Commit Graph

44 Commits

Author SHA1 Message Date
N0zoM1z0 75f50d86f6
refactor: add incremental capability migration safeguards (#819) 2026-10-07 10:56:06 +08:00
Rudy Mizrahi Celekli 0374865836
fix(cli): honor the selected native plist path (#773)
* fix(cli): honor the selected native plist path

Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>

* ci: run native plist selection regressions on macOS

Signed-off-by: RudyCelekli <47457359+rudycelekli@users.noreply.github.com>

---------

Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
Signed-off-by: RudyCelekli <47457359+rudycelekli@users.noreply.github.com>
2026-10-07 10:51:33 +08:00
Rudy Mizrahi Celekli e9fac56232
fix(cli): align structured output guard with native flags (#777)
Signed-off-by: RudyCelekli <47457359+rudycelekli@users.noreply.github.com>
2026-10-07 10:51:21 +08:00
N0zoM1z0 472b72a530
feat(web): export captured scripts for JavaScript application analysis (#801)
* feat(web): export captured scripts for JavaScript application analysis

Add capture adapters, conservative source path projection, verified exclusive publication and a shared CLI/MCP workflow. Retain source identities, missing content and competing URL versions in a complete manifest for existing static analysis.

Refs: #774
Closes: #799
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)

* test(web): include script export in independent effect audit

Register the new contract family in the independent inventory audit and verify the filesystem, session, network and idempotence metadata of the named export contract.

Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)

* fix(web): preserve capture limitation values in export manifests

Align the export boundary with passive capture’s string contract instead of rejecting an admitted empty limitation. Cover the publisher boundary and regenerate canonical schemas and identities.

Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
2026-10-07 05:24:32 +08:00
N0zoM1z0 911d580634
fix(cli): preserve unsupported historical-source imports (#795) 2026-10-07 04:02:10 +08:00
N0zoM1z0 8238232485
feat(ida): add read-only GUI and headless MCP providers (#754) 2026-10-07 01:47:05 +08:00
Tufail Akram 91daaa68ae
docs(browser): add an interaction example that captures the visible result (#750)
* docs(browser): add an interaction example that captures the visible result

Fixes #728

Co-authored-by: Cursor <cursoragent@cursor.com>

* docs(browser): wait for asynchronous search results before capture

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: N0zoM1z0 <1705004398@qq.com>
2026-10-07 01:24:22 +08:00
N0zoM1z0 5af1699103
docs: clarify onboarding and align provider guidance (#745) 2026-10-06 22:57:36 +08:00
N0zoM1z0 5a7c769692
feat(firmware): integrate Binwalk and Unblob analysis
* feat(firmware): integrate Binwalk and Unblob analysis

* fix(firmware): verify published files and namespace source references

* test(firmware): isolate extractor dependency failure from process cleanup

* fix(firmware): retain actionable report and cleanup diagnostics

* test: assert retained batch output failure diagnostics
2026-10-06 14:16:04 +00:00
N0zoM1z0 904d03e987
feat(android): integrate static APK analysis with headless JADX (#738)
* feat(android): integrate static APK analysis with headless JADX

* test(android): include APK tools in explicit effects audit
2026-10-06 12:46:48 +00:00
Kaoru0822 00eb03d0f2
Merge pull request #735 from kaoru0822-kitauji/fix/reference-import-cli-failure-status
fix(cli): report reference-source import failures
2026-10-06 05:09:11 -07:00
Kaoru0822 431e8ebfcf fix(cli): report reference-source import failures 2026-10-06 04:27:34 -07:00
Kaoru0822 3201f0538d fix(cli): fail when JSON input files cannot be parsed 2026-10-06 03:02:22 -07:00
N0zoM1z0 9bab55337a
feat(ghidra): add atomic function annotation edits (#709)
* feat(ghidra): edit function annotations atomically

Return annotation readback and refreshed function analysis through CLI and MCP. Own each database transaction, invalidate caches and immutable snapshots, preserve executable bytes, and retain the Windows mutation boundary.

Assisted-by: Nitori (gensokyo-skills:nitori-reverse-engineering)

* fix(ghidra): preserve qualified function annotation identity

Preserve namespaces during local name writes and match qualified readback to the refreshed dossier. Add a producer-shaped regression and verify a real namespaced C++ function through the CLI.

Assisted-by: Nitori (gensokyo-skills:nitori-reverse-engineering)

* test(ghidra): align verification with annotation authority

Keep strict capability and profile checks while admitting the explicit session metadata operation. Verify packaged transport authority and atomic transaction commitments and preserve a read-only Windows expectation.

Assisted-by: Nitori (gensokyo-skills:nitori-reverse-engineering)
2026-10-06 17:24:33 +08:00
Kaoru0822 2c1bf92010 fix(cli): disable unmanaged skill synchronization 2026-10-05 23:27:46 -07:00
Kaoru0822 ae72abd019 fix(cli): include build step in missing-runtime recovery 2026-10-05 22:19:35 -07:00
morluto 494d4db6d9
refactor(cli): collapse duplicate CLI layer into src/cli (#630)
Move root cli*Commands and cliSetup into src/cli, delete the
forwarding layer, point src/cli.ts and tests at the owners. No
forwarding shims.
2026-10-06 05:04:25 +08:00
N0zoM1z0 82957c98bf
chore(test): separate development feedback from full verification (#599) 2026-10-06 00:59:26 +08:00
morluto 6256b68666
feat(setup)!: expand agent integrations and verify updates (#577)
* feat(setup)!: expand agent integrations and simplify onboarding

Add native configuration formats for OpenCode, Antigravity, GitHub Copilot
CLI, VS Code, and Devin. Preserve JSONC comments and unrelated settings
while making setup and uninstall ownership-aware and idempotent.

Select agent targets before planning, separate discovery from intent, and
keep agent-only setup independent of optional provider prerequisites.
Cover configuration boundaries and interactive behavior in packaged checks.

BREAKING CHANGE: unscoped setup refreshes only existing REA-owned
registrations. Use --all-detected to configure every detected client.
Setup JSON contains a compact doctor summary; use rea doctor for full
diagnostics. Cancellation and successful dry runs now exit successfully.

* feat(cli)!: replace upgrade with verified updates

Resolve an exact release through npm's configured registry, update only the
identified installation, and verify its new executable before reporting success.
Return a read-only maintenance plan for existing enabled REA integrations.

BREAKING CHANGE: replace rea upgrade with rea update; no alias is retained.
Successful update JSON uses status "updated", reports the verified installed
version, and returns an unapplied maintenance plan instead of opening setup.
2026-10-05 23:06:19 +08:00
morluto e07b81649e
refactor!: simplify runtime tools and remove replay engines (#572)
* fix(hopper): report unavailable procedure body coverage

* refactor!: simplify runtime tools and remove replay engines

Keep direct inspection, capture, and comparison tools. Bind handlers to named contracts and let agents compose experiments with commands and local fixture servers.

BREAKING CHANGE: Remove controlled replay, Node characterization, finite replay-machine, managed runtime planning, and redundant string-tracing tools. Retire process replay, shims, reactive scenarios, custom checkpoints, and active browser replay and origin-scope inputs.
2026-10-05 21:15:04 +08:00
morluto b5e98915c6
fix(tools)!: simplify direct invocation and harden boundary contracts (#555)
Remove REA permission grants, scope ceilings, approval confirmations, and inert settings. Preserve selected local evidence, accept caller-chosen commands and paths, and report actual runtime failures.

Harden provider results, schema serialization, snapshot evidence binding, archive paths, source maps, native screenshots, managed EH parsing, and cancellation cleanup. Regenerate tool metadata and document direct invocation.

BREAKING CHANGE: Removed permission configuration and policy commands, approval fields, filesystem scope inputs, and fixed confirmation options. Process capture inherits the host environment and accepts command names; callers must refresh tool schemas and migrate removed fields.
2026-10-05 20:16:44 +08:00
Rudy Mizrahi Celekli 2fd11961cf
fix(cli): fail commands returning projected analysis errors (#506)
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
2026-10-05 14:59:05 +08:00
morluto 4fbc501121
feat(native): add inspection primitives, dispatch traces and approved UI observation (#500)
* fix(hopper): normalize string-backed addresses and update verification

* feat(native): add inspection primitives, dispatch traces and approved UI observation

* test: prioritize real artifact E2E and captured golden regressions

* fix(process): queue observed output before reactive rendering actions

* test: prune redundant cases and strengthen boundary assertions

* fix(cli): route native value tracing through shared workflows

* test: replace synthetic success with real workflows and captured data

* fix(catalog): separate portable metadata from native host availability
2026-10-04 16:02:36 +08:00
morluto dcb036292e test(cli): remove duplicate browser discovery case 2026-09-29 19:00:58 +08:00
morluto 9bd7e2cb45 test(cli): consolidate duplicate setup journey 2026-09-29 18:16:08 +08:00
morluto 5f73cb061b refactor(tools): remove arbitrary workflow ceilings 2026-09-29 17:36:26 +08:00
morluto acf33d6df2 test: remove stale limits and handoff expectations 2026-09-29 17:00:16 +08:00
morluto 2f08c7c932 refactor(tools): remove artificial analysis ceilings 2026-09-29 16:29:23 +08:00
morluto c34efca4cd refactor(files): use caller paths for local evidence files 2026-09-29 14:53:20 +08:00
morluto 6740ed5215 refactor(mcp): simplify evidence and workflows 2026-09-29 13:58:26 +08:00
morluto 7b3c797237 refactor(observation): internalize capture budgets 2026-09-29 12:16:10 +08:00
morluto f55c2b9267 refactor(mcp): simplify tool inputs and inline results 2026-09-29 11:22:00 +08:00
morluto bd0e341572 refactor(tools): remove redundant limits and acknowledgements 2026-09-29 10:53:45 +08:00
morluto f3645aa51e fix(cli): remove ignored result limits 2026-09-29 09:22:57 +08:00
morluto 7acac615ca refactor(contracts): simplify workflows and drop readiness tool 2026-09-29 09:22:44 +08:00
morluto 9e7605482a refactor(coverage): evaluate inline without workspaces 2026-09-29 08:45:00 +08:00
morluto a2a3243ea8 refactor: return complete analysis results inline 2026-09-29 08:07:24 +08:00
morluto 0d96275b68 refactor: return complete tool results inline 2026-09-29 07:08:46 +08:00
morluto 2160d4fae5
fix: consolidate boundary ownership and cleanup failure paths (#477) 2026-09-08 10:59:13 +08:00
morluto d4dc940bd8
refactor(test): keep coverage at behavioral boundaries (#474)
* refactor(test): keep coverage at behavioral boundaries

* fix(ci): restore package workflow temp-root classification
2026-08-11 18:34:32 +08:00
morluto e91c8c39c2
refactor(test): colocate pure-domain tests and reduce test debt (#471)
* refactor(test): colocate pure-domain tests and reduce test debt

Move focused immutable domain/contracts/adapter tests from
tests/composition/** beside their production owners under src/** as
colocated *.test.ts/*.fixture.ts, and relocate persistence-shaped
composition tests under tests/boundary/filesystem/**. Update import
paths, the Vitest project topology (shared worker context for pure
domain/contracts and recording-port service projects), the test
migration ledger, testing docs, and AGENTS.md to match.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* docs: remove test migration ledger

The cutover is complete and the ledger is no longer referenced anywhere
in source, scripts, or the docs gate. Drop the standalone artifact.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* docs: clean up stale migration artifacts

Remove empty directories left by the test migration and replace the
"final cutover" language in docs/testing.md with standing PR guidance
that no longer references the completed migration.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* fix: repair CI failures from schema, knip, and stale generated artifacts

Three root causes fixed:

1. catalog-schemas.mjs: valuesAt only traversed anyOf from Zod's
   toJSONSchema, not oneOf. The webScreenshotDiffSchema change to a
   discriminated union produces oneOf, so the product catalog generator
   could not derive the web_screenshot_diff schema version. Add oneOf
   traversal.

2. conformancePackage.ts: the test rewrite removed the only imports of
   ScenarioManifest, ReplayPlan, ShimPlan, and ExpectedEvidence, making
   them unused exports that knip flags. Remove the dead type aliases.

3. Regenerate stale artifacts (product catalog, MCP tool catalog, skill
   metadata, conformance manifest) that drifted from the source changes.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

---------

Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-08-10 14:57:44 +08:00
morluto 1783bf6dfd
fix(npm): preserve explicit setup versions (#465)
* fix(npm): refresh stale setup bootstraps

* fix(npm): preserve explicit setup versions

* docs: distinguish first-run and refresh setup
2026-08-10 02:59:52 +08:00
morluto 8f229ede70
feat(electron): add autonomous Electron runtime analysis (#464)
* feat: add autonomous Electron runtime analysis

* feat(electron): add lifecycle and boundary telemetry

* feat(electron): capture runtime boundary evidence

* fix(electron): package boundary hook helper

* feat(electron): report active capture coverage

* fix(electron): account for bring-your-own runtime

* feat(electron): expand agent-owned runtime scenarios

* fix(ghidra): keep fixture credentials out of argv

* perf(test): serialize local test and docs workloads

* fix(electron): harden active runtime capture

* fix(inspector): require exact runtime target authorization

* fix(docs): make managed manifest host independent

* fix(ci): make generated catalog portable

* fix: unblock autonomous command and electron flows

* fix(electron): close popup and detached helper gaps
2026-08-05 19:07:46 +08:00
morluto 513d9b1555 test: overhaul deterministic suite architecture 2026-07-29 22:00:38 +00:00