173 Commits

Include renames

Author	SHA1	Message	Date
gensokyo-dev	8eff651270	fix(ghidra): make checkpoint workflows discoverable (#9246) ... Expose the existing opt-in Ghidra checkpoint lifecycle in tool descriptions and summary capabilities. Distinguish confirmed initial analysis from restored Programs, preserving the checkpoint path and digest through shared CLI/MCP results. Remove prose-driven checks and their scaffolding; retain canonical effects and lifecycle/source-fact coverage. Validated with 445 focused tests, 13 real Ghidra CLI/MCP scenarios and three isolated local Codex CLI tasks covering disabled setup, saving edits and fresh-agent restoration.	2026-11-07 16:56:33 +08:00
Edgar ArakelyanandClaude Opus 5.5	ac23dc8077	feat(desktop): read XML with a plain DOCTYPE, and check an element's whole text (#9050) ... * feat(desktop): read XML with a plain DOCTYPE, and check an element's whole text - Both readers accept a DOCTYPE with only a name and an optional PUBLIC or SYSTEM identifier, record it as the view's doctype, and never fetch the DTD or expand entities beyond XML's five; an internal subset, an external entity and a parameter entity stay refused alike. - text_equals and text_contains compare the concatenated text of the element (or text node or attribute) a pointer reaches, as XPath string() does, with optional normalize_whitespace; both evaluators agree, and a text check on a truncated element is undecided. - Whitespace-only text between elements is dropped only when the element holds no other text, so text split into runs keeps its spaces. - The draft suggests text_equals for an element whose text changed. So an AbiWord .abw reads as XML, and its paragraph's text is checked whole however AbiWord splits it into <c> runs, as Writer's spans are. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): draft whole-text checks on the paragraph, read only text as text, and skip asctime stamps - A changed value is read at both ends, so text that became a run still marks its paragraph, and the drafted text_equals moves up out of mixed content to the nearest ancestor named by an attribute, such as AbiWord's p by its xid. - Text checks accept only a text node or an attribute value; element names and doctype fields fail, in both evaluators. - isTimestamp also recognises asctime dates (Www Mmm dd hh:mm:ss yyyy). - XML files are drafted with the keyed diff the archive entries use, so no suggestion reaches an element by position; the shared logic moves to appTaskDraftNamed.ts. - Text-check tests assert facts, not whole sentences. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): keep checks on a changed attribute inside a paragraph whose text check replaces its runs' A drafted whole-text check on a paragraph hid every change inside it, so a link whose label and href both changed drafted only the paragraph's text and the new destination went unchecked. The text check now covers text and runs added or removed whole; a changed name or attribute of an element both versions hold keeps its own check. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): read an attribute called name or attributes as an attribute when the draft keeps its check The owner of `.../attributes/name` was taken as `.../attributes`, so a changed `name` attribute inside a paragraph with a text check was dropped again. The owner is now read by segment, attributes first. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): draft text checks from text in runs added whole, and name a text element by its own id before its container Text typed into a run the diff lists whole was never read, so the draft kept only a presence check on the run, which wrong text also passed. Such text now marks the nearest element both ends hold, or, when none can take the check, the added element's own text. The climb also names an element by an identifier of its own (id, xml:id, xid) before a larger container, so a headline under a long layer keeps a whole-text check that survives re-split runs. Co-Authored-By: Claude Opus 5.5 <[email protected]> * test(desktop): expect the whole-text check where #8988's pairing test meets text checks On this branch a changed element's text is drafted as `text_equals` on the element, so the identity pairing test now expects that check, under the same `[@role=body]` key. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): keep checks for elements without text beside a text edit, and normalize DOCTYPE system id line endings A review found two gaps. - A paragraph's whole-text check covered every element added or removed inside it, including ones holding no text: an image frame, a line break. A solver who typed the text but never inserted the image passed. Such an element now keeps its own presence or absence check. - The Python reader kept a DOCTYPE system literal's CRLF where TypeScript normalizes it to LF. Both now report LF. Co-Authored-By: Claude Opus 5.5 <[email protected]> * test(desktop): import textSyntaxFormat once in the state format tests main's mixed-case JSON suffix fix and this branch both added the import, and the merge kept both. Co-Authored-By: Claude Opus 5.5 <[email protected]> --------- Co-authored-by: Claude Opus 5.5 <[email protected]>	2026-11-07 03:20:12 +00:00
Edgar ArakelyanandClaude Opus 5.5	c363f3e27b	feat(desktop): pick seed and end by checkpoint, and keep the capture host out of bundles (#9037) ... * feat(desktop): capture a Linux desktop application in use Add `capture-desktop-application`, a CLI-only, Linux and X11 capture that launches an installed desktop application, watches it while it is used and writes capture Evidence plus SHA-256 addressed content: - inventory: desktop entry, launch command, executable, package and its apt sources (or snap, flatpak, AppImage), Electron markers and candidate state directories; - session: the launched process tree, client windows from xprop with the first application window time and a window match, and files held open; - state: a stat walk of the home directory before launch, at checkpoints read from stdin, at stop and after exit, with created, modified, deleted and retyped paths and the content of changed files and state directories. It refuses non-Linux hosts, missing DISPLAY or xprop, a non-empty output folder and an application whose window is already open, and signals only processes it started. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): own launched processes, confirm walk coverage and keep cancelled captures - Launch through the owned provider path with a run token; release with SIGTERM, then the token-verified group cleanup, after every session. Processes without the token are never signalled; each records whether it carries it, and the session records whether cleanup was verified. - Report creations and deletions only where a walk listed the nearest existing directory; count the rest as unconfirmed. - Retain a file only when it is still the walked version, through owned no-follow reads; charge the budget only for new content; create files exclusively in a private output folder owned by the caller. - Walk content roots outside the home directory, compare paths in their physical spelling, and run executables from the caller's directory. - Refuse when the window list cannot be read, re-evaluate window ownership each sample, handle one queued request per sample with a bounded stdin queue, and write the capture with end reason `cancelled` on interruption. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): keep owned cleanup failures and fresh digests - Allow a capture cancelled before any requested checkpoint to hold only the baseline. - Retry an incomplete stop once; if cleanup is still unverified, write the capture and fail with the run token and process group as cleanup resources. - Classify path changes after a walk (ENOTDIR and other selected-file errors) as changed_since_walk instead of failing the capture. - Treat a non-directory ancestor as proof that nothing existed beneath it. - Report a before digest only for the file version it was read from. - Derive stderr_truncated from stderr's own byte counts. Co-Authored-By: Claude Opus 5.5 <[email protected]> * wip(desktop): state view over a capture folder Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): keep failed file-handle closes owned for retry Content reads pass retainFailedClose, so a handle whose close fails stays owned by the content store; the capture retries those closes after it is written and fails with the output folder as the cleanup resource if one still cannot be closed. Co-Authored-By: Claude Opus 5.5 <[email protected]> * feat(desktop): read a captured application's state Add inspect-desktop-application-state, a CLI command that reads a capture folder into the application's state: every retained or changed file with its role and reasons, a typed JSON view of each version (SQLite through the shared worker, dconf through a private dconf dump, JSON, XML, key files, text) and the kinds of change between versions (lines, values, keys, rows). Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): report process and handle cleanup failures together When both the launched processes and a retained file's handle remain unresolved after the capture is written, one cleanup error now lists both reasons and both resource sets. Co-Authored-By: Claude Opus 5.5 <[email protected]> * feat(desktop): export a captured application as an agentenv computer app Add export-desktop-application, which writes an agentenv bundle with one computer_app environment from a capture folder and its state view: the apt package, a boot launch matched on the captured window class with a window ready check, owned paths from the state roles, a seed of the baseline files, data hooks that call agentenv's add/get/reset helpers with a typed JSON view on get, a skill, a README and a deploy smoke task. The desktop CLI commands now load their services lazily. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): keep state views faithful to the capture - Read key files, XML attributes, dconf groups and SQLite tables into dictionaries without inherited properties, so captured keys such as __proto__ stay data. - Version databases with their write-ahead log as of each checkpoint, and stage only digest-verified bytes for the SQLite and dconf readers. - Detect the format per version, report format changes, keep JSON null and empty containers as values, keep XML text and preserved whitespace, and mark truncated views (including XML depth) and comparisons of them. - Number versions and changes by checkpoint index, decide baseline presence from the captured type, and keep tagged SQLite integers, text bytes and blobs distinct. - Carry the capture's limitations and omitted content forward, match state directories by their home path, index changes once per capture, keep failed handle closes owned, and finish the CLI through the shared owner. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): keep coverage, logs and handles honest in the state view - Read coverage flags only from formats whose readers write them, so JSON fields named truncated stay data. - Fail a SQLite version whose write-ahead log existed but was not retained or does not match its digest, instead of reading the database alone. - Close retained content on every exit, including cancellation, and report a close that still fails together with the primary failure. - Finish the CLI with the canonical operation name. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): export only what the computer can install and seed - Refuse packages not from the Ubuntu 24.04 archive, since the computer installs by name from that archive. - Start the launch command in the captured working directory. - Respell the home path only in files the state view read as text. - Report files that were not retained instead of dropping them silently. - Load captured dconf keys for apps that own no files. - Keep home-level files as owned paths; rename reserved Python class names. - Mark truncated SQLite and text views in the class's get view, and read file types the way the state view does. - Release the output tree through a resource scope, and read seeds through an owner closed on every exit. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): keep staged folders owned, symlinked state roots and XML values - Stage database bytes in a private runtime root released through a resource scope, so a failed removal keeps its owner and is reported with the read's outcome. - Report cleanup facts and owners from desktop failures instead of wrapping them as a plain adapter error. - Record the state directories as walked, in their physical spelling, and match roles against both spellings, so files in a symlinked state directory are not mistaken for selected documents. - Keep whitespace-only XML leaf values; drop only formatting between elements. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): read XML in the exported app the way the state view does Keep whitespace-only leaf values and xml:space="preserve" text in the generated get view; drop only formatting between elements. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): release retained handles with their owners, read older captures - Release retained-content handles whose close failed through a resource scope on every exit; a release that fails again reports the exact handle owners. A read that finished keeps its bytes when only its close failed. - Accept captures written before state directories were recorded, and say in the state view's limitations that symlinked state directories may be misclassed for them. - Compute each XML element's whitespace context once instead of scanning siblings for every text run. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): boot without the working folder, bound XML, accept mirrors - Try the captured working directory only when an argument is relative, and start the app even when that folder is missing. - Cut the generated XML view at REA's node and depth limits, and keep one unreadable file from failing data/get. - Accept Ubuntu 24.04 mirrors, not only the canonical hosts; PPAs and other repositories are still refused. - Read seeds through the retained-content owner's new signature. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): state view review round - Stage a retained -journal beside its database so the SQLite worker accepts an inactive journal and refuses a hot one; a -wal or -journal that existed but was not retained (including one omitted at the baseline) makes the version unreadable. - Keep tables that read when another fails, and let cancellation and unfinished cleanup propagate instead of becoming view errors. - Read text as a key file only when every line parses as one. - Rank a file named in a window title or selected by the caller as a document even when the application holds it open; match titles on file-name boundaries; leave the display name out of dconf matching. - Bound JSON and key file views (4 MiB, 500 levels, exact numbers) and report too-large, missing and altered retained content separately. - Add no version or change while a database stays absent. - Read staged databases in place instead of copying them again. - Give Evidence the same limitations as the result. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): export review round - Load captured dconf keys without D-Bus: install dconf-cli, compile the existing and captured key files into the user database, and warn on failure instead of stopping the server. - Start relative-argument launches in the captured working directory, the home included, since the framework launches from the app folder; respell the home itself and option values under it. - Read views in a thread, skip files over 64 MiB, align the generated readers with the state view's, and close SQLite connections. - Never own the home or a shared base folder; map a symlinked state directory's files back to their home spelling. - Report omitted files and unretained opened folders. - Name the module so it cannot shadow another, and keep the class off the module's own names; derive names the bundle check accepts. - Write seeds as they are read, and remove an unpublished bundle on failure. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): capture review round - Ask the launch process group and token carriers to exit before killing them, on errors too; report incomplete cleanup with its facts. - Count descendants of the launch as started by the capture even when their environment cannot be read; treat a reused pid as a new process. - Follow symlinked desktop entries; name a flatpak's state after its application id; match flatpak windows by name only. - Stop on end of input; refuse empty, duplicate and reserved checkpoint names; require whitespace after the checkpoint keyword. - Stay on each walk root's device, and never walk or retain `/` or a directory containing the home; say so in the limitations. - Refuse a window manager that does not publish _NET_CLIENT_LIST. - Remove retained content when a capture fails before it is written. - Skip reading a file larger than the remaining content budget. - Record apt's archive origin for each package source. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): read an unset client list as no windows when supported xfwm4 leaves _NET_CLIENT_LIST unset while it manages no windows, so the capture refused an ordinary desktop with nothing open. Read _NET_SUPPORTED with the list: an unset list means no windows when the window manager supports it, and the capture is refused only when it does not. `xprop`'s "no such atom" output now reads as unset too. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): accept packages by apt's archive origin Accept a package source when apt reports its origin as Ubuntu for a noble suite, so mirrors count and PPAs or other repositories that merely have "ubuntu" in their URL do not. Captures made before origins were recorded fall back to Canonical's own archive hosts. Seed reads report why retained content could not be used. Co-Authored-By: Claude Opus 5.5 <[email protected]> * feat(desktop): capture and export apps from vendor apt repositories A closed-source app installed from its vendor's apt repository, such as Typora, can now be captured and exported as a computer app. - The capture records each non-Ubuntu repository listing the installed version (uri, suite, components from apt's sources files, one-line or deb822) and the key that signs it: the signed-by key, or the trusted key that gpgv shows verifies the repository's signed index. The key is retained with the capture. - The capture records the packages owning the libraries the executable loads (DT_NEEDED with RUNPATH and the linker cache, through REA's ELF readers), since a vendor package may not depend on them. - The export declares a verified vendor repository as an AptSource with its key, installs a vendor package's library packages, and adds --no-sandbox to an Electron app's launch, since a container denies Chromium's sandbox. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): report a locked database at once in data/get A database the running app holds locked made each data/get wait sqlite's five-second busy timeout before reporting it. Record the Typora run in an agentenv computer in the verification. Co-Authored-By: Claude Opus 5.5 <[email protected]> * perf(desktop): detect key files without splitting the whole text Read lines one at a time and stop at the first that a key file view would drop, instead of splitting a file of up to 64 MiB into arrays before its format is known. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): keep symlinked homes and state folders under the home in exports - Respell a path under its state folder's logical spelling only when that spelling is under the captured home, so a symlinked HOME keeps its files; pair walked and logical state folders only when the capture lists the same number, and match the innermost folder first. - When two files map to one home path, keep the one present before the capture and name the other in the limitations. - Read key files in the generated data/get with the state view's rule, checked against it by running the helper under python3. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): end captures on zombies and keep cleanup owners - A zombie or dead process no longer keeps the session open. - Remove only the partial capture file this run created. - Keep the exact owners of handles and processes whose cleanup failed on the returned error, so a retry can release them; test the published capture's cleanup-failure branch with mixed outcomes and retries. - Release the application once even when the exit checkpoint fails. - A cancellation before the capture is written removes what it retained. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): vendor package review round - Match apt sources through `apt-get indextargets`, which covers flat `./` and `/` suites and gives each release file and sources entry. - Accept a key whose signature verifies even when the release carries another signature without a key here; keep only the verifying key from a keyring holding several (OpenPGP packet splitter). - Install the package from its repository's release (`name/<release>`), declare one source per URI and suite, support only the capture host's architecture, and refuse Ubuntu Pro repositories. - List only library packages the computer can install; walk libraries only for vendor installs, with RPATH inherited as ld.so does, normalized paths, and DT_NEEDED bounded while reading. - Put --no-sandbox after the program an env wrapper launches; keep the gpgv folder's owner when its removal fails; respect --max-file-bytes for keys; wait 0.25 s on a busy SQLite database in data/get. Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(desktop): keep the vendor spec's gpgv command on one line A code span broken across lines left `<binary keyring>` for VitePress to read as an unclosed HTML tag, so the docs build failed. Co-Authored-By: Claude Opus 5.5 <[email protected]> * feat(desktop): add a validated task to exported desktop applications Each capture can now yield one agentenv task in its exported bundle. An agent writes the task (a prompt plus declarative checks over the app's data/get views); REA validates it and stays model-free. - `describe-desktop-application-task` summarises a capture's net change per file (role, format, views before and after) and drafts checks. - Checks: file presence, lines present/absent/counted, JSON-pointer values, SQLite rows and counts. REA keeps a task only if a check fails on the seed and every check passes on the captured end state; a file that was not retained at the baseline counts as absent, as the computer starts. - `export-desktop-application --task` writes tasks/NAME.json (deploy, agent, skills, recording, prompt, verifier), a compiled verify.py that reads data/get, and an eval. A boundary test runs the verifier under python3 and checks it agrees with REA's evaluator on every check kind. - Docs, spec and skill guidance, with the solve-rate recipe. Co-Authored-By: Claude Opus 5.5 <[email protected]> * test(desktop): keep the seed test in its own block Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(desktop): record the task verifier driven in an agentenv computer Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(desktop): record the Typora task run in an agentenv computer Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): keep task checks bounded, complete and attributable - line_count counts lines holding a substring (contains) instead of matching a regular expression, which could stall the verifier on agent-written text and read differently in Python. - value_equals of a whole object or array is undecided on a truncated view. - The draft keeps a database whose rows changed under an unchanged hash, and a file whose truncated views match while it changed. - A task file that cannot be read keeps the reader's detail, and a failed cleanup keeps the read failure as its primary. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): leave a file with one version out of the task draft Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(desktop): update the task verification's test counts Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(desktop): record the task solve rate with Claude Code and Sonnet 5.5 Co-Authored-By: Claude Opus 5.5 <[email protected]> * feat(desktop): capture and export apps installed from a downloaded .deb capture-desktop-application --package-file reads the file's control fields with dpkg-deb and records its SHA-256, size and dependencies when it holds the installed package; the file itself is never kept. The library walk now also runs for local installs. export-desktop-application --package-url declares agentenv's Download(url, sha256) for that file, its dependencies and library packages as apt packages, and a run script that installs it with dpkg. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): seed app-named dotfiles and respell UTF-16 seeds The capture now treats dotfiles in the home named after the application (.varicad-cfg.ini, .notesrc) as state roots, so a file the app only reads during the capture is still seeded. The exported seeding respells the captured home in UTF-16 text files with a byte-order mark, keeping the mark. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): hold readiness until the app's own window shows An exported app is ready only once a window of its class that the taskbar lists is shown, so a splash screen of the class, which skips the taskbar, no longer counts as the app being up. Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(desktop): record VariCAD captured, exported and run in an agentenv computer Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): keep exported views strict JSON for infinite and inexact numbers The exported data/get spells infinite and negative-zero SQLite reals as REA's SQLite reader does ("Infinity", "-Infinity", "-0"), and refuses a JSON file holding a number that reading would change (1e999, integers past 2^53, -0, rounded fractions) with the state view's own error, instead of a view with an infinity in it. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): keep package-file facts tied to one file and URLs unechoed - A --package-url refusal never repeats the URL, and credentials are checked before the scheme. - The package file's identity must hold between dpkg-deb's read and the hash. - A failed close keeps its cleanup owner even when the capture is cancelled. - Readiness also ignores windows typed as splash screens. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): record database logs and keep state changes distinct - A selected path that is not a directory brings its -wal and -journal as content roots, so the capture records whether they exist and retains them. - The state view treats a file as absent only under recorded content roots and refuses a database whose log presence is unknown. - JSON changes list containers too, so an array that becomes an object with the same members is a change. - Key file entries escape the key as a JSON pointer segment, so [a/b] c and [a] b/c stay apart. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): keep watching through unread samples and late workers - An unreadable window list is unknown, not zero windows, and is named in the limitations. - Before ending the session, live run-token carriers no parent link reached are tracked; an unreadable process table leaves the exit unknown. - An env prefix's assignments find the program and name its XDG folders. - flatpak run options that take a value are skipped with it, -- is honoured and a /arch/branch suffix is dropped from the id. - State directories include the entry's full id. - Path options refuse empty values; roots count toward the entry limit. - A capture file whose close failed stays owned and is retried on discard. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): bound apt sources, keep older captures and cleanup owners - Sources files parse into one stanza per line or deb822 paragraph with its URIs and suites kept as lists, so no URI x suite product is built. - Repository architectures and release are optional, so captures written before they were recorded parse; the export treats them as unrestricted and unknown. - Library sources are matched against every index of a declared repository's URI, suite and components. - Two failures side by side keep both causes and both cleanup owners, and a host file whose close fails reports a lease on its handle. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): match escaped key file entries and suggest containers through members - The draft's key file lookup uses the state view's escaped `group/key`, so a key holding `/` or `~` still gets its suggestion. - JSON and XML changes now list containers too; the draft suggests an added or removed container through its listed members, and a container only when none of its members is listed. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): read relative PATH entries from the launch folder A program, or an empty or relative PATH entry, is resolved from the folder the program starts in, as the launch does, so `env PATH=. app` with the entry's Path still finds the app. Co-Authored-By: Claude Opus 5.5 <[email protected]> * perf(desktop): compare JSON views on one shared path JSON and XML changes are found by walking both trees with one shared pointer path, building a pointer only for a listed value, so memory follows depth rather than every container's full path. A pointer over 4096 characters is counted but not listed. A 256-level document with 4000-character keys went from about 251 MiB of heap to under 1 MiB. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): keep JSON Lines as text in the exported reader The exported reader parses the whole text before an inexact number makes it JSON with an error, so JSON Lines with an integer above 2^53 stay text as in REA. Over-long integer spellings are unsafe without converting them. The guide no longer claims large integers keep their value. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): keep the state-path help free of dash-led words The CLI alias check reads `-wal` and `-journal` in help text as short flags, so the help names the write-ahead log and rollback journal instead. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): never record or export apt source credentials - Source URIs lose any user name and password as they are parsed, the way apt splits them, and so do index-target URIs and descriptions and the sources apt-cache policy lists, so matching works whether or not apt prints them. - A repository whose entry held credentials is marked `uri_credentials_removed`, and the export refuses it, or an older capture whose URI still holds them, with a reason that names no URL. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): look programs up without normalizing their paths Program paths and PATH entries are joined rather than resolved, so `..` after a symbolic link means what it means to the launch. The lookup moves to its own module. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): note inexact JSON numbers with a flag, not a list The exported reader only needs to know whether any number was inexact, so it keeps a boolean instead of every rejected spelling. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): refuse older captures that still hold apt credentials A capture written before credentials were removed counted the credentialed repository's libraries as installable, so the export refuses it whole and asks for a new capture rather than declaring packages no source offers. Recorded policy sources are redacted in export messages too. Co-Authored-By: Claude Opus 5.5 <[email protected]> * test(desktop): keep the credential fixture on an example host A login on a real host reads as a secret to the commit scanner, so the older capture's fixture uses apt.example.com like the other credential tests. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): tidy looked-up paths and search relative entries only for env Empty and `.` segments are dropped from a looked-up program path, which keeps `/snap/bin/` entries recognisable as snaps, while `..` is still left for the kernel. Relative and empty PATH entries are searched only in the PATH an `env` prefix sets, which travels with the exported launch; the host's own PATH does not. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): keep excluded and unwalked database logs unknown The capture records the paths every walk left out, and the state view treats a log as absent only under content roots the baseline walked completely and outside those exclusions, so an excluded or unvisited log leaves the database unread rather than read without it. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): judge JSON numbers after duplicate keys settle The exported reader marks an inexact number instead of flagging it during the parse, then looks for marks in the parsed value, so a number a later duplicate key overwrote no longer refuses the file, as in REA. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): redact a repository's policy source when it names it An older capture whose policy source matched no sources entry kept that text whole, and the export named the repository by it; the export now names it without any user name or password. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): never signal the launch group on unknown membership When the current read cannot observe a carrier's process group, the carrier is signalled on its own instead of letting an older process-table row grant a group-wide SIGTERM. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): look programs up in the launch's order and refuse host-relative finds The lookup searches PATH as the launch does, an empty entry meaning the launch folder, so inspection and launch name the same program. A program found only through a relative or empty entry of the host's own PATH is refused, since the exported computer would not have it; an env prefix's PATH travels with the command. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): count unchecked paths and keep logs behind them unknown Each walk counts the paths it could not stat and the directories on another device it did not enter, and the checkpoint records it as `unchecked_paths`. The state view treats a log as absent only when the baseline left nothing unchecked, so a log whose stat failed stays unknown. Co-Authored-By: Claude Opus 5.5 <[email protected]> * perf(desktop): scan parsed JSON with one iterator per level The check for marked numbers walks the parsed value with an iterator per nesting level instead of copying each container's children; a million-entry array went from about 15.7 MiB to 8.1 MiB of peak traced memory. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): start a relative program from its captured folder An exported launch whose program path is relative, such as `./app` from an entry's Path, now changes to the captured working directory first, as it already did for relative arguments. Co-Authored-By: Claude Opus 5.5 <[email protected]> * feat(desktop): read zipped documents and name XML elements in task checks - A file that starts as a zip archive gets a `zip` view listing its entries in archive order, each with its own format and view, within limits on entries, bytes and expansion; the exported Python reader matches it. - A pointer segment applied to an array may be a selector, `[KEY=VALUE]` or `[@KEY=VALUE]` for XML attributes, matching exactly one member, so checks name elements instead of positions that shift between saves and versions. - `value_equals` takes an optional numeric `tolerance`, comparing numbers and numeric strings. - Changes inside zip views are listed by selector, and the task draft suggests name-addressed checks. FreeCAD's `.FCStd` is the first case: a hole cut into a plate is verified from the zipped `Document.xml` on files from both FreeCAD 0.21 and 1.0. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): record the desktop entry's package and app profiles in any case - A launch from a desktop entry records the package that owns the entry, so the export installs the app the entry starts (Writer, not only libreoffice-common); the program's own package is kept as executable_package when it differs. - State folders match the app's names ignoring letter case, as direct children of the XDG folders and the home, so GIMP's ~/.config/GIMP profile is seeded and reset; roles follow the same rule. Co-Authored-By: Claude Opus 5.5 <[email protected]> * feat(desktop): read namespaced XML alike in REA and the exported verifier The exported Python reader now names XML elements and attributes as the document spells them (svg, text:p, sodipodi:docname, xml:space), with namespace declarations kept as attributes, which is what REA's view already produced. Export therefore accepts checks into Inkscape SVGs, LibreOffice content.xml and namespaced XML inside zips, and the draft suggests them. expat replaces ElementTree: one pass with namespace processing refuses what REA's parser refuses, and a streaming pass builds the view within the same node and depth limits. Text splits at CDATA, comments and processing instructions as REA's DOM splits it. Fixtures are real Inkscape 1.2.2 and LibreOffice 24.2 saves. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): install the program's own package and keep unknown owners unknown - When the desktop entry's package does not own the program it runs, the export installs the program's package too. The capture records why it cannot (executable_package_reason), and the export then refuses. - The export owns a state folder in the letter case the app wrote it, as the state roles already did, so data/get and data/reset cover a profile folder the app created during the capture. - A dpkg-query that fails or exits 2 or higher leaves the package unknown instead of reading as "no owner". Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): keep selector checks undecided on partial views and pair members one to one - A selector check is undecided while an array it searched may be missing members: a cut zip listing, or a truncated XML or entry view. Both evaluators agree. - Diffs pair the members of two versions one to one, so two new elements can no longer both match the same old one and hide an addition. - The task draft descends into JSON values and readable entries added whole, and never suggests an element by its position, last step included. - The export's namespace refusal also checks XML entries inside the value a pointer names, such as the whole listing. - The exported reader keeps REA's 500-level JSON depth limit, so one deep entry no longer hides the rest of the archive, and treats an entry whose data runs past its declared size as damaged. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): check approved packages against the repositories the export keeps The capture approved library packages and the program's package against every repository with a verified key, but the export can still leave a repository out: its key dropped by the content budget, an architecture restriction, or a conflicting key. Each repository now records the packages only it supplies (`supplies`). The export drops stranded library packages with a limitation, and refuses when the program's own package is stranded. Captures without `supplies` behave as before. The install limitations move to appExportInstallLimitations.ts to keep appExportInstall.ts under the line limit. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): compare type changes in place, keep empty values and unread entries honest - When an array becomes another type, its members are compared with what their pointers name there, so values that are still present no longer look removed. - The draft checks an added empty array or object by equality. - The exported reader's JSON depth check keeps one iterator per level and copies no wide list, back to the memory peak before the check. - An entry whose view could not be read is no `null` value: the draft suggests no check on it, and a check into its view fails in both evaluators with the read error. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): decide entry view checks only on entries with a view, and walk JSON depth by level - A check into an archive entry's view needs an entry read in a format with a view. A binary or unread entry's `view` of `null` no longer passes a `null` or absence check, in either evaluator, and the draft suggests no absence inside an entry that ends without a view. - REA's JSON depth check keeps one iterator per level instead of queuing a pair per member, so 800,000 nulls need 18 MiB instead of more than 64. The helper came with the state view; its Python twin was fixed here. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): refuse an export whose desktop entry runs a program no package owns When a package owns the desktop entry but no package owns the program it runs, such as one in ~/.local/bin first on PATH, the capture keeps the entry's package and records why the program cannot be installed. Export refuses instead of installing a package that does not bring that program. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): bound zip entry reads, export metadata checks, and diff by the evaluator's pointer rules - The exported reader inflates a zip entry at most 64 KiB at a time and stops a byte past its declared size, so a forged small size no longer holds the whole stream in memory (77.5 MiB to 0.1 MiB on a 32 KiB bomb). - The namespace refusal applies only to checks that depend on an entry's XML, so checks on an entry's name, size or digest, or on its absence, export. - Diffs find a member's counterpart by the evaluator's pointer rules, so a selector step across a type change no longer reports a present value removed. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): read at most 1,000 zip directory records, and index arrays once per diff - Both zip readers now read the central directory a record at a time, keep the first 1,000 file records and count the rest, then hand the library an archive whose directory holds only those. Directories are told apart as zip.js does, so the Python reader stops listing attribute-marked directories as files. 600,000 entries now peak at 1.3 MiB in Python (was 293.6 MiB) and need 24 MiB of heap in REA. - The exported Python zip reader moves to appExportPythonZip.ts. - Diffs look members up through an index built once per compared array, so 20,000 selector keys against 20,000 members take 31 ms, not 5.4 s. Co-Authored-By: Claude Opus 5.5 <[email protected]> * feat(desktop): pick seed and end by checkpoint, and keep the capture host out of bundles - Export, task export and the task draft take --seed-checkpoint and --end-checkpoint, so one capture can make the seed in the app and then the edit; the defaults stay the baseline and the last version. - Capture reads apt's lists folder and trusted keys from apt-config, so a user-space apt-get update under APT_CONFIG is found, and starts the app without AGENTENV_* variables. - Capture records the host name and user. Export rewrites user@host, the host name as a whole name and the captured home in text, UTF-16 and dconf seeds, ships SEED_HOME=/home/user instead of the capture user's home, lists scrubbed and unscrubbable seeds, and refuses checks that name the host. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): check tasks against the shipped seed and scrub JSON and XML by value - Task validation reads the seed as the bundle ships it, after the scrub, so a task whose end value the scrub writes into the seed is refused. - JSON strings and XML text, attribute values, comments and CDATA are scrubbed as their decoded values and rewritten only when they change, so syntax stays valid and escaped identities are found. - One leftover search covers every shipped file's path and contents, generated module and dconf keys included; the strict whole-name rule is kept for replacing only. - A host named localhost is never replaced, but user@localhost is. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): resolve a record's selector keys together, and follow Zip64 locators without sentinels - The diff resolves all of a record's selector-shaped keys in one lookup: conditions are normalized per field, selectors grouped by field set, and only the values asked for are kept, so retained memory grows with the keys, not members times field sets (68 MB to 5.5 MB, 76 MB to 4.9 MB on the reported cases). - Both zip readers follow a Zip64 locator just before the end record whatever the classic record holds, as zipfile does, so valid Zip64 archives with ordinary classic values read again. The exported module's synthetic tail carries a real Zip64 end record, so bytes that only look like a locator no longer make zipfile refuse it. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): scrub JSON values only, with a scanner whose stack does not grow with string length JSON seeds are walked one string at a time, finding each closing quote with indexOf and a backslash count instead of a backtracking regex, so a 16,000,000-character string no longer overflows the stack. Member names are never rewritten, so two keys cannot collide; a name holding the host leaves the file in unscrubbed_files. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): scrub dconf and UTF-16 seeds by format, search check values for the host, and gate checks on the selected ends - dconf: the host scrub ran over the whole key file, so on a host named `true` `wrap=true` became an invalid `wrap=localhost`. Only decoded GVariant string values are scrubbed now; keys, groups, bytestrings, dictionary keys and object paths ship as captured and are reported. - Task identity: the host search read the serialized check, whose field names (`file`, `kind`) and default ids matched hosts of those names. It now reads the check's string values only. - Value checks: the text-file refusal read every recorded version; it now reads only the shipped seed and the end. - UTF-16 seeds: the plain scrubber renamed JSON keys and XML names; the decoded text's format now picks the scrubber, keeping the byte order mark. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): pair members by identity first, build selectors lazily, and refuse oversized and deep text before building a view - Pairing: an element with an identifier (name, id, xid, *:id) pairs only by it, so an unchanged id still names an edited element instead of a removal and an addition, and two objects of one type are never paired as a rename. Selectors keep the tag apart from each attribute condition and spell only the chosen one, so a long tag with many attributes no longer multiplies. - Size: REA's detection and the exported reader decide JSON with a scanner that builds no value, and refuse a view over the parsed-view limit before building it, in files and zip entries alike. - Deep text: the exported reader confirms the whole text is JSON before reporting a nesting depth error, as REA reads it. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): count a selector's matches over every sibling while identified elements choose only their identifiers Identity-first pairing also dropped an identified sibling's other attributes from the counts that prove a selector names one member, so a shared attribute such as `color` or `fill` could be chosen though it matched two siblings: the diff reported present elements removed and drafts lost their checks. Counting now covers every attribute of every sibling; only the choice is limited to an identified element's tag and identifiers. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): tell a UTF-16 seed's format without building it, and scrub XML without one piece per token Choosing the scrubber for a decoded UTF-16 seed ran the full state detection, which built the whole XML document (or JSON value), so a large seed within the capture limit could exhaust memory at export. A syntax pass now decides the format (the JSON token scan, and the XML parser's events keeping only the open elements), and the XML scrubber copies out only the spans it changes. Co-Authored-By: Claude Opus 5.5 <[email protected]> --------- Co-authored-by: Claude Opus 5.5 <[email protected]>	2026-11-06 10:01:25 +08:00
+2737 people	fb453f2930	fix(mcp): support retained pseudocode summaries and paging (#5046) ... * refactor(mcp): share official tool evidence registration Route official tools through registerEvidenceTools and remove the duplicate execution, progress, and Evidence delivery pipeline. Preserve relationship coverage in the shared path and reuse the existing source Evidence recording helper. Validation: typecheck and 29 focused MCP tests passed. Real native providers were not exercised. * fix(mcp): support retained pseudocode summaries and paging Allow procedure_pseudo_code to return an opt-in summary linked to its retained complete Evidence. Extend inspect_analysis_view to page the original pseudocode without repeating provider analysis. Preserve default complete output and exclude delivery detail from provider parameters and source Evidence identity. Add regression coverage for large results, Unicode, null and empty output, missing retention, transport-overflow recovery, and CLI paging. Validation: 178 focused tests, build, check, docs:check, and test discovery passed. Real stdio simulation reconstructed 98,000 code units exactly. Real Ghidra, iTunes, and Claude Code verification remains unavailable. Fixes #5032 * test(mcp): scope pseudocode contract lookup to official tools * feat(desktop): capture and export apps installed from a downloaded .deb (#8954) * feat(desktop): capture a Linux desktop application in use Add `capture-desktop-application`, a CLI-only, Linux and X11 capture that launches an installed desktop application, watches it while it is used and writes capture Evidence plus SHA-256 addressed content: - inventory: desktop entry, launch command, executable, package and its apt sources (or snap, flatpak, AppImage), Electron markers and candidate state directories; - session: the launched process tree, client windows from xprop with the first application window time and a window match, and files held open; - state: a stat walk of the home directory before launch, at checkpoints read from stdin, at stop and after exit, with created, modified, deleted and retyped paths and the content of changed files and state directories. It refuses non-Linux hosts, missing DISPLAY or xprop, a non-empty output folder and an application whose window is already open, and signals only processes it started. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): own launched processes, confirm walk coverage and keep cancelled captures - Launch through the owned provider path with a run token; release with SIGTERM, then the token-verified group cleanup, after every session. Processes without the token are never signalled; each records whether it carries it, and the session records whether cleanup was verified. - Report creations and deletions only where a walk listed the nearest existing directory; count the rest as unconfirmed. - Retain a file only when it is still the walked version, through owned no-follow reads; charge the budget only for new content; create files exclusively in a private output folder owned by the caller. - Walk content roots outside the home directory, compare paths in their physical spelling, and run executables from the caller's directory. - Refuse when the window list cannot be read, re-evaluate window ownership each sample, handle one queued request per sample with a bounded stdin queue, and write the capture with end reason `cancelled` on interruption. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): keep owned cleanup failures and fresh digests - Allow a capture cancelled before any requested checkpoint to hold only the baseline. - Retry an incomplete stop once; if cleanup is still unverified, write the capture and fail with the run token and process group as cleanup resources. - Classify path changes after a walk (ENOTDIR and other selected-file errors) as changed_since_walk instead of failing the capture. - Treat a non-directory ancestor as proof that nothing existed beneath it. - Report a before digest only for the file version it was read from. - Derive stderr_truncated from stderr's own byte counts. Co-Authored-By: Claude Opus 5.5 <[email protected]> * wip(desktop): state view over a capture folder Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): keep failed file-handle closes owned for retry Content reads pass retainFailedClose, so a handle whose close fails stays owned by the content store; the capture retries those closes after it is written and fails with the output folder as the cleanup resource if one still cannot be closed. Co-Authored-By: Claude Opus 5.5 <[email protected]> * feat(desktop): read a captured application's state Add inspect-desktop-application-state, a CLI command that reads a capture folder into the application's state: every retained or changed file with its role and reasons, a typed JSON view of each version (SQLite through the shared worker, dconf through a private dconf dump, JSON, XML, key files, text) and the kinds of change between versions (lines, values, keys, rows). Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): report process and handle cleanup failures together When both the launched processes and a retained file's handle remain unresolved after the capture is written, one cleanup error now lists both reasons and both resource sets. Co-Authored-By: Claude Opus 5.5 <[email protected]> * feat(desktop): export a captured application as an agentenv computer app Add export-desktop-application, which writes an agentenv bundle with one computer_app environment from a capture folder and its state view: the apt package, a boot launch matched on the captured window class with a window ready check, owned paths from the state roles, a seed of the baseline files, data hooks that call agentenv's add/get/reset helpers with a typed JSON view on get, a skill, a README and a deploy smoke task. The desktop CLI commands now load their services lazily. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): keep state views faithful to the capture - Read key files, XML attributes, dconf groups and SQLite tables into dictionaries without inherited properties, so captured keys such as __proto__ stay data. - Version databases with their write-ahead log as of each checkpoint, and stage only digest-verified bytes for the SQLite and dconf readers. - Detect the format per version, report format changes, keep JSON null and empty containers as values, keep XML text and preserved whitespace, and mark truncated views (including XML depth) and comparisons of them. - Number versions and changes by checkpoint index, decide baseline presence from the captured type, and keep tagged SQLite integers, text bytes and blobs distinct. - Carry the capture's limitations and omitted content forward, match state directories by their home path, index changes once per capture, keep failed handle closes owned, and finish the CLI through the shared owner. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): keep coverage, logs and handles honest in the state view - Read coverage flags only from formats whose readers write them, so JSON fields named truncated stay data. - Fail a SQLite version whose write-ahead log existed but was not retained or does not match its digest, instead of reading the database alone. - Close retained content on every exit, including cancellation, and report a close that still fails together with the primary failure. - Finish the CLI with the canonical operation name. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): export only what the computer can install and seed - Refuse packages not from the Ubuntu 24.04 archive, since the computer installs by name from that archive. - Start the launch command in the captured working directory. - Respell the home path only in files the state view read as text. - Report files that were not retained instead of dropping them silently. - Load captured dconf keys for apps that own no files. - Keep home-level files as owned paths; rename reserved Python class names. - Mark truncated SQLite and text views in the class's get view, and read file types the way the state view does. - Release the output tree through a resource scope, and read seeds through an owner closed on every exit. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): keep staged folders owned, symlinked state roots and XML values - Stage database bytes in a private runtime root released through a resource scope, so a failed removal keeps its owner and is reported with the read's outcome. - Report cleanup facts and owners from desktop failures instead of wrapping them as a plain adapter error. - Record the state directories as walked, in their physical spelling, and match roles against both spellings, so files in a symlinked state directory are not mistaken for selected documents. - Keep whitespace-only XML leaf values; drop only formatting between elements. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): read XML in the exported app the way the state view does Keep whitespace-only leaf values and xml:space="preserve" text in the generated get view; drop only formatting between elements. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): release retained handles with their owners, read older captures - Release retained-content handles whose close failed through a resource scope on every exit; a release that fails again reports the exact handle owners. A read that finished keeps its bytes when only its close failed. - Accept captures written before state directories were recorded, and say in the state view's limitations that symlinked state directories may be misclassed for them. - Compute each XML element's whitespace context once instead of scanning siblings for every text run. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): boot without the working folder, bound XML, accept mirrors - Try the captured working directory only when an argument is relative, and start the app even when that folder is missing. - Cut the generated XML view at REA's node and depth limits, and keep one unreadable file from failing data/get. - Accept Ubuntu 24.04 mirrors, not only the canonical hosts; PPAs and other repositories are still refused. - Read seeds through the retained-content owner's new signature. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): state view review round - Stage a retained -journal beside its database so the SQLite worker accepts an inactive journal and refuses a hot one; a -wal or -journal that existed but was not retained (including one omitted at the baseline) makes the version unreadable. - Keep tables that read when another fails, and let cancellation and unfinished cleanup propagate instead of becoming view errors. - Read text as a key file only when every line parses as one. - Rank a file named in a window title or selected by the caller as a document even when the application holds it open; match titles on file-name boundaries; leave the display name out of dconf matching. - Bound JSON and key file views (4 MiB, 500 levels, exact numbers) and report too-large, missing and altered retained content separately. - Add no version or change while a database stays absent. - Read staged databases in place instead of copying them again. - Give Evidence the same limitations as the result. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): export review round - Load captured dconf keys without D-Bus: install dconf-cli, compile the existing and captured key files into the user database, and warn on failure instead of stopping the server. - Start relative-argument launches in the captured working directory, the home included, since the framework launches from the app folder; respell the home itself and option values under it. - Read views in a thread, skip files over 64 MiB, align the generated readers with the state view's, and close SQLite connections. - Never own the home or a shared base folder; map a symlinked state directory's files back to their home spelling. - Report omitted files and unretained opened folders. - Name the module so it cannot shadow another, and keep the class off the module's own names; derive names the bundle check accepts. - Write seeds as they are read, and remove an unpublished bundle on failure. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): capture review round - Ask the launch process group and token carriers to exit before killing them, on errors too; report incomplete cleanup with its facts. - Count descendants of the launch as started by the capture even when their environment cannot be read; treat a reused pid as a new process. - Follow symlinked desktop entries; name a flatpak's state after its application id; match flatpak windows by name only. - Stop on end of input; refuse empty, duplicate and reserved checkpoint names; require whitespace after the checkpoint keyword. - Stay on each walk root's device, and never walk or retain `/` or a directory containing the home; say so in the limitations. - Refuse a window manager that does not publish _NET_CLIENT_LIST. - Remove retained content when a capture fails before it is written. - Skip reading a file larger than the remaining content budget. - Record apt's archive origin for each package source. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): read an unset client list as no windows when supported xfwm4 leaves _NET_CLIENT_LIST unset while it manages no windows, so the capture refused an ordinary desktop with nothing open. Read _NET_SUPPORTED with the list: an unset list means no windows when the window manager supports it, and the capture is refused only when it does not. `xprop`'s "no such atom" output now reads as unset too. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): accept packages by apt's archive origin Accept a package source when apt reports its origin as Ubuntu for a noble suite, so mirrors count and PPAs or other repositories that merely have "ubuntu" in their URL do not. Captures made before origins were recorded fall back to Canonical's own archive hosts. Seed reads report why retained content could not be used. Co-Authored-By: Claude Opus 5.5 <[email protected]> * feat(desktop): capture and export apps from vendor apt repositories A closed-source app installed from its vendor's apt repository, such as Typora, can now be captured and exported as a computer app. - The capture records each non-Ubuntu repository listing the installed version (uri, suite, components from apt's sources files, one-line or deb822) and the key that signs it: the signed-by key, or the trusted key that gpgv shows verifies the repository's signed index. The key is retained with the capture. - The capture records the packages owning the libraries the executable loads (DT_NEEDED with RUNPATH and the linker cache, through REA's ELF readers), since a vendor package may not depend on them. - The export declares a verified vendor repository as an AptSource with its key, installs a vendor package's library packages, and adds --no-sandbox to an Electron app's launch, since a container denies Chromium's sandbox. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): report a locked database at once in data/get A database the running app holds locked made each data/get wait sqlite's five-second busy timeout before reporting it. Record the Typora run in an agentenv computer in the verification. Co-Authored-By: Claude Opus 5.5 <[email protected]> * perf(desktop): detect key files without splitting the whole text Read lines one at a time and stop at the first that a key file view would drop, instead of splitting a file of up to 64 MiB into arrays before its format is known. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): keep symlinked homes and state folders under the home in exports - Respell a path under its state folder's logical spelling only when that spelling is under the captured home, so a symlinked HOME keeps its files; pair walked and logical state folders only when the capture lists the same number, and match the innermost folder first. - When two files map to one home path, keep the one present before the capture and name the other in the limitations. - Read key files in the generated data/get with the state view's rule, checked against it by running the helper under python3. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): end captures on zombies and keep cleanup owners - A zombie or dead process no longer keeps the session open. - Remove only the partial capture file this run created. - Keep the exact owners of handles and processes whose cleanup failed on the returned error, so a retry can release them; test the published capture's cleanup-failure branch with mixed outcomes and retries. - Release the application once even when the exit checkpoint fails. - A cancellation before the capture is written removes what it retained. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): vendor package review round - Match apt sources through `apt-get indextargets`, which covers flat `./` and `/` suites and gives each release file and sources entry. - Accept a key whose signature verifies even when the release carries another signature without a key here; keep only the verifying key from a keyring holding several (OpenPGP packet splitter). - Install the package from its repository's release (`name/<release>`), declare one source per URI and suite, support only the capture host's architecture, and refuse Ubuntu Pro repositories. - List only library packages the computer can install; walk libraries only for vendor installs, with RPATH inherited as ld.so does, normalized paths, and DT_NEEDED bounded while reading. - Put --no-sandbox after the program an env wrapper launches; keep the gpgv folder's owner when its removal fails; respect --max-file-bytes for keys; wait 0.25 s on a busy SQLite database in data/get. Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(desktop): keep the vendor spec's gpgv command on one line A code span broken across lines left `<binary keyring>` for VitePress to read as an unclosed HTML tag, so the docs build failed. Co-Authored-By: Claude Opus 5.5 <[email protected]> * feat(desktop): add a validated task to exported desktop applications Each capture can now yield one agentenv task in its exported bundle. An agent writes the task (a prompt plus declarative checks over the app's data/get views); REA validates it and stays model-free. - `describe-desktop-application-task` summarises a capture's net change per file (role, format, views before and after) and drafts checks. - Checks: file presence, lines present/absent/counted, JSON-pointer values, SQLite rows and counts. REA keeps a task only if a check fails on the seed and every check passes on the captured end state; a file that was not retained at the baseline counts as absent, as the computer starts. - `export-desktop-application --task` writes tasks/NAME.json (deploy, agent, skills, recording, prompt, verifier), a compiled verify.py that reads data/get, and an eval. A boundary test runs the verifier under python3 and checks it agrees with REA's evaluator on every check kind. - Docs, spec and skill guidance, with the solve-rate recipe. Co-Authored-By: Claude Opus 5.5 <[email protected]> * test(desktop): keep the seed test in its own block Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(desktop): record the task verifier driven in an agentenv computer Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(desktop): record the Typora task run in an agentenv computer Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): keep task checks bounded, complete and attributable - line_count counts lines holding a substring (contains) instead of matching a regular expression, which could stall the verifier on agent-written text and read differently in Python. - value_equals of a whole object or array is undecided on a truncated view. - The draft keeps a database whose rows changed under an unchanged hash, and a file whose truncated views match while it changed. - A task file that cannot be read keeps the reader's detail, and a failed cleanup keeps the read failure as its primary. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): leave a file with one version out of the task draft Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(desktop): update the task verification's test counts Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(desktop): record the task solve rate with Claude Code and Sonnet 5.5 Co-Authored-By: Claude Opus 5.5 <[email protected]> * feat(desktop): capture and export apps installed from a downloaded .deb capture-desktop-application --package-file reads the file's control fields with dpkg-deb and records its SHA-256, size and dependencies when it holds the installed package; the file itself is never kept. The library walk now also runs for local installs. export-desktop-application --package-url declares agentenv's Download(url, sha256) for that file, its dependencies and library packages as apt packages, and a run script that installs it with dpkg. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): seed app-named dotfiles and respell UTF-16 seeds The capture now treats dotfiles in the home named after the application (.varicad-cfg.ini, .notesrc) as state roots, so a file the app only reads during the capture is still seeded. The exported seeding respells the captured home in UTF-16 text files with a byte-order mark, keeping the mark. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): hold readiness until the app's own window shows An exported app is ready only once a window of its class that the taskbar lists is shown, so a splash screen of the class, which skips the taskbar, no longer counts as the app being up. Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(desktop): record VariCAD captured, exported and run in an agentenv computer Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): keep exported views strict JSON for infinite and inexact numbers The exported data/get spells infinite and negative-zero SQLite reals as REA's SQLite reader does ("Infinity", "-Infinity", "-0"), and refuses a JSON file holding a number that reading would change (1e999, integers past 2^53, -0, rounded fractions) with the state view's own error, instead of a view with an infinity in it. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): keep package-file facts tied to one file and URLs unechoed - A --package-url refusal never repeats the URL, and credentials are checked before the scheme. - The package file's identity must hold between dpkg-deb's read and the hash. - A failed close keeps its cleanup owner even when the capture is cancelled. - Readiness also ignores windows typed as splash screens. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): record database logs and keep state changes distinct - A selected path that is not a directory brings its -wal and -journal as content roots, so the capture records whether they exist and retains them. - The state view treats a file as absent only under recorded content roots and refuses a database whose log presence is unknown. - JSON changes list containers too, so an array that becomes an object with the same members is a change. - Key file entries escape the key as a JSON pointer segment, so [a/b] c and [a] b/c stay apart. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): keep watching through unread samples and late workers - An unreadable window list is unknown, not zero windows, and is named in the limitations. - Before ending the session, live run-token carriers no parent link reached are tracked; an unreadable process table leaves the exit unknown. - An env prefix's assignments find the program and name its XDG folders. - flatpak run options that take a value are skipped with it, -- is honoured and a /arch/branch suffix is dropped from the id. - State directories include the entry's full id. - Path options refuse empty values; roots count toward the entry limit. - A capture file whose close failed stays owned and is retried on discard. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): bound apt sources, keep older captures and cleanup owners - Sources files parse into one stanza per line or deb822 paragraph with its URIs and suites kept as lists, so no URI x suite product is built. - Repository architectures and release are optional, so captures written before they were recorded parse; the export treats them as unrestricted and unknown. - Library sources are matched against every index of a declared repository's URI, suite and components. - Two failures side by side keep both causes and both cleanup owners, and a host file whose close fails reports a lease on its handle. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): match escaped key file entries and suggest containers through members - The draft's key file lookup uses the state view's escaped `group/key`, so a key holding `/` or `~` still gets its suggestion. - JSON and XML changes now list containers too; the draft suggests an added or removed container through its listed members, and a container only when none of its members is listed. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): read relative PATH entries from the launch folder A program, or an empty or relative PATH entry, is resolved from the folder the program starts in, as the launch does, so `env PATH=. app` with the entry's Path still finds the app. Co-Authored-By: Claude Opus 5.5 <[email protected]> * perf(desktop): compare JSON views on one shared path JSON and XML changes are found by walking both trees with one shared pointer path, building a pointer only for a listed value, so memory follows depth rather than every container's full path. A pointer over 4096 characters is counted but not listed. A 256-level document with 4000-character keys went from about 251 MiB of heap to under 1 MiB. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): keep JSON Lines as text in the exported reader The exported reader parses the whole text before an inexact number makes it JSON with an error, so JSON Lines with an integer above 2^53 stay text as in REA. Over-long integer spellings are unsafe without converting them. The guide no longer claims large integers keep their value. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): keep the state-path help free of dash-led words The CLI alias check reads `-wal` and `-journal` in help text as short flags, so the help names the write-ahead log and rollback journal instead. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): never record or export apt source credentials - Source URIs lose any user name and password as they are parsed, the way apt splits them, and so do index-target URIs and descriptions and the sources apt-cache policy lists, so matching works whether or not apt prints them. - A repository whose entry held credentials is marked `uri_credentials_removed`, and the export refuses it, or an older capture whose URI still holds them, with a reason that names no URL. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): look programs up without normalizing their paths Program paths and PATH entries are joined rather than resolved, so `..` after a symbolic link means what it means to the launch. The lookup moves to its own module. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): note inexact JSON numbers with a flag, not a list The exported reader only needs to know whether any number was inexact, so it keeps a boolean instead of every rejected spelling. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): refuse older captures that still hold apt credentials A capture written before credentials were removed counted the credentialed repository's libraries as installable, so the export refuses it whole and asks for a new capture rather than declaring packages no source offers. Recorded policy sources are redacted in export messages too. Co-Authored-By: Claude Opus 5.5 <[email protected]> * test(desktop): keep the credential fixture on an example host A login on a real host reads as a secret to the commit scanner, so the older capture's fixture uses apt.example.com like the other credential tests. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): tidy looked-up paths and search relative entries only for env Empty and `.` segments are dropped from a looked-up program path, which keeps `/snap/bin/` entries recognisable as snaps, while `..` is still left for the kernel. Relative and empty PATH entries are searched only in the PATH an `env` prefix sets, which travels with the exported launch; the host's own PATH does not. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): keep excluded and unwalked database logs unknown The capture records the paths every walk left out, and the state view treats a log as absent only under content roots the baseline walked completely and outside those exclusions, so an excluded or unvisited log leaves the database unread rather than read without it. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): judge JSON numbers after duplicate keys settle The exported reader marks an inexact number instead of flagging it during the parse, then looks for marks in the parsed value, so a number a later duplicate key overwrote no longer refuses the file, as in REA. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): redact a repository's policy source when it names it An older capture whose policy source matched no sources entry kept that text whole, and the export named the repository by it; the export now names it without any user name or password. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): never signal the launch group on unknown membership When the current read cannot observe a carrier's process group, the carrier is signalled on its own instead of letting an older process-table row grant a group-wide SIGTERM. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): look programs up in the launch's order and refuse host-relative finds The lookup searches PATH as the launch does, an empty entry meaning the launch folder, so inspection and launch name the same program. A program found only through a relative or empty entry of the host's own PATH is refused, since the exported computer would not have it; an env prefix's PATH travels with the command. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): count unchecked paths and keep logs behind them unknown Each walk counts the paths it could not stat and the directories on another device it did not enter, and the checkpoint records it as `unchecked_paths`. The state view treats a log as absent only when the baseline left nothing unchecked, so a log whose stat failed stays unknown. Co-Authored-By: Claude Opus 5.5 <[email protected]> * perf(desktop): scan parsed JSON with one iterator per level The check for marked numbers walks the parsed value with an iterator per nesting level instead of copying each container's children; a million-entry array went from about 15.7 MiB to 8.1 MiB of peak traced memory. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): start a relative program from its captured folder An exported launch whose program path is relative, such as `./app` from an entry's Path, now changes to the captured working directory first, as it already did for relative arguments. Co-Authored-By: Claude Opus 5.5 <[email protected]> --------- Co-authored-by: Claude Opus 5.5 <[email protected]> * fix(electron): reject non-directory scenario roots before launch (#8967) * fix(contracts): align managed example MethodDef scope (#8966) * docs(debugger): document configurable session limits (#8963) * docs(debugger): document configurable session limits * docs(debugger): clarify GDB control command deadlines * docs(debugger): qualify configurable GDB output budget * docs(debugger): clarify one-shot CLI settings scope * docs(debugger): preserve repository line endings * docs(testing): explain npm launcher selection in PowerShell (#8962) * docs(mcp): explain PowerShell launch environment scope (#8961) * docs(mcp): explain PowerShell launch environment scope * docs(mcp): qualify saved setup selections and OpenCode environment * fix(native): declare temporary filesystem writes for inspect_macho (#8959) * fix(environment): retain ID ordering with missing clocks (#8957) * fix(environment): retain ID ordering with missing clocks * fix(environment): compare known creation clocks across gaps --------- Co-authored-by: hhang <[email protected]> * fix(gpu): distinguish ELF string scan limits from corruption (#8955) Co-authored-by: hhang <[email protected]> * fix(setup): replace the fixed Hopper download deadline with a stall timeout (#7150) * fix(setup): replace the fixed Hopper download deadline with a stall timeout Hopper package downloads aborted after a fixed 120 s, which was also the largest deadline the download owner accepted. The current 32 MB Linux package needs about 132 s at the reporter's sustained 245 KB/s, so setup could never finish on that connection, and the timeout surfaced only as Node's generic abort message. Abort a download when no response bytes arrive for 30 s, or when it outlives a 15-minute overall bound, with a tagged HopperDownloadTimeoutError that names the URL, the limit reached and the bytes received. Linux and macOS setup already relay a thrown download error's message; the Linux publisher now keeps it for release metadata and public key fetches instead of a generic verification failure. Metadata and key fetches keep their 10 s bound. Refs #7077 Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(setup): keep the macOS release feed on the metadata limit The stall-timeout change left the macOS release feed fetch on the package download bounds. That fetch could then wait up to 15 minutes instead of the 120 s it had, while the installation guide says release metadata keeps a 10 s limit. Only the Linux publisher owned that limit. Move the 10 s metadata limit into HopperDownload.ts beside the package bounds. The Linux feed and key fetches use it, and the macOS installer now passes it for its feed fetch through the installer host. Co-Authored-By: Claude Opus 5.5 <[email protected]> --------- Co-authored-by: Claude Opus 5.5 <[email protected]> * fix(cli): parse environment-serve --port and --host like rea mcp --http (#7092) * fix(cli): parse environment-serve --port and --host like rea mcp --http environment-serve declared --port as a number, so incur coerced the flag text with Number(): an empty --port= bound an ephemeral port instead of failing, and 0x1F90 or 1e3 were reinterpreted. --host accepted whitespace. docs/cli.md says these flags resolve like rea mcp --http, which accepts only decimal port text and a non-empty trimmed host. The flags now use the same rules and are refused before binding. * refactor(cli): reuse the shared MCP listener port and host schemas * fix(adb): separate unresolvable paths and host capacity in adb spawn failures (#6188) * fix(adb): name unexecutable adb paths in readiness refusals When REA_ADB_PATH or the PATH-resolved adb is a directory or a file the host refuses to execute, the version probe fails at spawn with EACCES or EPERM. That fell through to the generic "did not report a usable version" refusal, which named neither the path nor the cause. Classify those spawn errors as binary_not_executable (provider rejection executable_missing), name the selected path and errno, and give remediation for the environment, PATH and host-policy cases. The generic fallback now names the selected path too. Fixes #5689 * fix(process): admit synchronous spawn errors as captured failures Node throws spawn errors other than EACCES, EAGAIN, EMFILE, ENFILE and ENOENT synchronously from execFile. execFileBytes called execFile inside its Promise executor, so ENOTDIR or EPERM became a rejection without capture fields and execFileOutputFailure returned undefined. Consumers that classify by failure code, such as the adb version probe, could not see the code, which left the adb EPERM branch unreachable. Catch synchronous spawn errno errors at the capture boundary and attach the same empty capture an asynchronous spawn failure carries. Argument validation errors stay unadmitted. The adb version probe now reports an ENOTDIR selected path, such as a REA_ADB_PATH whose parent is a regular file, as a missing binary with the filesystem error code instead of the generic version refusal. * fix(process): expose spawn failures from the capture owner execFileBytes knows when a command never started, but ExecFileOutputFailure did not say so, so consumers reread raw syscall and code fields and disagreed. Mark both the synchronous throw and an asynchronous `spawn <path>` error with `spawnFailed: true`, and set `path` on the synchronous error to match the asynchronous shape. Argument validation errors stay unadmitted. Consumers now use the owner field: - inspectAdbClient never reports a spawn errno as `exit_code`. ENOENT, ENOTDIR, ELOOP and ENAMETOOLONG are `binary_missing`; EACCES and EPERM stay `binary_not_executable`; any other spawn errno, such as EINVAL, is `binary_not_executable` with a path-naming "could not be started" message. Each records `filesystem_error` and `path_source`. EACCES remediation also names parent directory search permission, and EPERM remediation no longer names host policy as the only cause. - DarwinProcessRunTokenReader tags every not-started compiler as `spawn_failed`, not only ENOENT. EACCES, EPERM and ENOTDIR were previously `failed`. - NativeDmgArtifactReader uses one not-started rule for both `processNotStarted` (previously `spawn ` only, so synchronous errors were missed) and the ENOENT unavailable/io split (previously any `spawn` prefix). Its fake hosts now reject with real execFileOutput spawn failures. * fix(process): classify spawn failures consistently across consumers Admit synchronous and asynchronous spawn errnos through one helper that requires an errno and a `spawn` or `spawn <path>` syscall. The synchronous shape now also gains `spawnargs`, so both shapes match. Use the owner's `spawnFailed` fact in the remaining consumers: - inspectAdbClient reports exhausted host capacity (EAGAIN, EMFILE, ENFILE, ENOMEM) as a host failure to retry and no longer tells the caller to change REA_ADB_PATH. Path-resolution errnos come from a predicate the filesystem owner exports. - runAdbCapture says adb could not be started instead of claiming an exit code for a process that never ran. - The Darwin compiler probe words every spawn_failed outcome as a start failure, not a compilation failure. - Asset catalog inspection treats any assetutil that never started as unavailable, not only ENOENT. * fix(process): report host spawn capacity as a retryable constraint Spawn errnos that report exhausted host capacity (EAGAIN, EMFILE, ENFILE, ENOMEM) were classified by adb readiness alone. assetutil reported them as an unavailable tool, which marked inspect_asset_catalog unavailable in the session, and adb commands reported them as protocol failures. Classify them once in the process capture owner and report a retryable capacity constraint with recovery advice from assetutil and adb commands. * docs(adb): describe host capacity failures from device operations * fix(adb): report exhausted host spawn capacity as runtime unavailability A host that cannot start adb for lack of process, memory or descriptor capacity is not a configuration problem. Give it its own failure code and map it to the runtime_unavailable provider rejection instead of not_configured. * fix(adb): report probe-time host capacity as a retryable constraint A device operation whose adb version probe could not start for lack of host capacity was refused as capability_unavailable without retryable. It now reports the same retryable capacity constraint as a later adb command. * fix(adb): keep the selected adb path in probe-time capacity errors The retryable capacity constraint raised at the version probe dropped the selected_binary and path_source diagnostics the refusal used to carry. * refactor(adb): keep the spawn-failure fact to adb consumers Restore the DMG reader, Darwin compiler probe and assetutil to main. The capture owner still marks a never-started command, including the spawn errors Node throws synchronously, and only the adb readiness probe and adb commands read that fact. * test(adb): assert spawn-failure facts instead of refusal wording The new adb tests compared complete refusal sentences and banned an old phrase. They now check the errno, selected path, path source and the owner's spawn-failure marker, so wording edits do not break them. * fix(adb): own one host-capacity remediation and cover the spawn route The host-capacity constraint and the configuration failure each carried their own remediation sentence. AdbConfiguration now owns the text and both use it, so the constraint's remediation.action equals diagnostics.remediation. The synchronous spawn-throw test now runs on Node's execFile route and on the owned spawn route adb uses (stopSignal). The provider test covers inspect_adb_client under EMFILE next to list_adb_devices, and the docs say which operations report the retryable capacity constraint and which report runtime_unavailable. * fix(process): report EMFILE and ENFILE spawn failures without stdio After an EMFILE or ENFILE spawn failure Node creates no stdio, so the owned stop-signal route threw a TypeError while reading the streams and the later spawn error went unhandled. Attach the error listener first and capture absent streams as empty, so adb reports retryable host capacity. * fix(adb): keep a completed push when host capacity stops its digest check A capacity failure starting sha256sum came back as a retryable error even though adb push had already written the file. Repeating the request with overwrite=false is then refused because the destination exists. Return the receipt with an unavailable device digest and name the capacity failure in its limitations, so the caller is told the transfer is unverified rather than advised to retry. * docs(adb): list host capacity as an unverified push case --------- Co-authored-by: t <t@t> * test(gdb): expect configurable stream truncation diagnostics (#8965) * test(gdb): expect configurable stream truncation diagnostics * build(gdb): include prerequisite duplicate-import repair from #8884 * fix(javascript): resolve module-level Electron options in functions (#8960) * fix(javascript): resolve module-level Electron options in functions * fix(javascript): limit module option ancestry walk * fix(javascript): preserve uncertain captured argument ordering * fix(javascript): retain hoisted activation uncertainty * fix(javascript): retain function ownership through loops * fix(javascript): account for classic global activations * fix(javascript): bind first activations to lexical identities * fix(javascript): retain uncertain global activation timing * fix(javascript): isolate receiver facts and share computed reads * fix(javascript): retain projected and opaque global activations * fix(javascript): refresh activation bounds as opaque effects grow * fix(ci): format website watch directories without changing configuration * fix(javascript): share source reads across opaque-effect updates * fix(javascript): retain constructed-code global activation bounds * fix(javascript): share runtime activation and receiver facts * fix(javascript): reuse pattern reads and function positions * fix(javascript): isolate copied paths and preserve runtime reads * style(javascript): format migrated reference imports * fix(javascript): normalize constructor activation and receiver effects * fix(javascript): retain aliased receiver timing and lexical global this * fix(javascript): preserve effect-free receiver identity across activations * fix(javascript): retain outer activation and prototype effects * fix(javascript): index implicit reads without deep path rescans * fix(javascript): retain aliased prototype and parameter read uncertainty * fix(javascript): index reflected reads through intrinsic invocation facts * fix(javascript): retain unresolved global activation reads * chore: refresh PR branch after review fix publication * fix(javascript): retain projected receiver reads and cache method facts * fix(javascript): retain inherited and implicit activation reads * fix(javascript): retain caller-owned this uncertainty * fix(javascript): retain reflected reads with unresolved spread arguments * fix(javascript): preserve enclosing activation for decorators * fix(javascript): track intrinsic literal prototype effects * fix(javascript): retain catch activation from implicit reads * perf(javascript): reuse effective keys for projected reads * fix(javascript): retain possible caller-owned ambient effects * fix(uninstall): preserve caller-selected Kuna caches during purge (#7921) * fix(uninstall): keep a managed cache namespace whole when it holds a caller-selected Kuna cache purge --purge-data reported a REA_KUNA_CACHE_DIR selection below the default Kuna cache as retained, then removed it together with its parent namespace. A namespace that contains the selection is now retained and reported, so the retained report is true. Fixes #7344 * fix(uninstall): also keep a namespace equal to, or reached by symlink traversal from, the selected Kuna cache Compare the namespace and the selection with the same normalization, treat an equal path as contained, and resolve existing paths before planning so a symbolic link followed by .. is judged by where it leads. * fix(uninstall): judge a selection with parent traversal where the filesystem resolves it Collapsing .. lexically contradicts the existing rule that parent traversal after a symbolic link leads elsewhere, and broke the retained-through-symlink-traversal test. Compare spellings without .. directly and resolve existing paths for the rest, so the symlink-parent case still purges the default cache while a selection that resolves into a managed namespace is retained. * fix(uninstall): keep a namespace whole when the selection's location is unknown A realpath failure other than ENOENT/ENOTDIR (for example EACCES under an inaccessible parent) no longer counts as "absent". Each namespace that may contain the caller-selected Kuna cache is retained instead of purged. Co-Authored-By: Claude Opus 5.5 <[email protected]> --------- Co-authored-by: Claude Opus 5.5 <[email protected]> * fix(changed-behavior): withhold equality for unknowns and contradictions (#7624) find_changed_behavior derived behavior_status from each process comparison's aggregate status alone. An unchanged comparison whose first_divergence was unknown (residual unknowns prevent proving no divergence) and a consistent contradiction comparison both fell through to observed_unchanged, with no unresolved finding and no changed-behavior registry unknown. An unchanged comparison with unknown divergence now counts as unknown and adds one comparison-level unresolved first_divergence finding carrying its reason, as artifact comparisons already do for coverage. A contradiction status makes the aggregate unknown, and contradiction dimensions are classified and counted as contradictions instead of unresolved branches. Complete unchanged comparisons stay observed_unchanged and changed comparisons with unknown localization stay observed_changed. Fixes #7384 Fixes #7383 Co-authored-by: Claude Opus 5.5 <[email protected]> * fix(process): reject contradictory filesystem capture facts (#7631) * fix(process): reject captures whose top-level filesystem facts contradict their checkpoints A process capture records its filesystem state twice: files_before, files_after and filesystem_effects at the top level, and the initial and final filesystem_checkpoints. Validation never reconciled the two, and comparison reads only the checkpoints. A caller-authored capture recording a created file at the top level while its final checkpoint was empty was therefore accepted and compared as unchanged. Semantic validation now requires the initial checkpoint to match files_before with no effects, and the final checkpoint to match files_after and filesystem_effects. The native producer builds both representations from the same snapshots, so produced captures are unaffected; consistent created-file captures still compare as changed. Fixes #7371 Co-Authored-By: Claude Opus 5.5 <[email protected]> * test(process): cover file-list checkpoint mismatches independently of effects Every rejected case in the checkpoint-consistency test also disagreed on effects, so removing both file-list comparisons left it passing. Add initial and final checkpoint cases whose file lists alone disagree while effects and coverage accounting stay valid. Co-Authored-By: Claude Opus 5.5 <[email protected]> --------- Co-authored-by: Claude Opus 5.5 <[email protected]> * fix(process): report deadlines expiring during final cleanup (#7635) * fix(process): report a deadline that elapses during final cleanup as a timeout runOwnedCommand checked its absolute command deadline before awaiting process cleanup, but on the ordinary successful path it consulted only the caller's cancellation signal afterwards. A command whose deadline expired while successful cleanup was still awaited therefore resolved as success. After cleanup, an elapsed deadline now throws OwnedCommandFailure with reason "timeout" and the completed snapshot, as docs/tool-design.md requires a final signal check after the last awaited finalization step. Existing primary failures, caller cancellation and incomplete-cleanup classification keep their precedence. Fixes #7369 Co-Authored-By: Claude Opus 5.5 <[email protected]> * test(process): drive the cleanup-deadline regression with controlled time The regression test gave output collection 100 ms of real time before the deadline. On a busy worker the deadline could expire during collection instead, taking a different failure path and failing the test even with the fix. Use fake timers, wait until cleanup has started, then advance past the deadline and release cleanup, so the ordering no longer depends on worker speed. Co-Authored-By: Claude Opus 5.5 <[email protected]> --------- Co-authored-by: Claude Opus 5.5 <[email protected]> * fix(enhanced): bound batch decompile input size (#5937) * fix(artifacts): handle early ASAR extraction cancellation (#5672) * fix(artifacts): own source errors during output setup * fix(artifacts): join silent source destruction before returning * fix(artifacts): retain source cleanup failures with primary errors * fix(artifacts): join source finalization and classify secondary failures * fix(firmware): separate source cleanup from output rollback * fix(artifacts): retain live source cleanup dependencies * fix(artifacts): preserve source failure completion and semantics * fix(artifacts): retain scope cleanup owners and typed failures * fix(artifacts): keep cleanup classification and admission recovery When the operation completed and only scope cleanup failed, keep the cleanup failure's own reason instead of reporting io, matching main (fixes artifactProvider.cleanupRetry). When a typed primary is rebuilt with pending scope cleanup, carry its userMessage and ASAR header admission so callers keep the configured ceiling and setting. * fix(artifacts): translate plain file-close failures through the reader path The outer file-cleanup branch rebuilt every ArtifactFileCleanupFailure as a ProviderAdapterError, so dyld reads lost their io, unavailable, format and cancelled reasons and their exact file-cleanup cause. Compose separately only when the failed primary owns its own translation (a domain error, source failure or scope cleanup failure); raw and reader primaries are already projected by the file failure with its exact lease. * fix(artifacts): bound source destruction by cancellation and keep wrapper admission After cancellation, SafeOutputTree.write could wait indefinitely for a source whose destruction did not settle, both in the destroy join and in the iterator's wait for close. Both waits now end at cancellation plus a fixed 1 s grace, modeled on the process-output closure grace. A destruction that outlives it is reported as incomplete source cleanup under an exact lease that releases only once closure is observed without a late error. ArtifactResourceCleanupFailure and SafeOutputSourceFailure now keep the primary's admission, matching withCleanup. * fix(artifacts): keep one settled wait while observing a stuck source observeClosure raced the same pending close promise against a new timer every 10 ms, so a source whose destruction never settled accumulated one reaction per poll for as long as it stayed open. Each poll now waits on its own promise that the close listener or the unref'd timer settles, leaving one pending wait and one close listener. The lifecycle test also asserts that a late close releases the retained owner without an explicit retry. * fix(artifacts): settle pending reads before cancellation * test(artifacts): observe the consumed ZIP iterator on cancellation * test(artifacts): validate projected cleanup resources before sorting * test(mcp): reserve parent capacity for timeout recovery * fix(artifacts): contain ASAR cancellation before output consumption * test(artifacts): hash ASAR cancellation fixture bytes * fix(decompile): retain inventory limitations and selection (#8466) * fix(decompile): retain inventory limitations with the latest selection The manifest and decompile index dropped procedure-inventory limitations, so a directory separated from its Evidence response could not explain why functions were selected or omitted. Keep those limitations on the manifest and in a latest_run index record that also names the filter and counts that produced them. Older runs remain represented only by their retained function records. Fixes #8355 * test(decompile): surface export errors and check function caveats Address review findings on the inventory-limitation regression: - Throw the typed export error instead of returning from a failed Result. - Assert historical function records keep their own pseudocode caveats and do not receive the latest inventory warnings. * fix(pyinstaller): leave PE carrier binary members unmarked (#6730) The Windows bootloader sets no execute bit on extracted ARCHIVE_ITEM_BINARY members (the S_IXUSR fchmod in pyi_archive.c is #ifndef WIN32). Mark type b members executable only when the carrier dialect is posix. * fix(jeb): reconnect after stale MCP sessions (#3754) * fix(jeb): reconnect after stale MCP sessions * fix(jeb): preserve failures for overlapping MCP requests * fix(jeb): make cleanup operations explicit and stabilize timeout fixtures * fix(setup): flag unresolved migrated Claude Desktop storage (#8971) * fix(setup): flag unresolved migrated Claude Desktop storage * fix(setup): preserve Claude MSIX process view when config is unresolved * fix(enhanced): restore batch input record limit * docs(tool-design): audit agent workflow guidance (#8439) * docs(tool-design): audit agent workflow guidance * docs(tool-design): check deployed guidance versions * fix(cli): align ADB directory and package query schemas (#8974) * fix(cli): align ADB directory and package query schemas * fix(cli): preserve ADB selector correction details * fix(devicetree): reject duplicate node paths in Evidence (#8970) * fix(pe): classify valid DOS targets as unsupported (#7530) fix(pe): classify confirmed DOS targets as unsupported Signed-off-by: Rudy Celekli <[email protected]> * fix(native): reject nonzero reserved ELF dynamic symbols (#7528) fix(native): validate the reserved ELF dynamic symbol Signed-off-by: Rudy Celekli <[email protected]> * fix(evidence): traverse large source link sets safely (#8457) * fix(verification): use inspected Ghidra JDK (#8440) * fix(mcp): clarify retained dossier handoff in crash prompt (#8437) * fix(evidence): clarify unsupported view recovery (#8412) * fix(evidence): clarify unsupported view recovery * fix(evidence): explain sensitive capture view refusal * test(ghidra): check regex recovery at its owning boundary (#8578) * test(ghidra): check structured snapshot profile mismatch (#8536) * test(ghidra): check retained historical snapshot evidence (#8381) * test(ghidra): check retained historical snapshot evidence * test(ghidra): select historical observations by address * test(cli): cover Frida argument admission and spawn ordering (#3356) * fix(cli): reject spawn arguments in Frida attach mode * test(cli): remove redundant Frida recorder assignments --------- Co-authored-by: Kaoru0822 <[email protected]> * fix(ghidra): report restricted-host temp write denial on Windows (#8889) * fix(ghidra): report restricted-host temp write denial on Windows Add a Windows doctor check that creates and deletes a file under os.tmpdir(), and classify a denied java_home.save in Ghidra startup output with its path, Win32 error 5, and TMP/TEMP remediation. The probe covers REA's own process only; a host that restricts only child processes is reported from the child's output at startup. Fixes #7075 * fix(ghidra): probe the session root and retain failed probe cleanup The Windows doctor temp_directory probe now writes under ghidraSessionRoot(), the same root Ghidra session runtimes use, instead of os.tmpdir(), which can differ when the inherited temp path has a dot-prefixed element. A probe file whose removal fails is retained on the doctor resource owner so doctor shutdown retries the removal; the result still reports its path. * fix(cli): normalize exit status on worker cleanup failure (#8049) (#8050) * fix(cli): normalize exit status on worker cleanup failure (#8049) * test(cli): verify SDK output status and finalization rejection on exit * ci: retrigger checks --------- Co-authored-by: Sarthak Pandey <[email protected]> * fix(gdb): keep inferior-tty verification for read-only queries (#5539) * fix(gdb): keep TTY verification across read-only inferior-tty inspection The console command path cleared `inferiorTtyVerified` before dispatching any command whose text merely mentioned `inferior-tty`, so the read-only `show inferior-tty` query permanently revoked a persistent session's verified output sink; no in-session path ever restored the flag, and a later close of a live session failed detach verification with capability_unavailable. Exempt the exact read-only query forms (`show inferior-tty` and the MI `-inferior-tty-show`) from the output-mutation predicate; every other command mentioning the TTY setting keeps revoking, so mutating commands still fail closed and detach keeps re-reading the live TTY before detaching. Cover the query forms, composite commands, and the inspect-then-close detach path with regression tests. Fixes #5099 * test(gdb): classify show inferior-tty in the one-shot table and rename the TTY classification table - Add a 'show inferior-tty' row to the 'classifies one-shot GDB commands' table: the read-only query no longer invalidates the detach proof, a user-visible one-shot behavior change. - Rename the 'classifies read-only inferior TTY queries as non-mutating' table to 'classifies inferior TTY commands' since two of its rows are mutation cases. - Assert via the existing recorded-commands array that the inspected 'show inferior-tty' text is actually dispatched, and add an execute-path assertion that the MI '-inferior-tty-show' form leaves the verified-sink flag intact (defensive exemption: REA's own MI calls do not route through this gate). --------- Co-authored-by: akushonkamen <[email protected]> * fix(browser): report an out-of-range generated position as a selection fault (#7133) trace_web_source_location reported a well-formed generated_position past the end of the selected script as invalid_format on generated_position, with no bounds, so callers were told their input was malformed and not which coordinate to change. Report out_of_range on the line or column that is past the end, with its valid bounds, as export_web_scripts and inspect_web_network_capture now do for their selections. The position scan now returns the bound it ran past, so the offset and the reported limit come from one pass and cannot disagree on line terminators. Fixes #7132 * fix(captures): classify unresolvable capture paths as capture_path input (#7814) * fix(captures): classify unresolvable capture paths as capture_path input Fixes #7636 * test(captures): cover unresolvable descriptor paths --------- Co-authored-by: Abelo9996 <[email protected]> Co-authored-by: morluto <[email protected]> * fix(apple): preserve exact integer precision with post-table plist objects (#8910) * fix(javascript): resolve electron findings through aliases of interop results (#8914) * fix(javascript): resolve electron findings through aliases of interop results * fix(javascript): resolve interop aliases iteratively and check target mutations * fix(javascript): retain possible writes through uncertain aliases and guard positive reads * perf(javascript): cache alias change status across semantic interop lookups * fix(javascript): transient Windows private-runtime source-transfer (#8769) * fix(javascript): transient Windows private-runtime source-transfer Parent source-transfer into the Windows private runtime root failed with EPERM on path-based exclusive create. Write through a native transient private-runtime path that closes the handle after flush so per-job rm still works, and yield around the sync write so abort deadlines can fire. * fix(javascript): yield timer phase before Windows source-transfer write * fix(il2cpp): reject module image references outside retained inventory (#8956) * fix(ida): admit Docker host-gateway names as local MCP hosts (#8932) Containerized REA reaches an IDA MCP server on the container host through host.docker.internal (Docker, Podman compatibility) or host.containers.internal (Podman). The HTTP registration refinement only admitted localhost, 127.0.0.1 and [::1], so doctor reported the valid gateway registration as invalid_configuration. Admit both gateway names in the registration's local-host set. The refinement still requires http or https, no URL credentials, and refuses every other host. Fixes #8925 * fix(mcp): report target after failed open (#8613) * fix(mcp): report target after failed open * test(session): cover failed open receipt ownership * test(session): verify restored target receipt * test(mcp): retain target on snapshot mismatch * test(mcp): retain oversized open failure receipts * test(cli): avoid continuing session receipt in one-shot errors * fix(mcp): report provider after failed switch * test(ghidra): verify failed open preserves annotations * test(mcp): join queued receipt request before cleanup * test(session): assert open failure receipts in lifecycle suites * test(session): keep open-failure receipt checks within function limits Move the provider-collision case and snapshot fixture setup out of the functions that grew when both failure receipts were asserted. --------- Co-authored-by: Cursor Agent <[email protected]> * fix(prompts): include existing static artifact investigation routes (#8972) * fix(prompts): include existing static artifact investigation routes * fix(prompts): preserve workflows in existing family scopes * fix(prompts): require readers for Apple resource routes * fix(rizin): keep debug targets off the debugger command stream (#8647) * fix(rizin): keep debug targets off the debugger command stream A Rizin debug target inherited Rizin's stdin, which is REA's command stream. Once resumed, a target that reads stdin consumed REA's commands, so close returned cleanup_incomplete and the one-shot CLI hung. Route the target's stdin to the caller-selected TTY alongside stdout and stderr. Before detaching, refuse a target whose stdin is still the command stream, so a Rizin or backend that ignores the key gets a specific, retained failure instead of a resumed target and a timeout. Fixes #8642 Co-Authored-By: Claude Opus 5.5 <[email protected]> * test(rizin): keep the stdin test launcher's descriptors under dash The launcher gated its target with `cat "$2" >/dev/null`. dash applies a simple command's redirection to the shell itself until the command returns, so on Ubuntu the waiting shell's fd 1 was /dev/null, and that shell is the target REA reads in /proc. All 8 Linux-gated tests then failed the existing output-descriptor check. macOS /bin/sh is bash, which redirects only in the forked child, so this did not show locally. Gate without any redirection. Production code is unchanged. Co-Authored-By: Claude Opus 5.5 <[email protected]> * test(rizin): reject unmodeled commands and own cleanup at acquisition Address review of the stdin regression tests. The launcher accepted any unknown line, so the marker that followed could complete it, and assertions only checked that commands were present. An added `dc` or a repeated `olj` still passed. It now records an unknown line and exits, and the tests pin the exact command sequence. Cleanup hung off module state assigned after setup finished, so a failed setup left its directory and terminal child behind. Each resource now registers its own finish hook when acquired, using createTestTempDirectory. Success checks throw the typed error instead of asserting `.ok`, and the refusal probe no longer sits inside a loop and conditional. Production code is unchanged. Co-Authored-By: Claude Opus 5.5 <[email protected]> --------- Co-authored-by: Claude Opus 5.5 <[email protected]> * fix(ci): align tests with current evidence contracts * feat(native): report binary hardening for ELF, PE and Mach-O (#8524) * feat(native): report binary hardening for ELF, PE and Mach-O Documents inspect_binary_hardening and its CLI equivalent, including per-property states, supporting evidence, read budgets, and one report per Mach-O slice. Explains that missing protection imports remain unknown, signature presence does not establish validity, and hardened runtime requires inspect_signature. Adds hardening links throughout the documentation. The supplied diff also removes the advanced CodeQL workflow and configuration, along with snapshot-binding mismatch guidance. * fix(native): validate declared payloads and dynamic tables before hardening rows Run the shared range checks for ELF, read imports from the dynamic tables rather than section metadata, and keep an unresolved symbol count apart from an absent table. Check every Mach-O command before building rows and retain only the offsets the rows need. Make the verifier's readelf output wide, check the emitted format before parsing Mach-O, and place the sources before the libraries in the link. * fix(native): share Mach-O segment admission with hardening reads A segment with a section count its cmdsize cannot hold passed the hardening reader and could enable restrict_segment. Move the size, section count and file range checks to a shared admission that readMachoImage and the hardening reader both use, and pin the ELF load-size case with a regression test. * fix(hardening): reject Mach-O section payloads past the slice and empty ELF interpreters Segment admission never checked each section's payload range, so a file-backed section past the slice still produced rows. Decode sections with the section header owner and mark the slice malformed when a payload leaves it; zero-fill and empty sections own no file bytes and are exempt. admitInterp accepted a NUL first byte in a longer extent, which counted an empty interpreter as PIE evidence. It now requires a nonempty path. Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01KuWHGvzJkrhCqjtEHUwqyH * fix(native): read CFG instrumentation from decoded GuardFlags Use the IMAGE_GUARD_CF_INSTRUMENTED flag that guardFlagRecord already decodes instead of masking the raw GuardFlags word a second time. * fix(native): reject ELF table spans a second PT_LOAD remaps The hardening reader mapped DT_STRTAB, DT_SYMTAB and hash tables through the one PT_LOAD containing the table's first address. A second PT_LOAD starting inside the table could map the rest of it from other file bytes and the reader still reported parsed import evidence. Cap each mapping at the next PT_LOAD that starts inside it, reject a requested range that crosses that boundary, and stop hash reads at the same limit, matching the conflicting-mapping refusal in readElfSymbols. * fix(native): dedupe ELF note tables only on shared boundaries The hardening reader dropped any note table whose bytes another table already covered. A covering SHT_NOTE can hold a non-GNU note whose descriptor is itself a complete GNU property note, while PT_NOTE names that inner note directly. Walking only the outer stream missed the GNU marker and reported CET disabled. Drop an alias only when it starts and ends on boundaries of admitted tables, which are note boundaries of the walked streams. Any other covered alias leaves the feature rows unknown, as a partial overlap already does. * fix(native): admit every Mach-O symbol record after a canary match The Mach-O stack protector scan returned as soon as it found an undefined ___stack_chk_fail, so a later undefined symbol whose n_strx lay outside the string table was never checked. The same damaged table parsed or failed as malformed depending only on record order. Keep the match and finish the bounded record walk. Records after the match are only checked against the string table bounds, so their names are not read or charged to the scan budget. The ELF reader already admits its whole symbol table before matching names. * fix(native): accept ELF load aliases with the same file translation The hardening reader treated every PT_LOAD that starts inside a table, or that also contains the table's address, as a conflicting mapping. A load with the same address-to-file translation names the same file bytes, so tables it overlaps still have one interpretation, and the canonical ElfLoadMap already merges such spans. Treat equivalent loads as one interpretation. A load with a different translation, or the zero-filled tail of an equivalent load, still ends the usable range, so a remapped table is still rejected. * fix(native): keep same-span ELF note tables with different alignments unknown A section and a program header that share endpoints were treated as one note stream even when their effective note alignments differed. Walking the same bytes at 4 and 8 can frame different notes, so dropping the second table could hide a GNU property word and report CET or BTI as disabled. Require matching effective alignment at both endpoints, and no alignment change inside the covered span, before treating a table as an alias. Otherwise mark the feature rows unknown. The fixture's .note.gnu.property section now declares the class's note alignment, as toolchains emit it. * refactor(native): read LC_SYMTAB through the shared fixed-word decoder Move the Mach-O fixed uint32 command layouts out of MachoCommandNames into domain/apple/machoLoadCommands so there is one owner of those offsets. MachoCommandNames and the hardening reader now both decode through it; the hardening reader keeps its own bounds and import policy. * fix(native): skip Mach-O common definitions in canary imports A common definition sets N_UNDF|N_EXT like an import but stores its allocation size in n_value. An object holding only `int __stack_chk_fail;` therefore reported stack_protector: enabled. Require a zero n_value before an undefined external counts as an import, for both nlist widths. * refactor(native): read linkedit data commands through the shared fixed-word decoder readMachoLinkeditDataCommand reproduced the dataoff/datasize offsets that FIXED_WORD_FIELDS already owns. Take the command and decode through decodeMachoFixedWordFields, as readMachoSymtabCommand does, keeping the truncation and endianness behavior. * fix(native): skip empty SHT_NOTE sections in ELF hardening A zero-sized SHT_NOTE owns no bytes, so the section directory marks it not file-backed and the hardening reader rejected the whole image as malformed, while readElfImage accepted the same bytes. Skip empty note sections before the file-backing check; they have nothing to walk. * fix(scripts): run hardening verifier commands through the shared owner The binary hardening verifier started its probes and compiler drivers with raw spawnSync, which bypassed the src/process/ supervision that AGENTS.md requires. Every launch now goes through createVerifierCommands, and the temporary root is removed only after the owner closes cleanly. * fix(scripts): clean up hardening verifier commands on Ctrl-C SIGINT or SIGTERM ended Node before withVerifierCleanup ran, so detached compiler trees and the temporary root could outlive the verifier. The verifier now turns those signals into an abort that every owned command receives, so cleanup closes the owner and removes the root before exit. * fix(scripts): fail the hardening verifier when a signal lands outside a command Only the owned commands read the interruption signal, so a SIGINT or SIGTERM during the final cleanup or between commands was recorded and then dropped, and the verifier exited 0. After cleanup settles, the verifier now throws the interruption reason. A failure the operation or its cleanup already raised still leaves first and is not replaced. * fix(native): fail Mach-O slices with a malformed encryption command The hardening reader turned every malformed status from the shared encryption reader into an unknown `encrypted` row, so a short LC_ENCRYPTION_INFO_64 or an encrypted range past the slice still left the slice parsed with a full report. Only two conflicting encryption commands stay an unknown row now. Any other encryption defect fails the slice like other structural command failures. * fix(native): ignore STB_LOCAL undefined ELF symbols as imports A local undefined __stack_chk_fail or __memcpy_chk is never resolved against another object, so it does not establish an external import. Skip STB_LOCAL bindings when reading protector signs, and give the fixture's positive symbols STB_GLOBAL binding. --------- Co-authored-by: Matt Van Horn <[email protected]> Co-authored-by: Claude Opus 5.5 <[email protected]> --------- Signed-off-by: Rudy Celekli <[email protected]> Co-authored-by: Kaoru0822 <[email protected]> Co-authored-by: Claude Opus 5.5 <[email protected]> Co-authored-by: Edgar Arakelyan <[email protected]> Co-authored-by: ShuaixinHuang <[email protected]> Co-authored-by: highmachs <[email protected]> Co-authored-by: hhang <[email protected]> Co-authored-by: hhang <[email protected]> Co-authored-by: Paritosh Lahre <[email protected]> Co-authored-by: Adolanium <[email protected]> Co-authored-by: 김준호 <[email protected]> Co-authored-by: t <t@t> Co-authored-by: Hasan Zayni <[email protected]> Co-authored-by: Salman Almutairi <[email protected]> Co-authored-by: Lucien <[email protected]> Co-authored-by: RRFZ <[email protected]> Co-authored-by: 2SinceJuly <[email protected]> Co-authored-by: Wade <[email protected]> Co-authored-by: Martin Klein <[email protected]> Co-authored-by: morluto <[email protected]> Co-authored-by: Rudy Mizrahi Celekli <[email protected]> Co-authored-by: xin zhuang <[email protected]> Co-authored-by: Beqa <[email protected]> Co-authored-by: NoThing <[email protected]> Co-authored-by: Sarthak Pandey <[email protected]> Co-authored-by: akushonkamen <[email protected]> Co-authored-by: akushonkamen <[email protected]> Co-authored-by: amyanger <[email protected]> Co-authored-by: Abel Yagubyan <[email protected]> Co-authored-by: Abelo9996 <[email protected]> Co-authored-by: Jiabin Yin <[email protected]> Co-authored-by: Cursor Agent <[email protected]> Co-authored-by: Mohamed Ayoub Eleuch <[email protected]> Co-authored-by: Kaoru0822 <[email protected]> Co-authored-by: Matt Van Horn <[email protected]> Co-authored-by: Matt Van Horn <[email protected]> Co-authored-by: gensokyo-dev <[email protected]>	2026-11-06 02:06:39 +08:00
3 people	560674e2de	feat(native): report binary hardening for ELF, PE and Mach-O (#8524) ... * feat(native): report binary hardening for ELF, PE and Mach-O Documents inspect_binary_hardening and its CLI equivalent, including per-property states, supporting evidence, read budgets, and one report per Mach-O slice. Explains that missing protection imports remain unknown, signature presence does not establish validity, and hardened runtime requires inspect_signature. Adds hardening links throughout the documentation. The supplied diff also removes the advanced CodeQL workflow and configuration, along with snapshot-binding mismatch guidance. * fix(native): validate declared payloads and dynamic tables before hardening rows Run the shared range checks for ELF, read imports from the dynamic tables rather than section metadata, and keep an unresolved symbol count apart from an absent table. Check every Mach-O command before building rows and retain only the offsets the rows need. Make the verifier's readelf output wide, check the emitted format before parsing Mach-O, and place the sources before the libraries in the link. * fix(native): share Mach-O segment admission with hardening reads A segment with a section count its cmdsize cannot hold passed the hardening reader and could enable restrict_segment. Move the size, section count and file range checks to a shared admission that readMachoImage and the hardening reader both use, and pin the ELF load-size case with a regression test. * fix(hardening): reject Mach-O section payloads past the slice and empty ELF interpreters Segment admission never checked each section's payload range, so a file-backed section past the slice still produced rows. Decode sections with the section header owner and mark the slice malformed when a payload leaves it; zero-fill and empty sections own no file bytes and are exempt. admitInterp accepted a NUL first byte in a longer extent, which counted an empty interpreter as PIE evidence. It now requires a nonempty path. Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01KuWHGvzJkrhCqjtEHUwqyH * fix(native): read CFG instrumentation from decoded GuardFlags Use the IMAGE_GUARD_CF_INSTRUMENTED flag that guardFlagRecord already decodes instead of masking the raw GuardFlags word a second time. * fix(native): reject ELF table spans a second PT_LOAD remaps The hardening reader mapped DT_STRTAB, DT_SYMTAB and hash tables through the one PT_LOAD containing the table's first address. A second PT_LOAD starting inside the table could map the rest of it from other file bytes and the reader still reported parsed import evidence. Cap each mapping at the next PT_LOAD that starts inside it, reject a requested range that crosses that boundary, and stop hash reads at the same limit, matching the conflicting-mapping refusal in readElfSymbols. * fix(native): dedupe ELF note tables only on shared boundaries The hardening reader dropped any note table whose bytes another table already covered. A covering SHT_NOTE can hold a non-GNU note whose descriptor is itself a complete GNU property note, while PT_NOTE names that inner note directly. Walking only the outer stream missed the GNU marker and reported CET disabled. Drop an alias only when it starts and ends on boundaries of admitted tables, which are note boundaries of the walked streams. Any other covered alias leaves the feature rows unknown, as a partial overlap already does. * fix(native): admit every Mach-O symbol record after a canary match The Mach-O stack protector scan returned as soon as it found an undefined ___stack_chk_fail, so a later undefined symbol whose n_strx lay outside the string table was never checked. The same damaged table parsed or failed as malformed depending only on record order. Keep the match and finish the bounded record walk. Records after the match are only checked against the string table bounds, so their names are not read or charged to the scan budget. The ELF reader already admits its whole symbol table before matching names. * fix(native): accept ELF load aliases with the same file translation The hardening reader treated every PT_LOAD that starts inside a table, or that also contains the table's address, as a conflicting mapping. A load with the same address-to-file translation names the same file bytes, so tables it overlaps still have one interpretation, and the canonical ElfLoadMap already merges such spans. Treat equivalent loads as one interpretation. A load with a different translation, or the zero-filled tail of an equivalent load, still ends the usable range, so a remapped table is still rejected. * fix(native): keep same-span ELF note tables with different alignments unknown A section and a program header that share endpoints were treated as one note stream even when their effective note alignments differed. Walking the same bytes at 4 and 8 can frame different notes, so dropping the second table could hide a GNU property word and report CET or BTI as disabled. Require matching effective alignment at both endpoints, and no alignment change inside the covered span, before treating a table as an alias. Otherwise mark the feature rows unknown. The fixture's .note.gnu.property section now declares the class's note alignment, as toolchains emit it. * refactor(native): read LC_SYMTAB through the shared fixed-word decoder Move the Mach-O fixed uint32 command layouts out of MachoCommandNames into domain/apple/machoLoadCommands so there is one owner of those offsets. MachoCommandNames and the hardening reader now both decode through it; the hardening reader keeps its own bounds and import policy. * fix(native): skip Mach-O common definitions in canary imports A common definition sets N_UNDF|N_EXT like an import but stores its allocation size in n_value. An object holding only `int __stack_chk_fail;` therefore reported stack_protector: enabled. Require a zero n_value before an undefined external counts as an import, for both nlist widths. * refactor(native): read linkedit data commands through the shared fixed-word decoder readMachoLinkeditDataCommand reproduced the dataoff/datasize offsets that FIXED_WORD_FIELDS already owns. Take the command and decode through decodeMachoFixedWordFields, as readMachoSymtabCommand does, keeping the truncation and endianness behavior. * fix(native): skip empty SHT_NOTE sections in ELF hardening A zero-sized SHT_NOTE owns no bytes, so the section directory marks it not file-backed and the hardening reader rejected the whole image as malformed, while readElfImage accepted the same bytes. Skip empty note sections before the file-backing check; they have nothing to walk. * fix(scripts): run hardening verifier commands through the shared owner The binary hardening verifier started its probes and compiler drivers with raw spawnSync, which bypassed the src/process/ supervision that AGENTS.md requires. Every launch now goes through createVerifierCommands, and the temporary root is removed only after the owner closes cleanly. * fix(scripts): clean up hardening verifier commands on Ctrl-C SIGINT or SIGTERM ended Node before withVerifierCleanup ran, so detached compiler trees and the temporary root could outlive the verifier. The verifier now turns those signals into an abort that every owned command receives, so cleanup closes the owner and removes the root before exit. * fix(scripts): fail the hardening verifier when a signal lands outside a command Only the owned commands read the interruption signal, so a SIGINT or SIGTERM during the final cleanup or between commands was recorded and then dropped, and the verifier exited 0. After cleanup settles, the verifier now throws the interruption reason. A failure the operation or its cleanup already raised still leaves first and is not replaced. * fix(native): fail Mach-O slices with a malformed encryption command The hardening reader turned every malformed status from the shared encryption reader into an unknown `encrypted` row, so a short LC_ENCRYPTION_INFO_64 or an encrypted range past the slice still left the slice parsed with a full report. Only two conflicting encryption commands stay an unknown row now. Any other encryption defect fails the slice like other structural command failures. * fix(native): ignore STB_LOCAL undefined ELF symbols as imports A local undefined __stack_chk_fail or __memcpy_chk is never resolved against another object, so it does not establish an external import. Skip STB_LOCAL bindings when reading protector signs, and give the fixture's positive symbols STB_GLOBAL binding. --------- Co-authored-by: Matt Van Horn <[email protected]> Co-authored-by: Claude Opus 5.5 <[email protected]>	2026-11-06 01:07:00 +08:00
morluto	65986d0a0f	docs(tool-design): audit agent workflow guidance (#8439) ... * docs(tool-design): audit agent workflow guidance * docs(tool-design): check deployed guidance versions	2026-11-05 17:28:48 +08:00
Edgar ArakelyanandClaude Opus 5.5	970969cb53	feat(desktop): capture and export apps installed from a downloaded .deb (#8954) ... * feat(desktop): capture a Linux desktop application in use Add `capture-desktop-application`, a CLI-only, Linux and X11 capture that launches an installed desktop application, watches it while it is used and writes capture Evidence plus SHA-256 addressed content: - inventory: desktop entry, launch command, executable, package and its apt sources (or snap, flatpak, AppImage), Electron markers and candidate state directories; - session: the launched process tree, client windows from xprop with the first application window time and a window match, and files held open; - state: a stat walk of the home directory before launch, at checkpoints read from stdin, at stop and after exit, with created, modified, deleted and retyped paths and the content of changed files and state directories. It refuses non-Linux hosts, missing DISPLAY or xprop, a non-empty output folder and an application whose window is already open, and signals only processes it started. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): own launched processes, confirm walk coverage and keep cancelled captures - Launch through the owned provider path with a run token; release with SIGTERM, then the token-verified group cleanup, after every session. Processes without the token are never signalled; each records whether it carries it, and the session records whether cleanup was verified. - Report creations and deletions only where a walk listed the nearest existing directory; count the rest as unconfirmed. - Retain a file only when it is still the walked version, through owned no-follow reads; charge the budget only for new content; create files exclusively in a private output folder owned by the caller. - Walk content roots outside the home directory, compare paths in their physical spelling, and run executables from the caller's directory. - Refuse when the window list cannot be read, re-evaluate window ownership each sample, handle one queued request per sample with a bounded stdin queue, and write the capture with end reason `cancelled` on interruption. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): keep owned cleanup failures and fresh digests - Allow a capture cancelled before any requested checkpoint to hold only the baseline. - Retry an incomplete stop once; if cleanup is still unverified, write the capture and fail with the run token and process group as cleanup resources. - Classify path changes after a walk (ENOTDIR and other selected-file errors) as changed_since_walk instead of failing the capture. - Treat a non-directory ancestor as proof that nothing existed beneath it. - Report a before digest only for the file version it was read from. - Derive stderr_truncated from stderr's own byte counts. Co-Authored-By: Claude Opus 5.5 <[email protected]> * wip(desktop): state view over a capture folder Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): keep failed file-handle closes owned for retry Content reads pass retainFailedClose, so a handle whose close fails stays owned by the content store; the capture retries those closes after it is written and fails with the output folder as the cleanup resource if one still cannot be closed. Co-Authored-By: Claude Opus 5.5 <[email protected]> * feat(desktop): read a captured application's state Add inspect-desktop-application-state, a CLI command that reads a capture folder into the application's state: every retained or changed file with its role and reasons, a typed JSON view of each version (SQLite through the shared worker, dconf through a private dconf dump, JSON, XML, key files, text) and the kinds of change between versions (lines, values, keys, rows). Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): report process and handle cleanup failures together When both the launched processes and a retained file's handle remain unresolved after the capture is written, one cleanup error now lists both reasons and both resource sets. Co-Authored-By: Claude Opus 5.5 <[email protected]> * feat(desktop): export a captured application as an agentenv computer app Add export-desktop-application, which writes an agentenv bundle with one computer_app environment from a capture folder and its state view: the apt package, a boot launch matched on the captured window class with a window ready check, owned paths from the state roles, a seed of the baseline files, data hooks that call agentenv's add/get/reset helpers with a typed JSON view on get, a skill, a README and a deploy smoke task. The desktop CLI commands now load their services lazily. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): keep state views faithful to the capture - Read key files, XML attributes, dconf groups and SQLite tables into dictionaries without inherited properties, so captured keys such as __proto__ stay data. - Version databases with their write-ahead log as of each checkpoint, and stage only digest-verified bytes for the SQLite and dconf readers. - Detect the format per version, report format changes, keep JSON null and empty containers as values, keep XML text and preserved whitespace, and mark truncated views (including XML depth) and comparisons of them. - Number versions and changes by checkpoint index, decide baseline presence from the captured type, and keep tagged SQLite integers, text bytes and blobs distinct. - Carry the capture's limitations and omitted content forward, match state directories by their home path, index changes once per capture, keep failed handle closes owned, and finish the CLI through the shared owner. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): keep coverage, logs and handles honest in the state view - Read coverage flags only from formats whose readers write them, so JSON fields named truncated stay data. - Fail a SQLite version whose write-ahead log existed but was not retained or does not match its digest, instead of reading the database alone. - Close retained content on every exit, including cancellation, and report a close that still fails together with the primary failure. - Finish the CLI with the canonical operation name. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): export only what the computer can install and seed - Refuse packages not from the Ubuntu 24.04 archive, since the computer installs by name from that archive. - Start the launch command in the captured working directory. - Respell the home path only in files the state view read as text. - Report files that were not retained instead of dropping them silently. - Load captured dconf keys for apps that own no files. - Keep home-level files as owned paths; rename reserved Python class names. - Mark truncated SQLite and text views in the class's get view, and read file types the way the state view does. - Release the output tree through a resource scope, and read seeds through an owner closed on every exit. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): keep staged folders owned, symlinked state roots and XML values - Stage database bytes in a private runtime root released through a resource scope, so a failed removal keeps its owner and is reported with the read's outcome. - Report cleanup facts and owners from desktop failures instead of wrapping them as a plain adapter error. - Record the state directories as walked, in their physical spelling, and match roles against both spellings, so files in a symlinked state directory are not mistaken for selected documents. - Keep whitespace-only XML leaf values; drop only formatting between elements. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): read XML in the exported app the way the state view does Keep whitespace-only leaf values and xml:space="preserve" text in the generated get view; drop only formatting between elements. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): release retained handles with their owners, read older captures - Release retained-content handles whose close failed through a resource scope on every exit; a release that fails again reports the exact handle owners. A read that finished keeps its bytes when only its close failed. - Accept captures written before state directories were recorded, and say in the state view's limitations that symlinked state directories may be misclassed for them. - Compute each XML element's whitespace context once instead of scanning siblings for every text run. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): boot without the working folder, bound XML, accept mirrors - Try the captured working directory only when an argument is relative, and start the app even when that folder is missing. - Cut the generated XML view at REA's node and depth limits, and keep one unreadable file from failing data/get. - Accept Ubuntu 24.04 mirrors, not only the canonical hosts; PPAs and other repositories are still refused. - Read seeds through the retained-content owner's new signature. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): state view review round - Stage a retained -journal beside its database so the SQLite worker accepts an inactive journal and refuses a hot one; a -wal or -journal that existed but was not retained (including one omitted at the baseline) makes the version unreadable. - Keep tables that read when another fails, and let cancellation and unfinished cleanup propagate instead of becoming view errors. - Read text as a key file only when every line parses as one. - Rank a file named in a window title or selected by the caller as a document even when the application holds it open; match titles on file-name boundaries; leave the display name out of dconf matching. - Bound JSON and key file views (4 MiB, 500 levels, exact numbers) and report too-large, missing and altered retained content separately. - Add no version or change while a database stays absent. - Read staged databases in place instead of copying them again. - Give Evidence the same limitations as the result. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): export review round - Load captured dconf keys without D-Bus: install dconf-cli, compile the existing and captured key files into the user database, and warn on failure instead of stopping the server. - Start relative-argument launches in the captured working directory, the home included, since the framework launches from the app folder; respell the home itself and option values under it. - Read views in a thread, skip files over 64 MiB, align the generated readers with the state view's, and close SQLite connections. - Never own the home or a shared base folder; map a symlinked state directory's files back to their home spelling. - Report omitted files and unretained opened folders. - Name the module so it cannot shadow another, and keep the class off the module's own names; derive names the bundle check accepts. - Write seeds as they are read, and remove an unpublished bundle on failure. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): capture review round - Ask the launch process group and token carriers to exit before killing them, on errors too; report incomplete cleanup with its facts. - Count descendants of the launch as started by the capture even when their environment cannot be read; treat a reused pid as a new process. - Follow symlinked desktop entries; name a flatpak's state after its application id; match flatpak windows by name only. - Stop on end of input; refuse empty, duplicate and reserved checkpoint names; require whitespace after the checkpoint keyword. - Stay on each walk root's device, and never walk or retain `/` or a directory containing the home; say so in the limitations. - Refuse a window manager that does not publish _NET_CLIENT_LIST. - Remove retained content when a capture fails before it is written. - Skip reading a file larger than the remaining content budget. - Record apt's archive origin for each package source. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): read an unset client list as no windows when supported xfwm4 leaves _NET_CLIENT_LIST unset while it manages no windows, so the capture refused an ordinary desktop with nothing open. Read _NET_SUPPORTED with the list: an unset list means no windows when the window manager supports it, and the capture is refused only when it does not. `xprop`'s "no such atom" output now reads as unset too. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): accept packages by apt's archive origin Accept a package source when apt reports its origin as Ubuntu for a noble suite, so mirrors count and PPAs or other repositories that merely have "ubuntu" in their URL do not. Captures made before origins were recorded fall back to Canonical's own archive hosts. Seed reads report why retained content could not be used. Co-Authored-By: Claude Opus 5.5 <[email protected]> * feat(desktop): capture and export apps from vendor apt repositories A closed-source app installed from its vendor's apt repository, such as Typora, can now be captured and exported as a computer app. - The capture records each non-Ubuntu repository listing the installed version (uri, suite, components from apt's sources files, one-line or deb822) and the key that signs it: the signed-by key, or the trusted key that gpgv shows verifies the repository's signed index. The key is retained with the capture. - The capture records the packages owning the libraries the executable loads (DT_NEEDED with RUNPATH and the linker cache, through REA's ELF readers), since a vendor package may not depend on them. - The export declares a verified vendor repository as an AptSource with its key, installs a vendor package's library packages, and adds --no-sandbox to an Electron app's launch, since a container denies Chromium's sandbox. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): report a locked database at once in data/get A database the running app holds locked made each data/get wait sqlite's five-second busy timeout before reporting it. Record the Typora run in an agentenv computer in the verification. Co-Authored-By: Claude Opus 5.5 <[email protected]> * perf(desktop): detect key files without splitting the whole text Read lines one at a time and stop at the first that a key file view would drop, instead of splitting a file of up to 64 MiB into arrays before its format is known. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): keep symlinked homes and state folders under the home in exports - Respell a path under its state folder's logical spelling only when that spelling is under the captured home, so a symlinked HOME keeps its files; pair walked and logical state folders only when the capture lists the same number, and match the innermost folder first. - When two files map to one home path, keep the one present before the capture and name the other in the limitations. - Read key files in the generated data/get with the state view's rule, checked against it by running the helper under python3. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): end captures on zombies and keep cleanup owners - A zombie or dead process no longer keeps the session open. - Remove only the partial capture file this run created. - Keep the exact owners of handles and processes whose cleanup failed on the returned error, so a retry can release them; test the published capture's cleanup-failure branch with mixed outcomes and retries. - Release the application once even when the exit checkpoint fails. - A cancellation before the capture is written removes what it retained. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): vendor package review round - Match apt sources through `apt-get indextargets`, which covers flat `./` and `/` suites and gives each release file and sources entry. - Accept a key whose signature verifies even when the release carries another signature without a key here; keep only the verifying key from a keyring holding several (OpenPGP packet splitter). - Install the package from its repository's release (`name/<release>`), declare one source per URI and suite, support only the capture host's architecture, and refuse Ubuntu Pro repositories. - List only library packages the computer can install; walk libraries only for vendor installs, with RPATH inherited as ld.so does, normalized paths, and DT_NEEDED bounded while reading. - Put --no-sandbox after the program an env wrapper launches; keep the gpgv folder's owner when its removal fails; respect --max-file-bytes for keys; wait 0.25 s on a busy SQLite database in data/get. Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(desktop): keep the vendor spec's gpgv command on one line A code span broken across lines left `<binary keyring>` for VitePress to read as an unclosed HTML tag, so the docs build failed. Co-Authored-By: Claude Opus 5.5 <[email protected]> * feat(desktop): add a validated task to exported desktop applications Each capture can now yield one agentenv task in its exported bundle. An agent writes the task (a prompt plus declarative checks over the app's data/get views); REA validates it and stays model-free. - `describe-desktop-application-task` summarises a capture's net change per file (role, format, views before and after) and drafts checks. - Checks: file presence, lines present/absent/counted, JSON-pointer values, SQLite rows and counts. REA keeps a task only if a check fails on the seed and every check passes on the captured end state; a file that was not retained at the baseline counts as absent, as the computer starts. - `export-desktop-application --task` writes tasks/NAME.json (deploy, agent, skills, recording, prompt, verifier), a compiled verify.py that reads data/get, and an eval. A boundary test runs the verifier under python3 and checks it agrees with REA's evaluator on every check kind. - Docs, spec and skill guidance, with the solve-rate recipe. Co-Authored-By: Claude Opus 5.5 <[email protected]> * test(desktop): keep the seed test in its own block Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(desktop): record the task verifier driven in an agentenv computer Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(desktop): record the Typora task run in an agentenv computer Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): keep task checks bounded, complete and attributable - line_count counts lines holding a substring (contains) instead of matching a regular expression, which could stall the verifier on agent-written text and read differently in Python. - value_equals of a whole object or array is undecided on a truncated view. - The draft keeps a database whose rows changed under an unchanged hash, and a file whose truncated views match while it changed. - A task file that cannot be read keeps the reader's detail, and a failed cleanup keeps the read failure as its primary. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): leave a file with one version out of the task draft Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(desktop): update the task verification's test counts Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(desktop): record the task solve rate with Claude Code and Sonnet 5.5 Co-Authored-By: Claude Opus 5.5 <[email protected]> * feat(desktop): capture and export apps installed from a downloaded .deb capture-desktop-application --package-file reads the file's control fields with dpkg-deb and records its SHA-256, size and dependencies when it holds the installed package; the file itself is never kept. The library walk now also runs for local installs. export-desktop-application --package-url declares agentenv's Download(url, sha256) for that file, its dependencies and library packages as apt packages, and a run script that installs it with dpkg. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): seed app-named dotfiles and respell UTF-16 seeds The capture now treats dotfiles in the home named after the application (.varicad-cfg.ini, .notesrc) as state roots, so a file the app only reads during the capture is still seeded. The exported seeding respells the captured home in UTF-16 text files with a byte-order mark, keeping the mark. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): hold readiness until the app's own window shows An exported app is ready only once a window of its class that the taskbar lists is shown, so a splash screen of the class, which skips the taskbar, no longer counts as the app being up. Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(desktop): record VariCAD captured, exported and run in an agentenv computer Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): keep exported views strict JSON for infinite and inexact numbers The exported data/get spells infinite and negative-zero SQLite reals as REA's SQLite reader does ("Infinity", "-Infinity", "-0"), and refuses a JSON file holding a number that reading would change (1e999, integers past 2^53, -0, rounded fractions) with the state view's own error, instead of a view with an infinity in it. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): keep package-file facts tied to one file and URLs unechoed - A --package-url refusal never repeats the URL, and credentials are checked before the scheme. - The package file's identity must hold between dpkg-deb's read and the hash. - A failed close keeps its cleanup owner even when the capture is cancelled. - Readiness also ignores windows typed as splash screens. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): record database logs and keep state changes distinct - A selected path that is not a directory brings its -wal and -journal as content roots, so the capture records whether they exist and retains them. - The state view treats a file as absent only under recorded content roots and refuses a database whose log presence is unknown. - JSON changes list containers too, so an array that becomes an object with the same members is a change. - Key file entries escape the key as a JSON pointer segment, so [a/b] c and [a] b/c stay apart. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): keep watching through unread samples and late workers - An unreadable window list is unknown, not zero windows, and is named in the limitations. - Before ending the session, live run-token carriers no parent link reached are tracked; an unreadable process table leaves the exit unknown. - An env prefix's assignments find the program and name its XDG folders. - flatpak run options that take a value are skipped with it, -- is honoured and a /arch/branch suffix is dropped from the id. - State directories include the entry's full id. - Path options refuse empty values; roots count toward the entry limit. - A capture file whose close failed stays owned and is retried on discard. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): bound apt sources, keep older captures and cleanup owners - Sources files parse into one stanza per line or deb822 paragraph with its URIs and suites kept as lists, so no URI x suite product is built. - Repository architectures and release are optional, so captures written before they were recorded parse; the export treats them as unrestricted and unknown. - Library sources are matched against every index of a declared repository's URI, suite and components. - Two failures side by side keep both causes and both cleanup owners, and a host file whose close fails reports a lease on its handle. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): match escaped key file entries and suggest containers through members - The draft's key file lookup uses the state view's escaped `group/key`, so a key holding `/` or `~` still gets its suggestion. - JSON and XML changes now list containers too; the draft suggests an added or removed container through its listed members, and a container only when none of its members is listed. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): read relative PATH entries from the launch folder A program, or an empty or relative PATH entry, is resolved from the folder the program starts in, as the launch does, so `env PATH=. app` with the entry's Path still finds the app. Co-Authored-By: Claude Opus 5.5 <[email protected]> * perf(desktop): compare JSON views on one shared path JSON and XML changes are found by walking both trees with one shared pointer path, building a pointer only for a listed value, so memory follows depth rather than every container's full path. A pointer over 4096 characters is counted but not listed. A 256-level document with 4000-character keys went from about 251 MiB of heap to under 1 MiB. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): keep JSON Lines as text in the exported reader The exported reader parses the whole text before an inexact number makes it JSON with an error, so JSON Lines with an integer above 2^53 stay text as in REA. Over-long integer spellings are unsafe without converting them. The guide no longer claims large integers keep their value. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): keep the state-path help free of dash-led words The CLI alias check reads `-wal` and `-journal` in help text as short flags, so the help names the write-ahead log and rollback journal instead. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): never record or export apt source credentials - Source URIs lose any user name and password as they are parsed, the way apt splits them, and so do index-target URIs and descriptions and the sources apt-cache policy lists, so matching works whether or not apt prints them. - A repository whose entry held credentials is marked `uri_credentials_removed`, and the export refuses it, or an older capture whose URI still holds them, with a reason that names no URL. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): look programs up without normalizing their paths Program paths and PATH entries are joined rather than resolved, so `..` after a symbolic link means what it means to the launch. The lookup moves to its own module. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): note inexact JSON numbers with a flag, not a list The exported reader only needs to know whether any number was inexact, so it keeps a boolean instead of every rejected spelling. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): refuse older captures that still hold apt credentials A capture written before credentials were removed counted the credentialed repository's libraries as installable, so the export refuses it whole and asks for a new capture rather than declaring packages no source offers. Recorded policy sources are redacted in export messages too. Co-Authored-By: Claude Opus 5.5 <[email protected]> * test(desktop): keep the credential fixture on an example host A login on a real host reads as a secret to the commit scanner, so the older capture's fixture uses apt.example.com like the other credential tests. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): tidy looked-up paths and search relative entries only for env Empty and `.` segments are dropped from a looked-up program path, which keeps `/snap/bin/` entries recognisable as snaps, while `..` is still left for the kernel. Relative and empty PATH entries are searched only in the PATH an `env` prefix sets, which travels with the exported launch; the host's own PATH does not. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): keep excluded and unwalked database logs unknown The capture records the paths every walk left out, and the state view treats a log as absent only under content roots the baseline walked completely and outside those exclusions, so an excluded or unvisited log leaves the database unread rather than read without it. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): judge JSON numbers after duplicate keys settle The exported reader marks an inexact number instead of flagging it during the parse, then looks for marks in the parsed value, so a number a later duplicate key overwrote no longer refuses the file, as in REA. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): redact a repository's policy source when it names it An older capture whose policy source matched no sources entry kept that text whole, and the export named the repository by it; the export now names it without any user name or password. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): never signal the launch group on unknown membership When the current read cannot observe a carrier's process group, the carrier is signalled on its own instead of letting an older process-table row grant a group-wide SIGTERM. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): look programs up in the launch's order and refuse host-relative finds The lookup searches PATH as the launch does, an empty entry meaning the launch folder, so inspection and launch name the same program. A program found only through a relative or empty entry of the host's own PATH is refused, since the exported computer would not have it; an env prefix's PATH travels with the command. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): count unchecked paths and keep logs behind them unknown Each walk counts the paths it could not stat and the directories on another device it did not enter, and the checkpoint records it as `unchecked_paths`. The state view treats a log as absent only when the baseline left nothing unchecked, so a log whose stat failed stays unknown. Co-Authored-By: Claude Opus 5.5 <[email protected]> * perf(desktop): scan parsed JSON with one iterator per level The check for marked numbers walks the parsed value with an iterator per nesting level instead of copying each container's children; a million-entry array went from about 15.7 MiB to 8.1 MiB of peak traced memory. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(desktop): start a relative program from its captured folder An exported launch whose program path is relative, such as `./app` from an entry's Path, now changes to the captured working directory first, as it already did for relative arguments. Co-Authored-By: Claude Opus 5.5 <[email protected]> --------- Co-authored-by: Claude Opus 5.5 <[email protected]>	2026-11-05 15:14:04 +08:00
3 people	5990ff0324	feat(artifacts): read WeChat mini-program wxapkg containers (#8148) ... * feat(artifacts): read WeChat mini-program wxapkg containers Add a read-only reader for plaintext wxapkg packages: the 0xBE/0xED 18-byte big-endian header, the bounded name/offset/size member table, and verbatim member bytes at absolute carrier offsets. - Members retain declared names, absolute offsets and sizes, so source_location reports real carrier positions. - V1MMWX PC-client packages are detected as encrypted coverage with null member facts; extraction refuses with a typed error and no decryption is attempted. - Bounded table and directory budgets are admitted before allocation; malformed marks, truncated tables, invalid UTF-8 names, member extents inside the header or beyond the file, and counts that cannot fit their table are typed format or limit failures. - Member reads stream in bounded 64 KiB chunks with carrier freshness checks; the reader joins outstanding streams before close and bounds active streams and repeated member I/O. Refs #8121. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(artifacts): bound wxapkg members to the declared data region Normalize the two indexLength conventions before the table bounds check and the table read. Member ranges must then lie in that declared data region, which has to fit in the file. Record wxapkg format metadata as not compared: header facts repeat the package bytes, and entry source paths keep a producer root prefix. * fix(artifacts): choose the wxapkg index after member ranges fit Four trailing bytes made the rows-only layout end on the file and dropped the count-inclusive layout. Keep every admitted layout until the parsed rows and member ranges select one. --------- Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: Cursor Agent <[email protected]>	2026-11-05 00:52:20 +08:00
Beqa	7570aabd9d	docs(skill): route SPA passive capture through allowed_origins (#7252) ... Default page-origin scope excludes cross-origin APIs. Point agents at JavaScript analysis for API-origin discovery, require page origin plus API origins in allowed_origins (list replaces default), and bump the packaged skill to version 60.	2026-11-04 19:47:28 +08:00
Kaoru0822andClaude Opus 5.5	93b8b82db7	feat(native): deliver batch decompile as a retained summary (#8631) ... * feat(native): select retained batch decompile results through analysis views A completed batch_decompile could only be read whole. When it did not fit the MCP response budget, or an agent wanted one function, inspect_analysis_view refused the parent as unsupported and the only recovery was exporting the session. - Own the batch result schema in the domain, replacing the contract's copy and the workflow's hand-written item types. - Add summary and batch-decompile views: body-free rows keyed by original index with exact filters and opt-in bodies, and UTF-16 pages of one body. - Report the decompiling provider from the upstream analysis profile, since the Evidence provider is the composing workflow. - Keep batch limitations visibly aggregated rather than attributing them to one successful item. Fixes #8498 Co-Authored-By: Claude Opus 5.5 <[email protected]> * feat(native): deliver batch decompile as a retained summary A batch that fits still floods the caller's context with every body, and one that does not fit only named an export. Selecting a body that cannot fit named an export too, even though its text pages can. - Accept detail: summary on batch_decompile: retain the complete batch first and return its counts, identities and sizes. The default stays complete, and the selection never reaches the Evidence parameters. - Offer a ready-to-call body-free first page when a complete batch overflows. - When a selected batch page overflows, continue from the same retained parent with fewer rows, then with one body's text pages. Refs #8498 Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(native): count every unavailable entry label in a batch summary label_unavailable only counted failed lookups, so a batch whose provider answered null for every label reported zero. The identity contract defines a null name as an unavailable label in both cases. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(native): continue an oversized batch view from the caller's own source A batch view read from an Evidence file or inline record advertised a retained-evidence continuation for a parent the session never retained, so following it failed. A view's continuation now repeats the caller's source and only narrows the selection. An inline record offers none, because it cannot be repeated within the reply it overflowed. Non-batch views skip the selection parse, since delivery asks about every view it returns. Co-Authored-By: Claude Opus 5.5 <[email protected]> * test(native): require advertised batch schemas through the shared validator A local validator map dropped any tool without an output schema, so removing an advertised schema would have left these contract tests green. Require both named schemas and validate through createMcpSchemaValidation, as docs/testing.md asks. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(native): offer file view continuations on servers that retain nothing A fixed-target server reads an Evidence file through inspect_analysis_view but records nothing, so its overflow skipped the continuation and returned generic CLI guidance. A view's continuation names the caller's source and needs no session, so it no longer depends on recording. Retained references still do. Co-Authored-By: Claude Opus 5.5 <[email protected]> --------- Co-authored-by: Claude Opus 5.5 <[email protected]>	2026-11-02 00:50:42 -08:00
Kaoru0822andClaude Opus 5.5	dec8d2d588	feat(native): select retained batch decompile results through analysis views (#8629) ... * feat(native): select retained batch decompile results through analysis views A completed batch_decompile could only be read whole. When it did not fit the MCP response budget, or an agent wanted one function, inspect_analysis_view refused the parent as unsupported and the only recovery was exporting the session. - Own the batch result schema in the domain, replacing the contract's copy and the workflow's hand-written item types. - Add summary and batch-decompile views: body-free rows keyed by original index with exact filters and opt-in bodies, and UTF-16 pages of one body. - Report the decompiling provider from the upstream analysis profile, since the Evidence provider is the composing workflow. - Keep batch limitations visibly aggregated rather than attributing them to one successful item. Fixes #8498 Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(native): count every unavailable entry label in a batch summary label_unavailable only counted failed lookups, so a batch whose provider answered null for every label reported zero. The identity contract defines a null name as an unavailable label in both cases. Co-Authored-By: Claude Opus 5.5 <[email protected]> * test(native): require advertised batch schemas through the shared validator A local validator map dropped any tool without an output schema, so removing an advertised schema would have left these contract tests green. Require both named schemas and validate through createMcpSchemaValidation, as docs/testing.md asks. Co-Authored-By: Claude Opus 5.5 <[email protected]> --------- Co-authored-by: Claude Opus 5.5 <[email protected]>	2026-11-01 23:58:54 -08:00
Kaoru0822andClaude Opus 5.5	cbc69537cd	fix(discovery): carry provider repair instructions into capability discovery (#8532) ... * fix(discovery): carry provider repair instructions into capability discovery Provider readiness reported only a failure description, so capability discovery copied that description into tool_availability remediation and dropped repairs the owners already had: the JEB discovery-deadline setting, the ADB/Apktool execute-permission repair kept in diagnostics, and the IDA and Kuna configuration recovery. Unavailable ProviderAvailability now requires the owner's remediation next to its reason, and readiness-derived unavailable capability descriptors carry it too. Every producer supplies it (ADB, Apktool, JADX, JEB, Ghidra, Hopper, IDA, Kuna, pcap, owned-process prerequisites, profile rejection); the inventory uses it verbatim, falling back to the reason only for static capability facts that declare no repair. ADB/Apktool configuration failures own remediation as a field instead of diagnostics, and execution refusals project it as remediation.action. JADX doctor reads the availability's remediation instead of re-deriving it. binary_session complete candidate availability and unavailable capability groups expose remediation (CLI capabilities/providers too); summary omits it and lists it in omitted_fields. The superseded IDA configuration_remediation and windows_native_failure.remediation diagnostics are removed. Fixes #8506 Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(discovery): keep owner repairs through provider selection and capability maps Address review findings on the readiness-remediation contract: - Provider selection rejections carry the availability owner's remediation, CLI/MCP error details project it, and an explicit selection refused by readiness uses it as remediation.action. IDA's unreadable registration and Ghidra's Windows readiness repair no longer degrade to generic selection advice now that the diagnostics copies are gone. - Ghidra's Windows readiness and existing-project capability maps carry the same repair as the availability. - pcap readiness keeps the limiter owner's repair (now a typed remediationAction) and falls back to Wireshark guidance only when the failure has none. - ADB/Apktool repairs are owner constants that are complete sentences. The execution refusal keeps its previous message-plus-repair recovery, which the compiled CLI contract asserts. - Regression tests compare with the owning formatter or constant and add public MCP and CLI coverage for an explicit IDA selection. Co-Authored-By: Claude Opus 5.5 <[email protected]> --------- Co-authored-by: Claude Opus 5.5 <[email protected]>	2026-11-01 08:57:11 -08:00
Kaoru0822andClaude Opus 5.5	eb39a07966	feat(evidence): read selected complete records without the whole bundle (#8528) ... * feat(evidence): read selected complete records without the whole bundle get_evidence_bundle could discover a record by exact ID, but reading it required the complete canonical bundle: complete + filters was rejected, and inspect_analysis_view refuses parents without a view, such as annotations, pseudocode sources and native traces. - Add detail: records, a page (offset, limit; default 0, 8) of the complete matching records in canonical bundle order. Records keep their original IDs, subjects, providers and readback; missing_evidence_links names direct links of the returned records that are not retained. - The selection is labelled as historical and not an importable bundle; complete keeps returning the canonical bundle, and offset/limit require detail: records. - Filters keep one owner shared by summary and records delivery, for the MCP session and the CLI's inspect-evidence-bundle. - An oversized record page now advises a smaller limit or one evidence_id; whole-bundle overflow guidance mentions record reads. Fixes #8307 Co-Authored-By: Claude Opus 5.5 <[email protected]> * test(evidence): compare record-selection guidance with its owners Assert the record-selection limitations and oversized-page guidance against their owning constants, and check the reported limit facts separately, instead of pinning explanatory phrases. Co-Authored-By: Claude Opus 5.5 <[email protected]> --------- Co-authored-by: Claude Opus 5.5 <[email protected]>	2026-11-01 08:56:58 -08:00
Kaoru0822andClaude Opus 5.5	423059a4de	feat(javascript): page retained feature traces through analysis views (#8522) ... * feat(javascript): page retained feature traces through analysis views A bidirectional trace_application_feature result can exceed one MCP response, and inspect_analysis_view refused trace parents as unsupported, so the only recovery was exporting the whole session. - Add a shared feature-trace view owner: a summary with the trace's identity, producer counts and coverage, and pages of paths, nodes, edges, seed_matches and native_handoffs in retained order with exact filters. Node rows are compact unless observations are requested. Page coverage never upgrades trace coverage. - Accept an optional MCP view on trace_application_feature that retains the complete trace before returning the selected facts; the CLI keeps complete JSON and reads saved traces with inspect-analysis-view. - Offer a ready-to-call first paths page when a retained complete trace exceeds the MCP response budget. - Share the distinct authority/state/confidence basis helper with module references. Fixes #8296 Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(javascript): name the retained parent when a selected view overflows Review follow-up for the feature-trace views. - Share one delivery owner between trace_application_feature and compare_source_to_bundle: stage the selected view against the completed parent, keep the established contract that a cancelled request commits no session facts, then commit sources and the parent. - A selected view that exceeds the response budget now references the retained parent and offers the same selection at half its limit, instead of naming the view record, which cannot be a view parent. - Cover two native handoffs paged one at a time, the oversized selected page, and cancellation after the trace completes. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(javascript): bind feature-trace pages to their collection rows Advertise each feature-trace page with exactly its own row schema, so a paths page cannot validate with node, edge, seed-match or handoff rows. The native-trace view in #8533 received the same review finding; the two sibling views now share one strict page contract. Co-Authored-By: Claude Opus 5.5 <[email protected]> * test(javascript): mix valid rows from another collection into a trace page Co-Authored-By: Claude Opus 5.5 <[email protected]> --------- Co-authored-by: Claude Opus 5.5 <[email protected]>	2026-11-01 08:56:05 -08:00
morluto	60c0cf977a	docs: clarify recovery for valid lookup failures	2026-11-01 17:53:37 +08:00
gensokyo-dev	f72638f6b1	feat(investigation)!: retain records across engine cleanup (#8361) ... Separate engine cleanup, investigation reset and terminal disposal in the shared application owner. Keep stable Evidence IDs and full Unknown revision history through engine close and target changes; serialize reset with all record writers and cleanup owners, optionally acknowledging a complete checkpoint before clearing. Bound retained representation without eviction. Validation: 43 focused files / 533 distinct tests, source/type/lint/schema/documentation checks, nine genuine source cases across eight families, real Ghidra session identity and cleanup, and nine actual local Codex CLI terra/high runs with independent full-result and checkpoint audits. See docs/verification/investigation-lifecycle.md for measurements, partial attempts and verification limits. Fixes #8347. BREAKING CHANGE: close_binary retains investigation records. Use reset_investigation to clear them. Cross-process recovery requires an explicitly acknowledged Evidence bundle checkpoint. Assisted-by: Suika (gensokyo-skills:suika-scatter-gather-planning)	2026-10-31 21:34:45 +00:00
Kaoru0822andClaude Opus 5.5	7c9ed94259	fix(ghidra): decide batch names independently of request order (#8306) ... * fix(ghidra): decide batch names independently of request order The Ghidra bridge applied set_addresses_names in JSON member order, each address in its own transaction, so a reordered but equivalent map could give a shared name, or a name released by another selected address, to a different address. The bridge now resolves every destination (namespace and leaf name) against the names held before the batch. Addresses that request the same destination, or a name that another selected address holds, are rejected without applying; the remaining edits are independent and apply as before. Both naming operations report each failure's canonical address, reason and related addresses. The adapter projects the bridge reply to the unchanged boolean results and keeps the reply as raw_result only when an address failed. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(ghidra): report each contested batch name once A batch conflict listed every other requester on each failure, so k addresses competing for one name produced k(k-1) related addresses, and the adapter retained the whole reply, booleans included, as raw_result. The bridge now reports each contested destination once in a conflicts table with its namespace, name, requesting and holding addresses, and each conflict failure refers to it by index. Conflicts are ordered by their first requester, so indexes do not depend on member order. Single and batch naming share one planner and reply layout. The adapter validates the table in linear time and keeps only failures and conflicts in raw_result. Co-Authored-By: Claude Opus 5.5 <[email protected]> --------- Co-authored-by: Claude Opus 5.5 <[email protected]>	2026-10-31 08:53:11 -07:00
gensokyo-dev	a989c0e458	refactor(evidence): unify retained inputs across domains (#8299) ... Declare logical Evidence sources once and resolve exact retained inputs through shared application workflows across 20 composition tools. Preserve domain-owned authentication, source closure, caller choices, coverage and resource admission. Validation includes public CLI/MCP regressions, local Codex terra/high trials and fresh-import real-artifact workflows. Measurements, failed attempts and coverage limits are recorded in docs/verification/evidence-input-composition-2026-10-31.md. Fixes #8293. Fixes #8281. Assisted-by: Suika (gensokyo-skills:suika-scatter-gather-planning)	2026-10-31 14:45:21 +00:00
Entrpiandmorluto	b43c329df7	feat(artifacts): inventory and extract UF2 and DfuSe firmware containers (#8230) ... * feat(artifacts): inventory and extract UF2 and DfuSe regions open_binary refused UF2 and DfuSe firmware containers as an unsupported format, so inspect_artifact and extract_artifact could not show which bytes a drag-and-drop or DFU update writes at which addresses. UF2 is recognized by a complete first block with all three magic numbers. Valid main-flash payloads are joined into address-contiguous regions per familyID, named family-0x<id>/0x<start>-0x<end>.bin, and known IDs are named from a small table copied from Microsoft's uf2families.json at a pinned commit. Numbering is counted per familyID and block count: absent, repeated, out-of-order and out-of-range block numbers are reported, and absent blocks leave coverage unknown. Not-main-flash blocks are excluded and reported; file-container blocks are reported and leave coverage unknown; invalid blocks and a partial final block are excluded with their position. A rewrite of one address with different bytes fails closed, naming both block spans. DfuSe is recognized only by its prefix together with a DFU 1.1a suffix. Each element becomes one region at its file range with its target's alternate setting and name. Structural faults fail closed with a byte offset; overlapping elements stay separate and are reported. A suffix CRC mismatch follows integrity_policy: fail refuses with a dfu-crc32 integrity error, and record-and-continue records a root contradiction that extraction also carries. HEX, UF2 and DfuSe share one retained-region reader and one run merger, so the HEX decoder and reader lose their private copies. * docs(artifacts): document UF2 and DfuSe images and their esptool lane Describe recognition, region names, metadata, numbering, failures, the DfuSe suffix CRC under integrity_policy, and limits, and link the page from the CLI and firmware guides and the agent skill reference. npm run verify:uf2 runs esptool merge-bin --format uf2 on generated inputs at known addresses, with and without MD5, with 256-byte payloads, and on a concatenation of two chips' outputs. Inspection and extraction through the built CLI must return every input at its address under the familyID esptool itself reports. * fix(artifacts): accept both DfuSe image size conventions UM0391 calls DFUImageSize the file length, and dfu-util's dfuse-pack.py writes that value, while ST's DfuFileMgr, MicroPython's dfu.py and pydfu leave the 16-byte suffix out. The decoder accepted only the second form, so it refused dfuse-pack.py output as malformed. Accept either value and keep the declared one in image_size; any other value still fails with the suffix offset and the file length. The tests pin both producers' output for one image, CRC included, from their build() functions transcribed and run under Python 3. * fix(artifacts): keep reused UF2 block numbers from hiding missing blocks esptool numbers every merged input from 0, so two inputs with the same block count share one numbering group. A block lost from one input left its number present in the other, and the file reported complete coverage. Each block number now records the target addresses it was seen at: equal address counts are complete copies, a resend to the same address is one block, and unequal counts make coverage unknown with a limitation and ambiguous_numbering_group_count. sequence_count becomes numbering_group_count, and region block positions become first_file_block and last_file_block. Review follow-ups in the same change: - compare_artifacts compares a DfuSe element's alternate setting and target name, so bytes moved to another device memory are changed; - the shared reader keeps no region bytes outside its map after close; - one domain type replaces four identical decoder failure types; - the UF2 decoder returns a typed limit instead of throwing on bytes beyond its admitted size, and caps retained regions, not runs; - DfuSe caps elements with bytes only, names empty elements and element-less targets, drops the constant bVersion and bcdDFU fields, and says whether the CRC matches when DFUImageSize fits neither convention; - classification evidence carries a suffix only when the probe saw the end, and root classification reads the tail only for a DfuSe prefix; - the UF2 domain region owns family_name, and the root records the family registry revision; the table's MIT notice is preserved; - docs pin the producer revisions (dfu-util ee6b393d and f9a537c9, MicroPython cb99ca98), give the MD5 structure's real meaning, and describe container contradictions in the MCP contract guide; - tests and the esptool lane add the equal-count inputs and a block lost from one of them, accepted boundaries beside each refusal, a DfuSe root larger than the classification prefix, and CLI refusals. * feat(artifacts): name the UF2 families that LibreTiny builds for LibreTiny writes UF2 for Realtek, Beken and Bouffalo Lab modules. The Microsoft registry revision REA already cites (cf3bd7f9) lists eight of those families: RTL8710A, RTL8710B, RTL8720C, RTL8720D, BK7231U, BK7231N, BK7251 and BL602. Their regions now carry those names. LN882H, which that revision omits, keeps its familyID with no name. * fix(artifacts): count DfuSe declarations without bytes instead of listing them Empty DfuSe elements have no entry, so DFUSE_MAX_ELEMENTS does not cap them, and the target walk kept a description string for each one. At 8 bytes per element, a file under the 128 MiB ceiling can declare about 16.7 million of them. The walk now counts every declaration without bytes and builds only the first NAMED_ELEMENTS descriptions, which is all that the limitation shows. The limitation text and empty_element_count do not change. The guide now says that both DfuSe limitations name the first four. On this host, decoding 4,000,000 empty elements (a 32 MB file) ran out of memory under a 128 MB V8 heap before this change, and it peaked at 1.59 GB RSS with the default heap. It now decodes in 114 ms with a 220 MB peak. --------- Co-authored-by: morluto <[email protected]>	2026-10-31 16:27:00 +08:00
4 people	22e5aa97af	feat(artifacts): inspect classic iNES container regions (#2816) ... * feat(artifacts): inspect classic iNES container regions * fix(artifacts): preserve iNES source disappearance as integrity failure * fix(artifacts): revalidate iNES source before parsing header * fix(artifacts): validate admitted roots before classification * fix(artifacts): normalize source loss during root hashing * fix(artifacts): bind iNES extraction admission to inventory * test(artifacts): clarify non-executing inspection wording * fix: preserve binary plist detection with extended magic probe * test(browser): wait for popup document loads before capture * fix(artifacts): honor cancellation across source validation * fix(artifacts): prefer artifact magic over implicit database suffix * fix(artifacts): select extraction readers from scanned format * fix(artifacts): complete prefix reads and share ZIP format admission * fix(browser): budget scenario cleanup for content drain and shutdown * test(artifacts): admit valid universal inputs before routing * test(artifacts): verify iNES workflows on macOS * test(ci): own iNES macOS coverage and portable fixture paths * fix: preserve cleanup retries and avoid duplicate inventory parsing * fix(contracts): share ZIP target formats across MCP lifecycle schemas * fix(target): preserve typed cancellation during descriptor admission * refactor(artifacts): use JSON-safe inventory producer output directly * test(artifacts): share file read setup and satisfy CI checks * fix(artifacts): classify changed admission as integrity failure * ci: run Mach-O summary delivery coverage on macOS * test(javascript): align parameter provenance with main contract * test(browser): await discoverable fixture pages before runtime verification * fix(artifacts): pass target metadata to format detection * fix(artifacts): bind extraction to opened target * fix: repair the static-check failures on the default branch (#2895) * fix: repair the static-check failures on the default branch The default branch fails its own required `Static checks` job three ways, so every pull request reports that job as failed regardless of its own change. - `npm run format:check` reports `src/domain/functionComparison.test.ts` and `src/ida/IdaOperationRunner.ts`. - `npm run lint` reports a duplicate `import { join } from "node:path"` in `tests/boundary/mcp/ghidraInventoryMcp.test.ts` (lines 4 and 17). - `npm run typecheck` reports `format: "devin"` missing from the client format union in `src/application/SupportedClients.ts`, and an unchecked index in `tests/boundary/cli/clientProfileLifecycle.test.ts`, whose pair array is inferred as `string[][]`. Apply the pinned formatter, drop the duplicate import, list the `"devin"` format that its own definition already uses, and mark the pair array `as const`. Validation: `npm run check:fast` and `npm run format:check` pass. * fix(setup): keep Devin on the JSON configuration dialect --------- Co-authored-by: 吴佳浩 <[email protected]> Co-authored-by: morluto <[email protected]> (cherry picked from commit df3d96da80) * fix(artifacts): bind session inventories to target identity * test(browser): bound fixture readiness acknowledgements --------- Co-authored-by: 64579525 <[email protected]> Co-authored-by: 吴佳浩Alben <[email protected]> Co-authored-by: 吴佳浩 <[email protected]>	2026-10-31 15:49:16 +08:00
Entrpi	e6d0618979	feat(artifacts): inventory and extract ESP flash layouts (#8228) ... * feat(artifacts): inventory and extract ESP32 firmware images ESP32-family app and bootloader images (magic 0xE9) had no reader, so open_binary refused OTA downloads, app partitions and bootloaders. Add the esp-image container format behind inspect_artifact and extract_artifact. A pure decoder reads each byte once and keeps only fixed-size fields. Derived facts cover the chip, from a table cited to ESP-IDF v6.1; segment classification as ESP-IDF's should_map and should_load; checksum and appended SHA-256 results; app and bootloader descriptors; Secure Boot v2 signature blocks, observed and unverified; and undescribed trailing byte ranges. Truncation and undescribed bytes make coverage unknown. ESP8266 images are refused with a specific reason, and ciphertext stays unrecognized. Add the format to every target, Evidence, snapshot, live-summary and artifact vocabulary, document it, and add an optional verify:esp-images lane that compares esptool-built images with esptool image-info and espsecure signature-info-v2. Refs #3615 * test(artifacts): run the ESP image lane on esptool v5.6.0 The lane compared descriptor fields only when esptool image-info printed one, so a descriptor that REA reports and esptool does not print passed without comparison. Compare the descriptor kind in both directions. Record that the lane passed for all 13 images with esptool and espsecure v5.6.0, the version the layout facts cite, as well as with 4.12.0. * refactor(artifacts): define ESP image layout sizes once The decoder and the derived facts each defined the segment-header, appended-digest and flash-sector sizes, the erased-byte scan and the offset formatter. Define them once with the other fixed-layout structures and import them in both places. The signature slot count is the one constant that drives the slot scan. Correct the observedEnd comment: it is the end of the last chunk read. * fix(artifacts): report ESP-IDF's segment length limit by chip ESP-IDF's verify_segment_header rejects a segment of 16 MiB or more unless the chip maps flash through 32-bit cache addresses (SOC_SPI_MEM_SUPPORT_CACHE_32BIT_ADDR_MAP: ESP32-S3, P4, C5, C61, H4 and S31 in v6.1). Record that capability in the chip table and add a limitation for such segments; unknown chips get none. `loaded` repeats should_load. It does not mean the bootloader accepts the segment: verify_load_addresses still rejects one outside the chip's RAM, which REA does not model. Say so in the docs, the skill reference and the inventory limitation. * test(artifacts): check ESP lane tools first and verify extraction The lane started work before checking its tools, so a missing RISC-V target, ld.lld, esptool or espsecure surfaced as a raw spawn or command error. Check each one before building and name the variable to set. Warn when esptool is not v5.6.0, the release the layout facts cite. Assert each segment's class for the ESP32-C3 app, its variants and the bootloader, as the Xtensa image already did. Extract the app and the signed image through the CLI and compare every file with the bytes at esptool's segment offsets or in the appended signature sector; the source's SHA-256 must be unchanged and equal the reported root_sha256. * docs(artifacts): state what the ESP image lane does not establish The Verification section listed the lane's checks but not its gaps: only ESP32-C3 and ESP32 images come from a real producer, no real project build, OTA download or flash dump is inspected, no signature is verified, and the lane does not run in CI. Record the timing of the final lane run on esptool v5.6.0. * fix(artifacts): compare ESP segment declarations Segment entries hash only their data, so compare_artifacts reported a segment that moved to another load address with the same bytes as unchanged; only the image itself changed. Compare each segment's load_addr and data_len as its declaration, as Node SEA and PyInstaller members are compared, and count a changed declaration as a metadata change, also when content is unavailable. Header offsets are layout and the classification is derived, so neither is compared. * test(artifacts): run ESP lane commands as owned process trees The lane ran its tools through execFile. A timeout killed only the direct child, so a linker or assembler that Clang or GCC had started could keep running while the lane removed its workspace. Run every command through createVerifierCommands, check the tools inside withVerifierCleanup, and remove the workspace only after commands.close() has stopped every tree; a failed close keeps the workspace. Only a nonzero exit now counts as a refusal or an expected esptool failure; timeouts and spawn failures propagate. Supervising each command roughly doubles the lane's run time. * test(artifacts): cancel ESP decoding after its first decoded chunk The cancellation test requested cancel or close on setImmediate, which can land while the file is still being opened and checked, so it never showed that decoding had started. It also passed against a reader that ignored both requests while decoding. Acknowledge the decoder's first chunk, then cancel or close, join the operation, and assert that no later chunk reaches the decoder and that the reader ends closed. * docs(artifacts): record which ESP metadata comparison ignores Segments are compared by their declaration. The image's and the signature blocks' format_metadata are not: every field comes from their own bytes, which content comparison already covers, and a block's image_digest_matches follows the image's content. * feat(artifacts): inventory and extract ESP flash layouts A whole-flash dump of an ESP32-family chip was read as its bootloader image, with the partition table, apps and data left as undescribed bytes, or refused when it began with erased flash. Read it as an esp-flash-image container instead. The partition table is decoded as esp_partition_table_verify accepts it and is found at the caller's partition_table_offset, at the default 0x8000, or by scanning 0x1000-aligned sectors for a table whose MD5 verifies, which the inventory reports as derived. The bootloader is located at its chip's ROM bootloader offset. Each partition is an entry with its declaration in flat format_metadata; the bootloader and app partitions carry ESP image facts from the existing streaming decoder; the otadata records are reported with a selection derived without rollback or anti-rollback, and the running partition stays unknown. One unreadable partition does not hide the others, and extraction writes every partition, nvs_keys included, as ordinary data. Flash layouts are detected before single ESP images. The scan runs only when an ESP image sits at a ROM bootloader offset, and is refused when a bootloader at another chip's offset shows that the dump does not start at flash address 0. open_binary gains flash_offset and partition_table_offset, which require format esp-flash-image and are part of the snapshot target identity; the CLI takes them with --target-format esp-flash-image. Comparison treats a partition's label, type, subtype, range and flags as its declaration. * test(artifacts): verify ESP flash layouts with gen_esp32part, merge-bin and otatool Add the optional verify:esp-flash lane. It builds default and relocated partition tables with ESP-IDF's gen_esp32part.py, assembles dumps with esptool merge-bin, including one written from flash 0x1000, and writes OTA records with otatool through flash_file_tool.py, which replaces parttool's esptool calls with reads and writes of the dump file. It compares REA's bootloader and app facts with esptool image-info, every partition with gen_esp32part.py's decoding of the extracted table, and the OTA records and derived slot with otatool read_otadata after each switch. It also checks extracted bytes and source integrity, the scan and caller table offsets, flash_offset on the 0x1000 dump, a corrupted app beside valid partitions and a truncated dump. ESP32 linker scripts place the conformance bootloader and app in ESP32 address ranges. * fix(artifacts): read ESP flash layouts as the bootloader does Read the partition table as bootloader_utility_load_partition_table does: the last factory, otadata and same-subtype OTA declaration wins, and a limitation names repeats. Plan each otadata record within its partition and the dump. An otadata partition smaller than two sectors selects none, the bootloader's INVALID_INDEX; a record the dump lacks leaves the selection unknown while the other record stays reported. The fallbacks follow the bootloader's indexes: ota_0-fallback and factory-fallback name no partition when the table declares none, and the assumptions add GPIO holds and deep-sleep wake. Refuse a dump whose bootloader contradicts its origin before the default table offset is tried, whether flash_offset was omitted or given, and keep the ESP image reader's ESP8266 refusal. A table never lies inside the located bootloader image, so single app images are no longer scanned. An explicit esp-flash-image selection is decided before other container signatures, and the native commands' --target-format no longer takes it. Say when no bootloader confirms the default origin. Exempt the primary bootloader and partition_table entries of ESP-IDF 5.3 from placement limits, report every region inside a longer one, and name partitions by index when labels repeat ignoring case. Keep an undecodable label's bytes in label_hex and compare them. Word undescribed ranges as starting at a byte that is not erased, and treat a short erased region as erased. Add an MCP compare_artifacts test for partition declarations, reader identity and close tests, scan edge cases, the 0x2000 ROM offset and a literal otatool CRC. * test(artifacts): verify ESP primary layout entries and the otadata fallback Build a table with the primary bootloader and partition_table entries that gen_esp32part.py fills from --primary-bootloader-offset, and check that REA reads it with complete coverage, no overlap or misplacement limitation, and a table that agrees with gen_esp32part's decoding. Erase the otadata with otatool after the slot switches and check the records against read_otadata and the factory fallback. * fix(artifacts): keep ESP flash coverage complete for a dump cut short An esptool merge-bin dump ends after the last part it wrote, usually inside its last partition. Such a partition made the layout's coverage unknown, so artifact comparison of two merge-bin dumps reported every unchanged partition as unknown. The partition table names every partition whatever the file's length, so a partition cut short or left out by the end of the file hides no entry. As the ESP image reader does for a cut-short segment, its entry holds the bytes the file has and an entry limitation gives the declared size; a partition with no bytes stays in partitions_outside_dump. Coverage stays complete unless undescribed bytes remain or no bootloader is located. An MCP compare_artifacts test of two dumps that end inside ota_0 now classifies every partition, and fails on the old rule. * fix(artifacts): report written bytes in ESP partitions, erased slots included An app slot is erased for ESP-IDF's bootloader when its image header bytes are erased flash, and REA reported only that status. A slot can still hold data further in: a dump read from a device held a complete older app image 1 MiB into an OTA slot reported as erased, with no limitation. Each partition entry now records where the bytes the dump holds are written, relative to the partition: written_offset, the first byte that is not 0xFF, written_end, just past the last, and written_bytes, how many are not 0xFF. They are null for a partition outside the dump. The status stays erased, which is the bootloader's view, and a limitation names an erased app slot that holds written bytes and says they are not read as an image. The reader reads every partition byte once more to find them. * fix(artifacts): derive the ESP boot selection for every partition table The boot selection lived inside otadata, so a table without an otadata partition, the common factory-only layout, had none. ESP-IDF's bootloader_utility_get_selected_boot_partition returns the factory index when the table declares no otadata partition. Move it to a top-level boot_selection that every layout has. Its basis names the bootloader's branch: otadata, factory-fallback and ota_0-fallback from the records, no-otadata for a table without otadata, none for the bootloader's INVALID_INDEX, and unknown when the dump lacks a record the bootloader reads, which replaces the null selection. running_partition moves with it, and otadata keeps its partition index and records. The assumptions name what each branch leaves out: no records assumption without otadata, and none for none or unknown. The real-tool lane checks no-otadata on a table gen_esp32part built without otadata. * fix(artifacts): say when an ESP image is a flash dump read from 0x1000 An ESP32 dump read from flash 0x1000, as read-flash 0x1000 or merge-bin --target-offset 0x1000 writes it, opened automatically as its bootloader image with a megabyte of undescribed bytes and no next probe. The flash reader refuses that origin, but nothing told an agent which flash_offset to pass. espFlashDumpOrigin owns the inference: an image of a chip whose ROM loads the bootloader from flash R, at file offset F, is the bootloader of a dump read from R - F when a partition table sits where that origin puts 0x8000. The ESP image reader asks it for a non-app image at file offset 0, so the result does not depend on how the reader was created, and records flash_dump {flash_offset, table_file_offset}, null otherwise, with a limitation that says to reopen the file as esp-flash-image with that flash_offset. inspect_artifact proposes the same open_binary call as a next probe, and the flash reader's misplaced-origin refusal names the offset. * perf(artifacts): summarize nested ESP images in the flash layout summary view The summary view returned an ESP flash layout's root facts whole, so each app partition and the bootloader carried every segment and signature block, about half of a dump's summary. The summary view now gives each nested image a summary instead of its facts: status, chip, entry point, segment count, load ranges (each mapped, loaded or unclassified segment's address and declared length), the checksum and appended SHA-256 statuses, coverage and limitations. Complete detail keeps the full facts, every segment included, and the retained Evidence is unchanged. On a 16 MiB device dump the summary's root falls from 5,141 to 2,657 bytes, and the summary Evidence from 10,038 to 7,554. * test(artifacts): expect the misplaced image the ESP bootloader search reports 8a748d3cc added misplacedImage to the bootloader search, which the locator uses to name the origin a misplaced bootloader implies, but one test still compared the search result without it. Expect the image's chip and file offset, and no image for an unknown chip. * fix(artifacts): give every ESP partition from the dump's start an entry After ecbc1a772 kept coverage complete for a dump cut short, a partition wholly past the end of the file still had no entry, only a partitions_outside_dump row. Comparing a merge-bin dump with a full device read then reported that partition as added or removed, as if one table did not declare it. Every partition from the dump's first byte on is now an entry holding the bytes the file has: none for one past the end, with a limitation saying the file holds none of its bytes, no image facts and null written fields. partitions_outside_dump keeps only partitions that begin before the dump's first byte, and coverage is unknown when one does, since it has no entry. Two dumps that lack the same partition now compare it as unchanged, and a dump against a longer one reports the partition as changed; an MCP test of a merge-bin dump against a full one checks that no path is added or removed. Unlike the ESP image reader, which marks a truncated image's coverage unknown because later segments and signature blocks may be hidden, the flash reader can list every partition from the table whatever the file's length; only the entry limitation follows the image reader. * fix(artifacts): select no ESP app from a partition table the bootloader rejects boot_selection followed bootloader_utility_get_selected_boot_partition but not the table check before it. For a table whose MD5 does not match, or that has a second MD5 entry, esp_partition_table_verify fails, the bootloader selects no app and resets. REA still derived a slot from the otadata records, although the table's own limitation said the bootloader rejects it. The selection now has basis none, with no assumptions, for a table the decoder marks invalid. It also follows two more branches of the bootloader: an otadata partition at offset 0, which the bootloader takes for none, selects the factory index as no-otadata, and a table without an OTA app selects its fallback even when the dump lacks a record, since the bootloader then ignores the records. The bootloader also rejects a table whose partitions end past the flash size in its header. REA does not model that check; the format guide says so. * fix(artifacts): require the ESP dump origin's table to follow the image espFlashDumpOrigin named a later flash origin whenever a partition table decoded where that origin puts 0x8000. Bytes inside the image's own segments could be read that way, so an ESP32 bootloader whose segment data held table-shaped bytes at file offset 0x7000 was reported as a dump read from 0x1000. The table must now start at or after the image's end, the rule the locator already applies to the default table. The ESP image reader passes the image_end it decoded, or the file size for a truncated image; the flash reader's refusal passes the end of the misplaced image's segments. The bootloader search drops its misplaced flag, which only restated misplacedImage, and the next probe formats offsets with offsetText. Reader tests cover the 0x1000 and 0x2000 ROM offsets, a standalone bootloader, bytes that begin like a table, an app with a table at 0x7000 and a table inside a segment; without the boundary check, three of them fail. * fix(artifacts): give the ESP flash summary its own kind and each image's identity The summary view's ESP flash root kept kind esp-flash-image, so a consumer bound to kind could not tell an image's summary from its full facts, and the advertised schema held two objects with the same kind const. It is now esp-flash-image-summary. The per-image summary also dropped the descriptor, which is what tells two app slots apart, and named each image only by its partition index, which the summary view, having no entry rows, could not resolve. Each nested image now carries its entry path from the layout plan, in both views. The summary adds the descriptor kind with its identifying fields (an app's project_name, version, idf_ver, secure_version and app_elf_sha256; a bootloader's version, idf_ver and secure_version), the signature block count and each load range's classification. Its enums and fields derive from the schemas that own them. An MCP test reads a dump with an app in ota_0 and an erased ota_1 that holds older bytes: it checks both summaries, that the summary's inventory Evidence is the one the complete view returns with full facts, and the erased slot's written range. * test(artifacts): cover cancel and close during the ESP written-bytes scan The written-bytes pass reads every byte of each partition the dump holds, checking that the reader is open before each chunk, but only app decoding had a cancellation and close test. A data partition, which only that pass reads, now holds 9 MiB; once the scan has examined its first chunk, a cancel rejects preparation with the caller's reason and a close with unavailable, and the scan examines no further chunk. The erased-slot test now asserts the whole set of erased-slot limitations, so factory, ota_0 and nvs, which the bootloader reads or which are not app slots, are shown to have none. * docs(artifacts): re-time the ESP flash lane and state only observed causes The lane ran again after its assertions changed; both esptool runs passed, and the timed run's figures replace the earlier ones. The erased-slot paragraph no longer names a cause for the older bytes, which REA cannot observe, and the skill reference states that every table has a boot_selection in its own sentence, with the none basis for a table the bootloader rejects. * fix(artifacts): retire ESP flash members as the ESP image reader does #7498's maintainer commits made the ESP image reader keep a member owned until its consumer closes it, retire fully buffered bytes when cancellation arrives after production, and refuse to finish an inventory paused across close. The ESP flash reader was copied from the earlier reader. Main's shared stored-member lifecycle cases failed two of eight against it: a paused inventory completed after close, and buffered member bytes stayed readable after cancellation. Give the flash reader the same lifecycle and run the shared cases against it. * docs(artifacts): re-time the ESP flash lane after merging main The lane passed again with esptool v5.6.0 and 4.12.0 on the merge of upstream main. Record the v5.6.0 run's time and peak resident set. * fix(artifacts): read ESP image Evidence recorded before flash_dump The flash layout work made `flash_dump` a required field of the `esp-image` root metadata. Evidence recorded before it has no such field, so newer REA rejected records that were valid when they were made: `compare_artifacts` and `inspect_analysis_view` reported `evidence_integrity_mismatch` for them. The field is now optional when read. A record without it parses as it is, so the graph digest it commits to still matches; nothing fills the field in. The image reader still writes it for every image, and the inspection probe reads a missing field as no hint. A regression test recommits an image inventory without the field and passes it inline to `compare_artifacts` and `inspect_analysis_view`. Against a server built with the required field, `compare_artifacts` rejects it. * fix(artifacts): stop the ESP flash gap scan when the reader closes The scan for the first written byte in each undescribed gap checked only the caller's signal. `close()` marks the reader closed and waits for preparation, so it waited while the rest of a long erased gap was read. The gap scan now takes the reader's open check, as the written-bytes scan and the image decoder do, and checks it before each chunk. Tests cancel or close the reader after the scan's first chunk of a 9 MiB erased gap and confirm that no later chunk is examined. * fix(artifacts): name ESP partitions with Windows device labels by index The safe-label rule accepted labels such as `NUL`, `con` or `COM1`, so extraction wrote `partitions/NUL.bin`. Windows reserves those names before any extension, and ordinary Windows tools cannot use such a file. A label that is a Windows device name (`CON`, `PRN`, `AUX`, `NUL`, `COM0`-`COM9` and `LPT0`-`LPT9`, any case, alone or before a dot) now takes the existing index fallback. The partition metadata and the entry's source path keep the label. * fix(artifacts): read ESP flash partitions' written bytes in one pass Each partition got its own scan of the bytes the dump holds, so partitions declared over the same bytes read them again and again. Overlaps only add limitations, so a crafted table reached this normally: 94 overlapping partitions over a 32 MiB dump would examine about 3 GiB before the first entry. The reader now reads the bytes the partitions cover once. Partition boundaries cut them into segments; one pass counts each segment's written bytes and bounds, and each partition's extent is the sum of the segments inside it. Every partition keeps its own declaration, extent and limitations. The pass checks the reader's open state before each chunk, as the per-partition scan did. A test declares 60 partitions over one MiB, 40 over all of it and 20 over its first half, and checks each partition's extent and the overlap limitations. The reader reads 1,113,256 bytes of the 1,114,112-byte dump; one scan per partition read 52,493,480. * test(artifacts): fail the ESP lanes on failed commands and refusals `otatool` turned a nonzero exit into returned text, which its callers discarded, and `inspect()` returned `{ refused }`, which the flash lane never checked. A failed command then surfaced later as a slot assertion, an output-parser error or a TypeError, hiding its cause. Commands the lanes need to succeed now reject with the output they exited with: `otatool` and `inspect()` do so through a shared `failedCommand`. An expected refusal is opt-in: `refusal()` returns REA's output and fails the lane when REA opens the file. The ESP image lane's two ESP8266 cases use it. Checked by calling `otatool` on a file without a table, `inspect()` on a file REA refuses and `refusal()` on a file REA opens; each rejects with its cause. * fix(artifacts): require a partition entry in an ESP partition table The decoder counted the slot, not the partitions, so a lone MD5 entry over the empty prefix, followed by the terminator, decoded as a table with no partitions. Default and caller-selected detection then accepted that empty layout, although the guide requires one partition. A table now needs one partition entry before its terminator. An MD5 entry alone is refused as `entry 1 at 0x20 ends the table before any partition entry`. The cases cover the decoder and both automatic and caller-selected location. * fix(artifacts): decode an image shared by ESP app partitions once Each app partition got its own decode, so app partitions declared over the same bytes decoded and hashed the same image again and again, the same pattern the written-bytes scan had. With 60 app partitions over one 960 KiB image the reader read 64,029,736 bytes of a 1,114,112-byte dump. Regions with the same file range now share one decode; each keeps its own copy of the facts. Partitions with different ranges still decode separately, because truncation can change the facts: at most one decode per partition the table holds, each within its partition. A test declares 60 app partitions over one image, 40 holding all of it and 20 cutting it short, and expects three decodes: the bootloader, the whole image and the cut one. The 60-partition dump now reads 2,161,864 bytes, as a dump with one app partition does.	2026-10-31 15:24:32 +08:00
morluto	ec107022fa	docs: guide audits of existing investigation tools (#8272)	2026-10-31 14:38:13 +08:00
gensokyo-dev	d9e01e5af2	feat(evidence): aggregate exact retained comparison references (#8267)	2026-10-31 13:59:13 +08:00
gensokyo-dev	6e2404b869	fix(comparison)!: preserve same-entry correspondence across renames (#8263) ... * fix(comparison): preserve same-entry correspondence across renames * docs(comparison): align rename guidance and focused contract checks	2026-10-31 12:53:42 +08:00
morluto	356cc50475	docs: guide design and verification of provider workflows (#8261) ... * docs: guide provider workflow design and annotation comparisons * docs: connect provider tool design to workflow verification	2026-10-31 12:15:15 +08:00
4 people	8188497f13	feat(artifacts): inspect and extract Bun standalone module graphs (#6998) ... * feat(artifacts): inventory and extract Bun standalone executable module graphs Adds a Bun standalone artifact reader for Mach-O, PE, ELF and appended trailers, supporting the 36-byte and 52-byte module record layouts. It preserves module names, entry-point details and raw metadata, and exposes contents, sourcemaps, bytecode and module-info as separate entries for safe extraction without executing the binary. Parsing rejects malformed or ambiguous graphs and enforces module-count, retained-byte and expansion limits. Adds synthetic parser tests, CLI and MCP coverage, agent skill guidance, and a verification script for Bun-produced executables. Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_016y53PdpyMAp9RSW65fatHe * fix(artifacts): bound Bun section probes and reject truncated sections Split Bun recognition into a bounded probe that reads only section headers, length prefixes, and the Offsets/trailer suffix, and a single payload load used by the reader. Inventory classification and extraction admission no longer allocate the whole graph. Match ELF `.bun` section names by comparing only the name bytes and terminator, so many headers sharing one long name cost constant work each. Reject sections whose declared extent ends past EOF instead of reading a silently shortened window. Launch Bun, Docker, and REA in the standalone verifier through the shared owned verifier commands, and release the runtime root only after those command families have settled. Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_016y53PdpyMAp9RSW65fatHe * style(artifacts): format Bun reader integration * fix(contracts): describe static Bun inventory facts * fix(artifacts): bound Bun metadata reads and combined path growth --------- Co-authored-by: Matt Van Horn <[email protected]> Co-authored-by: Claude Opus 5.5 <[email protected]> Co-authored-by: gensokyo-dev <[email protected]>	2026-10-29 22:31:50 +08:00
4 people	51ad84516e	feat(environment): serve sorted creates, listed references and toggles (#7600) ... * feat(environment): serve the writes callers make without recorded form fields - A create member a recording sent empty ("", null, false, [] or {}) is no longer required; a call that leaves it out is applied as sending that value (body.blank). - List views render envelope members that list the listed entities' ids (Paperless's `all`), so creates in such collections are confirmed. - Updates move their entity in collections kept sorted by a field they write, and a failed whole-collection read after an update can teach that order. - A later create that stores an unruled field otherwise is withheld at the create, and an item read may fill values a create's answer had not loaded. - An unsent field respelled between null, [] and {} is unchanged. - The skill asks for one create with every field and one with only what a person must give. Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(skill): show how to read signed-in pages before recording Agents guessed capture keys (artifacts, dom, final) to see pages behind sign-in, which inspect_web_page cannot reach. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): accept every empty spelling recorded creates sent A create that fills only what a person must give sends `null` where the full create sent a string, and `null` or `false` for the same flag. The merged plan now accepts each recorded empty value, and a call that leaves the member out is applied as the earliest call sent it. Also adds the spec folder for this change. Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(skill): keep the vary-fields step neutral on UI or API writes Agents read "the form" as a cue to write through the UI, where some applications' request bodies are not exposed; a body-unusable UI write now re-records once with request steps. Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(environment): record verification for blank members and sorted writes Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): address review of blank members and sorted writes - Bulk updates move their entities in turn against the others' earlier values and install the final order once, as replay does. - A member's recorded empty values stay accepted once a later call teaches its default; a left-out member with a default keeps the default. - Write answers spell empty lists and maps as their recorded answers did. - A rename can teach a sort when the creates chose one by a field the update did not write, such as ids that ascend with titles. Co-Authored-By: Claude Opus 5.5 <[email protected]> * feat(environment): serve the writes that later reads explain - An item read whose object is marked deleted (deleted, isDeleted or is_deleted true) agrees with an absent entity, as EspoCRM answers a deleted record; such an object never seeds or adopts an entity. - maxSize, max_results and maxResults are page sizes, for whole-collection list lines and the list query's limit role. - An item view also shows the fields only reads after its type's first write show, when no initial entity holds them (Vikunja's task subscription), without requiring them; write answers leave such a field out for entities without it, and it no longer withholds the write as incomplete-entities. - The skill asks updates to change the fields a person would change, and expects a deleted object to read back as 404 or marked deleted. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): answer sent empty members as sent, and keep a placed create's order - A write answer spells an empty list or map the call did not send as its recorded answer did; one the call sent is answered as sent, so a create sending `[]` is not answered `null` because the first recorded create was. - A read listing the whole collection that placed a create leaves the create only the sorted inserts whose order that read follows, so a later rename cannot teach a sort an earlier read ruled out. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): answer bulk updates without fields only later reads show A bulk update's answer renders each entity with the same allowance a single update's answer has: a field only reads after the type's first write showed, which no initial entity holds, is left out for an entity without it, so a bulk update of a seeded task is no longer refused for lacking it. Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(environment): correct how the EspoCRM contact update task passes The agent trajectories show gpt-oss passes it by creating a replacement contact and deleting the original, since the served update refuses emailAddress; the update itself is refused in both builds. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): answer a read of a served-deleted entity marked deleted An application that soft-deletes still answers a deleted record by id, marked deleted. Serving now keeps an entity a served delete removed from a type whose recorded item reads show that, until a reset or load and within the size data/add loads, and answers a read of it with its last fields and the flag true, instead of refusing the read. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): keep unloaded create answers, check bulk answers with sent members, narrow inserts only on collection-order reads - A create whose item read loaded values its answer had not records them (`observation.read.unloaded`), and a served create's answer keeps them as the recorded answer showed them, a zero-time owner included, while the state holds the read's. - Replay checks a bulk update's recorded answers with each target's sent members, as serving answers them, so echoed `null` and `[]` no longer make the plan body-unusable. - A whole-collection read whose query sorts it shows the query's order, so it no longer narrows a create's sorted insert candidates. Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(environment): record the census with main's unknown-clock rule merged Co-Authored-By: Claude Opus 5.5 <[email protected]> * feat(environment): serve query numbers, counted values and made objects - A query parameter accepts a number or boolean, which serving sends as its JSON text, as agents send page sizes and flags. - A sequence may start at the value its first create took above every value its type held (Vikunja's per-project task index), and a later create's composed, template or started-sequence rule is adopted when it also spells the first create's value. - A made-object rule explains an object the application makes with each created entity: members the request stamped, members holding the entity's own id, and counts one past the held objects' values. - A create's answer names the id of the one object a one-element array member holds, so bulk creates link to their type. - The skill reads each listed object by id before writing. Co-Authored-By: Claude Opus 5.5 <[email protected]> * feat(environment): let a linked create take path values it stores A create linked to its type's own collection, whose path has no parameters, accepts any path values when its plan stores each one in a field, as a Vikunja task stores its project; replay and serving apply it alike. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): learn a sort from a rename only when moving its entities reaches it Serving moves only the entities a write changes in a collection kept sorted, so replay now tries a sort after a rename only when the entities no write the read exercised changed already follow it. Seeded folders listed out of title order no longer teach a title sort that serving would answer with another order. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): keep unloaded create answers a sent value did not echo, and learn no sort from query-sorted reads - A served create keeps a value its recorded answer had not loaded unless the call sent that member and the plan stores it as sent, so a create sending `active: false` is answered `false` as recorded while the state holds the read's `true`. - A rename no longer teaches a sort from a whole-collection read its query sorts, whose ties need not follow the collection's own order. Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(environment): verify query values, counted values and made objects Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): learn the soft-delete flag in the state view and serve by it Extraction now records the member later item reads set true on a record the application soft-deleted, and the item view carries it as `deleted_flag`. Serving reads that fact instead of scanning recorded bodies itself, so one owner decides what a soft delete looks like. Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(environment): record the call-values checks at #7274 93821024 Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): learn the soft-delete flag from item reads with a query too A client may read a deleted record back only with a query, such as a cache-busting parameter. Every successful read of the item tool now shows the flag; only plain later reads still add fields. Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(environment): record the call-values checks at #7274 45832406 Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): learn sorts only from orders a list read confirmed - A sort retry after a failed whole-collection read requires the entities no write changed since a list last showed them to follow it already, rather than excusing every entity the update's tool ever wrote: an earlier rename a list confirmed in place stays where it was. - An update takes its creates' sort only from a create a list read showed placed; replay still tries a sort a create guessed from the initial order. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): drop entities read back as deleted and answer soft deletes as deleted - A held entity a later read shows marked deleted is dropped, not adopted with the marked object's fields. - Bulk-update replay renders answers with the optional and later-only fields serving uses, so a bulk update of created and seeded entities replays. - A served delete of a soft-deleting type answers with the entity marked deleted, single and bulk. - A deleted flag only query reads showed is a field of the item view, so a served tombstone keeps it where live records omit it. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): check made objects as recorded and keep their ids and clocks honest - A made object's clock counts as a write clock, so a capture with no clock anchor withholds the create instead of stamping 1970. - Members holding the entity's identity follow the id written, generated or sent, through the type's id field. - A later create's made object is checked as recorded, before its own members are rewritten, so one naming another entity withholds the plan. - A later create's template is adopted only when it spells that create's value too, not just when the first create's text holds its source value. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): move updated entities only by placed sorts and keep query-sorted reads from confirming order Replay moved an updated entity by a sort a create only guessed, while the update plan exported only placed sorts, so a read could confirm an update by a move serving would not make. Both now use the placed sort. A passing list read clears its entities from the moved set only when the state decides the order of every entity it lists, so a read whose query sorts it no longer hides an earlier move from a later sort check. Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(environment): count six withheld plans that explain more, not seven The bulk task create counted among them is served on this branch. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): try a learned sort by moving each pending write in turn, as serving does #retrySort sorted the whole collection, which a list could match while serving, moving each renamed entity in turn against the others' values before their own writes, gave another order. The state now records the values each write replaced, and the retry replays the writes since a list in collection order last showed their entities. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): answer a served delete with the deleted flag its recorded answer showed An application may answer a delete with the record as it was and mark it deleted only on later reads. Delete answers, single and bulk, now take the flag's value from the recorded answer; reads of a served-deleted entity still show it marked deleted. Co-Authored-By: Claude Opus 5.5 <[email protected]> * chore(environment): set aside two hunks next to lines main's saved-values change rewrites Main's #7267 changes the lines beside the blank-member docs and the empty-spelling check in explainUpdate. Setting them aside lets that merge apply cleanly; the commit after it puts them back on top of main's text. Co-Authored-By: Claude Opus 5.5 <[email protected]> * chore(environment): restore the set-aside hunks on main and bump the skill to 51 Puts the blank-member docs and the empty-spelling check back beside main's slug and composed text and heldSlugRule. Main is at skill 50 with different text, so this branch's skill changes take 51. Co-Authored-By: Claude Opus 5.5 <[email protected]> * chore(environment): bump the skill to 52 above #7260's 51 Co-Authored-By: Claude Opus 5.5 <[email protected]> * chore(environment): put back the call-values hunks main's merge took its side for, and bump the skill to 53 The merge of main kept main's side where it overlapped this branch, so it could commit without a conflict. This restores this branch's side next to main's: made-object agreement beside the & slug spellings, sequence starts in the earlier evidence (now built by earlierOf), the combined value imports, and recording step 2 beside main's UI-first step 3. Main is at skill 50 and #7274 at 52, so this branch takes 53. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): keep sorts a list showed in place ruled out, and created answers' nested members as recorded A whole list in collection order that showed a renamed entity where a sort by the renamed field would have moved it now rules that sort out, so a later rename of the same entity cannot teach it. A create's answer leaves out members its item read added inside an object the answer showed, as the recorded answer did; the state still stores them. Co-Authored-By: Claude Opus 5.5 <[email protected]> * feat(environment): serve writes whose calls send different members Recordings now vary what a type's two creates and updates send, and REA withheld writes where a later call left out what the first sent. An update plan's required members narrow to those every call sent; a member one create sent and another left for the application to number is a sequence that takes the value a call sends; a PUT's left-out member the application cleared becomes that member's default; and an update's clock is held as the read after it spells it. The skill spaces creates (skill 54). Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): keep a later create's made object only with clocks its request stamped followsMadeObjects only checked that a made object's clocks parsed, so a later create whose object showed an older clock still passed, while serving stamps the write's clock. Its clocks must now be in the rule's format and within the stamp window of that create's request. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): accept sent values either way, check defaults against every call, and store update clocks as reads spell them A sequence that takes sent values now accepts one a later create sent after the first left the member to be numbered. A default an update learned must agree with every update that left its member out, else the plan is withheld. An update plan whose read-back spells a stamped clock at a coarser precision keeps that read as observation.read, and serving stores the update's clocks in its spelling while answers keep the response's. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): check recorded member and sequence values * fix(environment): compare soft-deleted read fields * fix(environment): reject contradictory learned sequences * fix(environment): preserve initially deleted item observations * fix(environment): index stored deleted entities separately * fix(environment): replay lists that include deleted records * feat(environment): serve sorted creates, listed references and toggles A create a whole listing placed last is placed again by the sort a later listing shows. A field holding the entities a sent list of ids names is a reference with `many`, and a create that sent the member empty agrees with one that named entities. A scenario request whose body Playwright did not expose and that names no Content-Type sent no body. An item action calls show flipping a boolean both ways learns a `toggle` rule. Skill 55 asks recordings to run an action twice on one object. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): count a sequence number a create sends, as replay does Serving now records a number a call sends for a `sequence` with `sent` in the same count history it generates from, so after that entity is deleted the next generated number still follows it, as replay's takeSequences does. Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(environment): record the final gate run in the verification Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): make no count of a made-object member earlier creates held alike A count only a later create shows starts at the exemplar's value, which is right only while the exemplar is the one create accepted: creates accepted after it showed the member unchanged, which a count would have moved. The merge now refuses such a count, as the top-level sequence check does. Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(environment): restate the verification after merging #7539 Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): check PUT defaults against reads, and respell update clocks by serving's rule A default a PUT learns must also agree with what the read after an earlier or the current call showed for the member its answer left out, so a call whose read showed the member kept withholds a later clearing default. Replay and serving now choose an update clock's stored spelling by one rule, readSpellsCoarser: the read after it at a coarser precision in the same zone and separator. A read in another zone or separator is no longer adopted by replay, which serving could not store, and a create's plain clocks stay as answered, as serving makes them. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): keep sorts earlier listings ruled out, and empty added references A sort a whole listing that placed a create did not follow stays ruled out for that create, though the entity that showed it is later deleted. A create that sends a reference's member empty after a later create added the reference agrees with it, as with a reference the first create showed. Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(environment): restate the verification after the review round Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): leave out a reference the observed create left out A create the plan observes that left out a reference's member stored no such field, so a served call leaving the member out stores none either, though a later recorded create sent it empty; a call sending it empty still stores that. Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(environment): restate the verification after #7539 merged main Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): keep the largest sequence value in replay, and store update clocks by the kept read Replay now keeps the largest value a sequence took, as serving's commitWrite does, so a lower sent value no longer lowers the next number. Serving stores every update's clocks in the spelling of the read the plan keeps as observation.read; replay now does the same through readSpelledClocks, instead of adopting each update's own read, so a later update whose read spells its clock otherwise contradicts the plan. The plain clock branch of restampedFields, which no caller used any more, is gone. Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(environment): restate the verification after merging #7539 3b800a10 Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): keep learned sorts, references, and toggles faithful Do not adopt a sort an earlier update already ruled out. Learn a list reference only when every element shows the same nonempty fields. Promote a toggle only when every call started from a boolean. * test(environment): compare list-reference fields with matching values The mixed-field case uses the held tag's color, so rejection comes from the field set rather than a value the recording never stored. * test(mcp): assert bundle path issues by field The compare_bundles rejection reports each relative path as an invalid_format issue instead of one joined diagnostic sentence. * test(mcp): assert field issues for bundle paths and Dart ABI Relative bundle paths and rejected ABI selectors are reported as input issues on those fields, not as one joined diagnostic sentence. --------- Co-authored-by: Claude Opus 5.5 <[email protected]> Co-authored-by: morluto <[email protected]> Co-authored-by: Cursor Agent <[email protected]>	2026-10-29 18:46:18 +08:00
3 people	131fbe0754	feat(environment): serve writes whose calls send different members (#7539) ... * feat(environment): serve the writes callers make without recorded form fields - A create member a recording sent empty ("", null, false, [] or {}) is no longer required; a call that leaves it out is applied as sending that value (body.blank). - List views render envelope members that list the listed entities' ids (Paperless's `all`), so creates in such collections are confirmed. - Updates move their entity in collections kept sorted by a field they write, and a failed whole-collection read after an update can teach that order. - A later create that stores an unruled field otherwise is withheld at the create, and an item read may fill values a create's answer had not loaded. - An unsent field respelled between null, [] and {} is unchanged. - The skill asks for one create with every field and one with only what a person must give. Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(skill): show how to read signed-in pages before recording Agents guessed capture keys (artifacts, dom, final) to see pages behind sign-in, which inspect_web_page cannot reach. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): accept every empty spelling recorded creates sent A create that fills only what a person must give sends `null` where the full create sent a string, and `null` or `false` for the same flag. The merged plan now accepts each recorded empty value, and a call that leaves the member out is applied as the earliest call sent it. Also adds the spec folder for this change. Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(skill): keep the vary-fields step neutral on UI or API writes Agents read "the form" as a cue to write through the UI, where some applications' request bodies are not exposed; a body-unusable UI write now re-records once with request steps. Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(environment): record verification for blank members and sorted writes Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): address review of blank members and sorted writes - Bulk updates move their entities in turn against the others' earlier values and install the final order once, as replay does. - A member's recorded empty values stay accepted once a later call teaches its default; a left-out member with a default keeps the default. - Write answers spell empty lists and maps as their recorded answers did. - A rename can teach a sort when the creates chose one by a field the update did not write, such as ids that ascend with titles. Co-Authored-By: Claude Opus 5.5 <[email protected]> * feat(environment): serve the writes that later reads explain - An item read whose object is marked deleted (deleted, isDeleted or is_deleted true) agrees with an absent entity, as EspoCRM answers a deleted record; such an object never seeds or adopts an entity. - maxSize, max_results and maxResults are page sizes, for whole-collection list lines and the list query's limit role. - An item view also shows the fields only reads after its type's first write show, when no initial entity holds them (Vikunja's task subscription), without requiring them; write answers leave such a field out for entities without it, and it no longer withholds the write as incomplete-entities. - The skill asks updates to change the fields a person would change, and expects a deleted object to read back as 404 or marked deleted. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): answer sent empty members as sent, and keep a placed create's order - A write answer spells an empty list or map the call did not send as its recorded answer did; one the call sent is answered as sent, so a create sending `[]` is not answered `null` because the first recorded create was. - A read listing the whole collection that placed a create leaves the create only the sorted inserts whose order that read follows, so a later rename cannot teach a sort an earlier read ruled out. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): answer bulk updates without fields only later reads show A bulk update's answer renders each entity with the same allowance a single update's answer has: a field only reads after the type's first write showed, which no initial entity holds, is left out for an entity without it, so a bulk update of a seeded task is no longer refused for lacking it. Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(environment): correct how the EspoCRM contact update task passes The agent trajectories show gpt-oss passes it by creating a replacement contact and deleting the original, since the served update refuses emailAddress; the update itself is refused in both builds. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): answer a read of a served-deleted entity marked deleted An application that soft-deletes still answers a deleted record by id, marked deleted. Serving now keeps an entity a served delete removed from a type whose recorded item reads show that, until a reset or load and within the size data/add loads, and answers a read of it with its last fields and the flag true, instead of refusing the read. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): keep unloaded create answers, check bulk answers with sent members, narrow inserts only on collection-order reads - A create whose item read loaded values its answer had not records them (`observation.read.unloaded`), and a served create's answer keeps them as the recorded answer showed them, a zero-time owner included, while the state holds the read's. - Replay checks a bulk update's recorded answers with each target's sent members, as serving answers them, so echoed `null` and `[]` no longer make the plan body-unusable. - A whole-collection read whose query sorts it shows the query's order, so it no longer narrows a create's sorted insert candidates. Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(environment): record the census with main's unknown-clock rule merged Co-Authored-By: Claude Opus 5.5 <[email protected]> * feat(environment): serve query numbers, counted values and made objects - A query parameter accepts a number or boolean, which serving sends as its JSON text, as agents send page sizes and flags. - A sequence may start at the value its first create took above every value its type held (Vikunja's per-project task index), and a later create's composed, template or started-sequence rule is adopted when it also spells the first create's value. - A made-object rule explains an object the application makes with each created entity: members the request stamped, members holding the entity's own id, and counts one past the held objects' values. - A create's answer names the id of the one object a one-element array member holds, so bulk creates link to their type. - The skill reads each listed object by id before writing. Co-Authored-By: Claude Opus 5.5 <[email protected]> * feat(environment): let a linked create take path values it stores A create linked to its type's own collection, whose path has no parameters, accepts any path values when its plan stores each one in a field, as a Vikunja task stores its project; replay and serving apply it alike. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): learn a sort from a rename only when moving its entities reaches it Serving moves only the entities a write changes in a collection kept sorted, so replay now tries a sort after a rename only when the entities no write the read exercised changed already follow it. Seeded folders listed out of title order no longer teach a title sort that serving would answer with another order. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): keep unloaded create answers a sent value did not echo, and learn no sort from query-sorted reads - A served create keeps a value its recorded answer had not loaded unless the call sent that member and the plan stores it as sent, so a create sending `active: false` is answered `false` as recorded while the state holds the read's `true`. - A rename no longer teaches a sort from a whole-collection read its query sorts, whose ties need not follow the collection's own order. Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(environment): verify query values, counted values and made objects Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): learn the soft-delete flag in the state view and serve by it Extraction now records the member later item reads set true on a record the application soft-deleted, and the item view carries it as `deleted_flag`. Serving reads that fact instead of scanning recorded bodies itself, so one owner decides what a soft delete looks like. Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(environment): record the call-values checks at #7274 93821024 Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): learn the soft-delete flag from item reads with a query too A client may read a deleted record back only with a query, such as a cache-busting parameter. Every successful read of the item tool now shows the flag; only plain later reads still add fields. Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(environment): record the call-values checks at #7274 45832406 Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): learn sorts only from orders a list read confirmed - A sort retry after a failed whole-collection read requires the entities no write changed since a list last showed them to follow it already, rather than excusing every entity the update's tool ever wrote: an earlier rename a list confirmed in place stays where it was. - An update takes its creates' sort only from a create a list read showed placed; replay still tries a sort a create guessed from the initial order. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): drop entities read back as deleted and answer soft deletes as deleted - A held entity a later read shows marked deleted is dropped, not adopted with the marked object's fields. - Bulk-update replay renders answers with the optional and later-only fields serving uses, so a bulk update of created and seeded entities replays. - A served delete of a soft-deleting type answers with the entity marked deleted, single and bulk. - A deleted flag only query reads showed is a field of the item view, so a served tombstone keeps it where live records omit it. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): check made objects as recorded and keep their ids and clocks honest - A made object's clock counts as a write clock, so a capture with no clock anchor withholds the create instead of stamping 1970. - Members holding the entity's identity follow the id written, generated or sent, through the type's id field. - A later create's made object is checked as recorded, before its own members are rewritten, so one naming another entity withholds the plan. - A later create's template is adopted only when it spells that create's value too, not just when the first create's text holds its source value. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): move updated entities only by placed sorts and keep query-sorted reads from confirming order Replay moved an updated entity by a sort a create only guessed, while the update plan exported only placed sorts, so a read could confirm an update by a move serving would not make. Both now use the placed sort. A passing list read clears its entities from the moved set only when the state decides the order of every entity it lists, so a read whose query sorts it no longer hides an earlier move from a later sort check. Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(environment): count six withheld plans that explain more, not seven The bulk task create counted among them is served on this branch. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): try a learned sort by moving each pending write in turn, as serving does #retrySort sorted the whole collection, which a list could match while serving, moving each renamed entity in turn against the others' values before their own writes, gave another order. The state now records the values each write replaced, and the retry replays the writes since a list in collection order last showed their entities. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): answer a served delete with the deleted flag its recorded answer showed An application may answer a delete with the record as it was and mark it deleted only on later reads. Delete answers, single and bulk, now take the flag's value from the recorded answer; reads of a served-deleted entity still show it marked deleted. Co-Authored-By: Claude Opus 5.5 <[email protected]> * chore(environment): set aside two hunks next to lines main's saved-values change rewrites Main's #7267 changes the lines beside the blank-member docs and the empty-spelling check in explainUpdate. Setting them aside lets that merge apply cleanly; the commit after it puts them back on top of main's text. Co-Authored-By: Claude Opus 5.5 <[email protected]> * chore(environment): restore the set-aside hunks on main and bump the skill to 51 Puts the blank-member docs and the empty-spelling check back beside main's slug and composed text and heldSlugRule. Main is at skill 50 with different text, so this branch's skill changes take 51. Co-Authored-By: Claude Opus 5.5 <[email protected]> * chore(environment): bump the skill to 52 above #7260's 51 Co-Authored-By: Claude Opus 5.5 <[email protected]> * chore(environment): put back the call-values hunks main's merge took its side for, and bump the skill to 53 The merge of main kept main's side where it overlapped this branch, so it could commit without a conflict. This restores this branch's side next to main's: made-object agreement beside the & slug spellings, sequence starts in the earlier evidence (now built by earlierOf), the combined value imports, and recording step 2 beside main's UI-first step 3. Main is at skill 50 and #7274 at 52, so this branch takes 53. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): keep sorts a list showed in place ruled out, and created answers' nested members as recorded A whole list in collection order that showed a renamed entity where a sort by the renamed field would have moved it now rules that sort out, so a later rename of the same entity cannot teach it. A create's answer leaves out members its item read added inside an object the answer showed, as the recorded answer did; the state still stores them. Co-Authored-By: Claude Opus 5.5 <[email protected]> * feat(environment): serve writes whose calls send different members Recordings now vary what a type's two creates and updates send, and REA withheld writes where a later call left out what the first sent. An update plan's required members narrow to those every call sent; a member one create sent and another left for the application to number is a sequence that takes the value a call sends; a PUT's left-out member the application cleared becomes that member's default; and an update's clock is held as the read after it spells it. The skill spaces creates (skill 54). Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): keep a later create's made object only with clocks its request stamped followsMadeObjects only checked that a made object's clocks parsed, so a later create whose object showed an older clock still passed, while serving stamps the write's clock. Its clocks must now be in the rule's format and within the stamp window of that create's request. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): accept sent values either way, check defaults against every call, and store update clocks as reads spell them A sequence that takes sent values now accepts one a later create sent after the first left the member to be numbered. A default an update learned must agree with every update that left its member out, else the plan is withheld. An update plan whose read-back spells a stamped clock at a coarser precision keeps that read as observation.read, and serving stores the update's clocks in its spelling while answers keep the response's. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): check recorded member and sequence values * fix(environment): compare soft-deleted read fields * fix(environment): reject contradictory learned sequences * fix(environment): preserve initially deleted item observations * fix(environment): index stored deleted entities separately * fix(environment): replay lists that include deleted records * fix(environment): count a sequence number a create sends, as replay does Serving now records a number a call sends for a `sequence` with `sent` in the same count history it generates from, so after that entity is deleted the next generated number still follows it, as replay's takeSequences does. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): make no count of a made-object member earlier creates held alike A count only a later create shows starts at the exemplar's value, which is right only while the exemplar is the one create accepted: creates accepted after it showed the member unchanged, which a count would have moved. The merge now refuses such a count, as the top-level sequence check does. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): check PUT defaults against reads, and respell update clocks by serving's rule A default a PUT learns must also agree with what the read after an earlier or the current call showed for the member its answer left out, so a call whose read showed the member kept withholds a later clearing default. Replay and serving now choose an update clock's stored spelling by one rule, readSpellsCoarser: the read after it at a coarser precision in the same zone and separator. A read in another zone or separator is no longer adopted by replay, which serving could not store, and a create's plain clocks stay as answered, as serving makes them. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): keep the largest sequence value in replay, and store update clocks by the kept read Replay now keeps the largest value a sequence took, as serving's commitWrite does, so a lower sent value no longer lowers the next number. Serving stores every update's clocks in the spelling of the read the plan keeps as observation.read; replay now does the same through readSpelledClocks, instead of adopting each update's own read, so a later update whose read spells its clock otherwise contradicts the plan. The plain clock branch of restampedFields, which no caller used any more, is gone. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): keep a left-out default from numbering, a read's sub-millisecond digits, and references named by member A member a call left out and the application stored a fixed value for is no longer turned into a numbered sequence by a later call that left it out. Serving shortens an update's clock to the read's precision from the answer's own digits, keeping microseconds. A PUT that names a reference field's entity by its member supplies that field, for the default check and in serving. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): count a reference a later PUT names toward the default an earlier one cleared The default check now reads the reference rules the current call shows as well as the plan's, so a PUT naming the owner by ownerId after one that cleared it is served, as in the other order. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): number a left-out member past every sent value, and never fill it with a sent blank A later create the application numbered at or below a value an earlier create sent no longer turns the echo into a numbered sequence, since serving counts past every sent value. A member a numbered sequence covers is not filled with an empty value another call sent when a call leaves it out. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): count sent values in the sequence's scope before numbering a left-out member The largest value earlier creates sent is kept by type and by collection, and a collection-scoped sequence adopted later checks only its own collection, so a number sent in another collection no longer withholds a create numbered within its own. Co-Authored-By: Claude Opus 5.5 <[email protected]> --------- Co-authored-by: Claude Opus 5.5 <[email protected]> Co-authored-by: morluto <[email protected]>	2026-10-29 16:14:05 +08:00
morlutoandCursor Agent	bd3792566d	docs(skill): clarify scenario pause deadlines (#7961) ... Co-authored-by: Cursor Agent <[email protected]>	2026-10-29 16:05:03 +08:00
gensokyo-dev	cf9f010dcd	feat(managed): filter and project retained member views (#7968) ... * feat(managed): filter and project retained member views * test(managed): guard relationship endpoint filter semantics	2026-10-29 10:39:34 +08:00
morluto	1e088c19ad	fix(environment)!: report recorded reads and target uncertainty (#7834) ... * fix(environment)!: report recorded reads and target uncertainty BREAKING CHANGE: Environment state and coverage can report method-replay for non-GET safe reads; exhaustive reason consumers must handle it. * docs(environment): include safe-method replay reason	2026-10-29 05:09:31 +08:00
morluto	78a350e0b6	fix(skill): clarify packet capture tool selection (#7901)	2026-10-29 05:04:35 +08:00
gensokyo-devandEntrpi	37827af591	feat(artifacts): compare inventories from Evidence sources (#7869) ... * feat(artifacts): compare artifacts by Evidence reference and from the CLI compare_artifacts made agents send back the complete inventory Evidence that REA already retains, and the CLI had no artifact comparison. Each side of compare_artifacts now takes exactly one of: complete inline Evidence (unchanged), {kind: "retained-evidence", evidence_id}, or {kind: "evidence-file", path, evidence_id?}. The two references are the sources inspect_analysis_view accepts; both tools now compose one definition in evidenceReference.ts. A summary still resolves to its exact retained parent, and every source form gives the same comparison Evidence. An unresolvable retained reference is refused with a typed missing reference error. The application layer owns source resolution and the comparison Evidence, so MCP and the new `rea compare-artifacts` command share one workflow. readEvidenceFileSource reports bundle-selection refusals at the caller's own field path. * refactor(artifacts): resolve compare_artifacts sides like compare_functions compare_functions, compare_wasm_interfaces and the JavaScript application comparisons name each side with evidenceInputSchema and resolve it with resolvePairedEvidenceRequest. compare_artifacts reached the same result for inline and retained sides through its own dispatch. evidenceSourceInputSchema now extends evidenceInputSchema with the Evidence-file reference, and resolvePairedEvidenceSources sends inline and retained sides to the same resolveEvidenceInput and file sides to the shared Evidence file reader. compare_artifacts uses both, so the forms it shares with compare_functions are parsed and resolved by one owner. The advertised input schema is unchanged. * docs(cli): point rea compare to compare-artifacts for inventory contents rea compare (compare_bundles) compares records by Evidence identity and explicit pairs and never reads artifact contents, so two build inventories stay unresolved there. Its help and the CLI guide now name compare-artifacts for that comparison. * fix(artifacts): resolve summary parents within Evidence source bundles * perf(evidence): reuse file-owned immutable authentication proofs * test(evidence): inject failures at both authentication boundaries --------- Co-authored-by: Entrpi <[email protected]>	2026-10-29 03:12:03 +08:00
Entrpiandgensokyo-dev	64196b08ca	feat(artifacts): inventory and extract ESP32 firmware images (#7498) ... * feat(artifacts): inventory and extract ESP32 firmware images ESP32-family app and bootloader images (magic 0xE9) had no reader, so open_binary refused OTA downloads, app partitions and bootloaders. Add the esp-image container format behind inspect_artifact and extract_artifact. A pure decoder reads each byte once and keeps only fixed-size fields. Derived facts cover the chip, from a table cited to ESP-IDF v6.1; segment classification as ESP-IDF's should_map and should_load; checksum and appended SHA-256 results; app and bootloader descriptors; Secure Boot v2 signature blocks, observed and unverified; and undescribed trailing byte ranges. Truncation and undescribed bytes make coverage unknown. ESP8266 images are refused with a specific reason, and ciphertext stays unrecognized. Add the format to every target, Evidence, snapshot, live-summary and artifact vocabulary, document it, and add an optional verify:esp-images lane that compares esptool-built images with esptool image-info and espsecure signature-info-v2. Refs #3615 * test(artifacts): run the ESP image lane on esptool v5.6.0 The lane compared descriptor fields only when esptool image-info printed one, so a descriptor that REA reports and esptool does not print passed without comparison. Compare the descriptor kind in both directions. Record that the lane passed for all 13 images with esptool and espsecure v5.6.0, the version the layout facts cite, as well as with 4.12.0. * refactor(artifacts): define ESP image layout sizes once The decoder and the derived facts each defined the segment-header, appended-digest and flash-sector sizes, the erased-byte scan and the offset formatter. Define them once with the other fixed-layout structures and import them in both places. The signature slot count is the one constant that drives the slot scan. Correct the observedEnd comment: it is the end of the last chunk read. * fix(artifacts): report ESP-IDF's segment length limit by chip ESP-IDF's verify_segment_header rejects a segment of 16 MiB or more unless the chip maps flash through 32-bit cache addresses (SOC_SPI_MEM_SUPPORT_CACHE_32BIT_ADDR_MAP: ESP32-S3, P4, C5, C61, H4 and S31 in v6.1). Record that capability in the chip table and add a limitation for such segments; unknown chips get none. `loaded` repeats should_load. It does not mean the bootloader accepts the segment: verify_load_addresses still rejects one outside the chip's RAM, which REA does not model. Say so in the docs, the skill reference and the inventory limitation. * test(artifacts): check ESP lane tools first and verify extraction The lane started work before checking its tools, so a missing RISC-V target, ld.lld, esptool or espsecure surfaced as a raw spawn or command error. Check each one before building and name the variable to set. Warn when esptool is not v5.6.0, the release the layout facts cite. Assert each segment's class for the ESP32-C3 app, its variants and the bootloader, as the Xtensa image already did. Extract the app and the signed image through the CLI and compare every file with the bytes at esptool's segment offsets or in the appended signature sector; the source's SHA-256 must be unchanged and equal the reported root_sha256. * docs(artifacts): state what the ESP image lane does not establish The Verification section listed the lane's checks but not its gaps: only ESP32-C3 and ESP32 images come from a real producer, no real project build, OTA download or flash dump is inspected, no signature is verified, and the lane does not run in CI. Record the timing of the final lane run on esptool v5.6.0. * fix(artifacts): compare ESP segment declarations Segment entries hash only their data, so compare_artifacts reported a segment that moved to another load address with the same bytes as unchanged; only the image itself changed. Compare each segment's load_addr and data_len as its declaration, as Node SEA and PyInstaller members are compared, and count a changed declaration as a metadata change, also when content is unavailable. Header offsets are layout and the classification is derived, so neither is compared. * test(artifacts): run ESP lane commands as owned process trees The lane ran its tools through execFile. A timeout killed only the direct child, so a linker or assembler that Clang or GCC had started could keep running while the lane removed its workspace. Run every command through createVerifierCommands, check the tools inside withVerifierCleanup, and remove the workspace only after commands.close() has stopped every tree; a failed close keeps the workspace. Only a nonzero exit now counts as a refusal or an expected esptool failure; timeouts and spawn failures propagate. Supervising each command roughly doubles the lane's run time. * test(artifacts): cancel ESP decoding after its first decoded chunk The cancellation test requested cancel or close on setImmediate, which can land while the file is still being opened and checked, so it never showed that decoding had started. It also passed against a reader that ignored both requests while decoding. Acknowledge the decoder's first chunk, then cancel or close, join the operation, and assert that no later chunk reaches the decoder and that the reader ends closed. * docs(artifacts): record which ESP metadata comparison ignores Segments are compared by their declaration. The image's and the signature blocks' format_metadata are not: every field comes from their own bytes, which content comparison already covers, and a block's image_digest_matches follows the image's content. * docs(artifacts): state that ESP mmu_page_size is a base-2 logarithm The app descriptor's mmu_page_size keeps ESP-IDF's name and value, the MMU page size in log base 2 as esp_app_desc_t declares it, so 16 means 64 KiB. Say so in docs/esp-image.md and the schema comment; a reader could otherwise take 16 as 16 KiB. * fix(esp-image): retain member consumption and share lifecycle regressions * test(artifacts): scope MCP catalogs and budget full-schema validation * test(artifacts): verify compact output profiles and document bounded catalogs * test(artifacts): close readers when cleanup-test admission fails * test(artifacts): compare ESP image limitations with their owners The decoder and reader tests froze complete limitation sentences, so a harmless rewording failed them. The wording now has two owners: ESP_IMAGE_LIMITATIONS in espImageFacts.ts, which the decoder, the inventory and the reader use, and ESP_DESCRIPTOR_LIMITATIONS beside the descriptor decoder. Tests compare delivered limitations with the owner, called with the facts each case establishes (segment index, declared and available bytes, offsets, chip, page range), next to the structured assertions they already make. Delivered text is unchanged. * test(esp-image): assert structured facts and owned guidance * fix(esp-image): keep spi_flash_mode and descriptor fields before a truncated tail ESP-IDF v6.1's esp_app_desc_t declares spi_flash_mode at byte 181, after mmu_page_size, as the committed reference layout shows; the descriptor now keeps it as stored. The decoder also required all 256 descriptor bytes, though it reads none past byte 181, so a file ending in the reserved tail lost the version, project, digest and revision facts it does hold. The app descriptor now needs only its fields; the segment's truncation is reported as before. * test(esp-image): pin the P-192 public key digest to espsecure's layout espsecure packs ECDSA signature blocks as "<BBBx32sB64s64s1031x" and zero-pads a 48-byte P-192 point to 64 bytes, so the signature starts at byte 101 for every SHA-256 curve. signature_info_v2 hashes sig_block[36:101] and _digest_sbv2_public_key the curve ID with the padded point. No test built a P-192 block; this one checks public_key_sha256 against that definition. * fix(esp-image): keep each app descriptor field the file holds in full A file can end anywhere inside the 256-byte esp_app_desc_t. The decoder needed every field byte, so a cut at byte 176 dropped the version, project and app_elf_sha256 it does hold. Once the 4-byte magic identifies an app descriptor, each field is now kept when the file holds all of its bytes and is null otherwise; observed_length records where the descriptor ends, so a cut field is told apart from text that is not UTF-8. The fields after the magic become nullable in the metadata schema. * fix(esp-image): report a signature block whose image digest does not match A CRC-valid Secure Boot v2 block can carry another image's digest. The block recorded image_digest_matches false, but no limitation said so, unlike a checksum or appended-SHA mismatch, so CLI and MCP summaries showed only the generic unverified note. The mismatch is now a limitation; coverage stays complete and signature_status stays unverified. The three other signature-sector limitations move into ESP_IMAGE_LIMITATIONS with their text unchanged, so all ESP image wording has one owner. * refactor(esp-image): remove redundant descriptor byte guards --------- Co-authored-by: gensokyo-dev <[email protected]>	2026-10-28 23:18:22 +08:00
gensokyo-dev	c77735fa83	fix(setup)!: bind managed registrations to selected installation ... Use one command owner for setup, client writers, Gemini policy and CLI defaults. Migrate recognized runner registrations with backups and remove runner prewarm. Retain unknown identities and exercise real offline npm, CLI and MCP workflows. Fixes #7757 BREAKING CHANGE: managed MCP registrations use the selected absolute runtime and REA entry script, including package-runner cache paths. Keep that installation available or restore it before setup; unknown registrations require confirmed manual repair. Setup no longer returns prewarm or emits its progress events. Assisted-by: Reimu (gensokyo-skills:reimu-incident-triage) Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing) Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)	2026-10-28 11:34:28 +00:00
Cipherandgensokyo-dev	18a8e71c9f	feat(artifacts): add U-Boot legacy uImage reader (part of #7129) (#7234) ... * feat(artifacts): add U-Boot legacy uImage reader (part of #7129) Recognize legacy uImages by their 0x27051956 magic and inventory them as containers: 64-byte header facts (arch/os/type/compression raw and named, load/entry addresses, name, timestamp) with header and data CRC32 verified, stored payload extractable as payload.bin, and multi-file images split from the stored size table into image-<n>.bin. Compressed payloads stay as stored; nothing is executed or decompressed. Wires the format through classification, the artifact reader dispatch, extraction, and the evidence/snapshot format vocabularies. Related to #7129 (uImage part only); HEX/SREC and FIT are out of scope. * fix(uimage): preserve aligned component ranges and exact header facts * fix(uimage): retain buffered members through consumption and cancellation * fix(uimage): preserve active read and validation failure precedence --------- Co-authored-by: gensokyo-dev <[email protected]>	2026-10-28 19:11:41 +08:00
blankymandgensokyo-dev	e78ac1a55b	feat(artifacts): read UnityFS AssetBundle containers (#7699) ... * feat(artifacts): read UnityFS AssetBundle containers inspect-artifact and extract-artifact now recognize the UnityFS signature and treat format versions 6 through 9 as containers. Header facts (format version, player/engine strings, declared size, dataflags, blocks-info bounds and the declared 16-byte data hash) are retained alongside a directory of CAB-* and .resS members. Member bytes stream on demand: only the blocks covering the requested member are read and decompressed with bounded expansion and cancellation. Bundles declaring asset-bundle encryption keep header facts and report unknown directory coverage. LZMA blocks-info reports unknown coverage; LZMA member reads fail as unavailable while the directory stays readable. Malformed counts, out-of-stream members and declared sizes beyond the file fail as format errors. UnityFS classifies by bytes in root detection, inventory graph construction and desktop inspection, which emits a unityfs-header fact. Validation: tsc --noEmit, oxlint (no new findings on touched files), 17 reader tests covering LZ4HC/uncompressed tables, blocks-info at end, format 6 without padding alignment, multi-block members, malformed input, unsupported compression, cancellation and abandoned streams; full artifacts/domain/conformance suites pass. Verified against one real YooAsset bundle (Unity 2021.3.32f1, format 8, LZ4HC): the streamed SerializedFile contained its managed assembly byte-identical to a UnityPy extraction. Other producer variants unverified. * fix(unityfs): own bounded member reads and preserve partial evidence * refactor(unityfs): clarify producer revision flag decisions * fix(artifacts): preserve coverage authority and bound UnityFS block work --------- Co-authored-by: gensokyo-dev <[email protected]>	2026-10-28 16:47:39 +08:00
3 people	40b9c03f99	feat(environment): serve query numbers, counted values and made objects (#7332) ... * feat(environment): serve the writes callers make without recorded form fields - A create member a recording sent empty ("", null, false, [] or {}) is no longer required; a call that leaves it out is applied as sending that value (body.blank). - List views render envelope members that list the listed entities' ids (Paperless's `all`), so creates in such collections are confirmed. - Updates move their entity in collections kept sorted by a field they write, and a failed whole-collection read after an update can teach that order. - A later create that stores an unruled field otherwise is withheld at the create, and an item read may fill values a create's answer had not loaded. - An unsent field respelled between null, [] and {} is unchanged. - The skill asks for one create with every field and one with only what a person must give. Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(skill): show how to read signed-in pages before recording Agents guessed capture keys (artifacts, dom, final) to see pages behind sign-in, which inspect_web_page cannot reach. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): accept every empty spelling recorded creates sent A create that fills only what a person must give sends `null` where the full create sent a string, and `null` or `false` for the same flag. The merged plan now accepts each recorded empty value, and a call that leaves the member out is applied as the earliest call sent it. Also adds the spec folder for this change. Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(skill): keep the vary-fields step neutral on UI or API writes Agents read "the form" as a cue to write through the UI, where some applications' request bodies are not exposed; a body-unusable UI write now re-records once with request steps. Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(environment): record verification for blank members and sorted writes Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): address review of blank members and sorted writes - Bulk updates move their entities in turn against the others' earlier values and install the final order once, as replay does. - A member's recorded empty values stay accepted once a later call teaches its default; a left-out member with a default keeps the default. - Write answers spell empty lists and maps as their recorded answers did. - A rename can teach a sort when the creates chose one by a field the update did not write, such as ids that ascend with titles. Co-Authored-By: Claude Opus 5.5 <[email protected]> * feat(environment): serve the writes that later reads explain - An item read whose object is marked deleted (deleted, isDeleted or is_deleted true) agrees with an absent entity, as EspoCRM answers a deleted record; such an object never seeds or adopts an entity. - maxSize, max_results and maxResults are page sizes, for whole-collection list lines and the list query's limit role. - An item view also shows the fields only reads after its type's first write show, when no initial entity holds them (Vikunja's task subscription), without requiring them; write answers leave such a field out for entities without it, and it no longer withholds the write as incomplete-entities. - The skill asks updates to change the fields a person would change, and expects a deleted object to read back as 404 or marked deleted. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): answer sent empty members as sent, and keep a placed create's order - A write answer spells an empty list or map the call did not send as its recorded answer did; one the call sent is answered as sent, so a create sending `[]` is not answered `null` because the first recorded create was. - A read listing the whole collection that placed a create leaves the create only the sorted inserts whose order that read follows, so a later rename cannot teach a sort an earlier read ruled out. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): answer bulk updates without fields only later reads show A bulk update's answer renders each entity with the same allowance a single update's answer has: a field only reads after the type's first write showed, which no initial entity holds, is left out for an entity without it, so a bulk update of a seeded task is no longer refused for lacking it. Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(environment): correct how the EspoCRM contact update task passes The agent trajectories show gpt-oss passes it by creating a replacement contact and deleting the original, since the served update refuses emailAddress; the update itself is refused in both builds. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): answer a read of a served-deleted entity marked deleted An application that soft-deletes still answers a deleted record by id, marked deleted. Serving now keeps an entity a served delete removed from a type whose recorded item reads show that, until a reset or load and within the size data/add loads, and answers a read of it with its last fields and the flag true, instead of refusing the read. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): keep unloaded create answers, check bulk answers with sent members, narrow inserts only on collection-order reads - A create whose item read loaded values its answer had not records them (`observation.read.unloaded`), and a served create's answer keeps them as the recorded answer showed them, a zero-time owner included, while the state holds the read's. - Replay checks a bulk update's recorded answers with each target's sent members, as serving answers them, so echoed `null` and `[]` no longer make the plan body-unusable. - A whole-collection read whose query sorts it shows the query's order, so it no longer narrows a create's sorted insert candidates. Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(environment): record the census with main's unknown-clock rule merged Co-Authored-By: Claude Opus 5.5 <[email protected]> * feat(environment): serve query numbers, counted values and made objects - A query parameter accepts a number or boolean, which serving sends as its JSON text, as agents send page sizes and flags. - A sequence may start at the value its first create took above every value its type held (Vikunja's per-project task index), and a later create's composed, template or started-sequence rule is adopted when it also spells the first create's value. - A made-object rule explains an object the application makes with each created entity: members the request stamped, members holding the entity's own id, and counts one past the held objects' values. - A create's answer names the id of the one object a one-element array member holds, so bulk creates link to their type. - The skill reads each listed object by id before writing. Co-Authored-By: Claude Opus 5.5 <[email protected]> * feat(environment): let a linked create take path values it stores A create linked to its type's own collection, whose path has no parameters, accepts any path values when its plan stores each one in a field, as a Vikunja task stores its project; replay and serving apply it alike. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): learn a sort from a rename only when moving its entities reaches it Serving moves only the entities a write changes in a collection kept sorted, so replay now tries a sort after a rename only when the entities no write the read exercised changed already follow it. Seeded folders listed out of title order no longer teach a title sort that serving would answer with another order. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): keep unloaded create answers a sent value did not echo, and learn no sort from query-sorted reads - A served create keeps a value its recorded answer had not loaded unless the call sent that member and the plan stores it as sent, so a create sending `active: false` is answered `false` as recorded while the state holds the read's `true`. - A rename no longer teaches a sort from a whole-collection read its query sorts, whose ties need not follow the collection's own order. Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(environment): verify query values, counted values and made objects Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): learn the soft-delete flag in the state view and serve by it Extraction now records the member later item reads set true on a record the application soft-deleted, and the item view carries it as `deleted_flag`. Serving reads that fact instead of scanning recorded bodies itself, so one owner decides what a soft delete looks like. Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(environment): record the call-values checks at #7274 93821024 Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): learn the soft-delete flag from item reads with a query too A client may read a deleted record back only with a query, such as a cache-busting parameter. Every successful read of the item tool now shows the flag; only plain later reads still add fields. Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(environment): record the call-values checks at #7274 45832406 Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): learn sorts only from orders a list read confirmed - A sort retry after a failed whole-collection read requires the entities no write changed since a list last showed them to follow it already, rather than excusing every entity the update's tool ever wrote: an earlier rename a list confirmed in place stays where it was. - An update takes its creates' sort only from a create a list read showed placed; replay still tries a sort a create guessed from the initial order. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): drop entities read back as deleted and answer soft deletes as deleted - A held entity a later read shows marked deleted is dropped, not adopted with the marked object's fields. - Bulk-update replay renders answers with the optional and later-only fields serving uses, so a bulk update of created and seeded entities replays. - A served delete of a soft-deleting type answers with the entity marked deleted, single and bulk. - A deleted flag only query reads showed is a field of the item view, so a served tombstone keeps it where live records omit it. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): check made objects as recorded and keep their ids and clocks honest - A made object's clock counts as a write clock, so a capture with no clock anchor withholds the create instead of stamping 1970. - Members holding the entity's identity follow the id written, generated or sent, through the type's id field. - A later create's made object is checked as recorded, before its own members are rewritten, so one naming another entity withholds the plan. - A later create's template is adopted only when it spells that create's value too, not just when the first create's text holds its source value. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): move updated entities only by placed sorts and keep query-sorted reads from confirming order Replay moved an updated entity by a sort a create only guessed, while the update plan exported only placed sorts, so a read could confirm an update by a move serving would not make. Both now use the placed sort. A passing list read clears its entities from the moved set only when the state decides the order of every entity it lists, so a read whose query sorts it no longer hides an earlier move from a later sort check. Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(environment): count six withheld plans that explain more, not seven The bulk task create counted among them is served on this branch. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): try a learned sort by moving each pending write in turn, as serving does #retrySort sorted the whole collection, which a list could match while serving, moving each renamed entity in turn against the others' values before their own writes, gave another order. The state now records the values each write replaced, and the retry replays the writes since a list in collection order last showed their entities. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): answer a served delete with the deleted flag its recorded answer showed An application may answer a delete with the record as it was and mark it deleted only on later reads. Delete answers, single and bulk, now take the flag's value from the recorded answer; reads of a served-deleted entity still show it marked deleted. Co-Authored-By: Claude Opus 5.5 <[email protected]> * chore(environment): set aside two hunks next to lines main's saved-values change rewrites Main's #7267 changes the lines beside the blank-member docs and the empty-spelling check in explainUpdate. Setting them aside lets that merge apply cleanly; the commit after it puts them back on top of main's text. Co-Authored-By: Claude Opus 5.5 <[email protected]> * chore(environment): restore the set-aside hunks on main and bump the skill to 51 Puts the blank-member docs and the empty-spelling check back beside main's slug and composed text and heldSlugRule. Main is at skill 50 with different text, so this branch's skill changes take 51. Co-Authored-By: Claude Opus 5.5 <[email protected]> * chore(environment): bump the skill to 52 above #7260's 51 Co-Authored-By: Claude Opus 5.5 <[email protected]> * chore(environment): put back the call-values hunks main's merge took its side for, and bump the skill to 53 The merge of main kept main's side where it overlapped this branch, so it could commit without a conflict. This restores this branch's side next to main's: made-object agreement beside the & slug spellings, sequence starts in the earlier evidence (now built by earlierOf), the combined value imports, and recording step 2 beside main's UI-first step 3. Main is at skill 50 and #7274 at 52, so this branch takes 53. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): keep sorts a list showed in place ruled out, and created answers' nested members as recorded A whole list in collection order that showed a renamed entity where a sort by the renamed field would have moved it now rules that sort out, so a later rename of the same entity cannot teach it. A create's answer leaves out members its item read added inside an object the answer showed, as the recorded answer did; the state still stores them. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): keep a later create's made object only with clocks its request stamped followsMadeObjects only checked that a made object's clocks parsed, so a later create whose object showed an older clock still passed, while serving stamps the write's clock. Its clocks must now be in the rule's format and within the stamp window of that create's request. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): compare soft-deleted read fields * fix(environment): reject contradictory learned sequences * fix(environment): preserve initially deleted item observations * fix(environment): index stored deleted entities separately * fix(environment): replay lists that include deleted records * fix(environment): make no count of a made-object member earlier creates held alike A count only a later create shows starts at the exemplar's value, which is right only while the exemplar is the one create accepted: creates accepted after it showed the member unchanged, which a count would have moved. The merge now refuses such a count, as the top-level sequence check does. Co-Authored-By: Claude Opus 5.5 <[email protected]> --------- Co-authored-by: Claude Opus 5.5 <[email protected]> Co-authored-by: morluto <[email protected]>	2026-10-28 07:51:03 +08:00
3 people	aa210b7ccc	feat(environment): serve the writes that later reads explain (#7274) ... * feat(environment): serve the writes callers make without recorded form fields - A create member a recording sent empty ("", null, false, [] or {}) is no longer required; a call that leaves it out is applied as sending that value (body.blank). - List views render envelope members that list the listed entities' ids (Paperless's `all`), so creates in such collections are confirmed. - Updates move their entity in collections kept sorted by a field they write, and a failed whole-collection read after an update can teach that order. - A later create that stores an unruled field otherwise is withheld at the create, and an item read may fill values a create's answer had not loaded. - An unsent field respelled between null, [] and {} is unchanged. - The skill asks for one create with every field and one with only what a person must give. Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(skill): show how to read signed-in pages before recording Agents guessed capture keys (artifacts, dom, final) to see pages behind sign-in, which inspect_web_page cannot reach. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): accept every empty spelling recorded creates sent A create that fills only what a person must give sends `null` where the full create sent a string, and `null` or `false` for the same flag. The merged plan now accepts each recorded empty value, and a call that leaves the member out is applied as the earliest call sent it. Also adds the spec folder for this change. Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(skill): keep the vary-fields step neutral on UI or API writes Agents read "the form" as a cue to write through the UI, where some applications' request bodies are not exposed; a body-unusable UI write now re-records once with request steps. Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(environment): record verification for blank members and sorted writes Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): address review of blank members and sorted writes - Bulk updates move their entities in turn against the others' earlier values and install the final order once, as replay does. - A member's recorded empty values stay accepted once a later call teaches its default; a left-out member with a default keeps the default. - Write answers spell empty lists and maps as their recorded answers did. - A rename can teach a sort when the creates chose one by a field the update did not write, such as ids that ascend with titles. Co-Authored-By: Claude Opus 5.5 <[email protected]> * feat(environment): serve the writes that later reads explain - An item read whose object is marked deleted (deleted, isDeleted or is_deleted true) agrees with an absent entity, as EspoCRM answers a deleted record; such an object never seeds or adopts an entity. - maxSize, max_results and maxResults are page sizes, for whole-collection list lines and the list query's limit role. - An item view also shows the fields only reads after its type's first write show, when no initial entity holds them (Vikunja's task subscription), without requiring them; write answers leave such a field out for entities without it, and it no longer withholds the write as incomplete-entities. - The skill asks updates to change the fields a person would change, and expects a deleted object to read back as 404 or marked deleted. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): answer sent empty members as sent, and keep a placed create's order - A write answer spells an empty list or map the call did not send as its recorded answer did; one the call sent is answered as sent, so a create sending `[]` is not answered `null` because the first recorded create was. - A read listing the whole collection that placed a create leaves the create only the sorted inserts whose order that read follows, so a later rename cannot teach a sort an earlier read ruled out. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): answer bulk updates without fields only later reads show A bulk update's answer renders each entity with the same allowance a single update's answer has: a field only reads after the type's first write showed, which no initial entity holds, is left out for an entity without it, so a bulk update of a seeded task is no longer refused for lacking it. Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(environment): correct how the EspoCRM contact update task passes The agent trajectories show gpt-oss passes it by creating a replacement contact and deleting the original, since the served update refuses emailAddress; the update itself is refused in both builds. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): answer a read of a served-deleted entity marked deleted An application that soft-deletes still answers a deleted record by id, marked deleted. Serving now keeps an entity a served delete removed from a type whose recorded item reads show that, until a reset or load and within the size data/add loads, and answers a read of it with its last fields and the flag true, instead of refusing the read. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): keep unloaded create answers, check bulk answers with sent members, narrow inserts only on collection-order reads - A create whose item read loaded values its answer had not records them (`observation.read.unloaded`), and a served create's answer keeps them as the recorded answer showed them, a zero-time owner included, while the state holds the read's. - Replay checks a bulk update's recorded answers with each target's sent members, as serving answers them, so echoed `null` and `[]` no longer make the plan body-unusable. - A whole-collection read whose query sorts it shows the query's order, so it no longer narrows a create's sorted insert candidates. Co-Authored-By: Claude Opus 5.5 <[email protected]> * docs(environment): record the census with main's unknown-clock rule merged Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): learn a sort from a rename only when moving its entities reaches it Serving moves only the entities a write changes in a collection kept sorted, so replay now tries a sort after a rename only when the entities no write the read exercised changed already follow it. Seeded folders listed out of title order no longer teach a title sort that serving would answer with another order. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): keep unloaded create answers a sent value did not echo, and learn no sort from query-sorted reads - A served create keeps a value its recorded answer had not loaded unless the call sent that member and the plan stores it as sent, so a create sending `active: false` is answered `false` as recorded while the state holds the read's `true`. - A rename no longer teaches a sort from a whole-collection read its query sorts, whose ties need not follow the collection's own order. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): learn the soft-delete flag in the state view and serve by it Extraction now records the member later item reads set true on a record the application soft-deleted, and the item view carries it as `deleted_flag`. Serving reads that fact instead of scanning recorded bodies itself, so one owner decides what a soft delete looks like. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): learn the soft-delete flag from item reads with a query too A client may read a deleted record back only with a query, such as a cache-busting parameter. Every successful read of the item tool now shows the flag; only plain later reads still add fields. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): learn sorts only from orders a list read confirmed - A sort retry after a failed whole-collection read requires the entities no write changed since a list last showed them to follow it already, rather than excusing every entity the update's tool ever wrote: an earlier rename a list confirmed in place stays where it was. - An update takes its creates' sort only from a create a list read showed placed; replay still tries a sort a create guessed from the initial order. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): drop entities read back as deleted and answer soft deletes as deleted - A held entity a later read shows marked deleted is dropped, not adopted with the marked object's fields. - Bulk-update replay renders answers with the optional and later-only fields serving uses, so a bulk update of created and seeded entities replays. - A served delete of a soft-deleting type answers with the entity marked deleted, single and bulk. - A deleted flag only query reads showed is a field of the item view, so a served tombstone keeps it where live records omit it. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): move updated entities only by placed sorts and keep query-sorted reads from confirming order Replay moved an updated entity by a sort a create only guessed, while the update plan exported only placed sorts, so a read could confirm an update by a move serving would not make. Both now use the placed sort. A passing list read clears its entities from the moved set only when the state decides the order of every entity it lists, so a read whose query sorts it no longer hides an earlier move from a later sort check. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): try a learned sort by moving each pending write in turn, as serving does #retrySort sorted the whole collection, which a list could match while serving, moving each renamed entity in turn against the others' values before their own writes, gave another order. The state now records the values each write replaced, and the retry replays the writes since a list in collection order last showed their entities. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): answer a served delete with the deleted flag its recorded answer showed An application may answer a delete with the record as it was and mark it deleted only on later reads. Delete answers, single and bulk, now take the flag's value from the recorded answer; reads of a served-deleted entity still show it marked deleted. Co-Authored-By: Claude Opus 5.5 <[email protected]> * chore(environment): set aside two hunks next to lines main's saved-values change rewrites Main's #7267 changes the lines beside the blank-member docs and the empty-spelling check in explainUpdate. Setting them aside lets that merge apply cleanly; the commit after it puts them back on top of main's text. Co-Authored-By: Claude Opus 5.5 <[email protected]> * chore(environment): restore the set-aside hunks on main and bump the skill to 51 Puts the blank-member docs and the empty-spelling check back beside main's slug and composed text and heldSlugRule. Main is at skill 50 with different text, so this branch's skill changes take 51. Co-Authored-By: Claude Opus 5.5 <[email protected]> * chore(environment): bump the skill to 52 above #7260's 51 Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): keep sorts a list showed in place ruled out, and created answers' nested members as recorded A whole list in collection order that showed a renamed entity where a sort by the renamed field would have moved it now rules that sort out, so a later rename of the same entity cannot teach it. A create's answer leaves out members its item read added inside an object the answer showed, as the recorded answer did; the state still stores them. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(environment): compare soft-deleted read fields * fix(environment): preserve initially deleted item observations * fix(environment): index stored deleted entities separately --------- Co-authored-by: Claude Opus 5.5 <[email protected]> Co-authored-by: morluto <[email protected]>	2026-10-28 05:05:21 +08:00
5 people	0cd7ef456b	feat(plugins): make Claude Code and Codex installs self-contained (#7514) ... Ship Claude Code and Codex from one release-pinned npm artifact with bundled runtime dependencies, extraction-only MCP qualification, plugin-aware recovery, and synchronized release metadata. Integrates #2815 and the original proposal #1977. The original commits remain available on the PR branch; retain their author and assistant credit in this squash. Validation: required CI passed, real Codex/Claude loading verified, and reviewed packaging/recovery findings addressed. Co-authored-by: GamerDubz <[email protected]> Co-authored-by: morluto <[email protected]> Co-authored-by: OpenAI Codex <[email protected]> Co-authored-by: Claude Opus 5.5 <[email protected]>	2026-10-27 17:13:17 +00:00
gensokyo-dev	570abe95f2	feat(android): link native declarations to static JNI candidates (#7472) ... Link original DEX native declarations to per-ABI function exports and relocated static JNI table candidates through shared CLI/MCP workflows. Preserve global attribution ambiguity, exact provenance, partial coverage and retained Evidence; default MCP delivery to bounded summaries with filtered/batch pages. Use one immutable ELF relocation decoder with streaming IL2CPP materialization, cooperative bounded export/version parsing and bounded JNI state. Reuse validated session inventories without loading target libraries or executing JNI code. Validation: relevant type/lint/build and parser/domain/public CLI/MCP regressions; genuine four-ABI NDK fixtures and independent library/slot oracles; actual JDK/JADX Conscrypt workflows with retained-source removal. Full measurements and limitations are recorded in docs/verification/android-jni-bindings-2026-10-27.md. Closes #6403.	2026-10-27 18:53:22 +08:00
gensokyo-devand555aaditya	03f17cf41d	feat(android): apply caller-selected R8 mapping evidence (#7456) ... Apply caller-selected R8/ProGuard mappings to shared Android inspections, preserving raw identities, exact verification, ambiguity and provenance. Add retained summaries and bounded/cached parsing, with measured real R8/Conscrypt workflows and review fixes. Fixes #6329. Co-authored-by: 555aaditya <[email protected]>	2026-10-27 15:47:08 +08:00
gensokyo-devandEdgar Arakelyan	3fcbabe593	feat(browser): reuse saved response values across scenario steps (#7267) ... Save typed response fields and reuse generated IDs or authentication values across browser scenario requests, UI observations and navigation through the shared CLI/MCP workflow. Preserve exact numbers, retained Evidence, explicit source/coverage limits and prospective page-value semantics. Bound response decoding, retained spellings and request serialization before allocation, and protect marked response values across source records, follow-up text and planned screenshots. Integrates Edgar Arakelyan's #7162, including follow-ups through 9f5191ab0. Final local validation: 560 feature-branch tests and 561 current-main integration tests, static/build/docs checks and real PocketBase CLI/MCP privacy workflows. Whole-task comparison and verification limits are recorded in docs/verification/browser-saved-values-2026-10-26.md. Co-authored-by: Edgar Arakelyan <[email protected]>	2026-10-27 08:15:52 +08:00
morluto	d60b2cab65	docs(ida): document migration from legacy attached registrations ... Describe the native plugin setup, identity and capability differences, verification, and rollback. Link the migration from the packaged skill source.	2026-10-27 06:38:51 +08:00
gensokyo-devandHarsH	6d5532a204	feat(web): page retained bundle endpoint observations and inferences (#7259) ... Page retained web-bundle endpoint observations and inferences through shared CLI/MCP projections, preserving source identities, scoped unknowns, coverage and complete Evidence access. Based on HarsH’s original implementation in #7213 (6b1d5d42). Real Chromium/CLI/SDK verification and whole-task cost limits are recorded in docs/verification/web-bundle-paging-2026-10-26.md. Explicit user authorization permits leaving human-readiness declarations unchecked and bypassing reproduced main failures (ADB listing fixture, package catalog expectation, untouched APK verifier formatting). No human-review attestation is made. Co-authored-by: HarsH <[email protected]>	2026-10-27 01:37:39 +08:00
3 people	19447516a4	feat(ghidra): reuse existing projects through verified copies (#7236) ... Reuse selected Ghidra projects through verified private read-only copies, with shared CLI/MCP configuration, committed project identity, import-SHA verification and explicit historical/unknown analysis semantics. Preserve exact cancellation and platform capability boundaries. Actual Ghidra 12.1.4/JDK21 Linux CLI/MCP investigations matched fresh import on 652-function ls and 14,338-function libcrypto inventories and pseudocode; authenticated complete Evidence, mismatch/staleness refusal, saved historical reports and shared /tmp projects verified. 958 focused tests passed with four platform skips; build/static/docs/format passed. Real macOS/Windows reuse remains unverified; Windows reuse is unavailable. See PR verification for measured whole-task costs and final CI attribution. Co-authored-by: akushonkamen <[email protected]> Co-authored-by: morluto <[email protected]>	2026-10-26 22:31:13 +08:00
morluto	90b793e0f4	docs: scope performance measurements to concrete needs	2026-10-26 15:04:08 +08:00
3 people	b8ce3c74cd	feat(native): make function matching allowance configurable (#7159) ... Allow native matching representation budgets to be selected at runtime or launch while retaining the 96 MiB default and main shared-provenance accounting. Preserve actionable configuration recovery through the setting owner and verify complete CLI/MCP matches for 20k/50k synthetic inventories and real stripped LLVM 14/15 inventories. Fixes #6406. Based on #7112 by Kaoru0822; original authorship and co-author credit retained. Co-authored-by: Kaoru0822 <[email protected]> Co-authored-by: Claude Opus 5.5 <[email protected]>	2026-10-26 02:22:32 +08:00
gensokyo-dev	4c8647a706	feat(native): page retained observations and source context (#7146) ... * feat(native): page retained observations and source context * docs(native): record complete observation workflow measurements * fix(native): preserve context coverage and overflow recovery * fix(benchmarks): finalize partially initialized observation probes * docs(native): publish reviewed workflow verification	2026-10-26 00:32:01 +08:00
gensokyo-dev	f69c52a1cf	feat(native): page retained load-image observations (#7134) ... Add optional native load-image summary delivery and retained selected-row pages through shared CLI/MCP analysis views. Preserve source verification, provenance, unavailable collections, exact row identity and opt-in byte/check payloads. Preserve direct caller paths during shared CLI summary publication and cover raw/DOL projection contracts through the actual SDK. Real Ghidra ELF CLI/MCP captures, retained and file-backed pages, focused regressions and static checks passed; the PR records existing main schema failures and the JavaScript resource-recovery CI uncertainty.	2026-10-25 21:50:42 +08:00