morluto
1b97b0f370
* fix(application): retain completed evidence through cancellation Validate completed provider reports before classifying cancellation and preserve Evidence and captured diagnostics. Share MCP recording and delivery across custom observation handlers. Add source-owned completion and public SDK recording controls. Refs #3923, #3927, #4261. * fix(wasm): retain final observations through cancellation Keep completed Evidence after finalization and through CLI/MCP delivery. Preserve output and cleanup failure precedence. Refs #4254. * fix(browser): retain final observations and forward cancellation Classify final CDP detach and completed scenario cleanup at the provider boundary. Translate completed partials into canonical Evidence for MCP recording, and forward CLI cancellation to passive Electron tools. Refs #4255, #4256, #4257. * fix(ghidra): isolate cancellation of shared startup waiters Keep startup group-owned while each caller has an independent abortable wait. Await final-owner cleanup and preserve cleanup facts before retrying. Reuse the shared abortable promise helper. Refs #3983. * fix(mcp): keep shutdown registrations until cleanup succeeds Retain repeated event requests while unresolved owners need cleanup, and unregister only after success. Verify coalescing and failed-owner retry. Refs #4253. * fix(adb): own transfer snapshots and stage screen publication Bind transfer digests to the exact private input bytes and preserve caller APK names. Retain failed descriptors and private-root owners with typed cleanup evidence; publish captures exclusively after the cancellation cutoff. Refs #4251, #4252. * fix(verification): report ADB cleanup failures Always close after attempted verification and keep unexpected primary failures and cleanup details visible. Exercise the production script with controlled imports, including null and undefined throws. Refs #4260. * fix(runner): stop owned Windows commands on cancellation Use the retained ChildProcess handle for IPC cancellation and parent disconnection. Keep the SQLite lock until observed child close, and include native Windows regressions in the curated CI lane. Native Windows results remain pending. Refs #4258. * fix(website): canonicalize link containment boundaries Compare resolved targets with resolved repository and site roots. Accept directory aliases while preserving escape checks and keep fixtures within their temporary owner. Refs #4264. * docs(testing): cover completion races and cleanup retry Clarify validation-before-cancellation, independent startup waiter controls, producer and adapter coverage, and repeated shutdown events. * fix(filesystem): retain file owners and completed reads after close failure * fix(session): report retained snapshot staging in cleanup status Fixes #4277. Include both snapshot and profile file-resource scopes in the owning status fact, preserving publication receipts and cleanup retry. * docs(mcp): clarify recovery of raw partial observations Document the observed SDK cancellation boundary and the open design decision in #4276 without promoting raw errors to Evidence. * fix(kuna): own the complete installation inspection lifetime * test(kuna): cover session cleanup of shared cache resources * fix(hopper): isolate publisher operation resource admission * fix(hopper): preserve launcher cleanup failure classification * fix(adb): retain ordered cleanup and screen publication outcomes * fix(runner): retain Windows job ownership through cleanup retries * docs: clarify inspection admission and ordered cleanup regressions * fix(ghidra): preserve startup cleanup and request deadlines * fix(runner): supervise stdin errors and bootstrap native controls * docs: require queued lifecycle controls to survive admission * fix(cli): leave cleanup resolution with resource owners * test(adb): verify owned install snapshots through CLI * fix(errors): exclude resolved primary cleanup resources * fix(adb): resolve publication cleanup after its handle closes * fix(android): resolve JADX hash cleanup after owned close * refactor(android): share hash failure cause options * fix(kuna): gate commands on retained descriptor cleanup * docs: cover cleanup admission and owner-confirmed recovery * refactor(artifacts): bind cleanup errors to confirmed release * fix(adb): resolve recovered cleanup at retained owners * fix(kuna): resolve installation cleanup after owned close * fix(kuna): gate cache reads on retained hash cleanup * fix(setup): preserve publisher cleanup admission failures * fix(android): resolve the reported retirement cleanup error * test(runner): scope post-spawn fault control to POSIX * test(adb): cover persistent snapshot owner retirement * fix(kuna): preserve file outcomes with explicit cleanup ownership * fix(artifacts): resolve errors through retained cleanup owners * docs(lifecycle): carry cleanup ownership in typed outcomes * fix(adb): bind staged screen errors to their cleanup lease * fix(kuna): bind profile cleanup through a close capability * fix(artifacts): retain descriptor resources in cleanup errors * fix(pcap): bind existing errors to snapshot retirement * fix(windows): load source owner through its file URL * test(build): copy the command runner helper into fixtures * fix(mcp): own shared observation providers in the transport * fix(jadx): resolve every retained cleanup retry error * fix(kuna): bind retry errors to every retained cleanup owner * fix(adb): bind admission and shutdown errors to exact cleanup leases * fix(windows): resolve command paths before native ownership * test(publisher): assert exact descriptor recovery without release metadata * docs(lifecycle): require every retry error to follow its owners * fix(kuna): keep hash cleanup state stable across concurrent retries * test(windows): exercise surviving descendants with scoped shutdown deadlines * fix(uninstall): preserve primary read errors through cleanup failure * test(publisher): assert cleanup Result and exact owner recovery * test(windows): observe supervisor resources through IPC disconnect * fix(browser): retain typed cancellation after interrupted actions * test(publisher): assert ownership phases without retry-count coupling * fix(lifecycle): preserve abort reasons through shared provider execution * fix(jadx): preserve execution and late hash cancellation causes * fix(adb): compose late cancellation with exact cleanup failures * test(mcp): use the shared budget for session workflows
Preserved licenses and attribution
Start with THIRD_PARTY_NOTICES.md for the distinction between distributed material and separately obtained tools. These files retain upstream texts; they do not change REA's MIT license.
| Files | Provenance and scope |
|---|---|
npm-dependencies.txt |
Every package path in the root lockfile, with its exact version, declared license, scope, download URL, and integrity. Includes development and optional platform entries. |
npm-runtime-notices.txt |
Original license, copyright, and NOTICE texts collected from integrity-verified locked runtime npm archives across all platforms; also the license of Rolldown's generated runtime helpers. The archive manifest's name and version are checked. |
nativeaot-parser-MIT.txt |
Original Washi notice for derived NativeAOT parser code; source revision is recorded in the parser and the root notices. |
dotnet-runtime-MIT.txt |
Original .NET Foundation MIT text from the NativeAOT reference revision a3b2d40328be0be3f8dd43f0e5cc925b8827b044. |
ghidra-12.1.4-{LICENSE,NOTICE,DISCLAIMER}.txt |
Unchanged top-level documents from Ghidra_12.1.4_build. Ghidra is not bundled; these reference copies do not replace its component and GPL support-program notices. The US-government-specific disclaimer applies to Ghidra, not to REA. |
cfworker-MIT.txt, xterm-MIT.txt |
Original notices missing from their published runtime npm archives, recovered from the releases' upstream Git revisions. They are included in the corresponding runtime entries. |
Apache-2.0.txt, MIT-template.txt |
Standard license texts for explicitly documented upstream notice gaps. The MIT placeholders are not an attribution to an inferred author or year. |
frida-17.23.2-COPYING.txt, LGPL-2.0.txt |
Unchanged licensing supplements for the optional Frida dependency: tagged Frida wxWindows notice and GNU Library GPL v2 text. The npm archive and tagged Node binding omit a standalone license/copyright document; these texts do not recover binding or prebuild-component attribution. |
MinGW-w64-runtime.txt |
Upstream's combined runtime copyright and license notices, snapshot from v12.0.0, for the statically linked Windows addon. This is a notice snapshot, not a pin of the compiler used in release CI. |
GPL-3.0.txt, GCC-Runtime-Library-Exception-3.1.txt |
Unchanged GPLv3 and GCC runtime exception texts from GCC 14.2.0. The exception permits eligible compiled combinations under its conditions; the runtime keeps its own license. This snapshot does not assert that every release uses GCC 14.2.0. |
Node-22.19.0-LICENSE.txt |
The original Node 22.19.0 license and third-party notices. The Windows addon uses Node-API headers from that release; the complete Node runtime and all components listed in this reference document are not bundled. |
upstream-sources.json |
Source URLs and SHA-256 digests for the new unchanged reference and supplemental texts. These digests identify the preserved local texts. |
Additional preserved originals live at evmole/LICENSE, pwndbg/LICENSE.md, and the website dinosaur notice.
Collection scope and maintenance
The inventory and runtime texts were prepared from the root lockfile. The collection downloaded the locked npm archives, checked their lockfile integrity and package identity, and read license/NOTICE/copyright documents without installing packages or executing lifecycle scripts. It includes optional platform packages that may not be present in one local installation. Temporary archives were removed after collection.
For releases that omit original documents, the collection uses pinned upstream
texts, embedded source/README license sections, or the same release's parent
notice for the @lydell/node-pty prebuilt family. evmole@0.9.3 uses the existing
preserved upstream license. clean-git-ref@2.0.1 and minimisted@2.0.1 provide
only license and author metadata: their missing original copyright documents
remain explicitly identified in the runtime texts. Do not describe those
entries as complete recovered attribution.
frida@17.23.2 also lacks an original standalone notice in its npm archive and
tagged Node source. Its declared license and the preserved licensing supplements
are recorded explicitly without inferring a copyright holder or year.
These records do not establish the legal accuracy of upstream metadata or
prove that every upstream source-file attribution has been supplied in an
archive. Review and refresh them when dependencies change; compare reference
texts with the sources and SHA-256 digests in upstream-sources.json.
When updating engines, copied code, website assets, or the Windows release toolchain, review their actual upstream notices as well. The Linux MinGW-w64 compiler in release CI is not version-pinned by REA: compare its installed runtime/component notices with the retained snapshots and update them if they differ. Do not assume that a compiler change leaves redistribution requirements unchanged. Preserve applicable originals with any additionally bundled engine; top-level reference copies alone may not cover its entire distribution.
Generate the exact locked inventory with npm run licenses:generate. After
refreshing verified runtime notices, update their header fingerprint to the
generator's reported runtime_dependency_fingerprint, then run
npm run licenses:check; docs:check also runs this check. It compares the
inventory, runtime package identities,
license declarations, archive URLs/integrity, runtime dependency fingerprint,
and preserved reference digests. It does not verify legal completeness or
replace inspection of original upstream notices.