The CIL opcode table held five of the six ECMA-335 prefix opcodes and
omitted no. (FE 19 <unsigned int8>, III.2.2). A method body using it was
reported as malformed with "Unsupported CIL opcode 0xfe19", losing its
instruction counts and normalized IL digest.
Decode it with its one-byte check mask and treat it as a prefix, so it
shares an instruction boundary with the opcode it modifies.
Claude-Session: https://claude.ai/code/session_012pRGskbPGjT444CgJfuhhj
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
The decoder already reports "Instruction X at IL offset N leaves method
body" when an operand's computed end passes the IL body, but only after
the operand was read. Operand readers use Buffer reads, so an operand
cut off by the body end threw a RangeError first. The catch-all stored
Node's message ("Attempt to access memory outside buffer bounds" or an
offset RangeError) as body.issue, dropping the instruction and offset.
A body ending in a lone 0xFE two-byte opcode prefix failed the same way.
Treat a RangeError from the operand read as the operand leaving the body
so the existing diagnostic applies, and check the second opcode byte
before reading it. Malformed status, partial coverage and earlier
decoded instructions are unchanged.
Fixes#2677
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(managed): classify ReadyToRun images without ILONLY as modern .NET
crossgen2 clears COMIMAGE_FLAGS_ILONLY and sets IL_LIBRARY on ReadyToRun output. inspect_managed_artifact checked the clear ILONLY flag before the ReadyToRun signature, so real ReadyToRun assemblies were reported as runtime_family mixed-clr-native and implementation cpp-cli-mixed, and cil-and-ready-to-run was unreachable for crossgen2 output. Check the ReadyToRun signature first; a clear ILONLY flag without it still reports mixed CLR/native code.
* test(managed): exhaust capacity through inspected assembly references
---------
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
* feat(managed): name the declaring type of call and field targets
Call edges named external targets by member name alone (Join, ToJson,
WriteAllText), and method-spec edges had no name at all, so an analyst could
not tell which library a method calls or find every use of a type without a
decompiler. Field accesses through MemberRefs had no name either.
Name each TypeDef, TypeRef, and generic-instantiation TypeSpec once, in the
namespace-qualified form TypeDef full_name uses, and add member_refs
parent_name, call_edges target_declaring_type, and field_accesses
field_declaring_type. A method-spec target reports the generic method it
instantiates. Fields, member references, methods, and method specs now
resolve through one token-keyed MemberCore lookup instead of three maps.
Evidence recorded before these fields reads them as null.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(managed): validate spec blobs and member kinds before naming targets
Address review findings on declaring-type naming:
- A generic instantiation must name a TypeDef or TypeRef, so a TypeSpec
base is reported as malformed instead of followed. Naming no longer
recurses.
- TypeSpec and MethodSpec instantiation blobs are decoded with the
member-signature grammar. Malformed blobs and out-of-range TypeDef rows
are reported against their owning row and make coverage partial.
- A MethodSpec reads both columns. An invalid Method coded index is
reported; a readable Method keeps its name beside a malformed
instantiation.
- MemberCore carries its signature kind, so a field operand is named only
by a field or field-signature MemberRef. This replaces the token-table
guard.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(managed): validate MethodSpec arity and report unsupported spec blobs
- A MethodSpec now checks that its method signature is generic and that
the instantiation supplies as many type arguments as it declares. A
non-generic target, a field reference, or a count mismatch is reported
as invalid-row; the readable method keeps its name.
- Unsupported TypeSpec and MethodSpec forms raise an owner-scoped
unsupported-signature issue instead of reading as an intentional
unknown.
- MethodSpec reading moves to ManagedMethodSpecs.ts, and its tests get
their own describe block.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(managed): reject non-method signature headers and invalid TypeRef scopes
The method signature header reader now owns the calling-convention rule
that only FNPTR applied: FIELD, LOCAL_SIG, PROPERTY, and GENERICINST
headers, the reserved bit, and EXPLICITTHIS without HASTHIS are malformed.
A MethodSpec whose method has a PROPERTY header is no longer accepted as a
generic method, and member signatures with such headers no longer decode
as methods.
The type-name lookup validates a TypeRef's ResolutionScope coded index and
reports an out-of-range scope as invalid-row, keeping the readable name.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(managed): hold member rows to MethodDefSig and FieldSig headers
Method signature headers are now checked in context. MethodDef and
MemberRef rows accept only the MethodDefSig/MethodRefSig headers: DEFAULT,
VARARG, or GENERIC with DEFAULT. FNPTR keeps the unmanaged conventions
compilers emit for function pointers. A field signature must be exactly
FIELD, so a flagged FIELD header is malformed and never names a field.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(managed): accept MethodSpec arity only from a fully decoded signature
The arity check read only the target's signature header, so a truncated
generic method signature passed. Under type selection a MethodDef target
outside the selection is never decoded elsewhere, so coverage stayed
complete. The arity now comes from a transient full decode, and only a
decoded method signature supplies it. signature() keeps its raw length
and digest around the shared decodeSignature.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* perf(managed): decode each MethodSpec target signature once
edgeTargets caches the generic arity, including a failed decode, by
target method token, so many instantiations of one generic method share
a single signature decode. Unity.InputSystem has 472 distinct MethodSpecs
over about 133 target methods.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(managed): validate spec type operands and transitive reference scopes
* fix(managed): retain readable names when a scope row is unreadable
* test(managed): pin owner-scoped spec operand and scope-chain checks
e59217c83 validates spec type operands inside specSignature, so a
malformed generic TypeSpec base is now invalid-row under its owning
TypeSpec row; the three stale expectations follow that. New cases cover
a TypeSpec argument and a MethodSpec argument that name a missing TypeRef,
and a TypeRef whose ResolutionScope names itself. The scope cases move to
their own describe block.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(managed): keep field targets from naming MethodSpecs
A MethodSpec over a field-signature MemberRef inherited kind "field", so
an ldsfld on that MethodSpec published a field name and declaring type
for malformed IL. A MethodSpec now borrows its target's name only when
the target is not a field; the arity check still reports it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(managed): reuse owner-decoded signatures for MethodSpec arity
MemberRef signatures, and MethodDef signatures in the type selection, are
already fully decoded, but the MethodSpec arity check decoded them again
and admitted a second transient allocation, which could exhaust the
budget. MemberCore now carries the owner's genericArity, and only a target
nothing decoded, such as an unselected MethodDef, falls back to the raw
signature. signatureGenericArity is the one rule for both paths.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
The CLI header's 32BITREQUIRED and 32BITPREFERRED bits are one two-bit
field. Reading 32BITREQUIRED on its own reported Prefer32Bit assemblies
(flags 0x00020003) as x86-only with requires_32bit true, and left
anycpu-prefer-32 reachable only through the reserved combination.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(managed): report malformed PE layouts as invalid input
readManagedPeLayout raises ManagedReaderFailure for DOS, COFF and section
header failures such as section data past EOF. Those escaped the managed
inspectors, so ManagedStaticProvider wrapped them as ProviderAdapterError
and the CLI and MCP reported execution_failure with advice to run rea
doctor. Map format failures to an invalid_format input issue carrying the
reader's detail, as inspect-pe-resources and inspect-go-binary do.
Fixes#2191
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(managed): route unmappable PE layouts through one input error
inspect-managed-native-boundaries caught a layout-level ManagedReaderFailure
itself and returned an empty malformed inspection with exit 0, while the
other managed operations now report the same bytes as invalid input. Let
the layout failure reach the provider's invalid_format mapping; metadata
failures after a readable layout still return malformed coverage.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Reuse managed snapshot admission and hashing in sequential path comparisons, retaining caller paths and completed inspection Evidence on later failure. Preserve exact failed-close owners alongside typed read and cancellation failures, and retry them through caller-owned resource scopes. Require canonical Hopper lease identities, remove signed offset coercion, and repair stale setup cleanup expectations that failed CI.
Distinguish absent CLI directories from unreadable directory counts and truncated slots while preserving known PE headers and readable CLI data.
Retain environment-entry coverage in the Darwin parser and classify restricted empty, unavailable and ambiguous environments at the native boundary. Keep cleanup fail-closed; code-signing flags do not establish ownership.
Validation: 116 managed source tests, 13 ownership tests, native Swift parser probe and two live Darwin run-token tests; build, static checks and docs checks pass. Restricted-flag cases use parser fixtures; no real restricted capture is claimed. Related to #2035.
ReadyToRun images compiled for Linux, macOS or the BSDs store the COFF machine XORed with IMAGE_FILE_MACHINE_NATIVE_OS_OVERRIDE (dotnet/runtime src/coreclr/inc/pedecoder.h). Every framework assembly in a Linux .NET install has machine 0xFD1D, so target admission and the managed PE reader rejected them as an unsupported architecture.
Decode the PE machine once in src/domain/peMachine.ts, replacing the two duplicated switches, and accept an OS override only on images with a CLI directory.
Select exact declaring types before managed signatures and CIL bodies are decoded, preserving caller choices in CLI/MCP Evidence. Keep unmatched names and selected coverage explicit; comparisons and graphs retain unknowns outside their observed scope. Reuse existing metadata ownership/accounting and advertise unique selections through the actual SDK Schema.
Validated with 229 focused tests across 21 files, 11 managed conformance controls, fullstatic/docs checks and real Linux CLI and fresh MCP inspection of two unchanged DLLs. All 118 selected CIL hashes matched original PE-mapped bytes; result/caller-argument parity and unmatched controls passed. Full artifact/native-boundary metadata is complete; whole-assembly members retain the unchanged 64 MiB resource constraint. No target code executes.
Refs #1878
Co-authored-by: skared <190618464+skoodster@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Ysopwnable <161784452+N0zoM1z0@users.noreply.github.com>
Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Reject malformed UTF-8 ZIP filenames at the decoding boundary while retaining CP437, Unicode Path overrides and leading U+FEFF. Preserve valid CustomAttribute parent and value facts when constructor identity is invalid, with an explicit partial-coverage issue.
Validated ZIP integrity and filesystem-provider workflows, managed producer cases, temporary-file hygiene, package and static checks. Removed the superseded producer-only invalid-constructor regression.
Inventory attribute lookups and the members inspector each interpreted
TypeDef member-list ownership. The members lookup binary-searched ordered
ranges but fell back to a per-member scan of every type when malformed
lists were unordered, which was quadratic (8 s for 100,000 types).
Both now use firstMatchListOwners, one near-linear first-match index over
one-based list positions. Remove the ordered/fallback split and the
production declaringType scan, which remains only as the test oracle. The
inventory reserves only its retained index.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
Give snapshot capture, header admission, packed members, and container streams one file-handle owner. Serialize adoption with reader shutdown, retain failed closes for retry, and remove snapshots only after descriptor cleanup succeeds.
Cover unread members, pending opens, zero-byte members, and paired format/cleanup failures. Keep intentionally unrecoverable test fixtures hygienic and strengthen managed identity and process cleanup-authority expectations.
Validation: full npm run check; 99 targeted tests and temporary-directory hygiene; exact discovery of 877 test files. No real vendor-provider verification was performed.
Resolve fields, methods, and attribute constructors through one budgeted index per layout. Preserve malformed-list first-match ownership without per-member TypeDef scans; remove the superseded lookup implementations.
Validate pointer identity and malformed ranges through production parsers, including a 40,000-type/method case and allocation admission. Managed source tests and CLI/MCP pointer acceptance pass. Refs #1953.
Each CustomAttribute whose constructor is a local MethodDef scanned the
TypeDef table to find the declaring type, so inspect_managed_artifact did
O(attributes x types) row decoding. A 584 KB assembly with 16,000 types
and 16,000 such attributes blocked for about 38 s.
Build a first-match owner index once per metadata layout. Already-owned
list positions are skipped, so overlapping malformed method lists keep
their previous first-match owner in near-linear time. The index is
charged to the decode budget, and a build failure is cached like the
member pointer lookup.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Charge fixed row bookkeeping once per table and row within an admitted
metadata layout. Repeated owner lookups no longer permanently consume
capacity for temporary cursors; distinct rows and failed admissions retain
the existing representation limit and typed failure behavior.
Verify repeated local attribute-constructor lookups through public CLI
metadata/member inspection and preserve the remaining capacity guards.
Closes#1878
Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
* fix(managed): decode generic, array, fnptr, and modifier signatures
Member signatures using GENERICINST, ARRAY, FNPTR, CMOD_REQD/CMOD_OPT,
or TYPEDBYREF were reported as unsupported, leaving their types unknown
and turning otherwise complete inspections partial. Decode them with an
explicit stack so nested signatures stay recursion-free, keep encoded
TypeDefOrRefOrSpec values, and report malformed shapes as malformed.
Fixes#1832
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(managed): bound array rank before rendering dimensions
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(managed): keep modifier order and reject non-method fnptr headers
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(managed): reject corrupt fnptr flags and misplaced typed references
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(managed): decode signature elements by grammar position
Track whether each element is a field type, return type, parameter,
nested Type, or pointee. VOID is valid only as a return type or
pointee, TYPEDBYREF only as a return type or parameter, and BYREF only
at the top of a return type, parameter, or ref field; other placements
are malformed. Function pointer items are parsed as a return type then
parameters, and generic arguments as Types.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(managed): report ExportedType rows in managed member inspection
Facade assemblies such as System.Runtime.dll provide their types only
through ExportedType rows (type forwarders), which member inspection
never read, so they reported complete coverage with no types. Report
each row as declared with its flags, forwarder bit, TypeDefId hint, and
implementation token, and record invalid or null implementation coded
indexes as partial coverage. Comparisons now state that exported types
are not compared when either side has them.
Fixes#1812
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(managed): read earlier member Evidence without exported types
Member Evidence recorded before ExportedType rows were read omits the
field. Parse it as null (not examined) instead of rejecting it, and
state in comparisons that such an observation's exported types are
unknown.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(managed): leave exported types unknown when metadata is unavailable
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(managed): charge retained member facts instead of decoding bounds
inspect_managed_members returned no types or methods for ordinary
assemblies: Newtonsoft.Json 13.0.3 (netstandard2.0, 705 KB) exceeded
the 64 MiB representation budget. Each method body reserved 256 bytes
per IL byte and each signature 256 bytes per blob byte before decoding,
and those worst-case bounds were never returned, so the budget scaled
with total IL size rather than with the retained output. The final
projection admission also charged every decoded string at six bytes per
character and every scalar at 32 bytes, about eight times its JSON size.
Bound IL, exception-clause and signature decoding with a transient
admission that does not consume capacity, then reserve the decoded body
or signature that is actually retained. Projection admission now
charges the exact UTF-8 JSON bytes of decoded strings, keys and scalars;
escaped and multibyte text still counts at its encoded size.
Newtonsoft.Json now yields 496 types, 4185 methods and 18846 call
edges. Assemblies whose retained facts exceed the budget, such as the
2.3 MB System.Private.ServiceModel 4.7.0, remain unavailable.
* fix(managed): bound concurrent decoding and count JSON bytes in place
Review follow-up. A method's IL bound and its exception-section bounds
were each checked against the same remaining capacity although their
bookkeeping is live at the same time, so 40 MiB of IL plus 40 MiB of
exception clauses passed a 64 MiB budget. Transient admissions now
accumulate until the method body or signature is built, and reserve
respects bounds that are still live.
Projection admission also serialized each decoded string to measure it,
which could allocate about six times a near-limit string before the
check. It now counts the exact escaped UTF-8 bytes without building the
JSON text.
* fix(managed): admit derived call and field edges as they are built
Review follow-up. Released IL bounds no longer stand in for the call and field-access records that edges() derives from anchors. Each record is now admitted before the graph grows further, so a crafted assembly cannot materialize the whole derived graph before the representation guard fails.
* fix(managed): admit derived caller names before building them
Review follow-up. The caller name of call and field-access records was interpolated per anchor before any admission saw it. It is now built once per method, after its exact JSON size, counted from the type and member names, has been admitted.
Preserve .NET Standard as an API compatibility target while leaving the runtime family unknown unless independent markers identify it. Keep real DLL metadata and existing runtime-marker precedence intact.
Closes#1736.
Co-authored-by: AC <ac@fabtek.cn>
* fix(build): emit no runtime imports for type-only bindings
Under verbatimModuleSyntax, an import whose specifiers all carry inline
`type` modifiers compiles to `import {} from "..."`, a side-effect import
that still resolves and evaluates the module. 78 compiled modules carried
one, including `import {} from "playwright-core"` in the browser scenario
session, which loaded Playwright's module graph at MCP startup.
Use top-level `import type` for these bindings and enable oxlint's
typescript/no-import-type-side-effects rule so the pattern cannot return.
Refs #1685
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* perf(mcp): load Playwright when a scenario launches, not at startup
The browser scenario and Electron active providers are constructed before
the stdio server serves, and both bound Playwright's launchers at module
load. Resolve `chromium` and `_electron` from playwright-core when a
capture opens instead, as the web module resolver already does.
MCP startup now resolves 1,312 modules (4,902 resolutions) instead of
1,598 (6,076) before reading the first request, and no longer loads
playwright-core. Provider construction, the tool catalog, and capability
inventory are unchanged.
A boundary test spawns the stdio server, initializes, lists tools, and
asserts playwright-core and isomorphic-git were not resolved; the CLI
probe now exercises the real launch path to prove detection.
Closes#1685
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Use the shared resolver for virtual containment, overlap checks, and file-backed extent. Raw alignment padding no longer supplies method bytes or shadows a later virtual section. Preserve malformed body coverage and suppress CIL hashes outside the admitted range.
Verify zero, exact-end, truncated-body, padding, and true-overlap cases through compiled CLI and MCP consumers. Synthetic PE fixtures only; no Windows loader or real managed-provider verification.
Fixes#1596. Supersedes #1595.
Remove forwarding wrappers and shadow aliases, migrate callers and verification scripts to their owners, and share one exhaustive semantic resource-bound projection.
Deliver complete Evidence directly through MCP with required nullable analysis profiles and immutable per-server delivery settings. Bind selected environments at construction and require typed cleanup outcomes with retained retry ownership.
Remove test-only routing, duplicate session and snapshot metadata, producer-field repairs, and ambiguous provider arguments. Separate artifact byte identity from occurrence classification and retain typed source-map and partial native facts across CLI, MCP, and verifier consumers.
BREAKING CHANGE: obsolete Evidence envelopes, session aliases, incomplete snapshots, and missing normalized producer facts are no longer accepted.
When the CLI header parsed but its metadata could not be admitted, the
native-boundary fallback reported hard-coded false flags and zero header
values. A corrupt-metadata ReadyToRun image therefore appeared IL-free
and non-native. The fallback now reports the parsed CLI header and
derives the summary from it as the full inspection does. When the CLI
header itself is unreadable, a limitation says the values are defaults.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
`inspect_managed_native_boundaries` wrote the PE classification
(`not-managed` or `malformed`) into `coverage.state`, which accepts only
`complete`, `partial`, or `unavailable`. Its own result validation then
threw, so every native DLL and every PE with unreadable CLI metadata
failed as a generic execution failure advising a retry. The sibling
artifact and member inspectors succeed on the same files.
Report these files with `unavailable` coverage, as the member inspector
does, keeping the metadata status and parse issues.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor(domain): split error taxonomy into thematic modules
Move each error family out of domain/errors.ts into its own module
(base, core, provider selection/adapter, browser observation,
artifact, evidence, unknown registry, hopper, configuration) and
relocate AnalysisErrorProjection to analysisErrorProjection.
Migrate all 162 importers to the owning modules and delete
errors.ts. No re-export shims; behavior is unchanged.
* refactor(runtime): name all silent catch causes without changing diagnostics
Bind cause in every bare catch and unhandled rejection across src/.
Real failures preserve the cause for logging; best-effort cleanup
carries an explicit comment. Caller-visible and Evidence strings are
byte-identical to before.
Move each error family out of domain/errors.ts into its own module
(base, core, provider selection/adapter, browser observation,
artifact, evidence, unknown registry, hopper, configuration) and
relocate AnalysisErrorProjection to analysisErrorProjection.
Migrate all 162 importers to the owning modules and delete
errors.ts. No re-export shims; behavior is unchanged.
