4951a897c5
fix(browser)!: preserve payload shapes and WebMCP declarations
...
Retain primitive and nested array types with typed paths, and compare only mutually observed body shapes while preserving selected coverage uncertainty. Return full untrusted WebMCP input declarations with canonical digests, without resolving references or invoking tools.
BREAKING CHANGE: JSON shape paths now contain typed property and array-element segments. WebMCP input_schema_shape is replaced by input_schema and input_schema_sha256, retaining declared examples and defaults.
2026-10-10 06:20:28 +08:00
96af2fa744
fix(browser): preserve captures when response bodies are unavailable
2026-10-09 07:47:34 +08:00
0a0174b9ac
fix(browser): validate and bound source-map evidence
2026-10-09 06:32:10 +08:00
6dd719eaf6
fix(browser): preserve form destinations and satisfies mutation uncertainty ( #825 )
...
Resolve empty form destinations from the captured document URL while preserving
base-relative links and Chrome's form/control whitespace distinction. Follow
satisfies wrappers when propagating explicit member mutation paths.
Add fail-before regressions and real-browser CLI/MCP verification.
Fixes #820
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
2026-10-07 11:22:03 +08:00
3af3811ab0
fix: integrate 24 reviewed browser/native/semantics corrections ( #815 )
...
* fix(reference): resolve emitted extensions to TypeScript source
Signed-off-by: Rudy Celekli <rudy@gradiahq.com>
* test(reference): retain legitimate declaration import counterparts
Signed-off-by: Rudy Celekli <rudy@gradiahq.com>
* fix(mcp): recognize implicit form elicitation capability
Signed-off-by: RudyCelekli <47457359+rudycelekli@users.noreply.github.com>
* fix(ghidra): reject contradictory NativeAOT reports
* fix(native): preserve thin architectures across echoed filename lines
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
* fix(native): preserve app bundle executable filename whitespace
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
* fix(doctor): validate Node-wrapped client policy
Signed-off-by: RudyCelekli <47457359+rudycelekli@users.noreply.github.com>
* fix(reference): preserve observed entry failure reasons
Signed-off-by: Rudy Celekli <rudy@gradiahq.com>
* fix(artifacts): verify opaque bytes before reusing inventory identities
Signed-off-by: Rudy Celekli <rudy@gradiahq.com>
* fix(browser): resolve DOM destinations against document base URL
Signed-off-by: Rudy Celekli <rudy@gradiahq.com>
* fix: recover serialized native NIB view hierarchy
Signed-off-by: RudyCelekli <47457359+rudycelekli@users.noreply.github.com>
* ci: exercise native compiled NIB hierarchy regressions
Signed-off-by: RudyCelekli <47457359+rudycelekli@users.noreply.github.com>
* fix(deps): remediate reachable archive-parsing advisories
Two high-severity advisories are reachable from untrusted target content:
- @xmldom/xmldom 0.9.10 (via plist) parses XML plist bytes from analyzed
app bundles in the keyed-archive reader. Refreshed to 0.9.12.
- brace-expansion 5.0.7 (via @electron/asar -> minimatch) is reached while
analyzing untrusted ASAR archives. Refreshed to 5.0.12.
Both are in-range patch updates (plist declares ^0.9.10, minimatch declares
^5.0.5), so no source or API change is required and no direct dependency
declaration moves. Lockfile-only change.
The remaining smol-toml advisory is not included: it parses operator-owned
client configuration rather than untrusted target content, and its fix moves
outside the declared range and changes leading-BOM handling.
* fix(semantics): link wrapped arrow Promise returns
* fix(reconstruction): preserve unknown graph limitations
* fix(native): preserve exact code signing identifiers
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
* fix(native): recognize only whole otool command headers
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
* fix(native): retain nm-proven literal export names
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
* fix(javascript): project decoded file URL paths
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
* fix: preserve explicit source-relative URL observation spelling
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
* fix(native): project Mach-O evidence into container file offsets
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
* fix(browser): normalize referrer policy fallback lists
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
---------
Signed-off-by: Rudy Celekli <rudy@gradiahq.com>
Signed-off-by: RudyCelekli <47457359+rudycelekli@users.noreply.github.com>
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
Co-authored-by: Rudy Celekli <rudy@gradiahq.com>
Co-authored-by: RudyCelekli <47457359+rudycelekli@users.noreply.github.com>
Co-authored-by: Kaoru0822 <aisakamimaki@gmail.com>
Co-authored-by: DeryFerd <deryferdikao125@gmail.com>
2026-10-07 10:33:10 +08:00
78014e3d14
fix(browser): fingerprint cookies at the selected page URL ( #763 )
...
Signed-off-by: Rudy Celekli <rudy@gradiahq.com>
2026-10-07 10:11:57 +08:00
b5e98915c6
fix(tools)!: simplify direct invocation and harden boundary contracts ( #555 )
...
Remove REA permission grants, scope ceilings, approval confirmations, and inert settings. Preserve selected local evidence, accept caller-chosen commands and paths, and report actual runtime failures.
Harden provider results, schema serialization, snapshot evidence binding, archive paths, source maps, native screenshots, managed EH parsing, and cancellation cleanup. Regenerate tool metadata and document direct invocation.
BREAKING CHANGE: Removed permission configuration and policy commands, approval fields, filesystem scope inputs, and fixed confirmation options. Process capture inherits the host environment and accepts command names; callers must refresh tool schemas and migrate removed fields.
2026-10-05 20:16:44 +08:00
1ac3118aa2
feat(browser): capture controlled Playwright scenarios
2026-07-24 13:16:01 +00:00
1a99a60a29
refactor(adapters): split oversized provider workflows
2026-07-18 05:49:14 +00:00
morluto
N0zoM1z0
Rudy Mizrahi Celekli