`procedure_pseudo_code` may return null, which a provider uses to say a
procedure has no pseudocode: Kuna does so for an import slot or a function
it could not decompile. `batch_decompile` treated null like malformed
output and reported "unreadable result, run rea doctor". A null item is now
a non-retryable capability error pointing to the batch limitations, which
carry the provider's reason. An empty string remains unreadable output.
Refs #1957
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Advertise internal worker launches and temporary source writes through the
canonical effects owner so MCP hints and session availability agree with
existing analysis behavior. Preserve non-destructive, idempotent semantics.
Verify public metadata boundaries and a real Obsidian CLI/MCP workflow,
retaining compact reproduction and cost records.
Fixes#3867
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
A failed export's capability error appended "restart REA, then reopen the
target" to every resource-constraint remediation. Since output overflows
became fixed `memory` bounds, an export whose own output overflowed REA's
buffer was told both that repeating fails the same way and that a restart
would help. The restart sentence now follows only settings-backed
remediations such as the cache size.
Refs #1957
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Artifact comparison subtracted change rows from the left occurrence
count to derive summary.unchanged. A duplicate logical path produces one
unknown row that stands for every occurrence on that path, so the extra
occurrences were reported as affirmatively unchanged. The summary now
counts only left occurrences on paths without a left-side change row.
Fixes#3956
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Expose filtered canonical module identities, retained source-range counts and mixed support through the existing shared CLI/MCP analysis view. Preserve full-item access, source selection, provenance and partial coverage while allocating only the selected page.
Verify exact facts and CLI/MCP identity on shipped Obsidian, record complete-task BPE/resource measurements and reuse owned-process supervision for optional tokenizer cleanup.
Fixes#4092
Part of #4027; decision #4091.
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Add cached, reference-free Kuna string inventories through existing CLI/MCP operations. Preserve exact addresses, typed facts, selected Evidence and bounded query lifecycles; validate native fields and caller-specific failures. Verified with real Linux SQLite, zlib, printf and Unicode/empty ELF targets, 194 focused regressions and all 38 CI checks.
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Kuna output that overflowed REA's fixed buffer was a `capacity` constraint,
which projects as `retryable: true` with "wait for an active analysis to
complete, then retry". The same target and executable overflow the same
buffer every time; on a 169 MB Mach-O, each retry of a call query repeated a
113 s whole-program graph walk and failed again. The overflow is now a
`memory` constraint whose remediation says repeating fails the same way, a
session answers later call queries from a graph overflow it already saw, and
the cut-off document's stdout tail is no longer returned.
Refs #1957
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(kuna): report a failed export as not retryable in its session
A session never rebuilds a failed project export, yet requests that need it
returned the export's raw failure. For a timeout that projected as
`retryable: true` with "Try a smaller request", and every retry returned the
same stored failure. Those requests now fail with a non-retryable
capability error that keeps the export failure as its cause and diagnostics
and names what to change (the deadline or jobs for a timeout) before
reopening the target. Cancellation and unproven cleanup keep their own
errors.
Refs #1957
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(kuna): keep a failed export's output and name the restart it needs
The capability error for a failed export dropped the export's captured Kuna
output, which the MCP projection only reads from the top-level error. It
also told callers to change a setting and reopen the target, but REA reads
Kuna settings once at startup. The error now carries the captured output
and partial observation, and its recovery text says to change the setting
where REA starts and restart REA.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(kuna): keep resource limits on a failed export's capability error
An export larger than REA_KUNA_CACHE_MAX_BYTES, or a Kuna command at its
output cap, fails with a resource constraint whose resource and reported
limits the projection exposes only on the top-level error. The wrapper now
copies them into its diagnostics under the same names.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor(kuna): carry a failed export's whole projection on its wrapper
The capability error for a failed export copied the cause's facts field by
field (captured output, resource limits), and each missing field, such as an
artifact change's path and boundary, dropped evidence callers could not
reach through `cause`. The wrapper now carries the export failure's own
projected code and details in its diagnostics, so every typed field survives
in the shape its own projection gives it, and the duplicated top-level
copies are removed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: select caller paths through symlinks and .. as the filesystem does
CLI adapters, binary target resolution, the reverse-engineering service
and the objdump and Rizin command builders made caller-selected paths
absolute with path.resolve, which collapses `link/..` lexically. On
POSIX the filesystem follows `link` first, so these commands inspected,
hashed or launched a different file and returned internally consistent
Evidence for it.
absoluteCallerPath now owns that step: on POSIX it prefixes a relative
path with the working directory and keeps an absolute path as spelled;
on Windows, where `..` resolves lexically, it keeps win32.resolve.
Fixes#3864Fixes#3911Fixes#3912
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep firmware, WASM list and output-root paths on the selected file
Review follow-up. The CLI already passed firmware and WASM paths through
absoluteCallerPath, but snapshotFirmware and SafeOutputTree.create
re-resolved them lexically, and the WASM glue and candidate lists still
used resolve, so those inputs could still select a sibling file or
create output beside the intended directory.
absoluteCallerPath now also drops `.` segments and repeated or trailing
separators on POSIX, which never change the named file, so selected
paths such as `./module.wasm` keep matching their glue references
exactly. Every `..` is still left for the filesystem.
SafeOutputTree keeps host path syntax; its platform argument selects only
the Windows name policy.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep directory requirements and relative cwd in caller paths
Review follow-up. absoluteCallerPath stripped a trailing `/` or `/.`, so
`file/` selected the regular file instead of failing with ENOTDIR; it
now keeps one trailing separator. A relative cwd option was appended to
the root; it is now made absolute without collapsing `..`. WASM glue
matching resolved local literals lexically, so a module selected through
`link/..` matched only by basename; the adapter now compares both sides
through absoluteCallerPath and still reports each candidate as given.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(kuna): list a cold target from the export's own inventory
On a cold cache the session ran `kuna functions --json` for listings while
the background export ran the same inventory as its first step, so every
cold target was inventoried twice at once. On a 254 MB Mach-O each run took
about 66 s of CPU. The quick run was also bound by the single-function
deadline.
The export's status now carries its parsed inventory, the cache replays the
latest status to requests that join a running build, and listings wait for
that inventory. The session runs its own inventory only when the export ends
without one.
Refs #1957
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(kuna): replay a running build's status after its waiter can cancel
The cache replayed the latest status to a joining request before it
registered that request's abort listener, so a listener that cancelled on
the replayed status was ignored and the request waited for the export to
finish. Replay now happens once cancellation is registered.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* perf(kuna): publish the export's inventory without parsing it twice
The export parsed `functions.json` for its status and then parsed the file
it had just written again to publish, so two expanded inventories coexisted
while the export finished. Publishing now reuses the inventory parsed from
that same text. Cached lookups still parse the published file.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(kuna): exercise export inventory sharing from pseudocode requests
Inventory-only requests no longer start the export, so a cold request that
shares the export's inventory is now a text request. The tests and the
guide describe that trigger.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(kuna): let a listing wait for an export that is still starting
A listing that arrived while a concurrent text request was still looking up
the cache saw no export inventory yet and started its own `kuna functions`,
and the export then started another. The listing now waits for that startup
decision before falling back to its own run.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Admit Windows ARMNT/Thumb-2 and ARM64 PE targets using preserved COFF machine facts. Keep unsupported machine gates explicit and distinguish loader-selected versus configured language provenance.
Verified with real Windows Ghidra 12.1.4 CLI/MCP workflows, ARM fixtures and Microsoft-signed Coreinfo ARM64 / MSVCR120 ARM inputs. Resource limits, analyzer overrides, startup timeout observations and verification gaps are documented in the PR. Final CI and automated review passed.
Fixes#2186
Add session-cached call relationships and exact incoming xrefs using a body-free graph and bounded native queries. Reuse existing graph/path tools, preserve coverage and exact u64 identities, and retain native cleanup owners and admission leases.
Validated with 136 tests, real Linux Kuna workflows on SQLite/zlib and source-owned fixtures, independent native xref comparisons, resource measurements, CI and review.
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Reuse the existing CLI compilation policy in the exported binding acceptance
matrix. Own and clean a fresh cache per file while preserving caller cache
and coverage choices, all 92 cases, and every live CLI/MCP request and oracle.
Fixes#4079
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
A single-function run whose process tree could not be proven stopped
released its run slot immediately, so the next queued run started while
the old tree might still run, and repeated unproven stops bypassed the
bound. The retained run now carries its slot, and close releases it only
after a retried stop is proven.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
inspect-macho projected an empty Mach-O segment or section name as the
display label "unknown", so an exhaustive segment inventory for an
ordinary MH_OBJECT reported a segment literally named "unknown" while
the raw LC_SEGMENT_64 field showed "". Object files place every section
in one unnamed segment, so the empty name is a source value. Segment and
section names are now reported exactly as observed.
Fixes#3875
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
inspect-macho listed the LC_ID_DYLIB command of a dylib as a dependency,
so every dylib reported a self-dependency and an inflated exhaustive
count, while trace-dylib-resolution correctly treats that name as the
image identity. The dependency collector now skips LC_ID_DYLIB; the
command, with its install name, remains in the raw load commands.
Fixes#3872
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Every request a session admitted checked `#project` before awaiting the
cache lookup, so concurrent first requests, such as batch_decompile's
parallel resolutions on a fresh server, each re-hashed every export file
and re-parsed the export. Concurrent first requests now share one lookup.
Refs #1957
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
`inspect-macho` stored each `otool -l` row in a flat record, so a key
printed more than once kept only its last value. A two-string
LC_LINKER_OPTION lost `-framework` and kept `#2 Foundation`, and a
multi-tool LC_BUILD_VERSION kept only its last tool, while the
collection still claimed exhaustive coverage.
Linker-option strings are now keyed by otool's own `string #n` label
with the exact option text and must match the declared count. Any other
repeated key is labeled `key #n` in print order. Dylib encoding checks
read the parsed rows, so repeated `options` rows are still rejected.
Fixes#4008
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
While the project export builds, every pseudocode request started its own
`kuna decompile --addr` process, and each one analyzes the whole image
again. A cold batch_decompile therefore launched one process per address,
including duplicates, with no bound.
Requests for one entry now share one run, which stops when its last waiter
is cancelled; that waiter still receives the run's outcome, including
unproven cleanup. A provider-wide pool admits at most the host's cores
beyond REA_KUNA_JOBS (at least one) at once, and a queued request is
answered from the export when it finishes first.
Refs #1957
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Require typed cancellation and confirmed external-browser cleanup in the
real environment verifier. Close its provider and CDP observer while
preserving primary and cleanup failures. Cover six controlled outcomes
through the verifier's actual cancellation path.
Fixes#4033
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Let individual requests cancel their shared assembly-index wait while the session aborts and drains the owned producer. Preserve verifier workspaces until provider, transport and process cleanup are confirmed; report failed runs with original errors and lineage evidence.
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Retain named operations in GraphQL Source bodies with locationOffset metadata.
Use final property ownership and parsed lexical facts to suppress copies only
when a recovered document, its containers and source aliases have proven
private metadata ownership. Preserve independent observations after writes,
exports, opaque uses, classic-script global exposure or direct evaluation.
Share interpretation across application and captured-web analysis. Build
optional reference indexes once per source and checkpoint examined records,
including suppressed findings, to retain cooperative cancellation.
Fixes#3311
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
* feat(kuna): serve procedures, pseudocode and assembly from Kuna exports
Register Kuna as a bring-your-own deep-analysis provider. It answers
list_documents, list_procedures, search_procedures, procedure_address,
address_name, procedure_pseudo_code, procedure_assembly and
analyze_function (and batch_decompile through composition) from the
verified project export. While a cold export builds in the background,
pseudocode comes from a single-function `kuna decompile` run on a private
copy and says so; assembly and data names wait for the export.
Each answer records its source and file span in raw_result, limitations
are scoped per operation, and the session-owned export is stopped on
close unless another session still waits for it. The literal/regex
procedure search predicate moves from the IDA runner into a shared
domain helper. `npm run verify:kuna` adds a real-provider lane with an
optional Ghidra comparison.
Refs #1957
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(kuna): refuse a Ghidra comparison without caller-built targets
Refs #1957
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(kuna): retry owned cleanup and keep answers bound to the opened Kuna
- Re-verify the Kuna executable's digest before every launch (memoized by
file identity), so no answer names one build while another produced it.
- Keep the process supervisor of an unproven stop, and retry it on every
later close in both the session and the cache; a failed close keeps
failing until the stop is proven instead of reporting success.
- Report an abandoned export's retained cleanup from session close.
- Forget and rebuild an adopted export whose files another REA process
evicted, instead of failing every later read.
- Close a private copy whose setup failed, and retry failed removals.
- Let the session own the shared quick inventory; each caller only stops
waiting when it cancels.
- Report a failed export as `failed` with its reason.
- Lane: release the MCP client when open_binary rejects a target, and accept
either valid source for the first answer.
Refs #1957
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(kuna): drain session requests before releasing workspaces
Combine caller cancellation with session shutdown and wait for active reads before releasing their process supervisors or private inputs. Retain unproven cleanup for later close attempts. Measure UTF-8 reply bytes without implying model token usage.
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
* perf(kuna): keep document metadata reads free of target analysis
Listing the selected path no longer initializes the project cache or starts an export that the request never consumes.
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
* fix(kuna): reject verification matrices with missing functions
Validate requested matrix coverage before building the fixture or opening providers. Empty matrices, unmatched names and partially matched function sets must fail instead of reporting an unperformed comparison as successful.
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
* fix(kuna): retain component provenance in function dossiers
Record each source facet as one file span and preserve both pseudocode and assembly digests/ranges in combined reports. Keep direct text source fields compatible and verify every combined span through the real MCP lane.
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
* fix(kuna): keep retired file cleanup bound to its export
Retain the export key with each failed file removal so a cancelled session reports and retries its own stopped resources. Preserve that association across sweeping and process-cleanup recovery without attributing unrelated cache failures to the session.
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
* docs(kuna): document the Kuna provider and list it in the catalog (#3855)
* docs(kuna): document the Kuna provider and list it in the catalog
Add the Kuna provider guide (configuration, answered tools, cold and warm
paths, provenance, cache ownership, verification lane), link it from the
README and its translations, the CLI, installation and index pages and the
site navigation, describe `npm run verify:kuna` in the testing guide, credit
Kuna in THIRD_PARTY_NOTICES, teach the agent skill when to select Kuna, and
register its identity and operations in the generated product catalog.
Refs #1957
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(kuna): state the Linux cache fallback, raw_result scope and comparison inputs
Refs #1957
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(kuna): note that cache pins hold within one REA process
Refs #1957
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(kuna): describe retired staging and retried cleanup
Refs #1957
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(kuna): supervise regex and bind reads to one export
Share a cancellable ECMAScript matching worker with Hopper while preserving its error contract. Bind C and assembly indexes to immutable project readers, retry whole dossiers after eviction, and enforce the existing buffered-text capacity before allocating cached spans. Document the verified Linux scope and keep complete exports accessible.
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: N0zoM1z0 <161784452+N0zoM1z0@users.noreply.github.com>
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
inspect-electron-page read missing or non-array DOMSnapshot documents and
node arrays, frame-tree resource lists, and Target.getTargets target lists
as empty inventories while reporting complete_within_window.
The web capture path already validated these replies. Its parsing now has
one shared owner in CdpCaptureDocuments: snapshotDocuments,
snapshotDocumentNodes and frameTreeResources report unreadable parts
through a callback, and both the web and Electron inspections consume
them. Worker discovery records a missing target list or non-record entry as
an invalid_protocol_value exclusion. The Electron copies of this parsing are
removed.
Fixes#3379
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* test: resolve worker and CI script paths with fileURLToPath on Windows
* test: skip the fake gh lookup failure on Windows
* test: resolve the release helper and Hopper probe paths with fileURLToPath
open_binary read snapshot_path before it entered the session's lifecycle
order, so a current_document or close_binary dispatched after it could
run first: the read returned Evidence for the previous target and the
close left the snapshot target open. The session now loads the snapshot
inside the open's own turn.
Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
The generic Ghidra MIPS lane refuses a target whose ABI declaration
inspection is incomplete, such as a section-header table beyond the
captured file, because unexamined headers may hold declarations that
would refuse it. The PSP Allegrex lane skipped that check. It admitted
the target and resolved a supported profile while target inspection
said those declarations remained unknown.
The incomplete-declaration rule is now one shared helper,
ghidraMipsIncompleteDeclarationsReason, used by both the generic MIPS
and the PSP lanes.
Fixes#3329
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Add caller-supplied Kuna readiness, scoped doctor support and a verified whole-program export cache. Index function byte ranges without introducing analysis-tool responses, and retain unresolved process ownership through cleanup failures. Separate retryable file cleanup from unproven process cleanup.
Verified real Kuna 1.833 on Debian 12 x86-64 with coreutils, SQLite and zlib; 5,207 exported function spans, cold/warm performance, raw-export parity and lifecycle failures. Refs #1957.
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Co-authored-by: N0zoM1z0 <161784452+N0zoM1z0@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
The managed application graph copied metadata names into observation
labels. The graph schema requires a non-empty label or null, so Evidence
whose Module name was the string heap's empty entry made
project-managed-application-graph fail with invalid_request at
observations.0.label. The inspector accepts that Evidence as complete,
and no graph was returned.
Labels derived from metadata names (assembly, module, type, member,
P/Invoke import and native implementation) now become null when the name
is empty. The node's properties keep the source value, so display
formatting no longer rejects identity facts.
Fixes#3352
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(reference): select a package main before its directory index
import-reference-source resolved a relative directory import such as
require("./dep") from path candidates alone, so it reported dep/index.js
as the internal, parsed dependency even when dep/package.json declared
"main": "actual.js". Node loads actual.js.
parseReferenceSourceEntries now reads each inventoried package.json once.
When an internal specifier resolves through a directory index, a
non-empty string main is loaded first, as a file and then as a directory
index, as Node does. A main whose target is absent falls back to the
index, matching Node's legacy fallback. An unreadable or invalid
manifest leaves the relationship unresolved instead of asserting the
index.
Fixes#3383
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(reference): resolve package main the way path.resolve does
A trailing separator in main ("lib/") kept directory intent, so the
declared entry selected lib/index.js where Node loads lib.js. An absolute
main was joined under the package directory instead of leaving the
imported root. Strip trailing separators after joining, and report an
absolute main as unresolved. Both cases join the Node-oracle CLI test.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(apktool): own the version probe's process group and keep its timeout typed
The version probe ran its launcher through execFileOutput, which waits
for every inherited output pipe to close. A shell launcher's child that
holds those pipes outlived the stop request, so the probe stayed pending
past its deadline and its grace period, and cancellation hung the same
way. An expired probe also surfaced as a non-retryable unusable-version
refusal.
Run the probe through runOwnedCommand like the decode run, so the owned
process group is stopped with its children. Report its deadline as
AnalysisTimeoutError with timeout_ms and retain an unresolved cleanup
owner for close. Apktool launchers are interpreter scripts, so both the
probe and the decode run prove ownership by run token instead of the
launcher's argv prefix. A close with unresolved process cleanup reports
a typed ProviderCleanupError instead of an untyped AggregateError.
Fixes#3342Fixes#3347Fixes#3337
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(apktool): carry unresolved probe cleanup through both provider entry points
A probe failure other than cancellation or timeout, such as an output
overflow whose launcher child survives, now keeps its cleanup reason and
resources on ApktoolConfigurationFailure. inspectAvailability and execute
report it as ProviderCleanupError instead of ordinary unavailability or
capability_unavailable.
Add a real-process lifecycle test: an interpreter launcher starts a child
that holds the inherited output pipes, the probe is cancelled after
launch, and both processes must be stopped within the bound.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(apktool): ignore zombies and always clean up the probe lifecycle fixture
Treat a zombie as exited when checking the launcher and child, bound the
cancellation wait so a regressed probe still reaches cleanup, and stop
any remaining fixture processes in a finally block.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(apktool): treat a failed process inspection as unknown, not stopped
Only ESRCH, a zombie state or ps reporting no match counts as exited; a
ps launch failure leaves the process presumed live so the assertion
fails and the finally block still stops it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(native): retain valid Objective-C properties beside a malformed record
readObjcPropertyList decoded a whole property_list_t in one operation.
When a later entry's name pointer was unmapped, the list-level catch
discarded the properties already decoded. An empty property name passed
decoding and then failed schema validation of the whole result, so
inspect-native-dispatch-metadata exited 1 with no metadata.
Each property_t entry is now decoded on its own. A failing entry, or an
empty name, becomes a property_decode_failed issue at the entry address,
and sibling properties are retained. Incomplete-attribute issues also
report their entry address. List-header failures still fail only that
list.
Fixes#3336
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(native): cover property record isolation on every platform
Move the synthetic Objective-C property Mach-O into a shared fixture and
decode it through decodeAppleDispatchMetadata in a portable test, so
Linux and Windows runs also catch a regression that drops valid sibling
properties. The macOS CLI cases keep exercising the built command.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Replace fixed Linux Hopper release pins with current vendor feed metadata,
complete detached-PGP package verification under the stable publisher primary
key, and authenticated package evidence for offline admission. Share parsed
publisher facts across approved setup, doctor and the pre-execution guard.
Preserve existing ownership, cancellation, private-display and cleanup rules.
Fixes#3577
Normalize empty XDG settings, preserve backups during approved cache repair,
and retain publisher cleanup through cancellation and shutdown. Exercise cold
offline verification without reusing process-local proof state. Serialize
approved cache publication across processes, restore old evidence on failure,
and share the existing lease owner from process without changing its identities.
Validation: 438 focused tests (six platform-related skips), full static/documentation checks, real Ubuntu
24.04 official Hopper 6.6.0 setup/CLI/MCP, offline ordinary-user admission,
launcher mutation rejection, and cold/warm verification measurements. Official
RPM metadata mismatch is tracked separately in #3578 and fails closed.
BREAKING CHANGE: Older Linux Hopper builds admitted by the fixed allowlist
now require retained publisher-signed package evidence or an approved update
to the current public demo. Update explicit HOPPER_LAUNCHER_PATH values when
migrating; the live feed exposes only its current release.
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
An Objective-C property attribute string whose quoted class name never
closes, such as T@"NSString, was treated as complete. The missing N and
R were then read as the Objective-C defaults, so the property was reported
atomic and read-write, and objc_properties_categories coverage stayed
complete. The documented semantics require null flags for incomplete
attribute metadata.
The attribute splitter now reports whether every quote closed. An
incomplete string leaves atomicity and any unestablished read-only value
null, while explicit N or R tokens remain established and the raw type is
preserved. Each affected property adds a property_attributes_incomplete
issue, which marks the facet partial.
Fixes#3345
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(cli): accept --flag=value for global output flags
`rea <command> --format=json` failed with "Unknown flag: --format".
`--filter-output=...`, `--token-limit=...` and `--token-offset=...`
failed the same way. Incur reads these global flags only in spaced form,
so the equals form fell through to the command parser. Command options
already accept both forms, and `rea mcp doctor` parses `--format=` itself.
A valued output flag with no value (`--format` last, or `--format=`)
also reported the flag as unknown with code UNKNOWN.
normalizeCliOutputArguments, in the module that owns output-argument
interpretation, now splits the equals forms of the four valued output
flags. The entry point passes the normalized argv to rea's output
validation and to Incur, so both read the same effective values. A
missing value now fails with MISSING_OUTPUT_VALUE and names the flag.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(cli): detect missing output values while parsing output flags
The missing-value check scanned argv again after parsing, so it also
checked tokens the parser had already consumed as values. For example,
`--filter-output --format` selects the field `--format`, yet the second
scan reported `--format` as missing a value. parseCliOutputArguments
now records the first valued flag it skips for lack of a value, in the
same pass that consumes values.
Cover normalizeCliOutputArguments directly: values containing `=`, empty
values, and command options that only share a prefix. Export it in the
dispatcher test's runtime stub as well.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(javascript): reject FIFO recovery inputs without blocking
scanRecoveryFile opened the selected path with a blocking O_RDONLY open
before checking that it is a regular file. A FIFO with no writer blocks
that open in the libuv threadpool, so cancellation and the recovery
deadline could not settle the read, and the process could not exit.
Admit the input through the shared openRegularFile owner, which opens
with O_NONBLOCK and verifies a regular file before any read. A FIFO,
directory or socket now fails admission immediately with the existing
regular-file error; symlink rejection and cancellation are unchanged.
Fixes#3332
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(javascript): keep a failed admission close owned on cancellation
Rethrow RegularFileAdmissionFailure before mapping cancellation, so a
descriptor whose close failed stays owned by its error.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(reference): stop attributing overwritten require members to Node
import-reference-source treated require.resolve(...) and require.main(...)
as Node's resolver even after the file replaced that member, so a literal
argument became a parsed internal dependency that the source never loads.
Attribute member calls only while the loader's resolve and main members
keep Node's identity: no write to either member or a computed member
(assignment, update, delete, destructuring) and no use of require as a
value where a mutator or alias could replace them. Bare require(...) calls
are unaffected.
Fixes#3393
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(reference): keep optional and wrapped loader uses intact
An optional call require?.(...) or a TypeScript or parenthesis wrapper
around require was read as require escaping as a value, which disabled
every member-call link in the file. Look through inert wrappers and
accept optional calls before deciding the loader escaped, and add
controls for bare calls after a member overwrite, a local loader's
member write, and optional calls.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
A plain new Worker("./w.js") or navigator.serviceWorker.register("./sw.js")
resolves against the document base URL in a browser, and a Node
worker_threads string resolves against the working directory. Static
analysis was resolving browser strings against the calling script, which
recorded a resolved mapping to the wrong file.
Only new Worker(new URL(path, import.meta.url)) now produces a specifier.
Other worker and service-worker strings keep their expression and stay
unresolved, matching the existing worker_threads string handling.
Fixes#3309
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
plutil writes years past 9999 and negative years in a form the pinned
XML decoder cannot parse, and binary plists can hold dates outside the
JavaScript Date range. The decoder returns an Invalid Date. Its
projection's toISOString() call then threw, so inspect_plist failed the
whole plist as "unreadable_output" with a `rea doctor` remediation.
Keyed archive inspection and Interface Builder decoding rejected the
archive in the same way.
projectPlistValue, the shared projection, now reports such a date as
{ "$plist_type": "date", "iso8601": null } and counts it. inspect_plist,
keyed archive inspection and Interface Builder decoding each add a
counted limitation, as they already do for non-finite reals.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
resolveInternalSpecifier offered posix.join(dir, "index") as the
second candidate, ahead of every extension. With both dep.js and an
extensionless dep/index present, require("./dep") therefore resolved to
dep/index, a file that neither Node nor TypeScript ever selects.
Directory candidates now carry an extension. File and index ordering is
otherwise unchanged, so Node-validated cases such as dep/index.js
winning over dep.cjs keep their meaning.
Fixes#3381
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(cli): stop quietly when the stdout reader closes early
`rea ... | head` crashed once head closed the pipe. TOON and YAML output
raised an unhandled EPIPE 'error' event with a Node stack trace. JSON
output reported {"code":"UNKNOWN","message":"write EPIPE"} on stderr.
Both exited 1, as if the analysis had failed.
The CLI entry point owns process.stdout, so it now treats EPIPE as the
reader declining the rest of the output. It stops writing, suppresses
the failure report and exits 141 like a SIGPIPE-terminated writer, also
when Incur exits through its own failure path. Other stdout errors are
handled as before.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(cli): guard mcp doctor output and cover midstream reader closure
The closed-reader guard was only installed for ordinary CLI commands. As a
result `rea mcp doctor | head` still crashed on EPIPE. The guard now lives
in one entry-point function shared by both CLI branches; MCP stdio keeps
its own lifecycle.
The tests now also close the reader after the first chunk of a 4 MiB
streamed JSON result, so later writes in writeJsonOutput are covered.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
