rea-agents 3.1.0 → 3.2.1

package/dist/dotnet/ManagedNativeBoundaryHelpers.js

@@ -1,57 +1,28 @@
 import { managedNativeBoundaryInspectionSchema, } from "../domain/managedArtifact.js";
-import { metadataRowOffset, } from "./ManagedMetadataLayout.js";
-import { MetadataRowCursor, metadataToken, readMetadataString, } from "./ManagedMetadataHeaps.js";
+import {} from "./ManagedMetadataLayout.js";
+import { metadataRowCursor, metadataCodedToken, metadataToken, readMetadataString, } from "./ManagedMetadataHeaps.js";
 import { managedTableRowCounts } from "./ManagedMetadataInventory.js";
-import { managedFailure } from "./ManagedReaderFailure.js";
-const rowCursor = ({ bytes, layout, table, row, }) => {
-    const descriptor = layout.table(table);
-    const start = metadataRowOffset(layout, table, row);
-    if (descriptor === undefined)
-        throw managedFailure("invalid-row", `metadata.${String(table)}`, "Metadata table is absent", start);
-    return new MetadataRowCursor(bytes, start, start + descriptor.rowSize, `metadata.${descriptor.name}`);
-};
-const codedToken = (raw, tagBits, tables) => {
-    const tagMask = (1 << tagBits) - 1;
-    const table = tables[raw & tagMask];
-    const row = raw >> tagBits;
-    if (table === undefined || row === 0)
-        return null;
-    return metadataToken(table, row);
-};
 const flagsHex = (value) => `0x${value.toString(16).padStart(4, "0")}`;
-const page = (items, offset, limit) => {
-    const safeOffset = Math.min(offset, items.length);
-    const selected = items.slice(safeOffset, safeOffset + limit);
-    return {
-        items: selected,
-        offset,
-        limit,
-        total: items.length,
-        returned: selected.length,
-        dropped: Math.max(0, items.length - safeOffset - selected.length),
-        complete: safeOffset === 0 && selected.length === items.length,
-    };
-};
-export const parseModuleRefs = (bytes, layout, maxBytes) => {
+export const parseModuleRefs = (bytes, layout, heapExtent) => {
     const refs = [];
     const table = layout.table(26);
     for (let row = 1; row <= (table?.rowCount ?? 0); row += 1) {
-        const cursor = rowCursor({ bytes, layout, table: 26, row });
+        const cursor = metadataRowCursor(bytes, layout, 26, row);
         refs.push({
             token: metadataToken(26, row),
             row_offset: cursor.start,
-            name: readMetadataString(bytes, layout, cursor.readIndex(layout.stringIndexSize), maxBytes),
+            name: readMetadataString(bytes, layout, cursor.readIndex(layout.stringIndexSize), heapExtent),
         });
     }
     return refs;
 };
-export const parseFields = (bytes, layout, maxBytes) => {
+export const parseFields = (bytes, layout, heapExtent) => {
     const fields = new Map();
     const table = layout.table(4);
     for (let row = 1; row <= (table?.rowCount ?? 0); row += 1) {
-        const cursor = rowCursor({ bytes, layout, table: 4, row });
+        const cursor = metadataRowCursor(bytes, layout, 4, row);
         const flags = cursor.readUInt16();
-        const name = readMetadataString(bytes, layout, cursor.readIndex(layout.stringIndexSize), maxBytes);
+        const name = readMetadataString(bytes, layout, cursor.readIndex(layout.stringIndexSize), heapExtent);
         cursor.readIndex(layout.blobIndexSize);
         const token = metadataToken(4, row);
         fields.set(token, {
@@ -66,15 +37,15 @@ export const parseFields = (bytes, layout, maxBytes) => {
     }
     return fields;
 };
-export const parseMethods = (bytes, layout, maxBytes) => {
+export const parseMethods = (bytes, layout, heapExtent) => {
     const methods = new Map();
     const table = layout.table(6);
     for (let row = 1; row <= (table?.rowCount ?? 0); row += 1) {
-        const cursor = rowCursor({ bytes, layout, table: 6, row });
+        const cursor = metadataRowCursor(bytes, layout, 6, row);
         const rva = cursor.readUInt32();
         const implFlags = cursor.readUInt16();
         const flags = cursor.readUInt16();
-        const name = readMetadataString(bytes, layout, cursor.readIndex(layout.stringIndexSize), maxBytes);
+        const name = readMetadataString(bytes, layout, cursor.readIndex(layout.stringIndexSize), heapExtent);
         cursor.readIndex(layout.blobIndexSize);
         cursor.readIndex(layout.tableIndexSize(8));
         const token = metadataToken(6, row);
@@ -90,15 +61,15 @@ export const parseMethods = (bytes, layout, maxBytes) => {
     }
     return methods;
 };
-export const parseImplMaps = ({ bytes, layout, maxBytes, modules, members, }) => {
+export const parseImplMaps = ({ bytes, layout, heapExtent, modules, members, }) => {
     const moduleNames = new Map(modules.map((module) => [module.token, module]));
     const imports = [];
     const table = layout.table(28);
     for (let row = 1; row <= (table?.rowCount ?? 0); row += 1) {
-        const cursor = rowCursor({ bytes, layout, table: 28, row });
+        const cursor = metadataRowCursor(bytes, layout, 28, row);
         const mappingFlags = cursor.readUInt16();
-        const memberToken = codedToken(cursor.readIndex(layout.codedIndexSize("MemberForwarded")), 1, [4, 6]);
-        const importName = readMetadataString(bytes, layout, cursor.readIndex(layout.stringIndexSize), maxBytes);
+        const memberToken = metadataCodedToken(cursor.readIndex(layout.codedIndexSize("MemberForwarded")), 1, [4, 6]);
+        const importName = readMetadataString(bytes, layout, cursor.readIndex(layout.stringIndexSize), heapExtent);
         const importScopeRow = cursor.readIndex(layout.tableIndexSize(26));
         const importScopeToken = importScopeRow === 0 ? null : metadataToken(26, importScopeRow);
         const member = memberToken === null ? undefined : members.get(memberToken);
@@ -267,8 +238,7 @@ export const cliNative = (pe) => {
         managed_native_header_size: pe.cli.managedNativeHeader.size,
     };
 };
-export const buildNativeBoundaryInspection = ({ target, bytes, limits, layout, inventory, moduleRefs, imports, implementations, native, issues, }) => managedNativeBoundaryInspectionSchema.parse({
-    schema_version: 1,
+export const buildNativeBoundaryInspection = ({ target, bytes, layout, inventory, moduleRefs, imports, implementations, native, issues, }) => managedNativeBoundaryInspectionSchema.parse({
     artifact: {
         path: target.path,
         sha256: target.sha256,
@@ -287,9 +257,9 @@ export const buildNativeBoundaryInspection = ({ target, bytes, limits, layout, i
         requires_mvid: inventory.module?.mvid ?? null,
     },
     cli_native: native,
-    module_refs: page(moduleRefs, limits.moduleRefOffset, limits.moduleRefLimit),
-    pinvoke_imports: page(imports, limits.importOffset, limits.importLimit),
-    native_implementations: page(implementations, limits.implementationOffset, limits.implementationLimit),
+    module_refs: moduleRefs,
+    pinvoke_imports: imports,
+    native_implementations: implementations,
     summary: {
         module_ref_count: moduleRefs.length,
         pinvoke_import_count: imports.length,

package/dist/dotnet/ManagedNativeBoundaryInspector.js

@@ -4,17 +4,7 @@ import { readManagedMetadataLayout, } from "./ManagedMetadataLayout.js";
 import { readManagedPeLayout, } from "./ManagedPeReader.js";
 import { ManagedReaderFailure } from "./ManagedReaderFailure.js";
 import { buildNativeBoundaryInspection, cliNative, nativeImplementations, parseFields, parseImplMaps, parseMethods, parseModuleRefs, } from "./ManagedNativeBoundaryHelpers.js";
-const emptyPage = () => ({
-    items: [],
-    offset: 0,
-    limit: 0,
-    total: 0,
-    returned: 0,
-    dropped: 0,
-    complete: true,
-});
 const emptyInspection = (target, bytes, classification, issues = []) => managedNativeBoundaryInspectionSchema.parse({
-    schema_version: 1,
     artifact: {
         path: target.path,
         sha256: target.sha256,
@@ -43,9 +33,9 @@ const emptyInspection = (target, bytes, classification, issues = []) => managedN
         managed_native_header_rva: 0,
         managed_native_header_size: 0,
     },
-    module_refs: emptyPage(),
-    pinvoke_imports: emptyPage(),
-    native_implementations: emptyPage(),
+    module_refs: [],
+    pinvoke_imports: [],
+    native_implementations: [],
     summary: {
         module_ref_count: 0,
         pinvoke_import_count: 0,
@@ -59,32 +49,18 @@ const emptyInspection = (target, bytes, classification, issues = []) => managedN
         "Static inspection does not load or execute target code, so native export resolution is not performed.",
     ],
 });
-const readBoundaryInventory = (bytes, pe, cli, limits) => {
+const readBoundaryInventory = (bytes, pe, cli) => {
     const metadataOffset = pe.rvaToOffset(cli.metadata.rva, cli.metadata.size, "cli.metadata");
-    const layout = readManagedMetadataLayout(bytes, metadataOffset, cli.metadata.size, limits.maxTableRows);
+    const layout = readManagedMetadataLayout(bytes, metadataOffset, cli.metadata.size);
     const resourceDirectory = {
         offset: pe.rvaToOffset(cli.resources.rva, cli.resources.size, "cli.resources"),
         size: cli.resources.size,
     };
-    const inventory = readManagedMetadataInventory(bytes, layout, {
-        referenceOffset: 0,
-        referenceLimit: 0,
-        resourceOffset: 0,
-        resourceLimit: 0,
-        attributeOffset: 0,
-        attributeLimit: 0,
-        maxHeapItemBytes: limits.maxHeapItemBytes,
-    }, resourceDirectory);
+    const inventory = readManagedMetadataInventory(bytes, layout, resourceDirectory);
     return { layout, inventory };
 };
-const metadataLimitIssue = (cli, maxBytes) => ({
-    code: "limit-exceeded",
-    scope: "cli.metadata",
-    offset: cli.headerOffset + 8,
-    detail: `CLI metadata size exceeds max_metadata_bytes ${String(maxBytes)}`,
-});
 /** Inspect managed/native boundary declarations from PE metadata without execution. */
-export const inspectManagedNativeBoundariesBytes = (bytes, target, limits) => {
+export const inspectManagedNativeBoundariesBytes = (bytes, target) => {
     let pe;
     try {
         pe = readManagedPeLayout(bytes);
@@ -96,29 +72,26 @@ export const inspectManagedNativeBoundariesBytes = (bytes, target, limits) => {
     }
     if (pe.cli === null)
         return emptyInspection(target, bytes, pe.cliDirectoryPresent ? "malformed" : "not-managed", pe.cliIssue === null ? [] : [pe.cliIssue]);
-    if (pe.cli.metadata.size > limits.maxMetadataBytes)
-        return emptyInspection(target, bytes, "malformed", [
-            metadataLimitIssue(pe.cli, limits.maxMetadataBytes),
-        ]);
     let layout;
     let inventory;
     try {
-        ({ layout, inventory } = readBoundaryInventory(bytes, pe, pe.cli, limits));
+        ({ layout, inventory } = readBoundaryInventory(bytes, pe, pe.cli));
     }
     catch (cause) {
         if (!(cause instanceof ManagedReaderFailure))
             throw cause;
         return emptyInspection(target, bytes, "malformed", [cause.issue]);
     }
-    const moduleRefs = parseModuleRefs(bytes, layout, limits.maxHeapItemBytes);
+    const heapExtent = Math.max(layout.strings.size, layout.blob.size);
+    const moduleRefs = parseModuleRefs(bytes, layout, heapExtent);
     const members = new Map([
-        ...parseFields(bytes, layout, limits.maxHeapItemBytes),
-        ...parseMethods(bytes, layout, limits.maxHeapItemBytes),
+        ...parseFields(bytes, layout, heapExtent),
+        ...parseMethods(bytes, layout, heapExtent),
     ]);
     const imports = parseImplMaps({
         bytes,
         layout,
-        maxBytes: limits.maxHeapItemBytes,
+        heapExtent,
         modules: moduleRefs,
         members,
     });
@@ -129,7 +102,6 @@ export const inspectManagedNativeBoundariesBytes = (bytes, target, limits) => {
     return buildNativeBoundaryInspection({
         target,
         bytes,
-        limits,
         pe,
         layout,
         inventory,

package/dist/dotnet/ManagedPeReader.js

@@ -104,8 +104,8 @@ const readCoffHeader = (bytes) => {
     const coff = peOffset + 4;
     const machine = bytes.readUInt16LE(coff);
     const sectionCount = bytes.readUInt16LE(coff + 2);
-    if (sectionCount === 0 || sectionCount > 96)
-        throw managedFailure("invalid-directory", "pe.sections", "PE section count is outside the admitted range", coff + 2);
+    if (sectionCount === 0)
+        throw managedFailure("invalid-directory", "pe.sections", "PE section count must be positive", coff + 2);
     const optionalSize = bytes.readUInt16LE(coff + 16);
     const characteristics = bytes.readUInt16LE(coff + 18);
     return { coff, machine, sectionCount, optionalSize, characteristics };

package/dist/dotnet/ManagedStaticProvider.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { createReadStream } from "node:fs";
-import { readFile, stat } from "node:fs/promises";
+import { readFile } from "node:fs/promises";
 import { createAnalysisExecution, } from "../application/AnalysisProvider.js";
 import { MANAGED_STATIC_PROVIDER } from "../application/InvestigationProviders.js";
 import { MANAGED_TOOL_CONTRACTS, managedArtifactInputSchema, managedMemberInputSchema, managedNativeBoundaryInputSchema, } from "../contracts/managedToolContracts.js";
@@ -15,12 +15,8 @@ export class ManagedStaticProvider {
     #capabilities = Object.freeze(MANAGED_TOOL_CONTRACTS.map((contract) => Object.freeze({
         provider: IDENTITY,
         operation: contract.name,
-        inputContractVersion: 1,
-        outputContractVersion: 1,
         available: true,
         reason: null,
-        pagination: "offset",
-        exhaustive: false,
         effects: Object.freeze({
             mutatesArtifact: false,
             launchesProcess: false,
@@ -30,11 +26,6 @@ export class ManagedStaticProvider {
             changesPermissions: false,
             requiresRoot: false,
         }),
-        limits: Object.freeze({
-            maxResults: 500,
-            maxPayloadBytes: 4 * 1024 * 1024,
-            timeoutMs: null,
-        }),
         limitations: limitationsFor(contract.name),
     })));
     identity() {
@@ -63,16 +54,10 @@ class ManagedStaticClient {
         try {
             if (options?.signal?.aborted === true)
                 return err(new AnalysisCancelledError(operation));
-            const maxFileBytes = maxRequestedFileBytes(operation, parameters);
-            const metadata = await stat(this.target.path);
-            if (metadata.size > maxFileBytes)
-                return err(new AnalysisCapabilityUnavailableError(IDENTITY.id, operation, `Artifact size ${String(metadata.size)} exceeds max_file_bytes ${String(maxFileBytes)}.`));
             const snapshot = this.#snapshotBytes;
             const observed = snapshot === undefined
                 ? await readManagedSnapshot(this.target.path, options?.signal)
                 : await hashManagedSource(this.target.path, options?.signal);
-            if (observed.byteLength > maxFileBytes)
-                return err(new AnalysisCapabilityUnavailableError(IDENTITY.id, operation, `Artifact grew beyond max_file_bytes ${String(maxFileBytes)} while it was read.`));
             if (observed.sha256 !== this.target.sha256)
                 return err(new EvidenceIntegrityError(`Managed artifact digest changed after open: expected ${this.target.sha256}, observed ${observed.sha256} at ${this.target.path}`));
             const bytes = snapshot ?? observed.bytes;
@@ -113,6 +98,8 @@ const hashManagedSource = async (path, signal) => {
     for await (const chunk of stream) {
         if (!Buffer.isBuffer(chunk))
             throw new TypeError("Managed source stream returned non-buffer data");
+        if (chunk.length > Number.MAX_SAFE_INTEGER - byteLength)
+            throw new RangeError("Managed source byte length overflowed");
         byteLength += chunk.length;
         digest.update(chunk);
     }
@@ -121,7 +108,7 @@ const hashManagedSource = async (path, signal) => {
 const isManagedOperation = (operation) => MANAGED_TOOL_CONTRACTS.some(({ name }) => name === operation);
 const limitationsFor = (operation) => Object.freeze(operation === "inspect_managed_artifact"
     ? [
-        "This capability inventories PE/CLI identity only; inspect_managed_members admits bounded metadata members, signatures, and CIL anchors.",
+        "This capability inventories PE/CLI identity only; inspect_managed_members admits metadata members, signatures, and CIL anchors.",
         "It never loads the target assembly, resolves dependencies through a CLR, decompiles C#, or executes target code.",
     ]
     : operation === "inspect_managed_native_boundaries"
@@ -130,64 +117,20 @@ const limitationsFor = (operation) => Object.freeze(operation === "inspect_manag
             "It never loads the target assembly, resolves dependencies through a CLR, decompiles C#, or executes target code.",
         ]
         : [
-            "This capability decodes bounded PE/CLI metadata members, signatures, and file-backed method bodies; decompiled C# and cross-build matching are separate future contracts.",
+            "This capability decodes PE/CLI metadata members, signatures, and file-backed method bodies; decompiled C# reconstruction and cross-build member comparison are separate operations.",
             "It never loads the target assembly, resolves dependencies through a CLR, decompiles C#, or executes target code.",
         ]);
-const maxRequestedFileBytes = (operation, parameters) => {
-    if (operation === "inspect_managed_artifact")
-        return managedArtifactInputSchema.parse(parameters).max_file_bytes;
-    if (operation === "inspect_managed_native_boundaries")
-        return managedNativeBoundaryInputSchema.parse(parameters).max_file_bytes;
-    return managedMemberInputSchema.parse(parameters).max_file_bytes;
-};
 const inspectManagedOperation = (operation, parameters, bytes, target) => {
     if (operation === "inspect_managed_artifact") {
-        const input = managedArtifactInputSchema.parse(parameters);
-        return inspectManagedArtifactBytes(bytes, target, {
-            referenceOffset: input.reference_offset,
-            referenceLimit: input.reference_limit,
-            resourceOffset: input.resource_offset,
-            resourceLimit: input.resource_limit,
-            attributeOffset: input.attribute_offset,
-            attributeLimit: input.attribute_limit,
-            maxMetadataBytes: input.max_metadata_bytes,
-            maxTableRows: input.max_table_rows,
-            maxHeapItemBytes: input.max_heap_item_bytes,
-        });
+        managedArtifactInputSchema.parse(parameters);
+        return inspectManagedArtifactBytes(bytes, target);
     }
     if (operation === "inspect_managed_native_boundaries") {
-        const input = managedNativeBoundaryInputSchema.parse(parameters);
-        return inspectManagedNativeBoundariesBytes(bytes, target, {
-            moduleRefOffset: input.module_ref_offset,
-            moduleRefLimit: input.module_ref_limit,
-            importOffset: input.import_offset,
-            importLimit: input.import_limit,
-            implementationOffset: input.implementation_offset,
-            implementationLimit: input.implementation_limit,
-            maxMetadataBytes: input.max_metadata_bytes,
-            maxTableRows: input.max_table_rows,
-            maxHeapItemBytes: input.max_heap_item_bytes,
-        });
+        managedNativeBoundaryInputSchema.parse(parameters);
+        return inspectManagedNativeBoundariesBytes(bytes, target);
     }
-    const input = managedMemberInputSchema.parse(parameters);
-    return inspectManagedMembersBytes(bytes, target, {
-        typeOffset: input.type_offset,
-        typeLimit: input.type_limit,
-        methodOffset: input.method_offset,
-        methodLimit: input.method_limit,
-        fieldOffset: input.field_offset,
-        fieldLimit: input.field_limit,
-        memberRefOffset: input.member_ref_offset,
-        memberRefLimit: input.member_ref_limit,
-        edgeOffset: input.edge_offset,
-        edgeLimit: input.edge_limit,
-        instructionAnchorLimit: input.instruction_anchor_limit,
-        maxMetadataBytes: input.max_metadata_bytes,
-        maxTableRows: input.max_table_rows,
-        maxHeapItemBytes: input.max_heap_item_bytes,
-        maxMethodBodyBytes: input.max_method_body_bytes,
-        maxMethodInstructions: input.max_method_instructions,
-    });
+    managedMemberInputSchema.parse(parameters);
+    return inspectManagedMembersBytes(bytes, target);
 };
 const managedLocations = (result) => {
     if ("pe" in result) {
@@ -212,9 +155,8 @@ const managedLocations = (result) => {
             ...(result.module === null
                 ? [{ kind: "file-offset", offset: 0 }]
                 : [{ kind: "file-offset", offset: result.module.row_offset }]),
-            ...result.methods.items
+            ...result.methods
                 .filter((method) => method.body.file_offset !== null)
-                .slice(0, 8)
                 .map((method) => ({
                 kind: "file-offset",
                 offset: method.body.file_offset ?? 0,
@@ -224,7 +166,7 @@ const managedLocations = (result) => {
         ...(result.module === null
             ? [{ kind: "file-offset", offset: 0 }]
             : [{ kind: "file-offset", offset: result.module.row_offset }]),
-        ...result.pinvoke_imports.items.slice(0, 8).map((mapping) => ({
+        ...result.pinvoke_imports.map((mapping) => ({
             kind: "file-offset",
             offset: mapping.row_offset,
         })),