Ysopwnable
2f3dee3fcf
Select the Windows curated lane for edits to the shared runtime path matcher and its workflow suite. Strengthen the existing POSIX/Windows mapping controls with matching basis, coherent target/script coordinates, caller spelling and static load-state assertions. Follow-up to #2422; thanks to @Aurantium-47 for identifying the recorded-path grammar issue. Verified with actual Windows 11 x64, official Node 24.18.0 and production CLI/MCP workflows using published npm 11.16.0 module Evidence. Four exact/mismatched implicit/explicit mapping cases pass with unchanged normalized hashes. The capture provider was Node Inspector; no IDA, Ghidra or Electron GUI verification is claimed. 230 focused tests, all eight CI static tasks, architecture guards and documentation checks pass after rebasing onto mainfb28ec153. The unrelated release-checkpoint and dyld fixture corrections were integrated from upstream; no patches to those files are included here. Final Windows MCP replay ate6e86946dpreserves all four normalized hashes, with no owned Node processes remaining. Resource probes ran serially at BelowNormal priority with one CPU and 512 MiB Node heaps; calls took 251–620 ms and the sampled process-family working-set sum peaked at 499,380,224 bytes. Source pins, provenance and measurement limits are recorded in experiments/analysis-efficiency/windows-posix-reconciliation.md. All 34 jobs in current-head CI run 38391921571 passed, including the Windows capability/package lane, all six portable test shards, JavaScript recovery and the required aggregate. Current-head Codex and Greptile reviews are clean; both prior scope-selection findings were fixed and resolved.
400 lines
15 KiB
JavaScript
400 lines
15 KiB
JavaScript
// Ownership of the native-host, real-provider and website verification lanes.
|
|
// Shared build inputs are classified once in plan.mjs rather than repeated in
|
|
// every workflow.
|
|
export const SCOPES = {
|
|
// Apple artifact CLI/MCP lane on macOS, including its focused regressions.
|
|
apple: [
|
|
"src/native/Apple*",
|
|
"src/native/NativeMacOS*",
|
|
"src/native/NativeUi*",
|
|
"src/native/Lldb*",
|
|
"bridge/native/**",
|
|
"bridge/process/**",
|
|
"scripts/verify/apple/**",
|
|
"tests/boundary/filesystem/installScript.test.ts",
|
|
"tests/boundary/filesystem/nibNativeHierarchy.test.ts",
|
|
"tests/boundary/filesystem/interfaceBuilderBundle.test.ts",
|
|
"tests/boundary/cli/nativePlistCli.test.ts",
|
|
"tests/boundary/cli/nativePlistPrototypeKeyCli.test.ts",
|
|
"tests/boundary/cli/nativePlistSelectionFailureCli.test.ts",
|
|
"tests/boundary/cli/nativeDemangleCli.test.ts",
|
|
"tests/boundary/mcp/nativeDemangleMcp.test.ts",
|
|
"tests/boundary/providers/native/nativeSignatureTargetBinding.test.ts",
|
|
"tests/boundary/cli/nativeSignatureCli.test.ts",
|
|
"tests/boundary/mcp/nativeSignatureTargetBindingMcp.test.ts",
|
|
"src/process/capture/FilesystemSnapshot.test.ts",
|
|
"tests/boundary/process/darwinProcessRunTokenReader.test.ts",
|
|
"tests/boundary/process/directAnalysisSignals.test.ts",
|
|
"tests/boundary/process/processCaptureLifecycle.test.ts",
|
|
"tests/boundary/process/processCli.test.ts",
|
|
"tests/boundary/mcp/sessionMcp.test.ts",
|
|
],
|
|
// Four-host installed-package matrix and the Windows curated lane.
|
|
package: [
|
|
"src/windows/**",
|
|
"native/windows/**",
|
|
"src/inspector/**",
|
|
"scripts/verify/inspector/**",
|
|
"scripts/verify-package.mjs",
|
|
"scripts/verify-package-*",
|
|
"scripts/verify-windows-*.mjs",
|
|
"scripts/build-windows-native.mjs",
|
|
"scripts/windows-capabilities.mjs",
|
|
"scripts/prepack.mjs",
|
|
"scripts/prepare.mjs",
|
|
"scripts/rea.mjs",
|
|
"install.sh",
|
|
"src/config/**",
|
|
"src/application/Setup*.ts",
|
|
"src/application/Uninstall*.ts",
|
|
"src/cli/interactiveSetup.ts",
|
|
"src/cli/setupCommands.ts",
|
|
"tests/boundary/filesystem/binaryTarget.test.ts",
|
|
"tests/boundary/filesystem/safeOutputTree.test.ts",
|
|
"tests/boundary/providers/native/artifactProvider.archiveSafety.test.ts",
|
|
"tests/boundary/providers/native/artifactProvider.extractionCompleteness.test.ts",
|
|
"tests/boundary/filesystem/setupUnavailableProvider.test.ts",
|
|
"tests/boundary/filesystem/windowsNpxRegistration.test.ts",
|
|
"tests/acceptance/setup/homeDirectoryFallback.test.ts",
|
|
"tests/boundary/filesystem/javascriptApplicationWorkflows.test.ts",
|
|
"src/domain/javascript/javascriptRuntimeStaticCandidates.ts",
|
|
"tests/boundary/filesystem/webScriptManifestPaths.test.ts",
|
|
"tests/boundary/process/ProcessEvidence.host.test.ts",
|
|
"tests/acceptance/webModuleCli.test.ts",
|
|
"tests/acceptance/webSourceLocationCli.test.ts",
|
|
"tests/boundary/cli/referenceSourceImportStatus.test.ts",
|
|
"tests/boundary/filesystem/asarInventoryFreshness.test.ts",
|
|
"tests/boundary/filesystem/javascript-applications/javascriptArtifactReconstruction.test.ts",
|
|
"tests/conformance/providers/ghidra/windowsCapabilities.test.ts",
|
|
"src/ghidra/GhidraInstallation.test.ts",
|
|
"tests/boundary/filesystem/ghidraJavaProbe.test.ts",
|
|
"tests/boundary/providers/ghidra/ghidraTransport.test.ts",
|
|
"tests/boundary/providers/ghidra/ghidraTargetSnapshot.test.ts",
|
|
"tests/boundary/providers/ghidra/ghidraLauncher.test.ts",
|
|
"tests/boundary/providers/hopper/hopperClient.cleanupRetry.test.ts",
|
|
"src/windows/WindowsNativeLoader.test.ts",
|
|
"src/windows/WindowsOwnedProcess.test.ts",
|
|
"src/ghidra/GhidraLauncherEnvironment.test.ts",
|
|
"src/process/ProcessOwnership.test.ts",
|
|
"src/process/ProcessOwnership.part2.test.ts",
|
|
"src/process/ProcessOwnership.part3.test.ts",
|
|
"src/process/ProcessOwnership.validation.test.ts",
|
|
"src/application/Update.test.ts",
|
|
"tests/process-global/updateMaintenance.test.ts",
|
|
"tests/conformance/providers/ghidra/realGhidraWindowsWorkflow.test.ts",
|
|
"tests/boundary/filesystem/directoryArtifactReaderOpen.test.ts",
|
|
"tests/boundary/filesystem/javascriptPackagePrecedence.test.ts",
|
|
"tests/boundary/filesystem/javascriptArtifactContentIdentity.test.ts",
|
|
"tests/boundary/process/sourceMapUncHosts.test.ts",
|
|
],
|
|
// Native SQLite runtime compatibility for the producer, public adapters,
|
|
// fixtures, shared lifecycle, and the package script that defines its suite.
|
|
sqlite: [
|
|
"src/sqlite/**",
|
|
"src/domain/sqlite/**",
|
|
"src/contracts/sqlite/**",
|
|
"src/application/sqlite/**",
|
|
"src/composition/sqlite.ts",
|
|
"src/cli/sqliteCommands.ts",
|
|
"src/server/registerSqliteTools.ts",
|
|
"src/application/DirectAnalysisStatus*.ts",
|
|
"src/application/CapabilityInventory*.ts",
|
|
"src/application/AnalysisProvider*.ts",
|
|
"src/contracts/toolContracts.ts",
|
|
"src/contracts/toolContractTypes.ts",
|
|
"src/contracts/toolEffects*.ts",
|
|
"src/contracts/toolOutputSchemaPrimitives.ts",
|
|
"src/domain/analysisError*.ts",
|
|
"src/domain/evidence*.ts",
|
|
"src/domain/inputIssueProjection*.ts",
|
|
"src/domain/jsonSerialization*.ts",
|
|
"src/domain/jsonValue*.ts",
|
|
"src/domain/localPath*.ts",
|
|
"src/domain/providerAdapterError*.ts",
|
|
"src/domain/providerCleanupError*.ts",
|
|
"src/domain/result*.ts",
|
|
"src/process/OwnedCommand*.ts",
|
|
"src/process/ProviderProcess*.ts",
|
|
"src/process/PrivateRuntimeRoot*.ts",
|
|
"src/artifacts/ArtifactReader*.ts",
|
|
"src/artifacts/ArtifactResourceScope*.ts",
|
|
"src/artifacts/ArtifactPaths*.ts",
|
|
"src/artifacts/readStableArtifact*.ts",
|
|
"src/filesystem/OwnedFileHandle*.ts",
|
|
"src/server/EvidenceMcpServer*.ts",
|
|
"src/server/analysisAdmission*.ts",
|
|
"src/server/contractToolHandler*.ts",
|
|
"src/server/toolRegistrationOptions*.ts",
|
|
"src/server/createServer*.ts",
|
|
"src/cli.ts",
|
|
"src/cliCommandNames.ts",
|
|
"src/cliLogging.ts",
|
|
"src/cli/commandCancellation.ts",
|
|
"tests/boundary/sqlite/**",
|
|
"tests/fixtures/sqlite/**",
|
|
"tests/acceptance/sqliteDatabaseCli.test.ts",
|
|
"tests/boundary/mcp/serverLifecycleMcp.test.ts",
|
|
".github/workflows/sqlite-runtime.yml",
|
|
],
|
|
browser: [
|
|
".github/workflows/real-browser.yml",
|
|
"scripts/verify-real-browser.mjs",
|
|
"scripts/verify-browser-network.mjs",
|
|
"scripts/verify-browser-scripts.mjs",
|
|
"scripts/verify-browser-modules.mjs",
|
|
"scripts/verify-browser-dom-destinations.mjs",
|
|
"scripts/lib/browser-*.mjs",
|
|
"scripts/fixtures/browser-network-site.mjs",
|
|
"scripts/fixtures/browser-script-site.mjs",
|
|
"scripts/fixtures/browser-module-site.mjs",
|
|
"scripts/fixtures/browser-verifier-site.mjs",
|
|
"scripts/fixtures/page-cdp-proxy.mjs",
|
|
"src/browser/**",
|
|
"src/domain/browser*.ts",
|
|
"src/domain/webScript*.ts",
|
|
"src/domain/webModule*.ts",
|
|
"src/application/WebModule*.ts",
|
|
"src/composition/webModules.ts",
|
|
"src/artifacts/readStableArtifact.ts",
|
|
"src/artifacts/ArtifactPaths.ts",
|
|
"src/application/WebScriptExportService.ts",
|
|
"src/contracts/webScriptToolContracts.ts",
|
|
"src/server/registerWebScriptTool.ts",
|
|
"src/server/registerWebModuleTool.ts",
|
|
"src/server/createServer.ts",
|
|
"src/cli/webModuleCommands.ts",
|
|
"src/cli.ts",
|
|
"src/cliCommandNames.ts",
|
|
"src/contracts/toolEffects.ts",
|
|
"src/cli/webScriptCommands.ts",
|
|
],
|
|
binary_layout: [
|
|
".github/workflows/real-binary-layout.yml",
|
|
"bridge/pwntools/**",
|
|
"src/native/pwntools/**",
|
|
"src/domain/native/binaryLayout*",
|
|
"src/application/binaryDiagnostics/**",
|
|
"src/contracts/native/binaryDiagnosticsToolContracts.ts",
|
|
"src/composition/binaryDiagnostics.ts",
|
|
"src/server/registerBinaryDiagnosticsTools.ts",
|
|
"src/server/createServer.ts",
|
|
"src/cli/binaryDiagnosticsCommands.ts",
|
|
"src/cli.ts",
|
|
"src/cliCommandNames.ts",
|
|
"src/contracts/toolContracts.ts",
|
|
"src/contracts/toolEffects.ts",
|
|
"src/process/OwnedCommand.ts",
|
|
"src/process/ProviderProcess.ts",
|
|
"src/process/ProviderDeadline.ts",
|
|
"src/process/ProcessOwnership*.ts",
|
|
"src/process/PrivateRuntimeRoot.ts",
|
|
"src/artifacts/readStableArtifact*.ts",
|
|
"src/artifacts/ArtifactReader.ts",
|
|
"src/domain/analysisError*.ts",
|
|
"scripts/verify-binary-layout.mjs",
|
|
"scripts/lib/elf-section-name-fixtures.mjs",
|
|
"scripts/lib/large-result-mcp.mjs",
|
|
"scripts/fixtures/binary-layout*",
|
|
],
|
|
evm: [
|
|
".github/workflows/real-evm-interface.yml",
|
|
"src/evm/**",
|
|
"src/domain/evm/**",
|
|
"src/application/evm/**",
|
|
"src/contracts/evm/**",
|
|
"src/composition/evm.ts",
|
|
"src/cli/evmCommands.ts",
|
|
"src/server/registerEvmTools.ts",
|
|
"src/server/createServer.ts",
|
|
"src/cli.ts",
|
|
"src/cliCommandNames.ts",
|
|
"src/contracts/toolContracts.ts",
|
|
"src/contracts/toolEffects.ts",
|
|
"src/process/OwnedCommand.ts",
|
|
"src/process/ProviderProcess.ts",
|
|
"src/process/ProcessOwnership*.ts",
|
|
"src/process/ProviderDeadline.ts",
|
|
"src/process/PrivateRuntimeRoot.ts",
|
|
"src/artifacts/readStableArtifact*.ts",
|
|
"src/artifacts/ArtifactReader.ts",
|
|
"scripts/verify-evm-interface.mjs",
|
|
"scripts/fixtures/evm-interface.sol",
|
|
"third_party/evmole/**",
|
|
],
|
|
javascript_recovery: [
|
|
".github/workflows/real-javascript-recovery.yml",
|
|
"src/javascript/recovery/**",
|
|
"src/domain/javascript/**",
|
|
"src/application/javascript/JavaScriptRecovery*.ts",
|
|
"src/composition/javascriptRecovery.ts",
|
|
"src/contracts/javascript/javascriptRecoveryToolContracts.ts",
|
|
"src/cli/javascriptRecoveryCommands.ts",
|
|
"src/cli/javascriptApplicationAnalysis.ts",
|
|
"src/server/registerJavaScriptRecoveryTool.ts",
|
|
"src/server/createServer.ts",
|
|
"src/server/sessionAvailabilityPolicy.ts",
|
|
"src/application/CapabilityInventory.ts",
|
|
"src/cli.ts",
|
|
"src/cliCommandNames.ts",
|
|
"src/contracts/toolContracts.ts",
|
|
"src/contracts/toolEffects.ts",
|
|
"scripts/rea.mjs",
|
|
"src/process/**",
|
|
"src/artifacts/SafeOutputTree.ts",
|
|
"scripts/verify/javascript/recovery.mjs",
|
|
"scripts/fixtures/javascript-recovery/**",
|
|
"third_party/wakaru",
|
|
],
|
|
recorded_crash: [
|
|
".github/workflows/real-recorded-crash.yml",
|
|
"bridge/pwntools/**",
|
|
"bridge/pwndbg/**",
|
|
"src/native/pwntools/**",
|
|
"src/native/pwndbg/**",
|
|
"src/domain/native/recordedCrash*",
|
|
"src/application/binaryDiagnostics/**",
|
|
"src/contracts/native/binaryDiagnosticsToolContracts.ts",
|
|
"src/contracts/toolEffects.ts",
|
|
"src/contracts/toolOutputSchemaGroups.ts",
|
|
"src/composition/binaryDiagnostics.ts",
|
|
"src/server/registerRecordedCrashTools.ts",
|
|
"src/server/createServer.ts",
|
|
"src/server/sessionAvailabilityPolicy.ts",
|
|
"src/cli/binaryDiagnosticsCommands.ts",
|
|
"src/cliCommandNames.ts",
|
|
"src/process/**",
|
|
"src/artifacts/readStableArtifact*.ts",
|
|
"src/domain/analysisError*.ts",
|
|
"scripts/verify-recorded-crash.mjs",
|
|
"scripts/verify/recorded-crash/**",
|
|
"scripts/lib/recorded-core-fixtures.py",
|
|
"scripts/fixtures/recorded-crash.c",
|
|
"third_party/pwndbg/**",
|
|
],
|
|
web_network: [
|
|
".github/workflows/real-web-network-captures.yml",
|
|
"bridge/mitmproxy/**",
|
|
"src/browser/history/**",
|
|
"src/domain/webNetworkCapture*.ts",
|
|
"src/domain/analysisError*.ts",
|
|
"src/contracts/errorSchemas.ts",
|
|
"src/domain/explicitSensitive*.ts",
|
|
"src/application/WebNetworkCapture*",
|
|
"src/composition/webNetworkCaptures.ts",
|
|
"src/cli/webNetworkCaptureCommands.ts",
|
|
"src/server/registerWebNetworkCaptureTool.ts",
|
|
"src/server/createServer.ts",
|
|
"src/server/toolRegistrationOptions.ts",
|
|
"src/cli.ts",
|
|
"src/cliCommandNames.ts",
|
|
"src/contracts/toolContracts.ts",
|
|
"src/contracts/toolEffects.ts",
|
|
"src/process/OwnedCommand.ts",
|
|
"src/process/ProviderProcess.ts",
|
|
"src/process/ProviderDeadline.ts",
|
|
"src/process/ProcessOwnership*.ts",
|
|
"src/process/PrivateRuntimeRoot.ts",
|
|
"src/process/capture/ProcessCaptureLifecycle.ts",
|
|
"src/artifacts/readStableArtifact*.ts",
|
|
"src/artifacts/ArtifactReader.ts",
|
|
"src/contracts/webNetworkCaptureToolContracts.ts",
|
|
"scripts/verify-web-network-captures.mjs",
|
|
"scripts/fixtures/generate-mitmproxy-capture.py",
|
|
],
|
|
web_runtime: [
|
|
".github/workflows/real-web-runtime.yml",
|
|
"scripts/verify-browser-runtime.mjs",
|
|
"scripts/lib/browser-runtime-*.mjs",
|
|
"src/process/ProviderProcess.ts",
|
|
"src/process/ProcessOwnership*.ts",
|
|
"scripts/fixtures/browser-runtime-site.mjs",
|
|
"src/browser/execution/**",
|
|
"src/browser/CdpConnection.ts",
|
|
"src/browser/CdpEndpoint.ts",
|
|
"src/browser/CdpTarget*.ts",
|
|
"src/browser/CdpCaptureValues.ts",
|
|
"src/browser/CdpAuthorized*.ts",
|
|
"src/domain/webRuntime.ts",
|
|
"src/domain/webExecution.ts",
|
|
"src/domain/webEventListeners.ts",
|
|
"src/domain/browserObservationError*.ts",
|
|
"src/application/WebRuntime*.ts",
|
|
"src/composition/webRuntime.ts",
|
|
"src/contracts/webRuntimeToolContracts.ts",
|
|
"src/contracts/toolEffects.ts",
|
|
"src/server/registerWebRuntimeTools.ts",
|
|
"src/server/createServer.ts",
|
|
"src/cli/webRuntimeCommands.ts",
|
|
"src/cli/commandCancellation.ts",
|
|
"src/cli.ts",
|
|
],
|
|
web_source_map: [
|
|
".github/workflows/real-web-source-map.yml",
|
|
"scripts/verify-browser-source-maps.mjs",
|
|
"scripts/lib/browser-source-map-e2e.mjs",
|
|
"scripts/fixtures/browser-source-map-site.mjs",
|
|
"src/javascript/sourceMaps/**",
|
|
"src/browser/assets/**",
|
|
"src/domain/webSource*.ts",
|
|
"src/domain/webScript*.ts",
|
|
"src/application/WebSourceLocation*.ts",
|
|
"src/application/ValidateSelectedWebScript.ts",
|
|
"src/composition/webSourceLocations.ts",
|
|
"src/server/registerWebSourceLocationTool.ts",
|
|
"src/server/createServer.ts",
|
|
"src/contracts/webScriptToolContracts.ts",
|
|
"src/process/**",
|
|
"src/cli/webSourceLocationCommands.ts",
|
|
"src/cli.ts",
|
|
"src/artifacts/readStableArtifact.ts",
|
|
],
|
|
nativeaot: [
|
|
"bridge/nativeaot/**",
|
|
"scripts/generate-nativeaot-fixtures.mjs",
|
|
"scripts/lib/nativeaot-build.*",
|
|
"tests/fixtures/nativeaot/**",
|
|
".github/workflows/nativeaot-fixtures.yml",
|
|
],
|
|
website: [
|
|
"website/**",
|
|
"scripts/*website*.py",
|
|
"README*.md",
|
|
".github/workflows/website-check.yml",
|
|
".github/workflows/website-pages.yml",
|
|
],
|
|
};
|
|
|
|
export const CI_FLAGS = [
|
|
...new Set([
|
|
"code",
|
|
"runtime",
|
|
"package",
|
|
"apple",
|
|
"fixtures",
|
|
"readiness",
|
|
"docs",
|
|
"workflows",
|
|
...Object.keys(SCOPES),
|
|
]),
|
|
];
|
|
|
|
// Verifier entrypoints that only manual, licensed, or self-hosted workflows
|
|
// run. No selected CI lane executes them, so their edits need only the static
|
|
// checks and the source-test suite. Shared helpers under scripts/lib remain
|
|
// broad inputs.
|
|
export const MANUAL_VERIFIERS = [
|
|
"scripts/verify-real-electron.mjs",
|
|
"scripts/verify-real-ghidra*.mjs",
|
|
"scripts/verify-real-hopper*.mjs",
|
|
"scripts/verify-real-ida.mjs",
|
|
"scripts/verify-*-client.mjs",
|
|
"scripts/verify-native-agent-client.mjs",
|
|
"scripts/verify-jeb.mjs",
|
|
"scripts/verify-apktool.mjs",
|
|
"scripts/verify-adb.mjs",
|
|
"scripts/verify-agent-experience.mjs",
|
|
"scripts/verify-packaged-ghidra-windows.mjs",
|
|
"scripts/verify-wasm-artifact.mjs",
|
|
"scripts/verify-packaged-wasm-artifact.mjs",
|
|
];
|