Matt Van Horn 0e6eca4085 feat(native): read embedded cargo-auditable Rust dependency lists (#2456) ... * feat(native): read embedded cargo-auditable Rust dependency lists * fix(native): trim PE section padding and compute dependency cycles iteratively * fix(native): ignore SHT_NOBITS sections and validate dependency edges linearly * fix(native): bound compiler path scanning and retained hashes * fix(rust): pass package arrays as named parameterized test cases * fix(rust): admit graph expansion and preserve resource units * fix(rust): reject malformed packages, false cycles, and hidden compiler paths Fail the first malformed cargo-auditable package before Zod collects an issue per field. Require cyclic dependency indices to match the cycles in package dependencies. Keep read-only ELF ranges when a section name does not fit the bounded name window, so a rustc path in that range is still reported. * fix(ci): repair integrated checks and Hopper test baseline * fix(go): verify Mach-O sections against segments --------- Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Co-authored-by: morluto <76467478+morluto@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com>		2026-10-14 02:50:30 +08:00
..
ci	docs: move translated READMEs under docs/readme (#2165)	2026-10-13 22:25:32 +08:00
fixtures	test(http3): add real MITM capture verification lab (#1997)	2026-10-14 01:09:19 +08:00
lib	feat(native): read embedded cargo-auditable Rust dependency lists (#2456)	2026-10-14 02:50:30 +08:00
verify	refactor(process): give the prlimit producer budget one owner (#2698)	2026-10-13 23:47:41 +08:00
audit-website-links.py	chore(website): simplify maintenance and detect documentation drift	2026-10-10 20:27:01 +08:00
build-conformance-fixtures.mjs	refactor(schema): remove data-only version markers	2026-09-29 08:45:36 +08:00
build-ghidra-nativeaot.mjs	fix(ghidra): isolate optional nativeaot script sources	2026-10-11 09:35:22 +08:00
build-windows-native.mjs	fix(windows): retain failed native inspection ownership (#1826)	2026-10-11 21:33:25 +08:00
bundle-runtime.d.mts	perf(cli): bundle runtime entries to reduce Windows startup I/O (#1996)	2026-10-12 09:25:27 +08:00
bundle-runtime.mjs	fix(cli): preserve failure semantics across full-output formats	2026-10-13 03:33:27 +08:00
check-dependency-install.mjs	fix(deps): run freshness check from escaped paths	2026-07-16 19:51:25 +08:00
check-doc-facts.mjs	build: add canonical product catalog and docs drift checks	2026-07-15 17:43:52 +08:00
clean-build-output.mjs	build: separate runtime artifacts and supervise command ownership	2026-10-09 20:11:17 +08:00
create-ghidra-windows-fixture.mjs	fix(native): preserve compact reference provenance (#1438)	2026-10-10 21:39:28 +08:00
electron-active-hook-boundaries.cjs	fix(capture): retain Electron observations and HAR resource failures	2026-10-09 06:49:02 +08:00
electron-active-hook.cjs	fix(capture): retain Electron observations and HAR resource failures	2026-10-09 06:49:02 +08:00
generate-completion-ledger.mjs	fix(build): make catalogs and packaged skills generated outputs (#1086)	2026-10-08 22:43:51 +08:00
generate-error-schema.mjs	chore: migrate formatting to Oxfmt (#615)	2026-10-06 01:59:19 +08:00
generate-mcp-tool-catalog.mjs	build: separate runtime artifacts and supervise command ownership	2026-10-09 20:11:17 +08:00
generate-nativeaot-fixtures.mjs	fix(ghidra): resolve file offsets in decompile (#2101)	2026-10-13 18:23:17 +08:00
generate-package-metadata.mjs	fix(skills): expose authored skill to repository discovery	2026-10-10 14:20:22 +08:00
generate-product-catalog.mjs	fix(build): make catalogs and packaged skills generated outputs (#1086)	2026-10-08 22:43:51 +08:00
generate-skill-metadata.mjs	fix(skills): expose authored skill to repository discovery	2026-10-10 14:20:22 +08:00
generate-third-party-inventory.mjs	fix: align MCP archive contracts and documentation (#2478)	2026-10-13 12:06:41 +08:00
hopper-demo-x11.py	fix(hopper): stop Linux demo children when the REA owner exits (#2499)	2026-10-13 12:59:22 +08:00
prepack.mjs	fix(cli): preserve failure semantics across full-output formats	2026-10-13 03:33:27 +08:00
prepare-website.py	feat(website): add multilingual editions and translation workflow	2026-10-11 17:24:46 +08:00
prepare.mjs	build: streamline local and CI validation	2026-07-22 16:06:28 +00:00
print-mcp-config.mjs	fix(npm): use latest entry points without install scripts	2026-07-17 00:16:46 +00:00
rea-android-workspace-guardian.mjs	fix(android): clean Windows workspaces after owner termination (#2440)	2026-10-13 22:03:16 +08:00
rea.mjs	fix(cli): normalize empty Windows profile before imports (#2482)	2026-10-13 12:43:52 +08:00
release-notes.mjs	fix(release): avoid duplicated contributor thanks	2026-10-11 11:49:49 +08:00
release-npm-tag.mjs	fix(release): publish prereleases under the next npm tag	2026-10-09 00:49:30 +08:00
run-development-tests.mjs	build: separate runtime artifacts and supervise command ownership	2026-10-09 20:11:17 +08:00
run-exclusive-command.mjs	fix(dev): preserve command arguments in exclusive runners	2026-10-13 04:12:45 +08:00
run-exclusive.mjs	build: separate runtime artifacts and supervise command ownership	2026-10-09 20:11:17 +08:00
scan-todos.mjs	chore(scripts): merge duplicate node:fs import in scan-todos (#1790)	2026-10-11 18:18:10 +08:00
test-website.py	docs: move translated READMEs under docs/readme (#2165)	2026-10-13 22:25:32 +08:00
verify-adb.mjs	feat(adb): complete ADB device support for Android reverse engineering (#1552)	2026-10-10 23:01:24 +08:00
verify-agent-experience.mjs	test(evaluation): grade managed agent fixture facts (#1924)	2026-10-13 23:34:17 +08:00
verify-apktool.mjs	fix(android): preserve decoded values and duplicate class inventories	2026-10-12 06:29:13 +08:00
verify-binary-layout.mjs	fix(native): clarify Mach-O offset origins and reject partial ELF tables	2026-10-12 06:29:19 +08:00
verify-browser-dom-destinations.mjs	fix(verify): report final success only after resource cleanup	2026-10-09 04:12:49 +08:00
verify-browser-modules.mjs	feat(browser): trace captured website module imports (#879)	2026-10-07 14:59:52 +08:00
verify-browser-network.mjs	feat(browser): capture correlated network content and lifecycle evidence (#797)	2026-10-07 04:35:49 +08:00
verify-browser-runtime.mjs	feat(browser): attribute native execution and listener sources (#917)	2026-10-07 21:45:07 +08:00
verify-browser-scripts.mjs	feat(web): export captured scripts for JavaScript application analysis (#801)	2026-10-07 05:24:32 +08:00
verify-browser-source-maps.mjs	fix(browser): compose nested source-map column offsets (#1109)	2026-10-09 02:01:29 +08:00
verify-claude-client.mjs	perf(mcp)!: compact repeated session discovery facts (#1988)	2026-10-12 07:40:19 +08:00
verify-commandcode-client.mjs	fix(clients): preserve portable MCP schemas in native workflows (#1580)	2026-10-11 00:09:43 +08:00
verify-conformance-fixtures.mjs	refactor(schema): remove data-only version markers	2026-09-29 08:45:36 +08:00
verify-copilot-client.mjs	fix(tests): separate Copilot model IDs from wire models (#1647)	2026-10-11 06:52:45 +08:00
verify-deepseek-client.mjs	feat(setup): register DeepSeek Harness through setup, doctor and uninstall (#1929)	2026-10-12 11:06:26 +08:00
verify-evm-interface.mjs	feat(evm): inspect lossless Solidity terminal CBOR metadata (#2790)	2026-10-13 21:55:30 +08:00
verify-flutter.mjs	fix(flutter): reject ambiguous ELF mappings and bound note reads (#2334)	2026-10-13 22:13:22 +08:00
verify-frida.mjs	feat: add Frida instrumentation support (#1359)	2026-10-12 22:01:58 +08:00
verify-gemini-client.mjs	test(clients): verify native Gemini CLI integration on Windows (#1936)	2026-10-12 10:50:11 +08:00
verify-go-binary.mjs	fix(go): accept file-backed unmapped Mach-O debug segments	2026-10-13 03:47:45 +08:00
verify-grok-client.mjs	test(clients): verify native Grok Build workflows (#1571)	2026-10-10 22:59:43 +08:00
verify-http3-network-captures.mjs	test(http3): add real MITM capture verification lab (#1997)	2026-10-14 01:09:19 +08:00
verify-jeb.mjs	feat(jeb): add JEB engine provider over its MCP interface (#1536)	2026-10-10 23:03:27 +08:00
verify-linux-setup-e2e.mjs	test(hopper): repair Linux demo setup and native verification (#2638)	2026-10-13 14:39:18 +08:00
verify-mcp-registry-metadata.mjs	feat(electron): add autonomous Electron runtime analysis (#464)	2026-08-05 19:07:46 +08:00
verify-module-boundaries.mjs	build: verify resolved module boundaries (#862)	2026-10-07 13:02:28 +08:00
verify-native-agent-client.mjs	fix(onboarding): isolate client homes and clarify npm release support (#1627)	2026-10-11 04:37:31 +08:00
verify-native-calls.mjs	test(native): retain trace diagnostics when observed hits differ	2026-10-10 04:39:17 +08:00
verify-native-ui.mjs	refactor!: enforce canonical evidence and provider boundaries	2026-10-09 20:18:52 +08:00
verify-omp-client.mjs	fix(setup): reject invalid OMP profiles before fallback writes (#1562)	2026-10-10 22:11:14 +08:00
verify-opencode-client.mjs	test(clients): verify native OpenCode integration (#1546)	2026-10-10 19:51:30 +08:00
verify-package-artifact.mjs	feat(native): add investigation features (#486)	2026-09-30 00:41:05 +08:00
verify-package-capabilities.mjs	perf(mcp)!: compact repeated session discovery facts (#1988)	2026-10-12 07:40:19 +08:00
verify-package-discovery.d.mts	fix(package): separate agent and Hopper setup support (#584)	2026-10-06 00:00:15 +08:00
verify-package-discovery.mjs	fix(package): separate agent and Hopper setup support (#584)	2026-10-06 00:00:15 +08:00
verify-package-environment.d.mts	fix(test): use direct Node launcher on macOS	2026-07-24 03:31:26 +00:00
verify-package-environment.mjs	fix(setup): resolve the configuration MSIX Claude Desktop reads (#2426)	2026-10-13 22:04:22 +08:00
verify-package-evidence.mjs	refactor(adapters): split oversized provider workflows	2026-07-18 05:49:14 +00:00
verify-package-install.mjs	feat: add Hermes as a supported MCP client (#1403)	2026-10-10 16:03:25 +08:00
verify-package-managed.mjs	test(managed): include shared dossier fixture in artifact inputs	2026-10-10 04:09:45 +08:00
verify-package-mcp.mjs	test(mcp): align completion checks with provider readiness	2026-10-12 18:44:02 +08:00
verify-package-pack.mjs	fix(skills): expose authored skill to repository discovery	2026-10-10 14:20:22 +08:00
verify-package-platform.d.mts	fix: consolidate boundary ownership and cleanup failure paths (#477)	2026-09-08 10:59:13 +08:00
verify-package-platform.mjs	refactor: return complete tool results inline	2026-09-29 07:08:46 +08:00
verify-package-prompts.mjs	test(mcp): align completion checks with provider readiness	2026-10-12 18:44:02 +08:00
verify-package-setup.mjs	fix(setup): preserve initial backups and Codex comments (#1204)	2026-10-09 12:57:00 +08:00
verify-package-unknown-provider.mjs	refactor(adapters): split oversized provider workflows	2026-07-18 05:49:14 +00:00
verify-package-update.mjs	fix(setup): resolve the configuration MSIX Claude Desktop reads (#2426)	2026-10-13 22:04:22 +08:00
verify-package.mjs	ci: separate fast feedback from full qualification	2026-10-13 17:09:53 +08:00
verify-packaged-ghidra-windows.mjs	perf(mcp)!: compact repeated session discovery facts (#1988)	2026-10-12 07:40:19 +08:00
verify-packaged-wasm-artifact.mjs	feat(wasm): inspect local artifacts with WABT (#1533)	2026-10-11 19:49:00 +08:00
verify-packed-bridge.mjs	perf(ghidra): compile bundle activator with bridge scripts (#1931)	2026-10-12 02:46:32 +08:00
verify-packet-capture.mjs	feat(captures): discover installed protocol and field definitions (#2496)	2026-10-13 15:55:25 +09:00
verify-pcap.mjs	feat(pcap): add bounded capture summaries through CLI and MCP	2026-10-13 04:53:03 +00:00
verify-published-package.mjs	fix(setup): resolve the configuration MSIX Claude Desktop reads (#2426)	2026-10-13 22:04:22 +08:00
verify-qlog-captures.mjs	feat(browser): inspect retained aioquic qlog JSON captures	2026-10-13 03:24:05 +00:00
verify-qwen-client.mjs	test(clients): verify Qwen Code on native Windows (#2103)	2026-10-13 21:27:45 +08:00
verify-real-browser.mjs	feat(browser): attach passive tools to browsers without HTTP discovery (#2346)	2026-10-14 00:36:37 +08:00
verify-real-electron.mjs	fix(electron): attribute unresolved paths to selected inputs	2026-10-13 04:12:40 +08:00
verify-real-ghidra-6502.mjs	feat(ghidra): support raw NMOS 6502 analysis (#2079)	2026-10-13 21:13:01 +08:00
verify-real-ghidra-address-context.mjs	fix(ghidra): resolve file offsets in decompile (#2101)	2026-10-13 18:23:17 +08:00
verify-real-ghidra-assertions.mjs	refactor: remove forwarding exports and redundant aliases	2026-10-09 22:46:09 +08:00
verify-real-ghidra-com.mjs	refactor: prune obsolete provider and verification code	2026-10-12 08:59:14 +08:00
verify-real-ghidra-dos.mjs	refactor!: enforce canonical evidence and provider boundaries	2026-10-09 20:18:52 +08:00
verify-real-ghidra-function.mjs	feat(ghidra): recover signed AArch64 relative jump tables (#1592)	2026-10-11 10:45:35 +08:00
verify-real-ghidra-inventory.mjs	feat(native): add investigation features (#486)	2026-09-30 00:41:05 +08:00
verify-real-ghidra-mips-relocatable.mjs	fix(scripts): pass MCP callTool timeouts as request options (#2387)	2026-10-13 09:16:41 +09:00
verify-real-ghidra-mips-shared.mjs	feat(ghidra): admit verified MIPS16 shared ELF images	2026-10-12 07:50:31 +08:00
verify-real-ghidra-mips.mjs	feat(ghidra): admit recordless legacy MIPS32 ELFs with a pinned 32-bit language (#1898)	2026-10-13 21:42:38 +08:00
verify-real-ghidra-nativeaot.mjs	refactor!: enforce canonical evidence and provider boundaries	2026-10-09 20:18:52 +08:00
verify-real-ghidra-noreturn.mjs	fix(ghidra): normalize Mach-O imported symbol names	2026-10-11 09:59:27 +08:00
verify-real-ghidra-raw.mjs	feat(native): search analyzed memory for masked byte patterns (#2341)	2026-10-13 23:41:45 +08:00
verify-real-ghidra-riscv.mjs	feat(ghidra): admit RISC-V ELF analysis through a pinned generic lane (#2151)	2026-10-13 00:11:35 +08:00
verify-real-ghidra-swift.mjs	feat(ghidra): decode Swift String literals in function dossiers (#2049)	2026-10-13 20:41:10 +08:00
verify-real-ghidra-switch-assertions.mjs	fix(ghidra): recover evidenced switch cases and default targets (#579)	2026-10-05 22:54:17 +08:00
verify-real-ghidra-switch-controls.mjs	chore: migrate formatting to Oxfmt (#615)	2026-10-06 01:59:19 +08:00
verify-real-ghidra-switch.mjs	refactor!: enforce canonical evidence and provider boundaries	2026-10-09 20:18:52 +08:00
verify-real-ghidra-windows.mjs	fix(ghidra): resolve file offsets in decompile (#2101)	2026-10-13 18:23:17 +08:00
verify-real-ghidra.mjs	feat(ghidra): recover signed AArch64 relative jump tables (#1592)	2026-10-11 10:45:35 +08:00
verify-real-hopper-deadlines.mjs	refactor: remove forwarding exports and redundant aliases	2026-10-09 22:46:09 +08:00
verify-real-hopper-fat.mjs	refactor: remove forwarding exports and redundant aliases	2026-10-09 22:46:09 +08:00
verify-real-hopper-linux.mjs	test(hopper): repair Linux demo setup and native verification (#2638)	2026-10-13 14:39:18 +08:00
verify-real-hopper.mjs	fix(hopper): stop Linux demo children when the REA owner exits (#2499)	2026-10-13 12:59:22 +08:00
verify-real-ida.mjs	feat(ida): resolve containing procedures and report the admitted program as the document (#2374)	2026-10-13 20:56:20 +08:00
verify-reconstruction-readiness.mjs	perf(domain): avoid duplicate readiness bundle validation	2026-10-11 13:29:11 +08:00
verify-recorded-crash.mjs	feat(native): inspect recorded crashes through pwntools and pwndbg (#1054)	2026-10-08 16:50:31 +08:00
verify-release-checkpoint.mjs	fix(release): validate frozen checkpoint versions and breaking notes	2026-10-08 10:13:05 +00:00
verify-repository-skill.mjs	fix(skills): expose authored skill to repository discovery	2026-10-10 14:20:22 +08:00
verify-signal-recording.mjs	feat(signals): discover installed decoders and option help (#2487)	2026-10-13 15:58:19 +09:00
verify-solidity-metadata.mjs	feat(evm): inspect lossless Solidity terminal CBOR metadata (#2790)	2026-10-13 21:55:30 +08:00
verify-test-discovery.mjs	fix(verify): report final success only after resource cleanup	2026-10-09 04:12:49 +08:00
verify-test-temp-hygiene.mjs	fix(verify): report final success only after resource cleanup	2026-10-09 04:12:49 +08:00
verify-wasm-artifact.mjs	feat(wasm): compare retained core-module interfaces (#2464)	2026-10-13 23:49:04 +08:00
verify-wasm-interface-comparison.mjs	feat(wasm): compare retained core-module interfaces (#2464)	2026-10-13 23:49:04 +08:00
verify-web-network-captures.mjs	feat(mcp): derive an API surface view from retained web network captures (#1891)	2026-10-12 10:44:17 +08:00
verify-website.py	feat(website): add multilingual editions and translation workflow	2026-10-11 17:24:46 +08:00
verify-windows-native-artifact.mjs	fix(formats): preserve high bits in remaining magic-byte checks (#2384)	2026-10-13 20:54:37 +08:00
verify-windows-native-inspection.mjs	fix(windows): retain failed native inspection ownership (#1826)	2026-10-11 21:33:25 +08:00
verify-windows-native.mjs	fix(native/windows): share FILE_SHARE_DELETE so owned objects can be marked delete-pending (#2445)	2026-10-13 22:16:05 +08:00
verify-windows-package.mjs	fix(setup): resolve the configuration MSIX Claude Desktop reads (#2426)	2026-10-13 22:04:22 +08:00
website.py	fix(website): keep omitted language selectors free of whitespace	2026-10-13 18:21:09 +08:00
website_i18n.py	docs: move translated READMEs under docs/readme (#2165)	2026-10-13 22:25:32 +08:00
windows-capabilities.mjs	feat(ghidra): define the Windows P0 admission boundary	2026-07-17 03:05:19 +09:00