@zhuixin/engine 0.2.3 → 0.2.4

package/dist/engine-main.js

@@ -363,25 +363,25 @@ var require_utils = __commonJS({
       }
       mkdirSync(folder);
     };
-    Utils.prototype.writeFileTo = function(path9, content, overwrite, attr) {
+    Utils.prototype.writeFileTo = function(path10, content, overwrite, attr) {
       const self = this;
-      if (self.fs.existsSync(path9)) {
+      if (self.fs.existsSync(path10)) {
         if (!overwrite) return false;
-        var stat = self.fs.statSync(path9);
+        var stat = self.fs.statSync(path10);
         if (stat.isDirectory()) {
           return false;
         }
       }
-      var folder = pth.dirname(path9);
+      var folder = pth.dirname(path10);
       if (!self.fs.existsSync(folder)) {
         self.makeDir(folder);
       }
       var fd;
       try {
-        fd = self.fs.openSync(path9, "w", 438);
+        fd = self.fs.openSync(path10, "w", 438);
       } catch (e) {
-        self.fs.chmodSync(path9, 438);
-        fd = self.fs.openSync(path9, "w", 438);
+        self.fs.chmodSync(path10, 438);
+        fd = self.fs.openSync(path10, "w", 438);
       }
       if (fd) {
         try {
@@ -390,31 +390,31 @@ var require_utils = __commonJS({
           self.fs.closeSync(fd);
         }
       }
-      self.fs.chmodSync(path9, attr || 438);
+      self.fs.chmodSync(path10, attr || 438);
       return true;
     };
-    Utils.prototype.writeFileToAsync = function(path9, content, overwrite, attr, callback) {
+    Utils.prototype.writeFileToAsync = function(path10, content, overwrite, attr, callback) {
       if (typeof attr === "function") {
         callback = attr;
         attr = void 0;
       }
       const self = this;
-      self.fs.exists(path9, function(exist) {
+      self.fs.exists(path10, function(exist) {
         if (exist && !overwrite) return callback(false);
-        self.fs.stat(path9, function(err, stat) {
+        self.fs.stat(path10, function(err, stat) {
           if (exist && stat.isDirectory()) {
             return callback(false);
           }
-          var folder = pth.dirname(path9);
+          var folder = pth.dirname(path10);
           self.fs.exists(folder, function(exists) {
             if (!exists) self.makeDir(folder);
-            self.fs.open(path9, "w", 438, function(err2, fd) {
+            self.fs.open(path10, "w", 438, function(err2, fd) {
               if (err2) {
-                self.fs.chmod(path9, 438, function() {
-                  self.fs.open(path9, "w", 438, function(err3, fd2) {
+                self.fs.chmod(path10, 438, function() {
+                  self.fs.open(path10, "w", 438, function(err3, fd2) {
                     self.fs.write(fd2, content, 0, content.length, 0, function() {
                       self.fs.close(fd2, function() {
-                        self.fs.chmod(path9, attr || 438, function() {
+                        self.fs.chmod(path10, attr || 438, function() {
                           callback(true);
                         });
                       });
@@ -424,13 +424,13 @@ var require_utils = __commonJS({
               } else if (fd) {
                 self.fs.write(fd, content, 0, content.length, 0, function() {
                   self.fs.close(fd, function() {
-                    self.fs.chmod(path9, attr || 438, function() {
+                    self.fs.chmod(path10, attr || 438, function() {
                       callback(true);
                     });
                   });
                 });
               } else {
-                self.fs.chmod(path9, attr || 438, function() {
+                self.fs.chmod(path10, attr || 438, function() {
                   callback(true);
                 });
               }
@@ -439,7 +439,7 @@ var require_utils = __commonJS({
         });
       });
     };
-    Utils.prototype.findFiles = function(path9) {
+    Utils.prototype.findFiles = function(path10) {
       const self = this;
       function findSync(dir, pattern, recursive) {
         if (typeof pattern === "boolean") {
@@ -448,16 +448,16 @@ var require_utils = __commonJS({
         }
         let files = [];
         self.fs.readdirSync(dir).forEach(function(file) {
-          const path10 = pth.join(dir, file);
-          const stat = self.fs.statSync(path10);
-          if (!pattern || pattern.test(path10)) {
-            files.push(pth.normalize(path10) + (stat.isDirectory() ? self.sep : ""));
+          const path11 = pth.join(dir, file);
+          const stat = self.fs.statSync(path11);
+          if (!pattern || pattern.test(path11)) {
+            files.push(pth.normalize(path11) + (stat.isDirectory() ? self.sep : ""));
           }
-          if (stat.isDirectory() && recursive) files = files.concat(findSync(path10, pattern, recursive));
+          if (stat.isDirectory() && recursive) files = files.concat(findSync(path11, pattern, recursive));
         });
         return files;
       }
-      return findSync(path9, void 0, true);
+      return findSync(path10, void 0, true);
     };
     Utils.prototype.findFilesAsync = function(dir, cb) {
       const self = this;
@@ -512,14 +512,14 @@ var require_utils = __commonJS({
           return "UNSUPPORTED (" + method + ")";
       }
     };
-    Utils.canonical = function(path9) {
-      if (!path9) return "";
-      const safeSuffix = pth.posix.normalize("/" + path9.split("\\").join("/"));
+    Utils.canonical = function(path10) {
+      if (!path10) return "";
+      const safeSuffix = pth.posix.normalize("/" + path10.split("\\").join("/"));
       return pth.join(".", safeSuffix);
     };
-    Utils.zipnamefix = function(path9) {
-      if (!path9) return "";
-      const safeSuffix = pth.posix.normalize("/" + path9.split("\\").join("/"));
+    Utils.zipnamefix = function(path10) {
+      if (!path10) return "";
+      const safeSuffix = pth.posix.normalize("/" + path10.split("\\").join("/"));
       return pth.posix.join(".", safeSuffix);
     };
     Utils.findLast = function(arr, callback) {
@@ -536,9 +536,9 @@ var require_utils = __commonJS({
       prefix = pth.resolve(pth.normalize(prefix));
       var parts = name.split("/");
       for (var i = 0, l = parts.length; i < l; i++) {
-        var path9 = pth.normalize(pth.join(prefix, parts.slice(i, l).join(pth.sep)));
-        if (path9 === prefix || path9.startsWith(prefix + pth.sep)) {
-          return path9;
+        var path10 = pth.normalize(pth.join(prefix, parts.slice(i, l).join(pth.sep)));
+        if (path10 === prefix || path10.startsWith(prefix + pth.sep)) {
+          return path10;
         }
       }
       return pth.normalize(pth.join(prefix, pth.basename(name)));
@@ -585,8 +585,8 @@ var require_fattr = __commonJS({
   "node_modules/.pnpm/adm-zip@0.5.18/node_modules/adm-zip/util/fattr.js"(exports2, module2) {
     "use strict";
     var pth = require("path");
-    module2.exports = function(path9, { fs: fs10 }) {
-      var _path = path9 || "", _obj = newAttr(), _stat = null;
+    module2.exports = function(path10, { fs: fs12 }) {
+      var _path = path10 || "", _obj = newAttr(), _stat = null;
       function newAttr() {
         return {
           directory: false,
@@ -597,8 +597,8 @@ var require_fattr = __commonJS({
           atime: 0
         };
       }
-      if (_path && fs10.existsSync(_path)) {
-        _stat = fs10.statSync(_path);
+      if (_path && fs12.existsSync(_path)) {
+        _stat = fs12.statSync(_path);
         _obj.directory = _stat.isDirectory();
         _obj.mtime = _stat.mtime;
         _obj.atime = _stat.atime;
@@ -15019,7 +15019,7 @@ var require_BigInteger = __commonJS({
 var require_bplistParser = __commonJS({
   "node_modules/.pnpm/bplist-parser@0.3.2/node_modules/bplist-parser/bplistParser.js"(exports2) {
     "use strict";
-    var fs10 = require("fs");
+    var fs12 = require("fs");
     var bigInt = require_BigInteger();
     var debug = false;
     exports2.maxObjectSize = 100 * 1e3 * 1e3;
@@ -15046,7 +15046,7 @@ var require_bplistParser = __commonJS({
         if (Buffer.isBuffer(fileNameOrBuffer)) {
           return tryParseBuffer(fileNameOrBuffer);
         }
-        fs10.readFile(fileNameOrBuffer, function(err, data) {
+        fs12.readFile(fileNameOrBuffer, function(err, data) {
           if (err) {
             reject(err);
             return callback(err);
@@ -15057,7 +15057,7 @@ var require_bplistParser = __commonJS({
     };
     exports2.parseFileSync = function(fileNameOrBuffer) {
       if (!Buffer.isBuffer(fileNameOrBuffer)) {
-        fileNameOrBuffer = fs10.readFileSync(fileNameOrBuffer);
+        fileNameOrBuffer = fs12.readFileSync(fileNameOrBuffer);
       }
       return parseBuffer2(fileNameOrBuffer);
     };
@@ -15347,8 +15347,8 @@ var require_bplistParser = __commonJS({
 });
 
 // src/engine-main.ts
-var import_node_fs9 = __toESM(require("fs"));
-var import_node_path8 = __toESM(require("path"));
+var import_node_fs11 = __toESM(require("fs"));
+var import_node_path9 = __toESM(require("path"));
 var import_node_readline = __toESM(require("readline"));
 
 // node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/external.js
@@ -15829,8 +15829,8 @@ function getErrorMap() {
 
 // node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
-  const { data, path: path9, errorMaps, issueData } = params;
-  const fullPath = [...path9, ...issueData.path || []];
+  const { data, path: path10, errorMaps, issueData } = params;
+  const fullPath = [...path10, ...issueData.path || []];
   const fullIssue = {
     ...issueData,
     path: fullPath
@@ -15946,11 +15946,11 @@ var errorUtil;
 
 // node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/types.js
 var ParseInputLazyPath = class {
-  constructor(parent, value, path9, key) {
+  constructor(parent, value, path10, key) {
     this._cachedPath = [];
     this.parent = parent;
     this.data = value;
-    this._path = path9;
+    this._path = path10;
     this._key = key;
   }
   get path() {
@@ -19392,11 +19392,12 @@ var coerce = {
 };
 var NEVER = INVALID;
 
-// node_modules/.pnpm/@zhuixin+protocol@0.2.4/node_modules/@zhuixin/protocol/dist/index.js
+// node_modules/.pnpm/@zhuixin+protocol@0.2.6/node_modules/@zhuixin/protocol/dist/index.js
 var PROTOCOL_VERSION = "1";
 var engineCapabilities = [
   "inspect:ipa",
   "inspect:mac-app",
+  "inspect:pe",
   "extract:app",
   "javascript:analyze",
   "native:inspect",
@@ -19472,8 +19473,8 @@ var DEFINITIONS = [
     id: "javascript:analyze",
     label: "Analyze JS",
     description: "\u5BF9\u89E3\u5305\u5E94\u7528\u4E2D\u7684 uni-app / WebView \u4E1A\u52A1\u811A\u672C\u505A\u9759\u6001\u5206\u6790\u3002",
-    targetPlatforms: ["ios", "macos"],
-    packageFormats: ["ipa", "app"],
+    targetPlatforms: ["ios", "macos", "windows"],
+    packageFormats: ["ipa", "app", "exe"],
     requiresArtifact: true,
     requiresRea: true
   },
@@ -19515,13 +19516,12 @@ var DEFINITIONS = [
   },
   {
     id: "inspect:pe",
-    label: "Inspect PE",
-    description: "PE \u5934\u3001\u67B6\u6784\u3001\u8282\u533A\u3001\u5BFC\u5165\u8868\u4E0E .NET \u7EBF\u7D22\u3002",
+    label: "Inspect Windows app",
+    description: "Application directory layout, main executable PE headers, sections, imports, .NET clues, version resource, technology hints and Authenticode signature.",
     targetPlatforms: ["windows"],
     packageFormats: ["exe"],
     requiresArtifact: true,
-    available: false,
-    reason: "Windows Target Provider \u5F85 v1.1"
+    builtIn: true
   },
   {
     id: "inspect:msix",
@@ -19531,7 +19531,7 @@ var DEFINITIONS = [
     packageFormats: ["msix", "appx"],
     requiresArtifact: true,
     available: false,
-    reason: "Windows Target Provider \u5F85 v1.1"
+    reason: "Not implemented yet for Windows targets."
   },
   {
     id: "inspect:msi",
@@ -19541,7 +19541,7 @@ var DEFINITIONS = [
     packageFormats: ["msi"],
     requiresArtifact: true,
     available: false,
-    reason: "Windows Target Provider \u5F85 v1.1"
+    reason: "Not implemented yet for Windows targets."
   },
   {
     id: "signature:check",
@@ -19551,7 +19551,7 @@ var DEFINITIONS = [
     packageFormats: ["exe", "msi", "msix", "appx"],
     requiresArtifact: true,
     available: false,
-    reason: "Windows Target Provider \u5F85 v1.1"
+    reason: "Not implemented yet for Windows targets. inspect:pe already reports the main executable's signature."
   }
 ];
 var CapabilityRegistry = class {
@@ -19688,8 +19688,8 @@ function defaultWorkspaceRoot(hostPlatform, env) {
 
 // src/jobs/capability.ts
 var import_node_crypto = require("crypto");
-var import_node_fs5 = __toESM(require("fs"));
-var import_node_path5 = __toESM(require("path"));
+var import_node_fs7 = __toESM(require("fs"));
+var import_node_path6 = __toESM(require("path"));
 
 // src/errors.ts
 var CoreFailure = class extends Error {
@@ -20074,6 +20074,872 @@ async function inspectMacApp(bundlePath) {
   };
 }
 
+// src/inspectors/windowsApp.ts
+var import_node_child_process2 = require("child_process");
+var import_node_fs6 = __toESM(require("fs"));
+var import_node_path4 = __toESM(require("path"));
+var import_node_util2 = require("util");
+
+// src/inspectors/pe.ts
+var import_node_fs5 = __toESM(require("fs"));
+var MACHINES = {
+  332: "x86",
+  34404: "x64",
+  448: "arm",
+  452: "arm (Thumb-2)",
+  43620: "arm64",
+  42561: "arm64ec",
+  42574: "arm64x",
+  512: "ia64"
+};
+var SUBSYSTEMS = {
+  1: "native",
+  2: "windows-gui",
+  3: "windows-console",
+  5: "os2-console",
+  7: "posix-console",
+  9: "windows-ce-gui",
+  10: "efi-application",
+  11: "efi-boot-service-driver",
+  12: "efi-runtime-driver",
+  14: "xbox",
+  16: "windows-boot-application"
+};
+var CERTIFICATE_TYPES = {
+  1: "x509",
+  2: "pkcs-signed-data",
+  3: "reserved",
+  4: "ts-stack-signed"
+};
+var MAX_SECTIONS = 96;
+var MAX_IMPORT_LIBRARIES = 256;
+var MAX_FUNCTIONS_PER_LIBRARY = 12;
+var MAX_THUNKS_PER_LIBRARY = 2e4;
+var ENTROPY_SAMPLE_BYTES = 4 * 1024 * 1024;
+var RESOURCE_MAX_DEPTH = 4;
+function fileReader(fd, size) {
+  return {
+    size,
+    read(offset, length) {
+      if (!Number.isSafeInteger(offset) || offset < 0 || length < 0) return void 0;
+      if (offset + length > size) return void 0;
+      const buffer = Buffer.alloc(length);
+      let done = 0;
+      while (done < length) {
+        const count = import_node_fs5.default.readSync(fd, buffer, done, length - done, offset + done);
+        if (count <= 0) return void 0;
+        done += count;
+      }
+      return buffer;
+    }
+  };
+}
+function hex(value) {
+  return `0x${value.toString(16)}`;
+}
+function cString(buffer, start = 0, limit = buffer.length) {
+  let end = start;
+  const max = Math.min(limit, buffer.length);
+  while (end < max && buffer[end] !== 0) end += 1;
+  return buffer.toString("latin1", start, end);
+}
+function entropyOf(buffer) {
+  if (buffer.length === 0) return 0;
+  const counts = new Array(256).fill(0);
+  for (const byte of buffer) counts[byte] += 1;
+  let entropy = 0;
+  for (const count of counts) {
+    if (count === 0) continue;
+    const p = count / buffer.length;
+    entropy -= p * Math.log2(p);
+  }
+  return Math.round(entropy * 100) / 100;
+}
+function isPeFile(filePath) {
+  let fd;
+  try {
+    fd = import_node_fs5.default.openSync(filePath, "r");
+    const head = Buffer.alloc(2);
+    return import_node_fs5.default.readSync(fd, head, 0, 2, 0) === 2 && head[0] === 77 && head[1] === 90;
+  } catch {
+    return false;
+  } finally {
+    if (fd !== void 0) import_node_fs5.default.closeSync(fd);
+  }
+}
+function inspectPeFile(filePath) {
+  const fd = import_node_fs5.default.openSync(filePath, "r");
+  try {
+    const size = import_node_fs5.default.fstatSync(fd).size;
+    return inspectPe(fileReader(fd, size));
+  } finally {
+    import_node_fs5.default.closeSync(fd);
+  }
+}
+function inspectPe(reader) {
+  const warnings = [];
+  const dos = reader.read(0, 64);
+  if (!dos || dos.readUInt16LE(0) !== 23117) {
+    throw new Error("Not a PE file: the MZ signature is missing.");
+  }
+  const peOffset = dos.readUInt32LE(60);
+  const signature = reader.read(peOffset, 4);
+  if (!signature || signature.toString("latin1") !== "PE\0\0") {
+    throw new Error("Not a PE file: the PE signature is missing.");
+  }
+  const coff = reader.read(peOffset + 4, 20);
+  if (!coff) throw new Error("The COFF header is truncated.");
+  const machine = coff.readUInt16LE(0);
+  const sectionCount = coff.readUInt16LE(2);
+  const timeDateStamp = coff.readUInt32LE(4);
+  const optionalSize = coff.readUInt16LE(16);
+  const characteristics = coff.readUInt16LE(18);
+  const optionalOffset = peOffset + 24;
+  const optional = reader.read(optionalOffset, Math.min(optionalSize, 240));
+  if (!optional || optional.length < 96) {
+    throw new Error("The optional header is truncated.");
+  }
+  const magic = optional.readUInt16LE(0);
+  if (magic !== 267 && magic !== 523) {
+    throw new Error(`Unsupported optional header magic ${hex(magic)}.`);
+  }
+  const plus = magic === 523;
+  const directoriesOffset = plus ? 112 : 96;
+  const entryPointRva = optional.readUInt32LE(16);
+  const imageBase = plus ? optional.readBigUInt64LE(24) : BigInt(optional.readUInt32LE(28));
+  const linker = `${optional[2]}.${optional[3]}`;
+  const minimumOs = `${optional.readUInt16LE(40)}.${optional.readUInt16LE(42)}`;
+  const subsystemId = optional.readUInt16LE(68);
+  const dllCharacteristics = optional.readUInt16LE(70);
+  const declaredDirectories = optional.length >= directoriesOffset ? optional.readUInt32LE(directoriesOffset - 4) : 0;
+  const directory = (index) => {
+    if (index >= declaredDirectories || index >= 16) return void 0;
+    const at = directoriesOffset + index * 8;
+    if (at + 8 > optional.length) return void 0;
+    const rva = optional.readUInt32LE(at);
+    const sizeValue = optional.readUInt32LE(at + 4);
+    return rva === 0 && sizeValue === 0 ? void 0 : { rva, size: sizeValue };
+  };
+  const sections = [];
+  const sectionTableOffset = optionalOffset + optionalSize;
+  const boundedCount = Math.min(sectionCount, MAX_SECTIONS);
+  if (sectionCount > MAX_SECTIONS) {
+    warnings.push(`The file declares ${sectionCount} sections; only the first ${MAX_SECTIONS} were read.`);
+  }
+  for (let index = 0; index < boundedCount; index += 1) {
+    const raw = reader.read(sectionTableOffset + index * 40, 40);
+    if (!raw) {
+      warnings.push("The section table is truncated.");
+      break;
+    }
+    const sectionCharacteristics = raw.readUInt32LE(36);
+    const rawSize = raw.readUInt32LE(16);
+    const rawOffset = raw.readUInt32LE(20);
+    const section = {
+      name: cString(raw, 0, 8),
+      virtualSize: raw.readUInt32LE(8),
+      rawSize,
+      rawOffset,
+      characteristics: sectionCharacteristics,
+      executable: (sectionCharacteristics & 536870912) !== 0,
+      writable: (sectionCharacteristics & 2147483648) !== 0
+    };
+    if (rawSize > 0 && rawOffset > 0) {
+      const sample = reader.read(rawOffset, Math.min(rawSize, ENTROPY_SAMPLE_BYTES));
+      if (sample) section.entropy = entropyOf(sample);
+    }
+    sections.push(section);
+  }
+  const sectionRva = raws(sectionTableOffset, reader, boundedCount);
+  const rvaToOffset = (rva) => {
+    for (const entry of sectionRva) {
+      const span = Math.max(entry.virtualSize, entry.rawSize);
+      if (rva >= entry.rva && rva < entry.rva + span) {
+        const offset = entry.rawOffset + (rva - entry.rva);
+        return offset < reader.size ? offset : void 0;
+      }
+    }
+    return rva < reader.size && sectionRva.every((entry) => rva < entry.rva) ? rva : void 0;
+  };
+  const readRva = (rva, length) => {
+    const offset = rvaToOffset(rva);
+    return offset === void 0 ? void 0 : reader.read(offset, length);
+  };
+  const stringAtRva = (rva, max = 256) => {
+    const offset = rvaToOffset(rva);
+    if (offset === void 0) return void 0;
+    const chunk = reader.read(offset, Math.min(max, reader.size - offset));
+    return chunk ? cString(chunk) : void 0;
+  };
+  const imports = { libraryCount: 0, libraries: [], truncated: false };
+  const importDirectory = directory(1);
+  if (importDirectory) {
+    const thunkSize = plus ? 8 : 4;
+    const collectThunks = (lookupRva, library) => {
+      if (!lookupRva) return;
+      for (let i = 0; i < MAX_THUNKS_PER_LIBRARY; i += 1) {
+        const thunk = readRva(lookupRva + i * thunkSize, thunkSize);
+        if (!thunk) break;
+        const value = plus ? thunk.readBigUInt64LE(0) : BigInt(thunk.readUInt32LE(0));
+        if (value === 0n) break;
+        library.functionCount += 1;
+        if (library.functions.length >= MAX_FUNCTIONS_PER_LIBRARY) continue;
+        const ordinalFlag = plus ? 1n << 63n : 1n << 31n;
+        if (value & ordinalFlag) {
+          library.functions.push(`#${Number(value & 0xffffn)}`);
+        } else {
+          const name = stringAtRva(Number(value & 0x7fffffffn) + 2, 256);
+          if (name) library.functions.push(name);
+        }
+      }
+    };
+    for (let index = 0; index < 4096; index += 1) {
+      const descriptor = readRva(importDirectory.rva + index * 20, 20);
+      if (!descriptor) {
+        if (index === 0) warnings.push("The import table could not be read.");
+        break;
+      }
+      const nameRva = descriptor.readUInt32LE(12);
+      const lookupRva = descriptor.readUInt32LE(0) || descriptor.readUInt32LE(16);
+      if (nameRva === 0 && lookupRva === 0) break;
+      imports.libraryCount += 1;
+      if (imports.libraries.length >= MAX_IMPORT_LIBRARIES) {
+        imports.truncated = true;
+        continue;
+      }
+      const library = {
+        name: stringAtRva(nameRva, 260) ?? "?",
+        functionCount: 0,
+        functions: [],
+        delayLoaded: false
+      };
+      collectThunks(lookupRva, library);
+      imports.libraries.push(library);
+    }
+  }
+  const delayDirectory = directory(13);
+  if (delayDirectory) {
+    for (let index = 0; index < 64; index += 1) {
+      const descriptor = readRva(delayDirectory.rva + index * 32, 32);
+      if (!descriptor) break;
+      const attributes = descriptor.readUInt32LE(0);
+      const nameField = descriptor.readUInt32LE(4);
+      if (nameField === 0) break;
+      const nameRva = attributes & 1 ? nameField : nameField - Number(imageBase & 0xffffffffn);
+      const name = stringAtRva(nameRva, 260);
+      if (!name) continue;
+      imports.libraryCount += 1;
+      if (imports.libraries.length < MAX_IMPORT_LIBRARIES) {
+        imports.libraries.push({ name, functionCount: 0, functions: [], delayLoaded: true });
+      } else {
+        imports.truncated = true;
+      }
+    }
+  }
+  const exportsInfo = { count: 0, namedCount: 0 };
+  const exportDirectory = directory(0);
+  if (exportDirectory) {
+    const table = readRva(exportDirectory.rva, 40);
+    if (table) {
+      exportsInfo.count = table.readUInt32LE(20);
+      exportsInfo.namedCount = table.readUInt32LE(24);
+      exportsInfo.dllName = stringAtRva(table.readUInt32LE(12), 260);
+    }
+  }
+  let dotnet;
+  const clrDirectory = directory(14);
+  if (clrDirectory) {
+    const header = readRva(clrDirectory.rva, 72);
+    if (header) {
+      const flags = header.readUInt32LE(16);
+      dotnet = {
+        runtimeVersion: `${header.readUInt16LE(4)}.${header.readUInt16LE(6)}`,
+        ilOnly: (flags & 1) !== 0,
+        requires32Bit: (flags & 2) !== 0,
+        strongNameSigned: (flags & 8) !== 0,
+        nativeEntryPoint: (flags & 16) !== 0
+      };
+      const metadataRva = header.readUInt32LE(8);
+      const root = metadataRva ? readRva(metadataRva, 32) : void 0;
+      if (root && root.readUInt32LE(0) === 1112167234) {
+        const versionLength = root.readUInt32LE(12);
+        if (versionLength > 0 && versionLength <= 255) {
+          const version2 = readRva(metadataRva + 16, versionLength);
+          if (version2) dotnet.metadataVersion = cString(version2);
+        }
+      }
+    }
+  }
+  const version = readVersionInfo(directory(2), readRva, rvaToOffset, reader, warnings);
+  let debug;
+  const debugDirectory = directory(6);
+  if (debugDirectory) {
+    const entries = Math.min(Math.floor(debugDirectory.size / 28), 16);
+    for (let index = 0; index < entries && !debug; index += 1) {
+      const entry = readRva(debugDirectory.rva + index * 28, 28);
+      if (!entry || entry.readUInt32LE(12) !== 2) continue;
+      const dataSize = entry.readUInt32LE(16);
+      const pointer = entry.readUInt32LE(24);
+      const data = pointer && dataSize >= 24 && dataSize < 4096 ? reader.read(pointer, dataSize) : void 0;
+      if (data && data.toString("latin1", 0, 4) === "RSDS") {
+        debug = {
+          guid: guidString(data.subarray(4, 20)),
+          age: data.readUInt32LE(20),
+          pdbPath: cString(data, 24)
+        };
+      }
+    }
+  }
+  const certificate = { present: false, sizeBytes: 0 };
+  const certificateEntry = directory(4);
+  if (certificateEntry) {
+    certificate.sizeBytes = certificateEntry.size;
+    const header = reader.read(certificateEntry.rva, 8);
+    if (header) {
+      certificate.present = true;
+      certificate.type = CERTIFICATE_TYPES[header.readUInt16LE(6)] ?? `type-${header.readUInt16LE(6)}`;
+    } else {
+      warnings.push("The certificate table points outside the file.");
+    }
+  }
+  let endOfImage = 0;
+  for (const section of sections) {
+    endOfImage = Math.max(endOfImage, section.rawOffset + section.rawSize);
+  }
+  const certificateStart = certificate.present ? certificateEntry.rva : reader.size;
+  const overlayEnd = Math.min(reader.size, certificateStart);
+  const overlaySizeBytes = Math.max(0, overlayEnd - endOfImage);
+  const mitigations = [];
+  if (dllCharacteristics & 64) mitigations.push("ASLR");
+  if (dllCharacteristics & 32) mitigations.push("high-entropy-ASLR");
+  if (dllCharacteristics & 256) mitigations.push("DEP");
+  if (dllCharacteristics & 16384) mitigations.push("CFG");
+  if (dllCharacteristics & 1024) mitigations.push("no-SEH");
+  if (dllCharacteristics & 4096) mitigations.push("app-container");
+  const machineName = MACHINES[machine] ?? `machine-${hex(machine)}`;
+  const reproducible = debugHasReproFlag(debugDirectory, readRva) || timeDateStamp === 0;
+  const timestamp = timeDateStamp !== 0 && !reproducible ? new Date(timeDateStamp * 1e3).toISOString() : void 0;
+  return {
+    kind: "pe",
+    sizeBytes: reader.size,
+    format: plus ? "PE32+" : "PE32",
+    architecture: machineName,
+    isDll: (characteristics & 8192) !== 0,
+    subsystem: SUBSYSTEMS[subsystemId] ?? `subsystem-${subsystemId}`,
+    timestamp,
+    timestampIsReproducible: reproducible,
+    entryPointRva,
+    imageBase: hex(imageBase),
+    linkerVersion: linker,
+    minimumOsVersion: minimumOs,
+    mitigations,
+    sections,
+    imports,
+    exports: exportsInfo,
+    dotnet,
+    version,
+    debug,
+    certificate,
+    overlaySizeBytes,
+    warnings
+  };
+}
+function raws(tableOffset, reader, count) {
+  const result = [];
+  for (let index = 0; index < count; index += 1) {
+    const raw = reader.read(tableOffset + index * 40, 40);
+    if (!raw) break;
+    result.push({
+      virtualSize: raw.readUInt32LE(8),
+      rva: raw.readUInt32LE(12),
+      rawSize: raw.readUInt32LE(16),
+      rawOffset: raw.readUInt32LE(20)
+    });
+  }
+  return result;
+}
+function guidString(bytes) {
+  const part = (start, end) => [...bytes.subarray(start, end)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+  const reverse = (start, end) => [...bytes.subarray(start, end)].reverse().map((byte) => byte.toString(16).padStart(2, "0")).join("");
+  return `${reverse(0, 4)}-${reverse(4, 6)}-${reverse(6, 8)}-${part(8, 10)}-${part(10, 16)}`;
+}
+function debugHasReproFlag(directory, readRva) {
+  if (!directory) return false;
+  const entries = Math.min(Math.floor(directory.size / 28), 16);
+  for (let index = 0; index < entries; index += 1) {
+    const entry = readRva(directory.rva + index * 28, 28);
+    if (entry && entry.readUInt32LE(12) === 16) return true;
+  }
+  return false;
+}
+function readVersionInfo(resources, readRva, rvaToOffset, reader, warnings) {
+  if (!resources) return void 0;
+  const base = resources.rva;
+  const readDirectory = (offset2) => {
+    const header = readRva(base + offset2, 16);
+    if (!header) return void 0;
+    const named = header.readUInt16LE(12);
+    const ids = header.readUInt16LE(14);
+    const count = Math.min(named + ids, 512);
+    const table = count ? readRva(base + offset2 + 16, count * 8) : Buffer.alloc(0);
+    if (!table) return void 0;
+    const entries = [];
+    for (let index = 0; index < count; index += 1) {
+      const nameOrId = table.readUInt32LE(index * 8);
+      const target = table.readUInt32LE(index * 8 + 4);
+      entries.push({
+        id: nameOrId & 2147483647,
+        named: (nameOrId & 2147483648) !== 0,
+        isDirectory: (target & 2147483648) !== 0,
+        target: target & 2147483647
+      });
+    }
+    return entries;
+  };
+  const root = readDirectory(0);
+  const typeEntry = root?.find((entry) => !entry.named && entry.id === 16 && entry.isDirectory);
+  if (!typeEntry) return void 0;
+  let level = readDirectory(typeEntry.target);
+  let depth = 1;
+  let leaf;
+  while (level && level.length > 0 && depth <= RESOURCE_MAX_DEPTH) {
+    const entry = level[0];
+    if (!entry.isDirectory) {
+      leaf = entry;
+      break;
+    }
+    level = readDirectory(entry.target);
+    depth += 1;
+  }
+  if (!leaf) return void 0;
+  const dataEntry = readRva(base + leaf.target, 16);
+  if (!dataEntry) return void 0;
+  const dataRva = dataEntry.readUInt32LE(0);
+  const dataSize = dataEntry.readUInt32LE(4);
+  if (dataSize < 8 || dataSize > 256 * 1024) {
+    warnings.push("The version resource has an unexpected size and was skipped.");
+    return void 0;
+  }
+  const offset = rvaToOffset(dataRva);
+  const data = offset === void 0 ? void 0 : reader.read(offset, dataSize);
+  if (!data) return void 0;
+  return parseVersionResource(data);
+}
+function align4(value) {
+  return value + 3 & ~3;
+}
+function readVersionBlock(buffer, offset, limit) {
+  if (offset + 6 > limit) return void 0;
+  const length = buffer.readUInt16LE(offset);
+  const valueLength = buffer.readUInt16LE(offset + 2);
+  const type = buffer.readUInt16LE(offset + 4);
+  if (length < 6 || offset + length > limit) return void 0;
+  let cursor = offset + 6;
+  let key = "";
+  while (cursor + 2 <= offset + length) {
+    const unit = buffer.readUInt16LE(cursor);
+    cursor += 2;
+    if (unit === 0) break;
+    key += String.fromCharCode(unit);
+    if (key.length > 64) return void 0;
+  }
+  const valueOffset = align4(cursor);
+  const valueBytes = type === 1 ? valueLength * 2 : valueLength;
+  return {
+    key,
+    valueOffset,
+    valueLength,
+    type,
+    childrenOffset: align4(valueOffset + valueBytes),
+    end: offset + length
+  };
+}
+var VERSION_FIELDS = {
+  CompanyName: "companyName",
+  FileDescription: "fileDescription",
+  FileVersion: "fileVersion",
+  InternalName: "internalName",
+  LegalCopyright: "legalCopyright",
+  OriginalFilename: "originalFilename",
+  ProductName: "productName",
+  ProductVersion: "productVersion"
+};
+function parseVersionResource(data) {
+  const root = readVersionBlock(data, 0, data.length);
+  if (!root || root.key !== "VS_VERSION_INFO") return void 0;
+  const result = {};
+  let cursor = root.childrenOffset;
+  while (cursor < root.end) {
+    const group = readVersionBlock(data, cursor, root.end);
+    if (!group) break;
+    if (group.key === "StringFileInfo") {
+      let tableCursor = group.childrenOffset;
+      const table = readVersionBlock(data, tableCursor, group.end);
+      if (table) {
+        tableCursor = table.childrenOffset;
+        while (tableCursor < table.end) {
+          const entry = readVersionBlock(data, tableCursor, table.end);
+          if (!entry) break;
+          const field = VERSION_FIELDS[entry.key];
+          if (field && entry.type === 1 && entry.valueLength > 0) {
+            const raw = data.toString(
+              "utf16le",
+              entry.valueOffset,
+              Math.min(entry.valueOffset + entry.valueLength * 2, entry.end)
+            );
+            const value = raw.replace(/\0+$/, "").trim();
+            if (value) result[field] = value.slice(0, 256);
+          }
+          tableCursor = align4(entry.end);
+        }
+      }
+    }
+    cursor = align4(group.end);
+  }
+  return Object.keys(result).length > 0 ? result : void 0;
+}
+
+// src/inspectors/windowsApp.ts
+var execFileAsync2 = (0, import_node_util2.promisify)(import_node_child_process2.execFile);
+var WALK_ENTRY_LIMIT = 2e4;
+var WALK_DEPTH_LIMIT = 4;
+var HELPER_EXECUTABLE = /^(unins\d*|uninstall.*|update|squirrel|setup.*|install.*|vc_?redist.*|vcredist.*|dxsetup|crashpad_handler|crashreporter.*|crashsender.*|notification_helper|elevate|createdump|.*helper.*|.*updater.*)\.exe$/i;
+function normalizeName(value) {
+  return value.toLowerCase().replace(/[^a-z0-9]/g, "");
+}
+function relative(root, target) {
+  const value = import_node_path4.default.relative(root, target).split(import_node_path4.default.sep).join("/");
+  return value === "" ? "." : value;
+}
+function walk(root) {
+  const files = [];
+  const directories = [];
+  let seen = 0;
+  let truncated = false;
+  const visit = (dir, depth) => {
+    let entries;
+    try {
+      entries = import_node_fs6.default.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (seen >= WALK_ENTRY_LIMIT) {
+        truncated = true;
+        return;
+      }
+      seen += 1;
+      if (entry.isSymbolicLink()) continue;
+      const full = import_node_path4.default.join(dir, entry.name);
+      const rel = relative(root, full);
+      if (entry.isDirectory()) {
+        directories.push(rel.toLowerCase());
+        if (depth < WALK_DEPTH_LIMIT) visit(full, depth + 1);
+      } else if (entry.isFile()) {
+        let size = 0;
+        try {
+          size = import_node_fs6.default.statSync(full).size;
+        } catch {
+        }
+        files.push({ relative: rel, lower: rel.toLowerCase(), size });
+      }
+    }
+  };
+  visit(root, 0);
+  return { files, directories, truncated };
+}
+function topLevelExecutables(dir) {
+  try {
+    return import_node_fs6.default.readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.isFile() && /\.exe$/i.test(entry.name)).map((entry) => entry.name);
+  } catch {
+    return [];
+  }
+}
+function newestSquirrelVersion(dir) {
+  try {
+    const versions = import_node_fs6.default.readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && /^app-\d/i.test(entry.name)).map((entry) => entry.name);
+    versions.sort(
+      (a, b) => a.localeCompare(b, void 0, { numeric: true, sensitivity: "base" })
+    );
+    return versions.length ? versions[versions.length - 1] : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function findWindowsElectronRoot(appPath) {
+  let base = appPath;
+  try {
+    if (import_node_fs6.default.statSync(appPath).isFile()) base = import_node_path4.default.dirname(appPath);
+  } catch {
+    return void 0;
+  }
+  const roots = [base];
+  const squirrel = newestSquirrelVersion(base);
+  if (squirrel) roots.push(import_node_path4.default.join(base, squirrel));
+  for (const root of roots) {
+    const asar = import_node_path4.default.join(root, "resources", "app.asar");
+    if (import_node_fs6.default.existsSync(asar)) return asar;
+    const unpacked = import_node_path4.default.join(root, "resources", "app");
+    if (import_node_fs6.default.existsSync(import_node_path4.default.join(unpacked, "package.json"))) return unpacked;
+  }
+  return void 0;
+}
+function rankExecutables(root, names, appName) {
+  const wanted = normalizeName(appName);
+  const scored = names.map((name) => {
+    let size = 0;
+    try {
+      size = import_node_fs6.default.statSync(import_node_path4.default.join(root, name)).size;
+    } catch {
+    }
+    let score = Math.log10(size + 1);
+    if (HELPER_EXECUTABLE.test(name)) score -= 100;
+    if (wanted && normalizeName(name.replace(/\.exe$/i, "")) === wanted) score += 50;
+    return { name, score };
+  });
+  scored.sort((a, b) => b.score - a.score || a.name.localeCompare(b.name));
+  return scored.map((item) => item.name);
+}
+var FILE_MARKERS = [
+  { hint: "CEF (Chromium Embedded Framework)", test: (f) => /(^|\/)libcef\.dll$/.test(f), basis: "libcef.dll" },
+  { hint: "WebView2", test: (f) => /(^|\/)webview2loader\.dll$/.test(f), basis: "WebView2Loader.dll" },
+  { hint: "Qt", test: (f) => /(^|\/)qt\d?core(d)?\.dll$/.test(f), basis: "QtCore library" },
+  { hint: "Flutter", test: (f) => /(^|\/)flutter_windows\.dll$/.test(f), basis: "flutter_windows.dll" },
+  { hint: "Unity", test: (f) => /(^|\/)unityplayer\.dll$/.test(f), basis: "UnityPlayer.dll" },
+  { hint: "NW.js", test: (f) => /(^|\/)nw(_elf)?\.dll$/.test(f), basis: "nw.dll" },
+  { hint: "Java", test: (f) => /(^|\/)jvm\.dll$/.test(f), basis: "bundled jvm.dll" },
+  { hint: "Python", test: (f) => /(^|\/)python3\d*\.dll$/.test(f), basis: "python3 runtime DLL" },
+  { hint: "PyInstaller", test: (f) => /(^|\/)base_library\.zip$/.test(f), basis: "base_library.zip" },
+  { hint: ".NET (modern runtime)", test: (f) => /(^|\/)(hostfxr|coreclr)\.dll$/.test(f) || /\.runtimeconfig\.json$/.test(f), basis: "hostfxr/coreclr or runtimeconfig.json" },
+  { hint: "WPF", test: (f) => /(^|\/)presentationframework\.dll$/.test(f), basis: "PresentationFramework.dll" },
+  { hint: "Windows Forms", test: (f) => /(^|\/)system\.windows\.forms\.dll$/.test(f), basis: "System.Windows.Forms.dll" },
+  { hint: "WinUI", test: (f) => /(^|\/)microsoft\.ui\.xaml\.dll$/.test(f), basis: "Microsoft.UI.Xaml.dll" },
+  { hint: "Squirrel installer", test: (f) => f === "update.exe", basis: "Update.exe" },
+  { hint: "Inno Setup uninstaller", test: (f) => /(^|\/)unins\d+\.exe$/.test(f), basis: "unins000.exe" },
+  { hint: "NSIS uninstaller", test: (f) => /(^|\/)uninstall[^/]*\.exe$/.test(f), basis: "Uninstall*.exe" }
+];
+var BINARY_MARKERS = [
+  { hint: "Go", needle: Buffer.from("Go buildinf:", "latin1"), basis: "Go build info in the executable" },
+  { hint: "Rust", needle: Buffer.from("/rustc/", "latin1"), basis: "rustc source paths in the executable" },
+  { hint: "Tauri", needle: Buffer.from("tauri-runtime", "latin1"), basis: "tauri-runtime crate paths in the executable" },
+  { hint: "Wails", needle: Buffer.from("wailsapp/wails", "latin1"), basis: "wails module path in the executable" },
+  { hint: "PyInstaller", needle: Buffer.from("PyInstaller", "latin1"), basis: "PyInstaller bootloader strings" },
+  { hint: "Electron", needle: Buffer.from("dL7pKGdnNz796PbbjQWNKmHXBZaB9tsX", "latin1"), basis: "Electron fuse sentinel in the executable" }
+];
+var BINARY_SCAN_LIMIT = 192 * 1024 * 1024;
+var BINARY_SCAN_CHUNK = 8 * 1024 * 1024;
+function scanBinaryMarkers(filePath) {
+  const found = [];
+  let fd;
+  try {
+    fd = import_node_fs6.default.openSync(filePath, "r");
+    const size = import_node_fs6.default.fstatSync(fd).size;
+    const overlap = Math.max(...BINARY_MARKERS.map((marker) => marker.needle.length));
+    const buffer = Buffer.alloc(BINARY_SCAN_CHUNK + overlap);
+    let position = 0;
+    let carried = 0;
+    while (position < Math.min(size, BINARY_SCAN_LIMIT)) {
+      const read = import_node_fs6.default.readSync(fd, buffer, carried, BINARY_SCAN_CHUNK, position);
+      if (read <= 0) break;
+      const view = buffer.subarray(0, carried + read);
+      for (const marker of BINARY_MARKERS) {
+        if (!found.some((item) => item.hint === marker.hint) && view.includes(marker.needle)) {
+          found.push({ hint: marker.hint, basis: marker.basis });
+        }
+      }
+      position += read;
+      carried = Math.min(overlap - 1, view.length);
+      view.copy(buffer, 0, view.length - carried);
+    }
+  } catch {
+  } finally {
+    if (fd !== void 0) import_node_fs6.default.closeSync(fd);
+  }
+  return found;
+}
+function detectTechnology(files, directories, electron, pe, mainPath) {
+  const evidence = [];
+  const add = (hint, basis) => {
+    if (!evidence.some((item) => item.hint === hint)) evidence.push({ hint, basis });
+  };
+  if (electron.asar) add("Electron", "resources/app.asar");
+  else if (electron.unpackedApp) add("Electron", "resources/app");
+  const lower = files.map((file) => file.lower);
+  if (!electron.asar && !electron.unpackedApp && lower.includes("chrome_100_percent.pak") && lower.includes("resources.pak")) {
+    add("Chromium-based", "chrome_100_percent.pak and resources.pak");
+  }
+  for (const marker of FILE_MARKERS) {
+    if (lower.some(marker.test)) add(marker.hint, marker.basis);
+  }
+  if (directories.some((dir) => /(^|\/)[^/]+_data$/.test(dir)) && lower.some((f) => /(^|\/)unityplayer\.dll$/.test(f))) {
+    add("Unity", "*_Data directory");
+  }
+  if (pe?.dotnet) {
+    add(".NET", pe.dotnet.metadataVersion ? `CLR header (${pe.dotnet.metadataVersion})` : "CLR header");
+  }
+  if (pe?.imports.libraries.some((library) => /^mscoree\.dll$/i.test(library.name))) {
+    add(".NET Framework", "imports mscoree.dll");
+  }
+  const libraries = pe?.imports.libraries.map((library) => library.name.toLowerCase()) ?? [];
+  if (libraries.some((name) => /^mfc\d+/.test(name))) add("MFC", "imports mfc*.dll");
+  if (libraries.some((name) => /^qt\d?(core|gui|widgets)/.test(name))) add("Qt", "imports Qt libraries");
+  if (libraries.some((name) => /^webview2loader\.dll$/.test(name))) add("WebView2", "imports WebView2Loader.dll");
+  if (mainPath) {
+    for (const found of scanBinaryMarkers(mainPath)) add(found.hint, found.basis);
+  }
+  return { hints: evidence.map((item) => item.hint), evidence };
+}
+function powershellPath() {
+  const root = process.env.SystemRoot || "C:\\Windows";
+  return import_node_path4.default.join(root, "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+}
+async function verifyAuthenticode(filePath, warnings) {
+  if (process.platform !== "win32") {
+    warnings.push("Authenticode verification requires a Windows host; only the embedded signature block was read.");
+    return void 0;
+  }
+  const script = "$s = Get-AuthenticodeSignature -LiteralPath $env:APPTRACE_SIGNATURE_PATH; [pscustomobject]@{ Status = [string]$s.Status; Message = $s.StatusMessage; Subject = $s.SignerCertificate.Subject; Issuer = $s.SignerCertificate.Issuer; Thumbprint = $s.SignerCertificate.Thumbprint; NotAfter = if ($s.SignerCertificate) { $s.SignerCertificate.NotAfter.ToString('o') } else { $null }; Timestamper = $s.TimeStamperCertificate.Subject } | ConvertTo-Json -Compress";
+  try {
+    const { stdout } = await execFileAsync2(
+      powershellPath(),
+      ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-Command", script],
+      {
+        timeout: 45e3,
+        maxBuffer: 1024 * 1024,
+        windowsHide: true,
+        env: { ...process.env, APPTRACE_SIGNATURE_PATH: filePath }
+      }
+    );
+    const parsed = JSON.parse(stdout.trim());
+    const text2 = (value) => typeof value === "string" && value ? value : void 0;
+    const status = text2(parsed.Status);
+    return {
+      verified: status === "Valid",
+      status,
+      signer: text2(parsed.Subject),
+      issuer: text2(parsed.Issuer),
+      thumbprint: text2(parsed.Thumbprint),
+      notAfter: text2(parsed.NotAfter),
+      timestamper: text2(parsed.Timestamper)
+    };
+  } catch (error) {
+    warnings.push(
+      `Authenticode verification did not complete: ${error instanceof Error ? error.message.split("\n")[0] : String(error)}`
+    );
+    return void 0;
+  }
+}
+function packerWarnings(pe, warnings) {
+  const packerNames = /^(upx\d|\.upx|\.aspack|\.adata|\.themida|\.vmp\d|\.petite|\.mpress|\.enigma\d|\.nsp\d|\.packed)/i;
+  for (const section of pe.sections) {
+    if (packerNames.test(section.name)) {
+      warnings.push(`Section "${section.name}" is typical of a packer; static results may cover only the unpacker stub.`);
+      return;
+    }
+  }
+  const dense = pe.sections.filter((section) => section.executable && (section.entropy ?? 0) >= 7.4 && section.rawSize > 32 * 1024);
+  if (dense.length > 0) {
+    warnings.push(
+      `Executable section "${dense[0].name}" has entropy ${dense[0].entropy}; the code may be packed or encrypted.`
+    );
+  }
+}
+async function inspectWindowsApp(appPath) {
+  const warnings = [];
+  const stat = import_node_fs6.default.statSync(appPath);
+  let appRoot = stat.isDirectory() ? appPath : import_node_path4.default.dirname(appPath);
+  const requestedExecutable = stat.isFile() ? import_node_path4.default.basename(appPath) : void 0;
+  const appName = import_node_path4.default.basename(appRoot);
+  let executables = requestedExecutable ? [requestedExecutable] : topLevelExecutables(appRoot);
+  let ranked = rankExecutables(appRoot, executables, appName);
+  const onlyHelpers = ranked.length > 0 && ranked.every((name) => HELPER_EXECUTABLE.test(name));
+  if (!requestedExecutable && (ranked.length === 0 || onlyHelpers)) {
+    const version2 = newestSquirrelVersion(appRoot);
+    if (version2) {
+      const nested = import_node_path4.default.join(appRoot, version2);
+      const nestedRanked = rankExecutables(nested, topLevelExecutables(nested), appName);
+      if (nestedRanked.length > 0) {
+        warnings.push(`The program lives in "${version2}"; the newest versioned folder was inspected.`);
+        appRoot = nested;
+        executables = topLevelExecutables(nested);
+        ranked = nestedRanked;
+      }
+    }
+  }
+  if (ranked.length === 0) {
+    throw new Error("No Windows executable (.exe) was found at the top level of the application directory.");
+  }
+  const mainName = ranked[0];
+  const mainPath = import_node_path4.default.join(appRoot, mainName);
+  if (!isPeFile(mainPath)) {
+    throw new Error(`"${mainName}" is not a Windows executable (the MZ signature is missing).`);
+  }
+  if (HELPER_EXECUTABLE.test(mainName)) {
+    warnings.push(`Only helper-style executables were found; "${mainName}" was inspected but may not be the application itself.`);
+  }
+  if (ranked.length > 1) {
+    const second = ranked[1];
+    if (!HELPER_EXECUTABLE.test(second) && !requestedExecutable) {
+      warnings.push(`Several executables could be the main program (${ranked.slice(0, 4).join(", ")}); "${mainName}" was chosen.`);
+    }
+  }
+  const pe = inspectPeFile(mainPath);
+  warnings.push(...pe.warnings);
+  packerWarnings(pe, warnings);
+  const walked = walk(appRoot);
+  const asar = import_node_path4.default.join(appRoot, "resources", "app.asar");
+  const unpacked = import_node_path4.default.join(appRoot, "resources", "app");
+  let asarSize;
+  try {
+    asarSize = import_node_fs6.default.statSync(asar).size;
+  } catch {
+  }
+  const electron = {
+    asar: asarSize !== void 0,
+    unpackedApp: import_node_fs6.default.existsSync(import_node_path4.default.join(unpacked, "package.json")),
+    ...asarSize !== void 0 ? { asarSizeBytes: asarSize } : {}
+  };
+  let topLevel = [];
+  try {
+    topLevel = import_node_fs6.default.readdirSync(appRoot).sort((a, b) => a.localeCompare(b)).slice(0, 200);
+  } catch {
+  }
+  const signature = { embedded: pe.certificate.present };
+  const verified = await verifyAuthenticode(mainPath, warnings);
+  if (verified) Object.assign(signature, verified);
+  if (!pe.certificate.present && (!verified || verified.status === "NotSigned")) {
+    warnings.push("The main executable carries no Authenticode signature.");
+  }
+  const version = pe.version?.productVersion ?? pe.version?.fileVersion;
+  return {
+    kind: "windows-app",
+    app: {
+      path: appPath,
+      name: pe.version?.productName ?? pe.version?.fileDescription ?? appName,
+      version,
+      publisher: pe.version?.companyName
+    },
+    layout: {
+      root: relative(stat.isDirectory() ? appPath : import_node_path4.default.dirname(appPath), appRoot),
+      topLevel,
+      executableCount: walked.files.filter((file) => file.lower.endsWith(".exe")).length,
+      dllCount: walked.files.filter((file) => file.lower.endsWith(".dll")).length,
+      fileCount: walked.files.length,
+      truncated: walked.truncated,
+      electron
+    },
+    mainExecutable: {
+      path: relative(stat.isDirectory() ? appPath : import_node_path4.default.dirname(appPath), mainPath),
+      sizeBytes: pe.sizeBytes,
+      candidates: ranked.slice(0, 8),
+      pe
+    },
+    technology: detectTechnology(walked.files, walked.directories, electron, pe, mainPath),
+    signature,
+    warnings
+  };
+}
+
 // src/inspectors/report.ts
 function cell(value) {
   return String(value ?? "\u2014").replace(/\|/g, "\\|").replace(/\r?\n/g, " ");
@@ -20128,6 +20994,42 @@ function renderMacAppInspection(lines, inspection, warnings) {
     lines.push("");
   }
 }
+function renderWindowsAppInspection(lines, inspection, warnings) {
+  const app = record(inspection.app) ?? {};
+  const layout = record(inspection.layout) ?? {};
+  const electron = record(layout.electron);
+  const main = record(inspection.mainExecutable);
+  const pe = record(main?.pe);
+  const imports = record(pe?.imports);
+  const dotnet = record(pe?.dotnet);
+  const signature = record(inspection.signature);
+  const technology = record(inspection.technology);
+  const hints = Array.isArray(technology?.hints) ? technology.hints.map(String) : [];
+  lines.push(
+    "| Field | Value |",
+    "| --- | --- |",
+    `| Name | ${cell(app.name)} |`,
+    `| Version | ${cell(app.version)} |`,
+    `| Publisher | ${cell(app.publisher)} |`,
+    `| Main executable | ${cell(main?.path)} |`,
+    `| Architecture | ${cell(pe?.architecture)} (${cell(pe?.format)}) |`,
+    `| Subsystem | ${cell(pe?.subsystem)} |`,
+    `| Imported libraries | ${cell(imports?.libraryCount)} |`,
+    `| .NET runtime | ${cell(dotnet ? dotnet.runtimeVersion ?? "managed" : void 0)} |`,
+    `| Executables / DLLs | ${cell(layout.executableCount)} / ${cell(layout.dllCount)} |`,
+    `| Electron bundle | ${cell(electron?.asar ? "app.asar" : electron?.unpackedApp ? "unpacked app" : "none")} |`,
+    `| Technology hints | ${cell(hints.length > 0 ? hints.join(", ") : void 0)} |`,
+    `| Signature embedded | ${cell(signature?.embedded)} |`,
+    `| Signature verified | ${cell(signature?.verified ?? "not checked on this host")} |`,
+    `| Signer | ${cell(signature?.signer)} |`,
+    ""
+  );
+  if (warnings.length > 0) {
+    lines.push("### Inspection warnings", "");
+    for (const warning of warnings) lines.push(`- ${warning}`);
+    lines.push("");
+  }
+}
 function renderIpaInspection(lines, inspection, warnings) {
   lines.push(
     "| Field | Value |",
@@ -20219,6 +21121,8 @@ function renderReportMarkdown(input2) {
       lines.push(`Inspection failed: ${cell(inspection.error)}`, "");
     } else if (inspection.kind === "mac-app") {
       renderMacAppInspection(lines, inspection, warnings);
+    } else if (inspection.kind === "windows-app") {
+      renderWindowsAppInspection(lines, inspection, warnings);
     } else {
       renderIpaInspection(lines, inspection, warnings);
     }
@@ -20311,8 +21215,8 @@ function describeResult(result) {
 }
 
 // src/process/run.ts
-var import_node_child_process2 = require("child_process");
-var import_node_path4 = __toESM(require("path"));
+var import_node_child_process3 = require("child_process");
+var import_node_path5 = __toESM(require("path"));
 function quoteWindowsArgument(value) {
   if (value.length === 0) return '""';
   if (!/[\s"&|<>^()%!]/.test(value)) return value;
@@ -20322,7 +21226,7 @@ function windowsCommandLine(command, args) {
   return [command, ...args].map(quoteWindowsArgument).join(" ");
 }
 function windowsSpawnSpec(command, args) {
-  const extension = import_node_path4.default.extname(command).toLowerCase();
+  const extension = import_node_path5.default.extname(command).toLowerCase();
   if (extension !== ".cmd" && extension !== ".bat") {
     return { command, args, verbatim: false };
   }
@@ -20340,7 +21244,7 @@ function runCommand(command, args, options = {}) {
     let child;
     try {
       const spec = process.platform === "win32" ? windowsSpawnSpec(command, args) : { command, args, verbatim: false };
-      child = (0, import_node_child_process2.spawn)(spec.command, spec.args, {
+      child = (0, import_node_child_process3.spawn)(spec.command, spec.args, {
         env: options.env ?? process.env,
         cwd: options.cwd,
         stdio: ["ignore", "pipe", "pipe"],
@@ -20464,7 +21368,7 @@ function uniqueStrings(values2, limit) {
 function isNetworkEndpointValue(value) {
   return /^(?:https?|wss?):\/\//i.test(value) || /^\/\//.test(value) || /^[a-z0-9.-]+\.[a-z]{2,}(?:[/:?#]|$)/i.test(value) || /^\/[a-z0-9._~!$&'()*+,;=:@%/-]+$/i.test(value);
 }
-function detectTechnology(subjectName, modulePaths, assetPaths) {
+function detectTechnology2(subjectName, modulePaths, assetPaths) {
   const text2 = [subjectName, ...modulePaths, ...assetPaths].filter((value) => typeof value === "string").join("\n").toLowerCase();
   const hints = [];
   if (/__uni__|uni-app|uni-jsframework|hbuilder/.test(text2)) {
@@ -20516,7 +21420,7 @@ function javascriptFindings(job, artifact, evidenceId, parsed, summary) {
       }
     }
   }
-  if (artifact.packageFormat === "app") {
+  if (artifact.packageFormat === "app" || artifact.packageFormat === "exe") {
     push("technology", "Electron", {
       group: "technology",
       confidence: "high",
@@ -20613,10 +21517,10 @@ function javascriptFindings(job, artifact, evidenceId, parsed, summary) {
   return findings;
 }
 function findElectronJavascriptRoot(appPath) {
-  const asar = import_node_path5.default.join(appPath, "Contents", "Resources", "app.asar");
-  if (import_node_fs5.default.existsSync(asar)) return asar;
-  const unpacked = import_node_path5.default.join(appPath, "Contents", "Resources", "app");
-  if (import_node_fs5.default.existsSync(unpacked) && import_node_fs5.default.statSync(unpacked).isDirectory()) {
+  const asar = import_node_path6.default.join(appPath, "Contents", "Resources", "app.asar");
+  if (import_node_fs7.default.existsSync(asar)) return asar;
+  const unpacked = import_node_path6.default.join(appPath, "Contents", "Resources", "app");
+  if (import_node_fs7.default.existsSync(unpacked) && import_node_fs7.default.statSync(unpacked).isDirectory()) {
     return unpacked;
   }
   fail(
@@ -20712,7 +21616,7 @@ function summarizeRea(parsed) {
     operation: parsed.operation,
     technology: {
       confidence: "static-hint",
-      hints: detectTechnology(subject?.name, modulePaths, assetPaths)
+      hints: detectTechnology2(subject?.name, modulePaths, assetPaths)
     },
     subject: subject ? {
       name: subject.name,
@@ -20885,6 +21789,9 @@ var CapabilityJobRunner = class {
         case "inspect:mac-app":
           await this.runInspectMacApp(job, target, artifact);
           return;
+        case "inspect:pe":
+          await this.runInspectPe(job, target, artifact);
+          return;
         case "extract:app":
           await this.runExtract(job, target, artifact);
           return;
@@ -20975,10 +21882,36 @@ var CapabilityJobRunner = class {
       warnings: inspection.warnings.length
     });
   }
+  async runInspectPe(job, target, artifact) {
+    if (!artifact) fail("ARTIFACT_REQUIRED", "Acquire an artifact first.");
+    this.log(job, "info", "Inspecting the Windows application.");
+    this.patch(job, { progress: 25 });
+    const inspection = await inspectWindowsApp(
+      this.workspace.resolveStoredPath(artifact.path)
+    );
+    const pe = inspection.mainExecutable?.pe;
+    const updated = {
+      ...artifact,
+      version: inspection.app.version ?? artifact.version,
+      architecture: pe?.architecture ?? artifact.architecture,
+      inspection
+    };
+    this.store.insertArtifact(updated);
+    this.workspace.saveArtifactMetadata(target, updated);
+    this.patch(job, {
+      status: "analyzed",
+      progress: 100,
+      result: { inspection },
+      finishedAt: now()
+    });
+    this.log(job, "info", "Windows application inspection complete.", {
+      warnings: inspection.warnings.length
+    });
+  }
   async runExtract(job, target, artifact) {
     if (!artifact) fail("ARTIFACT_REQUIRED", "\u8BF7\u5148\u83B7\u53D6 artifact\u3002");
     this.log(job, "info", "\u5F00\u59CB\u89E3\u5305 .app\u3002");
-    const outputDir = import_node_path5.default.join(
+    const outputDir = import_node_path6.default.join(
       this.workspace.analysisDir(target),
       "extract-app",
       job.id
@@ -20992,7 +21925,7 @@ var CapabilityJobRunner = class {
       progress: 100,
       result: {
         ...extracted,
-        outputDir: import_node_path5.default.relative(this.workspace.root, extracted.outputDir)
+        outputDir: import_node_path6.default.relative(this.workspace.root, extracted.outputDir)
       },
       finishedAt: now()
     });
@@ -21003,19 +21936,34 @@ var CapabilityJobRunner = class {
   async runReaJavascript(job, target, artifact) {
     if (!artifact) fail("ARTIFACT_REQUIRED", "\u8BF7\u5148\u83B7\u53D6 artifact\u3002");
     let javascriptRoot;
-    if (artifact.packageFormat === "app") {
+    if (artifact.packageFormat === "exe") {
+      const found = findWindowsElectronRoot(
+        this.workspace.resolveStoredPath(artifact.path)
+      );
+      if (!found) {
+        fail(
+          "CAPABILITY_UNAVAILABLE",
+          "No Electron JavaScript bundle (resources/app.asar or resources/app) was found in this application."
+        );
+      }
+      javascriptRoot = found;
+      this.log(job, "info", "Running static analysis on the Windows JavaScript bundle.", {
+        path: import_node_path6.default.relative(this.workspace.root, javascriptRoot)
+      });
+      this.patch(job, { progress: 25 });
+    } else if (artifact.packageFormat === "app") {
       javascriptRoot = findElectronJavascriptRoot(
         this.workspace.resolveStoredPath(artifact.path)
       );
       this.log(job, "info", "Running static analysis on the macOS JavaScript bundle.", {
-        path: import_node_path5.default.relative(this.workspace.root, javascriptRoot)
+        path: import_node_path6.default.relative(this.workspace.root, javascriptRoot)
       });
       this.patch(job, { progress: 25 });
     } else {
       const extraction = await this.ensureExtraction(job, target, artifact);
       javascriptRoot = extraction.appRoot;
       this.log(job, "info", "\u5BF9\u89E3\u5305\u76EE\u5F55\u8FD0\u884C JavaScript \u9759\u6001\u5206\u6790\u3002", {
-        path: import_node_path5.default.relative(this.workspace.root, javascriptRoot)
+        path: import_node_path6.default.relative(this.workspace.root, javascriptRoot)
       });
       this.patch(job, { progress: 25 });
     }
@@ -21027,7 +21975,11 @@ var CapabilityJobRunner = class {
         "analyze-javascript-application",
         javascriptRoot,
         "--analysis-timeout-ms",
-        "300000"
+        "300000",
+        // Signed Electron apps often carry unpacked native binaries whose
+        // bytes no longer match the integrity recorded in app.asar. Keep
+        // going and let REA mark those files untrusted rather than abort.
+        ...artifact.packageFormat === "ipa" ? [] : ["--integrity-policy", "record-and-continue"]
       ],
       // Electron bundles are much larger than iOS web bundles; a 136 MB asar
       // takes several minutes on its own.
@@ -21035,7 +21987,7 @@ var CapabilityJobRunner = class {
     );
     const evidenceId = this.reaEvidenceId(rea);
     const summary = { ...rea.summary };
-    if (artifact.packageFormat === "app") {
+    if (artifact.packageFormat === "app" || artifact.packageFormat === "exe") {
       const technology = record2(summary.technology) ?? {};
       const hints = Array.isArray(technology.hints) ? [...technology.hints] : [];
       if (!hints.includes("Electron")) hints.unshift("Electron");
@@ -21064,7 +22016,7 @@ var CapabilityJobRunner = class {
       result: {
         ...summary,
         evidenceId,
-        outputDir: import_node_path5.default.relative(this.workspace.root, javascriptRoot),
+        outputDir: import_node_path6.default.relative(this.workspace.root, javascriptRoot),
         evidencePath: rea.rawPath
       },
       finishedAt: now()
@@ -21108,7 +22060,7 @@ var CapabilityJobRunner = class {
       result: {
         ...rea.summary,
         evidenceId,
-        binaryPath: import_node_path5.default.relative(this.workspace.root, prepared.binaryPath),
+        binaryPath: import_node_path6.default.relative(this.workspace.root, prepared.binaryPath),
         evidencePath: rea.rawPath,
         encryption,
         warning: encryption.encryptedSlices > 0 ? "\u4E3B\u7A0B\u5E8F\u5305\u542B\u58F0\u660E\u52A0\u5BC6\u7684\u5207\u7247\uFF1B\u4E0D\u8981\u628A\u52A0\u5BC6\u533A\u53CD\u7F16\u8BD1\u7ED3\u679C\u5F53\u4F5C\u53EF\u4FE1\u539F\u59CB\u5B9E\u73B0\u3002" : void 0
@@ -21171,7 +22123,7 @@ var CapabilityJobRunner = class {
         mode,
         matchCount: rawMatches.length,
         matches,
-        binaryPath: import_node_path5.default.relative(this.workspace.root, prepared.binaryPath),
+        binaryPath: import_node_path6.default.relative(this.workspace.root, prepared.binaryPath),
         evidencePath: rea.rawPath,
         limitations: Array.isArray(rea.parsed.limitations) ? rea.parsed.limitations : [],
         encryption: encryptionState(prepared.inspection)
@@ -21216,7 +22168,7 @@ var CapabilityJobRunner = class {
       result: {
         ...rea.summary,
         functionName: input2.functionName,
-        binaryPath: import_node_path5.default.relative(this.workspace.root, prepared.binaryPath),
+        binaryPath: import_node_path6.default.relative(this.workspace.root, prepared.binaryPath),
         evidencePath: rea.rawPath,
         encryption
       },
@@ -21231,7 +22183,7 @@ var CapabilityJobRunner = class {
     this.log(job, "info", "\u6C47\u603B Target\u3001artifact \u548C\u4EFB\u52A1\u8BC1\u636E\u3002");
     this.patch(job, { progress: 35 });
     const generatedAt = now();
-    const reportPath = import_node_path5.default.join(
+    const reportPath = import_node_path6.default.join(
       this.workspace.targetDir(target),
       "reports",
       `${job.id}.md`
@@ -21268,7 +22220,7 @@ var CapabilityJobRunner = class {
       generatedAt
     });
     this.workspace.writeText(reportPath, markdown);
-    const relativePath = import_node_path5.default.relative(this.workspace.root, reportPath);
+    const relativePath = import_node_path6.default.relative(this.workspace.root, reportPath);
     this.patch(job, {
       status: "analyzed",
       progress: 100,
@@ -21300,12 +22252,12 @@ var CapabilityJobRunner = class {
       fail("MAIN_EXECUTABLE_NOT_FOUND", "IPA \u68C0\u67E5\u7ED3\u679C\u4E2D\u6CA1\u6709\u4E3B\u7A0B\u5E8F\u8DEF\u5F84\u3002");
     }
     const extraction = await this.ensureExtraction(job, target, current);
-    const binaryPath = import_node_path5.default.resolve(extraction.outputDir, executable);
-    const root = import_node_path5.default.resolve(extraction.outputDir);
-    if (binaryPath !== root && !binaryPath.startsWith(root + import_node_path5.default.sep)) {
+    const binaryPath = import_node_path6.default.resolve(extraction.outputDir, executable);
+    const root = import_node_path6.default.resolve(extraction.outputDir);
+    if (binaryPath !== root && !binaryPath.startsWith(root + import_node_path6.default.sep)) {
       fail("UNSAFE_ARTIFACT_PATH", "\u4E3B\u7A0B\u5E8F\u8DEF\u5F84\u8D8A\u51FA\u89E3\u5305\u76EE\u5F55\uFF0C\u5DF2\u62D2\u7EDD\u6267\u884C\u3002");
     }
-    if (!import_node_fs5.default.existsSync(binaryPath)) {
+    if (!import_node_fs7.default.existsSync(binaryPath)) {
       fail("MAIN_EXECUTABLE_NOT_FOUND", `\u89E3\u5305\u76EE\u5F55\u4E2D\u6CA1\u6709\u4E3B\u7A0B\u5E8F\uFF1A${executable}`);
     }
     return { inspection, binaryPath };
@@ -21314,24 +22266,24 @@ var CapabilityJobRunner = class {
     const previous = this.findExtraction(target.id, artifact.id);
     if (previous) {
       this.log(job, "info", "\u590D\u7528\u5DF2\u6709\u89E3\u5305\u76EE\u5F55\u3002", {
-        path: import_node_path5.default.relative(this.workspace.root, previous.outputDir)
+        path: import_node_path6.default.relative(this.workspace.root, previous.outputDir)
       });
       return previous;
     }
-    const outputDir = import_node_path5.default.join(
+    const outputDir = import_node_path6.default.join(
       this.workspace.analysisDir(target),
       "extracted",
       artifact.id
     );
-    const existingApp = import_node_fs5.default.existsSync(outputDir) ? findAppPrefix(outputDir) : void 0;
+    const existingApp = import_node_fs7.default.existsSync(outputDir) ? findAppPrefix(outputDir) : void 0;
     if (existingApp) {
       const location = {
         outputDir,
         prefix: existingApp,
-        appRoot: import_node_path5.default.join(outputDir, existingApp)
+        appRoot: import_node_path6.default.join(outputDir, existingApp)
       };
       this.log(job, "info", "\u590D\u7528\u6309 artifact \u54C8\u5E0C\u5F52\u6863\u7684\u89E3\u5305\u76EE\u5F55\u3002", {
-        path: import_node_path5.default.relative(this.workspace.root, outputDir)
+        path: import_node_path6.default.relative(this.workspace.root, outputDir)
       });
       return location;
     }
@@ -21341,8 +22293,8 @@ var CapabilityJobRunner = class {
       this.workspace.resolveStoredPath(artifact.path),
       outputDir
     );
-    const appRoot = import_node_path5.default.resolve(outputDir, extracted.prefix);
-    if (appRoot !== outputDir && !appRoot.startsWith(outputDir + import_node_path5.default.sep)) {
+    const appRoot = import_node_path6.default.resolve(outputDir, extracted.prefix);
+    if (appRoot !== outputDir && !appRoot.startsWith(outputDir + import_node_path6.default.sep)) {
       fail("UNSAFE_ARTIFACT_PATH", "\u89E3\u5305\u524D\u7F00\u8D8A\u51FA\u8F93\u51FA\u76EE\u5F55\uFF0C\u5DF2\u62D2\u7EDD\u7EE7\u7EED\u3002");
     }
     return { outputDir, appRoot, prefix: extracted.prefix };
@@ -21357,8 +22309,8 @@ var CapabilityJobRunner = class {
       if (typeof output !== "string" || typeof prefix !== "string") continue;
       try {
         const outputDir = this.workspace.resolveStoredPath(output);
-        const appRoot = import_node_path5.default.resolve(outputDir, prefix);
-        if (import_node_fs5.default.existsSync(appRoot) && (appRoot === outputDir || appRoot.startsWith(outputDir + import_node_path5.default.sep))) {
+        const appRoot = import_node_path6.default.resolve(outputDir, prefix);
+        if (import_node_fs7.default.existsSync(appRoot) && (appRoot === outputDir || appRoot.startsWith(outputDir + import_node_path6.default.sep))) {
           return { outputDir, appRoot, prefix };
         }
       } catch {
@@ -21367,11 +22319,11 @@ var CapabilityJobRunner = class {
     return void 0;
   }
   async runReaJson(job, target, folder, args, timeoutMs) {
-    const dir = import_node_path5.default.join(this.workspace.analysisDir(target), folder, job.id);
-    const rawPath = import_node_path5.default.join(dir, "result.json");
-    const stderrPath = import_node_path5.default.join(dir, "stderr.log");
-    const commandPath = import_node_path5.default.join(dir, "command.json");
-    import_node_fs5.default.mkdirSync(dir, { recursive: true, mode: 448 });
+    const dir = import_node_path6.default.join(this.workspace.analysisDir(target), folder, job.id);
+    const rawPath = import_node_path6.default.join(dir, "result.json");
+    const stderrPath = import_node_path6.default.join(dir, "stderr.log");
+    const commandPath = import_node_path6.default.join(dir, "command.json");
+    import_node_fs7.default.mkdirSync(dir, { recursive: true, mode: 448 });
     this.workspace.writeJson(commandPath, {
       command: this.config.reaPath,
       args,
@@ -21390,7 +22342,7 @@ var CapabilityJobRunner = class {
     });
     this.workspace.writeText(rawPath, result.stdout);
     this.workspace.writeText(stderrPath, result.stderr);
-    this.workspace.writeJson(import_node_path5.default.join(dir, "status.json"), {
+    this.workspace.writeJson(import_node_path6.default.join(dir, "status.json"), {
       code: result.code,
       timedOut: result.timedOut,
       finishedAt: now()
@@ -21404,7 +22356,7 @@ var CapabilityJobRunner = class {
     if (result.code !== 0) {
       const parsed2 = parseJsonDocument(result.stdout);
       this.log(job, "warn", "\u5206\u6790\u5F15\u64CE\u672A\u6210\u529F\u5B8C\u6210\uFF0C\u539F\u59CB\u8F93\u51FA\u5DF2\u4FDD\u7559\u3002", {
-        evidencePath: import_node_path5.default.relative(this.workspace.root, rawPath)
+        evidencePath: import_node_path6.default.relative(this.workspace.root, rawPath)
       });
       const message = reaErrorMessage(parsed2) ?? shortFailure(result.stderr, result.stdout);
       fail("ENGINE_FAILED", message);
@@ -21418,7 +22370,7 @@ var CapabilityJobRunner = class {
     }
     return {
       parsed,
-      rawPath: import_node_path5.default.relative(this.workspace.root, rawPath),
+      rawPath: import_node_path6.default.relative(this.workspace.root, rawPath),
       sha256: hashText(result.stdout),
       summary: summarizeRea(parsed)
     };
@@ -21466,10 +22418,10 @@ var CapabilityJobRunner = class {
   }
 };
 function findAppPrefix(outputDir) {
-  const payload = import_node_path5.default.join(outputDir, "Payload");
-  if (!import_node_fs5.default.existsSync(payload)) return void 0;
+  const payload = import_node_path6.default.join(outputDir, "Payload");
+  if (!import_node_fs7.default.existsSync(payload)) return void 0;
   try {
-    const app = import_node_fs5.default.readdirSync(payload, { withFileTypes: true }).find((entry) => entry.isDirectory() && entry.name.endsWith(".app"));
+    const app = import_node_fs7.default.readdirSync(payload, { withFileTypes: true }).find((entry) => entry.isDirectory() && entry.name.endsWith(".app"));
     return app ? `Payload/${app.name}/` : void 0;
   } catch {
     return void 0;
@@ -21477,11 +22429,12 @@ function findAppPrefix(outputDir) {
 }
 
 // src/license.ts
-var import_node_fs6 = __toESM(require("fs"));
+var import_node_fs8 = __toESM(require("fs"));
 var import_node_crypto2 = __toESM(require("crypto"));
 var FREE_FEATURES = /* @__PURE__ */ new Set([
   "inspect:ipa",
   "inspect:mac-app",
+  "inspect:pe",
   "extract:app",
   "javascript:analyze",
   "generate:report"
@@ -21497,7 +22450,7 @@ function verifyLicense(token) {
   if (!encodedPayload || !encodedSignature) {
     throw new Error("Invalid license token.");
   }
-  const publicKeyValue = process.env.APPTRACE_LICENSE_PUBLIC_KEY || (process.env.APPTRACE_LICENSE_PUBLIC_KEY_FILE ? import_node_fs6.default.readFileSync(process.env.APPTRACE_LICENSE_PUBLIC_KEY_FILE, "utf8") : void 0);
+  const publicKeyValue = process.env.APPTRACE_LICENSE_PUBLIC_KEY || (process.env.APPTRACE_LICENSE_PUBLIC_KEY_FILE ? import_node_fs8.default.readFileSync(process.env.APPTRACE_LICENSE_PUBLIC_KEY_FILE, "utf8") : void 0);
   if (!publicKeyValue) {
     throw new Error("APPTRACE_LICENSE_PUBLIC_KEY is not configured.");
   }
@@ -21554,8 +22507,8 @@ function compareVersionData(input2) {
 }
 
 // src/store.ts
-var import_node_fs7 = __toESM(require("fs"));
-var import_node_path6 = __toESM(require("path"));
+var import_node_fs9 = __toESM(require("fs"));
+var import_node_path7 = __toESM(require("path"));
 var import_node_module = require("module");
 var import_meta = {};
 function openSqlite(databasePath) {
@@ -21808,7 +22761,7 @@ var SqliteStore = class {
   kind = "sqlite";
   db;
   constructor(databasePath) {
-    import_node_fs7.default.mkdirSync(import_node_path6.default.dirname(databasePath), { recursive: true, mode: 448 });
+    import_node_fs9.default.mkdirSync(import_node_path7.default.dirname(databasePath), { recursive: true, mode: 448 });
     const db = openSqlite(databasePath);
     if (!db) throw new Error("node:sqlite is not available");
     this.db = db;
@@ -22141,11 +23094,11 @@ var JsonStore = class {
   data;
   constructor(databasePath) {
     this.filePath = databasePath.replace(/\.sqlite$/i, "") + ".json";
-    import_node_fs7.default.mkdirSync(import_node_path6.default.dirname(this.filePath), { recursive: true, mode: 448 });
+    import_node_fs9.default.mkdirSync(import_node_path7.default.dirname(this.filePath), { recursive: true, mode: 448 });
     this.data = this.load();
   }
   load() {
-    if (!import_node_fs7.default.existsSync(this.filePath)) {
+    if (!import_node_fs9.default.existsSync(this.filePath)) {
       return {
         targets: [],
         artifacts: [],
@@ -22157,7 +23110,7 @@ var JsonStore = class {
       };
     }
     try {
-      const parsed = JSON.parse(import_node_fs7.default.readFileSync(this.filePath, "utf8"));
+      const parsed = JSON.parse(import_node_fs9.default.readFileSync(this.filePath, "utf8"));
       return {
         targets: parsed.targets ?? [],
         artifacts: parsed.artifacts ?? [],
@@ -22181,8 +23134,8 @@ var JsonStore = class {
   }
   save() {
     const temp = `${this.filePath}.${process.pid}.tmp`;
-    import_node_fs7.default.writeFileSync(temp, JSON.stringify(this.data, null, 2), { mode: 384 });
-    import_node_fs7.default.renameSync(temp, this.filePath);
+    import_node_fs9.default.writeFileSync(temp, JSON.stringify(this.data, null, 2), { mode: 384 });
+    import_node_fs9.default.renameSync(temp, this.filePath);
   }
   listTargets() {
     return [...this.data.targets].sort((a, b) => b.updatedAt.localeCompare(a.updatedAt));
@@ -22323,44 +23276,44 @@ function createStore(databasePath) {
 }
 
 // src/workspace.ts
-var import_node_fs8 = __toESM(require("fs"));
-var import_node_path7 = __toESM(require("path"));
+var import_node_fs10 = __toESM(require("fs"));
+var import_node_path8 = __toESM(require("path"));
 var WorkspaceService = class {
   root;
   constructor(root) {
-    this.root = import_node_path7.default.resolve(root);
-    import_node_fs8.default.mkdirSync(this.root, { recursive: true, mode: 448 });
-    import_node_fs8.default.mkdirSync(import_node_path7.default.join(this.root, "targets"), { recursive: true, mode: 448 });
-    import_node_fs8.default.mkdirSync(import_node_path7.default.join(this.root, "tmp"), { recursive: true, mode: 448 });
+    this.root = import_node_path8.default.resolve(root);
+    import_node_fs10.default.mkdirSync(this.root, { recursive: true, mode: 448 });
+    import_node_fs10.default.mkdirSync(import_node_path8.default.join(this.root, "targets"), { recursive: true, mode: 448 });
+    import_node_fs10.default.mkdirSync(import_node_path8.default.join(this.root, "tmp"), { recursive: true, mode: 448 });
   }
   targetDir(target) {
-    return import_node_path7.default.join(
+    return import_node_path8.default.join(
       this.root,
       "targets",
       `${target.targetRef.platform}-${target.targetRef.sourceId}-${target.slug}-${target.id.slice(0, 8)}`
     );
   }
   artifactDir(target) {
-    return import_node_path7.default.join(this.targetDir(target), "artifacts");
+    return import_node_path8.default.join(this.targetDir(target), "artifacts");
   }
   analysisDir(target) {
-    return import_node_path7.default.join(this.targetDir(target), "analysis");
+    return import_node_path8.default.join(this.targetDir(target), "analysis");
   }
   ensureTarget(target) {
     const dir = this.targetDir(target);
     for (const subdir of ["", "artifacts", "analysis", "reports"]) {
-      import_node_fs8.default.mkdirSync(import_node_path7.default.join(dir, subdir), { recursive: true, mode: 448 });
+      import_node_fs10.default.mkdirSync(import_node_path8.default.join(dir, subdir), { recursive: true, mode: 448 });
     }
   }
   saveResolvedTarget(target, rawSource) {
     this.ensureTarget(target);
     const dir = this.targetDir(target);
-    this.writeJson(import_node_path7.default.join(dir, "meta.json"), target);
-    this.writeJson(import_node_path7.default.join(dir, "source.json"), rawSource);
+    this.writeJson(import_node_path8.default.join(dir, "meta.json"), target);
+    this.writeJson(import_node_path8.default.join(dir, "source.json"), rawSource);
   }
   saveArtifactMetadata(target, artifact, extra = {}) {
     const dir = this.targetDir(target);
-    this.writeJson(import_node_path7.default.join(dir, "artifact.json"), {
+    this.writeJson(import_node_path8.default.join(dir, "artifact.json"), {
       schemaVersion: 1,
       target: {
         id: target.id,
@@ -22384,7 +23337,7 @@ var WorkspaceService = class {
       },
       ...extra
     });
-    this.writeJson(import_node_path7.default.join(dir, "current.json"), {
+    this.writeJson(import_node_path8.default.join(dir, "current.json"), {
       artifactId: artifact.id,
       path: artifact.path,
       sha256: artifact.sha256,
@@ -22392,11 +23345,11 @@ var WorkspaceService = class {
     });
   }
   artifactRelativePath(target, filePath) {
-    return import_node_path7.default.relative(this.root, filePath);
+    return import_node_path8.default.relative(this.root, filePath);
   }
   resolveStoredPath(relativePath) {
-    const resolved = import_node_path7.default.resolve(this.root, relativePath);
-    if (resolved !== this.root && !resolved.startsWith(this.root + import_node_path7.default.sep)) {
+    const resolved = import_node_path8.default.resolve(this.root, relativePath);
+    if (resolved !== this.root && !resolved.startsWith(this.root + import_node_path8.default.sep)) {
       throw new Error(`Path escapes workspace: ${relativePath}`);
     }
     return resolved;
@@ -22406,10 +23359,10 @@ var WorkspaceService = class {
 `);
   }
   writeText(filePath, value) {
-    import_node_fs8.default.mkdirSync(import_node_path7.default.dirname(filePath), { recursive: true, mode: 448 });
+    import_node_fs10.default.mkdirSync(import_node_path8.default.dirname(filePath), { recursive: true, mode: 448 });
     const temp = `${filePath}.${process.pid}.${Date.now()}.tmp`;
-    import_node_fs8.default.writeFileSync(temp, value, { mode: 384 });
-    import_node_fs8.default.renameSync(temp, filePath);
+    import_node_fs10.default.writeFileSync(temp, value, { mode: 384 });
+    import_node_fs10.default.renameSync(temp, filePath);
   }
 };
 
@@ -22448,6 +23401,8 @@ async function handle(line) {
       ok: true,
       result: { protocolVersion: PROTOCOL_VERSION, capabilities: [
         "inspect:ipa",
+        "inspect:mac-app",
+        "inspect:pe",
         "extract:app",
         "javascript:analyze",
         "native:inspect",
@@ -22475,12 +23430,12 @@ async function handle(line) {
     });
     return;
   }
-  const workspaceRoot = import_node_path8.default.resolve(request.workspacePath);
-  if (!import_node_fs9.default.existsSync(workspaceRoot)) {
+  const workspaceRoot = import_node_path9.default.resolve(request.workspacePath);
+  if (!import_node_fs11.default.existsSync(workspaceRoot)) {
     send({ id: request.id, ok: false, error: { code: "WORKSPACE_NOT_FOUND", message: workspaceRoot } });
     return;
   }
-  const store = createStore(import_node_path8.default.join(workspaceRoot, "workbench.sqlite"));
+  const store = createStore(import_node_path9.default.join(workspaceRoot, "workbench.sqlite"));
   try {
     if (request.capability === "compare:versions") {
       send({