Consume the same-container inventory lookup before treating a missing package.json projection as absent. Unknown metadata prevents index fallback and unsupported bare-package exports resolution; restored metadata selects its declared main or import/require export.
Validation: owner same-container/restored controls and actual ASAR CLI missing/restored package-manifest workflow. Completes the P1 review finding on #3278 that remained after the earlier missing-companion projection fix.
Fixes#3213
Related: #3278
Co-authored-by: Geronimo <varungore1@gmail.com>
Centralize canonical system/user and deterministic renamed-bundle path facts. Reuse the installer destination and honor the same local candidates in doctor and runtime; scan renamed bundles only after canonical candidates fail. Preserve explicit path spelling and exclusive selection. Homebrew command probing remains doctor-only with explicit runtime configuration guidance.
Validation: owner, config, setup and doctor tests cover canonical priority and renamed paths; public CLI verifies explicit path preservation without launching Hopper. No real Hopper analysis claimed.
Fixes#3054
Related: #3085
Co-authored-by: Vinícius DS Andrade <95101505+viniciusdsandrade@users.noreply.github.com>
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Preserve requested adb reinstall mode as replace_requested and report replaced as null when no prior package-state observation exists. Keep install Success/Failure, raw output and host digest, with an explicit Evidence limitation; add no device queries.
Validation: stateful CLI fake distinguishes fresh/existing installs and checks exact version/install commands, plus provider and MCP schema controls. No real-device verification claimed.
Fixes#3166
BREAKING CHANGE: install_adb_package now requires replace_requested and exposes replaced as nullable rather than claiming the selected mode was an observed replacement.
Merge direct same-call nested member facts into symbolic wrapper results using canonical deduplication and ordering. Preserve unknown spread coverage rather than losing known member paths.
Validation: bounded source cases and public CLI/stdio MCP spread/no-spread controls. The existing 125,000-member stress case exceeded the 384 MiB local cap and was stopped without increasing the limit; that capacity case remains unverified locally.
Fixes#3212
Project writes only from write-role references. Export references remain distinct facts and genuine assignments still traverse writes-only traces.
Validation: source semantic controls and public CLI/MCP writes-only traces.
Fixes#3207
Preserve missing ASAR companion occurrence identity, declared size and unknown content in graph nodes and resolution limitations. Apply URL text semantics once for ESM lookup while preserving literal CommonJS paths and original specifiers. Keep CJS wrapper var bindings and assignment history, recognizing only untouched wrapper redeclarations.
Validation: real ASAR producer workflow and CLI/MCP path/coverage cases; semantic reassignment controls. Context7 Node documentation and direct Node wrapper execution confirm wrapper behavior.
Fixes#3213Fixes#3214Fixes#3223
Related: #3278, #3254
Co-authored-by: Geronimo <varungore1@gmail.com>
Co-authored-by: Paolo Valletta <paovalletta@hotmail.it>
Measure actual wire result JSON, including its provenance marker, without allocating the full serialization. Retain complete SDK diagnostics through the existing Evidence writer and return a bounded reference or explicit retention failure. Keep fitting escaped errors and subsequent valid calls usable.
Validation: actual SDK client/transport retention readback and fit/one-byte-over delivery boundaries.
Fixes#3221
Related: #3267
Co-authored-by: CRYPTONIKAV <29835619+CRYPTONIKAV@users.noreply.github.com>
Probe the selected clients through their owning providers and expose current host availability through binary_session. Keep device/serial and target applicability separate. Reject unrecognized successful version output; retain the bounded producer output and original version spelling. Apply the documented Apktool floor, including the verified Debian dirty build.
Validation: provider/version tests and public MCP grouped availability; no real Android device or APK provider verification claimed.
Fixes#3067Fixes#3068
Related: #3077
Co-authored-by: Taksh <takshkothari09@gmail.com>
* fix(artifacts): inventory universal slices REA cannot structurally index
inspect_artifact and extract_artifact rejected a valid universal Mach-O
when one slice was outside the structural index, such as XLD's
big-endian PowerPC slice. The whole inventory failed with "Artifact is
invalid or has changed. Get a fresh copy and try again."
When lipo reports every slice's range, the slices are now inventoried
from those ranges with a limitation naming the unsupported structure,
as the reader already does for files without structural facts. When
lipo omits a range, the failure is reported as unavailable support
rather than a corrupt artifact.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(artifacts): validate every FAT slice past an unsupported one
readFatSlices returned at the first unsupported slice, so a later
malformed slice went unchecked: with lipo's ranges now inventoried for
unsupported structure, a malformed little-endian slice after a
big-endian one was accepted while the reverse order was rejected.
Unsupported slices are now remembered and the remaining slices are
still validated, so malformed structure wins in either order.
Adds portable fake-lipo coverage for complete ranges, missing ranges
(unavailable) and malformed slices on both sides of a big-endian slice.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Render a terminal dry-run plan only after setup admission succeeds. Blocked skill or registration plans use the existing remediation output. Reuse one bounded PTY helper for success and refusal workflows; verify no linked target or client configuration changes.
Follow-up-to: #3108
Validation: public CLI PTY tests and RPC owner controls pass (77 tests); build and static checks pass.
Serialize the typed resource reason once and let the application own path formatting, retaining partial static observations and reported limits.
Reviewed-PR: #3039
Co-authored-by: balkan16 <57933796+balkan16@users.noreply.github.com>
Adapt observed Playwright 1.58.2 bracketed IPv6 addresses only in the disposable HAR validation copy. Preserve the producer spelling and per-entry limitation through public CLI and MCP workflows, retaining existing safe-number admission policy.
Reviewed-PR: #3161
Co-authored-by: wunianze666-netizen <wunianze666@gmail.com>
Carry the concrete configuration and admission reason through the typed provider-selection error to CLI callers.
Fixes#3055.
Reviewed-PR: #3087
Co-authored-by: 1052326311 <65798732+1052326311@users.noreply.github.com>
Capture the current entrypoint once without inventing a path. Preserve unknown registration ownership through setup and doctor, refuse unsafe registration plans, and retain exact pinned-launcher readiness checks. Hash the same full or compact schema projection advertised by each MCP server and use that identity in doctor comparisons.
BREAKING CHANGE: server.command_path may be null when the invocation path is unavailable. Registration and setup statuses, and doctor classifications, may report unknown.
Reviewed-PR: #3230, #3015
Co-authored-by: qorvr <330186599+qorvr@users.noreply.github.com>
Co-authored-by: Hemang Varshney <218273197+hemv-857@users.noreply.github.com>
Close the browser scenario owner alongside session, Android and servers when transport startup throws. Preserve cleanup failures in the existing diagnostics.
Reviewed-PR: #3230
Co-authored-by: qorvr <330186599+qorvr@users.noreply.github.com>
Validate final selected skill roots and references before preview, approval,
and client/Hopper changes, with a repeated installation-boundary check.
Preserve interactive unselected-client choices and registration-only setup.
Share typed directory/read observations across setup, doctor, and update;
report unmanaged paths and unknown reads with actionable paths/reasons.
Retain uninstall child outcomes and ownership manifests when cleanup remains.
Shared single-pass inspection retains all unreadable paths after stale or
missing files and keeps observed metadata, without duplicate manifest reads.
Absent installed files do not depend on generated bundled bytes.
Validation: 217 related tests, 41 final CLI/MCP and filesystem checks, and all
7,446 source tests in 508 files pass (eight platform/condition skips).
Static/docs checks pass. Normal four-call
install/rerun/repair/uninstall tasks preserve results and output token counts.
No native Windows follow-up or arbitrary concurrent swap containment claim.
Fixes#3057.
Co-authored-by: geekwolf <3125615+geekwolf@users.noreply.github.com>
Co-authored-by: N0zoM1z0 <161784452+N0zoM1z0@users.noreply.github.com>
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Co-authored-by: akushonkamen <74654766+akushonkamen@users.noreply.github.com>
* fix: abort invalid JSON parses and keep retained worker owners
Main (7375ab6e3) fails four boundary tests from its latest batch.
- f79fd59e9 moved JSON value validation into a non-aborting superRefine, so
authenticated Evidence still computed its recursive identity digest over
a 10,000-level `parameters` value and overflowed the stack. The process
comparison CLI then reported "Maximum call stack size exceeded" instead of
the depth limit. Abort the parse on a JSON validation issue so enclosing
refinements never walk invalid data.
- runOwnedCommand retains an incomplete cleanup through retainCleanup and
then rethrows the command failure without a cleanupOwner. The EVM and SQLite
providers replaced their retained owner with that undefined value, so an
output-limit failure with unresolved cleanup lost cleanupIncomplete and its
owner. Keep the retained owner unless the failure carries one.
- The EVM malformed-reply test expected a nonexistent `output_failure` code;
AnalysisOutputError projects to `unreadable_output`. The pcap capinfos stub
prints its report with a trailing newline, which retained output preserves.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(sqlite): keep a retained worker owner after a failed worker exit
Cover the path the existing worker-cleanup test bypasses: a real owned worker
exits nonzero, runOwnedCommand retains its incomplete cleanup and rethrows the
failure without a cleanupOwner. The provider must still report
cleanupIncomplete and block a new worker until the retained cleanup succeeds.
Fails on the previous owner assignment.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(evm): retain the compact worker failure beside retained cleanup
When the worker command fails and its cleanup is retained, the cleanup error
now reports the primary failure in the same compact form as an unretained
command cleanup failure: failure kind, message, exit code and signal. Its
output is already retained once as captured_output, so the previous error no
longer repeats up to a megabyte of diagnostics, and failure_kind stays at the
top level that the provider test reads. Both paths share
ownedCommandPreviousError.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* perf(artifacts): overlap bundle magic reads while enumerating dylib roots
trace_dylib_resolution opened every file of an app bundle one at a time
to read its Mach-O magic (Keynote: 35,971 files, 23 Mach-O images).
Keep up to eight reads in flight while the directory walk continues,
settling them in walk order so classification and failure precedence
match the sequential scan. Keynote 4.20 s -> 2.78 s.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(artifacts): pin ordered-read failure precedence and cleanup
Extract the overlapped magic-read queue into consumeWithOrderedReads and
test its ordering, concurrency bound, failure precedence, enumeration
close and read settlement with controlled promises.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Exercise the production session and MCP SDK across provider failure, cancelled target switching, restored run identity, cleared stale availability and successful retry.
Co-authored-by: wxggzz <weixiegen0506@gmail.com>
Verify retained hierarchy limits and summary identity through the production artifact-only composition and real MCP SDK, alongside compiled CLI controls. Deep-provider selection is a separate lane.
Co-authored-by: Aliciawque <166712943+Aliciawque@users.noreply.github.com>
Verify the existing exact candidate-endpoint schema through a completed compiled CLI workflow instead of adding a duplicate worker-only assertion.
Fixes#3128
Co-authored-by: claudetrail2026-droid <313336388+claudetrail2026-droid@users.noreply.github.com>
Retain directive literal values, including escaped strict-mode lookalikes, in semantic function fingerprints. Verify normalized duplicates and distinct directives through CLI/MCP.
Co-authored-by: To3akaRin <131595336+To3akaRin@users.noreply.github.com>
Resolve final object writes once at the RPC endpoint producer. Unknown computed writes and spreads remain barriers; overridden properties do not invent endpoints. Source, CLI and stdio MCP regressions cover the behavior.
Co-authored-by: Vaishnavi220506 <vaishnaviharish2006@gmail.com>
Advertise the nonnegative outline-depth bound after safe-range conversion, verify it against the runtime parser and Ajv 2020, and describe every retained view family and both supported recorded-core architectures. Reuse the existing CLI schema fixture instead of three duplicate capture helpers.
Fixes#3211Fixes#3194Fixes#3167
Co-authored-by: Anankequ <2983852214@qq.com>
Co-authored-by: gongfpp <1360187968@qq.com>
Include imported declarations, nested Node package scopes and authored documentation helpers in compiler task ownership. Schedule static checks for documentation package scopes. Three real cold/warm compiler invalidation cases passed under bounded Flameox captures; the complete matrix remains CI verification.
Fixes#3164
Co-authored-by: N0zoM1z0 <161784452+N0zoM1z0@users.noreply.github.com>
Exercise real MCP navigation error delivery and preserve a custom caller abort cause through source-map cancellation. Document doctor stderr retention.
Co-authored-by: yasshmittal <myash0091@gmail.com>
Move the shared input-error constructor and operation identity to a leaf contract. View leaves no longer import their runtime composition owner. Replace a duplicate graph assertion with compiled CLI summary/facet coverage for omitted roots and unresolved hierarchy endpoints.
Latch target scope exclusion so a late frame-tree reply cannot restore a stale approved final URL or complete coverage. Preserve redirect observations and approved controls.
Fixes#2593
Admit documented compatible format revisions, preserve the original uint32 revision and disclose unverified fallback for unknown revisions. Keep malformed package and compressed-input rejection.
Co-authored-by: Dragolone <810170966qq@gmail.com>
Retain a worker owner transferred through the callback when a failure has no replacement owner. Give captured streams one canonical owner while preserving unrelated diagnostics and partial Evidence. Linux retained-cleanup coverage requires CI.
In environments where REA_ELECTRON_NODE_EXECUTABLE or node is unavailable,
unhandled error events on the spawned child process can crash the Electron
runtime before readiness checks complete.
This attaches an explicit error handler to absorb ENOENT and spawn failures.
Evaluated and error found by SubQ by Qorvr.
Co-authored-by: qorvr <330186599+qorvr@users.noreply.github.com>
* perf(native): skip llvm-nm's dyld-info pass when the symbol table names every export
inspect_macho ran `nm -gjU`, whose default dyld-info pass takes seconds on
large apps (Keynote arm64 5.8 s, x86_64 10.2 s) yet under -gU can only add
export-trie names that dyld_info -exports already reports. Run
`nm -gjU --no-dyldinfo` and rerun the default pass only when dyld_info
reports an export the symbol table lacks (e.g. strip -T), so its exact
names still disambiguate dyld_info rows.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(native): fall back to nm's dyld-info pass for unreadable export rows
Account for every dyld_info export line instead of only the rows the
parser returns, so an unfamiliar row format reruns the default nm pass.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* perf(managed): add retained member summary and pages
inspect_managed_members always returned the assembly-wide member_refs, so
one selected or unmatched type produced megabytes, and an unselected
ordinary assembly exceeded the MCP response budget. Add opt-in
detail: "summary" that retains the complete Evidence and returns identity,
selection with unmatched names, coverage, user-string coverage, limitations
and per-collection counts. Page original rows through inspect_analysis_view
with kind managed-members; each page names its collection so no row schema
is chosen by union order. Complete delivery stays the default.
Refs #3010
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* perf(managed): validate a sealed member parent once across pages
Each managed-members page reparsed the whole parent report, about 35 ms
for an 18 MB assembly result regardless of the page size. The analysis
view service now reports whether the parent Evidence is a sealed
snapshot, and the member view reuses the validated report for that
sealed result through a weak reference. Unsealed input is still
validated on every call.
The round-trip test fixture now carries an exported type, an ldstr
literal, a field access and a call edge, and requires every collection
to be nonempty so a row schema that drops facts cannot pass on empty
arrays.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(managed): keep delivery detail out of retained Evidence identity
Summary, omitted and complete delivery of the same managed inspection
now retain one parent record, as inspect_macho already does.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Hash the complete oversize fixture through a read stream rather than allocating the entire 128 MiB file. Preserve the digest and oversize admission test semantics.
Validation: node --check and full static checks pass. The capacity fixture was not rerun locally to avoid heavy work.
Based on #1892.
Co-authored-by: GRAB Racem <racem.grab@etu.univ-lyon1.fr>
Assert exact inventory contents and cardinality without depending on directory enumeration order.
Validation: all nine reader boundary tests pass.
Based on #3117.
Co-authored-by: Yog D <yogd7657@gmail.com>
A matching realpath does not make an excluded symlink spelling a discovered test. Compare differing path components, rejecting symlink aliases while preserving ordinary case and Unicode filesystem identity.
Validation: all 14 runner boundary tests pass, including excluded file/directory aliases, valid selections and no target execution.
Based on #2849.
Co-authored-by: ShuaixinHuang <1836656514@qq.com>
