rea-agents 4.1.0 → 5.0.0

package/dist/ghidra/GhidraProvider.js

@@ -1,25 +1,15 @@
-import { ghidraExtensionFailure } from "./extensions/GhidraExtensionFailures.js";
-import { fileURLToPath } from "node:url";
-import { createAnalysisExecution, } from "../application/AnalysisProvider.js";
-import { createAnalysisProfile } from "../domain/analysisProfile.js";
+import {} from "../application/AnalysisProvider.js";
+import { createAnalysisProfile, } from "../domain/analysisProfile.js";
 import { jsonObjectSchema, jsonValueSchema, } from "../domain/jsonValue.js";
-import { nativeLoadImageObservationSchema, nativeLoadImageSchema, } from "../domain/nativeLoadImage.js";
-import { attestGhidraDosLoadImage, attestGhidraDosComLoadImage, } from "./GhidraLoadImageValues.js";
-import { AnalysisCancelledError, AnalysisCapabilityUnavailableError, AnalysisInputError, AnalysisTimeoutError, } from "../domain/analysisErrorCore.js";
-import {} from "../domain/analysisErrorBase.js";
-import { ProviderAdapterError } from "../domain/providerAdapterError.js";
-import { err, ok } from "../domain/result.js";
+import { ok } from "../domain/result.js";
 import { GhidraClient } from "./GhidraClient.js";
-import { GHIDRA_STARTUP_TIMEOUT_MS } from "./GhidraDefaults.js";
-import { isGhidraFunctionOperation, parseGhidraFunctionInput, parseGhidraFunctionResult, } from "./GhidraFunctionValues.js";
-import { isGhidraInventoryOperation, parseGhidraInventoryInput, parseGhidraInventoryResult, } from "./GhidraInventoryValues.js";
 import { ghidraInstallationDiagnostics, inspectGhidraInstallation, } from "./GhidraInstallation.js";
-import { GhidraHeadlessLauncher } from "./GhidraLauncher.js";
 import { resolveGhidraAnalysisProfile } from "./GhidraAnalysisProfile.js";
-import { ghidraExtensionSchema, resolveGhidraExtensions, validateGhidraExtensionProfile, ghidraExtensionLimitations, } from "./extensions/GhidraExtensions.js";
-import { CAPABILITIES, windowsP0Capabilities, GHIDRA_PROVIDER_IDENTITY, GHIDRA_PROVIDER_TOOL_CONTRACTS, healthLimitations, windowsP0Limitations, limitationsFor, } from "./GhidraProviderCapabilities.js";
+import { resolveGhidraExtensions } from "./extensions/GhidraExtensions.js";
+import { CAPABILITIES, windowsP0Capabilities, GHIDRA_PROVIDER_IDENTITY, GHIDRA_OPERATIONS, } from "./GhidraProviderCapabilities.js";
+import { createGhidraProviderClient, } from "./GhidraProviderClient.js";
 import { windowsNativeAuthorityUnavailableReason, hasWindowsNativeAuthority, windowsNativeCapabilities, } from "../process/WindowsAuthority.js";
-export { GHIDRA_PROVIDER_IDENTITY, GHIDRA_PROVIDER_TOOL_CONTRACTS };
+export { GHIDRA_PROVIDER_IDENTITY, GHIDRA_OPERATIONS };
 const SUPPORTED_ARCHITECTURES = new Set(["x86", "x86_64", "arm", "arm64"]);
 /** Ghidra candidate backed by an isolated ephemeral headless import. */
 export class GhidraProvider {
@@ -133,178 +123,15 @@ export class GhidraProvider {
         });
     }
     createClient(target, profile, context) {
-        const installation = this.#inspectInstallation();
-        const prerequisites = ghidraClientPrerequisites(target, profile, installation);
-        if (!prerequisites.ok)
-            return unavailableClient(prerequisites.error);
-        const committedProfile = prerequisites.value.profile;
-        const extensionProfile = ghidraExtensionSchema
-            .array()
-            .safeParse(committedProfile.parameters.analysis_extensions ?? []);
-        if (!extensionProfile.success ||
-            (this.config.ghidraNativeAotJar !== undefined &&
-                extensionProfile.data.length === 0))
-            return unavailableClient(new ProviderAdapterError("ghidra", "open_binary", {
-                diagnostics: {
-                    reason: "Resolve the configured Ghidra extensions into an analysis profile before opening the session.",
-                },
-            }));
-        const extensions = extensionProfile.data;
-        const invalidProfile = validateGhidraExtensionProfile(extensions, this.config, target, installation.platform);
-        if (invalidProfile !== null)
-            return unavailableClient(new ProviderAdapterError("ghidra", "open_binary", {
-                diagnostics: { reason: invalidProfile },
-            }));
-        let extensionFailure;
-        const targetLimitations = target.format === "dos-mz"
-            ? [
-                "DOS MZ uses 16-bit x86 real mode with the Ghidra load segment 0x1000. Returned addresses are linear byte coordinates; they do not identify a unique segment:offset alias.",
-                "Static DOS analysis does not emulate BIOS, DOS interrupts, device ports, or self-modifying unpacking code. Packed targets require a separately identified unpacked artifact for original-program analysis; appended overlays are not the initialized load module.",
-            ]
-            : [];
-        const providerLimitations = installation.platform === "win32"
-            ? windowsP0Limitations
-            : installation.platform === "darwin"
-                ? [
-                    "macOS sessions require a matching executable Ghidra native decompiler; REA checks for it but does not build native components or change Gatekeeper quarantine state.",
-                ]
-                : [];
-        const client = this.clientFactory({
-            platform: installation.platform,
-            launcher: new GhidraHeadlessLauncher({
-                analyzeHeadlessPath: prerequisites.value.analyzeHeadlessPath,
-                ...(this.config.ghidraJavaHome === undefined
-                    ? {}
-                    : { javaHome: this.config.ghidraJavaHome }),
-                bridgeScriptPath: fileURLToPath(new URL("../../bridge/ghidra/ReaGhidraBridge.java", import.meta.url)),
-                ...(target.format === "dos-mz" ? { dosMz: true } : {}),
-                ...(target.format === "dos-com" ? { dosCom: true } : {}),
-                platform: installation.platform,
-                ...(extensions.length === 0 ? {} : { analysisExtensions: extensions }),
-            }),
-            targetPath: installation.platform === "win32"
-                ? (target.sourcePath ?? target.path)
-                : target.path,
-            targetSha256: target.sha256,
-            transport: installation.platform === "win32"
-                ? "authenticated-loopback-tcp"
-                : "unix-socket",
-            providerVersion: prerequisites.value.providerVersion,
-            profileDigest: committedProfile.digest,
-            ...(["dos-mz", "dos-com"].includes(target.format)
-                ? {
-                    expectedLanguageId: "x86:LE:16:Real Mode",
-                    expectedCompilerSpecId: "default",
-                }
-                : {}),
-            ...(context === undefined ? {} : { runId: context.runId }),
-            logger: this.logger.child({ layer: "ghidra-bridge" }),
+        return createGhidraProviderClient({
+            config: this.config,
+            logger: this.logger,
+            clientFactory: this.clientFactory,
+            target,
+            ...(profile === undefined ? {} : { profile }),
+            ...(context === undefined ? {} : { context }),
+            installation: this.#inspectInstallation(),
         });
-        const checkExtensions = async (operation, info) => {
-            extensionFailure = ghidraExtensionFailure(extensions, info.analysis_extensions ?? [], operation);
-            if (extensionFailure === undefined)
-                return undefined;
-            await client.close();
-            return extensionFailure;
-        };
-        return {
-            execute: async (operation, parameters, options) => {
-                if (extensionFailure !== undefined)
-                    return err(extensionFailure);
-                if (operation !== "health" &&
-                    !isGhidraInventoryOperation(operation) &&
-                    !isGhidraFunctionOperation(operation))
-                    return err(new AnalysisCapabilityUnavailableError(GHIDRA_PROVIDER_IDENTITY.id, operation, "The Ghidra adapter does not declare this operation."));
-                if (operation === "health") {
-                    const started = await client.start(options?.signal);
-                    if (!started.ok)
-                        return err(projectSessionError(operation, started.error));
-                    const failed = await checkExtensions(operation, started.value);
-                    if (failed !== undefined)
-                        return err(failed);
-                    return ok(createAnalysisExecution(started.value, committedProfile.provider, {
-                        analysisProfile: committedProfile,
-                        limitations: [
-                            ...healthLimitations,
-                            ...providerLimitations,
-                            ...targetLimitations,
-                            ...ghidraExtensionLimitations(extensions),
-                        ],
-                    }));
-                }
-                const input = isGhidraFunctionOperation(operation)
-                    ? parseGhidraFunctionInput(operation, parameters)
-                    : parseGhidraInventoryInput(operation, parameters);
-                if (!input.ok)
-                    return input;
-                if (extensions.length > 0) {
-                    const started = await client.start(options?.signal);
-                    if (!started.ok)
-                        return err(projectSessionError(operation, started.error));
-                    const failed = await checkExtensions(operation, started.value);
-                    if (failed !== undefined)
-                        return err(failed);
-                }
-                const called = await client.callTool(operation, input.value, options?.signal === undefined ? {} : { signal: options.signal });
-                if (!called.ok)
-                    return err(projectSessionError(operation, called.error));
-                const result = isGhidraFunctionOperation(operation)
-                    ? parseGhidraFunctionResult(operation, called.value)
-                    : parseGhidraInventoryResult(operation, called.value);
-                if (!result.ok)
-                    return result;
-                let normalized = result.value;
-                if (operation === "inspect_native_load_image") {
-                    const observations = nativeLoadImageObservationSchema.parse(result.value);
-                    if (target.format !== "dos-mz" && target.format !== "dos-com") {
-                        normalized = jsonValueSchema.parse(nativeLoadImageSchema.parse({
-                            status: "unsupported",
-                            reason: "Independent load-image verification currently supports DOS MZ and explicit DOS COM targets only.",
-                            observations,
-                            limitations: [
-                                "Other formats expose measured mappings and source identities; no format-specific verification was performed.",
-                            ],
-                        }));
-                    }
-                    else {
-                        if (client.readTargetSnapshot === undefined)
-                            return err(new ProviderAdapterError("ghidra", operation, {
-                                diagnostics: {
-                                    reason: "The Ghidra client does not expose its immutable target snapshot for independent load-image verification.",
-                                },
-                            }));
-                        const snapshot = await client.readTargetSnapshot();
-                        if (!snapshot.ok)
-                            return err(projectSessionError(operation, snapshot.error));
-                        const attested = (target.format === "dos-com"
-                            ? attestGhidraDosComLoadImage
-                            : attestGhidraDosLoadImage)(snapshot.value, target.sha256 ?? "", observations);
-                        if (!attested.ok)
-                            return err(new ProviderAdapterError("ghidra", operation, {
-                                diagnostics: { reason: attested.error },
-                            }));
-                        normalized = jsonValueSchema.parse(attested.value);
-                    }
-                }
-                return ok(createAnalysisExecution(normalized, committedProfile.provider, {
-                    rawResult: called.value,
-                    analysisProfile: committedProfile,
-                    limitations: [
-                        ...limitationsFor(operation),
-                        ...providerLimitations,
-                        ...targetLimitations,
-                        ...ghidraExtensionLimitations(extensions),
-                    ],
-                }));
-            },
-            runtimeLineageSnapshots: () => {
-                const observation = client.runtimeLineage?.() ?? null;
-                return observation === null
-                    ? []
-                    : [{ provider: committedProfile.provider, observation }];
-            },
-            close: () => client.close(),
-        };
     }
     #inspectInstallation() {
         const options = {
@@ -364,48 +191,3 @@ const inspectWindowsP0TargetSupport = (target, diagnostics) => {
         diagnostics,
     };
 };
-const ghidraClientPrerequisites = (target, profile, installation) => {
-    if (target.kind !== "executable")
-        return err(new AnalysisCapabilityUnavailableError("ghidra", "health", `Ghidra cannot import ${target.kind} targets through this adapter.`));
-    if (installation.status === "unavailable")
-        return err(new ProviderAdapterError("ghidra", "health", {
-            diagnostics: ghidraInstallationDiagnostics(installation),
-        }));
-    if (installation.platform === "win32" &&
-        !hasWindowsNativeAuthority(installation.platform))
-        return err(new AnalysisCapabilityUnavailableError("ghidra", "health", windowsNativeAuthorityUnavailableReason(installation.platform)));
-    if (profile === undefined || profile.provider.id !== "ghidra")
-        return err(new ProviderAdapterError("ghidra", "health"));
-    return ok({
-        analyzeHeadlessPath: installation.analyzeHeadlessPath,
-        providerVersion: installation.providerVersion,
-        profile,
-    });
-};
-const unavailableClient = (failure) => ({
-    execute: () => Promise.resolve(err(failure)),
-    close: () => Promise.resolve(),
-});
-const projectSessionError = (operation, failure) => {
-    if (operation === "annotate_native_function" &&
-        failure.kind === "remote" &&
-        failure.remoteCode === "invalid_function_name")
-        return new AnalysisInputError(operation, { cause: failure }, [
-            { path: ["name"], reason: "invalid_value", message: failure.message },
-        ]);
-    if (failure.kind === "cancelled")
-        return new AnalysisCancelledError(operation);
-    if (failure.kind === "timeout" || failure.kind === "analysis_timeout")
-        return new AnalysisTimeoutError(operation, failure.timeoutMs ?? GHIDRA_STARTUP_TIMEOUT_MS);
-    if (failure.kind === "remote" && failure.remoteCode === "decompile_cancelled")
-        return new AnalysisCancelledError(operation);
-    if (failure.kind === "remote" &&
-        ["invalid_request", "not_found", "ambiguous"].includes(failure.remoteCode ?? ""))
-        return new AnalysisInputError(operation, { cause: failure });
-    if (failure.kind === "remote" && failure.remoteCode === "method_unavailable")
-        return new AnalysisCapabilityUnavailableError("ghidra", operation, failure.message);
-    return new ProviderAdapterError("ghidra", operation, {
-        cause: failure,
-        diagnostics: failure.diagnostics,
-    });
-};

package/dist/ghidra/GhidraProviderCapabilities.js

@@ -1,5 +1,4 @@
 import { hasWindowsNativeAuthority, windowsNativeAuthorityUnavailableReason, } from "../process/WindowsAuthority.js";
-import { GENERATED_MCP_TOOL_CATALOG } from "../generatedMcpToolCatalog.js";
 import { GHIDRA_FUNCTION_OPERATIONS } from "./GhidraFunctionValues.js";
 import { GHIDRA_INVENTORY_OPERATIONS } from "./GhidraInventoryValues.js";
 /** Public identity committed by every Ghidra-backed observation. */
@@ -8,14 +7,11 @@ export const GHIDRA_PROVIDER_IDENTITY = Object.freeze({
     name: "Ghidra",
     version: null,
 });
-const providerContractByName = new Map(GENERATED_MCP_TOOL_CATALOG.filter(({ kind }) => kind === "official-proxy" || kind === "enhanced").map((contract) => [contract.name, contract]));
-/** Provider-neutral contracts implemented by the Ghidra adapter. */
-export const GHIDRA_PROVIDER_TOOL_CONTRACTS = Object.freeze([...GHIDRA_INVENTORY_OPERATIONS, ...GHIDRA_FUNCTION_OPERATIONS].map((operation) => {
-    const contract = providerContractByName.get(operation);
-    if (contract === undefined)
-        throw new TypeError(`Missing provider-neutral contract for ${operation}`);
-    return contract;
-}));
+/** Analyst operations implemented by the Ghidra inventory and function adapters. */
+export const GHIDRA_OPERATIONS = Object.freeze([
+    ...GHIDRA_INVENTORY_OPERATIONS,
+    ...GHIDRA_FUNCTION_OPERATIONS,
+]);
 /** Health limitations shared by every Ghidra-backed capability. */
 export const healthLimitations = Object.freeze([
     "The session serves operations only after Ghidra reports default auto-analysis complete; incomplete analysis does not expose partial results.",
@@ -132,10 +128,7 @@ export const limitationsFor = (operation) => {
     }
 };
 /** Provider-neutral capabilities advertised by every non-Windows Ghidra session. */
-export const CAPABILITIES = Object.freeze(GHIDRA_PROVIDER_TOOL_CONTRACTS.map((contract) => {
-    const operation = contract.analysisOperation;
-    if (operation === null)
-        throw new TypeError(`Missing analysis operation for ${contract.name}`);
+export const CAPABILITIES = Object.freeze(GHIDRA_OPERATIONS.map((operation) => {
     return Object.freeze({
         provider: GHIDRA_PROVIDER_IDENTITY,
         operation,
@@ -150,7 +143,7 @@ export const CAPABILITIES = Object.freeze(GHIDRA_PROVIDER_TOOL_CONTRACTS.map((co
             changesPermissions: false,
             requiresRoot: false,
         }),
-        limitations: Object.freeze(limitationsFor(contract.name)),
+        limitations: Object.freeze(limitationsFor(operation)),
     });
 }));
 /** Capabilities advertised for the experimental Windows x64 P0 boundary. */

package/dist/ghidra/GhidraProviderClient.js

@@ -0,0 +1,209 @@
+import { fileURLToPath } from "node:url";
+import { createAnalysisExecution, } from "../application/AnalysisProvider.js";
+import { AnalysisCancelledError, AnalysisCapabilityUnavailableError, AnalysisInputError, AnalysisTimeoutError, } from "../domain/analysisErrorCore.js";
+import {} from "../domain/analysisErrorBase.js";
+import { ProviderAdapterError } from "../domain/providerAdapterError.js";
+import { err, ok } from "../domain/result.js";
+import { GhidraClient } from "./GhidraClient.js";
+import { GHIDRA_STARTUP_TIMEOUT_MS } from "./GhidraDefaults.js";
+import { isGhidraFunctionOperation, parseGhidraFunctionInput, parseGhidraFunctionResult, } from "./GhidraFunctionValues.js";
+import { isGhidraInventoryOperation, parseGhidraInventoryInput, parseGhidraInventoryResult, } from "./GhidraInventoryValues.js";
+import { ghidraInstallationDiagnostics, } from "./GhidraInstallation.js";
+import { unverifiedGhidraBuildLimitation } from "./GhidraInstallationPolicy.js";
+import { GhidraHeadlessLauncher } from "./GhidraLauncher.js";
+import { attestGhidraNativeLoadImage } from "./GhidraLoadImageAttest.js";
+import { GHIDRA_PROVIDER_IDENTITY, healthLimitations, windowsP0Limitations, limitationsFor, } from "./GhidraProviderCapabilities.js";
+import { ghidraExtensionFailure } from "./extensions/GhidraExtensionFailures.js";
+import { ghidraExtensionSchema, validateGhidraExtensionProfile, ghidraExtensionLimitations, } from "./extensions/GhidraExtensions.js";
+import { windowsNativeAuthorityUnavailableReason, hasWindowsNativeAuthority, } from "../process/WindowsAuthority.js";
+/** Build one AnalysisClient for an admitted Ghidra target and profile. */
+export const createGhidraProviderClient = (input) => {
+    const { config, logger, clientFactory, target, context, installation } = input;
+    const prerequisites = ghidraClientPrerequisites(target, input.profile, installation);
+    if (!prerequisites.ok)
+        return unavailableClient(prerequisites.error);
+    const committedProfile = prerequisites.value.profile;
+    const extensionProfile = ghidraExtensionSchema
+        .array()
+        .safeParse(committedProfile.parameters.analysis_extensions ?? []);
+    if (!extensionProfile.success ||
+        (config.ghidraNativeAotJar !== undefined &&
+            extensionProfile.data.length === 0))
+        return unavailableClient(new ProviderAdapterError("ghidra", "open_binary", {
+            diagnostics: {
+                reason: "Resolve the configured Ghidra extensions into an analysis profile before opening the session.",
+            },
+        }));
+    const extensions = extensionProfile.data;
+    const invalidProfile = validateGhidraExtensionProfile(extensions, config, target, installation.platform);
+    if (invalidProfile !== null)
+        return unavailableClient(new ProviderAdapterError("ghidra", "open_binary", {
+            diagnostics: { reason: invalidProfile },
+        }));
+    let extensionFailure;
+    const targetLimitations = target.format === "dos-mz"
+        ? [
+            "DOS MZ uses 16-bit x86 real mode with the Ghidra load segment 0x1000. Returned addresses are linear byte coordinates; they do not identify a unique segment:offset alias.",
+            "Static DOS analysis does not emulate BIOS, DOS interrupts, device ports, or self-modifying unpacking code. Packed targets require a separately identified unpacked artifact for original-program analysis; appended overlays are not the initialized load module.",
+        ]
+        : [];
+    const providerLimitations = installation.platform === "win32"
+        ? windowsP0Limitations
+        : installation.platform === "darwin"
+            ? [
+                "macOS sessions require a matching executable Ghidra native decompiler; REA checks for it but does not build native components or change Gatekeeper quarantine state.",
+            ]
+            : [];
+    const client = clientFactory({
+        platform: installation.platform,
+        launcher: new GhidraHeadlessLauncher({
+            analyzeHeadlessPath: prerequisites.value.analyzeHeadlessPath,
+            ...(config.ghidraJavaHome === undefined
+                ? {}
+                : { javaHome: config.ghidraJavaHome }),
+            bridgeScriptPath: fileURLToPath(new URL("../../bridge/ghidra/ReaGhidraBridge.java", import.meta.url)),
+            ...(target.format === "dos-mz" ? { dosMz: true } : {}),
+            ...(target.format === "dos-com" ? { dosCom: true } : {}),
+            platform: installation.platform,
+            ...(extensions.length === 0 ? {} : { analysisExtensions: extensions }),
+        }),
+        targetPath: installation.platform === "win32"
+            ? (target.sourcePath ?? target.path)
+            : target.path,
+        targetSha256: target.sha256,
+        transport: installation.platform === "win32"
+            ? "authenticated-loopback-tcp"
+            : "unix-socket",
+        providerVersion: prerequisites.value.providerVersion,
+        profileDigest: committedProfile.digest,
+        ...(["dos-mz", "dos-com"].includes(target.format)
+            ? {
+                expectedLanguageId: "x86:LE:16:Real Mode",
+                expectedCompilerSpecId: "default",
+            }
+            : {}),
+        ...(context === undefined ? {} : { runId: context.runId }),
+        logger: logger.child({ layer: "ghidra-bridge" }),
+    });
+    const checkExtensions = async (operation, info) => {
+        extensionFailure = ghidraExtensionFailure(extensions, info.analysis_extensions ?? [], operation);
+        if (extensionFailure === undefined)
+            return undefined;
+        await client.close();
+        return extensionFailure;
+    };
+    const releaseLimitation = unverifiedGhidraBuildLimitation(prerequisites.value.providerVersion);
+    const sessionLimitations = [
+        ...providerLimitations,
+        ...targetLimitations,
+        ...ghidraExtensionLimitations(extensions),
+        ...(releaseLimitation === undefined ? [] : [releaseLimitation]),
+    ];
+    return {
+        execute: async (operation, parameters, options) => {
+            if (extensionFailure !== undefined)
+                return err(extensionFailure);
+            if (operation !== "health" &&
+                !isGhidraInventoryOperation(operation) &&
+                !isGhidraFunctionOperation(operation))
+                return err(new AnalysisCapabilityUnavailableError(GHIDRA_PROVIDER_IDENTITY.id, operation, "The Ghidra adapter does not declare this operation."));
+            if (operation === "health") {
+                const started = await client.start(options?.signal);
+                if (!started.ok)
+                    return err(projectSessionError(operation, started.error));
+                const failed = await checkExtensions(operation, started.value);
+                if (failed !== undefined)
+                    return err(failed);
+                return ok(createAnalysisExecution(started.value, committedProfile.provider, {
+                    analysisProfile: committedProfile,
+                    limitations: [...healthLimitations, ...sessionLimitations],
+                }));
+            }
+            const input = isGhidraFunctionOperation(operation)
+                ? parseGhidraFunctionInput(operation, parameters)
+                : parseGhidraInventoryInput(operation, parameters);
+            if (!input.ok)
+                return input;
+            if (extensions.length > 0) {
+                const started = await client.start(options?.signal);
+                if (!started.ok)
+                    return err(projectSessionError(operation, started.error));
+                const failed = await checkExtensions(operation, started.value);
+                if (failed !== undefined)
+                    return err(failed);
+            }
+            const called = await client.callTool(operation, input.value, options?.signal === undefined ? {} : { signal: options.signal });
+            if (!called.ok)
+                return err(projectSessionError(operation, called.error));
+            const result = isGhidraFunctionOperation(operation)
+                ? parseGhidraFunctionResult(operation, called.value)
+                : parseGhidraInventoryResult(operation, called.value);
+            if (!result.ok)
+                return result;
+            let normalized = result.value;
+            if (operation === "inspect_native_load_image") {
+                const attested = await attestGhidraNativeLoadImage(target, operation, result.value, client, (failure) => projectSessionError(operation, failure));
+                if (!attested.ok)
+                    return attested;
+                normalized = attested.value;
+            }
+            return ok(createAnalysisExecution(normalized, committedProfile.provider, {
+                rawResult: called.value,
+                analysisProfile: committedProfile,
+                limitations: [...limitationsFor(operation), ...sessionLimitations],
+            }));
+        },
+        runtimeLineageSnapshots: () => {
+            const observation = client.runtimeLineage?.() ?? null;
+            return observation === null
+                ? []
+                : [{ provider: committedProfile.provider, observation }];
+        },
+        close: () => client.close(),
+    };
+};
+const ghidraClientPrerequisites = (target, profile, installation) => {
+    if (target.kind !== "executable")
+        return err(new AnalysisCapabilityUnavailableError("ghidra", "health", `Ghidra cannot import ${target.kind} targets through this adapter.`));
+    if (installation.status === "unavailable")
+        return err(new ProviderAdapterError("ghidra", "health", {
+            diagnostics: ghidraInstallationDiagnostics(installation),
+        }));
+    if (installation.platform === "win32" &&
+        !hasWindowsNativeAuthority(installation.platform))
+        return err(new AnalysisCapabilityUnavailableError("ghidra", "health", windowsNativeAuthorityUnavailableReason(installation.platform)));
+    if (profile === undefined || profile.provider.id !== "ghidra")
+        return err(new ProviderAdapterError("ghidra", "health"));
+    return ok({
+        analyzeHeadlessPath: installation.analyzeHeadlessPath,
+        providerVersion: installation.providerVersion,
+        profile,
+    });
+};
+const unavailableClient = (failure) => ({
+    execute: () => Promise.resolve(err(failure)),
+    close: () => Promise.resolve(),
+});
+const projectSessionError = (operation, failure) => {
+    if (operation === "annotate_native_function" &&
+        failure.kind === "remote" &&
+        failure.remoteCode === "invalid_function_name")
+        return new AnalysisInputError(operation, { cause: failure }, [
+            { path: ["name"], reason: "invalid_value", message: failure.message },
+        ]);
+    if (failure.kind === "cancelled")
+        return new AnalysisCancelledError(operation);
+    if (failure.kind === "timeout" || failure.kind === "analysis_timeout")
+        return new AnalysisTimeoutError(operation, failure.timeoutMs ?? GHIDRA_STARTUP_TIMEOUT_MS);
+    if (failure.kind === "remote" && failure.remoteCode === "decompile_cancelled")
+        return new AnalysisCancelledError(operation);
+    if (failure.kind === "remote" &&
+        ["invalid_request", "not_found", "ambiguous"].includes(failure.remoteCode ?? ""))
+        return new AnalysisInputError(operation, { cause: failure });
+    if (failure.kind === "remote" && failure.remoteCode === "method_unavailable")
+        return new AnalysisCapabilityUnavailableError("ghidra", operation, failure.message);
+    return new ProviderAdapterError("ghidra", operation, {
+        cause: failure,
+        diagnostics: failure.diagnostics,
+    });
+};

package/dist/ghidra/GhidraResponseBuffer.js

@@ -2,12 +2,17 @@
 export class GhidraResponseBuffer {
     #options;
     #buffer = "";
+    #fragments = [];
     constructor(options) {
         this.#options = options;
     }
     /** Consume one decoded socket chunk. */
     push(chunk) {
-        this.#buffer += chunk;
+        this.#fragments.push(chunk);
+        if (!chunk.includes("\n"))
+            return;
+        this.#buffer += this.#fragments.join("");
+        this.#fragments = [];
         let newline = this.#buffer.indexOf("\n");
         while (newline >= 0) {
             const encodedLine = this.#buffer.slice(0, newline);
@@ -21,5 +26,6 @@ export class GhidraResponseBuffer {
     /** Drop any incomplete line when a session closes. */
     reset() {
         this.#buffer = "";
+        this.#fragments = [];
     }
 }

package/dist/ghidra/extensions/nativeaot/NativeAotReport.js

@@ -45,6 +45,18 @@ const report = z
         .optional(),
 })
     .strict();
+const validateNonRecoveryMetadata = (value, recovered) => {
+    if (recovered)
+        return null;
+    if (value.reason === null || value.reason.trim().length === 0)
+        return "NativeAOT non-recovery status omits its required reason.";
+    return value.method_tables !== 0 ||
+        value.types !== undefined ||
+        value.derived_memory !== undefined ||
+        value.coverage !== undefined
+        ? "NativeAOT non-recovery status carries recovered metadata."
+        : null;
+};
 /** Validate the pinned producer representation before its result enters Evidence. */
 export const validateNativeAotReport = (value) => {
     if (value.status === "failed" &&
@@ -59,7 +71,8 @@ export const validateNativeAotReport = (value) => {
     return validateRecoveredMetadata(parsed.data);
 };
 const validateRecoveredMetadata = (value) => {
-    if (["complete", "partial"].includes(value.status) &&
+    const recovered = ["complete", "partial"].includes(value.status);
+    if (recovered &&
         (value.method_tables === 0 ||
             value.format_major !== 9 ||
             value.format_minor !== 1 ||
@@ -70,6 +83,9 @@ const validateRecoveredMetadata = (value) => {
             value.coverage === undefined ||
             value.reason !== null))
         return "NativeAOT recovery omitted its supported format, method-table inventory or derived-memory identity.";
+    const nonRecoveryInvalid = validateNonRecoveryMetadata(value, recovered);
+    if (nonRecoveryInvalid !== null)
+        return nonRecoveryInvalid;
     const coverage = value.coverage;
     if (coverage !== undefined &&
         (coverage.frozen_objects_annotated > coverage.frozen_object_candidates ||

package/dist/hopper/HopperProvider.js

@@ -3,58 +3,12 @@ import { accessSync, constants } from "node:fs";
 import { createAnalysisExecution } from "../application/AnalysisProvider.js";
 import { AnalysisCapabilityUnavailableError } from "../domain/analysisErrorCore.js";
 import { err } from "../domain/result.js";
-import { GENERATED_MCP_TOOL_CATALOG } from "../generatedMcpToolCatalog.js";
 import { HopperApplicationLauncher } from "./BridgeLauncher.js";
 import { hopperLoaderArgsForTarget, resolveHopperAnalysisProfile, } from "./HopperAnalysisProfile.js";
 import { HopperClient } from "./HopperClient.js";
-/** Public identity committed by every Hopper-backed observation. */
-export const HOPPER_PROVIDER_IDENTITY = Object.freeze({
-    id: "hopper",
-    name: "Hopper Disassembler",
-    version: null,
-});
+import { CAPABILITIES, HOPPER_PROVIDER_IDENTITY, } from "./HopperProviderCapabilities.js";
+export { HOPPER_PROVIDER_IDENTITY, HOPPER_OPERATIONS, } from "./HopperProviderCapabilities.js";
 const IDENTITY = HOPPER_PROVIDER_IDENTITY;
-const MUTATING_OPERATIONS = new Set([
-    "set_address_name",
-    "set_addresses_names",
-    "set_bookmark",
-    "set_comment",
-    "set_inline_comment",
-    "unset_bookmark",
-]);
-/** Tool contracts implemented directly by the Hopper adapter. */
-export const HOPPER_PROVIDER_TOOL_CONTRACTS = Object.freeze([
-    ...GENERATED_MCP_TOOL_CATALOG.filter(({ kind, name }) => kind === "official-proxy" &&
-        name !== "annotate_native_function" &&
-        name !== "inspect_native_load_image" &&
-        name !== "inspect_native_data_type" &&
-        name !== "inspect_native_instruction" &&
-        name !== "resolve_native_call_targets"),
-    ...GENERATED_MCP_TOOL_CATALOG.filter(({ name }) => name === "analyze_function"),
-]);
-const CAPABILITIES = Object.freeze(HOPPER_PROVIDER_TOOL_CONTRACTS.map((contract) => {
-    const operation = contract.analysisOperation;
-    if (operation === null)
-        throw new TypeError(`Missing analysis operation for ${contract.name}`);
-    return Object.freeze({
-        provider: IDENTITY,
-        operation,
-        available: true,
-        reason: null,
-        effects: Object.freeze({
-            mutatesArtifact: MUTATING_OPERATIONS.has(contract.name),
-            launchesProcess: true,
-            mayShowUi: true,
-            mayAccessNetwork: false,
-            mayWriteFilesystem: MUTATING_OPERATIONS.has(contract.name),
-            changesPermissions: false,
-            requiresRoot: false,
-        }),
-        limitations: Object.freeze([
-            "Results depend on Hopper's completed static analysis.",
-        ]),
-    });
-}));
 /** Concrete analysis provider backed by REA's private Hopper bridge. */
 export class HopperProvider {
     config;