@dsh-fly/dsh-plugin-fly-mode 0.1.7 → 0.1.9

package/tools/dsh-plugin-fly-recon/index.js

@@ -12,6 +12,17 @@ import { defineTool } from '@deepseek-ai/dsh-tools'
  * Command execution goes through the host `shell` seam so the sandbox confines
  * it (and the FLY_ALLOW_RECON gate is an ADDITIONAL authorization layer on top
  * of the sandbox, not a replacement for it).
+ *
+ * **失败面的口径是"大声"**（Q5）：
+ *   · 没有 `nmap`（macOS 常态）⇒ 用系统自带的 `nc` 扫，并在结果里标明"这是 nc 扫的"，且**明说
+ *     `no-response` 分不清 closed 与 filtered**（要区分必须换 nmap）；端口数超过内置回退的 64 上限时
+ *     **一个都不扫**并说清上限与出路，绝不扫一半交差；
+ *   · 目标 URL **先校验再用**（`requireHttpUrl`：只允许 http/https）—— 2026-10-13 补：此前这条只有
+ *     `diag_net_throughput` 有，`recon_http_fingerprint` 会放行 `file://`，而 curl 能把本地文件读出来
+ *     回显进工具结果；Q5 那次我在本注释里先写了这条保护，**当时它并不成立**，现在它成立了；
+ *   · `curl` 失败 ⇒ `requireOk` 抛 `CommandError`，不给"空指纹"；
+ *   · `recon_http_fingerprint` 只读响应头与 `<title>`：**不执行 JS** —— 由 JS 搭出来的界面在这把尺子里
+ *     等于不存在（AGENTS.md 里那台摄像头的负结论就是这么来的），这一点写进了它的 `limitations`。
  */
 export const name = 'fly-recon'
 export const inject = ['tools', 'shell']
@@ -58,11 +69,60 @@ async function runCmd(shell, argv, exec, opts = {}) {
  * tools must say so instead of reporting an empty scan, because an empty scan
  * reads as "target closed".
  */
+/**
+ * 只接受主机名或 IP 字面量。2026-10-13 补：此前 `recon_ports` 的 `host` **没有**这道校验，
+ * 而 diag_* 三个工具都有 —— 于是 `-oN=/tmp/x` 这种"以 - 开头的目标"会被 nmap 当成**选项**
+ * （写出文件）。同族性质必须在**每个**工具上都有。
+ */
+function requireHost(value) {
+  const host = String(value ?? '').trim()
+  if (!/^[A-Za-z0-9](?:[A-Za-z0-9._:-]*[A-Za-z0-9])?$/u.test(host)) {
+    const error = new Error(
+      `拒绝目标 ${JSON.stringify(host)}：只接受主机名或 IP 字面量 ——`
+      + ' 不许有空格或 shell 元字符（; | & $ ` 引号 括号），也不许以 "-" 开头'
+      + '（会被当成命令参数：nmap、nc 会把 `-oN=file` 之类的选项当真）。',
+    )
+    error.name = 'ArgumentError'
+    throw error
+  }
+  return host
+}
+
+/** 只允许 http/https：`file:` 会让 curl 把本地文件读出来回显进工具结果（2026-10-13 发现并补上）。 */
+const ALLOWED_URL_SCHEMES = ['http:', 'https:']
+function requireHttpUrl(value) {
+  const text = String(value ?? '').trim()
+  let parsed
+  try {
+    parsed = new URL(text)
+  } catch {
+    const error = new Error(`不是合法的 URL：${text}`)
+    error.name = 'ArgumentError'
+    throw error
+  }
+  if (!ALLOWED_URL_SCHEMES.includes(parsed.protocol)) {
+    const error = new Error(`拒绝 ${parsed.protocol} 目标：只允许 http/https（file: 会读本地文件）`)
+    error.name = 'ArgumentError'
+    throw error
+  }
+  return parsed.href
+}
+
 function requireOk(run, what) {
   if (run.exitCode === 0) return run.stdout
-  const detail = run.stderr.trim().split('\n').map(line => line.trim()).filter(Boolean).slice(0, 3).join(' | ')
-  const missing = run.exitCode === 127 || /command not found/iu.test(run.stderr) ? ' — the command is not installed on this host' : ''
-  const error = new Error(`${what} failed (exit ${run.exitCode})${missing}: ${run.command}${detail === '' ? '' : `\n${detail}`}`)
+  // 沙箱拒绝的形状是**结果正文里的标记**（`[sandbox: file access denied under <mode> mode]`，
+  // 抄自 @deepseek-ai/dsh-sandbox/index.js:65）—— 它落在 stdout 上；只读 stderr 就会把它丢掉，
+  // 于是模型读到的是「命令失败」，而不是「你没有被授权」。所以标记必须原样带进错误文案。
+  const sandboxMark = /^\[sandbox: .*\]$/mu.exec(run.stdout)
+  const detail = [sandboxMark?.[0], ...run.stderr.trim().split('\n').map(line => line.trim()).filter(Boolean)].slice(0, 3).join(' | ')
+  const notInstalled = run.exitCode === 127 || /command not found/iu.test(run.stderr)
+  const missing = notInstalled ? ' — the command is not installed on this host' : ''
+  // 失败文案要对**读它的模型**可行动（Q6）：不是裸 stderr，但也不许臆断原因 ——
+  // 只给「这条 exit 属于哪一类」与「下一步可以试什么」，具体判断仍留给读的人。
+  const next = notInstalled
+    ? 'next: this host lacks that command — look for a built-in fallback in this package, or read the file another way'
+    : 'next: check the path, and that the file is what this tool expects (bin_file shows what it is); the line above is the command own reason'
+  const error = new Error(`${what} failed (exit ${run.exitCode})${missing}: ${run.command}${detail === '' ? '' : `\n${detail}\n${next}`}`)
   error.name = 'CommandError'
   throw error
 }
@@ -128,38 +188,59 @@ export function apply(ctx) {
       render: (_a, v) => [{ type: 'text', text: v }],
     },
     async execute(args, exec) {
+      // 先校验再构造命令（同族性质：diag_* 三个工具早就有这道门）。
+      const host = requireHost(args.host)
+      // 证据形状（规划 §5.1）：逐分支迁移 —— 本轮只把 nc 回退分支包上。
+      const envelope = (observed, limitations) => JSON.stringify({
+        tool: 'recon_ports',
+        target: args.host,
+        operation: 'TCP connect scan of the requested ports (authorized lab targets only)',
+        observed,
+        confidence: 'observed',
+        limitations,
+      }, null, 2)
       const requested = args.ports === undefined || String(args.ports).trim() === '' ? '22,80,443,445,3389,8080' : String(args.ports)
       const expanded = expandPorts(requested)
       if (expanded === null) {
-        return `unparsable port spec ${JSON.stringify(requested)} — use a comma list with optional ranges, e.g. 22,80,8000-8010`
+        return envelope({ requested, dump: `unparsable port spec ${JSON.stringify(requested)} — use a comma list with optional ranges, e.g. 22,80,8000-8010` }, ['端口规格不合法 ⇒ 一个端口都没扫：observed.dump 里是解析失败的原因与可照抄的写法'])
+      }
+      const nmap = await runCmd(shell, ['nmap', '-Pn', '--open', '-p', expanded.join(','), host], exec, { timeoutMs: 60_000 })
+      if (nmap.exitCode === 0) {
+        return envelope({ method: 'nmap', dump: nmap.stdout }, [
+          'nmap 的表格原样返回，本工具不改写它；本轮参数只带 -Pn --open（没有版本探测）',
+          'open 只说明 TCP 连得上，不说明服务身份或版本',
+        ])
       }
-      const nmap = await runCmd(shell, ['nmap', '-Pn', '--open', '-p', expanded.join(','), args.host], exec, { timeoutMs: 60_000 })
-      if (nmap.exitCode === 0) return nmap.stdout
       if (!portMissing(nmap)) return requireOk(nmap, 'nmap')
       // `nmap` is not installed by default on macOS. Instead of failing outright
       // (the previous behaviour) or returning an empty scan that reads as "target
       // closed", scan with `nc`, which ships with the base system. The result is
       // labelled: nc cannot tell closed from filtered, and does no fingerprinting.
       if (expanded.length > 64) {
-        return [
+        return envelope({ method: 'nc', scanned: 0, cap: 64, requested: expanded.length, dump: [
           `nmap is not installed on this host: the built-in fallback scans with the system nc and is capped at 64 ports per call, but ${expanded.length} were requested`,
           'narrow the range, or install nmap for a full scan (no 64-port cap, service and version detection)',
-        ].join('\n')
+        ].join('\n') }, [
+          '请求超过内置回退的 64 端口上限 ⇒ **一个端口都没扫**（不是"扫了、没有开着的端口"）',
+        ])
       }
       const script = expanded
-        .map((port) => `if nc -z -G 1 -w 1 ${shq(args.host)} ${port} >/dev/null 2>&1; then echo '${port}/tcp open'; else echo '${port}/tcp no-response'; fi`)
+        .map((port) => `if nc -z -G 1 -w 1 ${shq(host)} ${port} >/dev/null 2>&1; then echo '${port}/tcp open'; else echo '${port}/tcp no-response'; fi`)
         .join('; ')
       const scan = await runCmd(shell, ['/bin/sh', '-c', script], exec, { timeoutMs: 120_000 })
       if (scan.exitCode !== 0 && scan.stdout.trim() === '') return requireOk(scan, 'nc -z')
       const rows = scan.stdout.split('\n').map((l) => l.trim()).filter(Boolean)
-      return [
+      return envelope({ method: 'nc', scanned: expanded.length, dump: [
         'nmap=not installed (scanned with the system nc: one TCP connect per port, no service or version detection)',
-        `host=${args.host}`,
+        `host=${host}`,
         `ports=${expanded.length}`,
         ...rows,
         `open=${rows.filter((l) => l.endsWith('/tcp open')).length}`,
         'note: `no-response` means closed or filtered — nc cannot tell those two apart; install nmap for a real scan',
-      ].join('\n')
+      ].join('\n') }, [
+        'nmap 不在本机：这是系统 nc 的回退结果（每端口一次 TCP connect，无服务/版本探测）',
+        '**nc 分不清 closed 与 filtered**：no-response 两种都可能 —— 要区分必须换 nmap',
+      ])
     },
   }))
 
@@ -174,11 +255,31 @@ export function apply(ctx) {
       render: (_a, v) => [{ type: 'text', text: v }],
     },
     async execute(args, exec) {
-      const headers = requireOk(await runCmd(shell, ['curl', '-sI', '-m', '8', args.url], exec), `curl -sI ${args.url}`)
-      const body = await runCmd(shell, ['curl', '-s', '-m', '8', args.url], exec)
-      if (body.exitCode !== 0) return `${headers.trim()}\nTITLE: unknown (body fetch failed, exit ${body.exitCode})`
+      // 证据形状（规划 §5.1）：两支都产出信封。
+      const envelope = (observed, limitations) => JSON.stringify({
+        tool: 'recon_http_fingerprint',
+        target: args.url,
+        operation: 'one-shot HTTP fingerprint: response headers + <title> only',
+        observed,
+        confidence: 'observed',
+        limitations,
+      }, null, 2)
+      // 先校验再构造命令：non-http 目标在**命令构造之前**就被拒（不是事后清洗）。
+      const url = requireHttpUrl(args.url)
+      const headers = requireOk(await runCmd(shell, ['curl', '-sI', '-m', '8', url], exec), `curl -sI ${url}`)
+      const body = await runCmd(shell, ['curl', '-s', '-m', '8', url], exec)
+      if (body.exitCode !== 0) {
+        return envelope({ headers: headers.trim(), title: null, bodyFetched: false, dump: `${headers.trim()}\nTITLE: unknown (body fetch failed, exit ${body.exitCode})` }, [
+          'body 取不到 ⇒ 只有响应头；title 是**未知**，不是「这个页面没有标题」',
+          'curl -sI 不跟随重定向：看到的是**跳转前那一跳**的响应头',
+        ])
+      }
       const title = /<title[^>]*>([^<]*)<\/title>/iu.exec(body.stdout)?.[1]?.trim() ?? ''
-      return `${headers.trim()}\nTITLE: ${title === '' ? '(no <title> element in the body)' : title}`
+      return envelope({ headers: headers.trim(), title, bodyFetched: true, dump: `${headers.trim()}\nTITLE: ${title === '' ? '(no <title> element in the body)' : title}` }, [
+        '只读响应头与第一个 <title>：**不执行 JS** —— 由 JS 搭出来的界面（登录框、动态面板、JS 表格）在这把尺子里等于不存在',
+        '要判 JS 渲染出来的东西，得用真浏览器（仓库有 playwright-core），并断「页面实际请求了什么、状态码是什么」',
+        '标题取的是第一个 <title>；SPA 或没有 title 的页面会给 (no <title> element in the body)',
+      ])
     },
   }))
 }

package/tools/dsh-plugin-fly-reverse/index.js

@@ -18,7 +18,28 @@ function shq(value) {
  * `TypeError: shell.run is not a function` on every call, in every engine
  * version. `scripts/verify-security-tools.mjs` now fails loudly if a call site
  * names a seam method the executor does not have.
+ *
+ * **失败面的口径是"大声"**（Q5）：
+ *   · `objdump -T` 读不出动态符号表（Mach-O 常态）⇒ 换 `nm -u` 这条**回退**，并把"这是回退路径、
+ *     nm 只报未定义的名字、不说是从哪个库来的"写进结果的 `limitations`；
+ *   · **两把尺子都没有** ⇒ 明说"没有可读的未定义符号"，并附上两条命令的 exit 与 stderr，
+ *     绝不说成"这个程序不依赖任何外部符号"（静态链接/已 strip 正是这个形状）；
+ *   · `ROPgadget` 不在 ⇒ 用内置扫描器（只认 pop/leave + ret 的简单序列），并在结果里写明
+ *     "**没找到 ≠ 没有**"；`objdump` 缺失时 `requireOk` 抛错，不给空反汇编。
  */
+/**
+ * 路径参数规范化：以 `-` 开头的路径加 `./` 前缀（2026-10-13）。
+ *
+ * 为什么不插 `--`：实测本机（macOS，发布目标平台）**objdump（-h/-d/-T）/ base64 -i / otool -hv 都不支持
+ * `--`**，插进去直接失败；而 `file -b --version` 会打印 `file-5.41`、`nm -u --version` 会打印
+ * `llvm-nm, …`，两者都 **exit 0** ⇒ 工具会把版本串当**数据**返回（`bin_sections { path: '--version' }`
+ * 真发生过）。加 `./` 之后它就是一个普通相对路径：不存在就正常报错，存在就是那个文件。
+ */
+function safePath(value) {
+  const text = String(value ?? '')
+  return text.startsWith('-') ? './' + text : text
+}
+
 async function runCmd(shell, argv, exec, opts = {}) {
   const result = await (await shell.execute(shell.resolve({
     command: argv.map(shq).join(' '),
@@ -49,9 +70,19 @@ async function runCmd(shell, argv, exec, opts = {}) {
  */
 function requireOk(run, what) {
   if (run.exitCode === 0) return run.stdout
-  const detail = run.stderr.trim().split('\n').map(line => line.trim()).filter(Boolean).slice(0, 3).join(' | ')
-  const missing = run.exitCode === 127 || /command not found/iu.test(run.stderr) ? ' — the command is not installed on this host' : ''
-  const error = new Error(`${what} failed (exit ${run.exitCode})${missing}: ${run.command}${detail === '' ? '' : `\n${detail}`}`)
+  // 沙箱拒绝的形状是**结果正文里的标记**（`[sandbox: file access denied under <mode> mode]`，
+  // 抄自 @deepseek-ai/dsh-sandbox/index.js:65）—— 它落在 stdout 上；只读 stderr 就会把它丢掉，
+  // 于是模型读到的是「命令失败」，而不是「你没有被授权」。所以标记必须原样带进错误文案。
+  const sandboxMark = /^\[sandbox: .*\]$/mu.exec(run.stdout)
+  const detail = [sandboxMark?.[0], ...run.stderr.trim().split('\n').map(line => line.trim()).filter(Boolean)].slice(0, 3).join(' | ')
+  const notInstalled = run.exitCode === 127 || /command not found/iu.test(run.stderr)
+  const missing = notInstalled ? ' — the command is not installed on this host' : ''
+  // 失败文案要对**读它的模型**可行动（Q6）：不是裸 stderr，但也不许臆断原因 ——
+  // 只给「这条 exit 属于哪一类」与「下一步可以试什么」，具体判断仍留给读的人。
+  const next = notInstalled
+    ? 'next: this host lacks that command — look for a built-in fallback in this package, or read the file another way'
+    : 'next: check the path, and that the file is what this tool expects (bin_file shows what it is); the line above is the command own reason'
+  const error = new Error(`${what} failed (exit ${run.exitCode})${missing}: ${run.command}${detail === '' ? '' : `\n${detail}\n${next}`}`)
   error.name = 'CommandError'
   throw error
 }
@@ -103,33 +134,67 @@ export function apply(ctx) {
       render: (_a, v) => [{ type: 'text', text: v }],
     },
     async execute(args, exec) {
-      const kindRun = await runCmd(shell, ['file', '-b', args.path], exec)
+      const path = safePath(args.path)
+      const kindRun = await runCmd(shell, ['file', '-b', path], exec)
       const kind = kindRun.exitCode === 0 ? kindRun.stdout.trim() : ''
-      const dynamic = await runCmd(shell, ['objdump', '-T', args.path], exec)
+      const dynamic = await runCmd(shell, ['objdump', '-T', path], exec)
       const dynamicLines = dynamic.exitCode === 0
         ? dynamic.stdout.split('\n').filter((l) => l.includes('DF') && l.includes('*UND*')).map((l) => l.trim())
         : []
-      if (dynamicLines.length > 0) return dynamicLines.slice(0, 300).join('\n')
+      if (dynamicLines.length > 0) {
+        return JSON.stringify({
+          tool: 'rev_imports',
+          target: args.path,
+          operation: 'list undefined (imported) symbols: objdump -T (DF *UND*)',
+          observed: { method: 'objdump', shown: Math.min(dynamicLines.length, 300), dump: dynamicLines.slice(0, 300).join('\n') },
+          confidence: 'observed',
+          limitations: [
+            '只列**动态**符号表（.dynsym）里的未定义项：静态链接进来的、或本地定义的符号不在里面',
+            dynamicLines.length > 300 ? '只给前 300 条（要全量就自己按符号名筛）' : '这次没有截断（未定义符号 ≤ 300）',
+          ],
+        }, null, 2)
+      }
       // `objdump -T` exits 0 with a bare table header for Mach-O, and a stripped
       // ELF may have no dynamic symbol table at all. `nm -u` is the portable
       // second opinion (it ships with macOS and the Xcode CLT).
-      const nm = await runCmd(shell, ['nm', '-u', args.path], exec, { stdoutMaxBytes: 4194304 })
+      const nm = await runCmd(shell, ['nm', '-u', path], exec, { stdoutMaxBytes: 4194304 })
       const undefinedSymbols = nm.exitCode === 0
         ? nm.stdout.split('\n').map((l) => l.trim()).filter((l) => /^_?[A-Za-z_][\w$.@]*$/u.test(l))
         : []
       if (undefinedSymbols.length > 0) {
-        return [
+        return JSON.stringify({
+          tool: 'rev_imports',
+          target: args.path,
+          operation: 'list undefined (imported) symbols: nm -u (objdump -T had no dynamic table)',
+          observed: { method: 'nm -u', format: kind === '' ? null : kind, shown: Math.min(undefinedSymbols.length, 300), dump: [
           `${kind === '' ? 'format unknown' : kind}: no ELF dynamic symbol table to read, so these are the undefined symbols from nm -u (${undefinedSymbols.length}):`,
           ...undefinedSymbols.slice(0, 300),
-        ].join('\n')
+          ].join('\n') },
+          confidence: 'observed',
+          limitations: [
+            '走的是 nm -u 这条**回退**路径：objdump -T 在这个文件上没有动态符号表（Mach-O 常见）',
+            'nm -u 只报"未定义"的名字，不告诉你是从哪个库来的（要库映射得看 otool -L / readelf -d）',
+          ],
+        }, null, 2)
       }
-      return [
+      return JSON.stringify({
+        tool: 'rev_imports',
+        target: args.path,
+        operation: 'list undefined (imported) symbols: both objdump -T and nm -u came back empty',
+        observed: { method: null, format: kind === '' ? null : kind, shown: 0, dump: [
         `no undefined symbols for ${args.path}: objdump -T (exit ${dynamic.exitCode}) and nm -u (exit ${nm.exitCode}) both came back empty`,
         `format: ${kind === '' ? 'unknown (file(1) reported nothing)' : kind}`,
         `nm -u stderr: ${nm.stderr.trim().slice(0, 200) || '(empty)'}`,
         `objdump -T output follows (${dynamic.stdout.trim().length} chars), so the emptiness is inspectable:`,
         dynamic.stdout.trim().slice(0, 2000),
-      ].join('\n')
+        ].join('\n') },
+        confidence: 'observed',
+        limitations: [
+          '**两把尺子都没给出符号**：这句话的前提是 objdump -T 与 nm -u **都跑过了**（两条 exit 与 nm 的 stderr 就在 dump 里）',
+          '它说的是「这份文件里没有可读的未定义符号」，不是「这个程序不依赖任何外部符号」—— 静态链接或已 strip 的二进制正是这个形状',
+          '要继续追依赖，先换个体：bin_file 看格式、bin_readelf 看动态段（.dynamic / NEEDED）',
+        ],
+      }, null, 2)
     },
   }))
 
@@ -146,10 +211,23 @@ export function apply(ctx) {
       render: (_a, v) => [{ type: 'text', text: v }],
     },
     async execute(args, exec) {
-      const argv = ['-d', args.path]
+      const path = safePath(args.path)
+      const argv = ['-d', path]
       if (args.start && args.stop) argv.splice(1, 0, `--start-address=${args.start}`, `--stop-address=${args.stop}`)
       const stdout = requireOk(await runCmd(shell, ['objdump', ...argv], exec, { stdoutMaxBytes: 1048576 }), 'objdump -d')
-      return stdout.slice(0, 12000)
+      // 证据形状（规划 §5.1）：信封 JSON，objdump 输出原样进 observed.dump。
+      return JSON.stringify({
+        tool: 'rev_disasm',
+        target: args.path,
+        operation: 'objdump -d' + (args.start && args.stop ? ` --start-address=${args.start} --stop-address=${args.stop}` : ' (whole file)'),
+        observed: { window: args.start && args.stop ? { start: args.start, stop: args.stop } : null, truncated: stdout.length > 12000, dump: stdout.slice(0, 12000) },
+        confidence: 'observed',
+        limitations: [
+          stdout.length > 12000 ? '只给前 12000 字符（truncated=true）—— 要看后面请给 start/stop 缩小窗口' : '这次没有截断（输出 ≤ 12000 字符）',
+          '反汇编是**线性扫描**的结果：数据段夹在代码里时，那些字节也会被当成指令打出来（用 start/stop 框住函数能少踩这个）',
+          '不看控制流、不做函数边界识别（要那些得换真正的反编译器）',
+        ],
+      }, null, 2)
     },
   }))
 
@@ -165,14 +243,50 @@ export function apply(ctx) {
       render: (_a, v) => [{ type: 'text', text: v }],
     },
     async execute(args, exec) {
-      const argv = ['--binary', args.path, '--only', 'pop|ret|leave']
+      const path = safePath(args.path)
+      const argv = ['--binary', path, '--only', 'pop|ret|leave']
       if (args.filter) argv.push('--filter', args.filter)
       const rop = await runCmd(shell, ['ROPgadget', ...argv], exec)
-      if (rop.exitCode === 0) return rop.stdout.slice(0, 8000)
-      const disasm = requireOk(await runCmd(shell, ['objdump', '-d', args.path], exec, { stdoutMaxBytes: 1048576 }), 'objdump -d')
+      if (rop.exitCode === 0) {
+        return JSON.stringify({
+          tool: 'rev_gadget_scan',
+          target: args.path,
+          operation: 'ROPgadget --only pop|ret|leave' + (args.filter ? ` --filter ${args.filter}` : ''),
+          observed: { method: 'ROPgadget', shown: null, truncated: rop.stdout.length > 8000, dump: rop.stdout.slice(0, 8000) },
+          confidence: 'observed',
+          limitations: [
+            'ROPgadget 的输出原样返回（本工具只做截断：>8000 字符时 truncated=true）',
+            'ROPgadget 自己会做指令边界识别与去重，但**只扫 --only pop|ret|leave 这几类**（要别的指令得改本工具）',
+          ],
+        }, null, 2)
+      }
+      const disasm = requireOk(await runCmd(shell, ['objdump', '-d', path], exec, { stdoutMaxBytes: 1048576 }), 'objdump -d')
       const gadgets = scanGadgets(disasm, args.filter)
-      if (gadgets.length > 0) return gadgets.slice(0, 80).join('\n')
-      return `no pop/leave/ret gadgets found in ${args.path} (install ROPgadget for a deeper scan)`
+      if (gadgets.length > 0) {
+        return JSON.stringify({
+          tool: 'rev_gadget_scan',
+          target: args.path,
+          operation: 'built-in scanner over objdump -d (ROPgadget not installed)' + (args.filter ? ` filtered by ${args.filter}` : ''),
+          observed: { method: 'builtin', shown: Math.min(gadgets.length, 80), truncated: gadgets.length > 80, dump: gadgets.slice(0, 80).join('\n') },
+          confidence: 'observed',
+          limitations: [
+            '走的是**内置扫描器**（本机没有 ROPgadget）：它只在 objdump 的反汇编里找 pop/leave + 紧跟的 ret 这类**简单序列**',
+            '不做指令边界校验、不做 gadget 去重：地址可能重叠，长链 gadget（多指令 + 中间跳转）它也不会给',
+            gadgets.length > 80 ? '只给前 80 条（observed.truncated=true）' : '这次没有截断（≤ 80 条）',
+          ],
+        }, null, 2)
+      }
+      return JSON.stringify({
+        tool: 'rev_gadget_scan',
+        target: args.path,
+        operation: 'built-in scanner over objdump -d: nothing matched',
+        observed: { method: 'builtin', shown: 0, dump: `no pop/leave/ret gadgets found in ${args.path} (install ROPgadget for a deeper scan)` },
+        confidence: 'observed',
+        limitations: [
+          '**没找到 ≠ 没有**：这条走的是内置扫描器（只认 pop/leave + ret 的简单序列），装 ROPgadget 后同一条命令可能给出几十条',
+          '也不排除这个文件根本没有可执行段（比如被测的是数据文件）—— 先用 bin_file 看它是什么',
+        ],
+      }, null, 2)
     },
   }))
 }