Commit Graph

414 Commits

Author SHA1 Message Date
易良 aa23ec883f
feat(clients): register Qwen Code during setup (#1415)
* feat(clients): register Qwen Code during setup

* fix(clients): honor Qwen home and shared skill discovery

---------

Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
2026-10-10 15:12:09 +08:00
morluto 696fb834b8 fix(skills): expose authored skill to repository discovery 2026-10-10 14:20:22 +08:00
morluto 7633dd8d5d fix(ghidra): publish Windows verification success after cleanup 2026-10-10 13:43:01 +08:00
morluto 941dc425ca chore: merge main into Windows DLL support branch 2026-10-10 13:42:54 +08:00
Ysopwnable ce16f7bc95
test(native): verify macOS provenance through real CLI and MCP
Verify five native operations through the public CLI and real SDK stdio MCP using a source-built macOS fixture. Retain normalized provenance, response parity and unchanged input bytes.

Refs #1430, #1065, #723.
2026-10-10 13:05:12 +08:00
Kaoru0822 ca3131b36c
perf(cli): write compact JSON when output is not a terminal (#1413)
`--json` / `--format json` always indented its streamed result. Agents and
scripts read REA through pipes and redirects, where indentation carries no
information: on real application results it added 16-45% model tokens
(o200k proxy) and 25-73% bytes. The skill's CLI fallback uses `--json`.

Indent only when stdout is a TTY, as `gh --json` does; piped or redirected
JSON is compact. The JSON value, `jsonl`, `--filter-output`,
`--full-output` and the token-window paths are unchanged. `jq .` restores
indentation for files.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-09 20:29:48 -07:00
Kaoru0822 7623e21ff0
perf(native): record pwntools diagnostics once in their Evidence (#1404)
inspect_binary_layout and inspect_recorded_crash passed the decoded report
as both result and rawResult, so every Evidence record carried the whole
report twice (and an MCP response four times, counting its text copy).
The decoded report is the only representation, so raw_result is now null,
as for other single-representation operations.

The real pwntools verifiers asserted the duplicate; they now assert null.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-09 20:00:11 -07:00
BaaRai 73a664bc78
fix(ghidra): verify dense jump tables on an optimized fixture (#1374)
The dense jump-table oracles (inspect-native-api CLI and the
analyze_function dossier) ran against the -O0 debug fixture, which
assumes the host compiler lowers dense switches to tables at -O0. GCC 16
and later expand them as compare chains instead, so on those hosts the
lane rejected a correct provider and Ghidra build with empty
jump_tables.

Build the same inventory source once more at -O2 as a dedicated
jump-table variant, run both strict dense oracles there, and keep the
debug dossier at its complete generic shape. The dedicated switch lane
already compiles at -O2 for the same reason.
2026-10-10 06:58:29 +08:00
morluto ecc67cab2d ci: enforce architecture guards with portable checkout paths 2026-10-10 06:20:28 +08:00
morluto 4951a897c5 fix(browser)!: preserve payload shapes and WebMCP declarations
Retain primitive and nested array types with typed paths, and compare only mutually observed body shapes while preserving selected coverage uncertainty. Return full untrusted WebMCP input declarations with canonical digests, without resolving references or invoking tools.

BREAKING CHANGE: JSON shape paths now contain typed property and array-element segments. WebMCP input_schema_shape is replaced by input_schema and input_schema_sha256, retaining declared examples and defaults.
2026-10-10 06:20:28 +08:00
BaaRai bf934d5592
fix(hopper): probe interior navigation from multi-byte instructions (#1285)
The real-Hopper navigation probe derived its interior coordinate as
anchor + 1, which assumes the fixture procedure's first instruction is
longer than one byte. Host toolchains without endbr64-style prologue
padding (Kali gcc 16, or any build with -fcf-protection=none) compile
rea_entry to start with the one-byte push rbp, so anchor + 1 is itself
an instruction boundary: goto_address correctly observes that boundary
and the boundary-contract run rejects a correct bridge.

Advance the probe to the first instruction followed by a coordinate gap
larger than one byte and derive the interior-coordinate assertions from
that instruction, so the probed coordinate is never an analyzed-object
boundary on either prologue encoding.
2026-10-10 06:07:01 +08:00
morluto 392f1f3107 refactor: consolidate boundary semantics and prune redundant tests
Share parser modes and collision-free composite keys, enforce architecture guards, and consolidate redundant unit assertions into filesystem, CLI, MCP, and producer-backed workflows. Preserve concurrent upstream boundary fixes and exclude legacy Objective-C class-name bookkeeping labels.

Validation: source/composition suites (3358 passing), focused canonical digest and MCP checks, typecheck/lint, Knip, formatting, architecture guards, and real Foundation archive and Apple legacy simulator CLI/MCP verification. No real Hopper, Ghidra, or IDA verification claim.
2026-10-10 05:56:01 +08:00
yi111 f39e71ce18
fix(skill): pin packaged commands to the shipping package version (#1346)
Fixes #1338.

Use canonical product identity for bundled command versions and keep build-cache fixtures aligned. Verified 10 focused tests, actual CLI installation/repair/uninstall scenarios and all 19 final-head CI checks.

Co-authored-by: Yi-111-a <97448247+Yi-111-a@users.noreply.github.com>
2026-10-10 04:47:10 +08:00
morluto 048b79878c test(native): retain trace diagnostics when observed hits differ 2026-10-10 04:39:17 +08:00
morluto 66a20a2597 test(managed): include shared dossier fixture in artifact inputs 2026-10-10 04:09:45 +08:00
morluto ca9010936a test(package): share validated native dossier fixtures 2026-10-10 04:02:40 +08:00
morluto a4ba8aecd5 fix(contracts)!: require observed provider output metadata
Reject omitted segment bounds, procedure classification and body facts, unresolved-call observations, dossier facets, and Ghidra parameter flow metadata. Providers emit explicit nulls for unsupported facets. Verify those unknowns in the real Hopper workflow.

BREAKING CHANGE: Provider analysis outputs must explicitly supply metadata previously repaired with defaults; unsupported nullable facets must be reported as null.
2026-10-10 03:52:13 +08:00
Yi-111-a 2793672ee2 fix(skill): pin packaged commands to the shipping package version
The generated skill rewrote `rea-agents@latest` to the version it ships with, so a pinned install no longer needs a local edit that `doctor --skill` reports as stale.

Co-Authored-By: OpenCode <opencode@opencode.ai>
2026-10-10 02:49:46 +08:00
Lucien f6cfbfcc55
fix(browser): release attached viewport overrides without resizing the external page
Co-authored-by: dakjdakd <164857476+dakjdakd@users.noreply.github.com>
2026-10-10 02:33:56 +08:00
morluto cfce91d418 fix(browser): serialize attached scenarios through cleanup settlement 2026-10-10 01:45:01 +08:00
dakjdakd a0523b375e fix(browser): retain attached scenario emulation until cleanup 2026-10-10 01:45:00 +08:00
morluto 8c96baab80 refactor(catalog): import CLI metadata from its owner 2026-10-10 00:49:14 +08:00
morluto f3c4a332f7 fix(targets): cancel resolution before provider admission 2026-10-10 00:35:17 +08:00
morluto b112d44a39 fix(native)!: preserve unknown Objective-C metadata
BREAKING CHANGE: Objective-C attribute tokens now contain only name and value. Properties report nullable atomicity and readonly facts; class flags, ivar counts, and method requirement flags are nullable when unobserved.
2026-10-10 00:35:16 +08:00
Kaoru0822 8b4c359135
feat(setup): register OMP during setup (#1301)
* feat(setup): register OMP during setup

Add OMP (oh-my-pi) as a setup, doctor and uninstall client. Setup writes
a type: stdio entry to the user-level agent mcp.json that OMP reads,
following PI_CONFIG_DIR, an absolute PI_CODING_AGENT_DIR and the
OMP_PROFILE/PI_PROFILE named profile. It removes rea from OMP's
disabledServers denylist, which would otherwise hide the registration,
and doctor reports a listed registration as stale.

Closes #1257

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(setup): honor OMP's enabledServers allowlist in doctor

OMP's user enabledServers allowlist forces an entry with enabled: false
on, unless disabledServers also lists it. Doctor reported such a working
registration as stale. Also format the FAQ client list.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(setup): keep OMP's allowlisted entry in update maintenance

rea update skipped an owned OMP entry with enabled: false even when
OMP's enabledServers allowlist runs it. Apply the same forced-enable rule
as doctor. Share the client-location environment reset across the client
tests instead of repeating it in each file.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-09 08:51:12 -07:00
morluto 765e809e36 refactor: use canonical implementations and types directly
Remove forwarding wrappers and shadow aliases, migrate callers and verification scripts to their owners, and share one exhaustive semantic resource-bound projection.
2026-10-09 23:35:19 +08:00
Ysopwnable 4bb4c6fe6d
test(apple): verify compiled Mach-O root occurrence facts (#1300)
test(artifacts): verify compiled Mach-O roles and permissions

Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
2026-10-09 15:24:53 +00:00
kvalls be6863e9a1 feat(ghidra): support native PE DLLs on Windows 2026-10-09 16:11:13 +01:00
Kaoru0822 c3fc6c3aed
Merge pull request #1297 from morluto/fix/ghidra-session-root-stability
fix(ghidra): use dot-free private session paths
2026-10-09 07:59:06 -07:00
morluto ad59531a96 refactor: remove forwarding exports and redundant aliases 2026-10-09 22:46:09 +08:00
morluto 614e0c2e74 fix(browser): retain scenario observations across failures 2026-10-09 22:46:08 +08:00
N0zoM1z0 1c3766a8bc test(ghidra): preserve selected verification resource limits 2026-10-09 14:37:06 +00:00
N0zoM1z0 43405f9ffe Merge remote-tracking branch 'origin/main' into feat/website-seo-metadata 2026-10-09 22:33:04 +08:00
Kaoru0822 fe34ec2ef3
Merge pull request #1288 from morluto/fix/mcp-error-text-budget
fix(mcp): measure tool errors against their text-only delivery
2026-10-09 07:30:48 -07:00
N0zoM1z0 1e341973cf test(ghidra): size oversized annotations for canonical delivery 2026-10-09 14:21:38 +00:00
N0zoM1z0 8c9c5550d0 Merge remote-tracking branch 'origin/main' into feat/website-seo-metadata 2026-10-09 22:19:04 +08:00
Kaoru0822 59fbaa2d33 fix(ghidra): stop dereferencing the removed error payload in address verification
Since #1277 an MCP tool error carries no structuredContent, so the real
Ghidra address-boundary verifier threw a TypeError on its first expected
rejection and never checked the remaining representations or the
alias-preservation control. Assert that the error carries no structured
payload instead.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-09 14:04:35 +00:00
Kaoru0822 7b51121f7c fix(mcp): measure tool errors against their text-only delivery
Since #1277 an error result reaches the client without structuredContent,
but toErrorToolResult and the transport recovery still budgeted it as
structured JSON plus escaped text. An error whose text fit between about
half and all of the response budget was replaced by resource_constraint,
and without Evidence retention the original diagnostic was lost.

Count only the escaped text for errors. The boundary, process-global and
real Ghidra large-result probes now use diagnostics that exceed the
text-only budget.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-09 14:03:12 +00:00
Ysopwnable 7e96f25f8b
fix(mcp): deliver typed errors without invalid structured output (#1277)
* fix(mcp): deliver tool errors within advertised schema contracts

Retain complete typed JSON error content while omitting non-conforming
structured errors at the public transport boundary. Recover oversized
diagnostics into Evidence before removing their private structured carrier.
Update schema-validated client readers and cover actual stdio delivery.

Closes #1261

Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)

* test(mcp): read typed errors in canonical Evidence regressions

* test(mcp): validate public error diagnostics in acceptance workflows
2026-10-09 13:54:32 +00:00
N0zoM1z0 b8851cb977 feat(website): add search metadata and automatic sitemap
Prefer rea.tools in page canonicals and search listings. Generate the sitemap from current HTML indexing directives and render a shared PNG preview from SVG before verification and manual deployment.

Refs #1283
2026-10-09 21:46:05 +08:00
N0zoM1z0 5486860673 Merge remote-tracking branch 'origin/main' into fix/mcp-error-schema-delivery 2026-10-09 13:06:26 +00:00
morluto af7a439633 fix(windows): retain runtime authority after cleanup failure 2026-10-09 21:01:53 +08:00
N0zoM1z0 7bf63ed7f8 chore: integrate canonical Evidence changes for MCP error delivery 2026-10-09 12:43:17 +00:00
Ysopwnable 636b245f1b
fix(android): support owned JADX stdio on Windows (#1276)
Support owned JADX stdio on Windows x64, preserve protocol input errors through cancellation, and verify native stdin and Android CLI/MCP lifecycle on the real Windows host.

Closes #1262
2026-10-09 20:34:42 +08:00
N0zoM1z0 da606ff777 fix(mcp): deliver tool errors within advertised schema contracts
Retain complete typed JSON error content while omitting non-conforming
structured errors at the public transport boundary. Recover oversized
diagnostics into Evidence before removing their private structured carrier.
Update schema-validated client readers and cover actual stdio delivery.

Closes #1261

Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
2026-10-09 12:26:27 +00:00
morluto 63bf91405c refactor!: enforce canonical evidence and provider boundaries
Deliver complete Evidence directly through MCP with required nullable analysis profiles and immutable per-server delivery settings. Bind selected environments at construction and require typed cleanup outcomes with retained retry ownership.

Remove test-only routing, duplicate session and snapshot metadata, producer-field repairs, and ambiguous provider arguments. Separate artifact byte identity from occurrence classification and retain typed source-map and partial native facts across CLI, MCP, and verifier consumers.

BREAKING CHANGE: obsolete Evidence envelopes, session aliases, incomplete snapshots, and missing normalized producer facts are no longer accepted.
2026-10-09 20:18:52 +08:00
morluto abc4f47683 build: separate runtime artifacts and supervise command ownership 2026-10-09 20:11:17 +08:00
N0zoM1z0 8342e3a78f chore: merge current main into batch identity fix 2026-10-09 19:13:13 +08:00
N0zoM1z0 bfaa5a6c2c fix(native): distinguish batch selectors from resolved entries 2026-10-09 19:09:30 +08:00
N0zoM1z0 bcc8a773e2 fix(ghidra): preserve decoded return flow evidence 2026-10-09 18:53:28 +08:00