8 Commits

Include renames

Author	SHA1	Message	Date
morlutoandCursor Agent	b4db35f092	fix: bind identity and coverage to the producing rule (#1513) ... * fix: bind identity and coverage to the producing rule Logical paths, container families, examined bytes, path-segment conventions, destination collisions, file-id leases, Mach-O CPU selection, and firmware cleanup now follow the observation that owns each rule. * fix: fail unmatched Mach-O slices and keep firmware roots independent A fat target whose architecture lipo did not list now stops before slice tools run. Chained fixups still count unread LC_DYLD_INFO rebase bytes, and a firmware cleanup failure no longer blocks the next workspace. * test: cover path identity and runtime families at the projection boundary NFC joins and segment conventions are now asserted by the path resolver, the Apple projection, and a real APK inventory instead of helper unit tests. * test: expect unread dyld rebase bytes in the Apple dispatch fixture The legacy LC_DYLD_INFO fixture keeps a rebase range this reader does not decode, so the public CLI and MCP check now requires that partial coverage beside the bind opcodes. --------- Co-authored-by: Cursor Agent <[email protected]>	2026-10-10 17:14:47 +08:00
morluto	ad59531a96	refactor: remove forwarding exports and redundant aliases	2026-10-09 22:46:09 +08:00
morluto	b7b4333703	fix(reference)!: represent unreadable symlink targets explicitly ... BREAKING CHANGE: Historical source symlinks with unreadable or unknown target_state require target: null. Placeholder target strings are rejected.	2026-10-09 21:01:52 +08:00
5 people	3af3811ab0	fix: integrate 24 reviewed browser/native/semantics corrections (#815) ... * fix(reference): resolve emitted extensions to TypeScript source Signed-off-by: Rudy Celekli <[email protected]> * test(reference): retain legitimate declaration import counterparts Signed-off-by: Rudy Celekli <[email protected]> * fix(mcp): recognize implicit form elicitation capability Signed-off-by: RudyCelekli <[email protected]> * fix(ghidra): reject contradictory NativeAOT reports * fix(native): preserve thin architectures across echoed filename lines Signed-off-by: Rudy Celekli <[email protected]> * fix(native): preserve app bundle executable filename whitespace Signed-off-by: Rudy Celekli <[email protected]> * fix(doctor): validate Node-wrapped client policy Signed-off-by: RudyCelekli <[email protected]> * fix(reference): preserve observed entry failure reasons Signed-off-by: Rudy Celekli <[email protected]> * fix(artifacts): verify opaque bytes before reusing inventory identities Signed-off-by: Rudy Celekli <[email protected]> * fix(browser): resolve DOM destinations against document base URL Signed-off-by: Rudy Celekli <[email protected]> * fix: recover serialized native NIB view hierarchy Signed-off-by: RudyCelekli <[email protected]> * ci: exercise native compiled NIB hierarchy regressions Signed-off-by: RudyCelekli <[email protected]> * fix(deps): remediate reachable archive-parsing advisories Two high-severity advisories are reachable from untrusted target content: - @xmldom/xmldom 0.9.10 (via plist) parses XML plist bytes from analyzed app bundles in the keyed-archive reader. Refreshed to 0.9.12. - brace-expansion 5.0.7 (via @electron/asar -> minimatch) is reached while analyzing untrusted ASAR archives. Refreshed to 5.0.12. Both are in-range patch updates (plist declares ^0.9.10, minimatch declares ^5.0.5), so no source or API change is required and no direct dependency declaration moves. Lockfile-only change. The remaining smol-toml advisory is not included: it parses operator-owned client configuration rather than untrusted target content, and its fix moves outside the declared range and changes leading-BOM handling. * fix(semantics): link wrapped arrow Promise returns * fix(reconstruction): preserve unknown graph limitations * fix(native): preserve exact code signing identifiers Signed-off-by: Rudy Celekli <[email protected]> * fix(native): recognize only whole otool command headers Signed-off-by: Rudy Celekli <[email protected]> * fix(native): retain nm-proven literal export names Signed-off-by: Rudy Celekli <[email protected]> * fix(javascript): project decoded file URL paths Signed-off-by: Rudy Celekli <[email protected]> * fix: preserve explicit source-relative URL observation spelling Signed-off-by: Rudy Celekli <[email protected]> * fix(native): project Mach-O evidence into container file offsets Signed-off-by: Rudy Celekli <[email protected]> * fix(browser): normalize referrer policy fallback lists Signed-off-by: Rudy Celekli <[email protected]> --------- Signed-off-by: Rudy Celekli <[email protected]> Signed-off-by: RudyCelekli <[email protected]> Signed-off-by: Rudy Celekli <[email protected]> Co-authored-by: Rudy Celekli <[email protected]> Co-authored-by: RudyCelekli <[email protected]> Co-authored-by: Kaoru0822 <[email protected]> Co-authored-by: DeryFerd <[email protected]>	2026-10-07 10:33:10 +08:00
Rudy Mizrahi Celekli	c8aed4740d	fix(reference): preserve unresolved absolute module specifiers (#670) ... Signed-off-by: RudyCelekli <[email protected]>	2026-10-06 16:18:17 +08:00
morluto	c34efca4cd	refactor(files): use caller paths for local evidence files	2026-09-29 14:53:20 +08:00
morluto	77454dc8f4	fix(errors): improve recovery guidance	2026-07-13 19:09:27 +00:00
morluto	4ff4c11a00	Add evidence-backed investigation workflows	2026-07-12 21:12:18 +00:00