rea-agents 5.0.0 → 6.0.0

package/dist/evm/EvmoleInterfaceProvider.js

@@ -0,0 +1,273 @@
+import { createHash, randomUUID } from "node:crypto";
+import { access, readFile, stat, writeFile } from "node:fs/promises";
+import { constants } from "node:fs";
+import { isAbsolute, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { z } from "zod";
+import { createAnalysisExecution, } from "../application/AnalysisProvider.js";
+import { readStableArtifact } from "../artifacts/readStableArtifact.js";
+import { OwnedCommandFailure } from "../process/OwnedCommand.js";
+import { AnalysisCancelledError, AnalysisCapabilityUnavailableError, AnalysisUnsupportedTargetError, AnalysisInputError, AnalysisOutputError, } from "../domain/analysisErrorCore.js";
+import { projectAnalysisError } from "../domain/analysisErrorProjection.js";
+import { evmInterfaceSchema } from "../domain/evm/evmInterface.js";
+import { ProviderAdapterError } from "../domain/providerAdapterError.js";
+import { ProviderCleanupError } from "../domain/providerCleanupError.js";
+import { err, ok } from "../domain/result.js";
+import { runOwnedCommand } from "../process/OwnedCommand.js";
+import { PrivateRuntimeRoot } from "../process/PrivateRuntimeRoot.js";
+import { evmInterfaceFailure, capturedEvmOutput, } from "./EvmoleFailures.js";
+import { evmoleInterfaceReplySchema, projectEvmoleInterface, } from "./EvmoleInterfaceAdapter.js";
+import { EVMOLE_PROVIDER_IDENTITY, EVM_INTERFACE_LIMITS, EVM_FILE_SIZE_FAILURE_EXIT, } from "./EvmoleRelease.js";
+import { decodeEvmBytecodeCarrier } from "./EvmBytecodeCarrier.js";
+import { selectEvmWorkerLimits, } from "./EvmWorkerLimits.js";
+const OPERATION = "inspect_evm_interface";
+const replySchema = z.discriminatedUnion("ok", [
+    z.strictObject({
+        ok: z.literal(true),
+        version: z.literal("0.9.3"),
+        bytecode: z.strictObject({
+            sha256: z.string().regex(/^[a-f0-9]{64}$/),
+            bytes: z.number().int().nonnegative(),
+            hex: z.string().regex(/^(?:[a-f0-9]{2})*$/),
+        }),
+        raw: evmoleInterfaceReplySchema,
+    }),
+    z.strictObject({
+        ok: z.literal(false),
+        reason: z.enum(["format", "decoder", "output-limit", "unsupported"]),
+        message: z.string(),
+    }),
+]);
+/** Run unchanged EVMole/WASM in an owned worker; no target, chain or network execution. */
+export class EvmoleInterfaceProvider {
+    environment;
+    launcher;
+    createRuntime;
+    constructor(environment = process.env, launcher, createRuntime = () => PrivateRuntimeRoot.create({ prefix: "rea-evm-interface-" })) {
+        this.environment = environment;
+        this.launcher = launcher;
+        this.createRuntime = createRuntime;
+    }
+    /** Bind recovered interface candidates to both original carrier and decoded byte identity. */
+    async inspect(input, options) {
+        let root;
+        let retainedOutput;
+        let phase = "configuration";
+        let workerLimits;
+        const limiter = this.environment.REA_EVM_PRLIMIT_COMMAND ?? "/usr/bin/prlimit";
+        let result;
+        try {
+            if (options?.signal?.aborted)
+                throw new AnalysisCancelledError(OPERATION);
+            if (process.platform !== "linux" || process.arch !== "x64")
+                throw new AnalysisCapabilityUnavailableError(EVMOLE_PROVIDER_IDENTITY.id, OPERATION, "Initial real-verified offline EVM interface profile supports Linux x64 only.");
+            try {
+                if (!isAbsolute(limiter))
+                    throw new Error("REA_EVM_PRLIMIT_COMMAND must be an absolute executable path.");
+                await access(limiter, constants.X_OK);
+                if (!(await stat(limiter)).isFile())
+                    throw new Error("Configured prlimit must be a regular executable file, not a directory.");
+            }
+            catch (cause) {
+                const reason = `Offline EVM interface inspection requires caller-supplied util-linux prlimit: ${limiter}; ${cause instanceof Error ? cause.message : String(cause)}`;
+                throw new AnalysisCapabilityUnavailableError(EVMOLE_PROVIDER_IDENTITY.id, OPERATION, reason, { cause, userMessage: reason });
+            }
+            let inheritedLimits;
+            try {
+                inheritedLimits = await readFile("/proc/self/limits", "utf8");
+            }
+            catch (cause) {
+                const reason = `Could not read inherited Linux resource limits at /proc/self/limits: ${cause instanceof Error ? cause.message : String(cause)}`;
+                throw new AnalysisCapabilityUnavailableError(EVMOLE_PROVIDER_IDENTITY.id, OPERATION, reason, { cause, userMessage: reason });
+            }
+            const limits = selectEvmWorkerLimits(inheritedLimits);
+            if (!limits.ok)
+                throw new AnalysisCapabilityUnavailableError(EVMOLE_PROVIDER_IDENTITY.id, OPERATION, limits.error, { userMessage: limits.error });
+            workerLimits = limits.value;
+            phase = "artifact-read";
+            const carrier = await readStableArtifact(input.path, EVM_INTERFACE_LIMITS.inputBytes, options?.signal);
+            phase = "worker";
+            root = await this.createRuntime();
+            const snapshotPath = join(root.path, "carrier.snapshot");
+            const requestPath = join(root.path, "request.json");
+            const replyPath = join(root.path, "reply.json");
+            await writeFile(snapshotPath, carrier.bytes, {
+                flag: "wx",
+                mode: 0o600,
+                ...(options?.signal === undefined ? {} : { signal: options.signal }),
+            });
+            await writeFile(requestPath, JSON.stringify({
+                snapshot_path: snapshotPath,
+                reply_path: replyPath,
+                failure_marker_path: join(root.path, "resource.failure"),
+                encoding: input.encoding,
+            }), { flag: "wx", mode: 0o600 });
+            const { NODE_OPTIONS: _ambientNodeOptions, ...environment } = this.environment;
+            const execution = await runOwnedCommand({
+                command: limiter,
+                arguments: [
+                    `--as=${String(workerLimits.addressSpaceBytes)}:`,
+                    `--fsize=${String(workerLimits.fileSizeBytes)}:`,
+                    "--core=0:",
+                    `--cpu=${String(workerLimits.cpuSeconds)}:`,
+                    "--",
+                    process.execPath,
+                    "--max-old-space-size=256",
+                    "--v8-pool-size=1",
+                    "--disable-wasm-trap-handler",
+                    fileURLToPath(new URL("./EvmoleInterfaceWorker.js", import.meta.url)),
+                    requestPath,
+                ],
+                cwd: root.path,
+                expectedCommand: null,
+                runId: `rea-evm-interface-${randomUUID()}`,
+                hostEnvironment: environment,
+            }, {
+                timeoutMs: EVM_INTERFACE_LIMITS.timeoutMs,
+                diagnosticBytes: EVM_INTERFACE_LIMITS.diagnosticBytes,
+            }, {
+                ...(options?.signal === undefined ? {} : { signal: options.signal }),
+                ...(this.launcher === undefined ? {} : { launcher: this.launcher }),
+            });
+            const capturedOutput = capturedEvmOutput(execution);
+            retainedOutput = capturedOutput;
+            let reply;
+            try {
+                const file = await readStableArtifact(replyPath, EVM_INTERFACE_LIMITS.outputBytes, options?.signal);
+                reply = replySchema.parse(JSON.parse(file.bytes.toString("utf8")));
+            }
+            catch (cause) {
+                if (options?.signal?.aborted)
+                    throw new AnalysisCancelledError(OPERATION, { capturedOutput });
+                throw new AnalysisOutputError(OPERATION, `Owned interface worker reply failed for ${input.path}: ${cause instanceof Error ? cause.message : String(cause)}`, { cause, capturedOutput });
+            }
+            if (!reply.ok) {
+                if (reply.reason === "unsupported")
+                    throw new AnalysisUnsupportedTargetError(OPERATION, input.path, reply.message, { capturedOutput });
+                if (reply.reason === "format")
+                    throw new AnalysisInputError(OPERATION, { capturedOutput }, [
+                        {
+                            path: ["path"],
+                            reason: "invalid_format",
+                            message: reply.message,
+                        },
+                    ]);
+                if (reply.reason === "output-limit")
+                    throw new AnalysisOutputError(OPERATION, reply.message, {
+                        capturedOutput,
+                    });
+                throw new ProviderAdapterError(EVMOLE_PROVIDER_IDENTITY.id, OPERATION, {
+                    diagnostics: {
+                        phase,
+                        failure_kind: reply.reason,
+                        reason: reply.message,
+                        stdout: execution.stdout.text,
+                        stderr: execution.stderr.text,
+                        captured_output: { ...capturedOutput },
+                    },
+                });
+            }
+            const selectedBytes = decodeEvmBytecodeCarrier(carrier.bytes, input.encoding);
+            const selectedHex = Buffer.from(selectedBytes).toString("hex");
+            const decodedHash = createHash("sha256")
+                .update(selectedBytes)
+                .digest("hex");
+            if (decodedHash !== reply.bytecode.sha256 ||
+                selectedHex !== reply.bytecode.hex ||
+                selectedBytes.length !== reply.bytecode.bytes)
+                throw new AnalysisOutputError(OPERATION, "Decoded bytecode representation does not match the selected carrier, encoding or reported SHA-256.", { capturedOutput });
+            const limitations = [
+                `Configured worker resource soft limits: address_space_bytes=${String(workerLimits.addressSpaceBytes)}, cpu_seconds=${String(workerLimits.cpuSeconds)}, file_size_bytes=${String(workerLimits.fileSizeBytes)}. Selected from inherited tighter limits; original hard limits are retained. Effective worker limits are not independently probed.`,
+                "Upstream may also report terminal metadata while recovering selectors. Its reported values are retained in raw_result, but integer precision and non-text-key coverage are unknown in the JS binding; complete original bytecode remains available.",
+                "Recovered selectors, argument strings and mutability are upstream inferences, not verified ABI signatures or names. Empty results do not prove the absence of callable dispatch.",
+                "Bytecode kind, hardfork and deployed-contract authenticity are unknown. This inspection performs no target runtime execution, chain/RPC lookup or network request.",
+                "Original carrier and decoded bytecode SHA-256 are distinct identities; SHA-256 is not the Ethereum Keccak code hash.",
+                "The owned worker has a 256 MiB JavaScript heap, 3 GiB virtual address-space limit and 30-second deadline. Virtual address space is distinct from resident memory; limits fail without partial success.",
+            ];
+            const validated = evmInterfaceSchema.safeParse({
+                artifact: {
+                    path: input.path,
+                    sha256: carrier.sha256,
+                    bytes: carrier.bytes.length,
+                    encoding: input.encoding,
+                },
+                bytecode: {
+                    ...reply.bytecode,
+                    digest_algorithm: "sha256",
+                    kind: "unknown",
+                    deployment_authenticity: "unknown",
+                    hardfork: "unknown",
+                },
+                evidence_kind: "inferred",
+                functions: projectEvmoleInterface(reply.raw).functions,
+                discovery_completeness: "unknown",
+                runtime_execution: "not-performed",
+                diagnostics: {
+                    stdout: execution.stdout.text,
+                    stderr: execution.stderr.text,
+                    truncated: capturedOutput.truncated,
+                },
+                limitations,
+            });
+            if (!validated.success)
+                throw new AnalysisOutputError(OPERATION, `Interface worker returned invalid bytecode-relative evidence: ${validated.error.issues[0]?.message ?? "schema mismatch"}`, { capturedOutput });
+            const report = validated.data;
+            result = ok(createAnalysisExecution(report, EVMOLE_PROVIDER_IDENTITY, {
+                rawResult: reply.raw,
+                subject: { path: input.path, format: "file", sha256: carrier.sha256 },
+                locations: [{ kind: "artifact-path", path: input.path }],
+                limitations,
+            }));
+        }
+        catch (cause) {
+            let fileFailure;
+            if (cause instanceof OwnedCommandFailure &&
+                cause.snapshot?.exitCode === EVM_FILE_SIZE_FAILURE_EXIT &&
+                cause.snapshot.signal === null &&
+                root !== undefined) {
+                try {
+                    const marker = await readStableArtifact(join(root.path, "resource.failure"), 1);
+                    if (!marker.bytes.equals(Buffer.from("F")))
+                        throw new Error("Private worker failure marker does not match the observed exit status.");
+                    fileFailure = { verified: true, failure: null };
+                }
+                catch (markerFailure) {
+                    fileFailure = {
+                        verified: false,
+                        failure: markerFailure instanceof Error
+                            ? markerFailure.message
+                            : String(markerFailure),
+                    };
+                }
+            }
+            result = err(options?.signal?.aborted &&
+                (cause === options.signal.reason ||
+                    (cause instanceof Error && cause.name === "AbortError"))
+                ? new AnalysisCancelledError(OPERATION, retainedOutput === undefined
+                    ? undefined
+                    : { capturedOutput: retainedOutput })
+                : evmInterfaceFailure(cause, phase, input.path, workerLimits, limiter, fileFailure));
+        }
+        if (root !== undefined) {
+            try {
+                await root.close();
+            }
+            catch (cause) {
+                return err(new ProviderCleanupError(EVMOLE_PROVIDER_IDENTITY.id, [root.path], {
+                    reason: cause instanceof Error ? cause.message : String(cause),
+                    previous_error: result.ok
+                        ? null
+                        : projectAnalysisError(result.error),
+                    ...(retainedOutput === undefined
+                        ? {}
+                        : { captured_output: { ...retainedOutput } }),
+                }, { operation: OPERATION }));
+            }
+        }
+        return result.ok && options?.signal?.aborted
+            ? err(new AnalysisCancelledError(OPERATION, retainedOutput === undefined
+                ? undefined
+                : { capturedOutput: retainedOutput }))
+            : result;
+    }
+}

package/dist/evm/EvmoleInterfaceWorker.js

@@ -0,0 +1,87 @@
+import { createHash } from "node:crypto";
+import { readFile, writeFile } from "node:fs/promises";
+import { z } from "zod";
+import { decodeEvmBytecodeCarrier, EvmCarrierFailure, } from "./EvmBytecodeCarrier.js";
+import { projectEvmoleInterface } from "./EvmoleInterfaceAdapter.js";
+import { EVM_INTERFACE_LIMITS, EVM_FILE_SIZE_FAILURE_EXIT, } from "./EvmoleRelease.js";
+const requestSchema = z.strictObject({
+    snapshot_path: z.string(),
+    reply_path: z.string(),
+    failure_marker_path: z.string(),
+    encoding: z.enum(["raw", "hex"]),
+});
+class UnsupportedContainer extends Error {
+}
+const main = async () => {
+    const requestPath = process.argv[2];
+    if (requestPath === undefined)
+        throw new Error("Owned worker request path missing.");
+    const request = requestSchema.parse(JSON.parse(await readFile(requestPath, "utf8")));
+    let reply;
+    try {
+        const bytes = decodeEvmBytecodeCarrier(await readFile(request.snapshot_path), request.encoding);
+        if (bytes[0] === 0xef && bytes[1] === 0x00)
+            throw new UnsupportedContainer("Container marker EF00 is outside the verified flat-bytecode interface profile.");
+        const modulePath = import.meta.resolve("evmole/no_tla");
+        const metadata = z
+            .object({ version: z.literal("0.9.3") })
+            .parse(JSON.parse(await readFile(new URL("../package.json", modulePath), "utf8")));
+        const engine = await import("evmole/no_tla");
+        engine.initSync({
+            module: await readFile(new URL(import.meta.resolve("evmole/evmole_bg.wasm"))),
+        });
+        const inferred = projectEvmoleInterface(engine.contractInfo(Buffer.from(bytes).toString("hex"), {
+            selectors: true,
+            arguments: true,
+            stateMutability: true,
+        }));
+        reply = {
+            ok: true,
+            version: metadata.version,
+            bytecode: {
+                sha256: createHash("sha256").update(bytes).digest("hex"),
+                bytes: bytes.length,
+                hex: Buffer.from(bytes).toString("hex"),
+            },
+            raw: inferred.raw,
+        };
+    }
+    catch (cause) {
+        reply = {
+            ok: false,
+            reason: cause instanceof EvmCarrierFailure
+                ? "format"
+                : cause instanceof UnsupportedContainer
+                    ? "unsupported"
+                    : "decoder",
+            message: cause instanceof Error ? cause.message : String(cause),
+        };
+    }
+    let encoded = JSON.stringify(reply);
+    if (Buffer.byteLength(encoded) > EVM_INTERFACE_LIMITS.outputBytes)
+        encoded = JSON.stringify({
+            ok: false,
+            reason: "output-limit",
+            message: "Complete interface evidence exceeds the 16 MiB reply budget.",
+        });
+    try {
+        await writeFile(request.reply_path, encoded, { flag: "wx", mode: 0o600 });
+    }
+    catch (cause) {
+        if (cause instanceof Error && "code" in cause && cause.code === "EFBIG") {
+            try {
+                await writeFile(request.failure_marker_path, "F", {
+                    flag: "wx",
+                    mode: 0o600,
+                });
+            }
+            catch (markerFailure) {
+                process.stderr.write(`File-size failure marker unavailable: ${markerFailure instanceof Error ? markerFailure.message : String(markerFailure)}\n`);
+            }
+            process.exitCode = EVM_FILE_SIZE_FAILURE_EXIT;
+        }
+        else
+            throw cause;
+    }
+};
+await main();

package/dist/evm/EvmoleRelease.js

@@ -0,0 +1,16 @@
+/** Unchanged locked npm/WASM profile; provenance is independent of chain deployment authenticity. */
+export const EVMOLE_PROVIDER_IDENTITY = {
+    id: "evmole-interface",
+    name: "REA EVM interface adapter",
+    version: "evmole@0.9.3",
+};
+/** Worker-reserved status for an observed EFBIG write without a complete reply. */
+export const EVM_FILE_SIZE_FAILURE_EXIT = 76;
+/** Complete offline inspection budgets; worker JavaScript heap is bounded separately. */
+export const EVM_INTERFACE_LIMITS = {
+    inputBytes: 4 * 1024 * 1024,
+    outputBytes: 16 * 1024 * 1024,
+    timeoutMs: 30_000,
+    diagnosticBytes: 1024 * 1024,
+    addressSpaceBytes: 3 * 1024 * 1024 * 1024,
+};

package/dist/firmware/FirmwareCommand.js

@@ -63,6 +63,7 @@ export const runFirmwareCommand = async (context) => {
         runId,
         cwd: context.cwd,
         hostEnvironment: context.environment,
+        signal,
         env: {
             TMPDIR: context.cwd,
             OMP_NUM_THREADS: "1",

package/dist/generatedPackageMetadata.js

@@ -1,9 +1,9 @@
 /** Generated from package.json and package-lock.json; do not edit. */
 export const PACKAGE_METADATA = {
     name: "rea-agents",
-    version: "5.0.0", // x-release-please-version
+    version: "6.0.0", // x-release-please-version
     serverSdkVersion: "2.3.1",
     clientSdkVersion: "2.3.1",
     coreSdkVersion: "2.3.1",
-    skillVersion: "27",
+    skillVersion: "33",
 };

package/dist/ghidra/GhidraLauncher.js

@@ -76,6 +76,7 @@ export class GhidraHeadlessLauncher {
                 windowsVerbatimArguments: platform === "win32",
                 platform,
                 env: ghidraLaunchEnvironment(paths, this.options.javaHome, platform, command.command),
+                ...(options.signal === undefined ? {} : { signal: options.signal }),
             });
             await writeGhidraRuntimeFile(paths.ownershipPath, `${JSON.stringify({
                 run_id: session.runId,

package/dist/ghidra/GhidraProvider.js

@@ -163,11 +163,11 @@ const inspectWindowsP0TargetSupport = (target, diagnostics) => {
             reason: "Windows Ghidra P0 accepts PE targets only.",
             diagnostics,
         };
-    if (target.architecture !== "x86_64")
+    if (target.architecture !== "x86" && target.architecture !== "x86_64")
         return {
             status: "unsupported",
             code: "architecture_unsupported",
-            reason: "Windows Ghidra P0 accepts x86-64 PE targets only.",
+            reason: "Windows Ghidra P0 accepts x86 and x86-64 PE targets only.",
             diagnostics,
         };
     if (target.executableRole !== "application")

package/dist/ghidra/GhidraProviderCapabilities.js

@@ -19,7 +19,7 @@ export const healthLimitations = Object.freeze([
 ]);
 /** Additional limitations applied to the experimental Windows x64 P0 boundary. */
 export const windowsP0Limitations = Object.freeze([
-    "Windows Ghidra P0 accepts approved native x86-64 PE applications only; DLL, managed, hostile, sensitive, and mutable-path targets are unsupported.",
+    "Windows Ghidra P0 accepts approved native x86 and x86-64 PE applications only; DLL, managed, hostile, sensitive, and mutable-path targets are unsupported.",
     "The Windows bridge uses authenticated IPv4 loopback because Node path-based IPC does not expose Java AF_UNIX sockets; the endpoint file contains no bearer token.",
     "Windows sessions require the matching packaged Windows x64 native addon, local NTFS targets and runtimes, and Windows 10 or later. Native handles enforce path admission, private DACLs, and Job Object ownership automatically.",
 ]);

package/dist/hopper/BridgeLauncher.js

@@ -189,6 +189,7 @@ const launchHopperProcess = async (input) => {
         arguments: arguments_,
         runId: input.session.runId,
         expectedCommand: ownershipCommand,
+        ...(input.signal === undefined ? {} : { signal: input.signal }),
     });
     if (input.linuxDemo !== undefined)
         return spawnOwnedProviderProcess({
@@ -196,6 +197,7 @@ const launchHopperProcess = async (input) => {
             arguments: input.linuxDemo.args,
             runId: input.session.runId,
             expectedCommand: ownershipCommand,
+            ...(input.signal === undefined ? {} : { signal: input.signal }),
         });
     return spawn(input.argumentsForTarget);
 };

package/dist/hopper/LinuxPrivateDisplayProbe.js

@@ -6,6 +6,7 @@ import { parseLinuxPrivateDisplayDiagnostic } from "./LinuxPrivateDisplayDiagnos
 const PYTHON_PATH = "/usr/bin/python3";
 const UNSHARE_PATH = "/usr/bin/unshare";
 const DEFAULT_PROBE_TIMEOUT_MS = 5_000;
+const isAborted = (signal) => signal?.aborted === true;
 /** Probe the exact Xvfb boundary and select the least-privileged viable strategy. */
 export const selectLinuxPrivateDisplayStrategy = async (options) => {
     const timeoutMs = options.timeoutMs ?? DEFAULT_PROBE_TIMEOUT_MS;
@@ -39,7 +40,7 @@ export const selectLinuxPrivateDisplayStrategy = async (options) => {
 };
 /** Run one helper probe in an owned process group and retain its full diagnostics. */
 export const runLinuxPrivateDisplayProbe = async (strategy, options) => {
-    if (options.signal?.aborted === true)
+    if (isAborted(options.signal))
         return emptyProcessResult("cancelled");
     const command = privateDisplayProbeCommand(options.helperPath, strategy);
     let started;
@@ -49,12 +50,13 @@ export const runLinuxPrivateDisplayProbe = async (strategy, options) => {
             arguments: command.arguments,
             runId: randomUUID(),
             expectedCommand: null,
+            ...(options.signal === undefined ? {} : { signal: options.signal }),
         });
     }
     catch (cause) {
         // best-effort cleanup: probe spawn failure is reported as launch-failed.
         void cause;
-        return emptyProcessResult("launch-failed");
+        return emptyProcessResult(isAborted(options.signal) ? "cancelled" : "launch-failed");
     }
     const launch = {
         process: started.process,

package/dist/javascript/recovery/WakaruCommand.js

@@ -51,8 +51,11 @@ export const runWakaruCommand = async (context) => {
         runId,
         cwd: context.cwd,
         hostEnvironment: context.environment,
+        ...(context.signal === undefined ? {} : { signal: context.signal }),
         env: { TMPDIR: context.cwd, RAYON_NUM_THREADS: "1", NO_COLOR: "1" },
     }).catch((cause) => {
+        if (context.signal?.aborted === true)
+            throw new AnalysisCancelledError(OPERATION);
         throw new ProviderAdapterError("wakaru", OPERATION, {
             cause,
             diagnostics: {

package/dist/javascript/sourceMaps/SourceMapCommand.js

@@ -81,6 +81,7 @@ class OwnedCodec {
             runId: this.#runId,
             cwd: this.#runtime.path,
             hostEnvironment: environment,
+            signal: this.deadline.signal,
         });
         this.#supervisor = new ProviderProcessSupervisor({
             ...spawned,

package/dist/native/CommandRunner.js

@@ -64,7 +64,8 @@ const ALLOWED_TOOLS = new Set([
     "swift-demangle",
     "vtool",
 ]);
-const resolveXcrunTool = async (tool, signal) => {
+/** Locate an Xcode tool through `xcrun --find` and pin its executable digest. */
+export const resolveXcrunTool = async (tool, signal) => {
     const found = await captureProcess("/usr/bin/xcrun", ["--find", tool], "xcrun", signal === undefined ? {} : { signal });
     if (!found.ok) {
         if (found.error.reason === "cancelled")