Commit Graph

4089 Commits

Author SHA1 Message Date
morluto bb49252523 test(ida): verify typed timeout and retained cleanup through the CLI 2026-10-15 05:38:36 +08:00
morluto 4946688c33 refactor(setup): distinguish provider configuration from registration settings 2026-10-15 05:23:04 +08:00
morluto 333e0ab0df fix(setup): propagate selected provider deadlines through CLI registrations 2026-10-15 05:16:08 +08:00
morluto c0cfccb45f fix(ida): preserve SDK request timeout identity and captured output 2026-10-15 05:14:57 +08:00
morluto fbdd040324 docs(mcp): explain absolute SDK deadlines and client timeout configuration 2026-10-15 05:05:30 +08:00
morluto dadf909dce fix(setup): derive MCP tool deadlines and preserve caller timeout choices 2026-10-15 05:05:24 +08:00
morluto 097a4bce6f fix(jeb): make upstream request deadlines configurable and preserve cancellation 2026-10-15 05:05:18 +08:00
morluto c831c23633 docs(mcp): clarify gateway schema recovery without inferring backend constraints 2026-10-15 04:49:27 +08:00
morluto 5a46fbacd5 fix(mcp): advertise explicit target cleanup when investigations finish 2026-10-15 04:49:27 +08:00
morluto fffb074193 chore: integrate current main verification fixes 2026-10-15 04:06:41 +08:00
morluto 09e7f07108 fix(setup): select compact input schemas for Kimi registrations 2026-10-15 04:06:41 +08:00
morluto 1bbf4bd16c fix(process): preserve caller overrides during Windows environment normalization 2026-10-15 04:06:41 +08:00
morluto 07a501e82c fix(mcp): share inspection admission for prompt completion 2026-10-15 04:06:41 +08:00
morluto ebecf06f6e fix(setup): integrate Windows runner and ConPTY corrections 2026-10-15 04:04:17 +08:00
morluto 7e0c7b1244 fix(cutter): resolve bridge paths from the selected caller home 2026-10-15 04:01:36 +08:00
Ysopwnable d9cd239c5e fix(test): honor Ghidra startup budgets in Windows verification (#3417)
* fix(test): honor Ghidra startup budgets in file-offset verification

* fix(test): preserve selected startup budgets in direct Ghidra verification

* test(ghidra): cover verifier timeout budgets

* fix(test): preserve Ghidra MCP request budgets
2026-10-15 03:50:50 +08:00
morluto 11f64f653e test(browser): verify typed worker refusals across navigations 2026-10-15 03:43:29 +08:00
morluto 9b7ec809e6 test(process): use owned host-aware settlement fixtures 2026-10-15 03:43:29 +08:00
morluto 170bfc7b3f fix(mcp): authenticate inventory facts before prompt completion 2026-10-15 03:43:29 +08:00
morluto 591c87c4b6 refactor(artifacts): share inspection validation and prune legacy fixtures 2026-10-15 03:43:29 +08:00
morluto bfd76c5d16 test: isolate host discovery and update current capture fixtures 2026-10-15 03:43:29 +08:00
morluto 9ac91e0c1e fix(artifacts): bind inspection provenance to every retained inventory 2026-10-15 03:43:29 +08:00
morluto 30a9139b87 fix(javascript): keep source-module semantics independent of sibling bytes 2026-10-15 03:43:29 +08:00
morluto a9588be4eb fix(evidence)!: reject missing recorded inventory and capture facts
BREAKING CHANGE: Inventory Evidence must explicitly report integrity_contradictions, and browser capture Evidence must report every resolved budget. Caller input defaults remain supported; stored observations are never filled with inferred defaults.
2026-10-15 03:43:29 +08:00
morluto fc789d19ff style(apple): normalize class parser module formatting 2026-10-15 03:43:29 +08:00
morluto 4ff2dadf66 refactor(apple): remove unused class identity re-export 2026-10-15 03:43:29 +08:00
morluto 1a06c82772 style(test): format coverage regression fixtures 2026-10-15 03:43:29 +08:00
morluto 7d885d632c docs: align workflow recovery and current Evidence contracts 2026-10-15 03:43:29 +08:00
morluto 57a23f0a2d fix(browser)!: expose capture budgets and queue admitted content reads
BREAKING CHANGE: Browser capture results require resolved limits, event families, and omission facts. Caller-selected budgets replace hidden retention ceilings; admitted content reads queue behind bounded concurrency.
2026-10-15 03:43:29 +08:00
morluto d2a53beb3d test(hopper): verify external exit recovery and retained ownership 2026-10-15 03:43:29 +08:00
morluto a8887a9a85 fix(jeb): probe live operations with owned discovery deadlines 2026-10-15 03:43:29 +08:00
morluto 45d5e80144 fix(cli): preserve Cutter choices and reject invalid runtime arguments 2026-10-15 03:43:29 +08:00
morluto 50dd9fcad1 fix(ghidra): preserve MIPS overrides and filter entry metadata 2026-10-15 03:43:29 +08:00
morluto 6add17a317 fix(windows): explain missing native artifacts and verify output drain 2026-10-15 03:43:29 +08:00
morluto 8c0e431895 fix(setup): own Hopper replacement staging and committed outcomes 2026-10-15 03:43:29 +08:00
morluto ceb77f6697 fix(apple): distinguish JVM resources and UIKit event connections 2026-10-15 03:43:29 +08:00
morluto fc7e41ff3b fix(process): attribute finite trace omissions and cleanup states 2026-10-15 03:43:29 +08:00
morluto cb4ff50202 fix(functions): preserve coverage diagnostics separately from blockers 2026-10-15 03:43:28 +08:00
morluto b47055edbe fix(javascript): preserve module identity and boundary fields 2026-10-15 03:43:28 +08:00
morluto 0405c9d361 fix(artifacts)!: authenticate complete inspection and summary inputs
BREAKING CHANGE: Artifact inventories require scoped coverage. Obsolete coverage_status and prose-based coverage inference are removed. Inspection carriers authenticate every retained inventory substep.
2026-10-15 03:43:28 +08:00
morluto db8128dc0d refactor(evidence)!: require current coverage commitments
BREAKING CHANGE: Evidence and analysis snapshots require explicit nullable relationship coverage and include it in their identity commitments. Historical records without the field are rejected; saved files are not migrated.
2026-10-15 03:43:28 +08:00
Swatantra Yadav 2abfe53dbd fix(setup): preserve overridden runner variables and test isolation on Windows
Support case-insensitive environment value lookup in ClientRegistrationIdentity while preserving JavaScript property order precedence with findLast(). Add unit regression coverage for ambient uppercase npm variables on Windows. Isolate USERPROFILE in cliSetup tests so child processes do not touch the host profile directory. Harden JSON decision extraction in runJourney against ConPTY trailing ANSI escape codes. Deterministically sequence multiselect prompt navigation before confirmation. Filter ambient runner variables case-insensitively before launching interactive setup completion tests.
2026-10-15 00:56:31 +05:30
qorvr efbc486b9b fix(contracts): reject NUL bytes in keyed archive and extraction paths (#3606)
Co-authored-by: qorvr <330186599+qorvr@users.noreply.github.com>
2026-10-15 03:14:31 +08:00
Ysopwnable 11b747f29d fix(analysis-view): unify inert inline Evidence admission
Share inline Evidence admission before authentication across analysis views.
Reject executable object behavior before reflection, inspect arrays
incrementally, preserve inert JSON-omitted metadata and existing budgets.
Keep precise error locations with one bounded path stack.

Validated base failures, 48 source tests, 71 related public-boundary tests,
27 final CLI/MCP tests and eleven calls against a genuine Chromium HAR;
source identity, selected output and capacity accounting remain preserved.

Co-authored-by: Zhong-fan <205188959+Zhong-fan@users.noreply.github.com>
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
2026-10-15 03:13:28 +08:00
鸡哥 75104040df fix(javascript): track public CommonJS export receiver lifetimes (#3567)
* fix(javascript): track public CommonJS export receiver lifetimes

* fix(javascript): retain exports across uncertain identity effects
2026-10-15 02:46:14 +08:00
Ysopwnable 357996cc89 test(perf): measure genuine SAZ selection and retained recovery (#3584)
* test(perf): pin genuine Fiddler captures and raw HTTP oracles

Pin two public Microsoft SAZ captures with 13 and 1311 sessions, immutable source/digest/member coverage and predeclared caller-ordered transaction questions. Independently preserve stored HTTP headers, binary/empty bodies and archive coordinates; admit only known corpus bytes before ZIP allocation. Five reader regressions and both genuine selected-record checks pass. No production or performance-gain claim.

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>

* test(perf): measure SAZ selection and retained recovery workflows

Add authenticated complete/ordinal/retained-page SDK experiments, fixed real-Codex prompts and independent cited-byte grading. Preserve actual failed RPCs and exact retained-reference recovery when complete MCP delivery exceeds its receive buffer. Verify selected CLI/MCP facts, parameters and semantic Evidence identity. Keep a genuine partial-message admission-negative probe. Focused 12 tests and 10 actual-Evidence grading cases pass; no formal model or gain claim yet.

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>

* test(perf): verify resolved SAZ Evidence selection parameters

Distinguish omitted request ordinals from the complete resolved ordinal scope recorded by WebNetworkCaptureService. Share the expected sanitized Evidence representation between SDK checks and model grading; preserve original caller arguments. A focused regression and both saved genuine baseline RPCs confirm the correction. Keep original collector failures and costs unchanged; freeze a new driver before repeated measurements.

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>

* docs(perf): retain mixed SAZ whole-task costs and failure boundaries

Record both SDK batches, twelve corrected workflows, all four actual Codex attempts, independent byte equivalence and verified payload-phase CPU/memory. Distinguish successful-analysis MCP transport limits from real provider timeouts and negative partial-message admission. Three model questions complete; the only completed pair saves 1.6 percent input but takes 2 percent longer, with no consistent benefit. Keep production APIs/defaults/cache unchanged and preserve all deviations, failed attempts and unknowns.

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>

---------

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
2026-10-15 02:45:44 +08:00
To3akaRin e79e014f23 fix(browser): preserve passive network inventory uncertainty
Preserve uncertainty in offline passive network comparisons when request
identity, metadata, or per-kind inventory coverage is incomplete. Retain
proven HTTP/WebSocket changes without using missing information to infer
membership, duplicate counts, or equality.

Compare redirect resource types only where both observations retain them.
Keep metadata completeness with its owner, stream HTTP content digests,
and require full coverage for multiplicity and WebSocket stream inventories.
Preserve independently known metadata changes and full-inventory counts.

Keep the original JavaScript configuration-escape, JSON, cancellation,
SAZ and schema-documentation fixes compatible with current main. Split
public CLI comparisons into isolated test cases without loosening timeouts.
Validate actual Chromium/HTTP captures through CLI and real stdio SDK,
with explicit limits and unchanged source bytes.

Co-authored-by: To3akaRin <131595336+To3akaRin@users.noreply.github.com>
Co-authored-by: N0zoM1z0 <161784452+N0zoM1z0@users.noreply.github.com>
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
2026-10-15 02:28:46 +08:00
morluto b8510ee00b test(mcp): remove cache and event order dependence from fault probes
Inject IDA diagnostic capacity faults per connection so prior module imports cannot bypass them. Use the CDP fixture event barrier before asserting complete body shapes, and document profile and renderer verification.
2026-10-15 01:41:31 +08:00
morluto 36615d9165 fix(mcp): honor Frida partial evidence retention acknowledgments
Use shared recorded-partial delivery on start, load and instrument errors. Return a retained reference only after a successful write; preserve the original inline partial when retention fails or is unavailable.
2026-10-15 01:41:31 +08:00
morluto c5fb86d194 fix(mcp): bind catalog identity to output schema profiles
Include the selected output advertisement profile while retaining canonical output validation in the identity. Reuse the SDK output projection and select doctor expectations from both profiles. Correct the compact input error documentation.
2026-10-15 01:41:31 +08:00