Commit Graph
79 Commits
Author SHA1 Message Date
jhuang-tw ae02eb3e7d docs: keep AGENTS language consistent 2026-08-17 23:50:45 -07:00
jhuang-tw d0201b036b test: make Windows case assertions CRLF-safe 2026-08-17 23:50:22 -07:00
jhuang-tw ceabe94610 docs: remove stale routing case count 2026-08-17 23:49:51 -07:00
jhuang-tw a515665e70 docs(p0): complete native AI bootstrap path 2026-08-17 23:44:34 -07:00
jhuang-tw 21d5b2bf4e docs(p0): make master skill use platform-native entrypoints 2026-08-17 23:42:59 -07:00
jhuang-tw 01cd654e81 docs(p0): route canonical behavior through native platform entry 2026-08-17 23:41:53 -07:00
jhuang-tw 843bf5d1e3 docs(p0): make primary route entry cross-platform 2026-08-17 23:40:16 -07:00
jhuang-tw 58455eccd6 docs(p0): document native case-init scope contract 2026-08-17 23:39:46 -07:00
jhuang-tw 0f39e89cea test(p0): assert Force cannot bypass scope gate 2026-08-17 23:39:19 -07:00
jhuang-tw d2e51449ef test(p0): cover fresh cross-platform case contract 2026-08-17 23:37:56 -07:00
jhuang-tw 77e6be06a2 docs(p0): make agent entry platform-native 2026-08-17 23:36:49 -07:00
jhuang-tw e29bba4b6b fix(p0): align powershell offline sample case readiness 2026-08-17 23:35:27 -07:00
jhuang-tw fb1124daf9 fix(p0): write bash cases under caller project root 2026-08-17 23:34:35 -07:00
jhuang-tw d2445dc616 fix(p0): keep scope hard gates non-bypassable on powershell 2026-08-17 23:33:49 -07:00
jhuang-tw 0c83d1d69d fix(p0): keep scope hard gates non-bypassable on bash 2026-08-17 23:33:28 -07:00
Edison ea582f30d5 Merge pull request #85 from zhaoxuya520/fix/issue-77-blindspot-r52-r81
feat(ops): blindspot cookbook R52-R81 (#77 batch 2)
2026-08-16 20:41:00 +08:00
yhc e489f9ad6a fix(verify): run #77 anchors before fail gate; strip BEL in links
Move ADF/BSC assertions out of Write-Host string so they update $fail.
Use Ok/Bad + Test-Path/Get-Content (no phantom Assert-File*).
Assert re-agent-workflow hooks blindspot cookbook.
Remove ASCII BEL from ADF/workflow markdown link labels.
2026-08-15 08:58:36 +08:00
yhc 038e69fd5b feat(ops): blindspot cookbook R52-R81 (#77 batch 2)
Add analysis-blindspot-cookbook for language/obfuscation/behavior/format/
agent-meta recipes. Detection-oriented; no bypass tutorials. Hook ADF §5,
re-agent-workflow, verify anchors. Not a third master workflow.
2026-08-14 21:09:20 +08:00
Edison dd7c50dc38 Merge pull request #84 from zhaoxuya520/fix/issue-77-analysis-decision-framework
feat(ops): analysis decision framework R1-R51 (#77)
2026-08-14 20:31:25 +08:00
yhc ec61a6f951 feat(ops): analysis decision framework R1-R51 (#77)
Add analysis-decision-framework cookbook (P0 full / P1 short / P2 index).
R4* validated sufficiency (compatible >=1 bind). Thin hooks in evidence-
finding-path, re-agent-workflow Synthesis, RULES(+zh), verify anchors.
Not a second master workflow; keep #65 gates and A-T/U-AV superior.
2026-08-14 20:26:03 +08:00
Edison 2c95829db5 Merge pull request #76 from atirna/agent/reverse-skill-impactful-audit
fix(bootstrap): 强制使用清单中的固定来源
2026-08-14 19:56:25 +08:00
Edison 0865266d59 Merge pull request #81 from doublecurry/codex/issue-80-radare2-skills-sync
fix(radare2): sync radare2-skills ecosystem
2026-08-14 19:56:22 +08:00
Atirna 7ea6d50732 test(bootstrap): reset expected child exit status 2026-08-14 12:46:50 +05:30
Atirna 49a5d285aa test(bootstrap): complete git checkout fixture 2026-08-14 12:42:03 +05:30
Atirna 41ee697f54 fix(bootstrap): fail closed on verified checkouts 2026-08-14 12:36:31 +05:30
deku 23824b0f2d fix(radare2): index radare2-skills tools 2026-08-14 13:44:34 +08:00
deku 47d293df44 docs(radare2): document radare2-skills ecosystem 2026-08-14 13:44:27 +08:00
deku acf96b3e3a fix(radare2): route radare2-skills tools 2026-08-14 13:43:12 +08:00
ZhaoXu ee9217b8af fix(bootstrap): preserve native command exit codes 2026-08-14 01:45:40 +08:00
ZhaoXu 289c24b161 [field-journal] [field-journal] 2026-08-14 ??? - Windows PowerShell ??????? 2026-08-13 17:18:33 +00:00
Atirna 0bcde46f50 fix(bootstrap): stub nohup so Linux CI records pnpm dev
The anything-analyzer start path backgrounds `nohup pnpm dev`. On Ubuntu CI
that never invoked the pnpm stub, so the source-pin regression missed the
argv. Intercept nohup like sudo, and fall back to a plain background when
nohup is absent.
2026-08-13 19:23:29 +05:30
Atirna 5e818abbbd fix(bootstrap): stub Linux apt in the PATH-stripped parser test
After Kali detection stopped using grep, Ubuntu CI reached python install
and called apt-get, which the macOS-oriented fixture never stubbed. Detect
Kali with builtins only, and accept brew or apt-get as the python sink.
2026-08-13 19:20:22 +05:30
Atirna fb311078f9 fix(bootstrap): run under a grep-free PATH
is_kali called grep on every Linux run, so the PATH-stripped parser-bootstrap
regression aborted before the pin gate. Detect Kali from os-release with tr,
and write Unix stubs as LF/UTF-8 so Linux pwsh can execute them.
2026-08-13 19:16:16 +05:30
ZhaoXu 29e85db58e Merge pull request #78 from jhuang-tw/fix/bash-router-project-root-20260813
fix(router): keep Bash route artifacts in caller project
2026-08-13 21:41:55 +08:00
jhuang-tw d23dbf9c85 test(router): cover Bash default project root 2026-08-13 01:24:13 -07:00
jhuang-tw 9d33e2c5e7 fix(router): keep Bash route artifacts in caller project 2026-08-13 01:23:53 -07:00
Atirna 87e00b80db fix(bootstrap): fail closed before manifest installs 2026-08-13 03:22:32 +05:30
Atirna 1d929bf5db fix(bootstrap): harden pinned checkout promotion 2026-08-13 03:00:49 +05:30
Atirna e8faca63ed fix(bootstrap): enforce manifest-pinned sources 2026-08-13 02:30:36 +05:30
ZhaoXu b5ea7fb183 Merge pull request #75 from zhaoxuya520/fix/issue-65-nonpe-cookbook-u-av
feat(workflow): non-PE multi-format cookbook U-AV (#65)
2026-08-13 00:06:45 +08:00
yhc 241fa77be0 feat(workflow): non-PE multi-format cookbook U-AV (#65)
Add nonpe-format-cookbook for BAT/PS/VBA/JS/SYS/DLL/Android recipes.
Wire re-agent-workflow §3.4, malware/js/apk/kernel skills, verify asserts.
Dedup DLL Delay-Load with A-T R; detection-only for wiper/BYOVD/reflective.
2026-08-12 21:09:04 +08:00
ZhaoXu 0816b12435 Merge pull request #74 from zhaoxuya520/fix/issue-65-patches-a-t-cookbook
feat(workflow): anti-debug/obfuscation cookbook A-T (#65)
2026-08-12 19:39:17 +08:00
yhc 31708a99ae feat(workflow): anti-debug/obfuscation cookbook A-T (#65) 2026-08-12 18:52:29 +08:00
Edison 0182b10004 Merge pull request #73 from zhaoxuya520/fix/issue-65-feasibility-gate-patches-6-10
fix(workflow): feasibility gate + patches 6–10 (#65)
2026-08-12 15:11:27 +08:00
yhc 831ab83083 fix(workflow): feasibility gate + side-path patches 6-10 (#65)
- User-command feasibility gate: obey goals not blind step order;
  blocked steps require explain + confirm; forced steps mark quality
- Redo-X clarified: named step or confirmed prerequisite path;
  unpack is prerequisite not substitute for import Evidence
- Patch 6: post-unpack self-check crash -> dynamic CreateFile/GetFileSize
- Patch 7+10: TLS -> EP -> sensitive API -> ExitProcess dump baseline
- Patch 8: high-risk API cluster hints when import table is huge
- Patch 9: SHOULD time-boxes (15min static / ~200 steps dynamic), overridable
- Wire RULES (en/zh), agent-obedience, malware, r2/ida; extend verify asserts
2026-08-12 15:06:38 +08:00
yhc 899fedd36f Merge PR #72: IAT repair iron rule + six-phase map + vuln thin overlay (#65)
- IAT fail-fast to dynamic API breakpoints (E-iat-repair-fail)
- .NET/DLL-SYS equivalent anchors; clean-IAT and anti-VM side paths
- thin vuln report overlay (not a 3rd default full flavor)
- CI: nested smoke uses same host + UTF-8 BOM for PS5.1 safety
2026-08-12 12:34:16 +08:00
yhc 172e03ada0 fix(ci): run nested smoke scripts on same host + UTF-8 BOM
Windows CI failed because smoke.ps1 nested bare 'powershell' (often 5.1)
to run verify-routing-coherence.ps1. PS5.1 mis-parsed UTF-8 Chinese source
without BOM, so nested verify exited 1 while the standalone pwsh verify step passed.

- Resolve SmokeHostExe from current process (pwsh on GHA windows-latest)
- Rewrite nested invocations to use $SmokeHostExe
- Write UTF-8 BOM on smoke.ps1 and verify-routing-coherence.ps1 for PS5.1 safety
2026-08-12 12:09:38 +08:00
yhc 5d73e05e89 fix(workflow): IAT repair iron rule + vuln thin overlay (issue #65)
- Map reporter six-phase malware RE flow into re-agent-workflow with
  IAT repair fail-fast (E-iat-repair-fail -> dynamic API breakpoints)
- Equivalent import anchors for .NET; E-exports for DLL/SYS; clean IAT
  and sandbox no-behavior side paths
- Wire radare2/ida/malware hard gates + RULES/obedience rebuttals
- Add optional thin vuln report overlay (not a 3rd default full flavor)
- Extend verify-routing-coherence assertions; smoke+verify x3 pass
2026-08-12 11:57:38 +08:00
yhc 9c9f22da2b Merge PR #71: clarify report flavor routing and evidence traceability 2026-08-11 22:08:32 +08:00
yhc e0080b200e Merge PR #70: macOS system Bash compatibility CI 2026-08-11 22:08:32 +08:00