75f50d86f6
refactor: add incremental capability migration safeguards ( #819 )
2026-10-07 10:56:06 +08:00
6caa38a0ca
fix(javascript): keep mutated object initializer values unknown ( #752 )
...
* fix(javascript): keep mutated object initializer values unknown
Signed-off-by: Rudy Celekli <rudy@gradiahq.com>
* fix(javascript): retain copied slots while following nested mutations
Signed-off-by: Rudy Celekli <rudy@gradiahq.com>
* fix(javascript): retain facts for unchanged object properties
Signed-off-by: Rudy Celekli <rudy@gradiahq.com>
* docs(javascript): state untracked mutation channels
Signed-off-by: Rudy Celekli <rudy@gradiahq.com>
---------
Signed-off-by: Rudy Celekli <rudy@gradiahq.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
2026-10-07 10:51:44 +08:00
0374865836
fix(cli): honor the selected native plist path ( #773 )
...
* fix(cli): honor the selected native plist path
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
* ci: run native plist selection regressions on macOS
Signed-off-by: RudyCelekli <47457359+rudycelekli@users.noreply.github.com>
---------
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
Signed-off-by: RudyCelekli <47457359+rudycelekli@users.noreply.github.com>
2026-10-07 10:51:33 +08:00
e9fac56232
fix(cli): align structured output guard with native flags ( #777 )
...
Signed-off-by: RudyCelekli <47457359+rudycelekli@users.noreply.github.com>
2026-10-07 10:51:21 +08:00
5a0e0ba3b8
fix: address review nits from batch integration follow-ups ( #818 )
...
- browser: reject empty Referrer-Policy tokens structurally while
still skipping them per W3 fallback semantics.
- browser: document that WebMCP keys cannot collapse since unknown
frames are excluded before keying.
- ghidra: split NativeAOT non-recovery diagnostics into
reason-missing vs payload-present variants with exact assertions.
- reference: lock secret-patterned exclusion before failure
projection so failure messages cannot carry secret paths.
- doctor: lock direct-launcher Codex timeout ordering both ways.
- native: note plutil -n macOS 12+ requirement; add fat-output
control guarding the thin pre-scan.
- reconstruction: multi-unknown limitation coverage via shared helper.
Tracks #817 for the remaining smol-toml advisory.
2026-10-07 10:49:23 +08:00
3af3811ab0
fix: integrate 24 reviewed browser/native/semantics corrections ( #815 )
...
* fix(reference): resolve emitted extensions to TypeScript source
Signed-off-by: Rudy Celekli <rudy@gradiahq.com>
* test(reference): retain legitimate declaration import counterparts
Signed-off-by: Rudy Celekli <rudy@gradiahq.com>
* fix(mcp): recognize implicit form elicitation capability
Signed-off-by: RudyCelekli <47457359+rudycelekli@users.noreply.github.com>
* fix(ghidra): reject contradictory NativeAOT reports
* fix(native): preserve thin architectures across echoed filename lines
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
* fix(native): preserve app bundle executable filename whitespace
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
* fix(doctor): validate Node-wrapped client policy
Signed-off-by: RudyCelekli <47457359+rudycelekli@users.noreply.github.com>
* fix(reference): preserve observed entry failure reasons
Signed-off-by: Rudy Celekli <rudy@gradiahq.com>
* fix(artifacts): verify opaque bytes before reusing inventory identities
Signed-off-by: Rudy Celekli <rudy@gradiahq.com>
* fix(browser): resolve DOM destinations against document base URL
Signed-off-by: Rudy Celekli <rudy@gradiahq.com>
* fix: recover serialized native NIB view hierarchy
Signed-off-by: RudyCelekli <47457359+rudycelekli@users.noreply.github.com>
* ci: exercise native compiled NIB hierarchy regressions
Signed-off-by: RudyCelekli <47457359+rudycelekli@users.noreply.github.com>
* fix(deps): remediate reachable archive-parsing advisories
Two high-severity advisories are reachable from untrusted target content:
- @xmldom/xmldom 0.9.10 (via plist) parses XML plist bytes from analyzed
app bundles in the keyed-archive reader. Refreshed to 0.9.12.
- brace-expansion 5.0.7 (via @electron/asar -> minimatch) is reached while
analyzing untrusted ASAR archives. Refreshed to 5.0.12.
Both are in-range patch updates (plist declares ^0.9.10, minimatch declares
^5.0.5), so no source or API change is required and no direct dependency
declaration moves. Lockfile-only change.
The remaining smol-toml advisory is not included: it parses operator-owned
client configuration rather than untrusted target content, and its fix moves
outside the declared range and changes leading-BOM handling.
* fix(semantics): link wrapped arrow Promise returns
* fix(reconstruction): preserve unknown graph limitations
* fix(native): preserve exact code signing identifiers
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
* fix(native): recognize only whole otool command headers
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
* fix(native): retain nm-proven literal export names
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
* fix(javascript): project decoded file URL paths
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
* fix: preserve explicit source-relative URL observation spelling
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
* fix(native): project Mach-O evidence into container file offsets
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
* fix(browser): normalize referrer policy fallback lists
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
---------
Signed-off-by: Rudy Celekli <rudy@gradiahq.com>
Signed-off-by: RudyCelekli <47457359+rudycelekli@users.noreply.github.com>
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
Co-authored-by: Rudy Celekli <rudy@gradiahq.com>
Co-authored-by: RudyCelekli <47457359+rudycelekli@users.noreply.github.com>
Co-authored-by: Kaoru0822 <aisakamimaki@gmail.com>
Co-authored-by: DeryFerd <deryferdikao125@gmail.com>
2026-10-07 10:33:10 +08:00
2572e1eb2f
fix(javascript): project decoded file URL paths ( #810 )
...
* fix(javascript): project decoded file URL paths
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
* fix: preserve explicit source-relative URL observation spelling
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
---------
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
2026-10-07 10:28:48 +08:00
24a0bf9a61
fix(semantics): recognize Node builtin default namespaces ( #769 )
...
* fix(semantics): recognize Node builtin default namespaces
Signed-off-by: Rudy Celekli <rudy@gradiahq.com>
* style(semantics): keep Babel imports before local helpers
Signed-off-by: Rudy Celekli <rudy@gradiahq.com>
---------
Signed-off-by: Rudy Celekli <rudy@gradiahq.com>
2026-10-07 10:25:59 +08:00
630bdafcac
fix(semantics): preserve empty string property keys ( #764 )
...
Signed-off-by: Rudy Celekli <rudy@gradiahq.com>
2026-10-07 10:23:43 +08:00
dd3640548f
fix(browser): preserve Link header value delimiters ( #805 )
...
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
2026-10-07 10:22:32 +08:00
e84ad86a75
fix(browser): identify NodeNext TypeScript original source artifacts ( #811 )
...
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
2026-10-07 10:20:51 +08:00
b3b44d8a2d
fix(browser): distinguish WebMCP registration frame owners ( #813 )
...
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
2026-10-07 10:19:49 +08:00
02beb74535
fix(browser): distinguish computed call keys from identifiers ( #808 )
...
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
2026-10-07 10:19:44 +08:00
21a8bd0ccd
fix: capture IndexedDB object-store record fingerprints ( #809 )
...
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
2026-10-07 10:18:03 +08:00
78014e3d14
fix(browser): fingerprint cookies at the selected page URL ( #763 )
...
Signed-off-by: Rudy Celekli <rudy@gradiahq.com>
2026-10-07 10:11:57 +08:00
472b72a530
feat(web): export captured scripts for JavaScript application analysis ( #801 )
...
* feat(web): export captured scripts for JavaScript application analysis
Add capture adapters, conservative source path projection, verified exclusive publication and a shared CLI/MCP workflow. Retain source identities, missing content and competing URL versions in a complete manifest for existing static analysis.
Refs: #774
Closes : #799
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
* test(web): include script export in independent effect audit
Register the new contract family in the independent inventory audit and verify the filesystem, session, network and idempotence metadata of the named export contract.
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
* fix(web): preserve capture limitation values in export manifests
Align the export boundary with passive capture’s string contract instead of rejecting an admitted empty limitation. Cover the publisher boundary and regenerate canonical schemas and identities.
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
2026-10-07 05:24:32 +08:00
894c30ef02
fix(ghidra): select exact packaged bridge scripts ( #800 )
2026-10-07 04:54:52 +08:00
f9eaf056ef
feat(browser): capture correlated network content and lifecycle evidence ( #797 )
...
* feat(browser): capture correlated network content and lifecycle evidence
Keep request identities and redirect relationships across ordered scenario events.
Capture selected browser-exposed bytes and duplicate headers through modular
readers, settle bounded reads before cleanup, and preserve unavailable states.
Keep content-selection mismatches and legacy network coverage unknown during
comparison. Verify real CLI/MCP, installed package, and browser lifecycle paths.
Refs #774
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
* fix(browser): align capture defaults and redact encoded media metadata
Correct the complete documented request and legacy default expectation caught by CI. Cover and redact encoded declared values in captured body media types.
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
* test(browser): verify polling capture cutoff completeness
Accept incomplete event coverage only when the continuously polling fixture has explicit unfinished requests; retain failures for other missing or truncated sections. Include actual completeness and unfinished transactions in diagnostics.
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
2026-10-07 04:35:49 +08:00
50787b2faf
fix(process): clarify Windows capture support and recovery ( #798 )
2026-10-07 04:20:53 +08:00
911d580634
fix(cli): preserve unsupported historical-source imports ( #795 )
2026-10-07 04:02:10 +08:00
b62931f833
fix(windows): accept ordinary drive path separators ( #791 )
2026-10-07 03:51:59 +08:00
d2aed172ab
docs: fix stale IDA roadmap item, mermaid paths, toolchain wording
2026-10-07 02:49:43 +08:00
00a6ac3de9
docs: audit and improve localized readmes translations and wording
2026-10-07 02:42:32 +08:00
4bfd8038be
fix(semantics): retain trailing rest argument flows ( #756 )
...
Signed-off-by: Rudy Celekli <rudy@gradiahq.com>
2026-10-07 02:36:51 +08:00
e1ca412757
fix(semantics): preserve direct promise ownership boundaries ( #758 )
...
Signed-off-by: Rudy Celekli <rudy@gradiahq.com>
2026-10-07 02:36:41 +08:00
66c26f280b
fix(mcp): preserve exact guided prompt context ( #761 )
...
Signed-off-by: RudyCelekli <47457359+rudycelekli@users.noreply.github.com>
2026-10-07 02:36:31 +08:00
cffc548cd3
fix(reference): retain partial imports for unreadable directories ( #766 )
...
Signed-off-by: Rudy Celekli <rudy@gradiahq.com>
2026-10-07 02:36:21 +08:00
ae81f64d2a
fix(semantics): isolate named function expression bindings ( #776 )
...
Squash-merge: reviewed, no issues. Clean semantics fix with thorough binding-matrix coverage.
2026-10-07 02:36:06 +08:00
c945931961
docs: clarify NativeAOT scope and regenerate conformance ledger
...
Documents NativeAOT as a native-analysis route with format/architecture limits, keeps the skill DOS-guide link inside the installed bundle convention, and regenerates the managed conformance manifest.
2026-10-07 02:34:44 +08:00
69be514c67
docs: update release boundary to npm 4.1.0 with Windows native bundle
2026-10-07 02:32:55 +08:00
554e9b1612
docs: move quick start up and mark skill install optional
2026-10-07 02:08:21 +08:00
9622b4b4cf
chore(main): release rea-agents 4.1.0 ( #635 )
...
* chore(main): release rea-agents 4.1.0
* chore: normalize release product catalog
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-10-07 01:57:26 +08:00
8238232485
feat(ida): add read-only GUI and headless MCP providers ( #754 )
2026-10-07 01:47:05 +08:00
c8e66c704a
fix(artifacts): make extraction output tree work on Windows ( #753 )
...
SafeOutputTree.create() called fchmod(0o700) on a directory handle and
commit() fsynced a directory handle. Both are POSIX-only: Windows rejects
them with EPERM ("operation not permitted, fchmod"/"fsync"), so every
extract_artifact call failed with a generic io error and produced no output.
Skip the redundant directory chmod and directory fsync on Windows. mkdir
already applies the requested mode, and file contents are synced in write().
Add a Windows regression test and run it, plus the archive-safety test, in
the curated Windows CI lane so the behavior is covered.
2026-10-07 01:46:52 +08:00
91daaa68ae
docs(browser): add an interaction example that captures the visible result ( #750 )
...
* docs(browser): add an interaction example that captures the visible result
Fixes #728
Co-authored-by: Cursor <cursoragent@cursor.com>
* docs(browser): wait for asynchronous search results before capture
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: N0zoM1z0 <1705004398@qq.com>
2026-10-07 01:24:22 +08:00
9a4e6da5a9
fix(firmware): validate configured executables ( #751 )
2026-10-07 01:03:55 +08:00
fb679b63c2
feat(ghidra): integrate optional NativeAOT metadata recovery ( #748 )
...
* feat(ghidra): integrate optional NativeAOT metadata recovery
* fix(ghidra): bind extension snapshots to configured artifacts
* test(ghidra): verify lazy NativeAOT startup failures
* fix(ghidra): preserve NativeAOT failure reasons and coverage
* fix(ghidra): preserve NativeAOT x64 calling conventions
* test(ghidra): guard recovered NativeAOT method conventions
* fix(ghidra): reject blocking extension file inputs
* fix(ghidra): diagnose incompatible NativeAOT extension classes
* test(ghidra): verify real extension initialization failures
* fix(ghidra): keep extension descriptor fields optional
2026-10-07 00:57:08 +08:00
6d1f39b250
Merge pull request #749 from kaoru0822-kitauji/fix/javascript-schema-diagnostics
...
fix(javascript): expose result schema failures
2026-10-06 09:01:33 -07:00
99263a720d
fix(javascript): expose result schema failures
2026-10-06 08:52:29 -07:00
5af1699103
docs: clarify onboarding and align provider guidance ( #745 )
2026-10-06 22:57:36 +08:00
d3f498ceec
docs(hopper): document HopperTargetLease realpath fallback ( #711 )
...
* docs(hopper): document HopperTargetLease realpath fallback
Closes #642
* docs(hopper): clarify realpath fallback errors
---------
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
2026-10-06 22:27:57 +08:00
1d15bcb9ec
fix(browser): classify CSP host sources by their own origin ( #707 )
...
* fix(browser): classify CSP host sources by their own origin
A Content-Security-Policy host-source without a scheme (for example
`cdn.example.com` or `*.trusted.test`) was resolved with
`new URL(token, baseUrl)`, so it became a page-relative path and was
reported as the observed page's own origin. Third-party script, style, and
connect sources were therefore misreported as approved origins, and a bare
`*` wildcard collapsed to the page origin as well.
Resolve host-sources per CSP3 \u00a72.3.1: a scheme-less source inherits the
protected resource's scheme, wildcard host/port sources stay classified as a
set of origins, and non-host tokens remain `other`. Keyword and scheme
sources are unchanged.
Adds boundary coverage for scheme-less host sources, wildcards, and scheme
inheritance against the approved-origin set.
* fix(browser): validate CSP host source syntax
---------
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
2026-10-06 22:26:57 +08:00
739039092f
fix(android): validate explicit Java runtime ( #742 )
2026-10-06 22:25:54 +08:00
3f6d6dc756
docs: update Trendshift repository badge
2026-10-06 22:18:21 +08:00
5a7c769692
feat(firmware): integrate Binwalk and Unblob analysis
...
* feat(firmware): integrate Binwalk and Unblob analysis
* fix(firmware): verify published files and namespace source references
* test(firmware): isolate extractor dependency failure from process cleanup
* fix(firmware): retain actionable report and cleanup diagnostics
* test: assert retained batch output failure diagnostics
2026-10-06 14:16:04 +00:00
8d7071da4c
Merge pull request #739 from kaoru0822-kitauji/fix/hopper-shutdown-request-diagnostics
...
fix(hopper): retain shutdown request diagnostics
2026-10-06 06:19:07 -07:00
72548712fe
fix(hopper): retain shutdown request diagnostics
2026-10-06 05:49:26 -07:00
904d03e987
feat(android): integrate static APK analysis with headless JADX ( #738 )
...
* feat(android): integrate static APK analysis with headless JADX
* test(android): include APK tools in explicit effects audit
2026-10-06 12:46:48 +00:00
d0f3480a3c
feat(evidence): accept exact retained application references ( #734 )
2026-10-06 20:17:59 +08:00
00eb03d0f2
Merge pull request #735 from kaoru0822-kitauji/fix/reference-import-cli-failure-status
...
fix(cli): report reference-source import failures
2026-10-06 05:09:11 -07:00
N0zoM1z0
Rudy Mizrahi Celekli
morluto
github-actions[bot]
Dery Ferdika
Tufail Akram
Kaoru0822
Vinay Prasad