2203 Commits

Include renames

Author	SHA1	Message	Date
Edgar ArakelyanandClaude Opus 5.5	fc4c381dd7	feat(desktop): keep an agentenv computer up and drive it through REA's MCP tools (#9041) ... * feat(desktop): keep an agentenv computer up and drive it through REA's MCP tools - A Python helper keeps one agentenv computer up per build with run_bundle(keep=True) and reports its address, MCP URL, control token and sandbox id; it tears the computer down when stdin closes. - AgentEnvComputer owns the helper, waits for readiness, holds one MCP session to the computer's computer_* tools, records through the computer-recording routes, and removes the sandbox's containers by label when agentenv cannot confirm teardown. The token never leaves it. - start_build_computer starts a computer from a request (archive package, apt repository or .deb, opened on demand with REA in /opt/rea) or from a bundle folder; act_on_build_computer forwards screenshot, click, drag, scroll, type, key and wait and returns the driver's images unchanged; close_build_computer tears it down. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): remove a build computer's container by name when agentenv cannot confirm teardown agentenv's local provider runs an ordinary computer as agent-<sandbox id> without the agentenv.sandbox label, so the label-only fallback found nothing and reported a running computer as removed. The fallback now lists containers by exact name and by label. The real test holds its recording open long enough for a first frame, checks the container by name, and runs rea inside the computer; the guide and tool descriptions say the app opens from the Applications menu and that a screenshot after opening a menu should come from a wait. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): own failed build-computer starts, keep ids past oversized screenshots, bound recordings - A start is owned from the helper's spawn. One that fails and whose teardown is unconfirmed stays held under a computer_id close can retry; closeAll refuses new starts, cancels and joins starts in progress, then closes every held computer. - When the first screenshot is too large, the error carries REA's result with the computer_id, and start_build_computer takes screenshot region, format and quality. - Recordings are refused before reading when the manifest's total exceeds the allowance, then fetched one segment at a time, each read bounded and checked against its size and sha256. - The helper keeps the tail of its output (a new tail retention mode in ProviderProcessSupervisor), so a build's own error is not crowded out. - A helper that reported no computer exits on its own before SIGTERM, so no phantom owner is kept. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): bound a build computer's action log Every action kept its full arguments for the computer's whole life, so a long session grew REA's memory without limit. The log now keeps the latest 256 actions within 256 KiB, cuts each string to 1 KiB and each list to 64 items (naming what it cut), and keeps the total and the last applied index of each kind of action, so rules over the whole session hold after entries drop. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-06 11:01:11 +08:00
Edgar ArakelyanandClaude Opus 5.5	c363f3e27b	feat(desktop): pick seed and end by checkpoint, and keep the capture host out of bundles (#9037) ... * feat(desktop): capture a Linux desktop application in use Add `capture-desktop-application`, a CLI-only, Linux and X11 capture that launches an installed desktop application, watches it while it is used and writes capture Evidence plus SHA-256 addressed content: - inventory: desktop entry, launch command, executable, package and its apt sources (or snap, flatpak, AppImage), Electron markers and candidate state directories; - session: the launched process tree, client windows from xprop with the first application window time and a window match, and files held open; - state: a stat walk of the home directory before launch, at checkpoints read from stdin, at stop and after exit, with created, modified, deleted and retyped paths and the content of changed files and state directories. It refuses non-Linux hosts, missing DISPLAY or xprop, a non-empty output folder and an application whose window is already open, and signals only processes it started. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): own launched processes, confirm walk coverage and keep cancelled captures - Launch through the owned provider path with a run token; release with SIGTERM, then the token-verified group cleanup, after every session. Processes without the token are never signalled; each records whether it carries it, and the session records whether cleanup was verified. - Report creations and deletions only where a walk listed the nearest existing directory; count the rest as unconfirmed. - Retain a file only when it is still the walked version, through owned no-follow reads; charge the budget only for new content; create files exclusively in a private output folder owned by the caller. - Walk content roots outside the home directory, compare paths in their physical spelling, and run executables from the caller's directory. - Refuse when the window list cannot be read, re-evaluate window ownership each sample, handle one queued request per sample with a bounded stdin queue, and write the capture with end reason `cancelled` on interruption. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep owned cleanup failures and fresh digests - Allow a capture cancelled before any requested checkpoint to hold only the baseline. - Retry an incomplete stop once; if cleanup is still unverified, write the capture and fail with the run token and process group as cleanup resources. - Classify path changes after a walk (ENOTDIR and other selected-file errors) as changed_since_walk instead of failing the capture. - Treat a non-directory ancestor as proof that nothing existed beneath it. - Report a before digest only for the file version it was read from. - Derive stderr_truncated from stderr's own byte counts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * wip(desktop): state view over a capture folder Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep failed file-handle closes owned for retry Content reads pass retainFailedClose, so a handle whose close fails stays owned by the content store; the capture retries those closes after it is written and fails with the output folder as the cleanup resource if one still cannot be closed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(desktop): read a captured application's state Add inspect-desktop-application-state, a CLI command that reads a capture folder into the application's state: every retained or changed file with its role and reasons, a typed JSON view of each version (SQLite through the shared worker, dconf through a private dconf dump, JSON, XML, key files, text) and the kinds of change between versions (lines, values, keys, rows). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): report process and handle cleanup failures together When both the launched processes and a retained file's handle remain unresolved after the capture is written, one cleanup error now lists both reasons and both resource sets. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(desktop): export a captured application as an agentenv computer app Add export-desktop-application, which writes an agentenv bundle with one computer_app environment from a capture folder and its state view: the apt package, a boot launch matched on the captured window class with a window ready check, owned paths from the state roles, a seed of the baseline files, data hooks that call agentenv's add/get/reset helpers with a typed JSON view on get, a skill, a README and a deploy smoke task. The desktop CLI commands now load their services lazily. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep state views faithful to the capture - Read key files, XML attributes, dconf groups and SQLite tables into dictionaries without inherited properties, so captured keys such as __proto__ stay data. - Version databases with their write-ahead log as of each checkpoint, and stage only digest-verified bytes for the SQLite and dconf readers. - Detect the format per version, report format changes, keep JSON null and empty containers as values, keep XML text and preserved whitespace, and mark truncated views (including XML depth) and comparisons of them. - Number versions and changes by checkpoint index, decide baseline presence from the captured type, and keep tagged SQLite integers, text bytes and blobs distinct. - Carry the capture's limitations and omitted content forward, match state directories by their home path, index changes once per capture, keep failed handle closes owned, and finish the CLI through the shared owner. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep coverage, logs and handles honest in the state view - Read coverage flags only from formats whose readers write them, so JSON fields named truncated stay data. - Fail a SQLite version whose write-ahead log existed but was not retained or does not match its digest, instead of reading the database alone. - Close retained content on every exit, including cancellation, and report a close that still fails together with the primary failure. - Finish the CLI with the canonical operation name. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): export only what the computer can install and seed - Refuse packages not from the Ubuntu 24.04 archive, since the computer installs by name from that archive. - Start the launch command in the captured working directory. - Respell the home path only in files the state view read as text. - Report files that were not retained instead of dropping them silently. - Load captured dconf keys for apps that own no files. - Keep home-level files as owned paths; rename reserved Python class names. - Mark truncated SQLite and text views in the class's get view, and read file types the way the state view does. - Release the output tree through a resource scope, and read seeds through an owner closed on every exit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep staged folders owned, symlinked state roots and XML values - Stage database bytes in a private runtime root released through a resource scope, so a failed removal keeps its owner and is reported with the read's outcome. - Report cleanup facts and owners from desktop failures instead of wrapping them as a plain adapter error. - Record the state directories as walked, in their physical spelling, and match roles against both spellings, so files in a symlinked state directory are not mistaken for selected documents. - Keep whitespace-only XML leaf values; drop only formatting between elements. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): read XML in the exported app the way the state view does Keep whitespace-only leaf values and xml:space="preserve" text in the generated get view; drop only formatting between elements. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): release retained handles with their owners, read older captures - Release retained-content handles whose close failed through a resource scope on every exit; a release that fails again reports the exact handle owners. A read that finished keeps its bytes when only its close failed. - Accept captures written before state directories were recorded, and say in the state view's limitations that symlinked state directories may be misclassed for them. - Compute each XML element's whitespace context once instead of scanning siblings for every text run. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): boot without the working folder, bound XML, accept mirrors - Try the captured working directory only when an argument is relative, and start the app even when that folder is missing. - Cut the generated XML view at REA's node and depth limits, and keep one unreadable file from failing data/get. - Accept Ubuntu 24.04 mirrors, not only the canonical hosts; PPAs and other repositories are still refused. - Read seeds through the retained-content owner's new signature. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): state view review round - Stage a retained -journal beside its database so the SQLite worker accepts an inactive journal and refuses a hot one; a -wal or -journal that existed but was not retained (including one omitted at the baseline) makes the version unreadable. - Keep tables that read when another fails, and let cancellation and unfinished cleanup propagate instead of becoming view errors. - Read text as a key file only when every line parses as one. - Rank a file named in a window title or selected by the caller as a document even when the application holds it open; match titles on file-name boundaries; leave the display name out of dconf matching. - Bound JSON and key file views (4 MiB, 500 levels, exact numbers) and report too-large, missing and altered retained content separately. - Add no version or change while a database stays absent. - Read staged databases in place instead of copying them again. - Give Evidence the same limitations as the result. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): export review round - Load captured dconf keys without D-Bus: install dconf-cli, compile the existing and captured key files into the user database, and warn on failure instead of stopping the server. - Start relative-argument launches in the captured working directory, the home included, since the framework launches from the app folder; respell the home itself and option values under it. - Read views in a thread, skip files over 64 MiB, align the generated readers with the state view's, and close SQLite connections. - Never own the home or a shared base folder; map a symlinked state directory's files back to their home spelling. - Report omitted files and unretained opened folders. - Name the module so it cannot shadow another, and keep the class off the module's own names; derive names the bundle check accepts. - Write seeds as they are read, and remove an unpublished bundle on failure. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): capture review round - Ask the launch process group and token carriers to exit before killing them, on errors too; report incomplete cleanup with its facts. - Count descendants of the launch as started by the capture even when their environment cannot be read; treat a reused pid as a new process. - Follow symlinked desktop entries; name a flatpak's state after its application id; match flatpak windows by name only. - Stop on end of input; refuse empty, duplicate and reserved checkpoint names; require whitespace after the checkpoint keyword. - Stay on each walk root's device, and never walk or retain `/` or a directory containing the home; say so in the limitations. - Refuse a window manager that does not publish _NET_CLIENT_LIST. - Remove retained content when a capture fails before it is written. - Skip reading a file larger than the remaining content budget. - Record apt's archive origin for each package source. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): read an unset client list as no windows when supported xfwm4 leaves _NET_CLIENT_LIST unset while it manages no windows, so the capture refused an ordinary desktop with nothing open. Read _NET_SUPPORTED with the list: an unset list means no windows when the window manager supports it, and the capture is refused only when it does not. `xprop`'s "no such atom" output now reads as unset too. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): accept packages by apt's archive origin Accept a package source when apt reports its origin as Ubuntu for a noble suite, so mirrors count and PPAs or other repositories that merely have "ubuntu" in their URL do not. Captures made before origins were recorded fall back to Canonical's own archive hosts. Seed reads report why retained content could not be used. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(desktop): capture and export apps from vendor apt repositories A closed-source app installed from its vendor's apt repository, such as Typora, can now be captured and exported as a computer app. - The capture records each non-Ubuntu repository listing the installed version (uri, suite, components from apt's sources files, one-line or deb822) and the key that signs it: the signed-by key, or the trusted key that gpgv shows verifies the repository's signed index. The key is retained with the capture. - The capture records the packages owning the libraries the executable loads (DT_NEEDED with RUNPATH and the linker cache, through REA's ELF readers), since a vendor package may not depend on them. - The export declares a verified vendor repository as an AptSource with its key, installs a vendor package's library packages, and adds --no-sandbox to an Electron app's launch, since a container denies Chromium's sandbox. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): report a locked database at once in data/get A database the running app holds locked made each data/get wait sqlite's five-second busy timeout before reporting it. Record the Typora run in an agentenv computer in the verification. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * perf(desktop): detect key files without splitting the whole text Read lines one at a time and stop at the first that a key file view would drop, instead of splitting a file of up to 64 MiB into arrays before its format is known. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep symlinked homes and state folders under the home in exports - Respell a path under its state folder's logical spelling only when that spelling is under the captured home, so a symlinked HOME keeps its files; pair walked and logical state folders only when the capture lists the same number, and match the innermost folder first. - When two files map to one home path, keep the one present before the capture and name the other in the limitations. - Read key files in the generated data/get with the state view's rule, checked against it by running the helper under python3. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): end captures on zombies and keep cleanup owners - A zombie or dead process no longer keeps the session open. - Remove only the partial capture file this run created. - Keep the exact owners of handles and processes whose cleanup failed on the returned error, so a retry can release them; test the published capture's cleanup-failure branch with mixed outcomes and retries. - Release the application once even when the exit checkpoint fails. - A cancellation before the capture is written removes what it retained. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): vendor package review round - Match apt sources through `apt-get indextargets`, which covers flat `./` and `/` suites and gives each release file and sources entry. - Accept a key whose signature verifies even when the release carries another signature without a key here; keep only the verifying key from a keyring holding several (OpenPGP packet splitter). - Install the package from its repository's release (`name/<release>`), declare one source per URI and suite, support only the capture host's architecture, and refuse Ubuntu Pro repositories. - List only library packages the computer can install; walk libraries only for vendor installs, with RPATH inherited as ld.so does, normalized paths, and DT_NEEDED bounded while reading. - Put --no-sandbox after the program an env wrapper launches; keep the gpgv folder's owner when its removal fails; respect --max-file-bytes for keys; wait 0.25 s on a busy SQLite database in data/get. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(desktop): keep the vendor spec's gpgv command on one line A code span broken across lines left `<binary keyring>` for VitePress to read as an unclosed HTML tag, so the docs build failed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(desktop): add a validated task to exported desktop applications Each capture can now yield one agentenv task in its exported bundle. An agent writes the task (a prompt plus declarative checks over the app's data/get views); REA validates it and stays model-free. - `describe-desktop-application-task` summarises a capture's net change per file (role, format, views before and after) and drafts checks. - Checks: file presence, lines present/absent/counted, JSON-pointer values, SQLite rows and counts. REA keeps a task only if a check fails on the seed and every check passes on the captured end state; a file that was not retained at the baseline counts as absent, as the computer starts. - `export-desktop-application --task` writes tasks/NAME.json (deploy, agent, skills, recording, prompt, verifier), a compiled verify.py that reads data/get, and an eval. A boundary test runs the verifier under python3 and checks it agrees with REA's evaluator on every check kind. - Docs, spec and skill guidance, with the solve-rate recipe. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(desktop): keep the seed test in its own block Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(desktop): record the task verifier driven in an agentenv computer Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(desktop): record the Typora task run in an agentenv computer Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep task checks bounded, complete and attributable - line_count counts lines holding a substring (contains) instead of matching a regular expression, which could stall the verifier on agent-written text and read differently in Python. - value_equals of a whole object or array is undecided on a truncated view. - The draft keeps a database whose rows changed under an unchanged hash, and a file whose truncated views match while it changed. - A task file that cannot be read keeps the reader's detail, and a failed cleanup keeps the read failure as its primary. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): leave a file with one version out of the task draft Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(desktop): update the task verification's test counts Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(desktop): record the task solve rate with Claude Code and Sonnet 5.5 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(desktop): capture and export apps installed from a downloaded .deb capture-desktop-application --package-file reads the file's control fields with dpkg-deb and records its SHA-256, size and dependencies when it holds the installed package; the file itself is never kept. The library walk now also runs for local installs. export-desktop-application --package-url declares agentenv's Download(url, sha256) for that file, its dependencies and library packages as apt packages, and a run script that installs it with dpkg. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): seed app-named dotfiles and respell UTF-16 seeds The capture now treats dotfiles in the home named after the application (.varicad-cfg.ini, .notesrc) as state roots, so a file the app only reads during the capture is still seeded. The exported seeding respells the captured home in UTF-16 text files with a byte-order mark, keeping the mark. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): hold readiness until the app's own window shows An exported app is ready only once a window of its class that the taskbar lists is shown, so a splash screen of the class, which skips the taskbar, no longer counts as the app being up. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(desktop): record VariCAD captured, exported and run in an agentenv computer Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep exported views strict JSON for infinite and inexact numbers The exported data/get spells infinite and negative-zero SQLite reals as REA's SQLite reader does ("Infinity", "-Infinity", "-0"), and refuses a JSON file holding a number that reading would change (1e999, integers past 2^53, -0, rounded fractions) with the state view's own error, instead of a view with an infinity in it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep package-file facts tied to one file and URLs unechoed - A --package-url refusal never repeats the URL, and credentials are checked before the scheme. - The package file's identity must hold between dpkg-deb's read and the hash. - A failed close keeps its cleanup owner even when the capture is cancelled. - Readiness also ignores windows typed as splash screens. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): record database logs and keep state changes distinct - A selected path that is not a directory brings its -wal and -journal as content roots, so the capture records whether they exist and retains them. - The state view treats a file as absent only under recorded content roots and refuses a database whose log presence is unknown. - JSON changes list containers too, so an array that becomes an object with the same members is a change. - Key file entries escape the key as a JSON pointer segment, so [a/b] c and [a] b/c stay apart. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep watching through unread samples and late workers - An unreadable window list is unknown, not zero windows, and is named in the limitations. - Before ending the session, live run-token carriers no parent link reached are tracked; an unreadable process table leaves the exit unknown. - An env prefix's assignments find the program and name its XDG folders. - flatpak run options that take a value are skipped with it, -- is honoured and a /arch/branch suffix is dropped from the id. - State directories include the entry's full id. - Path options refuse empty values; roots count toward the entry limit. - A capture file whose close failed stays owned and is retried on discard. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): bound apt sources, keep older captures and cleanup owners - Sources files parse into one stanza per line or deb822 paragraph with its URIs and suites kept as lists, so no URI x suite product is built. - Repository architectures and release are optional, so captures written before they were recorded parse; the export treats them as unrestricted and unknown. - Library sources are matched against every index of a declared repository's URI, suite and components. - Two failures side by side keep both causes and both cleanup owners, and a host file whose close fails reports a lease on its handle. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): match escaped key file entries and suggest containers through members - The draft's key file lookup uses the state view's escaped `group/key`, so a key holding `/` or `~` still gets its suggestion. - JSON and XML changes now list containers too; the draft suggests an added or removed container through its listed members, and a container only when none of its members is listed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): read relative PATH entries from the launch folder A program, or an empty or relative PATH entry, is resolved from the folder the program starts in, as the launch does, so `env PATH=. app` with the entry's Path still finds the app. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * perf(desktop): compare JSON views on one shared path JSON and XML changes are found by walking both trees with one shared pointer path, building a pointer only for a listed value, so memory follows depth rather than every container's full path. A pointer over 4096 characters is counted but not listed. A 256-level document with 4000-character keys went from about 251 MiB of heap to under 1 MiB. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep JSON Lines as text in the exported reader The exported reader parses the whole text before an inexact number makes it JSON with an error, so JSON Lines with an integer above 2^53 stay text as in REA. Over-long integer spellings are unsafe without converting them. The guide no longer claims large integers keep their value. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep the state-path help free of dash-led words The CLI alias check reads `-wal` and `-journal` in help text as short flags, so the help names the write-ahead log and rollback journal instead. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): never record or export apt source credentials - Source URIs lose any user name and password as they are parsed, the way apt splits them, and so do index-target URIs and descriptions and the sources apt-cache policy lists, so matching works whether or not apt prints them. - A repository whose entry held credentials is marked `uri_credentials_removed`, and the export refuses it, or an older capture whose URI still holds them, with a reason that names no URL. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): look programs up without normalizing their paths Program paths and PATH entries are joined rather than resolved, so `..` after a symbolic link means what it means to the launch. The lookup moves to its own module. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): note inexact JSON numbers with a flag, not a list The exported reader only needs to know whether any number was inexact, so it keeps a boolean instead of every rejected spelling. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): refuse older captures that still hold apt credentials A capture written before credentials were removed counted the credentialed repository's libraries as installable, so the export refuses it whole and asks for a new capture rather than declaring packages no source offers. Recorded policy sources are redacted in export messages too. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(desktop): keep the credential fixture on an example host A login on a real host reads as a secret to the commit scanner, so the older capture's fixture uses apt.example.com like the other credential tests. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): tidy looked-up paths and search relative entries only for env Empty and `.` segments are dropped from a looked-up program path, which keeps `/snap/bin/` entries recognisable as snaps, while `..` is still left for the kernel. Relative and empty PATH entries are searched only in the PATH an `env` prefix sets, which travels with the exported launch; the host's own PATH does not. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep excluded and unwalked database logs unknown The capture records the paths every walk left out, and the state view treats a log as absent only under content roots the baseline walked completely and outside those exclusions, so an excluded or unvisited log leaves the database unread rather than read without it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): judge JSON numbers after duplicate keys settle The exported reader marks an inexact number instead of flagging it during the parse, then looks for marks in the parsed value, so a number a later duplicate key overwrote no longer refuses the file, as in REA. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): redact a repository's policy source when it names it An older capture whose policy source matched no sources entry kept that text whole, and the export named the repository by it; the export now names it without any user name or password. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): never signal the launch group on unknown membership When the current read cannot observe a carrier's process group, the carrier is signalled on its own instead of letting an older process-table row grant a group-wide SIGTERM. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): look programs up in the launch's order and refuse host-relative finds The lookup searches PATH as the launch does, an empty entry meaning the launch folder, so inspection and launch name the same program. A program found only through a relative or empty entry of the host's own PATH is refused, since the exported computer would not have it; an env prefix's PATH travels with the command. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): count unchecked paths and keep logs behind them unknown Each walk counts the paths it could not stat and the directories on another device it did not enter, and the checkpoint records it as `unchecked_paths`. The state view treats a log as absent only when the baseline left nothing unchecked, so a log whose stat failed stays unknown. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * perf(desktop): scan parsed JSON with one iterator per level The check for marked numbers walks the parsed value with an iterator per nesting level instead of copying each container's children; a million-entry array went from about 15.7 MiB to 8.1 MiB of peak traced memory. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): start a relative program from its captured folder An exported launch whose program path is relative, such as `./app` from an entry's Path, now changes to the captured working directory first, as it already did for relative arguments. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(desktop): read zipped documents and name XML elements in task checks - A file that starts as a zip archive gets a `zip` view listing its entries in archive order, each with its own format and view, within limits on entries, bytes and expansion; the exported Python reader matches it. - A pointer segment applied to an array may be a selector, `[KEY=VALUE]` or `[@KEY=VALUE]` for XML attributes, matching exactly one member, so checks name elements instead of positions that shift between saves and versions. - `value_equals` takes an optional numeric `tolerance`, comparing numbers and numeric strings. - Changes inside zip views are listed by selector, and the task draft suggests name-addressed checks. FreeCAD's `.FCStd` is the first case: a hole cut into a plate is verified from the zipped `Document.xml` on files from both FreeCAD 0.21 and 1.0. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): record the desktop entry's package and app profiles in any case - A launch from a desktop entry records the package that owns the entry, so the export installs the app the entry starts (Writer, not only libreoffice-common); the program's own package is kept as executable_package when it differs. - State folders match the app's names ignoring letter case, as direct children of the XDG folders and the home, so GIMP's ~/.config/GIMP profile is seeded and reset; roles follow the same rule. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(desktop): read namespaced XML alike in REA and the exported verifier The exported Python reader now names XML elements and attributes as the document spells them (svg, text:p, sodipodi:docname, xml:space), with namespace declarations kept as attributes, which is what REA's view already produced. Export therefore accepts checks into Inkscape SVGs, LibreOffice content.xml and namespaced XML inside zips, and the draft suggests them. expat replaces ElementTree: one pass with namespace processing refuses what REA's parser refuses, and a streaming pass builds the view within the same node and depth limits. Text splits at CDATA, comments and processing instructions as REA's DOM splits it. Fixtures are real Inkscape 1.2.2 and LibreOffice 24.2 saves. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): install the program's own package and keep unknown owners unknown - When the desktop entry's package does not own the program it runs, the export installs the program's package too. The capture records why it cannot (executable_package_reason), and the export then refuses. - The export owns a state folder in the letter case the app wrote it, as the state roles already did, so data/get and data/reset cover a profile folder the app created during the capture. - A dpkg-query that fails or exits 2 or higher leaves the package unknown instead of reading as "no owner". Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep selector checks undecided on partial views and pair members one to one - A selector check is undecided while an array it searched may be missing members: a cut zip listing, or a truncated XML or entry view. Both evaluators agree. - Diffs pair the members of two versions one to one, so two new elements can no longer both match the same old one and hide an addition. - The task draft descends into JSON values and readable entries added whole, and never suggests an element by its position, last step included. - The export's namespace refusal also checks XML entries inside the value a pointer names, such as the whole listing. - The exported reader keeps REA's 500-level JSON depth limit, so one deep entry no longer hides the rest of the archive, and treats an entry whose data runs past its declared size as damaged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): check approved packages against the repositories the export keeps The capture approved library packages and the program's package against every repository with a verified key, but the export can still leave a repository out: its key dropped by the content budget, an architecture restriction, or a conflicting key. Each repository now records the packages only it supplies (`supplies`). The export drops stranded library packages with a limitation, and refuses when the program's own package is stranded. Captures without `supplies` behave as before. The install limitations move to appExportInstallLimitations.ts to keep appExportInstall.ts under the line limit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): compare type changes in place, keep empty values and unread entries honest - When an array becomes another type, its members are compared with what their pointers name there, so values that are still present no longer look removed. - The draft checks an added empty array or object by equality. - The exported reader's JSON depth check keeps one iterator per level and copies no wide list, back to the memory peak before the check. - An entry whose view could not be read is no `null` value: the draft suggests no check on it, and a check into its view fails in both evaluators with the read error. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): decide entry view checks only on entries with a view, and walk JSON depth by level - A check into an archive entry's view needs an entry read in a format with a view. A binary or unread entry's `view` of `null` no longer passes a `null` or absence check, in either evaluator, and the draft suggests no absence inside an entry that ends without a view. - REA's JSON depth check keeps one iterator per level instead of queuing a pair per member, so 800,000 nulls need 18 MiB instead of more than 64. The helper came with the state view; its Python twin was fixed here. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): refuse an export whose desktop entry runs a program no package owns When a package owns the desktop entry but no package owns the program it runs, such as one in ~/.local/bin first on PATH, the capture keeps the entry's package and records why the program cannot be installed. Export refuses instead of installing a package that does not bring that program. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): bound zip entry reads, export metadata checks, and diff by the evaluator's pointer rules - The exported reader inflates a zip entry at most 64 KiB at a time and stops a byte past its declared size, so a forged small size no longer holds the whole stream in memory (77.5 MiB to 0.1 MiB on a 32 KiB bomb). - The namespace refusal applies only to checks that depend on an entry's XML, so checks on an entry's name, size or digest, or on its absence, export. - Diffs find a member's counterpart by the evaluator's pointer rules, so a selector step across a type change no longer reports a present value removed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): read at most 1,000 zip directory records, and index arrays once per diff - Both zip readers now read the central directory a record at a time, keep the first 1,000 file records and count the rest, then hand the library an archive whose directory holds only those. Directories are told apart as zip.js does, so the Python reader stops listing attribute-marked directories as files. 600,000 entries now peak at 1.3 MiB in Python (was 293.6 MiB) and need 24 MiB of heap in REA. - The exported Python zip reader moves to appExportPythonZip.ts. - Diffs look members up through an index built once per compared array, so 20,000 selector keys against 20,000 members take 31 ms, not 5.4 s. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(desktop): pick seed and end by checkpoint, and keep the capture host out of bundles - Export, task export and the task draft take --seed-checkpoint and --end-checkpoint, so one capture can make the seed in the app and then the edit; the defaults stay the baseline and the last version. - Capture reads apt's lists folder and trusted keys from apt-config, so a user-space apt-get update under APT_CONFIG is found, and starts the app without AGENTENV_* variables. - Capture records the host name and user. Export rewrites user@host, the host name as a whole name and the captured home in text, UTF-16 and dconf seeds, ships SEED_HOME=/home/user instead of the capture user's home, lists scrubbed and unscrubbable seeds, and refuses checks that name the host. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): check tasks against the shipped seed and scrub JSON and XML by value - Task validation reads the seed as the bundle ships it, after the scrub, so a task whose end value the scrub writes into the seed is refused. - JSON strings and XML text, attribute values, comments and CDATA are scrubbed as their decoded values and rewritten only when they change, so syntax stays valid and escaped identities are found. - One leftover search covers every shipped file's path and contents, generated module and dconf keys included; the strict whole-name rule is kept for replacing only. - A host named localhost is never replaced, but user@localhost is. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): resolve a record's selector keys together, and follow Zip64 locators without sentinels - The diff resolves all of a record's selector-shaped keys in one lookup: conditions are normalized per field, selectors grouped by field set, and only the values asked for are kept, so retained memory grows with the keys, not members times field sets (68 MB to 5.5 MB, 76 MB to 4.9 MB on the reported cases). - Both zip readers follow a Zip64 locator just before the end record whatever the classic record holds, as zipfile does, so valid Zip64 archives with ordinary classic values read again. The exported module's synthetic tail carries a real Zip64 end record, so bytes that only look like a locator no longer make zipfile refuse it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): scrub JSON values only, with a scanner whose stack does not grow with string length JSON seeds are walked one string at a time, finding each closing quote with indexOf and a backslash count instead of a backtracking regex, so a 16,000,000-character string no longer overflows the stack. Member names are never rewritten, so two keys cannot collide; a name holding the host leaves the file in unscrubbed_files. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): scrub dconf and UTF-16 seeds by format, search check values for the host, and gate checks on the selected ends - dconf: the host scrub ran over the whole key file, so on a host named `true` `wrap=true` became an invalid `wrap=localhost`. Only decoded GVariant string values are scrubbed now; keys, groups, bytestrings, dictionary keys and object paths ship as captured and are reported. - Task identity: the host search read the serialized check, whose field names (`file`, `kind`) and default ids matched hosts of those names. It now reads the check's string values only. - Value checks: the text-file refusal read every recorded version; it now reads only the shipped seed and the end. - UTF-16 seeds: the plain scrubber renamed JSON keys and XML names; the decoded text's format now picks the scrubber, keeping the byte order mark. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): pair members by identity first, build selectors lazily, and refuse oversized and deep text before building a view - Pairing: an element with an identifier (name, id, xid, *:id) pairs only by it, so an unchanged id still names an edited element instead of a removal and an addition, and two objects of one type are never paired as a rename. Selectors keep the tag apart from each attribute condition and spell only the chosen one, so a long tag with many attributes no longer multiplies. - Size: REA's detection and the exported reader decide JSON with a scanner that builds no value, and refuse a view over the parsed-view limit before building it, in files and zip entries alike. - Deep text: the exported reader confirms the whole text is JSON before reporting a nesting depth error, as REA reads it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): count a selector's matches over every sibling while identified elements choose only their identifiers Identity-first pairing also dropped an identified sibling's other attributes from the counts that prove a selector names one member, so a shared attribute such as `color` or `fill` could be chosen though it matched two siblings: the diff reported present elements removed and drafts lost their checks. Counting now covers every attribute of every sibling; only the choice is limited to an identified element's tag and identifiers. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): tell a UTF-16 seed's format without building it, and scrub XML without one piece per token Choosing the scrubber for a decoded UTF-16 seed ran the full state detection, which built the whole XML document (or JSON value), so a large seed within the capture limit could exhaust memory at export. A syntax pass now decides the format (the JSON token scan, and the XML parser's events keeping only the open elements), and the XML scrubber copies out only the spans it changes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-06 10:01:25 +08:00
5 people	a7574d4274	fix(filesystem): settle a Windows ChangeTime before recording a baseline (#8979) ... * fix(filesystem): settle a Windows ChangeTime before recording a baseline Windows advances a file's ChangeTime shortly after it is written while security components attach catalog and file-hash extended attributes. A baseline captured during that advance disagrees with the next observation, so an untouched file was reported as changed: "Root artifact changed before inventory" and "Selected input changed while being read". Dropping ctime on Windows is not an option because it is the only field that catches a same-size rewrite whose modification time was restored. Instead, keep ctime at full strength and stop capturing it mid-flight: on win32 a ChangeTime still inside the drift window is observed again until two consecutive observations agree, and the settled value becomes the baseline. Applied where a baseline is captured and later compared: openRegularFile's admitted metadata and the inventory root snapshot. The exhaustive process capture walk is left alone, since settling there would delay every freshly written file in the tree. Refs #8975 Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(filesystem): wait out the drift window instead of a repeated value Settling on two matching observations was not enough. Two reads taken before Windows performs its delayed ChangeTime update agree with each other and disagree with every later one, so an unchanged file still failed a later check: the reported drift lands 0.3-1.0 s after the write, well past a pair of reads 25 ms apart. Decide on the observation's age in the drift window instead, and keep observing until the ChangeTime itself has aged out. Both the first read and the empty-observation path now go through the same window check. The window-exit test could not fail before: its clock was frozen, so the window never closed and the exit branch never ran. Advance the clock while sleeping and cover a match that precedes a delayed update. Refs #8975 Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(filesystem): configure Windows ChangeTime settle limits REA_WINDOWS_CHANGE_TIME_DRIFT_MS, REA_WINDOWS_CHANGE_TIME_SETTLE_POLL_MS, and REA_WINDOWS_CHANGE_TIME_SETTLE_MAX_POLLS keep today's 2000 ms, 25 ms, and 40-poll defaults. Invalid values name the setting, current value, source, and range, and say to restart REA. * fix(filesystem): settle on the selected environment and stop when cancelled `settleChangeTimeBaseline` resolved its limits from `process.env`, but the inventory already carries the environment its owner selected. A Windows runtime with explicit settle settings therefore ran on ambient values or the defaults, and an invalid ambient value could fail a runtime whose own configuration was valid. `scanCanonical` now passes `options.environment` through. The wait loop also never observed the owning operation's signal, so a cancelled inventory could keep polling for the whole drift window — up to a minute at the configured maximum — and closing the artifact scope waited on it. The loop now checks the signal before each poll and after the sleep, and both call sites pass theirs. Refs morluto/rea#8979 * fix(filesystem): keep the caller's typed error on cancellation Checking the signal was not enough: `throwIfAborted` threw the raw `signal.reason`, which `openRegularFile` passed through unchanged. Its callers recognise cancellation through `RegularFileOperationCancelled`, so a cancelled admission surfaced as an `ArtifactReaderFailure` with reason `io` instead of a cancellation. Let the seam supply the error a caller matches on, and have `openRegularFile` pass its own cancellation type. Refs morluto/rea#8979 * fix(filesystem): keep inventory cancellation typed during ChangeTime settle scanCanonical passed the abort signal into settleChangeTimeBaseline without a cancellationError, so an aborted inventory threw the raw AbortError and analyze reported execution_failure. Inventory now throws ArtifactReaderFailure reason cancelled, which callers already translate as cancellation. * fix(filesystem): skip ChangeTime settling for private PYZ images External admission still waits out a fresh Windows ChangeTime. A private image REA just wrote is recorded as written, so a compressed PYZ spool does not add about a second per image. --------- Co-authored-by: 2SinceJuly <202121119+2SinceJuly@users.noreply.github.com> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>	2026-11-06 07:57:14 +08:00
gensokyo-dev	0beedcd712	perf(mcp): add opt-in hot/cold tool discovery (#9046) ... Add per-connection discovery that loads canonical named tools on demand while preserving the default full catalog. Bound discovery replies before changing visibility, preserve family exclusions and Evidence workflows, and reset visibility on HTTP reconnect. Verified with focused protocol tests and real Codex CLI artifact investigations; token costs remain task-dependent, so the profile is opt-in.	2026-11-05 20:27:31 +00:00
APZNandgensokyo-dev	ad518cff65	feat(artifacts): select extraction entries and output destination (#4031) ... * feat(artifacts): select extraction entries and output destination Refs morluto/rea#3490 * fix(artifacts): omit absent selection from execution parameters * fix(artifacts): protect source directories and verify public selection * fix(artifacts): keep optional selection inputs JSON-safe * fix(artifacts): separate reader ownership from selected destinations Validate complete reader inventory independently from collisions among selected output entries. Use occurrence-parent ownership instead of filename prefixes so independently owned PyInstaller entries remain selectable while nested-reader members remain refused. Validate advertised MCP schemas through the shared acceptance helper and add real PyInstaller/ASAR and excluded-entry regressions. * fix(artifacts): advertise absolute extraction destinations Reuse the shared host-absolute local path schema instead of an opaque refinement so SDK-converted JSON Schema preserves the runtime constraint. Extend the advertised-path and MCP-handler regression matrix for extract_artifact.output_root. * fix(contracts): advertise unique extraction occurrence IDs --------- Co-authored-by: gensokyo-dev <gensokyo-dev@users.noreply.github.com>	2026-11-06 03:28:05 +08:00
gensokyo-devandgensokyo-dev	8084916859	perf(eval): measure MCP catalog usage through the real Codex harness (#9035) ... * perf(eval): measure MCP catalog usage through real Codex sessions * fix(eval): control the active Codex code mode host * fix(eval): reject unavailable host controls without hiding client errors * test(eval): cover the supported default and actionable client errors * docs(eval): record pinned Codex catalog and real package measurements * fix(eval): pin matrix identity and retain failed trial observations --------- Co-authored-by: gensokyo-dev <gensokyo-dev@users.noreply.github.com>	2026-11-06 02:25:34 +08:00
+2737 people	fb453f2930	fix(mcp): support retained pseudocode summaries and paging (#5046) ... * refactor(mcp): share official tool evidence registration Route official tools through registerEvidenceTools and remove the duplicate execution, progress, and Evidence delivery pipeline. Preserve relationship coverage in the shared path and reuse the existing source Evidence recording helper. Validation: typecheck and 29 focused MCP tests passed. Real native providers were not exercised. * fix(mcp): support retained pseudocode summaries and paging Allow procedure_pseudo_code to return an opt-in summary linked to its retained complete Evidence. Extend inspect_analysis_view to page the original pseudocode without repeating provider analysis. Preserve default complete output and exclude delivery detail from provider parameters and source Evidence identity. Add regression coverage for large results, Unicode, null and empty output, missing retention, transport-overflow recovery, and CLI paging. Validation: 178 focused tests, build, check, docs:check, and test discovery passed. Real stdio simulation reconstructed 98,000 code units exactly. Real Ghidra, iTunes, and Claude Code verification remains unavailable. Fixes #5032 * test(mcp): scope pseudocode contract lookup to official tools * feat(desktop): capture and export apps installed from a downloaded .deb (#8954) * feat(desktop): capture a Linux desktop application in use Add `capture-desktop-application`, a CLI-only, Linux and X11 capture that launches an installed desktop application, watches it while it is used and writes capture Evidence plus SHA-256 addressed content: - inventory: desktop entry, launch command, executable, package and its apt sources (or snap, flatpak, AppImage), Electron markers and candidate state directories; - session: the launched process tree, client windows from xprop with the first application window time and a window match, and files held open; - state: a stat walk of the home directory before launch, at checkpoints read from stdin, at stop and after exit, with created, modified, deleted and retyped paths and the content of changed files and state directories. It refuses non-Linux hosts, missing DISPLAY or xprop, a non-empty output folder and an application whose window is already open, and signals only processes it started. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): own launched processes, confirm walk coverage and keep cancelled captures - Launch through the owned provider path with a run token; release with SIGTERM, then the token-verified group cleanup, after every session. Processes without the token are never signalled; each records whether it carries it, and the session records whether cleanup was verified. - Report creations and deletions only where a walk listed the nearest existing directory; count the rest as unconfirmed. - Retain a file only when it is still the walked version, through owned no-follow reads; charge the budget only for new content; create files exclusively in a private output folder owned by the caller. - Walk content roots outside the home directory, compare paths in their physical spelling, and run executables from the caller's directory. - Refuse when the window list cannot be read, re-evaluate window ownership each sample, handle one queued request per sample with a bounded stdin queue, and write the capture with end reason `cancelled` on interruption. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep owned cleanup failures and fresh digests - Allow a capture cancelled before any requested checkpoint to hold only the baseline. - Retry an incomplete stop once; if cleanup is still unverified, write the capture and fail with the run token and process group as cleanup resources. - Classify path changes after a walk (ENOTDIR and other selected-file errors) as changed_since_walk instead of failing the capture. - Treat a non-directory ancestor as proof that nothing existed beneath it. - Report a before digest only for the file version it was read from. - Derive stderr_truncated from stderr's own byte counts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * wip(desktop): state view over a capture folder Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep failed file-handle closes owned for retry Content reads pass retainFailedClose, so a handle whose close fails stays owned by the content store; the capture retries those closes after it is written and fails with the output folder as the cleanup resource if one still cannot be closed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(desktop): read a captured application's state Add inspect-desktop-application-state, a CLI command that reads a capture folder into the application's state: every retained or changed file with its role and reasons, a typed JSON view of each version (SQLite through the shared worker, dconf through a private dconf dump, JSON, XML, key files, text) and the kinds of change between versions (lines, values, keys, rows). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): report process and handle cleanup failures together When both the launched processes and a retained file's handle remain unresolved after the capture is written, one cleanup error now lists both reasons and both resource sets. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(desktop): export a captured application as an agentenv computer app Add export-desktop-application, which writes an agentenv bundle with one computer_app environment from a capture folder and its state view: the apt package, a boot launch matched on the captured window class with a window ready check, owned paths from the state roles, a seed of the baseline files, data hooks that call agentenv's add/get/reset helpers with a typed JSON view on get, a skill, a README and a deploy smoke task. The desktop CLI commands now load their services lazily. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep state views faithful to the capture - Read key files, XML attributes, dconf groups and SQLite tables into dictionaries without inherited properties, so captured keys such as __proto__ stay data. - Version databases with their write-ahead log as of each checkpoint, and stage only digest-verified bytes for the SQLite and dconf readers. - Detect the format per version, report format changes, keep JSON null and empty containers as values, keep XML text and preserved whitespace, and mark truncated views (including XML depth) and comparisons of them. - Number versions and changes by checkpoint index, decide baseline presence from the captured type, and keep tagged SQLite integers, text bytes and blobs distinct. - Carry the capture's limitations and omitted content forward, match state directories by their home path, index changes once per capture, keep failed handle closes owned, and finish the CLI through the shared owner. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep coverage, logs and handles honest in the state view - Read coverage flags only from formats whose readers write them, so JSON fields named truncated stay data. - Fail a SQLite version whose write-ahead log existed but was not retained or does not match its digest, instead of reading the database alone. - Close retained content on every exit, including cancellation, and report a close that still fails together with the primary failure. - Finish the CLI with the canonical operation name. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): export only what the computer can install and seed - Refuse packages not from the Ubuntu 24.04 archive, since the computer installs by name from that archive. - Start the launch command in the captured working directory. - Respell the home path only in files the state view read as text. - Report files that were not retained instead of dropping them silently. - Load captured dconf keys for apps that own no files. - Keep home-level files as owned paths; rename reserved Python class names. - Mark truncated SQLite and text views in the class's get view, and read file types the way the state view does. - Release the output tree through a resource scope, and read seeds through an owner closed on every exit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep staged folders owned, symlinked state roots and XML values - Stage database bytes in a private runtime root released through a resource scope, so a failed removal keeps its owner and is reported with the read's outcome. - Report cleanup facts and owners from desktop failures instead of wrapping them as a plain adapter error. - Record the state directories as walked, in their physical spelling, and match roles against both spellings, so files in a symlinked state directory are not mistaken for selected documents. - Keep whitespace-only XML leaf values; drop only formatting between elements. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): read XML in the exported app the way the state view does Keep whitespace-only leaf values and xml:space="preserve" text in the generated get view; drop only formatting between elements. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): release retained handles with their owners, read older captures - Release retained-content handles whose close failed through a resource scope on every exit; a release that fails again reports the exact handle owners. A read that finished keeps its bytes when only its close failed. - Accept captures written before state directories were recorded, and say in the state view's limitations that symlinked state directories may be misclassed for them. - Compute each XML element's whitespace context once instead of scanning siblings for every text run. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): boot without the working folder, bound XML, accept mirrors - Try the captured working directory only when an argument is relative, and start the app even when that folder is missing. - Cut the generated XML view at REA's node and depth limits, and keep one unreadable file from failing data/get. - Accept Ubuntu 24.04 mirrors, not only the canonical hosts; PPAs and other repositories are still refused. - Read seeds through the retained-content owner's new signature. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): state view review round - Stage a retained -journal beside its database so the SQLite worker accepts an inactive journal and refuses a hot one; a -wal or -journal that existed but was not retained (including one omitted at the baseline) makes the version unreadable. - Keep tables that read when another fails, and let cancellation and unfinished cleanup propagate instead of becoming view errors. - Read text as a key file only when every line parses as one. - Rank a file named in a window title or selected by the caller as a document even when the application holds it open; match titles on file-name boundaries; leave the display name out of dconf matching. - Bound JSON and key file views (4 MiB, 500 levels, exact numbers) and report too-large, missing and altered retained content separately. - Add no version or change while a database stays absent. - Read staged databases in place instead of copying them again. - Give Evidence the same limitations as the result. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): export review round - Load captured dconf keys without D-Bus: install dconf-cli, compile the existing and captured key files into the user database, and warn on failure instead of stopping the server. - Start relative-argument launches in the captured working directory, the home included, since the framework launches from the app folder; respell the home itself and option values under it. - Read views in a thread, skip files over 64 MiB, align the generated readers with the state view's, and close SQLite connections. - Never own the home or a shared base folder; map a symlinked state directory's files back to their home spelling. - Report omitted files and unretained opened folders. - Name the module so it cannot shadow another, and keep the class off the module's own names; derive names the bundle check accepts. - Write seeds as they are read, and remove an unpublished bundle on failure. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): capture review round - Ask the launch process group and token carriers to exit before killing them, on errors too; report incomplete cleanup with its facts. - Count descendants of the launch as started by the capture even when their environment cannot be read; treat a reused pid as a new process. - Follow symlinked desktop entries; name a flatpak's state after its application id; match flatpak windows by name only. - Stop on end of input; refuse empty, duplicate and reserved checkpoint names; require whitespace after the checkpoint keyword. - Stay on each walk root's device, and never walk or retain `/` or a directory containing the home; say so in the limitations. - Refuse a window manager that does not publish _NET_CLIENT_LIST. - Remove retained content when a capture fails before it is written. - Skip reading a file larger than the remaining content budget. - Record apt's archive origin for each package source. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): read an unset client list as no windows when supported xfwm4 leaves _NET_CLIENT_LIST unset while it manages no windows, so the capture refused an ordinary desktop with nothing open. Read _NET_SUPPORTED with the list: an unset list means no windows when the window manager supports it, and the capture is refused only when it does not. `xprop`'s "no such atom" output now reads as unset too. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): accept packages by apt's archive origin Accept a package source when apt reports its origin as Ubuntu for a noble suite, so mirrors count and PPAs or other repositories that merely have "ubuntu" in their URL do not. Captures made before origins were recorded fall back to Canonical's own archive hosts. Seed reads report why retained content could not be used. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(desktop): capture and export apps from vendor apt repositories A closed-source app installed from its vendor's apt repository, such as Typora, can now be captured and exported as a computer app. - The capture records each non-Ubuntu repository listing the installed version (uri, suite, components from apt's sources files, one-line or deb822) and the key that signs it: the signed-by key, or the trusted key that gpgv shows verifies the repository's signed index. The key is retained with the capture. - The capture records the packages owning the libraries the executable loads (DT_NEEDED with RUNPATH and the linker cache, through REA's ELF readers), since a vendor package may not depend on them. - The export declares a verified vendor repository as an AptSource with its key, installs a vendor package's library packages, and adds --no-sandbox to an Electron app's launch, since a container denies Chromium's sandbox. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): report a locked database at once in data/get A database the running app holds locked made each data/get wait sqlite's five-second busy timeout before reporting it. Record the Typora run in an agentenv computer in the verification. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * perf(desktop): detect key files without splitting the whole text Read lines one at a time and stop at the first that a key file view would drop, instead of splitting a file of up to 64 MiB into arrays before its format is known. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep symlinked homes and state folders under the home in exports - Respell a path under its state folder's logical spelling only when that spelling is under the captured home, so a symlinked HOME keeps its files; pair walked and logical state folders only when the capture lists the same number, and match the innermost folder first. - When two files map to one home path, keep the one present before the capture and name the other in the limitations. - Read key files in the generated data/get with the state view's rule, checked against it by running the helper under python3. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): end captures on zombies and keep cleanup owners - A zombie or dead process no longer keeps the session open. - Remove only the partial capture file this run created. - Keep the exact owners of handles and processes whose cleanup failed on the returned error, so a retry can release them; test the published capture's cleanup-failure branch with mixed outcomes and retries. - Release the application once even when the exit checkpoint fails. - A cancellation before the capture is written removes what it retained. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): vendor package review round - Match apt sources through `apt-get indextargets`, which covers flat `./` and `/` suites and gives each release file and sources entry. - Accept a key whose signature verifies even when the release carries another signature without a key here; keep only the verifying key from a keyring holding several (OpenPGP packet splitter). - Install the package from its repository's release (`name/<release>`), declare one source per URI and suite, support only the capture host's architecture, and refuse Ubuntu Pro repositories. - List only library packages the computer can install; walk libraries only for vendor installs, with RPATH inherited as ld.so does, normalized paths, and DT_NEEDED bounded while reading. - Put --no-sandbox after the program an env wrapper launches; keep the gpgv folder's owner when its removal fails; respect --max-file-bytes for keys; wait 0.25 s on a busy SQLite database in data/get. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(desktop): keep the vendor spec's gpgv command on one line A code span broken across lines left `<binary keyring>` for VitePress to read as an unclosed HTML tag, so the docs build failed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(desktop): add a validated task to exported desktop applications Each capture can now yield one agentenv task in its exported bundle. An agent writes the task (a prompt plus declarative checks over the app's data/get views); REA validates it and stays model-free. - `describe-desktop-application-task` summarises a capture's net change per file (role, format, views before and after) and drafts checks. - Checks: file presence, lines present/absent/counted, JSON-pointer values, SQLite rows and counts. REA keeps a task only if a check fails on the seed and every check passes on the captured end state; a file that was not retained at the baseline counts as absent, as the computer starts. - `export-desktop-application --task` writes tasks/NAME.json (deploy, agent, skills, recording, prompt, verifier), a compiled verify.py that reads data/get, and an eval. A boundary test runs the verifier under python3 and checks it agrees with REA's evaluator on every check kind. - Docs, spec and skill guidance, with the solve-rate recipe. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(desktop): keep the seed test in its own block Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(desktop): record the task verifier driven in an agentenv computer Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(desktop): record the Typora task run in an agentenv computer Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep task checks bounded, complete and attributable - line_count counts lines holding a substring (contains) instead of matching a regular expression, which could stall the verifier on agent-written text and read differently in Python. - value_equals of a whole object or array is undecided on a truncated view. - The draft keeps a database whose rows changed under an unchanged hash, and a file whose truncated views match while it changed. - A task file that cannot be read keeps the reader's detail, and a failed cleanup keeps the read failure as its primary. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): leave a file with one version out of the task draft Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(desktop): update the task verification's test counts Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(desktop): record the task solve rate with Claude Code and Sonnet 5.5 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(desktop): capture and export apps installed from a downloaded .deb capture-desktop-application --package-file reads the file's control fields with dpkg-deb and records its SHA-256, size and dependencies when it holds the installed package; the file itself is never kept. The library walk now also runs for local installs. export-desktop-application --package-url declares agentenv's Download(url, sha256) for that file, its dependencies and library packages as apt packages, and a run script that installs it with dpkg. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): seed app-named dotfiles and respell UTF-16 seeds The capture now treats dotfiles in the home named after the application (.varicad-cfg.ini, .notesrc) as state roots, so a file the app only reads during the capture is still seeded. The exported seeding respells the captured home in UTF-16 text files with a byte-order mark, keeping the mark. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): hold readiness until the app's own window shows An exported app is ready only once a window of its class that the taskbar lists is shown, so a splash screen of the class, which skips the taskbar, no longer counts as the app being up. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(desktop): record VariCAD captured, exported and run in an agentenv computer Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep exported views strict JSON for infinite and inexact numbers The exported data/get spells infinite and negative-zero SQLite reals as REA's SQLite reader does ("Infinity", "-Infinity", "-0"), and refuses a JSON file holding a number that reading would change (1e999, integers past 2^53, -0, rounded fractions) with the state view's own error, instead of a view with an infinity in it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep package-file facts tied to one file and URLs unechoed - A --package-url refusal never repeats the URL, and credentials are checked before the scheme. - The package file's identity must hold between dpkg-deb's read and the hash. - A failed close keeps its cleanup owner even when the capture is cancelled. - Readiness also ignores windows typed as splash screens. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): record database logs and keep state changes distinct - A selected path that is not a directory brings its -wal and -journal as content roots, so the capture records whether they exist and retains them. - The state view treats a file as absent only under recorded content roots and refuses a database whose log presence is unknown. - JSON changes list containers too, so an array that becomes an object with the same members is a change. - Key file entries escape the key as a JSON pointer segment, so [a/b] c and [a] b/c stay apart. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep watching through unread samples and late workers - An unreadable window list is unknown, not zero windows, and is named in the limitations. - Before ending the session, live run-token carriers no parent link reached are tracked; an unreadable process table leaves the exit unknown. - An env prefix's assignments find the program and name its XDG folders. - flatpak run options that take a value are skipped with it, -- is honoured and a /arch/branch suffix is dropped from the id. - State directories include the entry's full id. - Path options refuse empty values; roots count toward the entry limit. - A capture file whose close failed stays owned and is retried on discard. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): bound apt sources, keep older captures and cleanup owners - Sources files parse into one stanza per line or deb822 paragraph with its URIs and suites kept as lists, so no URI x suite product is built. - Repository architectures and release are optional, so captures written before they were recorded parse; the export treats them as unrestricted and unknown. - Library sources are matched against every index of a declared repository's URI, suite and components. - Two failures side by side keep both causes and both cleanup owners, and a host file whose close fails reports a lease on its handle. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): match escaped key file entries and suggest containers through members - The draft's key file lookup uses the state view's escaped `group/key`, so a key holding `/` or `~` still gets its suggestion. - JSON and XML changes now list containers too; the draft suggests an added or removed container through its listed members, and a container only when none of its members is listed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): read relative PATH entries from the launch folder A program, or an empty or relative PATH entry, is resolved from the folder the program starts in, as the launch does, so `env PATH=. app` with the entry's Path still finds the app. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * perf(desktop): compare JSON views on one shared path JSON and XML changes are found by walking both trees with one shared pointer path, building a pointer only for a listed value, so memory follows depth rather than every container's full path. A pointer over 4096 characters is counted but not listed. A 256-level document with 4000-character keys went from about 251 MiB of heap to under 1 MiB. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep JSON Lines as text in the exported reader The exported reader parses the whole text before an inexact number makes it JSON with an error, so JSON Lines with an integer above 2^53 stay text as in REA. Over-long integer spellings are unsafe without converting them. The guide no longer claims large integers keep their value. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep the state-path help free of dash-led words The CLI alias check reads `-wal` and `-journal` in help text as short flags, so the help names the write-ahead log and rollback journal instead. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): never record or export apt source credentials - Source URIs lose any user name and password as they are parsed, the way apt splits them, and so do index-target URIs and descriptions and the sources apt-cache policy lists, so matching works whether or not apt prints them. - A repository whose entry held credentials is marked `uri_credentials_removed`, and the export refuses it, or an older capture whose URI still holds them, with a reason that names no URL. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): look programs up without normalizing their paths Program paths and PATH entries are joined rather than resolved, so `..` after a symbolic link means what it means to the launch. The lookup moves to its own module. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): note inexact JSON numbers with a flag, not a list The exported reader only needs to know whether any number was inexact, so it keeps a boolean instead of every rejected spelling. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): refuse older captures that still hold apt credentials A capture written before credentials were removed counted the credentialed repository's libraries as installable, so the export refuses it whole and asks for a new capture rather than declaring packages no source offers. Recorded policy sources are redacted in export messages too. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(desktop): keep the credential fixture on an example host A login on a real host reads as a secret to the commit scanner, so the older capture's fixture uses apt.example.com like the other credential tests. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): tidy looked-up paths and search relative entries only for env Empty and `.` segments are dropped from a looked-up program path, which keeps `/snap/bin/` entries recognisable as snaps, while `..` is still left for the kernel. Relative and empty PATH entries are searched only in the PATH an `env` prefix sets, which travels with the exported launch; the host's own PATH does not. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep excluded and unwalked database logs unknown The capture records the paths every walk left out, and the state view treats a log as absent only under content roots the baseline walked completely and outside those exclusions, so an excluded or unvisited log leaves the database unread rather than read without it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): judge JSON numbers after duplicate keys settle The exported reader marks an inexact number instead of flagging it during the parse, then looks for marks in the parsed value, so a number a later duplicate key overwrote no longer refuses the file, as in REA. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): redact a repository's policy source when it names it An older capture whose policy source matched no sources entry kept that text whole, and the export named the repository by it; the export now names it without any user name or password. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): never signal the launch group on unknown membership When the current read cannot observe a carrier's process group, the carrier is signalled on its own instead of letting an older process-table row grant a group-wide SIGTERM. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): look programs up in the launch's order and refuse host-relative finds The lookup searches PATH as the launch does, an empty entry meaning the launch folder, so inspection and launch name the same program. A program found only through a relative or empty entry of the host's own PATH is refused, since the exported computer would not have it; an env prefix's PATH travels with the command. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): count unchecked paths and keep logs behind them unknown Each walk counts the paths it could not stat and the directories on another device it did not enter, and the checkpoint records it as `unchecked_paths`. The state view treats a log as absent only when the baseline left nothing unchecked, so a log whose stat failed stays unknown. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * perf(desktop): scan parsed JSON with one iterator per level The check for marked numbers walks the parsed value with an iterator per nesting level instead of copying each container's children; a million-entry array went from about 15.7 MiB to 8.1 MiB of peak traced memory. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): start a relative program from its captured folder An exported launch whose program path is relative, such as `./app` from an entry's Path, now changes to the captured working directory first, as it already did for relative arguments. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(electron): reject non-directory scenario roots before launch (#8967) * fix(contracts): align managed example MethodDef scope (#8966) * docs(debugger): document configurable session limits (#8963) * docs(debugger): document configurable session limits * docs(debugger): clarify GDB control command deadlines * docs(debugger): qualify configurable GDB output budget * docs(debugger): clarify one-shot CLI settings scope * docs(debugger): preserve repository line endings * docs(testing): explain npm launcher selection in PowerShell (#8962) * docs(mcp): explain PowerShell launch environment scope (#8961) * docs(mcp): explain PowerShell launch environment scope * docs(mcp): qualify saved setup selections and OpenCode environment * fix(native): declare temporary filesystem writes for inspect_macho (#8959) * fix(environment): retain ID ordering with missing clocks (#8957) * fix(environment): retain ID ordering with missing clocks * fix(environment): compare known creation clocks across gaps --------- Co-authored-by: hhang <169027046+xu91102@users.noreply.github.com> * fix(gpu): distinguish ELF string scan limits from corruption (#8955) Co-authored-by: hhang <169027046+xu91102@users.noreply.github.com> * fix(setup): replace the fixed Hopper download deadline with a stall timeout (#7150) * fix(setup): replace the fixed Hopper download deadline with a stall timeout Hopper package downloads aborted after a fixed 120 s, which was also the largest deadline the download owner accepted. The current 32 MB Linux package needs about 132 s at the reporter's sustained 245 KB/s, so setup could never finish on that connection, and the timeout surfaced only as Node's generic abort message. Abort a download when no response bytes arrive for 30 s, or when it outlives a 15-minute overall bound, with a tagged HopperDownloadTimeoutError that names the URL, the limit reached and the bytes received. Linux and macOS setup already relay a thrown download error's message; the Linux publisher now keeps it for release metadata and public key fetches instead of a generic verification failure. Metadata and key fetches keep their 10 s bound. Refs #7077 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(setup): keep the macOS release feed on the metadata limit The stall-timeout change left the macOS release feed fetch on the package download bounds. That fetch could then wait up to 15 minutes instead of the 120 s it had, while the installation guide says release metadata keeps a 10 s limit. Only the Linux publisher owned that limit. Move the 10 s metadata limit into HopperDownload.ts beside the package bounds. The Linux feed and key fetches use it, and the macOS installer now passes it for its feed fetch through the installer host. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(cli): parse environment-serve --port and --host like rea mcp --http (#7092) * fix(cli): parse environment-serve --port and --host like rea mcp --http environment-serve declared --port as a number, so incur coerced the flag text with Number(): an empty --port= bound an ephemeral port instead of failing, and 0x1F90 or 1e3 were reinterpreted. --host accepted whitespace. docs/cli.md says these flags resolve like rea mcp --http, which accepts only decimal port text and a non-empty trimmed host. The flags now use the same rules and are refused before binding. * refactor(cli): reuse the shared MCP listener port and host schemas * fix(adb): separate unresolvable paths and host capacity in adb spawn failures (#6188) * fix(adb): name unexecutable adb paths in readiness refusals When REA_ADB_PATH or the PATH-resolved adb is a directory or a file the host refuses to execute, the version probe fails at spawn with EACCES or EPERM. That fell through to the generic "did not report a usable version" refusal, which named neither the path nor the cause. Classify those spawn errors as binary_not_executable (provider rejection executable_missing), name the selected path and errno, and give remediation for the environment, PATH and host-policy cases. The generic fallback now names the selected path too. Fixes #5689 * fix(process): admit synchronous spawn errors as captured failures Node throws spawn errors other than EACCES, EAGAIN, EMFILE, ENFILE and ENOENT synchronously from execFile. execFileBytes called execFile inside its Promise executor, so ENOTDIR or EPERM became a rejection without capture fields and execFileOutputFailure returned undefined. Consumers that classify by failure code, such as the adb version probe, could not see the code, which left the adb EPERM branch unreachable. Catch synchronous spawn errno errors at the capture boundary and attach the same empty capture an asynchronous spawn failure carries. Argument validation errors stay unadmitted. The adb version probe now reports an ENOTDIR selected path, such as a REA_ADB_PATH whose parent is a regular file, as a missing binary with the filesystem error code instead of the generic version refusal. * fix(process): expose spawn failures from the capture owner execFileBytes knows when a command never started, but ExecFileOutputFailure did not say so, so consumers reread raw syscall and code fields and disagreed. Mark both the synchronous throw and an asynchronous `spawn <path>` error with `spawnFailed: true`, and set `path` on the synchronous error to match the asynchronous shape. Argument validation errors stay unadmitted. Consumers now use the owner field: - inspectAdbClient never reports a spawn errno as `exit_code`. ENOENT, ENOTDIR, ELOOP and ENAMETOOLONG are `binary_missing`; EACCES and EPERM stay `binary_not_executable`; any other spawn errno, such as EINVAL, is `binary_not_executable` with a path-naming "could not be started" message. Each records `filesystem_error` and `path_source`. EACCES remediation also names parent directory search permission, and EPERM remediation no longer names host policy as the only cause. - DarwinProcessRunTokenReader tags every not-started compiler as `spawn_failed`, not only ENOENT. EACCES, EPERM and ENOTDIR were previously `failed`. - NativeDmgArtifactReader uses one not-started rule for both `processNotStarted` (previously `spawn ` only, so synchronous errors were missed) and the ENOENT unavailable/io split (previously any `spawn` prefix). Its fake hosts now reject with real execFileOutput spawn failures. * fix(process): classify spawn failures consistently across consumers Admit synchronous and asynchronous spawn errnos through one helper that requires an errno and a `spawn` or `spawn <path>` syscall. The synchronous shape now also gains `spawnargs`, so both shapes match. Use the owner's `spawnFailed` fact in the remaining consumers: - inspectAdbClient reports exhausted host capacity (EAGAIN, EMFILE, ENFILE, ENOMEM) as a host failure to retry and no longer tells the caller to change REA_ADB_PATH. Path-resolution errnos come from a predicate the filesystem owner exports. - runAdbCapture says adb could not be started instead of claiming an exit code for a process that never ran. - The Darwin compiler probe words every spawn_failed outcome as a start failure, not a compilation failure. - Asset catalog inspection treats any assetutil that never started as unavailable, not only ENOENT. * fix(process): report host spawn capacity as a retryable constraint Spawn errnos that report exhausted host capacity (EAGAIN, EMFILE, ENFILE, ENOMEM) were classified by adb readiness alone. assetutil reported them as an unavailable tool, which marked inspect_asset_catalog unavailable in the session, and adb commands reported them as protocol failures. Classify them once in the process capture owner and report a retryable capacity constraint with recovery advice from assetutil and adb commands. * docs(adb): describe host capacity failures from device operations * fix(adb): report exhausted host spawn capacity as runtime unavailability A host that cannot start adb for lack of process, memory or descriptor capacity is not a configuration problem. Give it its own failure code and map it to the runtime_unavailable provider rejection instead of not_configured. * fix(adb): report probe-time host capacity as a retryable constraint A device operation whose adb version probe could not start for lack of host capacity was refused as capability_unavailable without retryable. It now reports the same retryable capacity constraint as a later adb command. * fix(adb): keep the selected adb path in probe-time capacity errors The retryable capacity constraint raised at the version probe dropped the selected_binary and path_source diagnostics the refusal used to carry. * refactor(adb): keep the spawn-failure fact to adb consumers Restore the DMG reader, Darwin compiler probe and assetutil to main. The capture owner still marks a never-started command, including the spawn errors Node throws synchronously, and only the adb readiness probe and adb commands read that fact. * test(adb): assert spawn-failure facts instead of refusal wording The new adb tests compared complete refusal sentences and banned an old phrase. They now check the errno, selected path, path source and the owner's spawn-failure marker, so wording edits do not break them. * fix(adb): own one host-capacity remediation and cover the spawn route The host-capacity constraint and the configuration failure each carried their own remediation sentence. AdbConfiguration now owns the text and both use it, so the constraint's remediation.action equals diagnostics.remediation. The synchronous spawn-throw test now runs on Node's execFile route and on the owned spawn route adb uses (stopSignal). The provider test covers inspect_adb_client under EMFILE next to list_adb_devices, and the docs say which operations report the retryable capacity constraint and which report runtime_unavailable. * fix(process): report EMFILE and ENFILE spawn failures without stdio After an EMFILE or ENFILE spawn failure Node creates no stdio, so the owned stop-signal route threw a TypeError while reading the streams and the later spawn error went unhandled. Attach the error listener first and capture absent streams as empty, so adb reports retryable host capacity. * fix(adb): keep a completed push when host capacity stops its digest check A capacity failure starting sha256sum came back as a retryable error even though adb push had already written the file. Repeating the request with overwrite=false is then refused because the destination exists. Return the receipt with an unavailable device digest and name the capacity failure in its limitations, so the caller is told the transfer is unverified rather than advised to retry. * docs(adb): list host capacity as an unverified push case --------- Co-authored-by: t <t@t> * test(gdb): expect configurable stream truncation diagnostics (#8965) * test(gdb): expect configurable stream truncation diagnostics * build(gdb): include prerequisite duplicate-import repair from #8884 * fix(javascript): resolve module-level Electron options in functions (#8960) * fix(javascript): resolve module-level Electron options in functions * fix(javascript): limit module option ancestry walk * fix(javascript): preserve uncertain captured argument ordering * fix(javascript): retain hoisted activation uncertainty * fix(javascript): retain function ownership through loops * fix(javascript): account for classic global activations * fix(javascript): bind first activations to lexical identities * fix(javascript): retain uncertain global activation timing * fix(javascript): isolate receiver facts and share computed reads * fix(javascript): retain projected and opaque global activations * fix(javascript): refresh activation bounds as opaque effects grow * fix(ci): format website watch directories without changing configuration * fix(javascript): share source reads across opaque-effect updates * fix(javascript): retain constructed-code global activation bounds * fix(javascript): share runtime activation and receiver facts * fix(javascript): reuse pattern reads and function positions * fix(javascript): isolate copied paths and preserve runtime reads * style(javascript): format migrated reference imports * fix(javascript): normalize constructor activation and receiver effects * fix(javascript): retain aliased receiver timing and lexical global this * fix(javascript): preserve effect-free receiver identity across activations * fix(javascript): retain outer activation and prototype effects * fix(javascript): index implicit reads without deep path rescans * fix(javascript): retain aliased prototype and parameter read uncertainty * fix(javascript): index reflected reads through intrinsic invocation facts * fix(javascript): retain unresolved global activation reads * chore: refresh PR branch after review fix publication * fix(javascript): retain projected receiver reads and cache method facts * fix(javascript): retain inherited and implicit activation reads * fix(javascript): retain caller-owned this uncertainty * fix(javascript): retain reflected reads with unresolved spread arguments * fix(javascript): preserve enclosing activation for decorators * fix(javascript): track intrinsic literal prototype effects * fix(javascript): retain catch activation from implicit reads * perf(javascript): reuse effective keys for projected reads * fix(javascript): retain possible caller-owned ambient effects * fix(uninstall): preserve caller-selected Kuna caches during purge (#7921) * fix(uninstall): keep a managed cache namespace whole when it holds a caller-selected Kuna cache purge --purge-data reported a REA_KUNA_CACHE_DIR selection below the default Kuna cache as retained, then removed it together with its parent namespace. A namespace that contains the selection is now retained and reported, so the retained report is true. Fixes #7344 * fix(uninstall): also keep a namespace equal to, or reached by symlink traversal from, the selected Kuna cache Compare the namespace and the selection with the same normalization, treat an equal path as contained, and resolve existing paths before planning so a symbolic link followed by .. is judged by where it leads. * fix(uninstall): judge a selection with parent traversal where the filesystem resolves it Collapsing .. lexically contradicts the existing rule that parent traversal after a symbolic link leads elsewhere, and broke the retained-through-symlink-traversal test. Compare spellings without .. directly and resolve existing paths for the rest, so the symlink-parent case still purges the default cache while a selection that resolves into a managed namespace is retained. * fix(uninstall): keep a namespace whole when the selection's location is unknown A realpath failure other than ENOENT/ENOTDIR (for example EACCES under an inaccessible parent) no longer counts as "absent". Each namespace that may contain the caller-selected Kuna cache is retained instead of purged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(changed-behavior): withhold equality for unknowns and contradictions (#7624) find_changed_behavior derived behavior_status from each process comparison's aggregate status alone. An unchanged comparison whose first_divergence was unknown (residual unknowns prevent proving no divergence) and a consistent contradiction comparison both fell through to observed_unchanged, with no unresolved finding and no changed-behavior registry unknown. An unchanged comparison with unknown divergence now counts as unknown and adds one comparison-level unresolved first_divergence finding carrying its reason, as artifact comparisons already do for coverage. A contradiction status makes the aggregate unknown, and contradiction dimensions are classified and counted as contradictions instead of unresolved branches. Complete unchanged comparisons stay observed_unchanged and changed comparisons with unknown localization stay observed_changed. Fixes #7384 Fixes #7383 Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(process): reject contradictory filesystem capture facts (#7631) * fix(process): reject captures whose top-level filesystem facts contradict their checkpoints A process capture records its filesystem state twice: files_before, files_after and filesystem_effects at the top level, and the initial and final filesystem_checkpoints. Validation never reconciled the two, and comparison reads only the checkpoints. A caller-authored capture recording a created file at the top level while its final checkpoint was empty was therefore accepted and compared as unchanged. Semantic validation now requires the initial checkpoint to match files_before with no effects, and the final checkpoint to match files_after and filesystem_effects. The native producer builds both representations from the same snapshots, so produced captures are unaffected; consistent created-file captures still compare as changed. Fixes #7371 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(process): cover file-list checkpoint mismatches independently of effects Every rejected case in the checkpoint-consistency test also disagreed on effects, so removing both file-list comparisons left it passing. Add initial and final checkpoint cases whose file lists alone disagree while effects and coverage accounting stay valid. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(process): report deadlines expiring during final cleanup (#7635) * fix(process): report a deadline that elapses during final cleanup as a timeout runOwnedCommand checked its absolute command deadline before awaiting process cleanup, but on the ordinary successful path it consulted only the caller's cancellation signal afterwards. A command whose deadline expired while successful cleanup was still awaited therefore resolved as success. After cleanup, an elapsed deadline now throws OwnedCommandFailure with reason "timeout" and the completed snapshot, as docs/tool-design.md requires a final signal check after the last awaited finalization step. Existing primary failures, caller cancellation and incomplete-cleanup classification keep their precedence. Fixes #7369 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(process): drive the cleanup-deadline regression with controlled time The regression test gave output collection 100 ms of real time before the deadline. On a busy worker the deadline could expire during collection instead, taking a different failure path and failing the test even with the fix. Use fake timers, wait until cleanup has started, then advance past the deadline and release cleanup, so the ordering no longer depends on worker speed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(enhanced): bound batch decompile input size (#5937) * fix(artifacts): handle early ASAR extraction cancellation (#5672) * fix(artifacts): own source errors during output setup * fix(artifacts): join silent source destruction before returning * fix(artifacts): retain source cleanup failures with primary errors * fix(artifacts): join source finalization and classify secondary failures * fix(firmware): separate source cleanup from output rollback * fix(artifacts): retain live source cleanup dependencies * fix(artifacts): preserve source failure completion and semantics * fix(artifacts): retain scope cleanup owners and typed failures * fix(artifacts): keep cleanup classification and admission recovery When the operation completed and only scope cleanup failed, keep the cleanup failure's own reason instead of reporting io, matching main (fixes artifactProvider.cleanupRetry). When a typed primary is rebuilt with pending scope cleanup, carry its userMessage and ASAR header admission so callers keep the configured ceiling and setting. * fix(artifacts): translate plain file-close failures through the reader path The outer file-cleanup branch rebuilt every ArtifactFileCleanupFailure as a ProviderAdapterError, so dyld reads lost their io, unavailable, format and cancelled reasons and their exact file-cleanup cause. Compose separately only when the failed primary owns its own translation (a domain error, source failure or scope cleanup failure); raw and reader primaries are already projected by the file failure with its exact lease. * fix(artifacts): bound source destruction by cancellation and keep wrapper admission After cancellation, SafeOutputTree.write could wait indefinitely for a source whose destruction did not settle, both in the destroy join and in the iterator's wait for close. Both waits now end at cancellation plus a fixed 1 s grace, modeled on the process-output closure grace. A destruction that outlives it is reported as incomplete source cleanup under an exact lease that releases only once closure is observed without a late error. ArtifactResourceCleanupFailure and SafeOutputSourceFailure now keep the primary's admission, matching withCleanup. * fix(artifacts): keep one settled wait while observing a stuck source observeClosure raced the same pending close promise against a new timer every 10 ms, so a source whose destruction never settled accumulated one reaction per poll for as long as it stayed open. Each poll now waits on its own promise that the close listener or the unref'd timer settles, leaving one pending wait and one close listener. The lifecycle test also asserts that a late close releases the retained owner without an explicit retry. * fix(artifacts): settle pending reads before cancellation * test(artifacts): observe the consumed ZIP iterator on cancellation * test(artifacts): validate projected cleanup resources before sorting * test(mcp): reserve parent capacity for timeout recovery * fix(artifacts): contain ASAR cancellation before output consumption * test(artifacts): hash ASAR cancellation fixture bytes * fix(decompile): retain inventory limitations and selection (#8466) * fix(decompile): retain inventory limitations with the latest selection The manifest and decompile index dropped procedure-inventory limitations, so a directory separated from its Evidence response could not explain why functions were selected or omitted. Keep those limitations on the manifest and in a latest_run index record that also names the filter and counts that produced them. Older runs remain represented only by their retained function records. Fixes #8355 * test(decompile): surface export errors and check function caveats Address review findings on the inventory-limitation regression: - Throw the typed export error instead of returning from a failed Result. - Assert historical function records keep their own pseudocode caveats and do not receive the latest inventory warnings. * fix(pyinstaller): leave PE carrier binary members unmarked (#6730) The Windows bootloader sets no execute bit on extracted ARCHIVE_ITEM_BINARY members (the S_IXUSR fchmod in pyi_archive.c is #ifndef WIN32). Mark type b members executable only when the carrier dialect is posix. * fix(jeb): reconnect after stale MCP sessions (#3754) * fix(jeb): reconnect after stale MCP sessions * fix(jeb): preserve failures for overlapping MCP requests * fix(jeb): make cleanup operations explicit and stabilize timeout fixtures * fix(setup): flag unresolved migrated Claude Desktop storage (#8971) * fix(setup): flag unresolved migrated Claude Desktop storage * fix(setup): preserve Claude MSIX process view when config is unresolved * fix(enhanced): restore batch input record limit * docs(tool-design): audit agent workflow guidance (#8439) * docs(tool-design): audit agent workflow guidance * docs(tool-design): check deployed guidance versions * fix(cli): align ADB directory and package query schemas (#8974) * fix(cli): align ADB directory and package query schemas * fix(cli): preserve ADB selector correction details * fix(devicetree): reject duplicate node paths in Evidence (#8970) * fix(pe): classify valid DOS targets as unsupported (#7530) fix(pe): classify confirmed DOS targets as unsupported Signed-off-by: Rudy Celekli <rudy@gradiahq.com> * fix(native): reject nonzero reserved ELF dynamic symbols (#7528) fix(native): validate the reserved ELF dynamic symbol Signed-off-by: Rudy Celekli <rudy@gradiahq.com> * fix(evidence): traverse large source link sets safely (#8457) * fix(verification): use inspected Ghidra JDK (#8440) * fix(mcp): clarify retained dossier handoff in crash prompt (#8437) * fix(evidence): clarify unsupported view recovery (#8412) * fix(evidence): clarify unsupported view recovery * fix(evidence): explain sensitive capture view refusal * test(ghidra): check regex recovery at its owning boundary (#8578) * test(ghidra): check structured snapshot profile mismatch (#8536) * test(ghidra): check retained historical snapshot evidence (#8381) * test(ghidra): check retained historical snapshot evidence * test(ghidra): select historical observations by address * test(cli): cover Frida argument admission and spawn ordering (#3356) * fix(cli): reject spawn arguments in Frida attach mode * test(cli): remove redundant Frida recorder assignments --------- Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com> * fix(ghidra): report restricted-host temp write denial on Windows (#8889) * fix(ghidra): report restricted-host temp write denial on Windows Add a Windows doctor check that creates and deletes a file under os.tmpdir(), and classify a denied java_home.save in Ghidra startup output with its path, Win32 error 5, and TMP/TEMP remediation. The probe covers REA's own process only; a host that restricts only child processes is reported from the child's output at startup. Fixes #7075 * fix(ghidra): probe the session root and retain failed probe cleanup The Windows doctor temp_directory probe now writes under ghidraSessionRoot(), the same root Ghidra session runtimes use, instead of os.tmpdir(), which can differ when the inherited temp path has a dot-prefixed element. A probe file whose removal fails is retained on the doctor resource owner so doctor shutdown retries the removal; the result still reports its path. * fix(cli): normalize exit status on worker cleanup failure (#8049) (#8050) * fix(cli): normalize exit status on worker cleanup failure (#8049) * test(cli): verify SDK output status and finalization rejection on exit * ci: retrigger checks --------- Co-authored-by: Sarthak Pandey <sarthak@email.com> * fix(gdb): keep inferior-tty verification for read-only queries (#5539) * fix(gdb): keep TTY verification across read-only inferior-tty inspection The console command path cleared `inferiorTtyVerified` before dispatching any command whose text merely mentioned `inferior-tty`, so the read-only `show inferior-tty` query permanently revoked a persistent session's verified output sink; no in-session path ever restored the flag, and a later close of a live session failed detach verification with capability_unavailable. Exempt the exact read-only query forms (`show inferior-tty` and the MI `-inferior-tty-show`) from the output-mutation predicate; every other command mentioning the TTY setting keeps revoking, so mutating commands still fail closed and detach keeps re-reading the live TTY before detaching. Cover the query forms, composite commands, and the inspect-then-close detach path with regression tests. Fixes #5099 * test(gdb): classify show inferior-tty in the one-shot table and rename the TTY classification table - Add a 'show inferior-tty' row to the 'classifies one-shot GDB commands' table: the read-only query no longer invalidates the detach proof, a user-visible one-shot behavior change. - Rename the 'classifies read-only inferior TTY queries as non-mutating' table to 'classifies inferior TTY commands' since two of its rows are mutation cases. - Assert via the existing recorded-commands array that the inspected 'show inferior-tty' text is actually dispatched, and add an execute-path assertion that the MI '-inferior-tty-show' form leaves the verified-sink flag intact (defensive exemption: REA's own MI calls do not route through this gate). --------- Co-authored-by: akushonkamen <akushonkamen@users.noreply.github.com> * fix(browser): report an out-of-range generated position as a selection fault (#7133) trace_web_source_location reported a well-formed generated_position past the end of the selected script as invalid_format on generated_position, with no bounds, so callers were told their input was malformed and not which coordinate to change. Report out_of_range on the line or column that is past the end, with its valid bounds, as export_web_scripts and inspect_web_network_capture now do for their selections. The position scan now returns the bound it ran past, so the offset and the reported limit come from one pass and cannot disagree on line terminators. Fixes #7132 * fix(captures): classify unresolvable capture paths as capture_path input (#7814) * fix(captures): classify unresolvable capture paths as capture_path input Fixes #7636 * test(captures): cover unresolvable descriptor paths --------- Co-authored-by: Abelo9996 <Abelo9996@users.noreply.github.com> Co-authored-by: morluto <76467478+morluto@users.noreply.github.com> * fix(apple): preserve exact integer precision with post-table plist objects (#8910) * fix(javascript): resolve electron findings through aliases of interop results (#8914) * fix(javascript): resolve electron findings through aliases of interop results * fix(javascript): resolve interop aliases iteratively and check target mutations * fix(javascript): retain possible writes through uncertain aliases and guard positive reads * perf(javascript): cache alias change status across semantic interop lookups * fix(javascript): transient Windows private-runtime source-transfer (#8769) * fix(javascript): transient Windows private-runtime source-transfer Parent source-transfer into the Windows private runtime root failed with EPERM on path-based exclusive create. Write through a native transient private-runtime path that closes the handle after flush so per-job rm still works, and yield around the sync write so abort deadlines can fire. * fix(javascript): yield timer phase before Windows source-transfer write * fix(il2cpp): reject module image references outside retained inventory (#8956) * fix(ida): admit Docker host-gateway names as local MCP hosts (#8932) Containerized REA reaches an IDA MCP server on the container host through host.docker.internal (Docker, Podman compatibility) or host.containers.internal (Podman). The HTTP registration refinement only admitted localhost, 127.0.0.1 and [::1], so doctor reported the valid gateway registration as invalid_configuration. Admit both gateway names in the registration's local-host set. The refinement still requires http or https, no URL credentials, and refuses every other host. Fixes #8925 * fix(mcp): report target after failed open (#8613) * fix(mcp): report target after failed open * test(session): cover failed open receipt ownership * test(session): verify restored target receipt * test(mcp): retain target on snapshot mismatch * test(mcp): retain oversized open failure receipts * test(cli): avoid continuing session receipt in one-shot errors * fix(mcp): report provider after failed switch * test(ghidra): verify failed open preserves annotations * test(mcp): join queued receipt request before cleanup * test(session): assert open failure receipts in lifecycle suites * test(session): keep open-failure receipt checks within function limits Move the provider-collision case and snapshot fixture setup out of the functions that grew when both failure receipts were asserted. --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> * fix(prompts): include existing static artifact investigation routes (#8972) * fix(prompts): include existing static artifact investigation routes * fix(prompts): preserve workflows in existing family scopes * fix(prompts): require readers for Apple resource routes * fix(rizin): keep debug targets off the debugger command stream (#8647) * fix(rizin): keep debug targets off the debugger command stream A Rizin debug target inherited Rizin's stdin, which is REA's command stream. Once resumed, a target that reads stdin consumed REA's commands, so close returned cleanup_incomplete and the one-shot CLI hung. Route the target's stdin to the caller-selected TTY alongside stdout and stderr. Before detaching, refuse a target whose stdin is still the command stream, so a Rizin or backend that ignores the key gets a specific, retained failure instead of a resumed target and a timeout. Fixes #8642 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(rizin): keep the stdin test launcher's descriptors under dash The launcher gated its target with `cat "$2" >/dev/null`. dash applies a simple command's redirection to the shell itself until the command returns, so on Ubuntu the waiting shell's fd 1 was /dev/null, and that shell is the target REA reads in /proc. All 8 Linux-gated tests then failed the existing output-descriptor check. macOS /bin/sh is bash, which redirects only in the forked child, so this did not show locally. Gate without any redirection. Production code is unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(rizin): reject unmodeled commands and own cleanup at acquisition Address review of the stdin regression tests. The launcher accepted any unknown line, so the marker that followed could complete it, and assertions only checked that commands were present. An added `dc` or a repeated `olj` still passed. It now records an unknown line and exits, and the tests pin the exact command sequence. Cleanup hung off module state assigned after setup finished, so a failed setup left its directory and terminal child behind. Each resource now registers its own finish hook when acquired, using createTestTempDirectory. Success checks throw the typed error instead of asserting `.ok`, and the refusal probe no longer sits inside a loop and conditional. Production code is unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(ci): align tests with current evidence contracts * feat(native): report binary hardening for ELF, PE and Mach-O (#8524) * feat(native): report binary hardening for ELF, PE and Mach-O Documents inspect_binary_hardening and its CLI equivalent, including per-property states, supporting evidence, read budgets, and one report per Mach-O slice. Explains that missing protection imports remain unknown, signature presence does not establish validity, and hardened runtime requires inspect_signature. Adds hardening links throughout the documentation. The supplied diff also removes the advanced CodeQL workflow and configuration, along with snapshot-binding mismatch guidance. * fix(native): validate declared payloads and dynamic tables before hardening rows Run the shared range checks for ELF, read imports from the dynamic tables rather than section metadata, and keep an unresolved symbol count apart from an absent table. Check every Mach-O command before building rows and retain only the offsets the rows need. Make the verifier's readelf output wide, check the emitted format before parsing Mach-O, and place the sources before the libraries in the link. * fix(native): share Mach-O segment admission with hardening reads A segment with a section count its cmdsize cannot hold passed the hardening reader and could enable restrict_segment. Move the size, section count and file range checks to a shared admission that readMachoImage and the hardening reader both use, and pin the ELF load-size case with a regression test. * fix(hardening): reject Mach-O section payloads past the slice and empty ELF interpreters Segment admission never checked each section's payload range, so a file-backed section past the slice still produced rows. Decode sections with the section header owner and mark the slice malformed when a payload leaves it; zero-fill and empty sections own no file bytes and are exempt. admitInterp accepted a NUL first byte in a longer extent, which counted an empty interpreter as PIE evidence. It now requires a nonempty path. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KuWHGvzJkrhCqjtEHUwqyH * fix(native): read CFG instrumentation from decoded GuardFlags Use the IMAGE_GUARD_CF_INSTRUMENTED flag that guardFlagRecord already decodes instead of masking the raw GuardFlags word a second time. * fix(native): reject ELF table spans a second PT_LOAD remaps The hardening reader mapped DT_STRTAB, DT_SYMTAB and hash tables through the one PT_LOAD containing the table's first address. A second PT_LOAD starting inside the table could map the rest of it from other file bytes and the reader still reported parsed import evidence. Cap each mapping at the next PT_LOAD that starts inside it, reject a requested range that crosses that boundary, and stop hash reads at the same limit, matching the conflicting-mapping refusal in readElfSymbols. * fix(native): dedupe ELF note tables only on shared boundaries The hardening reader dropped any note table whose bytes another table already covered. A covering SHT_NOTE can hold a non-GNU note whose descriptor is itself a complete GNU property note, while PT_NOTE names that inner note directly. Walking only the outer stream missed the GNU marker and reported CET disabled. Drop an alias only when it starts and ends on boundaries of admitted tables, which are note boundaries of the walked streams. Any other covered alias leaves the feature rows unknown, as a partial overlap already does. * fix(native): admit every Mach-O symbol record after a canary match The Mach-O stack protector scan returned as soon as it found an undefined ___stack_chk_fail, so a later undefined symbol whose n_strx lay outside the string table was never checked. The same damaged table parsed or failed as malformed depending only on record order. Keep the match and finish the bounded record walk. Records after the match are only checked against the string table bounds, so their names are not read or charged to the scan budget. The ELF reader already admits its whole symbol table before matching names. * fix(native): accept ELF load aliases with the same file translation The hardening reader treated every PT_LOAD that starts inside a table, or that also contains the table's address, as a conflicting mapping. A load with the same address-to-file translation names the same file bytes, so tables it overlaps still have one interpretation, and the canonical ElfLoadMap already merges such spans. Treat equivalent loads as one interpretation. A load with a different translation, or the zero-filled tail of an equivalent load, still ends the usable range, so a remapped table is still rejected. * fix(native): keep same-span ELF note tables with different alignments unknown A section and a program header that share endpoints were treated as one note stream even when their effective note alignments differed. Walking the same bytes at 4 and 8 can frame different notes, so dropping the second table could hide a GNU property word and report CET or BTI as disabled. Require matching effective alignment at both endpoints, and no alignment change inside the covered span, before treating a table as an alias. Otherwise mark the feature rows unknown. The fixture's .note.gnu.property section now declares the class's note alignment, as toolchains emit it. * refactor(native): read LC_SYMTAB through the shared fixed-word decoder Move the Mach-O fixed uint32 command layouts out of MachoCommandNames into domain/apple/machoLoadCommands so there is one owner of those offsets. MachoCommandNames and the hardening reader now both decode through it; the hardening reader keeps its own bounds and import policy. * fix(native): skip Mach-O common definitions in canary imports A common definition sets N_UNDF|N_EXT like an import but stores its allocation size in n_value. An object holding only `int __stack_chk_fail;` therefore reported stack_protector: enabled. Require a zero n_value before an undefined external counts as an import, for both nlist widths. * refactor(native): read linkedit data commands through the shared fixed-word decoder readMachoLinkeditDataCommand reproduced the dataoff/datasize offsets that FIXED_WORD_FIELDS already owns. Take the command and decode through decodeMachoFixedWordFields, as readMachoSymtabCommand does, keeping the truncation and endianness behavior. * fix(native): skip empty SHT_NOTE sections in ELF hardening A zero-sized SHT_NOTE owns no bytes, so the section directory marks it not file-backed and the hardening reader rejected the whole image as malformed, while readElfImage accepted the same bytes. Skip empty note sections before the file-backing check; they have nothing to walk. * fix(scripts): run hardening verifier commands through the shared owner The binary hardening verifier started its probes and compiler drivers with raw spawnSync, which bypassed the src/process/ supervision that AGENTS.md requires. Every launch now goes through createVerifierCommands, and the temporary root is removed only after the owner closes cleanly. * fix(scripts): clean up hardening verifier commands on Ctrl-C SIGINT or SIGTERM ended Node before withVerifierCleanup ran, so detached compiler trees and the temporary root could outlive the verifier. The verifier now turns those signals into an abort that every owned command receives, so cleanup closes the owner and removes the root before exit. * fix(scripts): fail the hardening verifier when a signal lands outside a command Only the owned commands read the interruption signal, so a SIGINT or SIGTERM during the final cleanup or between commands was recorded and then dropped, and the verifier exited 0. After cleanup settles, the verifier now throws the interruption reason. A failure the operation or its cleanup already raised still leaves first and is not replaced. * fix(native): fail Mach-O slices with a malformed encryption command The hardening reader turned every malformed status from the shared encryption reader into an unknown `encrypted` row, so a short LC_ENCRYPTION_INFO_64 or an encrypted range past the slice still left the slice parsed with a full report. Only two conflicting encryption commands stay an unknown row now. Any other encryption defect fails the slice like other structural command failures. * fix(native): ignore STB_LOCAL undefined ELF symbols as imports A local undefined __stack_chk_fail or __memcpy_chk is never resolved against another object, so it does not establish an external import. Skip STB_LOCAL bindings when reading protector signs, and give the fixture's positive symbols STB_GLOBAL binding. --------- Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> --------- Signed-off-by: Rudy Celekli <rudy@gradiahq.com> Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Edgar Arakelyan <edgar.arakelyan@scale.com> Co-authored-by: ShuaixinHuang <1836656514@qq.com> Co-authored-by: highmachs <samarjeeth06@gmail.com> Co-authored-by: hhang <17309584214@163.com> Co-authored-by: hhang <169027046+xu91102@users.noreply.github.com> Co-authored-by: Paritosh Lahre <155938586+SandstromPL@users.noreply.github.com> Co-authored-by: Adolanium <94890352+Adolanium@users.noreply.github.com> Co-authored-by: 김준호 <101695482+chordpli@users.noreply.github.com> Co-authored-by: t <t@t> Co-authored-by: Hasan Zayni <36798269+dark13b@users.noreply.github.com> Co-authored-by: Salman Almutairi <141588124+salmanalmutairi1@users.noreply.github.com> Co-authored-by: Lucien <164857476+dakjdakd@users.noreply.github.com> Co-authored-by: RRFZ <247457381+Plastic-time@users.noreply.github.com> Co-authored-by: 2SinceJuly <hongjxiao@gmail.com> Co-authored-by: Wade <160517347+Sriram-PR@users.noreply.github.com> Co-authored-by: Martin Klein <36695017+flitzrrr@users.noreply.github.com> Co-authored-by: morluto <76467478+morluto@users.noreply.github.com> Co-authored-by: Rudy Mizrahi Celekli <47457359+rudycelekli@users.noreply.github.com> Co-authored-by: xin zhuang <65798732+1052326311@users.noreply.github.com> Co-authored-by: Beqa <91750923+BeqaKs@users.noreply.github.com> Co-authored-by: NoThing <sarthakpandey5667@gmail.com> Co-authored-by: Sarthak Pandey <sarthak@email.com> Co-authored-by: akushonkamen <74654766+akushonkamen@users.noreply.github.com> Co-authored-by: akushonkamen <akushonkamen@users.noreply.github.com> Co-authored-by: amyanger <57688398+amyanger@users.noreply.github.com> Co-authored-by: Abel Yagubyan <abelyagubyan@berkeley.edu> Co-authored-by: Abelo9996 <Abelo9996@users.noreply.github.com> Co-authored-by: Jiabin Yin <54463072+Nolkee@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Mohamed Ayoub Eleuch <58662566+AyoubElleuch@users.noreply.github.com> Co-authored-by: Kaoru0822 <kanadekitauji@proton.me> Co-authored-by: Matt Van Horn <mvanhorn@users.noreply.github.com> Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Co-authored-by: gensokyo-dev <gensokyo-dev@users.noreply.github.com>	2026-11-06 02:06:39 +08:00
Edgar ArakelyanandClaude Opus 5.5	0ac6be1a3d	ci(environment): pin the real agentenv lane to agentenv-framework 0.9.1431 (#8865) ... * ci(environment): pin the real agentenv lane to agentenv-framework 0.9.1431 The real-agentenv lane, its identity check and the docs pinned agentenv-framework 0.9.1334, 97 releases behind the current 0.9.1431. Recorded verification notes keep the versions they ran with; the website catalogs change only the placeholder comment that shows the version. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(environment): describe 0.9.1431's pulled infra images; keep the site on the release 0.9.1431 pulls its gateway and service-db images from ghcr.io by the digests its release records and builds one only when that pull fails, so the lane docs, the export guide and the verifier's comments now say so, and the mirror step fetches only the bases those builds name. The public site describes the released package, which still runs 0.9.1334, so its guide and evidence page keep that version until a release ships the new pin. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-06 01:53:53 +08:00
3 people	560674e2de	feat(native): report binary hardening for ELF, PE and Mach-O (#8524) ... * feat(native): report binary hardening for ELF, PE and Mach-O Documents inspect_binary_hardening and its CLI equivalent, including per-property states, supporting evidence, read budgets, and one report per Mach-O slice. Explains that missing protection imports remain unknown, signature presence does not establish validity, and hardened runtime requires inspect_signature. Adds hardening links throughout the documentation. The supplied diff also removes the advanced CodeQL workflow and configuration, along with snapshot-binding mismatch guidance. * fix(native): validate declared payloads and dynamic tables before hardening rows Run the shared range checks for ELF, read imports from the dynamic tables rather than section metadata, and keep an unresolved symbol count apart from an absent table. Check every Mach-O command before building rows and retain only the offsets the rows need. Make the verifier's readelf output wide, check the emitted format before parsing Mach-O, and place the sources before the libraries in the link. * fix(native): share Mach-O segment admission with hardening reads A segment with a section count its cmdsize cannot hold passed the hardening reader and could enable restrict_segment. Move the size, section count and file range checks to a shared admission that readMachoImage and the hardening reader both use, and pin the ELF load-size case with a regression test. * fix(hardening): reject Mach-O section payloads past the slice and empty ELF interpreters Segment admission never checked each section's payload range, so a file-backed section past the slice still produced rows. Decode sections with the section header owner and mark the slice malformed when a payload leaves it; zero-fill and empty sections own no file bytes and are exempt. admitInterp accepted a NUL first byte in a longer extent, which counted an empty interpreter as PIE evidence. It now requires a nonempty path. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KuWHGvzJkrhCqjtEHUwqyH * fix(native): read CFG instrumentation from decoded GuardFlags Use the IMAGE_GUARD_CF_INSTRUMENTED flag that guardFlagRecord already decodes instead of masking the raw GuardFlags word a second time. * fix(native): reject ELF table spans a second PT_LOAD remaps The hardening reader mapped DT_STRTAB, DT_SYMTAB and hash tables through the one PT_LOAD containing the table's first address. A second PT_LOAD starting inside the table could map the rest of it from other file bytes and the reader still reported parsed import evidence. Cap each mapping at the next PT_LOAD that starts inside it, reject a requested range that crosses that boundary, and stop hash reads at the same limit, matching the conflicting-mapping refusal in readElfSymbols. * fix(native): dedupe ELF note tables only on shared boundaries The hardening reader dropped any note table whose bytes another table already covered. A covering SHT_NOTE can hold a non-GNU note whose descriptor is itself a complete GNU property note, while PT_NOTE names that inner note directly. Walking only the outer stream missed the GNU marker and reported CET disabled. Drop an alias only when it starts and ends on boundaries of admitted tables, which are note boundaries of the walked streams. Any other covered alias leaves the feature rows unknown, as a partial overlap already does. * fix(native): admit every Mach-O symbol record after a canary match The Mach-O stack protector scan returned as soon as it found an undefined ___stack_chk_fail, so a later undefined symbol whose n_strx lay outside the string table was never checked. The same damaged table parsed or failed as malformed depending only on record order. Keep the match and finish the bounded record walk. Records after the match are only checked against the string table bounds, so their names are not read or charged to the scan budget. The ELF reader already admits its whole symbol table before matching names. * fix(native): accept ELF load aliases with the same file translation The hardening reader treated every PT_LOAD that starts inside a table, or that also contains the table's address, as a conflicting mapping. A load with the same address-to-file translation names the same file bytes, so tables it overlaps still have one interpretation, and the canonical ElfLoadMap already merges such spans. Treat equivalent loads as one interpretation. A load with a different translation, or the zero-filled tail of an equivalent load, still ends the usable range, so a remapped table is still rejected. * fix(native): keep same-span ELF note tables with different alignments unknown A section and a program header that share endpoints were treated as one note stream even when their effective note alignments differed. Walking the same bytes at 4 and 8 can frame different notes, so dropping the second table could hide a GNU property word and report CET or BTI as disabled. Require matching effective alignment at both endpoints, and no alignment change inside the covered span, before treating a table as an alias. Otherwise mark the feature rows unknown. The fixture's .note.gnu.property section now declares the class's note alignment, as toolchains emit it. * refactor(native): read LC_SYMTAB through the shared fixed-word decoder Move the Mach-O fixed uint32 command layouts out of MachoCommandNames into domain/apple/machoLoadCommands so there is one owner of those offsets. MachoCommandNames and the hardening reader now both decode through it; the hardening reader keeps its own bounds and import policy. * fix(native): skip Mach-O common definitions in canary imports A common definition sets N_UNDF|N_EXT like an import but stores its allocation size in n_value. An object holding only `int __stack_chk_fail;` therefore reported stack_protector: enabled. Require a zero n_value before an undefined external counts as an import, for both nlist widths. * refactor(native): read linkedit data commands through the shared fixed-word decoder readMachoLinkeditDataCommand reproduced the dataoff/datasize offsets that FIXED_WORD_FIELDS already owns. Take the command and decode through decodeMachoFixedWordFields, as readMachoSymtabCommand does, keeping the truncation and endianness behavior. * fix(native): skip empty SHT_NOTE sections in ELF hardening A zero-sized SHT_NOTE owns no bytes, so the section directory marks it not file-backed and the hardening reader rejected the whole image as malformed, while readElfImage accepted the same bytes. Skip empty note sections before the file-backing check; they have nothing to walk. * fix(scripts): run hardening verifier commands through the shared owner The binary hardening verifier started its probes and compiler drivers with raw spawnSync, which bypassed the src/process/ supervision that AGENTS.md requires. Every launch now goes through createVerifierCommands, and the temporary root is removed only after the owner closes cleanly. * fix(scripts): clean up hardening verifier commands on Ctrl-C SIGINT or SIGTERM ended Node before withVerifierCleanup ran, so detached compiler trees and the temporary root could outlive the verifier. The verifier now turns those signals into an abort that every owned command receives, so cleanup closes the owner and removes the root before exit. * fix(scripts): fail the hardening verifier when a signal lands outside a command Only the owned commands read the interruption signal, so a SIGINT or SIGTERM during the final cleanup or between commands was recorded and then dropped, and the verifier exited 0. After cleanup settles, the verifier now throws the interruption reason. A failure the operation or its cleanup already raised still leaves first and is not replaced. * fix(native): fail Mach-O slices with a malformed encryption command The hardening reader turned every malformed status from the shared encryption reader into an unknown `encrypted` row, so a short LC_ENCRYPTION_INFO_64 or an encrypted range past the slice still left the slice parsed with a full report. Only two conflicting encryption commands stay an unknown row now. Any other encryption defect fails the slice like other structural command failures. * fix(native): ignore STB_LOCAL undefined ELF symbols as imports A local undefined __stack_chk_fail or __memcpy_chk is never resolved against another object, so it does not establish an external import. Skip STB_LOCAL bindings when reading protector signs, and give the fixture's positive symbols STB_GLOBAL binding. --------- Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-06 01:07:00 +08:00
Kaoru0822andClaude Opus 5.5	fe677f6cf9	fix(rizin): keep debug targets off the debugger command stream (#8647) ... * fix(rizin): keep debug targets off the debugger command stream A Rizin debug target inherited Rizin's stdin, which is REA's command stream. Once resumed, a target that reads stdin consumed REA's commands, so close returned cleanup_incomplete and the one-shot CLI hung. Route the target's stdin to the caller-selected TTY alongside stdout and stderr. Before detaching, refuse a target whose stdin is still the command stream, so a Rizin or backend that ignores the key gets a specific, retained failure instead of a resumed target and a timeout. Fixes #8642 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(rizin): keep the stdin test launcher's descriptors under dash The launcher gated its target with `cat "$2" >/dev/null`. dash applies a simple command's redirection to the shell itself until the command returns, so on Ubuntu the waiting shell's fd 1 was /dev/null, and that shell is the target REA reads in /proc. All 8 Linux-gated tests then failed the existing output-descriptor check. macOS /bin/sh is bash, which redirects only in the forked child, so this did not show locally. Gate without any redirection. Production code is unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(rizin): reject unmodeled commands and own cleanup at acquisition Address review of the stdin regression tests. The launcher accepted any unknown line, so the marker that followed could complete it, and assertions only checked that commands were present. An added `dc` or a repeated `olj` still passed. It now records an unknown line and exits, and the tests pin the exact command sequence. Cleanup hung off module state assigned after setup finished, so a failed setup left its directory and terminal child behind. Each resource now registers its own finish hook when acquired, using createTestTempDirectory. Success checks throw the typed error instead of asserting `.ok`, and the refusal probe no longer sits inside a loop and conditional. Production code is unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-05 18:38:12 +08:00
Mohamed Ayoub Eleuch	845eb54d2b	fix(prompts): include existing static artifact investigation routes (#8972) ... * fix(prompts): include existing static artifact investigation routes * fix(prompts): preserve workflows in existing family scopes * fix(prompts): require readers for Apple resource routes	2026-11-05 18:37:20 +08:00
morlutoandCursor Agent	56be61191e	fix(mcp): report target after failed open (#8613) ... * fix(mcp): report target after failed open * test(session): cover failed open receipt ownership * test(session): verify restored target receipt * test(mcp): retain target on snapshot mismatch * test(mcp): retain oversized open failure receipts * test(cli): avoid continuing session receipt in one-shot errors * fix(mcp): report provider after failed switch * test(ghidra): verify failed open preserves annotations * test(mcp): join queued receipt request before cleanup * test(session): assert open failure receipts in lifecycle suites * test(session): keep open-failure receipt checks within function limits Move the provider-collision case and snapshot fixture setup out of the functions that grew when both failure receipts were asserted. --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com>	2026-11-05 18:35:22 +08:00
Beqa	3395c9e6b3	fix(ida): admit Docker host-gateway names as local MCP hosts (#8932) ... Containerized REA reaches an IDA MCP server on the container host through host.docker.internal (Docker, Podman compatibility) or host.containers.internal (Podman). The HTTP registration refinement only admitted localhost, 127.0.0.1 and [::1], so doctor reported the valid gateway registration as invalid_configuration. Admit both gateway names in the registration's local-host set. The refinement still requires http or https, no URL credentials, and refuses every other host. Fixes #8925	2026-11-05 18:34:28 +08:00
Beqa	08a923f722	fix(ghidra): report restricted-host temp write denial on Windows (#8889) ... * fix(ghidra): report restricted-host temp write denial on Windows Add a Windows doctor check that creates and deletes a file under os.tmpdir(), and classify a denied java_home.save in Ghidra startup output with its path, Win32 error 5, and TMP/TEMP remediation. The probe covers REA's own process only; a host that restricts only child processes is reported from the child's output at startup. Fixes #7075 * fix(ghidra): probe the session root and retain failed probe cleanup The Windows doctor temp_directory probe now writes under ghidraSessionRoot(), the same root Ghidra session runtimes use, instead of os.tmpdir(), which can differ when the inherited temp path has a dot-prefixed element. A probe file whose removal fails is retained on the doctor resource owner so doctor shutdown retries the removal; the result still reports its path.	2026-11-05 17:52:25 +08:00
morluto	65986d0a0f	docs(tool-design): audit agent workflow guidance (#8439) ... * docs(tool-design): audit agent workflow guidance * docs(tool-design): check deployed guidance versions	2026-11-05 17:28:48 +08:00
ShuaixinHuang	3484432fb1	fix(setup): flag unresolved migrated Claude Desktop storage (#8971) ... * fix(setup): flag unresolved migrated Claude Desktop storage * fix(setup): preserve Claude MSIX process view when config is unresolved	2026-11-05 17:14:19 +08:00
Martin Klein	d854fb155a	fix(jeb): reconnect after stale MCP sessions (#3754) ... * fix(jeb): reconnect after stale MCP sessions * fix(jeb): preserve failures for overlapping MCP requests * fix(jeb): make cleanup operations explicit and stabilize timeout fixtures	2026-11-05 17:05:29 +08:00
Wade	9317c7d422	fix(pyinstaller): leave PE carrier binary members unmarked (#6730) ... The Windows bootloader sets no execute bit on extracted ARCHIVE_ITEM_BINARY members (the S_IXUSR fchmod in pyi_archive.c is #ifndef WIN32). Mark type b members executable only when the carrier dialect is posix.	2026-11-05 17:05:12 +08:00
2SinceJuly	fc20aebb94	fix(decompile): retain inventory limitations and selection (#8466) ... * fix(decompile): retain inventory limitations with the latest selection The manifest and decompile index dropped procedure-inventory limitations, so a directory separated from its Evidence response could not explain why functions were selected or omitted. Keep those limitations on the manifest and in a latest_run index record that also names the filter and counts that produced them. Older runs remain represented only by their retained function records. Fixes #8355 * test(decompile): surface export errors and check function caveats Address review findings on the inventory-limitation regression: - Throw the typed export error instead of returning from a failed Result. - Assert historical function records keep their own pseudocode caveats and do not receive the latest inventory warnings.	2026-11-05 17:04:55 +08:00
ShuaixinHuang	a2134b3a74	fix(javascript): resolve module-level Electron options in functions (#8960) ... * fix(javascript): resolve module-level Electron options in functions * fix(javascript): limit module option ancestry walk * fix(javascript): preserve uncertain captured argument ordering * fix(javascript): retain hoisted activation uncertainty * fix(javascript): retain function ownership through loops * fix(javascript): account for classic global activations * fix(javascript): bind first activations to lexical identities * fix(javascript): retain uncertain global activation timing * fix(javascript): isolate receiver facts and share computed reads * fix(javascript): retain projected and opaque global activations * fix(javascript): refresh activation bounds as opaque effects grow * fix(ci): format website watch directories without changing configuration * fix(javascript): share source reads across opaque-effect updates * fix(javascript): retain constructed-code global activation bounds * fix(javascript): share runtime activation and receiver facts * fix(javascript): reuse pattern reads and function positions * fix(javascript): isolate copied paths and preserve runtime reads * style(javascript): format migrated reference imports * fix(javascript): normalize constructor activation and receiver effects * fix(javascript): retain aliased receiver timing and lexical global this * fix(javascript): preserve effect-free receiver identity across activations * fix(javascript): retain outer activation and prototype effects * fix(javascript): index implicit reads without deep path rescans * fix(javascript): retain aliased prototype and parameter read uncertainty * fix(javascript): index reflected reads through intrinsic invocation facts * fix(javascript): retain unresolved global activation reads * chore: refresh PR branch after review fix publication * fix(javascript): retain projected receiver reads and cache method facts * fix(javascript): retain inherited and implicit activation reads * fix(javascript): retain caller-owned this uncertainty * fix(javascript): retain reflected reads with unresolved spread arguments * fix(javascript): preserve enclosing activation for decorators * fix(javascript): track intrinsic literal prototype effects * fix(javascript): retain catch activation from implicit reads * perf(javascript): reuse effective keys for projected reads * fix(javascript): retain possible caller-owned ambient effects	2026-11-05 16:52:19 +08:00
김준호andt	92f332652d	fix(adb): separate unresolvable paths and host capacity in adb spawn failures (#6188) ... * fix(adb): name unexecutable adb paths in readiness refusals When REA_ADB_PATH or the PATH-resolved adb is a directory or a file the host refuses to execute, the version probe fails at spawn with EACCES or EPERM. That fell through to the generic "did not report a usable version" refusal, which named neither the path nor the cause. Classify those spawn errors as binary_not_executable (provider rejection executable_missing), name the selected path and errno, and give remediation for the environment, PATH and host-policy cases. The generic fallback now names the selected path too. Fixes #5689 * fix(process): admit synchronous spawn errors as captured failures Node throws spawn errors other than EACCES, EAGAIN, EMFILE, ENFILE and ENOENT synchronously from execFile. execFileBytes called execFile inside its Promise executor, so ENOTDIR or EPERM became a rejection without capture fields and execFileOutputFailure returned undefined. Consumers that classify by failure code, such as the adb version probe, could not see the code, which left the adb EPERM branch unreachable. Catch synchronous spawn errno errors at the capture boundary and attach the same empty capture an asynchronous spawn failure carries. Argument validation errors stay unadmitted. The adb version probe now reports an ENOTDIR selected path, such as a REA_ADB_PATH whose parent is a regular file, as a missing binary with the filesystem error code instead of the generic version refusal. * fix(process): expose spawn failures from the capture owner execFileBytes knows when a command never started, but ExecFileOutputFailure did not say so, so consumers reread raw syscall and code fields and disagreed. Mark both the synchronous throw and an asynchronous `spawn <path>` error with `spawnFailed: true`, and set `path` on the synchronous error to match the asynchronous shape. Argument validation errors stay unadmitted. Consumers now use the owner field: - inspectAdbClient never reports a spawn errno as `exit_code`. ENOENT, ENOTDIR, ELOOP and ENAMETOOLONG are `binary_missing`; EACCES and EPERM stay `binary_not_executable`; any other spawn errno, such as EINVAL, is `binary_not_executable` with a path-naming "could not be started" message. Each records `filesystem_error` and `path_source`. EACCES remediation also names parent directory search permission, and EPERM remediation no longer names host policy as the only cause. - DarwinProcessRunTokenReader tags every not-started compiler as `spawn_failed`, not only ENOENT. EACCES, EPERM and ENOTDIR were previously `failed`. - NativeDmgArtifactReader uses one not-started rule for both `processNotStarted` (previously `spawn ` only, so synchronous errors were missed) and the ENOENT unavailable/io split (previously any `spawn` prefix). Its fake hosts now reject with real execFileOutput spawn failures. * fix(process): classify spawn failures consistently across consumers Admit synchronous and asynchronous spawn errnos through one helper that requires an errno and a `spawn` or `spawn <path>` syscall. The synchronous shape now also gains `spawnargs`, so both shapes match. Use the owner's `spawnFailed` fact in the remaining consumers: - inspectAdbClient reports exhausted host capacity (EAGAIN, EMFILE, ENFILE, ENOMEM) as a host failure to retry and no longer tells the caller to change REA_ADB_PATH. Path-resolution errnos come from a predicate the filesystem owner exports. - runAdbCapture says adb could not be started instead of claiming an exit code for a process that never ran. - The Darwin compiler probe words every spawn_failed outcome as a start failure, not a compilation failure. - Asset catalog inspection treats any assetutil that never started as unavailable, not only ENOENT. * fix(process): report host spawn capacity as a retryable constraint Spawn errnos that report exhausted host capacity (EAGAIN, EMFILE, ENFILE, ENOMEM) were classified by adb readiness alone. assetutil reported them as an unavailable tool, which marked inspect_asset_catalog unavailable in the session, and adb commands reported them as protocol failures. Classify them once in the process capture owner and report a retryable capacity constraint with recovery advice from assetutil and adb commands. * docs(adb): describe host capacity failures from device operations * fix(adb): report exhausted host spawn capacity as runtime unavailability A host that cannot start adb for lack of process, memory or descriptor capacity is not a configuration problem. Give it its own failure code and map it to the runtime_unavailable provider rejection instead of not_configured. * fix(adb): report probe-time host capacity as a retryable constraint A device operation whose adb version probe could not start for lack of host capacity was refused as capability_unavailable without retryable. It now reports the same retryable capacity constraint as a later adb command. * fix(adb): keep the selected adb path in probe-time capacity errors The retryable capacity constraint raised at the version probe dropped the selected_binary and path_source diagnostics the refusal used to carry. * refactor(adb): keep the spawn-failure fact to adb consumers Restore the DMG reader, Darwin compiler probe and assetutil to main. The capture owner still marks a never-started command, including the spawn errors Node throws synchronously, and only the adb readiness probe and adb commands read that fact. * test(adb): assert spawn-failure facts instead of refusal wording The new adb tests compared complete refusal sentences and banned an old phrase. They now check the errno, selected path, path source and the owner's spawn-failure marker, so wording edits do not break them. * fix(adb): own one host-capacity remediation and cover the spawn route The host-capacity constraint and the configuration failure each carried their own remediation sentence. AdbConfiguration now owns the text and both use it, so the constraint's remediation.action equals diagnostics.remediation. The synchronous spawn-throw test now runs on Node's execFile route and on the owned spawn route adb uses (stopSignal). The provider test covers inspect_adb_client under EMFILE next to list_adb_devices, and the docs say which operations report the retryable capacity constraint and which report runtime_unavailable. * fix(process): report EMFILE and ENFILE spawn failures without stdio After an EMFILE or ENFILE spawn failure Node creates no stdio, so the owned stop-signal route threw a TypeError while reading the streams and the later spawn error went unhandled. Attach the error listener first and capture absent streams as empty, so adb reports retryable host capacity. * fix(adb): keep a completed push when host capacity stops its digest check A capacity failure starting sha256sum came back as a retryable error even though adb push had already written the file. Repeating the request with overwrite=false is then refused because the destination exists. Return the receipt with an unavailable device digest and name the capacity failure in its limitations, so the caller is told the transfer is unverified rather than advised to retry. * docs(adb): list host capacity as an unverified push case --------- Co-authored-by: t <t@t>	2026-11-05 15:40:32 +08:00
Paritosh LahreandClaude Opus 5.5	5fd325066d	fix(setup): replace the fixed Hopper download deadline with a stall timeout (#7150) ... * fix(setup): replace the fixed Hopper download deadline with a stall timeout Hopper package downloads aborted after a fixed 120 s, which was also the largest deadline the download owner accepted. The current 32 MB Linux package needs about 132 s at the reporter's sustained 245 KB/s, so setup could never finish on that connection, and the timeout surfaced only as Node's generic abort message. Abort a download when no response bytes arrive for 30 s, or when it outlives a 15-minute overall bound, with a tagged HopperDownloadTimeoutError that names the URL, the limit reached and the bytes received. Linux and macOS setup already relay a thrown download error's message; the Linux publisher now keeps it for release metadata and public key fetches instead of a generic verification failure. Metadata and key fetches keep their 10 s bound. Refs #7077 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(setup): keep the macOS release feed on the metadata limit The stall-timeout change left the macOS release feed fetch on the package download bounds. That fetch could then wait up to 15 minutes instead of the 120 s it had, while the installation guide says release metadata keeps a 10 s limit. Only the Linux publisher owned that limit. Move the 10 s metadata limit into HopperDownload.ts beside the package bounds. The Linux feed and key fetches use it, and the macOS installer now passes it for its feed fetch through the installer host. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-05 15:39:03 +08:00
ShuaixinHuang	347dc9a32c	docs(mcp): explain PowerShell launch environment scope (#8961) ... * docs(mcp): explain PowerShell launch environment scope * docs(mcp): qualify saved setup selections and OpenCode environment	2026-11-05 15:36:07 +08:00
ShuaixinHuang	455d7953ec	docs(testing): explain npm launcher selection in PowerShell (#8962)	2026-11-05 15:35:20 +08:00
ShuaixinHuang	f6f565093f	docs(debugger): document configurable session limits (#8963) ... * docs(debugger): document configurable session limits * docs(debugger): clarify GDB control command deadlines * docs(debugger): qualify configurable GDB output budget * docs(debugger): clarify one-shot CLI settings scope * docs(debugger): preserve repository line endings	2026-11-05 15:34:34 +08:00
Edgar ArakelyanandClaude Opus 5.5	970969cb53	feat(desktop): capture and export apps installed from a downloaded .deb (#8954) ... * feat(desktop): capture a Linux desktop application in use Add `capture-desktop-application`, a CLI-only, Linux and X11 capture that launches an installed desktop application, watches it while it is used and writes capture Evidence plus SHA-256 addressed content: - inventory: desktop entry, launch command, executable, package and its apt sources (or snap, flatpak, AppImage), Electron markers and candidate state directories; - session: the launched process tree, client windows from xprop with the first application window time and a window match, and files held open; - state: a stat walk of the home directory before launch, at checkpoints read from stdin, at stop and after exit, with created, modified, deleted and retyped paths and the content of changed files and state directories. It refuses non-Linux hosts, missing DISPLAY or xprop, a non-empty output folder and an application whose window is already open, and signals only processes it started. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): own launched processes, confirm walk coverage and keep cancelled captures - Launch through the owned provider path with a run token; release with SIGTERM, then the token-verified group cleanup, after every session. Processes without the token are never signalled; each records whether it carries it, and the session records whether cleanup was verified. - Report creations and deletions only where a walk listed the nearest existing directory; count the rest as unconfirmed. - Retain a file only when it is still the walked version, through owned no-follow reads; charge the budget only for new content; create files exclusively in a private output folder owned by the caller. - Walk content roots outside the home directory, compare paths in their physical spelling, and run executables from the caller's directory. - Refuse when the window list cannot be read, re-evaluate window ownership each sample, handle one queued request per sample with a bounded stdin queue, and write the capture with end reason `cancelled` on interruption. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep owned cleanup failures and fresh digests - Allow a capture cancelled before any requested checkpoint to hold only the baseline. - Retry an incomplete stop once; if cleanup is still unverified, write the capture and fail with the run token and process group as cleanup resources. - Classify path changes after a walk (ENOTDIR and other selected-file errors) as changed_since_walk instead of failing the capture. - Treat a non-directory ancestor as proof that nothing existed beneath it. - Report a before digest only for the file version it was read from. - Derive stderr_truncated from stderr's own byte counts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * wip(desktop): state view over a capture folder Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep failed file-handle closes owned for retry Content reads pass retainFailedClose, so a handle whose close fails stays owned by the content store; the capture retries those closes after it is written and fails with the output folder as the cleanup resource if one still cannot be closed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(desktop): read a captured application's state Add inspect-desktop-application-state, a CLI command that reads a capture folder into the application's state: every retained or changed file with its role and reasons, a typed JSON view of each version (SQLite through the shared worker, dconf through a private dconf dump, JSON, XML, key files, text) and the kinds of change between versions (lines, values, keys, rows). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): report process and handle cleanup failures together When both the launched processes and a retained file's handle remain unresolved after the capture is written, one cleanup error now lists both reasons and both resource sets. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(desktop): export a captured application as an agentenv computer app Add export-desktop-application, which writes an agentenv bundle with one computer_app environment from a capture folder and its state view: the apt package, a boot launch matched on the captured window class with a window ready check, owned paths from the state roles, a seed of the baseline files, data hooks that call agentenv's add/get/reset helpers with a typed JSON view on get, a skill, a README and a deploy smoke task. The desktop CLI commands now load their services lazily. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep state views faithful to the capture - Read key files, XML attributes, dconf groups and SQLite tables into dictionaries without inherited properties, so captured keys such as __proto__ stay data. - Version databases with their write-ahead log as of each checkpoint, and stage only digest-verified bytes for the SQLite and dconf readers. - Detect the format per version, report format changes, keep JSON null and empty containers as values, keep XML text and preserved whitespace, and mark truncated views (including XML depth) and comparisons of them. - Number versions and changes by checkpoint index, decide baseline presence from the captured type, and keep tagged SQLite integers, text bytes and blobs distinct. - Carry the capture's limitations and omitted content forward, match state directories by their home path, index changes once per capture, keep failed handle closes owned, and finish the CLI through the shared owner. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep coverage, logs and handles honest in the state view - Read coverage flags only from formats whose readers write them, so JSON fields named truncated stay data. - Fail a SQLite version whose write-ahead log existed but was not retained or does not match its digest, instead of reading the database alone. - Close retained content on every exit, including cancellation, and report a close that still fails together with the primary failure. - Finish the CLI with the canonical operation name. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): export only what the computer can install and seed - Refuse packages not from the Ubuntu 24.04 archive, since the computer installs by name from that archive. - Start the launch command in the captured working directory. - Respell the home path only in files the state view read as text. - Report files that were not retained instead of dropping them silently. - Load captured dconf keys for apps that own no files. - Keep home-level files as owned paths; rename reserved Python class names. - Mark truncated SQLite and text views in the class's get view, and read file types the way the state view does. - Release the output tree through a resource scope, and read seeds through an owner closed on every exit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep staged folders owned, symlinked state roots and XML values - Stage database bytes in a private runtime root released through a resource scope, so a failed removal keeps its owner and is reported with the read's outcome. - Report cleanup facts and owners from desktop failures instead of wrapping them as a plain adapter error. - Record the state directories as walked, in their physical spelling, and match roles against both spellings, so files in a symlinked state directory are not mistaken for selected documents. - Keep whitespace-only XML leaf values; drop only formatting between elements. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): read XML in the exported app the way the state view does Keep whitespace-only leaf values and xml:space="preserve" text in the generated get view; drop only formatting between elements. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): release retained handles with their owners, read older captures - Release retained-content handles whose close failed through a resource scope on every exit; a release that fails again reports the exact handle owners. A read that finished keeps its bytes when only its close failed. - Accept captures written before state directories were recorded, and say in the state view's limitations that symlinked state directories may be misclassed for them. - Compute each XML element's whitespace context once instead of scanning siblings for every text run. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): boot without the working folder, bound XML, accept mirrors - Try the captured working directory only when an argument is relative, and start the app even when that folder is missing. - Cut the generated XML view at REA's node and depth limits, and keep one unreadable file from failing data/get. - Accept Ubuntu 24.04 mirrors, not only the canonical hosts; PPAs and other repositories are still refused. - Read seeds through the retained-content owner's new signature. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): state view review round - Stage a retained -journal beside its database so the SQLite worker accepts an inactive journal and refuses a hot one; a -wal or -journal that existed but was not retained (including one omitted at the baseline) makes the version unreadable. - Keep tables that read when another fails, and let cancellation and unfinished cleanup propagate instead of becoming view errors. - Read text as a key file only when every line parses as one. - Rank a file named in a window title or selected by the caller as a document even when the application holds it open; match titles on file-name boundaries; leave the display name out of dconf matching. - Bound JSON and key file views (4 MiB, 500 levels, exact numbers) and report too-large, missing and altered retained content separately. - Add no version or change while a database stays absent. - Read staged databases in place instead of copying them again. - Give Evidence the same limitations as the result. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): export review round - Load captured dconf keys without D-Bus: install dconf-cli, compile the existing and captured key files into the user database, and warn on failure instead of stopping the server. - Start relative-argument launches in the captured working directory, the home included, since the framework launches from the app folder; respell the home itself and option values under it. - Read views in a thread, skip files over 64 MiB, align the generated readers with the state view's, and close SQLite connections. - Never own the home or a shared base folder; map a symlinked state directory's files back to their home spelling. - Report omitted files and unretained opened folders. - Name the module so it cannot shadow another, and keep the class off the module's own names; derive names the bundle check accepts. - Write seeds as they are read, and remove an unpublished bundle on failure. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): capture review round - Ask the launch process group and token carriers to exit before killing them, on errors too; report incomplete cleanup with its facts. - Count descendants of the launch as started by the capture even when their environment cannot be read; treat a reused pid as a new process. - Follow symlinked desktop entries; name a flatpak's state after its application id; match flatpak windows by name only. - Stop on end of input; refuse empty, duplicate and reserved checkpoint names; require whitespace after the checkpoint keyword. - Stay on each walk root's device, and never walk or retain `/` or a directory containing the home; say so in the limitations. - Refuse a window manager that does not publish _NET_CLIENT_LIST. - Remove retained content when a capture fails before it is written. - Skip reading a file larger than the remaining content budget. - Record apt's archive origin for each package source. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): read an unset client list as no windows when supported xfwm4 leaves _NET_CLIENT_LIST unset while it manages no windows, so the capture refused an ordinary desktop with nothing open. Read _NET_SUPPORTED with the list: an unset list means no windows when the window manager supports it, and the capture is refused only when it does not. `xprop`'s "no such atom" output now reads as unset too. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): accept packages by apt's archive origin Accept a package source when apt reports its origin as Ubuntu for a noble suite, so mirrors count and PPAs or other repositories that merely have "ubuntu" in their URL do not. Captures made before origins were recorded fall back to Canonical's own archive hosts. Seed reads report why retained content could not be used. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(desktop): capture and export apps from vendor apt repositories A closed-source app installed from its vendor's apt repository, such as Typora, can now be captured and exported as a computer app. - The capture records each non-Ubuntu repository listing the installed version (uri, suite, components from apt's sources files, one-line or deb822) and the key that signs it: the signed-by key, or the trusted key that gpgv shows verifies the repository's signed index. The key is retained with the capture. - The capture records the packages owning the libraries the executable loads (DT_NEEDED with RUNPATH and the linker cache, through REA's ELF readers), since a vendor package may not depend on them. - The export declares a verified vendor repository as an AptSource with its key, installs a vendor package's library packages, and adds --no-sandbox to an Electron app's launch, since a container denies Chromium's sandbox. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): report a locked database at once in data/get A database the running app holds locked made each data/get wait sqlite's five-second busy timeout before reporting it. Record the Typora run in an agentenv computer in the verification. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * perf(desktop): detect key files without splitting the whole text Read lines one at a time and stop at the first that a key file view would drop, instead of splitting a file of up to 64 MiB into arrays before its format is known. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep symlinked homes and state folders under the home in exports - Respell a path under its state folder's logical spelling only when that spelling is under the captured home, so a symlinked HOME keeps its files; pair walked and logical state folders only when the capture lists the same number, and match the innermost folder first. - When two files map to one home path, keep the one present before the capture and name the other in the limitations. - Read key files in the generated data/get with the state view's rule, checked against it by running the helper under python3. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): end captures on zombies and keep cleanup owners - A zombie or dead process no longer keeps the session open. - Remove only the partial capture file this run created. - Keep the exact owners of handles and processes whose cleanup failed on the returned error, so a retry can release them; test the published capture's cleanup-failure branch with mixed outcomes and retries. - Release the application once even when the exit checkpoint fails. - A cancellation before the capture is written removes what it retained. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): vendor package review round - Match apt sources through `apt-get indextargets`, which covers flat `./` and `/` suites and gives each release file and sources entry. - Accept a key whose signature verifies even when the release carries another signature without a key here; keep only the verifying key from a keyring holding several (OpenPGP packet splitter). - Install the package from its repository's release (`name/<release>`), declare one source per URI and suite, support only the capture host's architecture, and refuse Ubuntu Pro repositories. - List only library packages the computer can install; walk libraries only for vendor installs, with RPATH inherited as ld.so does, normalized paths, and DT_NEEDED bounded while reading. - Put --no-sandbox after the program an env wrapper launches; keep the gpgv folder's owner when its removal fails; respect --max-file-bytes for keys; wait 0.25 s on a busy SQLite database in data/get. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(desktop): keep the vendor spec's gpgv command on one line A code span broken across lines left `<binary keyring>` for VitePress to read as an unclosed HTML tag, so the docs build failed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(desktop): add a validated task to exported desktop applications Each capture can now yield one agentenv task in its exported bundle. An agent writes the task (a prompt plus declarative checks over the app's data/get views); REA validates it and stays model-free. - `describe-desktop-application-task` summarises a capture's net change per file (role, format, views before and after) and drafts checks. - Checks: file presence, lines present/absent/counted, JSON-pointer values, SQLite rows and counts. REA keeps a task only if a check fails on the seed and every check passes on the captured end state; a file that was not retained at the baseline counts as absent, as the computer starts. - `export-desktop-application --task` writes tasks/NAME.json (deploy, agent, skills, recording, prompt, verifier), a compiled verify.py that reads data/get, and an eval. A boundary test runs the verifier under python3 and checks it agrees with REA's evaluator on every check kind. - Docs, spec and skill guidance, with the solve-rate recipe. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(desktop): keep the seed test in its own block Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(desktop): record the task verifier driven in an agentenv computer Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(desktop): record the Typora task run in an agentenv computer Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep task checks bounded, complete and attributable - line_count counts lines holding a substring (contains) instead of matching a regular expression, which could stall the verifier on agent-written text and read differently in Python. - value_equals of a whole object or array is undecided on a truncated view. - The draft keeps a database whose rows changed under an unchanged hash, and a file whose truncated views match while it changed. - A task file that cannot be read keeps the reader's detail, and a failed cleanup keeps the read failure as its primary. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): leave a file with one version out of the task draft Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(desktop): update the task verification's test counts Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(desktop): record the task solve rate with Claude Code and Sonnet 5.5 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(desktop): capture and export apps installed from a downloaded .deb capture-desktop-application --package-file reads the file's control fields with dpkg-deb and records its SHA-256, size and dependencies when it holds the installed package; the file itself is never kept. The library walk now also runs for local installs. export-desktop-application --package-url declares agentenv's Download(url, sha256) for that file, its dependencies and library packages as apt packages, and a run script that installs it with dpkg. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): seed app-named dotfiles and respell UTF-16 seeds The capture now treats dotfiles in the home named after the application (.varicad-cfg.ini, .notesrc) as state roots, so a file the app only reads during the capture is still seeded. The exported seeding respells the captured home in UTF-16 text files with a byte-order mark, keeping the mark. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): hold readiness until the app's own window shows An exported app is ready only once a window of its class that the taskbar lists is shown, so a splash screen of the class, which skips the taskbar, no longer counts as the app being up. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(desktop): record VariCAD captured, exported and run in an agentenv computer Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep exported views strict JSON for infinite and inexact numbers The exported data/get spells infinite and negative-zero SQLite reals as REA's SQLite reader does ("Infinity", "-Infinity", "-0"), and refuses a JSON file holding a number that reading would change (1e999, integers past 2^53, -0, rounded fractions) with the state view's own error, instead of a view with an infinity in it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep package-file facts tied to one file and URLs unechoed - A --package-url refusal never repeats the URL, and credentials are checked before the scheme. - The package file's identity must hold between dpkg-deb's read and the hash. - A failed close keeps its cleanup owner even when the capture is cancelled. - Readiness also ignores windows typed as splash screens. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): record database logs and keep state changes distinct - A selected path that is not a directory brings its -wal and -journal as content roots, so the capture records whether they exist and retains them. - The state view treats a file as absent only under recorded content roots and refuses a database whose log presence is unknown. - JSON changes list containers too, so an array that becomes an object with the same members is a change. - Key file entries escape the key as a JSON pointer segment, so [a/b] c and [a] b/c stay apart. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep watching through unread samples and late workers - An unreadable window list is unknown, not zero windows, and is named in the limitations. - Before ending the session, live run-token carriers no parent link reached are tracked; an unreadable process table leaves the exit unknown. - An env prefix's assignments find the program and name its XDG folders. - flatpak run options that take a value are skipped with it, -- is honoured and a /arch/branch suffix is dropped from the id. - State directories include the entry's full id. - Path options refuse empty values; roots count toward the entry limit. - A capture file whose close failed stays owned and is retried on discard. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): bound apt sources, keep older captures and cleanup owners - Sources files parse into one stanza per line or deb822 paragraph with its URIs and suites kept as lists, so no URI x suite product is built. - Repository architectures and release are optional, so captures written before they were recorded parse; the export treats them as unrestricted and unknown. - Library sources are matched against every index of a declared repository's URI, suite and components. - Two failures side by side keep both causes and both cleanup owners, and a host file whose close fails reports a lease on its handle. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): match escaped key file entries and suggest containers through members - The draft's key file lookup uses the state view's escaped `group/key`, so a key holding `/` or `~` still gets its suggestion. - JSON and XML changes now list containers too; the draft suggests an added or removed container through its listed members, and a container only when none of its members is listed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): read relative PATH entries from the launch folder A program, or an empty or relative PATH entry, is resolved from the folder the program starts in, as the launch does, so `env PATH=. app` with the entry's Path still finds the app. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * perf(desktop): compare JSON views on one shared path JSON and XML changes are found by walking both trees with one shared pointer path, building a pointer only for a listed value, so memory follows depth rather than every container's full path. A pointer over 4096 characters is counted but not listed. A 256-level document with 4000-character keys went from about 251 MiB of heap to under 1 MiB. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep JSON Lines as text in the exported reader The exported reader parses the whole text before an inexact number makes it JSON with an error, so JSON Lines with an integer above 2^53 stay text as in REA. Over-long integer spellings are unsafe without converting them. The guide no longer claims large integers keep their value. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep the state-path help free of dash-led words The CLI alias check reads `-wal` and `-journal` in help text as short flags, so the help names the write-ahead log and rollback journal instead. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): never record or export apt source credentials - Source URIs lose any user name and password as they are parsed, the way apt splits them, and so do index-target URIs and descriptions and the sources apt-cache policy lists, so matching works whether or not apt prints them. - A repository whose entry held credentials is marked `uri_credentials_removed`, and the export refuses it, or an older capture whose URI still holds them, with a reason that names no URL. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): look programs up without normalizing their paths Program paths and PATH entries are joined rather than resolved, so `..` after a symbolic link means what it means to the launch. The lookup moves to its own module. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): note inexact JSON numbers with a flag, not a list The exported reader only needs to know whether any number was inexact, so it keeps a boolean instead of every rejected spelling. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): refuse older captures that still hold apt credentials A capture written before credentials were removed counted the credentialed repository's libraries as installable, so the export refuses it whole and asks for a new capture rather than declaring packages no source offers. Recorded policy sources are redacted in export messages too. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(desktop): keep the credential fixture on an example host A login on a real host reads as a secret to the commit scanner, so the older capture's fixture uses apt.example.com like the other credential tests. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): tidy looked-up paths and search relative entries only for env Empty and `.` segments are dropped from a looked-up program path, which keeps `/snap/bin/` entries recognisable as snaps, while `..` is still left for the kernel. Relative and empty PATH entries are searched only in the PATH an `env` prefix sets, which travels with the exported launch; the host's own PATH does not. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep excluded and unwalked database logs unknown The capture records the paths every walk left out, and the state view treats a log as absent only under content roots the baseline walked completely and outside those exclusions, so an excluded or unvisited log leaves the database unread rather than read without it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): judge JSON numbers after duplicate keys settle The exported reader marks an inexact number instead of flagging it during the parse, then looks for marks in the parsed value, so a number a later duplicate key overwrote no longer refuses the file, as in REA. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): redact a repository's policy source when it names it An older capture whose policy source matched no sources entry kept that text whole, and the export named the repository by it; the export now names it without any user name or password. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): never signal the launch group on unknown membership When the current read cannot observe a carrier's process group, the carrier is signalled on its own instead of letting an older process-table row grant a group-wide SIGTERM. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): look programs up in the launch's order and refuse host-relative finds The lookup searches PATH as the launch does, an empty entry meaning the launch folder, so inspection and launch name the same program. A program found only through a relative or empty entry of the host's own PATH is refused, since the exported computer would not have it; an env prefix's PATH travels with the command. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): count unchecked paths and keep logs behind them unknown Each walk counts the paths it could not stat and the directories on another device it did not enter, and the checkpoint records it as `unchecked_paths`. The state view treats a log as absent only when the baseline left nothing unchecked, so a log whose stat failed stays unknown. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * perf(desktop): scan parsed JSON with one iterator per level The check for marked numbers walks the parsed value with an iterator per nesting level instead of copying each container's children; a million-entry array went from about 15.7 MiB to 8.1 MiB of peak traced memory. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): start a relative program from its captured folder An exported launch whose program path is relative, such as `./app` from an entry's Path, now changes to the captured working directory first, as it already did for relative arguments. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-05 15:14:04 +08:00
morlutoandCursor Agent	71f680d7c1	feat(mcp): page retained instruction references (#8594) ... * feat(mcp): page retained instruction references * test(mcp): verify oversized instruction reference recovery * test(mcp): follow instruction reference continuations * test(mcp): validate continuation source kind --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com>	2026-11-05 04:30:52 +08:00
morlutoandCursor Agent	9ef70696dd	fix(ghidra): expose bit-field base type identity (#8602) ... * fix(ghidra): expose bit-field base type identity * test(ghidra): verify bit-field type handoff * test(ghidra): verify big-endian bit-field handoff * fix(ghidra): bind bit-field facts to snapshot profile --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com>	2026-11-05 04:03:43 +08:00
morlutoandCursor Agent	2b740cab36	fix(native): preserve function byte source qualifications (#8606) ... * fix(native): preserve function byte source qualifications * fix(native): recover oversized inline matching sources * test(native): verify matching byte source recovery --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com>	2026-11-05 04:01:16 +08:00
morlutoandCursor Agent	4ec2726b1b	fix(kuna): clarify failed export record availability (#8789) ... * fix(kuna): clarify failed export record availability * test(kuna): cover failed export cleanup retry --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com>	2026-11-05 04:00:22 +08:00
morlutoandCursor Agent	982e750a70	fix(ghidra): bind existing MIPS projects to target metadata (#8605) ... Co-authored-by: Cursor Agent <cursoragent@cursor.com>	2026-11-05 03:35:21 +08:00
morlutoandCursor Agent	93295c3df3	fix(mcp): report selection after failed target opens (#8726) ... * fix(mcp): report selection after failed target opens * fix(mcp): retain resource root selection in open failures * test(session): assert selection during cleanup failures * test(mcp): delay failed open response across target switch * test(session): distinguish no selection from pending cleanup * test(session): assert selections during cleanup and cancellation * test(mcp): join the failed-open gate before restoring its spy The snapshot-switch gate waited only on its acknowledgement, so a request that settled early hung until the runner timeout, and a later assertion failure restored the spy while that request was still in flight. Race the acknowledgement and join the launched open in finally before mockRestore. --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com>	2026-11-05 03:34:03 +08:00
morlutoandCursor Agent	f1622fc8b4	feat(native): page retained feature traces (#8585) ... * feat(native): page retained feature traces * fix(snapshot): retain linked source evidence for replay * test(snapshot): verify linked foreign evidence stays scoped * docs(mcp): clarify imported residual questions * docs(mcp): guide trace reference classification * fix(cli): report result sources when Evidence publication fails A trace keeps linked sources on the result. Use those records for the undelivered source closure as well as the bundle, so a refused output does not report them as not captured. * ci: rerun pull request checks The merge of origin/main did not start the CI workflow for this head. --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com>	2026-11-05 03:26:31 +08:00
morlutoandCursor Agent	1ff5a655bc	fix(native)!: preserve value-flow absence semantics (#8785) ... * fix(native)!: preserve value-flow absence semantics * test(native): compare value-flow reasons with their owners Stop freezing the unrecorded and Kuna unavailable sentences. Assert the procedure-scoped unknown and that an explicit provider reason is preserved. --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com>	2026-11-05 02:32:15 +08:00
morlutoandCursor Agent	dd4b83c220	fix(ghidra)!: search adjacent initialized memory blocks (#8840) ... * fix(ghidra)!: search adjacent initialized memory blocks BREAKING CHANGE: Ghidra analysis snapshots from earlier byte-search policies are refused; reopen the target and create a new snapshot. Historical Evidence remains importable. * test(ghidra): supervise cross-block fixture process * docs(ghidra): clarify contiguous search range * test(ghidra): verify search metadata and cleanup --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com>	2026-11-05 02:31:32 +08:00
morluto	d896ab7bd7	fix(mcp)!: distinguish unavailable batch pseudocode (#8737) ... * fix(mcp)!: distinguish unavailable batch pseudocode * test(mcp): preserve historical batch error details * test(mcp): retain unavailable items in batch recovery * test: update Ghidra batch unavailable expectation	2026-11-05 01:51:38 +08:00
morluto	6df2ac1d7e	fix(evidence): report partial workflow question publication (#8848) ... * fix(evidence): report partial workflow question publication * fix: project nested recovery for caller lifetime	2026-11-05 01:49:36 +08:00
morluto	b97023809f	feat(native): retain decompile export source facts (#8805) ... * feat(native): retain decompile export source facts * test(native): verify historical export source facts * test(native): retain source after export conflict	2026-11-05 01:48:53 +08:00
morluto	5b82a253dc	fix(evidence): link snapshot replays to original observations (#8734) ... * fix(evidence): link snapshot replays to original observations * style(tests): format snapshot replay assertions * test(evidence): cover replay parent metadata refresh * test(evidence): surface snapshot replay failures * test(mcp): check replay source after cleanup recovery	2026-11-05 01:47:24 +08:00
morluto	9196c30f6e	fix(ghidra): guide packed program import recovery (#8820) ... * fix(ghidra): guide packed program import recovery * test(ghidra): verify packed import recovery facts	2026-11-05 01:45:22 +08:00
morluto	9a79ee8e9e	fix(kuna): clarify single-function fallback evidence (#8742) ... * fix(kuna): describe fallback evidence without guessing project state * fix(kuna): qualify export capacity guidance by source	2026-11-05 01:43:00 +08:00
3 people	5990ff0324	feat(artifacts): read WeChat mini-program wxapkg containers (#8148) ... * feat(artifacts): read WeChat mini-program wxapkg containers Add a read-only reader for plaintext wxapkg packages: the 0xBE/0xED 18-byte big-endian header, the bounded name/offset/size member table, and verbatim member bytes at absolute carrier offsets. - Members retain declared names, absolute offsets and sizes, so source_location reports real carrier positions. - V1MMWX PC-client packages are detected as encrypted coverage with null member facts; extraction refuses with a typed error and no decryption is attempted. - Bounded table and directory budgets are admitted before allocation; malformed marks, truncated tables, invalid UTF-8 names, member extents inside the header or beyond the file, and counts that cannot fit their table are typed format or limit failures. - Member reads stream in bounded 64 KiB chunks with carrier freshness checks; the reader joins outstanding streams before close and bounds active streams and repeated member I/O. Refs #8121. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(artifacts): bound wxapkg members to the declared data region Normalize the two indexLength conventions before the table bounds check and the table read. Member ranges must then lie in that declared data region, which has to fit in the file. Record wxapkg format metadata as not compared: header facts repeat the package bytes, and entry source paths keep a producer root prefix. * fix(artifacts): choose the wxapkg index after member ranges fit Four trailing bytes made the rows-only layout end on the file and dropped the count-inclusive layout. Keep every admitted layout until the parsed rows and member ranges select one. --------- Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com>	2026-11-05 00:52:20 +08:00
morlutoandCursor Agent	52bca6de41	fix(native): retain value trace source evidence (#8384) ... * fix(native): retain value trace source evidence * fix(native): build trace error evidence only on failure * test(mcp): expect unowned value trace refusal * test(mcp): avoid freezing trace error wording * test(native): keep value-trace stop coverage with source evidence Main's stop and continuation cases now meet the trace's evidence-owner precondition: direct calls supply a source id, and a completed MCP trace runs in a session that can retain it. --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com>	2026-11-05 00:19:50 +08:00
김준호	30a11af923	fix(browser)!: keep the Chromium sandbox for REA-launched browsers (#8738) ... * fix(browser)!: keep the Chromium sandbox for REA-launched browsers Playwright appends --no-sandbox unless a launch passes chromiumSandbox: true. Neither the browser scenario launch nor the native module resolver passed it, so every REA-launched Chromium ran without its sandbox and REA_BROWSER_NO_SANDBOX had no effect. Both launch sites now take the sandbox decision from ChromiumSandbox.ts: off on Android or when REA_BROWSER_NO_SANDBOX=true, on otherwise. When Chromium reports that it cannot start its sandbox, the launch failure's remediation names the opt-out. Fixes #8722 BREAKING CHANGE: hosts where Chromium cannot create its sandbox, such as root users and Linux containers without user namespaces or a setuid sandbox, now fail to launch until REA_BROWSER_NO_SANDBOX=true is set. * fix(browser): name the sandbox opt-out on any sandboxed launch failure Chromium reports an unusable sandbox through several unrelated startup messages, including a misconfigured setuid helper and a refused namespace move, and Playwright recognizes only some of them. Matching individual messages missed real failures, so a sandboxed launch failure now always names REA_BROWSER_NO_SANDBOX=true as a conditional remediation and the retained startup diagnostics show whether the sandbox was the cause. * fix(browser): keep default recovery for resolver failures after launch The module resolver's outer catch also covers context, navigation and evaluation failures after the browser launched. Attaching the sandbox remediation there replaced their default recovery guidance. Attach the shared launch remediation only when a sandboxed launch itself fails. * docs(browser): note the Android sandbox exception for module traces	2026-11-04 23:54:29 +08:00
星闌	b1b6cb64c2	fix(analysis-view)!: distinguish unavailable native collections (#8291)	2026-11-04 23:53:45 +08:00
Entrpi	c13dd36d95	fix(artifacts): decide how compare_artifacts compares every format_metadata kind (#8231) ... * feat(artifacts): inventory and extract ESP32 firmware images ESP32-family app and bootloader images (magic 0xE9) had no reader, so open_binary refused OTA downloads, app partitions and bootloaders. Add the esp-image container format behind inspect_artifact and extract_artifact. A pure decoder reads each byte once and keeps only fixed-size fields. Derived facts cover the chip, from a table cited to ESP-IDF v6.1; segment classification as ESP-IDF's should_map and should_load; checksum and appended SHA-256 results; app and bootloader descriptors; Secure Boot v2 signature blocks, observed and unverified; and undescribed trailing byte ranges. Truncation and undescribed bytes make coverage unknown. ESP8266 images are refused with a specific reason, and ciphertext stays unrecognized. Add the format to every target, Evidence, snapshot, live-summary and artifact vocabulary, document it, and add an optional verify:esp-images lane that compares esptool-built images with esptool image-info and espsecure signature-info-v2. Refs #3615 * test(artifacts): run the ESP image lane on esptool v5.6.0 The lane compared descriptor fields only when esptool image-info printed one, so a descriptor that REA reports and esptool does not print passed without comparison. Compare the descriptor kind in both directions. Record that the lane passed for all 13 images with esptool and espsecure v5.6.0, the version the layout facts cite, as well as with 4.12.0. * refactor(artifacts): define ESP image layout sizes once The decoder and the derived facts each defined the segment-header, appended-digest and flash-sector sizes, the erased-byte scan and the offset formatter. Define them once with the other fixed-layout structures and import them in both places. The signature slot count is the one constant that drives the slot scan. Correct the observedEnd comment: it is the end of the last chunk read. * fix(artifacts): report ESP-IDF's segment length limit by chip ESP-IDF's verify_segment_header rejects a segment of 16 MiB or more unless the chip maps flash through 32-bit cache addresses (SOC_SPI_MEM_SUPPORT_CACHE_32BIT_ADDR_MAP: ESP32-S3, P4, C5, C61, H4 and S31 in v6.1). Record that capability in the chip table and add a limitation for such segments; unknown chips get none. `loaded` repeats should_load. It does not mean the bootloader accepts the segment: verify_load_addresses still rejects one outside the chip's RAM, which REA does not model. Say so in the docs, the skill reference and the inventory limitation. * test(artifacts): check ESP lane tools first and verify extraction The lane started work before checking its tools, so a missing RISC-V target, ld.lld, esptool or espsecure surfaced as a raw spawn or command error. Check each one before building and name the variable to set. Warn when esptool is not v5.6.0, the release the layout facts cite. Assert each segment's class for the ESP32-C3 app, its variants and the bootloader, as the Xtensa image already did. Extract the app and the signed image through the CLI and compare every file with the bytes at esptool's segment offsets or in the appended signature sector; the source's SHA-256 must be unchanged and equal the reported root_sha256. * docs(artifacts): state what the ESP image lane does not establish The Verification section listed the lane's checks but not its gaps: only ESP32-C3 and ESP32 images come from a real producer, no real project build, OTA download or flash dump is inspected, no signature is verified, and the lane does not run in CI. Record the timing of the final lane run on esptool v5.6.0. * fix(artifacts): compare ESP segment declarations Segment entries hash only their data, so compare_artifacts reported a segment that moved to another load address with the same bytes as unchanged; only the image itself changed. Compare each segment's load_addr and data_len as its declaration, as Node SEA and PyInstaller members are compared, and count a changed declaration as a metadata change, also when content is unavailable. Header offsets are layout and the classification is derived, so neither is compared. * test(artifacts): run ESP lane commands as owned process trees The lane ran its tools through execFile. A timeout killed only the direct child, so a linker or assembler that Clang or GCC had started could keep running while the lane removed its workspace. Run every command through createVerifierCommands, check the tools inside withVerifierCleanup, and remove the workspace only after commands.close() has stopped every tree; a failed close keeps the workspace. Only a nonzero exit now counts as a refusal or an expected esptool failure; timeouts and spawn failures propagate. Supervising each command roughly doubles the lane's run time. * test(artifacts): cancel ESP decoding after its first decoded chunk The cancellation test requested cancel or close on setImmediate, which can land while the file is still being opened and checked, so it never showed that decoding had started. It also passed against a reader that ignored both requests while decoding. Acknowledge the decoder's first chunk, then cancel or close, join the operation, and assert that no later chunk reaches the decoder and that the reader ends closed. * docs(artifacts): record which ESP metadata comparison ignores Segments are compared by their declaration. The image's and the signature blocks' format_metadata are not: every field comes from their own bytes, which content comparison already covers, and a block's image_digest_matches follows the image's content. * fix(artifacts): decide declaration comparison for every metadata kind compare_artifacts listed the format_metadata kinds it compared by hand, so a new kind went uncompared without notice; ESP segment load addresses were first missed this way. One table beside the schemas now gives every kind a declaration projection or the reason comparison uses none of its facts, and a kind without an entry does not compile. Consumers read one result per pair instead of naming formats. - Godot PCK entries stay uncompared. Godot looks members up by the simplified path without res://, which logical_path holds apart from Unicode normalization. Godot 4.3 exports store res:// and 4.4.1 exports do not, so comparing source_path would mark every member changed. The reader admits only the encryption flag, which the occurrence's encrypted field records. - A changed PyInstaller declaration is now a metadata change also when the member's content is unavailable, as for ASAR, Node SEA and ESP segments. It was unknown before, for no recorded reason. - Root kinds and ESP signature blocks stay uncompared: their fields come from their own bytes, which content comparison covers. - A declaration that only one side records now adds one generic limitation for every compared kind. Only Node SEA added one before, with its own text. * fix(artifacts): keep content comparison for metadata records with content The record rule compared two metadata occurrences by their declaration alone. A hand-built record that names content, with an equal declaration, then hid a content change; PyInstaller records already did so before the table. The rule now needs both records without an artifact_id, which is every metadata record a reader emits. Review changes in the same area: - The unknown-declaration limitation also covers declarations of different kinds and non-container observations, and tests compare it with its constant. - docs/godot-pck.md gives each Godot version's lookup path, the backslash case, and that a member that becomes encrypted compares unknown. The table points to it instead of restating it. - The PyInstaller regression moves to an acceptance test whose MCP client validates the advertised output schema, and the domain tests keep one representative case per behavior. * fix(artifacts): compare encryption changes when content is unavailable An encrypted member has no content. Comparison then took the content-unavailable fallback, which counted only ASAR storage and format declarations, so a Godot PCK, ZIP or PYZ member that became encrypted compared unknown although both sides record `encrypted`. The record rule compared node-less metadata records by format declaration alone, so a PYZ namespace record whose encryption flipped compared unchanged. `OccurrenceMetadata` now owns the encryption comparison beside ASAR storage and the format declaration. Every occurrence records `encrypted`, so a pair's comparison is never unknown. The fallback, the record rule and the metadata dimension read it there; `metadataChanged` no longer compares `encrypted` itself. The record rule compares all of `OccurrenceMetadata`: a changed value is changed in metadata, with availability when another is unknown. Decision: occurrence limitations still do not count for node-less records. Readers derive them from the declared facts (the PYZ caveat follows `encrypted`), and their wording can change between REA versions while the record stays the same. The fallback does not compare them either. Behavior changes: - A pair with unavailable content whose `encrypted` differs is changed [metadata, availability], not unknown [availability]. - A node-less record whose `encrypted` differs is changed [metadata], not unchanged. - A hand-built node-less record that records ASAR storage now compares it; no reader emits such records. Remaining: - The fallback still ignores `entry_kind` and `executable`, which readers also declare, so a file that becomes a symlink, or a mode change on an encrypted ZIP member, still compares unknown. `executable` has its own dimension, so its fix needs content-free checks split from node checks. Each is its own behavior decision. - Node-bearing pairs still compare limitation wording; records do not. Whether limitation wording is ever a comparison fact needs one decision. * fix(artifacts): compare entry kind and executable when content is unavailable When either side lacked verified content, comparison took a fallback that counted only ASAR storage, encryption and format declarations. It compared `entry_kind` only in the metadata check of pairs with content, and `executable` only beside the node checks. A ZIP member that became a symlink, whose target REA does not read, and an encrypted ZIP member whose Unix mode gained an execute bit therefore compared unknown, although readers declare both fields on every occurrence. `OccurrenceMetadata` now owns the entry kind comparison beside encryption; it is never unknown. Comparison checks fall into two groups: declared facts that need no content (`executable` and the metadata declarations), and facts that need both content nodes (content, kind, format, size, relations and node metadata). The fallback, the record rule and pairs with content share the declared checks and one rule for unknown declarations. Kind and format stay content checks: without content they are guesses from the path. Behavior changes: - Unless both sides have content, a pair whose entry kind differs is changed [metadata, availability], not unknown [availability]. - Such a pair whose `executable` differs is changed [executable, availability], with metadata when another declared fact also differs. - A hand-built node-less record whose `executable` differs is changed [executable]. No reader emits such records. Remaining: declared sizes and integrity digests still compare only through observed bytes, so they do not count when content is unavailable. * fix(artifacts): never mark a symlink executable On POSIX hosts the directory reader recorded a symlink's own permission bits as `executable`. Linux reports 0777 for every symlink and macOS usually 0755, so directory, app bundle and DMG symlinks read true. zip.js, the PyInstaller reader and the Windows branch record false. The previous commit compares `executable` without content, so a symlink that two readers or two hosts record differently compared changed in `executable`, and a non-executable file that became a symlink also reported `executable`. `hostExecutableMarking` now gives a symlink no marking on any host: running a symlink runs its target, and the link's own bits do not control that. Behavior change: directory, app bundle and DMG inventories record `executable: false` for symlinks. Occurrence IDs do not change, but the graph digests and manifest IDs of inventories with symlinks do. Comparing an inventory stored before this change with a new one therefore reports changed [executable, availability] once for each such symlink. * fix(artifacts): stop comparing limitation wording Pairs with content compared node and occurrence limitations as metadata, while node-less records, the content-unavailable fallback and inventory limitations did not. Limitations explain what an observation could establish. Readers mostly derive them from fields that comparison already reads, from other occurrences or from what REA could read, and their wording changes between REA versions. So adding `A` beside an unchanged ZIP member `a` marked `a` changed in metadata through its case-collision note, and an older and a newer inventory of equal bytes could differ wherever a reader reworded a note. No comparison path reads limitations now. Inventory limitations still appear in the result, and occurrence limitations stay in the inventory Evidence. Readers write no node limitations, so only hand-built inventories compared them. Behavior change: for a pair with content, limitation text no longer adds metadata. A pair that differs only there compares unchanged, or unknown [availability] when a declaration is unknown. Remaining: a few facts appear only in limitation text, or also in fields that comparison does not read, so their changes are no longer reported while the compared bytes stay equal: an ASAR block integrity table or an unsupported integrity declaration, a Godot member's all-zero MD5, a ZIP name's leading `./` (also in `source_path`), and a PyInstaller PYZ image digest (also in `pyz_sha256`; the archive root still reports the change). Each needs a field or a comparison decision of its own if it matters. * fix(artifacts): compare declared digests when content is unavailable Without observed bytes on both sides, comparison ignored the containers' declared integrity claims. Two encrypted Godot PCK members therefore compared unknown even when their declared MD5s showed that the script had changed. Godot's exporter stores the MD5 of a member's original bytes, so the MD5 does not depend on the encryption IV. This comes from the 4.3, 4.4.1 and 4.7.1 exporter sources; no real encrypted export was compared. When either side has no content, claims of one algorithm that differ now make the path changed in metadata and availability. Equal claims add no change, because they are unverified, and observed bytes still decide when both sides have them. Godot PCK and ASAR readers record such claims. For a readable member, a directory that declares or omits an MD5 only decides whether REA can check its bytes, so such a member compares unchanged. An encrypted member with an MD5 on only one side stays unknown. Remaining: declared sizes still compare only through observed bytes. * docs(artifacts): check the contract's compared kinds against the table docs/mcp-contracts.md named the format_metadata kinds that compare_artifacts compares in prose, by hand, so a kind added to the declaration table could go unnamed. The integration branch already omits esp-flash-partition, which the ESP flash layout branch adds to the table. The paragraph now names each compared kind by its identifier. A conformance test requires it to name exactly the kinds whose table entry has a declaration, which artifactFormatMetadata.ts exports as COMPARED_FORMAT_METADATA_KINDS, and no kind that comparison ignores. * test(artifacts): share the comparison acceptance MCP fixture Six artifact comparison acceptance tests each copied the same MCP steps: open_binary, inspect_artifact, the inventory_artifact substep Evidence, then compare_artifacts. The coverage test repeated the inspect steps three times and kept its own inventory lookup. tests/fixtures/artifactComparisonMcp.ts now owns these steps on the schema-validating connectLocalToolsMcp client. connectArtifactComparisonMcp() returns call, inspect(path) and compare(left, right). inventoryEvidence() reads the inventory Evidence that an inspection retains, from MCP or CLI output. Each test still writes its own authored input and keeps its expectations. The coverage lookup matched evidence.operation, not the substep operation. The inspection schema fixes both to inventory_artifact, so both select the same substep. The plist acceptance test does not change. It compares the inspection Evidence itself across CLI and MCP and passes the comparison Evidence to verify_reconstruction and find_changed_behavior. No assertion or scenario changes. * fix(artifacts): leave .NET bundle member declarations uncompared Upstream main compares no .NET bundle member facts. Comparing `file_type` changed `compare_artifacts` output beyond this branch's fixes, so the kind stays uncompared until that is decided. A changed manifest still shows as a content change of the host. * fix(artifacts): leave HEX region declarations uncompared The comparison table compared a region's start_address and length. A region's path names its start and end addresses, and its length follows from them, so two regions that pair at one path always declare the same facts: the entry could never find a change. It only made a region with equal bytes unknown when the other side recorded no metadata, such as a directory of extracted regions. The kind is not compared, as on main. The contract paragraph also stops naming .NET bundle members, which 3e51a7760 left uncompared. * test(artifacts): compare node-less records of any compared kind The record rule follows the comparison table, not PyInstaller, but only PyInstaller records exercised it. An ESP segment record shows both outcomes: an equal declaration compares unchanged and a moved one changed in metadata, without the availability that the fallback for unread content would add. * test(artifacts): compare a node-less record's recorded ASAR storage The record rule compares ASAR storage beside the declaration and `encrypted`, but no test recorded it on a metadata record. A changed value is changed in metadata, and a value that only one side records is unknown in availability, as for any occurrence. * test(artifacts): compare UnityFS member declarations through MCP The table compares a UnityFS member's declared source_path and raw flags, but no comparison test covered the kind, so dropping either field from the projection left every test passing. Bundles with equal member bytes now show both: other flags, or a stored path in decomposed form, compare changed in metadata, and reordered members, whose index and stream offset are layout, compare unchanged. * test(artifacts): use the shared comparison fixture for UnityFS The UnityFS comparison test arrived from the bottom branch with its own copy of the open_binary, inspect_artifact and compare_artifacts steps, which tests/fixtures/artifactComparisonMcp.ts owns here. It now uses connectArtifactComparisonMcp() like the other comparison acceptance tests. No assertion changes. * test(artifacts): find the contract's compared kinds by marker The docs conformance test found its paragraph by an exact English phrase, so rewording "also compares" failed it while the named kinds stayed right. The paragraph now sits between BEGIN and END markers, as the allocation report's sections do, and the test reads the kinds between them. It still requires exactly the kinds whose table entry has a declaration.	2026-11-04 23:53:01 +08:00
morluto	2d16a40a49	fix(ghidra): report selected project identity failures (#8379) ... * fix(ghidra): report selected project identity failures * fix(ghidra): retain refusal until client shutdown	2026-11-04 19:58:50 +08:00
Ha1baraA1	bd7002b441	fix(cli): export source Evidence for native value traces (#8297) ... * fix(cli): export source Evidence for native value traces * fix(cli): export source Evidence for native value traces * fix(cli): preserve trace completeness in summaries	2026-11-04 19:56:50 +08:00
3 people	064bb3f713	fix(firmware): reject staged files cut off at the per-file limit (#4430) ... * fix(firmware): keep producer reports writable under small staging budgets extract_firmware passed max_output_bytes straight to prlimit --fsize. RLIMIT_FSIZE applies to every regular file the producer writes, including the mandatory report.json and unblob.log outside the staging tree, so a staging budget smaller than the report truncated it and failed the extraction even when every staged file fit. Derive the per-file ceiling as the larger of the staging budget and the 8 MiB report budget; polling and the final inventory still enforce the aggregate staging budget. Fixes #3888 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(firmware): keep files stopped at the size ceiling over budget The per-file RLIMIT_FSIZE ceiling equalled the largest size its readers accept, and both the staging inventory and the report reader accept a file of exactly their budget. A write the kernel stopped at the ceiling therefore left a truncated file that passed as complete. Raise the ceiling by one byte so such a file exceeds its budget and is rejected. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(firmware): report the effective file-size ceiling on limit failures The exit path re-derived the staging budget for SIGXFSZ and process-limit recovery, so a small-budget run killed at the 8 MiB + 1 ceiling reported file_size_bytes 64 and said the cap was max_output_bytes. Pass the ceiling runFirmwareCommand installs and describe how it is derived. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(firmware): reject staged files cut off at the per-file limit RLIMIT_FSIZE stops a write at the limit without extending the file, and the staging inventory admits a file of exactly max_output_bytes. With a budget of 8 MiB or more the producer limit equalled the budget, so a staged file the kernel cut short published as a complete extraction; an inherited ceiling below the budget did the same. Derive the per-run limit once in firmwareFileSizeLimit as one byte above the largest budget, still capped by the inherited ceiling, so a file stopped at the limit exceeds its budget. When the inherited ceiling removes that byte, both staging inventories refuse a regular file that reaches the installed limit with a nonretryable file-size constraint naming the inherited limit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(firmware): derive limit adjustability from the per-run limit The one byte of headroom makes the per-run file limit equal an inherited ceiling of exactly max_output_bytes + 1, but adjustability still compared that ceiling with the raw budget. A SIGXFSZ then advised raising max_output_bytes, which the same ceiling clamps back to the same limit. Decide adjustability in firmwareFileSizeAdjustable from firmwareFileSizeLimit itself: recommend a larger budget only when it raises that limit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(firmware): compare file-size recovery with its owners The SIGXFSZ adjustability cases and the inherited-ceiling workflow matched fragments of remediation prose, so a harmless rewrite would fail them. Compare the emitted guidance with firmwareSignalLimitError for the expected branch, check that the two branches stay distinct, and compare the inventory refusal with firmwareFileSizeLimitReached. The selected limit, resource and retryability stay asserted as structured facts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>	2026-11-04 19:56:05 +08:00
ShuaixinHuang	33e0bf101a	fix(adb): admit completed path probes after daemon startup (#8858) ... * fix(adb): admit completed path probes after daemon startup * test(adb): preserve startup probe and digest evidence	2026-11-04 19:55:13 +08:00