4aa51bfe19
fix(reverse): reconcile cleanup ownership and mutation diagnostics ( #2799 )
...
* feat(process): add owned debugger shutdown lifecycle
* feat(reverse): add local inspection commands
* feat(gdb): add persistent debugger integration
* feat(cutter): add Cutter bridge integration
* test(reverse): enforce complete integration coverage
* fix(process): preserve debugger shutdown ownership
* fix(reverse): retain evidence across interrupted commands
* fix(gdb): honor captured provider environment
* test(process): cover debugger shutdown retries
* fix(reverse): retain evidence for interrupted providers
* test(process): cover debugger shutdown retries
* fix(reverse): retain evidence for interrupted providers
* fix(server): snapshot provider environment at creation
* fix(reverse): close review gaps with complete coverage
* fix(reverse): address inspection review findings
* fix(gdb): bound sessions and retain cleanup ownership
* fix(ci): require reverse-tools quality lane
* fix(process): unref inherited debugger output pipes
* fix(reverse): address remaining PR 1960 findings
* fix(gdb): address remaining PR 1961 findings
* fix(reverse): account for unrestricted provider execution
* fix(process): retain debugger ownership until safe shutdown
* fix(process): preserve replacement debugger sessions
* fix(reverse): preserve admission and output provenance
* fix(process): retain exited debugger until output settles
* fix(mcp): bound provider admission and debugger cleanup
* fix(reverse): preserve failure provenance and classify E2BIG
* fix(gdb): preserve startup cleanup and detach safety
* fix(process): retain debugger ownership after detach failure
* fix(reverse): preserve mutation and failure provenance
* fix(gdb): address debugger review findings
* fix(reverse): rebind sessions after external mutation
* fix(process): cap debugger output after exit
* fix(gdb): protect one-shot detach verification
* feat(debugger): add reverse tool coverage gate
* test(debugger): cover integrated failure paths
* fix(gdb): bound and preserve session observations
* fix(gdb): address review regressions
* style: format merged integration files
* fix(reverse): preserve session and output evidence
* refactor(gdb): share repeated test and partial result setup
* fix(gdb): invalidate TTY proof for Python aliases
* fix(reverse): retain failure output byte counts
* test(process): synchronize late debugger output
* fix(gdb): invalidate TTY proof for wrapped commands
* fix(gdb): recognize wit command abbreviation
* test(reverse): wait for cancelled descendant readiness
* test(reverse): bound descendant cancellation cleanup
* style(reverse): format integration tests and adapters
* style: format reverse engineering integration files
* test(reverse): remove duplicate environment harness
* test(gdb): share session startup assertions
* fix(gdb): invalidate output proof for command abbreviations
* test(reverse): share composition edge case scenarios
* fix(ci): recognize verification and mutation tool entries
* test(rizin): cover successful fake inferior detach
* test(cli): align full output failure envelope
* test(cli): isolate reverse command lifecycle service
* test(process): share debugger output fixture setup
* fix(binary): preserve high-bit Windows signature bytes
* style(binary): format Windows signature parser
* test(mcp): preserve call coverage in unchanged comparison
* fix(ci): include reverse tools Vitest configs in lint cache
* fix(mcp): preserve target content on delivery errors
* ci: align duplication ceiling with expanded suite
* test(reverse): allow signal admission mutants
* fix(reverse): bound retained cleanup failures to process owners
* fix(test): replace drifting mutation ranges with owned selectors
* fix(reverse): admit persistent commands and retain cleanup ownership
* fix(cutter): recover timed-out commands from exact receipts
* fix(cutter): reject unsupported bridge request kinds
* fix(ci): repair client format and shared verification fixtures
* fix(native): preserve debugger cleanup ownership and bridge authentication
* test(native): retain diagnostics without perfect coverage requirements
* chore(licenses): refresh locked dependency inventory and notices
* fix(test): exclude transient command locks from mutation sandboxes
* fix(gdb): admit only platforms with safe detach verification
* fix(cutter): retain bounded completion receipts until acknowledgement
* fix(cutter): acknowledge commands rejected before UI dispatch
* test(reverse): fail cancellation checks before fixture teardown
* test(gdb): clean up the retained broken-stdin fixture owner
* docs(test): clarify focused provider verification scope
* fix(rizin): retain close cleanup failures
* fix(gdb): wait for inferior stop and bound MI buffering
* fix(cutter): retain failed receipt acknowledgements
* fix(rizin): return retained session identity on rebind failure
* fix(gdb): preserve startup cancellation and lossy status
* fix(rizin): retain launch provenance and assemble frames once
* fix(cutter): recover receipts across callers and bound discovery
* docs: describe debugger evidence and bridge recovery
* fix(process): keep cleanup incomplete while writers remain
Stopping a debugger no longer reports success when inherited output
streams stay open, so BinarySession cannot reopen a binary a child is
still changing. Concurrent Cutter cleanup retries share one receipt
acknowledgement instead of treating a consumed receipt as failure.
* fix(debuggers): recover cleanup with captured process identities
* fix(analysis): retire sessions after unrestricted commands
* fix(cli): preserve completed evidence after cleanup recovery
* fix(cutter): bound frame collection and coalesce cleanup
* fix(windows): resolve selected provider paths absolutely
* fix(gdb): report decoding loss in failed startup evidence
* fix(rizin): scope decoding loss to collected command frames
* test(mcp): cover snapshot retirement in reverse tools CI
---------
Co-authored-by: Daniel Gonçalves Araujo <47118053+dandgabr@users.noreply.github.com>
Co-authored-by: REA Maintainers <noreply@github.com>
Co-authored-by: OpenAI Codex <codex@users.noreply.github.com>
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
2026-10-14 04:47:34 +08:00
4a4ae9b2b9
feat: add Frida instrumentation support ( #1359 )
...
* feat: add Frida instrumentation support
* fix: resolve Frida CI checks
* test: cover Frida contract validation branches
* docs: link Frida instrumentation guide
* fix(frida): handle cancellation cleanup safely
* fix(frida): address PR review findings
* fix(frida): preserve resume and message observations
* fix(ci): use canonical registry for rolldown
* fix(frida): declare foreign code effects
* fix(frida): retain failed startup resources for cleanup retries
Keep failed startup session and spawn handles owned until detach, resume,
and remote lease cleanup complete. Serialize retries and release each
remote reference once. Await CLI provider cleanup while preserving the
primary failure and any completed observations.
Add regressions for retained startup resources, concurrent cleanup,
shared remote leases, and CLI cleanup outcomes.
Validation: 41 focused tests pass on the PR head and its latest-main
integration; serial static and docs checks pass. Real Linux Frida 17.23.2
workflows and the native spawn/controlled-failure cleanup probe pass.
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
---------
Co-authored-by: N0zoM1z0 <1705004398@qq.com>
2026-10-12 22:01:58 +08:00
49e6f00ed0
fix(ghidra): recover returning import callers
2026-10-11 09:59:27 +08:00
204e2c42a1
fix(ci): register Termux browser verifier as Knip entry point
2026-10-11 08:13:41 +08:00
4999e4be2c
fix(javascript): isolate source analysis and retain bounded partial evidence ( #1651 )
...
* refactor(javascript): validate transferable file projections
* test(javascript): consume decoded module and static facts
* fix(javascript): isolate source analysis and retain bounded partial evidence
* test(javascript): verify cleanup retention and repeated source paths
2026-10-11 07:22:50 +08:00
b71a591a60
test: consolidate redundant assertions into boundary workflows
...
Remove getter, enum, cloned-projection, cache-identity, and obsolete profile assertions along with the shadow JSON Schema engine and dead test-only APIs. Retain producer, filesystem, SDK, lifecycle, integrity, and malformed-format coverage.
Document the priority of real end-to-end workflows, boundary integration, and producer goldens.
2026-10-09 20:26:46 +08:00
27a9ceade7
fix!: restore caching, preserve failures, and verify fixture claims ( #1211 )
...
Restore profile-bound Ghidra snapshot reuse, preserve direct-analysis results through cleanup failures, and grade configured agent fixture claims against returned evidence.
Register the compiled agent-evaluation fixture entry for static analysis.
Co-authored-by: YouWish <29498139+Y0UW1SH@users.noreply.github.com>
Co-authored-by: N0zoM1z0 <161784452+N0zoM1z0@users.noreply.github.com>
2026-10-09 14:49:09 +08:00
a0784c0d2c
test(process): retire native caches at worker teardown
2026-10-09 04:12:49 +08:00
2366bda37b
fix(artifacts): harden reader lifecycle boundaries ( #951 )
...
* fix(artifacts): retain ASAR filesystem failure reasons
* fix(artifacts): avoid blocking on replaced FIFO entries
* test(artifacts): type the ASAR reader iterator
* fix(artifacts): classify filesystem-shaped ASAR errors
* test: account for POSIX FIFO fixture utility
2026-10-07 20:00:24 +08:00
c78fe6990b
docs: publish VitePress documentation on GitHub Pages
2026-10-07 16:58:04 +08:00
166dcd21d0
feat(javascript): recover readable modules with Wakaru ( #848 )
...
* feat(javascript): recover readable modules with Wakaru
Integrate pinned upstream source behind a typed optional recovery port,
preserve source identity and producer provenance, and publish verified
artifacts for existing JavaScript analysis through CLI and MCP.
Add focused real-tool CI with genuine bundler fixtures and bounded
resource, cancellation, cleanup, schema and packaged-artifact checks.
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
* fix(javascript): align recovery catalog and browser verification
Share canonical Wakaru provider identity, describe CLI mode options, and
format the new workflow test. Disconnect the real page transport after
its observation readiness progress instead of a fixed delay.
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
* refactor(javascript): consume the investigation evidence writer
Verify that the SDK recovery handler records complete Evidence through the newly shared investigation owner.
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
* chore(test): account for isolated recovery fixture compilers
* fix(javascript): validate recovery paths before acquiring the engine
Return field-specific invalid_format diagnostics for relative paths and verify compiled CLI/MCP parity even when the optional engine is unavailable.
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
2026-10-07 12:46:13 +08:00
9b392bb2f8
chore(deps): finish toolchain upgrades and drop dead weight ( #644 )
...
* chore(deps): finish toolchain upgrades and drop dead weight
pino 9 to 10, @types/node 24 to 26, oxlint 1.73 to 1.87, knip 6.26
to 6.39, turbo 2.10 to 2.11. Narrow engines to supported majors
(22/24/26; vitest 5 refuses Node 25). Scope no-var-requires off for
Electron CJS hooks and fixtures.
Remove TypeDoc: incompatible with TypeScript 7 at install and
runtime, used by nothing in any gate. Drop the dep, docs:api
workflow, typedoc.json, CI artifact step, and related docs.
Replace graphology with a local call-graph adjacency plus BFS: the
only consumer is call-path search, and graphology-types ships no
types entry for TS7 NodeNext resolution. Delete both graphology
dependencies.
Remove dead re-exports newly flagged by knip 6.39.
* chore: drop stale typedoc and replay references
Remove the docs:api release-checklist step, the orphaned docs/api
ignore entry, and the nonexistent replay glob from the adapters
project.
2026-10-06 06:02:02 +08:00
55e5eb090b
test: extract shared fixtures, drop knip carve-outs ( #627 )
...
* refactor(domain): consolidate canonical ordering and digest helpers (#624 )
* refactor(domain): consolidate canonical ordering and digest helpers
Single owner for code-point ordering (domain/canonicalOrdering.ts)
and canonical JSON digests (domain/comparisonSemantics.ts). Delete
all local compareCodePoints/compareText/digestCanonical duplicates
and migrate every importer. No re-export shims.
* fix(ci): allow slower real browser startup
* chore(config): remove dead eslint, dedupe scripts, cacheable turbo tasks
Delete eslint.config.js (oxlint is the linter), drop lint:dead alias,
pin smol-toml, fold jscpd/scan:todos into check:pr, make test:run
cacheable, align oxlint ignores.
* fix(config): hash all test inputs for cached runs
* docs: fix architecture diagram and pretty-print tool catalog
Drop dangling REPLAY edges, add dotnet/reference/error/evaluation
nodes. Emit 2-space JSON from the catalog generator and regenerate.
* test: extract shared fixtures, drop knip carve-outs
Dedupe android/apple session tests, bundler adapter headers, and
reconstruction helpers into tests/support fixtures. Delete unused
type aliases and the knip ignoreIssues block. Lower jscpd threshold
2.7 to 2.5.
2026-10-06 05:00:16 +08:00
82957c98bf
chore(test): separate development feedback from full verification ( #599 )
2026-10-06 00:59:26 +08:00
ed933d1893
feat(native): add investigation features ( #486 )
...
* feat(native): add UI and dispatch investigation workflows
* feat(ghidra): support macOS host validation
* docs: update native investigation capabilities
* feat(artifacts): decode compiled Interface Builder archives
* feat(ghidra): expose bounded p-code value flow
* test(ghidra): split host and cross-format verification
* fix(verify): follow complete result contracts
* refactor: remove unused authorization and schema helpers
* refactor: remove unused evidence result alias
* fix(ghidra): report jump-table evidence precisely
* fix(verify): align browser scenario fixture schema
* fix(setup): compare parsed client config structurally
* test(ghidra): verify AArch64 jump-table mappings
* fix(ghidra): recover AArch64 byte jump tables
* test(artifacts): verify compiled interface builder archives
* feat(native): trace UI actions through handlers
* fix(tests): update native trace and shutdown fixtures
* fix(verification): diagnose browser scenario failures
* fix(browser): wrap scenario snapshots in capture state
* fix(native): bind and bound investigation workflows
* fix(artifacts): preserve bounded interface builder evidence
* fix(ghidra): enforce admitted hosts and preflight tools
* fix(native): preserve trace cancellation and bounds
* test(application): expect bound analysis target evidence
* fix(native): preserve investigation bounds and cancellation
* fix(application): preserve bundle and unresolved trace evidence
* style(test): format artifact subject fixture
2026-09-30 00:41:05 +08:00
d4dc940bd8
refactor(test): keep coverage at behavioral boundaries ( #474 )
...
* refactor(test): keep coverage at behavioral boundaries
* fix(ci): restore package workflow temp-root classification
2026-08-11 18:34:32 +08:00
8f229ede70
feat(electron): add autonomous Electron runtime analysis ( #464 )
...
* feat: add autonomous Electron runtime analysis
* feat(electron): add lifecycle and boundary telemetry
* feat(electron): capture runtime boundary evidence
* fix(electron): package boundary hook helper
* feat(electron): report active capture coverage
* fix(electron): account for bring-your-own runtime
* feat(electron): expand agent-owned runtime scenarios
* fix(ghidra): keep fixture credentials out of argv
* perf(test): serialize local test and docs workloads
* fix(electron): harden active runtime capture
* fix(inspector): require exact runtime target authorization
* fix(docs): make managed manifest host independent
* fix(ci): make generated catalog portable
* fix: unblock autonomous command and electron flows
* fix(electron): close popup and detached helper gaps
2026-08-05 19:07:46 +08:00
97f6a0f3fd
fix(ci): allow documented public type aliases
2026-07-30 04:30:10 +00:00
99609823ef
fix(knip): ignore ps binary and in-file schema exports
2026-07-22 16:31:02 +00:00
5a7ccefc68
fix: preserve setup diagnostics and clean Knip config
2026-07-14 19:27:31 +08:00
8f035abb3a
Enforce local and CI quality gates
2026-07-12 10:57:48 +08:00
4dec415fc8
Remove dead exports found by knip
...
- Un-export HOMEBREW_COMMANDS, systemSetupHost, ToolKind, BinaryArchitecture,
HopperDiagnostic -- only consumed within their own files
- Remove unused HopperUnavailableError class (never instantiated)
- Reformat knip.json entry/project arrays to multi-line
2026-07-12 10:20:45 +08:00
8a62075a8e
Replace ESLint with oxlint and add code quality tooling
...
- Replace ESLint/typescript-eslint with oxlint (faster, zero-config TypeScript linting)
- Add oxlint config with complexity thresholds, max-lines, and TypeScript rules
- Add jscpd for duplicate code detection
- Add knip for dead code and unused dependency detection
- Add scripts/scan-todos.mjs for tech debt marker scanning
- Add Husky pre-commit hook running oxlint on staged files
- Fix unnecessary array spreads flagged by oxlint
2026-07-12 10:14:37 +08:00
morluto
Daniel Gonçalves Araujo
You Wish
Ysopwnable
N0zoM1z0