* fix(source): retain CommonJS requires spelled as exact no-substitution templates
Admit expression-free template arguments at the CommonJS require gate and
read their single cooked quasi through the shared exact-literal reader.
Scope is the require path only: static ESM template declarations keep their
parse failures and dynamic import() keeps the explicit unknown/partial
<dynamic-import> relationship with no invented target.
Refs: #4382
* fix(source): admit TypeScript-wrapped exact require arguments via the shared literal reader
Address review: the require gate matched the outer AST node, so
runtime-transparent TS wrappers (as const, !, satisfies) around exact
strings or expression-free templates were still silently omitted even
though readExactJavaScriptLiteral unwraps them. Remove the gate and let
the shared exact-literal reader own argument exactness; computed
arguments remain silent and dynamic import() behavior is unchanged.
Refs: #4382
---------
Co-authored-by: Hemang Varshney <218273197+hemv-857@users.noreply.github.com>
Carry the capture handle cleanup lease through retry results and bind composed export failures to it. Bind aborted binary retirement errors to the failed close so successful later cleanup reveals the original cancellation.
Validation: 46 focused tests passed; npm run check passed. Four regression assertions fail on the original source. Full suite and real-provider workflows were not run.
* fix(cancellation): preserve caller abort reasons through late finalization
Caller aborts that arrived during final provider, cleanup, or protocol
handling were dropped or replaced by I/O, cleanup, or success results.
Each affected path now samples the caller signal after its owner has
settled and returns AnalysisCancelledError carrying the exact
signal.reason, keeping any completed partial Evidence or cleanup state.
- Web script export: keep the exact reason for an interrupted output
write, and honor a cancellation fact recorded before a retried
capture close succeeds.
- Native value tracing and Hopper regex search: check the signal after
the final provider reply or regex worker settles.
- Apple asset catalog: stop assetutil with SIGTERM so cancellation
settles only after the helper exits.
- CDP observation: end an armed window on a fatal protocol failure.
- ADB bugreport: prefer cancellation over the staging-removal output
error when the caller aborted.
- JavaScript recovery: check the signal after provider success.
- export-web-scripts CLI: run under command cancellation and forward
the signal into the export workflow.
- Objdump and Rizin CLI: report cancellation after cleanup completes.
- Binary session: keep cancellation primary when previous-client
retirement fails after abort.
Fixesmorluto/rea#6042Fixesmorluto/rea#6043Fixesmorluto/rea#6048Fixesmorluto/rea#6049Fixesmorluto/rea#6057Fixesmorluto/rea#6060Fixesmorluto/rea#6078Fixesmorluto/rea#6080Fixesmorluto/rea#6108Fixesmorluto/rea#6111Fixesmorluto/rea#6115
* fix(cancellation): keep caller reasons through export rollback and commit
- Rollback failure after a caller abort now returns AnalysisCancelledError
with the exact signal.reason, attaching the rollback failure as cleanup
and retaining any published result as partial observation.
- A capture close retry that succeeds after abort returns cancellation
instead of the stale cleanup diagnostic.
- An abort that lands during the final output commit returns cancellation
carrying the completed manifest as partial observation.
- Apple assetutil stop test: abort and await the run in finally so a
timed-out wait does not leave the child running, and skip on Windows
where the JavaScript SIGTERM handler cannot run.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 35b247e9-c793-4b8f-979a-807c27112cf5
* fix(cancellation): bind export cancellations to cleanup and caller reasons
- A rollback-failure cancellation is bound to the retained cleanup lease,
so a later successful close clears cleanup_incomplete instead of
reporting a residual directory that no longer exists.
- mapExportFailure wraps the caller's own AnalysisCancelledError reason
under export_web_scripts rather than returning it as the export's error.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 35b247e9-c793-4b8f-979a-807c27112cf5
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
Copilot-Session: 35b247e9-c793-4b8f-979a-807c27112cf5
* fix(cancellation): preserve caller abort reason in cancellation errors
Several application, provider, and MCP boundaries constructed
AnalysisCancelledError, ArtifactReaderFailure, or
DetachedPgpSignatureError for an already-observed or newly-observed abort
without passing the caller's signal.reason as the error cause. The typed
result then reported cancellation with an undefined reason even though the
exact object supplied to AbortController.abort(reason) was still available.
Pass signal.reason as the cause at each producing cancellation site:
JavaScript artifact reconstruction and file abort checks, derived MCP
operation checkpoints, detached PGP verification, ASAR listing admission,
Dart AOT inspection and its provider guard, evidence-file analysis views,
binary layout and recorded crash admission, WASM inspection admission,
and the Kuna shared assembly-index wait.
Cancellation classification and cleanup behavior are unchanged.
Fixesmorluto/rea#5935Fixesmorluto/rea#5944Fixesmorluto/rea#6100Fixesmorluto/rea#6101Fixesmorluto/rea#6110Fixesmorluto/rea#6113Fixesmorluto/rea#6121Fixesmorluto/rea#6131Fixesmorluto/rea#6132
* test(cancellation): assert the exact caller reason identity
Copied reasons satisfied toMatchObject, so the tests would pass even if the
caller's abort reason were replaced by a structurally equal copy. Capture the
rejection and assert the cause is the same object.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 35b247e9-c793-4b8f-979a-807c27112cf5
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 35b247e9-c793-4b8f-979a-807c27112cf5
* fix(native): recover macOS command deadlines
Promote native_command_timeout_ms (default 60000), native_ui_deadline_ms
(default 180000), and pwntools_timeout_ms (default 30000) as validated
per-call settings. Keep cpuSeconds, byte allowances, LLDB grace, and plist
probes fixed, and say those caps have no runtime override.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(native): report the deadline that actually expired
Pass the selected native command timeout through xcrun resolution, thread
the pwntools deadline into pwndbg failures, and state the selected UI
deadline apart from the fixed wait-step cap. SIGXFSZ and EFBIG recovery
names the file-size allowance.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(native): honor the selected deadline on helper stages
The UI helper compile and capture subprocesses used fixed 60s and 30s
exec timeouts, so a longer native_ui_deadline_ms still failed as a generic
provider error. Preparation timeouts reported the 60000 ms default instead
of the selected native_command_timeout_ms.
Memory resource-constraint recovery names memory again, and the Darwin
plist CLI expectation matches the byte-counted input allowance.
Co-authored-by: morluto <morluto@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: morluto <morluto@users.noreply.github.com>
Select completed source-to-bundle mappings and candidates through the shared view owner, preserve reference-file provenance, and retain full Evidence. Reuse bounded JSON reading, heap admission, and cancellation before session writes.
Verified public Redux Toolkit source/map facts with an independent oracle, equivalent CLI/MCP workflows, focused negative controls, and complete CI/review. Historical paired SDK context estimates fall about 64%; timing/resource tradeoffs and final verification receipts are recorded without a general speedup or actual model-token claim.
Fixes#6112.
Use compact MCP input advertisements by default while preserving explicit full, canonical validation, output contracts and complete Evidence. Require an explicit selected catalog for runtime identity and honor both profiles in CLI status.
Real ripgrep/Zellij SDK tasks, independent ELF oracle, actual client trials, profile parity workflows and CI are recorded in experiments/analysis-efficiency/mcp-input-catalog.md. SDK token estimates improve; actual Codex token savings and general latency/memory gains are not established.
Refs #5861
BREAKING CHANGE: MCP input advertisements default to compact. Set REA_MCP_INPUT_SCHEMA_PROFILE=full for complete advertised guidance and nested constraints.
* test(ci): keep module mocks in isolated test projects
A module mock registered after another file in the same worker loaded the
module never applies, so a mocking test in a project that shares one module
graph passes or fails with file scheduling. That is how the environment
export source tests failed on hosted runs until c324d31b4 removed their
mocks.
Guard the rule: every tracked test using vi.mock or vi.doMock must belong
to an isolated project. Move the last shared-graph case,
DirectAnalysisStatFailure, which mocks node:fs/promises, into process-global
beside the other module-mocking workflow tests.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(pe): share one compiled CLI process across PE resource inspections
The acceptance test started a fresh CLI process for each of its fixtures
inside one 30 s test deadline. Hosted runs took 24-27 s and c324d31b4 timed
out. Every inspection there reads no stdin and sets no deadline, so use the
fixture's file-scoped compiled CLI process. Local time drops from 8.5 s to
about 3.9 s with the same assertions.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(artifacts): admit ZIP archives after unclaimed leading bytes
ZIP recognition required the archive at byte 0, so a ZIP behind a
script or self-extractor stub was refused as an unsupported binary
format although standard readers accept it. Target resolution and root
inventory now locate a trailing single-disk ZIP from its end record,
central directory and first local header, whether member offsets include
the leading bytes or not. Leading bytes any executable header family
claims keep their executable route.
Fixes#5732
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(artifacts): share the root ZIP family across recognition paths
The trailing-ZIP fallback named a stub-prefixed root `.app` archive
`zip`, while root inventory and the leading-signature route name it
`app-pack`. The root mapping now lives once in `zipRootPackageFormat`
and both target resolution routes and root inventory use it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
The atomic JSON writer reported a failed staging-directory release as
cleanup state on the returned EvidenceFileError or AnalysisCancelledError,
but never bound that error to the retained staging lease. A later scope
retry that removed the stage could not clear the error, so
`rea evidence-export` (and other writers sharing the scope, such as
--evidence-output delivery) kept reporting cleanup_incomplete and a
retained resource after cleanup had completed.
Bind each staged-output cleanup failure, and each admission retry
failure, to its exact leases so confirmed release restores the primary
outcome. Export recovery now reads that bound state instead of a local
close flag. A retry that still fails keeps the error incomplete with the
same retained stage.
Fixes#5842
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Use pinned tsrs on supported development hosts while retaining stable official
TypeScript on Windows and unsupported platforms. Partition compile/typecheck
caches by actual compiler and qualify fallback hosts for compiler inputs and
lifecycle hooks.
Reduce PE acceptance startup through the existing bounded compiled CLI. Retain
upstream named MCP definitions, every fixture/assertion and the original 30s
deadline. Verify that browser transport loss preserves the observed target.
Validation: full qualification and real host lanes in
https://github.com/morluto/rea/actions/runs/39590450889 ; 450 focused regressions
passed with two documented conditional skips. All 1724 production emit files
match SHA-256 and size across both compilers. Current-head Codex/Greptile review
found no actionable issues. Measurements and limitations are in the PR.
Assisted-by: Reimu (gensokyo-skills:reimu-incident-triage)
* perf(javascript): reuse the source-analysis worker within a process
Each analyze-javascript-application call started a new Node worker.
That startup, not fixture IO or the shared CLI session, dominated the
slow loader-review and factory-completion files.
Park one healthy worker on the artifact resource scope and on the CLI
process. Stop it when the scope, session, or one-shot process ends.
Do not reuse after failure, cancellation, or a different heap or timeout.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(cli): close the JavaScript worker when dispatch throws
Minimal dispatcher runtimes now export a no-op closeCliJavaScriptResources,
and CLI dispatch plus output rendering always await that cleanup. A dispatch
failure and a cleanup failure are both reported.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(artifacts): report close-hook failures with retained cleanup
When retained cleanup and the scope close hook both fail, the close error
keeps both causes and both resource labels. The pending owners and the hook
stay registered so the next close retries each path.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(javascript): stop a replaced analysis worker before the next one starts
A heap or timeout change now closes the parked worker before constructing
its replacement. The scope retains that process only when the close fails.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* style: format worker-reuse close and launch helpers
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(cli): report a failed JavaScript worker shutdown before exit
Share one in-flight close and drop the CLI scope only after it succeeds,
so a later caller retries a worker that is still owned. The one-shot
exit callback writes that failure and exits non-zero, while a closed
stdout pipe still exits 141.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(javascript): keep a worker parked during an overlapping limit change
Claim the scope slot only when it is still empty after the replaced
worker closes. A concurrent analysis that parked another healthy worker
keeps that process, and the extra worker is closed through its own port.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(artifacts): run later close hooks when an earlier hook fails
Run every registered close hook on each close. One failure is returned
unchanged, and several failures are aggregated so a later hook is not
skipped.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(javascript): fail a limit change when the previous worker stays alive
A failed close used to be retained and then ignored, so MCP could return
a successful analysis while the old process and its replacement were
both owned. The request now fails before the replacement is constructed,
and the still-live worker stays owned for a later close.
Co-authored-by: morluto <morluto@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: morluto <morluto@users.noreply.github.com>
Binary plist object tables may list one object offset more than once;
plistlib reads each entry independently. The scalar scanner marked any
repeated offset as incomplete metadata, which made the number projection
drop every exact decimal in the archive. A keyed archive whose entries
10 and 11 share an Int64 9007199254740993 reported both as observed
9007199254740992 and rounded an unrelated 2^60+3 sibling, with only the
generic incomplete-metadata caveat.
A repeated valid offset carries the same source facts as its first
visit, so observe it once and continue. Offsets that fail to parse still
mark metadata incomplete. Shared 16-byte integers and dates are rewritten
once in the decoder copy, which every entry then reads; the overlap plan
already treats one shared offset as one span. Keyed archives and
Interface Builder decoding share this scanner.
* perf(ci): pack each test tier from its own timing history
Fast shards were still ordered with the latest full-suite timing artifact,
which stayed stale across compiled-CLI session reuse. Publish and download
test-timings-fast and test-timings-full separately, and keep the legacy
artifact as a fallback until a tier has its own history.
* perf(ci): drop the shared timing-history fallback
Shard lookup now reads only the artifact for the current tier. A missing
artifact leaves history unset instead of packing from the old test-timings
file.
* test(ci): look up fast history when only full timings exist
The empty-history case now requests the fast tier against a full-tier
artifact and checks that the fast lookup ran and returned nothing. A
missing tier stays a separate test that does not query.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Decode native binary plists from bounded owned source bytes before conversion can erase scalar values. Share scalar preflight and isolate overlapping decoder records while retaining exact integers, date uncertainty, and original bytes. Refuse numeric payloads that read structural table bytes, and avoid retaining projection metadata when callers only need structural validation.
Closes#5701Closes#5703Closes#5705Closes#5782Closes#5783Closes#5792
Keep raw physical read diagnostics alongside explicit operation provenance on the same cleanup owner. Preserve provenance after successful close retry for opted-in readers, restore legacy error projections, and prevent borrowed cleanup-shaped failures from authorizing foreign resource retries.
Refs #5686
Tag physical read outcomes at the owning boundary and preserve opaque caller cancellation reasons through JSON pipelines and reference imports. Share named bounded-read options across consumers and retain failed cleanup ownership for retry.
Closes#5686
Preserve exact selected-image identity and descriptor ownership across preparation, final cleanup, and retries. Keep physical failures and failed cleanup leases observable through provider and launcher boundaries.
Closes#5688
* test(acceptance): split competing loader ownership across files
The loader matrix was one 578-second file, which set the floor for any
shard that received it. Three files keep every CLI and MCP case and let
workers overlap them.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* perf(ci): run eight fast built shards under a ten-minute budget
Charge each Vitest project by its resolved worker width so serial
process-boundary files spread as tail time. Fast feedback uses eight
built shards. The npm download cache stays; node_modules is too large
to ship as a shared artifact.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(ci): keep each scheduled file on one worker lane
Dividing a file by maxWorkers dropped its own wall-time floor and could
pack a parallel file onto a serial tail. Place each file whole on a lane,
overlap peers only inside a sequence group, and add later groups after.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* docs(testing): separate the shard budget from workflow time
The ten-minute figure is the built shard job. Classification, build, and
the portable-test merge are measured separately on run 39451548945.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* docs(testing): match fast shard count to lane scheduling
Main still described five shards and half-duration weights. Fast
qualification uses eight shards, and each file keeps its full duration
on one worker.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(ci): seed split loader durations from pre-split history
Timings published before the file split still name one 578-second path.
Until a new file appears in that artifact, share the recorded duration
by the pre-split case counts.
Co-authored-by: morluto <morluto@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: morluto <morluto@users.noreply.github.com>
* ci: keep npm download caches from Turbo snapshot growth
Per-commit static and portable Turbo snapshots had filled the 10 GB Actions
cache, which is what makes warm npm ci cheap. Trusted static runs now keep two
generations and one download-cache writer per host.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(ci): declare cache retention types for strict checks
Typecheck imports cache-retention.mjs and needs a sibling declaration.
The generation count stays module-private so knip does not report it.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(ci): keep compatible caches and qualification read-only
Npm dedupe deletes a record only when another has the same key, version,
and ref. Cache deletion moves to a follow-up workflow so reusable
qualification can keep its read-only token.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(ci): retain caches after failed default-branch runs
Static and build save Turbo snapshots before later lanes finish. Retention
now follows a failed, timed-out, or cancelled trusted run, not only a green one.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* test(cli): pass application trace input as a file
The CLI already reads workflow JSON from a path. Putting the full
application Evidence document on argv exceeds the runner argument limit.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(ci): retain deep and Knip snapshots without deleting a repeated id
Fast and deep static checks publish rea-static-deep-v1 and knip-meta-v1
entries per commit. Retention prunes those families with the same two-generation
rule. A cache id listed twice is one record; inconsistent repeats abort
before any delete.
Co-authored-by: morluto <morluto@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(errors): name fixed allowances in resource-constraint recovery
Fixed parser, count, report, input, and capture refusals inherited
host-memory, wait-and-retry, or retained-Evidence advice. Producers now
attach allowance-specific recovery, and deterministic capacity caps are
not retryable. IL2CPP reader occupancy stays retryable capacity.
Refs #5556, #5405, #5456, #5459, #5460, #5504, #5505, #5506, #5537, #5628, #5630, #5631, #5632
* fix(il2cpp): keep a closing metadata reader non-retryable
close() stops admission before the active inspection finishes. A second
inspect in that window was projected as retryable capacity. Closing and
closed readers now report capability_unavailable. Occupied readers that
remain open stay retryable.
* fix(errors): align fixed-cap recovery with retained facts
IL2CPP report refusals keep observed source facts instead of denying Evidence. Command-output caps use the capture allowance. Ghidra seed recovery names the limit that was exceeded.
* fix(errors): call byte caps a byte allowance
WASM representation limits and the IL2CPP Ghidra seed-file cap are byte budgets. Their recovery no longer says the exceeded allowance is a fixed count.
* test(ida): keep unresolved procedure lookups non-retryable
Main now treats an unchanged invalid request as non-retryable. The IDA lookup tests follow that projection.
* fix(errors): qualify capture recovery for live output
A fixed capture allowance still rejects the same output. Live captures such as adb logcat can change between requests, so recovery no longer says every unchanged request fails again.
* fix(adb): keep a truncated live capture retryable
Device output can shrink between calls, so an adb capture that exceeds the allowance stays retryable. Deterministic capture and version-output limits stay non-retryable.
* fix(adb): keep truncated mutations non-retryable
Only live observations opt into retrying a capture that exceeded the allowance. Push, install, uninstall, and other mutations stay non-retryable.
* fix(errors): keep live capture recovery off deterministic limits
Artifact-derived capture allowances again say the unchanged request fails. Only volatile adb observations use the live-output sentence.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* fix(javascript): preserve selected path host resolution reasons
Classify ELOOP and ENAMETOOLONG while resolving the caller-selected input so the path and host code stay on the invalid-request issue.
Refs #5623
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(javascript): count summary coverage in module units
Use the module population for both examined and total counts. Non-module graph nodes remain in the application coverage section.
Refs #5464
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(javascript): connect direct property reads to return and argument flow
Record the unwrapped value expression and alias the object projection's read occurrence so a direct member read stays in backward provenance.
Refs #5585, #5648
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(javascript): count return wrappers against expression depth
Evaluate the original return expression so erased TypeScript and Flow wrappers stay inside the expression-depth budget. Keep the unwrapped node for identity and value ranges.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(javascript): describe ELOOP as unresolved symlink traversal
A host can return ELOOP for a cycle or for a chain past its traversal limit. Keep the selected path and code without asserting that a cycle exists.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* test(javascript): skip symlink traversal fixtures on Windows
Keep the overlong-name case portable. Windows does not produce ELOOP for these fixtures, matching the other path-failure tests.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(javascript): describe ENAMETOOLONG as a path or component limit
realpath reports that code for a long component and for a long full path. Keep the selected path and host code without claiming only a filename was too long.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* style(javascript): format return-depth and object-read changes
oxfmt rejected the return-depth test and the object-read index. No behavior change.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* test(ida): expect unchanged invalid requests to be nonretryable
The shared projector no longer marks invalid_request retryable. This lookup assertion was not updated with that contract.
Co-authored-by: morluto <morluto@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: morluto <morluto@users.noreply.github.com>
* ci: split fast and deep static checks
Fast PRs run typecheck, lint, and format before provider admission.
Knip, duplication, architecture guards, and Python stay on the full tier.
Shared-boundary fallbacks keep the Linux x64 baseline, and Turbo jobs
export remote-cache credentials when they are configured.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* ci: keep pull requests from writing the remote cache
Trusted default-branch runs still receive TURBO_TOKEN. Pull requests get an
empty token and remote read-only mode. Knip saves a per-commit cache key so
the next trusted full run can refresh the restored snapshot.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* ci: forward the release cache token and upload deep static reports
Release qualification now passes TURBO_TOKEN into the called workflow.
Labeled pull requests still do not. The deep static job records its task
context and uploads duplication reports after a failed gate.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* style: format the turbo cache policy test
Co-authored-by: morluto <morluto@users.noreply.github.com>
* ci: keep fast checks exclusive and trusted cache writes explicit
Declare the static artifact name and context script so typecheck matches the
implementations. Lock check:ci:fast around dist, and publish the remote cache
only for release qualification or default-branch push, schedule, and dispatch.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* ci: record static task graphs without nesting the artifacts lock
Keep check:ci:fast locked, and point graph recording at the unlocked
check:ci:fast:tasks script so check:pr and check:test can record hashes
while they already hold that lock.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* ci: keep unauthenticated Turbo runs on the local cache
Open pull requests do not receive TURBO_TOKEN, so a remote read mode cannot
authenticate. Those runs now use the local cache. Trusted runs still publish.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* test(ida): treat unchanged invalid requests as nonretryable
Main already stopped marking invalid_request retryable. The pull request
merge runs that projector, while the IDA lookup tests still expected
retryable true. Match the merged behavior.
Co-authored-by: morluto <morluto@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: morluto <morluto@users.noreply.github.com>
Retain process input and unexpected failure diagnostics through the shared error projector. Preserve filesystem causes and firmware validation issues, and mark unchanged invalid requests nonretryable.
Use typed stat settlement and parse unknown command failures without losing null or undefined rejection causes.
Refs #5397, #5401, #5402, #5642
52d1a72af made a cancelled write whose staging cleanup also fails carry the
caller's exact abort reason as its cause, with the cancellation retained as
cleanupPrimary and the staging directory as cleanup state. The boundary test
still expected the old wrapped cause, so it failed on main and in every PR
built on it; its finally block then masked the assertion with a cleanup
error. Assert the current contract.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Read bounded regular registrations asynchronously with retained descriptor cleanup. Carry the selected parsed configuration through provider factories and restoration, preserve exact cancellation reasons, and share workspace-parent resolution with doctor checks.
Closes#5561Closes#5559Closes#5604
Compare executable fingerprints before and after the owned version probe, and capture the script prefix from the final hash stream. Preserve partial facts and failed-close ownership without claiming process interruption from a snapshot.
Closes#5611
Recognize AppKit binding connectors as explicit unknown connection facts and
report partial semantic coverage rather than silently omitting them. Share
format-aware connector admission across keyed archives and NIBArchive.
Make the keyed archive table own parsed class and superclass facts for names,
array hierarchy traversal, inherited connectors, and class-table projection.
Preserve malformed class evidence and exclude unrelated custom class names.
Validation: 84 focused tests passed, including compiled CLI, filesystem,
MCP summary, and retained views; check:fast and test discovery passed.
Independent source review found no blocker. Production CLI and stdio MCP
replayed a read-only copy of Terminal 2.15's picker NIB: 13 connections with
partial unsupported-type coverage, versus baseline 9 with complete coverage.
Advertised schemas and retained coverage results validated with the SDK/Ajv.
No app, analysis target, or optional deep provider was executed.
Fixes#5590
Retain native-only dispatch workflows without requiring a deep provider profile. Validate exact target, operation, and current reader bindings during open, import, recording, and export; preserve selected deep bindings and caller limits.
Validated public CLI and stdio MCP save/reopen, exact CLI replay, changed-limit cache partitioning, baseline failure and candidate success on an Apple-clang fixture, snapshot lifecycle regressions, typecheck and lint. No target or deep engine execution. Fixes#5529.
Share section classification across declaration analysis and mapping parsing. Preserve external URLs, malformed section reasons, section paths and safe sibling declarations without fetching nested maps.
Refs #5466. All 50 focused tests passed, including real CLI and stdio MCP regressions; typecheck and lint passed.
Link IL2CPP metadata names to native addresses and types through shared CLI/MCP workflows, with bounded queries and atomic Ghidra seed export.
Preserve the original implementation by 8rulerstar and follow-up correctness, resource, provenance, and CI dependency repairs. Verified against real Windows/Android artifacts, independent references, actual Ghidra, and focused CLI/MCP tests.
Fixes#5112.
Add shared, typed input-contract and timeout-state recovery guidance. Normalize SDK input failures within the actual MCP wire budget, preserve full diagnostics and protocol metadata, and retain original Evidence when normalized delivery would exceed the budget.
Fixes#5431.
Share the required mappings field contract and retain readable declarations across malformed indexed leaves while marking graph coverage partial.
Refs #5469.
* feat(il2cpp): read member names, string literals and metadata versions 24 and 27
Adds field, property, event and parameter names with their owners, managed string literals, and the version 24 and 27 header layouts to inspect_il2cpp_metadata, with filtered pages for the new collections. Member decoding yields between row batches like the other row readers.
* fix(il2cpp): bound metadata expansion and query parameter owners
* test(il2cpp): cover nonempty property and event tables
---------
Co-authored-by: gensokyo-dev <gensokyo-dev@users.noreply.github.com>
Retain 13 Windows-only environment/setup regressions in the curated native lane. Select Windows qualification for both their three test files and their client configuration, registration and DSH production owner families. Guard membership and actual Git-diff classification; qualify all 60 target cases on hosted Windows.
* feat(artifacts): read Godot PCK packs
Add a Godot Engine PCK artifact reader for standalone packs and packs
embedded behind an executable trailer (formats 2 and 3). Members are
uncompressed byte ranges verified against their declared MD5 on read.
Encrypted directories, sparse bundles, patch removal entries, unknown
flags and format 1 fail closed as unavailable; encrypted members are
reported without being read. inspect-artifact and extract-artifact
recognize standalone packs by their GDPC magic.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(artifacts): bound Godot PCK metadata and own member streams
Cap member paths at 4096 bytes and the retained directory at 64 MiB
before allocation. Read members with positional chunk reads through
pipeline so cancellation is typed, abandoned consumers release their
source, and the shared descriptor stays reader-owned. Retain the root
descriptor for godot-pck inventory, as for ZIP and universal Mach-O.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(artifacts): complete Godot PCK facts, integrity and selected views
* fix(artifacts): preserve atomic-root inventory Evidence
* fix(artifacts): bound aggregate PCK member expansion
---------
Co-authored-by: Samucahub <151155051+Samucahub@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
* feat(il2cpp): inventory IL2CPP global-metadata images, types and methods
Add inspect_il2cpp_metadata (CLI inspect-il2cpp-metadata), a read-only
in-process decoder for unencrypted Unity global-metadata.dat version 39.
It reports header sections, serialized index widths, images, type
definitions (nesting from the nestedTypes section) and method names.
Unrecognized magic and other versions are unsupported; damaged headers,
overlapping sections, inconsistent record sizes, out-of-range indices and
invalid strings fail with a reason code and no partial success. MCP
detail summary retains the complete Evidence and pages rows through
inspect_analysis_view kind il2cpp-metadata.
Adds an opt-in verify:il2cpp:metadata -- --metadata PATH check.
* feat(il2cpp): deliver metadata summaries by default over MCP
A 112,232-method file produced a 10.5 MB complete response, above the
10 MiB stdio budget. Default MCP delivery is now the retained summary;
detail complete stays available, and the one-shot CLI requests it.
* fix(il2cpp): reject shifted strings, nesting cycles and method owner drift
Review fuzzing showed that moving the strings section offset by one byte
silently renamed every image, type and method. Name indices must now start
a string, which also bounds total decoding by the section size.
Nesting cycles and methods whose declaring type disagrees with the owning
type range are rejected instead of returned. Adds service, shutdown and
index-width coverage, and moves environment-specific measurements out of
the public guide and tool description.
* feat(il2cpp): decode global-metadata versions 29 and 31
Unity 2022.3 writes version 29 or 31 metadata: a 256-byte header of
(offset, size) pairs, fixed 4-byte indices, type records with
elementTypeIndex, and method records that gained returnParameterToken in
version 31. Record counts come from section sizes and must be whole.
Sections report a null count for these versions and index widths report
fixed-width-version. Image, type and method rows keep the same shape, and
the string, nesting and method-ownership checks apply to every version.
* fix(il2cpp): bound report size before serializing and tighten coverage
Rows share decoded names, so a 130 KB file could expand into gigabytes of
JSON before the 64 MiB budget check, ending in an internal RangeError. The
provider now refuses from a lower bound on the serialized rows first.
The decoder also rejects non-empty sections inside the header, methods
outside their declaring type's range and overlapping image type ranges, and
keeps a leading byte order mark in names. Layouts now carry one indexing
mode instead of two coupled flags, and the tool description explains
nested_type_start.
* fix(il2cpp): refuse oversized metadata before decoding rows
Address review findings on the IL2CPP metadata inventory:
- check a lower bound from header row counts before any row object is
allocated, so a large rejected file no longer builds every row first;
- validate sealed parent Evidence and count its rows once per report
instead of on every inspect_analysis_view page;
- decode version 39 fixtures with 2- and 4-byte type-definition,
generic-container and parameter indices.
* docs(il2cpp): attach the decoder comment to readIl2cppMetadata
* fix(il2cpp): deliver complete rows by default like the other inspection tools
inspect_il2cpp_metadata defaulted to detail summary, the only inspection
tool to do so. Omitted detail now returns every row inline, as
inspect_artifact, decode_interface_builder and the capture tools do;
summary stays one argument away and the guide, CLI reference and skill
reference say to select it first for large games, whose complete MCP
delivery is refused at the stdio budget with retained Evidence.
* test(il2cpp): cover narrow-width -1 sentinels and fix the skill's default
An empty image stores its type start as the all-ones value of a one- or
two-byte index; the decoder reads it as -1, but no fixture exercised it,
so removing either conversion passed the suite. The fixture can now append
an empty image, and both widths decode it. The skill still described a
summary default; it now says to select summary first, as the guide does.
* docs(il2cpp): request summary explicitly in the summary example
* chore(il2cpp): hash the verifier metadata through owned file resources
* fix(il2cpp): count escaped name length without building the escaped string
* fix(il2cpp): keep the verifier's check failure and small-table last page
* feat(domain): count JSON string length without building the escaped string
* fix(il2cpp): keep descriptor cleanup owners and share the JSON length count
* test(domain): give the backslash case real backslashes
* fix(il2cpp): select the CLI path and finish the command like the other tools
Follow main's absoluteCallerPath (#4067) and pass the command signal to finishAnalysisCommand.
* fix(il2cpp): select the verifier input path like the CLI
Use absoluteCallerPath (#4067) so a path with a symlink followed by .. names the same file the CLI and MCP inspect.
* feat(il2cpp): add compact composable metadata queries
Retain source-indexed Evidence for filtered batch and field queries. Bound representation growth before serialization, yield decoding for cancellation, and share CLI Evidence publication with desktop inspection. Verify public Unity metadata against independent byte and managed-DLL oracles and exercise actual stdio SDK workflows.
* fix(il2cpp): retain the validated metadata header magic
* test(il2cpp): remove obsolete execution wording exception
* fix(artifacts): preserve export selection and completed source facts
---------
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
Build an agent environment directly from retained capture_browser_scenario Evidence through the existing manifest, serve and export commands. Preserve request ordinals, source pointers, redaction markers, unavailable bodies, provenance and the default stdio MCP transport.
Followups admit copied/transformed text before body validation or decoding, avoid request-text allocation in replay, normalize portable file inventories, select dependent CI lanes, retain the author's redaction/body-budget corrections, and count body coverage over represented requests.
Validation: full pinned-toolchain static gate, source and public CLI/MCP regressions, canonical catalog checks, actual Chromium interactive and live GitHub API captures with exact HTTP replay and stdio parity, the generated non-root Docker image, and its smoke task through real agent-env 0.9.1334. Verification scopes, resource measurements and platform limits are recorded in the PR and feature verification document.
Co-authored-by: gensokyo-dev <gensokyo-dev@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Export an authenticated capture and environment manifest as a pinned agentenv bundle with provenance, a replay verifier and smoke task.
Followups preserve immutable input ownership, bounded discovery, caller paths and numeric values; bind bundle writes and package copying to retained filesystem owners; verify POSIX modes; retain cleanup authority; and verify framework/npm executable selection. Default MCP remains stdio.
Validation: pinned Linux toolchain, typecheck/build/lint/format/docs/knip, 452 focused tests, ten product-catalog cases, real GitHub response replay in the generated non-root Docker image, and the real pinned agentenv framework smoke workflow. Platform and resource-measurement limits are recorded in the feature verification document.
Co-authored-by: gensokyo-dev <gensokyo-dev@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Hemang Varshney