Skip to content

Commit e257bc8

Browse files
waverideraiclaude
waveriderai
and
claude
committed
Initial public release of Type Foundry
Type Foundry casts a reconstructed OpenAPI spec — and optionally a working CLI — from closed applications that expose no public API. Feed it an APK, IPA, EXE, DMG, or a captured traffic session (HAR/pcap), and a three-pass research method with forced blind-spot diagnosis reconstructs the surface the app talks to, so you can integrate with or analyze a product that never shipped one. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
0 parents  commit e257bc8

29 files changed

Lines changed: 3111 additions & 0 deletions

File tree

‎.github/ISSUE_TEMPLATE/artifact_support.yml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
name: Artifact type support
2+
description: A punch kind the foundry cannot strike yet, or strikes badly
3+
labels: [artifact-support]
4+
body:
5+
- type: markdown
6+
attributes:
7+
value: |
8+
Describe the artifact **type**, not your specific file. Do not attach binaries or captures.
9+
10+
- type: input
11+
id: kind
12+
attributes:
13+
label: Artifact type
14+
placeholder: e.g. .msix, Flutter AOT snapshot, gRPC-web capture, Tauri bundle
15+
validations:
16+
required: true
17+
18+
- type: dropdown
19+
id: status
20+
attributes:
21+
label: Current behaviour
22+
options:
23+
- Classified as unknown
24+
- Classified correctly but extracts nothing useful
25+
- Extracts endpoints but the method or schema is wrong
26+
- Crashes
27+
validations:
28+
required: true
29+
30+
- type: textarea
31+
id: extractor
32+
attributes:
33+
label: What tool would extract it
34+
description: Name the tool, and what the fallback should be when that tool is absent.
35+
validations:
36+
required: true
37+
38+
- type: textarea
39+
id: shape
40+
attributes:
41+
label: What the extracted surface looks like
42+
description: Endpoint shapes, where URLs live in the container, how auth appears. Redact anything real.

‎.github/ISSUE_TEMPLATE/bug_report.yml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
name: Bug report
2+
description: Something in the CLI does not behave as documented
3+
labels: [bug]
4+
body:
5+
- type: markdown
6+
attributes:
7+
value: |
8+
**Do not attach raw HAR files, pcaps, or app binaries.** They contain credentials and may be licensed. Paste the relevant `manuscript/` JSON instead — it is already redacted.
9+
10+
- type: input
11+
id: version
12+
attributes:
13+
label: foundry version
14+
placeholder: output of `foundry version`
15+
validations:
16+
required: true
17+
18+
- type: dropdown
19+
id: stage
20+
attributes:
21+
label: Which stage
22+
options: [intake, capture, strike, matrix, specs, cast, press, proof, doctor, other]
23+
validations:
24+
required: true
25+
26+
- type: textarea
27+
id: what
28+
attributes:
29+
label: What happened
30+
description: Command run, what you expected, what you got.
31+
validations:
32+
required: true
33+
34+
- type: textarea
35+
id: doctor
36+
attributes:
37+
label: foundry doctor output
38+
render: shell
39+
40+
- type: input
41+
id: platform
42+
attributes:
43+
label: OS and Go version
44+
placeholder: macOS 14 / go1.22.5

‎.github/ISSUE_TEMPLATE/config.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
blank_issues_enabled: true
2+
contact_links:
3+
- name: Printing Press
4+
url: https://github.com/mvanhorn/cli-printing-press
5+
about: If you already have an API spec, you want the press, not the foundry.
6+
- name: Scope and legality
7+
url: https://github.com/waveriderai/cli-type-foundry#scope
8+
about: What this project will and will not do. Pinning and DRM are recorded as findings, never defeated.

‎.github/ISSUE_TEMPLATE/method.yml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
name: The Lens method
2+
description: A blind spot the three-pass method did not catch
3+
labels: [method]
4+
body:
5+
- type: markdown
6+
attributes:
7+
value: |
8+
The method is the product. This template is for evidence that it missed something — the most valuable kind of issue this repo takes.
9+
10+
- type: textarea
11+
id: target
12+
attributes:
13+
label: What you were mapping
14+
description: The subject, at whatever level of anonymity you are comfortable with.
15+
validations:
16+
required: true
17+
18+
- type: textarea
19+
id: passes
20+
attributes:
21+
label: What each pass found
22+
description: |
23+
Pass 1 — sources, organizing scheme, roughly what it produced.
24+
Diagnosis — what you wrote.
25+
Pass 2 — corrective lens, what it recovered.
26+
Pass 3 — if run, what inverting surfaced.
27+
validations:
28+
required: true
29+
30+
- type: textarea
31+
id: miss
32+
attributes:
33+
label: What was still missing afterwards
34+
description: The finding no pass reached, and how you eventually found it.
35+
validations:
36+
required: true
37+
38+
- type: textarea
39+
id: lens
40+
attributes:
41+
label: The corrective lens you would add
42+
description: State it as an instruction, not a topic. "Enumerate the help-article index, which describes capabilities as verbs" — not "look at more sources".
43+
validations:
44+
required: true
45+
46+
- type: checkboxes
47+
id: scope
48+
attributes:
49+
label: Scope
50+
options:
51+
- label: Everything I analysed was lawfully obtained, and any traffic came from my own account on my own device.
52+
required: true

‎.github/workflows/ci.yml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request:
7+
workflow_dispatch:
8+
9+
jobs:
10+
build:
11+
runs-on: ubuntu-latest
12+
steps:
13+
- uses: actions/checkout@v4
14+
15+
- uses: actions/setup-go@v5
16+
with:
17+
go-version: '1.22'
18+
check-latest: true
19+
20+
- name: Build
21+
run: go build ./...
22+
23+
- name: Vet
24+
run: go vet ./...
25+
26+
- name: Test
27+
run: go test ./...
28+
29+
- name: Smoke — version and doctor
30+
run: |
31+
go run ./cmd/foundry version
32+
go run ./cmd/foundry doctor || true
33+
34+
plugin:
35+
runs-on: ubuntu-latest
36+
steps:
37+
- uses: actions/checkout@v4
38+
39+
- name: Validate plugin manifest
40+
run: |
41+
python3 -c "import json,sys; json.load(open('plugin/.claude-plugin/plugin.json')); print('plugin.json OK')"
42+
43+
- name: Every skill has frontmatter
44+
run: |
45+
fail=0
46+
for f in plugin/skills/*/SKILL.md; do
47+
head -1 "$f" | grep -q '^---$' || { echo "missing frontmatter: $f"; fail=1; }
48+
grep -q '^name:' "$f" || { echo "missing name: $f"; fail=1; }
49+
grep -q '^description:' "$f" || { echo "missing description: $f"; fail=1; }
50+
done
51+
exit $fail

‎.gitignore‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
manuscript/
2+
cast/
3+
.foundry-work/
4+
/foundry
5+
*.plugin
6+
.DS_Store

‎CONTRIBUTING.md‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
# Contributing
2+
3+
Thanks for looking. This project has an unusual shape: about a third of it is a Go CLI, and two thirds of it is a research method encoded as prose. Contributions to either are welcome, but they are judged differently.
4+
5+
## The code
6+
7+
```bash
8+
git clone https://github.com/waveriderai/cli-type-foundry.git
9+
cd cli-type-foundry
10+
make # build
11+
make vet
12+
make test
13+
make plugin # repackage the Cowork/Claude Code plugin
14+
```
15+
16+
Requires Go 1.22+. No third-party dependencies — that is deliberate. A PR that adds one needs to justify why the standard library will not do.
17+
18+
Optional external tools (`jadx`, `apktool`, `7z`, `wireshark`) are detected at runtime by `foundry doctor`. Every one of them must have a fallback path; never make an external binary mandatory.
19+
20+
### What good code contributions look like
21+
22+
- A new `PunchKind` with a `strike` implementation, a magic-byte signature in `intake.Classify`, and a fallback for when the preferred extractor is missing.
23+
- A new redaction rule in `internal/redact` — with a test proving the raw value never survives.
24+
- Better path templating in `internal/strike/har.go`. The current regexes catch numeric, UUID, hex, and slug-ID segments; there are more shapes out there.
25+
- A `capture` playbook for a platform not yet covered.
26+
27+
### What will be declined
28+
29+
- Anything that defeats certificate pinning, DRM, or licence enforcement. Pinning is **recorded as a finding**, never bypassed. This is not negotiable and is not a difficulty problem.
30+
- Anything that stores, prints, or reconstructs a credential. Redaction happens on read, before values ever reach a struct field.
31+
- Vendoring or shelling out to a tool that has no fallback.
32+
33+
## The method
34+
35+
`docs/LENS.md` and `plugin/skills/foundry-lens/SKILL.md` describe the three-pass research method. They are the actual product; the CLI mechanises the extraction, not the thinking.
36+
37+
Changes here need evidence, not preference. "I reworded this to be clearer" is fine. "I added a fourth failure mode" needs a concrete teardown where the existing three did not explain the miss. The method earned its shape from a real case where pass 1 found ~120 features, pass 2 found ~80 more, and pass 3 found the one fact that changed what should be built — proposals should be able to point at something comparable.
38+
39+
If you run the method on your own target and it produces a finding class the docs do not name, that is the highest-value contribution this repo can receive. Open an issue describing the miss before writing the patch.
40+
41+
## Scope and legality
42+
43+
By contributing you affirm your change keeps the project inside its stated scope: analysing lawfully obtained artifacts, capturing traffic only from accounts the contributor controls on devices they own, and producing specs clearly labelled as reconstructed with no implied vendor endorsement.
44+
45+
## Style
46+
47+
- Go: `gofmt`, standard library, errors wrapped with context, no panics in library code.
48+
- Prose: plain declarative sentences. The docs avoid hedging and avoid hype in equal measure.
49+
- Commits: imperative mood, one logical change each.
50+
51+
MIT licensed. Contributions are accepted under the same licence.

‎LICENSE‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
MIT License
2+
3+
Copyright (c) 2026
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED.

‎Makefile‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
BINARY := foundry
2+
PREFIX ?= $(HOME)/.local
3+
4+
.PHONY: build install test vet clean plugin
5+
6+
build:
7+
go build -o $(BINARY) ./cmd/foundry
8+
9+
install: build
10+
mkdir -p $(PREFIX)/bin
11+
cp $(BINARY) $(PREFIX)/bin/$(BINARY)
12+
@echo "installed to $(PREFIX)/bin/$(BINARY)"
13+
14+
vet:
15+
go vet ./...
16+
17+
test:
18+
go test ./...
19+
20+
plugin:
21+
cd plugin && zip -qr ../type-foundry.plugin . -x "*.DS_Store"
22+
@echo "built type-foundry.plugin"
23+
24+
clean:
25+
rm -rf $(BINARY) .foundry-work manuscript cast type-foundry.plugin

0 commit comments

Comments
 (0)