Commit Graph
795 Commits
Author SHA1 Message Date
Kaoru0822 7acf4e741a Merge pull request #931 from morluto/fix/apple-bridge-roots
fix(apple): pair bridge hypotheses within one application root
2026-10-07 05:41:08 -07:00
morluto c7530f9a81 perf(javascript): reduce analysis and source-map work (#955)
* perf(javascript): reduce semantic traversal overhead

* perf(source-maps): reuse validated regular map rows
2026-10-07 20:33:35 +08:00
Kaoru0822 dda8e6a728 fix(setup): accept the pinned Hopper RPM launcher (#933) 2026-10-07 20:04:57 +08:00
morluto 2366bda37b fix(artifacts): harden reader lifecycle boundaries (#951)
* fix(artifacts): retain ASAR filesystem failure reasons

* fix(artifacts): avoid blocking on replaced FIFO entries

* test(artifacts): type the ASAR reader iterator

* fix(artifacts): classify filesystem-shaped ASAR errors

* test: account for POSIX FIFO fixture utility
2026-10-07 20:00:24 +08:00
morluto e0d76ae80d fix(mcp): advertise reserved process environment key (#949) 2026-10-07 19:58:51 +08:00
morluto f14b6a8430 fix(ida): share concurrent session cleanup (#950) 2026-10-07 19:58:43 +08:00
morluto 118d43e787 perf(setup): reuse initial diagnostics during planning (#940)
* perf(setup): reuse initial diagnostics during planning

* test(setup): verify post-configuration doctor refresh

* style(setup): remove extra test spacing
2026-10-07 19:52:43 +08:00
morluto c92a344d47 perf(javascript): index semantic fingerprint relations (#942) 2026-10-07 19:52:29 +08:00
morluto ac3bae3cb9 fix(native-ui): handle incomplete accessibility child collections (#944)
* fix(native-ui): align verifier with scenario contract

* perf(native-ui): reuse accessibility child counts

* fix(native-ui): handle incomplete child collections
2026-10-07 19:52:16 +08:00
morluto 348c65c7ec fix(javascript): handle deep static member paths (#939) 2026-10-07 19:51:43 +08:00
morluto 9e39795895 fix(android): bound fragmented JADX MCP frame memory (#937)
* perf(android): avoid repeated MCP frame copies

* fix(android): bound fragmented MCP frame memory

* style(android): format JADX transport changes
2026-10-07 19:51:08 +08:00
Kaoru0822andClaude Opus 5.5 2e81e867b2 fix(apple): count only real framework version directories
A file such as Versions/.DS_Store beside the only real version made the
framework look multi-versioned, so its Info.plist became unknown with a
misleading limitation. Version directories are now limited to entries
observed as directories or implied by deeper paths.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-07 11:46:53 +00:00
ysopwnable 28713f9b4d refactor(managed): group capability workflows and verification (#926) 2026-10-07 19:22:04 +08:00
morluto dcde958450 perf(javascript): analyze member chains without recursive copying (#932)
* fix(javascript): traverse deep semantic member chains iteratively

* fix(javascript): preserve deep initializer and pattern analysis
2026-10-07 19:09:25 +08:00
ysopwnable e6ba9c3af3 fix(javascript): retain recovered call argument positions (#929) 2026-10-07 19:08:45 +08:00
Jay HemnaniandCursor Agent 37d2ebac4c fix(artifacts): accept the bundle subject when extracting an app bundle (#891)
* fix(artifacts): accept the bundle subject when extracting an app bundle

For a .app target the session target is the bundle's executable, while the
artifact provider reports the bundle itself as the subject. The subject
check exempted inventory_artifact and inspect_artifact but not
extract_artifact, so extracting any .app failed with execution_failure after
the output tree had already been written, and the output path was never
reported.

* refactor(binary): rename artifact bundle subject helper

isArtifactInventorySubject also covers extract_artifact for .app
bundles, so name it for the shared bundle-subject exemption.

---------

Co-authored-by: Cursor Agent <[email protected]>
2026-10-07 19:04:55 +08:00
Jay HemnaniandCursor Agent 45fcd28b40 fix(javascript): resolve bare source-map and worker URLs next to the script (#890)
* fix(javascript): resolve bare source-map and worker URLs next to the script

A sourceMappingURL like `main.js.map` (the default of webpack, esbuild,
rollup, Vite and rolldown) and `new Worker("worker.js")` were resolved as
module specifiers, so the bare name was looked up as an npm package and the
map or worker script was never linked. Resolve them as URLs relative to the
declaring script.

* fix(javascript): tighten url-reference resolution edge cases

Use looksExternal for non-module contexts so protocol-relative URLs
cannot be misread as root-absolute paths, cover url-reference unit
cases, and assert bare service-worker script resolution.

---------

Co-authored-by: Cursor Agent <[email protected]>
2026-10-07 19:04:15 +08:00
Kaoru0822andClaude Opus 5.5 9226ade511 fix(apple): pair bridge hypotheses within one application root
A ZIP or DMG holding two applications produced bridge candidates from
scripts in one app to native code in the other. Candidates now pair only
components owned by the same application root; components outside every
root pair only with each other.

A versioned framework with several real version directories now keeps
its Info.plist unknown even when only one version has a plist, because
Versions/Current, which is not inventoried, decides which applies.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-07 11:02:47 +00:00
Kaoru0822 aa8082ea6c Merge pull request #913 from morluto/fix/uikit-runtime-connections
fix(artifacts): project UIKit runtime outlet and event connections
2026-10-07 04:00:25 -07:00
Kaoru0822 b3f013fa18 Merge pull request #899 from morluto/fix/interface-builder-plist-data
fix(artifacts): decode flat keyed-archive NIBs with data and shared references
2026-10-07 03:59:54 -07:00
Kaoru0822 2ed89e6529 Merge pull request #910 from morluto/feat/ios-app-bundles
feat(native): open iOS-style and iOS-on-Mac wrapper app bundles
2026-10-07 03:59:41 -07:00
morluto fd552a8c4b chore: merge main and regenerate combined catalog metadata 2026-10-07 18:44:34 +08:00
morluto be121d87eb chore: merge main and preserve keyed archive regressions 2026-10-07 18:44:01 +08:00
morluto b9292516f4 fix(process): retain provider output until streams close (#928) 2026-10-07 18:39:10 +08:00
morluto f826aa893f fix(browser): preserve evidence through deep AST analysis (#924) 2026-10-07 18:36:18 +08:00
Kaoru0822andClaude Opus 5.5 55249704c5 fix(apple): attribute only application-root components in macOS inventories
Directory, ZIP, and DMG inventories can hold installers, disk-image
extras, and AppleDouble sidecars beside the app. Those components were
classified as the application's frameworks, libraries, JavaScript, and
metadata, and fed runtime families and bridge candidates. For these
formats, components outside every application root are now left out,
with a limitation that counts them. IPA projection is unchanged.

A selected directory whose name ends in .app is now its own root by
identity, so an empty or partial inventory still reports it. iOS is
claimed only for shallow roots that have an Info.plist, so an empty root
reports no platform.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-07 10:30:47 +00:00
Kaoru0822 b956bd589f Merge branch 'fix/dmg-apfs-detach' into feat/macos-bundle-anatomy 2026-10-07 10:28:20 +00:00
Kaoru0822andClaude Opus 5.5 62634e4c01 fix(artifacts): keep the post-snapshot detach check out of provenance
The inventory snapshot captures reader provenance before close() runs,
so a `hdiutil info -plist` entry recorded during cleanup never reached
CLI or MCP results. Detach entries already share that timing. Record
neither instead of implying the query is observable.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-07 10:28:03 +00:00
Kaoru0822 28fd49f0f6 Merge pull request #889 from morluto/fix/managed-comparison-undecoded-signatures
fix(dotnet): compare members with undecoded signatures by exact identity
2026-10-07 03:22:54 -07:00
Kaoru0822 4f5110306d Merge pull request #895 from morluto/fix/javascript-indexeddb-open-version
fix(javascript): keep storage open versions out of XHR endpoints
2026-10-07 03:22:12 -07:00
morluto 9a15525298 perf(cli): defer unused catalog work during command startup (#920)
perf(cli): defer catalog digests and use canonical cache scope
2026-10-07 18:16:10 +08:00
Kaoru0822andClaude Opus 5.5 27c272bd9a fix(artifacts): read AppKit connectors from flat keyed-archive NIBs (#900)
* fix(artifacts): read AppKit connectors from flat keyed-archive NIBs

Flat AppKit NIBs archive NSNibOutletConnector and NSNibControlConnector
endpoints and the outlet or selector name under NSSource, NSDestination,
and NSLabel. The keyed-archive parser read only source, destination,
and label, so it skipped every such connector: XLD.app's 64 decoded NIBs
had no outlet or target-action edges. The NS-prefixed keys now follow the
same source and destination convention as compiled NIBArchive documents.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* fix(artifacts): read AppKit control connectors from the control to its target

NSNibControlConnector archives NSSource as the sending control and
NSDestination as the action target. The previous commit inverted them
like the unprefixed fields, so every flat AppKit action ran from the
target to the control. The action trace selects a control and follows
control -> action, and the graph keys the selector by its target, so
neither could resolve these actions. The NS-prefixed keys are now read
as source and destination for outlets and actions alike.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* fix(artifacts): key AppKit connector endpoints by their node identity

An NSSource or NSDestination object with an identifier field was
referenced by that identifier, but its node is keyed by its authored
object ID or archive UID. The connector then pointed at a synthetic
unknown node. NS-prefixed endpoints now use the referenced object's
node identity.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

---------

Co-authored-by: Claude Opus 5.5 <[email protected]>
2026-10-07 18:08:02 +08:00
Kaoru0822andClaude Opus 5.5 dd3e7aef0d feat(apple): project macOS bundle anatomy in application graphs
project_apple_application_graph accepted only IPA inventories. It now
also projects macOS .app directories and ZIP or DMG inventories that
contain applications. It reports application roots, platforms, and
every nested bundle with its path-convention role, layout, parent,
Info.plist path, executable candidates, and signing paths:
- roles: app extensions, XPC services (including inside frameworks),
  frameworks, login items, system and driver extensions, plug-ins,
  resource bundles, and helper or nested applications;
- privileged helpers in Contents/Library/LaunchServices and launchd
  plists in Contents/Library/LaunchAgents or LaunchDaemons;
- direct files of Contents/Helpers;
- symlinks by path. Their targets are not inventoried, so versioned
  frameworks are described through their real Versions/<version>/
  directories.

AppleDouble sidecars (._* and __MACOSX/) are excluded from roles. A DMG
whose contents could not be inventoried is reported as partial. Other
inventory formats remain input errors. The projection still reads no
plist or CMS semantics; it points callers at inspect_plist.

The result schema is additive. projection_id now covers the new fields,
so IPA projection IDs differ from earlier versions.

verify:macos-bundle compiles a source-owned app with clang (CLT only).
It packs it as a directory, a ditto ZIP, and an APFS DMG, and checks
identical anatomy through the CLI with stdio MCP parity. It runs in the
macOS CI job.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-07 10:06:48 +00:00
Kaoru0822andClaude Opus 5.5 b72c079a9a fix(artifacts): accept APFS image disks ejected with their container
An APFS disk image attaches as an image disk plus a synthesized APFS
container, and hdiutil reports both as whole disks. Detaching the
container also ejects the image disk, so the reverse-order detach then
failed with "No such file or directory" and every APFS DMG inventory
ended in "DMG detach or mount-root cleanup failed". APFS is the default
format of `hdiutil create` on current macOS.

When a detach fails, ask `hdiutil info -plist` whether the device is
still attached. A device that is gone counts as detached; one that is
still listed, or whose state cannot be read, remains a cleanup failure.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-07 10:06:37 +00:00
morluto 1d769cd261 chore: merge main and preserve UIKit and AppKit connections 2026-10-07 18:02:05 +08:00
morluto 071cfd1bb6 chore: merge main and preserve plist and AppKit regressions 2026-10-07 18:02:05 +08:00
ysopwnable f0a68dce60 refactor(artifacts): isolate JavaScript file acquisition (#916) 2026-10-07 17:57:33 +08:00
Kaoru0822 2db668f6ca fix(cli): emit empty structured filter projections (#914) 2026-10-07 17:51:10 +08:00
morluto 7a9f587c3a perf(dotnet): index declaring-type ranges once per metadata table (#918)
perf(dotnet): index ordered declaring-type ranges once per table
2026-10-07 17:48:39 +08:00
Kaoru0822andClaude Opus 5.5 900d7c8606 fix(artifacts): project compiled AppKit actions from the control to its target (#905)
* fix(artifacts): project compiled AppKit actions from the control to its target

NSNibControlConnector archives the sending control as NSSource and the
action target as NSDestination; a nil target is the first responder. The
NIBArchive projection swapped them for control connectors, so every
compiled AppKit action ran from its target to the control. The action
trace, which follows control -> action, could not find them, and the
selector node was keyed by the control instead of the target class. When
the target was nil, the swapped source was null and the action was
dropped: Chess lost 29 menu actions, KeepingYouAwake 7.

Connectors now keep NSSource -> NSDestination. The NIBArchive test
encoder moves to a fixture module so a bundle test can build compiled
NIBs.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* test(artifacts): report observed action routes when a compiled route is missing

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* test(artifacts): report compiled connector records when a storyboard route is missing

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* test(artifacts): write the storyboard fixture's action in Cocoa syntax

MacFixture.storyboard declared its button action with the iOS attribute,
<action selector="buildTapped:" destination="vc1">. Cocoa documents
name an action's receiver with target=. ibtool compiled the iOS spelling
into an NSNibControlConnector whose NSSource is the view controller
placeholder and whose NSDestination is the button. That is the reverse
of what Xcode-authored AppKit NIBs contain (Music, Chess,
KeepingYouAwake, and Transmission all archive NSSource as the control),
and it is what the old inversion had matched. With target= the compiled
fixture archives the button as NSSource. The temporary connector dump is
removed; the observed routes remain in the assertion message.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

---------

Co-authored-by: Claude Opus 5.5 <[email protected]>
2026-10-07 17:40:18 +08:00
morluto 62b37111e7 fix(javascript): handle deep AST traversal and addition without stack overflow (#915)
* fix(javascript): avoid recursion and eager ancestry copies in deep ASTs

* fix(javascript): traverse static analysis and bundler ASTs iteratively
2026-10-07 17:40:05 +08:00
morluto 5574287101 chore: merge main and resolve PR #889 conflicts 2026-10-07 17:28:56 +08:00
morluto 5b5b76a583 chore: merge main and resolve PR #895 conflicts 2026-10-07 17:28:56 +08:00
morluto 4d2faef37b chore: merge main and resolve PR #910 conflicts 2026-10-07 17:28:55 +08:00
morluto 96a9f32dc1 chore: merge main and resolve PR #899 conflicts 2026-10-07 17:28:55 +08:00
ysopwnable f6a58f1062 refactor(javascript): group domain semantics and contracts (#907) 2026-10-07 17:16:58 +08:00
Kaoru0822 d5f28fb29c Merge pull request #887 from morluto/fix/managed-native-boundaries-non-managed
fix(dotnet): inspect native boundaries of non-managed and malformed PEs
2026-10-07 02:12:48 -07:00
Kaoru0822 15ab5dbcaf Merge pull request #894 from morluto/fix/plist-prototype-key-reporting
fix(plist): report omitted __proto__ entries in signatures and Interface Builder
2026-10-07 02:12:34 -07:00
Kaoru0822andClaude Opus 5.5 8b243877c2 fix(artifacts): project UIKit runtime outlet and event connections
Compiled UIKit NIBs and storyboards archive outlets and control actions
as UIRuntimeOutletConnection and UIRuntimeEventConnection with
UISource, UIDestination, and UILabel. The NIBArchive projection
recognized only AppKit *Connector classes with NS-prefixed keys, so an
iOS app produced no outlet or action edges: Stash's 64 decoded documents
yielded none. These connections are now projected with the same
source -> destination roles, an event connection carries its
UIEventMask as ui_event_mask, UIClassSwapper reports its UIClassName,
UIProxyObject is a placeholder, and connection records are no longer
emitted as unknown objects.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-07 09:10:53 +00:00
Kaoru0822andClaude Opus 5.5 418a5562f6 fix(native): keep the resolved bundle plist and permission failures
- Carry the Info.plist that declared the program file on the target as
  bundleInfoPlist, so inspect_plist defaults to it even when the program
  file is a symlink into another bundle directory.
- Accept a readable Info.plist symlink, as reading the plist directly did.
- Treat only a missing path as an absent layout or wrapper; a permission
  denial now reaches the resolver's permission-denied classification.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-07 09:10:29 +00:00