Own CDP frame applicability and identity at the parsed event boundary. Preserve malformed or incomplete main-frame facts, recognize replacement roots, and carry the same document identity through captures, screenshots, timelines, and execution windows.
Validation: full check:ci and docs:check; 763 browser and dispatch tests passed, 6 skipped. Independent source and fixture-lifecycle review passed. Local real-Chrome behavior was not exercised.
Closes#5665
Keep malformed or missing CDP opcodes and payload facts unknown, retain observed zero and empty payloads, and avoid false capture differences while preserving independently known facts.
Validation: 59 source tests; compiled public CLI and stdio MCP fake-CDP acceptance; check:fast; docs:check; changed-file formatting. Real Chromium malformed-event behavior was not tested.
BREAKING CHANGE: WebSocket event opcode is nullable and numeric values are restricted to the four-bit protocol range.
Fixes#5666
Keep POSIX symlink-parent traversal at the shared JSON input boundary and forward the selected browser executable without a second lexical normalization. Verify Electron, browser, and Evidence-file consumers through registered commands and the built CLI.
Refs #5103
Retain absent or invalid Runtime timestamps as null and mark console event coverage incomplete. Preserve observed finite timestamps, including zero, and document the epoch-millisecond clock.
BREAKING CHANGE: console event timestamps may now be null when the protocol does not provide a finite number.
Refs #5656
Sample the browser monotonic clock with observation already subscribed, filter historical lifecycle and network facts, and preserve scope and termination handling when event time is unknown.
Bound pre-arm retention using transport-owned wire bytes. Fail closed when the relevant-event buffer fills, and keep unrelated protocol payloads outside that budget.
BREAKING CHANGE: observe_web_session timeline timestamps can be null when the producer supplies no comparable timestamp. Consumers must handle unknown time explicitly.
Refs #5609
Reuse the cancellable segmented wait and settle observation termination through one cleanup owner. Preserve caller cancellation and release timers/listeners across early target end.
Fixes#3929.
Parse gRPC-Web trailer blocks with typed failures, enforce field values and lower-case names, and propagate unexpected decoder failures. Retain earlier fields and raw capture bytes across binary and text framing.
Refs #5386. Related control-value fix: #5422.
Replace the lookahead-based pattern with separate allOf/not JSON Schema rules for quartet length, alphabet, padding and canonical pad bits. Share the runtime predicates with HAR and padded base64 parsing.
Validate converted advertised leaves with the MCP SDK validator, preserve permissive versus canonical semantics, and exercise every pattern near the 32 MiB encoded-input budget in all JavaScript modes.
Share padded decoding across CDP response shapes and cache fingerprints,
and count binary WebSocket bytes without allocating a decoded buffer.
Preserve HAR canonical pad bits and validate before allocation.
Replace repeated alphabet quartets in canonical schemas with separate
alphabet, padding and fixed-width length assertions. Cover near-32MiB
encodings under ordinary, Unicode and Unicode-set modes, plus complete
4MiB CLI and MCP retained-evidence export workflows.
Fixes#5253
Keep a run-scoped evidence owner from acquisition through settlement and
cleanup retry. Bind token observations to native generations and retain
related generations and unresolved identity lookups across table omissions,
reparenting and process-group changes without treating PID hints as authority.
Use native effective UID facts for withholding decisions, corroborate Linux
procfs absence, and share the Linux stat parser with sampling and debugger
identity checks. Signal only after current token and group revalidation.
Complete swept cleanup across all groups with one bounded final family check;
retain unresolved owners and successful-peer completion across retries.
Validation: npm run check, docs:check and test discovery passed. Focused
ownership/consumer coverage totals 513 passed and 1 skipped across 35 files,
including the corrected Electron cancellation test rerun independently. Darwin helper compilation, real
owned Node child cleanup, CLI/MCP capture and retained cleanup retries ran.
Real Electron applications, native Linux races/PID reuse and Windows cleanup
were not qualified. The original Linux reports remain open for that work.
Fixes#5238
Refs #4322, #5206
Parse Pickle extents once at the ASAR boundary and carry finalized signature
facts through root and nested classification. Scan JSON whitespace within its
declared extent and decode budget without retaining the whitespace prefix.
Keep prefix storage bounded independently of stream chunk ownership.
Fill fixed ASAR prefixes and DMG trailers across short reads, preserve
cancellation through admission and stream EOF, and retain existing cleanup
ownership. Cover public CLI/MCP selection, root/nested inventory, malformed
JSON whitespace and padding, limits, native/XML consumers and descriptor faults.
Validation: 24 focused files / 170 tests; full check; docs check; test discovery.
Official inert ASAR fixtures and controlled descriptor faults were exercised;
real Electron execution, Windows and natural OS short-read frequency remain
unverified. Equivalent compact CLI tasks returned identical results and reply
token estimates; repeated timings do not establish a speedup.
Fixes#3574Fixes#5188
Run inert captured-script analysis in owned children with per-script and aggregate deadlines, bounded source/result transfer and explicit per-script coverage. Preserve completed facts and exact cleanup authority across cancellation, mixed descriptor/process failures and cross-consumer retry.
Share aggregate source admission across page and Electron capture, expose CLI/MCP resource controls and retain selected parameters in Evidence. Verified with controlled CDP public workflows, real owned Node failure controls and the reporter-matching ReactDOM UMD artifact; real Chrome/Electron and Windows/Bun remain unqualified.
Keep canonical callback ownership independent of writable raw-listener
metadata. Resolve the native removal argument in current registration order,
then let EventEmitter own mutation, getter timing and removal meta-events.
Leave registrations unwrapped with explicit observation gaps when methods
or receivers do not support that ownership model. Preserve per-callback
Evidence for supported registrations and document the remaining limits.
Fixes#4513
Transfer canonical leases through opening, session and storage boundaries. Keep response deadlines separate from actual completion, drain independent owners, and join late opening failure cleanup before confirming recovery. Remove error copies in favor of canonical primary/cleanup composition.
Preserve exact caller reasons, completed observations and independent physical failures through final-close cancellation and retry. Closes#4869.
Validation:155 tests pass across15 focused source, service, CLI subprocess and MCP files; static/docs/discovery1551 pass. Two original-revision controls fail as expected. Bounded authored-session public CLI comparison preserves equivalent Evidence and1282 reply token estimates; no real Chromium qualification or forced-termination recovery claim (#4659).
Retain independent teardown leases, block capture admission until recovery, and preserve cancellation through failed finalization. Reuse pending close operations and require fresh Windows lineage plus passive family absence proof without cached descendant kills.
Fixes#4805
Adapt the prepared descriptor lifecycle repair from xu91102/rea dbb7db16. Bind exact file cleanup leases, retain typed physical failures and cancellation reasons, and join CLI/MCP finalization and active preflight. Share canonical Evidence construction and retain completed reports across reader handoff cancellation.
Scope active capture admission through shutdown and gate launch after close. Preserve successful descriptor peers and retry only unresolved owners. Separate process/transport retry ownership remains tracked in #4805.
Validation: 168 focused checks passed, one Windows-only skip; built CLI and actual stdio MCP controlled descriptor recovery; build, static and docs checks. No natural OS fault or real Electron launch/teardown claim. Ordinary full replies and Evidence IDs remain byte identical across 30 small CLI tasks.
Fixes#4658
Co-authored-by: hhang <169027046+xu91102@users.noreply.github.com>
Own decoded node columns, attributes and parent validity once for web, Electron and SVG interpretation. Reject dangling, self and cyclic parent facts; preserve source positions and independently unknown fields. Remove fallback conversions and duplicated string/attribute interpretation.
Validation: baseline public CLI controls failed for four malformed cases with valid control passing; final 103 focused checks, 5 final built CLI controls, 1 late-detach cancellation control (20 skipped), check:fast and docs:check passed. Fake CDP producers and generated local files; no real browser/Electron or Windows qualification.
Refs #4709
Use one typed CDP resource-size owner in web and Electron capture. Supplied invalid sizes retain null plus completeness diagnostics; omitted sizes remain unknown without inventing malformed metadata. Preserve other resource facts and valid zero/positive values.
Validation: public CLI regression failed against baseline clamping; 36 focused controls passed after the fix, check:fast and docs:check passed. Fake CDP producer with real CLI/transport and tiny local files; no real Electron/browser or heavy profiling qualification.
Refs #4708
Own syntax validation and source-located DOM projection together. Preserve explicit consumer policies and remove duplicated warning-message filters from Apktool and SAZ.
Validation: 92 focused checks, 3 selected fake Apktool boundary checks, check:fast and docs:check. No real Apktool or Ghidra execution.
Refs #4694
Validate token items and their parameters before projecting exact declared policy tokens. Keep malformed and non-token values unknown; retain separate grammar for other policy headers.
Validation: real pinned Chrome public CLI baseline/candidate, 101 focused checks and 90 overlapping final checks, 834 upstream item-vector adaptations with two permitted refusals, check:fast and docs:check. Other browser/platform and policy-specific MCP delivery unverified; no performance measurement. Refs #4677.
Parse CDP repeated field lines independently before applying URI and quoted-parameter delimiters. Preserve declaration order and derive agent hints from retained links.
Validation: real pinned Chrome public CLI baseline and candidate each captured three responses per fixture; repeated Document links/hints restored and comma/single/Fetch controls unchanged. Three source controls failed before the fix. Sixty-one focused checks plus fifteen overlapping final network checks, check:fast and docs:check passed. No performance measurement or other browser/platform claim. Refs #4679.
Refs #4467.
Retain failed socket owners across translated failures and resolve aggregate cleanup only after every required transport closes. Preserve concurrently active peer sessions.
Refs #4373, #4455, #4457, #4458.
Use canonical artifact ownership in Go, Rust, SQLite and PE readers and their failure consumers. Admit PE read budgets before allocation and ignore zero-extent sections in interval ownership. Close Rust resources through CLI and MCP lifecycles.
Fixes#4388. Refs #4027.
Observe cancellation during first-window waits and state reads; preserve cancellation and caller reasons before cleanup and retain partial observations when cleanup fails. Keep late cancellation and cleanup failure precedence.
Validation: 49 focused cases, static/docs checks, six controlled verifier-oracle cases and 39 current-head CI checks passed. Codex and Greptile found no remaining blocking issues. Real Joplin cancellation phases verified; complete Linux cleanup/first-signal CLI exit and packaged-runtime startup remain explicitly unverified/failed. Both verifiers now fail incomplete cleanup, including after main-process exit.
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Co-authored-by: Adolanium <94890352+Adolanium@users.noreply.github.com>
Preserve Electron cleanup observer reasons and typed primary failures through the shared error projection. Keep ownership and partial Evidence semantics intact.
Fixes#4403. Refs #4227, #4282.
* fix(application): retain completed evidence through cancellation
Validate completed provider reports before classifying cancellation and preserve Evidence and captured diagnostics. Share MCP recording and delivery across custom observation handlers. Add source-owned completion and public SDK recording controls. Refs #3923, #3927, #4261.
* fix(wasm): retain final observations through cancellation
Keep completed Evidence after finalization and through CLI/MCP delivery. Preserve output and cleanup failure precedence. Refs #4254.
* fix(browser): retain final observations and forward cancellation
Classify final CDP detach and completed scenario cleanup at the provider boundary. Translate completed partials into canonical Evidence for MCP recording, and forward CLI cancellation to passive Electron tools. Refs #4255, #4256, #4257.
* fix(ghidra): isolate cancellation of shared startup waiters
Keep startup group-owned while each caller has an independent abortable wait. Await final-owner cleanup and preserve cleanup facts before retrying. Reuse the shared abortable promise helper. Refs #3983.
* fix(mcp): keep shutdown registrations until cleanup succeeds
Retain repeated event requests while unresolved owners need cleanup, and unregister only after success. Verify coalescing and failed-owner retry. Refs #4253.
* fix(adb): own transfer snapshots and stage screen publication
Bind transfer digests to the exact private input bytes and preserve caller APK names. Retain failed descriptors and private-root owners with typed cleanup evidence; publish captures exclusively after the cancellation cutoff. Refs #4251, #4252.
* fix(verification): report ADB cleanup failures
Always close after attempted verification and keep unexpected primary failures and cleanup details visible. Exercise the production script with controlled imports, including null and undefined throws. Refs #4260.
* fix(runner): stop owned Windows commands on cancellation
Use the retained ChildProcess handle for IPC cancellation and parent disconnection. Keep the SQLite lock until observed child close, and include native Windows regressions in the curated CI lane. Native Windows results remain pending. Refs #4258.
* fix(website): canonicalize link containment boundaries
Compare resolved targets with resolved repository and site roots. Accept directory aliases while preserving escape checks and keep fixtures within their temporary owner. Refs #4264.
* docs(testing): cover completion races and cleanup retry
Clarify validation-before-cancellation, independent startup waiter controls, producer and adapter coverage, and repeated shutdown events.
* fix(filesystem): retain file owners and completed reads after close failure
* fix(session): report retained snapshot staging in cleanup status
Fixes#4277. Include both snapshot and profile file-resource scopes in the owning status fact, preserving publication receipts and cleanup retry.
* docs(mcp): clarify recovery of raw partial observations
Document the observed SDK cancellation boundary and the open design decision in #4276 without promoting raw errors to Evidence.
* fix(kuna): own the complete installation inspection lifetime
* test(kuna): cover session cleanup of shared cache resources
* fix(hopper): isolate publisher operation resource admission
* fix(hopper): preserve launcher cleanup failure classification
* fix(adb): retain ordered cleanup and screen publication outcomes
* fix(runner): retain Windows job ownership through cleanup retries
* docs: clarify inspection admission and ordered cleanup regressions
* fix(ghidra): preserve startup cleanup and request deadlines
* fix(runner): supervise stdin errors and bootstrap native controls
* docs: require queued lifecycle controls to survive admission
* fix(cli): leave cleanup resolution with resource owners
* test(adb): verify owned install snapshots through CLI
* fix(errors): exclude resolved primary cleanup resources
* fix(adb): resolve publication cleanup after its handle closes
* fix(android): resolve JADX hash cleanup after owned close
* refactor(android): share hash failure cause options
* fix(kuna): gate commands on retained descriptor cleanup
* docs: cover cleanup admission and owner-confirmed recovery
* refactor(artifacts): bind cleanup errors to confirmed release
* fix(adb): resolve recovered cleanup at retained owners
* fix(kuna): resolve installation cleanup after owned close
* fix(kuna): gate cache reads on retained hash cleanup
* fix(setup): preserve publisher cleanup admission failures
* fix(android): resolve the reported retirement cleanup error
* test(runner): scope post-spawn fault control to POSIX
* test(adb): cover persistent snapshot owner retirement
* fix(kuna): preserve file outcomes with explicit cleanup ownership
* fix(artifacts): resolve errors through retained cleanup owners
* docs(lifecycle): carry cleanup ownership in typed outcomes
* fix(adb): bind staged screen errors to their cleanup lease
* fix(kuna): bind profile cleanup through a close capability
* fix(artifacts): retain descriptor resources in cleanup errors
* fix(pcap): bind existing errors to snapshot retirement
* fix(windows): load source owner through its file URL
* test(build): copy the command runner helper into fixtures
* fix(mcp): own shared observation providers in the transport
* fix(jadx): resolve every retained cleanup retry error
* fix(kuna): bind retry errors to every retained cleanup owner
* fix(adb): bind admission and shutdown errors to exact cleanup leases
* fix(windows): resolve command paths before native ownership
* test(publisher): assert exact descriptor recovery without release metadata
* docs(lifecycle): require every retry error to follow its owners
* fix(kuna): keep hash cleanup state stable across concurrent retries
* test(windows): exercise surviving descendants with scoped shutdown deadlines
* fix(uninstall): preserve primary read errors through cleanup failure
* test(publisher): assert cleanup Result and exact owner recovery
* test(windows): observe supervisor resources through IPC disconnect
* fix(browser): retain typed cancellation after interrupted actions
* test(publisher): assert ownership phases without retry-count coupling
* fix(lifecycle): preserve abort reasons through shared provider execution
* fix(jadx): preserve execution and late hash cancellation causes
* fix(adb): compose late cancellation with exact cleanup failures
* test(mcp): use the shared budget for session workflows
Own CDP transports from admission through observed close, retain failed
owners for retry, and keep active peers separate from pending cleanup.
Preserve primary errors and completed facts through final cancellation.
Forward passive Electron CLI cancellation and dispose browser, runtime and
scenario owners from CLI and MCP shutdown.
Refs #4255, #4256, #4257
Keep each parsed script's observed frame after context destruction or ID reuse.
Remove the later context lookup so record identity and deduplication use the
same historical fact. Unknown and unauthorized frame mappings remain null.
Validated event-to-record behavior with real local files and simulated CDP
events, plus existing provider tests; no real Electron engine was exercised.
Refs #3823.
Co-authored-by: Liu Jie <maxazure@gmail.com>
Distinguish missing CDP inventories from observed empty arrays, retain valid
accessibility and worker siblings, and admit required fields before scope
inference. Stop interpreting DOM documents without a usable string table.
Validated producer semantics and simulated CDP provider boundaries; this does
not establish real Chrome or Electron engine behavior.
Refs #3376, #3379, #3850.
Co-authored-by: 李云周 <154221037+YunzhouLi-hub@users.noreply.github.com>
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
* fix(cleanup): preserve owner recovery instructions
Keep cleanup remediation through combined errors and direct or managed one-shot analysis while retaining primary diagnostics.
Refs: #4227
* fix(hopper): recover late startup and retained cleanup
Authenticate initial and cleanup handshakes through the same identity owner. Expose startup and cleanup activity, retain health after target retirement, and expire abandoned unauthenticated listeners without timing out authenticated work.
Refs: #4227
* fix(providers): retain composite lifecycle facts across retries
Preserve observed child health with incomplete peer coverage, retry only unresolved clients, and retain all child cleanup recovery actions.
Refs: #4233
* fix(process): honor cancellation through capture cleanup
Check the request signal after cleanup and before final publication, retaining completed observations under typed cancellation.
Refs: #4005
* fix(native): preserve failed LLDB launch ownership and exit proof
Publish failed-launch process identity and observed exit separately from object validity. Retire only the exact owned process and retain uncertainty when exit cannot be established.
Refs: #4232
* fix(native): honor cancellation after trace finalization
Check cancellation after runtime-root cleanup and retain collected trace observations as partial cancellation evidence.
Refs: #4009
* fix(cli): preserve analysis results when provider cleanup fails
Reuse the existing one-shot finalizer across thirteen command families to retain completed Evidence and primary diagnostics on close failure. Cover success, denied cleanup, and combined primary/cleanup failure through the public CLI.
Refs: #3935
* docs(lifecycle): define completion invariants and regression scenarios
Document distinct ownership/readiness/exit facts, late cancellation and atomic publication boundaries, partial child cleanup, and diagnostic retention. Link representative regressions and route contributor guidance through AGENTS.md.
Refs: #4227
* fix(session): retain run identity through pending cleanup
* fix(cli): preserve original cleanup resource diagnostics
* fix(native): retain completed facts through finalization failure
* fix(providers): report retained cleanup paths at their owners
Preserve the CDP detach limitation through successful and retained partial observations at their shared projector. Do not infer or replay unavailable caller user-agent/client-hint state.
This documents the reported Chromium platform reset; it does not prevent it. Source composition tests ran, without a new real-browser reproduction. Issue #4089 remains open.
Source-map original-source parsing reported `import type X = require("m")`
as a require dependency, although TypeScript erases the declaration. The
fetcher re-derived import-equals targets instead of using the existing
value-only rule. That rule now lives with the other type-only module
declaration predicates in javascriptModuleDeclaration, and the fetcher,
static analysis, and semantic analysis all use it.
Fixes#3932
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
inspect-electron-page read missing or non-array DOMSnapshot documents and
node arrays, frame-tree resource lists, and Target.getTargets target lists
as empty inventories while reporting complete_within_window.
The web capture path already validated these replies. Its parsing now has
one shared owner in CdpCaptureDocuments: snapshotDocuments,
snapshotDocumentNodes and frameTreeResources report unreadable parts
through a callback, and both the web and Electron inspections consume
them. Worker discovery records a missing target list or non-record entry as
an invalid_protocol_value exclusion. The Electron copies of this parsing are
removed.
Fixes#3379
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
morluto