rea-agents 3.1.0 → 3.2.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (590) hide show
  1. package/README.md +72 -95
  2. package/bridge/ghidra/ReaGhidraBridge.java +609 -841
  3. package/bridge/hopper_bridge.py +99 -344
  4. package/dist/application/AbortablePromise.js +6 -3
  5. package/dist/application/AnalysisSnapshotCache.js +0 -1
  6. package/dist/application/AnalysisSnapshotFiles.js +7 -7
  7. package/dist/application/AndroidApplicationService.js +1 -1
  8. package/dist/application/AppleApplicationService.js +1 -1
  9. package/dist/application/ArtifactExtraction.js +35 -54
  10. package/dist/application/ArtifactExtractionDestination.js +17 -0
  11. package/dist/application/ArtifactGraphConstruction.js +2 -17
  12. package/dist/application/ArtifactInventory/classify.js +2 -6
  13. package/dist/application/ArtifactInventory/hash.js +2 -20
  14. package/dist/application/ArtifactInventory/scanCanonical.js +8 -12
  15. package/dist/application/ArtifactInventory/scanReader.js +69 -51
  16. package/dist/application/ArtifactInventory.js +6 -14
  17. package/dist/application/AuthorizedArtifactInventory.js +3 -13
  18. package/dist/application/BinarySession.js +41 -13
  19. package/dist/application/BinarySessionComposition.js +0 -11
  20. package/dist/application/BinarySessionOpen.js +2 -1
  21. package/dist/application/BinarySessionRecords.js +5 -93
  22. package/dist/application/BinarySessionStatus.js +5 -16
  23. package/dist/application/BinaryTargetResolver.js +216 -0
  24. package/dist/application/BrowserEvidence.js +42 -58
  25. package/dist/application/BrowserObservationService.js +3 -6
  26. package/dist/application/BrowserScenarioCaptureService.js +3 -6
  27. package/dist/application/BrowserScenarioEvidence.js +3 -3
  28. package/dist/application/CallPathTracing.js +2 -36
  29. package/dist/application/CapabilityInventory.js +10 -15
  30. package/dist/application/ClientConfigurationDocument.js +27 -0
  31. package/dist/application/ClientRegistrationStatus.js +16 -13
  32. package/dist/application/CommandShimReplay.js +14 -1
  33. package/dist/application/DirectAnalysis.js +22 -46
  34. package/dist/application/DirectAnalysisStatus.js +5 -61
  35. package/dist/application/Doctor.js +11 -32
  36. package/dist/application/DoctorDiagnostics.js +1 -2
  37. package/dist/application/DoctorScope.js +1 -1
  38. package/dist/application/ElectronActiveEvidence.js +3 -8
  39. package/dist/application/ElectronActiveObservationService.js +3 -6
  40. package/dist/application/ElectronBoundaryAnalysis.js +7 -8
  41. package/dist/application/ElectronBoundaryGraphContext.js +1 -1
  42. package/dist/application/ElectronBoundaryGraphIpc.js +3 -3
  43. package/dist/application/ElectronBoundaryGraphNative.js +1 -2
  44. package/dist/application/ElectronBoundaryGraphWindows.js +6 -8
  45. package/dist/application/ElectronEvidence.js +4 -7
  46. package/dist/application/ElectronObservationService.js +5 -9
  47. package/dist/application/EnhancedLiteralTracing.js +42 -65
  48. package/dist/application/EnhancedTools.js +76 -44
  49. package/dist/application/EvidenceBundleCommands.js +11 -11
  50. package/dist/application/EvidenceBundleFiles.js +9 -15
  51. package/dist/application/EvidenceLedger.js +6 -41
  52. package/dist/application/FilesystemSnapshot.js +2 -3
  53. package/dist/application/InterfaceBuilderAnalysis.js +266 -0
  54. package/dist/application/InventoryProjectionEvidence.js +4 -2
  55. package/dist/application/InvestigationProviders.js +1 -1
  56. package/dist/application/JavaScriptApplicationEvidence.js +2 -5
  57. package/dist/application/JavaScriptApplicationEvidenceGraph.js +6 -10
  58. package/dist/application/JavaScriptApplicationService.js +6 -29
  59. package/dist/application/JavaScriptApplicationWorkflowEvidence.js +5 -5
  60. package/dist/application/JavaScriptApplicationWorkflowService.js +0 -8
  61. package/dist/application/JavaScriptArtifactAnalysis.js +38 -127
  62. package/dist/application/JavaScriptArtifactFiles.js +67 -107
  63. package/dist/application/JavaScriptArtifactGraphAccumulator.js +0 -7
  64. package/dist/application/JavaScriptArtifactGraphBuilder.js +7 -58
  65. package/dist/application/JavaScriptArtifactGraphBundlers.js +1 -6
  66. package/dist/application/JavaScriptArtifactGraphContext.js +12 -39
  67. package/dist/application/JavaScriptArtifactGraphDocuments.js +4 -11
  68. package/dist/application/JavaScriptArtifactGraphEvidence.js +0 -14
  69. package/dist/application/JavaScriptArtifactGraphFindings.js +3 -3
  70. package/dist/application/JavaScriptArtifactGraphStructure.js +16 -17
  71. package/dist/application/JavaScriptArtifactPathResolution.js +61 -49
  72. package/dist/application/JavaScriptArtifactReconstruction.js +5 -10
  73. package/dist/application/JavaScriptArtifactReconstructionInput.js +2 -14
  74. package/dist/application/JavaScriptJsonModules.js +2 -2
  75. package/dist/application/JavaScriptModuleRelationships.js +22 -27
  76. package/dist/application/JavaScriptReplayPlanning.js +9 -3
  77. package/dist/application/JavaScriptReplayService.js +6 -32
  78. package/dist/application/JavaScriptReturnShapeProjection.js +12 -42
  79. package/dist/application/JavaScriptRuntimeObservationEvidence.js +7 -8
  80. package/dist/application/JavaScriptRuntimeObservationService.js +4 -8
  81. package/dist/application/JavaScriptRuntimeReconciliationEvidence.js +2 -3
  82. package/dist/application/JavaScriptSemanticGraphBuilder.js +11 -41
  83. package/dist/application/JavaScriptSemanticGraphConstruction.js +5 -29
  84. package/dist/application/JavaScriptSemanticGraphEvidence.js +1 -1
  85. package/dist/application/JavaScriptSemanticGraphFingerprintProjection.js +1 -1
  86. package/dist/application/JavaScriptSemanticGraphFlowProjection.js +0 -13
  87. package/dist/application/JavaScriptSemanticGraphProjection.js +1 -3
  88. package/dist/application/JavaScriptSemanticTraceService.js +1 -10
  89. package/dist/application/JsonFiles.js +79 -0
  90. package/dist/application/LinuxHopper.js +11 -9
  91. package/dist/application/LoopbackReplay.js +26 -23
  92. package/dist/application/LoopbackReplayRecorder.js +29 -1
  93. package/dist/application/ManagedApplicationGraphService.js +1 -2
  94. package/dist/application/ManagedMemberComparisonService.js +11 -41
  95. package/dist/application/ManagedNativeVerificationService.js +1 -2
  96. package/dist/application/ManagedReconstructionService.js +1 -1
  97. package/dist/application/ManagedRuntimeCorrelationService.js +5 -8
  98. package/dist/application/NativeApiInspection.js +2 -7
  99. package/dist/application/NativeUiActionTrace.js +394 -0
  100. package/dist/application/NodeRuntimeCharacterizationService.js +3 -7
  101. package/dist/application/PermissionAuthority.js +15 -7
  102. package/dist/application/PermissionFailure.js +5 -0
  103. package/dist/application/ProcessCaptureAuthority.js +5 -7
  104. package/dist/application/ProcessCaptureJournal.js +3 -2
  105. package/dist/application/ProcessCaptureLifecycle.js +5 -12
  106. package/dist/application/ProcessCheckpoints.js +29 -11
  107. package/dist/application/ProcessCli.js +6 -16
  108. package/dist/application/ProcessEvidence.js +5 -7
  109. package/dist/application/ProcessHarness.js +52 -17
  110. package/dist/application/ProcessReactiveCoordinator.js +2 -4
  111. package/dist/application/ProcessReactiveEffects.js +9 -3
  112. package/dist/application/ProcessReactiveHarness.js +13 -7
  113. package/dist/application/ProcessSampling.js +2 -4
  114. package/dist/application/ProcessTimer.js +39 -0
  115. package/dist/application/ProjectPermissionStore.js +39 -96
  116. package/dist/application/RealHopperAssertions.js +20 -66
  117. package/dist/application/ReconstructionCoverageService.js +12 -58
  118. package/dist/application/ReconstructionObligationAuthority.js +2 -2
  119. package/dist/application/ReconstructionObligationCandidates.js +4 -4
  120. package/dist/application/ReconstructionObligationLedgerEvaluation.js +8 -15
  121. package/dist/application/ReconstructionObligationLedgerProjection.js +3 -7
  122. package/dist/application/ReconstructionObligationLedgerService.js +19 -38
  123. package/dist/application/ReferenceSourceImport.js +19 -45
  124. package/dist/application/ReferenceSourceImportEntries.js +2 -4
  125. package/dist/application/ReferenceSourceImportPolicy.js +5 -32
  126. package/dist/application/ReferenceSourceImportTypes.js +0 -16
  127. package/dist/application/RuntimeExecutableDiagnostics.js +55 -29
  128. package/dist/application/SessionProviderRouter.js +2 -2
  129. package/dist/application/Setup.js +1 -3
  130. package/dist/application/SetupClientConfiguration.js +22 -93
  131. package/dist/application/SetupRegistrationEnvironment.js +0 -7
  132. package/dist/application/StoreFileLock.js +119 -0
  133. package/dist/application/TerminalRenderer.js +2 -3
  134. package/dist/application/Uninstall.js +9 -14
  135. package/dist/application/UnknownEvidence.js +1 -1
  136. package/dist/artifacts/ArtifactPaths.js +2 -5
  137. package/dist/artifacts/ArtifactProvider.js +36 -58
  138. package/dist/artifacts/DirectoryArtifactReader.js +13 -8
  139. package/dist/artifacts/MachOSliceArtifactReader.js +1 -5
  140. package/dist/artifacts/NativeDmgArtifactReader.js +11 -11
  141. package/dist/artifacts/NibArchive.js +269 -0
  142. package/dist/artifacts/SafeOutputTree.js +15 -24
  143. package/dist/browser/BrowserProcessStartup.js +1 -2
  144. package/dist/browser/CdpAuthorizedMainFrame.js +16 -0
  145. package/dist/browser/CdpBrowserProvider.js +3 -13
  146. package/dist/browser/CdpCanonicalJsonDigest.js +9 -0
  147. package/dist/browser/CdpCaptureDocuments.js +28 -76
  148. package/dist/browser/CdpCaptureEventBodyShapes.js +13 -33
  149. package/dist/browser/CdpCaptureEventHandlers.js +22 -87
  150. package/dist/browser/CdpCaptureEvents.js +2 -8
  151. package/dist/browser/CdpCaptureStorage.js +9 -20
  152. package/dist/browser/CdpCaptureStorageFingerprints.js +85 -98
  153. package/dist/browser/CdpCaptureValues.js +21 -21
  154. package/dist/browser/CdpConnection.js +10 -25
  155. package/dist/browser/CdpElectronInspection.js +26 -50
  156. package/dist/browser/CdpElectronProvider.js +10 -35
  157. package/dist/browser/CdpElectronScriptEvents.js +8 -16
  158. package/dist/browser/CdpElectronScripts.js +6 -35
  159. package/dist/browser/CdpElectronWorkers.js +6 -10
  160. package/dist/browser/CdpEndpoint.js +25 -41
  161. package/dist/browser/CdpObservationSession.js +14 -26
  162. package/dist/browser/CdpPageCapture.js +34 -48
  163. package/dist/browser/CdpPageCaptureScripts.js +1 -19
  164. package/dist/browser/CdpPageCaptureWorkers.js +6 -10
  165. package/dist/browser/CdpSafeMetadata.js +19 -22
  166. package/dist/browser/CdpScreenshot.js +3 -5
  167. package/dist/browser/CdpTargetSession.js +1 -2
  168. package/dist/browser/CdpWebMcpDiscovery.js +13 -22
  169. package/dist/browser/ElectronFileScope.js +8 -19
  170. package/dist/browser/JavaScriptRuntimeScope.js +9 -14
  171. package/dist/browser/PlaywrightBrowserScenarioProvider.js +31 -64
  172. package/dist/browser/PlaywrightElectronActiveActions.js +54 -69
  173. package/dist/browser/PlaywrightElectronActiveProvider.js +14 -34
  174. package/dist/browser/PlaywrightExecutionBoundary.js +16 -5
  175. package/dist/browser/PlaywrightScenarioActions.js +3 -7
  176. package/dist/browser/PlaywrightScenarioArtifacts.js +23 -92
  177. package/dist/browser/PlaywrightScenarioBrowser.js +3 -5
  178. package/dist/browser/PlaywrightScenarioEvents.js +45 -94
  179. package/dist/browser/PlaywrightScenarioSession.js +14 -30
  180. package/dist/browser/PngVisualDiff.js +22 -14
  181. package/dist/browser/SensitiveTextCapture.js +0 -17
  182. package/dist/browser/V8InspectorCaptureProjection.js +7 -8
  183. package/dist/browser/V8InspectorEndpoint.js +12 -14
  184. package/dist/browser/V8InspectorProvider.js +20 -61
  185. package/dist/browser/WebSourceMapFetcher.js +56 -176
  186. package/dist/catalogIdentity.js +0 -54
  187. package/dist/cli/artifactCommands.js +49 -77
  188. package/dist/cli/coreAnalysisCommands.js +83 -133
  189. package/dist/cli/javascriptApplicationAnalysis.js +1 -9
  190. package/dist/cli/managedCommands.js +5 -270
  191. package/dist/cli/setupCommands.js +3 -12
  192. package/dist/cli/utilityCommands.js +7 -41
  193. package/dist/cli.js +0 -2
  194. package/dist/cliApplicationCommands.js +42 -112
  195. package/dist/cliBrowserAdvancedCommands.js +10 -106
  196. package/dist/cliBrowserCommands.js +15 -127
  197. package/dist/cliBrowserContext.js +30 -0
  198. package/dist/cliCommandNames.js +4 -5
  199. package/dist/cliElectronCommands.js +8 -72
  200. package/dist/cliEvidenceCommands.js +8 -77
  201. package/dist/cliJavaScriptRuntimeCommands.js +9 -91
  202. package/dist/cliJsonInput.js +4 -14
  203. package/dist/cliObservationOptions.js +11 -96
  204. package/dist/cliPolicyCommands.js +2 -17
  205. package/dist/cliProcessCommands.js +3 -3
  206. package/dist/cliSetup.js +0 -13
  207. package/dist/config/browserScenario.js +2 -2
  208. package/dist/config/environment.js +0 -9
  209. package/dist/config/parseConfig.js +1 -33
  210. package/dist/config/parsers.js +6 -27
  211. package/dist/config/passiveObservation.js +7 -77
  212. package/dist/config/permissions.js +0 -7
  213. package/dist/contracts/analysisSearchContract.js +2 -5
  214. package/dist/contracts/applicationToolContracts.js +56 -109
  215. package/dist/contracts/applicationWorkflowInputContracts.js +27 -102
  216. package/dist/contracts/artifactComparisonExample.js +58 -60
  217. package/dist/contracts/artifactToolContracts.js +20 -67
  218. package/dist/contracts/browserScenarioToolContracts.js +6 -51
  219. package/dist/contracts/browserToolContracts.js +8 -73
  220. package/dist/contracts/electronToolContracts.js +8 -108
  221. package/dist/contracts/enhancedInputs.js +23 -54
  222. package/dist/contracts/errorSchemas.js +0 -1
  223. package/dist/contracts/functionComparisonExample.js +10 -24
  224. package/dist/contracts/functionInstructionContract.js +1 -3
  225. package/dist/contracts/functionWorkflowToolContracts.js +2 -2
  226. package/dist/contracts/hopperMemoryContracts.js +3 -3
  227. package/dist/contracts/investigationExamples.js +14 -11
  228. package/dist/contracts/javascriptApplicationWorkflowExamples.js +12 -19
  229. package/dist/contracts/javascriptRuntimeObservationToolContracts.js +2 -20
  230. package/dist/contracts/javascriptRuntimeReconciliationExample.js +45 -12
  231. package/dist/contracts/managedToolContracts.js +6 -95
  232. package/dist/contracts/managedWorkflowExamples.js +77 -128
  233. package/dist/contracts/managedWorkflowToolContracts.js +51 -77
  234. package/dist/contracts/nativeToolContracts.js +7 -11
  235. package/dist/contracts/processCaptureExample.js +2 -69
  236. package/dist/contracts/promptContracts.js +49 -67
  237. package/dist/contracts/providerSelection.js +0 -1
  238. package/dist/contracts/reconstructionReadinessExample.js +1 -6
  239. package/dist/contracts/sessionStatusContract.js +1 -17
  240. package/dist/contracts/sessionToolSchemas.js +6 -15
  241. package/dist/contracts/toolContractExamples.js +11 -11
  242. package/dist/contracts/toolContractHelpers.js +0 -4
  243. package/dist/contracts/toolContracts.js +60 -71
  244. package/dist/contracts/toolEffects.js +5 -13
  245. package/dist/contracts/toolOutputSchemaGroups.js +37 -91
  246. package/dist/contracts/toolOutputSchemaPrimitives.js +16 -56
  247. package/dist/contracts/toolSchemaMetadata.js +8 -19
  248. package/dist/contracts/unknownContractExamples.js +0 -2
  249. package/dist/domain/analysisErrorPresentation.js +46 -54
  250. package/dist/domain/analysisErrorProjection.js +28 -37
  251. package/dist/domain/analysisProfile.js +3 -31
  252. package/dist/domain/analysisSnapshot.js +3 -12
  253. package/dist/domain/androidApplication.js +15 -54
  254. package/dist/domain/appleApplication.js +24 -67
  255. package/dist/domain/artifactComparison.js +11 -29
  256. package/dist/domain/artifactGraph.js +14 -44
  257. package/dist/domain/artifactInspection.js +38 -69
  258. package/dist/domain/artifactInventoryEvidence.js +27 -21
  259. package/dist/domain/binaryTarget.js +2 -221
  260. package/dist/domain/browserCaptureComparison.js +47 -24
  261. package/dist/domain/browserObservation.js +28 -193
  262. package/dist/domain/browserObservationSchemas.js +5 -23
  263. package/dist/domain/browserScenario.js +11 -14
  264. package/dist/domain/browserScenarioCapture.js +11 -12
  265. package/dist/domain/browserScenarioCaptureValues.js +146 -84
  266. package/dist/domain/browserScenarioDiff.js +2 -59
  267. package/dist/domain/browserScenarioDiffEvidence.js +51 -0
  268. package/dist/domain/browserScenarioDiffValues.js +21 -38
  269. package/dist/domain/browserScenarioValues.js +80 -109
  270. package/dist/domain/browserSession.js +4 -7
  271. package/dist/domain/bundleComparison.js +6 -32
  272. package/dist/domain/bytecodeProvider.js +20 -19
  273. package/dist/domain/callPath.js +47 -167
  274. package/dist/domain/callPathSchemas.js +79 -0
  275. package/dist/domain/changedBehavior.js +34 -60
  276. package/dist/domain/completionLedgerGeneration.js +8 -14
  277. package/dist/domain/conformancePackage.js +126 -97
  278. package/dist/domain/conformanceReplay.js +36 -8
  279. package/dist/domain/conformanceTrustGate.js +23 -14
  280. package/dist/domain/customProtocolCapture.js +1 -1
  281. package/dist/domain/electronActiveObservation.js +70 -103
  282. package/dist/domain/electronObservation.js +14 -80
  283. package/dist/domain/electronStaticAnalysisBrowser.js +36 -46
  284. package/dist/domain/electronStaticAnalysisIpc.js +38 -14
  285. package/dist/domain/electronStaticAnalysisNative.js +1 -8
  286. package/dist/domain/electronStaticAnalysisValues.js +10 -17
  287. package/dist/domain/errors.js +33 -54
  288. package/dist/domain/eventProcessTree.js +20 -12
  289. package/dist/domain/evidence.js +2 -10
  290. package/dist/domain/evidenceBundle.js +3 -5
  291. package/dist/domain/evidenceCompletionLedger.js +6 -8
  292. package/dist/domain/functionComparison.js +4 -14
  293. package/dist/domain/functionComparisonNormalization.js +4 -11
  294. package/dist/domain/functionComparisonResults.js +25 -15
  295. package/dist/domain/functionComparisonSchemas.js +49 -33
  296. package/dist/domain/functionDossierEvidence.js +31 -156
  297. package/dist/domain/hopperStartupFailure.js +1 -1
  298. package/dist/domain/hopperValues.js +15 -136
  299. package/dist/domain/interfaceBuilderGraph.js +654 -0
  300. package/dist/domain/javascriptApplicationAnalysis.js +8 -112
  301. package/dist/domain/javascriptApplicationChangeGraph.js +22 -82
  302. package/dist/domain/javascriptApplicationEvidenceSchemas.js +59 -47
  303. package/dist/domain/javascriptApplicationGraph.js +3 -13
  304. package/dist/domain/javascriptApplicationGraphSchemas.js +12 -34
  305. package/dist/domain/javascriptApplicationVersionComparison.js +26 -30
  306. package/dist/domain/javascriptApplicationVersionComparisonSchemas.js +123 -68
  307. package/dist/domain/javascriptApplicationVersionItems.js +120 -53
  308. package/dist/domain/javascriptApplicationVersionKeys.js +24 -11
  309. package/dist/domain/javascriptAstFingerprint.js +25 -58
  310. package/dist/domain/javascriptAstValues.js +9 -0
  311. package/dist/domain/javascriptExportInstrumentation.js +2 -4
  312. package/dist/domain/javascriptExportShapeComparison.js +6 -7
  313. package/dist/domain/javascriptExportShapeComparisonSchemas.js +68 -75
  314. package/dist/domain/javascriptExportShapeSelection.js +17 -19
  315. package/dist/domain/javascriptFeatureSeed.js +20 -12
  316. package/dist/domain/javascriptFeatureTrace.js +13 -67
  317. package/dist/domain/javascriptFeatureTraceSchemas.js +24 -52
  318. package/dist/domain/javascriptFeatureTraversal.js +1 -44
  319. package/dist/domain/javascriptNativeHandoff.js +1 -1
  320. package/dist/domain/javascriptReplay.js +24 -41
  321. package/dist/domain/javascriptRuntimeLoadState.js +3 -8
  322. package/dist/domain/javascriptRuntimeObservation.js +42 -103
  323. package/dist/domain/javascriptRuntimeReconciliation.js +1 -3
  324. package/dist/domain/javascriptRuntimeReconciliationActive.js +8 -17
  325. package/dist/domain/javascriptRuntimeReconciliationGraph.js +10 -23
  326. package/dist/domain/javascriptRuntimeReconciliationMatching.js +18 -12
  327. package/dist/domain/javascriptRuntimeReconciliationParsing.js +16 -45
  328. package/dist/domain/javascriptRuntimeReconciliationResult.js +4 -5
  329. package/dist/domain/javascriptRuntimeReconciliationRuntime.js +8 -12
  330. package/dist/domain/javascriptRuntimeReconciliationSchemas.js +33 -48
  331. package/dist/domain/javascriptRuntimeStaticCandidates.js +3 -3
  332. package/dist/domain/javascriptSemanticAnalysis.js +12 -45
  333. package/dist/domain/javascriptSemanticAsyncEffects.js +1 -9
  334. package/dist/domain/javascriptSemanticCallResolution.js +6 -16
  335. package/dist/domain/javascriptSemanticCalls.js +5 -32
  336. package/dist/domain/javascriptSemanticChildProcesses.js +1 -11
  337. package/dist/domain/javascriptSemanticCoverage.js +11 -0
  338. package/dist/domain/javascriptSemanticDataEffectHelpers.js +1 -8
  339. package/dist/domain/javascriptSemanticDataEffects.js +1 -11
  340. package/dist/domain/javascriptSemanticFingerprints.js +3 -5
  341. package/dist/domain/javascriptSemanticGraphSchemas.js +25 -51
  342. package/dist/domain/javascriptSemanticGraphSerialization.js +2 -13
  343. package/dist/domain/javascriptSemanticIr.js +1 -29
  344. package/dist/domain/javascriptSemanticObjects.js +1 -5
  345. package/dist/domain/javascriptSemanticPrimitives.js +2 -9
  346. package/dist/domain/javascriptSemanticProjection.js +0 -18
  347. package/dist/domain/javascriptSemanticPromises.js +9 -16
  348. package/dist/domain/javascriptSemanticProvenance.js +16 -19
  349. package/dist/domain/javascriptSemanticQuery.js +17 -139
  350. package/dist/domain/javascriptSemanticQueryAssessment.js +9 -37
  351. package/dist/domain/javascriptSemanticQueryIdentity.js +2 -23
  352. package/dist/domain/javascriptSemanticQuerySchemas.js +14 -107
  353. package/dist/domain/javascriptSemanticResources.js +1 -6
  354. package/dist/domain/javascriptSemanticReturns.js +10 -27
  355. package/dist/domain/javascriptSemanticValueTypes.js +1 -0
  356. package/dist/domain/javascriptSemanticValues.js +44 -62
  357. package/dist/domain/javascriptStaticAnalysis.js +21 -43
  358. package/dist/domain/javascriptStaticAnalysisBundler.js +34 -93
  359. package/dist/domain/javascriptStaticAnalysisCalls.js +17 -16
  360. package/dist/domain/javascriptStaticAnalysisFindings.js +3 -19
  361. package/dist/domain/javascriptStaticAnalysisHelpers.js +47 -88
  362. package/dist/domain/javascriptStaticAnalysisState.js +1 -5
  363. package/dist/domain/javascriptStaticAnalysisTypes.js +1 -0
  364. package/dist/domain/jsonShape.js +7 -33
  365. package/dist/domain/localPath.js +7 -0
  366. package/dist/domain/managedApplicationGraph.js +9 -41
  367. package/dist/domain/managedApplicationGraphCoverage.js +24 -156
  368. package/dist/domain/managedApplicationGraphNodes.js +10 -13
  369. package/dist/domain/managedArtifact.js +14 -27
  370. package/dist/domain/managedMemberComparison.js +90 -92
  371. package/dist/domain/managedMemberComparisonCoverage.js +11 -33
  372. package/dist/domain/managedMemberComparisonItems.js +221 -0
  373. package/dist/domain/managedMemberComparisonMatch.js +8 -208
  374. package/dist/domain/managedNativeVerification.js +3 -6
  375. package/dist/domain/managedNativeVerificationMatch.js +55 -59
  376. package/dist/domain/managedNativeVerificationSchemas.js +83 -47
  377. package/dist/domain/managedReconstruction.js +19 -23
  378. package/dist/domain/managedRuntimeCorrelation.js +6 -9
  379. package/dist/domain/nativeApiBoundary.js +2 -7
  380. package/dist/domain/nativeInspection.js +0 -2
  381. package/dist/domain/nativeInvestigationGraph.js +351 -0
  382. package/dist/domain/nativeValueFlow.js +61 -0
  383. package/dist/domain/nodeRuntimeCharacterization.js +1 -5
  384. package/dist/domain/objcSwiftMetadata.js +254 -0
  385. package/dist/domain/peInspection.js +1 -1
  386. package/dist/domain/permissionPolicy.js +13 -0
  387. package/dist/domain/processCapture.js +76 -113
  388. package/dist/domain/processCaptureExample.js +68 -0
  389. package/dist/domain/processCaptureParsing.js +21 -0
  390. package/dist/domain/processCaptureReactiveSchema.js +68 -0
  391. package/dist/domain/processCaptureValidation.js +1 -7
  392. package/dist/domain/processComparison.js +3 -12
  393. package/dist/domain/processReactiveMatching.js +29 -50
  394. package/dist/domain/processReactiveRuntime.js +4 -8
  395. package/dist/domain/processReactiveScenario.js +28 -94
  396. package/dist/domain/processReactiveScenarioPreflight.js +5 -30
  397. package/dist/domain/processReactiveTransition.js +33 -18
  398. package/dist/domain/processScenario.js +56 -90
  399. package/dist/domain/processTraceComparison.js +0 -8
  400. package/dist/domain/processTraceEvaluation.js +14 -4
  401. package/dist/domain/processTraceSpecification.js +11 -17
  402. package/dist/domain/protocolCapture.js +3 -3
  403. package/dist/domain/reconstructionCoverage.js +62 -129
  404. package/dist/domain/reconstructionCoverageEvaluation.js +17 -17
  405. package/dist/domain/reconstructionObligationLedgerSchemas.js +45 -72
  406. package/dist/domain/reconstructionReadiness.js +1 -2
  407. package/dist/domain/reconstructionReadinessSchemas.js +36 -38
  408. package/dist/domain/reconstructionUnknowns.js +3 -3
  409. package/dist/domain/reconstructionVerification.js +13 -47
  410. package/dist/domain/reconstructionVerificationSchemas.js +50 -38
  411. package/dist/domain/referenceSourceGraph.js +53 -61
  412. package/dist/domain/referenceSourceImportParsing.js +1 -5
  413. package/dist/domain/replayMachine.js +19 -31
  414. package/dist/domain/replayMachineRun.js +15 -63
  415. package/dist/domain/replayMachineRuntime.js +41 -41
  416. package/dist/domain/replayMachineValues.js +84 -0
  417. package/dist/domain/residualUnknown.js +25 -30
  418. package/dist/domain/runtimeCharacterization.js +15 -16
  419. package/dist/domain/runtimeIdentification.js +48 -47
  420. package/dist/domain/sourceToBundleComparison.js +9 -85
  421. package/dist/domain/sourceToBundleComparisonSchemas.js +17 -42
  422. package/dist/domain/sourceToBundleSignals.js +4 -15
  423. package/dist/domain/staticRuntimeCorrelation.js +37 -49
  424. package/dist/domain/symbolAnalysis.js +10 -19
  425. package/dist/domain/unicodeCodePointOrder.js +12 -0
  426. package/dist/domain/webBundleAnalysis.js +70 -99
  427. package/dist/domain/webBundleAnalyzer.js +2 -4
  428. package/dist/domain/webBundleAnalyzerAst.js +0 -13
  429. package/dist/domain/webBundleAnalyzerInspection.js +26 -52
  430. package/dist/domain/webBundleAnalyzerResult.js +7 -24
  431. package/dist/domain/webCaptureDiff.js +33 -73
  432. package/dist/domain/webCaptureDiffSchemas.js +86 -0
  433. package/dist/domain/webContentArtifact.js +1 -10
  434. package/dist/domain/webMcpDiscovery.js +3 -14
  435. package/dist/domain/webScreenshot.js +58 -34
  436. package/dist/domain/zipPackageFormat.js +7 -0
  437. package/dist/dotnet/ManagedArtifactInspector.js +17 -50
  438. package/dist/dotnet/ManagedMemberInspector.js +27 -58
  439. package/dist/dotnet/ManagedMemberInspectorCore.js +14 -51
  440. package/dist/dotnet/ManagedMemberInstructionDecoder.js +2 -2
  441. package/dist/dotnet/ManagedMemberRows.js +16 -16
  442. package/dist/dotnet/ManagedMetadataHeaps.js +26 -8
  443. package/dist/dotnet/ManagedMetadataInventory.js +21 -30
  444. package/dist/dotnet/ManagedMetadataInventoryRows.js +57 -63
  445. package/dist/dotnet/ManagedMetadataLayout.js +3 -5
  446. package/dist/dotnet/ManagedMethodBodyReader.js +5 -30
  447. package/dist/dotnet/ManagedNativeBoundaryHelpers.js +19 -49
  448. package/dist/dotnet/ManagedNativeBoundaryInspector.js +13 -41
  449. package/dist/dotnet/ManagedPeReader.js +2 -2
  450. package/dist/dotnet/ManagedStaticProvider.js +13 -71
  451. package/dist/generatedMcpToolCatalog.js +1 -1
  452. package/dist/generatedPackageMetadata.js +1 -1
  453. package/dist/ghidra/GhidraAnalysisProfile.js +3 -8
  454. package/dist/ghidra/GhidraClient.js +4 -12
  455. package/dist/ghidra/GhidraClientWire.js +9 -5
  456. package/dist/ghidra/GhidraDefaults.js +0 -18
  457. package/dist/ghidra/GhidraDiagnostics.js +0 -2
  458. package/dist/ghidra/GhidraDoctor.js +16 -12
  459. package/dist/ghidra/GhidraFunctionValues.js +65 -108
  460. package/dist/ghidra/GhidraInstallation.js +98 -42
  461. package/dist/ghidra/GhidraInventoryValues.js +16 -85
  462. package/dist/ghidra/GhidraLauncher.js +0 -8
  463. package/dist/ghidra/GhidraProvider.js +15 -22
  464. package/dist/ghidra/GhidraProviderCapabilities.js +6 -47
  465. package/dist/ghidra/GhidraRequestQueue.js +6 -30
  466. package/dist/ghidra/GhidraResponseBuffer.js +1 -7
  467. package/dist/ghidra/GhidraSessionValues.js +0 -2
  468. package/dist/ghidra/GhidraTransport.js +4 -7
  469. package/dist/ghidra/protocol.js +2 -2
  470. package/dist/hopper/BridgeLauncher.js +112 -36
  471. package/dist/hopper/HopperAnalysisProfile.js +1 -1
  472. package/dist/hopper/HopperCleanup.js +6 -3
  473. package/dist/hopper/HopperClient.js +4 -7
  474. package/dist/hopper/HopperProcessDiagnostic.js +2 -2
  475. package/dist/hopper/HopperProvider.js +0 -16
  476. package/dist/hopper/HopperRequestQueue.js +21 -40
  477. package/dist/hopper/HopperResponseStream.js +1 -9
  478. package/dist/hopper/HopperSessionValues.js +3 -2
  479. package/dist/hopper/HopperTargetLease.js +119 -0
  480. package/dist/hopper/LinuxPrivateDisplayDiagnostic.js +24 -31
  481. package/dist/hopper/LinuxPrivateDisplayProbe.js +5 -16
  482. package/dist/hopper/protocol.js +6 -4
  483. package/dist/main/reload.js +0 -3
  484. package/dist/main/shutdown.js +1 -1
  485. package/dist/main/state.js +0 -9
  486. package/dist/main/transport.js +0 -5
  487. package/dist/mcpDoctor.js +25 -45
  488. package/dist/native/CommandRunner.js +18 -25
  489. package/dist/native/NativeMacOSProvider.js +13 -38
  490. package/dist/native/NativeMachoInspection.js +1 -1
  491. package/dist/process/BoundedFileBytes.js +17 -0
  492. package/dist/process/ExecFileOutput.js +11 -0
  493. package/dist/process/PendingOperations.js +8 -6
  494. package/dist/process/ProcessOwnership.js +3 -2
  495. package/dist/process/ProcessOwnershipObservation.js +0 -1
  496. package/dist/process/ProviderProcess.js +7 -28
  497. package/dist/reference/ReferenceSourceReader.js +8 -24
  498. package/dist/reference/ReferenceSourceReaderEntries.js +11 -39
  499. package/dist/reference/ReferenceSourceReaderFile.js +13 -31
  500. package/dist/reference/ReferenceSourceReaderPaths.js +3 -18
  501. package/dist/reference/ReferenceSourceReaderValidate.js +3 -6
  502. package/dist/replay/JavaScriptReplayWorker.js +3 -5
  503. package/dist/replay/LinuxJavaScriptReplayRunner.js +33 -29
  504. package/dist/replay/LinuxJavaScriptReplaySandbox.js +0 -19
  505. package/dist/replay/LinuxRuntimeClosure.js +1 -3
  506. package/dist/replay/ReplayOutcome.js +1 -3
  507. package/dist/replay/ReplayProcessLifecycle.js +32 -7
  508. package/dist/replay/ReplaySeccompFile.js +29 -0
  509. package/dist/replay/ReplayWorkerProtocol.js +0 -2
  510. package/dist/replay/SystemJavaScriptReplayHost.js +45 -74
  511. package/dist/server/ProcessCaptureElicitation.js +4 -8
  512. package/dist/server/createServer.js +6 -44
  513. package/dist/server/promptCompletion.js +37 -61
  514. package/dist/server/recordDerivedEvidence.js +1 -1
  515. package/dist/server/registerApplicationTools/characterization.js +4 -8
  516. package/dist/server/registerApplicationTools/compareExportShapes.js +5 -10
  517. package/dist/server/registerApplicationTools/compareSourceToBundle.js +6 -10
  518. package/dist/server/registerApplicationTools/compareVersions.js +5 -10
  519. package/dist/server/registerApplicationTools/controlledReplay.js +3 -5
  520. package/dist/server/registerApplicationTools/coverage.js +6 -71
  521. package/dist/server/registerApplicationTools/helpers.js +1 -13
  522. package/dist/server/registerApplicationTools/obligationLedger.js +3 -2
  523. package/dist/server/registerApplicationTools/traceFeature.js +5 -9
  524. package/dist/server/registerApplicationTools/traceSemantics.js +5 -8
  525. package/dist/server/registerApplicationTools.js +0 -2
  526. package/dist/server/registerArtifactComparisonTool.js +23 -27
  527. package/dist/server/registerBrowserScenarioTool.js +4 -4
  528. package/dist/server/registerBrowserTools.js +5 -8
  529. package/dist/server/registerBundleComparisonTool.js +5 -7
  530. package/dist/server/registerCloseLifecycleTool.js +2 -16
  531. package/dist/server/registerElectronTools.js +10 -29
  532. package/dist/server/registerEnhancedTools.js +10 -11
  533. package/dist/server/registerEvidenceTools.js +15 -22
  534. package/dist/server/registerFunctionComparisonTool.js +30 -25
  535. package/dist/server/registerInvestigationTools/helpers.js +3 -32
  536. package/dist/server/registerInvestigationTools.js +20 -116
  537. package/dist/server/registerJavaScriptRuntimeObservationTools.js +6 -4
  538. package/dist/server/registerManagedWorkflowTools/compareManagedMembers.js +15 -17
  539. package/dist/server/registerManagedWorkflowTools/evidence.js +19 -35
  540. package/dist/server/registerManagedWorkflowTools/importManagedReconstruction.js +3 -8
  541. package/dist/server/registerManagedWorkflowTools/planManagedRuntimeCorrelation.js +3 -8
  542. package/dist/server/registerManagedWorkflowTools/projectManagedApplicationGraph.js +10 -14
  543. package/dist/server/registerManagedWorkflowTools/verifyManagedNativeBoundaries.js +9 -15
  544. package/dist/server/registerOfficialTools.js +1 -43
  545. package/dist/server/registerProcessComparisonTool.js +33 -23
  546. package/dist/server/registerPrompts.js +19 -17
  547. package/dist/server/registerSessionRecordTools.js +10 -156
  548. package/dist/server/registerSessionStatusTool.js +6 -69
  549. package/dist/server/registerSessionTools.js +10 -51
  550. package/dist/server/sessionAvailabilityPolicy.js +0 -2
  551. package/dist/server/sessionEvidence.js +9 -15
  552. package/dist/server/sessionToolPolicies.js +0 -8
  553. package/dist/server/toolResult.js +14 -50
  554. package/dist/serverIdentity.js +0 -20
  555. package/install.sh +1 -1
  556. package/package.json +11 -7
  557. package/scripts/electron-active-hook.cjs +23 -55
  558. package/scripts/hopper-demo-x11.py +13 -32
  559. package/skills/reverse-engineer-anything/SKILL.md +47 -12
  560. package/skills/reverse-engineer-anything/references/evidence-workflows.md +6 -4
  561. package/skills/reverse-engineer-anything/references/javascript-applications.md +13 -13
  562. package/skills/reverse-engineer-anything/references/native-and-artifacts.md +12 -8
  563. package/dist/application/ApplicationWorkflowEvidenceResolver.js +0 -188
  564. package/dist/application/BoundedJsonFiles.js +0 -86
  565. package/dist/application/CrossVersionInventory.js +0 -129
  566. package/dist/application/CrossVersionInvestigation.js +0 -301
  567. package/dist/application/CrossVersionInvestigationCollections.js +0 -23
  568. package/dist/application/CrossVersionInvestigationEvidence.js +0 -64
  569. package/dist/application/CrossVersionInvestigationReplay.js +0 -170
  570. package/dist/application/DeferredFileAuthorization.js +0 -61
  571. package/dist/application/DoctorProjection.js +0 -43
  572. package/dist/application/EnhancedToolPagination.js +0 -22
  573. package/dist/application/EvidenceReferenceResolver.js +0 -26
  574. package/dist/application/InvestigationWorkspaceStore.js +0 -204
  575. package/dist/application/ProcessPairedExperiment.js +0 -72
  576. package/dist/application/ReconstructionCoverageWorkspaceStore.js +0 -31
  577. package/dist/application/ReconstructionReadinessService.js +0 -48
  578. package/dist/cliInvestigationCommands.js +0 -173
  579. package/dist/domain/boundedCartesianProjection.js +0 -15
  580. package/dist/domain/investigationWorkspace.js +0 -347
  581. package/dist/domain/jsonLimits.js +0 -26
  582. package/dist/domain/knownPageCoverage.js +0 -29
  583. package/dist/domain/processPairedExperiment.js +0 -128
  584. package/dist/server/javascriptApplicationResult.js +0 -106
  585. package/dist/server/permissionFailure.js +0 -12
  586. package/dist/server/registerApplicationTools/readiness.js +0 -50
  587. package/dist/server/registerEvidenceResources.js +0 -315
  588. package/dist/server/registerJavaScriptApplicationGraphResource.js +0 -65
  589. package/dist/server/registerReconstructionObligationLedgerResource.js +0 -32
  590. package/dist/server/registerReconstructionReadinessResource.js +0 -32
@@ -2,15 +2,13 @@ import { createHash } from "node:crypto";
2
2
  import { z } from "zod";
3
3
  import { browserCompletenessSchema } from "./browserCompleteness.js";
4
4
  import { browserAllowedOriginsSchema, browserEndpointSchema, } from "./browserObservation.js";
5
- const MAX_SCREENSHOT_BYTES = 8 * 1_024 * 1_024;
6
5
  /** Self-verifying inline PNG artifact for CLI/MCP parity. */
7
6
  export const webScreenshotArtifactSchema = z
8
7
  .object({
9
- uri: z.string().regex(/^rea:\/\/web-screenshot\/sha256\/[a-f0-9]{64}$/u),
10
8
  sha256: z.string().regex(/^[a-f0-9]{64}$/u),
11
- bytes: z.number().int().min(1).max(MAX_SCREENSHOT_BYTES),
9
+ bytes: z.number().int().min(1),
12
10
  media_type: z.literal("image/png"),
13
- data_base64: z.string().max(Math.ceil((MAX_SCREENSHOT_BYTES * 4) / 3) + 4),
11
+ data_base64: z.string(),
14
12
  })
15
13
  .superRefine((artifact, context) => {
16
14
  const bytes = decodeCanonicalBase64(artifact.data_base64);
@@ -19,27 +17,17 @@ export const webScreenshotArtifactSchema = z
19
17
  return;
20
18
  }
21
19
  const sha256 = createHash("sha256").update(bytes).digest("hex");
22
- if (bytes.byteLength !== artifact.bytes ||
23
- sha256 !== artifact.sha256 ||
24
- artifact.uri !== `rea://web-screenshot/sha256/${sha256}`)
20
+ if (bytes.byteLength !== artifact.bytes || sha256 !== artifact.sha256)
25
21
  context.addIssue({
26
22
  code: "custom",
27
23
  message: "Screenshot artifact digest or size mismatch",
28
24
  });
29
25
  });
30
26
  /** Input for one read-only visible-viewport screenshot. */
31
- export const captureWebScreenshotInputSchema = z.object({
27
+ export const captureWebScreenshotInputSchema = z.strictObject({
32
28
  cdp_endpoint: browserEndpointSchema,
33
29
  allowed_origins: browserAllowedOriginsSchema,
34
- target_id: z.string().trim().min(1).max(256),
35
- approved: z.literal(true),
36
- screenshot_approved: z.literal(true),
37
- maximum_image_bytes: z
38
- .number()
39
- .int()
40
- .min(1)
41
- .max(MAX_SCREENSHOT_BYTES)
42
- .default(4 * 1_024 * 1_024),
30
+ target_id: z.string().trim().min(1),
43
31
  });
44
32
  const browserVersionSchema = z.object({
45
33
  product: z.string(),
@@ -48,9 +36,8 @@ const browserVersionSchema = z.object({
48
36
  user_agent: z.string(),
49
37
  js_version: z.string(),
50
38
  });
51
- /** Bounded screenshot observation with embedded immutable artifact bytes. */
39
+ /** Screenshot observation with embedded immutable artifact bytes. */
52
40
  export const webScreenshotSchema = z.object({
53
- schema_version: z.literal(1),
54
41
  browser: browserVersionSchema,
55
42
  target: z.object({
56
43
  target_id: z.string(),
@@ -66,17 +53,14 @@ export const webScreenshotSchema = z.object({
66
53
  completeness: browserCompletenessSchema,
67
54
  limitations: z.array(z.string()),
68
55
  });
69
- /** Input for bounded local pixel comparison of two screenshot artifacts. */
70
- export const compareWebScreenshotsInputSchema = z.object({
56
+ /** Input for local pixel comparison of two screenshot artifacts. */
57
+ export const compareWebScreenshotsInputSchema = z.strictObject({
71
58
  before: webScreenshotArtifactSchema,
72
59
  after: webScreenshotArtifactSchema,
73
60
  channel_threshold: z.number().int().min(0).max(255).default(0),
74
- maximum_pixels: z.number().int().min(1).max(32_000_000).default(16_000_000),
75
61
  });
76
62
  /** Value-only visual difference metrics; no OCR or image mutation. */
77
- export const webScreenshotDiffSchema = z.object({
78
- schema_version: z.literal(1),
79
- status: z.enum(["identical", "different", "dimension_mismatch"]),
63
+ const webScreenshotDiffContextShape = {
80
64
  before: z.object({
81
65
  width: z.number().int().min(1),
82
66
  height: z.number().int().min(1),
@@ -86,18 +70,59 @@ export const webScreenshotDiffSchema = z.object({
86
70
  height: z.number().int().min(1),
87
71
  }),
88
72
  channel_threshold: z.number().int().min(0).max(255),
89
- compared_pixels: z.number().int().min(0),
90
- changed_pixels: z.number().int().min(0).nullable(),
91
- changed_ratio: z.number().min(0).max(1).nullable(),
92
- maximum_channel_delta: z.number().int().min(0).max(255).nullable(),
93
- mean_absolute_channel_delta: z.number().min(0).max(255).nullable(),
94
73
  limitations: z.array(z.string()),
74
+ };
75
+ export const webScreenshotDiffSchema = z
76
+ .discriminatedUnion("status", [
77
+ z.object({
78
+ ...webScreenshotDiffContextShape,
79
+ status: z.literal("identical"),
80
+ compared_pixels: z.number().int().positive(),
81
+ changed_pixels: z.literal(0),
82
+ changed_ratio: z.literal(0),
83
+ maximum_channel_delta: z.number().int().min(0).max(255),
84
+ mean_absolute_channel_delta: z.number().min(0).max(255),
85
+ }),
86
+ z.object({
87
+ ...webScreenshotDiffContextShape,
88
+ status: z.literal("different"),
89
+ compared_pixels: z.number().int().positive(),
90
+ changed_pixels: z.number().int().positive(),
91
+ changed_ratio: z.number().positive().max(1),
92
+ maximum_channel_delta: z.number().int().positive().max(255),
93
+ mean_absolute_channel_delta: z.number().positive().max(255),
94
+ }),
95
+ z.object({
96
+ ...webScreenshotDiffContextShape,
97
+ status: z.literal("dimension_mismatch"),
98
+ compared_pixels: z.literal(0),
99
+ changed_pixels: z.null(),
100
+ changed_ratio: z.null(),
101
+ maximum_channel_delta: z.null(),
102
+ mean_absolute_channel_delta: z.null(),
103
+ }),
104
+ ])
105
+ .superRefine((diff, context) => {
106
+ const sameDimensions = diff.before.width === diff.after.width &&
107
+ diff.before.height === diff.after.height;
108
+ if (sameDimensions !== (diff.status !== "dimension_mismatch"))
109
+ context.addIssue({
110
+ code: "custom",
111
+ path: ["status"],
112
+ message: "Screenshot comparison status must match viewport dimensions",
113
+ });
114
+ if (diff.status !== "dimension_mismatch" &&
115
+ diff.compared_pixels !== diff.before.width * diff.before.height)
116
+ context.addIssue({
117
+ code: "custom",
118
+ path: ["compared_pixels"],
119
+ message: "Compared pixel count must match the shared dimensions",
120
+ });
95
121
  });
96
- /** Create a content-addressed PNG artifact from already bounded bytes. */
122
+ /** Create a content-addressed PNG artifact from captured bytes. */
97
123
  export const createWebScreenshotArtifact = (bytes) => {
98
124
  const sha256 = createHash("sha256").update(bytes).digest("hex");
99
125
  return webScreenshotArtifactSchema.parse({
100
- uri: `rea://web-screenshot/sha256/${sha256}`,
101
126
  sha256,
102
127
  bytes: bytes.byteLength,
103
128
  media_type: "image/png",
@@ -106,9 +131,8 @@ export const createWebScreenshotArtifact = (bytes) => {
106
131
  };
107
132
  /** Strict canonical base64 decoder used before digest validation. */
108
133
  export const decodeCanonicalBase64 = (value) => {
109
- if (value.length === 0 || value.length % 4 !== 0 || !BASE64.test(value))
134
+ if (value.length === 0 || value.length % 4 !== 0)
110
135
  return undefined;
111
136
  const decoded = Buffer.from(value, "base64");
112
137
  return decoded.toString("base64") === value ? decoded : undefined;
113
138
  };
114
- const BASE64 = /^(?:[A-Za-z\d+/]{4})*(?:[A-Za-z\d+/]{2}==|[A-Za-z\d+/]{3}=)?$/u;
@@ -1,3 +1,10 @@
1
+ /** Recognize local-header, empty-archive, or split-archive ZIP signatures, not archive validity. */
2
+ export const hasZipSignature = (bytes) => bytes.length >= 4 &&
3
+ bytes[0] === 0x50 &&
4
+ bytes[1] === 0x4b &&
5
+ ((bytes[2] === 0x03 && bytes[3] === 0x04) ||
6
+ (bytes[2] === 0x05 && bytes[3] === 0x06) ||
7
+ (bytes[2] === 0x07 && bytes[3] === 0x08));
1
8
  /**
2
9
  * Classify a ZIP-backed package by its complete lower-cased path suffix.
3
10
  *
@@ -3,15 +3,6 @@ import { readManagedPeLayout, } from "./ManagedPeReader.js";
3
3
  import { managedTableRowCounts, readManagedMetadataInventory, } from "./ManagedMetadataInventory.js";
4
4
  import { readManagedMetadataLayout, } from "./ManagedMetadataLayout.js";
5
5
  import { ManagedReaderFailure } from "./ManagedReaderFailure.js";
6
- const emptyPage = (offset, limit) => ({
7
- items: [],
8
- offset,
9
- limit,
10
- total: 0,
11
- returned: 0,
12
- dropped: 0,
13
- complete: offset === 0,
14
- });
15
6
  const flagNames = (flags) => {
16
7
  const names = [];
17
8
  for (const [mask, name] of [
@@ -64,7 +55,6 @@ const peProjection = (layout) => ({
64
55
  cli: layout.cli === null ? null : cliProjection(layout.cli),
65
56
  });
66
57
  const base = (target, bytes, layout) => ({
67
- schema_version: 1,
68
58
  artifact: {
69
59
  path: target.path,
70
60
  sha256: target.sha256,
@@ -73,7 +63,7 @@ const base = (target, bytes, layout) => ({
73
63
  },
74
64
  pe: peProjection(layout),
75
65
  });
76
- const unavailableResult = (target, bytes, layout, limits) => {
66
+ const unavailableResult = (target, bytes, layout) => {
77
67
  const malformed = layout.cliDirectoryPresent;
78
68
  const issues = layout.cliIssue === null ? [] : [layout.cliIssue];
79
69
  const limitations = malformed
@@ -108,9 +98,9 @@ const unavailableResult = (target, bytes, layout, limits) => {
108
98
  module: null,
109
99
  assembly: null,
110
100
  target_frameworks: [],
111
- references: emptyPage(limits.referenceOffset, limits.referenceLimit),
112
- resources: emptyPage(limits.resourceOffset, limits.resourceLimit),
113
- attributes: emptyPage(limits.attributeOffset, limits.attributeLimit),
101
+ references: [],
102
+ resources: [],
103
+ attributes: [],
114
104
  coverage: {
115
105
  state: malformed ? "partial" : "unavailable",
116
106
  issues,
@@ -205,7 +195,7 @@ const runtimeClassification = ({ layout, metadata, inventory, }) => {
205
195
  evidence,
206
196
  };
207
197
  };
208
- const partialMetadataResult = ({ target, bytes, layout, limits, issue, }) => ({
198
+ const partialMetadataResult = ({ target, bytes, layout, issue, }) => ({
209
199
  ...base(target, bytes, layout),
210
200
  classification: {
211
201
  status: "malformed",
@@ -222,7 +212,7 @@ const partialMetadataResult = ({ target, bytes, layout, limits, issue, }) => ({
222
212
  ],
223
213
  },
224
214
  metadata: {
225
- status: issue.code === "limit-exceeded" ? "partial" : "malformed",
215
+ status: "malformed",
226
216
  version: null,
227
217
  stream_names: [],
228
218
  table_row_counts: {},
@@ -230,12 +220,12 @@ const partialMetadataResult = ({ target, bytes, layout, limits, issue, }) => ({
230
220
  module: null,
231
221
  assembly: null,
232
222
  target_frameworks: [],
233
- references: emptyPage(limits.referenceOffset, limits.referenceLimit),
234
- resources: emptyPage(limits.resourceOffset, limits.resourceLimit),
235
- attributes: emptyPage(limits.attributeOffset, limits.attributeLimit),
223
+ references: [],
224
+ resources: [],
225
+ attributes: [],
236
226
  coverage: { state: "partial", issues: [issue] },
237
227
  limitations: [
238
- "CLI metadata triage stopped at the reported bounded format or resource limit.",
228
+ "CLI metadata could not be read because the PE/CLI structure is malformed or unsupported.",
239
229
  ],
240
230
  });
241
231
  const mapResources = (bytes, layout, issues) => {
@@ -255,32 +245,16 @@ const mapResources = (bytes, layout, issues) => {
255
245
  return null;
256
246
  }
257
247
  };
258
- const inventoryPagesComplete = (inventory) => inventory.references.complete &&
259
- inventory.resources.complete &&
260
- inventory.attributes.complete;
261
- /** Inspect PE/CLI identity directly from bounded bytes without CLR loading. */
262
- export const inspectManagedArtifactBytes = (bytes, target, limits) => {
248
+ /** Inspect PE/CLI identity directly from local bytes without CLR loading. */
249
+ export const inspectManagedArtifactBytes = (bytes, target) => {
263
250
  const layout = readManagedPeLayout(bytes);
264
251
  if (layout.cli === null)
265
- return unavailableResult(target, bytes, layout, limits);
252
+ return unavailableResult(target, bytes, layout);
266
253
  const cli = layout.cli;
267
- if (cli.metadata.size > limits.maxMetadataBytes)
268
- return managedArtifactInspectionSchema.parse(partialMetadataResult({
269
- target,
270
- bytes,
271
- layout,
272
- limits,
273
- issue: {
274
- code: "limit-exceeded",
275
- scope: "cli.metadata",
276
- offset: cli.headerOffset + 8,
277
- detail: `CLI metadata size exceeds max_metadata_bytes ${String(limits.maxMetadataBytes)}`,
278
- },
279
- }));
280
254
  let metadata;
281
255
  try {
282
256
  const metadataOffset = layout.rvaToOffset(cli.metadata.rva, cli.metadata.size, "cli.metadata");
283
- metadata = readManagedMetadataLayout(bytes, metadataOffset, cli.metadata.size, limits.maxTableRows);
257
+ metadata = readManagedMetadataLayout(bytes, metadataOffset, cli.metadata.size);
284
258
  }
285
259
  catch (cause) {
286
260
  if (!(cause instanceof ManagedReaderFailure))
@@ -289,25 +263,18 @@ export const inspectManagedArtifactBytes = (bytes, target, limits) => {
289
263
  target,
290
264
  bytes,
291
265
  layout,
292
- limits,
293
266
  issue: cause.issue,
294
267
  }));
295
268
  }
296
269
  const resourceIssues = [];
297
270
  const resourceDirectory = mapResources(bytes, layout, resourceIssues);
298
- const inventory = readManagedMetadataInventory(bytes, metadata, limits, resourceDirectory);
271
+ const inventory = readManagedMetadataInventory(bytes, metadata, resourceDirectory);
299
272
  const issues = [...resourceIssues, ...inventory.issues];
300
- const pagesComplete = inventoryPagesComplete(inventory);
301
273
  const limitations = [
302
- ...(pagesComplete
303
- ? []
304
- : [
305
- "At least one caller-selected metadata page omits rows; use its offset and total to continue.",
306
- ]),
307
274
  ...(issues.length === 0
308
275
  ? []
309
276
  : [
310
- "At least one bounded metadata or resource item was unavailable; coverage is partial.",
277
+ "At least one metadata or resource item could not be read; coverage is partial.",
311
278
  ]),
312
279
  "Static inspection did not load the assembly, resolve dependencies through a CLR, decompile C#, or execute target code.",
313
280
  ];
@@ -331,7 +298,7 @@ export const inspectManagedArtifactBytes = (bytes, target, limits) => {
331
298
  resources: inventory.resources,
332
299
  attributes: inventory.attributes,
333
300
  coverage: {
334
- state: pagesComplete && issues.length === 0 ? "complete" : "partial",
301
+ state: issues.length === 0 ? "complete" : "partial",
335
302
  issues,
336
303
  },
337
304
  limitations,
@@ -2,11 +2,10 @@ import { managedMemberInspectionSchema, } from "../domain/managedArtifact.js";
2
2
  import { readManagedPeLayout, } from "./ManagedPeReader.js";
3
3
  import { managedTableRowCounts, readManagedMetadataInventory, } from "./ManagedMetadataInventory.js";
4
4
  import { readManagedMetadataLayout } from "./ManagedMetadataLayout.js";
5
- import { ManagedReaderFailure, managedFailure, } from "./ManagedReaderFailure.js";
6
- import { emptyPage, page, parseTypes, typeRanges, } from "./ManagedMemberInspectorCore.js";
5
+ import { ManagedReaderFailure } from "./ManagedReaderFailure.js";
6
+ import { parseTypes, typeRanges } from "./ManagedMemberInspectorCore.js";
7
7
  import { edges, parseFields, parseMemberRefs, parseMethods, } from "./ManagedMemberRows.js";
8
- const unavailable = (target, bytes, limits, issue) => managedMemberInspectionSchema.parse({
9
- schema_version: 1,
8
+ const unavailable = (target, bytes, issue) => managedMemberInspectionSchema.parse({
10
9
  artifact: {
11
10
  path: target.path,
12
11
  sha256: target.sha256,
@@ -24,12 +23,12 @@ const unavailable = (target, bytes, limits, issue) => managedMemberInspectionSch
24
23
  requires_artifact_sha256: target.sha256,
25
24
  requires_mvid: null,
26
25
  },
27
- types: emptyPage(limits.typeOffset, limits.typeLimit),
28
- fields: emptyPage(limits.fieldOffset, limits.fieldLimit),
29
- methods: emptyPage(limits.methodOffset, limits.methodLimit),
30
- member_refs: emptyPage(limits.memberRefOffset, limits.memberRefLimit),
31
- call_edges: emptyPage(limits.edgeOffset, limits.edgeLimit),
32
- field_accesses: emptyPage(limits.edgeOffset, limits.edgeLimit),
26
+ types: [],
27
+ fields: [],
28
+ methods: [],
29
+ member_refs: [],
30
+ call_edges: [],
31
+ field_accesses: [],
33
32
  coverage: {
34
33
  state: "unavailable",
35
34
  issues: issue === null ? [] : [issue],
@@ -50,62 +49,37 @@ const resourceDirectory = (pe) => {
50
49
  size: pe.cli.resources.size,
51
50
  };
52
51
  };
53
- const collectMethodBodyIssues = (methods, limits) => methods.methods.flatMap((method) => method.body.status === "partial"
54
- ? [
55
- {
56
- code: "limit-exceeded",
57
- scope: `method.${method.token}.body.instructions`,
58
- offset: method.body.file_offset,
59
- detail: method.body.issue ??
60
- `Instruction decode reached max_method_instructions ${String(limits.maxMethodInstructions)}`,
61
- },
62
- ]
63
- : []);
64
- const readMemberInventory = (bytes, pe, limits) => {
52
+ const readMemberInventory = (bytes, pe) => {
65
53
  const cli = pe.cli;
66
54
  if (cli === null)
67
55
  throw new TypeError("Managed inventory requires CLI metadata");
68
56
  const rootOffset = pe.rvaToOffset(cli.metadata.rva, cli.metadata.size, "cli.metadata");
69
- if (cli.metadata.size > limits.maxMetadataBytes)
70
- throw managedFailure("limit-exceeded", "metadata.root", `CLI metadata size exceeds max_metadata_bytes ${String(limits.maxMetadataBytes)}`, rootOffset);
71
- const layout = readManagedMetadataLayout(bytes, rootOffset, cli.metadata.size, limits.maxTableRows);
72
- const inventory = readManagedMetadataInventory(bytes, layout, {
73
- referenceOffset: 0,
74
- referenceLimit: 1,
75
- resourceOffset: 0,
76
- resourceLimit: 1,
77
- attributeOffset: 0,
78
- attributeLimit: 1,
79
- maxHeapItemBytes: limits.maxHeapItemBytes,
80
- }, resourceDirectory(pe));
57
+ const layout = readManagedMetadataLayout(bytes, rootOffset, cli.metadata.size);
58
+ const inventory = readManagedMetadataInventory(bytes, layout, resourceDirectory(pe));
81
59
  return { layout, inventory };
82
60
  };
83
61
  /** Inspect metadata members and method bodies without loading target code. */
84
- export const inspectManagedMembersBytes = (bytes, target, limits) => {
62
+ export const inspectManagedMembersBytes = (bytes, target) => {
85
63
  const pe = readManagedPeLayout(bytes);
86
64
  if (pe.cli === null)
87
- return unavailable(target, bytes, limits, pe.cliIssue);
65
+ return unavailable(target, bytes, pe.cliIssue);
88
66
  const issues = [];
89
67
  try {
90
- const { layout, inventory } = readMemberInventory(bytes, pe, limits);
68
+ const { layout, inventory } = readMemberInventory(bytes, pe);
91
69
  issues.push(...inventory.issues);
92
- const ranges = typeRanges(bytes, layout, limits.maxHeapItemBytes);
93
- const types = parseTypes(bytes, layout, ranges, limits.maxHeapItemBytes);
94
- const fields = parseFields(bytes, layout, ranges, limits.maxHeapItemBytes);
95
- const memberRefs = parseMemberRefs(bytes, layout, limits.maxHeapItemBytes);
70
+ const ranges = typeRanges(bytes, layout);
71
+ const types = parseTypes(bytes, layout, ranges);
72
+ const fields = parseFields(bytes, layout, ranges);
73
+ const memberRefs = parseMemberRefs(bytes, layout);
96
74
  const methods = parseMethods({
97
75
  bytes,
98
76
  layout,
99
77
  pe,
100
78
  ranges,
101
- maxBytes: limits.maxHeapItemBytes,
102
- limits,
103
79
  });
104
- const methodBodyIssues = collectMethodBodyIssues(methods, limits);
105
- const coverageIssues = [...issues, ...methodBodyIssues];
80
+ const coverageIssues = issues;
106
81
  const related = edges(methods.methods, methods.core, fields.core, memberRefs.core);
107
82
  return managedMemberInspectionSchema.parse({
108
- schema_version: 1,
109
83
  artifact: {
110
84
  path: target.path,
111
85
  sha256: target.sha256,
@@ -123,12 +97,12 @@ export const inspectManagedMembersBytes = (bytes, target, limits) => {
123
97
  requires_artifact_sha256: target.sha256,
124
98
  requires_mvid: inventory.module?.mvid ?? null,
125
99
  },
126
- types: page(types, limits.typeOffset, limits.typeLimit),
127
- fields: page(fields.fields, limits.fieldOffset, limits.fieldLimit),
128
- methods: page(methods.methods, limits.methodOffset, limits.methodLimit),
129
- member_refs: page(memberRefs.refs, limits.memberRefOffset, limits.memberRefLimit),
130
- call_edges: page(related.callEdges, limits.edgeOffset, limits.edgeLimit),
131
- field_accesses: page(related.fieldAccesses, limits.edgeOffset, limits.edgeLimit),
100
+ types,
101
+ fields: fields.fields,
102
+ methods: methods.methods,
103
+ member_refs: memberRefs.refs,
104
+ call_edges: related.callEdges,
105
+ field_accesses: related.fieldAccesses,
132
106
  coverage: {
133
107
  state: coverageIssues.length === 0 ? "complete" : "partial",
134
108
  issues: coverageIssues,
@@ -137,17 +111,12 @@ export const inspectManagedMembersBytes = (bytes, target, limits) => {
137
111
  "Metadata tokens are build-local coordinates and are only meaningful with the reported artifact SHA-256 and MVID.",
138
112
  "CIL instruction anchors are decoded from file-backed method bodies only; no target assembly is loaded or executed.",
139
113
  "Signatures are decoded for common ECMA-335 primitive, class, valuetype, pointer, byref, array, and generic variable forms; unsupported forms retain raw signature hashes.",
140
- ...(methodBodyIssues.length > 0
141
- ? [
142
- "At least one CIL method body reached max_method_instructions; its decoded prefix is partial and has no normalized CIL identity.",
143
- ]
144
- : []),
145
114
  ],
146
115
  });
147
116
  }
148
117
  catch (cause) {
149
118
  if (cause instanceof ManagedReaderFailure)
150
- return unavailable(target, bytes, limits, cause.issue);
119
+ return unavailable(target, bytes, cause.issue);
151
120
  throw cause;
152
121
  }
153
122
  };
@@ -1,42 +1,5 @@
1
- import { metadataRowOffset, } from "./ManagedMetadataLayout.js";
2
- import { MetadataRowCursor, metadataToken, readMetadataString, sha256Bytes, } from "./ManagedMetadataHeaps.js";
3
- import { managedFailure } from "./ManagedReaderFailure.js";
4
- export const emptyPage = (offset, limit) => ({
5
- items: [],
6
- offset,
7
- limit,
8
- total: 0,
9
- returned: 0,
10
- dropped: 0,
11
- complete: offset === 0,
12
- });
13
- export const page = (all, offset, limit) => {
14
- const items = all.slice(offset, offset + limit);
15
- return {
16
- items,
17
- offset,
18
- limit,
19
- total: all.length,
20
- returned: items.length,
21
- dropped: all.length - items.length,
22
- complete: offset === 0 && offset + limit >= all.length,
23
- };
24
- };
25
- export const rowCursor = (bytes, layout, table, row) => {
26
- const descriptor = layout.table(table);
27
- const start = metadataRowOffset(layout, table, row);
28
- if (descriptor === undefined)
29
- throw managedFailure("invalid-row", `metadata.${String(table)}`, "Metadata table is absent", start);
30
- return new MetadataRowCursor(bytes, start, start + descriptor.rowSize, `metadata.${descriptor.name}`);
31
- };
32
- export const codedToken = (raw, bits, tables) => {
33
- if (raw === 0)
34
- return null;
35
- const tag = raw & (2 ** bits - 1);
36
- const row = Math.floor(raw / 2 ** bits);
37
- const table = tables[tag];
38
- return table === undefined || row === 0 ? null : metadataToken(table, row);
39
- };
1
+ import {} from "./ManagedMetadataLayout.js";
2
+ import { metadataRowCursor, metadataCodedToken, metadataToken, readMetadataString, sha256Bytes, } from "./ManagedMetadataHeaps.js";
40
3
  const rowRange = (table, start, nextStart) => {
41
4
  const total = table?.rowCount ?? 0;
42
5
  if (total === 0 || start === 0)
@@ -47,13 +10,13 @@ const rowRange = (table, start, nextStart) => {
47
10
  return { first: start, last: end - 1, count: end - start };
48
11
  };
49
12
  const fullName = (namespace, name) => namespace.length === 0 ? name : `${namespace}.${name}`;
50
- const readTypeRange = (bytes, layout, row, maxBytes) => {
13
+ const readTypeRange = (bytes, layout, row) => {
51
14
  const methods = layout.table(6);
52
15
  const fields = layout.table(4);
53
- const cursor = rowCursor(bytes, layout, 2, row);
16
+ const cursor = metadataRowCursor(bytes, layout, 2, row);
54
17
  cursor.readUInt32();
55
- const name = readMetadataString(bytes, layout, cursor.readIndex(layout.stringIndexSize), maxBytes);
56
- const namespace = readMetadataString(bytes, layout, cursor.readIndex(layout.stringIndexSize), maxBytes);
18
+ const name = readMetadataString(bytes, layout, cursor.readIndex(layout.stringIndexSize), layout.strings.size);
19
+ const namespace = readMetadataString(bytes, layout, cursor.readIndex(layout.stringIndexSize), layout.strings.size);
57
20
  cursor.readIndex(layout.codedIndexSize("TypeDefOrRef"));
58
21
  const fieldStart = cursor.readIndex(layout.tableIndexSize(4));
59
22
  const methodStart = cursor.readIndex(layout.tableIndexSize(6));
@@ -61,7 +24,7 @@ const readTypeRange = (bytes, layout, row, maxBytes) => {
61
24
  let nextMethod = (methods?.rowCount ?? 0) + 1;
62
25
  const typeTable = layout.table(2);
63
26
  if (typeTable !== undefined && row < typeTable.rowCount) {
64
- const next = rowCursor(bytes, layout, 2, row + 1);
27
+ const next = metadataRowCursor(bytes, layout, 2, row + 1);
65
28
  next.readUInt32();
66
29
  next.readIndex(layout.stringIndexSize);
67
30
  next.readIndex(layout.stringIndexSize);
@@ -78,11 +41,11 @@ const readTypeRange = (bytes, layout, row, maxBytes) => {
78
41
  methodEnd: nextMethod,
79
42
  };
80
43
  };
81
- export const typeRanges = (bytes, layout, maxBytes) => {
44
+ export const typeRanges = (bytes, layout) => {
82
45
  const typeTable = layout.table(2);
83
46
  const ranges = [];
84
47
  for (let row = 1; row <= (typeTable?.rowCount ?? 0); row += 1)
85
- ranges.push(readTypeRange(bytes, layout, row, maxBytes));
48
+ ranges.push(readTypeRange(bytes, layout, row));
86
49
  return ranges;
87
50
  };
88
51
  export const declaringType = (ranges, table, row) => {
@@ -94,16 +57,16 @@ export const declaringType = (ranges, table, row) => {
94
57
  }
95
58
  return null;
96
59
  };
97
- export const parseTypes = (bytes, layout, ranges, maxBytes) => {
60
+ export const parseTypes = (bytes, layout, ranges) => {
98
61
  const typeTable = layout.table(2);
99
62
  const fields = layout.table(4);
100
63
  const methods = layout.table(6);
101
64
  const items = [];
102
65
  for (let row = 1; row <= (typeTable?.rowCount ?? 0); row += 1) {
103
- const cursor = rowCursor(bytes, layout, 2, row);
66
+ const cursor = metadataRowCursor(bytes, layout, 2, row);
104
67
  const flags = cursor.readUInt32();
105
- const name = readMetadataString(bytes, layout, cursor.readIndex(layout.stringIndexSize), maxBytes);
106
- const namespace = readMetadataString(bytes, layout, cursor.readIndex(layout.stringIndexSize), maxBytes);
68
+ const name = readMetadataString(bytes, layout, cursor.readIndex(layout.stringIndexSize), layout.strings.size);
69
+ const namespace = readMetadataString(bytes, layout, cursor.readIndex(layout.stringIndexSize), layout.strings.size);
107
70
  const extendsRaw = cursor.readIndex(layout.codedIndexSize("TypeDefOrRef"));
108
71
  const fieldStart = cursor.readIndex(layout.tableIndexSize(4));
109
72
  const methodStart = cursor.readIndex(layout.tableIndexSize(6));
@@ -117,7 +80,7 @@ export const parseTypes = (bytes, layout, ranges, maxBytes) => {
117
80
  name,
118
81
  full_name: fullName(namespace, name),
119
82
  flags,
120
- extends_token: codedToken(extendsRaw, 2, [2, 1, 27]),
83
+ extends_token: metadataCodedToken(extendsRaw, 2, [2, 1, 27]),
121
84
  field_list: {
122
85
  first_row: fieldRange.first,
123
86
  last_row: fieldRange.last,
@@ -342,12 +342,12 @@ const readOperand = (il, offset, kind) => {
342
342
  return { next: offset + 4, anchorKind: tokenKind(token), value: token };
343
343
  return { next: offset, anchorKind: "unknown", value: null };
344
344
  };
345
- export const decodeInstructions = (il, limit) => {
345
+ export const decodeInstructions = (il) => {
346
346
  const parsed = [];
347
347
  let offset = 0;
348
348
  let issue = null;
349
349
  try {
350
- while (offset < il.length && parsed.length < limit) {
350
+ while (offset < il.length) {
351
351
  const start = offset;
352
352
  const first = il.readUInt8(offset);
353
353
  offset += 1;