runtime

RELEASE NOTES

Bytecode, VM, polymorphism, and execution internals.

Mutant Release Notes

A summary of new capabilities, changes, and upgrades for this release. For the full builtin catalog see the Capability Reference.

Highlights

• The standard library roughly doubled — now 399 builtins across 32 capability categories, all pure-Go (CGO_ENABLED=0) and cross-platform.
• First-class functions and closures are usable from the collection builtins. map, filter, reduce, each, and sort_by now call Mutant closures.
• OS-aware tooling. The language server warns when a program calls a builtin that is not supported on the operating system it is running on.
• New documentation set: a generated capability reference plus deep-dive guides for the graph database, runtime integration, structured data, and networking.
• All aoiflux/* forensic libraries upgraded to their latest releases.

New language capabilities

• Higher-order collection functions: map / filter / reduce / each / sort_by, backed by a closure-from-builtin bridge so callbacks can be ordinary Mutant closures (with full free-variable capture). map/filter/each callbacks accept (element) or (element, index); reduce is (accumulator, element).
• The broader functional/collection surface (sort, reverse, unique, range, zip, contains, index_of, hash keys/values/entries/merge/set/…) and the generic standard library (strings, math, hashing, time, structured data, type conversion) are documented end-to-end in the Capability Reference.

New standard-library capabilities (by category)

• Structured data: JSON, base64/base32/hex/URL encoding, gzip/zlib compression, base and type conversion, and Apple property lists. See STRUCTURED_DATA.md.
• Cryptography & fingerprinting: X.509 parsing, JWT decoding, PEM decoding, AES-GCM, HMAC, and imphash / ja3 / NT & LM hashes.
• Networking: sockets and TLS sessions, an in-process X.509 CA, HTTP message inspection, WebSocket framing, offline pcap analysis, and passive OS fingerprinting. See SECURE_NETWORKING.md.
• Graph database: typed nodes/edges, named relations, indexed artifacts, BFS, shortest-path, statistics, and timelines. See GRAPH_DATABASE.md.
• Runtime integration: sandboxed Lua execution. See RUNTIME_INTEGRATION.md.
• Forensics: Windows artifacts (Prefetch, EVTX, LNK, Jump Lists, Amcache, Shimcache), filesystem parsers (NTFS/FAT/exFAT/ext/HFS+/XFS, $MFT), disk images (raw/EWF/VHD(X), MBR/GPT), registry (hive/JSON/live), browser artifacts and SQLite, syslog, Mach-O/Go binary analysis, and timeline building.

LSP updates (the `mlsp` language server)

• NEW platformSupport diagnostic (OS-aware). Warns when a program calls a builtin unsupported on the host operating system — e.g. process_modules or process_memory_scan (Windows/Linux only) used on macOS. The supported-platform set comes from the builtin metadata; the host OS is runtime.GOOS.
• NEW unreachableCode diagnostic. Flags statements after an unconditional return / break / continue.
• Capability categories in hover and completion. Hover shows a builtin's category (e.g. filesystem, graph database) and any platform constraint; completion detail reads builtin · <category>.
• Strict semicolon formatting confirmed. The formatter emits semicolons from the AST — repairing missing ones and removing redundant ones on format — and the semicolon diagnostic surfaces them while typing.
• All new rules are configurable via mutant.lint.rules.<rule>.severity in the VS Code extension.

Library upgrades

All github.com/aoiflux/* dependencies were upgraded to their latest releases and verified building CGO_ENABLED=0 on Windows, Linux, and macOS with the full test suite green:

(libext, libfat, libhfs, libvhdi, and graphene were already at their latest versions.) No call-site changes were required by these bumps.

Deprecations & compatibility

• net_syn_scan is deprecated in favor of net_connect_scan. The builtin was always a full TCP connect() scan, not a half-open SYN scan (real SYN needs raw sockets and elevated privileges, which conflict with the pure-Go, unprivileged design). net_connect_scan is the truthful name; net_syn_scan remains as an alias so existing programs and compiled bytecode keep working.
• net_conn_write and ws_write_frame gained an optional trailing timeout_ms argument. This is backward compatible (existing calls are unchanged); a write deadline now defaults to 30s so a stalled peer can no longer hang a write. Pass <= 0 to restore indefinite blocking.
• http_build_request now adds a Content-Length header when a body is present and none was supplied (matching http_build_response).

Documentation

• NEW: CAPABILITY_REFERENCE.md (full builtin catalog, generated from metadata), GRAPH_DATABASE.md, RUNTIME_INTEGRATION.md, STRUCTURED_DATA.md, and this file.
• Updated: MUTANT_LANGUAGE_REFERENCE.md (accurate 399-builtin count, new language-capability sections, platform notes), SECURE_NETWORKING.md, WASM_REPL_REFERENCE.md, WHAT_IS_MUTANT.md, the LSP LLD/onboarding docs, and the README.
• NEW examples under examples/ covering filesystem triage, network recon, HTTP, structured data, sandboxed Lua, graph modeling, command-execution sandboxing, detection, cryptography, functional collections, forensic timelines, and a multi-file project layout (examples/project/portscan_service/).