Saim Shafique 40e18b2e37 fix(domain): preserve prototype-named JSON members through Evidence boundaries (#1049) ... * fix(domain): preserve prototype-named JSON members through Evidence boundaries Zod's z.json() record projection drops own __proto__ members as a prototype-pollution guard, so provider replies carrying them lost evidence before hashing/serialization and CLI/MCP output. The shared schema now validates with z.json() as before, then rebuilds the value keeping prototype-named own members as ordinary data properties (__proto__ via Object.defineProperty, so the prototype is never mutated). parseHarJson no longer rejects __proto__ members; the explicit unsupported case from #992 is replaced with a preservation regression, and the inspect_web_network_capture contract text is updated to match. Fixes #1036 * fix(domain): bound JSON depth and oversized payloads at parsing boundaries jsonValueSchema re-walked hostile input through z.json()'s recursive core, so a deeply nested payload from an MCP tool argument, inline evidence, provider result, or keyed archive threw RangeError: Maximum call stack size exceeded instead of a validation issue. The schema now runs an iterative depth guard first and keeps z.json() for full JSON semantics behind it, which also turns cyclic values into validation errors. The 1000-edge limit stays far below the range where the recursive core overflows its stack (measured between 2000 and 3000 on Node 24) while leaving room for legitimately deep target-derived trees such as compiled NIB view hierarchies, and the guard narrows with a typed record check instead of any or unchecked casts. The non-recursive JSON Schema advertisement stays intact on both the public and standard projection paths. Two payload sizes get explicit budgets tied to their producer constraints: web text artifacts reject beyond the 16 MiB source budget the web tooling already advertises, and native UI screenshot base64 beyond the 64 MiB helper output budget. Regenerated product catalog, skill catalog digest, and completion-ledger manifest follow the schema-boundary change. * fix(validation): preserve depth diagnostics across process inputs --------- Co-authored-by: DeryFerd <deryferdikao125@gmail.com> Co-authored-by: N0zoM1z0 <1705004398@qq.com>		2026-10-08 21:32:48 +08:00
..
fixtures	feat(native): inspect recorded crashes through pwntools and pwndbg (#1054)	2026-10-08 16:50:31 +08:00
lib	fix(release): recognize conventional titles in GitHub merge commits	2026-10-08 10:21:02 +00:00
verify	feat(native): inspect recorded crashes through pwntools and pwndbg (#1054)	2026-10-08 16:50:31 +08:00
build-conformance-fixtures.mjs	refactor(schema): remove data-only version markers	2026-09-29 08:45:36 +08:00
build-ghidra-nativeaot.mjs	fix(ghidra): admit the 12.1 line and the install's JDK range (#840)	2026-10-07 12:24:36 +08:00
build-windows-native.mjs	feat(ghidra): enable Windows x64 read-only analysis (#699)	2026-10-06 16:53:33 +08:00
check-dependency-install.mjs	fix(deps): run freshness check from escaped paths	2026-07-16 19:51:25 +08:00
check-doc-facts.mjs	build: add canonical product catalog and docs drift checks	2026-07-15 17:43:52 +08:00
clean-build-output.mjs	refactor(mcp): make analysis states unrepresentable (#468)	2026-08-10 02:28:11 +08:00
create-ghidra-windows-fixture.mjs	feat(ghidra): support native x86 PE applications on Windows (#1030)	2026-10-08 05:11:47 +08:00
electron-active-hook-boundaries.cjs	feat(electron): add autonomous Electron runtime analysis (#464)	2026-08-05 19:07:46 +08:00
electron-active-hook.cjs	refactor(browser): remove arbitrary capture ceilings	2026-09-29 15:31:27 +08:00
generate-completion-ledger.mjs	refactor(managed): group capability workflows and verification (#926)	2026-10-07 19:22:04 +08:00
generate-error-schema.mjs	chore: migrate formatting to Oxfmt (#615)	2026-10-06 01:59:19 +08:00
generate-mcp-tool-catalog.mjs	refactor(build): generate MCP tool catalog at build time instead of committing it (#997)	2026-10-08 00:16:34 +08:00
generate-nativeaot-fixtures.mjs	feat(ghidra): integrate optional NativeAOT metadata recovery (#748)	2026-10-07 00:57:08 +08:00
generate-package-metadata.mjs	build: streamline local and CI validation	2026-07-22 16:06:28 +00:00
generate-product-catalog.mjs	build: add canonical product catalog and docs drift checks	2026-07-15 17:43:52 +08:00
generate-skill-metadata.mjs	feat(skill): rename skill to reverse-engineer-anything	2026-07-17 00:35:19 +00:00
hopper-demo-x11.py	fix(linux): improve Hopper reliability and CachyOS support (#963)	2026-10-07 23:16:48 +08:00
prepack.mjs	build: streamline local and CI validation	2026-07-22 16:06:28 +00:00
prepare-website.py	docs(website): add Notion case study and improve onboarding	2026-10-07 20:59:56 +08:00
prepare.mjs	build: streamline local and CI validation	2026-07-22 16:06:28 +00:00
print-mcp-config.mjs	fix(npm): use latest entry points without install scripts	2026-07-17 00:16:46 +00:00
rea.mjs	fix(cli): stream large JavaScript JSON results (#1024)	2026-10-08 03:44:51 +08:00
run-development-tests.mjs	fix(test): improve capture reliability and runner cleanup (#609)	2026-10-06 01:32:46 +08:00
run-exclusive.mjs	fix(test): improve capture reliability and runner cleanup (#609)	2026-10-06 01:32:46 +08:00
scan-todos.mjs	build: shorten local validation loops	2026-07-23 03:42:41 +08:00
verify-agent-experience.mjs	refactor!: simplify runtime tools and remove replay engines (#572)	2026-10-05 21:15:04 +08:00
verify-binary-layout.mjs	feat(native): inspect recorded crashes through pwntools and pwndbg (#1054)	2026-10-08 16:50:31 +08:00
verify-browser-dom-destinations.mjs	fix(browser): preserve form destinations and satisfies mutation uncertainty (#825)	2026-10-07 11:22:03 +08:00
verify-browser-modules.mjs	feat(browser): trace captured website module imports (#879)	2026-10-07 14:59:52 +08:00
verify-browser-network.mjs	feat(browser): capture correlated network content and lifecycle evidence (#797)	2026-10-07 04:35:49 +08:00
verify-browser-runtime.mjs	feat(browser): attribute native execution and listener sources (#917)	2026-10-07 21:45:07 +08:00
verify-browser-scripts.mjs	feat(web): export captured scripts for JavaScript application analysis (#801)	2026-10-07 05:24:32 +08:00
verify-browser-source-maps.mjs	feat(browser): trace captured website source-map locations (#897)	2026-10-07 16:21:18 +08:00
verify-conformance-fixtures.mjs	refactor(schema): remove data-only version markers	2026-09-29 08:45:36 +08:00
verify-evm-interface.mjs	feat(evm): inspect offline bytecode interfaces through EVMole (#1051)	2026-10-08 15:32:05 +08:00
verify-linux-setup-e2e.mjs	feat(process): record provider and verifier run lineage	2026-07-22 14:01:47 +00:00
verify-mcp-registry-metadata.mjs	feat(electron): add autonomous Electron runtime analysis (#464)	2026-08-05 19:07:46 +08:00
verify-module-boundaries.mjs	build: verify resolved module boundaries (#862)	2026-10-07 13:02:28 +08:00
verify-native-calls.mjs	feat(native): observe function and Objective-C method calls under LLDB	2026-10-07 13:22:55 +00:00
verify-native-ui.mjs	fix(native)!: preserve incomplete native UI captures (#991)	2026-10-07 23:44:41 +08:00
verify-package-artifact.mjs	feat(native): add investigation features (#486)	2026-09-30 00:41:05 +08:00
verify-package-capabilities.mjs	feat(native): add investigation features (#486)	2026-09-30 00:41:05 +08:00
verify-package-discovery.d.mts	fix(package): separate agent and Hopper setup support (#584)	2026-10-06 00:00:15 +08:00
verify-package-discovery.mjs	fix(package): separate agent and Hopper setup support (#584)	2026-10-06 00:00:15 +08:00
verify-package-environment.d.mts	fix(test): use direct Node launcher on macOS	2026-07-24 03:31:26 +00:00
verify-package-environment.mjs	test(setup): isolate client fixtures across host platforms	2026-10-05 23:13:56 +08:00
verify-package-evidence.mjs	refactor(adapters): split oversized provider workflows	2026-07-18 05:49:14 +00:00
verify-package-install.mjs	refactor(process): separate capture implementation from analyst workflows (#988)	2026-10-08 00:46:21 +08:00
verify-package-managed.mjs	refactor(managed): group capability workflows and verification (#926)	2026-10-07 19:22:04 +08:00
verify-package-mcp.mjs	refactor(artifacts): move inventory and extraction into provider owners (#1032)	2026-10-08 05:51:14 +08:00
verify-package-pack.mjs	feat(electron): add autonomous Electron runtime analysis (#464)	2026-08-05 19:07:46 +08:00
verify-package-platform.d.mts	fix: consolidate boundary ownership and cleanup failure paths (#477)	2026-09-08 10:59:13 +08:00
verify-package-platform.mjs	refactor: return complete tool results inline	2026-09-29 07:08:46 +08:00
verify-package-prompts.mjs	Merge remote-tracking branch 'origin/main' into feat/mcp-prompts-completion	2026-07-14 04:55:38 +08:00
verify-package-setup.mjs	docs: clarify onboarding and align provider guidance (#745)	2026-10-06 22:57:36 +08:00
verify-package-unknown-provider.mjs	refactor(adapters): split oversized provider workflows	2026-07-18 05:49:14 +00:00
verify-package-update.mjs	feat(setup)!: expand agent integrations and verify updates (#577)	2026-10-05 23:06:19 +08:00
verify-package.mjs	fix(mcp): return complete inline Evidence records (#585)	2026-10-06 00:10:31 +08:00
verify-packaged-ghidra-windows.mjs	feat(ghidra): support native x86 PE applications on Windows (#1030)	2026-10-08 05:11:47 +08:00
verify-packed-bridge.mjs	feat(ghidra): add atomic function annotation edits (#709)	2026-10-06 17:24:33 +08:00
verify-published-package.mjs	feat(setup)!: expand agent integrations and verify updates (#577)	2026-10-05 23:06:19 +08:00
verify-real-browser.mjs	feat(browser): trace captured website module imports (#879)	2026-10-07 14:59:52 +08:00
verify-real-electron.mjs	refactor(javascript): group domain semantics and contracts (#907)	2026-10-07 17:16:58 +08:00
verify-real-ghidra-assertions.mjs	fix(ghidra): recover evidenced switch cases and default targets (#579)	2026-10-05 22:54:17 +08:00
verify-real-ghidra-com.mjs	feat(ghidra): add atomic function annotation edits (#709)	2026-10-06 17:24:33 +08:00
verify-real-ghidra-dos.mjs	feat(ghidra): add atomic function annotation edits (#709)	2026-10-06 17:24:33 +08:00
verify-real-ghidra-function.mjs	fix(ghidra): recover evidenced switch cases and default targets (#579)	2026-10-05 22:54:17 +08:00
verify-real-ghidra-inventory.mjs	feat(native): add investigation features (#486)	2026-09-30 00:41:05 +08:00
verify-real-ghidra-nativeaot.mjs	refactor(native): group analyst semantics workflows and contracts (#973)	2026-10-07 22:40:48 +08:00
verify-real-ghidra-switch-assertions.mjs	fix(ghidra): recover evidenced switch cases and default targets (#579)	2026-10-05 22:54:17 +08:00
verify-real-ghidra-switch-controls.mjs	chore: migrate formatting to Oxfmt (#615)	2026-10-06 01:59:19 +08:00
verify-real-ghidra-switch.mjs	chore: migrate formatting to Oxfmt (#615)	2026-10-06 01:59:19 +08:00
verify-real-ghidra-windows.mjs	feat(ghidra): support native x86 PE applications on Windows (#1030)	2026-10-08 05:11:47 +08:00
verify-real-ghidra.mjs	fix(ghidra): recover evidenced switch cases and default targets (#579)	2026-10-05 22:54:17 +08:00
verify-real-hopper-linux.mjs	feat(process): record provider and verifier run lineage	2026-07-22 14:01:47 +00:00
verify-real-hopper.mjs	fix: correct native inventories and bridge error classification (#503)	2026-10-04 17:25:09 +08:00
verify-real-ida.mjs	feat(ida): add read-only GUI and headless MCP providers (#754)	2026-10-07 01:47:05 +08:00
verify-reconstruction-readiness.mjs	refactor(contracts): simplify workflows and drop readiness tool	2026-09-29 09:22:44 +08:00
verify-recorded-crash.mjs	feat(native): inspect recorded crashes through pwntools and pwndbg (#1054)	2026-10-08 16:50:31 +08:00
verify-release-checkpoint.mjs	fix(release): validate frozen checkpoint versions and breaking notes	2026-10-08 10:13:05 +00:00
verify-test-discovery.mjs	refactor: add incremental capability migration safeguards (#819)	2026-10-07 10:56:06 +08:00
verify-test-temp-hygiene.mjs	feat: complete REA remediation program	2026-07-22 22:09:12 +09:00
verify-web-network-captures.mjs	fix(domain): preserve prototype-named JSON members through Evidence boundaries (#1049)	2026-10-08 21:32:48 +08:00
verify-website.py	docs(website): add Notion case study and improve onboarding	2026-10-07 20:59:56 +08:00
verify-windows-native-artifact.mjs	feat(ghidra): enable Windows x64 read-only analysis (#699)	2026-10-06 16:53:33 +08:00
verify-windows-native.mjs	fix(windows): allow Java to read retained target snapshots (#1027)	2026-10-08 04:33:01 +08:00
verify-windows-package.mjs	feat(ghidra): enable Windows x64 read-only analysis (#699)	2026-10-06 16:53:33 +08:00
windows-capabilities.mjs	feat(ghidra): define the Windows P0 admission boundary	2026-07-17 03:05:19 +09:00