Replace GNU-only sed -i in test-bash-workflow.sh with mktemp+sed+mv so
BSD sed runs case-guard reject-path tests 4/5. Wire the suite into
macos-bash-compat.yml.
Closes#135
pwntools is in the Kali bootstrap manifest (capabilities, canAutoInstall),
the Windows ToolDiscovery.ps1 catalog, and the generic
skills/scripts/refresh-tool-index.sh catalog, and the pwn-chain skill is
built entirely on it — but it was missing from kali/scripts/lib/
tool-discovery.sh, so the Kali refresh-tool-index.sh never reported its
path. Every sibling reverse-engineering CLI (binwalk, bkcrack, gdb) is
cataloged. Adds the entry, mirroring the Windows catalog (fallbacks
pwntools,pwn). Same parity fix as #137 (yara).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Treat repository discovery as read-only until the user explicitly activates the package and approves the disclosed first-side-effect plan. Preserve deterministic execution after approval, keep client-global configuration opt-in, align the English and Chinese entry contracts, and guard all four top-level agent entry files in CI.
ReFirmLabs.binwalk is not in the winget community repository
(0x8A150014 NO_APPLICATIONS_FOUND) and binwalk ships no prebuilt
binaries on any GitHub release, so the advertised auto-install path
could never succeed on Windows. Mark the capability manual with a
manualInstallHint (Rust toolchain + cargo install binwalk), matching
what firmware-pentest/SKILL.md already documents. Linux/Kali/macOS
are unaffected (apt/brew path does not read this entry).
yara is in the Kali bootstrap manifest and the Windows tool catalog and is
referenced by four skills, but was missing from kali/scripts/lib/tool-discovery.sh,
so refresh-tool-index.sh never reported its path on Kali. Add the catalog entry
(malware-analysis), matching its sibling analysis CLIs.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
R40 (case-evidence-review) had a single English benchmark case, leaving its
Chinese keyword set (证据链/证据图/可追溯性/案件审查/案例审计) and several English
branches (evidence.?graph, fixity.?check, case.?audit) untested. Add three
cases covering them; all verified to route to R40 through both the PowerShell
and Bash routers. Benchmark 175 -> 178, coherence green.
verify-routing-coherence.ps1 already rejects benchmark cases that point at a
removed route, but nothing enforced the reverse. The benchmark meta says to add
a case whenever a route is added, yet a new route could ship with zero coverage.
Add the symmetric check: every routing.json route must have at least one
routing-benchmark.json case. Passes today (44/44).
fix(docs): guard internal Markdown links
Owner integration: scan Git index blobs, include the payload corpus, and repair its missing reverse-shell link without materializing AV-sensitive content.
fix(ida-reverse): recover stalled Streamable HTTP supervisor
Owner integration: isolate opening and last-healthy state per MCP port and clear corrupt locks.
test-consolidate-evidence.ps1 printed CONSOLIDATE_ALIGN_OK but leaked exit 1:
it ran review_case.py --verify-hashes on a case whose consolidation had (by
design) rewritten E-001.md, so hash fixity could never pass. Drop --verify-hashes,
assert review_case's exit code, and wire both this and
test-bootstrap-codex-encoding.ps1 into the Windows leg of routing-tests. Both
shipped in the repo but were never run by CI.
zhaoxuya520