35a4e18d30
refactor(build): generate MCP tool catalog at build time instead of committing it ( #997 )
...
src/generatedMcpToolCatalog.ts had zero runtime importers and churned on every contract edit, guaranteeing merge conflicts on long-lived branches. It is now gitignored and regenerated by build:unlocked; typecheck and knip depend on build via turbo. Tests consume the build output unchanged. Adds a regen-generated CI workflow that pushes tracked generated metadata (product catalog, skill frontmatter, verification manifest/ledger, package metadata, error schema) to same-repo PR branches.
2026-10-08 00:16:34 +08:00
c67530535a
Merge pull request #994 from HoneyTyagii/perf/canonical-digest-batching-904
...
perf(domain): batch canonical digest writes with bounded buffer
2026-10-07 09:14:23 -07:00
4a6073810a
fix(contracts): align CLI/MCP boundary contracts ( #946 )
...
* fix(cli): validate native scenario and preserve JSON paths
* fix(process): reject invalid UTF-8 JSON inputs
* fix(cli): retain missing JSON path diagnostics
* test(cli): cover relative brace and bracket JSON paths
* test(cli): reject missing native scenario steps
* fix(mcp): advertise reserved process environment key
* fix(process): reject NUL in process scenario values
* fix(process): advertise NUL input constraints to MCP
* fix(cli): report scenario input schema issues
* fix(contracts): align CLI and MCP input validation
* fix(mcp): document semantic output constraints
* fix(mcp): describe process journal compatibility
* docs: regenerate catalog after schema grouping
* docs: regenerate catalog after main merge
* fix(cli): preserve JSON and native UI input diagnostics
* test(mcp): reuse advertised tool schemas in managed flow
2026-10-08 00:03:36 +08:00
fc4a9a0592
fix(artifacts): preserve reader failure diagnostics ( #987 )
...
* fix(artifacts): preserve filesystem and DMG diagnostics
* fix(artifacts): classify DMG verification failures
* fix(artifacts): distinguish inaccessible disk images
* fix(artifacts): classify damaged image checksums
2026-10-07 23:58:07 +08:00
abd7a5ed09
perf(artifacts): stream ASAR members without full buffering ( #962 )
...
* fix(artifacts): stream ASAR members without full buffering
* fix(artifacts): close unopened ASAR member streams
* fix(artifacts): preserve unpacked ASAR mismatch digests
* fix(artifacts): preserve ASAR read failures
* fix(artifacts): retain unpacked ASAR stat failures
* fix(artifacts): validate ASAR entry producer identity
2026-10-07 23:57:05 +08:00
58381eefa2
perf(inspector): bound runtime script location authorization ( #945 )
...
* perf(inspector): authorize script locations concurrently
* fix(inspector): bound concurrent location authorization
* fix(inspector): stop queued authorization on failure
* test(inspector): avoid freezing authorization scheduling
2026-10-07 23:54:31 +08:00
ebb065e2dc
perf(comparison): reuse canonical sort keys ( #990 )
2026-10-07 23:54:09 +08:00
2cedde9f1c
perf(javascript): index Promise return-site ownership ( #971 )
...
* perf(javascript): index promise return ownership lookups
* perf(javascript): defer Promise return-site indexing
2026-10-07 23:53:41 +08:00
7dc40d3d9e
perf(evidence): scale imports and dependency graphs ( #941 )
...
* perf(evidence): avoid rebuilding ledger on record imports
* perf(evidence): scale unknown graph validation
* fix(evidence): preserve import and projection semantics
* fix(evidence): invalidate cache on metadata replacement
* test(evidence): isolate snapshot import regression
* fix(evidence): preserve snapshots on additive imports
2026-10-07 23:47:47 +08:00
dca14900c4
perf(domain): batch canonical digest writes with bounded buffer
2026-10-07 21:16:44 +05:30
93aa9eb5c2
fix(process): harden filesystem snapshot identity and cancellation ( #956 )
...
* fix(process): bind snapshots to captured file identity
* fix(process): honor snapshot cancellation for empty files
* test(process): verify snapshot descriptor cleanup
* fix(process): preserve snapshot cancellation results
* fix(process): preserve non-cancellation capture failures
* test(process): verify descriptor cleanup with fstat
* fix(process): detect snapshot changes by ctime
* test(process): prove snapshot ctime invalidation
2026-10-07 23:45:23 +08:00
9f496ef2d4
fix(native)!: preserve incomplete native UI captures ( #991 )
...
* fix(native): preserve unknown accessibility child counts
* fix(native): align helper buffer with capture budget
* fix(native): align Swift helper JSON wire size
* fix(native): bound raw helper output to scenario budget
2026-10-07 23:44:41 +08:00
0a4caf4a0a
fix(evaluation): canonicalize Unicode argument keys ( #980 )
2026-10-07 23:19:49 +08:00
98b2b027af
fix(linux): improve Hopper reliability and CachyOS support ( #963 )
...
* fix(linux): support CachyOS Hopper hosts
* fix(config): reuse user-local Hopper launcher
* fix(hopper): harden Linux demo dialog handling
* chore: retrigger CI after PR title fix
* fix(linux): align Hopper defaults and support docs
---------
Co-authored-by: Ysopwnable <161784452+N0zoM1z0@users.noreply.github.com >
2026-10-07 23:16:48 +08:00
8aaf9a1978
fix(firmware): retain multi-file extraction failures ( #978 )
2026-10-07 23:06:41 +08:00
d5c43d65f0
fix(cli): preserve output and comparison input validation ( #981 )
2026-10-07 23:04:54 +08:00
71ac83f3dd
fix(apple): traverse keyed archive hierarchy collections ( #976 )
2026-10-07 23:00:43 +08:00
fb3749aff6
fix(android): align runtime suffix inference ( #977 )
2026-10-07 23:00:22 +08:00
f26c8b5b8c
perf(reconstruction): index coverage evaluation ( #983 )
2026-10-07 22:59:13 +08:00
ea4db4c9f7
refactor(native): group analyst semantics workflows and contracts ( #973 )
2026-10-07 22:40:48 +08:00
33d4761cc7
refactor(binary): move production composition outside application workflows ( #965 )
2026-10-07 21:56:58 +08:00
b5afa5f91e
feat(browser): attribute native execution and listener sources ( #917 )
...
* feat(browser): attribute native execution and listener sources
Integrate finite native precise-coverage windows and direct DOM listener inspection through shared CLI/MCP workflows, exact session script identities, inline source evidence and owned instrumentation cleanup.
Refs #881 , #774
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
* fix(browser): preserve runtime identity and settle fixture cleanup
Retain complete reported initiator objects, reject changing loader availability, propagate the selected operation through main-frame authorization and complete effect/help inventories. Close only the synthetic owned Chrome via its native endpoint, await process-group settlement and preserve primary verification errors during cleanup.
Refs #881
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
* fix(browser): settle invalid events and preserve document evidence
Accept same-document URL changes with proven stable loader identity, retain metadata without inventing ownership, terminate malformed event collection immediately, and sanitize known transport URLs without erasing sourceURL declarations.
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
* fix(browser): end detached target windows and sanitize coverage identities
Reuse the existing flat-session event matcher, retain prearming termination, and apply the source identity policy to coverage URLs. Add real MCP target-close verification and producer regressions for detachment orderings.
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
* fix(browser): retain final sample metadata and settle fatal protocol failures
Keep source inventory open through the resetting sample, propagate fatal wire failures without outstanding commands, and check listener collection failures after final document validation.
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
* fix(browser): require default execution worlds for website attribution
Preserve native context and world metadata without treating same-frame isolated or unknown contexts as website sources. Verify actual Chrome isolated function execution before excluding its coverage, and cover ambiguous world metadata with producer regressions.
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
* fix(browser): revalidate runtime source joins and selector failures
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
---------
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com >
2026-10-07 21:45:07 +08:00
ef1a0cc65a
refactor(apple): group artifact producers and verification ( #952 )
...
* refactor(apple): group artifact producers and verification
* test(apple): run affected native plist CLI regressions
2026-10-07 21:09:33 +08:00
a65755728f
Merge pull request #953 from morluto/feat/macho-chained-fixups
...
feat(native): decode chained fixups, binds, ObjC categories and properties
2026-10-07 05:43:23 -07:00
7acf4e741a
Merge pull request #931 from morluto/fix/apple-bridge-roots
...
fix(apple): pair bridge hypotheses within one application root
2026-10-07 05:41:08 -07:00
c7530f9a81
perf(javascript): reduce analysis and source-map work ( #955 )
...
* perf(javascript): reduce semantic traversal overhead
* perf(source-maps): reuse validated regular map rows
2026-10-07 20:33:35 +08:00
3e24a72465
feat(native): decode chained fixups, binds, ObjC categories and properties
...
inspect_native_dispatch_metadata read pointer fields as stored bytes, so
chained-fixup images (the default since Xcode 13) decoded no classes, and
superclasses from other images were always unresolved.
- Decode LC_DYLD_CHAINED_FIXUPS pointer formats 64, 64_OFFSET, ARM64E,
ARM64E_USERLAND and ARM64E_USERLAND24 with import formats 1-3, and
interpret LC_DYLD_INFO bind, weak-bind and lazy-bind opcode streams.
- Name external superclasses from their _OBJC_CLASS_$_ binds.
- Decode class_ro_t baseProperties and __objc_catlist category_t records
(instance/class methods, protocols, properties) into objc_categories;
category methods carry their category name.
- Report the fixup encoding in a pointer_fixups coverage facet.
- verify:apple-dispatch builds the fixture with dyld-info and chained
fixups, plus arm64e on Apple silicon.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-07 12:18:24 +00:00
dda8e6a728
fix(setup): accept the pinned Hopper RPM launcher ( #933 )
2026-10-07 20:04:57 +08:00
2366bda37b
fix(artifacts): harden reader lifecycle boundaries ( #951 )
...
* fix(artifacts): retain ASAR filesystem failure reasons
* fix(artifacts): avoid blocking on replaced FIFO entries
* test(artifacts): type the ASAR reader iterator
* fix(artifacts): classify filesystem-shaped ASAR errors
* test: account for POSIX FIFO fixture utility
2026-10-07 20:00:24 +08:00
e0d76ae80d
fix(mcp): advertise reserved process environment key ( #949 )
2026-10-07 19:58:51 +08:00
f14b6a8430
fix(ida): share concurrent session cleanup ( #950 )
2026-10-07 19:58:43 +08:00
118d43e787
perf(setup): reuse initial diagnostics during planning ( #940 )
...
* perf(setup): reuse initial diagnostics during planning
* test(setup): verify post-configuration doctor refresh
* style(setup): remove extra test spacing
2026-10-07 19:52:43 +08:00
c92a344d47
perf(javascript): index semantic fingerprint relations ( #942 )
2026-10-07 19:52:29 +08:00
ac3bae3cb9
fix(native-ui): handle incomplete accessibility child collections ( #944 )
...
* fix(native-ui): align verifier with scenario contract
* perf(native-ui): reuse accessibility child counts
* fix(native-ui): handle incomplete child collections
2026-10-07 19:52:16 +08:00
348c65c7ec
fix(javascript): handle deep static member paths ( #939 )
2026-10-07 19:51:43 +08:00
9e39795895
fix(android): bound fragmented JADX MCP frame memory ( #937 )
...
* perf(android): avoid repeated MCP frame copies
* fix(android): bound fragmented MCP frame memory
* style(android): format JADX transport changes
2026-10-07 19:51:08 +08:00
2e81e867b2
fix(apple): count only real framework version directories
...
A file such as Versions/.DS_Store beside the only real version made the
framework look multi-versioned, so its Info.plist became unknown with a
misleading limitation. Version directories are now limited to entries
observed as directories or implied by deeper paths.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-07 11:46:53 +00:00
28713f9b4d
refactor(managed): group capability workflows and verification ( #926 )
2026-10-07 19:22:04 +08:00
dcde958450
perf(javascript): analyze member chains without recursive copying ( #932 )
...
* fix(javascript): traverse deep semantic member chains iteratively
* fix(javascript): preserve deep initializer and pattern analysis
2026-10-07 19:09:25 +08:00
e6ba9c3af3
fix(javascript): retain recovered call argument positions ( #929 )
2026-10-07 19:08:45 +08:00
37d2ebac4c
fix(artifacts): accept the bundle subject when extracting an app bundle ( #891 )
...
* fix(artifacts): accept the bundle subject when extracting an app bundle
For a .app target the session target is the bundle's executable, while the
artifact provider reports the bundle itself as the subject. The subject
check exempted inventory_artifact and inspect_artifact but not
extract_artifact, so extracting any .app failed with execution_failure after
the output tree had already been written, and the output path was never
reported.
* refactor(binary): rename artifact bundle subject helper
isArtifactInventorySubject also covers extract_artifact for .app
bundles, so name it for the shared bundle-subject exemption.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
2026-10-07 19:04:55 +08:00
45fcd28b40
fix(javascript): resolve bare source-map and worker URLs next to the script ( #890 )
...
* fix(javascript): resolve bare source-map and worker URLs next to the script
A sourceMappingURL like `main.js.map` (the default of webpack, esbuild,
rollup, Vite and rolldown) and `new Worker("worker.js")` were resolved as
module specifiers, so the bare name was looked up as an npm package and the
map or worker script was never linked. Resolve them as URLs relative to the
declaring script.
* fix(javascript): tighten url-reference resolution edge cases
Use looksExternal for non-module contexts so protocol-relative URLs
cannot be misread as root-absolute paths, cover url-reference unit
cases, and assert bare service-worker script resolution.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
2026-10-07 19:04:15 +08:00
9226ade511
fix(apple): pair bridge hypotheses within one application root
...
A ZIP or DMG holding two applications produced bridge candidates from
scripts in one app to native code in the other. Candidates now pair only
components owned by the same application root; components outside every
root pair only with each other.
A versioned framework with several real version directories now keeps
its Info.plist unknown even when only one version has a plist, because
Versions/Current, which is not inventoried, decides which applies.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-07 11:02:47 +00:00
aa8082ea6c
Merge pull request #913 from morluto/fix/uikit-runtime-connections
...
fix(artifacts): project UIKit runtime outlet and event connections
2026-10-07 04:00:25 -07:00
b3f013fa18
Merge pull request #899 from morluto/fix/interface-builder-plist-data
...
fix(artifacts): decode flat keyed-archive NIBs with data and shared references
2026-10-07 03:59:54 -07:00
2ed89e6529
Merge pull request #910 from morluto/feat/ios-app-bundles
...
feat(native): open iOS-style and iOS-on-Mac wrapper app bundles
2026-10-07 03:59:41 -07:00
fd552a8c4b
chore: merge main and regenerate combined catalog metadata
2026-10-07 18:44:34 +08:00
be121d87eb
chore: merge main and preserve keyed archive regressions
2026-10-07 18:44:01 +08:00
b9292516f4
fix(process): retain provider output until streams close ( #928 )
2026-10-07 18:39:10 +08:00
f826aa893f
fix(browser): preserve evidence through deep AST analysis ( #924 )
2026-10-07 18:36:18 +08:00
morluto