7af7bc88ce
feat(evm): inspect offline bytecode interfaces through EVMole ( #1051 )
...
* feat(evm): inspect offline bytecode interfaces through evmole
* fix(evm): distinguish unsupported bytecode targets
* style(evm): format verifier string-prefix checks
2026-10-08 15:32:05 +08:00
4fc6565b0f
feat(native): inspect offline ELF layout through pwntools ( #1037 )
...
* feat(native): inspect offline ELF layout through pwntools
* fix(build): prepare offline ELF verification on clean runners
* fix(native): preserve snapshot acquisition cancellation
* fix(native): handle sectionless ELF and retain decoder diagnostics
* test(native): verify malformed symbol table entry sizes
* fix(native): respect inherited limits and unused segment fields
* fix(native): preserve packed relocations and decoder launch constraints
* fix(native): validate symbol spans and preserve resource failures
* fix(native): preserve diagnostic completeness and memory failures
* fix(native): guard bridge imports against allocation failures
* fix(native): validate relocation symbol and section references
* fix(native): retain diagnostics through compounded cleanup failures
* fix(native): preserve unresolved relocation section references
* fix(native): bound linkage evidence and preserve CPU signal diagnostics
* fix(native): preserve file-size resource failure evidence
* fix(native): retain opaque linkage names and late cancellation output
* test(native): make CPU-limit fixture robust across runners
* fix(native): verify resource failure branches before interpreting exits
* fix(native): validate declared ELF string references
* fix(native): validate section-name table before decoding
* fix(native): enforce canonical ELF name-table escapes
2026-10-08 14:22:08 +08:00
2bf3663f65
feat(browser): inspect historical web network captures ( #992 )
...
* feat(browser): inspect retained HAR and mitmproxy capture evidence
Add independent offline format adapters, inline CLI/MCP evidence, bounded
owned decoder processes, and real producer verification.
Refs #882
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
* fix(browser): preserve capture boundaries during cancellation and decoding
Honor cancellation during owned-command cleanup, retain opaque HAR
extension content, and clean verifier resources on every failure path.
Refs #882
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
* fix(browser): exclude sensitive capture fields across representations
Normalize known native transport URLs for both bytes and strings, including backups. Exclude explicitly sensitive text fields with null so redaction markers cannot reintroduce declared literals. Cover both provider identities in catalog conformance.
Refs #882
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
* fix(browser): exclude sensitive capture identities and bound diagnostics
* fix(browser): validate excluded HAR subtrees before projection
* fix(browser): distinguish capture input limits from decoder failures
* fix(browser): preserve decoder failure categories
* fix(browser): validate excluded native credential values
* test(browser): report capture verifier assertions directly
* fix(browser): classify native representation failures precisely
* fix(browser): exclude URL userinfo after header whitespace
* fix(browser): preserve capture evidence and failure boundaries
* fix(browser): exclude sensitive literals from capture limitations
* test(browser): check limitation values without JSON syntax
* fix(browser): preserve acquisition integrity and exclude selection diagnostics
* fix(browser): preserve capture acquisition and declaration boundaries
* fix(mcp): project sensitive capture argument validation
* fix: preserve capture bytes and prelaunch cancellation
* fix(browser): exclude sensitive HAR record ancestry
* fix(browser): preserve transport URL and parameter exclusions
* fix(browser): preserve numeric redaction and canonical capture provenance
* fix(browser): cover derived capture values and ownership preparation deadlines
* fix(browser): exclude explicitly sensitive artifact digests
* chore: regenerate generated metadata
* fix(browser): reject lossy HAR member normalization
* test(browser): assert the advertised unsupported-profile outcome
* fix(browser): preserve JSON visitor nesting failure locations
* fix(browser): exclude explicitly sensitive native source ranges
---------
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-10-08 07:53:41 +08:00
6aa9afb549
refactor(process): separate capture implementation from analyst workflows ( #988 )
...
* refactor(process): separate capture implementation from analyst workflows
* fix(ci): generate source catalog before shard tests
2026-10-08 00:46:21 +08:00
ea4db4c9f7
refactor(native): group analyst semantics workflows and contracts ( #973 )
2026-10-07 22:40:48 +08:00
b5afa5f91e
feat(browser): attribute native execution and listener sources ( #917 )
...
* feat(browser): attribute native execution and listener sources
Integrate finite native precise-coverage windows and direct DOM listener inspection through shared CLI/MCP workflows, exact session script identities, inline source evidence and owned instrumentation cleanup.
Refs #881 , #774
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
* fix(browser): preserve runtime identity and settle fixture cleanup
Retain complete reported initiator objects, reject changing loader availability, propagate the selected operation through main-frame authorization and complete effect/help inventories. Close only the synthetic owned Chrome via its native endpoint, await process-group settlement and preserve primary verification errors during cleanup.
Refs #881
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
* fix(browser): settle invalid events and preserve document evidence
Accept same-document URL changes with proven stable loader identity, retain metadata without inventing ownership, terminate malformed event collection immediately, and sanitize known transport URLs without erasing sourceURL declarations.
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
* fix(browser): end detached target windows and sanitize coverage identities
Reuse the existing flat-session event matcher, retain prearming termination, and apply the source identity policy to coverage URLs. Add real MCP target-close verification and producer regressions for detachment orderings.
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
* fix(browser): retain final sample metadata and settle fatal protocol failures
Keep source inventory open through the resetting sample, propagate fatal wire failures without outstanding commands, and check listener collection failures after final document validation.
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
* fix(browser): require default execution worlds for website attribution
Preserve native context and world metadata without treating same-frame isolated or unknown contexts as website sources. Verify actual Chrome isolated function execution before excluding its coverage, and cover ambiguous world metadata with producer regressions.
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
* fix(browser): revalidate runtime source joins and selector failures
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
---------
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
2026-10-07 21:45:07 +08:00
28713f9b4d
refactor(managed): group capability workflows and verification ( #926 )
2026-10-07 19:22:04 +08:00
f6a58f1062
refactor(javascript): group domain semantics and contracts ( #907 )
2026-10-07 17:16:58 +08:00
b808e2d6bb
refactor(provider): declare deep capabilities from source ( #892 )
2026-10-07 15:41:50 +08:00
507e8b3c7b
refactor(firmware): group layered source and verification ( #878 )
2026-10-07 14:44:52 +08:00
8e8921d40c
refactor(android): group layered source and verification ( #873 )
2026-10-07 14:09:57 +08:00
021ba690b0
refactor: give Inspector its own capability directory ( #869 )
2026-10-07 13:53:25 +08:00
166dcd21d0
feat(javascript): recover readable modules with Wakaru ( #848 )
...
* feat(javascript): recover readable modules with Wakaru
Integrate pinned upstream source behind a typed optional recovery port,
preserve source identity and producer provenance, and publish verified
artifacts for existing JavaScript analysis through CLI and MCP.
Add focused real-tool CI with genuine bundler fixtures and bounded
resource, cancellation, cleanup, schema and packaged-artifact checks.
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
* fix(javascript): align recovery catalog and browser verification
Share canonical Wakaru provider identity, describe CLI mode options, and
format the new workflow test. Disconnect the real page transport after
its observation readiness progress instead of a fixed delay.
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
* refactor(javascript): consume the investigation evidence writer
Verify that the SDK recovery handler records complete Evidence through the newly shared investigation owner.
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
* chore(test): account for isolated recovery fixture compilers
* fix(javascript): validate recovery paths before acquiring the engine
Return field-specific invalid_format diagnostics for relative paths and verify compiled CLI/MCP parity even when the optional engine is unavailable.
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
2026-10-07 12:46:13 +08:00
4a6c17ce83
refactor: declare auxiliary capabilities from source ( #853 )
2026-10-07 12:32:34 +08:00
472b72a530
feat(web): export captured scripts for JavaScript application analysis ( #801 )
...
* feat(web): export captured scripts for JavaScript application analysis
Add capture adapters, conservative source path projection, verified exclusive publication and a shared CLI/MCP workflow. Retain source identities, missing content and competing URL versions in a complete manifest for existing static analysis.
Refs: #774
Closes : #799
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
* test(web): include script export in independent effect audit
Register the new contract family in the independent inventory audit and verify the filesystem, session, network and idempotence metadata of the named export contract.
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
* fix(web): preserve capture limitation values in export manifests
Align the export boundary with passive capture’s string contract instead of rejecting an admitted empty limitation. Cover the publisher boundary and regenerate canonical schemas and identities.
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
2026-10-07 05:24:32 +08:00
8238232485
feat(ida): add read-only GUI and headless MCP providers ( #754 )
2026-10-07 01:47:05 +08:00
5a7c769692
feat(firmware): integrate Binwalk and Unblob analysis
...
* feat(firmware): integrate Binwalk and Unblob analysis
* fix(firmware): verify published files and namespace source references
* test(firmware): isolate extractor dependency failure from process cleanup
* fix(firmware): retain actionable report and cleanup diagnostics
* test: assert retained batch output failure diagnostics
2026-10-06 14:16:04 +00:00
904d03e987
feat(android): integrate static APK analysis with headless JADX ( #738 )
...
* feat(android): integrate static APK analysis with headless JADX
* test(android): include APK tools in explicit effects audit
2026-10-06 12:46:48 +00:00
5295d56b10
refactor(contracts): split tool contracts by family ( #634 )
...
Move official, enhanced, and session contract arrays with their
builders into officialToolContracts, enhancedToolContracts, and
sessionToolContracts. toolContracts keeps the ordered assembly and
resolver. Migrate all importers including catalog scripts. No
re-export shims; generated catalog output is unchanged.
2026-10-06 05:20:11 +08:00
81996df7a5
refactor: remove cross-version investigation workflow
2026-09-29 08:06:43 +08:00
8f229ede70
feat(electron): add autonomous Electron runtime analysis ( #464 )
...
* feat: add autonomous Electron runtime analysis
* feat(electron): add lifecycle and boundary telemetry
* feat(electron): capture runtime boundary evidence
* fix(electron): package boundary hook helper
* feat(electron): report active capture coverage
* fix(electron): account for bring-your-own runtime
* feat(electron): expand agent-owned runtime scenarios
* fix(ghidra): keep fixture credentials out of argv
* perf(test): serialize local test and docs workloads
* fix(electron): harden active runtime capture
* fix(inspector): require exact runtime target authorization
* fix(docs): make managed manifest host independent
* fix(ci): make generated catalog portable
* fix: unblock autonomous command and electron flows
* fix(electron): close popup and detached helper gaps
2026-08-05 19:07:46 +08:00
c4cd0330e0
fix(catalog): digest provider projections
2026-07-26 16:07:12 +00:00
035e1144b0
feat(server): advertise available tools dynamically
2026-07-24 13:18:58 +00:00
508a9ccde9
feat(javascript): expose bounded semantic tracing
2026-07-22 23:22:55 +00:00
f5b3e22e72
feat(evidence): generate verifier completion ledgers
2026-07-22 13:59:19 +00:00
1a99a60a29
refactor(adapters): split oversized provider workflows
2026-07-18 05:49:14 +00:00
Ysopwnable
morluto