main now carries #964 at skill version 29, so this branch moves to 30.
Regenerate the product catalog, conformance manifest, skill digest and
package metadata on top of it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Resolve conflicts against main:
- package.json: ship both the LLDB tracer bridge and main's process run
token reader sources.
- README.md: take main's simplified English README, which no longer has
the tool-family table.
- README_ja.md: take main's reworded table and count
observe_native_calls in the macOS native row (7 -> 8).
- Skill: the references gain the observe_native_calls paragraph, so the
version moves to 29 (main already uses 28).
- Regenerate the product catalog, conformance manifest, skill digest and
package metadata (135 tools). The MCP tool catalog is now built rather
than committed (#997), so it is removed here.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Resolve generated-metadata conflicts by regenerating them on top of
main. The skill references gain the inspect_signature paragraph, so the
skill version moves to 29 (main already uses 28). The MCP tool catalog
is now built rather than committed (#997), so it is removed here.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: simplify the English README
Preserve the opening and add the official skills.sh badge. Move setup diagnostics and CLI/Evidence details into guides, add three website showcases, and check setup-client facts in the installation guide.
Refs #1017
* docs: add README workflow and FAQ
Restore the original Disclaimer verbatim, invite community showcases, reuse the website investigation figure, and answer six common questions.
* docs: clarify README updates and collapse FAQ
* docs: welcome contributions in the README
* docs: highlight website guidance before quick start
* docs: keep README capability links aligned with main
* fix(docs): preserve README backlinks and release checks
The shared stale-file hint told developers to commit regenerated output, which is wrong for the gitignored build catalog. mcp-catalog:generate no longer re-runs the generator after build:cached since build:unlocked already produces it.
src/generatedMcpToolCatalog.ts had zero runtime importers and churned on every contract edit, guaranteeing merge conflicts on long-lived branches. It is now gitignored and regenerated by build:unlocked; typecheck and knip depend on build via turbo. Tests consume the build output unchanged. Adds a regen-generated CI workflow that pushes tracked generated metadata (product catalog, skill frontmatter, verification manifest/ledger, package metadata, error schema) to same-repo PR branches.
Follow #973's native ownership: the code-signing posture schemas move to
src/domain/native/ beside nativeInspection.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Follow #973's native ownership: the call-observation schemas move to
src/domain/native/, and the contract now lives in src/contracts/native/.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
observe-native-calls now runs through composition/directAnalysis, where #965
moved runProviderAnalysis.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Follow #952's layout: the code-signature lane moves to
scripts/verify/apple/code-signature.mjs and uses the relocated bundle
fixture builder.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Add observe_native_calls (CLI: observe-native-calls <path> <input-json>). It
launches the active Mach-O as an owned process under `lldb --batch`, stops at
caller-selected functions or Objective-C methods, records each entry and
auto-continues:
- thread, image, symbol, load and file address;
- raw integer argument registers and optional caller frames;
- for methods, the selector read from _cmd and the receiver's dynamic class,
from LLDB's runtime reader without running target code.
No expression is evaluated and no existing process is attached. The run ends
on exit, max_events or duration_ms; REA then kills the process and confirms
that it is gone. The result also carries exit status, bounded stdout/stderr,
breakpoint resolution with partial coverage for unresolved requests, and
limitations. A target LLDB may not debug fails with a debugger-attach-denied
reason and remediation.
verify:native-calls checks the tool through the CLI and stdio MCP against a
compiled fixture, compares breakpoint addresses with nm, exercises every
outcome, and checks hardened-runtime targets with and without get-task-allow.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
codesign prints one nested path per line, so a nested component whose name
contains a newline is split into fragments. inspect_signature now checks
that every --validated: path it reports exists, and names any that does not
in a limitation instead of trusting it as a complete path. The result stays
deterministic: codesign's progress lines arrive in no fixed order, so the raw
output is not echoed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The Electron guide currently uses a teaching fixture. Add a real Notion clipboard case with REA findings, short source excerpts and responsive figures, alongside the existing DX-Ball reconstruction.
- Trace the saved Notion 7.6.1 preload API through its wrappers to the clipboard receiver. Attribute the separate web-cache module probes to their original harness. Public content uses relative source locations and generic example data; packages and complete captures stay local.
- Add a Showcases index and links from the homepage and JavaScript guide. Simplify homepage copy while preserving the approved headline and closing question.
- Show copyable agent installation prompts and the direct setup command. Keep terminal cursors blinking consistently and respect reduced-motion settings.
- Provide one Notes example ZIP. Generate it from the six public source files before website checks and manual Pages deployment; verify its contents against the source. Pages remains manual-only.
Validation:
- `npm run check:fast`
- `python3 scripts/prepare-website.py` and `python3 scripts/verify-website.py`
- Browser checks at `/` and `/rea/`: downloads, prompt/command copying, responsive layouts, keyboard navigation, reduced motion and DX-Ball comparison controls.
- Published REA 4.1.0 preload analysis and feature traces; source/claim/privacy review.
- Real Hopper/Ghidra verification: not performed (website-only change).
- Treat a CodeDirectory platform identifier as a platform binary only when
the signature satisfies `anchor apple`, checked with
`codesign --verify -R="anchor apple"`; otherwise the dependent facets are
unknown. Developer ID code chains to Apple Root CA but fails this check.
- Report every security facet as unknown when architecture slices differ in
signing state.
- Map an aborted signal that escapes a native helper, such as ticket
hashing, to AnalysisCancelledError instead of an output error.
- Treat a target as an app bundle only when it was opened from a bundle
directory, so a regular file named X.app is verified as a bare Mach-O.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
inspect_native_dispatch_metadata read pointer fields as stored bytes, so
chained-fixup images (the default since Xcode 13) decoded no classes, and
superclasses from other images were always unresolved.
- Decode LC_DYLD_CHAINED_FIXUPS pointer formats 64, 64_OFFSET, ARM64E,
ARM64E_USERLAND and ARM64E_USERLAND24 with import formats 1-3, and
interpret LC_DYLD_INFO bind, weak-bind and lazy-bind opcode streams.
- Name external superclasses from their _OBJC_CLASS_$_ binds.
- Decode class_ro_t baseProperties and __objc_catlist category_t records
(instance/class methods, protocols, properties) into objc_categories;
category methods carry their category name.
- Report the fixup encoding in a pointer_fixups coverage facet.
- verify:apple-dispatch builds the fixture with dyld-info and chained
fixups, plus arm64e on Apple silicon.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Address review findings in inspect_signature:
- Verify with `codesign --verify --deep --strict`. Shallow verification
misses a file added inside a nested XPC service, or a modified dylib
inside a framework. verify:code-signature now tampers inside the
nested XPC service and requires `invalid`.
- Classify verification as `unsigned` only when the top-level target is
unsigned. Unsigned nested code inside a signed bundle is `invalid`.
- Report a stapled ticket that exists but cannot be read as
`unreadable`, with the error code in a new `reason` field, instead of
failing the whole signature inspection.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
inspect_signature reduced the CodeDirectory to a hardened-runtime boolean
and never verified the signature. It now also reports:
- the parsed CodeDirectory: version, flags decoded from their numeric
value (runtime, library-validation, restrict, kill, adhoc,
linker-signed, unknown bits in hex), code and special slot counts,
location, hash type, platform identifier, runtime version, and
executable-segment flags;
- sealed resources (version, rules, files, or none);
- a local `codesign --verify --strict` result on the opened bundle or
Mach-O, with diagnostics and the sorted nested code it validated;
- whether a notarization ticket is stapled at Contents/CodeResources,
with its digest. The ticket and Apple's records are not checked
because that needs the network;
- derived security facets with their supporting evidence: library
validation, DYLD_* handling, debugger attach, executable-memory
policy, and App Sandbox. Facets stay unknown when flags or aggregate
entitlements are unavailable.
verify:code-signature re-signs copies of the clang-built fixture with
real codesign (ad hoc, hardened runtime, hardened runtime with relaxing
entitlements, library,restrict). It also checks a platform binary and a
tampered bundle, with CLI/MCP parity, and runs in the macOS CI job.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(pages): reserve publishing for the REA website
* docs(website): add worked guides and agent prompt examples
* ci(website): check relevant PRs and publish only on demand
* docs(website): clarify IDA coverage and analysis session lifetime
project_apple_application_graph accepted only IPA inventories. It now
also projects macOS .app directories and ZIP or DMG inventories that
contain applications. It reports application roots, platforms, and
every nested bundle with its path-convention role, layout, parent,
Info.plist path, executable candidates, and signing paths:
- roles: app extensions, XPC services (including inside frameworks),
frameworks, login items, system and driver extensions, plug-ins,
resource bundles, and helper or nested applications;
- privileged helpers in Contents/Library/LaunchServices and launchd
plists in Contents/Library/LaunchAgents or LaunchDaemons;
- direct files of Contents/Helpers;
- symlinks by path. Their targets are not inventoried, so versioned
frameworks are described through their real Versions/<version>/
directories.
AppleDouble sidecars (._* and __MACOSX/) are excluded from roles. A DMG
whose contents could not be inventoried is reported as partial. Other
inventory formats remain input errors. The projection still reads no
plist or CMS semantics; it points callers at inspect_plist.
The result schema is additive. projection_id now covers the new fields,
so IPA projection IDs differ from earlier versions.
verify:macos-bundle compiles a source-owned app with clang (CLT only).
It packs it as a directory, a ditto ZIP, and an APFS DMG, and checks
identical anatomy through the CLI with stdio MCP parity. It runs in the
macOS CI job.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* perf(graph): avoid repeated traversal edge scans and copies
* fix(android)!: preserve JVM settings and reuse metadata sessions
Read class metadata without generating application source, retain immutable serialized APK sessions, and join owned cleanup on cancellation and shutdown.
BREAKING CHANGE: Android analysis now requires a full JDK 17 or newer with its compiler module for the packaged Java source bridge.
* feat(browser): trace captured website module imports
Compose verified exported scripts, inert native import syntax and a narrow
Chromium resolution port. Preserve query/fragment identity, import-map context,
all reported capture candidates and explicit unknown execution. Share named
CLI/MCP contracts and retain native reports, diagnostics and cleanup failures.
Add focused boundary regressions and a real module-loading oracle to the
existing conditional Chrome lane. No captured application code is executed
by module tracing, and no selected website asset is refetched.
Refs #851, #774
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
* fix(browser): preserve module contexts and source bindings
Keep capture completeness inline, validate actual source text against its
digest, and separate unsupported URL contexts from malformed input.
Use the importer origin for native module resolution and the selected map
base independently, including mixed HTTP/HTTPS and escaped HTML attributes.
Refs #851, #774
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
