web_site_capture keeps the first 4 MiB of the page's HTML; when the page has more, the evidence now
carries an html_cut limitation with both sizes and the README says page.html is the first part.
Fixes#336.
Merges the whole SQLite stack in one commit (#410, #411 and #412): WITHOUT ROWID tables are read in primary-key order, rows older than ALTER TABLE ADD COLUMN show the added columns, and records over the payload cap say which values were cut.
Fixes#406, fixes#407, fixes#408.
Fixes#294. walk_dir returns an error when the root folder can't be listed and keeps each unlistable folder below it; core_archive_show and js_app_map mark those folders, add an unlisted_folders limitation and report partial coverage.
core_archive_show records max_entries and max_total_bytes, and a shared recorded_inventory helper checks a folder's freshness at the scope it was recorded with, so core_archives_compare and the Android, Apple and Harmony graph tools no longer refuse unchanged folders as file_changed.
game_unity_bundle_list adds a files_unread limitation when a bundle has more serialized files than it reads (16) and says "at least N object(s)" in its summary.
In summary mode formats_ai_weights_show saves every tensor in its evidence record with complete coverage, so core_evidence_browse can page through all of them instead of stopping after the first page.
Declared source maps on the script's own loopback origin (http://127.0.0.1 or [::1] with a port) are now resolved against the script URL and fetched with the bounded HTTP client, reporting fetched, bytes or the reason. Other hosts, ports, schemes and remote https maps are still never requested.
app_folder_explain counts files it couldn't open to look inside (unopened_files) and reports partial coverage then, and when its walk couldn't read something, instead of a complete 'nothing points to a runtime'. Fixes#292.
Frozen and light pins keep a project's runtime models in assets/obj; only obj folders beside a .NET project file are left out as build output. Fixes#274.
Listing Frida devices with a remote address returns that remote as one device, marked not contacted, instead of running frida-ls-devices with a -H flag it doesn't have.
build_file_read always shows the first line of a page, cut to 256 KiB with a note when it is longer, so a long minified line no longer reads as an empty page that no offset gets past. Fixes#280.
In Deep mode, a position-independent program is decompiled by name: addresses move between our image base and the one Ghidra loaded it at (the bridge now reports it), with engine_entry and an engine_rebased limitation when they differ.
Triage says a file that starts like an ELF, PE or Mach-O but can't be read is damaged, with the parse error, instead of calling it an unknown format. Fixes#319.
Reopening the same raw bytes with another architecture or entry point replaces the open target instead of silently keeping the first settings and caches. Fixes#305.
Triage of a bare .class file says it is a compiled Java class and recommends the java toolset (java_class_show, java_classes_find) instead of calling it an unrecognised format. Fixes#348.
A .text section that runs past the end of the file is decoded as far as the bytes go, with a text_truncated limitation and partial coverage. Fixes#306.
`app_changes_summarize` decided whether each comparison found changes. For records with `counts` it added added + removed + changed, which left out moves. So an archive or folder comparison whose only difference was a moved file (reported `identical: false`, `moved: 1`) counted as unchanged ("0 of 1 comparisons found changes").
A record's own `identical` verdict now decides when it has one, and moves count otherwise. Archive `counts.changed` keeps its meaning (content-edited files).
**Verified:** a new test of the verdict: a move-only comparison is changed (with and without `identical`), and an identical one is not. The engine's compare tests, clippy and fmt pass.
Fixes#286
`runtime_captures_compare` compared the filesystem dimension by the set of changed paths only. A run that deleted a watched file and a run that created the same file both "changed" that path, so they matched, and the comparison said the two runs were the same.
Each path is now compared together with how it changed (created, deleted or modified). Two deletions of the same file still match, and different paths still differ.
**Verified:** a new test of the filesystem comparison covering deleted vs created (changed), deleted vs deleted (unchanged), different paths (changed), and an `unchanged` effect against none (unchanged). The engine's process-tool tests, clippy and fmt pass.
Fixes#300
The builder's approval check refused dev servers before looking at the safe build list. `npx vite build` is on that list, but it also starts with `npx vite` (a dev server), so it was refused as one, whatever the mode or Auto setting.
A listed build is no longer read as a dev server: `npx vite build` and `cd app && npx vite build` are allowed, while `npx vite` and `npx vite --host …` are still refused. A command in watch mode (`--watch`) is now refused with the same hint, since it never exits either. That includes a listed build such as `npx vite build --watch`. The safe-list match moved into one helper used by both checks.
**Verified:** new cases in the approval tests (three spellings of the build allowed; two server forms and a watch build refused). The engine's approval tests, clippy and fmt pass.
Fixes#291
The engine had its own `write_atomic` (used for `craft.json`, the inbox, reports and session files). Its temp file was named by process only, so two threads saving the same file at once wrote into one temp file. One rename then found it gone ("craft.json: No such file or directory"), and the file could end up with two versions mixed ("trailing characters").
The engine now uses the platform crate's `write_atomic`, which already gave each write its own temp file and kept the file's permissions. It also gains the engine's short retry when Windows briefly can't replace a file another program holds open. There is one atomic writer now; docs/pitfalls.md says so.
**Verified:**
- A new engine test: four threads each save one file 50 times and read it back. Every save succeeds, every read is one whole version, and no temp files are left. It fails against the old engine writer (checked) and passes now.
- The existing "file held open for a moment" test still passes.
- `cargo test -p craft-anything-engine` (397), the platform fs tests, clippy on both crates and fmt.
**Not covered:** two saves that overlap can still each start from what was on disk, so the later one wins for fields that aren't the person's (the person's fields are kept, as before). That's separate from the write itself.
Fixes#273
`android_package_show`'s summary, shown in CLI help and the MCP tool list, said "signatures are not verified". The tool does verify them: v2/v3 signatures over the signed data with a recomputed content digest, and v1 PKCS#7 with the per-file digests. Its own `verification_scope` limitation says so. The summary now says signatures and content digests are verified, but not whether the certificate is one you trust.
**Verified:** text only. `cargo xtask tools` leaves docs/tools.md unchanged, and fmt passes.
Fixes#247
`adb_screenshot_take`, `adb_bugreport_save`, `adb_file_download` and `adb_app_download` create their fresh `output_directory` first, then check adb and the device. A device that was offline (or a missing adb, or a failed pull) left that folder behind, empty. The retry the error recommends then failed with "already exists", without ever reaching adb.
These tools now hold the folder in a small guard (`UnlessWritten`, next to `create_absent_dir`). When the tool stops, the guard removes the folder only if nothing was written into it, so partial pulls stay. On success the tool keeps the folder.
**Verified:**
- A new test: the guard removes an empty folder, keeps one with a file in it and keeps one marked kept.
- The same test calls all four tools through the engine with adb missing: no folder is left, and the identical retry reaches the same adb error rather than "already exists". That half runs only where adb isn't installed, like the other adb tests; it was skipped here because adb is on this machine.
- `cargo test -p craft-anything-engine adb`, clippy, fmt.
**Not changed:** the website, web, firmware and packed tools create output folders the same way. They can take the guard if needed.
Fixes#234
`adb_app_show` treated `dumpsys package <name>` output as describing the package if it merely contained the name. Android's answer for a missing package, `Unable to find package: <name>`, contains the name, so the tool returned successful evidence with no fields and complete coverage.
It now requires that package's own `Package [<name>]` block and otherwise returns the existing `NotFound` error with the "List installed packages with adb_apps_list." remediation.
**Verified:** a unit test with Android's missing-package reply, another package's block and an installed package; `cargo test -p craft-anything-engine adb`, clippy, fmt.
**Not verified:** a run against a real device.
Fixes#235
A paused, stopped or failed build only offered Continue or Try again; there was no way to say "enough now". project_build_finish marks the project Ready and adds a Done step to its conversation, keeping everything; the project screen shows It's done beside Continue and Try again when nothing is running.
Fixes#210
web_site_open keeps its browser for one session, and each CLI command is a session of its own that closes its browser when it ends. From the CLI, a capture with no open site now says so, and to run the steps together in an MCP client, the app or rebuild. Documented in tool-status.
Fixes#153
project_play's help says that on Windows a started program inherits the caller's output pipe (#207), and the reproducing test is kept in platform as an ignored test.
Every computed colour was painted on a 1x1 canvas and read back; Brave adds noise to canvas reads, so colours came back one unit off per channel (#F5F2EC as #f4f2ed). Computed rgb()/rgba() values are now read as numbers, and only other notations go through the canvas.
Fixes#154
Chrome reports Tailwind v4's rounded-full as its largest length, 3.35544e+07px; the capture now records any corner above 9999px as 9999px and keeps the other corners.
Fixes#155
A visitor's view of a site no longer keeps the page's class names (outline items and unnamed-control examples) or the query strings and fragments on image and link addresses, which can carry deployment ids and tokens.
Fixes#156
web_site_capture checks where the page is first and refuses, without making the output folder, when the browser is on its own error page or a blank one after a failed open. Fixes#158.
Before each width's full-page screenshot the page is scrolled through, lazy images are loaded and waited on (5 s at most), and it goes back to the top, so scroll-revealed sections and lazy images are in the picture. Fixes#160.
The engine test no longer connects to the stopped stand-in's port, which another parallel test could be handed; platform::standin_server tests that dropping a server frees its port, trying it for a moment.
bflatastic