rea-agents 1.7.0 → 2.1.0

package/dist/ghidra/GhidraProviderCapabilities.js

@@ -0,0 +1,173 @@
+import { ENHANCED_TOOL_CONTRACTS, OFFICIAL_TOOL_CONTRACTS, } from "../contracts/toolContracts.js";
+import { GHIDRA_DECOMPILE_REQUEST_TIMEOUT_MS, GHIDRA_MAX_LINE_BYTES, GHIDRA_REQUEST_TIMEOUT_MS, } from "./GhidraDefaults.js";
+import { GHIDRA_FUNCTION_OPERATIONS } from "./GhidraFunctionValues.js";
+import { GHIDRA_INVENTORY_OPERATIONS } from "./GhidraInventoryValues.js";
+/** Public identity committed by every Ghidra-backed observation. */
+export const GHIDRA_PROVIDER_IDENTITY = Object.freeze({
+    id: "ghidra",
+    name: "Ghidra",
+    version: null,
+});
+const providerContractByName = new Map([...OFFICIAL_TOOL_CONTRACTS, ...ENHANCED_TOOL_CONTRACTS].map((contract) => [
+    contract.name,
+    contract,
+]));
+/** Provider-neutral read-only contracts implemented by the Ghidra adapter. */
+export const GHIDRA_PROVIDER_TOOL_CONTRACTS = Object.freeze([...GHIDRA_INVENTORY_OPERATIONS, ...GHIDRA_FUNCTION_OPERATIONS].map((operation) => {
+    const contract = providerContractByName.get(operation);
+    if (contract === undefined)
+        throw new TypeError(`Missing provider-neutral contract for ${operation}`);
+    return contract;
+}));
+const PAGINATED_OPERATIONS = new Set([
+    "list_names",
+    "list_procedures",
+    "list_strings",
+    "search_procedures",
+    "search_strings",
+    "procedure_references",
+    "analyze_function",
+]);
+const SEARCH_OPERATIONS = new Set([
+    "search_procedures",
+    "search_strings",
+]);
+const DECOMPILE_OPERATIONS = new Set([
+    "procedure_pseudo_code",
+    "analyze_function",
+]);
+/** Health limitations shared by every Ghidra-backed capability. */
+export const healthLimitations = Object.freeze([
+    "The session serves operations only after default Ghidra auto-analysis completes; an analysis timeout fails the open instead of exposing partial results.",
+    "The imported Program and temporary project are ephemeral, read-only to REA, and deleted on close.",
+]);
+/** Additional limitations applied to the experimental Windows x64 P0 boundary. */
+export const windowsP0Limitations = Object.freeze([
+    "Windows Ghidra P0 accepts approved native x86-64 PE applications only; DLL, managed, hostile, sensitive, and mutable-path targets are unsupported.",
+    "The Windows bridge uses authenticated IPv4 loopback because Node path-based IPC does not expose Java AF_UNIX sockets; the endpoint file contains no bearer token.",
+    "Windows P0 process-tree cleanup uses bounded taskkill termination and does not claim Job Object ownership, private DACL enforcement, or reparse-point-safe path authority.",
+]);
+/** Limitation text for one admitted operation, including the common base. */
+export const limitationsFor = (operation) => {
+    const common = [
+        ...healthLimitations,
+        "Default-space addresses use lowercase 0x-prefixed hexadecimal; other address spaces use <percent-encoded-space>:0x<hex>.",
+    ];
+    switch (operation) {
+        case "list_documents":
+            return [
+                ...common,
+                "A headless Ghidra session contains exactly one imported Program, unlike Hopper's multi-document GUI session.",
+            ];
+        case "list_names":
+            return [
+                ...common,
+                "The symbol inventory includes memory and external symbols, including dynamic symbols, but excludes variable and no-address namespace records.",
+            ];
+        case "list_procedures":
+        case "procedure_address":
+            return [
+                ...common,
+                "External functions and local thunks are distinct; procedure metadata identifies both and preserves a thunk target when Ghidra resolves one.",
+            ];
+        case "list_strings":
+            return [
+                ...common,
+                "Only Ghidra-defined string Data is observed; charset is reported, while a non-missing terminator cannot distinguish a present terminator from a fixed or Pascal layout.",
+                "Returned values are bounded to 1,024 Unicode code points and mark value_truncated instead of silently crossing the wire budget.",
+            ];
+        case "list_segments":
+            return [
+                ...common,
+                "Memory-block end addresses are exclusive; permissions come from Ghidra MemoryBlock flags rather than inference from section names.",
+            ];
+        case "search_procedures":
+        case "search_strings":
+            return [
+                ...common,
+                "Literal search enforces 1,000,000 cumulative work units; regex mode also accepts only a conservative finite Java-regex subset with 10,000 static paths and 4,096 UTF-16 code units per candidate.",
+            ];
+        case "procedure_pseudo_code":
+            return [
+                ...common,
+                "Pseudocode is Ghidra decompiler output, not original source and not text-equivalent to Hopper output; each decompile has a 30-second native deadline.",
+                "External functions and functions without an analyzable body return null; other decompiler failures remain explicit.",
+            ];
+        case "procedure_assembly":
+            return [
+                ...common,
+                "Assembly is Ghidra Listing text and fails rather than silently truncating when the 100,000-instruction or 1 MiB wire bound is exceeded.",
+            ];
+        case "procedure_callers":
+        case "procedure_callees":
+            return [
+                ...common,
+                "Only resolved Ghidra call references are returned; unresolved computed or indirect calls remain unknown, while function classifications distinguish thunks and externals.",
+            ];
+        case "xrefs":
+            return [
+                ...common,
+                "The direct address list projects exact Ghidra references to one address but does not expose their kinds; procedure_references and analyze_function preserve available kind metadata.",
+                "Synthetic Ghidra entry-point references without actionable memory sources are omitted.",
+            ];
+        case "procedure_references":
+            return [
+                ...common,
+                "Reference kinds are direct Ghidra ReferenceManager observations; unresolved computed flows without a target are absent and remain unknown.",
+                "Synthetic Ghidra entry-point references without actionable memory sources are omitted.",
+                "Instruction scans stop at max_instructions; a truncated scan reports an unknown total and no false continuation.",
+            ];
+        case "analyze_function":
+            return [
+                ...common,
+                "The dossier combines Ghidra FunctionManager, Listing, ReferenceManager, BasicBlockModel, and decompiler observations; provider-specific pseudocode and assembly are not cross-provider text invariants.",
+                "Resolved reference metadata identifies computed, indirect, external, call, jump, and data edges; unresolved targetless flows remain unknown, and function classifications distinguish thunks and externals.",
+                "Synthetic Ghidra entry-point references without actionable memory sources are omitted.",
+                "The Java bridge serializes one function request per Program through a bounded 32-request queue and applies a 30-second native decompilation deadline.",
+            ];
+        default:
+            return common;
+    }
+};
+/** Provider-neutral capabilities advertised by every non-Windows Ghidra session. */
+export const CAPABILITIES = Object.freeze(GHIDRA_PROVIDER_TOOL_CONTRACTS.map((contract) => Object.freeze({
+    provider: GHIDRA_PROVIDER_IDENTITY,
+    operation: contract.name,
+    inputContractVersion: 1,
+    outputContractVersion: 1,
+    available: true,
+    reason: null,
+    pagination: PAGINATED_OPERATIONS.has(contract.name)
+        ? "offset"
+        : "none",
+    exhaustive: !PAGINATED_OPERATIONS.has(contract.name),
+    effects: Object.freeze({
+        mutatesArtifact: false,
+        launchesProcess: true,
+        mayShowUi: false,
+        mayAccessNetwork: false,
+        mayWriteFilesystem: true,
+        changesPermissions: false,
+        requiresRoot: false,
+    }),
+    limits: Object.freeze({
+        maxResults: PAGINATED_OPERATIONS.has(contract.name)
+            ? SEARCH_OPERATIONS.has(contract.name)
+                ? 100
+                : 500
+            : null,
+        maxPayloadBytes: GHIDRA_MAX_LINE_BYTES,
+        timeoutMs: DECOMPILE_OPERATIONS.has(contract.name)
+            ? GHIDRA_DECOMPILE_REQUEST_TIMEOUT_MS
+            : GHIDRA_REQUEST_TIMEOUT_MS,
+    }),
+    limitations: Object.freeze(limitationsFor(contract.name)),
+})));
+/** Capabilities advertised for the experimental Windows x64 P0 boundary. */
+export const WINDOWS_P0_CAPABILITIES = Object.freeze(CAPABILITIES.map((capability) => Object.freeze({
+    ...capability,
+    limitations: Object.freeze([
+        ...capability.limitations,
+        ...windowsP0Limitations,
+    ]),
+})));

package/dist/ghidra/GhidraSessionValues.js

@@ -36,6 +36,7 @@ const sessionInfoSchema = z
         compiler_spec_id: z.string().min(1),
         image_base: z.string().regex(/^0x[0-9a-f]+$/u),
         default_address_space: z.string().min(1),
+        sha256: z.string().regex(/^[a-f0-9]{64}$/u),
     })
         .strict(),
 })
@@ -47,6 +48,7 @@ export const parseGhidraSessionInfo = (value, expected) => {
         parsed.data.run_id !== expected.runId ||
         parsed.data.provider.version !== expected.providerVersion ||
         parsed.data.profile_digest !== expected.profileDigest ||
+        parsed.data.target.sha256 !== expected.targetSha256 ||
         new Set(parsed.data.capabilities).size !==
             GHIDRA_SESSION_CAPABILITIES.length ||
         GHIDRA_SESSION_CAPABILITIES.some((capability) => !parsed.data.capabilities.includes(capability)) ||

package/dist/ghidra/GhidraSocketConnection.js

@@ -1,8 +1,9 @@
 import { createConnection } from "node:net";
 import { err, ok } from "../domain/result.js";
-import { GhidraSessionError } from "./GhidraSessionError.js";
+import { GhidraSessionError, } from "./GhidraSessionError.js";
+import { observeGhidraEndpoint, } from "./GhidraTransport.js";
 /** Attach decoded bridge listeners and return an idempotent detach callback. */
-export const attachGhidraSocket = (socket, handlers) => {
+const attachGhidraSocket = (socket, handlers) => {
     socket.setEncoding("utf8");
     socket.on("data", handlers.data);
     socket.on("error", handlers.error);
@@ -13,9 +14,40 @@ export const attachGhidraSocket = (socket, handlers) => {
         socket.off("close", handlers.close);
     };
 };
-/** Open one abort-aware Ghidra Unix-socket connection attempt. */
-export const connectGhidraSocketOnce = (socketPath, signal) => new Promise((resolve) => {
-    const socket = createConnection(socketPath);
+/** Poll the endpoint and attach the first ready bridge socket. */
+export const connectGhidraSocket = async (options) => {
+    while (options.deadline.remainingMs() > 0) {
+        if (options.deadline.signal.aborted)
+            return err(interruptionFailure(options));
+        if (options.isClosed())
+            return err(options.failure("cancelled", "Ghidra startup was closed"));
+        if (options.processExited())
+            return err(options.failure("process", "Ghidra exited before bridge startup"));
+        const observed = await observeGhidraEndpoint(options.endpoint);
+        if (!observed.ok)
+            return observed;
+        if (observed.value === null) {
+            if ((await options.deadline.wait(50)) === "aborted")
+                return err(interruptionFailure(options));
+            continue;
+        }
+        const connected = await connectGhidraSocketOnce(observed.value, options.deadline.signal);
+        if (connected.ok) {
+            const detach = attachGhidraSocket(connected.value, options.handlers);
+            return ok({ socket: connected.value, detach });
+        }
+        if ((await options.deadline.wait(50)) === "aborted")
+            return err(interruptionFailure(options));
+    }
+    return err(options.failure("timeout", "Ghidra startup deadline elapsed", undefined, {
+        timeoutMs: options.startupTimeoutMs,
+    }));
+};
+/** Open one abort-aware connection to an observed local Ghidra endpoint. */
+const connectGhidraSocketOnce = (target, signal) => new Promise((resolve) => {
+    const socket = "path" in target
+        ? createConnection(target.path)
+        : createConnection({ host: target.host, port: target.port });
     const detach = () => {
         socket.off("connect", onConnect);
         socket.off("error", onError);
@@ -29,14 +61,14 @@ export const connectGhidraSocketOnce = (socketPath, signal) => new Promise((reso
         detach();
         socket.destroy();
         resolve(err(new GhidraSessionError("start", "Ghidra bridge connection failed", {
-            socket_path: socketPath,
+            endpoint: target,
             error: cause.message,
         })));
     };
     const onAbort = () => {
         detach();
         socket.destroy();
-        resolve(err(new GhidraSessionError("cancelled", "Ghidra bridge connection was cancelled", { socket_path: socketPath })));
+        resolve(err(new GhidraSessionError("cancelled", "Ghidra bridge connection was cancelled", { endpoint: target })));
     };
     socket.once("connect", onConnect);
     socket.once("error", onError);
@@ -44,3 +76,8 @@ export const connectGhidraSocketOnce = (socketPath, signal) => new Promise((reso
     if (signal.aborted)
         onAbort();
 });
+const interruptionFailure = (options) => options.deadline.cancelled
+    ? options.failure("cancelled", "Ghidra startup was cancelled")
+    : options.failure("timeout", "Ghidra startup deadline elapsed", undefined, {
+        timeoutMs: options.startupTimeoutMs,
+    });

package/dist/ghidra/GhidraTargetSnapshot.js

@@ -0,0 +1,30 @@
+import { createHash } from "node:crypto";
+import { constants, createReadStream } from "node:fs";
+import { chmod, copyFile, rm } from "node:fs/promises";
+import { extname, join } from "node:path";
+/** Copy one target and require its bytes to match the parsed target identity. */
+export const createGhidraTargetSnapshot = async (sourcePath, runtimeRoot, expectedSha256) => {
+    if (!/^[a-f0-9]{64}$/u.test(expectedSha256))
+        throw new TypeError("Ghidra target SHA-256 commitment is invalid");
+    const suffix = safeExtension(sourcePath);
+    const snapshotPath = join(runtimeRoot, `target-${expectedSha256.slice(0, 12)}${suffix}`);
+    try {
+        await copyFile(sourcePath, snapshotPath, constants.COPYFILE_EXCL);
+        await chmod(snapshotPath, 0o600);
+        const hash = createHash("sha256");
+        for await (const chunk of createReadStream(snapshotPath))
+            hash.update(chunk);
+        const observedSha256 = hash.digest("hex");
+        if (observedSha256 !== expectedSha256)
+            throw new Error(`Ghidra target snapshot digest mismatch: expected ${expectedSha256}, observed ${observedSha256}`);
+        return { path: snapshotPath, sha256: observedSha256 };
+    }
+    catch (cause) {
+        await rm(snapshotPath, { force: true }).catch(() => undefined);
+        throw cause;
+    }
+};
+const safeExtension = (path) => {
+    const extension = extname(path);
+    return /^\.[A-Za-z0-9]{1,12}$/u.test(extension) ? extension : ".bin";
+};

package/dist/ghidra/GhidraTransport.js

@@ -0,0 +1,71 @@
+import { access, open } from "node:fs/promises";
+import { err, ok } from "../domain/result.js";
+import { GhidraSessionError } from "./GhidraSessionError.js";
+const MAX_ENDPOINT_BYTES = 1024;
+/** Observe a ready endpoint, returning null while its bridge is not listening. */
+export const observeGhidraEndpoint = async (endpoint) => {
+    if (endpoint.transport === "unix-socket") {
+        try {
+            await access(endpoint.path);
+            return ok({ path: endpoint.path });
+        }
+        catch (cause) {
+            return isMissing(cause)
+                ? ok(null)
+                : err(endpointFailure(endpoint, "Ghidra socket observation failed", cause));
+        }
+    }
+    let handle;
+    try {
+        handle = await open(endpoint.path, "r");
+    }
+    catch (cause) {
+        return isMissing(cause)
+            ? ok(null)
+            : err(endpointFailure(endpoint, "Ghidra endpoint observation failed", cause));
+    }
+    try {
+        const bytes = Buffer.alloc(MAX_ENDPOINT_BYTES + 1);
+        const observed = await handle.read(bytes, 0, bytes.length, 0);
+        if (observed.bytesRead === 0 || observed.bytesRead > MAX_ENDPOINT_BYTES)
+            return err(endpointFailure(endpoint, "Ghidra TCP endpoint is invalid"));
+        return parseTcpEndpoint(endpoint, bytes.subarray(0, observed.bytesRead).toString("utf8"));
+    }
+    catch (cause) {
+        return err(endpointFailure(endpoint, "Ghidra endpoint read failed", cause));
+    }
+    finally {
+        await handle.close();
+    }
+};
+const parseTcpEndpoint = (endpoint, encoded) => {
+    try {
+        const value = JSON.parse(encoded);
+        if (typeof value !== "object" ||
+            value === null ||
+            Array.isArray(value) ||
+            !hasExactKeys(value, ["host", "port", "schema_version"]) ||
+            value.schema_version !== 1 ||
+            value.host !== "127.0.0.1" ||
+            !Number.isSafeInteger(value.port) ||
+            typeof value.port !== "number" ||
+            value.port < 1 ||
+            value.port > 65_535)
+            return err(endpointFailure(endpoint, "Ghidra TCP endpoint is invalid"));
+        return ok({ host: "127.0.0.1", port: value.port });
+    }
+    catch (cause) {
+        return err(endpointFailure(endpoint, "Ghidra TCP endpoint is invalid", cause));
+    }
+};
+const hasExactKeys = (value, expected) => {
+    const keys = Object.keys(value).sort((left, right) => left.localeCompare(right));
+    return (keys.length === expected.length &&
+        keys.every((key, index) => key === expected[index]));
+};
+const endpointFailure = (endpoint, message, cause) => new GhidraSessionError("start", message, {
+    transport: endpoint.transport,
+    endpoint_path: endpoint.path,
+    ...(cause instanceof Error ? { error: cause.message } : {}),
+}, cause instanceof Error ? { cause } : undefined);
+const isMissing = (cause) => cause instanceof Error && "code" in cause && cause.code === "ENOENT";

package/dist/identity.js

@@ -6,11 +6,12 @@
 export const PRODUCT_IDENTITY = {
     displayName: "REA",
     packageName: PACKAGE_METADATA.name,
+    packageSpecifier: `${PACKAGE_METADATA.name}@latest`,
     packageVersion: PACKAGE_METADATA.version,
     cliBinary: "rea",
-    mcpCommand: "npx -y rea-agents mcp",
+    mcpCommand: `npx -y ${PACKAGE_METADATA.name}@latest mcp`,
     mcpServerKey: "rea",
-    skillName: "rea-analysis",
+    skillName: "reverse-engineer-anything",
     skillVersion: PACKAGE_METADATA.skillVersion,
     configFileName: "rea.json",
 };

package/dist/main/messages.js

@@ -0,0 +1,5 @@
+export const MCP_CONNECTION_LOST = "REA lost its MCP client connection. Restart REA from your MCP client.";
+export const MCP_CONNECTION_START_FAILED = "REA could not start its MCP connection. Restart REA from your MCP client; run `rea doctor` if it fails again.";
+export const MCP_SHUTDOWN_FAILED = "REA could not close cleanly. End the REA process before starting it again.";
+export const MCP_PERMISSION_RELOAD_FAILED = "Reloaded permission policy failed unexpectedly";
+export const SERVER_START_FAILED = "REA could not start. Run `rea doctor`, then restart REA from your MCP client.";

package/dist/main/reload.js

@@ -0,0 +1,49 @@
+import { parseConfig } from "../config.js";
+import { readProjectPermissionStore } from "../application/ProjectPermissionStore.js";
+import { MCP_PERMISSION_RELOAD_FAILED } from "./messages.js";
+export const registerConfigReload = (input) => {
+    const { dependencies, permissionAuthority, runtimeState, liveServers, serverLogger, } = input;
+    let reloadQueue = Promise.resolve();
+    return (dependencies.registerReload?.(() => {
+        const refreshed = parseConfig(dependencies.env);
+        if (!refreshed.ok) {
+            serverLogger.error("Reloaded permission policy is invalid");
+            return;
+        }
+        reloadQueue = reloadQueue
+            .then(async () => {
+            let projectGrants = [];
+            if (refreshed.value.permissionProjectRoot !== undefined &&
+                refreshed.value.permissionProjectStore !== undefined) {
+                const project = await (dependencies.readProjectPermissionStore ??
+                    readProjectPermissionStore)(refreshed.value.permissionProjectStore, refreshed.value.permissionProjectRoot);
+                if (!project.ok) {
+                    serverLogger.error("Reloaded project grants could not be read");
+                    return;
+                }
+                projectGrants = project.value?.grants ?? [];
+            }
+            const reloaded = await permissionAuthority.replaceConfiguredPolicy({
+                ceilings: refreshed.value.permissionCeilings,
+                administratorGrants: refreshed.value.administratorPermissionGrants,
+                projectGrants,
+            });
+            if (!reloaded.ok) {
+                serverLogger.error("Reloaded permission policy could not be applied");
+                return;
+            }
+            runtimeState.currentConfig = refreshed.value;
+            Object.assign(runtimeState.processPolicy, refreshed.value.processExecutionPolicy);
+            Object.assign(runtimeState.evidencePolicy, refreshed.value.evidenceFilePolicy);
+            Object.assign(runtimeState.snapshotPolicy, refreshed.value.analysisSnapshotFilePolicy);
+            runtimeState.investigationRoots.splice(0, runtimeState.investigationRoots.length, ...refreshed.value.investigationInputRoots);
+            Object.assign(runtimeState.javascriptReplayPolicy, refreshed.value.javascriptReplayPolicy);
+            Object.assign(runtimeState.managedRuntimePolicy, refreshed.value.managedRuntimePolicy);
+            for (const server of liveServers)
+                server.sendToolListChanged();
+        })
+            .catch(() => {
+            serverLogger.error(MCP_PERMISSION_RELOAD_FAILED);
+        });
+    }) ?? (() => undefined));
+};

package/dist/main/shutdown.js

@@ -0,0 +1,25 @@
+import { MCP_SHUTDOWN_FAILED } from "./messages.js";
+export const createShutdown = (input) => {
+    const { handle, session, permissionAuthority, unregisterReload, dependencies, serverLogger, } = input;
+    let shutdownPromise;
+    let unregisterShutdown = () => undefined;
+    const shutdown = async () => {
+        shutdownPromise ??= (async () => {
+            unregisterReload();
+            unregisterShutdown();
+            await handle.close();
+            await session.close();
+            permissionAuthority.clearSessionGrants();
+        })();
+        return shutdownPromise;
+    };
+    const requestShutdown = () => {
+        shutdown().catch(() => {
+            dependencies.setExitCode(1);
+            serverLogger.error(MCP_SHUTDOWN_FAILED);
+            dependencies.writeStderr(`${MCP_SHUTDOWN_FAILED}\n`);
+        });
+    };
+    unregisterShutdown = dependencies.registerShutdown(requestShutdown);
+    return { shutdown, request: requestShutdown };
+};

package/dist/main/startup.js

@@ -0,0 +1,14 @@
+import { projectAnalysisError } from "../domain/errors.js";
+export const openInitialTarget = async (session, config, serverLogger, writeStderr) => {
+    if (config.hopperTargetPath === undefined)
+        return { ok: true };
+    const opened = await session.open(config.hopperTargetPath, {
+        targetKind: config.hopperTargetKind,
+    });
+    if (opened.ok)
+        return { ok: true };
+    await session.close();
+    serverLogger.error({ errorTag: opened.error._tag }, "Initial target failed to open");
+    writeStderr(`${projectAnalysisError(opened.error).message}\n`);
+    return { ok: false, exitCode: 1 };
+};

package/dist/main/state.js

@@ -0,0 +1,26 @@
+export const createRuntimeState = (config) => ({
+    currentConfig: config,
+    processPolicy: {
+        ...config.processExecutionPolicy,
+        executableRoots: [...config.processExecutionPolicy.executableRoots],
+        workingRoots: [...config.processExecutionPolicy.workingRoots],
+        allowedEnvironment: [...config.processExecutionPolicy.allowedEnvironment],
+    },
+    evidencePolicy: {
+        ...config.evidenceFilePolicy,
+        roots: [...config.evidenceFilePolicy.roots],
+    },
+    snapshotPolicy: {
+        ...config.analysisSnapshotFilePolicy,
+        roots: [...config.analysisSnapshotFilePolicy.roots],
+    },
+    investigationRoots: [...config.investigationInputRoots],
+    javascriptReplayPolicy: {
+        ...config.javascriptReplayPolicy,
+        roots: [...config.javascriptReplayPolicy.roots],
+    },
+    managedRuntimePolicy: {
+        ...config.managedRuntimePolicy,
+        roots: [...config.managedRuntimePolicy.roots],
+    },
+});

package/dist/main/transport.js

@@ -0,0 +1,61 @@
+import { createServer } from "../server/createServer.js";
+import { MCP_CONNECTION_LOST, MCP_CONNECTION_START_FAILED, } from "./messages.js";
+export const startMcpTransport = async (dependencies, session, serverContext) => {
+    const liveServers = new Set();
+    const { serverLogger } = serverContext;
+    let handle;
+    try {
+        handle = dependencies.serve(() => {
+            const server = (dependencies.createServer ?? createServer)(session, session, {
+                logger: serverContext.logger,
+                processPolicy: serverContext.runtimeState.processPolicy,
+                evidenceFilePolicy: serverContext.runtimeState.evidencePolicy,
+                investigationInputRoots: serverContext.runtimeState.investigationRoots,
+                analysisSnapshotFilePolicy: serverContext.runtimeState.snapshotPolicy,
+                permissionAuthority: serverContext.permissionAuthority,
+                browserObservation: serverContext.browserObservation,
+                electronObservation: serverContext.electronObservation,
+                artifactIntegrityContinueEnabled: () => serverContext.runtimeState.currentConfig
+                    .artifactIntegrityContinueEnabled,
+                javascriptReplayPolicy: serverContext.runtimeState.javascriptReplayPolicy,
+                managedRuntimePolicy: serverContext.runtimeState.managedRuntimePolicy,
+                availabilityPolicy: () => ({
+                    processCaptureEnabled: serverContext.runtimeState.currentConfig.processExecutionPolicy
+                        .enabled,
+                    evidenceFileRoots: serverContext.runtimeState.currentConfig.evidenceFilePolicy
+                        .roots.length,
+                    browserObservationEnabled: serverContext.runtimeState.currentConfig
+                        .browserObservationEnabled &&
+                        serverContext.runtimeState.currentConfig.browserCdpEndpoints
+                            .length > 0 &&
+                        serverContext.runtimeState.currentConfig.browserAllowedOrigins
+                            .length > 0,
+                    electronObservationEnabled: serverContext.runtimeState.currentConfig
+                        .electronObservationEnabled &&
+                        serverContext.runtimeState.currentConfig.electronCdpEndpoints
+                            .length > 0 &&
+                        serverContext.runtimeState.currentConfig.electronFileRoots
+                            .length > 0,
+                    javascriptReplayEnabled: serverContext.runtimeState.currentConfig.javascriptReplayPolicy
+                        .enabled,
+                    managedRuntimeEnabled: serverContext.runtimeState.currentConfig.managedRuntimePolicy
+                        .enabled,
+                }),
+            });
+            liveServers.add(server);
+            return server;
+        }, {
+            onerror: () => {
+                serverLogger.error(MCP_CONNECTION_LOST);
+                dependencies.writeStderr(`${MCP_CONNECTION_LOST}\n`);
+            },
+        });
+    }
+    catch {
+        await session.close();
+        serverLogger.error(MCP_CONNECTION_START_FAILED);
+        dependencies.writeStderr(`${MCP_CONNECTION_START_FAILED}\n`);
+        return { ok: false };
+    }
+    return { ok: true, handle, liveServers };
+};

package/dist/main/types.js

@@ -0,0 +1 @@
+export {};