject": "test(web): cover nullable HTTP captures through CDP and CLI (#1834)", "body": "test(web): cover nullable HTTP captures through CDP and CLI (#1834)\n\n* fix(browser): preserve unknown HTTP response comparison fields\n\n* fix(browser): retain proven request inventory changes\n\n* fix(javascript): preserve Electron identity and avoid quadratic property scans\n\nShare visible Electron mutations with wrapper expansion, index static object\nliteral properties once, and align MCP assertions with current contracts.\n\n* fix(javascript): track writes through symbolic Electron aliases\n\nResolve mutation targets through the same factories, module tables, containers,\nand conditional origins as call analysis. Share mutation coverage between\ndirect and wrapper scans while isolating origin caches and preserving exact\nproperty paths, local rebinding semantics, and analysis resource limits.\n\n* fix(javascript): preserve container slots and imported mutation origins\n\n* perf(javascript): defer container mutation replay until property reads\n\n* fix(javascript): preserve captured object identities and write order\n\n* fix(javascript): preserve ordered mutation origins\n\n* fix(javascript): honor property mutation constraints\n\n* test(web): narrow PR to HTTP and CLI comparison regressions\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["9958754f6c2002dad39de6a64519af332b81244d"], "authors": [ { "name": "Yann Roberto", "email": "165009858+shoyann@users.noreply.github.com", "user": { "login": "shoyann", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [1834] }, { "sha": "23f72141d5befc6b14286ae7281c367d593f84bb", "subject": "fix(javascript): keep configuration setting reads out of endpoints (#2402)", "body": "fix(javascript): keep configuration setting reads out of endpoints (#2402)\n\n* fix(javascript): keep configuration setting reads out of endpoints\n\nStatic endpoint extraction reads the first literal argument of any call\nnamed get as an HTTP request path unless the receiver is a provable keyed\ncollection. VS Code extension bundles read settings through\n`workspace.getConfiguration(section).get(key)`, so every setting key\nbecame a network endpoint: the bundled Git extension's dist/main.js\nreported 173 network endpoints, nearly all of them setting names such as\n`autofetchPeriod` and `blame.statusBarItem.enabled`.\n\nThe lexical receiver classifier now records a `configuration` fact for a\n`.get` call whose receiver is a `getConfiguration(...)` call, inline or\nthrough a binding whose only visible write is one unconditional\ninitializer. Minifiers emit `let` for these bindings, so the proof relies\non the recorded writes rather than the declaration kind, as tRPC client\nroot resolution already does. Endpoint extraction skips non-URL literals\nfor that fact in both application and web bundle analysis. Reassigned,\nconditional, and shadowed receivers, URL or path literals, and other\nclients such as `api.get(\"users\")` keep their endpoints.\n\nThe receiver fact union was duplicated in three modules; consumers now\nimport the classifier's type.\n\nOn the Git extension bundle, network endpoints drop from 173 to 7 with\nunchanged analysis time (2.1 s).\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(javascript): require the workspace host for configuration receivers\n\nA bare or differently scoped `getConfiguration(...)` may be an\napplication's own HTTP client factory, so `.get(\"users\")` on its result\nlost its endpoint. Only `workspace.getConfiguration(...)` and\n`.workspace.getConfiguration(...)` now produce the configuration fact.\nMinifiers keep property names, so the bundled VS Code Git extension still\nreports 7 network endpoints instead of 173.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(javascript): recognize default VS Code namespace imports\n\n---------\n\nCo-authored-by: Claude Opus 5.5 \nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["5d12a0b4b6137f025d9aa88cf001dc2a68c28b8a"], "authors": [ { "name": "alfredo1491", "email": "208325033+alfredo1491@users.noreply.github.com", "user": { "login": "alfredo1491", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2402] }, { "sha": "fc0dbe7f9d676f776ffcbe047895ba8caa52f357", "subject": "fix(server): mark retained partial-observation errors as target content (#2398)", "body": "fix(server): mark retained partial-observation errors as target content (#2398)\n\nPass the tool contract's `returnsTargetContent` to\n`toRecordedPartialErrorToolResult` in the shared Evidence handler, matching\nthe Electron call site.\n\nThe call site that records a retained partial observation was added without\nthe argument required by the untrusted target-content framing, so the\ndelivery neither marked the result nor counted the provenance marker in its\nwire budget. The type gate failed on main with\n`contractToolHandler.ts(69,38): error TS2554`, which also blocked every\ncompiled boundary test lane.", "parents": ["23f72141d5befc6b14286ae7281c367d593f84bb"], "authors": [ { "name": "jbernous", "email": "39996743+jbernous@users.noreply.github.com", "user": { "login": "jbernous", "__typename": "User" } } ], "pullRequests": [2398] }, { "sha": "c8e85b962a58929cc272d966cfc0dd6e2409ed1d", "subject": "fix(javascript): recover child-process options without args (#2781)", "body": "fix(javascript): recover child-process options without args (#2781)\n\n* docs: celebrate 180,000 GitHub stars 🎉\n\n* fix(javascript): recover child-process options without args\n\n* fix(javascript): preserve execFile callback overload options\n\nChoose execFile options by the second argument object shape rather than total argument count, preserving callback overloads.\n\nSource inspection and git diff --check; tests/builds/typechecks/CI reruns skipped at explicit user request.\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["fc0dbe7f9d676f776ffcbe047895ba8caa52f357"], "authors": [ { "name": "Naimur Reza", "email": "95697060+naimur-reza@users.noreply.github.com", "user": { "login": "naimur-reza", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2781] }, { "sha": "4c79127fcb31c5e85c4806f5a9522e00674f10e4", "subject": "fix(sqlite): classify a missing database path as an invalid value (#2775)", "body": "fix(sqlite): classify a missing database path as an invalid value (#2775)\n\n* fix(sqlite): classify a missing database path as an invalid value\n\nThe snapshot reported an absent selected database as an artifact path\nfailure, which the adapter projects as invalid_format alongside malformed\npaths and content. The snapshot owns the absence observation, so it now\nreturns an invalid_value input issue on path directly, matching the\nadapter's existing ENOENT/ENOTDIR classification.\n\nFixes #2614\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(sqlite): classify a missing database path as an invalid value\n\nThe snapshot reported an absent selected database as an artifact path\nfailure, which the adapter projects as invalid_format alongside malformed\npaths and content. The snapshot owns the absence observation, so it now\nreturns an invalid_value input issue on path directly, matching the\nadapter's existing ENOENT/ENOTDIR classification.\n\nFixes #2614\n\nCo-Authored-By: Claude Opus 5.5 \n\n---------\n\nCo-authored-by: Claude Opus 5.5 \nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["c8e85b962a58929cc272d966cfc0dd6e2409ed1d"], "authors": [ { "name": "yasshmittal", "email": "yash.mittal@op.iitg.ac.in", "user": { "login": "yasshmittal", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2775] }, { "sha": "c22d7cd7567b52e6e6ba13f14df11c4a720c0c4e", "subject": "fix(browser): keep malformed Content-Length declarations unknown (#2773)", "body": "fix(browser): keep malformed Content-Length declarations unknown (#2773)\n\n* fix(browser): keep malformed Content-Length declarations unknown\n\nResponse metadata normalized Content-Length with Number(), truncation and\nclamping, so \"-5\", \"0x10\", \"1e3\" and \"+12\" became observed lengths 0, 16,\n1000 and 12. RFC 9110 section 8.6 defines the field as 1*DIGIT; any other\nspelling declares no length. Parse only decimal digits within the safe\ninteger range and keep every other value null.\n\nFixes #2596\n\nCo-Authored-By: Claude Opus 5.5 \n\n* test(browser): cover the largest accepted Content-Length\n\nPin the safe-integer boundary beside the overflow case so a future change\ncannot reject the largest representable declared length unnoticed.\n\nCo-Authored-By: Claude Opus 5.5 \n\n---------\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["4c79127fcb31c5e85c4806f5a9522e00674f10e4"], "authors": [ { "name": "yasshmittal", "email": "yash.mittal@op.iitg.ac.in", "user": { "login": "yasshmittal", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2773] }, { "sha": "46f51ee6cc45efc546369eae1691b76dfddc5825", "subject": "fix(flutter): name a missing or non-file APK selection (#2727)", "body": "fix(flutter): name a missing or non-file APK selection (#2727)\n\n* fix(flutter): name a missing or non-file APK selection\n\nidentify_flutter_build and inspect_dart_aot reported a missing path or a\ndirectory as \"The APK could not be read as a package: : ENOENT ...\",\nwhich blames the package bytes for a selection mistake. Report\n\"Selected APK does not exist\" for ENOENT/ENOTDIR and \"Selected APK is not\na regular file\" for a non-regular selection, matching the SQLite\ninspector's wording. The issue path and invalid_format reason are\nunchanged; package format failures keep their existing message.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(filesystem): classify unopenable non-regular selections at admission\n\nA Unix socket cannot be opened at all: open() fails with ENXIO on Linux\nand EOPNOTSUPP on macOS (surfaced by libuv as \"Unknown system error\n-102\") before openRegularFile can stat the descriptor, so such a\nselection escaped NonRegularFileReadError and the Flutter provider still\nblamed the package bytes.\n\nWhen open fails, classify the path by its own metadata (lstat when\nsymlinks are rejected, stat otherwise): an existing non-regular file\nbecomes NonRegularFileReadError. Missing paths, permission failures,\nregular files, and the O_NOFOLLOW ELOOP rejection keep their original\nerrors. The Flutter selection test now covers a real Unix socket.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(filesystem): reclassify only unopenable file-type errors at admission\n\nChecking the path's metadata after any open failure turned EACCES on an\nunreadable directory into NonRegularFileReadError, so callers reported\ninvalid input instead of access_denied. Reclassify only errors that mean\nthe file type cannot be opened (ENXIO, EOPNOTSUPP, ENOTSUP, matched by\nerrno because libuv has no name for macOS EOPNOTSUPP 102); permission,\nsymlink-rejection and resource failures keep their original errors.\n\nRun the Unix socket selection check in its own test, skipped on Windows\nwhere listen() takes named pipes, and keep the missing-path and\ndirectory checks cross-platform.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(filesystem): keep cancellation that arrives during the non-regular probe\n\nA caller abort while the post-open metadata probe ran was replaced by\nNonRegularFileReadError, so callers such as parseBinaryTarget reported an\ninput-format error instead of cancellation. Recheck the signal before\nsubstituting the non-regular classification.\n\nCo-Authored-By: Claude Opus 5.5 \n\n---------\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["c22d7cd7567b52e6e6ba13f14df11c4a720c0c4e"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2727] }, { "sha": "9680da76c84a6833635dc7a5df607806d899f804", "subject": "perf(evidence): reuse sealed bundle reads in compare and export (#2715)", "body": "perf(evidence): reuse sealed bundle reads in compare and export (#2715)\n\n* perf(evidence): reuse sealed bundle reads in compare and export\n\n`rea compare`, the compare_bundles MCP tool and `rea evidence-export`\nread bundles through the mutable reader, so each consumer\nre-authenticated every record again: compareBundles parsed both bundles\na second time and bundleDigest's serializeEvidenceBundle a third time;\nexport's writer parsed the source once more before serializing.\n\nThese consumers only read the bundle, so read it through the existing\nsealed reader (readImmutableEvidenceBundle). Later parses hit the\nimmutable bundle cache. Ordinary mutable reads, kept deliberately by\n#1721, are unchanged. Output is byte-identical.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(process): report no remaining time after a provider deadline fires\n\nNode timers can fire while performance.now() is still a fraction of a\nmillisecond short of the monotonic deadline. ProviderStartupDeadline then\nreported interruption \"timeout\" and an aborted signal while remainingMs()\nreturned ceil(0.x) = 1, so polling loops guarded by remainingMs() > 0\n(Hopper and Ghidra startup) could run past an elapsed deadline, and the\nreal-timer test \"aborts a bounded wait when its real monotonic deadline\nexpires\" failed intermittently in CI (expected 1 to be 0).\n\nOnce the deadline's own timer has classified a timeout, report zero\nremaining time. A deterministic regression test fires the timer with the\nmonotonic clock 0.4 ms short of the deadline.\n\nCo-Authored-By: Claude Opus 5.5 \n\n---------\n\nCo-authored-by: Claude Opus 5.5 \nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["46f51ee6cc45efc546369eae1691b76dfddc5825"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2715] }, { "sha": "a3daf8a07bf938ce6765b0e15c527493f9496a9f", "subject": "fix(ci): run the Windows native lane with its process boundary fixture (#2336)", "body": "fix(ci): run the Windows native lane with its process boundary fixture (#2336)\n\n* fix(ci): run the Windows native lane with its process boundary fixture\n\n`verify-windows-native.mjs` takes the boundary executable as its second\nargument and skips every observation that needs it when the argument is\nabsent. CI passed no argument, so the breakaway denial, caller and child\ntoken comparison, Windows environment semantics and in-place ancestor\nreparse attempt have never run there; they only ran for an operator who\nbuilt the fixture by hand, which `native/windows/README.md` described as\noptional.\n\nThe fixture is an ordinary Windows executable independent of the addon,\nso the lane that already installs MinGW to cross-build the artifact\ncross-builds it too and uploads it beside the existing inspection\nfixture. The Windows job downloads it and passes its path, matching how\nthat inspection fixture already crosses the same job boundary.\n\nNo observation, assertion or threshold changes; this only stops four of\nthem from being silently skipped.\n\nCo-Authored-By: Claude Opus 5 \n\n* fix(ci): pass the process boundary fixture in the real Ghidra Windows lane\n\n`real-ghidra-windows.yml` also runs the native lane without the boundary\nexecutable, so its proof run skipped the same breakaway, caller and child\ntoken, environment semantics and ancestor reparse observations. Its\nartifact job already installs MinGW, so it cross-builds and uploads the\nfixture the same way, and the self-hosted Windows job downloads it and\npasses its path.\n\nThis makes the README's claim about both Windows workflows true rather\nthan narrowing it to one lane.\n\nCo-Authored-By: Claude Opus 5 \n\n* fix(process): report no remaining time after a provider deadline fires\n\nNode timers can fire while performance.now() is still a fraction of a\nmillisecond short of the monotonic deadline. ProviderStartupDeadline then\nreported interruption \"timeout\" and an aborted signal while remainingMs()\nreturned ceil(0.x) = 1, so polling loops guarded by remainingMs() > 0\n(Hopper and Ghidra startup) could run past an elapsed deadline, and the\nreal-timer test \"aborts a bounded wait when its real monotonic deadline\nexpires\" failed intermittently in CI (expected 1 to be 0).\n\nOnce the deadline's own timer has classified a timeout, report zero\nremaining time. A deterministic regression test fires the timer with the\nmonotonic clock 0.4 ms short of the deadline.\n\nCo-Authored-By: Claude Opus 5.5 \n(cherry picked from commit dfdaa0ca74cc84a45dcb186422a0f51aa61bc427)\n\n---------\n\nCo-authored-by: Claude Opus 5 \nCo-authored-by: morluto \nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>", "parents": ["9680da76c84a6833635dc7a5df607806d899f804"], "authors": [ { "name": "Stefano Rizzello", "email": "rizzellostefano@gmail.com", "user": { "login": "Rinkia", "__typename": "User" } }, { "name": "Claude Opus 5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } }, { "name": "morluto", "email": "morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } } ], "pullRequests": [2336] }, { "sha": "48a683ac8c780786f0a2a71ab64aca5994087c00", "subject": "feat(evm): inspect lossless Solidity terminal CBOR metadata (#2790)", "body": "feat(evm): inspect lossless Solidity terminal CBOR metadata (#2790)\n\nfeat(evm): retain lossless terminal CBOR metadata\n\nRefs morluto/rea#2388\n\nCo-authored-by: Matheus Breguêz \nCo-authored-by: Codex ", "parents": ["a3daf8a07bf938ce6765b0e15c527493f9496a9f"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "Matheus Breguêz", "email": "matbrgz@gmail.com", "user": { "login": "matbrgz", "__typename": "User" } }, { "name": "Codex", "email": "noreply@openai.com", "user": { "login": "codex", "__typename": "User" } } ], "pullRequests": [2790] }, { "sha": "beca34f52258b7b25d72c160ae6fffa1cc3c034b", "subject": "fix(ida): report missing tools when a compatibility profile mismatches (#2307)", "body": "fix(ida): report missing tools when a compatibility profile mismatches (#2307)\n\nA profile mismatch reached the caller as a bare AnalysisProtocolError,\nwhich projects to `unreadable_output` with a generic message. The error\nalready named every missing tool, but none of that detail survived, so\nthe only way to identify the cause was to log the JSON-RPC traffic and\nnotice the exchange stopping after `tools/list`.\n\nThrow a ProviderAdapterError instead, carrying the mode, the expected\nprofile and the missing tool names through the diagnostics channel that\nalready surfaces in `details`. Document which upstream versions each\nprofile accepts, since upstream `main` now serves neither.\n\nRefs #2301\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["48a683ac8c780786f0a2a71ab64aca5994087c00"], "authors": [ { "name": "vtx", "email": "140315902+vt0x78@users.noreply.github.com", "user": { "login": "vt0x78", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2307] }, { "sha": "96d1f0f3fbc1a36664c62b66d7de8cc2f8837f52", "subject": "fix(cli): refuse scenario steps on passive native UI observation (#2712)", "body": "fix(cli): refuse scenario steps on passive native UI observation (#2712)\n\nobserve-native-ui and capture-native-ui-scenario were registered in one\nloop with a shared option schema and description. The passive command\ntherefore advertised `--steps` (\"Observe or run a scenario\"), accepted\nany value, and then dispatched observe_native_ui without it, so a\ncaller who selected the wrong command never learned that no scenario ran.\n\nRegister each command against its own contract. Observation declares\nonly the passive scope options, so `--steps` is rejected as an unknown\nflag; the scenario command keeps its JSON step decoding and validation.\nEach command now has its own description.\n\nFixes #2674\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["beca34f52258b7b25d72c160ae6fffa1cc3c034b"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2712] }, { "sha": "ae9a7f34e17850eda3419102c4ddc24995653c64", "subject": "fix(process): report no remaining time after a provider deadline fires (#2720)", "body": "fix(process): report no remaining time after a provider deadline fires (#2720)\n\nNode timers can fire while performance.now() is still a fraction of a\nmillisecond short of the monotonic deadline. ProviderStartupDeadline then\nreported interruption \"timeout\" and an aborted signal while remainingMs()\nreturned ceil(0.x) = 1, so polling loops guarded by remainingMs() > 0\n(Hopper and Ghidra startup) could run past an elapsed deadline, and the\nreal-timer test \"aborts a bounded wait when its real monotonic deadline\nexpires\" failed intermittently in CI (expected 1 to be 0).\n\nOnce the deadline's own timer has classified a timeout, report zero\nremaining time. A deterministic regression test fires the timer with the\nmonotonic clock 0.4 ms short of the deadline.\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["96d1f0f3fbc1a36664c62b66d7de8cc2f8837f52"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2720] }, { "sha": "1eca60051506cce310116854fdb59ef9cd195a7e", "subject": "fix(apktool): resolve Windows PATH launchers before invocation (#2802)", "body": "fix(apktool): resolve Windows PATH launchers before invocation (#2802)\n\n* fix(apktool): resolve Windows PATH launchers before invocation\n\nResolve the default launcher through the selected PATH/PATHEXT before choosing native process creation or the existing conservative cmd.exe wrapper. Reuse the resulting selection and one canonical environment for the version probe and decode.\n\nFollow-up to the release #1693 review of #1777. Source inspected and formatted; tests, builds, check reruns and real Windows Apktool execution were skipped at maintainer request.\n\n* fix(apktool): bound lookup and retain only selected environment\n\nSource inspection and targeted formatting only. Tests, builds, lint, typechecks and provider workloads were not run at the user's explicit request.\n\n* fix(apktool): use supported timeout diagnostics\n\nRetain lookup phase through AnalysisErrorOptions diagnostics while preserving the operation and timeout identity. Source inspection and targeted formatting only; tests, checks, builds and provider workloads were skipped at the user request.\n\n---------\n\nCo-authored-by: morluto ", "parents": ["ae9a7f34e17850eda3419102c4ddc24995653c64"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "morluto", "email": "morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2802] }, { "sha": "173da755cd6b922f8310a1efa0fb8435be2e4d64", "subject": "fix(reconstruction): reject contradictory function comparison status (#2798)", "body": "fix(reconstruction): reject contradictory function comparison status (#2798)\n\n* fix(reconstruction): reject contradictory function comparison status\n\n* test(reconstruction): cover imported function match precedence\n\n---------\n\nCo-authored-by: maxazure <405711+maxazure@users.noreply.github.com>", "parents": ["1eca60051506cce310116854fdb59ef9cd195a7e"], "authors": [ { "name": "Liu Jie", "email": "maxazure@gmail.com", "user": { "login": "maxazure", "__typename": "User" } }, { "name": "maxazure", "email": "405711+maxazure@users.noreply.github.com", "user": { "login": "maxazure", "__typename": "User" } } ], "pullRequests": [2798] }, { "sha": "ce748be2f30d5086e62106ca7d7d0d7b26b8fd28", "subject": "fix(process): order interaction differences by their dispatch time (#2739)", "body": "fix(process): order interaction differences by their dispatch time (#2739)\n\n* fix(process): order interaction differences by their dispatch time\n\nfirst_divergence ranks candidate differences by the earliest recorded\ntime of the differing observations, but eventTime read only `at_ms`.\nInteraction events record their time as `dispatched_at_ms`\n(and `scheduled_at_ms`), so a changed interaction always ranked as\nuntimed. An interaction outcome that differed at 6 ms therefore lost to\na process sample that differed at 500 ms.\n\nGive each comparison dimension its recorded time field. Interactions use\nthe dispatch time, when their outcome was observed; the other\ndimensions keep `at_ms`. An earlier process difference still wins.\n\nFixes #2645\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(process): require ordered interaction dispatch times in captures\n\nComparison ranks a changed interaction by its dispatch time, while\nfirstCollectionDivergence returns the first differing interaction by\nsequence. The capture parser checked only that interaction sequences are\ncontiguous, so an imported capture whose dispatch times decrease could\nmake that first-by-sequence difference later than another differing\ninteraction.\n\nInteractions are dispatched in sequence and their times come from the\nmonotonic capture clock, so require non-decreasing dispatch times at\nparsing, as frames, rendered frames, process samples and filesystem\ncheckpoints already require for their timestamps.\n\nCo-Authored-By: Claude Opus 5.5 \n\n---------\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["173da755cd6b922f8310a1efa0fb8435be2e4d64"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2739] }, { "sha": "c45d912c911a46c72017242a5c154c1347e6abd5", "subject": "feat(android): expose exact DEX descriptors and direct invoke sites (#2439)", "body": "feat(android): expose exact DEX descriptors and direct invoke sites (#2439)\n\n* feat(android): expose precise method references and DEX invoke sites\n\n* fix(android): bound invoke evidence without losing reference inventory\n\n* perf(android): skip invoke admission for class references\n\n---------\n\nCo-authored-by: LcokHcak <268763621+LcokHcak@users.noreply.github.com>\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["ce748be2f30d5086e62106ca7d7d0d7b26b8fd28"], "authors": [ { "name": "LcokHcak", "email": "j1637848276@gmail.com", "user": { "login": "LcokHcak", "__typename": "User" } }, { "name": "LcokHcak", "email": "268763621+LcokHcak@users.noreply.github.com", "user": { "login": "LcokHcak", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2439] }, { "sha": "c938f97fb2a84229a9de17fc20276ce3d009ee3b", "subject": "fix(android): clean Windows workspaces after owner termination (#2440)", "body": "fix(android): clean Windows workspaces after owner termination (#2440)\n\n* fix(android): clean Windows workspaces after owner termination\n\n* fix(android): retain Windows workspace guardian on cleanup failure\n\n* fix(android): preserve released guardian pipe state on cleanup retry\n\n* fix(android): normalize extended local guardian parent paths\n\n---------\n\nCo-authored-by: LcokHcak <268763621+LcokHcak@users.noreply.github.com>\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["c45d912c911a46c72017242a5c154c1347e6abd5"], "authors": [ { "name": "LcokHcak", "email": "j1637848276@gmail.com", "user": { "login": "LcokHcak", "__typename": "User" } }, { "name": "LcokHcak", "email": "268763621+LcokHcak@users.noreply.github.com", "user": { "login": "LcokHcak", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2440] }, { "sha": "5996d8160f2429965b30070d04b26aba472af1db", "subject": "fix(native): bound captured output carried by native command failures (#2764)", "body": "fix(native): bound captured output carried by native command failures (#2764)\n\n* fix(native): bound captured output carried by native command failures\n\nThe native command runner retains up to 64 MiB of output because\nsuccessful analysis needs it complete, and failureCapture copied all of\nit into the failure. An inspect_plist whose plutil output exceeded the\nbudget therefore returned a 67 MB resource_constraint error whose\ndetails.captured_output.stdout repeated the whole retained output.\n\nKeep a 64 KiB UTF-8-safe excerpt per stream in failure diagnostics,\nmark them truncated, and keep the observed stdout/stderr byte totals.\nSuccessful captures are unchanged.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(native): bound codesign failures and cover excerpt cuts\n\ntranslateCodeSignExitFailure wrapped an accepted nonzero codesign capture\ninto a NativeCommandFailure by copying both complete streams, so\ninspect_signature failures still bypassed the diagnostic bound. Route it\nthrough the shared failureCapture builder; accepted output stays\ncomplete until the provider decides it is a failure.\n\nAdd a focused runner test for an ordinary nonzero exit with stdout and\nstderr just above the excerpt size and a two-byte character straddling\nthe cut, and a provider test for the codesign path.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* test(native): build excerpt test output inside the child process\n\nThe output strings embedded in one node -e argument totalled about 133\nKB, above Linux's 128 KiB per-argument limit, so spawn failed with E2BIG\non the CI runner. Generate the repeated output in the child instead.\n\nCo-Authored-By: Claude Opus 5.5 \n\n---------\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["c938f97fb2a84229a9de17fc20276ce3d009ee3b"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2764] }, { "sha": "fd65e278be4d802a06bbe176d997aaac0c4c9884", "subject": "fix(setup): resolve the configuration MSIX Claude Desktop reads (#2426)", "body": "fix(setup): resolve the configuration MSIX Claude Desktop reads (#2426)\n\n* fix(setup): resolve the configuration MSIX Claude Desktop reads\n\nOn Windows, setup, doctor and uninstall always used\n%APPDATA%\\Claude\\claude_desktop_config.json. The MSIX build of Claude\nDesktop (package family Claude_pzs8sxrjxfjjc) virtualizes AppData writes\nand reads its package-private copy under\n%LOCALAPPDATA%\\Packages\\\\LocalCache\\Roaming\\Claude once it exists.\nSetup from an ordinary process therefore wrote a file the app never reads,\nand doctor reported that file healthy.\n\nResolve the Claude Desktop location once, in supportedClients(): the\nprivate copy when it exists, else the AppData file the package still\nreads, else a new private copy. An unrecognized Claude_* publisher or\nunreadable package storage is reported instead of falling back to AppData.\n\nCompare one of the package's private files with its AppData path through\nrealpath.native to learn whether the running package started this\nprocess. From that redirected view, or when no file can be compared,\nsetup and uninstall refuse to change Claude Desktop's configuration,\nbecause the running app rewrites it from memory. From a redirected view\nthey also refuse writes under %APPDATA% and %LOCALAPPDATA% for other\nclients and skills, which would land in the package's private storage.\n\nSetup refuses to register a launcher stored in any MSIX package's\nprivate storage, discloses which file the package reads, and tells the\nuser to quit Claude Desktop fully on every platform. Configuration fails\nwith target_changed if the package switched to its private copy after\nthe plan was shown. Uninstall removes REA from both files.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* docs(setup): record the verified MSIX Claude Desktop registration\n\nOn the Windows 11 host with the MSIX build 2.31226.1.0, setup from an\nordinary terminal with the app quit wrote the package-private copy. After\nthe app restarted, the entry persisted, doctor reported it aligned, and\nClaude Desktop's MCP log showed REA starting and answering tools/list.\nUninstall against the real app remains unverified.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* style(setup): format MSIX review corrections\n\n* fix(setup): carry the admitted legacy path through uninstall removal\n\nclientRegistrationRemoval returned a removeLegacy boolean, and removeClient\nrecomputed the legacy path separately, so TypeScript could not prove the\npath existed when removeLegacy was true and `tsc --noEmit` failed in\nUninstall.ts. The decision now returns the admitted legacy path itself;\npreflight and removal consume that one value.\n\nThe alias regression matched new-destination children with a \"/\"\nseparator while building paths with path.join, so it failed on Windows.\nIt now uses path.sep.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* test(setup): split MSIX Claude Desktop lifecycle cases under the function length limit\n\nThe uninstall cases pushed the registration lifecycle describe past the 150-line lint limit. Group them separately, with the AppData registration case kept among the registration cases.\n\nCo-Authored-By: Claude Opus 5.5 \n\n---------\n\nCo-authored-by: Claude Opus 5.5 \nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["5996d8160f2429965b30070d04b26aba472af1db"], "authors": [ { "name": "FeeHaard", "email": "120994000+FeeHaard@users.noreply.github.com", "user": { "login": "FeeHaard", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2426] }, { "sha": "e3a012d6c98c60f3254e41e8b7d9c9f66e7cbe17", "subject": "fix(flutter): reject ambiguous ELF mappings and bound note reads (#2334)", "body": "fix(flutter): reject ambiguous ELF mappings and bound note reads (#2334)\n\n* fix(flutter): reject ambiguous mappings and bound ELF notes\n\nResolve PT_LOAD interpretations once for symbols and dynamic tables, including partial overlaps. Preserve equivalent mappings and leave conflicting or invalid alternate definitions unresolved.\n\nBound distinct nonempty ELF note ranges before retention and reads, deduplicate shared ranges, preserve observed build-ID candidates and report partial coverage on exhaustion. Correct shared verifier workspace ownership and structured Windows path assertions.\n\nAddresses the two post-merge review findings on PR #1582. Validation: 147 focused cases across Linux, macOS Sonoma 14.8.9 and non-administrator Windows 11 build 26300.9457; real Gallery CLI/MCP checks on all three hosts; six compiler-produced ELF32/ELF64 hash-layout cases; static, docs, discovery and duplication checks. Full string-pool projections remain explicitly bounded.\n\n* test(flutter): parse complete facts through named result schemas\n\n---------\n\nCo-authored-by: me \nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["fd65e278be4d802a06bbe176d997aaac0c4c9884"], "authors": [ { "name": "Quentin Limo", "email": "85309073+3QL@users.noreply.github.com", "user": { "login": "3QL", "__typename": "User" } }, { "name": "me", "email": "me@medz.org", "user": null }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2334] }, { "sha": "5278835b534a9787a680f94ad2182c314f24c1e9", "subject": "fix(flutter): find snapshot headers that a read chunk boundary splits (#2804)", "body": "fix(flutter): find snapshot headers that a read chunk boundary splits (#2804)\n\n* fix(flutter): find snapshot headers that a read chunk boundary splits\n\nWithin one chunk the snapshot hash scanner resumes four bytes after each\nmagic, but across chunks it resumed after the whole 52-byte record and\ndropped the carried bytes. A magic starting 49-51 bytes after a rejected\n(non-hex) record was therefore lost when its four bytes straddled a read\nboundary, so the result depended on chunking and a conflicting hash could\nbe omitted while coverage stayed complete. Resume after the magic in both\ncases.\n\n* refactor(flutter): drop the snapshot scanner cursor the fix superseded\n\nAfter a complete record the carried tail is shorter than a magic, and a\npending magic has not been processed, so every push can rescan its carried\nbytes from the start without counting a record twice. Remove the absolute\ncursor and base offset, and cover sections 49-51 bytes after a rejected\nrecord with two-chunk and byte-at-a-time feeds.", "parents": ["e3a012d6c98c60f3254e41e8b7d9c9f66e7cbe17"], "authors": [ { "name": "Dragolone", "email": "160818051+Dragolone@users.noreply.github.com", "user": { "login": "Dragolone", "__typename": "User" } } ], "pullRequests": [2804] }, { "sha": "30e9b83a68c4729745ca6413ea306dbffb30f07a", "subject": "fix(ida): retain bounded stderr on upstream transport failures (#2449)", "body": "fix(ida): retain bounded stderr on upstream transport failures (#2449)\n\n* fix(ida): retain bounded stderr on upstream transport failures\n\n* fix(ida): preserve stderr through operation and cleanup boundaries\n\nAddress review findings at their producing boundaries and preserve directly affected consumers. Source inspection and git diff --check completed. Tests and automated checks were not run at the user’s explicit request.\n\n* fix(ida): preserve cancellation and single-owner stderr diagnostics\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["5278835b534a9787a680f94ad2182c314f24c1e9"], "authors": [ { "name": "GuoJun Tang", "email": "76832285+Melon-tgj@users.noreply.github.com", "user": { "login": "Melon-tgj", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2449] }, { "sha": "b17487f482ce0769dd0c1415297f9c3e1bb7509f", "subject": "fix(comparison): keep unsupported function facets unknown (#2450)", "body": "fix(comparison): keep unsupported function facets unknown (#2450)\n\n* fix(comparison): keep unsupported function facets unknown\n\n* docs(comparison): explain function facet availability\n\n* fix(analysis): preserve unavailable facets across Evidence consumers\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["30e9b83a68c4729745ca6413ea306dbffb30f07a"], "authors": [ { "name": "GuoJun Tang", "email": "76832285+Melon-tgj@users.noreply.github.com", "user": { "login": "Melon-tgj", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2450] }, { "sha": "21aa877e5ae3164cfbfab6f6db27967995ebc8c3", "subject": "fix(process): honor startup deadlines and add a CI audit skill (#2692)", "body": "fix(process): honor startup deadlines and add a CI audit skill (#2692)\n\n* docs(skills): add CI and test correctness auditing\n\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>\n\n* fix(process): report no remaining time after a provider deadline fires\n\nNode timers can fire while performance.now() is still a fraction of a\nmillisecond short of the monotonic deadline. ProviderStartupDeadline then\nreported interruption \"timeout\" and an aborted signal while remainingMs()\nreturned ceil(0.x) = 1, so polling loops guarded by remainingMs() > 0\n(Hopper and Ghidra startup) could run past an elapsed deadline, and the\nreal-timer test \"aborts a bounded wait when its real monotonic deadline\nexpires\" failed intermittently in CI (expected 1 to be 0).\n\nOnce the deadline's own timer has classified a timeout, report zero\nremaining time. A deterministic regression test fires the timer with the\nmonotonic clock 0.4 ms short of the deadline.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(process): retain the monotonic startup deadline budget\n\nRecheck the absolute monotonic deadline when an early timer fires, and keep\npolling waits pending until their own target or the shared deadline arrives.\nPreserve caller cancellation, disposal and the unchanged real-timer assertion.\nThis replaces the earlier remainingMs workaround: an early callback must not\nclassify an unexpired deadline as a timeout.\n\nAdapt the production fix and regression cases from nosmile99 PR #2793 at\n546001693636f13700d86c6e93b6086abba2b7d6, including the independently reported\nboth-timers-early reproduction. Preserve the prior contributor's commit.\n\nFixes #2760\n\nCo-authored-by: nosmile99 <147114285+nosmile99@users.noreply.github.com>\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>\n\n* style(tests): format the Java class fixture signature\n\nThe captured main baseline has an unformatted helper signature. Apply the\nrepository formatter so the required style gate can run to completion.\n\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>\n\n* test(ghidra): group expanded suites by their contracts\n\nSplit result-envelope and completeness checks, and Windows invocation and\nruntime checks, into named describe groups within the existing lint limit.\nPreserve every test, fixture, assertion and platform prerequisite.\n\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>\n\n---------\n\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>\nCo-authored-by: Claude Opus 5.5 \nCo-authored-by: nosmile99 <147114285+nosmile99@users.noreply.github.com>", "parents": ["b17487f482ce0769dd0c1415297f9c3e1bb7509f"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } }, { "name": "nosmile99", "email": "147114285+nosmile99@users.noreply.github.com", "user": { "login": "nosmile99", "__typename": "User" } } ], "pullRequests": [2692] }, { "sha": "9b08c2b1cbbd74631738db1ddb326592682326e8", "subject": "fix(native/windows): share FILE_SHARE_DELETE so owned objects can be marked delete-pending (#2445)", "body": "fix(native/windows): share FILE_SHARE_DELETE so owned objects can be marked delete-pending (#2445)\n\n* fix(native/windows): share FILE_SHARE_DELETE so owned objects can be marked delete-pending\n\nThe Windows native authority self-test (`binding.call(\"inspect\", [])`) fails\nclosed on stock Windows x64 with a non-admin user:\n\n Delete owned object by handle failed (Win32 5): Access is denied.\n\nReproduced deterministically (15/15 failures) on Windows 11 x64, Node 22.22.2,\nnon-elevated account. Because `inspect` is a hard gate, every provider-backed\noperation is rejected and the whole native authority is unusable.\n\nRoot cause: Windows requires that every handle currently open on an object\ngrants FILE_SHARE_DELETE before that object can be marked delete-pending via\nSetFileInformationByHandle(FileDispositionInfo).\n\n`createRelative()` creates the runtime object with FILE_SHARE_READ only, and the\nreturned handle is retained for the lifetime of the runtime\n(`Runtime::directory`). `closeRuntime()` later needs to mark that same object\ndelete-pending, but the retained handle never shared DELETE, so the transition\nis denied (Win32 5).\n\nThe child handles opened by `closeRuntime()` for recursive cleanup have the same\ndefect: they request DELETE access while sharing only FILE_SHARE_READ, so the\nsubsequent `dispose()` call on those very handles is denied too.\n\nFix: add FILE_SHARE_DELETE to both share masks, keeping FILE_SHARE_READ and\ndeliberately not adding FILE_SHARE_WRITE, so the existing write-exclusion\nbehaviour of the retained leases is preserved while the delete-pending\ntransition the cleanup path depends on becomes possible.\n\nVerified end-to-end after the change: `inspect` passes, the full runtime\nlifecycle (`runtime_create` / `runtime_mkdir` / `runtime_write` / `runtime_open`\n/ `runtime_close`) completes with no residual directories, and a real 925 MB\napplication analysis (4396 files) runs through all stages.\n\n* fix(windows): anchor private runtime cleanup to directory handles\n\n* test(windows): assert cleanup sharing failure by code\n\n---------\n\nCo-authored-by: maodns <311719211+maodns@users.noreply.github.com>\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["21aa877e5ae3164cfbfab6f6db27967995ebc8c3"], "authors": [ { "name": "maodns", "email": "maodns@qq.com", "user": { "login": "maodns", "__typename": "User" } }, { "name": "maodns", "email": "311719211+maodns@users.noreply.github.com", "user": { "login": "maodns", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2445] }, { "sha": "c9982ad8bfdfb8f33055ea6ead13d0b59830a18f", "subject": "fix(browser): release scenario listeners and allow bounded Chrome close (#2441)", "body": "fix(browser): release scenario listeners and allow bounded Chrome close (#2441)\n\n* fix(browser): release scenario event listeners on finish\n\n* fix(browser): allow Chrome cleanup to complete within bounded deadline\n\n* style(browser): format cleanup deadline regression\n\n* test(browser): expect popup cleanup listener\n\n---------\n\nCo-authored-by: LcokHcak <268763621+LcokHcak@users.noreply.github.com>\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["9b08c2b1cbbd74631738db1ddb326592682326e8"], "authors": [ { "name": "LcokHcak", "email": "j1637848276@gmail.com", "user": { "login": "LcokHcak", "__typename": "User" } }, { "name": "LcokHcak", "email": "268763621+LcokHcak@users.noreply.github.com", "user": { "login": "LcokHcak", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2441] }, { "sha": "f0b8ae1fc8347bffa363ec49ac210850123ee699", "subject": "fix(javascript): trace nested Electron bridge members (#2745)", "body": "fix(javascript): trace nested Electron bridge members (#2745)\n\n* fix(javascript): trace nested Electron bridge members\n\n* fix(javascript): preserve shallow Electron bridge paths\n\n* fix(javascript): preserve exact Electron bridge member paths\n\n* fix(javascript): preserve exact Electron bridge paths\n\n* fix(javascript): preserve bridge entry ownership\n\n* fix(javascript): preserve bridge path identity\n\n* fix(javascript): normalize typed feature seeds before tracing\n\n* test(javascript): normalize direct selector seed inputs\n\n* refactor(javascript): consume normalized feature seed defaults\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["c9982ad8bfdfb8f33055ea6ead13d0b59830a18f"], "authors": [ { "name": "Avocado", "email": "headmastereggy@gmail.com", "user": { "login": "HeadmasterEggy", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2745] }, { "sha": "1016c96e6ba920c1c7da6898db16929145c749be", "subject": "fix(source-maps): accept omitted names during browser collection (#2831)", "body": "fix(source-maps): accept omitted names during browser collection (#2831)", "parents": ["f0b8ae1fc8347bffa363ec49ac210850123ee699"], "authors": [ { "name": "Yann Roberto", "email": "165009858+shoyann@users.noreply.github.com", "user": { "login": "shoyann", "__typename": "User" } } ], "pullRequests": [2831] }, { "sha": "865c35e25a0123c3c3a24d63f98d7c585e609091", "subject": "fix(ghidra): disclose missing PDB symbol coverage (#2275)", "body": "fix(ghidra): disclose missing PDB symbol coverage (#2275)\n\n* fix(ghidra): disclose missing PDB symbol coverage\n\n* style: format reviewed source changes\n\n* fix(ghidra): bound PDB handshake and retain coverage uncertainty\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>\nCo-authored-by: morluto <17176810+morluto@users.noreply.github.com>", "parents": ["1016c96e6ba920c1c7da6898db16929145c749be"], "authors": [ { "name": "Hifza Zafar", "email": "152292315+hifzabuildsai@users.noreply.github.com", "user": { "login": "hifzabuildsai", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "morluto", "email": "17176810+morluto@users.noreply.github.com", "user": { "login": "skydavil", "__typename": "User" } } ], "pullRequests": [2275] }, { "sha": "cbe769b5043b32c5bbcf785cace094e29960d374", "subject": "docs: move translated READMEs under docs/readme (#2165)", "body": "docs: move translated READMEs under docs/readme (#2165)\n\nMove all 18 translated READMEs into docs/readme/ and keep the English entry at the repository root. Update navigation, guide/image paths, website discovery and documentation checks together.\n\nPreserve the contributor's work and current main content. Cover every translated command and HTML destination, and repair the verified Persian heading fragments.\n\nValidation: 203 focused tests on the synchronized head, plus 119 tests and documentation checks on the integration with main fc0dbe7f9; 1,501 local references and 399 authored fragments verified. The complete CI workflow passes. The upstream x64 dylib fixture correction is included; an unchanged-checkout rerun cleared the earlier deadline timing assertion.\n\nCloses #2141\n\nCo-authored-by: Aimal Khan <94559553+aimalexe@users.noreply.github.com>\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>", "parents": ["865c35e25a0123c3c3a24d63f98d7c585e609091"], "authors": [ { "name": "Aimal Khan", "email": "94559553+aimalexe@users.noreply.github.com", "user": { "login": "aimalexe", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "factory-droid[bot]", "email": "138933559+factory-droid[bot]@users.noreply.github.com", "user": { "login": "factory-droid[bot]", "__typename": "User" } } ], "pullRequests": [2165] }, { "sha": "c85abacdb27e275880722fcb7b4138c54e43a87b", "subject": "fix(ida): mock legacy list_functions in attached transport tests", "body": "fix(ida): mock legacy list_functions in attached transport tests\n\nThe attached fixture negotiates the legacy protocol, so list_procedures\ncalls list_functions, never list_funcs. The list_funcs mocks added in\n#2449 never fired and both tests failed on arrival. No product change.\n", "parents": ["cbe769b5043b32c5bbcf785cace094e29960d374"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "7369b5ee63c69af8af18601bb1de92dd41c6a250", "subject": "fix(ida): retain cleanup facts and let one-shot commands exit (#2814)", "body": "fix(ida): retain cleanup facts and let one-shot commands exit (#2814)\n\n* fix(ida): let one-shot commands exit after retaining cleanup\n\nWhen a headless IDA request outlives timeoutMs (for example idb_open on\na large binary still running auto-analysis), REA cannot prove the\nworker stopped and correctly retains the upstream connection and\nprivate workspace. The retained stdio child and its pipes stayed\nreferenced, so a one-shot CLI printed its cleanup_incomplete result and\nthen never exited, keeping the supervisor, worker and database alive.\n\nDetach the retained connection's child process and pipes from the event\nloop when cleanup fails. A long-lived MCP server can still retry\nthrough the retained connection; a one-shot CLI exits with status 1,\nand the supervisor observes end of input.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(ida): report an unverified upstream worker after failed cleanup\n\nUpstream ida-pro-mcp spawns headless workers in their own session and\ndeliberately leaves them running when its supervisor exits, so neither\na retained connection nor REA exiting proves that a timed-out worker\nstopped. When cleanup fails before the owned worker's release is\nconfirmed, the cleanup diagnostics now name its private session and\nstate that it may still be running until it finishes and reaches its\nidle timeout. Failures after a confirmed release, or before any open\nwas attempted, do not report a worker.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(ida): name the inventory sessions that block worker release\n\nWhen idb_close confirmed the requested worker gone but the follow-up\ninventory still found a different peer on the private input, the\nupstream_worker diagnostic named the released session and could\nmisdirect manual cleanup. Record the session ids of the inventory\nentries that actually blocked release and report those; fall back to\nthe requested private session only when no inventory evidence exists\n(an incomplete open or an unanswered request). The field becomes\nsession_ids, since more than one entry can block release.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(ida): keep blocker evidence and backend in cleanup diagnostics\n\nThe release diagnostic reset its observed blockers on every close, so a\nretry whose inventory was unavailable fell back to the already-released\nsession; and it kept only session ids, describing a blocking GUI\nsession with detached-worker guidance.\n\nBlocker evidence is now replaced only by a successful inventory, and\nthe diagnostic becomes upstream_sessions with each session's id and\nbackend, with guidance that distinguishes workers from GUI sessions.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(ida): stop naming a worker after its close was confirmed\n\nWhen idb_close confirmed the requested worker's release but the\nfollowing inventory failed, no blocker evidence existed yet and the\ndiagnostic fell back to the confirmed-absent worker. After a confirmed\nclose the diagnostic now reports an empty session list, meaning any\nremaining same-input sessions are unknown.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* test(ida): group cleanup diagnostic cases in their own suite\n\nThe added cases pushed the reaped-worker describe block past the\n150-line limit enforced by lint:built.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(ida): keep ownership and pre-close peers in cleanup diagnostics\n\nBlocking sessions dropped the parsed ownership fact, so an external\nunowned worker looked the same as REA's own; and recovery inventory\nrecorded same-input peers only when the requested worker was missing,\nso a peer seen beside it was lost if the following close failed.\n\nEach reported session now carries owned (null when no inventory has\nreported it), and recovery records every same-input session until a\nlater successful inventory replaces that evidence.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(ida): drop a confirmed worker from retained cleanup blockers\n\nRecovery inventory now records the requested worker beside any peers,\nso once idb_close confirmed its release a failing follow-up inventory\nstill reported it as unreleased. Remove the confirmed session from the\nretained blockers at close confirmation and keep the remaining peers.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* test(ida): retry cleanup through a detached stdio connection\n\nThe retry coverage used a recording connection whose detach() only\ncounts calls, so it could not show that detaching keeps a retained\nconnection usable. Run a real stdio supervisor in a long-lived host,\nfail the first post-close inventory, and require the retry through the\nsame detached connection to confirm release and remove the workspace.\nThe test fails if detach() destroys the pipes instead of unref-ing them.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(ida): close the stdio supervisor in failed retry tests\n\nMerge main and give its new IdaNativeProtocol connection double the\nrequired detach() method. The real-stdio retry test now closes its\nconnection in an unconditional teardown, so a failing assertion cannot\nleave the supervisor waiting on stdin.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* test(ida): share the cleanup diagnostic expectation in session tests\n\nRepeated upstream_sessions assertions and the unrelated live peer\nliteral pushed repository duplication over the jscpd threshold. Build\nthe expected diagnostic with one helper and reuse one peer constant.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* test(ida): distinguish observed ownership from unreported input bindings\n\n* fix(ida): keep requested-ID conflicts in recovery cleanup\n\nRecovery inventory kept only same-input entries, unlike the startup and\npost-close filters. After an explicitly rejected open, an entry under\nthe requested session ID on another input was dropped, so cleanup could\nclose the connection, remove the private workspace and report success\nwhile that session stayed registered. Match the requested ID as well so\nthe entry is retained as a blocker and cleanup stays incomplete.\n\nAlso split the cleanup diagnostics suite under the lint:built function\nlength limit, and make two startup-inventory fixtures pass a defined\nsession id so the test file typechecks.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(ida): preserve retained session inventory facts\n\n---------\n\nCo-authored-by: Xingchuan Ma \nCo-authored-by: Claude Opus 5.5 \nCo-authored-by: morluto ", "parents": ["c85abacdb27e275880722fcb7b4138c54e43a87b"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "Xingchuan Ma", "email": "xingchuan.ma@msn.com", "user": null }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } }, { "name": "morluto", "email": "morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2814] }, { "sha": "6e25cc3c761da358f799e306c2be3545830b6a3b", "subject": "fix(tests): clear lint and typecheck errors on main", "body": "fix(tests): clear lint and typecheck errors on main\n\nSplit two over-long test functions into module-level helpers\n(max-lines-per-function): IdaSessionClient transport cases, IDA provider\ncomposition, and function comparison identity cases keep their names and\nassertions.\n\nAlso fix three typecheck errors: default omitted\ndirect_invokes_exhaustive to null so the result schema stays JsonValue\ncompatible, parse the ghidra dossier before spreading it, and delete the\noptional beforeCall hook instead of assigning undefined under\nexactOptionalPropertyTypes.\n", "parents": ["7369b5ee63c69af8af18601bb1de92dd41c6a250"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "1e38a038c61096a9213ee4f81c20f36211ae75a9", "subject": "fix(process): release handles and close worker on incomplete cleanup (#2321)", "body": "fix(process): release handles and close worker on incomplete cleanup (#2321)\n\n* fix(process): unreference handles on incomplete provider process stop\n\nSigned-off-by: Vinícius DS Andrade <95101505+viniciusdsandrade@users.noreply.github.com>\n\n* fix(javascript): close worker and release handles on incomplete cleanup\n\nSigned-off-by: Vinícius DS Andrade <95101505+viniciusdsandrade@users.noreply.github.com>\n\n* fix(javascript): defer worker stdin close until incomplete cleanup\n\nSigned-off-by: Vinícius DS Andrade <95101505+viniciusdsandrade@users.noreply.github.com>\n\n* test(javascript): assert cleanup error instance on inspection uncertainty\n\nSigned-off-by: Vinícius DS Andrade <95101505+viniciusdsandrade@users.noreply.github.com>\n\n---------\n\nSigned-off-by: Vinícius DS Andrade <95101505+viniciusdsandrade@users.noreply.github.com>\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["6e25cc3c761da358f799e306c2be3545830b6a3b"], "authors": [ { "name": "Vinícius Andrade", "email": "95101505+viniciusdsandrade@users.noreply.github.com", "user": { "login": "viniciusdsandrade", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2321] }, { "sha": "edd99398797051f8910e777bf5bf94aea5756f4a", "subject": "fix(browser): give the DevToolsActivePort wait one deadline owner (#2265)", "body": "fix(browser): give the DevToolsActivePort wait one deadline owner (#2265)\n\n* Single owner for the Chrome DevToolsActivePort startup deadline\n\nCold Chrome startup tolerance was spelled three ways for one wait: the helper\nfell back to 15,000 ms, the runtime fixture lifecycle passed a literal 60,000,\nand the real-browser verifier kept a local 60,000 constant. A per-caller literal\nquietly changes how long a lane tolerates a cold browser before it fails, and\nthe failure reported only elapsed_ms, so a reader could not see which ceiling\nwas hit.\n\nExport BROWSER_DEVTOOLS_STARTUP_TIMEOUT_MS as the owner, use it for the helper\nfallback and both call sites, and report startup_timeout_ms in\nBrowserStartupError. A source guard keeps callers from restating the number.\n\n* Pin the DevToolsActivePort deadline guard to the startup call argument\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["1e38a038c61096a9213ee4f81c20f36211ae75a9"], "authors": [ { "name": "The one -Niu", "email": "912906590@qq.com", "user": { "login": "NIU-123370", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2265] }, { "sha": "e103a89889d4fe5291d8f9125c62fbf1485b621c", "subject": "fix(artifacts): preserve NIB key and class name identity (#2109)", "body": "fix(artifacts): preserve NIB key and class name identity (#2109)\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["edd99398797051f8910e777bf5bf94aea5756f4a"], "authors": [ { "name": "xin zhuang", "email": "65798732+1052326311@users.noreply.github.com", "user": { "login": "1052326311", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2109] }, { "sha": "94072364c7f8410b0e86e72c912c2611572b278f", "subject": "fix(sqlite): keep triggers whose declaration spells the table in another case (#2807)", "body": "fix(sqlite): keep triggers whose declaration spells the table in another case (#2807)\n\n* fix(sqlite): keep triggers whose declaration spells the table in another case\n\nSQLite stores a trigger's target in sqlite_schema.tbl_name exactly as\nwritten in CREATE TRIGGER and resolves it by ASCII case folding, while an\nindex stores the table's own name. The selected_table scope filtered\ntbl_name with COLLATE BINARY, so a trigger declared ON users for table\nUsers was omitted while the schema still reported complete. Match\ndependents with COLLATE NOCASE, and report each trigger's table as the\nstored table or view name so the selected-table contract still holds.\n\n* fix(sqlite): refuse an inexact table before the case-folded schema scan\n\nWith the NOCASE expansion, a selection such as users for table Users\nexpanded the stored table's declarations before readRows reported the\nmissing exact name, so large trigger definitions could surface as an\noutput-limit failure instead of the selection error. Check the exact\ntable name against PRAGMA table_list first and share the selection\nfailure with readRows.\n\n* fix(sqlite): fold dependent names only for a row-selectable table\n\nAn exact view, virtual or possible shadow table passed the exact-name\nguard, so the NOCASE scan could still expand a differently cased trigger\npast the reply budget before readRows refused the selection. Fold case\nonly when the selection is an ordinary table that is not a possible\nshadow table, and keep the exact filter otherwise so every refused\nselection fails as it did before the case-folding change.\n\n* fix(sqlite): resolve trigger tables without folding unrelated names\n\nThe stored-name lookup case-folded every PRAGMA table_list name up front,\nso a selected-table inspection of a tiny table paid for large unrelated\nidentifiers. A selected-table scan only returns the selected table's\ndependents, so report the selected name directly; other scopes use an\nexact stored name when one matches and fold the stored names once, only\nwhen a trigger spells its target differently.\n\n* perf(sqlite): fold each table name once when matching shadow parents\n\nThe extracted shadow-parent helper folded the table name inside the find\ncallback, once per unresolved virtual table, and the selected table was\nchecked both before and during the schema scan. Fold the name once per\ncall as before, and reuse the selected table's result in the scan.", "parents": ["e103a89889d4fe5291d8f9125c62fbf1485b621c"], "authors": [ { "name": "Dragolone", "email": "160818051+Dragolone@users.noreply.github.com", "user": { "login": "Dragolone", "__typename": "User" } } ], "pullRequests": [2807] }, { "sha": "e13da084e7c5967b80632ae5ad8d3d37bcf57469", "subject": "fix(apple): exclude AppleDouble sidecars from IPA components (#2838)", "body": "fix(apple): exclude AppleDouble sidecars from IPA components (#2838)\n\n* fix(apple): exclude AppleDouble sidecars from IPA components\n\nIPA projection returned every inventoried component before the AppleDouble\nsidecar filter applied to directory, ZIP and DMG roots, so ._* and\n__MACOSX/ metadata appeared as native libraries and frameworks while the\nresult reported that sidecars are excluded. Apply the sidecar exclusion\nfirst for every root format; IPA still keeps non-sidecar components\noutside Payload/.\n\nFixes #2546\n\nCo-Authored-By: Claude Opus 5.5 \n\n* test(apple): exercise the __MACOSX exclusion with a non-dotfile name\n\nThe IPA fixture's __MACOSX entry also started with \"._\", so the AppleDouble\nfilename rule excluded it and a broken __MACOSX check would go unnoticed.\nUse a library name that only the __MACOSX rule excludes; the native\nlibrary assertion now fails if that rule regresses.\n\nCo-Authored-By: Claude Opus 5.5 \n\n---------\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["94072364c7f8410b0e86e72c912c2611572b278f"], "authors": [ { "name": "yasshmittal", "email": "myash0091@gmail.com", "user": { "login": "yasshmittal", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2838] }, { "sha": "204a6f3f20c48d3bbf96d8f2819f391150dafe32", "subject": "fix(ghidra): import HashMap in the bridge script (#2844)", "body": "fix(ghidra): import HashMap in the bridge script (#2844)\n\n8823c55b0 added a HashMap use without its import, so Ghidra could not\ncompile ReaGhidraBridge.java and every Ghidra-backed operation exited\nbefore bridge startup.\n\nCo-authored-by: SeokMyungSeop \nCo-authored-by: Claude Opus 5.5 ", "parents": ["e13da084e7c5967b80632ae5ad8d3d37bcf57469"], "authors": [ { "name": "SeokMyungSeop", "email": "132800182+SeokMyungSeop@users.noreply.github.com", "user": { "login": "SeokMyungSeop", "__typename": "User" } }, { "name": "SeokMyungSeop", "email": "SeokMyungSeop@users.noreply.github.com", "user": { "login": "SeokMyungSeop", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2844] }, { "sha": "3e7c6302233ecbcb9b92e43ee5a60337738961bd", "subject": "fix(mcp): count the error flag in error result budgets (#2848)", "body": "fix(mcp): count the error flag in error result budgets (#2848)\n\nError results reach the wire as text plus `isError: true`, but the\ntext-only envelope omitted the flag. An error up to 15 bytes above the\nresult budget passed both the delivery and transport checks and was sent\nas the original diagnostic instead of taking the oversized-error recovery\npath.\n\nRename the error representation to \"error-text\" and size its envelope\nwith the flag, so ToolResultDelivery and the error transport share the\ncomplete delivered shape. Successful structured results are unchanged.\n\nFixes #2557\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["204a6f3f20c48d3bbf96d8f2819f391150dafe32"], "authors": [ { "name": "Shubham Ahuja", "email": "157806066+shubhamahuja9999@users.noreply.github.com", "user": { "login": "shubhamahuja9999", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2848] }, { "sha": "40e94aeb9d127f61f554efdc7ab69c666fbf2c37", "subject": "fix(browser): preserve distinct WebMCP declaration metadata (#2854)", "body": "fix(browser): preserve distinct WebMCP declaration metadata (#2854)\n\n* fix(browser): preserve distinct WebMCP declaration metadata\n\n* test(browser): retain the first equivalent declaration location", "parents": ["3e7c6302233ecbcb9b92e43ee5a60337738961bd"], "authors": [ { "name": "xingzhou", "email": "zhang.guiping@xydigit.com", "user": { "login": "zhangguiping-xydt", "__typename": "User" } } ], "pullRequests": [2854] }, { "sha": "e6c6fdd21a769906c538629498cd9c1465821a94", "subject": "fix(browser): preserve script-specific parser uncertainty (#2858)", "body": "fix(browser): preserve script-specific parser uncertainty (#2858)", "parents": ["40e94aeb9d127f61f554efdc7ab69c666fbf2c37"], "authors": [ { "name": "xingzhou", "email": "zhang.guiping@xydigit.com", "user": { "login": "zhangguiping-xydt", "__typename": "User" } } ], "pullRequests": [2858] }, { "sha": "3c39a3f536b2b2dfdbab1109e1da949b59661a7e", "subject": "test(adb): isolate cross-platform activity launch regressions (#2226)", "body": "test(adb): isolate cross-platform activity launch regressions (#2226)\n\n* fix(adb): reject timed-out activity launches and retain observations\n\n* test(adb): isolate cross-platform activity launch regressions\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["e6c6fdd21a769906c538629498cd9c1465821a94"], "authors": [ { "name": "Lucien", "email": "164857476+dakjdakd@users.noreply.github.com", "user": { "login": "dakjdakd", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2226] }, { "sha": "688defca0f4a3de04eb199f7754f323c68896c3c", "subject": "fix(comparison): recheck historical calls-only changes (#2223)", "body": "fix(comparison): recheck historical calls-only changes (#2223)\n\n* fix(comparison): preserve incomplete function call evidence\n\nKeep missing, unknown, partial and unresolved call relationships unknown in function comparisons and reconstruction claims. Aggregate IDA caller and callee coverage without overwriting uncertainty.\n\nValidate with 144 focused tests, typecheck/lint, docs checks and test discovery. Real providers were not verified; the full headless IDA session suite requires unavailable Windows native controls.\n\n* fix(comparison): recheck historical calls-only changes\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["3c39a3f536b2b2dfdbab1109e1da949b59661a7e"], "authors": [ { "name": "Lucien", "email": "164857476+dakjdakd@users.noreply.github.com", "user": { "login": "dakjdakd", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2223] }, { "sha": "d005bd5dcd5fecf540a82b963df693efee38ac2c", "subject": "fix(javascript): preserve CommonJS lookup and analysis provenance (#2306)", "body": "fix(javascript): preserve CommonJS lookup and analysis provenance (#2306)\n\n* fix(javascript): preserve CommonJS directory and ancestor lookup\n\n* test(apple): bound cold archive fixture compilation\n\n* test(release): scope preflight schema to selected jobs\n\n* fix(javascript): retain requested analysis limits in Evidence\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["688defca0f4a3de04eb199f7754f323c68896c3c"], "authors": [ { "name": "Rohit Ghumare", "email": "48523873+rohitg00@users.noreply.github.com", "user": { "login": "rohitg00", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2306] }, { "sha": "ed93abed02e03d5423fd85c1f547121f406a06b7", "subject": "fix(cli): label each uninstall skill root by its client (#2197)", "body": "fix(cli): label each uninstall skill root by its client (#2197)\n\n* fix(cli): label each uninstall skill root by its client\n\nrea uninstall reported every managed skill destination under the\nshared \"skill\" label (with only Claude Code special-cased), so a\nretained or failed directory could not be told apart from the others.\n\nUse the destination's client identifier so the aggregated detail names\neach root: \"shared: retained (...)\", \"claude_code: removed (...)\",\n\"antigravity: retained (...)\". Retained and failed entries now point to\nthe specific directory that needs attention.\n\nFixes #2111\n\nCo-Authored-By: Claude Fable 5 \n\n* test(cli): align skill summary assertions with client and path labels\n\n---------\n\nCo-authored-by: wjl8636 \nCo-authored-by: Claude Fable 5 \nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["d005bd5dcd5fecf540a82b963df693efee38ac2c"], "authors": [ { "name": "万家良", "email": "102887115+wjl8636@users.noreply.github.com", "user": { "login": "wjl8636", "__typename": "User" } }, { "name": "wjl8636", "email": "wjl8636@users.noreply.github.com", "user": { "login": "wjl8636", "__typename": "User" } }, { "name": "Claude Fable 5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2197] }, { "sha": "7dcd23c005ac40ae2523861ae8806e29cb1d74ed", "subject": "fix(setup): separate host support and stop skill checks after drift (#2073)", "body": "fix(setup): separate host support and stop skill checks after drift (#2073)\n\n* fix(host): separate REA host support from Hopper installer targets\n\nLinuxDistribution.supported carried two meanings at once: that the host runs\nREA, and that the automated Hopper installer is tested on it. The doctor read\nthe first meaning from the second, so Debian-derived hosts such as Kali\nreported unsupported_host while their providers worked normally.\n\nRename the field to hopperSetupSupported, which only the Hopper installer and\nsetup planning consume, and derive host support from the package family\nthrough supportsReaHost(). Any distribution with a recognized apt, dnf, or\npacman family is now a REA host. The tested Hopper installer list is\nunchanged, so Debian and Kali keep falling back to configuring an existing\nprovider instead of downloading an untested package.\n\nVerified on Kali 2026.3 (Debian testing, x86_64): rea doctor reports a healthy\nenvironment with Ghidra 12.1.4, and analyze_function decompiles an x86_64 ELF\nthrough the MCP server. npm run check, npm run docs:check, and the application\nand Ghidra suites pass. No Hopper or IDA host workflow was exercised.\n\n* fix(setup): stop skill checks after first drift\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["ed93abed02e03d5423fd85c1f547121f406a06b7"], "authors": [ { "name": "CindyGest", "email": "111882715+txiki739@users.noreply.github.com", "user": { "login": "txiki739", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2073] }, { "sha": "ffd8c9c03ddf5409cc7b044f0a1c48b4b0114bee", "subject": "test(evaluation): grade managed agent fixture facts (#1924)", "body": "test(evaluation): grade managed agent fixture facts (#1924)\n\n* test(evaluation): grade managed agent fixture facts\n\n* test(evaluation): cover distinct managed artifact deliveries\n\n* fix(evaluation): require unfiltered managed type inventories\n\n* fix(evaluation): preserve selected entry point grounding\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["7dcd23c005ac40ae2523861ae8806e29cb1d74ed"], "authors": [ { "name": "Huamnanx", "email": "69626391+Ramcharan49@users.noreply.github.com", "user": { "login": "Ramcharan49", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [1924] }, { "sha": "af142f656cf448120ad66ebb545bc92e77fd2401", "subject": "fix(mcp): report references a provider truncated in trace_feature (#2348)", "body": "fix(mcp): report references a provider truncated in trace_feature (#2348)\n\n* test(mcp): expect trace_feature to report references the provider truncated\n\nA provider that reports a capped xrefs read makes the trace truncated with a residual unknown for that target. An explicit complete report and a provider that reports nothing leave the trace as before.\n\n* fix(mcp): report references a provider truncated in trace_feature\n\nExecutions gain an optional flag for a capped xrefs read, set by the IDA adapter from the upstream cap. trace_feature marks the trace truncated with a residual unknown for that target only when the provider reports a truncation; a provider that reports nothing keeps its previous result. The trace_feature workflow profile is revised so earlier results are not replayed.\n\n* refactor(ida): report reference truncation whenever the runner observed an xrefs cap\n\n* test(mcp): cover session forwarding, per-target state, native reports and failures of the trace coverage\n\n* test(mcp): format the session forwarding test\n\n* test(process): format processCaptureLifecycle.test.ts after the merge\n\n* test(ida): declare the alignment each synthetic universal slice offset satisfies\n\n* fix(process): report no remaining time after a provider deadline fires\n\nNode timers can fire while performance.now() is still a fraction of a\nmillisecond short of the monotonic deadline. ProviderStartupDeadline then\nreported interruption \"timeout\" and an aborted signal while remainingMs()\nreturned ceil(0.x) = 1, so polling loops guarded by remainingMs() > 0\n(Hopper and Ghidra startup) could run past an elapsed deadline, and the\nreal-timer test \"aborts a bounded wait when its real monotonic deadline\nexpires\" failed intermittently in CI (expected 1 to be 0).\n\nOnce the deadline's own timer has classified a timeout, report zero\nremaining time. A deterministic regression test fires the timer with the\nmonotonic clock 0.4 ms short of the deadline.\n\nCo-Authored-By: Claude Opus 5.5 \n(cherry picked from commit dfdaa0ca74cc84a45dcb186422a0f51aa61bc427)\n\n* fix(process): keep monotonic deadline ownership after merge\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>\nCo-authored-by: Claude Opus 5.5 ", "parents": ["ffd8c9c03ddf5409cc7b044f0a1c48b4b0114bee"], "authors": [ { "name": "Mykola Dementiev", "email": "nikolay-dementiev@users.noreply.github.com", "user": { "login": "nikolay-dementiev", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2348] }, { "sha": "b19f9e4d2dc0c4e863b4b2e567b3eaf9cf320983", "subject": "fix(javascript): keep spread child argv counts unknown (#2748)", "body": "fix(javascript): keep spread child argv counts unknown (#2748)\n\n* fix(javascript): keep spread child argv counts unknown\n\n* test(javascript): own runtime controls and tighten evidence assertions\n\n* test(apple): keep dyld slice regression portable\n\n---------\n\nCo-authored-by: hhang <169027046+xu91102@users.noreply.github.com>", "parents": ["af142f656cf448120ad66ebb545bc92e77fd2401"], "authors": [ { "name": "hhang", "email": "17309584214@163.com", "user": { "login": "xu91102", "__typename": "User" } }, { "name": "hhang", "email": "169027046+xu91102@users.noreply.github.com", "user": { "login": "xu91102", "__typename": "User" } } ], "pullRequests": [2748] }, { "sha": "efc491ab4527b9e2084c6519f250472a1322b096", "subject": "feat(setup): add Kimi Code client support (#2744)", "body": "feat(setup): add Kimi Code client support (#2744)\n\n* feat(setup): add Kimi Code client support\n\nRegisters rea in ~/.kimi-code/mcp.json (or $KIMI_CODE_HOME/mcp.json), preserving unrelated settings with a .rea.backup; registration is command-based stdio with no type field, startupTimeoutMs 30000 and toolTimeoutMs 120000 from MCP_STARTUP_POLICY.\nStrict JSON parsing: empty or whitespace-only files initialize; malformed JSON is rejected untouched with no backup; explicit transport other than stdio reports invalid.\nBundled skill uses the shared ~/.agents/skills destination that Kimi Code discovers, installed and verified through the shared-skill flow.\nValidated by 19 Kimi-specific tests, 260 adjacent-client regressions passing, check:fast and docs:check, and real-client verification on Kimi Code 0.40.1 (173 tools discovered, real mcp__rea__analyze_javascript_application call succeeded).\n\n* fix(setup): preserve Kimi tool filters and strict JSON coverage\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["b19f9e4d2dc0c4e863b4b2e567b3eaf9cf320983"], "authors": [ { "name": "Tony Yu", "email": "49832190+ysntony@users.noreply.github.com", "user": { "login": "ysntony", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2744] }, { "sha": "43e33cd49e6707a36312d4a948fa42eaf96a72a1", "subject": "fix(artifacts): compare plist and NIB signatures without ASCII folding (#2098)", "body": "fix(artifacts): compare plist and NIB signatures without ASCII folding (#2098)\n\n* fix(artifacts): compare plist and NIB signatures without ASCII folding\n\nBuffer.toString(\"ascii\") drops the high bit, so a non-plist prefix could be decoded as bplist00 or NIBArchive and sent to the binary decoder.\n\nCo-authored-by: Cursor \n\n* fix(artifacts): satisfy the strict index check in the signature test\n\nCo-authored-by: Cursor \n\n* fix(artifacts): remove superseded signature regression causing CI failure\n\n---------\n\nCo-authored-by: Cursor \nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["efc491ab4527b9e2084c6519f250472a1322b096"], "authors": [ { "name": "Faheem Ahmad", "email": "fisforfaheem@gmail.com", "user": { "login": "fisforfaheem", "__typename": "User" } }, { "name": "Cursor", "email": "cursoragent@cursor.com", "user": { "login": "cursoragent", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2098] }, { "sha": "70611713e140a86201cdef659181012cbdd17f4d", "subject": "fix(targets): compare the Info.plist bplist prefix without ASCII folding (#2100)", "body": "fix(targets): compare the Info.plist bplist prefix without ASCII folding (#2100)\n\n* fix(targets): compare the Info.plist bplist prefix without ASCII folding\n\nThe six-byte prefix check used an encoding that maps high-bit bytes onto bplist, so a non-binary property list could be sent to the binary decoder.\n\nCo-authored-by: Cursor \n\n* fix(targets): satisfy the strict index check in the plist prefix test\n\nCo-authored-by: Cursor \n\n---------\n\nCo-authored-by: Cursor \nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["43e33cd49e6707a36312d4a948fa42eaf96a72a1"], "authors": [ { "name": "Faheem Ahmad", "email": "fisforfaheem@gmail.com", "user": { "login": "fisforfaheem", "__typename": "User" } }, { "name": "Cursor", "email": "cursoragent@cursor.com", "user": { "login": "cursoragent", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2100] }, { "sha": "2a78763e2070d71818a44bd419df549e13ce203c", "subject": "feat(native): search analyzed memory for masked byte patterns (#2341)", "body": "feat(native): search analyzed memory for masked byte patterns (#2341)\n\n* feat(native): search analyzed memory for masked byte patterns\n\nThe diff adds search_bytes to the CLI, the shared MCP contract, Ghidra\ninventory, and the headless bridge, and advertises the same operation on\nHopper as unavailable until that provider is verified. Patterns are\nhexadecimal byte pairs with optional ?? wildcards and an optional\nequal-length bit mask; the TypeScript boundary and the bridge both\nrequire a nonempty pattern, equal lengths, and at least one constrained\nbit. Ghidra walks initialized blocks in address order within inclusive\nbounds, keeps overlapping matches inside a single block, and returns\neach hit with its segment, unique source file offset, and containing\nprocedure, continuing through a cursor bound to the target, profile,\npattern, mask, and bounds. Each page reports the inclusive ranges\nexamined and the skipped uninitialized blocks; cancellation returns a\ntyped error and discards the active Ghidra database.\naddress_to_file_offset now uses the same unique-offset helper, which\nrejects a mapping that is missing, ambiguous, or larger than a safe\ninteger.\n\n* fix(native): limit unbounded byte search to loaded memory\n\nWithout start or end, search_bytes walked every Ghidra block, including\nnon-loaded file parts such as .symtab and overlay blocks, which the docs\ncall out of scope. Unbounded searches now skip those blocks and list them\nin searched.skipped_not_loaded; explicit bounds in their address space\nstill search them. Document that a match must end at or before end.\n\n* fix(native): preserve implicit address spaces in range consumers\n\n* fix(native): reject present malformed byte search state\n\n---------\n\nCo-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["70611713e140a86201cdef659181012cbdd17f4d"], "authors": [ { "name": "Matt Van Horn", "email": "mvanhorn@users.noreply.github.com", "user": { "login": "mvanhorn", "__typename": "User" } }, { "name": "Matt Van Horn", "email": "455140+mvanhorn@users.noreply.github.com", "user": { "login": "mvanhorn", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2341] }, { "sha": "c580ba940a1a29c586db47ad7df5234d51e0cc4a", "subject": "fix(browser): treat an unusable cache list as incomplete storage coverage (#2762)", "body": "fix(browser): treat an unusable cache list as incomplete storage coverage (#2762)\n\nSquash merge of https://github.com/morluto/rea/pull/2762.\n\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>\nCo-authored-by: Claude Opus 5.5 ", "parents": ["2a78763e2070d71818a44bd419df549e13ce203c"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2762] }, { "sha": "48b90fbaa4978d1f605b9901d58e6c4ab5ec78b6", "subject": "fix(native): preserve unresolved calls in untyped route fallback (#2757)", "body": "fix(native): preserve unresolved calls in untyped route fallback (#2757)\n\nSquash merge of https://github.com/morluto/rea/pull/2757.\n\nCo-authored-by: IvenKooLab <276572622@qq.com>", "parents": ["c580ba940a1a29c586db47ad7df5234d51e0cc4a"], "authors": [ { "name": "Iven Koo", "email": "73214171+IvenKooLab@users.noreply.github.com", "user": { "login": "IvenKooLab", "__typename": "User" } }, { "name": "IvenKooLab", "email": "276572622@qq.com", "user": { "login": "IvenKooLab", "__typename": "User" } } ], "pullRequests": [2757] }, { "sha": "af7638fa9d049283719c9c103bc59b49faab9676", "subject": "fix(session): preserve investigation records after failed target opens (#2754)", "body": "fix(session): preserve investigation records after failed target opens (#2754)\n\nSquash merge of https://github.com/morluto/rea/pull/2754.\n\nCo-authored-by: Adkid-Zephyr ", "parents": ["48b90fbaa4978d1f605b9901d58e6c4ab5ec78b6"], "authors": [ { "name": "Feng", "email": "laufs0310@163.com", "user": { "login": "Adkid-Zephyr", "__typename": "User" } } ], "pullRequests": [2754] }, { "sha": "ba06d9ec521f2654f6916ca58e38d33213dd6ddb", "subject": "fix(setup): keep a Cordis operation's own fields when uninstall empties it (#2730)", "body": "fix(setup): keep a Cordis operation's own fields when uninstall empties it (#2730)\n\nSquash merge of https://github.com/morluto/rea/pull/2730.\n\nCo-authored-by: JayOfTheKeyboard <140487034+JayOfTheKeyboard@users.noreply.github.com>", "parents": ["af7638fa9d049283719c9c103bc59b49faab9676"], "authors": [ { "name": "Jeremy Levartovsky", "email": "140487034+JayOfTheKeyboard@users.noreply.github.com", "user": { "login": "JayOfTheKeyboard", "__typename": "User" } } ], "pullRequests": [2730] }, { "sha": "9240a4e9ac22f6307ca591853c8c56ce2d0a5d56", "subject": "fix(javascript): preserve asterisks in block source-map URLs (#2728)", "body": "fix(javascript): preserve asterisks in block source-map URLs (#2728)\n\nSquash merge of https://github.com/morluto/rea/pull/2728.\n\nCo-authored-by: LouisChen <3361008+chqcjq@users.noreply.github.com>", "parents": ["ba06d9ec521f2654f6916ca58e38d33213dd6ddb"], "authors": [ { "name": "LouisChen", "email": "65096591@qq.com", "user": { "login": "chqcjq", "__typename": "User" } }, { "name": "LouisChen", "email": "3361008+chqcjq@users.noreply.github.com", "user": { "login": "chqcjq", "__typename": "User" } } ], "pullRequests": [2728] }, { "sha": "f825c869d6e94e27759160f3d0d3e82b5d2f55db", "subject": "fix(artifacts): bound expanded ASAR listing before allocation (#2724)", "body": "fix(artifacts): bound expanded ASAR listing before allocation (#2724)\n\nSquash merge of https://github.com/morluto/rea/pull/2724.\n\nCo-authored-by: chAngE <172472630+chAng-L19@users.noreply.github.com>\nCo-authored-by: morluto ", "parents": ["9240a4e9ac22f6307ca591853c8c56ce2d0a5d56"], "authors": [ { "name": "chAngE", "email": "2815456271@qq.com", "user": { "login": "chAng-L19", "__typename": "User" } }, { "name": "chAngE", "email": "172472630+chAng-L19@users.noreply.github.com", "user": { "login": "chAng-L19", "__typename": "User" } }, { "name": "morluto", "email": "morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2724] }, { "sha": "782cc3b060562f0397dd9f48827ef5e4ffc456a9", "subject": "refactor(process): give the prlimit producer budget one owner (#2698)", "body": "refactor(process): give the prlimit producer budget one owner (#2698)\n\nSquash merge of https://github.com/morluto/rea/pull/2698.\n\nCo-authored-by: NIU-123370 <191000457+NIU-123370@users.noreply.github.com>", "parents": ["f825c869d6e94e27759160f3d0d3e82b5d2f55db"], "authors": [ { "name": "The one -Niu", "email": "912906590@qq.com", "user": { "login": "NIU-123370", "__typename": "User" } }, { "name": "NIU-123370", "email": "191000457+NIU-123370@users.noreply.github.com", "user": { "login": "NIU-123370", "__typename": "User" } } ], "pullRequests": [2698] }, { "sha": "8b1549a264a914a1aec97d6945fc68ec8c5e1f64", "subject": "test: share repeated boundary preambles to restore the jscpd gate (#2691)", "body": "test: share repeated boundary preambles to restore the jscpd gate (#2691)\n\nSquash merge of https://github.com/morluto/rea/pull/2691.\n\nCo-authored-by: NIU-123370 <191000457+NIU-123370@users.noreply.github.com>", "parents": ["782cc3b060562f0397dd9f48827ef5e4ffc456a9"], "authors": [ { "name": "The one -Niu", "email": "912906590@qq.com", "user": { "login": "NIU-123370", "__typename": "User" } }, { "name": "NIU-123370", "email": "191000457+NIU-123370@users.noreply.github.com", "user": { "login": "NIU-123370", "__typename": "User" } } ], "pullRequests": [2691] }, { "sha": "2b98fc5f518f6da06a4f5157f5b7dd90014bbd6f", "subject": "fix(cli): reject empty analyze and artifact target paths (#2687)", "body": "fix(cli): reject empty analyze and artifact target paths (#2687)\n\nSquash merge of https://github.com/morluto/rea/pull/2687.\n\nCo-authored-by: LouisChen <3361008+chqcjq@users.noreply.github.com>\nCo-authored-by: morluto ", "parents": ["8b1549a264a914a1aec97d6945fc68ec8c5e1f64"], "authors": [ { "name": "LouisChen", "email": "65096591@qq.com", "user": { "login": "chqcjq", "__typename": "User" } }, { "name": "LouisChen", "email": "3361008+chqcjq@users.noreply.github.com", "user": { "login": "chqcjq", "__typename": "User" } }, { "name": "morluto", "email": "morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2687] }, { "sha": "522b9927c80bf0a3d0ab3343a648a158e94eba0c", "subject": "feat(recorded-crash): decode AArch64 core register notes (#2505)", "body": "feat(recorded-crash): decode AArch64 core register notes (#2505)\n\nSquash merge of https://github.com/morluto/rea/pull/2505.\n\nCo-authored-by: NIU-123370 <191000457+NIU-123370@users.noreply.github.com>", "parents": ["2b98fc5f518f6da06a4f5157f5b7dd90014bbd6f"], "authors": [ { "name": "The one -Niu", "email": "912906590@qq.com", "user": { "login": "NIU-123370", "__typename": "User" } }, { "name": "NIU-123370", "email": "191000457+NIU-123370@users.noreply.github.com", "user": { "login": "NIU-123370", "__typename": "User" } } ], "pullRequests": [2505] }, { "sha": "75e7965dc3a8a72576b1d5f013b624da81d53607", "subject": "docs(nativeaot): document the verified Windows-host parser route (#2497)", "body": "docs(nativeaot): document the verified Windows-host parser route (#2497)\n\nSquash merge of https://github.com/morluto/rea/pull/2497.\n\nCo-authored-by: pablodiazjorge ", "parents": ["522b9927c80bf0a3d0ab3343a648a158e94eba0c"], "authors": [ { "name": "pablodiazjorge", "email": "102741971+pablodiazjorge@users.noreply.github.com", "user": { "login": "pablodiazjorge", "__typename": "User" } }, { "name": "pablodiazjorge", "email": "pablodiazjorgegarcia@gmail.com", "user": { "login": "pablodiazjorge", "__typename": "User" } } ], "pullRequests": [2497] }, { "sha": "911894d75822116141897a582c1e26e1d0273dba", "subject": "feat(wasm): compare retained core-module interfaces (#2464)", "body": "feat(wasm): compare retained core-module interfaces (#2464)\n\nSquash merge of https://github.com/morluto/rea/pull/2464.\n\nCo-authored-by: Thang Luu <76550342+thangldw@users.noreply.github.com>", "parents": ["75e7965dc3a8a72576b1d5f013b624da81d53607"], "authors": [ { "name": "Thang Luu", "email": "thangldw@gmail.com", "user": { "login": "thangldw", "__typename": "User" } }, { "name": "Thang Luu", "email": "76550342+thangldw@users.noreply.github.com", "user": { "login": "thangldw", "__typename": "User" } } ], "pullRequests": [2464] }, { "sha": "554ea7611ea7eb94d73c80b57be168527de17d79", "subject": "fix(adb): keep the device's refusal when a package change exits nonzero (#2344)", "body": "fix(adb): keep the device's refusal when a package change exits nonzero (#2344)\n\nSquash merge of https://github.com/morluto/rea/pull/2344.\n\nCo-authored-by: Hui \nCo-authored-by: Claude Opus 5.5 ", "parents": ["911894d75822116141897a582c1e26e1d0273dba"], "authors": [ { "name": "Jin", "email": "a3239737781@gmail.com", "user": { "login": "huiq777", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2344] }, { "sha": "168bfe50604b3a435c05f2db9f8a0cf47230c660", "subject": "fix(target): probe WASM before inferred database routing (#2007)", "body": "fix(target): probe WASM before inferred database routing (#2007)\n\n* fix(target): probe WASM before inferred database routing\n\n* test(wasm): execute recovery arguments from native refusal\n\n* test(ci): repair fixture alignment and share MCP assertions\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["554ea7611ea7eb94d73c80b57be168527de17d79"], "authors": [ { "name": "SII-YDD", "email": "38822679+SII-YDD@users.noreply.github.com", "user": { "login": "SII-YDD", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2007] }, { "sha": "77e71d55ec5b3b44e3db366618b3f51ffd41c736", "subject": "fix(native): name numeric Mach-O build-version platforms and tools (#2065)", "body": "fix(native): name numeric Mach-O build-version platforms and tools (#2065)\n\nSquash merge of https://github.com/morluto/rea/pull/2065.\n\nCo-authored-by: TonyWu <2038838159@qq.com>", "parents": ["168bfe50604b3a435c05f2db9f8a0cf47230c660"], "authors": [ { "name": "TonyWu", "email": "75903587+TonyWu2333@users.noreply.github.com", "user": { "login": "TonyWu2333", "__typename": "User" } }, { "name": "TonyWu", "email": "2038838159@qq.com", "user": { "login": "TonyWu2333", "__typename": "User" } } ], "pullRequests": [2065] }, { "sha": "d86d29c41108cc5d784e324c6cbe50beac70a543", "subject": "fix(mcp): keep advertised inputs within client reference budgets (#1749)", "body": "fix(mcp): keep advertised inputs within client reference budgets (#1749)\n\nSquash merge of https://github.com/morluto/rea/pull/1749.\n\nCo-authored-by: akushonkamen \nCo-authored-by: GLM ", "parents": ["77e71d55ec5b3b44e3db366618b3f51ffd41c736"], "authors": [ { "name": "akushonkamen", "email": "74654766+akushonkamen@users.noreply.github.com", "user": { "login": "akushonkamen", "__typename": "User" } }, { "name": "akushonkamen", "email": "akushonkamen@163.com", "user": { "login": "akushonkamen", "__typename": "User" } }, { "name": "GLM", "email": "noreply@z.ai", "user": null } ], "pullRequests": [1749] }, { "sha": "af782dd5f56463fcd2a6a0af918569d70696551f", "subject": "fix(setup): treat empty DSH_HOME as unset (#2686)", "body": "fix(setup): treat empty DSH_HOME as unset (#2686)\n\n* fix(setup): treat empty DSH_HOME as unset (#2666)\n\nThe released `@deepseek-ai/dsh-home-paths` package explicitly treats an\nempty or whitespace-only `DSH_HOME` as unset and selects the default\nHarness home patch. `dshHomeDirectory` previously used nullish coalescing\n(`env.DSH_HOME ?? join(home, \".dsh\")`), so an empty override flowed\nstraight through `join(..., \"cordis.patch.yml\")` and produced a\ncwd-relative `cordis.patch.yml` outside the client-selected home.\n\nTreat empty and whitespace-only overrides as unset, matching the sibling\nOpenCode override resolver and the released DSH resolver. The patch now\nlands at `$DSH_HOME/cordis.patch.yml` for explicit overrides, the default\n`~/.dsh/cordis.patch.yml` for empty/unset, and trimmed whitespace for\npadded overrides.\n\nAdds `src/application/SupportedClients.test.ts` covering the empty,\nwhitespace-only, unset, padded, and explicit cases via the public\n`supportedClients(...)` entrypoint. Fixes #2666.\n\n* test(setup): remove superseded DSH path unit coverage\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["d86d29c41108cc5d784e324c6cbe50beac70a543"], "authors": [ { "name": "Royce", "email": "roycelam@umich.edu", "user": { "login": "rollroyces", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2686] }, { "sha": "59298923a5fc22eb3bfe192511b7fc72aaa85321", "subject": "fix(apktool): read the resource locale grammar from its owner (#2738)", "body": "fix(apktool): read the resource locale grammar from its owner (#2738)\n\nSquash merge of https://github.com/morluto/rea/pull/2738.\n\nOriginal pull request submitted by @XiaoBinGan.\n\nCo-authored-by: 吴佳浩 ", "parents": ["af782dd5f56463fcd2a6a0af918569d70696551f"], "authors": [ { "name": "吴佳浩Alben", "email": "35291372+XiaoBinGan@users.noreply.github.com", "user": { "login": "XiaoBinGan", "__typename": "User" } }, { "name": "吴佳浩", "email": "wujiahao@supremind.com", "user": null } ], "pullRequests": [2738] }, { "sha": "855ed9689e972903d3c6854907dac83207a00141", "subject": "fix(application): preserve a cancellation that races a completed provider run (#2710)", "body": "fix(application): preserve a cancellation that races a completed provider run (#2710)\n\nSquash merge of https://github.com/morluto/rea/pull/2710.\n\nOriginal pull request submitted by @XiaoBinGan.\n\nCo-authored-by: 吴佳浩 ", "parents": ["59298923a5fc22eb3bfe192511b7fc72aaa85321"], "authors": [ { "name": "吴佳浩Alben", "email": "35291372+XiaoBinGan@users.noreply.github.com", "user": { "login": "XiaoBinGan", "__typename": "User" } }, { "name": "吴佳浩", "email": "wujiahao@supremind.com", "user": null } ], "pullRequests": [2710] }, { "sha": "3f80b75708f88e51c64eb0122c178b96789c53b3", "subject": "fix(source-maps): keep sources when sourcesContent length differs (#2873)", "body": "fix(source-maps): keep sources when sourcesContent length differs (#2873)\n\nECMA-426 DecodeSourceMapSources reads a content slot only while its index\nis within sourcesContent, so a shorter array leaves trailing sources\nwithout content and a longer array adds no sources. Local application\nanalysis and browser collection rejected any length mismatch and dropped\nevery original from the map.\n\nThe content helper now checks only entry types. Browser collection drops\nits separate check because the leaf schema already validates every\nsupplied entry, and the raw records are still budgeted before parsing.\n\nFixes #2821", "parents": ["855ed9689e972903d3c6854907dac83207a00141"], "authors": [ { "name": "Riley Gramlich", "email": "101842921+rileygramlich@users.noreply.github.com", "user": { "login": "rileygramlich", "__typename": "User" } } ], "pullRequests": [2873] }, { "sha": "d4f0c5e664e26fe7ed1566dcc4b85ea9b57d52da", "subject": "fix(cli): start on Windows when USERPROFILE is empty (#2345)", "body": "fix(cli): start on Windows when USERPROFILE is empty (#2345)\n\n* fix(cli): start on Windows when USERPROFILE is empty\n\nNode's Windows home lookup throws ERR_SYSTEM_ERROR (uv_os_homedir ENOENT)\nfor an empty USERPROFILE instead of consulting the account profile. Incur\nresolves the home while it is imported, so every command, including\n`rea --version`, stopped with a raw stack trace before REA ran.\n\nTreat the empty selection as unset in the launcher, before any runtime\nimport, and cover startup with a compiled-CLI regression.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(process): report no remaining time after a provider deadline fires\n\nNode timers can fire while performance.now() is still a fraction of a\nmillisecond short of the monotonic deadline. ProviderStartupDeadline then\nreported interruption \"timeout\" and an aborted signal while remainingMs()\nreturned ceil(0.x) = 1, so polling loops guarded by remainingMs() > 0\n(Hopper and Ghidra startup) could run past an elapsed deadline, and the\nreal-timer test \"aborts a bounded wait when its real monotonic deadline\nexpires\" failed intermittently in CI (expected 1 to be 0).\n\nOnce the deadline's own timer has classified a timeout, report zero\nremaining time. A deterministic regression test fires the timer with the\nmonotonic clock 0.4 ms short of the deadline.\n\nCo-Authored-By: Claude Opus 5.5 \n\n---------\n\nCo-authored-by: Claude Opus 5.5 \nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>", "parents": ["3f80b75708f88e51c64eb0122c178b96789c53b3"], "authors": [ { "name": "Gefrezim", "email": "bruuuhofficial@gmail.com", "user": { "login": "gefrezim", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } } ], "pullRequests": [2345] }, { "sha": "72b9ab4af16a4f19383aa6dde4b12f25fab7f59f", "subject": "fix(javascript): retain configuration reads before member access (#2756)", "body": "fix(javascript): retain configuration reads before member access (#2756)\n\nSquash merge of https://github.com/morluto/rea/pull/2756.\n\nOriginal pull request submitted by @xu91102.\n\nCo-authored-by: hhang <169027046+xu91102@users.noreply.github.com>", "parents": ["d4f0c5e664e26fe7ed1566dcc4b85ea9b57d52da"], "authors": [ { "name": "hhang", "email": "17309584214@163.com", "user": { "login": "xu91102", "__typename": "User" } }, { "name": "hhang", "email": "169027046+xu91102@users.noreply.github.com", "user": { "login": "xu91102", "__typename": "User" } } ], "pullRequests": [2756] }, { "sha": "7e3a19863835215491b55fba7127a78bad6a7709", "subject": "fix(javascript): keep logical assignment results uncertain for unknown values (#2788)", "body": "fix(javascript): keep logical assignment results uncertain for unknown values (#2788)\n\n* fix(javascript): keep logical assignment results uncertain for unknown values\n\n* test(javascript): cover exact uninitialized logical assignments\n\nSource inspection and targeted formatting only. Tests, builds, lint, typechecks and provider workloads were not run at the user's explicit request.\n\n---------\n\nCo-authored-by: Ganesh2325 <184471511+Ganesh2325@users.noreply.github.com>\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["72b9ab4af16a4f19383aa6dde4b12f25fab7f59f"], "authors": [ { "name": "Ganesh", "email": "ganeshmaheshwaram2005@gmail.com", "user": { "login": "Ganesh2325", "__typename": "User" } }, { "name": "Ganesh2325", "email": "184471511+Ganesh2325@users.noreply.github.com", "user": { "login": "Ganesh2325", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2788] }, { "sha": "df3d96da801976fdbe37a726c2f4f84af8ffbf90", "subject": "fix: repair the static-check failures on the default branch (#2895)", "body": "fix: repair the static-check failures on the default branch (#2895)\n\n* fix: repair the static-check failures on the default branch\n\nThe default branch fails its own required `Static checks` job three ways, so\nevery pull request reports that job as failed regardless of its own change.\n\n- `npm run format:check` reports `src/domain/functionComparison.test.ts` and\n `src/ida/IdaOperationRunner.ts`.\n- `npm run lint` reports a duplicate `import { join } from \"node:path\"` in\n `tests/boundary/mcp/ghidraInventoryMcp.test.ts` (lines 4 and 17).\n- `npm run typecheck` reports `format: \"devin\"` missing from the client format\n union in `src/application/SupportedClients.ts`, and an unchecked index in\n `tests/boundary/cli/clientProfileLifecycle.test.ts`, whose pair array is\n inferred as `string[][]`.\n\nApply the pinned formatter, drop the duplicate import, list the `\"devin\"` format\nthat its own definition already uses, and mark the pair array `as const`.\n\nValidation: `npm run check:fast` and `npm run format:check` pass.\n\n* fix(setup): keep Devin on the JSON configuration dialect\n\n---------\n\nCo-authored-by: 吴佳浩 \nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["7e3a19863835215491b55fba7127a78bad6a7709"], "authors": [ { "name": "吴佳浩Alben", "email": "35291372+XiaoBinGan@users.noreply.github.com", "user": { "login": "XiaoBinGan", "__typename": "User" } }, { "name": "吴佳浩", "email": "wujiahao@supremind.com", "user": null }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2895] }, { "sha": "501c5d45fe60cae4a6337f38fc417f86d13e1ae8", "subject": "fix(managed): share native verification input diagnostics (#2901)", "body": "fix(managed): share native verification input diagnostics (#2901)", "parents": ["df3d96da801976fdbe37a726c2f4f84af8ffbf90"], "authors": [ { "name": "ShitK", "email": "80999801+ShitK@users.noreply.github.com", "user": { "login": "ShitK", "__typename": "User" } } ], "pullRequests": [2901] }, { "sha": "0c9ee56c2f819d122f12cb5872c5db76cfee1169", "subject": "fix(native): accept declared facts in dispatch name inventory (#2906)", "body": "fix(native): accept declared facts in dispatch name inventory (#2906)", "parents": ["501c5d45fe60cae4a6337f38fc417f86d13e1ae8"], "authors": [ { "name": "ShitK", "email": "80999801+ShitK@users.noreply.github.com", "user": { "login": "ShitK", "__typename": "User" } } ], "pullRequests": [2906] }, { "sha": "62c8b3da1b00260a5ef97d088737dafa0a7ea542", "subject": "feat(browser): attach passive tools to browsers without HTTP discovery (#2346)", "body": "feat(browser): attach passive tools to browsers without HTTP discovery (#2346)\n\n* feat(browser): attach passive tools to browsers without HTTP discovery\n\nAccept a literal loopback browser WebSocket,\nws://127.0.0.1:PORT/devtools/browser/ID, as the cdp_endpoint of the six\npassive browser tools. Discovery then reads Browser.getVersion and\nTarget.getTargets over that socket, and the target session adopts the\nsame socket, so a browser that asks for consent per connection prompts\nonce per call.\n\nThe socket identifier gates access, so Evidence records the endpoint as\nws://127.0.0.1:PORT/devtools/browser/[REDACTED], and runtime\nreconciliation accepts that recorded form. HTTP endpoints and their\nEvidence are unchanged. Electron, web runtime, scenario and Inspector\nendpoints stay HTTP-only.\n\nRefs #2288\n\n* test(browser): match browser-socket captures against HTTP discovery\n\nCheck in the real Chrome lane that DevToolsActivePort names the same\nbrowser socket as /json/version, and that inspecting the selected page\nthrough that socket leaves DOM structure and scripts unchanged compared\nwith an inspection through HTTP discovery.\n\nRefs #2288\n\n* fix(browser): bound browser-socket handshake and report discovery timeouts\n\nRun the browser-socket WebSocket handshake and both discovery commands\nunder one discovery deadline, so a port that accepts the connection but\nnever completes the upgrade times out instead of waiting forever.\n\nReport a reached deadline as a timeout without carrying the internal\nabort as its cause, so CLI and MCP project provider_timeout rather than\ncancelled. Caller cancellation is still reported as cancelled.\n\nRefs #2288", "parents": ["0c9ee56c2f819d122f12cb5872c5db76cfee1169"], "authors": [ { "name": "all-black-493", "email": "justinjerome401@gmail.com", "user": { "login": "all-black-493", "__typename": "User" } } ], "pullRequests": [2346] }, { "sha": "c6631814e0b70a324c48fda4acef12541dd30cf5", "subject": "docs(website): document Apple Silicon Cairo setup for local preview (#1930)", "body": "docs(website): document Apple Silicon Cairo setup for local preview (#1930)\n\n* docs(website): document Apple Silicon Cairo setup for local preview\n\n* docs(website): scope Apple Silicon Cairo fix to preview process\n\n* docs(website): avoid shared-prefix rewrite and clobbering backup\n\n* docs(website): keep shared Intel libs intact with same-shell Cairo lookup\n\n* docs(website): enter ARM shell before exporting Cairo lookup\n\n* docs(website): use ARM brew path and unprotected Python for Cairo\n\n* docs(website): reinstall requirements after ARM venv rebuild\n\n* docs(website): document DejaVu font dependency\n\n* docs(website): show ARM Python selection for venv rebuild\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["62c8b3da1b00260a5ef97d088737dafa0a7ea542"], "authors": [ { "name": "Praveen Yadav", "email": "153702595+parbin-12@users.noreply.github.com", "user": { "login": "parbin-12", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [1930] }, { "sha": "93e29d242ae60a3d2daec355e7a31b4a0bdd4234", "subject": "feat(cli): summarize committed reference-source inventories (#2768)", "body": "feat(cli): summarize committed reference-source inventories (#2768)", "parents": ["c6631814e0b70a324c48fda4acef12541dd30cf5"], "authors": [ { "name": "To3akaRin", "email": "131595336+To3akaRin@users.noreply.github.com", "user": { "login": "To3akaRin", "__typename": "User" } } ], "pullRequests": [2768] }, { "sha": "1b6c899b031421dcf2d725a63e67d99375028d6e", "subject": "docs: update Chinese README guides (#2119)", "body": "docs: update Chinese README guides (#2119)\n\nUpdate Chinese README docs\n\nRefresh the Chinese README guidance to mention IDA as a supported native analysis backend, clarify that static JavaScript analysis does not require native engines, and document global CLI installation/update steps for Bun (`bun add --global`, `bunx` usage, minimum version 1.2.17). The capability table also now includes Go binary and WASM artifact support.\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["93e29d242ae60a3d2daec355e7a31b4a0bdd4234"], "authors": [ { "name": "Lin Gan", "email": "190970720@qq.com", "user": { "login": "lg114", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2119] }, { "sha": "69bd81f7f2768b22fb75caa753f4b21a8e5d249d", "subject": "fix: isolate Linux inventory and repair DEX schema regex (#2910)", "body": "fix: isolate Linux inventory and repair DEX schema regex (#2910)\n\n* fix(ci): isolate Linux Hopper process fixture inventory\n\n* fix(android): make DEX descriptor pattern portable", "parents": ["1b6c899b031421dcf2d725a63e67d99375028d6e"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2910] }, { "sha": "f1045001f03ca0ddb2247769e3b4d1fadedaf630", "subject": "fix(browser): retain optional source-map requires (#2886)", "body": "fix(browser): retain optional source-map requires (#2886)\n\nCarry the require callee from dependency extraction into lexical scope\nvalidation so optional calls remain visible without admitting shadowed\nloaders.\n\nFixes #2883", "parents": ["69bd81f7f2768b22fb75caa753f4b21a8e5d249d"], "authors": [ { "name": "R", "email": "115410287+JFSAS@users.noreply.github.com", "user": { "login": "JFSAS", "__typename": "User" } } ], "pullRequests": [2886] }, { "sha": "c8ef1f916cb0f94a39d74320f58398ba1bc2b17d", "subject": "docs(readme): sync Turkish translation with current README (#2777)", "body": "docs(readme): sync Turkish translation with current README (#2777)\n\ndocs(readme): sync Turkish translation", "parents": ["f1045001f03ca0ddb2247769e3b4d1fadedaf630"], "authors": [ { "name": "Burak Kalaycı", "email": "kalayciburak1996@gmail.com", "user": { "login": "kalayciburak", "__typename": "User" } } ], "pullRequests": [2777] }, { "sha": "f652709cac54441f401e90b6a604997c9321d70d", "subject": "fix(cli): keep file URLs out of operator-relative path resolution (#2882)", "body": "fix(cli): keep file URLs out of operator-relative path resolution (#2882)\n\nCLI path normalization resolved every nonblank selected string against\nthe working directory, so executable_path \"file:///opt/electron\" became\nan invented local path and failed with ENOENT for that location instead\nof the field's local-path requirement. Leave `file:` and `scheme://`\nreferences unchanged so the shared schema rejects them as non-local\npaths. One-letter prefixes stay paths, so Windows drive paths and\nrelative names containing a colon resolve as before.\n\nFixes #2577\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["c8ef1f916cb0f94a39d74320f58398ba1bc2b17d"], "authors": [ { "name": "Shubham Ahuja", "email": "157806066+shubhamahuja9999@users.noreply.github.com", "user": { "login": "shubhamahuja9999", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2882] }, { "sha": "1d5f95dc4aff3ffadd06e922128606ea0fb669cc", "subject": "fix(native): parse renamed dyld_info re-exports (#2364)", "body": "fix(native): parse renamed dyld_info re-exports (#2364)\n\n* fix(native): parse renamed dyld_info re-exports\n\ndyld_info prints a re-export whose name differs from the source library's\nsymbol as `[re-export] _foo_renamed (_foo from libfoo)`. The export parser\nonly accepted `(from libfoo)`, so inspect_macho reported a nonexistent\nexport named `_foo_renamed (_foo from libfoo)` with no source, and the nm\nrow for `_foo_renamed` survived the name-based merge as a second export\nwith reexport null.\n\nAccept the optional source symbol, trying the plain `(from lib)` form\nfirst so a library name containing ` from ` keeps its text. The row now\nreports `_foo_renamed` re-exported from libfoo and replaces the nm\nduplicate. The export schema has no field for the source symbol name, so\nexports coverage records a limitation when a renamed re-export is present.\nThe golden fixture is a dyld_info capture of a synthetic dylib linked with\n-Wl,-alias,_foo,_foo_renamed.\n\n* fix(native): split dyld re-export suffix without nested quantifiers\n\nReplace the (?:(.+?)\\s+)??from lazy-optional group with a linear string\nscan so malformed lines cannot backtrack and a library path containing\n\" from \" still keeps its whole text via the plain-form-first check.\n\n* test(native): cover nested re-export library names\n\n* fix(native): retain reexports missing from nm inventory\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>\nCo-authored-by: morluto <17176810+morluto@users.noreply.github.com>", "parents": ["f652709cac54441f401e90b6a604997c9321d70d"], "authors": [ { "name": "Chaoqi", "email": "136579807+Chaoqi31@users.noreply.github.com", "user": { "login": "Chaoqi31", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "morluto", "email": "17176810+morluto@users.noreply.github.com", "user": { "login": "skydavil", "__typename": "User" } } ], "pullRequests": [2364] }, { "sha": "ebaaa79ca02bde4a73013a2a9a781d0b07a57ee4", "subject": "test(http3): add real MITM capture verification lab (#1997)", "body": "test(http3): add real MITM capture verification lab (#1997)\n\n* test(http3): add real MITM capture verification lab\n\n* test(http3): register the optional verification command\n\n* fix(http3): preserve the latest verification attempt owner\n\n* test(cli): admit the dyld slice fixture on x64 hosts\n\n* test(http3): verify exact producer TLS connection facts\n\n* test(http3): verify readable capture fields against observed bytes\n\n* fix(comparison): recheck historical calls-only changes (#2223)\n\n* fix(comparison): preserve incomplete function call evidence\n\nKeep missing, unknown, partial and unresolved call relationships unknown in function comparisons and reconstruction claims. Aggregate IDA caller and callee coverage without overwriting uncertainty.\n\nValidate with 144 focused tests, typecheck/lint, docs checks and test discovery. Real providers were not verified; the full headless IDA session suite requires unavailable Windows native controls.\n\n* fix(comparison): recheck historical calls-only changes\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>\n\n* fix(android): make DEX descriptor pattern portable\n\n* fix(ci): isolate Linux Hopper process fixture inventory\n\n* fix(http3): retain MCP startup diagnostics\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>\nCo-authored-by: Lucien <164857476+dakjdakd@users.noreply.github.com>", "parents": ["1d5f95dc4aff3ffadd06e922128606ea0fb669cc"], "authors": [ { "name": "Luis", "email": "86675342+LuisTaffelli@users.noreply.github.com", "user": { "login": "LuisTaffelli", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "Lucien", "email": "164857476+dakjdakd@users.noreply.github.com", "user": { "login": "dakjdakd", "__typename": "User" } } ], "pullRequests": [1997] }, { "sha": "8fef2aa64ec1ee742e8b70b825938d30a0ea7319", "subject": "fix(ci): enforce merge verification and unblock superseded runs (#2938)", "body": "fix(ci): enforce merge verification and unblock superseded runs (#2938)\n\n* fix(ci): repair inherited formatting failures\n\n* fix(ci): release superseded PR concurrency slots\n\n* docs: require current-base checks before maintainer merges\n\n* docs: preserve administrator merge override", "parents": ["ebaaa79ca02bde4a73013a2a9a781d0b07a57ee4"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2938] }, { "sha": "7a6defab186b0d9b137360b5a300ce2251383775", "subject": "test(reconstruction): declare complete comparison fixture facets (#2964)", "body": "test(reconstruction): declare complete comparison fixture facets (#2964)", "parents": ["8fef2aa64ec1ee742e8b70b825938d30a0ea7319"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2964] }, { "sha": "2895a18ca92f415ae62f87167ba9c7a672e3b7dc", "subject": "fix(ci): skip portable report merge when shards are skipped (#2943)", "body": "fix(ci): skip portable report merge when shards are skipped (#2943)\n\n* fix(ci): skip portable report merge when shards are skipped\n\nThe portable consumer can still run after an upstream build failure, even though the test-shard matrix is skipped and no Vitest blob artifacts exist. Guard artifact download and both report merge variants on successful shards; retain the required-shard gate so skipped or failed shards remain failures.\n\nThis applies the report-consumer condition from ee0256c740c9be18baae6c56d90285df8069f5b4 to current pinned main without changing action pins or required gates.\n\n* fix(ci): preserve failed shard diagnostics\n\n* docs: clarify current revision CI policy", "parents": ["7a6defab186b0d9b137360b5a300ce2251383775"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2943] }, { "sha": "0bc422d7bed1184a6b9fc0ea2655e4b2c5e1c4f4", "subject": "fix(wasm): attribute invalid paths to their selected fields (#2796)", "body": "fix(wasm): attribute invalid paths to their selected fields (#2796)\n\n* fix(wasm): attribute invalid paths to their selected fields\n\n* test(wasm): assert the exact rejected selection issues\n\n---------\n\nCo-authored-by: maxazure <405711+maxazure@users.noreply.github.com>", "parents": ["2895a18ca92f415ae62f87167ba9c7a672e3b7dc"], "authors": [ { "name": "Liu Jie", "email": "maxazure@gmail.com", "user": { "login": "maxazure", "__typename": "User" } }, { "name": "maxazure", "email": "405711+maxazure@users.noreply.github.com", "user": { "login": "maxazure", "__typename": "User" } } ], "pullRequests": [2796] }, { "sha": "090b454350591f58d3349fa992109d55414f5294", "subject": "fix(javascript-semantics): keep emitted data out of dispatch listener fields (#2952)", "body": "fix(javascript-semantics): keep emitted data out of dispatch listener fields (#2952)\n\n* fix(javascript-semantics): keep emitted data out of dispatch listener fields\n\nThe EventEmitter operation collector read argument position 1 as the\nlistener for every event method, so a dispatch such as\nbus.emit(\"ready\", data) reported the data binding and its range as the\nlistener. Only registration and removal name a listener there; emit\npasses its remaining arguments to listeners that already exist. Read the\nlistener argument only for register and remove operations.\n\nFixes #2574\n\nCo-Authored-By: Claude Fable 5.1 \n\n* fix(javascript-semantics): read listener arguments only for listener-taking methods\n\nremoveAllListeners accepts only an optional event name, so gating the\nlistener argument on operation kind still reported an ignored second\nargument as a listener. Gate on the methods whose argument position 1\nnames a listener instead: the registration methods, off, and\nremoveListener.\n\nCo-Authored-By: Claude Fable 5.1 \n\n---------\n\nCo-authored-by: Claude Fable 5.1 ", "parents": ["0bc422d7bed1184a6b9fc0ea2655e4b2c5e1c4f4"], "authors": [ { "name": "saurabh sharma", "email": "146759278+saurabh-sol@users.noreply.github.com", "user": { "login": "saurabh-sol", "__typename": "User" } }, { "name": "Claude Fable 5.1", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2952] }, { "sha": "c7ceaadb709ab5ac14a9487b3e170e3633cec250", "subject": "fix(browser): preserve unknown storage inventory and fingerprint coverage (#2491)", "body": "fix(browser): preserve unknown storage inventory and fingerprint coverage (#2491)\n\n* fix(browser): preserve unknown storage inventory and fingerprint coverage\n\n* fix(browser): compare known storage edits with incomplete inventories\n\n* test(browser): consolidate storage completeness regression workflows\n\n* test(ida): admit aligned FAT thinning fixtures on every platform\n\n---------\n\nCo-authored-by: chAngE <172472630+chAng-L19@users.noreply.github.com>\nCo-authored-by: morluto \nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["090b454350591f58d3349fa992109d55414f5294"], "authors": [ { "name": "chAngE", "email": "2815456271@qq.com", "user": { "login": "chAng-L19", "__typename": "User" } }, { "name": "chAngE", "email": "172472630+chAng-L19@users.noreply.github.com", "user": { "login": "chAng-L19", "__typename": "User" } }, { "name": "morluto", "email": "morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2491] }, { "sha": "0e6eca40857471341139e4203bfb32925b5333c5", "subject": "feat(native): read embedded cargo-auditable Rust dependency lists (#2456)", "body": "feat(native): read embedded cargo-auditable Rust dependency lists (#2456)\n\n* feat(native): read embedded cargo-auditable Rust dependency lists\n\n* fix(native): trim PE section padding and compute dependency cycles iteratively\n\n* fix(native): ignore SHT_NOBITS sections and validate dependency edges linearly\n\n* fix(native): bound compiler path scanning and retained hashes\n\n* fix(rust): pass package arrays as named parameterized test cases\n\n* fix(rust): admit graph expansion and preserve resource units\n\n* fix(rust): reject malformed packages, false cycles, and hidden compiler paths\n\nFail the first malformed cargo-auditable package before Zod collects an\nissue per field. Require cyclic dependency indices to match the cycles in\npackage dependencies. Keep read-only ELF ranges when a section name does\nnot fit the bounded name window, so a rustc path in that range is still\nreported.\n\n* fix(ci): repair integrated checks and Hopper test baseline\n\n* fix(go): verify Mach-O sections against segments\n\n---------\n\nCo-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>\nCo-authored-by: Cursor Agent ", "parents": ["c7ceaadb709ab5ac14a9487b3e170e3633cec250"], "authors": [ { "name": "Matt Van Horn", "email": "mvanhorn@users.noreply.github.com", "user": { "login": "mvanhorn", "__typename": "User" } }, { "name": "Matt Van Horn", "email": "455140+mvanhorn@users.noreply.github.com", "user": { "login": "mvanhorn", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "Cursor Agent", "email": "cursoragent@cursor.com", "user": { "login": "cursoragent", "__typename": "User" } } ], "pullRequests": [2456] }, { "sha": "388b907c923133096a3387272367cbfb04ff1c04", "subject": "perf(javascript): defer ambiguity expansion in version comparisons (#2962)", "body": "perf(javascript): defer ambiguity expansion in version comparisons (#2962)\n\nperf(javascript): avoid quadratic temporary matching state\n\nRepeated source groups can allocate candidates that later identity matches\ndiscard. Retain the original ambiguous groups until all tiers finish, expand\nonly unmatched survivors, and append to locally owned key buckets in place.\n\nConstraint: Preserve matching priority, full ambiguity, and public output.\nDirective: Do not re-match residual groups that become unique after later tiers.\nTested: 59 relevant tests, npm run check, and test discovery on current main.\nTested: CLI benchmarks and full-suite failure comparison on the recorded base.\nNot-tested: Full suite on the updated main; native Linux and Windows workflows.", "parents": ["0e6eca40857471341139e4203bfb32925b5333c5"], "authors": [ { "name": "Shenrui Ma", "email": "115921185+Shenrui-Ma@users.noreply.github.com", "user": { "login": "Shenrui-Ma", "__typename": "User" } } ], "pullRequests": [2962] }, { "sha": "97268f40ea21b5f2d24b08c0c068a7ccf41459d4", "subject": "fix(dotnet): name the truncated instruction when an operand leaves the method body (#2704)", "body": "fix(dotnet): name the truncated instruction when an operand leaves the method body (#2704)\n\n* fix(dotnet): name the truncated instruction when an operand leaves the method body\n\nThe extent guard ran after the operand read, so a truncated operand threw a raw Buffer RangeError that replaced the intended diagnostic with the runtime message and lost the instruction identity.\n\nBound the operand extent before reading its value and carry the width beside each fixed reader so the two facts cannot drift.\n\nFixes #2677\n\n* test(dotnet): consolidate truncated operand coverage\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["388b907c923133096a3387272367cbfb04ff1c04"], "authors": [ { "name": "Yunzhou Li", "email": "154221037+YunzhouLi-hub@users.noreply.github.com", "user": { "login": "YunzhouLi-hub", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2704] }, { "sha": "72d5bbc96d221709e9d9c9de96061dd5bebee7f1", "subject": "fix(process): keep provider deadlines independent of wall-clock changes (#2311)", "body": "fix(process): keep provider deadlines independent of wall-clock changes (#2311)\n\n* fix(process): keep provider deadlines independent of wall-clock changes\n\n* fix(process): retain monotonic targets after early timers\n\nAdapt the stronger timer/poll owner from @nosmile99 PR #2793 as integrated by 21aa877e5 and captured main 94072364c7f8410b0e86e72c912c2611572b278f. Retain all contributor reliability coverage. Tests and workloads skipped by explicit request.\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["97268f40ea21b5f2d24b08c0c068a7ccf41459d4"], "authors": [ { "name": "Jose Camargo", "email": "aml.camargo@hotmail.com", "user": { "login": "jcamargos", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2311] }, { "sha": "4481f861880f5cbcd864059b2509c656b5803f7c", "subject": "fix(frida): drain admitted operations and honor queued cancellation (#2305)", "body": "fix(frida): drain admitted operations and honor queued cancellation (#2305)\n\n* fix(frida): drain admitted operations and honor queued cancellation\n\n* fix(frida): settle cancelled loads before queued resume\n\n* test(frida): share lifecycle fixtures without duplicating assertions\n\n* fix(frida): preserve operation admission before session close\n\n* test(apple): bound cold archive fixture compilation\n\n* fix(frida): retain cancelled script creation evidence\n\n* test(release): scope preflight schema to selected jobs\n\n* fix(process): report no remaining time after a provider deadline fires\n\nNode timers can fire while performance.now() is still a fraction of a\nmillisecond short of the monotonic deadline. ProviderStartupDeadline then\nreported interruption \"timeout\" and an aborted signal while remainingMs()\nreturned ceil(0.x) = 1, so polling loops guarded by remainingMs() > 0\n(Hopper and Ghidra startup) could run past an elapsed deadline, and the\nreal-timer test \"aborts a bounded wait when its real monotonic deadline\nexpires\" failed intermittently in CI (expected 1 to be 0).\n\nOnce the deadline's own timer has classified a timeout, report zero\nremaining time. A deterministic regression test fires the timer with the\nmonotonic clock 0.4 ms short of the deadline.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(comparison): recheck historical calls-only changes (#2223)\n\n* fix(comparison): preserve incomplete function call evidence\n\nKeep missing, unknown, partial and unresolved call relationships unknown in function comparisons and reconstruction claims. Aggregate IDA caller and callee coverage without overwriting uncertainty.\n\nValidate with 144 focused tests, typecheck/lint, docs checks and test discovery. Real providers were not verified; the full headless IDA session suite requires unavailable Windows native controls.\n\n* fix(comparison): recheck historical calls-only changes\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>\n(cherry picked from commit 688defca0f4a3de04eb199f7754f323c68896c3c)\n\n* fix(ci): isolate Linux Hopper process fixture inventory\n\n(cherry picked from commit 8cac51e12184d56a9ba80a4427b3e6082ddac1ec)\n\n* fix(android): make DEX descriptor pattern portable\n\n(cherry picked from commit 1335bcddc569a1cfb34b6efedcb6f2e3aaaa3357)\n\n* fix: repair the static-check failures on the default branch (#2895)\n\n* fix: repair the static-check failures on the default branch\n\nThe default branch fails its own required `Static checks` job three ways, so\nevery pull request reports that job as failed regardless of its own change.\n\n- `npm run format:check` reports `src/domain/functionComparison.test.ts` and\n `src/ida/IdaOperationRunner.ts`.\n- `npm run lint` reports a duplicate `import { join } from \"node:path\"` in\n `tests/boundary/mcp/ghidraInventoryMcp.test.ts` (lines 4 and 17).\n- `npm run typecheck` reports `format: \"devin\"` missing from the client format\n union in `src/application/SupportedClients.ts`, and an unchecked index in\n `tests/boundary/cli/clientProfileLifecycle.test.ts`, whose pair array is\n inferred as `string[][]`.\n\nApply the pinned formatter, drop the duplicate import, list the `\"devin\"` format\nthat its own definition already uses, and mark the pair array `as const`.\n\nValidation: `npm run check:fast` and `npm run format:check` pass.\n\n* fix(setup): keep Devin on the JSON configuration dialect\n\n---------\n\nCo-authored-by: 吴佳浩 \nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>\n(cherry picked from commit df3d96da801976fdbe37a726c2f4f84af8ffbf90)\n\n---------\n\nCo-authored-by: morluto \nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>\nCo-authored-by: Claude Opus 5.5 \nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>\nCo-authored-by: Lucien <164857476+dakjdakd@users.noreply.github.com>\nCo-authored-by: 吴佳浩Alben <35291372+XiaoBinGan@users.noreply.github.com>\nCo-authored-by: 吴佳浩 \nCo-authored-by: OpenAI Codex ", "parents": ["72d5bbc96d221709e9d9c9de96061dd5bebee7f1"], "authors": [ { "name": "Rohit Ghumare", "email": "48523873+rohitg00@users.noreply.github.com", "user": { "login": "rohitg00", "__typename": "User" } }, { "name": "morluto", "email": "morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "Lucien", "email": "164857476+dakjdakd@users.noreply.github.com", "user": { "login": "dakjdakd", "__typename": "User" } }, { "name": "吴佳浩Alben", "email": "35291372+XiaoBinGan@users.noreply.github.com", "user": { "login": "XiaoBinGan", "__typename": "User" } }, { "name": "吴佳浩", "email": "wujiahao@supremind.com", "user": null }, { "name": "OpenAI Codex", "email": "codex@openai.com", "user": { "login": "codex", "__typename": "User" } } ], "pullRequests": [2305] }, { "sha": "729ca2ab6ae0644b5a466534f9287961bf7152db", "subject": "fix(ghidra): report unapplied PE CodeView PDB limitation (#2283)", "body": "fix(ghidra): report unapplied PE CodeView PDB limitation (#2283)\n\n* fix(ghidra): report unapplied PE CodeView PDB limitation (#2259)\n\nWhen Ghidra analyzes a PE target that references companion debug symbols\nin its CodeView (IMAGE_DEBUG_TYPE_CODEVIEW / RSDS or NB10) debug directory,\nGhidra's headless analyzer cannot automatically locate or apply the companion\nPDB from isolated runtime directories without companion admission. Procedure\nnames remain analysis-generated (FUN_
).\n\nParse CodeView debug metadata (RSDS GUID/age and NB10 age) during PE target\nresolution, and report an Evidence limitation informing callers and agents\nthat referenced debug symbols were not applied and procedure names are\nanalysis-generated.\n\nFixes #2259\n\n* test(pe): group CodeView header coverage separately\n\n* fix(ghidra): avoid contradictory PDB limitations\n\n* fix(android): make DEX descriptor pattern portable\n\n* fix(ci): isolate Linux Hopper process fixture inventory\n\n* fix(comparison): recheck historical calls-only changes (#2223)\n\n* fix(comparison): preserve incomplete function call evidence\n\nKeep missing, unknown, partial and unresolved call relationships unknown in function comparisons and reconstruction claims. Aggregate IDA caller and callee coverage without overwriting uncertainty.\n\nValidate with 144 focused tests, typecheck/lint, docs checks and test discovery. Real providers were not verified; the full headless IDA session suite requires unavailable Windows native controls.\n\n* fix(comparison): recheck historical calls-only changes\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>\n\n* style: format identity comparison and IDA runner\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>\nCo-authored-by: Lucien <164857476+dakjdakd@users.noreply.github.com>", "parents": ["4481f861880f5cbcd864059b2509c656b5803f7c"], "authors": [ { "name": "Tufail Akram", "email": "72789060+akram1089@users.noreply.github.com", "user": { "login": "akram1089", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "Lucien", "email": "164857476+dakjdakd@users.noreply.github.com", "user": { "login": "dakjdakd", "__typename": "User" } } ], "pullRequests": [2283] }, { "sha": "42667fc1a03ffae7ffea57a611f52162ea223a7c", "subject": "fix(wasm): report WABT output past its budget as a resource constraint (#2117)", "body": "fix(wasm): report WABT output past its budget as a resource constraint (#2117)\n\n* fix(wasm): report WABT output past its budget as a resource constraint\n\nA module whose WAT exceeds the 32 MiB output budget failed as\nunreadable_output, advised `rea doctor`, and echoed the full 32 MiB\ntruncated WAT prefix in details.captured_output. Map the owned-command\noutput-limit outcome during inspection to AnalysisResourceConstraintError\nnaming the budget, as the apktool and native macOS providers do, with a\nremediation that says the fixed budget will not change on retry.\n\nCaptured output for an output-limit failure keeps only the first 4,096\ncharacters of each stream, including on the cleanup-failure path. An\noversized --version probe keeps its configuration-phase mapping.\n\n* fix(wasm): keep observed sizes and whole code points in output-limit excerpts\n\nCut each stream's output-limit excerpt with boundedUtf8Text at 4,096\nUTF-8 bytes, so an astral character at the cut no longer leaves a lone\nsurrogate. Mark the output truncated when either excerpt was cut, and\nreport each stream's observed byte count.\n\nWord the remediation as a fact about the fixed budget. A flood of\ndiagnostics from any WABT tool reaches this path, so it no longer says\nthe module is too large.\n\nReplace the 32 MiB end-to-end test with a launcher seam that raises a\nsmall output-limit failure.\n\n* fix(wasm): match sibling captured-output fields for WABT output limits\n\nReport retained byte counts in stdout_bytes and stderr_bytes, as apktool\nand the firmware command do, and record exit_code and signal. Mark the\nexcerpt truncated outright, since the command raises output-limit only\nafter retention was truncated.\n\nWhen cleanup also fails, record the output limit and its budget as the\nprevious error instead of the generic command message. Document that\nthe two streams share the budget, so the excerpt holds up to 4,096 of\nthe bytes each stream retained.\n\n* docs(wasm): scope the output-budget error to inspection commands\n\n* docs(wasm): distinguish reported warm costs from unmeasured gaps\n\n* docs(wasm): clarify the scope of reported warm measurements\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["729ca2ab6ae0644b5a466534f9287961bf7152db"], "authors": [ { "name": "Jeremy Levartovsky", "email": "140487034+JayOfTheKeyboard@users.noreply.github.com", "user": { "login": "JayOfTheKeyboard", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2117] }, { "sha": "e4186af31be855a127804a8543def43cd77404be", "subject": "fix(process): expose Darwin swiftc compile deadline via env (#2240)", "body": "fix(process): expose Darwin swiftc compile deadline via env (#2240)\n\n* fix(process): expose Darwin swiftc compile deadline via env\n\nBusy hosts can exceed the hard-coded 60s ownership-helper compile\ntimeout. Honor REA_SWIFTC_COMPILE_TIMEOUT_MS like the other provider\nstartup deadlines, keeping 60000 as the default.\n\nFixes #2184\n\nCo-authored-by: Cursor \n\n* fix(process): keep the Swift compile deadline with its runtime owner\n\n* fix(comparison): recheck historical calls-only changes (#2223)\n\n* fix(comparison): preserve incomplete function call evidence\n\nKeep missing, unknown, partial and unresolved call relationships unknown in function comparisons and reconstruction claims. Aggregate IDA caller and callee coverage without overwriting uncertainty.\n\nValidate with 144 focused tests, typecheck/lint, docs checks and test discovery. Real providers were not verified; the full headless IDA session suite requires unavailable Windows native controls.\n\n* fix(comparison): recheck historical calls-only changes\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>\n(cherry picked from commit 688defca0f4a3de04eb199f7754f323c68896c3c)\n\n* fix(ci): isolate Linux Hopper process fixture inventory\n\n(cherry picked from commit 8cac51e12184d56a9ba80a4427b3e6082ddac1ec)\n\n* fix(android): make DEX descriptor pattern portable\n\n(cherry picked from commit 1335bcddc569a1cfb34b6efedcb6f2e3aaaa3357)\n\n* fix: repair the static-check failures on the default branch (#2895)\n\n* fix: repair the static-check failures on the default branch\n\nThe default branch fails its own required `Static checks` job three ways, so\nevery pull request reports that job as failed regardless of its own change.\n\n- `npm run format:check` reports `src/domain/functionComparison.test.ts` and\n `src/ida/IdaOperationRunner.ts`.\n- `npm run lint` reports a duplicate `import { join } from \"node:path\"` in\n `tests/boundary/mcp/ghidraInventoryMcp.test.ts` (lines 4 and 17).\n- `npm run typecheck` reports `format: \"devin\"` missing from the client format\n union in `src/application/SupportedClients.ts`, and an unchecked index in\n `tests/boundary/cli/clientProfileLifecycle.test.ts`, whose pair array is\n inferred as `string[][]`.\n\nApply the pinned formatter, drop the duplicate import, list the `\"devin\"` format\nthat its own definition already uses, and mark the pair array `as const`.\n\nValidation: `npm run check:fast` and `npm run format:check` pass.\n\n* fix(setup): keep Devin on the JSON configuration dialect\n\n---------\n\nCo-authored-by: 吴佳浩 \nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>\n(cherry picked from commit df3d96da801976fdbe37a726c2f4f84af8ffbf90)\n\n---------\n\nCo-authored-by: Cursor \nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>\nCo-authored-by: morluto <17176810+morluto@users.noreply.github.com>\nCo-authored-by: Lucien <164857476+dakjdakd@users.noreply.github.com>\nCo-authored-by: 吴佳浩Alben <35291372+XiaoBinGan@users.noreply.github.com>\nCo-authored-by: 吴佳浩 ", "parents": ["42667fc1a03ffae7ffea57a611f52162ea223a7c"], "authors": [ { "name": "BeqaKs", "email": "91750923+BeqaKs@users.noreply.github.com", "user": { "login": "BeqaKs", "__typename": "User" } }, { "name": "Cursor", "email": "cursoragent@cursor.com", "user": { "login": "cursoragent", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "morluto", "email": "17176810+morluto@users.noreply.github.com", "user": { "login": "skydavil", "__typename": "User" } }, { "name": "Lucien", "email": "164857476+dakjdakd@users.noreply.github.com", "user": { "login": "dakjdakd", "__typename": "User" } }, { "name": "吴佳浩Alben", "email": "35291372+XiaoBinGan@users.noreply.github.com", "user": { "login": "XiaoBinGan", "__typename": "User" } }, { "name": "吴佳浩", "email": "wujiahao@supremind.com", "user": null } ], "pullRequests": [2240] }, { "sha": "45a3509db34e2eca5558b90b06fca1baefdf3479", "subject": "fix(artifacts): compare inventories using declared coverage (#2214)", "body": "fix(artifacts): compare inventories using declared coverage (#2214)\n\n* fix(artifacts): preserve complete root inventory comparisons\n\n* fix(artifacts): declare inventory coverage before comparison\n\n* fix(artifacts): preserve traversal omissions and materialization limits\n\n* fix(artifacts): preserve coverage declarations and projection scope\n\nRemove the duplicate inventory-schema import. Compare original coverage declarations, including field omission, before adapting legacy pages. Require explicit scope for completeness and container-entry coverage for application projections.\n\nSource inspection and git diff --check only. Tests, builds and typechecks skipped by explicit user request. GitHub review writes paused globally.\n\n* fix(artifacts): require entry coverage for child changes\n\n* fix(artifacts): accept source-valid inventory limitations\n\n* style(artifacts): format mobile graph projection\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>\nCo-authored-by: OpenAI Codex ", "parents": ["e4186af31be855a127804a8543def43cd77404be"], "authors": [ { "name": "Thang Luu", "email": "thangldw@gmail.com", "user": { "login": "thangldw", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "OpenAI Codex", "email": "openai-codex@users.noreply.github.com", "user": null } ], "pullRequests": [2214] }, { "sha": "26525706fcd102355d1cd765138398067f32527f", "subject": "feat(managed): decode ldstr user strings in member inspection (#2162)", "body": "feat(managed): decode ldstr user strings in member inspection (#2162)\n\n* feat(managed): decode ldstr user strings in member inspection\n\ninspect_managed_members reported every ldstr operand as a bare 0x70 token,\nso an analyst could see that a method loads a literal but not which one.\nAnswering \"where is this path or key used\" required a second tool.\n\nRead the optional #US stream and add a top-level user_strings inventory:\neach distinct token loaded by an inspected method body, once, in token\norder, with its #US file offset and decoded UTF-16 value. Instruction\nanchors and normalized CIL digests keep their build-local tokens. A missing\n#US stream or malformed item is reported against its token as partial\ncoverage. Evidence recorded before this field reads user_strings as null.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(managed): collect user strings only from ldstr\n\nA malformed ldtoken can carry a 0x70 token, which the operand decoder\nclassifies as a string operand. Only ldstr loads a literal, so collect\nuser strings by opcode.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(managed): admit user-string tokens and failures before collecting them\n\nCharge each distinct ldstr token to the decode budget before adding it to\nthe collection set, and admit each #US failure before retaining it. A\nmissing #US stream is now one stream-level issue rather than one per\ntoken.\n\nDocument why the #US terminal flag is not validated: Mono and Roslyn\nassemblies disagree with ECMA-335 II.24.2.4 and the runtime ignores it.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* docs(managed): describe missing #US reporting and the unvalidated flag byte\n\nCo-Authored-By: Claude Opus 5.5 \n\n* test(managed): cover #US items that run past the stream end\n\nAn odd length whose payload crosses the end of #US, and a two-byte\nlength prefix that starts on the last #US byte, are both rejected as\n\"User string leaves #US\" beside a readable literal. The test fails if\nthat bounds check is removed.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(managed): report reserved #US length prefixes as string failures\n\nThe compressed-length reader shared by #Blob and #US hard-coded\ninvalid-blob and \"Metadata blob\" for a reserved prefix, so a malformed\nuser string was published as a blob failure. The caller now names the\nitem it reads: #Blob keeps its code and message, and #US reports\ninvalid-string.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(managed): append member inspection issues without argument spreading\n\ninspectManagedMembersBytes gathered every producer's issues with\nissues.push(...list), passing one argument per issue. A large malformed\ninput, such as hundreds of thousands of distinct bad ldstr operands or\nMemberRef rows, overflows the stack with an untyped RangeError instead of\nreturning partial coverage. All six sites now use\nappendManagedParseIssues, which appends one issue at a time.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(managed): classify truncated #US and #Blob length prefixes by item\n\nA two- or four-byte compressed-length prefix cut off by the end of the\nartifact went through the generic range check and was reported as\ninvalid-row. The prefix reader now uses the item's own code for both\nreserved and truncated prefixes: invalid-string for #US, invalid-blob for\n#Blob. The unused generic range helper is removed.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(managed): retain user-string terminal flag conformance issues\n\n* test(managed): write ECMA-335 #US terminal flags and cover flag issues\n\nd5b7b0704 reports a #US terminal flag that differs from ECMA-335\nII.24.2.4. The fixture heap always wrote 0, so its non-Latin-1 literals\nnow read as nonconforming. The fixture writes the spec flag, and a new\ntest flips one flag each way (\"ok\" set to 1, \"it's\" set to 0) and checks\nthat both literals remain beside one issue each.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(managed): classify ldstr operands before collapsing a missing #US\n\nWith no #US stream, every collected ldstr operand was counted as a #US\nreference and reported only as missing-stream, while the same non-0x70\noperand got invalid-heap-index when the stream existed. parseUserStrings\nnow owns which operands are user-string tokens: any other operand is\ninvalid-heap-index either way, and only 0x70 tokens count toward the\nmissing-stream issue. The heap reader drops its duplicate kind check.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(managed): state user-string limits in member comparisons\n\ncompare_managed_members ignored user_strings, so a method whose ldstr\nliteral changed at the same token, or legacy Evidence that never examined\nliterals, could read as unchanged with no caveat. The comparison now adds\nan unknown limitation when either side predates user strings and a\nnot-compared limitation when literals were observed. ExportedType and\nuser-string inventories share one uncomparedInventory rule.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* docs(managed): advertise ldstr literals in member inspection help\n\nThe MCP tool description, the type_names input, and the CLI command and\n--type help now say that inspect_managed_members returns the #US string\nliterals that ldstr loads, and that a type selection limits them to the\nliterals the selected types' method bodies load.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(managed): read the empty #US entry at offset 0\n\nECMA-335 II.24.2.4 makes the first #US entry the empty blob: a zero\nlength with no terminal flag byte. ldstr 0x70000000 loads it, but the\nodd-length check rejected it as invalid-string, dropping the literal and\nmaking coverage partial. Offset 0 with length 0 now reads as \"\".\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(managed): reserve #US offset 0 and admit literals before scanning\n\nOffset 0 is the reserved empty #US entry, so a nonempty item there is now\ninvalid-string instead of a published literal. The literal's projection\nis reserved before the terminal-flag scan, so an inadmissible item fails\nat the budget without reading every code unit. The scan's loop index no\nlonger shadows the token's heap index.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(managed): report #US length prefixes wider than ECMA-335 assigns\n\ncompressedLength accepted an overlong encoding, such as 0x80 0x05 for a\n5-byte item, without comment. It now reports whether the width is the\none ECMA-335 II.23.2 assigns, and the #US reader reports a non-minimal\nprefix as an invalid-string conformance issue beside the readable\nliteral, like the terminal flag. readMetadataUserString returns every\nissue it observes. #Blob behavior is unchanged.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(managed): check the #US length width before the empty entry\n\nThe offset-0 empty entry returned \"\" before the length-width check, so an\noverlong empty entry such as 0x80 0x00 read as complete. The width issue\nis now collected first and returned with the empty literal.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(managed): admit #US width issues only for returned literals\n\nThe overlong-prefix issue was reserved before the fatal shape checks, so\nan item that then failed, such as 0x80 0x00 away from offset 0, leaked\n512 bytes of budget per token. The width issue is now built and admitted\nonly on paths that return the literal.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(managed): keep #US issues out of member metadata status\n\nUser-string issues, including terminal-flag and length-prefix\nconformance differences, marked metadata.status partial, so\ncompare_managed_members turned one-sided methods and fields into unknown\neven though every member row was examined. #US issues now make coverage\npartial while metadata.status describes the member inventory.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(managed): give user strings their own coverage\n\n#US issues entered the member coverage, so every consumer that reads it\nas member coverage (application graph member facts, comparison status)\nreported examined members as partial over a literal conformance\ndifference. user_strings is now { state, literals, issues }: #US issues\nlive there and never change the member coverage or metadata.status.\nparseUserStrings returns that inventory directly.\n\ncompare_managed_members inspects with user strings skipped, since it\nnever reads literals, so a large literal cannot exhaust the decode budget\nof a comparison. Its limitations state once that literals are not\ncompared, and the ExportedType limitations return to their main form.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(managed): mark user strings partial when a body is not fully decoded\n\nWith user strings owning their coverage, an inspected method body that\nwas partial, malformed, or truncated no longer reached their state, so a\nliteral after the decode stopped was missing from a \"complete\" inventory.\nparseUserStrings now marks the inventory partial unless every inspected\nbody was fully decoded, keeping the literals it did observe.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(managed): mark user strings partial when a method row is omitted\n\nA MethodDef row that failed before its body was read was recorded as an\nissue and omitted, so its ldstr instructions were never scanned, yet the\nuser-string inventory could still read as complete. parseUserStrings now\ntakes the parseMethods result and stays partial whenever a method row\nfailed, as well as when an inspected body was not fully decoded.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(managed): count only method rows that may hide a selected body\n\nAny parseMethods issue marked user strings partial, including an\nunreadable name on a method outside the type selection, so a fully\nscanned selection read as incomplete. parseMethods now reads each row's\nowner first and reports unscannedRows: rows that produced no method while\ntheir owner is selected or unknown. parseUserStrings uses that count.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(managed): treat unreadably named types as possibly selected\n\nUnder a type_names selection, a type whose name could not be read may be\na requested type, but its methods were skipped without counting toward\nunscannedRows, so an unexamined body left user strings complete. A\nmethod whose owner's name is unreadable now counts as possibly selected.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(managed): judge user-string scans by CIL decoding, not body status\n\nbody.status is malformed for an invalid exception section even when\nevery instruction decoded, so user strings read as partial although every\nldstr was examined. The body reader now reports whether its CIL was fully\nscanned, independent of exception-region validity, and parseMethods folds\nunscanned bodies and unproduced rows into one unscannedMethods count that\nparseUserStrings uses instead of reinterpreting body.status.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(managed): stop deduplicating user-string issues\n\nThe inventory passed its issues through uniqueManagedParseIssues, which\nserializes every issue into an unbudgeted map: about 42 MB of heap and\n113 ms for 125,000 issues on Node 24. The issues are unique by\nconstruction (one failure or per-offset conformance issues per distinct\ntoken, one missing-stream issue), so the inventory now returns them, and\nits literals, without copies.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(managed): preserve selected string coverage unknowns\n\n---------\n\nCo-authored-by: Claude Opus 5.5 \nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["45a3509db34e2eca5558b90b06fca1baefdf3479"], "authors": [ { "name": "Nelglor", "email": "nadagrava@gmail.com", "user": { "login": "Nelglor", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2162] }, { "sha": "02095cd74a39e55227e554b37ed76e62476e8e94", "subject": "fix(browser): report complete storage key inventory changes (#2861)", "body": "fix(browser): report complete storage key inventory changes (#2861)\n\n* fix(browser): report complete storage key inventory changes\n\n* fix(browser): preserve unavailable storage inventory coverage\n\nReuse the key-coverage propagation and independent fingerprint mapping proposed by chAng-L19 in morluto/rea#2491. Propagate failed or malformed inventories into the canonical completeness ledger before comparing membership; preserve independently proven value changes. Add producer-to-comparison regressions and document recapture requirements.", "parents": ["26525706fcd102355d1cd765138398067f32527f"], "authors": [ { "name": "xingzhou", "email": "zhang.guiping@xydigit.com", "user": { "login": "zhangguiping-xydt", "__typename": "User" } } ], "pullRequests": [2861] }, { "sha": "39f96d7188a75e96af7875f16b02b6a0b7facfe3", "subject": "fix(qlog): list a hidden stream's records without spreading call arguments (#2860)", "body": "fix(qlog): list a hidden stream's records without spreading call arguments (#2860)\n\n* fix(qlog): list a hidden stream's records without spreading call arguments\n\nWhen an explicit declaration matched a stream's derived total, the\ndecoder pushed every contribution ordinal with a spread call. A stream\nwith more than ~125k STREAM frames exceeded the engine's argument limit,\nso a valid capture within the input budget failed with RangeError\ninstead of listing the records as incomplete. Push the ordinals in a\nloop.\n\n* fix(comparison): recheck historical calls-only changes (#2223)\n\n* fix(comparison): preserve incomplete function call evidence\n\nKeep missing, unknown, partial and unresolved call relationships unknown in function comparisons and reconstruction claims. Aggregate IDA caller and callee coverage without overwriting uncertainty.\n\nValidate with 144 focused tests, typecheck/lint, docs checks and test discovery. Real providers were not verified; the full headless IDA session suite requires unavailable Windows native controls.\n\n* fix(comparison): recheck historical calls-only changes\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>\n\n* fix(ci): isolate Linux Hopper process fixture inventory\n\n* fix(android): make DEX descriptor pattern portable\n\n---------\n\nCo-authored-by: Lucien <164857476+dakjdakd@users.noreply.github.com>\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["02095cd74a39e55227e554b37ed76e62476e8e94"], "authors": [ { "name": "Dragolone", "email": "160818051+Dragolone@users.noreply.github.com", "user": { "login": "Dragolone", "__typename": "User" } }, { "name": "Lucien", "email": "164857476+dakjdakd@users.noreply.github.com", "user": { "login": "dakjdakd", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2860] }, { "sha": "64041e3072e968002e2085445217ccde1f36e5d7", "subject": "fix(session): reject an unknown configured provider before unbound routing (#2976)", "body": "fix(session): reject an unknown configured provider before unbound routing (#2976)\n\nWhen every registered deep provider rejected a target, select() returned\nan intentionally unbound success for any concrete environment selector,\nincluding one that names no registered provider. A misconfigured\nREA_ANALYSIS_PROVIDER therefore opened the target unbound, and the later\ndeep-operation diagnostic blamed target support instead of the unknown\nconfiguration. The same identifier requested explicitly already failed\nwith unknown_provider.\n\nTake the unbound shortcut only for a registered environment preference.\nAn unknown configured identifier now reaches concrete selection and fails\nwith unknown_provider, matching the explicit request. Registered\npreferences and auto still leave artifact-only targets unbound.\n\nFixes #2592", "parents": ["39f96d7188a75e96af7875f16b02b6a0b7facfe3"], "authors": [ { "name": "Aaditya", "email": "aadityasinha554@gmail.com", "user": { "login": "555aaditya", "__typename": "User" } } ], "pullRequests": [2976] }, { "sha": "4758ba30b6852c49b9539a2e815af22b3f822341", "subject": "fix(package-verifier): reject overview responses without a procedure count (#2936)", "body": "fix(package-verifier): reject overview responses without a procedure count (#2936)\n\n* fix(package-verifier): reject overview responses without a procedure count\n\nThe analyze and inspect checks compared procedure_count with `< 1`, and an absent\nor null normalized_result makes that comparison false, so a binary_overview\nresponse without its required result passed the platform smoke check. Require an\ninteger procedure count before the positive-count comparison.\n\n* test(package-verifier): cover malformed overview receipts\n\n---------\n\nCo-authored-by: REA Maintenance <76467478+morluto@users.noreply.github.com>", "parents": ["64041e3072e968002e2085445217ccde1f36e5d7"], "authors": [ { "name": "CodeAlex", "email": "59381946+CodeAlex52@users.noreply.github.com", "user": { "login": "CodeAlex52", "__typename": "User" } }, { "name": "REA Maintenance", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2936] }, { "sha": "a9195c3a9804d8b815eddb4431c486b048548dfe", "subject": "fix(managed): retain raw CIL changes in member comparison (#2912)", "body": "fix(managed): retain raw CIL changes in member comparison (#2912)", "parents": ["4758ba30b6852c49b9539a2e815af22b3f822341"], "authors": [ { "name": "Devulapalli Naga Sri Vaishnavi", "email": "vaishnaviharish2006@gmail.com", "user": { "login": "Vaishnavi220506", "__typename": "User" } } ], "pullRequests": [2912] }, { "sha": "0c6c571a01f0c35aa56a0189fb8b8adfd0012c61", "subject": "perf(javascript): reuse semantic member-mutation lookups (#2941)", "body": "perf(javascript): reuse semantic member-mutation lookups (#2941)\n\nThe semantic member-mutation collector revisits the same nodes while it closes\nalias chains, and each visit re-derived results that cannot change within the\nphase:\n\n- resolveSemanticBindingState re-walked the scope chain for the same identifier\n node. Definition collection completes before this phase, and addBinding is\n reachable only from it, so a scope's bindings no longer change.\n- directInitializerPosition, directMutationPosition and\n referenceInitializerPosition are pure functions of a node and the analysis\n parent map, but were recomputed for every mutation and initializer.\n- markValue re-encoded the same capture tuple with JSON.stringify and built a\n fresh long key for every Set/Map lookup, so each lookup re-hashed the whole\n key. The capture key is now cached per binding, origin and owner, and the\n lifetime key is derived from it.\n\nOn pdfjs-dist 5.3.93 wasm/openjpeg_nowasm_fallback.js (462316 bytes, sha256\n53c228428a8861035a34738966af263fc9d4cee6df25a0ad942af947469a0bd9) the semantic\nphase takes 177.8 s instead of 272.9 s in-process, with a byte-identical\nsemantic IR. With --max-heap-mb 3072 and the default heap the base revision\nexhausts the worker; with the default 300 s per-source deadline raised, the\ncompleted CLI run takes 240.6 s instead of 396.7 s and its output is identical\napart from volatile identifiers.\n\nRefs #2498\n\nCo-authored-by: gongfpp <22683417+gongfpp@users.noreply.github.com>", "parents": ["a9195c3a9804d8b815eddb4431c486b048548dfe"], "authors": [ { "name": "gongfpp", "email": "1360187968@qq.com", "user": { "login": "gongfpp", "__typename": "User" } }, { "name": "gongfpp", "email": "22683417+gongfpp@users.noreply.github.com", "user": { "login": "gongfpp", "__typename": "User" } } ], "pullRequests": [2941] }, { "sha": "23dc8fbf83a36b7fb273674b74fc3c80de9acf1c", "subject": "fix(application): accept alternative document selection in binary_ove… (#2680)", "body": "fix(application): accept alternative document selection in binary_ove… (#2680)\n\n* fix(application): accept alternative document selection in binary_overview (#2460)\n\nUpdate binary_overview capability negotiation so that either current_document or list_documents satisfies the document identity requirement, matching resolveAnalysisDocument runtime semantics. When a provider declares neither document capability, resolveAnalysisDocument reports AnalysisCapabilityUnavailableError for current_document rather than leaking the internal list_documents fallback. Preserve list_segments as an independently mandatory requirement.\n\n* fix(application): retain document fallback provider errors\n\nReturn the fallback producer error unchanged, retaining operation identity, retry advice, diagnostics and cleanup instead of fabricating missing capabilities.\n\nSource inspection and git diff --check; tests/builds/typechecks/CI reruns skipped at explicit user request.\n\n* test(application): retain document fallback error expectations\n\nComposition and MCP controls now expect the original list_documents producer error and reason.\n\nSource inspection and git diff --check only. Tests, builds and typechecks skipped by explicit user request. GitHub review writes paused globally.\n\n* fix(ida): assert attached-mode routing failure\n\n---------\n\nCo-authored-by: yashas1624 \nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["0c6c571a01f0c35aa56a0189fb8b8adfd0012c61"], "authors": [ { "name": "yashas s", "email": "yashas.study77@gmail.com", "user": { "login": "yashas1624", "__typename": "User" } }, { "name": "yashas1624", "email": "yashas1624@users.noreply.github.com", "user": { "login": "yashas1624", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2680] }, { "sha": "20b802f165b572cc067d14d3011563cad4508285", "subject": "fix(analysis-view): bound limitations and unknowns per view (#2794)", "body": "fix(analysis-view): bound limitations and unknowns per view (#2794)\n\n* fix(analysis-view): bound limitations and unknowns per view\n\nViews of a JavaScript application or binary layout copied every parent\nlimitation into both limitations and unknowns, so a parent with tens of\nthousands of limitations produced views as large as the complete record\nand exceeded the MCP response budget even for a one-item page. Each view\nnow carries at most 64 distinct messages per field plus one line naming\nthe omitted count and the parent Evidence that retains the full list.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* test(analysis-view): assert exact bounded message notices\n\nSource inspection and targeted formatting only. Tests, builds, lint, typechecks and provider workloads were not run at the user's explicit request.\n\n* fix(analysis-view): preserve coverage facts in bounded messages\n\nReserve JavaScript completeness and unknown-count facts before bulk limitations. Direct omission recovery to the source parent without assuming session retention. Preserve exact threshold assertions and add unrun exhausted-page/item and unretained-inline MCP regressions. Source inspection and targeted formatting only; tests/checks/builds/provider workloads/CI reruns skipped by explicit user request.\n\n* fix(analysis-view): bound repeated message serialization bytes\n\n* fix(analysis-view): let byte budget bound messages\n\n* test(analysis-view): exercise byte-based message omissions\n\n---------\n\nCo-authored-by: Claude Opus 5.5 \nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>\nCo-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>", "parents": ["23dc8fbf83a36b7fb273674b74fc3c80de9acf1c"], "authors": [ { "name": "Bruno Costa Candia", "email": "55243348+bruno-candia@users.noreply.github.com", "user": { "login": "bruno-candia", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "github-actions[bot]", "email": "41898282+github-actions[bot]@users.noreply.github.com", "user": { "login": "github-actions[bot]", "__typename": "User" } } ], "pullRequests": [2794] }, { "sha": "ed24604ee10362b063feb8610cee1f2049df65c8", "subject": "fix(javascript): preserve empty ESM import names in provenance (#2797)", "body": "fix(javascript): preserve empty ESM import names in provenance (#2797)\n\nCo-authored-by: LouisChen <3361008+chqcjq@users.noreply.github.com>", "parents": ["20b802f165b572cc067d14d3011563cad4508285"], "authors": [ { "name": "LouisChen", "email": "65096591@qq.com", "user": { "login": "chqcjq", "__typename": "User" } }, { "name": "LouisChen", "email": "3361008+chqcjq@users.noreply.github.com", "user": { "login": "chqcjq", "__typename": "User" } } ], "pullRequests": [2797] }, { "sha": "e1897c3c17c342cddf8834622c9d63e7bc6ff313", "subject": "fix(verify-package): read Hopper installer applicability from its owner (#2973)", "body": "fix(verify-package): read Hopper installer applicability from its owner (#2973)\n\n* fix(verify-package): read Hopper installer applicability from its owner\n\npackageSetupSupport derived hopperSetupSupported from the general doctor\nhost check plus a non-Windows condition, so a Debian-family host REA\nsupports but the Hopper package never tested reported an automated\ninstaller the packaged setup never offers. verifySetupApply then expected\nneeds_confirmation for the explicit --install-hopper request and failed\nat verify-package-setup.mjs:403.\n\nApplicability now comes from readLinuxDistribution() in the built\napplication, so the verifier follows the predicate the package ships, and\nit stays unknown when no distribution can be read instead of collapsing\ninto a known-unsupported host. Generic agent configuration and idempotence\nassertions stay independent of installer applicability, and the expected\nstatus is still derived from the host rather than from the request being\nasserted.\n\nVerified on Kali 2026.3, a Debian-family host with an installer-untested\ndistribution and the simulated Hopper package environment: before the\nchange npm run verify:package fails at verify-package-setup.mjs:403 with\nthe packaged setup correctly returning needs_human; after it the same run\npasses every stage. Both applicability branches are covered by\ntests/evaluation/package/packageSetupSupport.test.ts, which runs in the\nsource lane without a build. No real Hopper installation was exercised,\nso no engine compatibility claim follows.\n\nRefs #2939\n\n* fix(ci): preserve Hopper doctor readiness checks\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["ed24604ee10362b063feb8610cee1f2049df65c8"], "authors": [ { "name": "CindyGest", "email": "111882715+txiki739@users.noreply.github.com", "user": { "login": "txiki739", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2973] }, { "sha": "cddf31d55e63b809e9a075bcbe34238c2728c06e", "subject": "fix(wasm): preserve original glue source locations (#2114)", "body": "fix(wasm): preserve original glue source locations (#2114)\n\n* fix(wasm): preserve original glue source locations\n\n* fix(wasm): retain BOM-prefixed hashbang glue references\n\n* test(wasm): parse the artifact contract before reading glue evidence\n\n* test(wasm): give glue fixtures and assertions a single owner\n\n* fix(comparison): recheck historical calls-only changes (#2223)\n\n* fix(comparison): preserve incomplete function call evidence\n\nKeep missing, unknown, partial and unresolved call relationships unknown in function comparisons and reconstruction claims. Aggregate IDA caller and callee coverage without overwriting uncertainty.\n\nValidate with 144 focused tests, typecheck/lint, docs checks and test discovery. Real providers were not verified; the full headless IDA session suite requires unavailable Windows native controls.\n\n* fix(comparison): recheck historical calls-only changes\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>\n(cherry picked from commit 688defca0f4a3de04eb199f7754f323c68896c3c)\n\n* fix(ci): isolate Linux Hopper process fixture inventory\n\n(cherry picked from commit 8cac51e12184d56a9ba80a4427b3e6082ddac1ec)\n\n* fix(android): make DEX descriptor pattern portable\n\n(cherry picked from commit 1335bcddc569a1cfb34b6efedcb6f2e3aaaa3357)\n\n* fix: repair the static-check failures on the default branch (#2895)\n\n* fix: repair the static-check failures on the default branch\n\nThe default branch fails its own required `Static checks` job three ways, so\nevery pull request reports that job as failed regardless of its own change.\n\n- `npm run format:check` reports `src/domain/functionComparison.test.ts` and\n `src/ida/IdaOperationRunner.ts`.\n- `npm run lint` reports a duplicate `import { join } from \"node:path\"` in\n `tests/boundary/mcp/ghidraInventoryMcp.test.ts` (lines 4 and 17).\n- `npm run typecheck` reports `format: \"devin\"` missing from the client format\n union in `src/application/SupportedClients.ts`, and an unchecked index in\n `tests/boundary/cli/clientProfileLifecycle.test.ts`, whose pair array is\n inferred as `string[][]`.\n\nApply the pinned formatter, drop the duplicate import, list the `\"devin\"` format\nthat its own definition already uses, and mark the pair array `as const`.\n\nValidation: `npm run check:fast` and `npm run format:check` pass.\n\n* fix(setup): keep Devin on the JSON configuration dialect\n\n---------\n\nCo-authored-by: 吴佳浩 \nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>\n(cherry picked from commit df3d96da801976fdbe37a726c2f4f84af8ffbf90)\n\n---------\n\nCo-authored-by: morluto \nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>\nCo-authored-by: Lucien <164857476+dakjdakd@users.noreply.github.com>\nCo-authored-by: 吴佳浩Alben <35291372+XiaoBinGan@users.noreply.github.com>\nCo-authored-by: 吴佳浩 ", "parents": ["e1897c3c17c342cddf8834622c9d63e7bc6ff313"], "authors": [ { "name": "xin zhuang", "email": "65798732+1052326311@users.noreply.github.com", "user": { "login": "1052326311", "__typename": "User" } }, { "name": "morluto", "email": "morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "Lucien", "email": "164857476+dakjdakd@users.noreply.github.com", "user": { "login": "dakjdakd", "__typename": "User" } }, { "name": "吴佳浩Alben", "email": "35291372+XiaoBinGan@users.noreply.github.com", "user": { "login": "XiaoBinGan", "__typename": "User" } }, { "name": "吴佳浩", "email": "wujiahao@supremind.com", "user": null } ], "pullRequests": [2114] }, { "sha": "4c838469477f0b6ea844c235f78534a55118ddca", "subject": "docs: identify official REA installation sources (#2429)", "body": "docs: identify official REA installation sources (#2429)\n\n* docs: identify official REA installation sources\n\nAssisted-by: OpenAI GPT-6 \n\n* docs: show official sources before setup shortcut\n\nMove the unchanged official-source notice before the first setup command in all 19 README editions.\n\nAssisted-by: OpenAI GPT-6 \n\n---------\n\nCo-authored-by: Aurantium-47 <280805072+Aurantium-47@users.noreply.github.com>", "parents": ["cddf31d55e63b809e9a075bcbe34238c2728c06e"], "authors": [ { "name": "Aurantium", "email": "3550271410@qq.com", "user": { "login": "Aurantium-47", "__typename": "User" } }, { "name": "Aurantium-47", "email": "280805072+Aurantium-47@users.noreply.github.com", "user": { "login": "Aurantium-47", "__typename": "User" } } ], "pullRequests": [2429] }, { "sha": "2320ac23ee41f9b4224cc71bfe8f81b66fd67fe5", "subject": "test(process): preserve terminal deadline expiry regression (#2055)", "body": "test(process): preserve terminal deadline expiry regression (#2055)\n\n* fix(cli): preserve import-map option descriptions\n\n* fix(process): report no remaining time after a provider deadline fires\n\nNode timers can fire while performance.now() is still a fraction of a\nmillisecond short of the monotonic deadline. ProviderStartupDeadline then\nreported interruption \"timeout\" and an aborted signal while remainingMs()\nreturned ceil(0.x) = 1, so polling loops guarded by remainingMs() > 0\n(Hopper and Ghidra startup) could run past an elapsed deadline, and the\nreal-timer test \"aborts a bounded wait when its real monotonic deadline\nexpires\" failed intermittently in CI (expected 1 to be 0).\n\nOnce the deadline's own timer has classified a timeout, report zero\nremaining time. A deterministic regression test fires the timer with the\nmonotonic clock 0.4 ms short of the deadline.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* test(process): keep terminal deadline expiry sticky\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>\nCo-authored-by: Claude Opus 5.5 ", "parents": ["4c838469477f0b6ea844c235f78534a55118ddca"], "authors": [ { "name": "Akash-M-D", "email": "aakashdshetty@gmail.com", "user": { "login": "Akashmdshetty", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2055] }, { "sha": "3cb9d61ec1a1bf29000a00cff712ed07ca472da6", "subject": "fix(artifacts): describe ZIP non-entry coverage accurately (#2059)", "body": "fix(artifacts): describe ZIP non-entry coverage accurately (#2059)\n\n* fix(artifacts): describe ZIP non-entry coverage accurately\n\n* fix(process): report no remaining time after a provider deadline fires\n\nNode timers can fire while performance.now() is still a fraction of a\nmillisecond short of the monotonic deadline. ProviderStartupDeadline then\nreported interruption \"timeout\" and an aborted signal while remainingMs()\nreturned ceil(0.x) = 1, so polling loops guarded by remainingMs() > 0\n(Hopper and Ghidra startup) could run past an elapsed deadline, and the\nreal-timer test \"aborts a bounded wait when its real monotonic deadline\nexpires\" failed intermittently in CI (expected 1 to be 0).\n\nOnce the deadline's own timer has classified a timeout, report zero\nremaining time. A deterministic regression test fires the timer with the\nmonotonic clock 0.4 ms short of the deadline.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* style: format comparison and IDA sources\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>\nCo-authored-by: Claude Opus 5.5 ", "parents": ["2320ac23ee41f9b4224cc71bfe8f81b66fd67fe5"], "authors": [ { "name": "xin zhuang", "email": "65798732+1052326311@users.noreply.github.com", "user": { "login": "1052326311", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2059] }, { "sha": "87a8c8c9236f72fe771aa1f1771e87132f24b1d5", "subject": "test(signals): verify native decoder discovery coverage (#2818)", "body": "test(signals): verify native decoder discovery coverage (#2818)\n\n* test(signals): verify native decoder discovery coverage\n\nCompare catalog and help pages against independent native sigrok output,\nincluding full coverage counts, empty matches and boundary offsets.\n\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>\n\n* style(test): format the JVM class fixture\n\n* fix(comparison): recheck historical calls-only changes (#2223)\n\n* fix(comparison): preserve incomplete function call evidence\n\nKeep missing, unknown, partial and unresolved call relationships unknown in function comparisons and reconstruction claims. Aggregate IDA caller and callee coverage without overwriting uncertainty.\n\nValidate with 144 focused tests, typecheck/lint, docs checks and test discovery. Real providers were not verified; the full headless IDA session suite requires unavailable Windows native controls.\n\n* fix(comparison): recheck historical calls-only changes\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>\n\n* fix(ci): isolate Linux Hopper process fixture inventory\n\n---------\n\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>\nCo-authored-by: Lucien <164857476+dakjdakd@users.noreply.github.com>", "parents": ["3cb9d61ec1a1bf29000a00cff712ed07ca472da6"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "Lucien", "email": "164857476+dakjdakd@users.noreply.github.com", "user": { "login": "dakjdakd", "__typename": "User" } } ], "pullRequests": [2818] }, { "sha": "dd36b4a8a0c2c93216961f351856d54dd23e7156", "subject": "feat(analysis-view): report observed query parameter names (#2982)", "body": "feat(analysis-view): report observed query parameter names (#2982)", "parents": ["87a8c8c9236f72fe771aa1f1771e87132f24b1d5"], "authors": [ { "name": "Nianze Wu", "email": "wunianze666@gmail.com", "user": { "login": "wunianze666-netizen", "__typename": "User" } } ], "pullRequests": [2982] }, { "sha": "9630c8ff46533fe63ec0e06212d01545070d17f0", "subject": "fix(adb): remove false exclusivity from the push-file description (#2990)", "body": "fix(adb): remove false exclusivity from the push-file description (#2990)\n\npush_adb_file claimed to be the only device-mutating ADB tool while\ninstall, uninstall, start-app, start-activity and stop-app are also\ndevice-mutating. Drop the exclusivity claim from the contract\ndescription and the push limitations, keeping the device-mutation fact.\n\nFixes #2602.\n\nCo-authored-by: me ", "parents": ["dd36b4a8a0c2c93216961f351856d54dd23e7156"], "authors": [ { "name": "Quentin Limo", "email": "85309073+3QL@users.noreply.github.com", "user": { "login": "3QL", "__typename": "User" } }, { "name": "me", "email": "me@medz.org", "user": null } ], "pullRequests": [2990] }, { "sha": "0bf01dfa595c6d2bf7012c049a253895d89de8b8", "subject": "perf(ci): share trusted caches and fail fast on PR test failures (#3007)", "body": "perf(ci): share trusted caches and fail fast on PR test failures (#3007)\n\n* fix(ci): restore inherited validation failures\n\n* perf(ci): share trusted caches and fail fast on PR test failures\n\n* fix(ci): bound static cache and hash vitest config for knip\n\n- Bound the rolling .turbo/cache snapshot with 7d/500MB eviction so each\n trusted main save cannot accumulate history toward the GitHub limit.\n- Hash vitest.config.ts in knip inputs so removing the CiTestSequencer\n import invalidates the cached passing check.\n- Cover both in cache-policy and task-hash regressions.", "parents": ["9630c8ff46533fe63ec0e06212d01545070d17f0"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [3007] }, { "sha": "49e73fc03bec57c6a881a863a6c922d0f69017e7", "subject": "chore(package): replace disassembler keyword with rea", "body": "chore(package): replace disassembler keyword with rea\n", "parents": ["0bf01dfa595c6d2bf7012c049a253895d89de8b8"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "2ad2a044d419513b9ad563662363250b185ee4f6", "subject": "chore(package): add analysis target and provider keywords", "body": "chore(package): add analysis target and provider keywords\n", "parents": ["49e73fc03bec57c6a881a863a6c922d0f69017e7"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "4aa51bfe1997ef2df6e905ab2fb7bcd5fabfe16e", "subject": "fix(reverse): reconcile cleanup ownership and mutation diagnostics (#2799)", "body": "fix(reverse): reconcile cleanup ownership and mutation diagnostics (#2799)\n\n* feat(process): add owned debugger shutdown lifecycle\n\n* feat(reverse): add local inspection commands\n\n* feat(gdb): add persistent debugger integration\n\n* feat(cutter): add Cutter bridge integration\n\n* test(reverse): enforce complete integration coverage\n\n* fix(process): preserve debugger shutdown ownership\n\n* fix(reverse): retain evidence across interrupted commands\n\n* fix(gdb): honor captured provider environment\n\n* test(process): cover debugger shutdown retries\n\n* fix(reverse): retain evidence for interrupted providers\n\n* test(process): cover debugger shutdown retries\n\n* fix(reverse): retain evidence for interrupted providers\n\n* fix(server): snapshot provider environment at creation\n\n* fix(reverse): close review gaps with complete coverage\n\n* fix(reverse): address inspection review findings\n\n* fix(gdb): bound sessions and retain cleanup ownership\n\n* fix(ci): require reverse-tools quality lane\n\n* fix(process): unref inherited debugger output pipes\n\n* fix(reverse): address remaining PR 1960 findings\n\n* fix(gdb): address remaining PR 1961 findings\n\n* fix(reverse): account for unrestricted provider execution\n\n* fix(process): retain debugger ownership until safe shutdown\n\n* fix(process): preserve replacement debugger sessions\n\n* fix(reverse): preserve admission and output provenance\n\n* fix(process): retain exited debugger until output settles\n\n* fix(mcp): bound provider admission and debugger cleanup\n\n* fix(reverse): preserve failure provenance and classify E2BIG\n\n* fix(gdb): preserve startup cleanup and detach safety\n\n* fix(process): retain debugger ownership after detach failure\n\n* fix(reverse): preserve mutation and failure provenance\n\n* fix(gdb): address debugger review findings\n\n* fix(reverse): rebind sessions after external mutation\n\n* fix(process): cap debugger output after exit\n\n* fix(gdb): protect one-shot detach verification\n\n* feat(debugger): add reverse tool coverage gate\n\n* test(debugger): cover integrated failure paths\n\n* fix(gdb): bound and preserve session observations\n\n* fix(gdb): address review regressions\n\n* style: format merged integration files\n\n* fix(reverse): preserve session and output evidence\n\n* refactor(gdb): share repeated test and partial result setup\n\n* fix(gdb): invalidate TTY proof for Python aliases\n\n* fix(reverse): retain failure output byte counts\n\n* test(process): synchronize late debugger output\n\n* fix(gdb): invalidate TTY proof for wrapped commands\n\n* fix(gdb): recognize wit command abbreviation\n\n* test(reverse): wait for cancelled descendant readiness\n\n* test(reverse): bound descendant cancellation cleanup\n\n* style(reverse): format integration tests and adapters\n\n* style: format reverse engineering integration files\n\n* test(reverse): remove duplicate environment harness\n\n* test(gdb): share session startup assertions\n\n* fix(gdb): invalidate output proof for command abbreviations\n\n* test(reverse): share composition edge case scenarios\n\n* fix(ci): recognize verification and mutation tool entries\n\n* test(rizin): cover successful fake inferior detach\n\n* test(cli): align full output failure envelope\n\n* test(cli): isolate reverse command lifecycle service\n\n* test(process): share debugger output fixture setup\n\n* fix(binary): preserve high-bit Windows signature bytes\n\n* style(binary): format Windows signature parser\n\n* test(mcp): preserve call coverage in unchanged comparison\n\n* fix(ci): include reverse tools Vitest configs in lint cache\n\n* fix(mcp): preserve target content on delivery errors\n\n* ci: align duplication ceiling with expanded suite\n\n* test(reverse): allow signal admission mutants\n\n* fix(reverse): bound retained cleanup failures to process owners\n\n* fix(test): replace drifting mutation ranges with owned selectors\n\n* fix(reverse): admit persistent commands and retain cleanup ownership\n\n* fix(cutter): recover timed-out commands from exact receipts\n\n* fix(cutter): reject unsupported bridge request kinds\n\n* fix(ci): repair client format and shared verification fixtures\n\n* fix(native): preserve debugger cleanup ownership and bridge authentication\n\n* test(native): retain diagnostics without perfect coverage requirements\n\n* chore(licenses): refresh locked dependency inventory and notices\n\n* fix(test): exclude transient command locks from mutation sandboxes\n\n* fix(gdb): admit only platforms with safe detach verification\n\n* fix(cutter): retain bounded completion receipts until acknowledgement\n\n* fix(cutter): acknowledge commands rejected before UI dispatch\n\n* test(reverse): fail cancellation checks before fixture teardown\n\n* test(gdb): clean up the retained broken-stdin fixture owner\n\n* docs(test): clarify focused provider verification scope\n\n* fix(rizin): retain close cleanup failures\n\n* fix(gdb): wait for inferior stop and bound MI buffering\n\n* fix(cutter): retain failed receipt acknowledgements\n\n* fix(rizin): return retained session identity on rebind failure\n\n* fix(gdb): preserve startup cancellation and lossy status\n\n* fix(rizin): retain launch provenance and assemble frames once\n\n* fix(cutter): recover receipts across callers and bound discovery\n\n* docs: describe debugger evidence and bridge recovery\n\n* fix(process): keep cleanup incomplete while writers remain\n\nStopping a debugger no longer reports success when inherited output\nstreams stay open, so BinarySession cannot reopen a binary a child is\nstill changing. Concurrent Cutter cleanup retries share one receipt\nacknowledgement instead of treating a consumed receipt as failure.\n\n* fix(debuggers): recover cleanup with captured process identities\n\n* fix(analysis): retire sessions after unrestricted commands\n\n* fix(cli): preserve completed evidence after cleanup recovery\n\n* fix(cutter): bound frame collection and coalesce cleanup\n\n* fix(windows): resolve selected provider paths absolutely\n\n* fix(gdb): report decoding loss in failed startup evidence\n\n* fix(rizin): scope decoding loss to collected command frames\n\n* test(mcp): cover snapshot retirement in reverse tools CI\n\n---------\n\nCo-authored-by: Daniel Gonçalves Araujo <47118053+dandgabr@users.noreply.github.com>\nCo-authored-by: REA Maintainers \nCo-authored-by: OpenAI Codex \nCo-authored-by: Cursor Agent ", "parents": ["2ad2a044d419513b9ad563662363250b185ee4f6"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "Daniel Gonçalves Araujo", "email": "47118053+dandgabr@users.noreply.github.com", "user": { "login": "dandgabr", "__typename": "User" } }, { "name": "REA Maintainers", "email": "noreply@github.com", "user": { "login": "web-flow", "__typename": "User" } }, { "name": "OpenAI Codex", "email": "codex@users.noreply.github.com", "user": { "login": "codex", "__typename": "User" } }, { "name": "Cursor Agent", "email": "cursoragent@cursor.com", "user": { "login": "cursoragent", "__typename": "User" } } ], "pullRequests": [2799] }, { "sha": "ddcdb3c37837fb8eda0fdee92853774453f1b4ef", "subject": "docs(i18n): add Greek translations (#2985)", "body": "docs(i18n): add Greek translations (#2985)\n\n* docs(i18n): add Greek translations\n\nGive Greek-speaking readers localized onboarding guidance and begin website coverage while keeping incomplete pages on the explicit English fallback.\n\n- Add the reviewed Greek README and place Greek last in every language selector.\n- Register Greek website localization and include 206 translated messages.\n- Keep incomplete routes nonindexable and replace fixed translation counts with inventory-based coverage.\n\nRefs #2984\n\n* docs(website): improve Greek homepage wording", "parents": ["4aa51bfe1997ef2df6e905ab2fb7bcd5fabfe16e"], "authors": [ { "name": "Pirro Zani", "email": "131965864+pirrozani@users.noreply.github.com", "user": { "login": "pirrozani", "__typename": "User" } } ], "pullRequests": [2985] }, { "sha": "3620074b318a3b2182237d39b52d5d4aee832317", "subject": "docs(android): link the JADX provider download", "body": "docs(android): link the JADX provider download\n\nDocument the pinned JADX release download and digest verification for npm users and repository checkouts. Keep caller-selected local paths; identify the fixture helper as checkout-only. Include shell and PowerShell examples, with the POSIX path set only after successful download and verification.\n\nValidation: actual pinned JAR/APK fetch verification; real curl download and SHA-256 checks using sha256sum and the shasum fallback; controlled corrupt-file and failed-download cases; POSIX syntax; docs:check (5 conformance tests), typecheck/lint, formatting and diff checks. Provider execution and native macOS/Windows command runs were not repeated.\n\nCo-authored-by: Seelly <93262000+Seelly@users.noreply.github.com>\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>", "parents": ["ddcdb3c37837fb8eda0fdee92853774453f1b4ef"], "authors": [ { "name": "wseelly", "email": "93262000+Seelly@users.noreply.github.com", "user": { "login": "Seelly", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "factory-droid[bot]", "email": "138933559+factory-droid[bot]@users.noreply.github.com", "user": { "login": "factory-droid[bot]", "__typename": "User" } } ], "pullRequests": [2699] }, { "sha": "bee73fcb67cd13fca7a1177de215bc0a14e43d5b", "subject": "docs(readme): move setup command above official-source notice", "body": "docs(readme): move setup command above official-source notice\n", "parents": ["3620074b318a3b2182237d39b52d5d4aee832317"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "06739aeaf259ab709fd8014e0cde83c5ea25d0a0", "subject": "fix(javascript): ignore erased TypeScript names in native-addon requests (#2766)", "body": "fix(javascript): ignore erased TypeScript names in native-addon requests (#2766)\n\n* fix(javascript): ignore erased TypeScript names in native-addon requests\n\nSkip import type / export type declarations and per-binding type\nspecifiers when collecting .node addon members so only runtime value\nimports request native exports (fixes #2667).\n\nCo-authored-by: Cursor \n\n* test(javascript): cover erased TypeScript re-export forms\n\n* test(javascript): allow Inspector observation events to arrive\n\n* test(inspector): emit events before enable responses\n\n---------\n\nCo-authored-by: Cursor \nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["bee73fcb67cd13fca7a1177de215bc0a14e43d5b"], "authors": [ { "name": "BeqaKs", "email": "91750923+BeqaKs@users.noreply.github.com", "user": { "login": "BeqaKs", "__typename": "User" } }, { "name": "Cursor", "email": "cursoragent@cursor.com", "user": { "login": "cursoragent", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2766] }, { "sha": "14fef73882f8789d80e5af5cf44b25244a15e357", "subject": "docs(readme): restore Greek guide and official-source links (#3021)", "body": "docs(readme): restore Greek guide and official-source links (#3021)\n\n* docs(readme): restore Greek guide and official-source links\n\nCopy the canonical English official-source notice, Rust analysis row, and GNU\nobjdump/Rizin guide paragraph into the newly added Greek README. Restore the\ndocumentation target set required by docs:check.\n\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>\n\n* docs(i18n): translate restored Greek README guidance\n\n---------\n\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["06739aeaf259ab709fd8014e0cde83c5ea25d0a0"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "factory-droid[bot]", "email": "138933559+factory-droid[bot]@users.noreply.github.com", "user": { "login": "factory-droid[bot]", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [3021] }, { "sha": "1342eddd03ff4f50cf87484d36fcd72b698d80af", "subject": "test(analysis-view): order the message-cutoff fixture lexicographically (#3018)", "body": "test(analysis-view): order the message-cutoff fixture lexicographically (#3018)\n\nboundedViewMessages returns uniqueSorted output, so the 100-message fixture\ncame back in lexicographic order (\"message 59\", \"message 6\", \"message 60\")\nwhile the assertion compared against generation order. Pad the index to a\nfixed width so both orders coincide and the test checks what it means to:\nthat no count-based cutoff applies below the byte budget.\n\nCo-authored-by: Claude Opus 5 ", "parents": ["14fef73882f8789d80e5af5cf44b25244a15e357"], "authors": [ { "name": "morconsultoriadigital-afk", "email": "mor.consultoriadigital@gmail.com", "user": { "login": "morconsultoriadigital-afk", "__typename": "User" } }, { "name": "Claude Opus 5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [3018] }, { "sha": "aa6f74af04c06d3d09ef69d2292f05f74e93cf1b", "subject": "fix(setup): configure a comment-only Hermes config.yaml (#2096)", "body": "fix(setup): configure a comment-only Hermes config.yaml (#2096)\n\n* fix(setup): configure a comment-only Hermes config.yaml\n\ncomments, or only a `---` marker, also parses to a null YAML document.\nSetup still rejected it as malformed (\"expected record, received null\")\nand reported Hermes as invalid.\n\nTreat a null Hermes document as holding no settings, as #1983 does for\nan empty file. The serializer already edits a comment-only document in\nplace. A bare `---` document holds a null scalar that takes no keys, so\nreplace it with a map and keep the comments written after the marker.\n\n* fix(setup): keep rejecting an explicit null Hermes root\n\nOnly a document with no root, or a bare --- marker whose null scalar has\nno source text, holds no settings. An explicit null or ~ is a value, so\nsetup and uninstall reject it as before, the same as any other non-map\nroot.\n\n* test(setup): split the Hermes empty-configuration tests under the function length limit\n\nThe Hermes YAML registration block reached 159 lines, past oxlint's\nmax-lines-per-function limit of 150. Move the empty-document cases and\nthe multiple-document rejection into their own block.\n\n* fix(setup): type the Hermes edit document as a plain Document\n\nparseDocument with options returns a Document.Parsed, whose contents\naccept only parsed nodes, so assigning the new map for a bare --- root\nfailed typecheck (TS2322). Annotate the edited document as Document, as\nthe code did before it moved into HermesConfigurationYaml.ts.\n\n* fix(ci): isolate Linux Hopper process fixture inventory\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["1342eddd03ff4f50cf87484d36fcd72b698d80af"], "authors": [ { "name": "Jeremy Levartovsky", "email": "140487034+JayOfTheKeyboard@users.noreply.github.com", "user": { "login": "JayOfTheKeyboard", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2096] }, { "sha": "6510d0d57f9d37da866fdf4fdf9d3146f974fd28", "subject": "perf(ci): start source feedback early and diagnose stalled runs (#3013)", "body": "perf(ci): start source feedback early and diagnose stalled runs (#3013)\n\n* perf(ci): start source feedback early and diagnose stalled runs\n\n* fix(ci): verify workflow identities before main comparison limits\n\n* fix(ci): preserve diagnostics across passing checks and install failures\n\n* fix(ci): preserve ambiguous workflow run ordering\n\n* fix(ci): preserve failure-report candidate and request budgets\n\n* fix(ci): retain candidate errors while checking later main evidence\n\n* fix(ci): retain partial reports and require complete health scans\n\n* test(ci): prune stale fixtures and duplicated assumptions", "parents": ["aa6f74af04c06d3d09ef69d2292f05f74e93cf1b"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [3013] }, { "sha": "4d98123279c5a6f5442c458307f5a3ec678fd49e", "subject": "fix(hopper): recover from a Spotlight not-found launch (#2795)", "body": "fix(hopper): recover from a Spotlight not-found launch (#2795)\n\n* fix(hopper): recover from a Spotlight not-found launch\n\nHopper's native launcher locates the application through a fixed Spotlight\nquery before any Apple event. With indexing disabled it exits 3 with a\nnot-found report, but REA treated the external document as unconfirmed,\nretained the runtime and failed every later open_binary until the server\nrestarted. Recognize the complete report as a pre-handoff failure, confirm\nno document exists, and tell the caller to enable Spotlight indexing.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(hopper): require empty stdout for native launch signatures\n\n* fix(hopper): retain ownership after unverified Spotlight reports\n\n---------\n\nCo-authored-by: Claude Opus 5.5 \nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["6510d0d57f9d37da866fdf4fdf9d3146f974fd28"], "authors": [ { "name": "Bruno Costa Candia", "email": "55243348+bruno-candia@users.noreply.github.com", "user": { "login": "bruno-candia", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2795] }, { "sha": "4acda94b76203cae15363bdf65be5b0e1390395b", "subject": "fix(hopper): recover provenance-verified Spotlight exits", "body": "fix(hopper): recover provenance-verified Spotlight exits\n\nVerify the native helper's sealed identifier and pinned Apple signing team in BridgeLauncher, then carry that provenance to HopperClient. Only a verified native helper's complete not-found exit confirms no document handoff, allowing runtime and target-lease cleanup and retry; wrappers retain unknown document state.\n\nShare publisher identity with setup through the domain contract. Correct fixture teardown ordering and parameterized MCP coverage. Validation: 54 focused tests passed across boundary, CLI, MCP acceptance, diagnostics and installer coverage (one Linux-only case skipped); check:fast passed. Real codesign verification accepted the installed official Hopper helper; Spotlight failures and bridge recovery used process fixtures.\n", "parents": ["4d98123279c5a6f5442c458307f5a3ec678fd49e"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "3ae02f6a458e25e56b82386e89fb56eae5249bff", "subject": "fix(verification): parse browser endpoints before provider calls", "body": "fix(verification): parse browser endpoints before provider calls\n", "parents": ["4acda94b76203cae15363bdf65be5b0e1390395b"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "f0e86997aa5337f2229d228ea3cb94cb5d1903e5", "subject": "test(providers): correct executable and retained-owner expectations", "body": "test(providers): correct executable and retained-owner expectations\n", "parents": ["3ae02f6a458e25e56b82386e89fb56eae5249bff"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "70c238e376aff3c4ff16f8c6e8474c61e8e7fa89", "subject": "test(ci): verify resolved cache inputs instead of glob spelling", "body": "test(ci): verify resolved cache inputs instead of glob spelling\n", "parents": ["f0e86997aa5337f2229d228ea3cb94cb5d1903e5"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "0161a593e520db550d5e76288124d520870aa2cd", "subject": "style(hopper): format startup diagnostic expectations", "body": "style(hopper): format startup diagnostic expectations\n", "parents": ["70c238e376aff3c4ff16f8c6e8474c61e8e7fa89"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "22552525d54f349571c1e9d43d9535abea3df9b7", "subject": "fix(ci): preserve per-job findings and unavailable blob evidence", "body": "fix(ci): preserve per-job findings and unavailable blob evidence\n", "parents": ["0161a593e520db550d5e76288124d520870aa2cd"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "cd740a6764d24e466f31613c2cef3368c3f64cba", "subject": "test(hopper): fix fixture context and cleanup assumptions", "body": "test(hopper): fix fixture context and cleanup assumptions\n", "parents": ["22552525d54f349571c1e9d43d9535abea3df9b7"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "7e9fb6f1bbea8aad1704627d5961d88067680051", "subject": "test(javascript): run native type bindings with compiled boundary prerequisites", "body": "test(javascript): run native type bindings with compiled boundary prerequisites\n", "parents": ["cd740a6764d24e466f31613c2cef3368c3f64cba"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "c86b09a1095ffd360cd8851ff20a7b6aeb19b198", "subject": "feat(ghidra): admit 32-bit big-endian PowerPC ELF (#1747)", "body": "feat(ghidra): admit 32-bit big-endian PowerPC ELF (#1747)\n\n* feat(ghidra): admit 32-bit big-endian PowerPC ELF\n\nRecognize EM_PPC as a provider-neutral `powerpc` family that keeps its ELF\nclass, byte order, type and flags, and admit ELF32 big-endian ET_EXEC through\na bounded Ghidra lane. ELF64, little-endian, relocatable/shared objects and\nEF_PPC_EMB are refused with a specific reason; Hopper and IDA do not gain\nPowerPC support, and Windows Ghidra P0 is unchanged.\n\nGhidra's ELF loader selects PowerPC:BE:32:e500:default for a plain EM_PPC\nheader, which misreads 750-family code. The lane binds\nPowerPC:BE:32:default/default in the profile (language_selection\n\"admitted-lane-v1\"), imports with it and checks the reported language. A\nlanguage set through REA_GHIDRA_LANGUAGE_ID still replaces the lane default.\n\nAdd a source-owned fixture, fixed-encoding probe, GNU readelf cross-check and\nthe optional `verify:ghidra:ppc` real-provider lane, plus docs/ghidra-ppc.md.\n\nRefs #1741\n\n* style(ghidra): format shared PowerPC profile integration\n\n* fix(ghidra): preserve caller-selected PowerPC languages\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["7e9fb6f1bbea8aad1704627d5961d88067680051"], "authors": [ { "name": "Ariel Fikru Avicenna", "email": "71917936+arielfikru@users.noreply.github.com", "user": { "login": "arielfikru", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [1747] }, { "sha": "1ebbc3b3714a83f10950eaa09bee5d4490bd572e", "subject": "fix(managed): pair members by declared identity before name-free remaps (#2116)", "body": "fix(managed): pair members by declared identity before name-free remaps (#2116)\n\n* fix(managed): pair members by declared identity before name-free remaps\n\nThe first matching round keyed methods on signature and normalized CIL,\nand fields on signature, without the declared type or name. Identical\nmembers of different types fell into one ambiguous group, so a file\ncompared with itself reported unknowns, and a lone match across types\nwas reported as an unchanged exact pair while the member's own\ncounterpart went unpaired.\n\nPair by declared type, name, and exact CIL/signature first, then by\ndeclared type, name, and raw signature. The name-free CIL/signature,\nfield-signature, and structural rounds now run last, as remaps, and\nskip a pair across declared identities while either member's own type\nand name remain unpaired on the other side.\n\nNested types that share a bare name still share one declared identity,\nso their identical members stay ambiguous in a self-comparison.\n\n* fix(managed): keep members with kept identities out of remap rounds\n\nThe cross-identity check applied only to one-to-one groups. A member\nwhose own declared type and name were still unpaired on the other side\ncould fall into a larger remap group and be reported ambiguous, and a\nblocked candidate could make an otherwise unique remap ambiguous.\n\nA remap round now drops such members before grouping, along with\nmembers whose declaring type is unresolved. Same-identity structural\npairs get their own round before the remaps. Each member's declared\nidentity is computed once.\n\nAmbiguity limitations now name the evidence a group shares, which\nstays true whether the round keyed on names or not.\n\n* fix(managed): keep names in unresolved identities and hold ambiguous ones\n\nA member of an unresolved declaring type had no declared identity, so\nthe declared-identity rounds keyed it by CIL or signature alone. Two\nunresolved members with different names paired as an exact match, and\na file compared with itself reported unresolved members ambiguous.\n\nThe declared identity now always includes the name, with a null type\nfor an unresolved one. Remap rounds still leave such members out.\n\nA remap round now also leaves out a member whose own identity sits in\nan ambiguous group on the other side, not only one left one-sided.\n\nThe undecoded-counterpart check uses the same declared identity.\n\n* fix(managed): keep remap groups with unresolved owners ambiguous\n\nRemap rounds dropped members of an unresolved declaring type before\ngrouping. Such a member can be another member's own counterpart, so a\nresolved member could remap to a copy in another type while its\nunresolved counterpart was reported added.\n\nUnresolved members now join remap grouping, and a group that contains\none stays ambiguous instead of pairing.\n\nThe undecoded-counterpart set reuses each member's computed identity.\n\n* fix(managed): keep ownerless members out of declared rounds when shared\n\nA member whose declaring type did not resolve has a declared identity\nof a null type and its name. The declared rounds paired two such\nsame-named members even when the other side also held a resolved\nmember with the same CIL and signature, which could be the owner. The\nold name-free first round reported that group as ambiguous.\n\nAn ownerless member now enters the declared rounds only when no other\nmember on either side shares its exact CIL/signature key, and never\nthe declared structural round. Otherwise it reaches the remap rounds,\nwhich keep any group with an unresolved member ambiguous.\n\n* fix(managed): keep competitors of an ownerless member out of the declared round\n\nWhen an ownerless member shares its exact CIL/signature key with another\nmember on the same side, its owner may be that member. The resolved\nmembers holding the key now stay out of the declared round too, so they\ncannot pair and consume the candidate the ownerless member may own, and\nthe remap round keeps the whole group ambiguous as main does. A lone\nownerless member still pairs with its lone counterpart.\n\n* test(managed): split the ownerless comparison tests under the function length limit\n\nThe ownerless describe block reached 181 lines, past oxlint's\nmax-lines-per-function limit of 150. Move the structural-competitor\ncase into its own block.\n\n* fix(managed): contest signatures and remap only open candidates\n\n* fix(managed): retain blocked raw-signature choices as unknown\n\n* fix(managed): keep member names in signature contention\n\n* fix(managed): scope residual signature contention by name once\n\nownerlessContested applies competitionIdentityKey itself, but\nunresolvedSignatureAmbiguities passed it keys that were already\nname-scoped, so the contested set never matched the groups and the\nsame-signature, different-body case reported additions and removals\ninstead of one unknown group. Pass the raw signature key.\n\n* fix(managed): constrain matchObserved to declared members\n\nmatchObserved passes its items to matchByKeys, which needs Declared, so\nits looser { declaring_type } bound failed typecheck (TS2344, TS2322).\n\n* fix(managed): retain held ownership contention for residual matches\n\n* fix(test): bind workspace fixture in Hopper launch cases\n\n* fix(ci): prepare worker tests and preserve Hopper cleanup ordering\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["c86b09a1095ffd360cd8851ff20a7b6aeb19b198"], "authors": [ { "name": "Jeremy Levartovsky", "email": "140487034+JayOfTheKeyboard@users.noreply.github.com", "user": { "login": "JayOfTheKeyboard", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2116] }, { "sha": "7072f87baf096eb944f15bc52e3925653d459cba", "subject": "fix(artifacts): preserve Mach-O load-command string identity (#2110)", "body": "fix(artifacts): preserve Mach-O load-command string identity (#2110)\n\n* fix(artifacts): preserve Mach-O load-command string identity\n\n* fix(process): report no remaining time after a provider deadline fires\n\nNode timers can fire while performance.now() is still a fraction of a\nmillisecond short of the monotonic deadline. ProviderStartupDeadline then\nreported interruption \"timeout\" and an aborted signal while remainingMs()\nreturned ceil(0.x) = 1, so polling loops guarded by remainingMs() > 0\n(Hopper and Ghidra startup) could run past an elapsed deadline, and the\nreal-timer test \"aborts a bounded wait when its real monotonic deadline\nexpires\" failed intermittently in CI (expected 1 to be 0).\n\nOnce the deadline's own timer has classified a timeout, report zero\nremaining time. A deterministic regression test fires the timer with the\nmonotonic clock 0.4 ms short of the deadline.\n\nCo-Authored-By: Claude Opus 5.5 \n(cherry picked from commit dfdaa0ca74cc84a45dcb186422a0f51aa61bc427)\n\n* fix(ci): isolate Linux Hopper process fixture inventory\n\n* fix(comparison): recheck historical calls-only changes (#2223)\n\n* fix(comparison): preserve incomplete function call evidence\n\nKeep missing, unknown, partial and unresolved call relationships unknown in function comparisons and reconstruction claims. Aggregate IDA caller and callee coverage without overwriting uncertainty.\n\nValidate with 144 focused tests, typecheck/lint, docs checks and test discovery. Real providers were not verified; the full headless IDA session suite requires unavailable Windows native controls.\n\n* fix(comparison): recheck historical calls-only changes\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>\n\n* style: format identity comparison and IDA runner\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>\nCo-authored-by: Claude Opus 5.5 \nCo-authored-by: Lucien <164857476+dakjdakd@users.noreply.github.com>", "parents": ["1ebbc3b3714a83f10950eaa09bee5d4490bd572e"], "authors": [ { "name": "xin zhuang", "email": "65798732+1052326311@users.noreply.github.com", "user": { "login": "1052326311", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } }, { "name": "Lucien", "email": "164857476+dakjdakd@users.noreply.github.com", "user": { "login": "dakjdakd", "__typename": "User" } } ], "pullRequests": [2110] }, { "sha": "3a4d49406a4f3c0b566b6a16f3655c08b1354e19", "subject": "fix(javascript): preserve Electron runtime entrypoint paths (#2742)", "body": "fix(javascript): preserve Electron runtime entrypoint paths (#2742)\n\n* fix(javascript): preserve Electron runtime entrypoint paths\n\n* fix(javascript): resolve runtime entrypoints before modules\n\n* fix(javascript): preserve Electron runtime path semantics\n\n* fix(javascript): resolve Electron renderers exactly\n\n* fix(javascript): retain runtime package aliases\n\n* fix(javascript): retain missing renderer URL paths\n\n* fix(javascript): resolve Electron URL and utility entries correctly\n\n* fix(javascript): reject suffix-only worker URLs\n\n* fix(javascript): respect Electron URL and utility path semantics\n\n* fix(javascript): separate Node runtime entrypoints from source imports\n\n* fix(comparison): recheck historical calls-only changes (#2223)\n\n* fix(comparison): preserve incomplete function call evidence\n\nKeep missing, unknown, partial and unresolved call relationships unknown in function comparisons and reconstruction claims. Aggregate IDA caller and callee coverage without overwriting uncertainty.\n\nValidate with 144 focused tests, typecheck/lint, docs checks and test discovery. Real providers were not verified; the full headless IDA session suite requires unavailable Windows native controls.\n\n* fix(comparison): recheck historical calls-only changes\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>\n(cherry picked from commit 688defca0f4a3de04eb199f7754f323c68896c3c)\n\n* fix(ci): isolate Linux Hopper process fixture inventory\n\n(cherry picked from commit 8cac51e12184d56a9ba80a4427b3e6082ddac1ec)\n\n* fix(android): make DEX descriptor pattern portable\n\n(cherry picked from commit 1335bcddc569a1cfb34b6efedcb6f2e3aaaa3357)\n\n* fix: repair the static-check failures on the default branch (#2895)\n\n* fix: repair the static-check failures on the default branch\n\nThe default branch fails its own required `Static checks` job three ways, so\nevery pull request reports that job as failed regardless of its own change.\n\n- `npm run format:check` reports `src/domain/functionComparison.test.ts` and\n `src/ida/IdaOperationRunner.ts`.\n- `npm run lint` reports a duplicate `import { join } from \"node:path\"` in\n `tests/boundary/mcp/ghidraInventoryMcp.test.ts` (lines 4 and 17).\n- `npm run typecheck` reports `format: \"devin\"` missing from the client format\n union in `src/application/SupportedClients.ts`, and an unchecked index in\n `tests/boundary/cli/clientProfileLifecycle.test.ts`, whose pair array is\n inferred as `string[][]`.\n\nApply the pinned formatter, drop the duplicate import, list the `\"devin\"` format\nthat its own definition already uses, and mark the pair array `as const`.\n\nValidation: `npm run check:fast` and `npm run format:check` pass.\n\n* fix(setup): keep Devin on the JSON configuration dialect\n\n---------\n\nCo-authored-by: 吴佳浩 \nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>\n(cherry picked from commit df3d96da801976fdbe37a726c2f4f84af8ffbf90)\n\n---------\n\nCo-authored-by: morluto \nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>\nCo-authored-by: Lucien <164857476+dakjdakd@users.noreply.github.com>\nCo-authored-by: 吴佳浩Alben <35291372+XiaoBinGan@users.noreply.github.com>\nCo-authored-by: 吴佳浩 ", "parents": ["7072f87baf096eb944f15bc52e3925653d459cba"], "authors": [ { "name": "Avocado", "email": "headmastereggy@gmail.com", "user": { "login": "HeadmasterEggy", "__typename": "User" } }, { "name": "morluto", "email": "morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "Lucien", "email": "164857476+dakjdakd@users.noreply.github.com", "user": { "login": "dakjdakd", "__typename": "User" } }, { "name": "吴佳浩Alben", "email": "35291372+XiaoBinGan@users.noreply.github.com", "user": { "login": "XiaoBinGan", "__typename": "User" } }, { "name": "吴佳浩", "email": "wujiahao@supremind.com", "user": null } ], "pullRequests": [2742] }, { "sha": "c6166d4b56d6c6e4ad33980464edc8697672168a", "subject": "fix(javascript): retain bridge conditions on IPC joins (#2747)", "body": "fix(javascript): retain bridge conditions on IPC joins (#2747)\n\n* fix(javascript): retain bridge conditions on IPC joins\n\n* fix(javascript): retain IPC condition ownership\n\n* style(javascript): format bridge path regression\n\n* fix(process): report no remaining time after a provider deadline fires\n\nNode timers can fire while performance.now() is still a fraction of a\nmillisecond short of the monotonic deadline. ProviderStartupDeadline then\nreported interruption \"timeout\" and an aborted signal while remainingMs()\nreturned ceil(0.x) = 1, so polling loops guarded by remainingMs() > 0\n(Hopper and Ghidra startup) could run past an elapsed deadline, and the\nreal-timer test \"aborts a bounded wait when its real monotonic deadline\nexpires\" failed intermittently in CI (expected 1 to be 0).\n\nOnce the deadline's own timer has classified a timeout, report zero\nremaining time. A deterministic regression test fires the timer with the\nmonotonic clock 0.4 ms short of the deadline.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(javascript): preserve Electron join condition coverage\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>\nCo-authored-by: Claude Opus 5.5 \nCo-authored-by: Codex ", "parents": ["3a4d49406a4f3c0b566b6a16f3655c08b1354e19"], "authors": [ { "name": "Avocado", "email": "headmastereggy@gmail.com", "user": { "login": "HeadmasterEggy", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } }, { "name": "Codex", "email": "codex@users.noreply.github.com", "user": { "login": "codex", "__typename": "User" } } ], "pullRequests": [2747] }, { "sha": "bcb60c179e30c6e7caa1113cb98e91744bfea3a6", "subject": "fix(browser): read expression-free template literals as module specifiers (#2842)", "body": "fix(browser): read expression-free template literals as module specifiers (#2842)\n\nCaptured-bundle chunk edges and source-map original module edges only\naccepted quoted string literals as import()/require() specifiers. Bundlers\nsuch as rolldown emit plain constants as expression-free template literals\n(import(`./chunk.js`)), so statically known dependencies were dropped while\ncompleteness stayed complete. Read both sites through the shared exact-literal\nreader (stringValue); template literals with substitutions stay unrecognized.\n\nOn OWASP Juice Shop v20.3.0 this recovers 8 lazy chunk edges (previously 0).\n\nFixes #2841\nFixes #2599\n\nCo-authored-by: Claude Opus 5.5 \nCo-authored-by: morluto <17176810+morluto@users.noreply.github.com>\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["c6166d4b56d6c6e4ad33980464edc8697672168a"], "authors": [ { "name": "Shubham Ahuja", "email": "157806066+shubhamahuja9999@users.noreply.github.com", "user": { "login": "shubhamahuja9999", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } }, { "name": "morluto", "email": "17176810+morluto@users.noreply.github.com", "user": { "login": "skydavil", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2842] }, { "sha": "1f122c02b71dae7f4109f35ed834f82b96fbf247", "subject": "fix(javascript): exclude HTML URL suffixes from path admission (#2833)", "body": "fix(javascript): exclude HTML URL suffixes from path admission (#2833)", "parents": ["bcb60c179e30c6e7caa1113cb98e91744bfea3a6"], "authors": [ { "name": "Yann Roberto", "email": "165009858+shoyann@users.noreply.github.com", "user": { "login": "shoyann", "__typename": "User" } } ], "pullRequests": [2833] }, { "sha": "b9b3a9098b072313119eccb3ae574faa57c3e517", "subject": "fix(gemini): compare consolidated allowlists through one normalizer (#2495)", "body": "fix(gemini): compare consolidated allowlists through one normalizer (#2495)\n\n* fix(gemini): compare consolidated allowlists through one normalizer\n\ngeminiServerPolicyBlock consolidates allowlists by normalized intersection but\ntested the consolidated list against the raw server key. Because the\nintersection keeps the spelling of whichever policy came first, the same pair of\npolicies blocked the server in one arrangement and allowed it in the other, and\nthe excluded test had the mirror-image asymmetry.\n\nNormalize the comparison key once and use the same normalizer for the exclusion\ntest, the intersection and the membership test. The messages keep the\ncaller-facing server key, so lookup and display stay separate.\n\nVerified with 88 client profile, lifecycle and registration tests, check:fast\nand verify:test-discovery on macOS arm64. The regression test drives setup twice\nwith the same policies in both arrangements; before the change one arrangement\nfailed and the other passed.\n\n* test(gemini): cover normalized exclusions and padded allowlist entries\n\nThe regression case added with the fix drove the allowlist intersection in\nboth spellings but left the other two comparisons the change touches\nuncovered: the exclusion membership test and the trimming applied to padded\nnames. Reverting either behaviour kept the suite green, so neither was\npinned. Greptile raised exactly this on the PR.\n\nAn exclusion is now exercised as \" REA \" against the selected server, and a\npadded allowlist entry is exercised as the only policy, so a padded entry has\nto permit the same server its exact spelling permits rather than fall to the\nmembership test.\n\nVerified with `npm run test:focused -- tests/boundary/cli/clientProfiles.test.ts`:\n14 passed with the change; reverting only ClientConfigurationDocument.ts to\nmain fails both cases, the arrangement case with `rea+REA: expected 1 to be +0`\nand the new one on both the excluded and the padded-allowlist assertions.\n\n* fix(process): report no remaining time after a provider deadline fires\n\nNode timers can fire while performance.now() is still a fraction of a\nmillisecond short of the monotonic deadline. ProviderStartupDeadline then\nreported interruption \"timeout\" and an aborted signal while remainingMs()\nreturned ceil(0.x) = 1, so polling loops guarded by remainingMs() > 0\n(Hopper and Ghidra startup) could run past an elapsed deadline, and the\nreal-timer test \"aborts a bounded wait when its real monotonic deadline\nexpires\" failed intermittently in CI (expected 1 to be 0).\n\nOnce the deadline's own timer has classified a timeout, report zero\nremaining time. A deterministic regression test fires the timer with the\nmonotonic clock 0.4 ms short of the deadline.\n\nCo-Authored-By: Claude Opus 5.5 \n\n---------\n\nCo-authored-by: 吴佳浩 \nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>\nCo-authored-by: Claude Opus 5.5 ", "parents": ["1f122c02b71dae7f4109f35ed834f82b96fbf247"], "authors": [ { "name": "吴佳浩Alben", "email": "35291372+XiaoBinGan@users.noreply.github.com", "user": { "login": "XiaoBinGan", "__typename": "User" } }, { "name": "吴佳浩", "email": "wujiahao@supremind.com", "user": null }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [2495] }, { "sha": "80592b82a6f854886862978533bb405e3f2e38c5", "subject": "fix(javascript): keep CommonJS percent bytes literal (#3001)", "body": "fix(javascript): keep CommonJS percent bytes literal (#3001)\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["b9b3a9098b072313119eccb3ae574faa57c3e517"], "authors": [ { "name": "Shivek", "email": "152221558+ShivekRanjan@users.noreply.github.com", "user": { "login": "ShivekRanjan", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [3001] }, { "sha": "b1b0211c284f06e67d697dd8e016925f833eca6c", "subject": "fix(native): preserve observed function dossier coverage", "body": "fix(native): preserve observed function dossier coverage\n\nDeclare observed Ghidra and Hopper facets, preserve unavailable pseudocode, and attach dossier call-set coverage. Version the analysis profiles to invalidate older snapshots and remove the retired include_assembly fixture branch.\n\nAdd MCP comparison and snapshot-replay regressions plus real-provider checks for empty and unavailable facets. Fixes #2980.\n", "parents": ["80592b82a6f854886862978533bb405e3f2e38c5"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "02987d8e8ce47f1e34b1e8a7b918a1f62f0560f1", "subject": "test(hopper): bind string assertions to observed source extents", "body": "test(hopper): bind string assertions to observed source extents\n\nRemove OS-based assumptions about long and non-ASCII string recognition. Require the dedicated fragmented fixture, independently verify full source bytes, and reject gaps, overlaps, incomplete reads and corrupted decoding. Report unrecognized native strings explicitly and retain the actual procedure count.\n\nVerified through 14 verifier regressions and the complete macOS arm64 Hopper 6.6.0-demo CLI/MCP lane with cleanup.\n", "parents": ["b1b0211c284f06e67d697dd8e016925f833eca6c"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "1ae90005874034b59741bf59809b75150b54a257", "subject": "fix(javascript): exclude TypeScript this annotations from runtime parameters (#2761)", "body": "fix(javascript): exclude TypeScript this annotations from runtime parameters (#2761)\n\n* fix(javascript): exclude TypeScript this annotations from runtime parameters\n\n* test(javascript): assert exact typed argument bindings\n\n* test(apple): keep dyld slice regression portable\n\n* fix(process): report no remaining time after a provider deadline fires\n\nNode timers can fire while performance.now() is still a fraction of a\nmillisecond short of the monotonic deadline. ProviderStartupDeadline then\nreported interruption \"timeout\" and an aborted signal while remainingMs()\nreturned ceil(0.x) = 1, so polling loops guarded by remainingMs() > 0\n(Hopper and Ghidra startup) could run past an elapsed deadline, and the\nreal-timer test \"aborts a bounded wait when its real monotonic deadline\nexpires\" failed intermittently in CI (expected 1 to be 0).\n\nOnce the deadline's own timer has classified a timeout, report zero\nremaining time. A deterministic regression test fires the timer with the\nmonotonic clock 0.4 ms short of the deadline.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(ci): restore descriptor and fixture validation\n\n* test(ci): retain verification coverage within lint limits\n\n* fix(test): share admitted Ghidra profile installation fixtures\n\n* fix(ci): isolate timing report fixtures from workflow state\n\n---------\n\nCo-authored-by: hhang <169027046+xu91102@users.noreply.github.com>\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>\nCo-authored-by: Claude Opus 5.5 \nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["02987d8e8ce47f1e34b1e8a7b918a1f62f0560f1"], "authors": [ { "name": "hhang", "email": "17309584214@163.com", "user": { "login": "xu91102", "__typename": "User" } }, { "name": "hhang", "email": "169027046+xu91102@users.noreply.github.com", "user": { "login": "xu91102", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2761] }, { "sha": "641a8395ee6e7f9fbf268765bb3e2ff3c2604dd2", "subject": "fix(cli): refuse a JavaScript integrity policy the binary analyze lane cannot honor (#2808)", "body": "fix(cli): refuse a JavaScript integrity policy the binary analyze lane cannot honor (#2808)\n\n* fix(cli): refuse an integrity policy the binary analyze lane cannot honor\n\n`analyze` declares --integrity-policy for its JavaScript lane and forwards it\nonly there. On a binary target the flag was accepted and then dropped:\ninspect_artifact-style integrity handling does not exist on this path, and\nbinary_overview is a strictObject with no input at all, so the request could\nnever take effect and the run proceeded as if the caller had not asked.\n\nThe same branch already refuses source_paths on a binary target with a typed\nAnalysisInputError, and the sibling `inspect` command refuses the flag outright,\nso the refusal is the established handling here. The policy option carries a\ndefault, so the check keys off a value that differs from the owner schema's own\ndefault rather than the flag's presence; otherwise every binary analyze would be\nrefused. The default is read from the schema instead of being restated.\n\nVerified with 5 integrity policy CLI cases, check:fast and\nverify:test-discovery (1023 files) on macOS arm64, and by running the built CLI\nfor the no-flag, explicit-default and record-and-continue cases. The regression\ncase failed with the command reaching the binary lane before the change.\n\n* fix(cli): reject explicit default integrity policies for binaries\n\n* fix(cli): keep an omitted integrity policy absent on the binary lane\n\n`javascriptApplicationOptions.shape.integrityPolicy` fills an omission with its\ndefault, and `.optional()` keeps reporting that parsed value, so\n`options.integrityPolicy !== undefined` was true for every `analyze `\ncall: ordinary binary analysis was rejected before the target was even read.\n\nList `z.undefined()` first in a union so an omitted option stays absent while\nthe owner still validates a supplied value, and reapply the owner's metadata so\nhelp and `--schema` keep describing the option.\n\nValidation: tests/boundary/cli/javascriptIntegrityPolicyCli.test.ts reports\n1 failed | 5 passed without this change (the case \"still routes a binary\nanalyze target without an integrity policy\" returned invalid_request for\nintegrity_policy instead of reaching the target) and 6 passed with it;\n`npm run check:fast` passes on macOS 26.5.1 arm64 with Node.js 24.18.0.\n\n* fix(cli): omit integrity defaults from binary option schema\n\n* test(ci): isolate report fixtures and declare PowerPC Java bounds\n\n---------\n\nCo-authored-by: 吴佳浩 \nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["1ae90005874034b59741bf59809b75150b54a257"], "authors": [ { "name": "吴佳浩Alben", "email": "35291372+XiaoBinGan@users.noreply.github.com", "user": { "login": "XiaoBinGan", "__typename": "User" } }, { "name": "吴佳浩", "email": "wujiahao@supremind.com", "user": null }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2808] }, { "sha": "97aff282018907e7e48dc67fc12043e1237e2c99", "subject": "fix(electron): reject non-executable paths and contain launch rejections (#2705)", "body": "fix(electron): reject non-executable paths and contain launch rejections (#2705)\n\n* fix(electron): reject non-executable paths and contain launch rejections\n\nAn executable_path that runs but never prints the inspector line made\nPlaywright's electron.launch() leave three waits unawaited. They rejected\nunhandled and Node ended the CLI or the MCP server (#2269).\n\nCheck the resolved executable_path is a regular file, and on non-Windows\nhosts that it passes X_OK, before any launch. Wrap only the launch call\nin a scoped unhandledRejection listener that absorbs rejections whose\nstack is in playwright-core/lib and re-throws anything else.\n\nTested on Linux with Node 22.23.1, 24.18.0 and 26.11.1.\n\nRefs #2269\n\n🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊\n\n* fix(electron): absorb only this launch's orphaned rejections\n\nThe listener around the launch dropped every rejection with a\nplaywright-core stack, so an unrelated Playwright failure during the\nlaunch window would vanish. Hold those rejections instead. When the\nlaunch settles, drop only the ones whose message is part of the launch's\nown error (the orphans of a failed launch). Raise every other one again\nthrough the unhandledRejection path, so the process still fails. A launch\nthat succeeds raises all of them. Rejections without a Playwright stack\nstill fail at once.\n\nOne setImmediate turn before the decision lets rejections queued by the\nsettling tick arrive first. It is a single turn, not a timer. A shared\nset of absorbed errors stops overlapping launches from raising each\nother's orphans. The listener is removed on every path.\n\nAdd child-process tests that drive the built provider through its launch\nseam, since Vitest's worker has its own unhandledRejection listener.\n\n🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊\n\n* test(electron): distinguish launch success from capture ownership\n\n* test(electron): assert cleanup ownership failures around overlapping launches\n\n* fix(comparison): recheck historical calls-only changes (#2223)\n\n* fix(comparison): preserve incomplete function call evidence\n\nKeep missing, unknown, partial and unresolved call relationships unknown in function comparisons and reconstruction claims. Aggregate IDA caller and callee coverage without overwriting uncertainty.\n\nValidate with 144 focused tests, typecheck/lint, docs checks and test discovery. Real providers were not verified; the full headless IDA session suite requires unavailable Windows native controls.\n\n* fix(comparison): recheck historical calls-only changes\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>\n\n* fix(android): make DEX descriptor pattern portable\n\n* fix(ci): isolate Linux Hopper process fixture inventory\n\n* fix(browser): avoid replaying observed launch rejections\n\n* style: format comparison and IDA sources\n\n* test(electron): allow cold macOS ownership setup\n\n* test(electron): allow cold macOS setup in the early-exit path test\n\nThe test that runs an executable which exits at once builds the Swift\nownership helper twice on macOS: in the CLI process, and again in the\nMCP server process on its first tool call that prepares. A cold Swift\ncache can spend up to 120 seconds on a build. The test had only the\n30 second default.\n\nGive the test 180 seconds, as e1579ec31 did for\nelectronLaunchRejections.test.ts and 65a809a0d did for\nwebSourceLocationCli.test.ts. cli.run has no deadline of its own, so\nit needs no timeoutMs.\n\n🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊\n\n* test(ci): isolate report fixtures and declare PowerPC Java bounds\n\n---------\n\nCo-authored-by: Claude Opus 5.5 \nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>\nCo-authored-by: Lucien <164857476+dakjdakd@users.noreply.github.com>", "parents": ["641a8395ee6e7f9fbf268765bb3e2ff3c2604dd2"], "authors": [ { "name": "Cassie_Fox", "email": "249835913+CassieFox23@users.noreply.github.com", "user": { "login": "CassieFox23", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "opus@fox.invalid", "user": null }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "Lucien", "email": "164857476+dakjdakd@users.noreply.github.com", "user": { "login": "dakjdakd", "__typename": "User" } } ], "pullRequests": [2705] }, { "sha": "20e4f83097511090205c9f867c62bca0152e6676", "subject": "fix(ghidra): fail doctor when the JVM os.arch selects an unvalidated decompiler directory (#2792)", "body": "fix(ghidra): fail doctor when the JVM os.arch selects an unvalidated decompiler directory (#2792)\n\n* fix(ghidra): fail doctor when the JVM os.arch selects an unvalidated decompiler directory\n\nprobeJava now also reads the JVM os.arch property. When it maps to a\ndifferent native decompiler directory than the one validated from the\nhost architecture (for example an x86_64 JDK under Rosetta on Apple\nsilicon selecting os/mac_x86_64 while only mac_arm_64 was built), the\nnative_decompiler check fails with a remediation pointing at a\nmatching-arch JDK instead of reporting a healthy installation that\nfails every analysis. Unknown os.arch values keep the previous\nbehavior.\n\n* fix(ghidra): tighten JVM arch remediation and cover os.arch extraction\n\nAddress review findings on the JVM os.arch decompiler-directory check:\n- The remediation no longer suggests building the decompiler for the\n JVM-selected directory, which could never clear the check; it only\n advises pointing JAVA_HOME at a matching-architecture JDK.\n- Add a test running the real Java probe against captured\n -XshowSettings:properties output, asserting os.arch reaches the\n installation diagnostics.\n- Document the JDK-architecture prerequisite in the Ghidra setup guide.\n\n* fix(ghidra): refuse unrecognized JVM native architectures\n\n* docs(ghidra): align doctor prerequisites with JVM architecture admission\n\n* fix(ghidra): reject unreported JVM architecture\n\n* test(ghidra): separate JVM and executable admission cases\n\n* fix(ghidra): defer decompiler arch validation when Java is absent\n\n* fix(ghidra): reject JVM native architecture override\n\n* fix(ghidra): validate JVM platform overrides\n\n* fix(ghidra): validate JVM os.name and helper-environment platform overrides\n\n* test(ci): isolate report fixtures and declare PowerPC Java bounds\n\n* test(ghidra): provide observed JVM platform in PowerPC fixture\n\n* fix(ghidra): parse quoted JVM environment options before admission\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["97aff282018907e7e48dc67fc12043e1237e2c99"], "authors": [ { "name": "Saim Shafique", "email": "msaimshafique4664@gmail.com", "user": { "login": "sx4im", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2792] }, { "sha": "599a8ee11de6b1a7fb270e669b88d78b6be982d2", "subject": "fix(process): preserve cleanup ownership and normalize captures once", "body": "fix(process): preserve cleanup ownership and normalize captures once\n\nRetain unresolved process identity and launch evidence through retryable cleanup. Share capture path normalization and preserve failed filesystem observations. Bound child output and drain Windows pipes without one-chunk throttling.\n\nReviewed fixes include #1628, #2632, #2644, #2784, #2928, #2931, #2965, #2992, and #3011.\n\nValidation: 92 focused source tests passed; four platform-specific skips. Real Windows and Hopper lifecycle coverage was not rerun.\n", "parents": ["20e4f83097511090205c9f867c62bca0152e6676"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "ec56c1da04c6c25825721a45e596e8cc237a6dd3", "subject": "fix(setup): preserve registration identity and recovery ownership", "body": "fix(setup): preserve registration identity and recovery ownership\n\nKeep layered environment choices, current byte-exact recovery snapshots, and package-manager failure details. Report pinned package drift without claiming runner resolution. Retain failed Linux installer cleanup for host-owned retry while preserving the install outcome.\n\nReviewed fixes include #2632, #2769, #2783, #2959, #2979, #2983, #2995, #3009, and #2559.\n\nValidation: 98 focused setup/registration tests passed; 45 Linux installer tests passed. Real Linux package installation remains unverified.\n", "parents": ["599a8ee11de6b1a7fb270e669b88d78b6be982d2"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "d4bd65c53c0254d0195cc7ab8da163dcadfd3b9b", "subject": "fix(providers)!: preserve readiness, coverage, and diagnostic ownership", "body": "fix(providers)!: preserve readiness, coverage, and diagnostic ownership\n\nShare tagged readiness observations, retain partial provider facts, authenticate bridge identity, bound diagnostics, and preserve cancellation and lost-session reasons. Fail closed for unparsed MIPS ABI attributes and macOS saved Hopper databases without a script-capable bridge route.\n\nReviewed fixes: #2010, #2108, #2513, #2695, #2731, #2771, #2828, #2867, #2868, #2870, #2880, #2919, #2945, #2961, #2981, #2998, #3000, #3002.\n\nValidation: 285 focused source/boundary tests passed. Real Ghidra, IDA, Linux Hopper, and Windows provider runs were not repeated.\n\nBREAKING CHANGE: MIPS targets with unresolved GNU ABI attributes and saved Hopper databases on macOS are refused rather than advertised as supported.\n", "parents": ["ec56c1da04c6c25825721a45e596e8cc237a6dd3"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "55dd21a5e2172187dfe7167df684f85ecb536f5e", "subject": "fix(native): retain partial format facts and explicit coverage", "body": "fix(native): retain partial format facts and explicit coverage\n\nPreserve XML and Interface Builder identity at their parsing boundary, retain usable Objective-C slots with precise coverage, and keep native trace failures distinct from absence. Add caller-selected Interface Builder summaries backed by complete retained Evidence, and preserve comparison limitations.\n\nReviewed fixes: #1969, #2088, #2108, #2513, #2639, #2684, #2731, #2759, #2875, #2888, #2889, #2970, #2971, #3002.\n\nValidation: relevant native/domain focused lane passed 142 tests; earlier Interface Builder/MCP checks passed 24 tests. Real native UI and Ghidra producer coverage was not repeated.\n", "parents": ["d4bd65c53c0254d0195cc7ab8da163dcadfd3b9b"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "ec271121e4996f89f666a5a2ed1cd2f3229411b4", "subject": "fix(artifacts): preserve path identity and exclusion applicability", "body": "fix(artifacts): preserve path identity and exclusion applicability\n\nNormalize path facts once at the owning filesystem boundary, preserve caller spelling and unavailable inventory members, and retain typed read failures. Record exclusion entry kinds so only proven directories can establish descendant symlink targets; omitted legacy kinds stay unknown.\n\nReviewed fixes include #1969, #2642, #2759, and #2994.\n\nValidation: 26 reference graph source tests passed; prior artifact checks passed 275 tests with one Windows-only skip. Updated compiled import workflows are included in final validation after regeneration.\n", "parents": ["55dd21a5e2172187dfe7167df684f85ecb536f5e"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "f6905719c3c80d829037e509d6e46129b131d893", "subject": "fix(browser): bound capture work and preserve observation gaps", "body": "fix(browser): bound capture work and preserve observation gaps\n\nOwn service-worker CDP registrations and retry failed teardown. Admit redaction and network metadata against remaining capture capacity, retain explicit omission reasons, and preserve source URL, redirect ancestry, caller-selected content, and historical capture values. Forward CLI cancellation through provider cleanup.\n\nReviewed fixes: #2263, #2637, #2767, #2845, #2859, #2863, #2872, #2874, #2876, #2879, #2955, #2957, #2961, #3033.\n\nValidation: 25 current event/network source tests passed; earlier focused browser lanes passed 201 source tests and 176 boundary tests with two skips, plus 35 Python tests. Real browser/Windows lanes were not rerun. Playwright allocation before admission remains unbounded by these retention limits.\n", "parents": ["ec271121e4996f89f666a5a2ed1cd2f3229411b4"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "80de3145e458474319f160d2d2c09586e7a282a4", "subject": "fix(mcp): align advertised contracts and retain workflow evidence", "body": "fix(mcp): align advertised contracts and retain workflow evidence\n\nUse one named input-schema projection for clients and catalog identity, preserve dialect declarations, and bound compact schema depth. Keep canonical SDK output validation when output advertisements are disabled. Release request-owned state on cancellation and carry upstream limitations through composed workflows. Preserve doctor full-output envelopes and validate navigation facts at their owner.\n\nReviewed fixes: #2088, #2108, #2513, #2684, #2693, #2695, #2836, #2864, #2868, #2877, #2933, #2998, #3002, #3015.\n\nValidation: focused schema, SDK output-validation, context, and workflow tests passed; no schema dialect or canonical output validation was relaxed.\n", "parents": ["f6905719c3c80d829037e509d6e46129b131d893"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "5b7fe947108dcc0cc4a7e98f0c6d62080b5e7f8d", "subject": "fix(analysis): preserve extraction gaps and database failure reasons", "body": "fix(analysis): preserve extraction gaps and database failure reasons\n\nDerive firmware completeness from examined coverage, retain linked continuation evidence, and preserve reported extraction limits. Keep Android package attribution and Go image fixtures coherent, and classify SQLite busy failures without discarding descriptor cleanup facts.\n\nReviewed fixes include firmware, ADB, SQLite, and recorded-transport bug reports and their focused PRs.\n\nValidation: firmware report source tests passed 21 cases; prior focused artifact/provider boundaries passed. Real Android devices and external firmware tools were not rerun.\n", "parents": ["80de3145e458474319f160d2d2c09586e7a282a4"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "242e2b0001095524382183b771aa444310900942", "subject": "fix(ghidra): preserve function facet and call coverage (#3002)", "body": "fix(ghidra): preserve function facet and call coverage (#3002)\n\n* fix(ghidra): preserve observed function facet and call coverage\n\nDeclare successful query availability in the Java producer, including explicit unavailable pseudocode reasons. Carry observed static call-set coverage through the parsed provider result and Evidence without inventing facts for legacy omissions. Use Ghidra indexed comment addresses over the function body and entry, retaining cancellation checks and sparse collection.\n\nCloses #2951\n\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>\n\n* fix(ghidra): retain unresolved call coverage in observations\n\nShare decoded unresolved-call facts between dossiers, callee coverage and reference observations. Combine terminal and unresolved observations in one instruction traversal and retain site records only when requested. Keep missing procedure identities incomplete and validate unresolved locations at the provider boundary.\n\nBind snapshots to the corrected call coverage profile so older complete claims cannot replay under the new semantics. Add real public MCP callback trace/comparison regressions.\n\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>\n\n* fix(ghidra): separate reference targets from callee coverage\n\nReuse containing-function ownership for resolved reference identities and independently compare those identities with the actual returned callee set. Keep known interior routes out of unresolved site records while retaining partial inventory coverage.\n\nAdvance the coverage profile to v3 and reject interim v2 cache bindings. Add a real Ghidra producer regression with restored reference metadata; the previous bridge fails the known-route assertion.\n\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>\n\n* fix(ghidra): measure incoming call coverage across function bodies\n\nCompare incoming reference source identities across the owned function body and entry with the actual returned caller set. Stream caller-only checks and reuse dossier reference observations. Combine caller/callee coverage from observed counts without reinterpreting serialized metadata, and share the body scope owner with comments and references.\n\nBind snapshots to function-body coverage semantics v4 and preserve the real off-entry caller regression.\n\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>\n\n* fix(ghidra): preserve whole-scope directional call coverage\n\nCheck body-and-entry call references independently of decoded instruction flow. Reuse collected dossier references and stream inventory-only coverage checks. Keep caller-only gaps distinct from incomplete outgoing coverage in offline path reconstruction, and invalidate prior snapshot profiles.\n\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>\n\n* fix(mcp): retain compact Evidence field types\n\nShare optional diagnostics across the three tagged relationship coverage states instead of advertising duplicate branches. Preserve coverage validation while keeping compact Evidence properties within the existing reference expansion budget. Verify invalid direction cardinalities against the actual SDK-advertised schema.\n\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>\n\n---------\n\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["20e4f83097511090205c9f867c62bca0152e6676"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [3002] }, { "sha": "bbf0638e884d29cac21cb1f51fa0d41dce36d3a1", "subject": "fix(javascript): report EventSource and sendBeacon URLs as network endpoints (#3044)", "body": "fix(javascript): report EventSource and sendBeacon URLs as network endpoints (#3044)\n\nCo-authored-by: xpeng5278-web <330743750+xpeng5278-web@users.noreply.github.com>", "parents": ["242e2b0001095524382183b771aa444310900942"], "authors": [ { "name": "xpeng5278-web", "email": "xpeng5278@gmail.com", "user": { "login": "xpeng5278-web", "__typename": "User" } }, { "name": "xpeng5278-web", "email": "330743750+xpeng5278-web@users.noreply.github.com", "user": { "login": "xpeng5278-web", "__typename": "User" } } ], "pullRequests": [3044] }, { "sha": "e049ef70f71aeb9965e9d75d4d4a84ea02eaee11", "subject": "feat(setup): add WorkBuddy client support (#3041)", "body": "feat(setup): add WorkBuddy client support (#3041)\n\n* feat(setup): add WorkBuddy client support\n\nRegister rea in the global ~/.workbuddy/mcp.json through a new workbuddy\nentry in SUPPORTED_CLIENT_DEFINITIONS (json dialect, ~/.workbuddy marker,\n~/.workbuddy/skills skill directory; WorkBuddy AI shares the file).\nDocument the client, extend the unreleased-client note, and cover\nregistration and uninstall with boundary tests.\n\n* docs(setup): record verified WorkBuddy tool calls\n\nReal-client verification completed: WorkBuddy loads the registration and\nreal REA tool calls execute through the registered server.", "parents": ["bbf0638e884d29cac21cb1f51fa0d41dce36d3a1"], "authors": [ { "name": "Xiangfang Chen", "email": "565499699@qq.com", "user": { "login": "cainiao1992", "__typename": "User" } } ], "pullRequests": [3041] }, { "sha": "30128a03cff3289479f78df09b3aacf62382d4c2", "subject": "refactor(domain): centralize relationship coverage interpretation", "body": "refactor(domain): centralize relationship coverage interpretation\n", "parents": ["e049ef70f71aeb9965e9d75d4d4a84ea02eaee11"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "2dc89f81be807de88b7b19b5f4ffcc7bff171068", "subject": "docs(readme): sync Korean README with the English README (#3046)", "body": "docs(readme): sync Korean README with the English README (#3046)", "parents": ["30128a03cff3289479f78df09b3aacf62382d4c2"], "authors": [ { "name": "JANG BYUNGKUN", "email": "bkbkjang@gmail.com", "user": { "login": "8rulerstar", "__typename": "User" } } ], "pullRequests": [3046] }, { "sha": "d82ad1faf0b2774c56a10d8a81b09defacd99c7b", "subject": "test(android): preserve malformed DEX prototype rejection (#2917)", "body": "test(android): preserve malformed DEX prototype rejection (#2917)\n\nPreserve malformed DEX parameter/return rejection with tagged producer errors and exact issue paths.\n\nThe equivalent portable descriptor fix is already on main via #2910.\n\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>", "parents": ["2dc89f81be807de88b7b19b5f4ffcc7bff171068"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } } ], "pullRequests": [2917] }, { "sha": "a6c3d3a365fae5fd41455f1a6eaad041caddfa50", "subject": "docs(skill): route browser actions to scenario capture", "body": "docs(skill): route browser actions to scenario capture\n\nRoute user browser actions to passive observation and agent actions to declared scenarios. Clarify requested artifacts, step outcomes, connect navigation and cleanup, and the limits of listener and request-initiator evidence. Distinguish discarded raw headers from retained response metadata. Update the bundled skill to version 42 with matching package metadata.\n\nValidation on the synchronized revision: docs (5 tests), typecheck/lint, formatting, 61 focused tests, and real Linux Chromium launch/connect and passive CLI probes. Verified declared steps, requested artifacts, digests, external page preservation, temporary form reset and cleanup. Native Windows/macOS and separate follow-up tools were not rerun. Package install/update and CLI/MCP verification passed earlier on 738d02a, before this main sync.\n\nCo-authored-by: 0xRafie <155859586+0xRafie@users.noreply.github.com>\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>", "parents": ["d82ad1faf0b2774c56a10d8a81b09defacd99c7b"], "authors": [ { "name": "Danish Rafie Ekaputra", "email": "155859586+0xRafie@users.noreply.github.com", "user": { "login": "0xRafie", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "factory-droid[bot]", "email": "138933559+factory-droid[bot]@users.noreply.github.com", "user": { "login": "factory-droid[bot]", "__typename": "User" } } ], "pullRequests": [2286] }, { "sha": "679658b28748729c9b881497e680c811a708f5f3", "subject": "fix(reference): report entries beyond the path limit as I/O failures (#2716)", "body": "fix(reference): report entries beyond the path limit as I/O failures (#2716)\n\n* fix(reference): report entries beyond the path limit as I/O failures\n\nReference-source traversal joins each child onto the root path. A valid\ntree whose nested entries exceed the platform's absolute path limit\n(PATH_MAX 1024 on macOS) makes lstat fail with ENAMETOOLONG. The\nreader's filesystem error allow-list lacked that code, so\nfilesystemFailureDetail returned undefined and the native rejection\nescaped both readReferenceSource and importReferenceSource instead of\nbecoming the existing failed `io` entry.\n\nAdd ENAMETOOLONG to the allow-list, matching the JavaScript application\nreader's list. Readable siblings stay in the graph and the unreachable\nentry is recorded with its OS message.\n\nFixes #2652\n\nCo-Authored-By: Claude Opus 5.5 \n\n* test(reference): assert the imported graph keeps readable and failed entries\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(process): report no remaining time after a provider deadline fires\n\nNode timers can fire while performance.now() is still a fraction of a\nmillisecond short of the monotonic deadline. ProviderStartupDeadline then\nreported interruption \"timeout\" and an aborted signal while remainingMs()\nreturned ceil(0.x) = 1, so polling loops guarded by remainingMs() > 0\n(Hopper and Ghidra startup) could run past an elapsed deadline, and the\nreal-timer test \"aborts a bounded wait when its real monotonic deadline\nexpires\" failed intermittently in CI (expected 1 to be 0).\n\nOnce the deadline's own timer has classified a timeout, report zero\nremaining time. A deterministic regression test fires the timer with the\nmonotonic clock 0.4 ms short of the deadline.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(reference): preserve path limit entry uncertainty\n\n* fix(reference): preserve unknown entry failures and identity\n\n* fix(reference): type unknown-kind exclusions and keep them out of symlink counts\n\nThe metadata-failure path offers \"unknown\" to exclusion predicates, but\nthe predicate type only admitted concrete kinds, which broke the build.\nDirectory-only secret and ignore rules now also match an unknown-kind\nentry (it may be a directory), and the summary counts unknown entries\nseparately instead of as symlinks.\n\nCo-Authored-By: Claude Opus 5.5 \n\n---------\n\nCo-authored-by: Claude Opus 5.5 \nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>\nCo-authored-by: Codex ", "parents": ["a6c3d3a365fae5fd41455f1a6eaad041caddfa50"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "Codex", "email": "codex@users.noreply.github.com", "user": { "login": "codex", "__typename": "User" } } ], "pullRequests": [2716] }, { "sha": "ff56f785946c609b09c1c60232b28d7c34ac89a9", "subject": "fix(uninstall): remove the REA-owned ZCode fallback registration (#2783)", "body": "fix(uninstall): remove the REA-owned ZCode fallback registration (#2783)\n\n* fix(uninstall): remove the REA-owned ZCode fallback registration\n\nZCode loads the user-scope `~/.agents/mcp.json` `mcpServers` fallback\nwhenever its native `mcp.servers` table is empty. Uninstall removed REA\nonly from the native table, so a REA-owned fallback entry became eligible\nto load again once the last native server was gone, while uninstall\nreported ZCode as removed and complete.\n\nAlso visit the ZCode fallback as a standard `mcpServers` JSON\nconfiguration in the uninstall host. It goes through the same\nownership check, `.rea.backup`, readback and restore path as every other\nclient configuration, so other fallback servers and settings, and a\nforeign `rea` entry, are preserved. Its result merges into the ZCode item.\n\nFixes #2664\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(uninstall): preserve the strict ZCode fallback dialect\n\nAddress review findings at their producing boundaries and preserve directly affected consumers. Source inspection and git diff --check completed. Tests and automated checks were not run at the user’s explicit request.\n\n* fix(comparison): recheck historical calls-only changes (#2223)\n\n* fix(comparison): preserve incomplete function call evidence\n\nKeep missing, unknown, partial and unresolved call relationships unknown in function comparisons and reconstruction claims. Aggregate IDA caller and callee coverage without overwriting uncertainty.\n\nValidate with 144 focused tests, typecheck/lint, docs checks and test discovery. Real providers were not verified; the full headless IDA session suite requires unavailable Windows native controls.\n\n* fix(comparison): recheck historical calls-only changes\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>\n\n* fix(ci): isolate Linux Hopper process fixture inventory\n\n* fix(android): make DEX descriptor pattern portable\n\n* fix: repair the static-check failures on the default branch (#2895)\n\n* fix: repair the static-check failures on the default branch\n\nThe default branch fails its own required `Static checks` job three ways, so\nevery pull request reports that job as failed regardless of its own change.\n\n- `npm run format:check` reports `src/domain/functionComparison.test.ts` and\n `src/ida/IdaOperationRunner.ts`.\n- `npm run lint` reports a duplicate `import { join } from \"node:path\"` in\n `tests/boundary/mcp/ghidraInventoryMcp.test.ts` (lines 4 and 17).\n- `npm run typecheck` reports `format: \"devin\"` missing from the client format\n union in `src/application/SupportedClients.ts`, and an unchecked index in\n `tests/boundary/cli/clientProfileLifecycle.test.ts`, whose pair array is\n inferred as `string[][]`.\n\nApply the pinned formatter, drop the duplicate import, list the `\"devin\"` format\nthat its own definition already uses, and mark the pair array `as const`.\n\nValidation: `npm run check:fast` and `npm run format:check` pass.\n\n* fix(setup): keep Devin on the JSON configuration dialect\n\n---------\n\nCo-authored-by: 吴佳浩 \nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>\n\n---------\n\nCo-authored-by: Claude Opus 5.5 \nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>\nCo-authored-by: Lucien <164857476+dakjdakd@users.noreply.github.com>\nCo-authored-by: 吴佳浩Alben <35291372+XiaoBinGan@users.noreply.github.com>\nCo-authored-by: 吴佳浩 ", "parents": ["679658b28748729c9b881497e680c811a708f5f3"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "Lucien", "email": "164857476+dakjdakd@users.noreply.github.com", "user": { "login": "dakjdakd", "__typename": "User" } }, { "name": "吴佳浩Alben", "email": "35291372+XiaoBinGan@users.noreply.github.com", "user": { "login": "XiaoBinGan", "__typename": "User" } }, { "name": "吴佳浩", "email": "wujiahao@supremind.com", "user": null } ], "pullRequests": [2783] }, { "sha": "3ea5fdd7cf760fc6b1aaf09fefb9350e79f2c87e", "subject": "chore: reconcile current main fixes and client support", "body": "chore: reconcile current main fixes and client support\n", "parents": [ "5b7fe947108dcc0cc4a7e98f0c6d62080b5e7f8d", "ff56f785946c609b09c1c60232b28d7c34ac89a9" ], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "0f4c484be552a4d5e8e1d0fa072441bfa900c815", "subject": "fix(reference): preserve missing symlink target facts", "body": "fix(reference): preserve missing symlink target facts\n\nTreat ENOTDIR while resolving a symlink target as missing target evidence, preserving its spelling and partial inventory. Keep graph-level excluded-ancestor rejection separate from import success. The compiled boundary regression passes.\n", "parents": ["3ea5fdd7cf760fc6b1aaf09fefb9350e79f2c87e"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "04672f2b917d7ae3d71424a6abbcc2da0f24fa0b", "subject": "fix(javascript): preserve builtin identity and share alias traversal", "body": "fix(javascript): preserve builtin identity and share alias traversal\n\nTrack module writes and escapes at their owner, preserve capture and reassignment ordering, and share CommonJS/default namespace identity without erasing parent-slot changes. Carry write sites into ambient alias resolution and use parsed write targets across consumers. Deduplicate returned-reference work with cycle context; retain unchanged temporal selection identity so provenance memoization stays effective.\n\nReviewed fixes include #2041, #2465, #2830, #2881, and #2948. Remove superseded mutation representations and the ineffective per-markValue dedup layer.\n\nValidation: 380 focused JavaScript tests passed under a 384 MiB heap cap, including the previously aborting 30-level/128-call alias regression. Six public CLI/MCP builtin tests passed. Exact pdf.js completed-workflow performance remains unmeasured.\n", "parents": ["0f4c484be552a4d5e8e1d0fa072441bfa900c815"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "b58adafa4fa16d578132810f677eabc6d9ffdc09", "subject": "fix(javascript): align module lookup and source evidence", "body": "fix(javascript): align module lookup and source evidence\n\nPreserve CommonJS literal paths and confined ESM URL semantics, including package main fallback, directory intent, Unicode identity, and present opaque modules. Parse extraction inputs at their AST/source owner, retain skipped HTML and source-map coverage, and distinguish endpoint candidates from proven receiver facts. Version structural fingerprints with computed literal contents and propagate them through worker contracts.\n\nReviewed fixes include #1810, #1840, #2642, #2700, #2702, #2714, #2803, #2960, #2968, #2986, #3035, and #3036.\n\nValidation: 158 resolver tests passed; public CLI/MCP module lookup controls, package-main/Unicode workflows, and six builtin workflows passed in the current compiled lane. Worker schema/fingerprint regressions passed. Large public pdf.js completion and real Electron analysis remain unverified.\n", "parents": ["04672f2b917d7ae3d71424a6abbcc2da0f24fa0b"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "a769915f6e49c783596c361150d1d665f6d2375e", "subject": "refactor(javascript): reuse canonical AST traversal", "body": "refactor(javascript): reuse canonical AST traversal\n\nRemove the separate Vite walker and raw visitor-key require scan. Keep subtree selection at the shared traversal owner. All 103 focused builtin/Vite tests and the complete static and architecture checks pass.\n", "parents": ["b58adafa4fa16d578132810f677eabc6d9ffdc09"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "537467ab9ecad4db8f984c792cd165d01a10054d", "subject": "fix(test-fixtures): keep managed metadata and method bodies disjoint", "body": "fix(test-fixtures): keep managed metadata and method bodies disjoint\n\nLay out resources, ReadyToRun data and IL bodies from their actual extents. Preserve RVA zero for bodyless methods and verify adjacent bodies through the production inspector.\n", "parents": ["a769915f6e49c783596c361150d1d665f6d2375e"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "a688c797848dc6b1e7500666f32eebced8d2ab2a", "subject": "docs(ida): describe catalog-based lifecycle compatibility", "body": "docs(ida): describe catalog-based lifecycle compatibility\n", "parents": ["537467ab9ecad4db8f984c792cd165d01a10054d"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "1b14870ace1bd9b93ece3dc73654e958b054bf33", "subject": "refactor(evidence): remove superseded ordering wrapper and document exclusions", "body": "refactor(evidence): remove superseded ordering wrapper and document exclusions\n", "parents": ["a688c797848dc6b1e7500666f32eebced8d2ab2a"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "4d4631ac94431bb8aae2fe3edcf1e8227048848d", "subject": "test: harden verification fixtures and runtime coverage", "body": "test: harden verification fixtures and runtime coverage\n\nUse exact discovered test identities, production MCP sessions and byte-exact setup backups. Add CLI signal cleanup coverage and independent Ghidra, Go and firmware verification assertions; prune redundant test configuration and preserve platform limits.\n", "parents": ["1b14870ace1bd9b93ece3dc73654e958b054bf33"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "6a7f70fd5422489e724de54d1fd6052416b9732d", "subject": "test(windows): verify retained inspection ownership after rename (#2902)", "body": "test(windows): verify retained inspection ownership after rename (#2902)\n\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>", "parents": ["ff56f785946c609b09c1c60232b28d7c34ac89a9"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } } ], "pullRequests": [2902] }, { "sha": "41a2e846470bd2af40dd298d975b1a1d2fef5786", "subject": "docs(installation): limit REA to one project or agent profile", "body": "docs(installation): limit REA to one project or agent profile\n\nDocument existing Claude Code profile and per-project installation workflows, including scoped maintenance, backups, caller metadata and Windows commands. Clarify authentication storage and the filesystem/network restrictions required for enforced separation.\n\nValidated 68 boundary tests, docs checks, formatting, typecheck/lint and two real REA setup dry-runs with zero applied actions or profile writes. Native Claude sessions, PowerShell execution and enforcement policies were not tested. Setup automation remains separate in #2187.\n\nCo-authored-by: William Blair <60581672+williamblair333@users.noreply.github.com>\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>", "parents": ["6a7f70fd5422489e724de54d1fd6052416b9732d"], "authors": [ { "name": "William Blair", "email": "60581672+williamblair333@users.noreply.github.com", "user": { "login": "williamblair333", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "factory-droid[bot]", "email": "138933559+factory-droid[bot]@users.noreply.github.com", "user": { "login": "factory-droid[bot]", "__typename": "User" } } ], "pullRequests": [2188] }, { "sha": "127c621328d69e28b2757625fbea7dad9286f983", "subject": "Merge remote-tracking branch 'origin/main'", "body": "Merge remote-tracking branch 'origin/main'\n", "parents": [ "4d4631ac94431bb8aae2fe3edcf1e8227048848d", "41a2e846470bd2af40dd298d975b1a1d2fef5786" ], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "86afc040e5c9f2e9fbf9604f234bf180d9ebe954", "subject": "fix(ghidra): discover installations from resolved PATH launchers", "body": "fix(ghidra): discover installations from resolved PATH launchers\n\nReuse installation inspection in doctor and provider readiness. Keep explicit configuration authoritative and validate discovered roots without executing launchers. Clarify the existing per-operation availability contract.\n", "parents": ["127c621328d69e28b2757625fbea7dad9286f983"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "fab33a66c6348942bb112f890daaee7614d2bb7b", "subject": "test(package): select the intended Hopper smoke-test provider", "body": "test(package): select the intended Hopper smoke-test provider\n\nKeep provider discovery independent from Hopper-specific packaged workflows. Installed Ghidra launchers on PATH must not turn the fixture into an ambiguous auto-selection request; target-free inventory and unknown-provider checks remain explicit.\n", "parents": ["86afc040e5c9f2e9fbf9604f234bf180d9ebe954"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "31b99306aa67e7840ae624d5a8e8a958ae600b4f", "subject": "fix(providers): retain composite cleanup failures and probe child liveness", "body": "fix(providers): retain composite cleanup failures and probe child liveness\n", "parents": ["fab33a66c6348942bb112f890daaee7614d2bb7b"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "b940ad0d65a4db6de1d8416d2d538c191c692708", "subject": "fix(sqlite): retain completed worker evidence and unresolved cleanup ownership", "body": "fix(sqlite): retain completed worker evidence and unresolved cleanup ownership\n", "parents": ["31b99306aa67e7840ae624d5a8e8a958ae600b4f"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "5fa7a52d1f4b28c0b842c5737b84fef6ef2a8eb4", "subject": "fix(frida): preserve script diagnostics and isolate capture truncation", "body": "fix(frida): preserve script diagnostics and isolate capture truncation\n", "parents": ["b940ad0d65a4db6de1d8416d2d538c191c692708"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "36db19c59c9e7bd36b00a468b589d1cb5c3d2d49", "subject": "fix(providers)!: preserve unknown segment extents and initialized IDA readiness", "body": "fix(providers)!: preserve unknown segment extents and initialized IDA readiness\n\nBREAKING CHANGE: binary_overview segment length is null when Hopper coordinates do not establish a finite same-address-space extent. Consumers must preserve this unknown instead of treating it as zero or a saturated value.\n", "parents": ["5fa7a52d1f4b28c0b842c5737b84fef6ef2a8eb4"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "9fe54c4073056587d4cdddd4ade06b993dc833d4", "subject": "fix(dotnet): honor bounded method row selections", "body": "fix(dotnet): honor bounded method row selections\n", "parents": ["36db19c59c9e7bd36b00a468b589d1cb5c3d2d49"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "896696b2e761e34c267977bb5c6982c607a622d0", "subject": "fix(javascript): preserve semantic uncertainty and lexical ownership", "body": "fix(javascript): preserve semantic uncertainty and lexical ownership\n", "parents": ["9fe54c4073056587d4cdddd4ade06b993dc833d4"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "6e344302cb1c7fa36570afe6ec5e1c9994fa9034", "subject": "fix(javascript): prove bundled CommonJS getter identity", "body": "fix(javascript): prove bundled CommonJS getter identity\n", "parents": ["896696b2e761e34c267977bb5c6982c607a622d0"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "88afcc738bff8ea2023b504e9ce2254d8bc8ba5a", "subject": "fix(javascript): retain endpoint candidates through graph projection", "body": "fix(javascript): retain endpoint candidates through graph projection\n", "parents": ["6e344302cb1c7fa36570afe6ec5e1c9994fa9034"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "29a2d13994708789fa3104437f1f2f93c6a34c36", "subject": "fix(captures): validate SAZ XML and classify expansion limits", "body": "fix(captures): validate SAZ XML and classify expansion limits\n", "parents": ["88afcc738bff8ea2023b504e9ce2254d8bc8ba5a"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "55778f20bacffe428e2cddcff81ffe01c0d477ae", "subject": "fix(inspector): retain usable targets and cancel owned capture waits", "body": "fix(inspector): retain usable targets and cancel owned capture waits\n", "parents": ["29a2d13994708789fa3104437f1f2f93c6a34c36"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "443c7aff77c862d19fca296149fce28091ab0592", "subject": "fix(evaluation): require explicit REA server attribution", "body": "fix(evaluation): require explicit REA server attribution\n", "parents": ["55778f20bacffe428e2cddcff81ffe01c0d477ae"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "eca18e08ac80ac838eef78788bf82429bbb30673", "subject": "fix(verifiers): require positive ownership and restore cleanup coverage", "body": "fix(verifiers): require positive ownership and restore cleanup coverage\n", "parents": ["443c7aff77c862d19fca296149fce28091ab0592"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "e572c38dcf6ae72176319baef000784ff7d15e2f", "subject": "docs: repair analysis guide links and document Linux process prerequisites", "body": "docs: repair analysis guide links and document Linux process prerequisites\n", "parents": ["eca18e08ac80ac838eef78788bf82429bbb30673"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "bffdd91053fb5d076b762cf1b325e8dcb5ab2d8c", "subject": "fix(browser): preserve malformed capture gaps and protocol session identity", "body": "fix(browser): preserve malformed capture gaps and protocol session identity\n", "parents": ["e572c38dcf6ae72176319baef000784ff7d15e2f"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "bcc141549a071c02ad2c3eeabd25fbf6207eb95b", "subject": "feat(electron): inspect packaged Electron fuse state without execution (#2399)", "body": "feat(electron): inspect packaged Electron fuse state without execution (#2399)\n\nAdd bounded, read-only inspection of packaged Electron fuse state for ELF, PE, and Mach-O applications through CLI and MCP workflows.\n\nPreserve artifact provenance and unknown values, resolve app bundles without execution, reject malformed or overlapping containers before scanning, and keep output compact for agent use.\n\nCo-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>\nCo-authored-by: N0zoM1z0 <161784452+N0zoM1z0@users.noreply.github.com>\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>", "parents": ["fab33a66c6348942bb112f890daaee7614d2bb7b"], "authors": [ { "name": "Matt Van Horn", "email": "mvanhorn@users.noreply.github.com", "user": { "login": "mvanhorn", "__typename": "User" } }, { "name": "Matt Van Horn", "email": "455140+mvanhorn@users.noreply.github.com", "user": { "login": "mvanhorn", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "N0zoM1z0", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } } ], "pullRequests": [2399] }, { "sha": "b11fe63bf4d9c4ea375b071599c374429f0b54e7", "subject": "docs(installation): document Linux procps prerequisite", "body": "docs(installation): document Linux procps prerequisite\n\nDocument the Linux procps-compatible ps prerequisite before quick start and in the installation/provider guides. Scope it to shared process-supervision workflows and give recovery guidance for generic provider startup errors.\n\nActual JavaScript CLI analysis passed with ps and refused an empty PATH with capability_unavailable and retained partial evidence. Real Chrome scenario launch succeeded without ps, confirming the need for qualified wording. Docs checks, formatting, typecheck/lint and diff checks passed. Five English documentation files; no runtime changes. Native Ghidra/JADX/firmware execution was not performed.\n\nFixes #2763\n\nCo-authored-by: Avocado <93173363+HeadmasterEggy@users.noreply.github.com>\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>", "parents": ["bcc141549a071c02ad2c3eeabd25fbf6207eb95b"], "authors": [ { "name": "Avocado", "email": "headmastereggy@gmail.com", "user": { "login": "HeadmasterEggy", "__typename": "User" } }, { "name": "Avocado", "email": "93173363+HeadmasterEggy@users.noreply.github.com", "user": { "login": "HeadmasterEggy", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "factory-droid[bot]", "email": "138933559+factory-droid[bot]@users.noreply.github.com", "user": { "login": "factory-droid[bot]", "__typename": "User" } } ], "pullRequests": [2779] }, { "sha": "b8513401e1344a7c0322b8906820db2f81b9be20", "subject": "docs: celebrate 200,000 GitHub stars 🎉 (#2897)", "body": "docs: celebrate 200,000 GitHub stars 🎉 (#2897)\n\nCelebrate the 200,000-star milestone across the English README and all 19 current translations, preserving locale-specific number formatting.\n\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>", "parents": ["b11fe63bf4d9c4ea375b071599c374429f0b54e7"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } } ], "pullRequests": [2897] }, { "sha": "c7105d9723c835b5e0122f5fc6cfbea86265c349", "subject": "test(perf): preserve negative small-PCAP workflow measurements (#2640)", "body": "test(perf): preserve negative small-PCAP workflow measurements (#2640)\n\nPreserve reproducible complete versus summary/page PCAP measurements on two official HTTP recordings and a fixed metadata/URI question. Summary/page uses more than twice the SDK JSON and about 51% more total model input in both real-model pairs, so existing complete defaults and production APIs/cache remain unchanged. These results apply to these captures and question; no general speedup is claimed. Refs #2016.\n\nAuthenticate experiment SDK envelopes with the pinned runtime's existing Evidence parser and check coverage, target/view/operation ownership and retained-parent identity. Separate factual and exact-workflow grading, retaining diagnostics and partial facts for malformed replies. Register six comparator CLI scenarios in the discovered Vitest evaluation project and remove the manual suite. The final change is limited to nine experiment files and one discovered evaluation test; production behavior is unchanged.\n\nValidation includes eight actual SDK workflows and four actual Codex CLI tasks, independent raw-frame and CLI/MCP checks, authentication of all 18 original receipts, 34 context/grading regressions and six comparator scenarios. All four stored model answers pass factual and workflow regrading without model reruns. Original measured runtime remains 3ae826ceba6f25b08bce50bcb51001209bc16b57; original measurements and private raw artifacts are unchanged. Serial local checks use one CPU with 3-GiB early-stop/4-GiB hard/no-swap limits. Unknown terminal counters remain explicitly unknown.\n\nIntegrate upstream shared fixture owners and Windows verification, removing both superseded local differences. All final experiment/comparator files remain byte-identical to the reviewed sources and the final PR scope is 10 files. Full bounded preflight passes in 73.953 seconds with ~2.23 GiB peak; payload cleanup is verified, zero phase OOM/limit events are observed, and terminal counters remain unknown. Current-head automatic CI 38492231165 passes all 35 selected jobs, including every compiled shard, source/static/build/docs, actual Windows/native/package and real application lanes, Portable reports/inventory, reverse-tools coverage/mutation and CI required. Greptile passes and all review threads are resolved. Actual CI checkout is 4eb2262359cb01f2fb1314db0bc18d3dc9092792, integrated with main 41a2e846470bd2af40dd298d975b1a1d2fef5786. Passing retries do not establish the root cause or a fix of the earlier main worker cleanup failure; its original evidence is preserved. No release.\n\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>", "parents": ["b8513401e1344a7c0322b8906820db2f81b9be20"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "factory-droid[bot]", "email": "138933559+factory-droid[bot]@users.noreply.github.com", "user": { "login": "factory-droid[bot]", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [2640] }, { "sha": "e84c58dabf9b424870954f046dd030b02dfb1a59", "subject": "chore: merge upstream main while preserving bug fixes", "body": "chore: merge upstream main while preserving bug fixes\n\n# Conflicts:\n#\tREADME.md\n", "parents": [ "bffdd91053fb5d076b762cf1b325e8dcb5ab2d8c", "c7105d9723c835b5e0122f5fc6cfbea86265c349" ], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "e8d22ec9eb6341a51ef9b09fc7b8e44a95fc3fd3", "subject": "fix(browser): carry unknown XML ancestry through metadata contracts", "body": "fix(browser): carry unknown XML ancestry through metadata contracts\n", "parents": ["e84c58dabf9b424870954f046dd030b02dfb1a59"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "278d7fb284124438eed1da3d248ea2a764dc67bf", "subject": "fix(analysis-view): reject accessor-backed inline evidence before parsing", "body": "fix(analysis-view): reject accessor-backed inline evidence before parsing\n", "parents": ["e8d22ec9eb6341a51ef9b09fc7b8e44a95fc3fd3"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "fd8a2e98ff431fe9d28257d97db502039778cf58", "subject": "fix(verifiers): own browser fixture setup and cleanup in one scope", "body": "fix(verifiers): own browser fixture setup and cleanup in one scope\n", "parents": ["278d7fb284124438eed1da3d248ea2a764dc67bf"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "70771523c5759a28f7250e96bfc5fb6646eefe90", "subject": "chore(licenses): preserve locked XML parser runtime notices", "body": "chore(licenses): preserve locked XML parser runtime notices\n", "parents": ["fd8a2e98ff431fe9d28257d97db502039778cf58"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "b3c5672ce67564e9b7c7baa6ce21f1674e27b287", "subject": "fix(setup): preserve validated caller-selected JEB registration settings", "body": "fix(setup): preserve validated caller-selected JEB registration settings\n", "parents": ["70771523c5759a28f7250e96bfc5fb6646eefe90"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "d901561640121272bf1498d85e38e1ac8b3f5793", "subject": "docs(hopper): clarify lease directory recovery guidance (#1628)", "body": "docs(hopper): clarify lease directory recovery guidance (#1628)\n\nClarify that path-specific Hopper lease recovery guidance applies when opening the lease directory fails with a permission error. Earlier creation failures retain their separate diagnostic.\n\nThe reviewed security implementation and owning regressions from this PR are already present on main through 599a8ee11, which explicitly records #1628 among its integrated fixes; this merge does not duplicate that code.\n\nCo-authored-by: Sunil <180283757+Sunil56224972@users.noreply.github.com>\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>\nCo-authored-by: N0zoM1z0 <161784452+N0zoM1z0@users.noreply.github.com>\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>", "parents": ["b3c5672ce67564e9b7c7baa6ce21f1674e27b287"], "authors": [ { "name": "Sunil", "email": "sunilnathyogi008@gmail.com", "user": { "login": "Sunil56224972", "__typename": "User" } }, { "name": "Sunil", "email": "180283757+Sunil56224972@users.noreply.github.com", "user": { "login": "Sunil56224972", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "N0zoM1z0", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } } ], "pullRequests": [1628] }, { "sha": "f3534749e564421036ac445f536fc766b038208f", "subject": "docs(process): clarify terminal progress message fields (#3086)", "body": "docs(process): clarify terminal progress message fields (#3086)\n\nClarify that final capture progress carries disposition and cleanup states as key=value text inside message, with an illustrative wire-format example.\n\nFixes #3052.\n\nCo-authored-by: 1052326311 <65798732+1052326311@users.noreply.github.com>\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>", "parents": ["d901561640121272bf1498d85e38e1ac8b3f5793"], "authors": [ { "name": "xin zhuang", "email": "65798732+1052326311@users.noreply.github.com", "user": { "login": "1052326311", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "factory-droid[bot]", "email": "138933559+factory-droid[bot]@users.noreply.github.com", "user": { "login": "factory-droid[bot]", "__typename": "User" } } ], "pullRequests": [3086] }, { "sha": "58300885207133422af235e0f2b10658cf958b03", "subject": "docs(release): review compatibility for the current candidate (#3112)", "body": "docs(release): review compatibility for the current candidate (#3112)\n\nReview breaking changes and migration notes for the release being prepared; retain the 6.1-to-6.2 guide as historical context.\n\nFixes #3058.\n\nCo-authored-by: Geekwolf <3125615+geekwolf@users.noreply.github.com>\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>", "parents": ["f3534749e564421036ac445f536fc766b038208f"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "Geekwolf", "email": "3125615+geekwolf@users.noreply.github.com", "user": { "login": "geekwolf", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "factory-droid[bot]", "email": "138933559+factory-droid[bot]@users.noreply.github.com", "user": { "login": "factory-droid[bot]", "__typename": "User" } } ], "pullRequests": [3112] }, { "sha": "7ad75bdc80d1d45dd9fb4c0b3153997cb392a710", "subject": "fix: restore JavaScript analysis and current regression checks (#3080)", "body": "fix: restore JavaScript analysis and current regression checks (#3080)\n\nRestore source-position-aware ambient aliases, scalar env/argv reads, candidate\nendpoint worker data, Chrome DOMSnapshot empty strings, and accumulated Ghidra\nLaunchSupport diagnostics. Align regression fixtures with declared current\ncontracts, while preserving identity, provenance, cancellation, and cleanup\nchecks. Assert workflow caveats independently at both established locations.\n\nValidation: original five source failures reproduced on main; 307 focused tests\npassed with one platform skip, 22 fixture follow-up tests and 22 workflow/MCP\ntests passed; full static and docs checks passed. Real public http-server CLI\nanalyses preserve identical artifact identity, statistics, and 581-token selected\noutput. Real Chromium confirms restored DOM form destinations; isolated real\nservice-worker verification passes on main and the change. The complete local\nbrowser run retained an unclassified later marker timeout; current-head CI\nprovides complete real-browser and recovery lane results. Native IDA/Ghidra\nexecution and complete local suite execution are not claimed.\n\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>\nCo-authored-by: N0zoM1z0 <161784452+N0zoM1z0@users.noreply.github.com>\nCo-authored-by: Claude Opus 5.5 ", "parents": ["58300885207133422af235e0f2b10658cf958b03"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "N0zoM1z0", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [3080] }, { "sha": "5b5de1b52788c83665e71e54db79472c6205df8b", "subject": "test(javascript): synchronize worker cleanup and validate candidate facts", "body": "test(javascript): synchronize worker cleanup and validate candidate facts\n", "parents": ["7ad75bdc80d1d45dd9fb4c0b3153997cb392a710"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "767fe0f0ccbab3ae4be28e71cc8214c7cd302133", "subject": "test(docs): isolate README facts from CLI catalog imports", "body": "test(docs): isolate README facts from CLI catalog imports\n", "parents": ["5b5de1b52788c83665e71e54db79472c6205df8b"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "77be0f6666df67de48ad737fe5b5d204aa34ae85", "subject": "fix(capture): end special-scheme URL authorities at a backslash (#2767)", "body": "fix(capture): end special-scheme URL authorities at a backslash (#2767)\n\n* fix(capture): end special-scheme URL authorities at a backslash\n\nThe native mitmproxy adapter removed transport userinfo with\n`^(...//)[^/?#]*@`, so the authority ran to the last \"@\" before \"/\", \"?\"\nor \"#\". For `https://example.test\\part@tail` it treated\n`example.test\\part` as userinfo, reported `https://tail` as the\nLocation, and withdrew the original bytes as a transport credential.\nWHATWG URL parsing, used by the shared TypeScript owner\n(recordedTransportUrl.ts) and by HAR captures, ends a special-scheme or\nscheme-relative authority at a backslash, so that \"@\" is ordinary path\ntext.\n\nLocate the authority with the same boundary rule before removing\nuserinfo. Bytes are handled as Latin-1 text so unrelated bytes stay\nidentical. Userinfo before the backslash is still removed and redacted.\nAdd source unit tests for the adapter projection to test:python.\n\nFixes #2671\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(capture): skip special-scheme leading slashes before userinfo\n\nEnding the authority at a backslash exposed a credential: for\n`https://\\user:pass@host/path`, WHATWG parsing skips every leading \"/\"\nor \"\\\" after a special scheme (and in scheme-relative references), so\n`user:pass` is userinfo, but the new boundary stopped at the first\nbackslash and found no \"@\". The same applied to `https:\\\\user:pass@host`\nand `https:user:pass@host`.\n\nStart the authority after that whole slash run for non-file special\nschemes and scheme-relative references. File URLs keep their \"//\"\nboundary because they carry no userinfo. Load the adapter in tests with\nfresh mitmproxy stand-ins scoped to its import instead of leaving them\nin sys.modules.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(capture): parse URL controls and mixed network authorities\n\n* fix(capture): distinguish native paths and URL base authorities\n\n* fix(capture): preserve file-relative path evidence after separators\n\n* fix(comparison): recheck historical calls-only changes (#2223)\n\n* fix(comparison): preserve incomplete function call evidence\n\nKeep missing, unknown, partial and unresolved call relationships unknown in function comparisons and reconstruction claims. Aggregate IDA caller and callee coverage without overwriting uncertainty.\n\nValidate with 144 focused tests, typecheck/lint, docs checks and test discovery. Real providers were not verified; the full headless IDA session suite requires unavailable Windows native controls.\n\n* fix(comparison): recheck historical calls-only changes\n\n---------\n\nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>\n\n* fix(android): make DEX descriptor pattern portable\n\n* fix(ci): isolate Linux Hopper process fixture inventory\n\n* fix(capture): remove empty URL userinfo markers\n\n* test(capture): cover empty URL userinfo markers\n\n* test(ci): isolate Hopper process inventory fixtures\n\n* fix(ci): declare process inventory callback\n\n* test(ci): isolate alternate launcher process fixture\n\n* fix(capture): keep URLs that WHATWG rejects instead of redacting userinfo\n\nFile URLs cannot carry userinfo (an \"@\" in a file host fails the parse),\nand a special authority whose host or port WHATWG rejects fails the whole\nURL. Neither has credentials, so the bridge now keeps their source text\nand byte sidecar. Checked against Node's URL over 30,000 spellings: no\nunder-redaction, over-redaction 20,540 -> 5,865 (remaining: empty\nuserinfo, IPv4 range, IDNA, non-special and baseless references).\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(capture): strip trailing URL whitespace and validate IP hosts and ports\n\nThe previous host check counted trailing C0 controls and spaces, which\nWHATWG strips, so `https://user:pw@host ` kept its password. Trailing\nC0/space is now removed from the parse view (raw offsets are unchanged).\n\nSpecial hosts now also follow the WHATWG IPv4 parser (ends-in-a-number,\nhex/octal parts, range) and IPv6 literal syntax (zone IDs rejected), and\nports are bounded lexically before int(), which raised ValueError past\n4300 digits on Python 3.11+ and failed the whole capture.\n\nNode URL differential over 126,000 spellings: under-redaction 8,084 -> 0,\nValueError 2,550 -> 0; remaining special-scheme over-redaction is IDNA\nand the pinned empty-userinfo case. Cost: +0.6 us per URL.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(capture): redact userinfo before hosts that need Unicode mapping\n\nA non-ASCII special host may map under UTS #46 to an accepted host\n(fullwidth digits, ideographic full stops, ignored code points), so\ntreat it as accepted instead of running the ASCII IPv4 check on it.\n\nCo-Authored-By: Claude Opus 5.5 \n\n---------\n\nCo-authored-by: Claude Opus 5.5 \nCo-authored-by: morluto <76467478+morluto@users.noreply.github.com>\nCo-authored-by: Lucien <164857476+dakjdakd@users.noreply.github.com>", "parents": ["767fe0f0ccbab3ae4be28e71cc8214c7cd302133"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } }, { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "Lucien", "email": "164857476+dakjdakd@users.noreply.github.com", "user": { "login": "dakjdakd", "__typename": "User" } } ], "pullRequests": [2767] }, { "sha": "f4df6ab280ce30395816159a05ee3c89ff47ff0f", "subject": "fix(native): classify every Swift mangling prefix as invalid when undecodable (#3089)", "body": "fix(native): classify every Swift mangling prefix as invalid when undecodable (#3089)\n\n* fix(native): classify every Swift mangling prefix as invalid when undecodable\n\ndemangle_swift reported \"invalid\" only for $s and _$s inputs that\nswift-demangle left unchanged. Undecodable symbols carrying the other\nprefixes the Swift demangler accepts (_T0, $S, _$S, @__swiftmacro_, $e,\n_$e) were reported as \"unchanged\", i.e. as non-Swift names. Legacy _T\nstays \"unchanged\" because it is also an ordinary C symbol spelling.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* test(native): expect only toolchain-portable Swift manglings to demangle\n\nThe macOS 15 runner's swift-demangle predates Embedded Swift, so valid\n$e symbols stay unchanged there. Keep $e and _$e in the undecodable\nhalf only.\n\nCo-Authored-By: Claude Opus 5.5 \n\n---------\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["77be0f6666df67de48ad737fe5b5d204aa34ae85"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [3089] }, { "sha": "ec67aebed02dbd20fa5c7703fcd183ad0b1c343c", "subject": "fix(electron): preserve selected fuse inspection paths (#3104)", "body": "fix(electron): preserve selected fuse inspection paths (#3104)\n\nPreserve caller-selected POSIX symlink/parent paths during CLI anchoring and\nElectron bundle traversal. Resolve terminal directory suffixes through checked\nreal directories, retaining their identities for before/after readback. Keep\nthe existing Windows CLI resolution, bounded scan, and output contracts.\n\nValidation: six regressions reproduced on main 7ad75bdc8; 41 focused tests pass\nwith one Windows-only skip. Full static/docs checks and final main-sync fast\nchecks pass. Official Electron v44.7.1 release archives, extracted executable\nhashes and independent fuse wires verify actual ELF/PE/Mach-O bytes. Real CLI\nand stdio MCP reproduce main's wrong target and confirm corrected artifact\nidentity plus CLI/MCP parity; owned MCP servers exit. Equivalent direct-file\noutputs remain 963-1,054 o200k tokens. Individual timing measurements and their\nlimits are recorded in the PR; no speedup is claimed. Native Windows/macOS REA\nexecution and target application execution are not claimed.\n\nCo-authored-by: Yann Roberto <165009858+shoyann@users.noreply.github.com>\nCo-authored-by: N0zoM1z0 <161784452+N0zoM1z0@users.noreply.github.com>\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>", "parents": ["f4df6ab280ce30395816159a05ee3c89ff47ff0f"], "authors": [ { "name": "Yann Roberto", "email": "165009858+shoyann@users.noreply.github.com", "user": { "login": "shoyann", "__typename": "User" } }, { "name": "N0zoM1z0", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } } ], "pullRequests": [3104] }, { "sha": "500e32399a3bc827e17fb4adaa97db3bc0df29b5", "subject": "fix(ci): check authored documentation code (#3119)", "body": "fix(ci): check authored documentation code (#3119)\n\nSelect portable code checks for authored JavaScript and TypeScript documentation, including hidden directories, removed paths and line separators. Keep Markdown-only changes on their existing documentation route.\n\nCloses #3116.\n\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>", "parents": ["ec67aebed02dbd20fa5c7703fcd183ad0b1c343c"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } } ], "pullRequests": [3119] }, { "sha": "f79fd59e962ff00da7b57fdd3513512f3db29ca3", "subject": "fix(domain): validate JSON data without invoking caller code", "body": "fix(domain): validate JSON data without invoking caller code\n\nReject proxies, accessors, sparse arrays and non-JSON object members at the owning boundary. Validate once before preserving JSON data; retain immutable snapshot reuse.\n\nValidation: JSON, Evidence and immutable snapshot focused tests; cached build and static checks passed.\n", "parents": ["500e32399a3bc827e17fb4adaa97db3bc0df29b5"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "345c47ccf8897a517975a256b9d1b99582f8609c", "subject": "fix(binary): clear retired availability when restoring a session", "body": "fix(binary): clear retired availability when restoring a session\n\nA cancelled target switch restores a new client but retained the retired runtime availability cache. Clear that cache when installing the restored client. Preserve cancellation, target identity and later real provider failures.\n\nValidation: all 9 BinarySession liveness tests passed. Fixes #2657.\n", "parents": ["f79fd59e962ff00da7b57fdd3513512f3db29ca3"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "02aea22f88feae5e0048c7c241d5b8757f9c0b3f", "subject": "fix(electron): classify dropped preload configuration at the hook", "body": "fix(electron): classify dropped preload configuration at the hook\n\nClassify browser-role preload configuration while event kind and role remain paired. Consume canonical dropped families once and retain unknown attribution for legacy independent totals. Correct the stale dropped IPC assertion.\n\nValidation: hook and projection regressions passed. Fixes #2649.\n", "parents": ["345c47ccf8897a517975a256b9d1b99582f8609c"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "6cc6d22585d31b45fe01b36221dfa268126bec1a", "subject": "fix(evm): retain partial evidence and unresolved worker ownership", "body": "fix(evm): retain partial evidence and unresolved worker ownership\n\nPreserve parsed worker facts and captured diagnostics when owned worker or snapshot cleanup fails, and retain the owner for retry. Keep primary malformed-reply errors in the cleanup chain.\n\nValidation: build, typecheck and static checks passed. Linux x64 worker regressions added; unavailable on this macOS host.\n", "parents": ["02aea22f88feae5e0048c7c241d5b8757f9c0b3f"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "23c70d674c53c2d5eba62d29f8f10d88418f7b1d", "subject": "fix(pcap): retain parsed observations when process cleanup fails", "body": "fix(pcap): retain parsed observations when process cleanup fails\n\nSeparate command facts from unresolved cleanup, preserve captured stdout, and build partial Evidence through the domain owner. Retain process and snapshot ownership until cleanup succeeds.\n\nValidation: command boundary tests, build and static checks passed. Linux provider regressions added; unavailable on this macOS host.\n", "parents": ["6cc6d22585d31b45fe01b36221dfa268126bec1a"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "131b2d85f344cbaac0160480244bea5f1bf8fd80", "subject": "fix(verify): report every owned cleanup failure before success", "body": "fix(verify): report every owned cleanup failure before success\n\nUse one cleanup owner across browser, Frida and JEB verifiers. Attempt all independent cleanup tasks, retain primary failures, and emit successful reports only after cleanup. Remove the superseded browser helper and duplicate tests.\n\nValidation: cleanup aggregation and runtime fixture tests, build and static checks passed. No real Frida or JEB run.\n", "parents": ["23c70d674c53c2d5eba62d29f8f10d88418f7b1d"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "3f5b7033799f9fe993ad5b81fb51c8f822173817", "subject": "fix(native): derive Mach-O word size and byte order from the selected slice (#3163)", "body": "fix(native): derive Mach-O word size and byte order from the selected slice (#3163)\n\n* fix(native): derive Mach-O word size and byte order from the selected slice\n\ninspect_macho read endian and word_size from `file -b` for the whole\nfile. macOS `file` never prints a Mach-O byte order, so endian was null\nfor every target. For a universal binary, word_size matched \"64-bit\"\nanywhere in the summary instead of describing the selected slice, and it\nwas null for a thin 32-bit slice.\n\nBoth now come from the selected slice's otool header: the magic gives\nthe word size and the CPU family gives the byte order (x86 and ARM\nlittle, PowerPC big, other families unknown). The file capture is no\nlonger needed by inspect_macho, so it is no longer run there.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* test(native): select a 32-bit slice beside a 64-bit slice through inspect_macho\n\nCo-Authored-By: Claude Opus 5.5 \n\n---------\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["131b2d85f344cbaac0160480244bea5f1bf8fd80"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [3163] }, { "sha": "96e7c22a9cc917448ed080e11cde4dacd2a2d70a", "subject": "fix(docs): render README source notices as GitHub alerts (#3228)", "body": "fix(docs): render README source notices as GitHub alerts (#3228)\n\nMove the official-source notices outside the centered HTML headers so GitHub renders IMPORTANT alerts in all 20 README editions. Preserve wording, links, placement and Persian RTL attributes.\n\nVerified before/after rendering with the GitHub Markdown API, unchanged rendered link/image targets, exact source preservation, scoped formatting and a clean integration with latest main.\n\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>", "parents": ["3f5b7033799f9fe993ad5b81fb51c8f822173817"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "factory-droid[bot]", "email": "138933559+factory-droid[bot]@users.noreply.github.com", "user": { "login": "factory-droid[bot]", "__typename": "User" } } ], "pullRequests": [3228] }, { "sha": "ee9bf58abc2e0e6450b3dcdae95b51d222412ebe", "subject": "fix(mcp): materialize catalog identity at the JSON boundary", "body": "fix(mcp): materialize catalog identity at the JSON boundary\n\nKeep lazy cached catalog calculation internal; publish catalog counts and digests as plain data. This repairs binary_session and doctor output after inert JSON validation.\n\nValidation: production stdio MCP doctor and invalid-probe controls pass; build, static and docs checks pass.\n", "parents": ["96e7c22a9cc917448ed080e11cde4dacd2a2d70a"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "66dcd94d092c1cb3d9ee92fcbd733f0c61c584c1", "subject": "fix(cli): route static artifact analysis without native engines", "body": "fix(cli): route static artifact analysis without native engines\n\nStatic .app decoding failed under auto selection when multiple deep engines were installed. Compose the existing artifact provider without native candidates and reuse the shared one-shot target, Evidence and cleanup lifecycle. Preserve the selected provider environment.\n\nValidation: real NIB filesystem and built CLI cases, artifact direct workflow and direct-analysis lifecycle tests pass (57 tests with MCP controls).\n", "parents": ["ee9bf58abc2e0e6450b3dcdae95b51d222412ebe"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "7e1c560dd608594687d4ef94c6f88e4085ad9719", "subject": "fix(javascript): decode literal file URLs at the path boundary", "body": "fix(javascript): decode literal file URLs at the path boundary\n\nDecode known literal file URLs with explicit path semantics before assigning filesystem-expression context. Preserve unknown drive, UNC, dynamic and malformed inputs and existing source-relative projection.\n\nValidation: 64 path-owner and 26 filesystem application tests pass. Fixes #2561.\n\nBased on #3147.\n\nCo-authored-by: João Pedro de Faria \n", "parents": ["66dcd94d092c1cb3d9ee92fcbd733f0c61c584c1"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "João Pedro de Faria", "email": "jpdefo7@hotmail.com", "user": { "login": "jpdefo", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "bdf865252cd972e9dbce967f2e7fad2c7f6dfee1", "subject": "fix(electron): retain computed literal preference keys", "body": "fix(electron): retain computed literal preference keys\n\nUse the parsed semantic property key instead of treating all bracketed keys as dynamic. Preserve empty and numeric literal keys; unresolved computed expressions remain unknown.\n\nValidation: exact named preference and dynamic coverage regressions pass. Fixes #2521.\n\nBased on #3105.\n\nCo-authored-by: ShuaixinHuang <1836656514@qq.com>\n", "parents": ["7e1c560dd608594687d4ef94c6f88e4085ad9719"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "ShuaixinHuang", "email": "1836656514@qq.com", "user": { "login": "ShuaixinHuang", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "a9af4718ad246cf3486a9bc8b6c2b297f6c4b86f", "subject": "fix(javascript): parse ignored tokens throughout GraphQL headers", "body": "fix(javascript): parse ignored tokens throughout GraphQL headers\n\nReplace the whitespace-only header regex with bounded name/token scanning that consumes GraphQL comments and exact ignored characters at each boundary. Preserve anonymous, prose and incomplete input controls.\n\nValidation: all 36 RPC endpoint tests pass. Fixes #2523.\n\nBased on #2900.\n\nCo-authored-by: Nikhil Jangid <161968345+nikhiljangid120@users.noreply.github.com>\n", "parents": ["bdf865252cd972e9dbce967f2e7fad2c7f6dfee1"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "Nikhil Jangid", "email": "161968345+nikhiljangid120@users.noreply.github.com", "user": { "login": "nikhiljangid120", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "17e3cf9802f557eeb388ee4522b9fae75ceb5daa", "subject": "fix(native): share Swift mangling recognition across metadata", "body": "fix(native): share Swift mangling recognition across metadata\n\nUse one upstream Swift mangling prefix owner for demangler status and metadata projection/counts. Keep visible legacy class names and nominal-category decoding semantics distinct.\n\nValidation: metadata prefix, negative symbol and partial decode regressions pass; existing Mach-O controls pass.\n\nBased on #3157.\n\nCo-authored-by: 吴佳浩 \n", "parents": ["a9af4718ad246cf3486a9bc8b6c2b297f6c4b86f"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "吴佳浩", "email": "wujiahao@supremind.com", "user": null } ], "pullRequests": [] }, { "sha": "576b58cefea9ed6abd8f467565ab114ec248e259", "subject": "fix(native): wrap bind address advances to 64 bits", "body": "fix(native): wrap bind address advances to 64 bits\n\nApply dyld modulo-64 address arithmetic at the shared bind advance, retaining subsequent bindings after a negative ULEB skip.\n\nValidation: all 37 Mach-O fixup tests pass, including continuation and false-failure controls.\n\nBased on #3138.\n\nCo-authored-by: Dragolone <810170966qq@gmail.com>\n", "parents": ["17e3cf9802f557eeb388ee4522b9fae75ceb5daa"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "Dragolone", "email": "810170966qq@gmail.com", "user": { "login": "Dragolone", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "03ffb2c13dc6d3e8e0cc8cec70efb2a220c38607", "subject": "fix(reference-source): recognize Kotlin files in imported inventories", "body": "fix(reference-source): recognize Kotlin files in imported inventories\n\nClassify .kt and .kts at the source owner so imported entries and historical language summaries preserve Kotlin identity.\n\nValidation: production inventory projection covers Kotlin, Gradle script, Java and backup-suffix controls.\n\nBased on #3224.\n\nCo-authored-by: Aurantium <280805072+Aurantium-47@users.noreply.github.com>\n", "parents": ["576b58cefea9ed6abd8f467565ab114ec248e259"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "Aurantium", "email": "280805072+Aurantium-47@users.noreply.github.com", "user": { "login": "Aurantium-47", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "583166785fa3b22fbda3a54d3abe1f43bc95f170", "subject": "fix(setup): report the effective ZCode fallback registration", "body": "fix(setup): report the effective ZCode fallback registration\n\nResolve native-versus-fallback precedence once at the parsed configuration owner. Status and maintenance consume the selected dialect and path, including invalid and disabled fallback registrations.\n\nValidation: 28 ZCode boundary and 26 maintenance tests pass. No configuration writes introduced.\n\nBased on #3123.\n\nCo-authored-by: IvenKooLab <276572622@qq.com>\n", "parents": ["03ffb2c13dc6d3e8e0cc8cec70efb2a220c38607"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "IvenKooLab", "email": "276572622@qq.com", "user": { "login": "IvenKooLab", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "7cfcd166e3b99a6612eda9b564c692a88b2d4eee", "subject": "fix(apple): derive hierarchy completeness once per document", "body": "fix(apple): derive hierarchy completeness once per document\n\nInclude omitted roots, unresolved retained endpoints and serialized NIB omissions in the owning hierarchy status. Reuse that status for summaries and coverage; remove the adapter recomputation and preserve per-document isolation.\n\nValidation: 18 graph and 12 real NIB filesystem/built CLI tests pass.\n\nBased on #3156.\n\nCo-authored-by: Aliciawque <166712943+Aliciawque@users.noreply.github.com>\n", "parents": ["583166785fa3b22fbda3a54d3abe1f43bc95f170"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "Aliciawque", "email": "166712943+Aliciawque@users.noreply.github.com", "user": { "login": "Aliciawque", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "ad9e22d05fc4207eef7e2466a895bea6a8b005ee", "subject": "fix(browser): honor cancellation during CDP cleanup", "body": "fix(browser): honor cancellation during CDP cleanup\n\nComplete owned teardown before deciding whether a successful observation can be published. Classify an exactly propagated source-map abort reason as cancellation while preserving unrelated failures.\n\nValidation: all four cleanup/cancellation boundary tests pass, retaining detach, socket and target-liveness assertions. Based on #2893.\n", "parents": ["7cfcd166e3b99a6612eda9b564c692a88b2d4eee"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "ae433f0983acfc320c4be1cc203931a8a1e971dd", "subject": "fix(mcp): bound retained doctor stderr while draining output", "body": "fix(mcp): bound retained doctor stderr while draining output\n\nRetain a 64 KiB diagnostic prefix while counting and draining the complete stderr stream. Report truncation and avoid manufacturing a replacement character at a truncated UTF-8 boundary.\n\nValidation: all nine doctor tests pass, including real noisy child, malformed bytes, canonical catalog and startup deadline controls.\n\nBased on #3121.\n\nCo-authored-by: 1052326311 <65798732+1052326311@users.noreply.github.com>\n", "parents": ["ad9e22d05fc4207eef7e2466a895bea6a8b005ee"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "1052326311", "email": "65798732+1052326311@users.noreply.github.com", "user": { "login": "1052326311", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "ef153774f7622167e3752dd89c8754e3d1a531b9", "subject": "fix(mcp): tolerate synthetic entrypoint paths during import", "body": "fix(mcp): tolerate synthetic entrypoint paths during import\n\nTreat an unresolvable argv entry path as an imported module instead of throwing during entrypoint detection. Keep canonical direct-entry comparison private.\n\nValidation: real child imports compiled runtime with a nonexistent argv path and no CLI side effects; all six runtime-error tests pass.\n\nBased on #3162.\n\nCo-authored-by: qorvr <330186599+qorvr@users.noreply.github.com>\n", "parents": ["ae433f0983acfc320c4be1cc203931a8a1e971dd"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "qorvr", "email": "330186599+qorvr@users.noreply.github.com", "user": { "login": "qorvr", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "b782064d5471361532186b54d625698ae4032cee", "subject": "fix(test): reject excluded symlink aliases in exact selection", "body": "fix(test): reject excluded symlink aliases in exact selection\n\nA matching realpath does not make an excluded symlink spelling a discovered test. Compare differing path components, rejecting symlink aliases while preserving ordinary case and Unicode filesystem identity.\n\nValidation: all 14 runner boundary tests pass, including excluded file/directory aliases, valid selections and no target execution.\n\nBased on #2849.\n\nCo-authored-by: ShuaixinHuang <1836656514@qq.com>\n", "parents": ["ef153774f7622167e3752dd89c8754e3d1a531b9"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "ShuaixinHuang", "email": "1836656514@qq.com", "user": { "login": "ShuaixinHuang", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "e62e92526cb969eb601a359cbcf8679932967a10", "subject": "test(reference-source): avoid filesystem enumeration order assumptions", "body": "test(reference-source): avoid filesystem enumeration order assumptions\n\nAssert exact inventory contents and cardinality without depending on directory enumeration order.\n\nValidation: all nine reader boundary tests pass.\n\nBased on #3117.\n\nCo-authored-by: Yog D \n", "parents": ["b782064d5471361532186b54d625698ae4032cee"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "Yog D", "email": "yogd7657@gmail.com", "user": { "login": "yogd71", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "7375ab6e34e511095a74d5a67e57cec28d56fd10", "subject": "test(firmware): stream hashes of sparse oversize fixtures", "body": "test(firmware): stream hashes of sparse oversize fixtures\n\nHash the complete oversize fixture through a read stream rather than allocating the entire 128 MiB file. Preserve the digest and oversize admission test semantics.\n\nValidation: node --check and full static checks pass. The capacity fixture was not rerun locally to avoid heavy work.\n\nBased on #1892.\n\nCo-authored-by: GRAB Racem \n", "parents": ["e62e92526cb969eb601a359cbcf8679932967a10"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "GRAB Racem", "email": "racem.grab@etu.univ-lyon1.fr", "user": { "login": "BaaRai", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "74844016018dfdb171132c0d1d2c937905b16d1f", "subject": "perf(managed): add retained member summary and pages (#3061)", "body": "perf(managed): add retained member summary and pages (#3061)\n\n* perf(managed): add retained member summary and pages\n\ninspect_managed_members always returned the assembly-wide member_refs, so\none selected or unmatched type produced megabytes, and an unselected\nordinary assembly exceeded the MCP response budget. Add opt-in\ndetail: \"summary\" that retains the complete Evidence and returns identity,\nselection with unmatched names, coverage, user-string coverage, limitations\nand per-collection counts. Page original rows through inspect_analysis_view\nwith kind managed-members; each page names its collection so no row schema\nis chosen by union order. Complete delivery stays the default.\n\nRefs #3010\n\nCo-Authored-By: Claude Opus 5.5 \n\n* perf(managed): validate a sealed member parent once across pages\n\nEach managed-members page reparsed the whole parent report, about 35 ms\nfor an 18 MB assembly result regardless of the page size. The analysis\nview service now reports whether the parent Evidence is a sealed\nsnapshot, and the member view reuses the validated report for that\nsealed result through a weak reference. Unsealed input is still\nvalidated on every call.\n\nThe round-trip test fixture now carries an exported type, an ldstr\nliteral, a field access and a call edge, and requires every collection\nto be nonempty so a row schema that drops facts cannot pass on empty\narrays.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(managed): keep delivery detail out of retained Evidence identity\n\nSummary, omitted and complete delivery of the same managed inspection\nnow retain one parent record, as inspect_macho already does.\n\nCo-Authored-By: Claude Opus 5.5 \n\n---------\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["7375ab6e34e511095a74d5a67e57cec28d56fd10"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [3061] }, { "sha": "e5791229f3d64e3b3ccc9d839b8e4c567e97cc98", "subject": "perf(native): skip llvm-nm's dyld-info pass when the symbol table names every export (#3200)", "body": "perf(native): skip llvm-nm's dyld-info pass when the symbol table names every export (#3200)\n\n* perf(native): skip llvm-nm's dyld-info pass when the symbol table names every export\n\ninspect_macho ran `nm -gjU`, whose default dyld-info pass takes seconds on\nlarge apps (Keynote arm64 5.8 s, x86_64 10.2 s) yet under -gU can only add\nexport-trie names that dyld_info -exports already reports. Run\n`nm -gjU --no-dyldinfo` and rerun the default pass only when dyld_info\nreports an export the symbol table lacks (e.g. strip -T), so its exact\nnames still disambiguate dyld_info rows.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(native): fall back to nm's dyld-info pass for unreadable export rows\n\nAccount for every dyld_info export line instead of only the rows the\nparser returns, so an unfamiliar row format reruns the default nm pass.\n\nCo-Authored-By: Claude Opus 5.5 \n\n---------\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["74844016018dfdb171132c0d1d2c937905b16d1f"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [3200] }, { "sha": "419063043261b5342f46ad702f069009212e6ad3", "subject": "test(ghidra): preserve address alias restoration failures (#3060)", "body": "test(ghidra): preserve address alias restoration failures (#3060)\n\nCover shared DOS/COM alias restoration after uncertain writes, rejected edits, incorrect readback and simultaneous failures. Reuse the upstream producer restoration unchanged; preserve exact observed naming and immutable input protections.\n\nCloses #2924\n\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>", "parents": ["e5791229f3d64e3b3ccc9d839b8e4c567e97cc98"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } } ], "pullRequests": [3060] }, { "sha": "e195b8ba91c0b8b6cc6c71a696588e08711bf41c", "subject": "fix(evm): decode shortest-form empty CBOR text in Solidity metadata (#3226)", "body": "fix(evm): decode shortest-form empty CBOR text in Solidity metadata (#3226)", "parents": ["419063043261b5342f46ad702f069009212e6ad3"], "authors": [ { "name": "pablodiazjorge", "email": "102741971+pablodiazjorge@users.noreply.github.com", "user": { "login": "pablodiazjorge", "__typename": "User" } } ], "pullRequests": [3226] }, { "sha": "877d40408b0d9a670fa19a53440b7e75022ca14a", "subject": "fix(electron): attach error listener to spawned node process in readiness fixture (#3165)", "body": "fix(electron): attach error listener to spawned node process in readiness fixture (#3165)\n\nIn environments where REA_ELECTRON_NODE_EXECUTABLE or node is unavailable,\nunhandled error events on the spawned child process can crash the Electron\nruntime before readiness checks complete.\n\nThis attaches an explicit error handler to absorb ENOENT and spawn failures.\n\nEvaluated and error found by SubQ by Qorvr.\n\nCo-authored-by: qorvr <330186599+qorvr@users.noreply.github.com>", "parents": ["e195b8ba91c0b8b6cc6c71a696588e08711bf41c"], "authors": [ { "name": "qorvr", "email": "cadefunn@gmail.com", "user": { "login": "qorvr", "__typename": "User" } }, { "name": "qorvr", "email": "330186599+qorvr@users.noreply.github.com", "user": { "login": "qorvr", "__typename": "User" } } ], "pullRequests": [3165] }, { "sha": "713163e6442c53cff6df4e8f79e8d6ba4d1d832f", "subject": "fix(domain): stop Evidence authentication after invalid JSON", "body": "fix(domain): stop Evidence authentication after invalid JSON\n\nAbort rejected JSON validation so Evidence refinements never recursively hash invalid deep data. Validated 10,000-level inputs through source parsing and compiled CLI.\n", "parents": ["877d40408b0d9a670fa19a53440b7e75022ca14a"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "07540cbcde9cacda43c3758ec8e6ac9c868c983e", "subject": "fix(evm): preserve transferred cleanup ownership and bounded output", "body": "fix(evm): preserve transferred cleanup ownership and bounded output\n\nRetain a worker owner transferred through the callback when a failure has no replacement owner. Give captured streams one canonical owner while preserving unrelated diagnostics and partial Evidence. Linux retained-cleanup coverage requires CI.\n", "parents": ["713163e6442c53cff6df4e8f79e8d6ba4d1d832f"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "1341e8c831388fa9b7d421d43b67e364643eb187", "subject": "test(pcap): retain exact output and release injected cleanup failures", "body": "test(pcap): retain exact output and release injected cleanup failures\n\nAssert the capinfos newline as actually captured, and restore fixture cleanup even after an assertion failure.\n", "parents": ["07540cbcde9cacda43c3758ec8e6ac9c868c983e"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "93872822745e4e91ae0516d306053c32db8181cf", "subject": "fix(ghidra): reconcile GNU MIPS ABI declarations", "body": "fix(ghidra): reconcile GNU MIPS ABI declarations\n\nParse bounded GNU file-scope FP/MSA attributes once, retain absent versus uninspected declarations, reject conflicts and unsupported argument ABIs, and include observed facts in profile identity. LE/BE filesystem and profile regressions pass; real Ghidra/MIPS behavior remains unverified.\n\nFixes #3096\n\nCo-authored-by: Aurelio Bernal \n", "parents": ["1341e8c831388fa9b7d421d43b67e364643eb187"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "Aurelio Bernal", "email": "aurelio@bernalr.com", "user": { "login": "AurelioB", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "66536d0d2e183418caca09cf80c01cea9e029c9b", "subject": "fix(setup): preserve Hermes YAML scalar semantics", "body": "fix(setup): preserve Hermes YAML scalar semantics\n\nUse one Hermes YAML owner for fresh writes and edits, preserving source scalars, exact Python key equality and ruamel timestamp resolution. Validate round trips, backups, idempotence and CLI doctor.\n\nCo-authored-by: Yann Roberto <1922498827@qq.com>\n", "parents": ["93872822745e4e91ae0516d306053c32db8181cf"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "Yann Roberto", "email": "1922498827@qq.com", "user": { "login": "shoyann", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "36c91428fc6ad9fc30336617c24e7031c8d574a2", "subject": "fix(rust): retain compatible cargo-auditable revisions", "body": "fix(rust): retain compatible cargo-auditable revisions\n\nAdmit documented compatible format revisions, preserve the original uint32 revision and disclose unverified fallback for unknown revisions. Keep malformed package and compressed-input rejection.\n\nCo-authored-by: Dragolone <810170966qq@gmail.com>\n", "parents": ["66536d0d2e183418caca09cf80c01cea9e029c9b"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "Dragolone", "email": "810170966qq@gmail.com", "user": { "login": "Dragolone", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "410537667e7c0cdbfce438c875f76b32c32a7b8e", "subject": "fix(javascript): retain uncertainty for conditionally skipped writes", "body": "fix(javascript): retain uncertainty for conditionally skipped writes\n\nOwn skipped-write interpretation at definition collection, including conditional branches, loop iterations and optional-chain arguments. Remove the narrower initializer-only representation.\n\nFixes #2562\n", "parents": ["36c91428fc6ad9fc30336617c24e7031c8d574a2"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "b98be5408b6b7163b08028e2fcc8463c9fc72f8b", "subject": "fix(browser): retain excluded scope through final URL capture", "body": "fix(browser): retain excluded scope through final URL capture\n\nLatch target scope exclusion so a late frame-tree reply cannot restore a stale approved final URL or complete coverage. Preserve redirect observations and approved controls.\n\nFixes #2593\n", "parents": ["410537667e7c0cdbfce438c875f76b32c32a7b8e"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "778114a1ab5b1a3619aa5b8cb9abdf895b6a2253", "subject": "fix(browser): confirm late-opening cleanup independently of cancellation", "body": "fix(browser): confirm late-opening cleanup independently of cancellation\n\nKeep cancellation responsive while retained browser/profile cleanup owns its independent confirmation deadline and remains retryable.\n\nFixes #2597\n\nCo-authored-by: ShitK <1724059440@qq.com>\n", "parents": ["b98be5408b6b7163b08028e2fcc8463c9fc72f8b"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "ShitK", "email": "1724059440@qq.com", "user": { "login": "ShitK", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "bcc884556eed475c10dfbaff8fea8395ed8f70c0", "subject": "fix(ghidra): preserve unknown PDB application state", "body": "fix(ghidra): preserve unknown PDB application state\n\nUse parsed PDB loaded facts without collapsing omitted/null state to false. Only an explicit false reports unapplied symbols; operation and health Evidence retain the same uncertainty. Controlled bridge validation only.\n\nFixes #2534\n", "parents": ["778114a1ab5b1a3619aa5b8cb9abdf895b6a2253"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "3f11bd96556ad03babbc8de1a9f332f8249346d1", "subject": "fix(verify): decode Hopper dispatcher file URLs", "body": "fix(verify): decode Hopper dispatcher file URLs\n\nResolve the dispatcher using fileURLToPath so spaces and encoded path characters retain filesystem identity. Syntax checked; real Hopper verification was not rerun.\n\nFixes #2587\n", "parents": ["bcc884556eed475c10dfbaff8fea8395ed8f70c0"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "16e1cc65ed3e3d9803d6355ae7a840e19a960398", "subject": "fix(analysis-view): remove contract initialization cycles", "body": "fix(analysis-view): remove contract initialization cycles\n\nMove the shared input-error constructor and operation identity to a leaf contract. View leaves no longer import their runtime composition owner. Replace a duplicate graph assertion with compiled CLI summary/facet coverage for omitted roots and unresolved hierarchy endpoints.\n", "parents": ["3f11bd96556ad03babbc8de1a9f332f8249346d1"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "dc6872c66faf07d86d7632bbf54f0019abf6a055", "subject": "test(mcp): cover navigation errors and source-map cancellation", "body": "test(mcp): cover navigation errors and source-map cancellation\n\nExercise real MCP navigation error delivery and preserve a custom caller abort cause through source-map cancellation. Document doctor stderr retention.\n\nCo-authored-by: yasshmittal \n", "parents": ["16e1cc65ed3e3d9803d6355ae7a840e19a960398"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "yasshmittal", "email": "myash0091@gmail.com", "user": { "login": "yasshmittal", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "29d3dcb7ea85b3be37cd81e977ae4e09cebdd2fc", "subject": "test(managed): verify complete fixture resources and references", "body": "test(managed): verify complete fixture resources and references\n\nExercise the actual JavaScript fixture producer with the reported 2045-byte embedded resource and all 60 AssemblyRef names. Verify declared complete extents and clean production-inspector coverage.\n\nFixes #2585\nFixes #2583\n", "parents": ["dc6872c66faf07d86d7632bbf54f0019abf6a055"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "b57a054d5e777d5e33eb17b305015d2f469320b0", "subject": "fix(mcp): cover prompt objectives in catalog identity", "body": "fix(mcp): cover prompt objectives in catalog identity\n\nDigest the delivered guided-prompt objective alongside metadata and steps. Objective-only changes update prompt and combined identity without changing tools.\n\nFixes #3222\n\nCo-authored-by: Saim Shafique \n", "parents": ["29d3dcb7ea85b3be37cd81e977ae4e09cebdd2fc"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "Saim Shafique", "email": "msaimshafique4664@gmail.com", "user": { "login": "sx4im", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "ada133c256a34128cd66fef4113525f751a551f4", "subject": "fix(reference): retain unknown kind for unsupported source entries", "body": "fix(reference): retain unknown kind for unsupported source entries\n\nKeep FIFO, socket and device entries unknown instead of projecting unsupported reader entries as ordinary files. Preserve real file read-failure identity.\n\nFixes #3218\n\nCo-authored-by: Saim Shafique \n", "parents": ["b57a054d5e777d5e33eb17b305015d2f469320b0"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "Saim Shafique", "email": "msaimshafique4664@gmail.com", "user": { "login": "sx4im", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "4c401458da5ceef80d5c27305d0cdb586e66a46c", "subject": "fix(ci): track imported compiler inputs and package scopes", "body": "fix(ci): track imported compiler inputs and package scopes\n\nInclude imported declarations, nested Node package scopes and authored documentation helpers in compiler task ownership. Schedule static checks for documentation package scopes. Three real cold/warm compiler invalidation cases passed under bounded Flameox captures; the complete matrix remains CI verification.\n\nFixes #3164\n\nCo-authored-by: N0zoM1z0 <161784452+N0zoM1z0@users.noreply.github.com>\n", "parents": ["ada133c256a34128cd66fef4113525f751a551f4"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "N0zoM1z0", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "7df85f16a0a549ec9baa3c9bb8802dc1f6c18185", "subject": "fix(cli): align advertised analysis contracts with runtime", "body": "fix(cli): align advertised analysis contracts with runtime\n\nAdvertise the nonnegative outline-depth bound after safe-range conversion, verify it against the runtime parser and Ajv 2020, and describe every retained view family and both supported recorded-core architectures. Reuse the existing CLI schema fixture instead of three duplicate capture helpers.\n\nFixes #3211\n\nFixes #3194\n\nFixes #3167\n\nCo-authored-by: Anankequ <2983852214@qq.com>\n\nCo-authored-by: gongfpp <1360187968@qq.com>\n", "parents": ["4c401458da5ceef80d5c27305d0cdb586e66a46c"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "gongfpp", "email": "1360187968@qq.com", "user": { "login": "gongfpp", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "74afb04f32892d661371c58d015e2f3c57e4102f", "subject": "fix(native): decode the Objective-C word-alignment sentinel", "body": "fix(native): decode the Objective-C word-alignment sentinel\n\nInterpret the 64-bit ivar word-alignment sentinel as eight bytes. Preserve ordinary exponents and unknown invalid encodings; source fixtures only.\n\nFixes #3186\n\nCo-authored-by: arlandev \n", "parents": ["7df85f16a0a549ec9baa3c9bb8802dc1f6c18185"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "arlandev", "email": "arlanpower69@gmail.com", "user": { "login": "arlandev", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "9d00d7d7fabb643d1d11c71c77ae4fc704ef6f69", "subject": "fix(native): retain unclassified accepted Swift manglings", "body": "fix(native): retain unclassified accepted Swift manglings\n\nUse the shared Swift prefix owner for admission while preserving legacy classified spellings. Keep unresolved symbols and aliases without letting them override decoded category votes.\n\nCo-authored-by: 吴佳浩 \n", "parents": ["74afb04f32892d661371c58d015e2f3c57e4102f"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "吴佳浩", "email": "wujiahao@supremind.com", "user": null } ], "pullRequests": [] }, { "sha": "b8eea783da48cab680f5278e40d6e44985525597", "subject": "fix(javascript): honor final RPC object properties", "body": "fix(javascript): honor final RPC object properties\n\nResolve final object writes once at the RPC endpoint producer. Unknown computed writes and spreads remain barriers; overridden properties do not invent endpoints. Source, CLI and stdio MCP regressions cover the behavior.\n\nCo-authored-by: Vaishnavi220506 \n", "parents": ["9d00d7d7fabb643d1d11c71c77ae4fc704ef6f69"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "Vaishnavi220506", "email": "vaishnaviharish2006@gmail.com", "user": { "login": "Vaishnavi220506", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "6396851958242e56a2162f14b200c46031ca4299", "subject": "fix(javascript): retain directive values in function fingerprints", "body": "fix(javascript): retain directive values in function fingerprints\n\nRetain directive literal values, including escaped strict-mode lookalikes, in semantic function fingerprints. Verify normalized duplicates and distinct directives through CLI/MCP.\n\nCo-authored-by: To3akaRin <131595336+To3akaRin@users.noreply.github.com>\n", "parents": ["b8eea783da48cab680f5278e40d6e44985525597"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "To3akaRin", "email": "131595336+To3akaRin@users.noreply.github.com", "user": { "login": "To3akaRin", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "76fa5304a8f1b197a30d99e2b81c79891d536e02", "subject": "refactor(javascript): share computed-key callable ownership", "body": "refactor(javascript): share computed-key callable ownership\n\nGive calls, captures, object operations, promises and effects one callable-owner tracker. Suspend a method while its computed key is evaluated in the enclosing callable; remove the capture-only downstream repair.\n\nCo-authored-by: Alex Desir \n", "parents": ["6396851958242e56a2162f14b200c46031ca4299"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "Alex Desir", "email": "adesir089@gmail.com", "user": { "login": "adesir089-spec", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "eb00112a3f02bd745d901fd532accdfa0aad1181", "subject": "test(javascript): exercise candidate endpoints through the worker", "body": "test(javascript): exercise candidate endpoints through the worker\n\nVerify the existing exact candidate-endpoint schema through a completed compiled CLI workflow instead of adding a duplicate worker-only assertion.\n\nFixes #3128\n\nCo-authored-by: claudetrail2026-droid <313336388+claudetrail2026-droid@users.noreply.github.com>\n", "parents": ["76fa5304a8f1b197a30d99e2b81c79891d536e02"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "claudetrail2026-droid", "email": "313336388+claudetrail2026-droid@users.noreply.github.com", "user": { "login": "claudetrail2026-droid", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "27311f88d419c4aa9fc7d0078acbdd6523cdb1d5", "subject": "fix(browser): preserve capture uncertainty and frame ancestry", "body": "fix(browser): preserve capture uncertainty and frame ancestry\n\nParse required resource rows and retain valid siblings. Missing collections and malformed child subtrees keep unknown omission counts. Compare complete frame forests without capture-local IDs, and never infer aggregate DOM/metadata changes from omissions.\n\nCo-authored-by: ShuaixinHuang <1836656514@qq.com>\n", "parents": ["eb00112a3f02bd745d901fd532accdfa0aad1181"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "ShuaixinHuang", "email": "1836656514@qq.com", "user": { "login": "ShuaixinHuang", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "7777abf473d4865fda4922560667cabb9a264566", "subject": "fix(artifacts): preserve ZIP member identity and filename semantics", "body": "fix(artifacts): preserve ZIP member identity and filename semantics\n\nRetain duplicate archive occurrences with validated ordinal identities across pages; qualify ambiguous comparison, parent and source-map relationships instead of overwriting entries. Preserve exact integrity-contradiction ownership. Decode unflagged names as CP437 while honoring UTF-8 and valid Unicode Path overrides.\n\nFixes #3152\n\nFixes #3237\n\nCo-authored-by: Charan Rathore <180254320+charan-rathore@users.noreply.github.com>\n\nCo-authored-by: hhang <169027046+xu91102@users.noreply.github.com>\n\nCo-authored-by: gongfpp <1360187968@qq.com>\n", "parents": ["27311f88d419c4aa9fc7d0078acbdd6523cdb1d5"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "gongfpp", "email": "1360187968@qq.com", "user": { "login": "gongfpp", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "11d38cbc000a1dc537f94ca74e59366d423ea431", "subject": "test(mcp): verify retained Interface Builder limits", "body": "test(mcp): verify retained Interface Builder limits\n\nVerify retained hierarchy limits and summary identity through the production artifact-only composition and real MCP SDK, alongside compiled CLI controls. Deep-provider selection is a separate lane.\n\nCo-authored-by: Aliciawque <166712943+Aliciawque@users.noreply.github.com>\n", "parents": ["7777abf473d4865fda4922560667cabb9a264566"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "Aliciawque", "email": "166712943+Aliciawque@users.noreply.github.com", "user": { "login": "Aliciawque", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "102c5a3ae5acba0c4f066d738905f943cf77d9a3", "subject": "test(mcp): verify availability after cancelled session restoration", "body": "test(mcp): verify availability after cancelled session restoration\n\nExercise the production session and MCP SDK across provider failure, cancelled target switching, restored run identity, cleared stale availability and successful retry.\n\nCo-authored-by: wxggzz \n", "parents": ["11d38cbc000a1dc537f94ca74e59366d423ea431"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "wxggzz", "email": "weixiegen0506@gmail.com", "user": null } ], "pullRequests": [] }, { "sha": "8dde6370d0809ad04cda3342d4e6f290f48aa063", "subject": "fix(deps): update the development-only qs serializer", "body": "fix(deps): update the development-only qs serializer\n\nScope qs 6.16.0 to typed-rest-client under mutation tooling, addressing the affected serializer advisories without changing runtime dependencies. Regenerate the locked dependency inventory; installed dependency tree and unchanged runtime fingerprint verified.\n\nFixes #3114\n\nCo-authored-by: Yog D \n", "parents": ["102c5a3ae5acba0c4f066d738905f943cf77d9a3"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "Yog D", "email": "yogd7657@gmail.com", "user": { "login": "yogd71", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "fb752d229391a8c4d65b6dd970e3eb6053affa9a", "subject": "test(domain): keep rejected Evidence payloads inert (#3260)", "body": "test(domain): keep rejected Evidence payloads inert (#3260)\n\nExercise actual Evidence authentication with rejected accessors and proxies in parameters, raw_result and normalized_result. Require zero caller-code reads and preserve the original rejection path without a semantic-ID error.\n\nCloses #3251.\n\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>", "parents": ["8dde6370d0809ad04cda3342d4e6f290f48aa063"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } } ], "pullRequests": [3260] }, { "sha": "1c296f11a1fe994fe74a3c9d43db2efd3ac8c86e", "subject": "fix(website): correct Korean FAQ translations (#3276)", "body": "fix(website): correct Korean FAQ translations (#3276)", "parents": ["fb752d229391a8c4d65b6dd970e3eb6053affa9a"], "authors": [ { "name": "min eunyoung", "email": "mey990425@gmail.com", "user": { "login": "danbom", "__typename": "User" } } ], "pullRequests": [3276] }, { "sha": "9385060f9c804e393858e97e25b507cfc060ae91", "subject": "fix(website): correct the Korean skip-link label (#3280)", "body": "fix(website): correct the Korean skip-link label (#3280)", "parents": ["1c296f11a1fe994fe74a3c9d43db2efd3ac8c86e"], "authors": [ { "name": "min eunyoung", "email": "mey990425@gmail.com", "user": { "login": "danbom", "__typename": "User" } } ], "pullRequests": [3280] }, { "sha": "307af044bc0bdc15bc836c549e774220af8f459e", "subject": "perf(artifacts): overlap bundle magic reads while enumerating dylib roots (#3248)", "body": "perf(artifacts): overlap bundle magic reads while enumerating dylib roots (#3248)\n\n* perf(artifacts): overlap bundle magic reads while enumerating dylib roots\n\ntrace_dylib_resolution opened every file of an app bundle one at a time\nto read its Mach-O magic (Keynote: 35,971 files, 23 Mach-O images).\nKeep up to eight reads in flight while the directory walk continues,\nsettling them in walk order so classification and failure precedence\nmatch the sequential scan. Keynote 4.20 s -> 2.78 s.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* test(artifacts): pin ordered-read failure precedence and cleanup\n\nExtract the overlapped magic-read queue into consumeWithOrderedReads and\ntest its ordering, concurrency bound, failure precedence, enumeration\nclose and read settlement with controlled promises.\n\nCo-Authored-By: Claude Opus 5.5 \n\n---------\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["9385060f9c804e393858e97e25b507cfc060ae91"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [3248] }, { "sha": "bdacd4140ef68d6860b70867d058939d0b4d37d1", "subject": "fix(sqlite): keep a retained worker owner after a failed worker exit (#3242)", "body": "fix(sqlite): keep a retained worker owner after a failed worker exit (#3242)\n\n* fix: abort invalid JSON parses and keep retained worker owners\n\nMain (7375ab6e3) fails four boundary tests from its latest batch.\n\n- f79fd59e9 moved JSON value validation into a non-aborting superRefine, so\n authenticated Evidence still computed its recursive identity digest over\n a 10,000-level `parameters` value and overflowed the stack. The process\n comparison CLI then reported \"Maximum call stack size exceeded\" instead of\n the depth limit. Abort the parse on a JSON validation issue so enclosing\n refinements never walk invalid data.\n- runOwnedCommand retains an incomplete cleanup through retainCleanup and\n then rethrows the command failure without a cleanupOwner. The EVM and SQLite\n providers replaced their retained owner with that undefined value, so an\n output-limit failure with unresolved cleanup lost cleanupIncomplete and its\n owner. Keep the retained owner unless the failure carries one.\n- The EVM malformed-reply test expected a nonexistent `output_failure` code;\n AnalysisOutputError projects to `unreadable_output`. The pcap capinfos stub\n prints its report with a trailing newline, which retained output preserves.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* test(sqlite): keep a retained worker owner after a failed worker exit\n\nCover the path the existing worker-cleanup test bypasses: a real owned worker\nexits nonzero, runOwnedCommand retains its incomplete cleanup and rethrows the\nfailure without a cleanupOwner. The provider must still report\ncleanupIncomplete and block a new worker until the retained cleanup succeeds.\nFails on the previous owner assignment.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(evm): retain the compact worker failure beside retained cleanup\n\nWhen the worker command fails and its cleanup is retained, the cleanup error\nnow reports the primary failure in the same compact form as an unretained\ncommand cleanup failure: failure kind, message, exit code and signal. Its\noutput is already retained once as captured_output, so the previous error no\nlonger repeats up to a megabyte of diagnostics, and failure_kind stays at the\ntop level that the provider test reads. Both paths share\nownedCommandPreviousError.\n\nCo-Authored-By: Claude Opus 5.5 \n\n---------\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["307af044bc0bdc15bc836c549e774220af8f459e"], "authors": [ { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [3242] }, { "sha": "90d4098a01b62d0e00dd79376465c2243aff800d", "subject": "docs(contributing): require human ownership and review readiness (#3286)", "body": "docs(contributing): require human ownership and review readiness (#3286)\n\n* docs(contributing): require human ownership and review readiness\n\n* docs(contributing): strengthen the human declaration instruction", "parents": ["bdacd4140ef68d6860b70867d058939d0b4d37d1"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [3286] }, { "sha": "cf6ea097116bdf3578b1e02e35c772d8aa92db00", "subject": "fix(setup): refuse linked skill installation directories (#3108)", "body": "fix(setup): refuse linked skill installation directories (#3108)\n\nValidate final selected skill roots and references before preview, approval,\nand client/Hopper changes, with a repeated installation-boundary check.\nPreserve interactive unselected-client choices and registration-only setup.\n\nShare typed directory/read observations across setup, doctor, and update;\nreport unmanaged paths and unknown reads with actionable paths/reasons.\nRetain uninstall child outcomes and ownership manifests when cleanup remains.\n\nShared single-pass inspection retains all unreadable paths after stale or\nmissing files and keeps observed metadata, without duplicate manifest reads.\nAbsent installed files do not depend on generated bundled bytes.\n\nValidation: 217 related tests, 41 final CLI/MCP and filesystem checks, and all\n7,446 source tests in 508 files pass (eight platform/condition skips).\nStatic/docs checks pass. Normal four-call\ninstall/rerun/repair/uninstall tasks preserve results and output token counts.\nNo native Windows follow-up or arbitrary concurrent swap containment claim.\n\nFixes #3057.\n\nCo-authored-by: geekwolf <3125615+geekwolf@users.noreply.github.com>\nCo-authored-by: N0zoM1z0 <161784452+N0zoM1z0@users.noreply.github.com>\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>\nCo-authored-by: akushonkamen <74654766+akushonkamen@users.noreply.github.com>", "parents": ["90d4098a01b62d0e00dd79376465c2243aff800d"], "authors": [ { "name": "Geekwolf", "email": "geekwolf@163.com", "user": { "login": "geekwolf", "__typename": "User" } }, { "name": "geekwolf", "email": "3125615+geekwolf@users.noreply.github.com", "user": { "login": "geekwolf", "__typename": "User" } }, { "name": "N0zoM1z0", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "akushonkamen", "email": "74654766+akushonkamen@users.noreply.github.com", "user": { "login": "akushonkamen", "__typename": "User" } } ], "pullRequests": [3108] }, { "sha": "69b850960225a59fa9a957c530e489ba2a816830", "subject": "docs(contributing): strengthen issue evidence guidance (#3287)", "body": "docs(contributing): strengthen issue evidence guidance (#3287)", "parents": ["cf6ea097116bdf3578b1e02e35c772d8aa92db00"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [3287] }, { "sha": "c482ddd6ad5e4cf09eb28eca5a453b24e67248a7", "subject": "fix(mcp): release optional providers when transport startup fails", "body": "fix(mcp): release optional providers when transport startup fails\n\nClose the browser scenario owner alongside session, Android and servers when transport startup throws. Preserve cleanup failures in the existing diagnostics.\n\nReviewed-PR: #3230\nCo-authored-by: qorvr <330186599+qorvr@users.noreply.github.com>\n", "parents": ["69b850960225a59fa9a957c530e489ba2a816830"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "qorvr", "email": "330186599+qorvr@users.noreply.github.com", "user": { "login": "qorvr", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "dd1c879580200714ebb2eaaa0e07eae2a2497e1c", "subject": "fix(windows): end output streams before releasing owned handles", "body": "fix(windows): end output streams before releasing owned handles\n\nSettle local streams even when native handle release fails, retaining handle ownership and retry semantics until release succeeds.\n\nReviewed-PR: #3230\nCo-authored-by: qorvr <330186599+qorvr@users.noreply.github.com>\n", "parents": ["c482ddd6ad5e4cf09eb28eca5a453b24e67248a7"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "qorvr", "email": "330186599+qorvr@users.noreply.github.com", "user": { "login": "qorvr", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "187f113f798b5b8a080d22285b51c05596c3e0f2", "subject": "fix(identity)!: preserve invocation uncertainty and advertised catalogs", "body": "fix(identity)!: preserve invocation uncertainty and advertised catalogs\n\nCapture the current entrypoint once without inventing a path. Preserve unknown registration ownership through setup and doctor, refuse unsafe registration plans, and retain exact pinned-launcher readiness checks. Hash the same full or compact schema projection advertised by each MCP server and use that identity in doctor comparisons.\n\nBREAKING CHANGE: server.command_path may be null when the invocation path is unavailable. Registration and setup statuses, and doctor classifications, may report unknown.\n\nReviewed-PR: #3230, #3015\nCo-authored-by: qorvr <330186599+qorvr@users.noreply.github.com>\nCo-authored-by: Hemang Varshney <218273197+hemv-857@users.noreply.github.com>\n", "parents": ["dd1c879580200714ebb2eaaa0e07eae2a2497e1c"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "qorvr", "email": "330186599+qorvr@users.noreply.github.com", "user": { "login": "qorvr", "__typename": "User" } }, { "name": "Hemang Varshney", "email": "218273197+hemv-857@users.noreply.github.com", "user": { "login": "hemv-857", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "57bb7ec5ca44388b9e4ced1588eda0a72bd879ac", "subject": "fix(adb): parse successful daemon notices from both output streams", "body": "fix(adb): parse successful daemon notices from both output streams\n\nRecognize exact current and legacy ADB startup notices without treating stderr as device inventory or accepting error lookalikes.\n\nFixes #3051.\nReviewed-PR: #3073\nCo-authored-by: Vinícius DS Andrade <95101505+viniciusdsandrade@users.noreply.github.com>\n", "parents": ["187f113f798b5b8a080d22285b51c05596c3e0f2"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "Vinícius DS Andrade", "email": "95101505+viniciusdsandrade@users.noreply.github.com", "user": { "login": "viniciusdsandrade", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "5b3400d5d945d98b1f31b18579bf6cece1c55773", "subject": "fix(pwntools): preserve actionable provider admission errors", "body": "fix(pwntools): preserve actionable provider admission errors\n\nCarry the concrete configuration and admission reason through the typed provider-selection error to CLI callers.\n\nFixes #3055.\nReviewed-PR: #3087\nCo-authored-by: 1052326311 <65798732+1052326311@users.noreply.github.com>\n", "parents": ["57bb7ec5ca44388b9e4ced1588eda0a72bd879ac"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "1052326311", "email": "65798732+1052326311@users.noreply.github.com", "user": { "login": "1052326311", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "56128a8424d8922fe3d4a45faed9e29989e5924d", "subject": "fix(frida): preserve attach targets and reconcile early detachment", "body": "fix(frida): preserve attach targets and reconcile early detachment\n\nTreat process lookup as optional display metadata, attach to the caller-selected PID, and reconcile already-detached sessions after subscribing to events. Tests observe the actual attach target and the detach race.\n\nReviewed-PR: #3099\nCo-authored-by: LcokHcak <268763621+LcokHcak@users.noreply.github.com>\n", "parents": ["5b3400d5d945d98b1f31b18579bf6cece1c55773"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "LcokHcak", "email": "268763621+LcokHcak@users.noreply.github.com", "user": { "login": "LcokHcak", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "f14c2d4df398dbcd3353ea15ab5a4e31be7a5920", "subject": "fix(browser): retain Playwright IPv6 capture representations", "body": "fix(browser): retain Playwright IPv6 capture representations\n\nAdapt observed Playwright 1.58.2 bracketed IPv6 addresses only in the disposable HAR validation copy. Preserve the producer spelling and per-entry limitation through public CLI and MCP workflows, retaining existing safe-number admission policy.\n\nReviewed-PR: #3161\nCo-authored-by: wunianze666-netizen \n", "parents": ["56128a8424d8922fe3d4a45faed9e29989e5924d"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "wunianze666-netizen", "email": "wunianze666@gmail.com", "user": { "login": "wunianze666-netizen", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "f2f83934d22e4d375a74dea06677eb77d6958259", "subject": "fix(javascript): preserve resource error reasons across worker frames", "body": "fix(javascript): preserve resource error reasons across worker frames\n\nSerialize the typed resource reason once and let the application own path formatting, retaining partial static observations and reported limits.\n\nReviewed-PR: #3039\nCo-authored-by: balkan16 <57933796+balkan16@users.noreply.github.com>\n", "parents": ["f14c2d4df398dbcd3353ea15ab5a4e31be7a5920"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "balkan16", "email": "57933796+balkan16@users.noreply.github.com", "user": { "login": "balkan16", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "eef4a0bfb4f005dcfb0d16cf6a6d5bc85d743e23", "subject": "fix(javascript): derive loader references from lexical binding ownership", "body": "fix(javascript): derive loader references from lexical binding ownership\n\nUse shared lexical bindings and recovered bundler identities for require and chunk references. Preserve uncertain writes as unresolved evidence; remove name-only loader aliases and repeated definition scans.\n\nReviewed-PR: #2989\nCo-authored-by: Hussnain Ahmad \n", "parents": ["f2f83934d22e4d375a74dea06677eb77d6958259"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "Hussnain Ahmad", "email": "ha7886899@gmail.com", "user": { "login": "hussnainahmedd", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "12b3cdb8041d82e90dc7360db9e74782ac8583ae", "subject": "fix(javascript): preserve final RPC property and source-body ownership", "body": "fix(javascript): preserve final RPC property and source-body ownership\n\nNormalize exact template and bigint keys at the shared AST boundary. Keep overwritten GraphQL body literals owned by their source object so they cannot resurface as standalone operations.\n\nReviewed-PR: #3244\nCo-authored-by: Vaishnavi220506 \n", "parents": ["eef4a0bfb4f005dcfb0d16cf6a6d5bc85d743e23"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "Vaishnavi220506", "email": "vaishnaviharish2006@gmail.com", "user": { "login": "Vaishnavi220506", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "ccd748635cf776dc95a1b3bea89298aafe4a2a07", "subject": "test(mcp): retain uncertainty for empty capped IDA reference pages", "body": "test(mcp): retain uncertainty for empty capped IDA reference pages\n\nExercise the empty-but-truncated reference page through trace_feature, preserving unknown coverage without fabricating a reference row.\n\nFixes #2558.\n", "parents": ["12b3cdb8041d82e90dc7360db9e74782ac8583ae"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "cd88163e42cf598c8540a580ed3e3d4de969074a", "subject": "fix(cli): show refusals for blocked setup dry runs", "body": "fix(cli): show refusals for blocked setup dry runs\n\nRender a terminal dry-run plan only after setup admission succeeds. Blocked skill or registration plans use the existing remediation output. Reuse one bounded PTY helper for success and refusal workflows; verify no linked target or client configuration changes.\n\nFollow-up-to: #3108\nValidation: public CLI PTY tests and RPC owner controls pass (77 tests); build and static checks pass.\n", "parents": ["ccd748635cf776dc95a1b3bea89298aafe4a2a07"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "ca7450beffff59325ce3bddc78e181693ce77177", "subject": "test(perf): evaluate larger and non-HTTP packet workflows (#3232)", "body": "test(perf): evaluate larger and non-HTTP packet workflows (#3232)\n\nAdd reproducible larger/non-HTTP packet cost measurements, an independent header oracle, exact page validation and separate factual/plan grading. Document caller-selected controls and retain negative/mixed model results. Production defaults and APIs remain unchanged.\n\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>", "parents": ["cd88163e42cf598c8540a580ed3e3d4de969074a"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "factory-droid[bot]", "email": "138933559+factory-droid[bot]@users.noreply.github.com", "user": { "login": "factory-droid[bot]", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } } ], "pullRequests": [3232] }, { "sha": "04345767a85394741416d1ebf8285db0eed7ca30", "subject": "perf(artifacts): run the asset catalog and Interface Builder bundle walks together (#3285)", "body": "perf(artifacts): run the asset catalog and Interface Builder bundle walks together (#3285)\n\n* perf(artifacts): run the asset catalog and Interface Builder bundle walks together\n\ninspect_asset_catalog walked the app bundle for Assets.car files and then\nwalked it again for the Interface Builder graph that supplies resource\nkeys. The analyses are independent, so start the Interface Builder one\nfirst and let a catalog failure cancel it and win, as the sequential\norder did. Keynote 4.20 s -> 2.89 s with identical output.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* test(artifacts): hold asset catalog and Interface Builder work open to pin overlap\n\nKeep the Interface Builder stub pending until catalog inspection starts,\nand keep catalog inspection pending while asserting an early Interface\nBuilder failure has not escaped.\n\nCo-Authored-By: Claude Opus 5.5 \n\n---------\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["ca7450beffff59325ce3bddc78e181693ce77177"], "authors": [ { "name": "Kaoru0822", "email": "aisakamimaki@gmail.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [3285] }, { "sha": "e5828596c50029e48feb7f56d6f5fe7b5580a561", "subject": "fix(artifacts): inventory universal slices REA cannot structurally index (#3283)", "body": "fix(artifacts): inventory universal slices REA cannot structurally index (#3283)\n\n* fix(artifacts): inventory universal slices REA cannot structurally index\n\ninspect_artifact and extract_artifact rejected a valid universal Mach-O\nwhen one slice was outside the structural index, such as XLD's\nbig-endian PowerPC slice. The whole inventory failed with \"Artifact is\ninvalid or has changed. Get a fresh copy and try again.\"\n\nWhen lipo reports every slice's range, the slices are now inventoried\nfrom those ranges with a limitation naming the unsupported structure,\nas the reader already does for files without structural facts. When\nlipo omits a range, the failure is reported as unavailable support\nrather than a corrupt artifact.\n\nCo-Authored-By: Claude Opus 5.5 \n\n* fix(artifacts): validate every FAT slice past an unsupported one\n\nreadFatSlices returned at the first unsupported slice, so a later\nmalformed slice went unchecked: with lipo's ranges now inventoried for\nunsupported structure, a malformed little-endian slice after a\nbig-endian one was accepted while the reverse order was rejected.\nUnsupported slices are now remembered and the remaining slices are\nstill validated, so malformed structure wins in either order.\n\nAdds portable fake-lipo coverage for complete ranges, missing ranges\n(unavailable) and malformed slices on both sides of a big-endian slice.\n\nCo-Authored-By: Claude Opus 5.5 \n\n---------\n\nCo-authored-by: Claude Opus 5.5 ", "parents": ["04345767a85394741416d1ebf8285db0eed7ca30"], "authors": [ { "name": "Kaoru0822", "email": "kanadekitauji@proton.me", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "Claude Opus 5.5", "email": "noreply@anthropic.com", "user": { "login": "claude", "__typename": "User" } } ], "pullRequests": [3283] }, { "sha": "535c8ef3031d6808c8e03986d513b4507931b777", "subject": "docs(readme): add the Linux ps prerequisite to the Korean README (#3270)", "body": "docs(readme): add the Linux ps prerequisite to the Korean README (#3270)", "parents": ["e5828596c50029e48feb7f56d6f5fe7b5580a561"], "authors": [ { "name": "min eunyoung", "email": "mey990425@gmail.com", "user": { "login": "danbom", "__typename": "User" } } ], "pullRequests": [3270] }, { "sha": "57290a01ac9e89b1e3f395e0bc2611cc47a6762b", "subject": "fix(apple): order projection paths by Unicode code point (#3294)", "body": "fix(apple): order projection paths by Unicode code point (#3294)\n\nThe Apple projection sorted application roots, bundle paths and symlinks\nwith relational string operators, which compare UTF-16 code units, so a\nname with U+10000 sorted before one with U+FFFD. Use the shared\ncompareUnicodeCodePoints instead and remove compareProjectionStrings,\nwhose documented code point contract it did not meet.\n\nFixes #3177", "parents": ["535c8ef3031d6808c8e03986d513b4507931b777"], "authors": [ { "name": "Wade", "email": "160517347+Sriram-PR@users.noreply.github.com", "user": { "login": "Sriram-PR", "__typename": "User" } } ], "pullRequests": [3294] }, { "sha": "7c962cc70bcebf6201da9c5db5b7c0edd2564ae7", "subject": "feat(website): simplify the reader journey and beginner setup (#3274)", "body": "feat(website): simplify the reader journey and beginner setup (#3274)\n\nLead new readers from compact setup through the preserved dinosaur and\nCalculator examples, with code, comparisons, and verification in disclosures.\nExpand Windows, macOS, and Linux onboarding, client/provider choices,\non-site curl instructions, and the supplied first investigation.\nComplete Get started translations while retaining executable literals,\nhistorical evidence, and main's explicitly partial Greek fallback.\n\nVerified the integrated website, its 12 maintenance regressions, all tracked\nformatting, typecheck/lint, 38 locale/base-path browser combinations, and\nthe public Funnel preview. Native installers and providers were not run.\nThe separate manual production publication workflow is not triggered here.\n\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>\nCo-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>\nAssisted-by: Suika (gensokyo-skills:suika-scatter-gather-planning)", "parents": ["57290a01ac9e89b1e3f395e0bc2611cc47a6762b"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } }, { "name": "factory-droid[bot]", "email": "138933559+factory-droid[bot]@users.noreply.github.com", "user": { "login": "factory-droid[bot]", "__typename": "User" } } ], "pullRequests": [3274] }, { "sha": "5f0065c54217852ff26ae2b0071c6671f0528682", "subject": "ci: validate initial PR readiness declarations (#3302)", "body": "ci: validate initial PR readiness declarations (#3302)", "parents": ["7c962cc70bcebf6201da9c5db5b7c0edd2564ae7"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [3302] }, { "sha": "ffeb2d436756008a764ec2045157855098768381", "subject": "fix(apple): keep unrooted extensionless Mach-O in IPA executables (#3300)", "body": "fix(apple): keep unrooted extensionless Mach-O in IPA executables (#3300)\n\nIPA projections keep components outside every application root, but\nexecutables required root membership and native_libraries matched only\n.dylib/.so names, so an unrooted extensionless Mach-O such as\nSwiftSupport/HelperTool was in neither list and formed no bridge\ncandidate. List unrooted Mach-O images under executables unless they\nare already native libraries.\n\nFixes #3174", "parents": ["5f0065c54217852ff26ae2b0071c6671f0528682"], "authors": [ { "name": "Wade", "email": "160517347+Sriram-PR@users.noreply.github.com", "user": { "login": "Sriram-PR", "__typename": "User" } } ], "pullRequests": [3300] }, { "sha": "a154b9752c81ff660666d11acd40744f52de81ab", "subject": "test(setup): use verified invocations in uninstall fixtures", "body": "test(setup): use verified invocations in uninstall fixtures\n\nUpdate byte-preservation fixtures for the fail-closed command ownership contract. Unknown path retention remains covered.\n\nValidation: both filesystem boundary files pass, including BOM restoration and idempotent removal.\n", "parents": ["ffeb2d436756008a764ec2045157855098768381"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "459c0951f268cd2221f204722ca27fce574e9803", "subject": "fix(analysis): propagate typed cancellation across batch stages", "body": "fix(analysis): propagate typed cancellation across batch stages\n\nStop dispatching later resolution, identity and pseudocode stages after typed cancellation; settle already dispatched work. Preserve ordinary partial failures and stop queued graph traversal.\n\nValidation: public MCP cancellation and partial-failure controls.\n\nFixes #3198\n", "parents": ["a154b9752c81ff660666d11acd40744f52de81ab"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "ee5cfbe05cd309a88003c711721e67a3bee36554", "subject": "fix(dotnet): accept legacy small exception section sizes", "body": "fix(dotnet): accept legacy small exception section sizes\n\nApply CoreCLR-compatible clause counting while validating and advancing by the physical section extent. Preserve malformed, reserved, chained and truncation checks.\n\nValidation: managed decoder suite passes; no native compiler or runtime verification claimed.\n\nFixes #3279\n", "parents": ["459c0951f268cd2221f204722ca27fce574e9803"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "cf806ea02a0b5785faaca7ec9fe92e73d1c4f875", "subject": "fix(hopper): prepare deterministic FAT32 analysis slices", "body": "fix(hopper): prepare deterministic FAT32 analysis slices\n\nUse the validated thin-image preparation path for FAT32 and FAT64. Prefer ordinary arm64 then arm64e, masking capability bits only for ranking while preserving raw slice identity; reject unresolved ambiguity. Bump the analysis profile epoch.\n\nValidation: slice/profile fixtures cover raw subtypes, ambiguity, malformed tables and source integrity. Real Hopper execution was not run.\n\nRelated: #3072, #3092\n\nCo-authored-by: akushonkamen \n", "parents": ["ee5cfbe05cd309a88003c711721e67a3bee36554"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "akushonkamen", "email": "akushonkamen@163.com", "user": { "login": "akushonkamen", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "e5deb832cb09bb524877d0df40f49d5b5bb7dea4", "subject": "fix(android): report validated ADB and Apktool host availability", "body": "fix(android): report validated ADB and Apktool host availability\n\nProbe the selected clients through their owning providers and expose current host availability through binary_session. Keep device/serial and target applicability separate. Reject unrecognized successful version output; retain the bounded producer output and original version spelling. Apply the documented Apktool floor, including the verified Debian dirty build.\n\nValidation: provider/version tests and public MCP grouped availability; no real Android device or APK provider verification claimed.\n\nFixes #3067\nFixes #3068\nRelated: #3077\n\nCo-authored-by: Taksh \n", "parents": ["cf806ea02a0b5785faaca7ec9fe92e73d1c4f875"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "Taksh", "email": "takshkothari09@gmail.com", "user": { "login": "Chessing234", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "7fb0a0cc577f7c9033a2674d877d8242b5864556", "subject": "fix(mcp): bound SDK validation errors before transport delivery", "body": "fix(mcp): bound SDK validation errors before transport delivery\n\nMeasure actual wire result JSON, including its provenance marker, without allocating the full serialization. Retain complete SDK diagnostics through the existing Evidence writer and return a bounded reference or explicit retention failure. Keep fitting escaped errors and subsequent valid calls usable.\n\nValidation: actual SDK client/transport retention readback and fit/one-byte-over delivery boundaries.\n\nFixes #3221\nRelated: #3267\n\nCo-authored-by: CRYPTONIKAV <29835619+CRYPTONIKAV@users.noreply.github.com>\n", "parents": ["e5deb832cb09bb524877d0df40f49d5b5bb7dea4"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "CRYPTONIKAV", "email": "29835619+CRYPTONIKAV@users.noreply.github.com", "user": { "login": "CRYPTONIKAV", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "1d826f304f032acfe69dad3ff824b300aacaeb43", "subject": "fix(process): bound normalized terminal retention before allocation", "body": "fix(process): bound normalized terminal retention before allocation\n\nPre-count ordered normalization stages before materializing output. Charge original and normalized terminal bytes independently, omit whole over-budget chunks and preserve exact raw counts plus explicit unknown final sizes. Bound rendered normalization, retain legacy capture compatibility, and remove temporary per-match output arrays.\n\nValidation: UTF-8 surrogate boundaries, shrinking/no-op/literal rules, capture validation and public MCP expansion/equal-size controls with verified cleanup. CPU, process-family memory and token changes are unmeasured; no performance speedup claimed. Nonterminal derived payload bounds remain separate work.\n\nFixes #3168\n", "parents": ["7fb0a0cc577f7c9033a2674d877d8242b5864556"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "7e5cffa2ae9dfc9afaeca0715110d4dd41c0dcdd", "subject": "fix(javascript): preserve loader ownership and unavailable artifact facts", "body": "fix(javascript): preserve loader ownership and unavailable artifact facts\n\nPreserve missing ASAR companion occurrence identity, declared size and unknown content in graph nodes and resolution limitations. Apply URL text semantics once for ESM lookup while preserving literal CommonJS paths and original specifiers. Keep CJS wrapper var bindings and assignment history, recognizing only untouched wrapper redeclarations.\n\nValidation: real ASAR producer workflow and CLI/MCP path/coverage cases; semantic reassignment controls. Context7 Node documentation and direct Node wrapper execution confirm wrapper behavior.\n\nFixes #3213\nFixes #3214\nFixes #3223\nRelated: #3278, #3254\n\nCo-authored-by: Geronimo \nCo-authored-by: Paolo Valletta \n", "parents": ["1d826f304f032acfe69dad3ff824b300aacaeb43"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "Geronimo", "email": "varungore1@gmail.com", "user": { "login": "VarunGore36", "__typename": "User" } }, { "name": "Paolo Valletta", "email": "paovalletta@hotmail.it", "user": { "login": "paoValle", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "81f763820319a762f003cf95651ed14ce9326a4c", "subject": "fix(javascript): keep exports out of write relations", "body": "fix(javascript): keep exports out of write relations\n\nProject writes only from write-role references. Export references remain distinct facts and genuine assignments still traverse writes-only traces.\n\nValidation: source semantic controls and public CLI/MCP writes-only traces.\n\nFixes #3207\n", "parents": ["7e5cffa2ae9dfc9afaeca0715110d4dd41c0dcdd"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "0351328e54ce70ea3f2814482e76b132774aff48", "subject": "fix(electron): retain nested bridge facts through wrapper resolution", "body": "fix(electron): retain nested bridge facts through wrapper resolution\n\nMerge direct same-call nested member facts into symbolic wrapper results using canonical deduplication and ordering. Preserve unknown spread coverage rather than losing known member paths.\n\nValidation: bounded source cases and public CLI/stdio MCP spread/no-spread controls. The existing 125,000-member stress case exceeded the 384 MiB local cap and was stopped without increasing the limit; that capacity case remains unverified locally.\n\nFixes #3212\n", "parents": ["81f763820319a762f003cf95651ed14ce9326a4c"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "864314ac857924a7e6e65bfb37e8dc720fcc21e7", "subject": "fix(adb)!: distinguish reinstall intent from observed replacement", "body": "fix(adb)!: distinguish reinstall intent from observed replacement\n\nPreserve requested adb reinstall mode as replace_requested and report replaced as null when no prior package-state observation exists. Keep install Success/Failure, raw output and host digest, with an explicit Evidence limitation; add no device queries.\n\nValidation: stateful CLI fake distinguishes fresh/existing installs and checks exact version/install commands, plus provider and MCP schema controls. No real-device verification claimed.\n\nFixes #3166\n\nBREAKING CHANGE: install_adb_package now requires replace_requested and exposes replaced as nullable rather than claiming the selected mode was an observed replacement.\n", "parents": ["0351328e54ce70ea3f2814482e76b132774aff48"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "7582f0dff29ae0e80c97b885ddd386ac61a92570", "subject": "fix(hopper): share launcher discovery across setup and runtime", "body": "fix(hopper): share launcher discovery across setup and runtime\n\nCentralize canonical system/user and deterministic renamed-bundle path facts. Reuse the installer destination and honor the same local candidates in doctor and runtime; scan renamed bundles only after canonical candidates fail. Preserve explicit path spelling and exclusive selection. Homebrew command probing remains doctor-only with explicit runtime configuration guidance.\n\nValidation: owner, config, setup and doctor tests cover canonical priority and renamed paths; public CLI verifies explicit path preservation without launching Hopper. No real Hopper analysis claimed.\n\nFixes #3054\nRelated: #3085\n\nCo-authored-by: Vinícius DS Andrade <95101505+viniciusdsandrade@users.noreply.github.com>\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>\n", "parents": ["864314ac857924a7e6e65bfb37e8dc720fcc21e7"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "Vinícius DS Andrade", "email": "95101505+viniciusdsandrade@users.noreply.github.com", "user": { "login": "viniciusdsandrade", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "322506d0c0d39d3cd1e2e1c285c2cc23cfa73ee7", "subject": "fix(javascript): retain unavailable package metadata during resolution", "body": "fix(javascript): retain unavailable package metadata during resolution\n\nConsume the same-container inventory lookup before treating a missing package.json projection as absent. Unknown metadata prevents index fallback and unsupported bare-package exports resolution; restored metadata selects its declared main or import/require export.\n\nValidation: owner same-container/restored controls and actual ASAR CLI missing/restored package-manifest workflow. Completes the P1 review finding on #3278 that remained after the earlier missing-companion projection fix.\n\nFixes #3213\nRelated: #3278\n\nCo-authored-by: Geronimo \n", "parents": ["7582f0dff29ae0e80c97b885ddd386ac61a92570"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "Geronimo", "email": "varungore1@gmail.com", "user": { "login": "VarunGore36", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "dae1e55381f0d6cfee7f2082d5d27b938e55704c", "subject": "fix(javascript): preserve lexical binding and default export capture semantics", "body": "fix(javascript): preserve lexical binding and default export capture semantics\n\nResolve CommonJS wrapper bindings from the parser-owned source type. Capture default identifier export values at the export statement while preserving live named bindings.\n\nRefs: #3261, #3297\n\nCo-authored-by: hhang <169027046+xu91102@users.noreply.github.com>\n", "parents": ["322506d0c0d39d3cd1e2e1c285c2cc23cfa73ee7"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "hhang", "email": "169027046+xu91102@users.noreply.github.com", "user": { "login": "xu91102", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "28f57619738e41cc5e9c8b8e50692231d238a6bb", "subject": "test(mcp): isolate target-free sessions from host provider discovery", "body": "test(mcp): isolate target-free sessions from host provider discovery\n\nInject explicit unavailable provider ports into the fake-session harness, forbid accidental execution, and retain public availability coverage. This removes host-dependent timeouts without increasing deadlines.\n", "parents": ["dae1e55381f0d6cfee7f2082d5d27b938e55704c"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "503109995f9dcf8a955585d39a344fc846d2f59e", "subject": "fix(javascript): retain early-return conditions in wrapped call paths", "body": "fix(javascript): retain early-return conditions in wrapped call paths\n\nShare sequential fallthrough interpretation between block traversal and isolated seed context.\n\nRefs: #3196\n", "parents": ["28f57619738e41cc5e9c8b8e50692231d238a6bb"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "44c9d2924d5b95d7a86595e8d7b7cf4fd4f0f6ac", "subject": "fix(javascript): match feature seeds against their owning source values", "body": "fix(javascript): match feature seeds against their owning source values\n\nApply exact, contains, and case options to node IDs. Route seeds consume retained route values rather than generated display labels.\n\nRefs: #3189, #3190, #3298\n\nCo-authored-by: João Pedro de Faria \n", "parents": ["503109995f9dcf8a955585d39a344fc846d2f59e"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "João Pedro de Faria", "email": "jpdefo7@hotmail.com", "user": { "login": "jpdefo", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "5e79d468e5864204cbe79a7ca2898541cee5e012", "subject": "fix(javascript): retain runtime candidate ambiguity", "body": "fix(javascript): retain runtime candidate ambiguity\n\nKeep referenced ambiguous candidates unknown instead of classifying them as absent.\n\nRefs: #3192\n", "parents": ["44c9d2924d5b95d7a86595e8d7b7cf4fd4f0f6ac"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "2b60e097f281f7708c69f1f7ba9263694547bcc0", "subject": "fix(browser): preserve uncertainty and compare redirect observations", "body": "fix(browser): preserve uncertainty and compare redirect observations\n\nRetain scenario selection limitations independently of known changes. Compare known status, MIME and byte observations for each redirect hop without inventing missing facts.\n\nRefs: #3172, #3173\n", "parents": ["5e79d468e5864204cbe79a7ca2898541cee5e012"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "1250aaedd8b4d1e471d8a382f76418bde65c05d2", "subject": "fix(browser): decode SAZ XML through typed encoding validation", "body": "fix(browser): decode SAZ XML through typed encoding validation\n\nReuse the format-aware XML text owner, preserve decoder causes, and reject contradictory declarations even in unselected records.\n\nRefs: #3273\n", "parents": ["2b60e097f281f7708c69f1f7ba9263694547bcc0"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "3a34ad37bdb7b8debba0f6515ba85b80141f2716", "subject": "fix(evidence): classify noncanonical bundles at the input boundary", "body": "fix(evidence): classify noncanonical bundles at the input boundary\n\nUse a dedicated canonical-projection error so unrelated TypeErrors retain their protocol failure meaning.\n\nRefs: #3219\n", "parents": ["1250aaedd8b4d1e471d8a382f76418bde65c05d2"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "030c47732833c9cedcc31db1309eb3a1ca2c62e8", "subject": "fix(evidence): derive bundle comparison status from classified changes", "body": "fix(evidence): derive bundle comparison status from classified changes\n\nKeep digests as provenance while status follows examined deltas and unresolved coverage.\n\nRefs: #3216\n", "parents": ["3a34ad37bdb7b8debba0f6515ba85b80141f2716"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "e67c3642c8920a2a9c0e231ee2f16f50b245df31", "subject": "fix(process): retain deletions after observed roots become obstructed", "body": "fix(process): retain deletions after observed roots become obstructed\n\nCarry initial root observations into final capture. Treat ENOTDIR as absence only for a previously observed root, preserving initial obstruction and cancellation failures.\n\nRefs: #3238, #3263\n\nCo-authored-by: hhang <169027046+xu91102@users.noreply.github.com>\n", "parents": ["030c47732833c9cedcc31db1309eb3a1ca2c62e8"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "hhang", "email": "169027046+xu91102@users.noreply.github.com", "user": { "login": "xu91102", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "2daeff4b243e1cd137c591ca394e18a1c05c8bbc", "subject": "fix(application): normalize owned target admission cancellation", "body": "fix(application): normalize owned target admission cancellation\n\nNormalize only the exact aborted signal reason, retaining unrelated failures and descriptor ownership after cleanup failures.\n\nRefs: #3197, #3265\n\nCo-authored-by: SII-YDD <38822679+SII-YDD@users.noreply.github.com>\n", "parents": ["e67c3642c8920a2a9c0e231ee2f16f50b245df31"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "SII-YDD", "email": "38822679+SII-YDD@users.noreply.github.com", "user": { "login": "SII-YDD", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "45b6a7fe8f51a89951aaa823ffa627f6f5453a33", "subject": "fix(native): distinguish proven pre-launch failure from unknown target ownership", "body": "fix(native): distinguish proven pre-launch failure from unknown target ownership\n\nEmit explicit target-creation facts only when known. Invalid post-launch process handles remain unknown and retain cleanup ownership.\n\nRefs: #3185\n\nValidation uses bridge fakes and provider-boundary tests; no real LLDB target launch was performed.\n", "parents": ["2daeff4b243e1cd137c591ca394e18a1c05c8bbc"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "3f6b5755b3e699bd9373641acffe0f2c5d2ab094", "subject": "fix(managed)!: share member list facts and retain verification uncertainty", "body": "fix(managed)!: share member list facts and retain verification uncertainty\n\nParse TypeDef member lists once at their owning boundary, retain malformed ranges as unknown, and admit representation storage before allocation. Reuse parsed facts across member ownership, inventory, attributes, and native boundaries. Preserve constant operands in structural matching.\n\nRefs: #3202, #3201, #3199\n\nBREAKING CHANGE: unresolved managed/native verification results may retain a non-null matched_native and candidate facts when module identity is unknown. Consumers must use status and reason rather than assume unresolved observations are empty.\n", "parents": ["45b6a7fe8f51a89951aaa823ffa627f6f5453a33"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "0930e94e077ab7fb4d695f62785919a8a25c2e21", "subject": "fix(setup): validate registered MCP output schema profiles", "body": "fix(setup): validate registered MCP output schema profiles\n\nReuse the shared profile schema before setup writes and preserve supported values through registration and startup.\n\nRefs: #3205, #3277\n\nCo-authored-by: PaoloValletta \n", "parents": ["3f6b5755b3e699bd9373641acffe0f2c5d2ab094"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "PaoloValletta", "email": "paovalletta@hotmail.it", "user": { "login": "paoValle", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "aade9bbcb79aa8504ab6921b25f8ab082aba78e7", "subject": "fix(setup): evaluate Gemini workspace trust before settings content", "body": "fix(setup): evaluate Gemini workspace trust before settings content\n\nTreat only ENOENT as absence. Preserve unreadable metadata errors and ignore untrusted workspace content before parsing it.\n\nRefs: #3206, #3319\n\nCo-authored-by: haoran20100322 \n", "parents": ["0930e94e077ab7fb4d695f62785919a8a25c2e21"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "haoran20100322", "email": "haoran20100322@outlook.com", "user": { "login": "CmsChase", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "ba33c706d26b63e43308be50c0249c72cff62cc6", "subject": "fix(setup): inspect installed skill identity for unqualified doctor", "body": "fix(setup): inspect installed skill identity for unqualified doctor\n\nSelect installed skill destinations in the existing inspection pass, retaining malformed or foreign identity facts while ignoring empty marker-only roots.\n\nRefs: #3208, #3296\n\nCo-authored-by: msaimshafique \n", "parents": ["aade9bbcb79aa8504ab6921b25f8ab082aba78e7"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } }, { "name": "msaimshafique", "email": "msaimshafique4664@gmail.com", "user": { "login": "sx4im", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "44d98de2367b99808d78db732ec7d72533266233", "subject": "test: align malformed XML and route seed assertions with owning contracts", "body": "test: align malformed XML and route seed assertions with owning contracts\n", "parents": ["ba33c706d26b63e43308be50c0249c72cff62cc6"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "7435e79d6524e81fc17e49469d8d284e0b569707", "subject": "test(doctor): assert platform-specific Hopper readiness and exit status", "body": "test(doctor): assert platform-specific Hopper readiness and exit status\n", "parents": ["44d98de2367b99808d78db732ec7d72533266233"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "60c08802a7b6d2195121114a9e4224492f138185", "subject": "test(native): validate demangling through owned contracts", "body": "test(native): validate demangling through owned contracts\n", "parents": ["7435e79d6524e81fc17e49469d8d284e0b569707"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "a32b4b6ac54a02a8fe9a7cb62861e54473ba5eb0", "subject": "test(ci): correct Rizin readiness and Hopper launcher fixtures (#3299)", "body": "test(ci): correct Rizin readiness and Hopper launcher fixtures (#3299)\n\nCorrect two independently reproduced CI fixture preconditions: close the real Rizin child's stdin before its readiness frame, and provide scoped Linux loader evidence for the Hopper doctor shell fixture. Preserve original timeouts, rejection checks, path spelling, launch prevention and cleanup.\n\nCurrent-head CI passed, including both complete reverse-tools mutation passes and 1,273 unique portable test files (14,521 passed, 126 skipped, zero failures). Each issue retains its own branch/commit; the validated integration tree includes the Hopper fix from #3410. That duplicate PR can close after the same code is verified on main.\n\nFixes #3295\nFixes #3406\n\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>", "parents": ["60c08802a7b6d2195121114a9e4224492f138185"], "authors": [ { "name": "Ysopwnable", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } } ], "pullRequests": [3299] }, { "sha": "efe0923914312487e790f059837f6f89eefce16f", "subject": "fix(release): exclude Codex automation from contributor thanks", "body": "fix(release): exclude Codex automation from contributor thanks\n", "parents": ["a32b4b6ac54a02a8fe9a7cb62861e54473ba5eb0"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "c2b79aa462af6a7eaff26124f39473417f2a5ff0", "subject": "test(doctor): separate Hopper availability and version assertions", "body": "test(doctor): separate Hopper availability and version assertions\n", "parents": ["efe0923914312487e790f059837f6f89eefce16f"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "0686b07546d0e2bdc01ff936c5ba7678b045bece", "subject": "test(doctor): retain discovered Hopper paths despite version failures", "body": "test(doctor): retain discovered Hopper paths despite version failures\n", "parents": ["c2b79aa462af6a7eaff26124f39473417f2a5ff0"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "f75b1a416ba67b8421e7dbd248160afedb79581f", "subject": "test(browser): retain bounded diagnostics for scenario policy failures", "body": "test(browser): retain bounded diagnostics for scenario policy failures\n", "parents": ["0686b07546d0e2bdc01ff936c5ba7678b045bece"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "1b463987959815842c99920b5801358252af19a4", "subject": "perf(ci): preflight mutation configurations during fast feedback", "body": "perf(ci): preflight mutation configurations during fast feedback\n\nKeep full qualification and standalone mutation execution intact, retain distinct reports, and preserve fail-closed quality gates.\n\nRelated: #3281\n\nCo-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>\n", "parents": ["f75b1a416ba67b8421e7dbd248160afedb79581f"], "authors": [ { "name": "N0zoM1z0", "email": "161784452+N0zoM1z0@users.noreply.github.com", "user": { "login": "N0zoM1z0", "__typename": "User" } }, { "name": "Kaoru0822", "email": "208281322+kaoru0822-kitauji@users.noreply.github.com", "user": { "login": "kaoru0822-kitauji", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "92a0edf1875f74528910db461ed03f782b7b59b3", "subject": "perf(ci): move full mutation sweeps off the release path", "body": "perf(ci): move full mutation sweeps off the release path\n\nKeep fresh coverage and both real mutation preflights required in every CI tier. Run complete canonical sweeps daily or manually in isolated jobs with distinct reports, retained failure diagnostics, and explicit report-presence checks.\n\nPreserve regression inventories, release qualification and mutation settings; remove the superseded duplicate gate test. Related: #3281.\n", "parents": ["1b463987959815842c99920b5801358252af19a4"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] }, { "sha": "cbc0e97c29b8dcb3d6ff96eb3af9e0f519a22345", "subject": "test(ci): bind npm cache IDs to output consumers", "body": "test(ci): bind npm cache IDs to output consumers\n\nRemove the blanket caller ID requirement that rejected the standalone mutation workflow. Keep producer bindings where static cache authorization and package verification consume action outputs.\n", "parents": ["92a0edf1875f74528910db461ed03f782b7b59b3"], "authors": [ { "name": "morluto", "email": "76467478+morluto@users.noreply.github.com", "user": { "login": "morluto", "__typename": "User" } } ], "pullRequests": [] } ], "pullRequests": [ { "number": 1359, "title": "feat: add Frida instrumentation support", "url": "https://github.com/morluto/rea/pull/1359", "author": { "login": "dandgabr", "__typename": "User" }, "mergeCommit": { "oid": "4a4ae9b2b9712f7ac16f2d23c71b5c29b0c23d2f" }, "issues": [] }, { "number": 1363, "title": "feat(go): inspect embedded binary build metadata", "url": "https://github.com/morluto/rea/pull/1363", "author": { "login": "Y0UW1SH", "__typename": "User" }, "mergeCommit": { "oid": "a1b5d51a8dfb7fff6272d91270c16b95555c2643" }, "issues": [] }, { "number": 1394, "title": "test(native): skip the EACCES directory diagnostic as root", "url": "https://github.com/morluto/rea/pull/1394", "author": { "login": "marnixpluim", "__typename": "User" }, "mergeCommit": { "oid": "40d9c7b836a3aca5d589c0a65c7d02b3ea5cd36b" }, "issues": [] }, { "number": 1447, "title": "feat(harmony): project HarmonyOS package inventory evidence", "url": "https://github.com/morluto/rea/pull/1447", "author": { "login": "BaaRai", "__typename": "User" }, "mergeCommit": { "oid": "f2150eb9a7ed76748238009ca6666efa52de5271" }, "issues": [] }, { "number": 1533, "title": "feat(wasm): inspect local artifacts with WABT", "url": "https://github.com/morluto/rea/pull/1533", "author": { "login": "thangldw", "__typename": "User" }, "mergeCommit": { "oid": "ffaf2c12f1793c7c451e66dc09c3074544a4c086" }, "issues": [ { "number": 884, "url": "https://github.com/morluto/rea/issues/884", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1544, "title": "feat(ida): support optional native IDA Free MCP in attached mode", "url": "https://github.com/morluto/rea/pull/1544", "author": { "login": "imissapixel", "__typename": "User" }, "mergeCommit": { "oid": "d1aaeee400e0d9911d5c53339ca3ac42dccbbba3" }, "issues": [] }, { "number": 1564, "title": "feat(clients): register ZCode during setup", "url": "https://github.com/morluto/rea/pull/1564", "author": { "login": "IvenKooLab", "__typename": "User" }, "mergeCommit": { "oid": "51d6c87cdbf5f11eaf3cb1862befe704a81827c5" }, "issues": [] }, { "number": 1572, "title": "feat(clients): register Qoder CLI during setup", "url": "https://github.com/morluto/rea/pull/1572", "author": { "login": "IvenKooLab", "__typename": "User" }, "mergeCommit": { "oid": "109769319a4a3a5f85e8a43bb419d04aefff66a4" }, "issues": [] }, { "number": 1573, "title": "feat(clients): register Trae during setup", "url": "https://github.com/morluto/rea/pull/1573", "author": { "login": "IvenKooLab", "__typename": "User" }, "mergeCommit": { "oid": "bfa805decf83744bd3ecb0d1402667cf3ed5c3b2" }, "issues": [] }, { "number": 1582, "title": "feat(flutter): identify Dart snapshot builds and inspect AOT payloads by pure APK parsing", "url": "https://github.com/morluto/rea/pull/1582", "author": { "login": "3QL", "__typename": "User" }, "mergeCommit": { "oid": "e4d3e1399d9cd4932653e7015a1bf8589e56029d" }, "issues": [] }, { "number": 1584, "title": "test(native): skip the DMG EACCES diagnostic as root", "url": "https://github.com/morluto/rea/pull/1584", "author": { "login": "rekcilyssup", "__typename": "User" }, "mergeCommit": { "oid": "262efe6c54d8f179e9f9515d96025871ae45806a" }, "issues": [] }, { "number": 1599, "title": "feat(ghidra): admit bounded PSP ELF through installed Allegrex", "url": "https://github.com/morluto/rea/pull/1599", "author": { "login": "jaelliot", "__typename": "User" }, "mergeCommit": { "oid": "e4407dbed5dc24851f47532f5e3d75d5627d3e7d" }, "issues": [] }, { "number": 1628, "title": "docs(hopper): clarify lease directory recovery guidance", "url": "https://github.com/morluto/rea/pull/1628", "author": { "login": "Sunil56224972", "__typename": "User" }, "mergeCommit": { "oid": "d901561640121272bf1498d85e38e1ac8b3f5793" }, "issues": [] }, { "number": 1668, "title": "test(ci): stabilize JADX recovery and ignore generated reports", "url": "https://github.com/morluto/rea/pull/1668", "author": { "login": "Y0UW1SH", "__typename": "User" }, "mergeCommit": { "oid": "0a6b46d5b0299f76c0d268f7b70395f9b6fbd68e" }, "issues": [] }, { "number": 1686, "title": "feat(javascript): recover code-split bundles from multiple inputs", "url": "https://github.com/morluto/rea/pull/1686", "author": { "login": "JingHao-Leon", "__typename": "User" }, "mergeCommit": { "oid": "12c416005f9d2abf438f4df4447972424d781b65" }, "issues": [ { "number": 1605, "url": "https://github.com/morluto/rea/issues/1605", "author": { "login": "pionxzh", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1691, "title": "perf(mcp): keep Playwright and type-only imports off MCP startup", "url": "https://github.com/morluto/rea/pull/1691", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "0ecf3f2438ec96a6b543942869808018e8d84452" }, "issues": [ { "number": 1685, "url": "https://github.com/morluto/rea/issues/1685", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1694, "title": "perf(evidence): fuse streamed JSON token handling", "url": "https://github.com/morluto/rea/pull/1694", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "13e03e94363a007353fcb5dfedec764de12fc927" }, "issues": [] }, { "number": 1698, "title": "fix(ghidra): keep JVM warnings out of LaunchSupport output", "url": "https://github.com/morluto/rea/pull/1698", "author": { "login": "Petru101", "__typename": "User" }, "mergeCommit": { "oid": "e20994a8ea10609d420e958bd8a1268b0bcd8899" }, "issues": [] }, { "number": 1699, "title": "style(website): kbd, install-node width and nested collapsible indentation", "url": "https://github.com/morluto/rea/pull/1699", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "4353089c670070ef918f88f7b131ed240feb83dd" }, "issues": [] }, { "number": 1700, "title": "fix(process): observe already-due trailing callbacks before settling the capture journal", "url": "https://github.com/morluto/rea/pull/1700", "author": { "login": "JasonBuildAI", "__typename": "User" }, "mergeCommit": { "oid": "ed084b3dbb13ec9dee1adc8f5b76e784b52c00bb" }, "issues": [ { "number": 1697, "url": "https://github.com/morluto/rea/issues/1697", "author": { "login": "JasonBuildAI", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1703, "title": "fix(native): raise default PE resource entry budget to 16384", "url": "https://github.com/morluto/rea/pull/1703", "author": { "login": "JasonBuildAI", "__typename": "User" }, "mergeCommit": { "oid": "951c2aae3be1c357df9f23558d8c09680e64c2cb" }, "issues": [ { "number": 1702, "url": "https://github.com/morluto/rea/issues/1702", "author": { "login": "JasonBuildAI", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1705, "title": "fix(mcp): express inspect_analysis_view selector constraints in the contract schema", "url": "https://github.com/morluto/rea/pull/1705", "author": { "login": "sx4im", "__typename": "User" }, "mergeCommit": { "oid": "a8a9c4d8173b63fb42d343a8ca043927970ea4ce" }, "issues": [ { "number": 1695, "url": "https://github.com/morluto/rea/issues/1695", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1706, "title": "feat(managed): select declaring types in inspect_managed_members", "url": "https://github.com/morluto/rea/pull/1706", "author": { "login": "skoodster", "__typename": "User" }, "mergeCommit": { "oid": "a149d183efd08b0ad7c2a35c99f2394d905621d5" }, "issues": [] }, { "number": 1707, "title": "perf(domain): avoid duplicate readiness bundle validation", "url": "https://github.com/morluto/rea/pull/1707", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "29ff887f6558cf00c0d6392889b890ed8a702a6f" }, "issues": [] }, { "number": 1708, "title": "fix(native): retain failed pwntools process and runtime cleanup", "url": "https://github.com/morluto/rea/pull/1708", "author": { "login": "1NormalGuy", "__typename": "User" }, "mergeCommit": { "oid": "11fe5a13f8aee87d0c0e036a9f497407e085fe48" }, "issues": [] }, { "number": 1709, "title": "fix(native): honor Mach-O chained pointer locations and library ordinals", "url": "https://github.com/morluto/rea/pull/1709", "author": { "login": "1NormalGuy", "__typename": "User" }, "mergeCommit": { "oid": "3b0ea590fcc876fa017946f4cec009d653f02b38" }, "issues": [] }, { "number": 1713, "title": "fix(native): retain failed command cleanup owners", "url": "https://github.com/morluto/rea/pull/1713", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "d9b4ae182d60dfd7fd5ba5bb539716413cbfdca6" }, "issues": [] }, { "number": 1714, "title": "docs(website): highlight the setup guide on the homepage", "url": "https://github.com/morluto/rea/pull/1714", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "8be7ad496c9a52a9986c4d3f6596de279b52df7e" }, "issues": [] }, { "number": 1715, "title": "feat(native): expose typed incoming references at exact addresses", "url": "https://github.com/morluto/rea/pull/1715", "author": { "login": "bugstan", "__typename": "User" }, "mergeCommit": { "oid": "cdd9fe716774c9e5abd121b70e9fd5e1eb91d2b8" }, "issues": [ { "number": 1245, "url": "https://github.com/morluto/rea/issues/1245", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1716, "title": "perf(snapshot): restore large legacy caches within live memory bounds", "url": "https://github.com/morluto/rea/pull/1716", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "092de8f4b336b537579bd48d7d30135b7114371d" }, "issues": [ { "number": 1680, "url": "https://github.com/morluto/rea/issues/1680", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1721, "title": "perf(evidence): reuse authenticated file snapshots during session import", "url": "https://github.com/morluto/rea/pull/1721", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "966dc3acde2880a0f94b2658e2a02180d505cafa" }, "issues": [ { "number": 1718, "url": "https://github.com/morluto/rea/issues/1718", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1726, "title": "fix(artifacts): preserve emitted ZIP entry identity", "url": "https://github.com/morluto/rea/pull/1726", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "e36c82becdd613787bcc59903f8b5fe14eb2f105" }, "issues": [ { "number": 1725, "url": "https://github.com/morluto/rea/issues/1725", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1730, "title": "fix(bun): report the real runtime and enforce worker memory budgets on Windows", "url": "https://github.com/morluto/rea/pull/1730", "author": { "login": "xeropresence", "__typename": "User" }, "mergeCommit": { "oid": "66c21572defc97fe277cad49d3173bd4073d1f58" }, "issues": [] }, { "number": 1731, "title": "fix(setup): register a stable launcher when run through bunx", "url": "https://github.com/morluto/rea/pull/1731", "author": { "login": "xeropresence", "__typename": "User" }, "mergeCommit": { "oid": "d412def7225a556e6d2140176dc9ab4bd34af0f3" }, "issues": [] }, { "number": 1733, "title": "fix(evidence): normalize unknown revisions and preserve mutation intent", "url": "https://github.com/morluto/rea/pull/1733", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "21650455a9c90a26e725c3505a3c17054cc4516c" }, "issues": [ { "number": 1723, "url": "https://github.com/morluto/rea/issues/1723", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } }, { "number": 1724, "url": "https://github.com/morluto/rea/issues/1724", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1734, "title": "fix(evaluation): authenticate delivered Evidence citations", "url": "https://github.com/morluto/rea/pull/1734", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "844fa52772c1533f7358a71a764da780503775a3" }, "issues": [ { "number": 1728, "url": "https://github.com/morluto/rea/issues/1728", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1735, "title": "feat(update): update Bun global installations", "url": "https://github.com/morluto/rea/pull/1735", "author": { "login": "xeropresence", "__typename": "User" }, "mergeCommit": { "oid": "e4027e4afccc6316cd9cfc27c7b0427e66ceb91f" }, "issues": [] }, { "number": 1739, "title": "test(evidence): cover workflow question whitespace normalization", "url": "https://github.com/morluto/rea/pull/1739", "author": { "login": "014-code", "__typename": "User" }, "mergeCommit": { "oid": "b2da21abe11ac43a4cc24b233bd52ce10995e4a1" }, "issues": [] }, { "number": 1740, "title": "fix(javascript): report JSON status for imported package manifests", "url": "https://github.com/morluto/rea/pull/1740", "author": { "login": "immanuwell", "__typename": "User" }, "mergeCommit": { "oid": "914ba833ded5f8604345de4e4f6d306de0a38c4e" }, "issues": [] }, { "number": 1742, "title": "fix(browser): retain effective source-map response urls", "url": "https://github.com/morluto/rea/pull/1742", "author": { "login": "evenafterallisaid", "__typename": "User" }, "mergeCommit": { "oid": "062723e44e937c1e1df865e9ae16184b41e70ae8" }, "issues": [ { "number": 1729, "url": "https://github.com/morluto/rea/issues/1729", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1743, "title": "fix(managed): distinguish .NET Standard targets from runtimes", "url": "https://github.com/morluto/rea/pull/1743", "author": { "login": "ac1982", "__typename": "User" }, "mergeCommit": { "oid": "81dc64e3cd13dc8bfcac8898386717ece9721da1" }, "issues": [ { "number": 1736, "url": "https://github.com/morluto/rea/issues/1736", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1747, "title": "feat(ghidra): admit 32-bit big-endian PowerPC ELF", "url": "https://github.com/morluto/rea/pull/1747", "author": { "login": "arielfikru", "__typename": "User" }, "mergeCommit": { "oid": "c86b09a1095ffd360cd8851ff20a7b6aeb19b198" }, "issues": [] }, { "number": 1749, "title": "fix(mcp): keep advertised inputs within client reference budgets", "url": "https://github.com/morluto/rea/pull/1749", "author": { "login": "akushonkamen", "__typename": "User" }, "mergeCommit": { "oid": "d86d29c41108cc5d784e324c6cbe50beac70a543" }, "issues": [ { "number": 1632, "url": "https://github.com/morluto/rea/issues/1632", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1752, "title": "docs: celebrate 80,000 GitHub stars 🎉", "url": "https://github.com/morluto/rea/pull/1752", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "6ff4d4a0500e5f9fb7601e1c5ae5dbbd85796d91" }, "issues": [] }, { "number": 1754, "title": "fix(setup): preserve unrelated Hermes YAML line formatting", "url": "https://github.com/morluto/rea/pull/1754", "author": { "login": "zaydiscold", "__typename": "User" }, "mergeCommit": { "oid": "58e91e14bd5659dd57acbb91e56b5fc6a6963c80" }, "issues": [] }, { "number": 1755, "title": "fix(mcp): cancel evidence imports before session mutation", "url": "https://github.com/morluto/rea/pull/1755", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "e5699d23b173bbd0b68e3ab177d0b7583d6df345" }, "issues": [ { "number": 1746, "url": "https://github.com/morluto/rea/issues/1746", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1756, "title": "fix(process): aggregate incomplete trace-spec diagnostics", "url": "https://github.com/morluto/rea/pull/1756", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "857a1b7b04da4488db2b224c270ad78998c6b6c7" }, "issues": [ { "number": 1753, "url": "https://github.com/morluto/rea/issues/1753", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1758, "title": "docs(i18n): celebrate 80,000 GitHub stars in translated READMEs", "url": "https://github.com/morluto/rea/pull/1758", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "953a0ce5bd3a8b44051eb9c16d8c9a20cad29e7c" }, "issues": [] }, { "number": 1759, "title": "fix(javascript): index repeated graph observations before final sorting", "url": "https://github.com/morluto/rea/pull/1759", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "6d5d71fab5e135c687f7aa2f797da19b4c2a1c1e" }, "issues": [ { "number": 1748, "url": "https://github.com/morluto/rea/issues/1748", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1760, "title": "fix(process): align capture Evidence provider admission", "url": "https://github.com/morluto/rea/pull/1760", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "713db4dc2665c964707cb0e937e8794cbe73534e" }, "issues": [ { "number": 1757, "url": "https://github.com/morluto/rea/issues/1757", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1762, "title": "fix(javascript): honor package exports before sibling files", "url": "https://github.com/morluto/rea/pull/1762", "author": { "login": "shoyann", "__typename": "User" }, "mergeCommit": { "oid": "3ad5782dfdc8864879a887dc63fef682ffeb5839" }, "issues": [ { "number": 1761, "url": "https://github.com/morluto/rea/issues/1761", "author": { "login": "shoyann", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1763, "title": "fix(hopper): let failed one-shot commands exit while retaining a lease", "url": "https://github.com/morluto/rea/pull/1763", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "e8528cedcdfb1ca1d769304afdc353936e8e0d70" }, "issues": [ { "number": 1751, "url": "https://github.com/morluto/rea/issues/1751", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1764, "title": "fix(ida): declare GUI navigation for attached legacy analysis", "url": "https://github.com/morluto/rea/pull/1764", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "cf692072b56903b60426e4b301b3c48fd31ee0fd" }, "issues": [ { "number": 1712, "url": "https://github.com/morluto/rea/issues/1712", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1767, "title": "fix(javascript): bound self-alias mutation paths that never prune", "url": "https://github.com/morluto/rea/pull/1767", "author": { "login": "flitzrrr", "__typename": "User" }, "mergeCommit": { "oid": "e365f3715f0e9856218f0b2878bfe2144c821d9a" }, "issues": [] }, { "number": 1768, "title": "fix(managed): charge retained member facts instead of decoding bounds", "url": "https://github.com/morluto/rea/pull/1768", "author": { "login": "flitzrrr", "__typename": "User" }, "mergeCommit": { "oid": "30787297d49bf93e67f62a9ec42f896188d57a20" }, "issues": [] }, { "number": 1770, "title": "fix(reference): report sloppy scripts, PHP, C# and enclosing Git facts", "url": "https://github.com/morluto/rea/pull/1770", "author": { "login": "flitzrrr", "__typename": "User" }, "mergeCommit": { "oid": "7b15762d09acf3d4ffb937f55ec1b54e7db5fbfa" }, "issues": [] }, { "number": 1772, "title": "fix(apple): preserve slice identity and macOS boundary diagnostics", "url": "https://github.com/morluto/rea/pull/1772", "author": { "login": "dhl84", "__typename": "User" }, "mergeCommit": { "oid": "5c2956587a1b0d431f72e10df07a1a6363fa066c" }, "issues": [ { "number": 1765, "url": "https://github.com/morluto/rea/issues/1765", "author": { "login": "dhl84", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1773, "title": "fix(cli): retry retained browser scenario cleanup", "url": "https://github.com/morluto/rea/pull/1773", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "4daea941bfeeb426886f2d048aed7f3cb2dbf97b" }, "issues": [ { "number": 1771, "url": "https://github.com/morluto/rea/issues/1771", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1776, "title": "fix(session): verify retained client liveness on open fast path", "url": "https://github.com/morluto/rea/pull/1776", "author": { "login": "sx4im", "__typename": "User" }, "mergeCommit": { "oid": "e59db2f5deefb1c5e74f01e19631f6d75cfaa25a" }, "issues": [] }, { "number": 1777, "title": "fix(apktool): run Windows batch launchers through cmd.exe", "url": "https://github.com/morluto/rea/pull/1777", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "ae95e68ba5fa95cf2ec0453b50ffd217cabf5359" }, "issues": [ { "number": 1774, "url": "https://github.com/morluto/rea/issues/1774", "author": { "login": "psipher", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1778, "title": "fix(ida): wait out a transient busy worker health in headless sessions", "url": "https://github.com/morluto/rea/pull/1778", "author": { "login": "nikolay-dementiev", "__typename": "User" }, "mergeCommit": { "oid": "0bdc7a40ac171a05971b287f2aab0376e2f14358" }, "issues": [ { "number": 1766, "url": "https://github.com/morluto/rea/issues/1766", "author": { "login": "nikolay-dementiev", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1779, "title": "feat(website): add maintained multilingual editions", "url": "https://github.com/morluto/rea/pull/1779", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "6e38529333a7a0704690a087c7cb054fb7385d25" }, "issues": [ { "number": 1022, "url": "https://github.com/morluto/rea/issues/1022", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1780, "title": "fix(cli): await browser scenario cleanup on interrupts", "url": "https://github.com/morluto/rea/pull/1780", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "aaeadf2d4c4e3f0d0581af2dca33c5bfdc2bcb0e" }, "issues": [] }, { "number": 1784, "title": "fix(apple): validate build-version tool records within cmdsize", "url": "https://github.com/morluto/rea/pull/1784", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "817aef406861c2ce3f87ad3c912ea6c235bcdf12" }, "issues": [ { "number": 1775, "url": "https://github.com/morluto/rea/issues/1775", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1785, "title": "fix(ida): report a procedure IDA cannot resolve as invalid input", "url": "https://github.com/morluto/rea/pull/1785", "author": { "login": "nikolay-dementiev", "__typename": "User" }, "mergeCommit": { "oid": "d3e9ee5505251f760666bb8e1e6c295b6d6aedb2" }, "issues": [ { "number": 1769, "url": "https://github.com/morluto/rea/issues/1769", "author": { "login": "nikolay-dementiev", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1788, "title": "fix(javascript): preserve and resolve complete source-map URLs", "url": "https://github.com/morluto/rea/pull/1788", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "ce845ba428e9b23d6b74eae1e25e17c37532adac" }, "issues": [ { "number": 1781, "url": "https://github.com/morluto/rea/issues/1781", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } }, { "number": 1782, "url": "https://github.com/morluto/rea/issues/1782", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1789, "title": "perf(javascript): skip the repeated-prefix scan on first capture visits", "url": "https://github.com/morluto/rea/pull/1789", "author": { "login": "flitzrrr", "__typename": "User" }, "mergeCommit": { "oid": "41544fb952aef84fcf6ff5d9a5284cf2b2985053" }, "issues": [] }, { "number": 1790, "title": "chore(scripts): merge duplicate node:fs import in scan-todos", "url": "https://github.com/morluto/rea/pull/1790", "author": { "login": "Nik1313132", "__typename": "User" }, "mergeCommit": { "oid": "a077e81becd430708e8e273484c503108c5613db" }, "issues": [] }, { "number": 1799, "title": "fix(javascript): retain unbound CommonJS semantic imports", "url": "https://github.com/morluto/rea/pull/1799", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "3a17882cc469515e562df9ecc7d154f30a5a9205" }, "issues": [ { "number": 1793, "url": "https://github.com/morluto/rea/issues/1793", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1807, "title": "fix(build): preserve LF text checkouts on Windows", "url": "https://github.com/morluto/rea/pull/1807", "author": { "login": "CmsChase", "__typename": "User" }, "mergeCommit": { "oid": "031d7781f0f6c99e5f14e67f56cb89a88d6af3eb" }, "issues": [] }, { "number": 1809, "title": "fix(build): preserve resource controls in strict Turbo tasks", "url": "https://github.com/morluto/rea/pull/1809", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "2e223300375101558f90b6e78ef9612c55626673" }, "issues": [ { "number": 1805, "url": "https://github.com/morluto/rea/issues/1805", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1814, "title": "perf(mcp): reduce Windows startup module resolution", "url": "https://github.com/morluto/rea/pull/1814", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "76e4153d346b14ef194222bbeef240cf8a16dc99" }, "issues": [] }, { "number": 1817, "title": "fix(hopper): preserve startup failures and recover denied launches", "url": "https://github.com/morluto/rea/pull/1817", "author": { "login": "morluto", "__typename": "User" }, "mergeCommit": { "oid": "069308bbe6d73b1d87038b43c9121658325042a9" }, "issues": [] }, { "number": 1821, "title": "fix(setup): retain symlinked data roots during uninstall", "url": "https://github.com/morluto/rea/pull/1821", "author": { "login": "shoyann", "__typename": "User" }, "mergeCommit": { "oid": "7e2f79ab45a23ab844f89fb93c9cdf202230c73f" }, "issues": [ { "number": 1816, "url": "https://github.com/morluto/rea/issues/1816", "author": { "login": "shoyann", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1822, "title": "fix(managed): bound transient CIL by decoded instruction count", "url": "https://github.com/morluto/rea/pull/1822", "author": { "login": "jhuang-tw", "__typename": "User" }, "mergeCommit": { "oid": "554cb45f7ff967884c9d1fdf706c20803d76a6df" }, "issues": [ { "number": 1801, "url": "https://github.com/morluto/rea/issues/1801", "author": { "login": "Nelglor", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1823, "title": "fix(artifacts): mark Windows host executables by extension", "url": "https://github.com/morluto/rea/pull/1823", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "91f843bf38b0e4ec8576f41f3140488b4ee8ff32" }, "issues": [ { "number": 1819, "url": "https://github.com/morluto/rea/issues/1819", "author": { "login": "JasonBuildAI", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1824, "title": "fix(artifacts): mark Windows launchable files as host executables", "url": "https://github.com/morluto/rea/pull/1824", "author": { "login": "dollarsmoney", "__typename": "User" }, "mergeCommit": { "oid": "e8491e023a255f790ae9850225084d7495e9ade0" }, "issues": [ { "number": 1819, "url": "https://github.com/morluto/rea/issues/1819", "author": { "login": "JasonBuildAI", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1826, "title": "fix(windows): retain failed native inspection ownership", "url": "https://github.com/morluto/rea/pull/1826", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "0b4ce83618bb800627264ae6221e2e35140417b5" }, "issues": [] }, { "number": 1827, "title": "fix(javascript): follow bundler namespace interop for Electron APIs", "url": "https://github.com/morluto/rea/pull/1827", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "6ac5c36503492d3b6da4fcf2a5dee87aff60fc8c" }, "issues": [ { "number": 1802, "url": "https://github.com/morluto/rea/issues/1802", "author": { "login": "Nelglor", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1828, "title": "fix(managed): report ExportedType rows in managed member inspection", "url": "https://github.com/morluto/rea/pull/1828", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "ed1519ddee02739f57136e356786f64c7f74fed0" }, "issues": [ { "number": 1812, "url": "https://github.com/morluto/rea/issues/1812", "author": { "login": "JasonBuildAI", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1829, "title": "perf(browser): parse captured module URLs once per lookup", "url": "https://github.com/morluto/rea/pull/1829", "author": { "login": "shayanxcyber", "__typename": "User" }, "mergeCommit": { "oid": "ca11162d027a0d3e3b5a65a54825b00d5689fb80" }, "issues": [] }, { "number": 1833, "title": "fix(javascript): preserve namespace re-export relationships", "url": "https://github.com/morluto/rea/pull/1833", "author": { "login": "shoyann", "__typename": "User" }, "mergeCommit": { "oid": "37a9eb9d65a088209f962e5094f6bc67eacbbaf9" }, "issues": [ { "number": 1831, "url": "https://github.com/morluto/rea/issues/1831", "author": { "login": "shoyann", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1834, "title": "test(web): cover nullable HTTP captures through CDP and CLI", "url": "https://github.com/morluto/rea/pull/1834", "author": { "login": "shoyann", "__typename": "User" }, "mergeCommit": { "oid": "5d12a0b4b6137f025d9aa88cf001dc2a68c28b8a" }, "issues": [] }, { "number": 1835, "title": "fix(managed): decode generic, array, fnptr, and modifier signatures", "url": "https://github.com/morluto/rea/pull/1835", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "1f531fc257f71731624cbd6b595208adacf59108" }, "issues": [ { "number": 1832, "url": "https://github.com/morluto/rea/issues/1832", "author": { "login": "JasonBuildAI", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1841, "title": "fix(ida): let one-shot commands exit after retaining cleanup", "url": "https://github.com/morluto/rea/pull/1841", "author": { "login": "AS9929", "__typename": "User" }, "mergeCommit": { "oid": "5dd2ce3125b0c7918bffe99011ccacbba6592853" }, "issues": [] }, { "number": 1843, "title": "fix(plist): decode formatted XML dictionary keys", "url": "https://github.com/morluto/rea/pull/1843", "author": { "login": "Aliciawque", "__typename": "User" }, "mergeCommit": { "oid": "928b4d5fe4523e3226aeb865f105e3f711bc8ed3" }, "issues": [] }, { "number": 1845, "title": "fix(ida): retain private input after ambiguous open", "url": "https://github.com/morluto/rea/pull/1845", "author": { "login": "jhuang-tw", "__typename": "User" }, "mergeCommit": { "oid": "4ea24f97670bebf8ca053179ca0dc5009e6f6a28" }, "issues": [] }, { "number": 1854, "title": "fix(artifacts): count a changed partial-inventory root once", "url": "https://github.com/morluto/rea/pull/1854", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "ee5275cd9fae8db64f945a0c8b59e1c19ac402c3" }, "issues": [ { "number": 1844, "url": "https://github.com/morluto/rea/issues/1844", "author": { "login": "Bortlesboat", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1857, "title": "fix(javascript): prove namespace interop before attributing Electron APIs", "url": "https://github.com/morluto/rea/pull/1857", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "9b3e59804db71072ed023f109342f96063c57b45" }, "issues": [ { "number": 1842, "url": "https://github.com/morluto/rea/issues/1842", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1858, "title": "docs: celebrate 90,000 GitHub stars 🎉", "url": "https://github.com/morluto/rea/pull/1858", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "5876779013726964deef748120c48f5fa0155546" }, "issues": [] }, { "number": 1861, "title": "docs: sync French, Indonesian and Italian READMEs with English", "url": "https://github.com/morluto/rea/pull/1861", "author": { "login": "peter-research", "__typename": "User" }, "mergeCommit": { "oid": "96547d373fcdc672058b29774d6c634f4e9cc1bd" }, "issues": [] }, { "number": 1862, "title": "feat(javascript): resolve exact package import aliases", "url": "https://github.com/morluto/rea/pull/1862", "author": { "login": "mvanhorn", "__typename": "User" }, "mergeCommit": { "oid": "d28b41ea4e93bb4c4d360a3bf2291ca83bb2b378" }, "issues": [ { "number": 1838, "url": "https://github.com/morluto/rea/issues/1838", "author": { "login": "AWUQAQ", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1863, "title": "fix(windows): bring the real Windows Ghidra verifiers up to date", "url": "https://github.com/morluto/rea/pull/1863", "author": { "login": "pablodiazjorge", "__typename": "User" }, "mergeCommit": { "oid": "ea40f717b26392000f989a8b500f6774b5e85091" }, "issues": [ { "number": 1859, "url": "https://github.com/morluto/rea/issues/1859", "author": { "login": "pablodiazjorge", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1865, "title": "fix(artifacts): preserve physical ZIP member identities", "url": "https://github.com/morluto/rea/pull/1865", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "bcd350c365030a5d210208c0a8dc238302c43303" }, "issues": [ { "number": 1860, "url": "https://github.com/morluto/rea/issues/1860", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1866, "title": "fix(hopper): wait for late bridges during cleanup", "url": "https://github.com/morluto/rea/pull/1866", "author": { "login": "morluto", "__typename": "User" }, "mergeCommit": { "oid": "cf7477eb4642bc07228fa33ccc4c87656e6e3003" }, "issues": [] }, { "number": 1867, "title": "fix: order remaining outputs independently of host locale", "url": "https://github.com/morluto/rea/pull/1867", "author": { "login": "dollarsmoney", "__typename": "User" }, "mergeCommit": { "oid": "e4ac7bbfc2f8c631ba1c60f507d85253e122d4c8" }, "issues": [] }, { "number": 1868, "title": "feat(native): admit raw binaries with caller-supplied architecture and entry", "url": "https://github.com/morluto/rea/pull/1868", "author": { "login": "mvanhorn", "__typename": "User" }, "mergeCommit": { "oid": "7c207c79512f6baa70f4ed9d7d5334ab2d62f3ac" }, "issues": [ { "number": 1836, "url": "https://github.com/morluto/rea/issues/1836", "author": { "login": "casesolved-co-uk", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1869, "title": "fix(errors): stop recommending retries for non-retryable failures", "url": "https://github.com/morluto/rea/pull/1869", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "fb94d9dde0ccda83ae520ac6fb22b1d283562cf3" }, "issues": [ { "number": 1855, "url": "https://github.com/morluto/rea/issues/1855", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1871, "title": "perf(javascript): skip nested callables during fingerprint traversal", "url": "https://github.com/morluto/rea/pull/1871", "author": { "login": "cyanseek", "__typename": "User" }, "mergeCommit": { "oid": "097f0d54afceb3ce61dbaa24dd6736658d1fce06" }, "issues": [] }, { "number": 1872, "title": "feat(target): explain static WASM inspection after native rejection", "url": "https://github.com/morluto/rea/pull/1872", "author": { "login": "SII-YDD", "__typename": "User" }, "mergeCommit": { "oid": "1f17ac82282dfda1ae2dc87d99e66a8a039c0259" }, "issues": [] }, { "number": 1873, "title": "fix(evidence): reject NUL bytes in subject and snapshot paths", "url": "https://github.com/morluto/rea/pull/1873", "author": { "login": "DeryFerd", "__typename": "User" }, "mergeCommit": { "oid": "fa9a7e5ec026c5a4e8426f0f36c2c4555be9c9f0" }, "issues": [] }, { "number": 1874, "title": "fix(javascript): trace wrapped Electron IPC paths in large bundles", "url": "https://github.com/morluto/rea/pull/1874", "author": { "login": "fengdwx", "__typename": "User" }, "mergeCommit": { "oid": "87b9793c53caf70a9f3a516214856899ca2d7cf8" }, "issues": [] }, { "number": 1876, "title": "fix(android): preserve executable static initializer evidence", "url": "https://github.com/morluto/rea/pull/1876", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "efbc25fbea1b6ade2a284a4916644c791f83bf49" }, "issues": [ { "number": 1846, "url": "https://github.com/morluto/rea/issues/1846", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1877, "title": "fix(ghidra): report progress while startup is pending", "url": "https://github.com/morluto/rea/pull/1877", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "29d2624b3475586356c27f518bf6b823030268fb" }, "issues": [] }, { "number": 1879, "title": "fix(firmware): name missing extractor dependencies in partial extraction", "url": "https://github.com/morluto/rea/pull/1879", "author": { "login": "DeryFerd", "__typename": "User" }, "mergeCommit": { "oid": "176941700118cc33c86e07373cd6950f30548386" }, "issues": [ { "number": 1853, "url": "https://github.com/morluto/rea/issues/1853", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1885, "title": "fix(test): wait for Hopper reconnect listener readiness", "url": "https://github.com/morluto/rea/pull/1885", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "d3e83b089943e2941dace3546a068a59bd0a335e" }, "issues": [] }, { "number": 1886, "title": "fix(managed): resolve member ownership through pointer tables", "url": "https://github.com/morluto/rea/pull/1886", "author": { "login": "chqcjq", "__typename": "User" }, "mergeCommit": { "oid": "a95795c6ed3cb149e03460f4c818ad12e0c670d9" }, "issues": [] }, { "number": 1890, "title": "fix(android): bound inline search Evidence with retained inventory provenance", "url": "https://github.com/morluto/rea/pull/1890", "author": { "login": "akushonkamen", "__typename": "User" }, "mergeCommit": { "oid": "7a0140b4aa43276368058ab98826b77e040ea14f" }, "issues": [ { "number": 1850, "url": "https://github.com/morluto/rea/issues/1850", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1891, "title": "feat(mcp): derive an API surface view from retained web network captures", "url": "https://github.com/morluto/rea/pull/1891", "author": { "login": "mvanhorn", "__typename": "User" }, "mergeCommit": { "oid": "880a603fe89db2132fd05a35b33a8c459673beda" }, "issues": [] }, { "number": 1893, "title": "fix(managed): honor metadata ExtraData before table decoding", "url": "https://github.com/morluto/rea/pull/1893", "author": { "login": "chqcjq", "__typename": "User" }, "mergeCommit": { "oid": "fb43dd9716fe113effa14a03b603b72ca7d9097c" }, "issues": [] }, { "number": 1894, "title": "feat(website): follow the system dark mode and fix small-screen text", "url": "https://github.com/morluto/rea/pull/1894", "author": { "login": "CassieFox23", "__typename": "User" }, "mergeCommit": { "oid": "12ee785e5e61132898adecf9424ce6706a2e754a" }, "issues": [] }, { "number": 1897, "title": "fix(managed): bind row budget charges to metadata identities", "url": "https://github.com/morluto/rea/pull/1897", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "23d50ea3bec186b4459d36c04854a92276accdf1" }, "issues": [ { "number": 1878, "url": "https://github.com/morluto/rea/issues/1878", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1898, "title": "feat(ghidra): admit recordless legacy MIPS32 ELFs with a pinned 32-bit language", "url": "https://github.com/morluto/rea/pull/1898", "author": { "login": "BaaRai", "__typename": "User" }, "mergeCommit": { "oid": "a4b8e9ccee50f83bfb72d7ad33db6962c9befa72" }, "issues": [ { "number": 1620, "url": "https://github.com/morluto/rea/issues/1620", "author": { "login": "bqw371", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1899, "title": "fix(web): reject NUL bytes in web tool local path inputs", "url": "https://github.com/morluto/rea/pull/1899", "author": { "login": "DeryFerd", "__typename": "User" }, "mergeCommit": { "oid": "499ac180115de7c9de3f1adc55159ffa6e9bb40e" }, "issues": [] }, { "number": 1900, "title": "test(native): skip the inaccessible-directory diagnostic as root", "url": "https://github.com/morluto/rea/pull/1900", "author": { "login": "larinyo", "__typename": "User" }, "mergeCommit": { "oid": "d0edeec1009f1149956ee2a95dc5941aff8f78b5" }, "issues": [] }, { "number": 1901, "title": "ci: pin GitHub Actions to full commit SHAs", "url": "https://github.com/morluto/rea/pull/1901", "author": { "login": "larinyo", "__typename": "User" }, "mergeCommit": { "oid": "c6503edfc4afdc0de6812ba3f7cd0909df5555f7" }, "issues": [] }, { "number": 1902, "title": "fix(install): describe automatic setup and guard truncated downloads", "url": "https://github.com/morluto/rea/pull/1902", "author": { "login": "larinyo", "__typename": "User" }, "mergeCommit": { "oid": "d802304c542b20bc86e22cc492718e89a8a5579b" }, "issues": [] }, { "number": 1904, "title": "fix(contracts): mark foreign execution and device mutation destructive", "url": "https://github.com/morluto/rea/pull/1904", "author": { "login": "larinyo", "__typename": "User" }, "mergeCommit": { "oid": "0b7fc40eeef03b06de08d886572c2862331d8947" }, "issues": [] }, { "number": 1905, "title": "perf(javascript): index source-map ignore lists per leaf", "url": "https://github.com/morluto/rea/pull/1905", "author": { "login": "cyanseek", "__typename": "User" }, "mergeCommit": { "oid": "898d5096f94fe1ed3ea7d091455e638cc7d23bfd" }, "issues": [] }, { "number": 1906, "title": "fix(ida): preserve non-x86 call edges and workflow uncertainty", "url": "https://github.com/morluto/rea/pull/1906", "author": { "login": "nikolay-dementiev", "__typename": "User" }, "mergeCommit": { "oid": "0ae38e1e31414c67a3be09231d208f0726c035f8" }, "issues": [ { "number": 1794, "url": "https://github.com/morluto/rea/issues/1794", "author": { "login": "nikolay-dementiev", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1907, "title": "fix(process): retain owned command cleanup diagnostics", "url": "https://github.com/morluto/rea/pull/1907", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "38539a2f4a522243d6fc369ae34ef30e2a2f80cc" }, "issues": [ { "number": 1856, "url": "https://github.com/morluto/rea/issues/1856", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1908, "title": "feat(server): frame analysis-target content as untrusted data", "url": "https://github.com/morluto/rea/pull/1908", "author": { "login": "larinyo", "__typename": "User" }, "mergeCommit": { "oid": "85e124253ac93dd443be6bbcee0939d525b90d4e" }, "issues": [] }, { "number": 1910, "title": "fix(mcp): provide native evidence paging continuation", "url": "https://github.com/morluto/rea/pull/1910", "author": { "login": "cold-atom", "__typename": "User" }, "mergeCommit": { "oid": "1449e8e05138bf0c86d5fe6f4c93122b4b93b2b1" }, "issues": [ { "number": 1849, "url": "https://github.com/morluto/rea/issues/1849", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1912, "title": "fix(javascript): follow actual receivers in nested intrinsic calls", "url": "https://github.com/morluto/rea/pull/1912", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "9d8e42bdd6f1bf8a984da1e06e1d76a1dbb9a7ed" }, "issues": [ { "number": 1909, "url": "https://github.com/morluto/rea/issues/1909", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1913, "title": "feat(ghidra): apply validated analyzer overrides before analysis", "url": "https://github.com/morluto/rea/pull/1913", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "9878bb7296c13c2b4838be76f6128e5fc31eda3c" }, "issues": [] }, { "number": 1915, "title": "fix(javascript): report available parent result budget in coverage limits", "url": "https://github.com/morluto/rea/pull/1915", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "72489a9445299f695d793f004fed88e1bac0a557" }, "issues": [ { "number": 1911, "url": "https://github.com/morluto/rea/issues/1911", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1916, "title": "fix(javascript): normalize package URLs before array selection", "url": "https://github.com/morluto/rea/pull/1916", "author": { "login": "morluto", "__typename": "User" }, "mergeCommit": { "oid": "369cd3dfdc47709cc34d01c50f645a885c70ded7" }, "issues": [] }, { "number": 1917, "title": "fix(test): audit static Wasm and Harmony tool wording", "url": "https://github.com/morluto/rea/pull/1917", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "dfe31172ca0a090be3f40bc134f54d69c08e31d8" }, "issues": [] }, { "number": 1921, "title": "fix(javascript): preserve graphs within parent capacity", "url": "https://github.com/morluto/rea/pull/1921", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "0485cd3bce29c977bae05a4fdce5436f3e3d7913" }, "issues": [ { "number": 1911, "url": "https://github.com/morluto/rea/issues/1911", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1924, "title": "test(evaluation): grade managed agent fixture facts", "url": "https://github.com/morluto/rea/pull/1924", "author": { "login": "Ramcharan49", "__typename": "User" }, "mergeCommit": { "oid": "ffd8c9c03ddf5409cc7b044f0a1c48b4b0114bee" }, "issues": [] }, { "number": 1925, "title": "fix(contracts): reject OS-invalid local paths in binary and artifact tools", "url": "https://github.com/morluto/rea/pull/1925", "author": { "login": "viniciusdsandrade", "__typename": "User" }, "mergeCommit": { "oid": "976c2c083eee1fdd9e89a1a720f768a6ee6df277" }, "issues": [] }, { "number": 1926, "title": "test(clients): verify native Claude Code integration on Windows", "url": "https://github.com/morluto/rea/pull/1926", "author": { "login": "pablodiazjorge", "__typename": "User" }, "mergeCommit": { "oid": "c32d84622fb3952823c6cfc25c557aec08c1788c" }, "issues": [ { "number": 1923, "url": "https://github.com/morluto/rea/issues/1923", "author": { "login": "pablodiazjorge", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1927, "title": "fix(hopper): preserve observed process failures across requests", "url": "https://github.com/morluto/rea/pull/1927", "author": { "login": "morluto", "__typename": "User" }, "mergeCommit": { "oid": "601814ed0e4a0c57d6e045da0e6cf8ee2f29bb7f" }, "issues": [] }, { "number": 1929, "title": "feat(setup): register DeepSeek Harness through setup, doctor and uninstall", "url": "https://github.com/morluto/rea/pull/1929", "author": { "login": "BaaRai", "__typename": "User" }, "mergeCommit": { "oid": "d9d2a173819ce8e2e7f09eb584ec6ff7b4ee3480" }, "issues": [ { "number": 1839, "url": "https://github.com/morluto/rea/issues/1839", "author": { "login": "whoishaha", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1930, "title": "docs(website): document Apple Silicon Cairo setup for local preview", "url": "https://github.com/morluto/rea/pull/1930", "author": { "login": "parbin-12", "__typename": "User" }, "mergeCommit": { "oid": "c6631814e0b70a324c48fda4acef12541dd30cf5" }, "issues": [] }, { "number": 1931, "title": "perf(ghidra): compile bundle activator with bridge scripts", "url": "https://github.com/morluto/rea/pull/1931", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "0f4992fb9e5bfe1fafe75c35b7f20ad411595573" }, "issues": [] }, { "number": 1933, "title": "test(apple): consolidate keyed archive integer verification", "url": "https://github.com/morluto/rea/pull/1933", "author": { "login": "morluto", "__typename": "User" }, "mergeCommit": { "oid": "3b490a743fd56a8a27b1356f7b2d1284db8848ef" }, "issues": [] }, { "number": 1934, "title": "fix(javascript): retain completed facts through cancellation", "url": "https://github.com/morluto/rea/pull/1934", "author": { "login": "morluto", "__typename": "User" }, "mergeCommit": { "oid": "b6651cb99fba8fec3fd3efcb6794ae32b8a1525d" }, "issues": [] }, { "number": 1936, "title": "test(clients): verify native Gemini CLI integration on Windows", "url": "https://github.com/morluto/rea/pull/1936", "author": { "login": "pablodiazjorge", "__typename": "User" }, "mergeCommit": { "oid": "04089d5bec11d6e0411e7c35d0168bbae63d7e7d" }, "issues": [ { "number": 1935, "url": "https://github.com/morluto/rea/issues/1935", "author": { "login": "pablodiazjorge", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1939, "title": "fix(javascript): preserve package and source-map boundary identity", "url": "https://github.com/morluto/rea/pull/1939", "author": { "login": "morluto", "__typename": "User" }, "mergeCommit": { "oid": "14935e4d470be318fdee442d279d6acb7d441119" }, "issues": [ { "number": 1881, "url": "https://github.com/morluto/rea/issues/1881", "author": { "login": "xu91102", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } }, { "number": 1882, "url": "https://github.com/morluto/rea/issues/1882", "author": { "login": "xu91102", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } }, { "number": 1883, "url": "https://github.com/morluto/rea/issues/1883", "author": { "login": "xu91102", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1941, "title": "fix(javascript): bound value evaluation through nested closure aliases", "url": "https://github.com/morluto/rea/pull/1941", "author": { "login": "ranmori", "__typename": "User" }, "mergeCommit": { "oid": "d59ab6d977d5b9376af2fdd141b4f65460bb9a9f" }, "issues": [] }, { "number": 1942, "title": "fix(verification): align Linux Hopper setup lane with current contracts", "url": "https://github.com/morluto/rea/pull/1942", "author": { "login": "LuisTaffelli", "__typename": "User" }, "mergeCommit": { "oid": "003707f712d06e49b84a48e04d58b50f9a097469" }, "issues": [ { "number": 339, "url": "https://github.com/morluto/rea/issues/339", "author": { "login": "morluto", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1943, "title": "fix(managed): index attribute constructor owners once per layout", "url": "https://github.com/morluto/rea/pull/1943", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "c2cf7dcb86e11350214f82e5c51de7ca6ee3d27a" }, "issues": [ { "number": 1940, "url": "https://github.com/morluto/rea/issues/1940", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1944, "title": "feat(javascript): analyze selected application sources", "url": "https://github.com/morluto/rea/pull/1944", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "85c1d2587a7d42c6e2108405c802fe7f7b046c15" }, "issues": [ { "number": 1848, "url": "https://github.com/morluto/rea/issues/1848", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1946, "title": "fix(apktool): name host requirements in configuration refusals", "url": "https://github.com/morluto/rea/pull/1946", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "7cdb7981c3612bc42bd0153fddd9c33b639918ed" }, "issues": [ { "number": 1945, "url": "https://github.com/morluto/rea/issues/1945", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1949, "title": "feat(ghidra): admit soft-float MIPS32r2 ELF with integer-register float storage", "url": "https://github.com/morluto/rea/pull/1949", "author": { "login": "AurelioB", "__typename": "User" }, "mergeCommit": { "oid": "5e219de44134d34f5a07a9cd1911fb2295bf1d88" }, "issues": [ { "number": 1937, "url": "https://github.com/morluto/rea/issues/1937", "author": { "login": "AurelioB", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1950, "title": "feat(ghidra): admit relocatable MIPS32r2 ELF objects", "url": "https://github.com/morluto/rea/pull/1950", "author": { "login": "AurelioB", "__typename": "User" }, "mergeCommit": { "oid": "290d301ec770955f313c2d48678ed0ae3b9f8a73" }, "issues": [ { "number": 1938, "url": "https://github.com/morluto/rea/issues/1938", "author": { "login": "AurelioB", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1954, "title": "fix(adb): share host configuration refusals with apktool", "url": "https://github.com/morluto/rea/pull/1954", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "39418ea173763ca55d4f116992ee903bcaeb1898" }, "issues": [ { "number": 1952, "url": "https://github.com/morluto/rea/issues/1952", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1955, "title": "fix(managed): share first-match member list ownership", "url": "https://github.com/morluto/rea/pull/1955", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "7d92d93a550f3be221d7cf1da07c37ea1770e922" }, "issues": [ { "number": 1953, "url": "https://github.com/morluto/rea/issues/1953", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1962, "title": "fix(adb): reject unsafe host file names when pulling one device file", "url": "https://github.com/morluto/rea/pull/1962", "author": { "login": "DeryFerd", "__typename": "User" }, "mergeCommit": { "oid": "1d4c4eb0308b4cb5761a91533edeb33fcfb442f2" }, "issues": [] }, { "number": 1963, "title": "fix(wasm): accept unpadded WABT section rows", "url": "https://github.com/morluto/rea/pull/1963", "author": { "login": "sathariels", "__typename": "User" }, "mergeCommit": { "oid": "9eee709f0cc4064808579c225814898a475ca388" }, "issues": [ { "number": 1956, "url": "https://github.com/morluto/rea/issues/1956", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1967, "title": "fix(wasm): preserve debug module names in WABT output", "url": "https://github.com/morluto/rea/pull/1967", "author": { "login": "bugstan", "__typename": "User" }, "mergeCommit": { "oid": "b777e5d4d8a7b60edad7d5c0eaa56408a4b3f610" }, "issues": [] }, { "number": 1972, "title": "test(native): replay complete dylib-use provider output", "url": "https://github.com/morluto/rea/pull/1972", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "89f5e489adac69af2937fabc1a5ba283191d630a" }, "issues": [] }, { "number": 1974, "title": "test(ghidra): require pending multi-HI16 coverage in the real MIPS relocatable lane", "url": "https://github.com/morluto/rea/pull/1974", "author": { "login": "AurelioB", "__typename": "User" }, "mergeCommit": { "oid": "eaf88aca2af2b8ad7a277c09d0b45f6e2de8ac4a" }, "issues": [] }, { "number": 1981, "title": "fix(wasm): inspect modules whose custom section names contain NUL", "url": "https://github.com/morluto/rea/pull/1981", "author": { "login": "viniciusdsandrade", "__typename": "User" }, "mergeCommit": { "oid": "1febc22907f1cc8035dd1450616233121bd7f19d" }, "issues": [] }, { "number": 1982, "title": "fix(native): accept universal binaries with LIB64 x86_64 slices", "url": "https://github.com/morluto/rea/pull/1982", "author": { "login": "viniciusdsandrade", "__typename": "User" }, "mergeCommit": { "oid": "4b653fe6ad1d25a2d9a69d5e93610380c0c09a34" }, "issues": [] }, { "number": 1983, "title": "fix(setup): configure an empty Hermes config.yaml", "url": "https://github.com/morluto/rea/pull/1983", "author": { "login": "viniciusdsandrade", "__typename": "User" }, "mergeCommit": { "oid": "43f9c39dfbdfaa6e5bc260b037a506cd1f56fe6d" }, "issues": [] }, { "number": 1984, "title": "test(android): verify duplicate class inventory behavior on empty discovery queries", "url": "https://github.com/morluto/rea/pull/1984", "author": { "login": "viniciusdsandrade", "__typename": "User" }, "mergeCommit": { "oid": "6611bcf6e86630c775c24e6afa00d7239c64e70e" }, "issues": [ { "number": 1978, "url": "https://github.com/morluto/rea/issues/1978", "author": { "login": "AntonioNoOne", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1985, "title": "fix(managed): admit ReadyToRun images built for non-Windows hosts", "url": "https://github.com/morluto/rea/pull/1985", "author": { "login": "JayOfTheKeyboard", "__typename": "User" }, "mergeCommit": { "oid": "0d11f71e0dc5cf95d3bea093355f7edc09089a68" }, "issues": [] }, { "number": 1986, "title": "fix(build): resolve rolldown from the npm registry in package-lock.json", "url": "https://github.com/morluto/rea/pull/1986", "author": { "login": "balkan16", "__typename": "User" }, "mergeCommit": { "oid": "f889a69fb9efe42dd0120c96ff44b4298c1c7c6c" }, "issues": [] }, { "number": 1987, "title": "fix(targets): remove path advice for format refusals", "url": "https://github.com/morluto/rea/pull/1987", "author": { "login": "Ha1baraA11", "__typename": "User" }, "mergeCommit": { "oid": "f28f3382836f8dd8629c25b1bf5455d29b28d41d" }, "issues": [ { "number": 1979, "url": "https://github.com/morluto/rea/issues/1979", "author": { "login": "CassieFox23", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1988, "title": "perf(mcp)!: compact repeated session discovery facts", "url": "https://github.com/morluto/rea/pull/1988", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "6395e8d3007d5ee453477460e7ee1c51cff76be0" }, "issues": [] }, { "number": 1991, "title": "feat(ghidra): admit verified MIPS16 shared ELF images", "url": "https://github.com/morluto/rea/pull/1991", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "e9fe6437a7da381f0aa5aa77571dcf03317122e7" }, "issues": [ { "number": 1851, "url": "https://github.com/morluto/rea/issues/1851", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1995, "title": "fix(native): reject required otool fields truncated before their value", "url": "https://github.com/morluto/rea/pull/1995", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "adde8a80921b199ddd7105998f3760d345b468fc" }, "issues": [ { "number": 1990, "url": "https://github.com/morluto/rea/issues/1990", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 1996, "title": "perf(cli): bundle runtime entries to reduce Windows startup I/O", "url": "https://github.com/morluto/rea/pull/1996", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "d93fbda390c6b8b2741c552bd194b50c3e08e0c1" }, "issues": [] }, { "number": 1997, "title": "test(http3): add real MITM capture verification lab", "url": "https://github.com/morluto/rea/pull/1997", "author": { "login": "LuisTaffelli", "__typename": "User" }, "mergeCommit": { "oid": "ebaaa79ca02bde4a73013a2a9a781d0b07a57ee4" }, "issues": [] }, { "number": 1999, "title": "fix(process): report the Swift compiler outcome with bounded diagnostics", "url": "https://github.com/morluto/rea/pull/1999", "author": { "login": "jimpablo", "__typename": "User" }, "mergeCommit": { "oid": "091cb81fc3ca2b8ec96df7a534934388a6b882cd" }, "issues": [ { "number": 1993, "url": "https://github.com/morluto/rea/issues/1993", "author": { "login": "EDMND-SRC", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2001, "title": "fix(call-path): preserve relationship coverage from analysis", "url": "https://github.com/morluto/rea/pull/2001", "author": { "login": "khanukov", "__typename": "User" }, "mergeCommit": { "oid": "ed6af7eb8cf052c52fec8bfdc5d509377cb30a1a" }, "issues": [] }, { "number": 2004, "title": "fix(targets): project invalid raw-binary loads as caller input", "url": "https://github.com/morluto/rea/pull/2004", "author": { "login": "jimpablo", "__typename": "User" }, "mergeCommit": { "oid": "edf46248f2a44b4e5776518489fee09d0fc4516b" }, "issues": [ { "number": 2002, "url": "https://github.com/morluto/rea/issues/2002", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2007, "title": "fix(target): probe WASM before inferred database routing", "url": "https://github.com/morluto/rea/pull/2007", "author": { "login": "SII-YDD", "__typename": "User" }, "mergeCommit": { "oid": "168bfe50604b3a435c05f2db9f8a0cf47230c660" }, "issues": [] }, { "number": 2011, "title": "fix(ghidra): retain launcher command outcome in launch failure diagnostics", "url": "https://github.com/morluto/rea/pull/2011", "author": { "login": "sx4im", "__typename": "User" }, "mergeCommit": { "oid": "d4e8ef74999666cdb735b49eb8fea367f8f86489" }, "issues": [ { "number": 1992, "url": "https://github.com/morluto/rea/issues/1992", "author": { "login": "EDMND-SRC", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2013, "title": "fix(session): attribute selected-provider capabilities to the resolved identity", "url": "https://github.com/morluto/rea/pull/2013", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "2ff850de68dc9b05c6faf2bbfd26d56bc2d5d27c" }, "issues": [ { "number": 2009, "url": "https://github.com/morluto/rea/issues/2009", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2014, "title": "fix(ghidra): recover stale clients on same-target reopen", "url": "https://github.com/morluto/rea/pull/2014", "author": { "login": "lyly-bonbon", "__typename": "User" }, "mergeCommit": { "oid": "4573e8cf35de822bfc5feabcc89ec3717c247c8c" }, "issues": [] }, { "number": 2026, "title": "fix(scripts, install): honor test:fast \"without build\" promise and orient Node.js engine mismatches", "url": "https://github.com/morluto/rea/pull/2026", "author": { "login": "astralyx0129", "__typename": "User" }, "mergeCommit": { "oid": "69e097a8ca256ab97ee4b2883739447784a5f90e" }, "issues": [] }, { "number": 2029, "title": "docs(install): explain Claude Code upfront tool loading on third-party endpoints", "url": "https://github.com/morluto/rea/pull/2029", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "d0249282c64882329a6acab8f3b477552da53499" }, "issues": [ { "number": 2019, "url": "https://github.com/morluto/rea/issues/2019", "author": { "login": "DwarfishRex", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2031, "title": "test(javascript): consolidate module lookup regressions", "url": "https://github.com/morluto/rea/pull/2031", "author": { "login": "xu91102", "__typename": "User" }, "mergeCommit": { "oid": "783fcb06a4bd0444be214822fed60a3786932782" }, "issues": [] }, { "number": 2034, "title": "test(sourcemap): consolidate source map regressions", "url": "https://github.com/morluto/rea/pull/2034", "author": { "login": "xu91102", "__typename": "User" }, "mergeCommit": { "oid": "83a4445f440fab978ad9376b4260acae3f5fb189" }, "issues": [] }, { "number": 2037, "title": "docs(cli): add a managed assembly inspection workflow", "url": "https://github.com/morluto/rea/pull/2037", "author": { "login": "sandr01", "__typename": "User" }, "mergeCommit": { "oid": "538f8cc7224dba44b728cf6c000920f911957fc4" }, "issues": [] }, { "number": 2040, "title": "fix(native): select one slice when universal Mach-O slices share a CPU type", "url": "https://github.com/morluto/rea/pull/2040", "author": { "login": "hemanthrayuduu", "__typename": "User" }, "mergeCommit": { "oid": "96fc84f1fb7c8bc69f66cd899896f4de9061fead" }, "issues": [] }, { "number": 2042, "title": "docs: celebrate 110,000 GitHub stars 🎉", "url": "https://github.com/morluto/rea/pull/2042", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "0d78c99c11efee66570772efe6eb88dfd0e1c694" }, "issues": [] }, { "number": 2049, "title": "feat(ghidra): decode Swift String literals in function dossiers", "url": "https://github.com/morluto/rea/pull/2049", "author": { "login": "thefolahan", "__typename": "User" }, "mergeCommit": { "oid": "8823c55b0ce325cf9edb7d2f9aadaf39db4e8f31" }, "issues": [ { "number": 2030, "url": "https://github.com/morluto/rea/issues/2030", "author": { "login": "thefolahan", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2055, "title": "test(process): preserve terminal deadline expiry regression", "url": "https://github.com/morluto/rea/pull/2055", "author": { "login": "Akashmdshetty", "__typename": "User" }, "mergeCommit": { "oid": "2320ac23ee41f9b4224cc71bfe8f81b66fd67fe5" }, "issues": [] }, { "number": 2059, "title": "fix(artifacts): describe ZIP non-entry coverage accurately", "url": "https://github.com/morluto/rea/pull/2059", "author": { "login": "1052326311", "__typename": "User" }, "mergeCommit": { "oid": "3cb9d61ec1a1bf29000a00cff712ed07ca472da6" }, "issues": [] }, { "number": 2061, "title": "test(javascript): verify CommonJS file URL boundaries via CLI and MCP", "url": "https://github.com/morluto/rea/pull/2061", "author": { "login": "xu91102", "__typename": "User" }, "mergeCommit": { "oid": "6ce5903e7a37252156ec847c4c8874410a4d8f3f" }, "issues": [] }, { "number": 2062, "title": "fix(javascript): preserve import-equals declaration and export evidence", "url": "https://github.com/morluto/rea/pull/2062", "author": { "login": "xu91102", "__typename": "User" }, "mergeCommit": { "oid": "86fab11fbe000a04c0810699419e99e50476e424" }, "issues": [ { "number": 2058, "url": "https://github.com/morluto/rea/issues/2058", "author": { "login": "xu91102", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2065, "title": "fix(native): name numeric Mach-O build-version platforms and tools", "url": "https://github.com/morluto/rea/pull/2065", "author": { "login": "TonyWu2333", "__typename": "User" }, "mergeCommit": { "oid": "77e71d55ec5b3b44e3db366618b3f51ffd41c736" }, "issues": [] }, { "number": 2069, "title": "fix(artifacts): compare package signatures without ASCII folding", "url": "https://github.com/morluto/rea/pull/2069", "author": { "login": "1052326311", "__typename": "User" }, "mergeCommit": { "oid": "75a4a14fa05d352762ffaefd3cd2e16515842b03" }, "issues": [] }, { "number": 2070, "title": "test(apple): skip ibtool-compiled NIB tests when Xcode ibtool is unavailable", "url": "https://github.com/morluto/rea/pull/2070", "author": { "login": "TonyWu2333", "__typename": "User" }, "mergeCommit": { "oid": "7bc57e1e64915a26c32f89fb53d0321193a37160" }, "issues": [] }, { "number": 2073, "title": "fix(setup): separate host support and stop skill checks after drift", "url": "https://github.com/morluto/rea/pull/2073", "author": { "login": "txiki739", "__typename": "User" }, "mergeCommit": { "oid": "7dcd23c005ac40ae2523861ae8806e29cb1d74ed" }, "issues": [] }, { "number": 2074, "title": "fix(browser): isolate script URLs with empty query or fragment", "url": "https://github.com/morluto/rea/pull/2074", "author": { "login": "1052326311", "__typename": "User" }, "mergeCommit": { "oid": "9b780c47bca039939dd5f73b78541f3ea566a7dd" }, "issues": [] }, { "number": 2075, "title": "fix(managed): classify ReadyToRun images without ILONLY as modern .NET", "url": "https://github.com/morluto/rea/pull/2075", "author": { "login": "TonyWu2333", "__typename": "User" }, "mergeCommit": { "oid": "cdc41fc86c440317160652c1000fe8b082ba76f1" }, "issues": [] }, { "number": 2077, "title": "fix(javascript): keep CommonJS require file URLs unresolved", "url": "https://github.com/morluto/rea/pull/2077", "author": { "login": "rekcilyssup", "__typename": "User" }, "mergeCommit": { "oid": "352c46aa7567afcd142524e5f583379c27a1075d" }, "issues": [ { "number": 2057, "url": "https://github.com/morluto/rea/issues/2057", "author": { "login": "xu91102", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2079, "title": "feat(ghidra): support raw NMOS 6502 analysis", "url": "https://github.com/morluto/rea/pull/2079", "author": { "login": "Zhong-fan", "__typename": "User" }, "mergeCommit": { "oid": "9c14999efd94ae04bfaf6532a74613b7a914810c" }, "issues": [] }, { "number": 2082, "title": "docs: clarify responsible use and preserve third-party notices", "url": "https://github.com/morluto/rea/pull/2082", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "974f11d010570c0a18423cd1cc93e9a5203df1b6" }, "issues": [] }, { "number": 2083, "title": "fix(analysis): expose provider image base", "url": "https://github.com/morluto/rea/pull/2083", "author": { "login": "NIU-123370", "__typename": "User" }, "mergeCommit": { "oid": "81cca2e0e3ebd98c21f41d7ad63d6a00e4cbc3f9" }, "issues": [] }, { "number": 2084, "title": "fix(wasm): stop appending WABT remediation to unrelated runtime-root failures", "url": "https://github.com/morluto/rea/pull/2084", "author": { "login": "STiFLeR7", "__typename": "User" }, "mergeCommit": { "oid": "ea2f94d4de2241306158fecdd75f96cd34566694" }, "issues": [] }, { "number": 2091, "title": "fix: honor empty URL query and fragment markers", "url": "https://github.com/morluto/rea/pull/2091", "author": { "login": "fisforfaheem", "__typename": "User" }, "mergeCommit": { "oid": "af29247a7873ba8badec204a4a59f9a2b3a880b6" }, "issues": [] }, { "number": 2096, "title": "fix(setup): configure a comment-only Hermes config.yaml", "url": "https://github.com/morluto/rea/pull/2096", "author": { "login": "JayOfTheKeyboard", "__typename": "User" }, "mergeCommit": { "oid": "aa6f74af04c06d3d09ef69d2292f05f74e93cf1b" }, "issues": [] }, { "number": 2098, "title": "fix(artifacts): compare plist and NIB signatures without ASCII folding", "url": "https://github.com/morluto/rea/pull/2098", "author": { "login": "fisforfaheem", "__typename": "User" }, "mergeCommit": { "oid": "43e33cd49e6707a36312d4a948fa42eaf96a72a1" }, "issues": [] }, { "number": 2099, "title": "fix(browser): compare PNG IHDR bytes without ASCII folding", "url": "https://github.com/morluto/rea/pull/2099", "author": { "login": "fisforfaheem", "__typename": "User" }, "mergeCommit": { "oid": "fdd8f826023c568937d237c2f97d855de283a9b8" }, "issues": [] }, { "number": 2100, "title": "fix(targets): compare the Info.plist bplist prefix without ASCII folding", "url": "https://github.com/morluto/rea/pull/2100", "author": { "login": "fisforfaheem", "__typename": "User" }, "mergeCommit": { "oid": "70611713e140a86201cdef659181012cbdd17f4d" }, "issues": [] }, { "number": 2101, "title": "fix(ghidra): resolve file offsets in decompile", "url": "https://github.com/morluto/rea/pull/2101", "author": { "login": "Zhong-fan", "__typename": "User" }, "mergeCommit": { "oid": "2995ec6910ead327829378f5ab1b9172ecce33fc" }, "issues": [ { "number": 2078, "url": "https://github.com/morluto/rea/issues/2078", "author": { "login": "nosmile99", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2102, "title": "fix(wasm): preserve leading BOM in custom section names", "url": "https://github.com/morluto/rea/pull/2102", "author": { "login": "1052326311", "__typename": "User" }, "mergeCommit": { "oid": "abc8c6dadf4f11b67de1cc2ee96bb55047416d71" }, "issues": [] }, { "number": 2103, "title": "test(clients): verify Qwen Code on native Windows", "url": "https://github.com/morluto/rea/pull/2103", "author": { "login": "AICodeLion", "__typename": "User" }, "mergeCommit": { "oid": "117bd23dd5084a0a15286d749a46bf1f7bc8fadb" }, "issues": [] }, { "number": 2104, "title": "fix(javascript): resolve module-relative Worker URL references", "url": "https://github.com/morluto/rea/pull/2104", "author": { "login": "shoyann", "__typename": "User" }, "mergeCommit": { "oid": "653067d799591ce2b8fdc84e99c160ac17e2860f" }, "issues": [] }, { "number": 2106, "title": "fix(artifacts): preserve NIB field and class identities", "url": "https://github.com/morluto/rea/pull/2106", "author": { "login": "1NormalGuy", "__typename": "User" }, "mergeCommit": { "oid": "f8e95799f941e9e55e0d47841896b401bab67d29" }, "issues": [] }, { "number": 2107, "title": "fix(native): preserve literal line breaks in signing identifiers", "url": "https://github.com/morluto/rea/pull/2107", "author": { "login": "1NormalGuy", "__typename": "User" }, "mergeCommit": { "oid": "ec3db374574060fcc4fa6b215fceaea1bd4ca3f3" }, "issues": [] }, { "number": 2109, "title": "fix(artifacts): preserve NIB key and class name identity", "url": "https://github.com/morluto/rea/pull/2109", "author": { "login": "1052326311", "__typename": "User" }, "mergeCommit": { "oid": "e103a89889d4fe5291d8f9125c62fbf1485b621c" }, "issues": [] }, { "number": 2110, "title": "fix(artifacts): preserve Mach-O load-command string identity", "url": "https://github.com/morluto/rea/pull/2110", "author": { "login": "1052326311", "__typename": "User" }, "mergeCommit": { "oid": "7072f87baf096eb944f15bc52e3925653d459cba" }, "issues": [] }, { "number": 2112, "title": "docs(ghidra): verified macOS arm64 native decompiler build recipe", "url": "https://github.com/morluto/rea/pull/2112", "author": { "login": "nKOxxx", "__typename": "User" }, "mergeCommit": { "oid": "5f79c852af8e53a56f58266a9dcf84314c197164" }, "issues": [] }, { "number": 2114, "title": "fix(wasm): preserve original glue source locations", "url": "https://github.com/morluto/rea/pull/2114", "author": { "login": "1052326311", "__typename": "User" }, "mergeCommit": { "oid": "cddf31d55e63b809e9a075bcbe34238c2728c06e" }, "issues": [] }, { "number": 2116, "title": "fix(managed): pair members by declared identity before name-free remaps", "url": "https://github.com/morluto/rea/pull/2116", "author": { "login": "JayOfTheKeyboard", "__typename": "User" }, "mergeCommit": { "oid": "1ebbc3b3714a83f10950eaa09bee5d4490bd572e" }, "issues": [] }, { "number": 2117, "title": "fix(wasm): report WABT output past its budget as a resource constraint", "url": "https://github.com/morluto/rea/pull/2117", "author": { "login": "JayOfTheKeyboard", "__typename": "User" }, "mergeCommit": { "oid": "42667fc1a03ffae7ffea57a611f52162ea223a7c" }, "issues": [] }, { "number": 2118, "title": "fix(setup): name each skill directory in the uninstall summary", "url": "https://github.com/morluto/rea/pull/2118", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "5190843f8f09ac17cbf79561bd1f708c509cda78" }, "issues": [ { "number": 2111, "url": "https://github.com/morluto/rea/issues/2111", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2119, "title": "docs: update Chinese README guides", "url": "https://github.com/morluto/rea/pull/2119", "author": { "login": "lg114", "__typename": "User" }, "mergeCommit": { "oid": "1b6c899b031421dcf2d725a63e67d99375028d6e" }, "issues": [] }, { "number": 2122, "title": "feat(analysis): add opt-in retained inventory and WASM views", "url": "https://github.com/morluto/rea/pull/2122", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "58fb372071e56da9c5df0e37593ee3f0da6b64bc" }, "issues": [] }, { "number": 2125, "title": "fix(managed): validate CLI type selections with the member contract", "url": "https://github.com/morluto/rea/pull/2125", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "60259a91d9a58cbd313ad7f3d321acc2deb65d2e" }, "issues": [ { "number": 2121, "url": "https://github.com/morluto/rea/issues/2121", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2131, "title": "ci: narrow native-host lane selection and reuse build caches", "url": "https://github.com/morluto/rea/pull/2131", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "4f46eac453965efde3bc782aebfeec198551afc4" }, "issues": [] }, { "number": 2133, "title": "fix(target): recognize binary plists by magic under any extension", "url": "https://github.com/morluto/rea/pull/2133", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "672bdea21fd943688e081d209a993e234c45507f" }, "issues": [ { "number": 2129, "url": "https://github.com/morluto/rea/issues/2129", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2137, "title": "test(mcp): ready providers before live prompt completion checks", "url": "https://github.com/morluto/rea/pull/2137", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "621cee192d582c87ca3d254d4cb22c9d209d3aea" }, "issues": [ { "number": 2123, "url": "https://github.com/morluto/rea/issues/2123", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2140, "title": "fix(cli): report an invalid REA_LOG_LEVEL as configuration", "url": "https://github.com/morluto/rea/pull/2140", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "315973259732544a597b8b17d25c69735910e72e" }, "issues": [ { "number": 2135, "url": "https://github.com/morluto/rea/issues/2135", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2144, "title": "fix(artifacts): bound archive decompression by source size", "url": "https://github.com/morluto/rea/pull/2144", "author": { "login": "DeryFerd", "__typename": "User" }, "mergeCommit": { "oid": "c59fbf5e9c3b856d042f02cb18ad4de077eaeab5" }, "issues": [] }, { "number": 2145, "title": "fix(jeb): confine an invalid REA_JEB_MCP_URL to the JEB tools", "url": "https://github.com/morluto/rea/pull/2145", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "df2c08b546d4f40103e11b8b31dbfc3d41ee687b" }, "issues": [ { "number": 2143, "url": "https://github.com/morluto/rea/issues/2143", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2151, "title": "feat(ghidra): admit RISC-V ELF analysis through a pinned generic lane", "url": "https://github.com/morluto/rea/pull/2151", "author": { "login": "NIU-123370", "__typename": "User" }, "mergeCommit": { "oid": "0baad58e606f12a8dc6cef06253f85350378e5b1" }, "issues": [] }, { "number": 2154, "title": "fix(setup): name structural problems in client configurations", "url": "https://github.com/morluto/rea/pull/2154", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "51367cae6f4e6ef9b9dcb28dc21fe6c92d1dd6f8" }, "issues": [ { "number": 2152, "url": "https://github.com/morluto/rea/issues/2152", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2157, "title": "fix(setup): name invalid client config shape errors clearly", "url": "https://github.com/morluto/rea/pull/2157", "author": { "login": "BeqaKs", "__typename": "User" }, "mergeCommit": { "oid": "b1bf4a70d44191348ca20a91a52fb663da4daed0" }, "issues": [ { "number": 2152, "url": "https://github.com/morluto/rea/issues/2152", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2161, "title": "fix(apple): preflight XML plist nesting before keyed archive decoding", "url": "https://github.com/morluto/rea/pull/2161", "author": { "login": "Zburgers", "__typename": "User" }, "mergeCommit": { "oid": "7711b0000592aa80c7b0412004150313f78feabc" }, "issues": [ { "number": 2105, "url": "https://github.com/morluto/rea/issues/2105", "author": { "login": "Zburgers", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2162, "title": "feat(managed): decode ldstr user strings in member inspection", "url": "https://github.com/morluto/rea/pull/2162", "author": { "login": "Nelglor", "__typename": "User" }, "mergeCommit": { "oid": "26525706fcd102355d1cd765138398067f32527f" }, "issues": [ { "number": 2158, "url": "https://github.com/morluto/rea/issues/2158", "author": { "login": "Nelglor", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2163, "title": "feat(managed): name the declaring type of call and field targets", "url": "https://github.com/morluto/rea/pull/2163", "author": { "login": "Nelglor", "__typename": "User" }, "mergeCommit": { "oid": "91830f1e0e68232e991902b0fa7617651d2eee15" }, "issues": [ { "number": 2160, "url": "https://github.com/morluto/rea/issues/2160", "author": { "login": "Nelglor", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2165, "title": "docs: move translated READMEs under docs/readme", "url": "https://github.com/morluto/rea/pull/2165", "author": { "login": "aimalexe", "__typename": "User" }, "mergeCommit": { "oid": "cbe769b5043b32c5bbcf785cace094e29960d374" }, "issues": [ { "number": 2141, "url": "https://github.com/morluto/rea/issues/2141", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2182, "title": "fix(setup): remove emptied skill directories on uninstall", "url": "https://github.com/morluto/rea/pull/2182", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "d35035780a643e38301b8eaea03f01bb506e9df9" }, "issues": [ { "number": 2159, "url": "https://github.com/morluto/rea/issues/2159", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2188, "title": "docs(installation): limit REA to one project or agent profile", "url": "https://github.com/morluto/rea/pull/2188", "author": { "login": "williamblair333", "__typename": "User" }, "mergeCommit": { "oid": "41a2e846470bd2af40dd298d975b1a1d2fef5786" }, "issues": [] }, { "number": 2193, "title": "feat(wasm): add opt-in first-call summary delivery", "url": "https://github.com/morluto/rea/pull/2193", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "0b7145361ec02d27260eb1f5bc0be955c9374a96" }, "issues": [] }, { "number": 2194, "title": "fix(managed): report malformed PE layouts as invalid input", "url": "https://github.com/morluto/rea/pull/2194", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "90e37f4152990be721784006a820a3794920213c" }, "issues": [ { "number": 2191, "url": "https://github.com/morluto/rea/issues/2191", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2197, "title": "fix(cli): label each uninstall skill root by its client", "url": "https://github.com/morluto/rea/pull/2197", "author": { "login": "wjl8636", "__typename": "User" }, "mergeCommit": { "oid": "ed93abed02e03d5423fd85c1f547121f406a06b7" }, "issues": [ { "number": 2111, "url": "https://github.com/morluto/rea/issues/2111", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2200, "title": "docs(readiness): align required stage identifier and checks with evaluator", "url": "https://github.com/morluto/rea/pull/2200", "author": { "login": "Totopo27", "__typename": "User" }, "mergeCommit": { "oid": "85c5477930d504cfd8b72334b48255d8e746a85e" }, "issues": [ { "number": 2179, "url": "https://github.com/morluto/rea/issues/2179", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2201, "title": "fix(ida): thin the selected FAT slice into the private headless input", "url": "https://github.com/morluto/rea/pull/2201", "author": { "login": "akushonkamen", "__typename": "User" }, "mergeCommit": { "oid": "10400fdb57e4226c5ce15af17968a664f35498ce" }, "issues": [ { "number": 2139, "url": "https://github.com/morluto/rea/issues/2139", "author": { "login": "zecaro", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2202, "title": "fix(windows): preserve caller affinity only within one processor group", "url": "https://github.com/morluto/rea/pull/2202", "author": { "login": "Rinkia", "__typename": "User" }, "mergeCommit": { "oid": "ab62ee9dcf98e4717d0b3445330f7cfdfe50c9f4" }, "issues": [ { "number": 2181, "url": "https://github.com/morluto/rea/issues/2181", "author": { "login": "hzh666kevin-hue", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2203, "title": "fix(readiness): deduplicate stage-level missing-evidence findings", "url": "https://github.com/morluto/rea/pull/2203", "author": { "login": "Totopo27", "__typename": "User" }, "mergeCommit": { "oid": "df04f99df018e205138490557d46068adcc4ccad" }, "issues": [ { "number": 2178, "url": "https://github.com/morluto/rea/issues/2178", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2205, "title": "fix(mcp): keep shared optional providers open across discarded probes", "url": "https://github.com/morluto/rea/pull/2205", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "7c9c1ebdb77662f6276ef2f7250e7df414bd03ca" }, "issues": [ { "number": 2195, "url": "https://github.com/morluto/rea/issues/2195", "author": { "login": "JackOdegard", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2206, "title": "fix(ghidra): encode Java probe output as UTF-8", "url": "https://github.com/morluto/rea/pull/2206", "author": { "login": "Ha1baraA11", "__typename": "User" }, "mergeCommit": { "oid": "59be866719e8fe8ec060515044d427a3b0a57649" }, "issues": [ { "number": 2204, "url": "https://github.com/morluto/rea/issues/2204", "author": { "login": "lovecontroing", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2207, "title": "docs: correct drift and reorganize English guides", "url": "https://github.com/morluto/rea/pull/2207", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "7ae3c50a9d49c480035855de9fcc4484befacd92" }, "issues": [] }, { "number": 2210, "title": "ci: keep validation fresh and preserve failed-shard reports", "url": "https://github.com/morluto/rea/pull/2210", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "428eee00fdd0406cdf2b734c9ea14a2bb02da279" }, "issues": [] }, { "number": 2211, "title": "fix(frida): reject an unreadable script file before starting a session", "url": "https://github.com/morluto/rea/pull/2211", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "c9aecde580d26d4e7745c2623a4efa327a27367e" }, "issues": [ { "number": 2209, "url": "https://github.com/morluto/rea/issues/2209", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2212, "title": "fix(adb): count UTF-8 bytes in logcat total_bytes", "url": "https://github.com/morluto/rea/pull/2212", "author": { "login": "sx4im", "__typename": "User" }, "mergeCommit": { "oid": "ec2d251c0ad8382e0665546be5ec8f5f1c175962" }, "issues": [ { "number": 2175, "url": "https://github.com/morluto/rea/issues/2175", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2214, "title": "fix(artifacts): compare inventories using declared coverage", "url": "https://github.com/morluto/rea/pull/2214", "author": { "login": "thangldw", "__typename": "User" }, "mergeCommit": { "oid": "45a3509db34e2eca5558b90b06fca1baefdf3479" }, "issues": [ { "number": 2173, "url": "https://github.com/morluto/rea/issues/2173", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2216, "title": "test(native): verify real PE and DOS entry views", "url": "https://github.com/morluto/rea/pull/2216", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "1770f38cfc6cbe87491d0de8b8730c305c5cf8ea" }, "issues": [] }, { "number": 2217, "title": "fix(frida): name the argument each Frida input error rejects", "url": "https://github.com/morluto/rea/pull/2217", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "86de439ba4c9297f721abc60c715fe30fb6ff3df" }, "issues": [ { "number": 2213, "url": "https://github.com/morluto/rea/issues/2213", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2221, "title": "fix(adb): preserve existing bugreport archives", "url": "https://github.com/morluto/rea/pull/2221", "author": { "login": "dakjdakd", "__typename": "User" }, "mergeCommit": { "oid": "d80b55e11bc47c6f999dac7dcb8382219d65739a" }, "issues": [ { "number": 2220, "url": "https://github.com/morluto/rea/issues/2220", "author": { "login": "dakjdakd", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2223, "title": "fix(comparison): recheck historical calls-only changes", "url": "https://github.com/morluto/rea/pull/2223", "author": { "login": "dakjdakd", "__typename": "User" }, "mergeCommit": { "oid": "688defca0f4a3de04eb199f7754f323c68896c3c" }, "issues": [] }, { "number": 2224, "title": "docs: preserve the native guide title anchor", "url": "https://github.com/morluto/rea/pull/2224", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "ae412654d5947f3841c191e92f3ad6b73d6f894b" }, "issues": [] }, { "number": 2226, "title": "test(adb): isolate cross-platform activity launch regressions", "url": "https://github.com/morluto/rea/pull/2226", "author": { "login": "dakjdakd", "__typename": "User" }, "mergeCommit": { "oid": "3c39a3f536b2b2dfdbab1109e1da949b59661a7e" }, "issues": [] }, { "number": 2229, "title": "docs: define contribution scope and simplify proposal forms", "url": "https://github.com/morluto/rea/pull/2229", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "ac6ef95e12335bdc054ccaaa96c32474cf8789ea" }, "issues": [] }, { "number": 2230, "title": "fix(cli): retain browser and Inspector input correction details", "url": "https://github.com/morluto/rea/pull/2230", "author": { "login": "369Apps", "__typename": "User" }, "mergeCommit": { "oid": "916ac97bf9f7b976982e438ceb856a9692576cb1" }, "issues": [ { "number": 2180, "url": "https://github.com/morluto/rea/issues/2180", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2232, "title": "fix(process): report single empty settlement observation as unverifiable", "url": "https://github.com/morluto/rea/pull/2232", "author": { "login": "sx4im", "__typename": "User" }, "mergeCommit": { "oid": "7724edbdd3fa0acd94c8210a30dceba501fcdbe8" }, "issues": [ { "number": 2170, "url": "https://github.com/morluto/rea/issues/2170", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2239, "title": "fix(browser): report mismatched event family selection as unknown in capture comparison", "url": "https://github.com/morluto/rea/pull/2239", "author": { "login": "chqcjq", "__typename": "User" }, "mergeCommit": { "oid": "0043d9b134c0a353e8bf85c0bde4492275f1f720" }, "issues": [ { "number": 2169, "url": "https://github.com/morluto/rea/issues/2169", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2240, "title": "fix(process): expose Darwin swiftc compile deadline via env", "url": "https://github.com/morluto/rea/pull/2240", "author": { "login": "BeqaKs", "__typename": "User" }, "mergeCommit": { "oid": "e4186af31be855a127804a8543def43cd77404be" }, "issues": [ { "number": 2184, "url": "https://github.com/morluto/rea/issues/2184", "author": { "login": "athosmartins", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2241, "title": "fix(managed): decode the CIL no. prefix", "url": "https://github.com/morluto/rea/pull/2241", "author": { "login": "Angelopgit", "__typename": "User" }, "mergeCommit": { "oid": "e46bed73f190484984c42efcb6fae0ccc42da4ee" }, "issues": [] }, { "number": 2242, "title": "ci: summarize static checks and retain complete reports", "url": "https://github.com/morluto/rea/pull/2242", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "d96550f2f61647ffa150597de73363fa90c4e169" }, "issues": [ { "number": 2238, "url": "https://github.com/morluto/rea/issues/2238", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2245, "title": "docs: define performance priorities for analysis workflows", "url": "https://github.com/morluto/rea/pull/2245", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "8e004522f232ec698c77536235853088a851e6b5" }, "issues": [] }, { "number": 2248, "title": "fix(apple): join recognized keys from NIBArchive field maps", "url": "https://github.com/morluto/rea/pull/2248", "author": { "login": "XiaoBinGan", "__typename": "User" }, "mergeCommit": { "oid": "fd985dbc5b9435918732c0cc1825060af2a3a47e" }, "issues": [ { "number": 2176, "url": "https://github.com/morluto/rea/issues/2176", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2250, "title": "fix(website): prioritize getting started across language editions", "url": "https://github.com/morluto/rea/pull/2250", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "8cbd57cafaf1cfacbe832bae593589cf211442ef" }, "issues": [] }, { "number": 2252, "title": "fix(process): add an opt-in Swift module cache", "url": "https://github.com/morluto/rea/pull/2252", "author": { "login": "charan-rathore", "__typename": "User" }, "mergeCommit": { "oid": "47a51b08f4d79f808c1b74de79c3852aa853df53" }, "issues": [ { "number": 2218, "url": "https://github.com/morluto/rea/issues/2218", "author": { "login": "xthunder0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2261, "title": "refactor(evm): bind offline analysis through a static descriptor", "url": "https://github.com/morluto/rea/pull/2261", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "ad08510a113d7a9b8d92fb1e385757880e469869" }, "issues": [] }, { "number": 2262, "title": "fix(native): refuse inspect_signature on non-Mach-O targets", "url": "https://github.com/morluto/rea/pull/2262", "author": { "login": "aznikline", "__typename": "User" }, "mergeCommit": { "oid": "5eb296649d2cd53b0bb74df7b3d8081e964e027d" }, "issues": [] }, { "number": 2265, "title": "fix(browser): give the DevToolsActivePort wait one deadline owner", "url": "https://github.com/morluto/rea/pull/2265", "author": { "login": "NIU-123370", "__typename": "User" }, "mergeCommit": { "oid": "edd99398797051f8910e777bf5bf94aea5756f4a" }, "issues": [] }, { "number": 2271, "title": "feat(sqlite): inspect offline snapshots with selective evidence", "url": "https://github.com/morluto/rea/pull/2271", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "aeee5074d124414239b6dd440dc79c26bcbd58a4" }, "issues": [] }, { "number": 2275, "title": "fix(ghidra): disclose missing PDB symbol coverage", "url": "https://github.com/morluto/rea/pull/2275", "author": { "login": "hifzabuildsai", "__typename": "User" }, "mergeCommit": { "oid": "865c35e25a0123c3c3a24d63f98d7c585e609091" }, "issues": [] }, { "number": 2277, "title": "feat(browser): inspect retained aioquic qlog JSON captures", "url": "https://github.com/morluto/rea/pull/2277", "author": { "login": "LuisTaffelli", "__typename": "User" }, "mergeCommit": { "oid": "bb154d1067b0fc250452b7d468d0b0523031a16f" }, "issues": [] }, { "number": 2279, "title": "fix(electron): identify each unresolved scenario path", "url": "https://github.com/morluto/rea/pull/2279", "author": { "login": "1052326311", "__typename": "User" }, "mergeCommit": { "oid": "ece15ed6a18122f95e59d7d9f8bf9f0d3589f9f6" }, "issues": [ { "number": 2272, "url": "https://github.com/morluto/rea/issues/2272", "author": { "login": "BeLit-Development-2", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2281, "title": "fix(native): name the retained pwntools process group in cleanup resources", "url": "https://github.com/morluto/rea/pull/2281", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "4303dcdcf68af4d71d777ffff75cbd4f17a8877d" }, "issues": [ { "number": 2274, "url": "https://github.com/morluto/rea/issues/2274", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2283, "title": "fix(ghidra): report unapplied PE CodeView PDB limitation", "url": "https://github.com/morluto/rea/pull/2283", "author": { "login": "akram1089", "__typename": "User" }, "mergeCommit": { "oid": "729ca2ab6ae0644b5a466534f9287961bf7152db" }, "issues": [ { "number": 2259, "url": "https://github.com/morluto/rea/issues/2259", "author": { "login": "BeLit-Development-2", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2284, "title": "fix: preserve process identities in pwntools cleanup errors", "url": "https://github.com/morluto/rea/pull/2284", "author": { "login": "jeonjw85", "__typename": "User" }, "mergeCommit": { "oid": "d85374496965a8a997e1d13e98a27ff5e5ca1077" }, "issues": [ { "number": 2274, "url": "https://github.com/morluto/rea/issues/2274", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2286, "title": "docs(skill): route agent-driven browser actions to scenario capture", "url": "https://github.com/morluto/rea/pull/2286", "author": { "login": "0xRafie", "__typename": "User" }, "mergeCommit": { "oid": "a6c3d3a365fae5fd41455f1a6eaad041caddfa50" }, "issues": [] }, { "number": 2287, "title": "docs(browser): clarify attach coverage and Chromium setup", "url": "https://github.com/morluto/rea/pull/2287", "author": { "login": "0xRafie", "__typename": "User" }, "mergeCommit": { "oid": "f63674cac0329aa3ed76234b31cf8a3536ac07d0" }, "issues": [] }, { "number": 2291, "title": "fix(ida): stop the private input of a universal Mach-O at the end of the selected slice", "url": "https://github.com/morluto/rea/pull/2291", "author": { "login": "nikolay-dementiev", "__typename": "User" }, "mergeCommit": { "oid": "c6acd19b6d842699ab807d9526dc762c743686f4" }, "issues": [ { "number": 2139, "url": "https://github.com/morluto/rea/issues/2139", "author": { "login": "zecaro", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } }, { "number": 2285, "url": "https://github.com/morluto/rea/issues/2285", "author": { "login": "nikolay-dementiev", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2292, "title": "fix(apple): limit already-loaded reuse to rpath dependencies", "url": "https://github.com/morluto/rea/pull/2292", "author": { "login": "viniciusdsandrade", "__typename": "User" }, "mergeCommit": { "oid": "60f771a11e9889ce69cce6ad631b6b186ac742dd" }, "issues": [] }, { "number": 2294, "title": "fix(cli): retain correction details across adjacent browser commands", "url": "https://github.com/morluto/rea/pull/2294", "author": { "login": "morluto", "__typename": "User" }, "mergeCommit": { "oid": "bb266226707135ad9f181e6c3afd6af0ef62fb22" }, "issues": [] }, { "number": 2295, "title": "docs(contributing): explain Windows native prerequisites for source checkouts", "url": "https://github.com/morluto/rea/pull/2295", "author": { "login": "jcamargos", "__typename": "User" }, "mergeCommit": { "oid": "811bd9f6353748d01023260681f138fdf81313c9" }, "issues": [] }, { "number": 2303, "title": "fix(evidence): admit bundle imports across session transitions", "url": "https://github.com/morluto/rea/pull/2303", "author": { "login": "rohitg00", "__typename": "User" }, "mergeCommit": { "oid": "12303812a8d70f198c99c7aeb0df3aaa8166543c" }, "issues": [] }, { "number": 2305, "title": "fix(frida): drain admitted operations and honor queued cancellation", "url": "https://github.com/morluto/rea/pull/2305", "author": { "login": "rohitg00", "__typename": "User" }, "mergeCommit": { "oid": "4481f861880f5cbcd864059b2509c656b5803f7c" }, "issues": [] }, { "number": 2306, "title": "fix(javascript): preserve CommonJS lookup and analysis provenance", "url": "https://github.com/morluto/rea/pull/2306", "author": { "login": "rohitg00", "__typename": "User" }, "mergeCommit": { "oid": "d005bd5dcd5fecf540a82b963df693efee38ac2c" }, "issues": [] }, { "number": 2307, "title": "fix(ida): report missing tools when a compatibility profile mismatches", "url": "https://github.com/morluto/rea/pull/2307", "author": { "login": "vt0x78", "__typename": "User" }, "mergeCommit": { "oid": "beca34f52258b7b25d72c160ae6fffa1cc3c034b" }, "issues": [] }, { "number": 2308, "title": "feat(evm): add retained interface summary delivery", "url": "https://github.com/morluto/rea/pull/2308", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "f76163c2467db623f9de0bda757c9d8610ca9565" }, "issues": [] }, { "number": 2309, "title": "feat(clients): register Factory Droid during setup", "url": "https://github.com/morluto/rea/pull/2309", "author": { "login": "0xRafie", "__typename": "User" }, "mergeCommit": { "oid": "9e019ad27dbad078122f87a9bb41ff6d8687d217" }, "issues": [] }, { "number": 2311, "title": "fix(process): keep provider deadlines independent of wall-clock changes", "url": "https://github.com/morluto/rea/pull/2311", "author": { "login": "jcamargos", "__typename": "User" }, "mergeCommit": { "oid": "72d5bbc96d221709e9d9c9de96061dd5bebee7f1" }, "issues": [] }, { "number": 2312, "title": "test(mcp): fix three MCP boundary suites on native Windows", "url": "https://github.com/morluto/rea/pull/2312", "author": { "login": "pablodiazjorge", "__typename": "User" }, "mergeCommit": { "oid": "a97b713f740932339a5f1036ad2213168c421270" }, "issues": [] }, { "number": 2315, "title": "fix(cli): reject unterminated output filter slices", "url": "https://github.com/morluto/rea/pull/2315", "author": { "login": "maxazure", "__typename": "User" }, "mergeCommit": { "oid": "c95315d2ce365dd7a31aa67c8c13f4a99f209ced" }, "issues": [] }, { "number": 2318, "title": "feat(captures): inspect recorded packets with bounded TShark delivery", "url": "https://github.com/morluto/rea/pull/2318", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "f611d8ce722cd36345e9ff83b9669ef2e7fe57a9" }, "issues": [] }, { "number": 2321, "title": "fix(process): release handles and close worker on incomplete cleanup", "url": "https://github.com/morluto/rea/pull/2321", "author": { "login": "viniciusdsandrade", "__typename": "User" }, "mergeCommit": { "oid": "1e38a038c61096a9213ee4f81c20f36211ae75a9" }, "issues": [ { "number": 2290, "url": "https://github.com/morluto/rea/issues/2290", "author": { "login": "morluto", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2324, "title": "fix(ida): preserve native coverage and verify returned values", "url": "https://github.com/morluto/rea/pull/2324", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "37b7550ecc916acc8619fa72e5c05af45702733f" }, "issues": [] }, { "number": 2327, "title": "fix(artifacts): distinguish JVM classes from universal Mach-O files", "url": "https://github.com/morluto/rea/pull/2327", "author": { "login": "jeonjw85", "__typename": "User" }, "mergeCommit": { "oid": "fcfa5b7e88e2251359950d3fcca8a1ae61dc6814" }, "issues": [ { "number": 2317, "url": "https://github.com/morluto/rea/issues/2317", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2333, "title": "fix(cli)!: keep a selected JSON null in --filter-output output", "url": "https://github.com/morluto/rea/pull/2333", "author": { "login": "Jackmeson1", "__typename": "User" }, "mergeCommit": { "oid": "1ca5fd38b4833ac3fe6213a55e5abfd426228266" }, "issues": [] }, { "number": 2334, "title": "fix(flutter): reject ambiguous ELF mappings and bound note reads", "url": "https://github.com/morluto/rea/pull/2334", "author": { "login": "3QL", "__typename": "User" }, "mergeCommit": { "oid": "e3a012d6c98c60f3254e41e8b7d9c9f66e7cbe17" }, "issues": [] }, { "number": 2336, "title": "fix(ci): run the Windows native lane with its process boundary fixture", "url": "https://github.com/morluto/rea/pull/2336", "author": { "login": "Rinkia", "__typename": "User" }, "mergeCommit": { "oid": "a3daf8a07bf938ce6765b0e15c527493f9496a9f" }, "issues": [] }, { "number": 2339, "title": "feat(signals): decode recordings with bounded sigrok output", "url": "https://github.com/morluto/rea/pull/2339", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "91b8f587cd495c509946e69076525eb19dc1ca65" }, "issues": [] }, { "number": 2340, "title": "feat(pcap): add bounded capture summaries through CLI and MCP", "url": "https://github.com/morluto/rea/pull/2340", "author": { "login": "3QL", "__typename": "User" }, "mergeCommit": { "oid": "9581e067ad306aab842024e47f2dd18ac8056859" }, "issues": [] }, { "number": 2341, "title": "feat(native): search analyzed memory for masked byte patterns", "url": "https://github.com/morluto/rea/pull/2341", "author": { "login": "mvanhorn", "__typename": "User" }, "mergeCommit": { "oid": "2a78763e2070d71818a44bd419df549e13ce203c" }, "issues": [] }, { "number": 2342, "title": "fix(managed): classify 32-bit-preferred assemblies as platform neutral", "url": "https://github.com/morluto/rea/pull/2342", "author": { "login": "huiq777", "__typename": "User" }, "mergeCommit": { "oid": "36132d3e1770c8b69f86c86821d2c872234e370a" }, "issues": [] }, { "number": 2344, "title": "fix(adb): keep the device's refusal when a package change exits nonzero", "url": "https://github.com/morluto/rea/pull/2344", "author": { "login": "huiq777", "__typename": "User" }, "mergeCommit": { "oid": "554ea7611ea7eb94d73c80b57be168527de17d79" }, "issues": [] }, { "number": 2345, "title": "fix(cli): start on Windows when USERPROFILE is empty", "url": "https://github.com/morluto/rea/pull/2345", "author": { "login": "gefrezim", "__typename": "User" }, "mergeCommit": { "oid": "d4f0c5e664e26fe7ed1566dcc4b85ea9b57d52da" }, "issues": [] }, { "number": 2346, "title": "feat(browser): attach passive tools to browsers without HTTP discovery", "url": "https://github.com/morluto/rea/pull/2346", "author": { "login": "all-black-493", "__typename": "User" }, "mergeCommit": { "oid": "62c8b3da1b00260a5ef97d088737dafa0a7ea542" }, "issues": [] }, { "number": 2347, "title": "fix(javascript): keep ASAR-named files without an ASAR header opaque", "url": "https://github.com/morluto/rea/pull/2347", "author": { "login": "huiq777", "__typename": "User" }, "mergeCommit": { "oid": "dd4bfed6141efcb57aef81cf653962272efdf866" }, "issues": [] }, { "number": 2348, "title": "fix(mcp): report references a provider truncated in trace_feature", "url": "https://github.com/morluto/rea/pull/2348", "author": { "login": "nikolay-dementiev", "__typename": "User" }, "mergeCommit": { "oid": "af142f656cf448120ad66ebb545bc92e77fd2401" }, "issues": [] }, { "number": 2349, "title": "test(analysis): verify real preset snapshot and cleanup boundaries", "url": "https://github.com/morluto/rea/pull/2349", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "1dd20ce1ff4ab66c74350929577e753aa17a9006" }, "issues": [] }, { "number": 2354, "title": "fix(adb): report the device state when a push cannot probe the path", "url": "https://github.com/morluto/rea/pull/2354", "author": { "login": "huiq777", "__typename": "User" }, "mergeCommit": { "oid": "2a61deafc632079d10c572bc09e99233826516a3" }, "issues": [] }, { "number": 2359, "title": "fix(adb): count requested permissions that the device marks restricted", "url": "https://github.com/morluto/rea/pull/2359", "author": { "login": "huiq777", "__typename": "User" }, "mergeCommit": { "oid": "15463bdbe605b9dd11da5dbba031f99cd1ec9190" }, "issues": [] }, { "number": 2360, "title": "fix(ghidra): warn when callee/caller reads stop at a truncated function body", "url": "https://github.com/morluto/rea/pull/2360", "author": { "login": "sx4im", "__typename": "User" }, "mergeCommit": { "oid": "6637161e0272513ccc11c33aa6d8915bce6171ac" }, "issues": [ { "number": 2326, "url": "https://github.com/morluto/rea/issues/2326", "author": { "login": "CassieFox23", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2361, "title": "fix(ghidra): bound the Java version probe output", "url": "https://github.com/morluto/rea/pull/2361", "author": { "login": "DeryFerd", "__typename": "User" }, "mergeCommit": { "oid": "e0bd31c18c84fc406ad1c1fe412bc9018ede44ec" }, "issues": [] }, { "number": 2364, "title": "fix(native): parse renamed dyld_info re-exports", "url": "https://github.com/morluto/rea/pull/2364", "author": { "login": "Chaoqi31", "__typename": "User" }, "mergeCommit": { "oid": "1d5f95dc4aff3ffadd06e922128606ea0fb669cc" }, "issues": [] }, { "number": 2365, "title": "fix(artifacts): read ASCII control bytes in legacy ZIP names as ASCII", "url": "https://github.com/morluto/rea/pull/2365", "author": { "login": "Chaoqi31", "__typename": "User" }, "mergeCommit": { "oid": "9928f357fb9c420e6384e155d74586dfe37d4533" }, "issues": [] }, { "number": 2366, "title": "fix(javascript): keep paths after __dirname inside the source directory", "url": "https://github.com/morluto/rea/pull/2366", "author": { "login": "Chaoqi31", "__typename": "User" }, "mergeCommit": { "oid": "f974353c329ebfa58ba5f268078da30952a82ec0" }, "issues": [] }, { "number": 2368, "title": "fix(setup): keep Hermes config numbers as written", "url": "https://github.com/morluto/rea/pull/2368", "author": { "login": "Chaoqi31", "__typename": "User" }, "mergeCommit": { "oid": "d3a55720fc4aac8f9d2c5f5a4c9f20cdf5594d8e" }, "issues": [] }, { "number": 2371, "title": "fix(call-path): keep caller-only unknown coverage from blocking not_found", "url": "https://github.com/morluto/rea/pull/2371", "author": { "login": "sx4im", "__typename": "User" }, "mergeCommit": { "oid": "84cf7791a881e5b16a0288600fbc8d48d494ef01" }, "issues": [ { "number": 2322, "url": "https://github.com/morluto/rea/issues/2322", "author": { "login": "nikolay-dementiev", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2374, "title": "feat(ida): resolve containing procedures and report the admitted program as the document", "url": "https://github.com/morluto/rea/pull/2374", "author": { "login": "nikolay-dementiev", "__typename": "User" }, "mergeCommit": { "oid": "5f8af4ee5f615e97f343d70d91a74568d0ec9fbd" }, "issues": [ { "number": 2335, "url": "https://github.com/morluto/rea/issues/2335", "author": { "login": "nikolay-dementiev", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2384, "title": "fix(formats): preserve high bits in remaining magic-byte checks", "url": "https://github.com/morluto/rea/pull/2384", "author": { "login": "lusknchars", "__typename": "User" }, "mergeCommit": { "oid": "8e6f37e2a0873ac21ebcc889c27839bfcb7552ca" }, "issues": [] }, { "number": 2387, "title": "fix(scripts): pass MCP callTool timeouts as request options", "url": "https://github.com/morluto/rea/pull/2387", "author": { "login": "AurelioB", "__typename": "User" }, "mergeCommit": { "oid": "c462a4ebd3a10e59253bcf38353a0914b176738b" }, "issues": [] }, { "number": 2398, "title": "fix(server): mark retained partial-observation errors as target content", "url": "https://github.com/morluto/rea/pull/2398", "author": { "login": "jbernous", "__typename": "User" }, "mergeCommit": { "oid": "fc0dbe7f9d676f776ffcbe047895ba8caa52f357" }, "issues": [] }, { "number": 2399, "title": "feat(electron): inspect packaged Electron fuse state without execution", "url": "https://github.com/morluto/rea/pull/2399", "author": { "login": "mvanhorn", "__typename": "User" }, "mergeCommit": { "oid": "bcc141549a071c02ad2c3eeabd25fbf6207eb95b" }, "issues": [] }, { "number": 2402, "title": "fix(javascript): keep configuration setting reads out of endpoints", "url": "https://github.com/morluto/rea/pull/2402", "author": { "login": "alfredo1491", "__typename": "User" }, "mergeCommit": { "oid": "23f72141d5befc6b14286ae7281c367d593f84bb" }, "issues": [] }, { "number": 2404, "title": "test(evm): verify real worker cancellation and cleanup recovery", "url": "https://github.com/morluto/rea/pull/2404", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "ae8051302b5834322fa00cfa31c968ae74ab6ed9" }, "issues": [] }, { "number": 2409, "title": "feat(fiddler): inspect native SAZ captures", "url": "https://github.com/morluto/rea/pull/2409", "author": { "login": "zahhak", "__typename": "User" }, "mergeCommit": { "oid": "a2d8b94dd50dab8d966239dd63ab84718aa8b4b4" }, "issues": [] }, { "number": 2413, "title": "feat(managed): add retained metadata overview and pages", "url": "https://github.com/morluto/rea/pull/2413", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "82cfcee19f18b0eeae9a330ba04e0411cdf85225" }, "issues": [] }, { "number": 2416, "title": "test(perf): distinguish Codex tool context and token accounting", "url": "https://github.com/morluto/rea/pull/2416", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "ee87111009ace2ca4ef82c9aef09c82a37ca55f7" }, "issues": [] }, { "number": 2422, "title": "fix(javascript): preserve POSIX runtime path case on Windows", "url": "https://github.com/morluto/rea/pull/2422", "author": { "login": "Aurantium-47", "__typename": "User" }, "mergeCommit": { "oid": "1a1b67c8885e9ff33f7a06ed2e027ebfdb83e084" }, "issues": [] }, { "number": 2426, "title": "fix(setup): resolve the configuration MSIX Claude Desktop reads", "url": "https://github.com/morluto/rea/pull/2426", "author": { "login": "FeeHaard", "__typename": "User" }, "mergeCommit": { "oid": "fd65e278be4d802a06bbe176d997aaac0c4c9884" }, "issues": [] }, { "number": 2427, "title": "test(evm): verify static descriptor bindings before use", "url": "https://github.com/morluto/rea/pull/2427", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "4f4f6cd7b5d7a400b90772a138d7b9f942c2a556" }, "issues": [] }, { "number": 2429, "title": "docs: identify official REA installation sources", "url": "https://github.com/morluto/rea/pull/2429", "author": { "login": "Aurantium-47", "__typename": "User" }, "mergeCommit": { "oid": "4c838469477f0b6ea844c235f78534a55118ddca" }, "issues": [ { "number": 2424, "url": "https://github.com/morluto/rea/issues/2424", "author": { "login": "Orb-Eater", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2430, "title": "test(reference): scope cleanup faults to the owned source file", "url": "https://github.com/morluto/rea/pull/2430", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "eeba61826c1cd1c7be70f011fda0537baadd4179" }, "issues": [ { "number": 2428, "url": "https://github.com/morluto/rea/issues/2428", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2431, "title": "test(perf): observe owned counters at payload completion", "url": "https://github.com/morluto/rea/pull/2431", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "ca2d15b3ee965bd7ab27204cdf4b96b117d148c1" }, "issues": [] }, { "number": 2432, "title": "feat(website): add a persistent light and dark theme switch", "url": "https://github.com/morluto/rea/pull/2432", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "4773c152bc5f299fa682575bb8d1efea7587c7bc" }, "issues": [] }, { "number": 2437, "title": "fix(managed): preserve negative zero in CIL operands", "url": "https://github.com/morluto/rea/pull/2437", "author": { "login": "fisHarly0", "__typename": "User" }, "mergeCommit": { "oid": "6c816af11975e8e801adb2924c4e3c116c72ebba" }, "issues": [] }, { "number": 2438, "title": "feat(android): add opt-in package summaries and retained manifest views", "url": "https://github.com/morluto/rea/pull/2438", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "f254f5ac2b804b353a711264bb178f43fdf07867" }, "issues": [] }, { "number": 2439, "title": "feat(android): expose exact DEX descriptors and direct invoke sites", "url": "https://github.com/morluto/rea/pull/2439", "author": { "login": "LcokHcak", "__typename": "User" }, "mergeCommit": { "oid": "c45d912c911a46c72017242a5c154c1347e6abd5" }, "issues": [] }, { "number": 2440, "title": "fix(android): clean Windows workspaces after owner termination", "url": "https://github.com/morluto/rea/pull/2440", "author": { "login": "LcokHcak", "__typename": "User" }, "mergeCommit": { "oid": "c938f97fb2a84229a9de17fc20276ce3d009ee3b" }, "issues": [] }, { "number": 2441, "title": "fix(browser): release scenario listeners and allow bounded Chrome close", "url": "https://github.com/morluto/rea/pull/2441", "author": { "login": "LcokHcak", "__typename": "User" }, "mergeCommit": { "oid": "c9982ad8bfdfb8f33055ea6ead13d0b59830a18f" }, "issues": [] }, { "number": 2445, "title": "fix(native/windows): share FILE_SHARE_DELETE so owned objects can be marked delete-pending", "url": "https://github.com/morluto/rea/pull/2445", "author": { "login": "maodns", "__typename": "User" }, "mergeCommit": { "oid": "9b08c2b1cbbd74631738db1ddb326592682326e8" }, "issues": [] }, { "number": 2448, "title": "fix(targets): retain unsupported PE machine in diagnostics", "url": "https://github.com/morluto/rea/pull/2448", "author": { "login": "Aurantium-47", "__typename": "User" }, "mergeCommit": { "oid": "43738bec579fc69bab084bffa964916d43d43ed1" }, "issues": [] }, { "number": 2449, "title": "fix(ida): retain bounded stderr on upstream transport failures", "url": "https://github.com/morluto/rea/pull/2449", "author": { "login": "Melon-tgj", "__typename": "User" }, "mergeCommit": { "oid": "30e9b83a68c4729745ca6413ea306dbffb30f07a" }, "issues": [] }, { "number": 2450, "title": "fix(comparison): keep unsupported function facets unknown", "url": "https://github.com/morluto/rea/pull/2450", "author": { "login": "Melon-tgj", "__typename": "User" }, "mergeCommit": { "oid": "b17487f482ce0769dd0c1415297f9c3e1bb7509f" }, "issues": [] }, { "number": 2455, "title": "perf(flutter): add opt-in retained AOT summary and string pages", "url": "https://github.com/morluto/rea/pull/2455", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "23de4f77c74dd299d45cab880c36321d802b21fe" }, "issues": [] }, { "number": 2456, "title": "feat(native): read embedded cargo-auditable Rust dependency lists", "url": "https://github.com/morluto/rea/pull/2456", "author": { "login": "mvanhorn", "__typename": "User" }, "mergeCommit": { "oid": "0e6eca40857471341139e4203bfb32925b5333c5" }, "issues": [] }, { "number": 2458, "title": "fix(go): classify JVM class files instead of universal Mach-O for CAFEBABE bytes", "url": "https://github.com/morluto/rea/pull/2458", "author": { "login": "Joshwong1908", "__typename": "User" }, "mergeCommit": { "oid": "48b92e1be1110fd200cc6d2fd0cdf7c6e2f9e21a" }, "issues": [ { "number": 2317, "url": "https://github.com/morluto/rea/issues/2317", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2461, "title": "fix(setup): resolve DeepSeek Harness home overrides", "url": "https://github.com/morluto/rea/pull/2461", "author": { "login": "saya-ch", "__typename": "User" }, "mergeCommit": { "oid": "1dd6c2dff9252c27838589590e07f809a9b1ff42" }, "issues": [] }, { "number": 2462, "title": "docs: celebrate 170,000 GitHub stars 🎉", "url": "https://github.com/morluto/rea/pull/2462", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "91886982fccc50a9f7f31d4f320b25ffbcff35af" }, "issues": [] }, { "number": 2464, "title": "feat(wasm): compare retained core-module interfaces", "url": "https://github.com/morluto/rea/pull/2464", "author": { "login": "thangldw", "__typename": "User" }, "mergeCommit": { "oid": "911894d75822116141897a582c1e26e1d0273dba" }, "issues": [ { "number": 2356, "url": "https://github.com/morluto/rea/issues/2356", "author": { "login": "matbrgz", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2466, "title": "perf(native): run independent Mach-O slice commands concurrently", "url": "https://github.com/morluto/rea/pull/2466", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "2c7240cf9d8231e16ad01de7678af9dbd01bab46" }, "issues": [] }, { "number": 2467, "title": "fix(windows): preserve transient runtime admission failures", "url": "https://github.com/morluto/rea/pull/2467", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "172407787f1842dedbcd27b5385177595f786ce4" }, "issues": [ { "number": 2257, "url": "https://github.com/morluto/rea/issues/2257", "author": { "login": "Ashen00001", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2468, "title": "fix(process): preserve nested path identities during normalization", "url": "https://github.com/morluto/rea/pull/2468", "author": { "login": "rudycelekli", "__typename": "User" }, "mergeCommit": { "oid": "b9ee921560dcf4590c2b13a1cc92c49c93e10675" }, "issues": [] }, { "number": 2469, "title": "test(mcp): reuse advertised schema in inventory check", "url": "https://github.com/morluto/rea/pull/2469", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "a6efa4fcefeffcf5ff5310b8154988b4be30c349" }, "issues": [ { "number": 2453, "url": "https://github.com/morluto/rea/issues/2453", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2470, "title": "fix(ghidra): pre-create the launch-support config directory", "url": "https://github.com/morluto/rea/pull/2470", "author": { "login": "AbdulAzizWang", "__typename": "User" }, "mergeCommit": { "oid": "0ca70e121c43db41d02c5afb6439e15cbf335289" }, "issues": [] }, { "number": 2471, "title": "fix(process): resolve POSIX backslash basenames through PATH", "url": "https://github.com/morluto/rea/pull/2471", "author": { "login": "rudycelekli", "__typename": "User" }, "mergeCommit": { "oid": "03ab521db3330493372dd47ab858fc142feea5b9" }, "issues": [] }, { "number": 2472, "title": "fix(screenshot): reject invalid PNG header dimensions", "url": "https://github.com/morluto/rea/pull/2472", "author": { "login": "rudycelekli", "__typename": "User" }, "mergeCommit": { "oid": "e74e4e951bf59c42b25779b45d1c7b8dde6b618f" }, "issues": [] }, { "number": 2474, "title": "fix(config): reject NUL bytes in Hopper loader arguments", "url": "https://github.com/morluto/rea/pull/2474", "author": { "login": "rudycelekli", "__typename": "User" }, "mergeCommit": { "oid": "a07ceaec36346a7c73e66efe35c8af4654029c84" }, "issues": [] }, { "number": 2475, "title": "fix(javascript): parse explicit CommonJS wrapper syntax", "url": "https://github.com/morluto/rea/pull/2475", "author": { "login": "rudycelekli", "__typename": "User" }, "mergeCommit": { "oid": "6a04f922e16ad4d171ba0c07e32238efdaf43e2d" }, "issues": [] }, { "number": 2477, "title": "fix(browser): exclude sensitive binary lengths from historical captures", "url": "https://github.com/morluto/rea/pull/2477", "author": { "login": "chAng-L19", "__typename": "User" }, "mergeCommit": { "oid": "68ecf3df8c666fdbe1ced8089c64340af614d1c3" }, "issues": [] }, { "number": 2478, "title": "fix: align MCP archive contracts and documentation", "url": "https://github.com/morluto/rea/pull/2478", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "a86deecac5fa8434a4f50482f86b0c6ab486a936" }, "issues": [ { "number": 2454, "url": "https://github.com/morluto/rea/issues/2454", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2480, "title": "fix(browser): distinguish SVG links from HTML XLink attributes", "url": "https://github.com/morluto/rea/pull/2480", "author": { "login": "zhangguiping-xydt", "__typename": "User" }, "mergeCommit": { "oid": "84ec40f1af8ea7d74b757d7b50b391aec8482f8a" }, "issues": [ { "number": 2479, "url": "https://github.com/morluto/rea/issues/2479", "author": { "login": "zhangguiping-xydt", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2481, "title": "fix(setup): pin Hopper's macOS publisher identity before install", "url": "https://github.com/morluto/rea/pull/2481", "author": { "login": "NIU-123370", "__typename": "User" }, "mergeCommit": { "oid": "650237efb01b3c4a154799dbbedb2af1084f2312" }, "issues": [] }, { "number": 2482, "title": "fix(cli): normalize empty Windows profile before imports", "url": "https://github.com/morluto/rea/pull/2482", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "fa4b8288655188426222773ead2ccbdaf76334fd" }, "issues": [] }, { "number": 2484, "title": "fix(apple): report a recognized connector that cannot name its owner", "url": "https://github.com/morluto/rea/pull/2484", "author": { "login": "XiaoBinGan", "__typename": "User" }, "mergeCommit": { "oid": "cae7620b77ec2893c944197603cc9158e2224930" }, "issues": [] }, { "number": 2486, "title": "fix(pwntools): let callers widen the artifact input bound", "url": "https://github.com/morluto/rea/pull/2486", "author": { "login": "NIU-123370", "__typename": "User" }, "mergeCommit": { "oid": "c44d17fd3c4c71b86fcae401d9ff1088b4e27170" }, "issues": [ { "number": 2446, "url": "https://github.com/morluto/rea/issues/2446", "author": { "login": "amateurdcb", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2487, "title": "feat(signals): discover installed decoders and option help", "url": "https://github.com/morluto/rea/pull/2487", "author": { "login": "Olorinm", "__typename": "User" }, "mergeCommit": { "oid": "4276aaf18bb607cdd0182280f76cf50fcd110c3c" }, "issues": [] }, { "number": 2488, "title": "fix(process): accept a trace identifier the comparison result can represent", "url": "https://github.com/morluto/rea/pull/2488", "author": { "login": "XiaoBinGan", "__typename": "User" }, "mergeCommit": { "oid": "2c6a4fac4ff3477ac14f3d780894c5b390880607" }, "issues": [] }, { "number": 2489, "title": "test(perf): verify existing SQLite column selection on QGIS data", "url": "https://github.com/morluto/rea/pull/2489", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "45984a4319c8b6dcf2b03e969fbd4330c8432394" }, "issues": [] }, { "number": 2491, "title": "fix(browser): preserve unknown storage inventory and fingerprint coverage", "url": "https://github.com/morluto/rea/pull/2491", "author": { "login": "chAng-L19", "__typename": "User" }, "mergeCommit": { "oid": "c7ceaadb709ab5ac14a9487b3e170e3633cec250" }, "issues": [] }, { "number": 2493, "title": "fix(artifacts): read every ZIP package family extraction is asked to open", "url": "https://github.com/morluto/rea/pull/2493", "author": { "login": "XiaoBinGan", "__typename": "User" }, "mergeCommit": { "oid": "7017c4d68cab49aed998283e09069d9d791e1b0b" }, "issues": [] }, { "number": 2494, "title": "fix(domain): preserve retryable capability failures through redaction", "url": "https://github.com/morluto/rea/pull/2494", "author": { "login": "XiaoBinGan", "__typename": "User" }, "mergeCommit": { "oid": "d73ed6fce24f6d1372c80319cd41d29d66666159" }, "issues": [] }, { "number": 2495, "title": "fix(gemini): compare consolidated allowlists through one normalizer", "url": "https://github.com/morluto/rea/pull/2495", "author": { "login": "XiaoBinGan", "__typename": "User" }, "mergeCommit": { "oid": "b9b3a9098b072313119eccb3ae574faa57c3e517" }, "issues": [] }, { "number": 2496, "title": "feat(captures): discover installed protocol and field definitions", "url": "https://github.com/morluto/rea/pull/2496", "author": { "login": "Olorinm", "__typename": "User" }, "mergeCommit": { "oid": "9c34c091b3b8c47f8bd18d6f0321efde2dedb92a" }, "issues": [] }, { "number": 2497, "title": "docs(nativeaot): document the verified Windows-host parser route", "url": "https://github.com/morluto/rea/pull/2497", "author": { "login": "pablodiazjorge", "__typename": "User" }, "mergeCommit": { "oid": "75e7965dc3a8a72576b1d5f013b624da81d53607" }, "issues": [] }, { "number": 2499, "title": "fix(hopper): stop Linux demo children when the REA owner exits", "url": "https://github.com/morluto/rea/pull/2499", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "c105391db53e2e2ab8b8624d5f3870c14aae3637" }, "issues": [ { "number": 2459, "url": "https://github.com/morluto/rea/issues/2459", "author": { "login": "Joshwong1908", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2505, "title": "feat(recorded-crash): decode AArch64 core register notes", "url": "https://github.com/morluto/rea/pull/2505", "author": { "login": "NIU-123370", "__typename": "User" }, "mergeCommit": { "oid": "522b9927c80bf0a3d0ab3343a648a158e94eba0c" }, "issues": [ { "number": 2353, "url": "https://github.com/morluto/rea/issues/2353", "author": { "login": "matbrgz", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2506, "title": "fix(native): name the ownership helper prerequisite in command failures", "url": "https://github.com/morluto/rea/pull/2506", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "20f51d7286b1759e42f99c0512c73230052dda86" }, "issues": [] }, { "number": 2507, "title": "fix(pcap): name the host tool to configure in capability refusals", "url": "https://github.com/morluto/rea/pull/2507", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "bb96afdbe32f5318d57fcb00099191c5a7712f53" }, "issues": [] }, { "number": 2509, "title": "fix(pcap): order evidence ties by code point instead of host locale", "url": "https://github.com/morluto/rea/pull/2509", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "f6556ad2bc102d80223f5b434136f546dbd2bbab" }, "issues": [] }, { "number": 2510, "title": "test(pcap): run the missing-path refusal only where captures are admitted", "url": "https://github.com/morluto/rea/pull/2510", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "1991542e59f64d46269b3ff942be77a5ff06e88f" }, "issues": [] }, { "number": 2511, "title": "fix(ci): ignore generated website translation staging", "url": "https://github.com/morluto/rea/pull/2511", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "18831491cfb5cb98abbffce0cb04dae12a90fe28" }, "issues": [ { "number": 2508, "url": "https://github.com/morluto/rea/issues/2508", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2605, "title": "fix(native): keep lipo path echoes out of FAT records", "url": "https://github.com/morluto/rea/pull/2605", "author": { "login": "FengCi0", "__typename": "User" }, "mergeCommit": { "oid": "59d33a2733ce50ed0ac3d0371b4b646237d33619" }, "issues": [] }, { "number": 2628, "title": "perf(frida): evict captured messages without copying the whole queue", "url": "https://github.com/morluto/rea/pull/2628", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "6a05248d464387c0ce4ec1577b4c1b24d3d355c7" }, "issues": [] }, { "number": 2634, "title": "perf(native): add opt-in Mach-O summary delivery and retained pages", "url": "https://github.com/morluto/rea/pull/2634", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "bf34d0d2fc3cc22076f49d682e74a0b71aa1db18" }, "issues": [] }, { "number": 2635, "title": "test(javascript): verify Windows path case and load scope", "url": "https://github.com/morluto/rea/pull/2635", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "2f3dee3fcf65813d6daf7c3209d921451c160ddb" }, "issues": [] }, { "number": 2638, "title": "test(hopper): repair Linux demo setup and native verification", "url": "https://github.com/morluto/rea/pull/2638", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "141d2095f5c6faaf2d3c9b81b0f0f992cacec79c" }, "issues": [] }, { "number": 2640, "title": "test(perf): preserve negative small-PCAP workflow measurements", "url": "https://github.com/morluto/rea/pull/2640", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "c7105d9723c835b5e0122f5fc6cfbea86265c349" }, "issues": [] }, { "number": 2643, "title": "fix(process): preserve discovery ownership across cleanup retries", "url": "https://github.com/morluto/rea/pull/2643", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "9958754f6c2002dad39de6a64519af332b81244d" }, "issues": [] }, { "number": 2680, "title": "fix(application): accept alternative document selection in binary_ove…", "url": "https://github.com/morluto/rea/pull/2680", "author": { "login": "yashas1624", "__typename": "User" }, "mergeCommit": { "oid": "23dc8fbf83a36b7fb273674b74fc3c80de9acf1c" }, "issues": [] }, { "number": 2683, "title": "fix(artifacts): report malformed ZIP archives as format failures", "url": "https://github.com/morluto/rea/pull/2683", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "cd2ad1f24084e68910e4ceab4a33e1b88998ebe7" }, "issues": [] }, { "number": 2685, "title": "fix(snapshot): classify non-object roots as invalid content", "url": "https://github.com/morluto/rea/pull/2685", "author": { "login": "jiangjiang248", "__typename": "User" }, "mergeCommit": { "oid": "9cf49c7a784ace9b79e4b4c1022c9fbf2b3f77e1" }, "issues": [ { "number": 2675, "url": "https://github.com/morluto/rea/issues/2675", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2686, "title": "fix(setup): treat empty DSH_HOME as unset", "url": "https://github.com/morluto/rea/pull/2686", "author": { "login": "rollroyces", "__typename": "User" }, "mergeCommit": { "oid": "af782dd5f56463fcd2a6a0af918569d70696551f" }, "issues": [ { "number": 2666, "url": "https://github.com/morluto/rea/issues/2666", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2687, "title": "fix(cli): reject empty analyze and artifact target paths", "url": "https://github.com/morluto/rea/pull/2687", "author": { "login": "chqcjq", "__typename": "User" }, "mergeCommit": { "oid": "2b98fc5f518f6da06a4f5157f5b7dd90014bbd6f" }, "issues": [] }, { "number": 2690, "title": "perf(artifacts): share sealed inventory and report in inspect_artifact", "url": "https://github.com/morluto/rea/pull/2690", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "11268fe241a86fde0b462270dd8708934c74ab06" }, "issues": [] }, { "number": 2691, "title": "test: share repeated boundary preambles to restore the jscpd gate", "url": "https://github.com/morluto/rea/pull/2691", "author": { "login": "NIU-123370", "__typename": "User" }, "mergeCommit": { "oid": "8b1549a264a914a1aec97d6945fc68ec8c5e1f64" }, "issues": [] }, { "number": 2692, "title": "fix(process): honor startup deadlines and add a CI audit skill", "url": "https://github.com/morluto/rea/pull/2692", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "21aa877e5ae3164cfbfab6f6db27967995ebc8c3" }, "issues": [ { "number": 2760, "url": "https://github.com/morluto/rea/issues/2760", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2697, "title": "fix(dotnet): name the instruction when a CIL operand leaves the method body", "url": "https://github.com/morluto/rea/pull/2697", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "97dc6581f45adfe5fcaa9c98e77e7dc6bc423a6e" }, "issues": [ { "number": 2677, "url": "https://github.com/morluto/rea/issues/2677", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2698, "title": "refactor(process): give the prlimit producer budget one owner", "url": "https://github.com/morluto/rea/pull/2698", "author": { "login": "NIU-123370", "__typename": "User" }, "mergeCommit": { "oid": "782cc3b060562f0397dd9f48827ef5e4ffc456a9" }, "issues": [] }, { "number": 2699, "title": "docs(android): link the JADX provider download", "url": "https://github.com/morluto/rea/pull/2699", "author": { "login": "Seelly", "__typename": "User" }, "mergeCommit": { "oid": "3620074b318a3b2182237d39b52d5d4aee832317" }, "issues": [] }, { "number": 2704, "title": "fix(dotnet): name the truncated instruction when an operand leaves the method body", "url": "https://github.com/morluto/rea/pull/2704", "author": { "login": "YunzhouLi-hub", "__typename": "User" }, "mergeCommit": { "oid": "97268f40ea21b5f2d24b08c0c068a7ccf41459d4" }, "issues": [] }, { "number": 2705, "title": "fix(electron): reject non-executable paths and contain launch rejections", "url": "https://github.com/morluto/rea/pull/2705", "author": { "login": "CassieFox23", "__typename": "User" }, "mergeCommit": { "oid": "97aff282018907e7e48dc67fc12043e1237e2c99" }, "issues": [ { "number": 2272, "url": "https://github.com/morluto/rea/issues/2272", "author": { "login": "BeLit-Development-2", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2707, "title": "fix(apktool): accept --no-strings CLI option", "url": "https://github.com/morluto/rea/pull/2707", "author": { "login": "HeadmasterEggy", "__typename": "User" }, "mergeCommit": { "oid": "11f8b7625788d747eaadd59af6efdf88587ed058" }, "issues": [ { "number": 2672, "url": "https://github.com/morluto/rea/issues/2672", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2708, "title": "fix(captures): name the violated HAR schema constraint", "url": "https://github.com/morluto/rea/pull/2708", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "b69d20a300dba57783a810146f25dacb69f9b8a4" }, "issues": [] }, { "number": 2710, "title": "fix(application): preserve a cancellation that races a completed provider run", "url": "https://github.com/morluto/rea/pull/2710", "author": { "login": "XiaoBinGan", "__typename": "User" }, "mergeCommit": { "oid": "855ed9689e972903d3c6854907dac83207a00141" }, "issues": [] }, { "number": 2712, "title": "fix(cli): refuse scenario steps on passive native UI observation", "url": "https://github.com/morluto/rea/pull/2712", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "96d1f0f3fbc1a36664c62b66d7de8cc2f8837f52" }, "issues": [ { "number": 2674, "url": "https://github.com/morluto/rea/issues/2674", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2713, "title": "refactor(firmware): split verification into staged functions", "url": "https://github.com/morluto/rea/pull/2713", "author": { "login": "ShreyanshJain105", "__typename": "User" }, "mergeCommit": { "oid": "a8b50ea147ab3aaa2870160481e09403c3310ea0" }, "issues": [] }, { "number": 2715, "title": "perf(evidence): reuse sealed bundle reads in compare and export", "url": "https://github.com/morluto/rea/pull/2715", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "9680da76c84a6833635dc7a5df607806d899f804" }, "issues": [] }, { "number": 2716, "title": "fix(reference): report entries beyond the path limit as I/O failures", "url": "https://github.com/morluto/rea/pull/2716", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "679658b28748729c9b881497e680c811a708f5f3" }, "issues": [ { "number": 2652, "url": "https://github.com/morluto/rea/issues/2652", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2720, "title": "fix(process): report no remaining time after a provider deadline fires", "url": "https://github.com/morluto/rea/pull/2720", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "ae9a7f34e17850eda3419102c4ddc24995653c64" }, "issues": [] }, { "number": 2724, "title": "fix(artifacts): bound expanded ASAR listing before allocation", "url": "https://github.com/morluto/rea/pull/2724", "author": { "login": "chAng-L19", "__typename": "User" }, "mergeCommit": { "oid": "f825c869d6e94e27759160f3d0d3e82b5d2f55db" }, "issues": [] }, { "number": 2727, "title": "fix(flutter): name a missing or non-file APK selection", "url": "https://github.com/morluto/rea/pull/2727", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "46f51ee6cc45efc546369eae1691b76dfddc5825" }, "issues": [] }, { "number": 2728, "title": "fix(javascript): preserve asterisks in block source-map URLs", "url": "https://github.com/morluto/rea/pull/2728", "author": { "login": "chqcjq", "__typename": "User" }, "mergeCommit": { "oid": "9240a4e9ac22f6307ca591853c8c56ce2d0a5d56" }, "issues": [ { "number": 2662, "url": "https://github.com/morluto/rea/issues/2662", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2730, "title": "fix(setup): keep a Cordis operation's own fields when uninstall empties it", "url": "https://github.com/morluto/rea/pull/2730", "author": { "login": "JayOfTheKeyboard", "__typename": "User" }, "mergeCommit": { "oid": "ba06d9ec521f2654f6916ca58e38d33213dd6ddb" }, "issues": [] }, { "number": 2732, "title": "docs(website): publish essay on reverse engineering models", "url": "https://github.com/morluto/rea/pull/2732", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "f1f5582ce84f54e529826fef7af3e201f52248d9" }, "issues": [] }, { "number": 2733, "title": "fix(apple): derive dyld environment findings from each traced slice", "url": "https://github.com/morluto/rea/pull/2733", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "52d4ce6ced1c3b6ae7570a5df7f4499cd65a1182" }, "issues": [ { "number": 2661, "url": "https://github.com/morluto/rea/issues/2661", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2737, "title": "fix(javascript): retain distinct chunk registration callback metadata", "url": "https://github.com/morluto/rea/pull/2737", "author": { "login": "chqcjq", "__typename": "User" }, "mergeCommit": { "oid": "0cf224e76214abbcf47274aa936d1b5cad28db2f" }, "issues": [ { "number": 2663, "url": "https://github.com/morluto/rea/issues/2663", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2738, "title": "fix(apktool): read the resource locale grammar from its owner", "url": "https://github.com/morluto/rea/pull/2738", "author": { "login": "XiaoBinGan", "__typename": "User" }, "mergeCommit": { "oid": "59298923a5fc22eb3bfe192511b7fc72aaa85321" }, "issues": [] }, { "number": 2739, "title": "fix(process): order interaction differences by their dispatch time", "url": "https://github.com/morluto/rea/pull/2739", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "ce748be2f30d5086e62106ca7d7d0d7b26b8fd28" }, "issues": [ { "number": 2645, "url": "https://github.com/morluto/rea/issues/2645", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2742, "title": "fix(javascript): preserve Electron runtime entrypoint paths", "url": "https://github.com/morluto/rea/pull/2742", "author": { "login": "HeadmasterEggy", "__typename": "User" }, "mergeCommit": { "oid": "3a4d49406a4f3c0b566b6a16f3655c08b1354e19" }, "issues": [ { "number": 2670, "url": "https://github.com/morluto/rea/issues/2670", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2744, "title": "feat(setup): add Kimi Code client support", "url": "https://github.com/morluto/rea/pull/2744", "author": { "login": "ysntony", "__typename": "User" }, "mergeCommit": { "oid": "efc491ab4527b9e2084c6519f250472a1322b096" }, "issues": [] }, { "number": 2745, "title": "fix(javascript): trace nested Electron bridge members", "url": "https://github.com/morluto/rea/pull/2745", "author": { "login": "HeadmasterEggy", "__typename": "User" }, "mergeCommit": { "oid": "f0b8ae1fc8347bffa363ec49ac210850123ee699" }, "issues": [ { "number": 2669, "url": "https://github.com/morluto/rea/issues/2669", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2747, "title": "fix(javascript): retain bridge conditions on IPC joins", "url": "https://github.com/morluto/rea/pull/2747", "author": { "login": "HeadmasterEggy", "__typename": "User" }, "mergeCommit": { "oid": "c6166d4b56d6c6e4ad33980464edc8697672168a" }, "issues": [ { "number": 2668, "url": "https://github.com/morluto/rea/issues/2668", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2748, "title": "fix(javascript): keep spread child argv counts unknown", "url": "https://github.com/morluto/rea/pull/2748", "author": { "login": "xu91102", "__typename": "User" }, "mergeCommit": { "oid": "b19f9e4d2dc0c4e863b4b2e567b3eaf9cf320983" }, "issues": [ { "number": 2746, "url": "https://github.com/morluto/rea/issues/2746", "author": { "login": "xu91102", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2754, "title": "fix(session): preserve investigation records after failed target opens", "url": "https://github.com/morluto/rea/pull/2754", "author": { "login": "Adkid-Zephyr", "__typename": "User" }, "mergeCommit": { "oid": "af7638fa9d049283719c9c103bc59b49faab9676" }, "issues": [ { "number": 2753, "url": "https://github.com/morluto/rea/issues/2753", "author": { "login": "Adkid-Zephyr", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2755, "title": "test(apple): keep the same-named slice dyld fixture openable on x64 hosts", "url": "https://github.com/morluto/rea/pull/2755", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "fb28ec1537e2d02aaca96325483c849c5c8ade6f" }, "issues": [] }, { "number": 2756, "title": "fix(javascript): retain configuration reads before member access", "url": "https://github.com/morluto/rea/pull/2756", "author": { "login": "xu91102", "__typename": "User" }, "mergeCommit": { "oid": "72b9ab4af16a4f19383aa6dde4b12f25fab7f59f" }, "issues": [ { "number": 2575, "url": "https://github.com/morluto/rea/issues/2575", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2757, "title": "fix(native): preserve unresolved calls in untyped route fallback", "url": "https://github.com/morluto/rea/pull/2757", "author": { "login": "IvenKooLab", "__typename": "User" }, "mergeCommit": { "oid": "48b90fbaa4978d1f605b9901d58e6c4ab5ec78b6" }, "issues": [] }, { "number": 2758, "title": "fix(native): keep bounded trace edges and depth consistent", "url": "https://github.com/morluto/rea/pull/2758", "author": { "login": "IvenKooLab", "__typename": "User" }, "mergeCommit": { "oid": "f90382756d4625d2a50b0cf6a4c30de038289b9a" }, "issues": [] }, { "number": 2761, "title": "fix(javascript): exclude TypeScript this annotations from runtime parameters", "url": "https://github.com/morluto/rea/pull/2761", "author": { "login": "xu91102", "__typename": "User" }, "mergeCommit": { "oid": "1ae90005874034b59741bf59809b75150b54a257" }, "issues": [ { "number": 2570, "url": "https://github.com/morluto/rea/issues/2570", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2762, "title": "fix(browser): treat an unusable cache list as incomplete storage coverage", "url": "https://github.com/morluto/rea/pull/2762", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "c580ba940a1a29c586db47ad7df5234d51e0cc4a" }, "issues": [ { "number": 2660, "url": "https://github.com/morluto/rea/issues/2660", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2764, "title": "fix(native): bound captured output carried by native command failures", "url": "https://github.com/morluto/rea/pull/2764", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "5996d8160f2429965b30070d04b26aba472af1db" }, "issues": [] }, { "number": 2765, "title": "fix(javascript): preserve container ownership for getter mutations", "url": "https://github.com/morluto/rea/pull/2765", "author": { "login": "To3akaRin", "__typename": "User" }, "mergeCommit": { "oid": "eeeb4ca379a948109542e66a8d0adb3998f6f60d" }, "issues": [ { "number": 2654, "url": "https://github.com/morluto/rea/issues/2654", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2766, "title": "fix(javascript): ignore erased TypeScript names in native-addon requests", "url": "https://github.com/morluto/rea/pull/2766", "author": { "login": "BeqaKs", "__typename": "User" }, "mergeCommit": { "oid": "06739aeaf259ab709fd8014e0cde83c5ea25d0a0" }, "issues": [ { "number": 2667, "url": "https://github.com/morluto/rea/issues/2667", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2767, "title": "fix(capture): end special-scheme URL authorities at a backslash", "url": "https://github.com/morluto/rea/pull/2767", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "77be0f6666df67de48ad737fe5b5d204aa34ae85" }, "issues": [ { "number": 2671, "url": "https://github.com/morluto/rea/issues/2671", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2768, "title": "feat(cli): summarize committed reference-source inventories", "url": "https://github.com/morluto/rea/pull/2768", "author": { "login": "To3akaRin", "__typename": "User" }, "mergeCommit": { "oid": "93e29d242ae60a3d2daec355e7a31b4a0bdd4234" }, "issues": [ { "number": 2442, "url": "https://github.com/morluto/rea/issues/2442", "author": { "login": "matbrgz", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2770, "title": "fix(reference): preserve directory intent when resolving source imports", "url": "https://github.com/morluto/rea/pull/2770", "author": { "login": "Shenrui-Ma", "__typename": "User" }, "mergeCommit": { "oid": "68ecdcd7a130806a03067fbfcce5ee90c70b968f" }, "issues": [] }, { "number": 2772, "title": "fix(ghidra): read UTF-8 signed language definitions", "url": "https://github.com/morluto/rea/pull/2772", "author": { "login": "yasshmittal", "__typename": "User" }, "mergeCommit": { "oid": "ec4f4ddc588a564b75d69249b4ebbe4d4051c792" }, "issues": [ { "number": 2533, "url": "https://github.com/morluto/rea/issues/2533", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2773, "title": "fix(browser): keep malformed Content-Length declarations unknown", "url": "https://github.com/morluto/rea/pull/2773", "author": { "login": "yasshmittal", "__typename": "User" }, "mergeCommit": { "oid": "c22d7cd7567b52e6e6ba13f14df11c4a720c0c4e" }, "issues": [ { "number": 2596, "url": "https://github.com/morluto/rea/issues/2596", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2774, "title": "fix(sqlite): attribute unknown column selections to columns", "url": "https://github.com/morluto/rea/pull/2774", "author": { "login": "yasshmittal", "__typename": "User" }, "mergeCommit": { "oid": "d2e16b2a4998818be5f29219467b97cc15ae8061" }, "issues": [ { "number": 2613, "url": "https://github.com/morluto/rea/issues/2613", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2775, "title": "fix(sqlite): classify a missing database path as an invalid value", "url": "https://github.com/morluto/rea/pull/2775", "author": { "login": "yasshmittal", "__typename": "User" }, "mergeCommit": { "oid": "4c79127fcb31c5e85c4806f5a9522e00674f10e4" }, "issues": [ { "number": 2614, "url": "https://github.com/morluto/rea/issues/2614", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2777, "title": "docs(readme): sync Turkish translation with current README", "url": "https://github.com/morluto/rea/pull/2777", "author": { "login": "kalayciburak", "__typename": "User" }, "mergeCommit": { "oid": "c8ef1f916cb0f94a39d74320f58398ba1bc2b17d" }, "issues": [] }, { "number": 2778, "title": "fix(javascript): retain getter receivers through local aliases", "url": "https://github.com/morluto/rea/pull/2778", "author": { "login": "To3akaRin", "__typename": "User" }, "mergeCommit": { "oid": "dea770d5d9e4af92bc3fa6a8ffad9ff414f6e4e6" }, "issues": [ { "number": 2653, "url": "https://github.com/morluto/rea/issues/2653", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2779, "title": "docs(installation): document Linux procps prerequisite", "url": "https://github.com/morluto/rea/pull/2779", "author": { "login": "HeadmasterEggy", "__typename": "User" }, "mergeCommit": { "oid": "b11fe63bf4d9c4ea375b071599c374429f0b54e7" }, "issues": [ { "number": 2763, "url": "https://github.com/morluto/rea/issues/2763", "author": { "login": "mredodos", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2781, "title": "fix(javascript): recover child-process options without args", "url": "https://github.com/morluto/rea/pull/2781", "author": { "login": "naimur-reza", "__typename": "User" }, "mergeCommit": { "oid": "c8e85b962a58929cc272d966cfc0dd6e2409ed1d" }, "issues": [] }, { "number": 2783, "title": "fix(uninstall): remove the REA-owned ZCode fallback registration", "url": "https://github.com/morluto/rea/pull/2783", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "ff56f785946c609b09c1c60232b28d7c34ac89a9" }, "issues": [ { "number": 2664, "url": "https://github.com/morluto/rea/issues/2664", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2788, "title": "fix(javascript): keep logical assignment results uncertain for unknown values", "url": "https://github.com/morluto/rea/pull/2788", "author": { "login": "Ganesh2325", "__typename": "User" }, "mergeCommit": { "oid": "7e3a19863835215491b55fba7127a78bad6a7709" }, "issues": [ { "number": 2646, "url": "https://github.com/morluto/rea/issues/2646", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2790, "title": "feat(evm): inspect lossless Solidity terminal CBOR metadata", "url": "https://github.com/morluto/rea/pull/2790", "author": { "login": "morluto", "__typename": "User" }, "mergeCommit": { "oid": "48a683ac8c780786f0a2a71ab64aca5994087c00" }, "issues": [] }, { "number": 2792, "title": "fix(ghidra): fail doctor when the JVM os.arch selects an unvalidated decompiler directory", "url": "https://github.com/morluto/rea/pull/2792", "author": { "login": "sx4im", "__typename": "User" }, "mergeCommit": { "oid": "20e4f83097511090205c9f867c62bca0152e6676" }, "issues": [ { "number": 2785, "url": "https://github.com/morluto/rea/issues/2785", "author": { "login": "dogskip", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2794, "title": "fix(analysis-view): bound limitations and unknowns per view", "url": "https://github.com/morluto/rea/pull/2794", "author": { "login": "bruno-candia", "__typename": "User" }, "mergeCommit": { "oid": "20b802f165b572cc067d14d3011563cad4508285" }, "issues": [] }, { "number": 2795, "title": "fix(hopper): recover from a Spotlight not-found launch", "url": "https://github.com/morluto/rea/pull/2795", "author": { "login": "bruno-candia", "__typename": "User" }, "mergeCommit": { "oid": "4d98123279c5a6f5442c458307f5a3ec678fd49e" }, "issues": [] }, { "number": 2796, "title": "fix(wasm): attribute invalid paths to their selected fields", "url": "https://github.com/morluto/rea/pull/2796", "author": { "login": "maxazure", "__typename": "User" }, "mergeCommit": { "oid": "0bc422d7bed1184a6b9fc0ea2655e4b2c5e1c4f4" }, "issues": [ { "number": 2618, "url": "https://github.com/morluto/rea/issues/2618", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2797, "title": "fix(javascript): preserve empty ESM import names in provenance", "url": "https://github.com/morluto/rea/pull/2797", "author": { "login": "chqcjq", "__typename": "User" }, "mergeCommit": { "oid": "ed24604ee10362b063feb8610cee1f2049df65c8" }, "issues": [ { "number": 2647, "url": "https://github.com/morluto/rea/issues/2647", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2798, "title": "fix(reconstruction): reject contradictory function comparison status", "url": "https://github.com/morluto/rea/pull/2798", "author": { "login": "maxazure", "__typename": "User" }, "mergeCommit": { "oid": "173da755cd6b922f8310a1efa0fb8435be2e4d64" }, "issues": [ { "number": 2623, "url": "https://github.com/morluto/rea/issues/2623", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2799, "title": "fix(reverse): reconcile cleanup ownership and mutation diagnostics", "url": "https://github.com/morluto/rea/pull/2799", "author": { "login": "morluto", "__typename": "User" }, "mergeCommit": { "oid": "4aa51bfe1997ef2df6e905ab2fb7bcd5fabfe16e" }, "issues": [] }, { "number": 2802, "title": "fix(apktool): resolve Windows PATH launchers before invocation", "url": "https://github.com/morluto/rea/pull/2802", "author": { "login": "morluto", "__typename": "User" }, "mergeCommit": { "oid": "1eca60051506cce310116854fdb59ef9cd195a7e" }, "issues": [] }, { "number": 2804, "title": "fix(flutter): find snapshot headers that a read chunk boundary splits", "url": "https://github.com/morluto/rea/pull/2804", "author": { "login": "Dragolone", "__typename": "User" }, "mergeCommit": { "oid": "5278835b534a9787a680f94ad2182c314f24c1e9" }, "issues": [] }, { "number": 2807, "title": "fix(sqlite): keep triggers whose declaration spells the table in another case", "url": "https://github.com/morluto/rea/pull/2807", "author": { "login": "Dragolone", "__typename": "User" }, "mergeCommit": { "oid": "94072364c7f8410b0e86e72c912c2611572b278f" }, "issues": [] }, { "number": 2808, "title": "fix(cli): refuse a JavaScript integrity policy the binary analyze lane cannot honor", "url": "https://github.com/morluto/rea/pull/2808", "author": { "login": "XiaoBinGan", "__typename": "User" }, "mergeCommit": { "oid": "641a8395ee6e7f9fbf268765bb3e2ff3c2604dd2" }, "issues": [] }, { "number": 2814, "title": "fix(ida): retain cleanup facts and let one-shot commands exit", "url": "https://github.com/morluto/rea/pull/2814", "author": { "login": "morluto", "__typename": "User" }, "mergeCommit": { "oid": "7369b5ee63c69af8af18601bb1de92dd41c6a250" }, "issues": [] }, { "number": 2818, "title": "test(signals): verify native decoder discovery coverage", "url": "https://github.com/morluto/rea/pull/2818", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "87a8c8c9236f72fe771aa1f1771e87132f24b1d5" }, "issues": [] }, { "number": 2831, "title": "fix(source-maps): accept omitted names during browser collection", "url": "https://github.com/morluto/rea/pull/2831", "author": { "login": "shoyann", "__typename": "User" }, "mergeCommit": { "oid": "1016c96e6ba920c1c7da6898db16929145c749be" }, "issues": [ { "number": 2826, "url": "https://github.com/morluto/rea/issues/2826", "author": { "login": "shoyann", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2833, "title": "fix(javascript): exclude HTML URL suffixes from path admission", "url": "https://github.com/morluto/rea/pull/2833", "author": { "login": "shoyann", "__typename": "User" }, "mergeCommit": { "oid": "1f122c02b71dae7f4109f35ed834f82b96fbf247" }, "issues": [ { "number": 2827, "url": "https://github.com/morluto/rea/issues/2827", "author": { "login": "shoyann", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2838, "title": "fix(apple): exclude AppleDouble sidecars from IPA components", "url": "https://github.com/morluto/rea/pull/2838", "author": { "login": "yasshmittal", "__typename": "User" }, "mergeCommit": { "oid": "e13da084e7c5967b80632ae5ad8d3d37bcf57469" }, "issues": [ { "number": 2546, "url": "https://github.com/morluto/rea/issues/2546", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2842, "title": "fix(browser): read expression-free template literals as module specifiers", "url": "https://github.com/morluto/rea/pull/2842", "author": { "login": "shubhamahuja9999", "__typename": "User" }, "mergeCommit": { "oid": "bcb60c179e30c6e7caa1113cb98e91744bfea3a6" }, "issues": [ { "number": 2599, "url": "https://github.com/morluto/rea/issues/2599", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } }, { "number": 2841, "url": "https://github.com/morluto/rea/issues/2841", "author": { "login": "shubhamahuja9999", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2844, "title": "fix(ghidra): import HashMap in the bridge script", "url": "https://github.com/morluto/rea/pull/2844", "author": { "login": "SeokMyungSeop", "__typename": "User" }, "mergeCommit": { "oid": "204a6f3f20c48d3bbf96d8f2819f391150dafe32" }, "issues": [] }, { "number": 2848, "title": "fix(mcp): count the error flag in error result budgets", "url": "https://github.com/morluto/rea/pull/2848", "author": { "login": "shubhamahuja9999", "__typename": "User" }, "mergeCommit": { "oid": "3e7c6302233ecbcb9b92e43ee5a60337738961bd" }, "issues": [ { "number": 2557, "url": "https://github.com/morluto/rea/issues/2557", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2854, "title": "fix(browser): preserve distinct WebMCP declaration metadata", "url": "https://github.com/morluto/rea/pull/2854", "author": { "login": "zhangguiping-xydt", "__typename": "User" }, "mergeCommit": { "oid": "40e94aeb9d127f61f554efdc7ab69c666fbf2c37" }, "issues": [ { "number": 2624, "url": "https://github.com/morluto/rea/issues/2624", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2858, "title": "fix(browser): preserve script-specific parser uncertainty", "url": "https://github.com/morluto/rea/pull/2858", "author": { "login": "zhangguiping-xydt", "__typename": "User" }, "mergeCommit": { "oid": "e6c6fdd21a769906c538629498cd9c1465821a94" }, "issues": [ { "number": 2627, "url": "https://github.com/morluto/rea/issues/2627", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2860, "title": "fix(qlog): list a hidden stream's records without spreading call arguments", "url": "https://github.com/morluto/rea/pull/2860", "author": { "login": "Dragolone", "__typename": "User" }, "mergeCommit": { "oid": "39f96d7188a75e96af7875f16b02b6a0b7facfe3" }, "issues": [] }, { "number": 2861, "title": "fix(browser): report complete storage key inventory changes", "url": "https://github.com/morluto/rea/pull/2861", "author": { "login": "zhangguiping-xydt", "__typename": "User" }, "mergeCommit": { "oid": "02095cd74a39e55227e554b37ed76e62476e8e94" }, "issues": [ { "number": 2608, "url": "https://github.com/morluto/rea/issues/2608", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2873, "title": "fix(source-maps): keep sources when sourcesContent length differs", "url": "https://github.com/morluto/rea/pull/2873", "author": { "login": "rileygramlich", "__typename": "User" }, "mergeCommit": { "oid": "3f80b75708f88e51c64eb0122c178b96789c53b3" }, "issues": [ { "number": 2821, "url": "https://github.com/morluto/rea/issues/2821", "author": { "login": "shoyann", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2882, "title": "fix(cli): keep file URLs out of operator-relative path resolution", "url": "https://github.com/morluto/rea/pull/2882", "author": { "login": "shubhamahuja9999", "__typename": "User" }, "mergeCommit": { "oid": "f652709cac54441f401e90b6a604997c9321d70d" }, "issues": [ { "number": 2577, "url": "https://github.com/morluto/rea/issues/2577", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2886, "title": "fix(browser): retain optional source-map requires", "url": "https://github.com/morluto/rea/pull/2886", "author": { "login": "JFSAS", "__typename": "User" }, "mergeCommit": { "oid": "f1045001f03ca0ddb2247769e3b4d1fadedaf630" }, "issues": [ { "number": 2883, "url": "https://github.com/morluto/rea/issues/2883", "author": { "login": "JFSAS", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2895, "title": "fix: repair the static-check failures on the default branch", "url": "https://github.com/morluto/rea/pull/2895", "author": { "login": "XiaoBinGan", "__typename": "User" }, "mergeCommit": { "oid": "df3d96da801976fdbe37a726c2f4f84af8ffbf90" }, "issues": [] }, { "number": 2897, "title": "docs: celebrate 200,000 GitHub stars 🎉", "url": "https://github.com/morluto/rea/pull/2897", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "b8513401e1344a7c0322b8906820db2f81b9be20" }, "issues": [] }, { "number": 2901, "title": "fix(managed): share native verification input diagnostics", "url": "https://github.com/morluto/rea/pull/2901", "author": { "login": "ShitK", "__typename": "User" }, "mergeCommit": { "oid": "501c5d45fe60cae4a6337f38fc417f86d13e1ae8" }, "issues": [ { "number": 2621, "url": "https://github.com/morluto/rea/issues/2621", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2902, "title": "test(windows): verify retained inspection ownership after rename", "url": "https://github.com/morluto/rea/pull/2902", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "6a7f70fd5422489e724de54d1fd6052416b9732d" }, "issues": [ { "number": 2898, "url": "https://github.com/morluto/rea/issues/2898", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2906, "title": "fix(native): accept declared facts in dispatch name inventory", "url": "https://github.com/morluto/rea/pull/2906", "author": { "login": "ShitK", "__typename": "User" }, "mergeCommit": { "oid": "0c9ee56c2f819d122f12cb5872c5db76cfee1169" }, "issues": [ { "number": 2564, "url": "https://github.com/morluto/rea/issues/2564", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2910, "title": "fix: isolate Linux inventory and repair DEX schema regex", "url": "https://github.com/morluto/rea/pull/2910", "author": { "login": "morluto", "__typename": "User" }, "mergeCommit": { "oid": "69bd81f7f2768b22fb75caa753f4b21a8e5d249d" }, "issues": [] }, { "number": 2912, "title": "fix(managed): retain raw CIL changes in member comparison", "url": "https://github.com/morluto/rea/pull/2912", "author": { "login": "Vaishnavi220506", "__typename": "User" }, "mergeCommit": { "oid": "a9195c3a9804d8b815eddb4431c486b048548dfe" }, "issues": [] }, { "number": 2917, "title": "test(android): preserve malformed DEX prototype rejection", "url": "https://github.com/morluto/rea/pull/2917", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "d82ad1faf0b2774c56a10d8a81b09defacd99c7b" }, "issues": [] }, { "number": 2936, "title": "fix(package-verifier): reject overview responses without a procedure count", "url": "https://github.com/morluto/rea/pull/2936", "author": { "login": "CodeAlex52", "__typename": "User" }, "mergeCommit": { "oid": "4758ba30b6852c49b9539a2e815af22b3f822341" }, "issues": [ { "number": 2518, "url": "https://github.com/morluto/rea/issues/2518", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2938, "title": "fix(ci): enforce merge verification and unblock superseded runs", "url": "https://github.com/morluto/rea/pull/2938", "author": { "login": "morluto", "__typename": "User" }, "mergeCommit": { "oid": "8fef2aa64ec1ee742e8b70b825938d30a0ea7319" }, "issues": [] }, { "number": 2941, "title": "perf(javascript): reuse semantic member-mutation lookups", "url": "https://github.com/morluto/rea/pull/2941", "author": { "login": "gongfpp", "__typename": "User" }, "mergeCommit": { "oid": "0c6c571a01f0c35aa56a0189fb8b8adfd0012c61" }, "issues": [] }, { "number": 2943, "title": "fix(ci): skip portable report merge when shards are skipped", "url": "https://github.com/morluto/rea/pull/2943", "author": { "login": "morluto", "__typename": "User" }, "mergeCommit": { "oid": "2895a18ca92f415ae62f87167ba9c7a672e3b7dc" }, "issues": [] }, { "number": 2952, "title": "fix(javascript-semantics): keep emitted data out of dispatch listener fields", "url": "https://github.com/morluto/rea/pull/2952", "author": { "login": "saurabh-sol", "__typename": "User" }, "mergeCommit": { "oid": "090b454350591f58d3349fa992109d55414f5294" }, "issues": [ { "number": 2574, "url": "https://github.com/morluto/rea/issues/2574", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2962, "title": "perf(javascript): defer ambiguity expansion in version comparisons", "url": "https://github.com/morluto/rea/pull/2962", "author": { "login": "Shenrui-Ma", "__typename": "User" }, "mergeCommit": { "oid": "388b907c923133096a3387272367cbfb04ff1c04" }, "issues": [] }, { "number": 2964, "title": "test(reconstruction): declare complete comparison fixture facets", "url": "https://github.com/morluto/rea/pull/2964", "author": { "login": "morluto", "__typename": "User" }, "mergeCommit": { "oid": "7a6defab186b0d9b137360b5a300ce2251383775" }, "issues": [] }, { "number": 2973, "title": "fix(verify-package): read Hopper installer applicability from its owner", "url": "https://github.com/morluto/rea/pull/2973", "author": { "login": "txiki739", "__typename": "User" }, "mergeCommit": { "oid": "e1897c3c17c342cddf8834622c9d63e7bc6ff313" }, "issues": [ { "number": 2939, "url": "https://github.com/morluto/rea/issues/2939", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2976, "title": "fix(session): reject an unknown configured provider before unbound routing", "url": "https://github.com/morluto/rea/pull/2976", "author": { "login": "555aaditya", "__typename": "User" }, "mergeCommit": { "oid": "64041e3072e968002e2085445217ccde1f36e5d7" }, "issues": [ { "number": 2592, "url": "https://github.com/morluto/rea/issues/2592", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2982, "title": "feat(analysis-view): report observed query parameter names", "url": "https://github.com/morluto/rea/pull/2982", "author": { "login": "wunianze666-netizen", "__typename": "User" }, "mergeCommit": { "oid": "dd36b4a8a0c2c93216961f351856d54dd23e7156" }, "issues": [ { "number": 2913, "url": "https://github.com/morluto/rea/issues/2913", "author": { "login": "zhangguiping-xydt", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2985, "title": "docs(i18n): add Greek translations", "url": "https://github.com/morluto/rea/pull/2985", "author": { "login": "pirrozani", "__typename": "User" }, "mergeCommit": { "oid": "ddcdb3c37837fb8eda0fdee92853774453f1b4ef" }, "issues": [ { "number": 2984, "url": "https://github.com/morluto/rea/issues/2984", "author": { "login": "pirrozani", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 2990, "title": "fix(adb): remove false exclusivity from the push-file description", "url": "https://github.com/morluto/rea/pull/2990", "author": { "login": "3QL", "__typename": "User" }, "mergeCommit": { "oid": "9630c8ff46533fe63ec0e06212d01545070d17f0" }, "issues": [ { "number": 2602, "url": "https://github.com/morluto/rea/issues/2602", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 3001, "title": "fix(javascript): keep CommonJS percent bytes literal", "url": "https://github.com/morluto/rea/pull/3001", "author": { "login": "ShivekRanjan", "__typename": "User" }, "mergeCommit": { "oid": "80592b82a6f854886862978533bb405e3f2e38c5" }, "issues": [] }, { "number": 3002, "title": "fix(ghidra): preserve function facet and call coverage", "url": "https://github.com/morluto/rea/pull/3002", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "242e2b0001095524382183b771aa444310900942" }, "issues": [ { "number": 2951, "url": "https://github.com/morluto/rea/issues/2951", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 3007, "title": "perf(ci): share trusted caches and fail fast on PR test failures", "url": "https://github.com/morluto/rea/pull/3007", "author": { "login": "morluto", "__typename": "User" }, "mergeCommit": { "oid": "0bf01dfa595c6d2bf7012c049a253895d89de8b8" }, "issues": [] }, { "number": 3013, "title": "perf(ci): start source feedback early and diagnose stalled runs", "url": "https://github.com/morluto/rea/pull/3013", "author": { "login": "morluto", "__typename": "User" }, "mergeCommit": { "oid": "6510d0d57f9d37da866fdf4fdf9d3146f974fd28" }, "issues": [] }, { "number": 3018, "title": "test(analysis-view): order the message-cutoff fixture lexicographically", "url": "https://github.com/morluto/rea/pull/3018", "author": { "login": "morconsultoriadigital-afk", "__typename": "User" }, "mergeCommit": { "oid": "1342eddd03ff4f50cf87484d36fcd72b698d80af" }, "issues": [] }, { "number": 3021, "title": "docs(readme): restore Greek guide and official-source links", "url": "https://github.com/morluto/rea/pull/3021", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "14fef73882f8789d80e5af5cf44b25244a15e357" }, "issues": [] }, { "number": 3041, "title": "feat(setup): add WorkBuddy client support", "url": "https://github.com/morluto/rea/pull/3041", "author": { "login": "cainiao1992", "__typename": "User" }, "mergeCommit": { "oid": "e049ef70f71aeb9965e9d75d4d4a84ea02eaee11" }, "issues": [ { "number": 3040, "url": "https://github.com/morluto/rea/issues/3040", "author": { "login": "cainiao1992", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 3044, "title": "fix(javascript): report EventSource and sendBeacon URLs as network endpoints", "url": "https://github.com/morluto/rea/pull/3044", "author": { "login": "xpeng5278-web", "__typename": "User" }, "mergeCommit": { "oid": "bbf0638e884d29cac21cb1f51fa0d41dce36d3a1" }, "issues": [ { "number": 3042, "url": "https://github.com/morluto/rea/issues/3042", "author": { "login": "xpeng5278-web", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 3046, "title": "docs(readme): sync Korean README with the English README", "url": "https://github.com/morluto/rea/pull/3046", "author": { "login": "8rulerstar", "__typename": "User" }, "mergeCommit": { "oid": "2dc89f81be807de88b7b19b5f4ffcc7bff171068" }, "issues": [] }, { "number": 3060, "title": "test(ghidra): preserve address alias restoration failures", "url": "https://github.com/morluto/rea/pull/3060", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "419063043261b5342f46ad702f069009212e6ad3" }, "issues": [ { "number": 2924, "url": "https://github.com/morluto/rea/issues/2924", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 3061, "title": "perf(managed): add retained member summary and pages", "url": "https://github.com/morluto/rea/pull/3061", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "74844016018dfdb171132c0d1d2c937905b16d1f" }, "issues": [ { "number": 3010, "url": "https://github.com/morluto/rea/issues/3010", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 3080, "title": "fix: restore JavaScript analysis and current regression checks", "url": "https://github.com/morluto/rea/pull/3080", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "7ad75bdc80d1d45dd9fb4c0b3153997cb392a710" }, "issues": [] }, { "number": 3086, "title": "docs(process): clarify terminal progress message fields", "url": "https://github.com/morluto/rea/pull/3086", "author": { "login": "1052326311", "__typename": "User" }, "mergeCommit": { "oid": "f3534749e564421036ac445f536fc766b038208f" }, "issues": [ { "number": 3052, "url": "https://github.com/morluto/rea/issues/3052", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 3089, "title": "fix(native): classify every Swift mangling prefix as invalid when undecodable", "url": "https://github.com/morluto/rea/pull/3089", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "f4df6ab280ce30395816159a05ee3c89ff47ff0f" }, "issues": [] }, { "number": 3104, "title": "fix(electron): preserve selected fuse inspection paths", "url": "https://github.com/morluto/rea/pull/3104", "author": { "login": "shoyann", "__typename": "User" }, "mergeCommit": { "oid": "ec67aebed02dbd20fa5c7703fcd183ad0b1c343c" }, "issues": [] }, { "number": 3108, "title": "fix(setup): refuse linked skill installation directories", "url": "https://github.com/morluto/rea/pull/3108", "author": { "login": "geekwolf", "__typename": "User" }, "mergeCommit": { "oid": "cf6ea097116bdf3578b1e02e35c772d8aa92db00" }, "issues": [ { "number": 3057, "url": "https://github.com/morluto/rea/issues/3057", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 3112, "title": "docs(release): review compatibility for the current candidate", "url": "https://github.com/morluto/rea/pull/3112", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "58300885207133422af235e0f2b10658cf958b03" }, "issues": [ { "number": 3058, "url": "https://github.com/morluto/rea/issues/3058", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 3119, "title": "fix(ci): check authored documentation code", "url": "https://github.com/morluto/rea/pull/3119", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "500e32399a3bc827e17fb4adaa97db3bc0df29b5" }, "issues": [ { "number": 3116, "url": "https://github.com/morluto/rea/issues/3116", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 3163, "title": "fix(native): derive Mach-O word size and byte order from the selected slice", "url": "https://github.com/morluto/rea/pull/3163", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "3f5b7033799f9fe993ad5b81fb51c8f822173817" }, "issues": [] }, { "number": 3165, "title": "fix(electron): attach error listener to spawned node process in readiness fixture", "url": "https://github.com/morluto/rea/pull/3165", "author": { "login": "qorvr", "__typename": "User" }, "mergeCommit": { "oid": "877d40408b0d9a670fa19a53440b7e75022ca14a" }, "issues": [] }, { "number": 3200, "title": "perf(native): skip llvm-nm's dyld-info pass when the symbol table names every export", "url": "https://github.com/morluto/rea/pull/3200", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "e5791229f3d64e3b3ccc9d839b8e4c567e97cc98" }, "issues": [] }, { "number": 3226, "title": "fix(evm): decode shortest-form empty CBOR text in Solidity metadata", "url": "https://github.com/morluto/rea/pull/3226", "author": { "login": "pablodiazjorge", "__typename": "User" }, "mergeCommit": { "oid": "e195b8ba91c0b8b6cc6c71a696588e08711bf41c" }, "issues": [ { "number": 3203, "url": "https://github.com/morluto/rea/issues/3203", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 3228, "title": "fix(docs): render README source notices as GitHub alerts", "url": "https://github.com/morluto/rea/pull/3228", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "96e7c22a9cc917448ed080e11cde4dacd2a2d70a" }, "issues": [] }, { "number": 3232, "title": "test(perf): evaluate larger and non-HTTP packet workflows", "url": "https://github.com/morluto/rea/pull/3232", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "ca7450beffff59325ce3bddc78e181693ce77177" }, "issues": [ { "number": 3130, "url": "https://github.com/morluto/rea/issues/3130", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 3242, "title": "fix(sqlite): keep a retained worker owner after a failed worker exit", "url": "https://github.com/morluto/rea/pull/3242", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "bdacd4140ef68d6860b70867d058939d0b4d37d1" }, "issues": [] }, { "number": 3248, "title": "perf(artifacts): overlap bundle magic reads while enumerating dylib roots", "url": "https://github.com/morluto/rea/pull/3248", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "307af044bc0bdc15bc836c549e774220af8f459e" }, "issues": [] }, { "number": 3260, "title": "test(domain): keep rejected Evidence payloads inert", "url": "https://github.com/morluto/rea/pull/3260", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "fb752d229391a8c4d65b6dd970e3eb6053affa9a" }, "issues": [ { "number": 3251, "url": "https://github.com/morluto/rea/issues/3251", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 3270, "title": "docs(readme): add the Linux ps prerequisite to the Korean README", "url": "https://github.com/morluto/rea/pull/3270", "author": { "login": "danbom", "__typename": "User" }, "mergeCommit": { "oid": "535c8ef3031d6808c8e03986d513b4507931b777" }, "issues": [] }, { "number": 3274, "title": "feat(website): simplify the reader journey and beginner setup", "url": "https://github.com/morluto/rea/pull/3274", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "7c962cc70bcebf6201da9c5db5b7c0edd2564ae7" }, "issues": [] }, { "number": 3276, "title": "fix(website): correct Korean FAQ translations", "url": "https://github.com/morluto/rea/pull/3276", "author": { "login": "danbom", "__typename": "User" }, "mergeCommit": { "oid": "1c296f11a1fe994fe74a3c9d43db2efd3ac8c86e" }, "issues": [] }, { "number": 3280, "title": "fix(website): correct the Korean skip-link label", "url": "https://github.com/morluto/rea/pull/3280", "author": { "login": "danbom", "__typename": "User" }, "mergeCommit": { "oid": "9385060f9c804e393858e97e25b507cfc060ae91" }, "issues": [] }, { "number": 3283, "title": "fix(artifacts): inventory universal slices REA cannot structurally index", "url": "https://github.com/morluto/rea/pull/3283", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "e5828596c50029e48feb7f56d6f5fe7b5580a561" }, "issues": [] }, { "number": 3285, "title": "perf(artifacts): run the asset catalog and Interface Builder bundle walks together", "url": "https://github.com/morluto/rea/pull/3285", "author": { "login": "kaoru0822-kitauji", "__typename": "User" }, "mergeCommit": { "oid": "04345767a85394741416d1ebf8285db0eed7ca30" }, "issues": [] }, { "number": 3286, "title": "docs(contributing): require human ownership and review readiness", "url": "https://github.com/morluto/rea/pull/3286", "author": { "login": "morluto", "__typename": "User" }, "mergeCommit": { "oid": "90d4098a01b62d0e00dd79376465c2243aff800d" }, "issues": [] }, { "number": 3287, "title": "docs(contributing): strengthen issue evidence guidance", "url": "https://github.com/morluto/rea/pull/3287", "author": { "login": "morluto", "__typename": "User" }, "mergeCommit": { "oid": "69b850960225a59fa9a957c530e489ba2a816830" }, "issues": [] }, { "number": 3294, "title": "fix(apple): order projection paths by Unicode code point", "url": "https://github.com/morluto/rea/pull/3294", "author": { "login": "Sriram-PR", "__typename": "User" }, "mergeCommit": { "oid": "57290a01ac9e89b1e3f395e0bc2611cc47a6762b" }, "issues": [ { "number": 3177, "url": "https://github.com/morluto/rea/issues/3177", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 3299, "title": "test(ci): correct Rizin readiness and Hopper launcher fixtures", "url": "https://github.com/morluto/rea/pull/3299", "author": { "login": "N0zoM1z0", "__typename": "User" }, "mergeCommit": { "oid": "a32b4b6ac54a02a8fe9a7cb62861e54473ba5eb0" }, "issues": [ { "number": 3295, "url": "https://github.com/morluto/rea/issues/3295", "author": { "login": "N0zoM1z0", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 3300, "title": "fix(apple): keep unrooted extensionless Mach-O in IPA executables", "url": "https://github.com/morluto/rea/pull/3300", "author": { "login": "Sriram-PR", "__typename": "User" }, "mergeCommit": { "oid": "ffeb2d436756008a764ec2045157855098768381" }, "issues": [ { "number": 3174, "url": "https://github.com/morluto/rea/issues/3174", "author": { "login": "coygeek", "__typename": "User" }, "repository": { "nameWithOwner": "morluto/rea" } } ] }, { "number": 3302, "title": "ci: validate initial PR readiness declarations", "url": "https://github.com/morluto/rea/pull/3302", "author": { "login": "morluto", "__typename": "User" }, "mergeCommit": { "oid": "5f0065c54217852ff26ae2b0071c6671f0528682" }, "issues": [] } ] }