Add immutable session bundle snapshots, bounded resource discovery, paginated unknowns, mutable current analysis snapshots, and provider-neutral navigation/address context tools.
BREAKING CHANGE: export_evidence_bundle now requires a filesystem path and no longer returns an inline bundle.
Add static providers for Android APK/AAB/DEX and Apple IPA artifacts,
including manifests, resources, signing, and native libraries (#366).
- mobileApplicationInvestigation.ts: domain schemas for Android
(APK, AAB, DEX) and iOS (IPA) artifact formats with manifests,
signing info, resources, and native libraries.
- detectMobileFormat and detectPlatform: classify from extensions
- classifyMobileResource: resource type from path
- Utility functions for native library filtering, internet
permission checking, and architecture enumeration
Closes#366
Replace 50 ms procfs sampling with event-backed capture of root/child/
grandchild spawn, exit, re-exec, and reparent events (#332).
- eventProcessTree.ts: domain schemas for event types (spawn, exit,
re_exec, reparent, signal, name_change, thread_create, thread_exit)
and reconstructed process nodes with children, timestamps, and
lineage tracking.
- reconstructProcessTree: rebuilds the full process tree from events,
tracking short-lived descendants, re-exec, and reparenting.
- Utility functions: getDescendants, containsProcess, maxTreeDepth.
- Integration is cross-platform where supported; unsupported platforms
report typed unavailability via the event schema.
Closes#332
Add deeper Objective-C and Swift metadata extraction, plus database
path/save/licensing behavior where licensing permits (#353).
- objcSwiftMetadata.ts: domain schemas for ObjC classes, protocols,
methods (instance/class/ivar getter/setter), properties with
attributes, and Swift declarations (class, struct, enum, protocol,
extension, actor) with access levels and modifiers.
- Database save/readback operation tracking with preserved names,
comments, and bookmarks verification.
- Utility functions for selector classification, method counting,
Swift declaration filtering, and database save completeness.
- Read-only and mutating operations are distinguished.
Closes#353
Add static analysis for MSIX, MSI, AppX packages, their resources,
and digital signatures (#363).
- packageAnalysis.ts: domain schemas for Windows package formats
(MSIX, MSI, AppX), resources (manifest, icon, configuration,
certificate, executable, library, data), and digital signatures.
- detectPackageFormat: classifies from file extension
- classifyResource: identifies resource type from path
- Digital signature validation with timestamp detection
- Package and resource contents are inventoried without execution
Closes#363
Add support for custom TCP and UDP framing, local IPC, Unix sockets,
named pipes, XPC, and authentication/token lifecycle metadata (#365).
- customProtocolCapture.ts: domain schemas for custom protocol
frames with transport types (TCP, UDP, IPC, Unix socket, named
pipe, XPC), frame direction, process identity correlation, and
decoded content.
- Authentication flow events with stage tracking (init, challenge,
response, token exchange, renewal, revocation, failure, success).
- Token lifecycle events (issued, refreshed, expired, revoked,
renewed).
- Credential detection and redaction by default.
- Filters for transport type, protocol, and auth success/failure.
Closes#365
Define a committed scenario/replay/shim/evidence package format for
portable process-fidelity conformance fixtures (#336). The package
format is versioned, path-independent, and consumable from a clean
checkout.
- conformancePackage.ts: top-level package schema with scenario
manifests, replay plans, shim plans, expected evidence, and
verifier contracts. Deterministic package ID computed from
canonical JSON. Cross-reference validation ensures internal
consistency.
- conformanceTrustGate.ts: trust gates that compare captured runs
against committed conformance packages (#337). Classifies semantic
diffs from timing/normalization noise. Unknown/truncated evidence
is never treated as equivalence.
- conformanceReplay.ts: CI replay engine that runs each scenario,
evaluates trust gates, and detects drift between captured and
committed evidence (#338).
Closes#336, #337, #338
morluto