Preserve the owner-observed opaque caller reason through preparation, collection and cleanup failure wrapping without assigning cleanup authority or serializing the raw reason.
Validation: 68 focused process/deadline tests; check:fast; docs:check (5 conformance tests). Controlled local process fixtures only; no native provider verification.
Refs: #4638
Produce typed cancellation at each command checkpoint while retaining the exact opaque reason as cause. Preserve independent typed physical failures without downstream equality guesses.
Validated 72 focused tests across nine files, static checks, docs and five conformance controls, including real client/service admission races and matching physical-error controls. No native Cutter engine or new public-transport reproduction claimed.
Refs: #4635
Pass the requesting operation into the descriptor failure owner. Discovery retains its own identity; command execution and completion confirmation retain cutter_command with exact cleanup dependencies.
Validated 61 focused tests across five files, including denied retry and successful native descriptor release. Controlled close faults; no native Cutter engine verified.
Refs: #4634
Parse command status and validate session identity at one bridge boundary. Keep the preflight watermark requirement separate from exact completion receipt proof, and retain status as a compact auxiliary diagnostic.
Reuse authenticated protocol and descriptor fixtures. Validate 66 focused tests across eight files, static checks, docs and five conformance controls. CLI refusal controls use an authenticated loopback fixture; native Cutter was not verified.
Refs: #4607
Attribute shared startup failures separately for each accepted operation. Preserve the original stage as a compact diagnostic, with typed timeout budgets, limits, output, recovery and exact cleanup dependencies.
Link cancellation wrappers to the originating live cleanup owner, including release before and after wrapping. Remove the redundant typed-error branch.
Validated 130 focused tests, static checks, docs and five conformance controls; four source controls rerun after fixture type correction. Public CLI uses a loopback supervisor; no native IDA engine verified.
Refs: #4614, #4633
Retain the primary error through cleanup composition and resolve its presentation only after live ownership confirms release. Preserve historical diagnostics separately from producer facts.
Validate domain primary types, nested owners, denied retry and late observations; exercise public CLI and MCP projection plus firmware descriptor retry. Focused tests, source controls, static checks and docs pass. Native providers were not verified.
Refs: #4628
Reuse canonical artifact chunk reads across hash, snapshot, range and publication, leaving cleanup to the exact owner. Let the reader own cancellation, preserve same-read physical failures, and classify growth past the input allowance through the existing typed admission failure.
Validation: 46 focused tests across four files, docs checks and five conformance tests. Native file IO with controlled faults; no Linux firmware engines verified. Shared post-cleanup error projection remains tracked in #4628. Refs #4619, #4475
Classify the WABT reader file-size boundary as a deterministic resource constraint with its input allowance. Give Go input-size refusals selected-input recovery rather than evidence-write advice. Preserve configuration and cleanup semantics.
Validation: 66 focused tests across four files including public CLI refusals, plus docs checks and five conformance tests. Sparse admission fixtures and version-only WABT stubs; no real WABT execution. Refs #4621, #4622
Parse window focus into declaration records, normalize explicit null references once, and preserve original named lines in Evidence. Keep fallback based on declaration presence and retain unknown focus when both sections omit fields.
Validation: 86 focused tests including public CLI/MCP with advertised schemas, plus docs checks and five conformance tests. Fake ADB only; no physical device verified. Refs #4608
Share source identity and one iterative pattern walker across declarations and assignments. Traverse nested default targets without losing dependency paths, preserving existing scalar-default occurrence identities and conservative unresolved slots.
Validation: 405 focused tests across five files, including public CLI dependency Evidence. Refs #4609, #4604
Use the canonical cooked literal value for for-in and for-of string cardinality, preserving possible assignments and prototype uncertainty across quoted and template spellings.
Validation: 473 focused tests across six files, including public CLI assignment Evidence and exported return shapes. Refs #4617
Do not interpret exact caller cancellation reasons as descriptor ownership records. Preserve checkpoint-shaped reasons through successful close retry and supply cancellation context in direct signal-aware cleanup consumers.
Validation: 156 focused tests across 14 files passed; no native provider execution. Refs #4610
Charge inner alias and branch work to the existing getter query budget before allocating queued states. Widen local suffixes during fallback so a single getter cannot reintroduce path permutations.
Validation: two new class/object controls fail on the baseline; 411 tests across eight affected files pass. Public CLI baseline/candidate controls preserve unrelated observations and expose intended partial resource coverage. Typecheck/lint, docs and formatting pass. Diagnostic costs retained; no speed or token reduction claim. This fixes a separate getter gap and does not resolve the getter-free Qodo input. Refs #3839.
* fix(objc): isolate empty Objective-C protocol method selectors
A protocol method_list_t entry whose selector reached an empty string was
appended to objc_protocols and objc_protocol_records unchecked. The final
metadata schema then rejected the whole result, discarding every valid
class, protocol and category.
The protocol method decoder now skips only that entry and reports it as
a protocol failure. The protocol keeps its other method declarations, and
its record is marked partial with protocol_method_selector_empty.
Fixes#4540
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(objc): treat empty local category class names as unresolved
A category whose class reference pointed at a mapped local class with an
empty class_ro_t name took that empty string as class_name. The final
metadata schema then rejected the whole result, discarding every valid
class, protocol and category.
An empty local class name now fails the class reference the same way an
unmapped one does: the category is kept with class_name null,
class_source unresolved and a category_class_unresolved issue, and its
name, methods and protocols survive.
Fixes#4541
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
* fix(ghidra): resolve keg-only Homebrew openjdk on macOS (#4556)
Fixes an issue where the `ghidra-java` check fails when OpenJDK is installed via Homebrew on macOS (where it is keg-only and not added to `PATH` or resolved by `java_home`).
- **Problem:** When `options.javaHome` is undefined, the provider defaulted to a bare `"java"` command, causing valid Homebrew OpenJDK installations to be reported as missing dependencies.
- **Solution:** Replaced the single fallback with an absolute candidate list (`javaCandidates`) that probes standard Homebrew OpenJDK paths (`/opt/homebrew/opt/openjdk/...` and `/usr/local/opt/openjdk/...`) before falling back to `"java"`. All candidates are absolute, preserving existing constraints and current behavior.
* fix(ghidra): fix javaHome type narrowing in java candidate list (#4556)
Fixes a TypeScript compilation error (`TS2322` and `TS2345`) in `src/ghidra/GhidraInstallation.ts` where `options.javaHome` was inferred as `string | undefined` inside `path.join()`.
- **Problem:** The ternary operator structure prevented TypeScript from narrowing `options.javaHome` to `string` in the `path.join()` call when `options.javaHome` was defined, causing CI compile checks to fail.
- **Solution:** Refactored the `javaCandidates` assignment using an immediately invoked function expression (IIFE) with an explicit `if (options.javaHome === undefined)` check. This properly narrows `options.javaHome` to `string` in the non-undefined branch while keeping the same logic and Homebrew OpenJDK paths intact.
* fix(ghidra): order homebrew java candidates by host architecture (#4556)
Updates the Homebrew OpenJDK candidate ordering in `src/ghidra/GhidraInstallation.ts` to be architecture-aware, addressing review feedback regarding cross-architecture runs (e.g., x64 under Rosetta on Apple Silicon).
- **Problem:** Previously, `/opt/homebrew` was always checked before `/usr/local`. When running REA as an x64 process under Rosetta on Apple Silicon, this could incorrectly select an ARM64 JDK over an Intel/x64 one, triggering a `nativeDecompilerCheck` failure and missing the valid fallback.
- **Solution:** Dynamically orders `javaCandidates` based on the runtime `architecture`. On `arm64`, `/opt/homebrew` is prioritized; on `x64`, `/usr/local` is prioritized. Bare `"java"` remains first in both cases to preserve standard PATH resolution.
---------
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
Project canonical timeout and cancellation facts at the provider boundary while preserving causes, partial observations, live cleanup dependencies and provider-authored deadline guidance.
Validation: four real SDK/HTTP catalog and tool timeout controls fail before the fix. After rebasing onto the Ghidra timeout guidance change, 189 tests across ten files pass, including public CLI/MCP workflows and affected Ghidra tests. Typecheck/lint, docs, format and discovery pass. No native JEB engine or target verification. Refs #4597.
Bind pending SDK resources to exact cleanup leases, coalesce disposal, and retry only unresolved children. Shared startup callers retain final cleanup while independent peers can cancel their waits.
Attribute SDK aborts by exact owned rejection identity, preserve physical failures under late cancellation, and retain completed Evidence at the application boundary.
Validation: 83 focused tests across eight files; typecheck/lint, docs check, formatting and discovery. Controlled real HTTP/SDK faults only; no native JEB engine or target verification. Refs #4603.
Own the parsed engine facts separately from identity projections. Reuse successful unknown-version metadata, retain explicit refresh, and bind each execution identity to its own selected metadata under concurrent inspection.
Refs #4600 and #4597. Six affected files pass 58 tests; static, documentation and discovery checks passed. Real JEB and reconnect behavior remain unverified; prepared reconnect PR3754 stays separate pending cleanup ownership work.
Pass the caller operation into the shared client-information producer and consume its parsed facts during inspection. Remove duplicate metadata parsing and the forwarding wrapper.
Refs #4597. Baseline real CLI/MCP controls failed for three requested operations; all 51 affected tests and static checks now pass. The endpoint is simulated; real JEB refusal behavior is unverified.
Cover ADB pull, package and bugreport physical failures and completed cancellation across successful and failed closes. Verify artifact retention callback timing and Pcap failed-admission owner recovery.
Refs #4598. Controlled real host files and simulated ADB output; native close faults and Android device behavior remain unverified.
Record cancellation at file checkpoints and before owner handoff. Keep physical hash failures, exact reasons, completed facts and failed-close owners distinct through artifact and provider projections and cleanup retries.
Refs #4598. Validated with 566 passing affected tests and 22 platform skips; final Kuna cleanup reason rerun passed 43 tests. No Android device or real JADX/Kuna execution claimed.
Classify producer-recorded timeout and capture overflow before configuration fallback, and pass typed failures through provider admission. Preserve exact version-probe cancellation reasons and parsed output facts. Clarify command lifecycle diagnostics.
Related: #3886, #4594. Controlled Node subprocess, provider/application and actual CLI regressions cover late abort ordering, active and preadmission cancellation, validated partial Evidence, physical failures, capture overflow and the unchanged ten-second deadline. The affected suite passed 218 tests across 14 files; static/docs/format/discovery checks passed. Native adb/device and Windows execution remain unverified.
Remaining related work: shared file-close cancellation provenance for digest consumers requires a separate producer and consumer migration.
Use the subprocess owner cancellation marker instead of the later signal state or an arbitrary ABORT_ERR code. Preserve the exact caller reason and captured output, and share parsed output projection with existence probes.
Related: #4594. Controlled process and source regressions fail on 9a95db681; the affected 14-file suite passes 218 tests. Actual Node subprocesses and simulated adb clients were exercised on macOS; no Android device or native Windows run.
Block showItemInFolder and writeShortcutLink using the shared active shell boundary, preserving undefined/false synchronous refusal contracts and shape-only timeline evidence.
Retain Nitin13-git implementation and add base-red/shared-contract coverage plus a reproducible unchanged Joplin welcome-attachment reveal. Local87cases, static and docs pass. The explicit test argv shim verifies the operation phase; standard startup and provider cleanup remain unsuccessful and are recorded without a full-workflow performance claim.
Fixes#4393
Co-authored-by: Nitin13-git <internshipsvc01@gmail.com>
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Plan and approve Cursor setup in an isolated home, edit an unrelated server, then uninstall and verify both the historical backup and exact pre-uninstall recovery bytes. Related: #4581, PR #4580.
The new real CLI control fails on f9ccacca2 with a missing recovery file and passes with the recovery owner fix. Verified on macOS; native Windows/Linux runs remain unverified.
Route skill backup selection and verification through the shared recovery owner with the installer resource scope. Reuse verified snapshots without copying and remove duplicate selection and EEXIST handling.
Cover failed closes at first backup, recovery backup, and post-copy verification; block new descriptors while cleanup is pending and retain the exact owner through disposal retries. Related: #4592.
Validation: 158 focused tests and 511 adjacent setup tests passed; check:fast, docs:check and formatting passed. Close failures were injected on real file handles on macOS; native Windows/Linux faults were not reproduced.
Add cases where the backup copy reports success but leaves the recovery
file missing or holding other bytes; uninstall must fail before writing.
Narrow the installation guide so it promises a backup path only for the
failures that report one.
(cherry picked from commit 70bff72403)
Keep bounded stable reads, format interpretation, snapshot writes and final descriptor cleanup under exact owners. Join complete provider profile work during shutdown and retain primary failures through late cancellation and cleanup retry.
Related: #4584, #4586
Own ADB command failure facts once and interpret only the clean empty test false result as absence. Preserve unknown probe output and reuse parsed facts for package refusals.
Related: #4574
Join pending profile producers on cancellation and shutdown. Preserve failed results before later signals, retain every automatic-selection cleanup owner, and move profile file ownership into the registry.
Related: #4569
Model spawnSync results as typed Buffer output, retain Unicode path assertions, and verify ENOBUFS remains runtime_unavailable with captured diagnostics.
Fixes four stale fixture failures observed in Linux portable and Windows curated CI at ae07d1517. Validation: 131 tests passed across five Java admission files; check:fast passed. Native Windows rerun remains CI verification.
Retain exact file and directory cleanup owners through profile admission and launch reinspection. Preserve typed primary failures and exact cancellation; keep fingerprint framing and bounds stable.
Validation: 137 tests passed, 3 platform skips across six filesystem/provider/MCP files; check:fast passed. Controlled real-handle fixtures do not establish actual Allegrex execution or native Windows faults.
Refs: #4521, #4517. Shared profile evaluation completion remains tracked in #4569.
Explain how to select an existing Homebrew JDK with JAVA_HOME when macOS
Java discovery cannot find a keg-only installation. Preserve caller-selected
runtime inputs and the Ghidra installation's declared Java bounds. Document
the installation paths and retain a regression showing only the requested
Java command is probed; no automatic JDK discovery or installation added.
Validation: 4 focused files, 122 passed; npm run check and docs:check passed.
Public CLI prerequisite fixtures ran on macOS; Homebrew keg-only guidance
is source/fixture verified against the primary formula documentation, not
a fresh Homebrew installation or a Windows runtime test.
Refs #4556
Replace ambiguous absent observations with an owning Result producer for
Java prerequisite probes. Preserve missing-command, runtime-failure and
unresolved-property outcomes, process error codes, both bounded streams,
raw byte counts and partial properties through provider and doctor adapters.
Reject malformed numeric-prefix versions while retaining their source facts.
Migrate all injected hosts to the named probe contract and remove the old
parser/observation ownership from installation discovery.
Validation: 17 focused files, 350 passed; npm run check passed. Public doctor
fixtures distinguish absent/nonzero/malformed commands. Real installed JDK
and Ghidra readiness facts matched across 20 baseline/candidate CLI tasks.
Warm repeat raw replies6392tokens each, elapsed .448/.444s, CPU .662/.660s;
sampled family memory varied and reversed direction on repeat. No causal
performance improvement claim, true-cold or full-agent/fault-path measurement.
Synchronous probe deadline/cancellation/family cleanup remains #4561 and needs
coordinated discovery/admission supervision; no claim that it is fixed here.
No real failing JVM or Windows runtime verification performed.
Refs #4560, #4561
Normalize empty addresses once at the symbol-inventory interpretation
boundary. Keep Swift and Objective-C records with null locations, preserve
the original empty value in evidence.reported_address, and retain partial
coverage instead of failing the entire metadata result. Nonempty provider
address syntax remains unchanged.
Validation: domain and production-registration MCP regressions failed before
the fix. Ten focused files passed 181 tests with 2 skipped, including SDK
converted JSON Schema/catalog validation and graph consumers. npm run check
and docs:check passed (5 documentation tests). Fixture provider only; no
native-provider malformed-symbol or Windows runtime reproduction claimed.
BREAKING CHANGE: Swift symbol address can now be null when the provider has
no location. Clients consuming swift_symbols must handle an unknown address.
The original provider value is retained in optional evidence.reported_address.
Refs #4542
Allow the composed one-shot dispatch workflow to open a covered Mach-O
without selecting a deep provider. The registry still owns selector
precedence; explicit request/environment choices remain binding, while
non-Mach-O and unsupported hosts retain deep symbol fallback. Requested
snapshots keep ordinary binding and profile semantics.
Share runtime composition and target admission with the native byte reader.
Keep target parsing, resource ownership and Evidence on the original session.
Validation: 13 focused files, 192 passed and 2 skipped; npm run check passed.
The six previously blocked native property CLI controls now pass. Ten measured
CLI workflows preserved exact metadata facts; warm raw reply token medians
1344/927, elapsed .475/.547s, CPU .691/.745s, sampled family RSS351.2/359.3MiB
baseline/candidate. Baseline used explicit Ghidra workaround; true cold and
full-agent costs unmeasured. No speed/memory improvement or Windows claim.
Refs #4555
Validate protocol and implementation selectors, ivar names and category
names before publishing records. Share validated local class identity
between class, superclass and category consumers, retaining unresolved
addresses and the decoder's failure reason.
Byte fixtures reproduced the reported validation failures. Final focused
4-file run: 118 passed; npm run check passed. Six existing CLI property
controls remain blocked before decoding by deep-provider auto-selection
ambiguity, as exposed by improved assertion diagnostics (#4555).
No Windows runtime or real malformed-application verification performed.
Refs #4540, #4541, #4533, #4534, #4115, #4555
Compose native utility sessions for the five existing static CLI questions.
Keep ordinary session routing for native runtime observations, and retain
caller-selected environments, target admission, Evidence and cleanup.
Validation: 17 focused files, 97 passed and 2 skipped; npm run check passed.
The three thin Mach-O CLI regressions now pass with macOS native utilities.
No Windows runtime verification or performance measurements performed.
Refs #4555
Refs #4475.
Check public cleanup projection and retained primary diagnostics instead of a
superseded error subclass and flat diagnostic location. Require the caller's
retained error to resolve after the exact cleanup owner succeeds on retry.
Validation: 59 tests passed in the cached Linux audit container with Node
24.18.0 and npm 11.16.0, including both failing CI regressions. Producers are
controlled Node fixtures, not real unblob/binwalk engines. The temporary
container was removed through its recorded owner. Static checks passed.
Refs #4522, #4526, #4555.
Retain producer-owned compiler output and cleanup markers through xcrun
resolution and native failure projection. Keep physical preparation failures
primary and preserve separate command deadline classification for interrupted
preparation. Omitted output facts stay unknown; client close does not resolve
foreign helper cleanup. Include CLI failure output in native regression reports.
Validation: 87 focused tests passed. Broader 140-file run passed 1483 tests,
skipped 109, and exposed three pre-existing deep-provider selection failures
tracked in #4555. Static checks passed. Compiler faults use controlled Node
fixtures; native Swift compiler faults and Windows execution were not verified.
Other command consumers still need preparation-fact propagation.
Document the translated README and website PO contribution entry points. Resolve README filenames through the existing locale inventory, preserving canonical Korean README links.
Validated on Linux with docs:check, five README consistency tests, all 20 inventory README paths, and current-head CI/automated reviews.
Preserve invalid V8 script events as unavailable protocol data instead of merging them into target-policy exclusions. Keep independent producer counts, original Evidence, and existing target authority.
Validated with 90 focused Linux tests, real Node Inspector CLI/MCP captures, complete static/architecture checks, and current-head automated review/CI.
Fixes#4376.
morluto