claude-flow 3.59.16 → 3.60.0

package/v3/@claude-flow/cli/dist/src/rure/dotnet-parse.d.ts

@@ -0,0 +1,30 @@
+/**
+ * ruRE Phase 3 — .NET assembly metadata inspection (ADR-0004).
+ * Reads ECMA-335 metadata from a Buffer. Never loads or executes the assembly.
+ */
+export interface DotNetInfo {
+    isManaged: boolean;
+    runtimeVersion: string | null;
+    assembly: {
+        name: string;
+        version: string;
+    } | null;
+    assemblyRefs: {
+        name: string;
+        version: string;
+    }[];
+    typeCount: number;
+    types: string[];
+    methodCount: number;
+    pinvokes: {
+        module: string;
+        function: string;
+    }[];
+    userStrings: string[];
+    entryPointToken: number | null;
+    warnings: string[];
+    truncated: boolean;
+}
+/** Inspects a managed assembly's metadata. Never throws on hostile input. */
+export declare function parseDotNet(b: Buffer): DotNetInfo;
+//# sourceMappingURL=dotnet-parse.d.ts.map

package/v3/@claude-flow/cli/dist/src/rure/dotnet-parse.js

@@ -0,0 +1,299 @@
+/**
+ * ruRE Phase 3 — .NET assembly metadata inspection (ADR-0004).
+ * Reads ECMA-335 metadata from a Buffer. Never loads or executes the assembly.
+ */
+const MAX_LIST = 500;
+const MAX_USER_STRINGS = 200;
+const MAX_STR = 256;
+const CODED = {
+    TypeDefOrRef: { bits: 2, tables: [2, 1, 27] },
+    HasConstant: { bits: 2, tables: [4, 8, 23] },
+    HasCustomAttribute: { bits: 5, tables: [6, 4, 1, 2, 8, 9, 10, 0, 14, 23, 20, 17, 26, 27, 32, 35, 38, 39, 40, 42, 44, 43] },
+    HasFieldMarshal: { bits: 1, tables: [4, 8] },
+    HasDeclSecurity: { bits: 2, tables: [2, 6, 32] },
+    MemberRefParent: { bits: 3, tables: [2, 1, 26, 6, 27] },
+    HasSemantics: { bits: 1, tables: [20, 23] },
+    MethodDefOrRef: { bits: 1, tables: [6, 10] },
+    MemberForwarded: { bits: 1, tables: [4, 6] },
+    Implementation: { bits: 2, tables: [38, 35, 39] },
+    CustomAttributeType: { bits: 3, tables: [6, 10] },
+    ResolutionScope: { bits: 2, tables: [0, 26, 35, 1] },
+    TypeOrMethodDef: { bits: 1, tables: [2, 6] },
+};
+// ECMA-335 II.22 row layouts, indexed by table id.
+const SCHEMA = {
+    0: [2, 'S', 'G', 'G', 'G'],
+    1: ['C:ResolutionScope', 'S', 'S'],
+    2: [4, 'S', 'S', 'C:TypeDefOrRef', 'T:4', 'T:6'],
+    3: ['T:4'],
+    4: [2, 'S', 'B'],
+    5: ['T:6'],
+    6: [4, 2, 2, 'S', 'B', 'T:8'],
+    7: ['T:8'],
+    8: [2, 2, 'S'],
+    9: ['T:2', 'C:TypeDefOrRef'],
+    10: ['C:MemberRefParent', 'S', 'B'],
+    11: [1, 1, 'C:HasConstant', 'B'],
+    12: ['C:HasCustomAttribute', 'C:CustomAttributeType', 'B'],
+    13: ['C:HasFieldMarshal', 'B'],
+    14: [2, 'C:HasDeclSecurity', 'B'],
+    15: [2, 4, 'T:2'],
+    16: [4, 'T:4'],
+    17: ['B'],
+    18: ['T:2', 'T:20'],
+    19: ['T:20'],
+    20: [2, 'S', 'C:TypeDefOrRef'],
+    21: ['T:2', 'T:23'],
+    22: ['T:23'],
+    23: [2, 'S', 'B'],
+    24: [2, 'T:6', 'C:HasSemantics'],
+    25: ['T:2', 'C:MethodDefOrRef', 'C:MethodDefOrRef'],
+    26: ['S'],
+    27: ['B'],
+    28: [2, 'C:MemberForwarded', 'S', 'T:26'],
+    29: [4, 'T:4'],
+    30: [4, 4],
+    31: [4],
+    32: [4, 2, 2, 2, 2, 4, 'B', 'S', 'S'],
+    33: [4],
+    34: [4, 4, 4],
+    35: [2, 2, 2, 2, 4, 'B', 'S', 'S', 'B'],
+    36: [4, 'T:35'],
+    37: [4, 4, 4, 'T:35'],
+    38: [4, 'S', 'B'],
+    39: [4, 4, 'S', 'S', 'C:Implementation'],
+    40: [4, 4, 'S', 'C:Implementation'],
+    41: ['T:2', 'T:2'],
+    42: [2, 2, 'C:TypeOrMethodDef', 'S'],
+    43: ['C:MethodDefOrRef', 'B'],
+    44: ['T:42', 'C:TypeDefOrRef'],
+};
+function emptyInfo() {
+    return {
+        isManaged: false, runtimeVersion: null, assembly: null, assemblyRefs: [], typeCount: 0, types: [],
+        methodCount: 0, pinvokes: [], userStrings: [], entryPointToken: null, warnings: [], truncated: false,
+    };
+}
+function inBounds(b, off, len) {
+    if (!Number.isInteger(off) || !Number.isInteger(len) || off < 0 || len < 0 || off + len > b.length) {
+        throw new RangeError('out-of-bounds metadata range');
+    }
+}
+function readPeLayout(b) {
+    if (b.length < 0x40 || b[0] !== 0x4d || b[1] !== 0x5a)
+        return null;
+    const pe = b.readUInt32LE(0x3c);
+    if (b.toString('latin1', pe, pe + 4) !== 'PE\0\0')
+        return null;
+    const coff = pe + 4;
+    const nSections = Math.min(b.readUInt16LE(coff + 2), 96); // PE format limit
+    const optSize = b.readUInt16LE(coff + 16);
+    const opt = coff + 20;
+    const plus = b.readUInt16LE(opt) === 0x20b;
+    const secs = [];
+    for (let i = 0; i < nSections; i++) {
+        const o = opt + optSize + i * 40;
+        const vsize = b.readUInt32LE(o + 8);
+        secs.push({ va: b.readUInt32LE(o + 12), span: Math.max(vsize, b.readUInt32LE(o + 16)), raw: b.readUInt32LE(o + 20) });
+    }
+    const toOff = (rva) => {
+        const s = secs.find((x) => rva >= x.va && rva < x.va + x.span);
+        if (!s)
+            throw new RangeError('unmapped RVA');
+        return s.raw + (rva - s.va);
+    };
+    const dirBase = opt + (plus ? 112 : 96);
+    return { toOff, clrRva: b.readUInt32LE(dirBase + 14 * 8), clrSize: b.readUInt32LE(dirBase + 14 * 8 + 4) };
+}
+function readCompressedUInt(b, off, end) {
+    if (off >= end)
+        throw new RangeError('compressed int');
+    const first = b[off];
+    if ((first & 0x80) === 0)
+        return { value: first, len: 1 };
+    if ((first & 0xc0) === 0x80) {
+        if (off + 2 > end)
+            throw new RangeError('compressed int');
+        return { value: ((first & 0x3f) << 8) | b[off + 1], len: 2 };
+    }
+    if (off + 4 > end)
+        throw new RangeError('compressed int');
+    return { value: ((first & 0x1f) << 24) | (b[off + 1] << 16) | (b[off + 2] << 8) | b[off + 3], len: 4 };
+}
+function guarded(info, label, fn) {
+    try {
+        fn();
+    }
+    catch (err) {
+        info.warnings.push(`${label}: ${err instanceof RangeError ? err.message : String(err)}`);
+    }
+}
+/** Inspects a managed assembly's metadata. Never throws on hostile input. */
+export function parseDotNet(b) {
+    const info = emptyInfo();
+    try {
+        parseInto(b, info);
+    }
+    catch (err) {
+        info.warnings.push(`metadata parse failed: ${err instanceof RangeError ? err.message : String(err)}`);
+    }
+    return info;
+}
+function parseInto(b, info) {
+    const layout = readPeLayout(b);
+    if (!layout) {
+        info.warnings.push('not a PE file');
+        return;
+    }
+    if (!layout.clrRva)
+        return; // native PE: isManaged stays false
+    info.isManaged = true;
+    const cor = layout.toOff(layout.clrRva);
+    inBounds(b, cor, 24);
+    info.entryPointToken = b.readUInt32LE(cor + 20) || null;
+    const meta = layout.toOff(b.readUInt32LE(cor + 8));
+    const metaSize = b.readUInt32LE(cor + 12);
+    inBounds(b, meta, Math.min(metaSize, 32));
+    if (b.readUInt32LE(meta) !== 0x424a5342)
+        throw new RangeError('missing BSJB metadata signature');
+    const verLen = b.readUInt32LE(meta + 12);
+    if (verLen > 256)
+        throw new RangeError('implausible version string length');
+    inBounds(b, meta + 16, verLen);
+    info.runtimeVersion = b.toString('latin1', meta + 16, meta + 16 + verLen).replace(/\0+$/, '');
+    const nStreams = b.readUInt16LE(meta + 18 + verLen);
+    const streams = new Map();
+    let p = meta + 20 + verLen;
+    for (let i = 0; i < Math.min(nStreams, 16); i++) {
+        inBounds(b, p, 9);
+        const off = b.readUInt32LE(p);
+        const size = b.readUInt32LE(p + 4);
+        let q = p + 8;
+        while (q < b.length && b[q] !== 0 && q - p < 40)
+            q++;
+        const name = b.toString('latin1', p + 8, q);
+        inBounds(b, meta + off, size);
+        streams.set(name, { off: meta + off, size });
+        p = p + 8 + Math.ceil((q - (p + 8) + 1) / 4) * 4;
+    }
+    const strHeap = streams.get('#Strings');
+    const us = streams.get('#US');
+    const tbl = streams.get('#~') ?? streams.get('#-');
+    if (!tbl || !strHeap)
+        throw new RangeError('missing #~ or #Strings stream');
+    const str = (idx) => {
+        if (idx >= strHeap.size)
+            throw new RangeError('string index out of range');
+        const start = strHeap.off + idx;
+        let end = start;
+        const limit = Math.min(strHeap.off + strHeap.size, start + MAX_STR);
+        while (end < limit && b[end] !== 0)
+            end++;
+        return b.toString('utf8', start, end);
+    };
+    guarded(info, 'tables', () => readTables(b, info, tbl, str));
+    if (us) {
+        guarded(info, 'user strings', () => {
+            const end = us.off + us.size;
+            let o = us.off + 1;
+            while (o < end && info.userStrings.length < MAX_USER_STRINGS) {
+                const { value, len } = readCompressedUInt(b, o, end);
+                o += len;
+                if (value === 0)
+                    continue;
+                if (o + value > end)
+                    break;
+                const text = b.toString('utf16le', o, o + Math.max(0, value - 1));
+                if (text.trim())
+                    info.userStrings.push(text.slice(0, MAX_STR));
+                o += value;
+            }
+            if (o < end)
+                info.truncated = true;
+        });
+    }
+}
+function readTables(b, info, tbl, str) {
+    inBounds(b, tbl.off, 24);
+    const heapSizes = b[tbl.off + 6];
+    const valid = b.readBigUInt64LE(tbl.off + 8);
+    const sIdx = heapSizes & 1 ? 4 : 2;
+    const gIdx = heapSizes & 2 ? 4 : 2;
+    const bIdx = heapSizes & 4 ? 4 : 2;
+    const rows = new Array(64).fill(0);
+    let p = tbl.off + 24;
+    for (let t = 0; t < 64; t++) {
+        if ((valid >> BigInt(t)) & 1n) {
+            inBounds(b, p, 4);
+            rows[t] = b.readUInt32LE(p);
+            p += 4;
+        }
+    }
+    const tableIdx = (t) => (rows[t] < 0x10000 ? 2 : 4);
+    const codedIdx = (name) => {
+        const c = CODED[name];
+        const max = Math.max(...c.tables.map((t) => rows[t]));
+        return max < 2 ** (16 - c.bits) ? 2 : 4;
+    };
+    const tables = {};
+    let off = p;
+    for (let t = 0; t < 64; t++) {
+        if (!rows[t])
+            continue;
+        const schema = SCHEMA[t];
+        if (!schema)
+            throw new RangeError(`unknown metadata table ${t}`);
+        const colSize = schema.map((c) => (typeof c === 'number' ? c : c === 'S' ? sIdx : c === 'G' ? gIdx : c === 'B' ? bIdx : c.startsWith('T:') ? tableIdx(Number(c.slice(2))) : codedIdx(c.slice(2))));
+        const colOff = [];
+        let rowSize = 0;
+        for (const s of colSize) {
+            colOff.push(rowSize);
+            rowSize += s;
+        }
+        tables[t] = { rows: rows[t], rowSize, off, colOff, colSize };
+        off += rows[t] * rowSize;
+        if (off > tbl.off + tbl.size)
+            throw new RangeError('table extents exceed #~ stream');
+    }
+    const cell = (t, row, col) => {
+        const tb = tables[t];
+        const o = tb.off + row * tb.rowSize + tb.colOff[col];
+        const size = tb.colSize[col];
+        return size === 1 ? b[o] : size === 2 ? b.readUInt16LE(o) : b.readUInt32LE(o);
+    };
+    if (tables[32]) {
+        info.assembly = { name: str(cell(32, 0, 7)), version: `${cell(32, 0, 1)}.${cell(32, 0, 2)}.${cell(32, 0, 3)}.${cell(32, 0, 4)}` };
+    }
+    if (tables[35]) {
+        const n = Math.min(tables[35].rows, MAX_LIST);
+        if (n < tables[35].rows)
+            info.truncated = true;
+        for (let i = 0; i < n; i++) {
+            info.assemblyRefs.push({ name: str(cell(35, i, 6)), version: `${cell(35, i, 0)}.${cell(35, i, 1)}.${cell(35, i, 2)}.${cell(35, i, 3)}` });
+        }
+    }
+    if (tables[2]) {
+        info.typeCount = tables[2].rows;
+        const n = Math.min(tables[2].rows, MAX_LIST);
+        if (n < tables[2].rows)
+            info.truncated = true;
+        for (let i = 0; i < n; i++) {
+            const name = str(cell(2, i, 1));
+            const ns = str(cell(2, i, 2));
+            info.types.push(ns ? `${ns}.${name}` : name);
+        }
+    }
+    info.methodCount = tables[6]?.rows ?? 0;
+    if (tables[28] && tables[26]) {
+        const n = Math.min(tables[28].rows, MAX_LIST);
+        if (n < tables[28].rows)
+            info.truncated = true;
+        for (let i = 0; i < n; i++) {
+            const scope = cell(28, i, 3); // 1-based ModuleRef row
+            if (scope < 1 || scope > tables[26].rows)
+                continue;
+            info.pinvokes.push({ module: str(cell(26, scope - 1, 0)), function: str(cell(28, i, 2)) });
+        }
+    }
+}
+//# sourceMappingURL=dotnet-parse.js.map

package/v3/@claude-flow/cli/dist/src/rure/evm-parse.d.ts

@@ -0,0 +1,52 @@
+/**
+ * ruRE Phase 4 — EVM bytecode static inventory (ADR-0005).
+ * Aligned disassembly + pattern scan over bytes. There is no interpreter:
+ * nothing is executed, no RPC, no network.
+ */
+export declare const MAX_EVM_BYTES: number;
+export declare function opcodeName(op: number): string | null;
+export interface EvmInfo {
+    byteLength: number;
+    instructionCount: number;
+    jumpdestCount: number;
+    invalidOpcodeCount: number;
+    selectors: {
+        selector: string;
+        name: string | null;
+        offset: number;
+    }[];
+    hazards: Record<string, {
+        count: number;
+        offsets: number[];
+    }>;
+    addresses: string[];
+    eventTopics: {
+        topic: string;
+        name: string | null;
+        offset: number;
+    }[];
+    minimalProxy: {
+        implementation: string;
+    } | null;
+    metadata: {
+        solc?: string;
+        ipfs?: string;
+        bzzr?: string;
+        experimental?: boolean;
+    } | null;
+    strings: string[];
+    disassembly?: string[];
+    warnings: string[];
+    truncated: boolean;
+}
+export type HexParse = {
+    ok: true;
+    bytes: Buffer;
+} | {
+    ok: false;
+    error: string;
+};
+/** Accepts `0x`-optional hex; rejects odd length, non-hex, empty, and over-cap input. */
+export declare function parseHex(text: string): HexParse;
+export declare function analyzeEvm(b: Buffer, includeDisassembly?: boolean): EvmInfo;
+//# sourceMappingURL=evm-parse.d.ts.map

package/v3/@claude-flow/cli/dist/src/rure/evm-parse.js

@@ -0,0 +1,233 @@
+/**
+ * ruRE Phase 4 — EVM bytecode static inventory (ADR-0005).
+ * Aligned disassembly + pattern scan over bytes. There is no interpreter:
+ * nothing is executed, no RPC, no network.
+ */
+export const MAX_EVM_BYTES = 256 * 1024;
+const MAX_LIST = 200;
+const MAX_OFFSETS = 20;
+const MAX_STRINGS = 100;
+const SIMPLE = {
+    0x00: 'STOP', 0x01: 'ADD', 0x02: 'MUL', 0x03: 'SUB', 0x04: 'DIV', 0x05: 'SDIV', 0x06: 'MOD', 0x07: 'SMOD', 0x08: 'ADDMOD',
+    0x09: 'MULMOD', 0x0a: 'EXP', 0x0b: 'SIGNEXTEND', 0x10: 'LT', 0x11: 'GT', 0x12: 'SLT', 0x13: 'SGT', 0x14: 'EQ', 0x15: 'ISZERO',
+    0x16: 'AND', 0x17: 'OR', 0x18: 'XOR', 0x19: 'NOT', 0x1a: 'BYTE', 0x1b: 'SHL', 0x1c: 'SHR', 0x1d: 'SAR', 0x20: 'KECCAK256',
+    0x30: 'ADDRESS', 0x31: 'BALANCE', 0x32: 'ORIGIN', 0x33: 'CALLER', 0x34: 'CALLVALUE', 0x35: 'CALLDATALOAD', 0x36: 'CALLDATASIZE',
+    0x37: 'CALLDATACOPY', 0x38: 'CODESIZE', 0x39: 'CODECOPY', 0x3a: 'GASPRICE', 0x3b: 'EXTCODESIZE', 0x3c: 'EXTCODECOPY',
+    0x3d: 'RETURNDATASIZE', 0x3e: 'RETURNDATACOPY', 0x3f: 'EXTCODEHASH', 0x40: 'BLOCKHASH', 0x41: 'COINBASE', 0x42: 'TIMESTAMP',
+    0x43: 'NUMBER', 0x44: 'PREVRANDAO', 0x45: 'GASLIMIT', 0x46: 'CHAINID', 0x47: 'SELFBALANCE', 0x48: 'BASEFEE', 0x49: 'BLOBHASH',
+    0x4a: 'BLOBBASEFEE', 0x50: 'POP', 0x51: 'MLOAD', 0x52: 'MSTORE', 0x53: 'MSTORE8', 0x54: 'SLOAD', 0x55: 'SSTORE', 0x56: 'JUMP',
+    0x57: 'JUMPI', 0x58: 'PC', 0x59: 'MSIZE', 0x5a: 'GAS', 0x5b: 'JUMPDEST', 0x5c: 'TLOAD', 0x5d: 'TSTORE', 0x5e: 'MCOPY', 0x5f: 'PUSH0',
+    0xf0: 'CREATE', 0xf1: 'CALL', 0xf2: 'CALLCODE', 0xf3: 'RETURN', 0xf4: 'DELEGATECALL', 0xf5: 'CREATE2', 0xfa: 'STATICCALL',
+    0xfd: 'REVERT', 0xfe: 'INVALID', 0xff: 'SELFDESTRUCT',
+};
+export function opcodeName(op) {
+    if (SIMPLE[op])
+        return SIMPLE[op];
+    if (op >= 0x60 && op <= 0x7f)
+        return `PUSH${op - 0x5f}`;
+    if (op >= 0x80 && op <= 0x8f)
+        return `DUP${op - 0x7f}`;
+    if (op >= 0x90 && op <= 0x9f)
+        return `SWAP${op - 0x8f}`;
+    if (op >= 0xa0 && op <= 0xa4)
+        return `LOG${op - 0xa0}`;
+    return null;
+}
+const HAZARDS = {
+    0xff: 'SELFDESTRUCT', 0xf4: 'DELEGATECALL', 0xf2: 'CALLCODE', 0xf0: 'CREATE', 0xf5: 'CREATE2', 0x32: 'ORIGIN',
+    0xf1: 'CALL', 0xfa: 'STATICCALL',
+};
+const KNOWN_SELECTORS = {
+    '0xa9059cbb': 'transfer(address,uint256)', '0x70a08231': 'balanceOf(address)', '0x23b872dd': 'transferFrom(address,address,uint256)',
+    '0x095ea7b3': 'approve(address,uint256)', '0xdd62ed3e': 'allowance(address,address)', '0x18160ddd': 'totalSupply()',
+    '0x06fdde03': 'name()', '0x95d89b41': 'symbol()', '0x313ce567': 'decimals()', '0x8da5cb5b': 'owner()',
+    '0xf2fde38b': 'transferOwnership(address)', '0x715018a6': 'renounceOwnership()', '0x3659cfe6': 'upgradeTo(address)',
+    '0x5c60da1b': 'implementation()', '0x01ffc9a7': 'supportsInterface(bytes4)', '0x42842e0e': 'safeTransferFrom(address,address,uint256)',
+    '0x6352211e': 'ownerOf(uint256)', '0x40c10f19': 'mint(address,uint256)', '0x42966c68': 'burn(uint256)',
+    '0x8456cb59': 'pause()', '0x3f4ba83a': 'unpause()',
+};
+const KNOWN_TOPICS = {
+    '0xddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a4df523b3ef': 'Transfer(address,address,uint256)',
+    '0x8c5be1e5ebec7d5bd14f71427d1e84f3dd0314c0f7b2291e5b200ac8c7c3b925': 'Approval(address,address,uint256)',
+};
+/** Accepts `0x`-optional hex; rejects odd length, non-hex, empty, and over-cap input. */
+export function parseHex(text) {
+    const t = text.trim().replace(/^0x/i, '');
+    if (!t)
+        return { ok: false, error: 'empty bytecode' };
+    if (t.length % 2 !== 0)
+        return { ok: false, error: 'odd number of hex digits' };
+    if (t.length / 2 > MAX_EVM_BYTES)
+        return { ok: false, error: `bytecode exceeds the ${MAX_EVM_BYTES}-byte cap` };
+    if (!/^[0-9a-fA-F]+$/.test(t))
+        return { ok: false, error: 'not hexadecimal' };
+    return { ok: true, bytes: Buffer.from(t, 'hex') };
+}
+function hex(b, start, end) {
+    return '0x' + b.toString('hex', start, end);
+}
+function parseMetadata(b) {
+    if (b.length < 4)
+        return null;
+    const len = (b[b.length - 2] << 8) | b[b.length - 1];
+    const start = b.length - 2 - len;
+    if (len < 3 || len > 128 || start < 0)
+        return null;
+    const end = b.length - 2;
+    let o = start;
+    if ((b[o] & 0xe0) !== 0xa0)
+        return null;
+    const pairs = b[o] & 0x1f;
+    o += 1;
+    const out = {};
+    for (let i = 0; i < pairs; i++) {
+        if (o >= end || (b[o] & 0xe0) !== 0x60)
+            return null;
+        const klen = b[o] & 0x1f;
+        if (klen >= 24 || o + 1 + klen > end)
+            return null;
+        const key = b.toString('latin1', o + 1, o + 1 + klen);
+        o += 1 + klen;
+        if (o >= end)
+            return null;
+        const head = b[o];
+        if (head === 0xf5 || head === 0xf4) {
+            if (key === 'experimental')
+                out.experimental = head === 0xf5;
+            o += 1;
+        }
+        else if ((head & 0xe0) === 0x40) {
+            let vlen = head & 0x1f;
+            let vo = o + 1;
+            if (vlen === 24) {
+                vlen = b[vo];
+                vo += 1;
+            }
+            else if (vlen > 24)
+                return null;
+            if (vo + vlen > end)
+                return null;
+            if (key === 'solc' && vlen === 3)
+                out.solc = `${b[vo]}.${b[vo + 1]}.${b[vo + 2]}`;
+            else if (key === 'ipfs')
+                out.ipfs = b.toString('hex', vo, vo + vlen);
+            else if (key.startsWith('bzzr'))
+                out.bzzr = b.toString('hex', vo, vo + vlen);
+            o = vo + vlen;
+        }
+        else
+            return null;
+    }
+    return o === end && (out.solc || out.ipfs || out.bzzr) ? out : null;
+}
+const EIP1167_PREFIX = Buffer.from('363d3d373d3d3d363d73', 'hex');
+const EIP1167_SUFFIX = Buffer.from('5af43d82803e903d91602b57fd5bf3', 'hex');
+function detectMinimalProxy(b) {
+    if (b.length < 45 || !b.subarray(0, 10).equals(EIP1167_PREFIX) || !b.subarray(30, 45).equals(EIP1167_SUFFIX))
+        return null;
+    return { implementation: hex(b, 10, 30) };
+}
+/** Aligned disassembly: PUSH immediates are data, never opcodes. Truncated trailing PUSH data is clamped. */
+function disassemble(b) {
+    const out = [];
+    for (let i = 0; i < b.length;) {
+        const op = b[i];
+        const n = op >= 0x60 && op <= 0x7f ? op - 0x5f : 0;
+        out.push({ off: i, op, dataStart: i + 1, dataLen: Math.min(n, b.length - i - 1) });
+        i += 1 + n;
+    }
+    return out;
+}
+export function analyzeEvm(b, includeDisassembly = false) {
+    const info = {
+        byteLength: b.length, instructionCount: 0, jumpdestCount: 0, invalidOpcodeCount: 0, selectors: [], hazards: {},
+        addresses: [], eventTopics: [], minimalProxy: null, metadata: null, strings: [], warnings: [], truncated: false,
+    };
+    if (b.length > MAX_EVM_BYTES) {
+        info.warnings.push(`bytecode exceeds the ${MAX_EVM_BYTES}-byte cap; nothing analyzed`);
+        return info;
+    }
+    info.minimalProxy = detectMinimalProxy(b);
+    info.metadata = parseMetadata(b);
+    const ins = disassemble(b);
+    info.instructionCount = ins.length;
+    const addrSeen = new Set();
+    const strSeen = new Set();
+    const seenSel = new Set();
+    if (includeDisassembly) {
+        info.disassembly = ins.slice(0, 500).map((x) => {
+            const name = opcodeName(x.op) ?? `UNKNOWN(0x${x.op.toString(16)})`;
+            return x.dataLen ? `${x.off} ${name} ${hex(b, x.dataStart, x.dataStart + x.dataLen)}` : `${x.off} ${name}`;
+        });
+        if (ins.length > 500)
+            info.truncated = true;
+    }
+    for (let k = 0; k < ins.length; k++) {
+        const x = ins[k];
+        if (x.op === 0x5b)
+            info.jumpdestCount += 1;
+        if (opcodeName(x.op) === null)
+            info.invalidOpcodeCount += 1;
+        const hazard = HAZARDS[x.op];
+        if (hazard) {
+            const h = (info.hazards[hazard] ??= { count: 0, offsets: [] });
+            h.count += 1;
+            if (h.offsets.length < MAX_OFFSETS)
+                h.offsets.push(x.off);
+        }
+        if (x.op === 0x63 && x.dataLen === 4) {
+            const next = ins[k + 1];
+            const after = ins[k + 2];
+            const isEq = next?.op === 0x14 || (next?.op === 0x81 && after?.op === 0x14);
+            const sel = hex(b, x.dataStart, x.dataStart + 4);
+            if (isEq && !seenSel.has(sel)) {
+                seenSel.add(sel);
+                if (info.selectors.length < MAX_LIST)
+                    info.selectors.push({ selector: sel, name: KNOWN_SELECTORS[sel] ?? null, offset: x.off });
+                else
+                    info.truncated = true;
+            }
+        }
+        if (x.op === 0x73 && x.dataLen === 20) {
+            const a = hex(b, x.dataStart, x.dataStart + 20);
+            const nonTrivial = /[1-9a-f]/.test(a.slice(2)) && !/^0x(f{40})$/.test(a);
+            if (nonTrivial && !addrSeen.has(a)) {
+                addrSeen.add(a);
+                if (info.addresses.length < MAX_LIST)
+                    info.addresses.push(a);
+                else
+                    info.truncated = true;
+            }
+        }
+        if (x.op >= 0xa1 && x.op <= 0xa4) {
+            for (let j = k - 1; j >= Math.max(0, k - 12); j--) {
+                if (ins[j].op === 0x7f && ins[j].dataLen === 32) {
+                    const topic = hex(b, ins[j].dataStart, ins[j].dataStart + 32);
+                    if (!info.eventTopics.some((t) => t.topic === topic) && info.eventTopics.length < MAX_LIST) {
+                        info.eventTopics.push({ topic, name: KNOWN_TOPICS[topic] ?? null, offset: x.off });
+                    }
+                    break;
+                }
+            }
+        }
+        if (x.op >= 0x60 && x.op <= 0x7f && x.dataLen >= 8) {
+            const raw = b.subarray(x.dataStart, x.dataStart + x.dataLen);
+            let end = raw.length;
+            while (end > 0 && raw[end - 1] === 0)
+                end--;
+            let start = 0;
+            while (start < end && raw[start] === 0)
+                start++;
+            const text = raw.subarray(start, end);
+            if (text.length >= 8 && text.every((c) => c >= 0x20 && c < 0x7f)) {
+                const s = text.toString('latin1');
+                if (!strSeen.has(s) && info.strings.length < MAX_STRINGS) {
+                    strSeen.add(s);
+                    info.strings.push(s);
+                }
+            }
+        }
+    }
+    return info;
+}
+//# sourceMappingURL=evm-parse.js.map

package/v3/@claude-flow/cli/dist/src/rure/extract-asar.d.ts

@@ -0,0 +1,33 @@
+/**
+ * ruRE Phase 1 — ASAR extraction with resource caps (ADR-0002).
+ *
+ * @electron/asar already guards path traversal internally
+ * (lib/path-validation.ts's ensureWithin); this module adds the
+ * decompression-bomb guard ADR-0002 requires, by reading the archive header
+ * (no extraction) and summing declared sizes BEFORE calling extractAll.
+ *
+ * ruRE never writes into a path derived from archive entry names — the
+ * destination is always a ruRE-owned scratch directory.
+ */
+export interface AsarExtractLimits {
+    /** Maximum total declared uncompressed size, in bytes. */
+    maxTotalBytes: number;
+    /** Maximum number of files. */
+    maxFileCount: number;
+}
+export declare const DEFAULT_ASAR_LIMITS: AsarExtractLimits;
+export interface AsarExtractResult {
+    unpackedPath: string;
+    fileCount: number;
+    totalBytes: number;
+    truncated: boolean;
+    reason?: string;
+}
+/**
+ * Extracts an .asar archive to a fresh ruRE-owned scratch directory, after
+ * verifying the archive's declared size/file-count against `limits`. Never
+ * extracts (even partially) when the pre-check fails — `truncated: true`
+ * with no files written, not a partial extraction passed off as complete.
+ */
+export declare function extractAsarWithCaps(archivePath: string, limits?: AsarExtractLimits): Promise<AsarExtractResult>;
+//# sourceMappingURL=extract-asar.d.ts.map