shifathosn
/
rea
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
rea/scripts
History
Matt Van Horn 880a603fe8
feat(mcp): derive an API surface view from retained web network captures (#1891) 
* feat(mcp): derive an API surface view from retained web network captures

* fix(mcp): fail closed on sensitive parents and budget api-surface path expansion

* fix(mcp): keep recorded api-surface paths and budget only templated segments

* fix(mcp): read api-surface paths only from canonical URLs and charge new values once

* fix(mcp): reject authority-less api-surface URLs and key groups by rule positions

* fix(mcp): label api-surface confidence from all groups and cap transient path memory

* fix(mcp): budget api-surface dedup sets and narrow detail outputs

Charge retained deduplication sets before allocation, advertise only
each analysis operation's summary from its detail output, and document
that any templated group makes every API-surface page inferred.

* fix(mcp): bound api-surface path text and record limitations

Charge retained literal path copies before allocation, publish only
valid media-type essences, and deduplicate examined record limitations
onto the view.

* fix(mcp): keep api-surface refusals and path splits inside the reply budget

Sensitive-parent refusals now use the token sensitive_values_unretained so declared literals are not echoed. A later path split is charged against bytes already retained, and the published example includes the HAR record limitation with its matching digest.

* fix(mcp): budget api-surface method text before group keys

Charge method and origin text against the reply budget before the group key is serialized. Document that samples merge only when method, origin, and exact segment rules match.

* fix(mcp): bound api-surface copies and control-character authorities

Reject authorities containing a tab or newline so WHATWG cannot move userinfo into the recorded path. Charge four path copies, two method and origin copies, and each distinct content type against bytes already retained.

* fix(mcp): preflight combined api-surface group charges

Total path, method, origin, and segment charges before retaining a new group. Track content types in a set so distinct MIME essences are not compared quadratically.

* fix(mcp): charge api-surface content-type sets on first use

Create the per-group content-type set when the first essence is retained, and charge it before allocation. Groups with no content type no longer keep an empty set.

* refactor(analysis): centralize API-surface ownership and admission

Own grouping, deduplication, and combined retained/temporary resource admission in one accumulator. Charge fixed group storage before allocation and materialize only the requested page.

Share recorded URL parsing between capture redaction and projection, preserving source paths and excluding ambiguous credential fields. Cover resource admission invariants and the compiled HAR-to-view workflow.

* fix(analysis): admit capture schema clone before parsing

* fix(javascript): share Electron mutation proof with wrapped calls

* test(mcp): align graph and catalog checks with current contracts

* fix(analysis): admit and validate portable capture views

---------

Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
 		2026-10-12 10:44:17 +08:00
..
ci feat(website): add multilingual editions and translation workflow 2026-10-11 17:24:46 +08:00
fixtures feat(harmony): project HarmonyOS package inventory evidence (#1447) 2026-10-11 20:09:21 +08:00
lib fix(analysis)!: scope call-graph caveats to their observed relationships 2026-10-12 09:29:07 +08:00
verify refactor: prune obsolete provider and verification code 2026-10-12 08:59:14 +08:00
audit-website-links.py chore(website): simplify maintenance and detect documentation drift 2026-10-10 20:27:01 +08:00
build-conformance-fixtures.mjs refactor(schema): remove data-only version markers 2026-09-29 08:45:36 +08:00
build-ghidra-nativeaot.mjs fix(ghidra): isolate optional nativeaot script sources 2026-10-11 09:35:22 +08:00
build-windows-native.mjs fix(windows): retain failed native inspection ownership (#1826) 2026-10-11 21:33:25 +08:00
bundle-runtime.d.mts perf(cli): bundle runtime entries to reduce Windows startup I/O (#1996) 2026-10-12 09:25:27 +08:00
bundle-runtime.mjs perf(cli): bundle runtime entries to reduce Windows startup I/O (#1996) 2026-10-12 09:25:27 +08:00
check-dependency-install.mjs fix(deps): run freshness check from escaped paths 2026-07-16 19:51:25 +08:00
check-doc-facts.mjs build: add canonical product catalog and docs drift checks 2026-07-15 17:43:52 +08:00
clean-build-output.mjs build: separate runtime artifacts and supervise command ownership 2026-10-09 20:11:17 +08:00
create-ghidra-windows-fixture.mjs fix(native): preserve compact reference provenance (#1438) 2026-10-10 21:39:28 +08:00
electron-active-hook-boundaries.cjs fix(capture): retain Electron observations and HAR resource failures 2026-10-09 06:49:02 +08:00
electron-active-hook.cjs fix(capture): retain Electron observations and HAR resource failures 2026-10-09 06:49:02 +08:00
generate-completion-ledger.mjs fix(build): make catalogs and packaged skills generated outputs (#1086) 2026-10-08 22:43:51 +08:00
generate-error-schema.mjs chore: migrate formatting to Oxfmt (#615) 2026-10-06 01:59:19 +08:00
generate-mcp-tool-catalog.mjs build: separate runtime artifacts and supervise command ownership 2026-10-09 20:11:17 +08:00
generate-nativeaot-fixtures.mjs feat(ghidra): integrate optional NativeAOT metadata recovery (#748) 2026-10-07 00:57:08 +08:00
generate-package-metadata.mjs fix(skills): expose authored skill to repository discovery 2026-10-10 14:20:22 +08:00
generate-product-catalog.mjs fix(build): make catalogs and packaged skills generated outputs (#1086) 2026-10-08 22:43:51 +08:00
generate-skill-metadata.mjs fix(skills): expose authored skill to repository discovery 2026-10-10 14:20:22 +08:00
hopper-demo-x11.py fix(linux): improve Hopper reliability and CachyOS support (#963) 2026-10-07 23:16:48 +08:00
prepack.mjs perf(cli): bundle runtime entries to reduce Windows startup I/O (#1996) 2026-10-12 09:25:27 +08:00
prepare-website.py feat(website): add multilingual editions and translation workflow 2026-10-11 17:24:46 +08:00
prepare.mjs build: streamline local and CI validation 2026-07-22 16:06:28 +00:00
print-mcp-config.mjs fix(npm): use latest entry points without install scripts 2026-07-17 00:16:46 +00:00
rea.mjs perf(cli): bundle runtime entries to reduce Windows startup I/O (#1996) 2026-10-12 09:25:27 +08:00
release-notes.mjs fix(release): avoid duplicated contributor thanks 2026-10-11 11:49:49 +08:00
release-npm-tag.mjs fix(release): publish prereleases under the next npm tag 2026-10-09 00:49:30 +08:00
run-development-tests.mjs build: separate runtime artifacts and supervise command ownership 2026-10-09 20:11:17 +08:00
run-exclusive-command.mjs build: separate runtime artifacts and supervise command ownership 2026-10-09 20:11:17 +08:00
run-exclusive.mjs build: separate runtime artifacts and supervise command ownership 2026-10-09 20:11:17 +08:00
scan-todos.mjs chore(scripts): merge duplicate node:fs import in scan-todos (#1790) 2026-10-11 18:18:10 +08:00
test-website.py feat(website): follow the system dark mode and fix small-screen text (#1894) 2026-10-12 03:17:49 +08:00
verify-adb.mjs feat(adb): complete ADB device support for Android reverse engineering (#1552) 2026-10-10 23:01:24 +08:00
verify-agent-experience.mjs feat(skills)!: improve Codex onboarding and task recovery (#1613) 2026-10-11 03:13:56 +08:00
verify-apktool.mjs fix(android): preserve decoded values and duplicate class inventories 2026-10-12 06:29:13 +08:00
verify-binary-layout.mjs fix(native): clarify Mach-O offset origins and reject partial ELF tables 2026-10-12 06:29:19 +08:00
verify-browser-dom-destinations.mjs fix(verify): report final success only after resource cleanup 2026-10-09 04:12:49 +08:00
verify-browser-modules.mjs feat(browser): trace captured website module imports (#879) 2026-10-07 14:59:52 +08:00
verify-browser-network.mjs feat(browser): capture correlated network content and lifecycle evidence (#797) 2026-10-07 04:35:49 +08:00
verify-browser-runtime.mjs feat(browser): attribute native execution and listener sources (#917) 2026-10-07 21:45:07 +08:00
verify-browser-scripts.mjs feat(web): export captured scripts for JavaScript application analysis (#801) 2026-10-07 05:24:32 +08:00
verify-browser-source-maps.mjs fix(browser): compose nested source-map column offsets (#1109) 2026-10-09 02:01:29 +08:00
verify-claude-client.mjs perf(mcp)!: compact repeated session discovery facts (#1988) 2026-10-12 07:40:19 +08:00
verify-commandcode-client.mjs fix(clients): preserve portable MCP schemas in native workflows (#1580) 2026-10-11 00:09:43 +08:00
verify-conformance-fixtures.mjs refactor(schema): remove data-only version markers 2026-09-29 08:45:36 +08:00
verify-copilot-client.mjs fix(tests): separate Copilot model IDs from wire models (#1647) 2026-10-11 06:52:45 +08:00
verify-deepseek-client.mjs fix(onboarding): isolate client homes and clarify npm release support (#1627) 2026-10-11 04:37:31 +08:00
verify-evm-interface.mjs refactor!: enforce canonical evidence and provider boundaries 2026-10-09 20:18:52 +08:00
verify-gemini-client.mjs test(clients): verify native Gemini CLI integration (#1541) 2026-10-10 19:17:55 +08:00
verify-grok-client.mjs test(clients): verify native Grok Build workflows (#1571) 2026-10-10 22:59:43 +08:00
verify-jeb.mjs feat(jeb): add JEB engine provider over its MCP interface (#1536) 2026-10-10 23:03:27 +08:00
verify-linux-setup-e2e.mjs feat(process): record provider and verifier run lineage 2026-07-22 14:01:47 +00:00
verify-mcp-registry-metadata.mjs feat(electron): add autonomous Electron runtime analysis (#464) 2026-08-05 19:07:46 +08:00
verify-module-boundaries.mjs build: verify resolved module boundaries (#862) 2026-10-07 13:02:28 +08:00
verify-native-agent-client.mjs fix(onboarding): isolate client homes and clarify npm release support (#1627) 2026-10-11 04:37:31 +08:00
verify-native-calls.mjs test(native): retain trace diagnostics when observed hits differ 2026-10-10 04:39:17 +08:00
verify-native-ui.mjs refactor!: enforce canonical evidence and provider boundaries 2026-10-09 20:18:52 +08:00
verify-omp-client.mjs fix(setup): reject invalid OMP profiles before fallback writes (#1562) 2026-10-10 22:11:14 +08:00
verify-opencode-client.mjs test(clients): verify native OpenCode integration (#1546) 2026-10-10 19:51:30 +08:00
verify-package-artifact.mjs feat(native): add investigation features (#486) 2026-09-30 00:41:05 +08:00
verify-package-capabilities.mjs perf(mcp)!: compact repeated session discovery facts (#1988) 2026-10-12 07:40:19 +08:00
verify-package-discovery.d.mts fix(package): separate agent and Hopper setup support (#584) 2026-10-06 00:00:15 +08:00
verify-package-discovery.mjs fix(package): separate agent and Hopper setup support (#584) 2026-10-06 00:00:15 +08:00
verify-package-environment.d.mts fix(test): use direct Node launcher on macOS 2026-07-24 03:31:26 +00:00
verify-package-environment.mjs fix(setup): honor active client configuration and skill roots (#1504) 2026-10-10 17:03:43 +08:00
verify-package-evidence.mjs refactor(adapters): split oversized provider workflows 2026-07-18 05:49:14 +00:00
verify-package-install.mjs feat: add Hermes as a supported MCP client (#1403) 2026-10-10 16:03:25 +08:00
verify-package-managed.mjs test(managed): include shared dossier fixture in artifact inputs 2026-10-10 04:09:45 +08:00
verify-package-mcp.mjs perf(mcp)!: compact repeated session discovery facts (#1988) 2026-10-12 07:40:19 +08:00
verify-package-pack.mjs fix(skills): expose authored skill to repository discovery 2026-10-10 14:20:22 +08:00
verify-package-platform.d.mts fix: consolidate boundary ownership and cleanup failure paths (#477) 2026-09-08 10:59:13 +08:00
verify-package-platform.mjs refactor: return complete tool results inline 2026-09-29 07:08:46 +08:00
verify-package-prompts.mjs Merge remote-tracking branch 'origin/main' into feat/mcp-prompts-completion 2026-07-14 04:55:38 +08:00
verify-package-setup.mjs fix(setup): preserve initial backups and Codex comments (#1204) 2026-10-09 12:57:00 +08:00
verify-package-unknown-provider.mjs refactor(adapters): split oversized provider workflows 2026-07-18 05:49:14 +00:00
verify-package-update.mjs feat(setup): register OMP during setup (#1301) 2026-10-09 08:51:12 -07:00
verify-package.mjs fix(ci): report package verifier stage progress 2026-10-11 11:11:38 +08:00
verify-packaged-ghidra-windows.mjs perf(mcp)!: compact repeated session discovery facts (#1988) 2026-10-12 07:40:19 +08:00
verify-packaged-wasm-artifact.mjs feat(wasm): inspect local artifacts with WABT (#1533) 2026-10-11 19:49:00 +08:00
verify-packed-bridge.mjs perf(ghidra): compile bundle activator with bridge scripts (#1931) 2026-10-12 02:46:32 +08:00
verify-published-package.mjs perf(mcp)!: compact repeated session discovery facts (#1988) 2026-10-12 07:40:19 +08:00
verify-qwen-client.mjs fix(tests): verify Qwen skills through an isolated native home (#1646) 2026-10-11 06:05:57 +08:00
verify-real-browser.mjs fix(ci): close speculative browser fixture connections 2026-10-11 11:05:08 +08:00
verify-real-electron.mjs refactor!: enforce canonical evidence and provider boundaries 2026-10-09 20:18:52 +08:00
verify-real-ghidra-assertions.mjs refactor: remove forwarding exports and redundant aliases 2026-10-09 22:46:09 +08:00
verify-real-ghidra-com.mjs refactor: prune obsolete provider and verification code 2026-10-12 08:59:14 +08:00
verify-real-ghidra-dos.mjs refactor!: enforce canonical evidence and provider boundaries 2026-10-09 20:18:52 +08:00
verify-real-ghidra-function.mjs feat(ghidra): recover signed AArch64 relative jump tables (#1592) 2026-10-11 10:45:35 +08:00
verify-real-ghidra-inventory.mjs feat(native): add investigation features (#486) 2026-09-30 00:41:05 +08:00
verify-real-ghidra-mips-relocatable.mjs test(ghidra): require pending multi-HI16 coverage in the real MIPS relocatable lane (#1974) 2026-10-12 08:42:08 +08:00
verify-real-ghidra-mips-shared.mjs feat(ghidra): admit verified MIPS16 shared ELF images 2026-10-12 07:50:31 +08:00
verify-real-ghidra-mips.mjs feat(ghidra): admit soft-float MIPS32r2 ELF with integer-register float storage (#1949) 2026-10-12 04:54:38 +08:00
verify-real-ghidra-nativeaot.mjs refactor!: enforce canonical evidence and provider boundaries 2026-10-09 20:18:52 +08:00
verify-real-ghidra-noreturn.mjs fix(ghidra): normalize Mach-O imported symbol names 2026-10-11 09:59:27 +08:00
verify-real-ghidra-raw.mjs feat(ghidra): apply validated analyzer overrides before analysis 2026-10-12 03:49:31 +08:00
verify-real-ghidra-swift.mjs refactor!: enforce canonical evidence and provider boundaries 2026-10-09 20:18:52 +08:00
verify-real-ghidra-switch-assertions.mjs fix(ghidra): recover evidenced switch cases and default targets (#579) 2026-10-05 22:54:17 +08:00
verify-real-ghidra-switch-controls.mjs chore: migrate formatting to Oxfmt (#615) 2026-10-06 01:59:19 +08:00
verify-real-ghidra-switch.mjs refactor!: enforce canonical evidence and provider boundaries 2026-10-09 20:18:52 +08:00
verify-real-ghidra-windows.mjs fix(windows): bring the real Windows Ghidra verifiers up to date (#1863) 2026-10-11 23:38:34 +08:00
verify-real-ghidra.mjs feat(ghidra): recover signed AArch64 relative jump tables (#1592) 2026-10-11 10:45:35 +08:00
verify-real-hopper-deadlines.mjs refactor: remove forwarding exports and redundant aliases 2026-10-09 22:46:09 +08:00
verify-real-hopper-fat.mjs refactor: remove forwarding exports and redundant aliases 2026-10-09 22:46:09 +08:00
verify-real-hopper-linux.mjs feat(process): record provider and verifier run lineage 2026-07-22 14:01:47 +00:00
verify-real-hopper.mjs perf(mcp)!: compact repeated session discovery facts (#1988) 2026-10-12 07:40:19 +08:00
verify-real-ida.mjs fix(mcp): deliver typed errors without invalid structured output (#1277) 2026-10-09 13:54:32 +00:00
verify-reconstruction-readiness.mjs perf(domain): avoid duplicate readiness bundle validation 2026-10-11 13:29:11 +08:00
verify-recorded-crash.mjs feat(native): inspect recorded crashes through pwntools and pwndbg (#1054) 2026-10-08 16:50:31 +08:00
verify-release-checkpoint.mjs fix(release): validate frozen checkpoint versions and breaking notes 2026-10-08 10:13:05 +00:00
verify-repository-skill.mjs fix(skills): expose authored skill to repository discovery 2026-10-10 14:20:22 +08:00
verify-test-discovery.mjs fix(verify): report final success only after resource cleanup 2026-10-09 04:12:49 +08:00
verify-test-temp-hygiene.mjs fix(verify): report final success only after resource cleanup 2026-10-09 04:12:49 +08:00
verify-wasm-artifact.mjs fix(wasm): inspect modules whose custom section names contain NUL (#1981) 2026-10-12 08:41:55 +08:00
verify-web-network-captures.mjs feat(mcp): derive an API surface view from retained web network captures (#1891) 2026-10-12 10:44:17 +08:00
verify-website.py feat(website): add multilingual editions and translation workflow 2026-10-11 17:24:46 +08:00
verify-windows-native-artifact.mjs feat(ghidra): enable Windows x64 read-only analysis (#699) 2026-10-06 16:53:33 +08:00
verify-windows-native-inspection.mjs fix(windows): retain failed native inspection ownership (#1826) 2026-10-11 21:33:25 +08:00
verify-windows-native.mjs fix(bun): report the real runtime and enforce worker memory budgets on Windows (#1730) 2026-10-11 19:20:00 +08:00
verify-windows-package.mjs feat(setup): register OMP during setup (#1301) 2026-10-09 08:51:12 -07:00
website.py feat(website): add multilingual editions and translation workflow 2026-10-11 17:24:46 +08:00
website_i18n.py fix(website): incorporate multilingual contributor refinements 2026-10-11 17:24:46 +08:00
windows-capabilities.mjs feat(ghidra): define the Windows P0 admission boundary 2026-07-17 03:05:19 +09:00