@remnux/mcp-server 0.1.54 → 0.1.56

package/dist/osint/index.js

@@ -0,0 +1,64 @@
+/**
+ * OSINT resource catalog loader.
+ *
+ * Loads the contributor-editable data/osint-resources.json (maintained by pull
+ * request, validated in CI) and provides slicing helpers for the
+ * get_osint_guidance handler. Mirrors the data-file loading pattern in
+ * src/catalog/index.ts (data/ at package root, two levels up from dist/osint/),
+ * with a module-level memo since the catalog is immutable at runtime.
+ *
+ * This module reads a bundled JSON file only — no network, no API keys.
+ */
+import { readFileSync } from "node:fs";
+import { resolve, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+/** Sort priority: keyless programmatic services first (most agent-usable), web/GUI last. */
+export const AI_ACCESS_ORDER = { api_nokey: 0, api_key: 1, web: 2 };
+/** Absolute path to the bundled catalog (data/ is two levels up from dist/osint/ or src/osint/). */
+export function resolveCatalogPath() {
+    const __dirname = dirname(fileURLToPath(import.meta.url));
+    return resolve(__dirname, "../../data/osint-resources.json");
+}
+/** Load and parse the catalog, throwing on any error. Used by the CI integrity test. */
+export function loadOsintCatalogStrict() {
+    const raw = readFileSync(resolveCatalogPath(), "utf-8");
+    return JSON.parse(raw);
+}
+let cached = null;
+/** Load the catalog with a module-level memo and a graceful fallback so a missing/corrupt file never crashes the server. */
+export function loadOsintCatalog() {
+    if (cached)
+        return cached;
+    try {
+        const cat = loadOsintCatalogStrict();
+        // Order keyless programmatic services first so an agent sees what it can use now.
+        cat.resources = [...cat.resources].sort((a, b) => (AI_ACCESS_ORDER[a.ai_access] ?? 9) - (AI_ACCESS_ORDER[b.ai_access] ?? 9));
+        cached = cat;
+    }
+    catch (err) {
+        console.error("WARNING: Failed to load OSINT catalog — get_osint_guidance resources will be empty:", err);
+        cached = { version: "0.0.0", updated: "unknown", resources: [] };
+    }
+    return cached;
+}
+/** Condense one entry to the fields shown in the topic:"all" index. */
+export function condense(r) {
+    return {
+        name: r.name,
+        ioc_types: r.ioc_types,
+        access: r.access,
+        ai_access: r.ai_access,
+        query_disclosing: r.query_disclosing,
+        content_disclosing: r.content_disclosing,
+        best_use: r.best_use,
+    };
+}
+/** The full catalog condensed (topic:"all"). */
+export function condensedCatalog() {
+    return loadOsintCatalog().resources.map(condense);
+}
+/** Full-detail entries whose ioc_types include the given type (ioc_type slice). */
+export function resourcesForIocType(iocType) {
+    return loadOsintCatalog().resources.filter((r) => r.ioc_types.includes(iocType));
+}
+//# sourceMappingURL=index.js.map

package/dist/osint/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/osint/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAQzC,4FAA4F;AAC5F,MAAM,CAAC,MAAM,eAAe,GAA6B,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;AAmC9F,oGAAoG;AACpG,MAAM,UAAU,kBAAkB;IAChC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,OAAO,OAAO,CAAC,SAAS,EAAE,iCAAiC,CAAC,CAAC;AAC/D,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,sBAAsB;IACpC,MAAM,GAAG,GAAG,YAAY,CAAC,kBAAkB,EAAE,EAAE,OAAO,CAAC,CAAC;IACxD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiB,CAAC;AACzC,CAAC;AAED,IAAI,MAAM,GAAwB,IAAI,CAAC;AAEvC,4HAA4H;AAC5H,MAAM,UAAU,gBAAgB;IAC9B,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,sBAAsB,EAAE,CAAC;QACrC,kFAAkF;QAClF,GAAG,CAAC,SAAS,GAAG,CAAC,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CACrC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CACpF,CAAC;QACF,MAAM,GAAG,GAAG,CAAC;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,qFAAqF,EAAE,GAAG,CAAC,CAAC;QAC1G,MAAM,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IACnE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,QAAQ,CAAC,CAAgB;IACvC,OAAO;QACL,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;QACpC,kBAAkB,EAAE,CAAC,CAAC,kBAAkB;QACxC,QAAQ,EAAE,CAAC,CAAC,QAAQ;KACrB,CAAC;AACJ,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,gBAAgB;IAC9B,OAAO,gBAAgB,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AACpD,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,OAAO,gBAAgB,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;AACnF,CAAC"}

package/dist/parsers/capa.d.ts

@@ -4,6 +4,13 @@
  * Extracts capabilities and their associated ATT&CK techniques.
  * Expects JSON output from `capa -j <file>`.
  */
-import type { ParsedToolOutput } from "./types.js";
+import type { ParsedToolOutput, EvidenceType } from "./types.js";
+/**
+ * Derive the evidence_types set for a single capa rule from the feature nodes
+ * that actually matched, plus two unambiguous namespace signals. Returns
+ * undefined when nothing can be determined (the caller then omits the field).
+ * Never throws — a malformed rule yields undefined, never a lost finding.
+ */
+export declare function deriveEvidenceTypes(rule: Record<string, unknown>): EvidenceType[] | undefined;
 export declare function parseCapaOutput(rawOutput: string): ParsedToolOutput;
 //# sourceMappingURL=capa.d.ts.map

package/dist/parsers/capa.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capa.d.ts","sourceRoot":"","sources":["../../src/parsers/capa.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAW,MAAM,YAAY,CAAC;AAE5D,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,gBAAgB,CA+DnE"}
+{"version":3,"file":"capa.d.ts","sourceRoot":"","sources":["../../src/parsers/capa.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAW,YAAY,EAAE,MAAM,YAAY,CAAC;AAsG1E;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,YAAY,EAAE,GAAG,SAAS,CA4B7F;AAED,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,gBAAgB,CAsEnE"}

package/dist/parsers/capa.js

@@ -4,6 +4,144 @@
  * Extracts capabilities and their associated ATT&CK techniques.
  * Expects JSON output from `capa -j <file>`.
  */
+/**
+ * Map a capa feature-node type to the kind of evidence it represents.
+ *
+ * Deliberately conservative: only feature types whose evidence kind is
+ * unambiguous are mapped. A rule's namespace describes its INTENT
+ * (e.g. "collection/*"), not how it matched, so it is NOT used here to infer
+ * behavior — conflating the two is exactly the artifact-vs-behavior error this
+ * tagging exists to prevent.
+ */
+const FEATURE_EVIDENCE_TYPE = {
+    // artifact — data/content patterns present in the binary
+    string: "artifact",
+    substring: "artifact",
+    regex: "artifact",
+    bytes: "artifact",
+    // behavior — code-level semantics (these feature types occur only in code)
+    api: "behavior",
+    mnemonic: "behavior",
+    number: "behavior",
+    offset: "behavior",
+    "operand number": "behavior",
+    "operand offset": "behavior",
+    // structural — binary layout / metadata
+    section: "structural",
+    export: "structural",
+    // linking — imports / library presence
+    import: "linking",
+    // Intentionally NEUTRAL (no contribution): os, arch, format, match, class,
+    // property, namespace, function-name. These are environment guards or
+    // ambiguous signals that would dilute the artifact-vs-behavior distinction
+    // (e.g. `os: windows` appears in many behavioral rules as a guard).
+};
+/**
+ * capa's `characteristic` feature is overloaded: some values describe binary
+ * structure, others describe code execution. Map by value; unknown values
+ * contribute nothing (conservative — a mislabel is worse than no label).
+ */
+const CHARACTERISTIC_EVIDENCE_TYPE = {
+    // structural — file/layout characteristics
+    "embedded pe": "structural",
+    "mixed mode": "structural",
+    "forwarded export": "structural",
+    // artifact — string data (constructed in code, but still data)
+    "stack string": "artifact",
+    // behavior — code-execution characteristics
+    loop: "behavior",
+    "tight loop": "behavior",
+    "recursive call": "behavior",
+    nzxor: "behavior",
+    "peb access": "behavior",
+    "fs access": "behavior",
+    "gs access": "behavior",
+    "cross section flow": "behavior",
+    "indirect call": "behavior",
+    "unmanaged call": "behavior",
+};
+/** Stable ordering for the unordered evidence_types set (deterministic output). */
+const EVIDENCE_TYPE_ORDER = ["artifact", "behavior", "structural", "linking"];
+/**
+ * Walk a capa match-node tree and collect the feature types of nodes that
+ * ACTUALLY matched (success === true). capa includes non-matching branches
+ * (the untaken side of an `or`, the inner feature of a satisfied `not`) with
+ * success === false; excluding them ensures a rule that fired on a `string`
+ * branch is never credited with an unmatched `api` branch.
+ */
+function collectMatchedEvidenceTypes(node, out) {
+    if (!node || typeof node !== "object")
+        return;
+    const n = node;
+    // A node that did not match contributes nothing, and NEITHER do its children.
+    // capa retains partially-satisfied subtrees, so a success===true feature can sit
+    // under a success===false statement (e.g. an `api` that matched before a sibling
+    // in a failed `and`). Pruning the whole failed subtree here prevents crediting a
+    // rule that fired on one branch with an unmatched sibling branch's features.
+    if (n.success !== true)
+        return;
+    const inner = n.node;
+    if (inner && typeof inner === "object") {
+        const i = inner;
+        if (i.type === "feature" && i.feature && typeof i.feature === "object") {
+            const f = i.feature;
+            const ft = f.type;
+            if (typeof ft === "string") {
+                if (ft === "characteristic") {
+                    const val = typeof f.characteristic === "string" ? f.characteristic : "";
+                    const et = CHARACTERISTIC_EVIDENCE_TYPE[val];
+                    if (et)
+                        out.add(et);
+                }
+                else {
+                    const et = FEATURE_EVIDENCE_TYPE[ft];
+                    if (et)
+                        out.add(et);
+                }
+            }
+        }
+    }
+    if (Array.isArray(n.children)) {
+        for (const c of n.children)
+            collectMatchedEvidenceTypes(c, out);
+    }
+}
+/**
+ * Derive the evidence_types set for a single capa rule from the feature nodes
+ * that actually matched, plus two unambiguous namespace signals. Returns
+ * undefined when nothing can be determined (the caller then omits the field).
+ * Never throws — a malformed rule yields undefined, never a lost finding.
+ */
+export function deriveEvidenceTypes(rule) {
+    try {
+        const types = new Set();
+        if (Array.isArray(rule.matches)) {
+            for (const m of rule.matches) {
+                // each match is [address, matchNode]
+                if (Array.isArray(m) && m.length >= 2) {
+                    collectMatchedEvidenceTypes(m[1], types);
+                }
+            }
+        }
+        // Namespace carries an unambiguous evidence-kind signal in two cases only.
+        const meta = rule.meta;
+        if (meta && typeof meta === "object" && !Array.isArray(meta)) {
+            const ns = meta.namespace;
+            if (typeof ns === "string") {
+                if (ns.startsWith("linking/"))
+                    types.add("linking");
+                else if (ns.startsWith("executable/"))
+                    types.add("structural");
+            }
+        }
+        if (types.size === 0)
+            return undefined;
+        return EVIDENCE_TYPE_ORDER.filter((t) => types.has(t));
+    }
+    catch {
+        return undefined;
+    }
+}
 export function parseCapaOutput(rawOutput) {
     const result = {
         tool: "capa",
@@ -38,6 +176,13 @@ export function parseCapaOutput(rawOutput) {
                             .join(", ");
                     }
                 }
+                // Tag the kind(s) of evidence the rule actually matched on (artifact vs
+                // behavior vs structural vs linking). Additive and fail-soft: if this
+                // cannot be determined the field is simply omitted — the finding's name
+                // and ATT&CK evidence are never affected.
+                const evidenceTypes = deriveEvidenceTypes(r);
+                if (evidenceTypes)
+                    finding.evidence_types = evidenceTypes;
                 result.findings.push(finding);
             }
         }

package/dist/parsers/capa.js.map

@@ -1 +1 @@
-{"version":3,"file":"capa.js","sourceRoot":"","sources":["../../src/parsers/capa.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,UAAU,eAAe,CAAC,SAAiB;IAC/C,MAAM,MAAM,GAAqB;QAC/B,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,EAAE;QACZ,QAAQ,EAAE,EAAE;QACZ,GAAG,EAAE,SAAS;KACf,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;QAErB,6BAA6B;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChE,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;oBAAE,SAAS;gBAChD,MAAM,CAAC,GAAG,IAA+B,CAAC;gBAC1C,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;gBACpB,MAAM,OAAO,GAAY;oBACvB,WAAW,EAAE,IAAI;oBACjB,QAAQ,EAAE,YAAY;oBACtB,QAAQ,EAAE,MAAM;iBACjB,CAAC;gBAEF,4DAA4D;gBAC5D,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7D,MAAM,CAAC,GAAG,IAA+B,CAAC;oBAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACnD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC,MAAM;6BACxB,MAAM,CAAC,CAAC,CAAC,EAA+B,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC;6BACtE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,SAAS,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,IAAI,GAAG,GAAG,CAAC;6BACpD,IAAI,CAAC,IAAI,CAAC,CAAC;oBAChB,CAAC;gBACH,CAAC;gBAED,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,mBAAmB;QACnB,IAAI,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC/C,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;YAC1C,MAAM,CAAC,QAAQ,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;QAChD,CAAC;QAED,yDAAyD;QACzD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,MAAM,CAAC,QAAQ,CAAC,kBAAkB;gBAChC,mDAAmD;oBACnD,+EAA+E;oBAC/E,4DAA4D;oBAC5D,2DAA2D;oBAC3D,6CAA6C;oBAC7C,0DAA0D;oBAC1D,wEAAwE,CAAC;QAC7E,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sCAAsC;IACxC,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"capa.js","sourceRoot":"","sources":["../../src/parsers/capa.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH;;;;;;;;GAQG;AACH,MAAM,qBAAqB,GAAiC;IAC1D,yDAAyD;IACzD,MAAM,EAAE,UAAU;IAClB,SAAS,EAAE,UAAU;IACrB,KAAK,EAAE,UAAU;IACjB,KAAK,EAAE,UAAU;IACjB,2EAA2E;IAC3E,GAAG,EAAE,UAAU;IACf,QAAQ,EAAE,UAAU;IACpB,MAAM,EAAE,UAAU;IAClB,MAAM,EAAE,UAAU;IAClB,gBAAgB,EAAE,UAAU;IAC5B,gBAAgB,EAAE,UAAU;IAC5B,wCAAwC;IACxC,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,YAAY;IACpB,uCAAuC;IACvC,MAAM,EAAE,SAAS;IACjB,2EAA2E;IAC3E,sEAAsE;IACtE,2EAA2E;IAC3E,oEAAoE;CACrE,CAAC;AAEF;;;;GAIG;AACH,MAAM,4BAA4B,GAAiC;IACjE,2CAA2C;IAC3C,aAAa,EAAE,YAAY;IAC3B,YAAY,EAAE,YAAY;IAC1B,kBAAkB,EAAE,YAAY;IAChC,+DAA+D;IAC/D,cAAc,EAAE,UAAU;IAC1B,4CAA4C;IAC5C,IAAI,EAAE,UAAU;IAChB,YAAY,EAAE,UAAU;IACxB,gBAAgB,EAAE,UAAU;IAC5B,KAAK,EAAE,UAAU;IACjB,YAAY,EAAE,UAAU;IACxB,WAAW,EAAE,UAAU;IACvB,WAAW,EAAE,UAAU;IACvB,oBAAoB,EAAE,UAAU;IAChC,eAAe,EAAE,UAAU;IAC3B,gBAAgB,EAAE,UAAU;CAC7B,CAAC;AAEF,mFAAmF;AACnF,MAAM,mBAAmB,GAAmB,CAAC,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;AAE9F;;;;;;GAMG;AACH,SAAS,2BAA2B,CAAC,IAAa,EAAE,GAAsB;IACxE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO;IAC9C,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,8EAA8E;IAC9E,iFAAiF;IACjF,iFAAiF;IACjF,iFAAiF;IACjF,6EAA6E;IAC7E,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO;IAC/B,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC;IACrB,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,KAAgC,CAAC;QAC3C,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACvE,MAAM,CAAC,GAAG,CAAC,CAAC,OAAkC,CAAC;YAC/C,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC;YAClB,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAC3B,IAAI,EAAE,KAAK,gBAAgB,EAAE,CAAC;oBAC5B,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzE,MAAM,EAAE,GAAG,4BAA4B,CAAC,GAAG,CAAC,CAAC;oBAC7C,IAAI,EAAE;wBAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACtB,CAAC;qBAAM,CAAC;oBACN,MAAM,EAAE,GAAG,qBAAqB,CAAC,EAAE,CAAC,CAAC;oBACrC,IAAI,EAAE;wBAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACtB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ;YAAE,2BAA2B,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAA6B;IAC/D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,GAAG,EAAgB,CAAC;QAEtC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC7B,qCAAqC;gBACrC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;oBACtC,2BAA2B,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;gBAC3C,CAAC;YACH,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACvB,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,MAAM,EAAE,GAAI,IAAgC,CAAC,SAAS,CAAC;YACvD,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAC3B,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;oBAAE,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;qBAC/C,IAAI,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC;oBAAE,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QACvC,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,SAAiB;IAC/C,MAAM,MAAM,GAAqB;QAC/B,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,EAAE;QACZ,QAAQ,EAAE,EAAE;QACZ,GAAG,EAAE,SAAS;KACf,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;QAErB,6BAA6B;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChE,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;oBAAE,SAAS;gBAChD,MAAM,CAAC,GAAG,IAA+B,CAAC;gBAC1C,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;gBACpB,MAAM,OAAO,GAAY;oBACvB,WAAW,EAAE,IAAI;oBACjB,QAAQ,EAAE,YAAY;oBACtB,QAAQ,EAAE,MAAM;iBACjB,CAAC;gBAEF,4DAA4D;gBAC5D,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7D,MAAM,CAAC,GAAG,IAA+B,CAAC;oBAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACnD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC,MAAM;6BACxB,MAAM,CAAC,CAAC,CAAC,EAA+B,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC;6BACtE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,SAAS,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,IAAI,GAAG,GAAG,CAAC;6BACpD,IAAI,CAAC,IAAI,CAAC,CAAC;oBAChB,CAAC;gBACH,CAAC;gBAED,wEAAwE;gBACxE,sEAAsE;gBACtE,wEAAwE;gBACxE,0CAA0C;gBAC1C,MAAM,aAAa,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC;gBAC7C,IAAI,aAAa;oBAAE,OAAO,CAAC,cAAc,GAAG,aAAa,CAAC;gBAE1D,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,mBAAmB;QACnB,IAAI,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC/C,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;YAC1C,MAAM,CAAC,QAAQ,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;QAChD,CAAC;QAED,yDAAyD;QACzD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,MAAM,CAAC,QAAQ,CAAC,kBAAkB;gBAChC,mDAAmD;oBACnD,+EAA+E;oBAC/E,4DAA4D;oBAC5D,2DAA2D;oBAC3D,6CAA6C;oBAC7C,0DAA0D;oBAC1D,wEAAwE,CAAC;QAC7E,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sCAAsC;IACxC,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/parsers/imports.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Parser for a PE import table from `readpe -i -f json` (pev suite).
+ *
+ * Produces a structured, queryable view of which APIs a PE statically imports.
+ * This is the enabling primitive for check_behavior_prerequisites: knowing the
+ * import surface lets us ask "can this binary even call the APIs a behavior
+ * requires?" — without conflating "the API is imported" with "the behavior
+ * runs".
+ *
+ * Note on what imports prove: a statically imported API means the binary *can*
+ * call it; it is not evidence the call happens on a reachable path. Absence is
+ * weaker still — APIs can be resolved at runtime (GetProcAddress + LoadLibrary)
+ * or hidden by packing.
+ */
+export interface PeImports {
+    /** True when readpe produced valid JSON we could read (even if zero imports). */
+    parsed: boolean;
+    dlls: Array<{
+        dll: string;
+        functions: string[];
+    }>;
+    /** Lowercased imported function names, for case-insensitive lookup. */
+    functionSet: Set<string>;
+    /** Total number of imported functions across all DLLs. */
+    count: number;
+}
+export declare function parsePeImports(readpeJson: string): PeImports;
+/**
+ * Whether a required API (given as a base name without the ANSI/Unicode suffix)
+ * is present in the import set. Matches the base plus its `...A` / `...W`
+ * variants — e.g. required "InternetOpenUrl" is satisfied by "InternetOpenUrlW".
+ * We APPEND candidate suffixes rather than stripping, because many genuine API
+ * names already end in 'a'/'w' (e.g. "GetClipboardData", "ShowWindow").
+ */
+export declare function apiPresent(requiredBaseName: string, functionSet: Set<string>): boolean;
+//# sourceMappingURL=imports.d.ts.map

package/dist/parsers/imports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"imports.d.ts","sourceRoot":"","sources":["../../src/parsers/imports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,MAAM,WAAW,SAAS;IACxB,iFAAiF;IACjF,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IAClD,uEAAuE;IACvE,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACzB,0DAA0D;IAC1D,KAAK,EAAE,MAAM,CAAC;CACf;AAMD,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAoC5D;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,gBAAgB,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,OAAO,CAGtF"}

package/dist/parsers/imports.js

@@ -0,0 +1,67 @@
+/**
+ * Parser for a PE import table from `readpe -i -f json` (pev suite).
+ *
+ * Produces a structured, queryable view of which APIs a PE statically imports.
+ * This is the enabling primitive for check_behavior_prerequisites: knowing the
+ * import surface lets us ask "can this binary even call the APIs a behavior
+ * requires?" — without conflating "the API is imported" with "the behavior
+ * runs".
+ *
+ * Note on what imports prove: a statically imported API means the binary *can*
+ * call it; it is not evidence the call happens on a reachable path. Absence is
+ * weaker still — APIs can be resolved at runtime (GetProcAddress + LoadLibrary)
+ * or hidden by packing.
+ */
+function emptyImports(parsed) {
+    return { parsed, dlls: [], functionSet: new Set(), count: 0 };
+}
+export function parsePeImports(readpeJson) {
+    let data;
+    try {
+        data = JSON.parse(readpeJson);
+    }
+    catch {
+        return emptyImports(false);
+    }
+    if (!data || typeof data !== "object")
+        return emptyImports(false);
+    const imported = data["Imported functions"];
+    // Valid JSON but no import table (e.g. a PE with no imports) → parsed, empty.
+    if (!Array.isArray(imported))
+        return emptyImports(true);
+    const dlls = [];
+    const functionSet = new Set();
+    let count = 0;
+    for (const lib of imported) {
+        if (!lib || typeof lib !== "object")
+            continue;
+        const l = lib;
+        const dll = typeof l.Name === "string" ? l.Name : "";
+        const fns = Array.isArray(l.Functions) ? l.Functions : [];
+        const names = [];
+        for (const fn of fns) {
+            if (!fn || typeof fn !== "object")
+                continue;
+            const name = fn.Name;
+            if (typeof name === "string" && name.length > 0) {
+                names.push(name);
+                functionSet.add(name.toLowerCase());
+                count++;
+            }
+        }
+        dlls.push({ dll, functions: names });
+    }
+    return { parsed: true, dlls, functionSet, count };
+}
+/**
+ * Whether a required API (given as a base name without the ANSI/Unicode suffix)
+ * is present in the import set. Matches the base plus its `...A` / `...W`
+ * variants — e.g. required "InternetOpenUrl" is satisfied by "InternetOpenUrlW".
+ * We APPEND candidate suffixes rather than stripping, because many genuine API
+ * names already end in 'a'/'w' (e.g. "GetClipboardData", "ShowWindow").
+ */
+export function apiPresent(requiredBaseName, functionSet) {
+    const base = requiredBaseName.toLowerCase();
+    return functionSet.has(base) || functionSet.has(base + "a") || functionSet.has(base + "w");
+}
+//# sourceMappingURL=imports.js.map

package/dist/parsers/imports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"imports.js","sourceRoot":"","sources":["../../src/parsers/imports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAYH,SAAS,YAAY,CAAC,MAAe;IACnC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,UAAkB;IAC/C,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IAElE,MAAM,QAAQ,GAAI,IAAgC,CAAC,oBAAoB,CAAC,CAAC;IACzE,8EAA8E;IAC9E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;IAExD,MAAM,IAAI,GAAgD,EAAE,CAAC;IAC7D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,SAAS;QAC9C,MAAM,CAAC,GAAG,GAA8B,CAAC;QACzC,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ;gBAAE,SAAS;YAC5C,MAAM,IAAI,GAAI,EAA8B,CAAC,IAAI,CAAC;YAClD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACjB,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;gBACpC,KAAK,EAAE,CAAC;YACV,CAAC;QACH,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AACpD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,gBAAwB,EAAE,WAAwB;IAC3E,MAAM,IAAI,GAAG,gBAAgB,CAAC,WAAW,EAAE,CAAC;IAC5C,OAAO,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;AAC7F,CAAC"}

package/dist/parsers/r2.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Pure parsers for radare2 JSON output (izj/izzj strings, iSj sections, aflj
+ * functions, axtj cross-references) plus the marker-split for the batched
+ * "Pass 2" command used by verify_string_usage.
+ *
+ * Every parser is defensive and NEVER throws — malformed/partial r2 output
+ * returns an empty result so the classifier can degrade to `unknown` rather
+ * than mistaking a parse failure for a real "no xref" answer. Field shapes were
+ * captured from radare2 6.1.6; alternative key names seen across versions are
+ * tolerated (e.g. function address as `addr` or `offset`).
+ */
+/** Self-generated markers (emitted via `?e`) that delimit the Pass-2 sections. */
+export declare const R2_MARKERS: {
+    readonly sections: "__R2MCP_SEC__";
+    readonly functions: "__R2MCP_FNS__";
+    readonly xref: "__R2MCP_XR__";
+};
+export interface R2String {
+    value: string;
+    vaddr: number;
+    section: string;
+}
+export interface R2Section {
+    name: string;
+    vaddr: number;
+    vaddrEnd: number;
+    /** True when the section is executable (perm contains 'x'). */
+    exec: boolean;
+}
+export interface R2Function {
+    addr: number;
+    name: string;
+    size: number;
+}
+export interface R2Xref {
+    /** Source address of the reference. */
+    from: number;
+    /** r2 reference type: STRN / DATA / CODE / CALL … */
+    type: string;
+    /** Containing function address, when r2 attributed one. */
+    fcnAddr?: number;
+    /** Containing function name, when present. */
+    fcnName?: string;
+    opcode?: string;
+}
+/** Parse `izj` / `izzj` string output. */
+export declare function parseR2Strings(json: string): R2String[];
+/** Parse `iSj` section output into ranges with an exec flag. */
+export declare function parseR2Sections(json: string): R2Section[];
+/** Parse `aflj` function list (address key is `addr` or `offset` across versions). */
+export declare function parseR2Functions(json: string): R2Function[];
+/** Parse `axtj` cross-reference output for one address. */
+export declare function parseR2Xrefs(json: string): R2Xref[];
+/** Extract the radare2 version string from `?V` output (first matching line). */
+export declare function parseR2Version(text: string): string | undefined;
+export interface SplitR2Output {
+    /** True if the connector truncated the output (→ treat as incomplete). */
+    truncated: boolean;
+    version?: string;
+    sectionsJson: string;
+    functionsJson: string;
+    /** Raw axtj JSON keyed by the queried address marker (hex string as emitted). */
+    xrefsByVaddr: Map<string, string>;
+}
+/**
+ * Split the batched Pass-2 stdout on the self-generated markers. The preamble
+ * (before the sections marker) carries the `?V` version line; sections sit
+ * between the sections and functions markers; functions between the functions
+ * marker and the first xref marker; each `__R2MCP_XR__ <addr>` block holds that
+ * address's axtj JSON up to the next marker or EOF.
+ */
+export declare function splitMarkedR2Output(stdout: string): SplitR2Output;
+//# sourceMappingURL=r2.d.ts.map

package/dist/parsers/r2.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"r2.d.ts","sourceRoot":"","sources":["../../src/parsers/r2.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,kFAAkF;AAClF,eAAO,MAAM,UAAU;;;;CAIb,CAAC;AAKX,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,MAAM;IACrB,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8CAA8C;IAC9C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAeD,0CAA0C;AAC1C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,EAAE,CAYvD;AAED,gEAAgE;AAChE,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,CAiBzD;AAED,sFAAsF;AACtF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,EAAE,CAU3D;AAED,2DAA2D;AAC3D,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAgBnD;AAED,iFAAiF;AACjF,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG/D;AAED,MAAM,WAAW,aAAa;IAC5B,0EAA0E;IAC1E,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,CA4CjE"}

package/dist/parsers/r2.js

@@ -0,0 +1,161 @@
+/**
+ * Pure parsers for radare2 JSON output (izj/izzj strings, iSj sections, aflj
+ * functions, axtj cross-references) plus the marker-split for the batched
+ * "Pass 2" command used by verify_string_usage.
+ *
+ * Every parser is defensive and NEVER throws — malformed/partial r2 output
+ * returns an empty result so the classifier can degrade to `unknown` rather
+ * than mistaking a parse failure for a real "no xref" answer. Field shapes were
+ * captured from radare2 6.1.6; alternative key names seen across versions are
+ * tolerated (e.g. function address as `addr` or `offset`).
+ */
+/** Self-generated markers (emitted via `?e`) that delimit the Pass-2 sections. */
+export const R2_MARKERS = {
+    sections: "__R2MCP_SEC__",
+    functions: "__R2MCP_FNS__",
+    xref: "__R2MCP_XR__",
+};
+/** The connector caps stdout at 10MB and appends this sentinel when it does. */
+const TRUNCATION_SENTINEL = "[OUTPUT TRUNCATED";
+function asArray(json) {
+    try {
+        const data = JSON.parse(json);
+        return Array.isArray(data) ? data : [];
+    }
+    catch {
+        return [];
+    }
+}
+function num(v) {
+    return typeof v === "number" && Number.isFinite(v) ? v : undefined;
+}
+/** Parse `izj` / `izzj` string output. */
+export function parseR2Strings(json) {
+    const out = [];
+    for (const e of asArray(json)) {
+        if (!e || typeof e !== "object")
+            continue;
+        const r = e;
+        const value = r.string;
+        const vaddr = num(r.vaddr);
+        if (typeof value === "string" && vaddr !== undefined) {
+            out.push({ value, vaddr, section: typeof r.section === "string" ? r.section : "" });
+        }
+    }
+    return out;
+}
+/** Parse `iSj` section output into ranges with an exec flag. */
+export function parseR2Sections(json) {
+    const out = [];
+    for (const e of asArray(json)) {
+        if (!e || typeof e !== "object")
+            continue;
+        const r = e;
+        const vaddr = num(r.vaddr);
+        const vsize = num(r.vsize) ?? 0;
+        if (vaddr === undefined)
+            continue;
+        const perm = typeof r.perm === "string" ? r.perm : "";
+        out.push({
+            name: typeof r.name === "string" ? r.name : "",
+            vaddr,
+            vaddrEnd: vaddr + vsize,
+            exec: perm.includes("x"),
+        });
+    }
+    return out;
+}
+/** Parse `aflj` function list (address key is `addr` or `offset` across versions). */
+export function parseR2Functions(json) {
+    const out = [];
+    for (const e of asArray(json)) {
+        if (!e || typeof e !== "object")
+            continue;
+        const r = e;
+        const addr = num(r.addr) ?? num(r.offset);
+        if (addr === undefined)
+            continue;
+        out.push({ addr, name: typeof r.name === "string" ? r.name : "", size: num(r.size) ?? 0 });
+    }
+    return out;
+}
+/** Parse `axtj` cross-reference output for one address. */
+export function parseR2Xrefs(json) {
+    const out = [];
+    for (const e of asArray(json)) {
+        if (!e || typeof e !== "object")
+            continue;
+        const r = e;
+        const from = num(r.from);
+        if (from === undefined)
+            continue;
+        out.push({
+            from,
+            type: typeof r.type === "string" ? r.type : "",
+            fcnAddr: num(r.fcn_addr),
+            fcnName: typeof r.fcn_name === "string" ? r.fcn_name : undefined,
+            opcode: typeof r.opcode === "string" ? r.opcode : undefined,
+        });
+    }
+    return out;
+}
+/** Extract the radare2 version string from `?V` output (first matching line). */
+export function parseR2Version(text) {
+    const m = text.match(/radare2\s+(\S+)/i);
+    return m ? m[1] : undefined;
+}
+/**
+ * Split the batched Pass-2 stdout on the self-generated markers. The preamble
+ * (before the sections marker) carries the `?V` version line; sections sit
+ * between the sections and functions markers; functions between the functions
+ * marker and the first xref marker; each `__R2MCP_XR__ <addr>` block holds that
+ * address's axtj JSON up to the next marker or EOF.
+ */
+export function splitMarkedR2Output(stdout) {
+    const result = {
+        truncated: stdout.includes(TRUNCATION_SENTINEL),
+        sectionsJson: "",
+        functionsJson: "",
+        xrefsByVaddr: new Map(),
+    };
+    const lines = stdout.split("\n");
+    let bucket = { kind: "pre" };
+    let buf = [];
+    const flush = () => {
+        const text = buf.join("\n").trim();
+        if (bucket.kind === "pre") {
+            result.version = parseR2Version(text);
+        }
+        else if (bucket.kind === "sec") {
+            result.sectionsJson = text;
+        }
+        else if (bucket.kind === "fns") {
+            result.functionsJson = text;
+        }
+        else if (bucket.kind === "xref" && bucket.key) {
+            result.xrefsByVaddr.set(bucket.key, text);
+        }
+        buf = [];
+    };
+    for (const line of lines) {
+        const trimmed = line.trim();
+        if (trimmed === R2_MARKERS.sections) {
+            flush();
+            bucket = { kind: "sec" };
+        }
+        else if (trimmed === R2_MARKERS.functions) {
+            flush();
+            bucket = { kind: "fns" };
+        }
+        else if (trimmed.startsWith(R2_MARKERS.xref + " ")) {
+            flush();
+            bucket = { kind: "xref", key: trimmed.slice(R2_MARKERS.xref.length + 1).trim() };
+        }
+        else {
+            buf.push(line);
+        }
+    }
+    flush();
+    return result;
+}
+//# sourceMappingURL=r2.js.map

package/dist/parsers/r2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"r2.js","sourceRoot":"","sources":["../../src/parsers/r2.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,kFAAkF;AAClF,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,QAAQ,EAAE,eAAe;IACzB,SAAS,EAAE,eAAe;IAC1B,IAAI,EAAE,cAAc;CACZ,CAAC;AAEX,gFAAgF;AAChF,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AAkChD,SAAS,OAAO,CAAC,IAAY;IAC3B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9B,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,GAAG,CAAC,CAAU;IACrB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACrE,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,GAAG,GAAe,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,SAAS;QAC1C,MAAM,CAAC,GAAG,CAA4B,CAAC;QACvC,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC;QACvB,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACrD,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,GAAG,GAAgB,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,SAAS;QAC1C,MAAM,CAAC,GAAG,CAA4B,CAAC;QACvC,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC3B,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;YAC9C,KAAK;YACL,QAAQ,EAAE,KAAK,GAAG,KAAK;YACvB,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;SACzB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,SAAS;QAC1C,MAAM,CAAC,GAAG,CAA4B,CAAC;QACvC,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,IAAI,KAAK,SAAS;YAAE,SAAS;QACjC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,SAAS;QAC1C,MAAM,CAAC,GAAG,CAA4B,CAAC;QACvC,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,IAAI,KAAK,SAAS;YAAE,SAAS;QACjC,GAAG,CAAC,IAAI,CAAC;YACP,IAAI;YACJ,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;YAC9C,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;YACxB,OAAO,EAAE,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;YAChE,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;SAC5D,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACzC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9B,CAAC;AAYD;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,MAAM,MAAM,GAAkB;QAC5B,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QAC/C,YAAY,EAAE,EAAE;QAChB,aAAa,EAAE,EAAE;QACjB,YAAY,EAAE,IAAI,GAAG,EAAE;KACxB,CAAC;IAEF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAEjC,IAAI,MAAM,GAAW,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACrC,IAAI,GAAG,GAAa,EAAE,CAAC;IAEvB,MAAM,KAAK,GAAG,GAAG,EAAE;QACjB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC1B,MAAM,CAAC,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACxC,CAAC;aAAM,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACjC,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC;QAC7B,CAAC;aAAM,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACjC,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC;QAC9B,CAAC;aAAM,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YAChD,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC5C,CAAC;QACD,GAAG,GAAG,EAAE,CAAC;IACX,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,KAAK,UAAU,CAAC,QAAQ,EAAE,CAAC;YACpC,KAAK,EAAE,CAAC;YACR,MAAM,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;aAAM,IAAI,OAAO,KAAK,UAAU,CAAC,SAAS,EAAE,CAAC;YAC5C,KAAK,EAAE,CAAC;YACR,MAAM,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;aAAM,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;YACrD,KAAK,EAAE,CAAC;YACR,MAAM,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACnF,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IACD,KAAK,EAAE,CAAC;IACR,OAAO,MAAM,CAAC;AAChB,CAAC"}