claude-flow 3.59.16 → 3.60.0

package/v3/@claude-flow/cli/dist/src/mcp-tools/github-tools.js

@@ -70,17 +70,25 @@ function run(cmd, cwd) {
  * strings stay literal.
  */
 function runArgv(file, args, cwd) {
+    const r = runArgvResult(file, args, cwd);
+    return 'out' in r ? r.out : null;
+}
+/** runArgv that keeps the failure text (stderr, else the error message) for reporting. */
+function runArgvResult(file, args, cwd) {
     try {
-        return execFileSync(file, args, {
-            encoding: 'utf-8',
-            timeout: 15000,
-            cwd: cwd || getProjectCwd(),
-            stdio: ['pipe', 'pipe', 'pipe'],
-            shell: false,
-        }).trim();
+        return {
+            out: execFileSync(file, args, {
+                encoding: 'utf-8',
+                timeout: 15000,
+                cwd: cwd || getProjectCwd(),
+                stdio: ['pipe', 'pipe', 'pipe'],
+                shell: false,
+            }).trim(),
+        };
     }
-    catch {
-        return null;
+    catch (err) {
+        const e = err;
+        return { error: String(e.stderr ?? '').trim() || e.message || 'unknown error' };
     }
 }
 /**
@@ -255,9 +263,12 @@ export const githubTools = [
             const store = loadGitHubStore();
             const action = input.action || 'list';
             const gh = hasGhCli();
+            // #4424: like #2963 for issues — owner/repo were validated but never
+            // passed to `gh`, so PR actions (including merge/close) hit the cwd's repo.
+            const repoArgs = input.owner && input.repo ? ['--repo', `${input.owner}/${input.repo}`] : [];
             if (action === 'list') {
                 if (gh) {
-                    const raw = run('gh pr list --state all --limit 20 --json number,title,state,headRefName,createdAt');
+                    const raw = runArgv('gh', ['pr', 'list', '--state', 'all', '--limit', '20', '--json', 'number,title,state,headRefName,createdAt', ...repoArgs]);
                     if (raw) {
                         try {
                             const prs = JSON.parse(raw);
@@ -285,6 +296,7 @@ export const githubTools = [
                         '--base', baseBranch,
                         '--head', headBranch,
                         '--body', body,
+                        ...repoArgs,
                     ]);
                     if (result) {
                         return { success: true, _real: true, action: 'created', url: result };
@@ -306,6 +318,7 @@ export const githubTools = [
                     const raw = runArgv('gh', [
                         'pr', 'view', String(prNumber),
                         '--json', 'number,title,state,body,additions,deletions,changedFiles,reviews,mergeable,statusCheckRollup',
+                        ...repoArgs,
                     ]);
                     if (raw) {
                         try {
@@ -316,36 +329,28 @@ export const githubTools = [
                 }
                 return { success: false, error: prNumber ? 'gh CLI not available or PR not found. Install gh: https://cli.github.com' : 'prNumber is required (positive integer) for review.' };
             }
-            if (action === 'merge') {
-                const prNumber = toPositiveInt(input.prNumber);
-                if (gh && prNumber) {
-                    const result = runArgv('gh', ['pr', 'merge', String(prNumber), '--merge']);
-                    if (result !== null) {
-                        return { success: true, _real: true, action: 'merged', prNumber, mergedAt: new Date().toISOString() };
-                    }
-                }
-                // Fallback: local store
-                const prKey = prNumber ? Object.keys(store.prs).find(k => k.includes(String(prNumber))) : undefined;
-                if (prKey && store.prs[prKey]) {
-                    store.prs[prKey].status = 'merged';
-                    saveGitHubStore(store);
-                }
-                return { success: true, source: 'local-store', action: 'merged', prNumber, mergedAt: new Date().toISOString() };
-            }
-            if (action === 'close') {
+            if (action === 'merge' || action === 'close') {
+                // #4424: a failed `gh` call, or a local fallback that matched nothing,
+                // used to be reported as success. Fail instead; offline, only update a
+                // local record whose id is exactly `pr-<prNumber>`.
                 const prNumber = toPositiveInt(input.prNumber);
-                if (gh && prNumber) {
-                    const result = runArgv('gh', ['pr', 'close', String(prNumber)]);
-                    if (result !== null) {
-                        return { success: true, _real: true, action: 'closed', prNumber, closedAt: new Date().toISOString() };
+                if (!prNumber)
+                    return { success: false, error: `prNumber is required (positive integer) for ${action}.` };
+                const status = action === 'merge' ? 'merged' : 'closed';
+                if (gh) {
+                    const argv = action === 'merge' ? ['pr', 'merge', String(prNumber), '--merge'] : ['pr', 'close', String(prNumber)];
+                    const r = runArgvResult('gh', [...argv, ...repoArgs]);
+                    if ('error' in r) {
+                        return { success: false, source: 'gh-cli', error: `gh pr ${action} ${prNumber} failed: ${r.error}` };
                     }
+                    return { success: true, _real: true, action: status, prNumber, [`${status}At`]: new Date().toISOString() };
                 }
-                const prKey = prNumber ? Object.keys(store.prs).find(k => k.includes(String(prNumber))) : undefined;
-                if (prKey && store.prs[prKey]) {
-                    store.prs[prKey].status = 'closed';
-                    saveGitHubStore(store);
-                }
-                return { success: true, source: 'local-store', action: 'closed', prNumber, closedAt: new Date().toISOString() };
+                const pr = store.prs[`pr-${prNumber}`];
+                if (!pr)
+                    return { success: false, source: 'local-store', error: `gh CLI not available and no local PR pr-${prNumber}` };
+                pr.status = status;
+                saveGitHubStore(store);
+                return { success: true, source: 'local-store', action: status, prNumber, [`${status}At`]: new Date().toISOString() };
             }
             return { success: false, error: 'Unknown action' };
         },
@@ -435,51 +440,49 @@ export const githubTools = [
                 saveGitHubStore(store);
                 return { success: true, source: 'local-store', action: 'created', issue };
             }
-            if (action === 'update') {
+            if (action === 'update' || action === 'close') {
+                // #4424: same contract as github_pr_manage merge/close — a failed `gh`
+                // call or an unmatched local fallback is a failure, not a success.
                 const issueNumber = toPositiveInt(input.issueNumber);
-                if (gh && issueNumber) {
-                    const argv = ['issue', 'edit', String(issueNumber)];
-                    if (input.title)
-                        argv.push('--title', input.title);
-                    if (input.labels) {
-                        const labels = sanitizeLabels(input.labels);
-                        if (labels === null)
-                            return { success: false, error: 'labels contains disallowed characters' };
-                        if (labels.length > 0)
+                if (!issueNumber)
+                    return { success: false, error: `issueNumber is required (positive integer) for ${action}.` };
+                const labels = input.labels === undefined ? undefined : sanitizeLabels(input.labels);
+                if (labels === null)
+                    return { success: false, error: 'labels contains disallowed characters' };
+                if (gh) {
+                    const argv = ['issue', action === 'update' ? 'edit' : 'close', String(issueNumber)];
+                    if (action === 'update') {
+                        if (input.title)
+                            argv.push('--title', input.title);
+                        if (labels && labels.length > 0)
                             argv.push('--add-label', labels.join(','));
+                        if (argv.length === 3)
+                            return { success: false, error: 'update requires title or labels' };
                     }
-                    if (argv.length > 3) {
-                        const result = runArgv('gh', [...argv, ...repoArgs]);
-                        if (result !== null)
-                            return { success: true, _real: true, action: 'updated', issueNumber };
-                    }
-                }
-                const issueKey = issueNumber ? Object.keys(store.issues).find(k => k.includes(String(issueNumber))) : undefined;
-                if (issueKey && store.issues[issueKey]) {
-                    if (input.title)
-                        store.issues[issueKey].title = input.title;
-                    if (input.labels) {
-                        const labels = sanitizeLabels(input.labels);
-                        if (labels !== null)
-                            store.issues[issueKey].labels = labels;
+                    const r = runArgvResult('gh', [...argv, ...repoArgs]);
+                    if ('error' in r) {
+                        return { success: false, source: 'gh-cli', error: `gh issue ${argv[1]} ${issueNumber} failed: ${r.error}` };
                     }
-                    saveGitHubStore(store);
+                    return action === 'update'
+                        ? { success: true, _real: true, action: 'updated', issueNumber }
+                        : { success: true, _real: true, action: 'closed', issueNumber, closedAt: new Date().toISOString() };
                 }
-                return { success: true, source: 'local-store', action: 'updated', issueNumber };
-            }
-            if (action === 'close') {
-                const issueNumber = toPositiveInt(input.issueNumber);
-                if (gh && issueNumber) {
-                    const result = runArgv('gh', ['issue', 'close', String(issueNumber), ...repoArgs]);
-                    if (result !== null)
-                        return { success: true, _real: true, action: 'closed', issueNumber, closedAt: new Date().toISOString() };
+                const issue = store.issues[`issue-${issueNumber}`];
+                if (!issue)
+                    return { success: false, source: 'local-store', error: `gh CLI not available and no local issue issue-${issueNumber}` };
+                if (action === 'close') {
+                    issue.status = 'closed';
                 }
-                const issueKey = issueNumber ? Object.keys(store.issues).find(k => k.includes(String(issueNumber))) : undefined;
-                if (issueKey && store.issues[issueKey]) {
-                    store.issues[issueKey].status = 'closed';
-                    saveGitHubStore(store);
+                else {
+                    if (input.title)
+                        issue.title = input.title;
+                    if (labels)
+                        issue.labels = labels;
                 }
-                return { success: true, source: 'local-store', action: 'closed', issueNumber, closedAt: new Date().toISOString() };
+                saveGitHubStore(store);
+                return action === 'update'
+                    ? { success: true, source: 'local-store', action: 'updated', issueNumber }
+                    : { success: true, source: 'local-store', action: 'closed', issueNumber, closedAt: new Date().toISOString() };
             }
             return { success: false, error: 'Unknown action' };
         },

package/v3/@claude-flow/cli/dist/src/mcp-tools/neural-tools.js

@@ -899,7 +899,7 @@ export const neuralTools = [
             properties: {
                 modelId: { type: 'string', description: 'Model ID to compress' },
                 method: { type: 'string', enum: ['quantize', 'prune', 'distill'], description: 'Compression method' },
-                targetSize: { type: 'number', description: 'Target size reduction (0-1)' },
+                targetSize: { type: 'number', description: 'Not used: quantize (#4195) and prune (#4423) are unavailable, and distill merges by similarity' },
             },
         },
         handler: async (input) => {
@@ -910,7 +910,6 @@ export const neuralTools = [
             }
             const store = loadNeuralStore();
             const method = input.method || 'quantize';
-            const targetReduction = input.targetSize || 0.5;
             const patterns = Object.values(store.patterns);
             if (patterns.length === 0) {
                 return { success: false, error: 'No patterns to compress. Train patterns first with neural_train.' };
@@ -936,23 +935,18 @@ export const neuralTools = [
             // Resolve provider only for operations that actually use embeddings.
             await ensureEmbeddings();
             if (method === 'prune') {
-                // Prune patterns with low usage count below threshold (targetReduction as min usage)
-                const threshold = targetReduction;
-                const toRemove = [];
-                for (const [id, pattern] of Object.entries(store.patterns)) {
-                    if ((pattern.usageCount || 0) < threshold)
-                        toRemove.push(id);
-                }
-                for (const id of toRemove)
-                    delete store.patterns[id];
-                saveNeuralStore(store);
+                // #4423: prune deleted patterns with usageCount below targetSize, but
+                // nothing in the neural store records usage (patterns are written with
+                // 0 and only max-merged), so any targetSize > 0, including the old 0.5
+                // default, deleted and persisted every pattern. Refuse until usage is
+                // tracked, the same way quantize refuses (#4195). The store is untouched.
                 return {
-                    success: true, _real: true, method,
-                    embeddingProvider: embeddingServiceName,
-                    threshold,
-                    patternsRemoved: toRemove.length,
+                    success: false,
+                    error: 'Pruning is unavailable: neural patterns do not record usage, so there is no signal to choose which to remove.',
+                    method,
+                    patternsRemoved: 0,
                     patternsBefore: beforeCount,
-                    patternsAfter: Object.keys(store.patterns).length,
+                    patternsAfter: beforeCount,
                 };
             }
             if (method === 'distill') {

package/v3/@claude-flow/cli/dist/src/mcp-tools/rure-tools.d.ts

@@ -0,0 +1,11 @@
+/**
+ * ruRE Phase 1 MCP Tools — JS/Electron static analysis.
+ *
+ * See plugins/ruflo-rure/docs/adrs/0001-scope-and-dual-use-policy.md and
+ * 0002-phase1-architecture.md. These tools parse local files; they never
+ * execute analyzed code, and all extracted text is routed through the
+ * AIDefence gate before being returned to the caller.
+ */
+import type { MCPTool } from './types.js';
+export declare const rureTools: MCPTool[];
+//# sourceMappingURL=rure-tools.d.ts.map

package/v3/@claude-flow/cli/dist/src/mcp-tools/rure-tools.js

@@ -0,0 +1,359 @@
+/**
+ * ruRE Phase 1 MCP Tools — JS/Electron static analysis.
+ *
+ * See plugins/ruflo-rure/docs/adrs/0001-scope-and-dual-use-policy.md and
+ * 0002-phase1-architecture.md. These tools parse local files; they never
+ * execute analyzed code, and all extracted text is routed through the
+ * AIDefence gate before being returned to the caller.
+ */
+import { openSync, fstatSync, readFileSync, closeSync } from 'node:fs';
+import { validatePath, validateText } from './validate-input.js';
+import { extractAsarWithCaps, DEFAULT_ASAR_LIMITS } from '../rure/extract-asar.js';
+import { analyzeJsApp } from '../rure/analyze-js-app.js';
+import { findFeature } from '../rure/find-feature.js';
+import { gateWithAIDefence } from '../rure/aidefence-gate.js';
+import { parseBinary, extractStrings, MAX_BINARY_BYTES } from '../rure/binary-parse.js';
+import { parseDotNet } from '../rure/dotnet-parse.js';
+import { analyzeEvm, parseHex, MAX_EVM_BYTES } from '../rure/evm-parse.js';
+function fail(error) {
+    return { content: [{ type: 'text', text: JSON.stringify({ success: false, error }) }], isError: true };
+}
+function ok(data) {
+    return { content: [{ type: 'text', text: JSON.stringify({ success: true, ...data }) }] };
+}
+/**
+ * Screens untrusted extracted text through AIDefence. Every attacker-derived string in a
+ * tool result goes through here (paths, names, literals), results are cached per call, and
+ * `screened` reports honestly whether the scanner actually ran on everything.
+ */
+class Screener {
+    redacted = 0;
+    unscreened = 0;
+    cache = new Map();
+    async one(item) {
+        let g = this.cache.get(item);
+        if (!g) {
+            g = await gateWithAIDefence(item);
+            this.cache.set(item, g);
+            if (g.flagged)
+                this.redacted += 1;
+            if (!g.gated && item)
+                this.unscreened += 1;
+        }
+        return g.text;
+    }
+    async screen(items) {
+        const out = [];
+        for (const item of items)
+            out.push(await this.one(item));
+        return out;
+    }
+    get screened() {
+        return this.unscreened === 0;
+    }
+}
+async function screenEvidence(sc, e) {
+    return { ...e, file: await sc.one(e.file) };
+}
+/** Returns a module analysis with every attacker-derived string screened and clipped; raw snippets are dropped. */
+async function screenModule(sc, mod) {
+    const imports = [];
+    for (const i of mod.imports) {
+        imports.push({ source: await sc.one(i.source), names: await sc.screen(i.names), evidence: await screenEvidence(sc, i.evidence) });
+    }
+    const exports = [];
+    for (const e of mod.exports)
+        exports.push({ name: await sc.one(e.name), evidence: await screenEvidence(sc, e.evidence) });
+    const electronBoundaries = [];
+    for (const b of mod.electronBoundaries) {
+        electronBoundaries.push({ kind: b.kind, detail: await sc.one(b.detail), evidence: await screenEvidence(sc, b.evidence) });
+    }
+    return { file: await sc.one(mod.file), imports, exports, electronBoundaries };
+}
+/** Opens once and checks the size on the same descriptor, so a file swapped after a stat cannot bypass the cap. */
+function readCapped(path, cap) {
+    const fd = openSync(path, 'r');
+    try {
+        const st = fstatSync(fd);
+        if (!st.isFile())
+            return { ok: false, error: 'path is not a regular file' };
+        if (st.size > cap)
+            return { ok: false, error: `file exceeds the ${cap}-byte analysis cap` };
+        return { ok: true, bytes: readFileSync(fd) };
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+export const rureTools = [
+    {
+        name: 'rure_extract_asar',
+        description: 'Unpack an Electron .asar archive to a scratch directory, under resource caps (max total declared size, max file count) checked from the archive header before any bytes are written. Refuses to partially extract: returns truncated:true with nothing written if the archive exceeds the caps. Use when you need to analyze the JS inside a packaged Electron app and rure_analyze_js_app rejects the .asar path directly.',
+        category: 'rure',
+        tags: ['reverse-engineering', 'electron', 'asar', 'static-analysis'],
+        inputSchema: {
+            type: 'object',
+            properties: {
+                path: { type: 'string', description: 'Absolute path to the .asar file' },
+            },
+            required: ['path'],
+        },
+        handler: async (input) => {
+            const v = validatePath(input.path, 'path');
+            if (!v.valid)
+                return fail(v.error);
+            try {
+                const result = await extractAsarWithCaps(v.sanitized, DEFAULT_ASAR_LIMITS);
+                if (result.truncated) {
+                    return ok({ truncated: true, reason: result.reason, fileCount: result.fileCount, totalBytes: result.totalBytes });
+                }
+                return ok({
+                    truncated: false,
+                    unpackedPath: result.unpackedPath,
+                    fileCount: result.fileCount,
+                    totalBytes: result.totalBytes,
+                });
+            }
+            catch (err) {
+                return fail(`asar extraction failed: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        },
+    },
+    {
+        name: 'rure_analyze_js_app',
+        description: 'Statically analyze a directory of JavaScript/TypeScript/Electron source: module list, import/export graph, and Electron process-boundary detection (ipcMain/ipcRenderer/contextBridge, require("electron"), nodeIntegration flags). Every finding carries evidence (file + line range), AIDefence-screened before return. Use when you need a structural map of unfamiliar JS/Electron source rather than reading files one at a time — native Read is fine for a single already-identified file, but wrong for discovering the import graph or Electron boundaries across a whole app. Does not accept a .asar path directly — run rure_extract_asar first and pass its unpackedPath.',
+        category: 'rure',
+        tags: ['reverse-engineering', 'electron', 'javascript', 'static-analysis'],
+        inputSchema: {
+            type: 'object',
+            properties: {
+                path: { type: 'string', description: 'Absolute path to a directory of extracted JS/Electron source' },
+            },
+            required: ['path'],
+        },
+        handler: async (input) => {
+            const v = validatePath(input.path, 'path');
+            if (!v.valid)
+                return fail(v.error);
+            try {
+                const analysis = await analyzeJsApp(v.sanitized);
+                const sc = new Screener();
+                const modules = [];
+                for (const m of analysis.modules)
+                    modules.push(await screenModule(sc, m));
+                return ok({
+                    filesScanned: analysis.filesScanned,
+                    truncated: analysis.truncated,
+                    skippedFiles: analysis.skippedFiles,
+                    isElectron: analysis.isElectron,
+                    modules,
+                    redactedSnippetCount: sc.redacted,
+                    screened: sc.screened,
+                });
+            }
+            catch (err) {
+                return fail(`analysis failed: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        },
+    },
+    {
+        name: 'rure_find_feature',
+        description: 'Locate where a described feature likely lives in an already-extracted JS/Electron app, using deterministic lexical and structural scoring (not semantic/LLM matching, so results stay explainable). Returns ranked matches with file, line range, a short snippet, and a score, every snippet AIDefence-screened before return. Use when the target app is too large to read file-by-file and you need evidence of where a feature lives before explaining or reimplementing it — grep is fine for an exact known string, but wrong when you only have a plain-language description of the behavior.',
+        category: 'rure',
+        tags: ['reverse-engineering', 'search', 'static-analysis'],
+        inputSchema: {
+            type: 'object',
+            properties: {
+                path: { type: 'string', description: 'Absolute path to a directory of extracted JS/Electron source' },
+                query: { type: 'string', description: 'Plain-language description of the feature to locate' },
+            },
+            required: ['path', 'query'],
+        },
+        handler: async (input) => {
+            const v = validatePath(input.path, 'path');
+            if (!v.valid)
+                return fail(v.error);
+            const q = validateText(input.query, 'query', 2000);
+            if (!q.valid)
+                return fail(q.error);
+            try {
+                const result = await findFeature(v.sanitized, q.sanitized);
+                const sc = new Screener();
+                const gated = [];
+                for (const m of result.matches) {
+                    const before = sc.redacted;
+                    const snippet = await sc.one(m.snippet);
+                    gated.push({ ...m, file: await sc.one(m.file), snippet, redacted: sc.redacted > before });
+                }
+                return ok({
+                    matches: gated,
+                    filesScanned: result.filesScanned,
+                    truncated: result.truncated,
+                    skippedFiles: result.skippedFiles,
+                    screened: sc.screened,
+                });
+            }
+            catch (err) {
+                return fail(`feature search failed: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        },
+    },
+    {
+        name: 'rure_analyze_binary',
+        description: 'Statically inspect a native ELF, PE, or Mach-O file (ADR-0003): format, architecture, entry point, section layout, linked libraries, and imported/exported symbols, plus optional printable strings. Pure byte parsing under hard caps (128 MiB file, bounded tables); the file is never loaded or executed, and every name and string is AIDefence-screened before return. Use when you need an inventory of what a native binary links against and exposes before deciding where to look next — not for disassembly or decompilation, which this does not do. Malformed headers yield warnings, not errors.',
+        category: 'rure',
+        tags: ['reverse-engineering', 'binary', 'elf', 'pe', 'macho', 'static-analysis'],
+        inputSchema: {
+            type: 'object',
+            properties: {
+                path: { type: 'string', description: 'Absolute path to a native binary (ELF, PE, or Mach-O)' },
+                includeStrings: { type: 'boolean', description: 'Also return up to 200 printable strings (default false)' },
+            },
+            required: ['path'],
+        },
+        handler: async (input) => {
+            const v = validatePath(input.path, 'path');
+            if (!v.valid)
+                return fail(v.error);
+            try {
+                const r = readCapped(v.sanitized, MAX_BINARY_BYTES);
+                if (!r.ok)
+                    return fail(r.error);
+                const buf = r.bytes;
+                const info = parseBinary(buf);
+                const sc = new Screener();
+                const libraries = await sc.screen(info.libraries);
+                const imports = await sc.screen(info.imports);
+                const exports = await sc.screen(info.exports);
+                const sectionNames = await sc.screen(info.sections.map((x) => x.name));
+                const sections = info.sections.map((x, i) => ({ ...x, name: sectionNames[i] }));
+                let strings;
+                let stringsTruncated = false;
+                const warnings = [...info.warnings];
+                if (input.includeStrings === true) {
+                    if (info.format === 'unknown') {
+                        warnings.push('strings not extracted: file is not a recognized binary format');
+                    }
+                    else {
+                        const ex = extractStrings(buf);
+                        stringsTruncated = ex.truncated;
+                        const gated = await sc.screen(ex.strings.map((x) => x.value));
+                        strings = ex.strings.map((x, i) => ({ value: gated[i], offset: x.offset }));
+                    }
+                }
+                return ok({ ...info, warnings, sections, libraries, imports, exports, ...(strings ? { strings, stringsTruncated } : {}), redactedCount: sc.redacted, screened: sc.screened });
+            }
+            catch (err) {
+                return fail(`binary analysis failed: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        },
+    },
+    {
+        name: 'rure_analyze_dotnet',
+        description: 'Inspect a managed .NET assembly (.dll/.exe) from its ECMA-335 metadata (ADR-0004): runtime version, assembly identity, assembly references, type names, method count, P/Invoke native imports (module + function), user-string literals, and entry-point token. Reads metadata only under hard caps; the assembly is never loaded or run, and every name and string is AIDefence-screened before return. Use when you need the dependency and native-call surface of a .NET binary before deciding where to dig deeper — not for IL disassembly or decompilation, which this does not do. A native (non-managed) PE returns isManaged:false.',
+        category: 'rure',
+        tags: ['reverse-engineering', 'dotnet', 'assembly', 'static-analysis'],
+        inputSchema: {
+            type: 'object',
+            properties: {
+                path: { type: 'string', description: 'Absolute path to a .NET assembly (.dll or .exe)' },
+            },
+            required: ['path'],
+        },
+        handler: async (input) => {
+            const v = validatePath(input.path, 'path');
+            if (!v.valid)
+                return fail(v.error);
+            try {
+                const r = readCapped(v.sanitized, MAX_BINARY_BYTES);
+                if (!r.ok)
+                    return fail(r.error);
+                const info = parseDotNet(r.bytes);
+                const sc = new Screener();
+                const assembly = info.assembly ? { ...info.assembly, name: await sc.one(info.assembly.name) } : null;
+                const refNames = await sc.screen(info.assemblyRefs.map((x) => x.name));
+                const types = await sc.screen(info.types);
+                const pmods = await sc.screen(info.pinvokes.map((x) => x.module));
+                const pfuncs = await sc.screen(info.pinvokes.map((x) => x.function));
+                const userStrings = await sc.screen(info.userStrings);
+                const runtimeVersion = info.runtimeVersion === null ? null : await sc.one(info.runtimeVersion);
+                return ok({
+                    ...info,
+                    runtimeVersion,
+                    assembly,
+                    assemblyRefs: info.assemblyRefs.map((x, i) => ({ ...x, name: refNames[i] })),
+                    types,
+                    pinvokes: info.pinvokes.map((_, i) => ({ module: pmods[i], function: pfuncs[i] })),
+                    userStrings,
+                    redactedCount: sc.redacted,
+                    screened: sc.screened,
+                });
+            }
+            catch (err) {
+                return fail(`dotnet analysis failed: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        },
+    },
+    {
+        name: 'rure_analyze_evm',
+        description: 'Statically inventory EVM contract bytecode (ADR-0005): instruction and JUMPDEST counts, function selectors recognized from the dispatcher (with names for a small well-known table only), counts and offsets of hazardous opcodes (SELFDESTRUCT, DELEGATECALL, CALLCODE, CREATE/CREATE2, ORIGIN, CALL, STATICCALL), embedded addresses, event topics, EIP-1167 minimal-proxy detection, compiler metadata, and embedded strings such as revert reasons (AIDefence-screened). Pass bytecode inline as hex, or a path to a file of hex text or raw bytes. Aligned disassembly only: there is no EVM interpreter, no RPC, and no network. Use when you need the exposed surface and risky capabilities of a contract before deeper review; a hazardous opcode is an inventory fact, not a vulnerability finding, and dispatcher detection can miss unusual layouts.',
+        category: 'rure',
+        tags: ['reverse-engineering', 'evm', 'smart-contract', 'static-analysis'],
+        inputSchema: {
+            type: 'object',
+            properties: {
+                bytecode: { type: 'string', description: 'Contract bytecode as hex (0x prefix optional). Provide this or path, not both.' },
+                path: { type: 'string', description: 'Absolute path to a file containing hex text or raw bytecode' },
+                includeDisassembly: { type: 'boolean', description: 'Also return the first 500 instructions (default false)' },
+            },
+        },
+        handler: async (input) => {
+            const hasInline = typeof input.bytecode === 'string' && input.bytecode.length > 0;
+            const hasPath = typeof input.path === 'string' && input.path.length > 0;
+            if (hasInline === hasPath)
+                return fail('provide exactly one of bytecode or path');
+            try {
+                let bytes;
+                if (hasInline) {
+                    const text = input.bytecode;
+                    if (text.length > MAX_EVM_BYTES * 2 + 2)
+                        return fail(`bytecode exceeds the ${MAX_EVM_BYTES}-byte cap`);
+                    const parsed = parseHex(text);
+                    if (!parsed.ok)
+                        return fail(parsed.error);
+                    bytes = parsed.bytes;
+                }
+                else {
+                    const v = validatePath(input.path, 'path');
+                    if (!v.valid)
+                        return fail(v.error);
+                    const r = readCapped(v.sanitized, MAX_EVM_BYTES * 2 + 64);
+                    if (!r.ok)
+                        return fail(r.error);
+                    const raw = r.bytes;
+                    const asText = raw.toString('latin1').trim();
+                    if (/^(0x)?[0-9a-fA-F\s]+$/.test(asText)) {
+                        const parsed = parseHex(asText.replace(/\s/g, ''));
+                        if (!parsed.ok)
+                            return fail(parsed.error);
+                        bytes = parsed.bytes;
+                    }
+                    else if (raw.length <= MAX_EVM_BYTES) {
+                        bytes = raw;
+                    }
+                    else {
+                        return fail(`file exceeds the ${MAX_EVM_BYTES}-byte bytecode cap`);
+                    }
+                }
+                const info = analyzeEvm(bytes, input.includeDisassembly === true);
+                const sc = new Screener();
+                const strings = await sc.screen(info.strings);
+                return ok({ ...info, strings, redactedCount: sc.redacted, screened: sc.screened });
+            }
+            catch (err) {
+                return fail(`evm analysis failed: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        },
+    },
+];
+//# sourceMappingURL=rure-tools.js.map