A website stand-in charges its per-body and total byte limits on the text it actually keeps after redaction, and drops repeated samples before charging them, so polling no longer uses up the budget. A cached 304 whose body was left out stays unavailable (R3.11).
Older stand-in recordings keep their empty query pairs when current credential rules are reapplied, so replay matches the right page (follow-up to #648).
Replays #602–#605. HAR reports redact percent-encoded credential names and declared secrets in every kept field, count decoded body bytes, and template only real dates in API paths; the stand-in backend matches older recordings with the current query rules.
Co-authored-by: Afloat <132809511+Afloat16@users.noreply.github.com>
web_scripts_save copies only the scripts that fit its max_scripts and max_bytes; scripts past them are listed by URL only, so a large or hostile capture costs no more than the export's own limits.
A native call graph lists at most 50,000 call edges and says when it stopped there, so one function with a huge number of call sites can't blow up the report.
Fixes#519. core_archive_show counts nested archives that a depth or size limit left unopened, reports a nested_not_opened limitation and marks coverage partial.
A stand-in backend no longer replays a recorded 304 without its cached body: such samples are kept for diagnosis, skipped in replay, and a request with no usable answer gets cached_body_unavailable. Builds count them.
An inventory's content id hashes its (path, sha256) pairs sorted, so the same files listed in another archive order are the same content tree and compare as identical. Fixes#281.
`core_archives_compare` matched moves by content through a map from hash to one new path. Two identical old files missing on the new side both "moved" to that one path, so a removal went unreported. With two renamed copies, one copy was reused and the other was reported as added.
Each new-only file is now a move destination at most once. Old files are paired with distinct new copies of the same content, and the rest are removed or added. Every file on each side is accounted for once.
**Verified:** a new test with the reporter's fixtures. Two old copies and one new copy give 1 move and 1 removal; two and two give 2 moves to different paths, with no additions or removals. The existing comparison test still passes. `cargo test -p craft-anything-analysis` (86), the engine's artifact tests, clippy and fmt pass.
Fixes#283
Selecting a macOS app folder is recognised as an app bundle (its root-relative Contents/Info.plist), and nested XPC services appear as services and xpc-service graph nodes.
Fixes#282
An inline `<script>` becomes a module of its own (`index.html#inline-0`). Its summary took its hash from the input file with the same path, and there is no such file, so the hash was always empty. Comparing two maps then read "both empty" as "the same", and an edited inline script counted as unchanged.
- **Inline scripts now get the hash of their own code.**
- **Maps saved before this have no hash for them.** Where either side lacks a hash, the comparison now checks the module's structure fingerprint, size and strings instead.
**Verified:** a new test with a page whose inline script changes from `console.log("A")` to `("B")`:
- the inline module and the page are reported changed, and a map compared with itself has two unchanged modules;
- the same holds for maps with the inline hashes blanked, as saved before this fix.
`cargo test -p craft-anything-analysis` (80), the engine's app tests (31), clippy and fmt pass.
Fixes#236
The pseudo-Java for a method with one try/catch rendered the protected region, the handler and what follows, but never the statements before the `try`. So `v0 = 7; try { v1 = 2; } catch (RuntimeException e) {} return v0;` came out without `v0 = 7;`.
- Those statements are now rendered first. A branch from them into the try region falls back to a labelled `goto`, as elsewhere, so the method is no longer marked fully structured.
- The single-handler wrap is now refused when anything sits between the try's closing `goto` and the handler. That code would have been dropped the same way; such methods now get the plain rendering with the "exception handler(s) in the table" note.
**Verified:** a test with the reporter's 152-byte class (it fails without the fix); `cargo test -p craft-anything-analysis` (79), the engine's Java tool tests (9), clippy, fmt.
**Not checked:** `cargo xtask wasm`. The change is pure logic inside an existing function.
Fixes#232
A native, pure-Rust app that shows anyone how a piece of software works, with
evidence-backed answers, then helps them rebuild it. It ships a desktop app, a
CLI and an MCP server, all driven by one engine.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Afloat