@zhuixin/engine 0.2.2 → 0.2.3

package/dist/engine-main.js

@@ -19472,8 +19472,8 @@ var DEFINITIONS = [
     id: "javascript:analyze",
     label: "Analyze JS",
     description: "\u5BF9\u89E3\u5305\u5E94\u7528\u4E2D\u7684 uni-app / WebView \u4E1A\u52A1\u811A\u672C\u505A\u9759\u6001\u5206\u6790\u3002",
-    targetPlatforms: ["ios"],
-    packageFormats: ["ipa"],
+    targetPlatforms: ["ios", "macos"],
+    packageFormats: ["ipa", "app"],
     requiresArtifact: true,
     requiresRea: true
   },
@@ -20261,6 +20261,12 @@ function renderReportMarkdown(input2) {
     }
     lines.push("");
   }
+  const analysisGaps = findings.filter((finding) => finding.type === "limitation").slice(0, 20);
+  if (analysisGaps.length > 0) {
+    lines.push("### Analysis gaps", "");
+    for (const gap of analysisGaps) lines.push(`- ${gap.value}`);
+    lines.push("");
+  }
   lines.push(
     "## Jobs and evidence",
     "",
@@ -20510,6 +20516,13 @@ function javascriptFindings(job, artifact, evidenceId, parsed, summary) {
       }
     }
   }
+  if (artifact.packageFormat === "app") {
+    push("technology", "Electron", {
+      group: "technology",
+      confidence: "high",
+      metadata: { basis: "electron-bundle" }
+    });
+  }
   const normalized = record2(parsed.normalized_result);
   const graph = record2(normalized?.graph);
   const nodes = Array.isArray(graph?.nodes) ? graph.nodes : [];
@@ -20570,17 +20583,47 @@ function javascriptFindings(job, artifact, evidenceId, parsed, summary) {
     }
   }
   const limitations = Array.isArray(parsed.limitations) ? parsed.limitations : [];
+  const seenLimitations = /* @__PURE__ */ new Set();
+  const LIMITATION_CAP = 50;
+  let kept = 0;
   for (const limitation of limitations) {
-    if (typeof limitation === "string") {
-      push("limitation", limitation, {
+    if (typeof limitation !== "string") continue;
+    const normalized2 = limitation.replace(/\s+/g, " ").trim();
+    if (!normalized2 || seenLimitations.has(normalized2)) continue;
+    if (kept >= LIMITATION_CAP) break;
+    seenLimitations.add(normalized2);
+    kept += 1;
+    push("limitation", normalized2, {
+      group: "analysis-limitation",
+      confidence: "exact",
+      metadata: { evidenceId }
+    });
+  }
+  if (limitations.length > kept) {
+    push(
+      "limitation",
+      `${limitations.length - kept} additional per-file limitations were omitted from this summary.`,
+      {
         group: "analysis-limitation",
         confidence: "exact",
-        metadata: { evidenceId }
-      });
-    }
+        metadata: { evidenceId, omitted: limitations.length - kept }
+      }
+    );
   }
   return findings;
 }
+function findElectronJavascriptRoot(appPath) {
+  const asar = import_node_path5.default.join(appPath, "Contents", "Resources", "app.asar");
+  if (import_node_fs5.default.existsSync(asar)) return asar;
+  const unpacked = import_node_path5.default.join(appPath, "Contents", "Resources", "app");
+  if (import_node_fs5.default.existsSync(unpacked) && import_node_fs5.default.statSync(unpacked).isDirectory()) {
+    return unpacked;
+  }
+  fail(
+    "CAPABILITY_UNAVAILABLE",
+    "No Electron JavaScript bundle (app.asar or Resources/app) was found in this app."
+  );
+}
 function nativeSearchFindings(job, artifact, evidenceId, parsed, kind) {
   const values2 = Array.isArray(parsed.normalized_result) ? parsed.normalized_result : Array.isArray(parsed.raw_result) ? parsed.raw_result : [];
   const createdAt = now();
@@ -20959,31 +21002,52 @@ var CapabilityJobRunner = class {
   }
   async runReaJavascript(job, target, artifact) {
     if (!artifact) fail("ARTIFACT_REQUIRED", "\u8BF7\u5148\u83B7\u53D6 artifact\u3002");
-    const extraction = await this.ensureExtraction(job, target, artifact);
-    this.log(job, "info", "\u5BF9\u89E3\u5305\u76EE\u5F55\u8FD0\u884C JavaScript \u9759\u6001\u5206\u6790\u3002", {
-      path: import_node_path5.default.relative(this.workspace.root, extraction.appRoot)
-    });
-    this.patch(job, { progress: 25 });
+    let javascriptRoot;
+    if (artifact.packageFormat === "app") {
+      javascriptRoot = findElectronJavascriptRoot(
+        this.workspace.resolveStoredPath(artifact.path)
+      );
+      this.log(job, "info", "Running static analysis on the macOS JavaScript bundle.", {
+        path: import_node_path5.default.relative(this.workspace.root, javascriptRoot)
+      });
+      this.patch(job, { progress: 25 });
+    } else {
+      const extraction = await this.ensureExtraction(job, target, artifact);
+      javascriptRoot = extraction.appRoot;
+      this.log(job, "info", "\u5BF9\u89E3\u5305\u76EE\u5F55\u8FD0\u884C JavaScript \u9759\u6001\u5206\u6790\u3002", {
+        path: import_node_path5.default.relative(this.workspace.root, javascriptRoot)
+      });
+      this.patch(job, { progress: 25 });
+    }
     const rea = await this.runReaJson(
       job,
       target,
       "javascript-analyze",
       [
         "analyze-javascript-application",
-        extraction.appRoot,
+        javascriptRoot,
         "--analysis-timeout-ms",
         "300000"
       ],
-      10 * 6e4
+      // Electron bundles are much larger than iOS web bundles; a 136 MB asar
+      // takes several minutes on its own.
+      15 * 6e4
     );
     const evidenceId = this.reaEvidenceId(rea);
+    const summary = { ...rea.summary };
+    if (artifact.packageFormat === "app") {
+      const technology = record2(summary.technology) ?? {};
+      const hints = Array.isArray(technology.hints) ? [...technology.hints] : [];
+      if (!hints.includes("Electron")) hints.unshift("Electron");
+      summary.technology = { ...technology, hints };
+    }
     this.persistEvidence(
       job,
       artifact,
       "javascript-analysis",
       rea,
       evidenceId,
-      javascriptFindings(job, artifact, evidenceId, rea.parsed, rea.summary),
+      javascriptFindings(job, artifact, evidenceId, rea.parsed, summary),
       [
         "technology",
         "route",
@@ -20998,9 +21062,9 @@ var CapabilityJobRunner = class {
       status: "analyzed",
       progress: 100,
       result: {
-        ...rea.summary,
+        ...summary,
         evidenceId,
-        outputDir: import_node_path5.default.relative(this.workspace.root, extraction.appRoot),
+        outputDir: import_node_path5.default.relative(this.workspace.root, javascriptRoot),
         evidencePath: rea.rawPath
       },
       finishedAt: now()
@@ -21172,16 +21236,34 @@ var CapabilityJobRunner = class {
       "reports",
       `${job.id}.md`
     );
-    const findingResult = this.store.searchFindings({
+    const findingTypes = [
+      "technology",
+      "route",
+      "network_endpoint",
+      "module",
+      "asset",
+      "storage",
+      "native_procedure",
+      "risk",
+      "limitation"
+    ];
+    const findings = findingTypes.flatMap(
+      (type) => this.store.searchFindings({
+        targetId: target.id,
+        types: [type],
+        limit: 20
+      }).items
+    );
+    const findingTotal = this.store.searchFindings({
       targetId: target.id,
-      limit: 1e3
-    });
+      limit: 1
+    }).total;
     const markdown = renderReportMarkdown({
       target,
       artifact,
       jobs: this.store.listJobs(target.id).filter((item) => item.id !== job.id).slice(0, 20),
-      findings: findingResult.items,
-      findingTotal: findingResult.total,
+      findings,
+      findingTotal,
       hostPlatform: this.config.hostPlatform,
       generatedAt
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zhuixin/engine",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "private": false,
   "license": "UNLICENSED",
   "description": "AppTrace analysis engine (compiled)",