Verify the native helper's sealed identifier and pinned Apple signing team in BridgeLauncher, then carry that provenance to HopperClient. Only a verified native helper's complete not-found exit confirms no document handoff, allowing runtime and target-lease cleanup and retry; wrappers retain unknown document state.
Share publisher identity with setup through the domain contract. Correct fixture teardown ordering and parameterized MCP coverage. Validation: 54 focused tests passed across boundary, CLI, MCP acceptance, diagnostics and installer coverage (one Linux-only case skipped); check:fast passed. Real codesign verification accepted the installed official Hopper helper; Spotlight failures and bridge recovery used process fixtures.
* fix(hopper): recover from a Spotlight not-found launch
Hopper's native launcher locates the application through a fixed Spotlight
query before any Apple event. With indexing disabled it exits 3 with a
not-found report, but REA treated the external document as unconfirmed,
retained the runtime and failed every later open_binary until the server
restarted. Recognize the complete report as a pre-handoff failure, confirm
no document exists, and tell the caller to enable Spotlight indexing.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(hopper): require empty stdout for native launch signatures
* fix(hopper): retain ownership after unverified Spotlight reports
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
* perf(ci): start source feedback early and diagnose stalled runs
* fix(ci): verify workflow identities before main comparison limits
* fix(ci): preserve diagnostics across passing checks and install failures
* fix(ci): preserve ambiguous workflow run ordering
* fix(ci): preserve failure-report candidate and request budgets
* fix(ci): retain candidate errors while checking later main evidence
* fix(ci): retain partial reports and require complete health scans
* test(ci): prune stale fixtures and duplicated assumptions
* fix(setup): configure a comment-only Hermes config.yaml
comments, or only a `---` marker, also parses to a null YAML document.
Setup still rejected it as malformed ("expected record, received null")
and reported Hermes as invalid.
Treat a null Hermes document as holding no settings, as #1983 does for
an empty file. The serializer already edits a comment-only document in
place. A bare `---` document holds a null scalar that takes no keys, so
replace it with a map and keep the comments written after the marker.
* fix(setup): keep rejecting an explicit null Hermes root
Only a document with no root, or a bare --- marker whose null scalar has
no source text, holds no settings. An explicit null or ~ is a value, so
setup and uninstall reject it as before, the same as any other non-map
root.
* test(setup): split the Hermes empty-configuration tests under the function length limit
The Hermes YAML registration block reached 159 lines, past oxlint's
max-lines-per-function limit of 150. Move the empty-document cases and
the multiple-document rejection into their own block.
* fix(setup): type the Hermes edit document as a plain Document
parseDocument with options returns a Document.Parsed, whose contents
accept only parsed nodes, so assigning the new map for a bare --- root
failed typecheck (TS2322). Annotate the edited document as Document, as
the code did before it moved into HermesConfigurationYaml.ts.
* fix(ci): isolate Linux Hopper process fixture inventory
---------
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
boundedViewMessages returns uniqueSorted output, so the 100-message fixture
came back in lexicographic order ("message 59", "message 6", "message 60")
while the assertion compared against generation order. Pad the index to a
fixed width so both orders coincide and the test checks what it means to:
that no count-based cutoff applies below the byte budget.
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Document the pinned JADX release download and digest verification for npm users and repository checkouts. Keep caller-selected local paths; identify the fixture helper as checkout-only. Include shell and PowerShell examples, with the POSIX path set only after successful download and verification.
Validation: actual pinned JAR/APK fetch verification; real curl download and SHA-256 checks using sha256sum and the shasum fallback; controlled corrupt-file and failed-download cases; POSIX syntax; docs:check (5 conformance tests), typecheck/lint, formatting and diff checks. Provider execution and native macOS/Windows command runs were not repeated.
Co-authored-by: Seelly <93262000+Seelly@users.noreply.github.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
* docs(i18n): add Greek translations
Give Greek-speaking readers localized onboarding guidance and begin website coverage while keeping incomplete pages on the explicit English fallback.
- Add the reviewed Greek README and place Greek last in every language selector.
- Register Greek website localization and include 206 translated messages.
- Keep incomplete routes nonindexable and replace fixed translation counts with inventory-based coverage.
Refs #2984
* docs(website): improve Greek homepage wording
* fix(ci): restore inherited validation failures
* perf(ci): share trusted caches and fail fast on PR test failures
* fix(ci): bound static cache and hash vitest config for knip
- Bound the rolling .turbo/cache snapshot with 7d/500MB eviction so each
trusted main save cannot accumulate history toward the GitHub limit.
- Hash vitest.config.ts in knip inputs so removing the CiTestSequencer
import invalidates the cached passing check.
- Cover both in cache-policy and task-hash regressions.
push_adb_file claimed to be the only device-mutating ADB tool while
install, uninstall, start-app, start-activity and stop-app are also
device-mutating. Drop the exclusivity claim from the contract
description and the push limitations, keeping the device-mutation fact.
Fixes#2602.
Co-authored-by: me <me@medz.org>
* test(signals): verify native decoder discovery coverage
Compare catalog and help pages against independent native sigrok output,
including full coverage counts, empty matches and boundary offsets.
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
* style(test): format the JVM class fixture
* fix(comparison): recheck historical calls-only changes (#2223)
* fix(comparison): preserve incomplete function call evidence
Keep missing, unknown, partial and unresolved call relationships unknown in function comparisons and reconstruction claims. Aggregate IDA caller and callee coverage without overwriting uncertainty.
Validate with 144 focused tests, typecheck/lint, docs checks and test discovery. Real providers were not verified; the full headless IDA session suite requires unavailable Windows native controls.
* fix(comparison): recheck historical calls-only changes
---------
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
* fix(ci): isolate Linux Hopper process fixture inventory
---------
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
Co-authored-by: Lucien <164857476+dakjdakd@users.noreply.github.com>
* fix(artifacts): describe ZIP non-entry coverage accurately
* fix(process): report no remaining time after a provider deadline fires
Node timers can fire while performance.now() is still a fraction of a
millisecond short of the monotonic deadline. ProviderStartupDeadline then
reported interruption "timeout" and an aborted signal while remainingMs()
returned ceil(0.x) = 1, so polling loops guarded by remainingMs() > 0
(Hopper and Ghidra startup) could run past an elapsed deadline, and the
real-timer test "aborts a bounded wait when its real monotonic deadline
expires" failed intermittently in CI (expected 1 to be 0).
Once the deadline's own timer has classified a timeout, report zero
remaining time. A deterministic regression test fires the timer with the
monotonic clock 0.4 ms short of the deadline.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* style: format comparison and IDA sources
---------
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(cli): preserve import-map option descriptions
* fix(process): report no remaining time after a provider deadline fires
Node timers can fire while performance.now() is still a fraction of a
millisecond short of the monotonic deadline. ProviderStartupDeadline then
reported interruption "timeout" and an aborted signal while remainingMs()
returned ceil(0.x) = 1, so polling loops guarded by remainingMs() > 0
(Hopper and Ghidra startup) could run past an elapsed deadline, and the
real-timer test "aborts a bounded wait when its real monotonic deadline
expires" failed intermittently in CI (expected 1 to be 0).
Once the deadline's own timer has classified a timeout, report zero
remaining time. A deterministic regression test fires the timer with the
monotonic clock 0.4 ms short of the deadline.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(process): keep terminal deadline expiry sticky
---------
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* docs: identify official REA installation sources
Assisted-by: OpenAI GPT-6 <noreply@openai.com>
* docs: show official sources before setup shortcut
Move the unchanged official-source notice before the first setup command in all 19 README editions.
Assisted-by: OpenAI GPT-6 <noreply@openai.com>
---------
Co-authored-by: Aurantium-47 <280805072+Aurantium-47@users.noreply.github.com>
* fix(wasm): preserve original glue source locations
* fix(wasm): retain BOM-prefixed hashbang glue references
* test(wasm): parse the artifact contract before reading glue evidence
* test(wasm): give glue fixtures and assertions a single owner
* fix(comparison): recheck historical calls-only changes (#2223)
* fix(comparison): preserve incomplete function call evidence
Keep missing, unknown, partial and unresolved call relationships unknown in function comparisons and reconstruction claims. Aggregate IDA caller and callee coverage without overwriting uncertainty.
Validate with 144 focused tests, typecheck/lint, docs checks and test discovery. Real providers were not verified; the full headless IDA session suite requires unavailable Windows native controls.
* fix(comparison): recheck historical calls-only changes
---------
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
(cherry picked from commit 688defca0f)
* fix(ci): isolate Linux Hopper process fixture inventory
(cherry picked from commit 8cac51e12184d56a9ba80a4427b3e6082ddac1ec)
* fix(android): make DEX descriptor pattern portable
(cherry picked from commit 1335bcddc569a1cfb34b6efedcb6f2e3aaaa3357)
* fix: repair the static-check failures on the default branch (#2895)
* fix: repair the static-check failures on the default branch
The default branch fails its own required `Static checks` job three ways, so
every pull request reports that job as failed regardless of its own change.
- `npm run format:check` reports `src/domain/functionComparison.test.ts` and
`src/ida/IdaOperationRunner.ts`.
- `npm run lint` reports a duplicate `import { join } from "node:path"` in
`tests/boundary/mcp/ghidraInventoryMcp.test.ts` (lines 4 and 17).
- `npm run typecheck` reports `format: "devin"` missing from the client format
union in `src/application/SupportedClients.ts`, and an unchecked index in
`tests/boundary/cli/clientProfileLifecycle.test.ts`, whose pair array is
inferred as `string[][]`.
Apply the pinned formatter, drop the duplicate import, list the `"devin"` format
that its own definition already uses, and mark the pair array `as const`.
Validation: `npm run check:fast` and `npm run format:check` pass.
* fix(setup): keep Devin on the JSON configuration dialect
---------
Co-authored-by: 吴佳浩 <wujiahao@supremind.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
(cherry picked from commit df3d96da80)
---------
Co-authored-by: morluto <morluto@users.noreply.github.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
Co-authored-by: Lucien <164857476+dakjdakd@users.noreply.github.com>
Co-authored-by: 吴佳浩Alben <35291372+XiaoBinGan@users.noreply.github.com>
Co-authored-by: 吴佳浩 <wujiahao@supremind.com>
* fix(verify-package): read Hopper installer applicability from its owner
packageSetupSupport derived hopperSetupSupported from the general doctor
host check plus a non-Windows condition, so a Debian-family host REA
supports but the Hopper package never tested reported an automated
installer the packaged setup never offers. verifySetupApply then expected
needs_confirmation for the explicit --install-hopper request and failed
at verify-package-setup.mjs:403.
Applicability now comes from readLinuxDistribution() in the built
application, so the verifier follows the predicate the package ships, and
it stays unknown when no distribution can be read instead of collapsing
into a known-unsupported host. Generic agent configuration and idempotence
assertions stay independent of installer applicability, and the expected
status is still derived from the host rather than from the request being
asserted.
Verified on Kali 2026.3, a Debian-family host with an installer-untested
distribution and the simulated Hopper package environment: before the
change npm run verify:package fails at verify-package-setup.mjs:403 with
the packaged setup correctly returning needs_human; after it the same run
passes every stage. Both applicability branches are covered by
tests/evaluation/package/packageSetupSupport.test.ts, which runs in the
source lane without a build. No real Hopper installation was exercised,
so no engine compatibility claim follows.
Refs #2939
* fix(ci): preserve Hopper doctor readiness checks
---------
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
* fix(analysis-view): bound limitations and unknowns per view
Views of a JavaScript application or binary layout copied every parent
limitation into both limitations and unknowns, so a parent with tens of
thousands of limitations produced views as large as the complete record
and exceeded the MCP response budget even for a one-item page. Each view
now carries at most 64 distinct messages per field plus one line naming
the omitted count and the parent Evidence that retains the full list.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(analysis-view): assert exact bounded message notices
Source inspection and targeted formatting only. Tests, builds, lint, typechecks and provider workloads were not run at the user's explicit request.
* fix(analysis-view): preserve coverage facts in bounded messages
Reserve JavaScript completeness and unknown-count facts before bulk limitations. Direct omission recovery to the source parent without assuming session retention. Preserve exact threshold assertions and add unrun exhausted-page/item and unretained-inline MCP regressions. Source inspection and targeted formatting only; tests/checks/builds/provider workloads/CI reruns skipped by explicit user request.
* fix(analysis-view): bound repeated message serialization bytes
* fix(analysis-view): let byte budget bound messages
* test(analysis-view): exercise byte-based message omissions
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* fix(application): accept alternative document selection in binary_overview (#2460)
Update binary_overview capability negotiation so that either current_document or list_documents satisfies the document identity requirement, matching resolveAnalysisDocument runtime semantics. When a provider declares neither document capability, resolveAnalysisDocument reports AnalysisCapabilityUnavailableError for current_document rather than leaking the internal list_documents fallback. Preserve list_segments as an independently mandatory requirement.
* fix(application): retain document fallback provider errors
Return the fallback producer error unchanged, retaining operation identity, retry advice, diagnostics and cleanup instead of fabricating missing capabilities.
Source inspection and git diff --check; tests/builds/typechecks/CI reruns skipped at explicit user request.
* test(application): retain document fallback error expectations
Composition and MCP controls now expect the original list_documents producer error and reason.
Source inspection and git diff --check only. Tests, builds and typechecks skipped by explicit user request. GitHub review writes paused globally.
* fix(ida): assert attached-mode routing failure
---------
Co-authored-by: yashas1624 <yashas1624@users.noreply.github.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
The semantic member-mutation collector revisits the same nodes while it closes
alias chains, and each visit re-derived results that cannot change within the
phase:
- resolveSemanticBindingState re-walked the scope chain for the same identifier
node. Definition collection completes before this phase, and addBinding is
reachable only from it, so a scope's bindings no longer change.
- directInitializerPosition, directMutationPosition and
referenceInitializerPosition are pure functions of a node and the analysis
parent map, but were recomputed for every mutation and initializer.
- markValue re-encoded the same capture tuple with JSON.stringify and built a
fresh long key for every Set/Map lookup, so each lookup re-hashed the whole
key. The capture key is now cached per binding, origin and owner, and the
lifetime key is derived from it.
On pdfjs-dist 5.3.93 wasm/openjpeg_nowasm_fallback.js (462316 bytes, sha256
53c228428a8861035a34738966af263fc9d4cee6df25a0ad942af947469a0bd9) the semantic
phase takes 177.8 s instead of 272.9 s in-process, with a byte-identical
semantic IR. With --max-heap-mb 3072 and the default heap the base revision
exhausts the worker; with the default 300 s per-source deadline raised, the
completed CLI run takes 240.6 s instead of 396.7 s and its output is identical
apart from volatile identifiers.
Refs #2498
Co-authored-by: gongfpp <22683417+gongfpp@users.noreply.github.com>
* fix(package-verifier): reject overview responses without a procedure count
The analyze and inspect checks compared procedure_count with `< 1`, and an absent
or null normalized_result makes that comparison false, so a binary_overview
response without its required result passed the platform smoke check. Require an
integer procedure count before the positive-count comparison.
* test(package-verifier): cover malformed overview receipts
---------
Co-authored-by: REA Maintenance <76467478+morluto@users.noreply.github.com>
When every registered deep provider rejected a target, select() returned
an intentionally unbound success for any concrete environment selector,
including one that names no registered provider. A misconfigured
REA_ANALYSIS_PROVIDER therefore opened the target unbound, and the later
deep-operation diagnostic blamed target support instead of the unknown
configuration. The same identifier requested explicitly already failed
with unknown_provider.
Take the unbound shortcut only for a registered environment preference.
An unknown configured identifier now reaches concrete selection and fails
with unknown_provider, matching the explicit request. Registered
preferences and auto still leave artifact-only targets unbound.
Fixes#2592
* fix(qlog): list a hidden stream's records without spreading call arguments
When an explicit declaration matched a stream's derived total, the
decoder pushed every contribution ordinal with a spread call. A stream
with more than ~125k STREAM frames exceeded the engine's argument limit,
so a valid capture within the input budget failed with RangeError
instead of listing the records as incomplete. Push the ordinals in a
loop.
* fix(comparison): recheck historical calls-only changes (#2223)
* fix(comparison): preserve incomplete function call evidence
Keep missing, unknown, partial and unresolved call relationships unknown in function comparisons and reconstruction claims. Aggregate IDA caller and callee coverage without overwriting uncertainty.
Validate with 144 focused tests, typecheck/lint, docs checks and test discovery. Real providers were not verified; the full headless IDA session suite requires unavailable Windows native controls.
* fix(comparison): recheck historical calls-only changes
---------
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
* fix(ci): isolate Linux Hopper process fixture inventory
* fix(android): make DEX descriptor pattern portable
---------
Co-authored-by: Lucien <164857476+dakjdakd@users.noreply.github.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
* feat(managed): decode ldstr user strings in member inspection
inspect_managed_members reported every ldstr operand as a bare 0x70 token,
so an analyst could see that a method loads a literal but not which one.
Answering "where is this path or key used" required a second tool.
Read the optional #US stream and add a top-level user_strings inventory:
each distinct token loaded by an inspected method body, once, in token
order, with its #US file offset and decoded UTF-16 value. Instruction
anchors and normalized CIL digests keep their build-local tokens. A missing
#US stream or malformed item is reported against its token as partial
coverage. Evidence recorded before this field reads user_strings as null.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(managed): collect user strings only from ldstr
A malformed ldtoken can carry a 0x70 token, which the operand decoder
classifies as a string operand. Only ldstr loads a literal, so collect
user strings by opcode.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(managed): admit user-string tokens and failures before collecting them
Charge each distinct ldstr token to the decode budget before adding it to
the collection set, and admit each #US failure before retaining it. A
missing #US stream is now one stream-level issue rather than one per
token.
Document why the #US terminal flag is not validated: Mono and Roslyn
assemblies disagree with ECMA-335 II.24.2.4 and the runtime ignores it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(managed): describe missing #US reporting and the unvalidated flag byte
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(managed): cover #US items that run past the stream end
An odd length whose payload crosses the end of #US, and a two-byte
length prefix that starts on the last #US byte, are both rejected as
"User string leaves #US" beside a readable literal. The test fails if
that bounds check is removed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(managed): report reserved #US length prefixes as string failures
The compressed-length reader shared by #Blob and #US hard-coded
invalid-blob and "Metadata blob" for a reserved prefix, so a malformed
user string was published as a blob failure. The caller now names the
item it reads: #Blob keeps its code and message, and #US reports
invalid-string.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(managed): append member inspection issues without argument spreading
inspectManagedMembersBytes gathered every producer's issues with
issues.push(...list), passing one argument per issue. A large malformed
input, such as hundreds of thousands of distinct bad ldstr operands or
MemberRef rows, overflows the stack with an untyped RangeError instead of
returning partial coverage. All six sites now use
appendManagedParseIssues, which appends one issue at a time.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(managed): classify truncated #US and #Blob length prefixes by item
A two- or four-byte compressed-length prefix cut off by the end of the
artifact went through the generic range check and was reported as
invalid-row. The prefix reader now uses the item's own code for both
reserved and truncated prefixes: invalid-string for #US, invalid-blob for
#Blob. The unused generic range helper is removed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(managed): retain user-string terminal flag conformance issues
* test(managed): write ECMA-335 #US terminal flags and cover flag issues
d5b7b0704 reports a #US terminal flag that differs from ECMA-335
II.24.2.4. The fixture heap always wrote 0, so its non-Latin-1 literals
now read as nonconforming. The fixture writes the spec flag, and a new
test flips one flag each way ("ok" set to 1, "it's" set to 0) and checks
that both literals remain beside one issue each.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(managed): classify ldstr operands before collapsing a missing #US
With no #US stream, every collected ldstr operand was counted as a #US
reference and reported only as missing-stream, while the same non-0x70
operand got invalid-heap-index when the stream existed. parseUserStrings
now owns which operands are user-string tokens: any other operand is
invalid-heap-index either way, and only 0x70 tokens count toward the
missing-stream issue. The heap reader drops its duplicate kind check.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(managed): state user-string limits in member comparisons
compare_managed_members ignored user_strings, so a method whose ldstr
literal changed at the same token, or legacy Evidence that never examined
literals, could read as unchanged with no caveat. The comparison now adds
an unknown limitation when either side predates user strings and a
not-compared limitation when literals were observed. ExportedType and
user-string inventories share one uncomparedInventory rule.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(managed): advertise ldstr literals in member inspection help
The MCP tool description, the type_names input, and the CLI command and
--type help now say that inspect_managed_members returns the #US string
literals that ldstr loads, and that a type selection limits them to the
literals the selected types' method bodies load.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(managed): read the empty #US entry at offset 0
ECMA-335 II.24.2.4 makes the first #US entry the empty blob: a zero
length with no terminal flag byte. ldstr 0x70000000 loads it, but the
odd-length check rejected it as invalid-string, dropping the literal and
making coverage partial. Offset 0 with length 0 now reads as "".
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(managed): reserve #US offset 0 and admit literals before scanning
Offset 0 is the reserved empty #US entry, so a nonempty item there is now
invalid-string instead of a published literal. The literal's projection
is reserved before the terminal-flag scan, so an inadmissible item fails
at the budget without reading every code unit. The scan's loop index no
longer shadows the token's heap index.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(managed): report #US length prefixes wider than ECMA-335 assigns
compressedLength accepted an overlong encoding, such as 0x80 0x05 for a
5-byte item, without comment. It now reports whether the width is the
one ECMA-335 II.23.2 assigns, and the #US reader reports a non-minimal
prefix as an invalid-string conformance issue beside the readable
literal, like the terminal flag. readMetadataUserString returns every
issue it observes. #Blob behavior is unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(managed): check the #US length width before the empty entry
The offset-0 empty entry returned "" before the length-width check, so an
overlong empty entry such as 0x80 0x00 read as complete. The width issue
is now collected first and returned with the empty literal.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(managed): admit #US width issues only for returned literals
The overlong-prefix issue was reserved before the fatal shape checks, so
an item that then failed, such as 0x80 0x00 away from offset 0, leaked
512 bytes of budget per token. The width issue is now built and admitted
only on paths that return the literal.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(managed): keep #US issues out of member metadata status
User-string issues, including terminal-flag and length-prefix
conformance differences, marked metadata.status partial, so
compare_managed_members turned one-sided methods and fields into unknown
even though every member row was examined. #US issues now make coverage
partial while metadata.status describes the member inventory.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(managed): give user strings their own coverage
#US issues entered the member coverage, so every consumer that reads it
as member coverage (application graph member facts, comparison status)
reported examined members as partial over a literal conformance
difference. user_strings is now { state, literals, issues }: #US issues
live there and never change the member coverage or metadata.status.
parseUserStrings returns that inventory directly.
compare_managed_members inspects with user strings skipped, since it
never reads literals, so a large literal cannot exhaust the decode budget
of a comparison. Its limitations state once that literals are not
compared, and the ExportedType limitations return to their main form.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(managed): mark user strings partial when a body is not fully decoded
With user strings owning their coverage, an inspected method body that
was partial, malformed, or truncated no longer reached their state, so a
literal after the decode stopped was missing from a "complete" inventory.
parseUserStrings now marks the inventory partial unless every inspected
body was fully decoded, keeping the literals it did observe.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(managed): mark user strings partial when a method row is omitted
A MethodDef row that failed before its body was read was recorded as an
issue and omitted, so its ldstr instructions were never scanned, yet the
user-string inventory could still read as complete. parseUserStrings now
takes the parseMethods result and stays partial whenever a method row
failed, as well as when an inspected body was not fully decoded.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(managed): count only method rows that may hide a selected body
Any parseMethods issue marked user strings partial, including an
unreadable name on a method outside the type selection, so a fully
scanned selection read as incomplete. parseMethods now reads each row's
owner first and reports unscannedRows: rows that produced no method while
their owner is selected or unknown. parseUserStrings uses that count.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(managed): treat unreadably named types as possibly selected
Under a type_names selection, a type whose name could not be read may be
a requested type, but its methods were skipped without counting toward
unscannedRows, so an unexamined body left user strings complete. A
method whose owner's name is unreadable now counts as possibly selected.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(managed): judge user-string scans by CIL decoding, not body status
body.status is malformed for an invalid exception section even when
every instruction decoded, so user strings read as partial although every
ldstr was examined. The body reader now reports whether its CIL was fully
scanned, independent of exception-region validity, and parseMethods folds
unscanned bodies and unproduced rows into one unscannedMethods count that
parseUserStrings uses instead of reinterpreting body.status.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(managed): stop deduplicating user-string issues
The inventory passed its issues through uniqueManagedParseIssues, which
serializes every issue into an unbudgeted map: about 42 MB of heap and
113 ms for 125,000 issues on Node 24. The issues are unique by
construction (one failure or per-offset conformance issues per distinct
token, one missing-stream issue), so the inventory now returns them, and
its literals, without copies.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(managed): preserve selected string coverage unknowns
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
* fix(process): expose Darwin swiftc compile deadline via env
Busy hosts can exceed the hard-coded 60s ownership-helper compile
timeout. Honor REA_SWIFTC_COMPILE_TIMEOUT_MS like the other provider
startup deadlines, keeping 60000 as the default.
Fixes#2184
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(process): keep the Swift compile deadline with its runtime owner
* fix(comparison): recheck historical calls-only changes (#2223)
* fix(comparison): preserve incomplete function call evidence
Keep missing, unknown, partial and unresolved call relationships unknown in function comparisons and reconstruction claims. Aggregate IDA caller and callee coverage without overwriting uncertainty.
Validate with 144 focused tests, typecheck/lint, docs checks and test discovery. Real providers were not verified; the full headless IDA session suite requires unavailable Windows native controls.
* fix(comparison): recheck historical calls-only changes
---------
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
(cherry picked from commit 688defca0f)
* fix(ci): isolate Linux Hopper process fixture inventory
(cherry picked from commit 8cac51e12184d56a9ba80a4427b3e6082ddac1ec)
* fix(android): make DEX descriptor pattern portable
(cherry picked from commit 1335bcddc569a1cfb34b6efedcb6f2e3aaaa3357)
* fix: repair the static-check failures on the default branch (#2895)
* fix: repair the static-check failures on the default branch
The default branch fails its own required `Static checks` job three ways, so
every pull request reports that job as failed regardless of its own change.
- `npm run format:check` reports `src/domain/functionComparison.test.ts` and
`src/ida/IdaOperationRunner.ts`.
- `npm run lint` reports a duplicate `import { join } from "node:path"` in
`tests/boundary/mcp/ghidraInventoryMcp.test.ts` (lines 4 and 17).
- `npm run typecheck` reports `format: "devin"` missing from the client format
union in `src/application/SupportedClients.ts`, and an unchecked index in
`tests/boundary/cli/clientProfileLifecycle.test.ts`, whose pair array is
inferred as `string[][]`.
Apply the pinned formatter, drop the duplicate import, list the `"devin"` format
that its own definition already uses, and mark the pair array `as const`.
Validation: `npm run check:fast` and `npm run format:check` pass.
* fix(setup): keep Devin on the JSON configuration dialect
---------
Co-authored-by: 吴佳浩 <wujiahao@supremind.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
(cherry picked from commit df3d96da80)
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
Co-authored-by: morluto <17176810+morluto@users.noreply.github.com>
Co-authored-by: Lucien <164857476+dakjdakd@users.noreply.github.com>
Co-authored-by: 吴佳浩Alben <35291372+XiaoBinGan@users.noreply.github.com>
Co-authored-by: 吴佳浩 <wujiahao@supremind.com>
* fix(wasm): report WABT output past its budget as a resource constraint
A module whose WAT exceeds the 32 MiB output budget failed as
unreadable_output, advised `rea doctor`, and echoed the full 32 MiB
truncated WAT prefix in details.captured_output. Map the owned-command
output-limit outcome during inspection to AnalysisResourceConstraintError
naming the budget, as the apktool and native macOS providers do, with a
remediation that says the fixed budget will not change on retry.
Captured output for an output-limit failure keeps only the first 4,096
characters of each stream, including on the cleanup-failure path. An
oversized --version probe keeps its configuration-phase mapping.
* fix(wasm): keep observed sizes and whole code points in output-limit excerpts
Cut each stream's output-limit excerpt with boundedUtf8Text at 4,096
UTF-8 bytes, so an astral character at the cut no longer leaves a lone
surrogate. Mark the output truncated when either excerpt was cut, and
report each stream's observed byte count.
Word the remediation as a fact about the fixed budget. A flood of
diagnostics from any WABT tool reaches this path, so it no longer says
the module is too large.
Replace the 32 MiB end-to-end test with a launcher seam that raises a
small output-limit failure.
* fix(wasm): match sibling captured-output fields for WABT output limits
Report retained byte counts in stdout_bytes and stderr_bytes, as apktool
and the firmware command do, and record exit_code and signal. Mark the
excerpt truncated outright, since the command raises output-limit only
after retention was truncated.
When cleanup also fails, record the output limit and its budget as the
previous error instead of the generic command message. Document that
the two streams share the budget, so the excerpt holds up to 4,096 of
the bytes each stream retained.
* docs(wasm): scope the output-budget error to inspection commands
* docs(wasm): distinguish reported warm costs from unmeasured gaps
* docs(wasm): clarify the scope of reported warm measurements
---------
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
* fix(ghidra): report unapplied PE CodeView PDB limitation (#2259)
When Ghidra analyzes a PE target that references companion debug symbols
in its CodeView (IMAGE_DEBUG_TYPE_CODEVIEW / RSDS or NB10) debug directory,
Ghidra's headless analyzer cannot automatically locate or apply the companion
PDB from isolated runtime directories without companion admission. Procedure
names remain analysis-generated (FUN_<address>).
Parse CodeView debug metadata (RSDS GUID/age and NB10 age) during PE target
resolution, and report an Evidence limitation informing callers and agents
that referenced debug symbols were not applied and procedure names are
analysis-generated.
Fixes#2259
* test(pe): group CodeView header coverage separately
* fix(ghidra): avoid contradictory PDB limitations
* fix(android): make DEX descriptor pattern portable
* fix(ci): isolate Linux Hopper process fixture inventory
* fix(comparison): recheck historical calls-only changes (#2223)
* fix(comparison): preserve incomplete function call evidence
Keep missing, unknown, partial and unresolved call relationships unknown in function comparisons and reconstruction claims. Aggregate IDA caller and callee coverage without overwriting uncertainty.
Validate with 144 focused tests, typecheck/lint, docs checks and test discovery. Real providers were not verified; the full headless IDA session suite requires unavailable Windows native controls.
* fix(comparison): recheck historical calls-only changes
---------
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
* style: format identity comparison and IDA runner
---------
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
Co-authored-by: Lucien <164857476+dakjdakd@users.noreply.github.com>
* fix(frida): drain admitted operations and honor queued cancellation
* fix(frida): settle cancelled loads before queued resume
* test(frida): share lifecycle fixtures without duplicating assertions
* fix(frida): preserve operation admission before session close
* test(apple): bound cold archive fixture compilation
* fix(frida): retain cancelled script creation evidence
* test(release): scope preflight schema to selected jobs
* fix(process): report no remaining time after a provider deadline fires
Node timers can fire while performance.now() is still a fraction of a
millisecond short of the monotonic deadline. ProviderStartupDeadline then
reported interruption "timeout" and an aborted signal while remainingMs()
returned ceil(0.x) = 1, so polling loops guarded by remainingMs() > 0
(Hopper and Ghidra startup) could run past an elapsed deadline, and the
real-timer test "aborts a bounded wait when its real monotonic deadline
expires" failed intermittently in CI (expected 1 to be 0).
Once the deadline's own timer has classified a timeout, report zero
remaining time. A deterministic regression test fires the timer with the
monotonic clock 0.4 ms short of the deadline.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(comparison): recheck historical calls-only changes (#2223)
* fix(comparison): preserve incomplete function call evidence
Keep missing, unknown, partial and unresolved call relationships unknown in function comparisons and reconstruction claims. Aggregate IDA caller and callee coverage without overwriting uncertainty.
Validate with 144 focused tests, typecheck/lint, docs checks and test discovery. Real providers were not verified; the full headless IDA session suite requires unavailable Windows native controls.
* fix(comparison): recheck historical calls-only changes
---------
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
(cherry picked from commit 688defca0f)
* fix(ci): isolate Linux Hopper process fixture inventory
(cherry picked from commit 8cac51e12184d56a9ba80a4427b3e6082ddac1ec)
* fix(android): make DEX descriptor pattern portable
(cherry picked from commit 1335bcddc569a1cfb34b6efedcb6f2e3aaaa3357)
* fix: repair the static-check failures on the default branch (#2895)
* fix: repair the static-check failures on the default branch
The default branch fails its own required `Static checks` job three ways, so
every pull request reports that job as failed regardless of its own change.
- `npm run format:check` reports `src/domain/functionComparison.test.ts` and
`src/ida/IdaOperationRunner.ts`.
- `npm run lint` reports a duplicate `import { join } from "node:path"` in
`tests/boundary/mcp/ghidraInventoryMcp.test.ts` (lines 4 and 17).
- `npm run typecheck` reports `format: "devin"` missing from the client format
union in `src/application/SupportedClients.ts`, and an unchecked index in
`tests/boundary/cli/clientProfileLifecycle.test.ts`, whose pair array is
inferred as `string[][]`.
Apply the pinned formatter, drop the duplicate import, list the `"devin"` format
that its own definition already uses, and mark the pair array `as const`.
Validation: `npm run check:fast` and `npm run format:check` pass.
* fix(setup): keep Devin on the JSON configuration dialect
---------
Co-authored-by: 吴佳浩 <wujiahao@supremind.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
(cherry picked from commit df3d96da80)
---------
Co-authored-by: morluto <morluto@users.noreply.github.com>
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
Co-authored-by: Lucien <164857476+dakjdakd@users.noreply.github.com>
Co-authored-by: 吴佳浩Alben <35291372+XiaoBinGan@users.noreply.github.com>
Co-authored-by: 吴佳浩 <wujiahao@supremind.com>
Co-authored-by: OpenAI Codex <codex@openai.com>
* fix(process): keep provider deadlines independent of wall-clock changes
* fix(process): retain monotonic targets after early timers
Adapt the stronger timer/poll owner from @nosmile99 PR #2793 as integrated by 21aa877e5 and captured main 94072364c7. Retain all contributor reliability coverage. Tests and workloads skipped by explicit request.
---------
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
* fix(dotnet): name the truncated instruction when an operand leaves the method body
The extent guard ran after the operand read, so a truncated operand threw a raw Buffer RangeError that replaced the intended diagnostic with the runtime message and lost the instruction identity.
Bound the operand extent before reading its value and carry the width beside each fixed reader so the two facts cannot drift.
Fixes#2677
* test(dotnet): consolidate truncated operand coverage
---------
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
perf(javascript): avoid quadratic temporary matching state
Repeated source groups can allocate candidates that later identity matches
discard. Retain the original ambiguous groups until all tiers finish, expand
only unmatched survivors, and append to locally owned key buckets in place.
Constraint: Preserve matching priority, full ambiguity, and public output.
Directive: Do not re-match residual groups that become unique after later tiers.
Tested: 59 relevant tests, npm run check, and test discovery on current main.
Tested: CLI benchmarks and full-suite failure comparison on the recorded base.
Not-tested: Full suite on the updated main; native Linux and Windows workflows.
* feat(native): read embedded cargo-auditable Rust dependency lists
* fix(native): trim PE section padding and compute dependency cycles iteratively
* fix(native): ignore SHT_NOBITS sections and validate dependency edges linearly
* fix(native): bound compiler path scanning and retained hashes
* fix(rust): pass package arrays as named parameterized test cases
* fix(rust): admit graph expansion and preserve resource units
* fix(rust): reject malformed packages, false cycles, and hidden compiler paths
Fail the first malformed cargo-auditable package before Zod collects an
issue per field. Require cyclic dependency indices to match the cycles in
package dependencies. Keep read-only ELF ranges when a section name does
not fit the bounded name window, so a rustc path in that range is still
reported.
* fix(ci): repair integrated checks and Hopper test baseline
* fix(go): verify Mach-O sections against segments
---------
Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* fix(javascript-semantics): keep emitted data out of dispatch listener fields
The EventEmitter operation collector read argument position 1 as the
listener for every event method, so a dispatch such as
bus.emit("ready", data) reported the data binding and its range as the
listener. Only registration and removal name a listener there; emit
passes its remaining arguments to listeners that already exist. Read the
listener argument only for register and remove operations.
Fixes#2574
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(javascript-semantics): read listener arguments only for listener-taking methods
removeAllListeners accepts only an optional event name, so gating the
listener argument on operation kind still reported an ignored second
argument as a listener. Gate on the methods whose argument position 1
names a listener instead: the registration methods, off, and
removeListener.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
* fix(ci): skip portable report merge when shards are skipped
The portable consumer can still run after an upstream build failure, even though the test-shard matrix is skipped and no Vitest blob artifacts exist. Guard artifact download and both report merge variants on successful shards; retain the required-shard gate so skipped or failed shards remain failures.
This applies the report-consumer condition from ee0256c740c9be18baae6c56d90285df8069f5b4 to current pinned main without changing action pins or required gates.
* fix(ci): preserve failed shard diagnostics
* docs: clarify current revision CI policy
morluto
Bruno Costa Candia
Jeremy Levartovsky
morconsultoriadigital-afk
Ysopwnable
BeqaKs
wseelly
Pirro Zani
Quentin Limo
Nianze Wu
xin zhuang
Akash-M-D
Aurantium
CindyGest
LouisChen
yashas s
gongfpp
Devulapalli Naga Sri Vaishnavi
CodeAlex
Aaditya
Dragolone
xingzhou
Nelglor
Thang Luu
Tufail Akram
Rohit Ghumare
Jose Camargo
Yunzhou Li
Shenrui Ma
Matt Van Horn
chAngE
saurabh sharma
Liu Jie