rea-agents 5.0.0 → 6.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (507) hide show
  1. package/README.md +168 -655
  2. package/bridge/android/ReaJadxBridge.java +14 -5
  3. package/bridge/ghidra/ReaGhidraBridge.java +173 -47
  4. package/bridge/hopper_bridge.py +310 -128
  5. package/bridge/mitmproxy/capture.py +208 -0
  6. package/bridge/native/rea_lldb_tracer.py +839 -0
  7. package/bridge/process/ProcessRunTokenReader.swift +297 -0
  8. package/bridge/process/ProcessRunTokenReaderMain.swift +35 -0
  9. package/bridge/pwndbg/core_context.py +101 -0
  10. package/bridge/pwndbg/launch.py +39 -0
  11. package/bridge/pwndbg/launch_impl.py +34 -0
  12. package/bridge/pwntools/decoder_runtime.py +59 -0
  13. package/bridge/pwntools/layout.py +39 -0
  14. package/bridge/pwntools/layout_impl.py +309 -0
  15. package/bridge/pwntools/recorded_crash.py +39 -0
  16. package/bridge/pwntools/recorded_crash_impl.py +147 -0
  17. package/dist/android/JadxConfiguration.js +196 -33
  18. package/dist/android/JadxMcpTransport.js +4 -0
  19. package/dist/android/JadxProtocol.js +6 -0
  20. package/dist/android/JadxProvider.js +20 -2
  21. package/dist/android/JadxSession.js +23 -4
  22. package/dist/application/AnalysisContextQueries.js +8 -35
  23. package/dist/application/AnalysisDocument.js +32 -0
  24. package/dist/application/AppBundleExecutable.js +67 -21
  25. package/dist/application/CallPathTracing.js +19 -3
  26. package/dist/application/CapabilityInventory.js +27 -3
  27. package/dist/application/ClientConfigurationDocument.js +871 -6
  28. package/dist/application/ClientRegistrationIdentity.js +26 -5
  29. package/dist/application/ClientRegistrationStatus.js +29 -14
  30. package/dist/application/DirectAnalysis.js +97 -33
  31. package/dist/application/Doctor.js +4 -2
  32. package/dist/application/DoctorScope.js +25 -13
  33. package/dist/application/EnhancedLiteralTracing.js +22 -25
  34. package/dist/application/EnhancedTools.js +13 -11
  35. package/dist/application/EvidenceBundleFiles.js +24 -12
  36. package/dist/application/FunctionAnalysisEvidence.js +2 -3
  37. package/dist/application/InventoryProjectionEvidence.js +4 -3
  38. package/dist/application/InvestigationProviders.js +3 -2
  39. package/dist/application/JsonFiles.js +50 -28
  40. package/dist/application/ProcedureAddressResolution.js +11 -0
  41. package/dist/application/ReconstructionCoverageService.js +7 -4
  42. package/dist/application/ReconstructionObligationCandidates.js +5 -1
  43. package/dist/application/ReconstructionObligationLedgerService.js +4 -3
  44. package/dist/application/Setup.js +13 -1
  45. package/dist/application/SetupClientConfiguration.js +10 -15
  46. package/dist/application/SetupHost.js +5 -2
  47. package/dist/application/SetupPlan.js +5 -3
  48. package/dist/application/SupportedClients.js +34 -1
  49. package/dist/application/Uninstall.js +4 -3
  50. package/dist/application/Update.js +18 -3
  51. package/dist/application/UpdateRuntime.js +46 -25
  52. package/dist/application/WebModuleTraceService.js +4 -2
  53. package/dist/application/WebNetworkCapturePort.js +1 -0
  54. package/dist/application/WebNetworkCaptureService.js +134 -0
  55. package/dist/application/WebRuntimeService.js +5 -3
  56. package/dist/application/WebScriptExportService.js +2 -2
  57. package/dist/application/WebSourceLocationService.js +4 -2
  58. package/dist/application/WindowsCapabilities.js +1 -1
  59. package/dist/application/WorkflowEvidence.js +82 -0
  60. package/dist/application/binary/AnalysisProviderEvaluation.js +21 -5
  61. package/dist/application/binary/AnalysisProviderRegistry.js +2 -0
  62. package/dist/application/binary/AnalysisSnapshotCache.js +52 -12
  63. package/dist/application/binary/BinarySession.js +131 -76
  64. package/dist/application/binary/BinarySessionOpen.js +19 -6
  65. package/dist/application/binary/BinarySessionRecords.js +45 -3
  66. package/dist/application/binary/BinarySessionStatus.js +17 -1
  67. package/dist/application/binary/CompositeProvider.js +13 -0
  68. package/dist/application/binary/LazyAnalysisProvider.js +3 -0
  69. package/dist/application/binaryDiagnostics/BinaryLayoutPort.js +1 -0
  70. package/dist/application/binaryDiagnostics/BinaryLayoutService.js +59 -0
  71. package/dist/application/binaryDiagnostics/RecordedCrashPort.js +1 -0
  72. package/dist/application/binaryDiagnostics/RecordedCrashService.js +62 -0
  73. package/dist/application/evm/EvmInterfacePort.js +1 -0
  74. package/dist/application/evm/EvmInterfaceService.js +64 -0
  75. package/dist/application/investigation/EvidenceLedger.js +21 -7
  76. package/dist/application/investigation/InvestigationRecords.js +8 -0
  77. package/dist/application/javascript/JavaScriptAnalysisControl.js +34 -0
  78. package/dist/application/javascript/JavaScriptApplicationEvidence.js +25 -5
  79. package/dist/application/javascript/JavaScriptApplicationEvidenceGraph.js +19 -2
  80. package/dist/application/javascript/JavaScriptApplicationService.js +34 -14
  81. package/dist/application/javascript/JavaScriptApplicationWorkflowService.js +5 -5
  82. package/dist/application/javascript/JavaScriptArtifactAnalysis.js +47 -27
  83. package/dist/application/javascript/JavaScriptArtifactGraphBuilder.js +39 -7
  84. package/dist/application/javascript/JavaScriptArtifactGraphDocuments.js +26 -2
  85. package/dist/application/javascript/JavaScriptArtifactPathResolution.js +80 -27
  86. package/dist/application/javascript/JavaScriptArtifactReconstruction.js +33 -12
  87. package/dist/application/javascript/JavaScriptModuleRelationships.js +37 -8
  88. package/dist/application/javascript/JavaScriptRecoveryService.js +4 -2
  89. package/dist/application/javascript/JavaScriptRuntimeObservationService.js +3 -1
  90. package/dist/application/javascript/JavaScriptRuntimeReconciliationService.js +3 -3
  91. package/dist/application/javascript/JavaScriptSemanticGraphAsyncProjection.js +7 -7
  92. package/dist/application/javascript/JavaScriptSemanticGraphBuilder.js +149 -72
  93. package/dist/application/javascript/JavaScriptSemanticGraphChildProcessProjection.js +14 -15
  94. package/dist/application/javascript/JavaScriptSemanticGraphConstruction.js +41 -1
  95. package/dist/application/javascript/JavaScriptSemanticGraphDataProjection.js +7 -7
  96. package/dist/application/javascript/JavaScriptSemanticGraphFlowProjection.js +5 -9
  97. package/dist/application/javascript/JavaScriptSemanticGraphObjectProjection.js +3 -3
  98. package/dist/application/javascript/JavaScriptSemanticGraphProjection.js +118 -12
  99. package/dist/application/javascript/JavaScriptSemanticGraphResourceProjection.js +3 -3
  100. package/dist/application/javascript/JavaScriptSemanticGraphValueProjection.js +27 -5
  101. package/dist/application/managed/ManagedApplicationGraphService.js +4 -3
  102. package/dist/application/managed/ManagedMemberComparisonService.js +7 -4
  103. package/dist/application/managed/ManagedNativeVerificationService.js +4 -3
  104. package/dist/application/managed/ManagedReconstructionService.js +4 -3
  105. package/dist/application/{ProcessCli.js → process/ProcessCli.js} +23 -15
  106. package/dist/application/{ProcessEvidence.js → process/ProcessEvidence.js} +8 -7
  107. package/dist/application/workflowInputError.js +18 -0
  108. package/dist/artifacts/ArtifactProvider.js +42 -5
  109. package/dist/artifacts/ArtifactProviderMetadata.js +2 -1
  110. package/dist/artifacts/MachOSliceArtifactReader.js +98 -14
  111. package/dist/artifacts/NativeDmgArtifactReader.js +13 -6
  112. package/dist/artifacts/ZipArtifactReader.js +3 -0
  113. package/dist/artifacts/apple/AppleAssetCatalogAnalysis.js +22 -3
  114. package/dist/artifacts/apple/DylibResolutionReader.js +259 -0
  115. package/dist/artifacts/apple/InterfaceBuilderAnalysis.js +176 -56
  116. package/dist/artifacts/apple/InterfaceBuilderDecodeBudget.js +195 -0
  117. package/dist/artifacts/apple/KeyedArchiveReader.js +36 -22
  118. package/dist/artifacts/apple/MachoLoadCommandReader.js +355 -0
  119. package/dist/artifacts/apple/NibArchive.js +81 -14
  120. package/dist/artifacts/apple/NibViewHierarchy.js +10 -3
  121. package/dist/artifacts/apple/PlistNumberLiterals.js +164 -0
  122. package/dist/{application → artifacts/extraction}/ArtifactExtraction.js +10 -10
  123. package/dist/{application → artifacts/inventory}/ArtifactGraphConstruction.js +16 -11
  124. package/dist/{application → artifacts/inventory}/ArtifactInventory.js +4 -4
  125. package/dist/{application/ArtifactInventory → artifacts/inventory}/classify.js +2 -2
  126. package/dist/{application/ArtifactInventory → artifacts/inventory}/reader.js +5 -5
  127. package/dist/{application/ArtifactInventory → artifacts/inventory}/scanCanonical.js +14 -17
  128. package/dist/{application/ArtifactInventory → artifacts/inventory}/scanReader.js +5 -5
  129. package/dist/artifacts/javascript/JavaScriptArtifactFiles.js +6 -2
  130. package/dist/artifacts/readStableArtifact.js +20 -4
  131. package/dist/browser/CdpCaptureCompleteness.js +2 -0
  132. package/dist/browser/CdpCaptureEventHandlers.js +165 -12
  133. package/dist/browser/CdpCaptureEventTypes.js +5 -1
  134. package/dist/browser/CdpCaptureEvents.js +34 -0
  135. package/dist/browser/CdpConnection.js +30 -11
  136. package/dist/browser/CdpOptionalCommand.js +2 -3
  137. package/dist/browser/CdpPageCapture.js +23 -1
  138. package/dist/browser/PlaywrightElectronActiveActions.js +32 -23
  139. package/dist/browser/PlaywrightElectronActiveProjection.js +141 -0
  140. package/dist/browser/PlaywrightElectronActiveProvider.js +130 -122
  141. package/dist/browser/WebSourceMapFetcher.js +426 -72
  142. package/dist/browser/assets/LocalWebScriptArtifacts.js +2 -2
  143. package/dist/browser/history/CaptureFailures.js +137 -0
  144. package/dist/browser/history/CaptureFormatError.js +10 -0
  145. package/dist/browser/history/CaptureRedaction.js +65 -0
  146. package/dist/browser/history/CaptureRelease.js +17 -0
  147. package/dist/browser/history/HarCapture.js +165 -0
  148. package/dist/browser/history/HarCaptureAdapter.js +20 -0
  149. package/dist/browser/history/HarCaptureProcess.js +57 -0
  150. package/dist/browser/history/HarJson.js +92 -0
  151. package/dist/browser/history/HarSchema.js +72 -0
  152. package/dist/browser/history/HistoricalCaptureDecoder.js +188 -0
  153. package/dist/browser/history/HistoricalCaptureFormatAdapter.js +1 -0
  154. package/dist/browser/history/MitmproxyCaptureAdapter.js +42 -0
  155. package/dist/cli/analysisSelector.js +23 -0
  156. package/dist/cli/applicationCommands.js +2 -3
  157. package/dist/cli/artifactCommands.js +26 -1
  158. package/dist/cli/binaryDiagnosticsCommands.js +39 -0
  159. package/dist/cli/coreAnalysisCommands.js +2 -2
  160. package/dist/cli/coreBinaryCommands.js +78 -20
  161. package/dist/cli/electronCommands.js +21 -13
  162. package/dist/cli/evmCommands.js +24 -0
  163. package/dist/cli/firmwareCommands.js +6 -3
  164. package/dist/cli/javascriptApplicationAnalysis.js +20 -3
  165. package/dist/cli/jsonOutput.js +38 -0
  166. package/dist/cli/nativeCallCommands.js +34 -0
  167. package/dist/cli/processCommands.js +1 -1
  168. package/dist/cli/streamedJsonOutput.js +56 -0
  169. package/dist/cli/utilityCommands.js +2 -0
  170. package/dist/cli/webNetworkCaptureCommands.js +40 -0
  171. package/dist/cli/webRuntimeCommands.js +8 -8
  172. package/dist/cli.js +11 -4
  173. package/dist/cliBrowserScenarioCommands.js +2 -2
  174. package/dist/cliCommandNames.js +6 -1
  175. package/dist/cliJsonInput.js +35 -1
  176. package/dist/cliOutput.js +21 -6
  177. package/dist/composition/binaryDiagnostics.js +8 -0
  178. package/dist/composition/evm.js +4 -0
  179. package/dist/composition/webNetworkCaptures.js +6 -0
  180. package/dist/config/environment.js +4 -0
  181. package/dist/config/ghidraStartupTimeout.js +17 -0
  182. package/dist/config/mcpResponseBudget.js +22 -0
  183. package/dist/config/parseConfig.js +2 -1
  184. package/dist/contracts/artifactToolContracts.js +6 -0
  185. package/dist/contracts/browserCaptureToolInputSchema.js +43 -0
  186. package/dist/contracts/browserToolContracts.js +4 -3
  187. package/dist/contracts/enhancedInputs.js +5 -3
  188. package/dist/contracts/enhancedToolContracts.js +3 -3
  189. package/dist/contracts/errorSchemas.js +8 -1
  190. package/dist/contracts/evm/evmToolContracts.js +20 -0
  191. package/dist/contracts/hopperMemoryContracts.js +2 -5
  192. package/dist/contracts/investigationExamples.js +2 -2
  193. package/dist/contracts/javascript/electronToolContracts.js +1 -1
  194. package/dist/contracts/managed/managedToolContracts.js +8 -6
  195. package/dist/contracts/native/binaryDiagnosticsToolContracts.js +42 -0
  196. package/dist/contracts/native/nativeToolContracts.js +21 -3
  197. package/dist/contracts/officialToolContracts.js +26 -24
  198. package/dist/contracts/process/processCaptureExample.js +2 -0
  199. package/dist/contracts/promptContracts.js +3 -3
  200. package/dist/contracts/sessionLifecycleInputs.js +18 -5
  201. package/dist/contracts/sessionStatusContract.js +8 -2
  202. package/dist/contracts/sessionToolContracts.js +8 -3
  203. package/dist/contracts/sessionToolSchemas.js +8 -4
  204. package/dist/contracts/toolContractExamples.js +1 -2
  205. package/dist/contracts/toolContractHelpers.js +4 -1
  206. package/dist/contracts/toolContracts.js +6 -0
  207. package/dist/contracts/toolEffects.js +30 -1
  208. package/dist/contracts/toolOutputSchemaGroups.js +33 -28
  209. package/dist/contracts/toolOutputSchemaPrimitives.js +19 -1
  210. package/dist/contracts/toolSchemaMetadata.js +69 -10
  211. package/dist/contracts/webNetworkCaptureToolContracts.js +24 -0
  212. package/dist/domain/analysisErrorBase.js +22 -2
  213. package/dist/domain/analysisErrorCore.js +61 -5
  214. package/dist/domain/analysisErrorPresentation.js +95 -12
  215. package/dist/domain/analysisErrorProjection.js +148 -19
  216. package/dist/domain/analysisSnapshot.js +166 -2
  217. package/dist/domain/android/androidAnalysis.js +2 -4
  218. package/dist/domain/android/androidApplication.js +17 -9
  219. package/dist/domain/apple/appleApplication.js +41 -14
  220. package/dist/domain/apple/dyldEnvironment.js +73 -0
  221. package/dist/domain/apple/dyldPaths.js +81 -0
  222. package/dist/domain/apple/dylibResolution.js +478 -0
  223. package/dist/domain/apple/dylibResolutionFindings.js +77 -0
  224. package/dist/domain/apple/interfaceBuilderGraph.js +25 -13
  225. package/dist/domain/apple/interfaceBuilderKeyedArchive.js +13 -3
  226. package/dist/domain/apple/keyedArchive.js +9 -1
  227. package/dist/domain/apple/machoContainer.js +54 -0
  228. package/dist/domain/apple/plistNumbers.js +76 -0
  229. package/dist/domain/artifactIdentity.js +29 -0
  230. package/dist/domain/artifactInventoryEvidence.js +19 -24
  231. package/dist/domain/artifactPathSyntax.js +1 -1
  232. package/dist/domain/bridgeCandidateProjection.js +71 -0
  233. package/dist/domain/browserCompleteness.js +1 -0
  234. package/dist/domain/browserObservation.js +1 -1
  235. package/dist/domain/browserObservationError.js +24 -5
  236. package/dist/domain/browserObservationSchemas.js +13 -0
  237. package/dist/domain/browserScenarioValues.js +5 -2
  238. package/dist/domain/bundleComparison.js +3 -2
  239. package/dist/domain/callPathSchemas.js +1 -1
  240. package/dist/domain/canonicalDigest.js +13 -1
  241. package/dist/domain/canonicalJsonDigestSteps.js +133 -0
  242. package/dist/domain/canonicalOrdering.js +9 -5
  243. package/dist/domain/changedBehavior.js +9 -9
  244. package/dist/domain/comparisonSourceEvidence.js +40 -0
  245. package/dist/domain/comparisonStatus.js +2 -30
  246. package/dist/domain/configurationErrors.js +1 -1
  247. package/dist/domain/conformanceTrustGate.js +0 -16
  248. package/dist/domain/evidence.js +78 -11
  249. package/dist/domain/evidenceBundle.js +42 -1
  250. package/dist/domain/evidenceErrors.js +12 -1
  251. package/dist/domain/evm/evmInterface.js +63 -0
  252. package/dist/domain/explicitSensitiveFailure.js +108 -0
  253. package/dist/domain/explicitSensitiveValues.js +10 -0
  254. package/dist/domain/firmware/firmwareAnalysis.js +10 -4
  255. package/dist/domain/hopperErrors.js +23 -2
  256. package/dist/domain/hopperValues.js +51 -8
  257. package/dist/domain/immutableJson.js +114 -0
  258. package/dist/domain/inputIssueProjection.js +3 -0
  259. package/dist/domain/javascript/electronActiveObservation.js +37 -6
  260. package/dist/domain/javascript/electronStaticAnalysisValues.js +6 -12
  261. package/dist/domain/javascript/htmlArtifactReferences.js +40 -0
  262. package/dist/domain/javascript/javascriptApplicationAnalysis.js +71 -23
  263. package/dist/domain/javascript/javascriptApplicationGraph.js +13 -0
  264. package/dist/domain/javascript/javascriptAstValues.js +20 -0
  265. package/dist/domain/javascript/javascriptExportShapeComparison.js +21 -5
  266. package/dist/domain/javascript/javascriptExportShapeVariants.js +0 -10
  267. package/dist/domain/javascript/javascriptRecovery.js +3 -8
  268. package/dist/domain/javascript/javascriptSemanticAnalysis.js +97 -2
  269. package/dist/domain/javascript/javascriptSemanticCoverage.js +6 -5
  270. package/dist/domain/javascript/javascriptSemanticDataEffectHelpers.js +9 -17
  271. package/dist/domain/javascript/javascriptSemanticDataEffects.js +22 -5
  272. package/dist/domain/javascript/javascriptSemanticGraph.js +34 -5
  273. package/dist/domain/javascript/javascriptSemanticGraphSchemas.js +1 -0
  274. package/dist/domain/javascript/javascriptSemanticPrimitives.js +25 -17
  275. package/dist/domain/javascript/javascriptSemanticQuerySchemas.js +8 -4
  276. package/dist/domain/javascript/javascriptSemanticResourceLimits.js +77 -0
  277. package/dist/domain/javascript/javascriptSemanticValues.js +83 -11
  278. package/dist/domain/javascript/javascriptSourceParser.js +6 -2
  279. package/dist/domain/javascript/javascriptStaticAnalysis.js +22 -17
  280. package/dist/domain/javascript/javascriptStaticAnalysisBundler.js +5 -3
  281. package/dist/domain/javascript/javascriptStaticAnalysisCalls.js +14 -4
  282. package/dist/domain/javascript/javascriptStaticAnalysisFindings.js +66 -7
  283. package/dist/domain/javascript/javascriptStaticAnalysisHelpers.js +28 -16
  284. package/dist/domain/javascript/javascriptStaticAnalysisState.js +3 -2
  285. package/dist/domain/jsonSerialization.js +109 -0
  286. package/dist/domain/jsonValue.js +91 -3
  287. package/dist/domain/localPath.js +8 -0
  288. package/dist/domain/managed/managedApplicationGraph.js +10 -10
  289. package/dist/domain/managed/managedInspectionEvidence.js +16 -0
  290. package/dist/domain/managed/managedMemberComparisonMatch.js +5 -9
  291. package/dist/domain/managed/managedNativeVerification.js +3 -9
  292. package/dist/domain/native/binaryLayout.js +357 -0
  293. package/dist/domain/native/fileOffsetPartialObservation.js +1 -0
  294. package/dist/domain/native/nativeCallObservation.js +186 -0
  295. package/dist/domain/native/nativeCallPartialObservation.js +33 -0
  296. package/dist/domain/native/objcSwiftMetadata.js +0 -39
  297. package/dist/domain/native/recordedCrash.js +266 -0
  298. package/dist/domain/native/recordedCrashNoteCoverage.js +73 -0
  299. package/dist/domain/{processCapture.js → process/processCapture.js} +143 -2
  300. package/dist/domain/{processCaptureExample.js → process/processCaptureExample.js} +5 -0
  301. package/dist/domain/process/processCaptureParsing.js +54 -0
  302. package/dist/domain/{processCaptureValidation.js → process/processCaptureValidation.js} +18 -2
  303. package/dist/domain/{processComparison.js → process/processComparison.js} +39 -5
  304. package/dist/domain/{processObservation.js → process/processObservation.js} +1 -1
  305. package/dist/domain/{processScenario.js → process/processScenario.js} +11 -10
  306. package/dist/domain/{processTraceSpecification.js → process/processTraceSpecification.js} +1 -1
  307. package/dist/domain/propertyListKeys.js +1 -1
  308. package/dist/domain/propertyListXmlText.js +19 -0
  309. package/dist/domain/providerAdapterError.js +1 -1
  310. package/dist/domain/providerOperationHealth.js +54 -0
  311. package/dist/domain/providerSelectionError.js +4 -2
  312. package/dist/domain/reconstructionVerification.js +9 -46
  313. package/dist/domain/reconstructionVerificationSchemas.js +3 -3
  314. package/dist/domain/residualUnknown.js +3 -2
  315. package/dist/domain/staticRuntimeCorrelation.js +9 -46
  316. package/dist/domain/webBundleAnalysis.js +20 -8
  317. package/dist/domain/webBundleAnalyzerInspection.js +13 -8
  318. package/dist/domain/webBundleAnalyzerResult.js +41 -2
  319. package/dist/domain/webCaptureDiff.js +1 -0
  320. package/dist/domain/webNetworkCapture.js +118 -0
  321. package/dist/domain/webNetworkCaptureCoordinates.js +58 -0
  322. package/dist/domain/webRuntime.js +19 -5
  323. package/dist/domain/webSourceLocation.js +1 -0
  324. package/dist/dotnet/ManagedExceptionRegionValidation.js +41 -0
  325. package/dist/dotnet/ManagedMemberInspector.js +4 -2
  326. package/dist/dotnet/ManagedMemberInspectorCore.js +38 -32
  327. package/dist/dotnet/ManagedMemberInstructionDecoder.js +23 -7
  328. package/dist/dotnet/ManagedMemberRows.js +14 -3
  329. package/dist/dotnet/ManagedMetadataHeaps.js +20 -2
  330. package/dist/dotnet/ManagedMetadataInventory.js +38 -28
  331. package/dist/dotnet/ManagedMetadataInventoryRows.js +24 -10
  332. package/dist/dotnet/ManagedMethodBodyReader.js +7 -1
  333. package/dist/dotnet/ManagedNativeBoundaryHelpers.js +15 -3
  334. package/dist/dotnet/ManagedNativeBoundaryInspector.js +3 -1
  335. package/dist/dotnet/ManagedPeReader.js +11 -0
  336. package/dist/evm/EvmBytecodeCarrier.js +21 -0
  337. package/dist/evm/EvmWorkerLimits.js +40 -0
  338. package/dist/evm/EvmoleFailures.js +126 -0
  339. package/dist/evm/EvmoleInterfaceAdapter.js +53 -0
  340. package/dist/evm/EvmoleInterfaceProvider.js +273 -0
  341. package/dist/evm/EvmoleInterfaceWorker.js +87 -0
  342. package/dist/evm/EvmoleRelease.js +16 -0
  343. package/dist/firmware/FirmwareCommand.js +1 -0
  344. package/dist/firmware/FirmwareFiles.js +1 -1
  345. package/dist/generatedPackageMetadata.js +2 -2
  346. package/dist/ghidra/GhidraAnalysisProfile.js +5 -0
  347. package/dist/ghidra/GhidraClient.js +47 -14
  348. package/dist/ghidra/GhidraDiagnostics.js +7 -7
  349. package/dist/ghidra/GhidraFunctionValues.js +10 -7
  350. package/dist/ghidra/GhidraInstallation.js +18 -21
  351. package/dist/ghidra/GhidraInventoryValues.js +14 -4
  352. package/dist/ghidra/GhidraJavaLaunch.js +62 -0
  353. package/dist/ghidra/GhidraLauncher.js +34 -16
  354. package/dist/ghidra/GhidraProvider.js +2 -2
  355. package/dist/ghidra/GhidraProviderCapabilities.js +15 -3
  356. package/dist/ghidra/GhidraProviderClient.js +23 -12
  357. package/dist/ghidra/GhidraSessionError.js +11 -7
  358. package/dist/ghidra/GhidraTargetSnapshot.js +47 -12
  359. package/dist/ghidra/GhidraTransport.js +20 -0
  360. package/dist/hopper/BridgeLauncher.js +33 -11
  361. package/dist/hopper/HopperAnalysisProfile.js +62 -4
  362. package/dist/hopper/HopperCleanup.js +15 -3
  363. package/dist/hopper/HopperClient.js +222 -14
  364. package/dist/hopper/HopperFileOffset.js +237 -0
  365. package/dist/hopper/HopperMachOImage.js +196 -0
  366. package/dist/hopper/HopperOperationStage.js +6 -0
  367. package/dist/hopper/HopperProvider.js +63 -9
  368. package/dist/hopper/HopperProviderCapabilities.js +19 -1
  369. package/dist/hopper/HopperRegexSearch.js +137 -0
  370. package/dist/hopper/HopperRegexWorker.js +27 -0
  371. package/dist/hopper/HopperRequestQueue.js +68 -19
  372. package/dist/hopper/HopperTargetLease.js +3 -2
  373. package/dist/hopper/LinuxPrivateDisplayProbe.js +4 -2
  374. package/dist/inspector/JavaScriptRuntimeScope.js +9 -1
  375. package/dist/inspector/V8InspectorCaptureProjection.js +8 -3
  376. package/dist/inspector/V8InspectorProvider.js +47 -11
  377. package/dist/javascript/recovery/WakaruCommand.js +3 -0
  378. package/dist/javascript/sourceMaps/DecodedSourceMap.js +47 -0
  379. package/dist/javascript/sourceMaps/SourceMapCommand.js +17 -0
  380. package/dist/javascript/sourceMaps/SourceMapFormat.js +79 -31
  381. package/dist/javascript/sourceMaps/TraceSourceMap.js +14 -28
  382. package/dist/mcpDoctor.js +62 -2
  383. package/dist/native/AppleDispatchCoverage.js +47 -6
  384. package/dist/native/AppleDispatchDecodeFacts.js +6 -0
  385. package/dist/native/AppleDispatchMetadata.js +6 -3
  386. package/dist/native/AppleMachoFixups.js +48 -24
  387. package/dist/native/AppleMachoSelection.js +32 -16
  388. package/dist/native/AppleObjcCategories.js +6 -2
  389. package/dist/native/AppleObjcDispatchFacets.js +5 -2
  390. package/dist/native/AppleObjcProperties.js +2 -1
  391. package/dist/native/AppleSwiftDispatchFacets.js +27 -21
  392. package/dist/native/AppleSwiftVtables.js +21 -15
  393. package/dist/native/CommandRunner.js +82 -84
  394. package/dist/native/LldbCallTracer.js +541 -0
  395. package/dist/native/LldbRetainedObservations.js +178 -0
  396. package/dist/native/NativeCallObservation.js +194 -0
  397. package/dist/native/NativeMacOSProvider.js +117 -20
  398. package/dist/native/NativeMacOSProviderMetadata.js +8 -3
  399. package/dist/native/SignatureTargetBinding.js +155 -0
  400. package/dist/native/parsers/lipo.js +71 -1
  401. package/dist/native/pwndbg/PwndbgCoreContext.js +180 -0
  402. package/dist/native/pwntools/PwntoolsDecoder.js +203 -0
  403. package/dist/native/pwntools/PwntoolsFailures.js +180 -0
  404. package/dist/native/pwntools/PwntoolsLayoutProvider.js +36 -0
  405. package/dist/native/pwntools/PwntoolsRecordedCrashProvider.js +75 -0
  406. package/dist/native/pwntools/PwntoolsRelease.js +19 -0
  407. package/dist/native/pwntools/PwntoolsResourceLimits.js +76 -0
  408. package/dist/native/pwntools/RecordedCrashSourceBindings.js +46 -0
  409. package/dist/native/pwntools/RecordedCrashStructureBindings.js +103 -0
  410. package/dist/process/DarwinProcessRunTokenReader.js +293 -0
  411. package/dist/process/ExecFileOutput.js +20 -0
  412. package/dist/process/OwnedCommand.js +118 -0
  413. package/dist/process/ProcessOwnership.js +431 -51
  414. package/dist/process/ProcessOwnershipObservation.js +209 -27
  415. package/dist/process/ProviderProcess.js +68 -10
  416. package/dist/{application → process/capture}/ProcessCaptureCapability.js +15 -0
  417. package/dist/{application → process/capture}/ProcessCaptureError.js +18 -2
  418. package/dist/process/capture/ProcessCaptureLifecycle.js +681 -0
  419. package/dist/{application → process/capture}/ProcessHarness.js +195 -29
  420. package/dist/{application → process/capture}/ProcessSampling.js +2 -2
  421. package/dist/server/EvidenceMcpServer.js +146 -0
  422. package/dist/server/createServer.js +37 -8
  423. package/dist/server/promptCompletion.js +10 -3
  424. package/dist/server/registerAndroidTools.js +2 -4
  425. package/dist/server/registerApplicationTools/helpers.js +2 -4
  426. package/dist/server/registerArtifactComparisonTool.js +11 -7
  427. package/dist/server/registerBinaryDiagnosticsTools.js +15 -0
  428. package/dist/server/registerBrowserScenarioTool.js +2 -4
  429. package/dist/server/registerBrowserTools.js +2 -4
  430. package/dist/server/registerBundleComparisonTool.js +2 -3
  431. package/dist/server/registerCloseLifecycleTool.js +8 -18
  432. package/dist/server/registerElectronTools.js +2 -4
  433. package/dist/server/registerEnhancedTools.js +18 -59
  434. package/dist/server/registerEvidenceTools.js +3 -5
  435. package/dist/server/registerEvmTools.js +15 -0
  436. package/dist/server/registerFirmwareTools.js +2 -4
  437. package/dist/server/registerFunctionComparisonTool.js +10 -6
  438. package/dist/server/registerInvestigationTools.js +7 -7
  439. package/dist/server/registerJavaScriptRecoveryTool.js +2 -4
  440. package/dist/server/registerJavaScriptRuntimeObservationTools.js +2 -4
  441. package/dist/server/registerManagedWorkflowTools/compareManagedMembers.js +2 -4
  442. package/dist/server/registerManagedWorkflowTools/importManagedReconstruction.js +2 -4
  443. package/dist/server/registerManagedWorkflowTools/projectManagedApplicationGraph.js +2 -4
  444. package/dist/server/registerManagedWorkflowTools/verifyManagedNativeBoundaries.js +2 -4
  445. package/dist/server/registerOfficialTools.js +2 -4
  446. package/dist/server/registerProcessComparisonTool.js +72 -46
  447. package/dist/server/registerRecordedCrashTools.js +15 -0
  448. package/dist/server/registerSessionRecordTools.js +5 -6
  449. package/dist/server/registerSessionStatusTool.js +17 -3
  450. package/dist/server/registerSessionTools.js +13 -5
  451. package/dist/server/registerWebModuleTool.js +2 -4
  452. package/dist/server/registerWebNetworkCaptureTool.js +26 -0
  453. package/dist/server/registerWebRuntimeTools.js +3 -7
  454. package/dist/server/registerWebScriptTool.js +2 -4
  455. package/dist/server/registerWebSourceLocationTool.js +2 -4
  456. package/dist/server/runDerivedOperation.js +15 -3
  457. package/dist/server/sessionAvailabilityPolicy.js +3 -1
  458. package/dist/server/sessionToolPolicies.js +1 -1
  459. package/dist/server/toolRegistrationOptions.js +2 -2
  460. package/dist/server/toolResult.js +63 -11
  461. package/dist/server/toolResultEncoding.js +33 -0
  462. package/install.sh +1 -1
  463. package/native/windows/build/manifest.json +2 -2
  464. package/native/windows/build/rea-windows-x64.node +0 -0
  465. package/package.json +42 -9
  466. package/scripts/electron-active-hook-boundaries.cjs +18 -20
  467. package/scripts/electron-active-hook.cjs +241 -37
  468. package/scripts/rea.mjs +11 -3
  469. package/skills/reverse-engineer-anything/SKILL.md +32 -4
  470. package/skills/reverse-engineer-anything/references/javascript-applications.md +8 -1
  471. package/skills/reverse-engineer-anything/references/native-and-artifacts.md +29 -0
  472. package/third_party/README.md +60 -0
  473. package/third_party/evmole/LICENSE +21 -0
  474. package/third_party/evmole/README.md +22 -0
  475. package/third_party/pwndbg/LICENSE.md +21 -0
  476. package/third_party/pwndbg/README.md +23 -0
  477. package/third_party/pwntools/README.md +40 -0
  478. package/dist/application/AuthorizedArtifactInventory.js +0 -7
  479. package/dist/application/ProcessCaptureLifecycle.js +0 -299
  480. package/dist/application/StoreFileLock.js +0 -124
  481. package/dist/contracts/processCaptureExample.js +0 -2
  482. package/dist/domain/bytecodeProvider.js +0 -178
  483. package/dist/domain/customProtocolCapture.js +0 -137
  484. package/dist/domain/eventProcessTree.js +0 -225
  485. package/dist/domain/mobileApplicationInvestigation.js +0 -159
  486. package/dist/domain/packageAnalysis.js +0 -123
  487. package/dist/domain/peInspection.js +0 -197
  488. package/dist/domain/processCaptureParsing.js +0 -21
  489. package/dist/domain/protocolCapture.js +0 -217
  490. package/dist/domain/runtimeIdentification.js +0 -212
  491. package/dist/generatedMcpToolCatalog.js +0 -37
  492. package/dist/ghidra/GhidraDefaults.js +0 -2
  493. /package/dist/application/{ArtifactExtractionDestination.js → artifacts/ArtifactExtractionDestination.js} +0 -0
  494. /package/dist/{application/ArtifactInventory → artifacts/inventory}/policy.js +0 -0
  495. /package/dist/{application/ArtifactInventory → artifacts/inventory}/types.js +0 -0
  496. /package/dist/domain/{processEvidenceProvider.js → process/processEvidenceProvider.js} +0 -0
  497. /package/dist/domain/{processTraceComparison.js → process/processTraceComparison.js} +0 -0
  498. /package/dist/domain/{processTraceDimensionProjection.js → process/processTraceDimensionProjection.js} +0 -0
  499. /package/dist/domain/{processTraceEvaluation.js → process/processTraceEvaluation.js} +0 -0
  500. /package/dist/{application → process/capture}/FilesystemSnapshot.js +0 -0
  501. /package/dist/{application → process/capture}/ProcessCaptureEnvironment.js +0 -0
  502. /package/dist/{application → process/capture}/ProcessCaptureJournal.js +0 -0
  503. /package/dist/{application → process/capture}/ProcessFilesystemEffects.js +0 -0
  504. /package/dist/{application → process/capture}/ProcessNormalization.js +0 -0
  505. /package/dist/{application → process/capture}/ProcessScenarioRuntimeValidation.js +0 -0
  506. /package/dist/{application → process/capture}/ProcessTimer.js +0 -0
  507. /package/dist/{application → process/capture}/TerminalRenderer.js +0 -0
@@ -1,8 +1,9 @@
1
1
  import { inferJsonShape } from "../domain/jsonShape.js";
2
2
  import { safeResponseMetadata } from "./CdpSafeMetadata.js";
3
3
  import { allowedSanitizedUrl, isHttpUrl, numberValue, recordValue, recordsValue, cdpStringValue, } from "./CdpCaptureValues.js";
4
- import { requestBodyShape } from "./CdpCaptureEventBodyShapes.js";
5
- import { consolePrimitive, decodeBase64, exclusionReasonForUrl, executionContextKey, firstCallFrame, initiatorLocation, integerOrNull, isMainFrameNavigation, } from "./CdpCaptureEventHelpers.js";
4
+ import { requestBodyShape, updateResponseBodyShape, } from "./CdpCaptureEventBodyShapes.js";
5
+ import { consolePrimitive, decodeBase64, exclusionReasonForUrl, executionContextKey, firstCallFrame, initiatorLocation, integerOrNull, isJsonMediaType, isMainFrameNavigation, } from "./CdpCaptureEventHelpers.js";
6
+ import { CDP_CAPTURE_SCRIPT_METADATA_LIMITS, } from "./CdpCaptureEventTypes.js";
6
7
  export const handleExecutionContextCreated = (state, params) => {
7
8
  const context = recordValue(params.context);
8
9
  const identifier = numberValue(context?.id);
@@ -27,12 +28,18 @@ export const handleScriptParsed = (state, params) => {
27
28
  state.completeness.exclude("scripts", "invalid_protocol_value");
28
29
  return;
29
30
  }
31
+ const replacedBytes = state.scriptMetadataBytesById.get(scriptId) ?? 0;
32
+ state.scriptMetadataBudgetOmissionsById.delete(scriptId);
33
+ if (replacedBytes > 0) {
34
+ state.scripts.delete(scriptId);
35
+ state.scriptMetadataBytesById.delete(scriptId);
36
+ state.retainedScriptMetadataBytes -= replacedBytes;
37
+ }
30
38
  if (sanitized === undefined) {
31
39
  state.completeness.exclude("scripts", exclusionReasonForUrl(rawUrl));
32
40
  return;
33
41
  }
34
- const sourceMap = sourceMapForScript(params.sourceMapURL, rawUrl, state);
35
- const script = {
42
+ const baseScript = {
36
43
  scriptId,
37
44
  rawUrl,
38
45
  url: sanitized.url,
@@ -41,16 +48,49 @@ export const handleScriptParsed = (state, params) => {
41
48
  length: Math.max(0, Math.min(Number.MAX_SAFE_INTEGER, Math.trunc(numberValue(params.length) ?? 0))),
42
49
  isModule: params.isModule === true,
43
50
  language: cdpStringValue(params.scriptLanguage) ?? null,
44
- sourceMapUrl: sourceMap.sanitized,
45
- sourceMapRawUrl: sourceMap.raw,
46
51
  executionContextKey: executionContextKey(params.executionContextId),
47
52
  };
53
+ const baseBytes = scriptMetadataStringBytes(baseScript);
54
+ const sourceMapDeclared = typeof params.sourceMapURL === "string" && params.sourceMapURL.length > 0;
55
+ if (state.scripts.size >= CDP_CAPTURE_SCRIPT_METADATA_LIMITS.scripts ||
56
+ baseBytes >
57
+ CDP_CAPTURE_SCRIPT_METADATA_LIMITS.retainedBytes -
58
+ state.retainedScriptMetadataBytes) {
59
+ state.rejectedScriptMetadataBudgetCount += 1;
60
+ if (sourceMapDeclared)
61
+ state.rejectedSourceMapMetadataBudgetCount += 1;
62
+ return;
63
+ }
64
+ const sourceMap = sourceMapForScript(params.sourceMapURL, rawUrl, state, CDP_CAPTURE_SCRIPT_METADATA_LIMITS.retainedBytes -
65
+ state.retainedScriptMetadataBytes -
66
+ baseBytes);
67
+ const { budgetExhausted, ...sourceMapFields } = sourceMap;
68
+ const script = { ...baseScript, ...sourceMapFields };
69
+ if (budgetExhausted)
70
+ state.scriptMetadataBudgetOmissionsById.set(scriptId, true);
71
+ const retainedBytes = baseBytes +
72
+ stringByteLength(sourceMap.sourceMapUrl) +
73
+ stringByteLength(sourceMap.sourceMapRawUrl);
74
+ state.retainedScriptMetadataBytes += retainedBytes;
75
+ state.scriptMetadataBytesById.set(scriptId, retainedBytes);
48
76
  state.scripts.set(scriptId, script);
49
77
  };
50
- const sourceMapForScript = (value, scriptUrl, state) => {
78
+ const scriptMetadataStringBytes = (script) => stringByteLength(script.scriptId) +
79
+ stringByteLength(script.rawUrl) +
80
+ stringByteLength(script.url) +
81
+ stringByteLength(script.origin) +
82
+ stringByteLength(script.hash) +
83
+ stringByteLength(script.language) +
84
+ stringByteLength(script.executionContextKey);
85
+ const stringByteLength = (value) => value === null ? 0 : Buffer.byteLength(value, "utf8");
86
+ const sourceMapForScript = (value, scriptUrl, state, remainingBytes) => {
51
87
  const declaredUrl = cdpStringValue(value);
52
88
  if (declaredUrl === undefined || declaredUrl === "")
53
- return { sanitized: null, raw: null };
89
+ return {
90
+ sourceMapUrl: null,
91
+ sourceMapRawUrl: null,
92
+ budgetExhausted: false,
93
+ };
54
94
  let rawUrl;
55
95
  try {
56
96
  rawUrl = new URL(declaredUrl, scriptUrl).href;
@@ -59,13 +99,34 @@ const sourceMapForScript = (value, scriptUrl, state) => {
59
99
  // Unparseable URLs are recorded as unsupported, not as failures.
60
100
  void cause;
61
101
  state.completeness.exclude("source_maps", "unsupported_url");
62
- return { sanitized: null, raw: null };
102
+ return {
103
+ sourceMapUrl: null,
104
+ sourceMapRawUrl: null,
105
+ budgetExhausted: false,
106
+ };
63
107
  }
64
108
  const sanitized = allowedSanitizedUrl(rawUrl, state.allowedOrigins);
65
- if (sanitized !== undefined)
66
- return { sanitized: sanitized.url, raw: rawUrl };
109
+ if (sanitized !== undefined) {
110
+ if (stringByteLength(rawUrl) + stringByteLength(sanitized.url) >
111
+ remainingBytes) {
112
+ return {
113
+ sourceMapUrl: null,
114
+ sourceMapRawUrl: null,
115
+ budgetExhausted: true,
116
+ };
117
+ }
118
+ return {
119
+ sourceMapUrl: sanitized.url,
120
+ sourceMapRawUrl: rawUrl,
121
+ budgetExhausted: false,
122
+ };
123
+ }
67
124
  state.completeness.exclude("source_maps", exclusionReasonForUrl(rawUrl));
68
- return { sanitized: null, raw: null };
125
+ return {
126
+ sourceMapUrl: null,
127
+ sourceMapRawUrl: null,
128
+ budgetExhausted: false,
129
+ };
69
130
  };
70
131
  export const handleRequestWillBeSent = (state, params) => {
71
132
  const requestId = cdpStringValue(params.requestId);
@@ -74,16 +135,73 @@ export const handleRequestWillBeSent = (state, params) => {
74
135
  state.completeness.exclude("network_requests", "invalid_protocol_value");
75
136
  return;
76
137
  }
138
+ if (state.malformedRedirectRequestIds.has(requestId))
139
+ return;
140
+ const previous = state.network.get(requestId);
141
+ if (!Object.hasOwn(params, "redirectResponse") &&
142
+ previous !== undefined &&
143
+ preserveMalformedRedirectEvidence(state, requestId, previous))
144
+ return;
77
145
  if (request === undefined) {
78
146
  state.completeness.exclude("network_requests", "invalid_protocol_value");
79
147
  state.network.delete(requestId);
148
+ state.networkRequestTimestamps.delete(requestId);
80
149
  return;
81
150
  }
82
151
  const sanitized = allowedSanitizedUrl(request.url, state.allowedOrigins);
83
152
  if (sanitized === undefined) {
84
153
  state.completeness.exclude("network_requests", exclusionReasonForUrl(cdpStringValue(request.url)));
85
154
  state.network.delete(requestId);
155
+ state.networkRequestTimestamps.delete(requestId);
156
+ return;
157
+ }
158
+ const redirectResponse = recordValue(params.redirectResponse);
159
+ if (Object.hasOwn(params, "redirectResponse") &&
160
+ redirectResponse === undefined &&
161
+ preserveMalformedRedirectEvidence(state, requestId, previous))
86
162
  return;
163
+ const redirects = [...(previous?.redirects ?? [])];
164
+ if (redirectResponse !== undefined) {
165
+ const rawResponseUrl = cdpStringValue(redirectResponse.url);
166
+ const responseUrl = rawResponseUrl === undefined || rawResponseUrl === ""
167
+ ? undefined
168
+ : allowedSanitizedUrl(rawResponseUrl, state.allowedOrigins);
169
+ const responseUrlReason = redirectResponseUrlReason(rawResponseUrl);
170
+ if (previous === undefined) {
171
+ if (responseUrl === undefined)
172
+ state.completeness.exclude("network_requests", responseUrlReason);
173
+ else
174
+ // CDP may deliver the continuation after its predecessor was excluded
175
+ // by origin policy or before capture began. Keep the final request but
176
+ // report missing prior coverage without calling it malformed protocol.
177
+ state.completeness.attachLimited("network_requests");
178
+ }
179
+ else if (responseUrl === undefined) {
180
+ // redirectResponse belongs to the same request ID and can contain an
181
+ // excluded origin. Drop the entire chain before retaining any details.
182
+ state.completeness.exclude("network_requests", responseUrlReason);
183
+ state.network.delete(requestId);
184
+ state.networkRequestTimestamps.delete(requestId);
185
+ return;
186
+ }
187
+ else {
188
+ redirects.push({
189
+ url: previous.url,
190
+ response_url: responseUrl.url,
191
+ method: previous.method,
192
+ resource_type: previous.resource_type,
193
+ status: numberValue(redirectResponse.status) ?? null,
194
+ mime_type: cdpStringValue(redirectResponse.mimeType) ?? null,
195
+ encoded_data_length: (() => {
196
+ const length = numberValue(redirectResponse.encodedDataLength);
197
+ return length === undefined ? null : Math.max(0, length);
198
+ })(),
199
+ request_timestamp: state.networkRequestTimestamps.get(requestId) ?? null,
200
+ // CDP reports redirectResponse on the next requestWillBeSent event.
201
+ // This is the event boundary, not a separately observed response time.
202
+ redirect_event_timestamp: numberValue(params.timestamp) ?? null,
203
+ });
204
+ }
87
205
  }
88
206
  const initiator = recordValue(params.initiator);
89
207
  const initiatorFrame = initiatorLocation(initiator);
@@ -100,6 +218,7 @@ export const handleRequestWillBeSent = (state, params) => {
100
218
  status: null,
101
219
  mime_type: null,
102
220
  encoded_data_length: null,
221
+ redirects,
103
222
  initiator: {
104
223
  type: cdpStringValue(initiator?.type) ?? "other",
105
224
  url: initiatorUrl?.url ?? null,
@@ -108,6 +227,35 @@ export const handleRequestWillBeSent = (state, params) => {
108
227
  },
109
228
  body_shapes: requestBodyShape(state, request),
110
229
  });
230
+ const timestamp = numberValue(params.timestamp);
231
+ if (timestamp === undefined)
232
+ state.networkRequestTimestamps.delete(requestId);
233
+ else
234
+ state.networkRequestTimestamps.set(requestId, timestamp);
235
+ };
236
+ const preserveMalformedRedirectEvidence = (state, requestId, previous) => {
237
+ state.completeness.exclude("network_requests", "invalid_protocol_value");
238
+ if (previous === undefined)
239
+ return false;
240
+ state.malformedRedirectRequestIds.add(requestId);
241
+ if (state.input.include_json_body_shapes &&
242
+ isJsonMediaType(previous.mime_type) &&
243
+ previous.body_shapes.response === null) {
244
+ updateResponseBodyShape(state, requestId, null);
245
+ state.completeness.exclude("json_body_shapes", "invalid_protocol_value");
246
+ }
247
+ return true;
248
+ };
249
+ const redirectResponseUrlReason = (value) => {
250
+ if (value === undefined || value === "")
251
+ return "invalid_protocol_value";
252
+ try {
253
+ new URL(value);
254
+ }
255
+ catch {
256
+ return "invalid_protocol_value";
257
+ }
258
+ return exclusionReasonForUrl(value);
111
259
  };
112
260
  export const handleResponseReceived = (state, params) => {
113
261
  const requestId = cdpStringValue(params.requestId);
@@ -115,6 +263,8 @@ export const handleResponseReceived = (state, params) => {
115
263
  state.completeness.exclude("network_requests", "invalid_protocol_value");
116
264
  return;
117
265
  }
266
+ if (state.malformedRedirectRequestIds.has(requestId))
267
+ return;
118
268
  const current = state.network.get(requestId);
119
269
  const response = recordValue(params.response);
120
270
  if (current === undefined)
@@ -125,6 +275,7 @@ export const handleResponseReceived = (state, params) => {
125
275
  ? "invalid_protocol_value"
126
276
  : exclusionReasonForUrl(cdpStringValue(response.url)));
127
277
  state.network.delete(requestId);
278
+ state.networkRequestTimestamps.delete(requestId);
128
279
  return;
129
280
  }
130
281
  state.network.set(requestId, {
@@ -140,6 +291,8 @@ export const handleLoadingFinished = (state, params) => {
140
291
  const requestId = cdpStringValue(params.requestId);
141
292
  if (requestId === undefined)
142
293
  return;
294
+ if (state.malformedRedirectRequestIds.has(requestId))
295
+ return;
143
296
  const current = state.network.get(requestId);
144
297
  if (current === undefined)
145
298
  return;
@@ -1 +1,5 @@
1
- export {};
1
+ /** Bounds retained CDP script identities independently from source text capture. */
2
+ export const CDP_CAPTURE_SCRIPT_METADATA_LIMITS = {
3
+ retainedBytes: 8 * 1024 * 1024,
4
+ scripts: 50_000,
5
+ };
@@ -6,9 +6,17 @@ import { recordValue } from "./CdpCaptureValues.js";
6
6
  export {} from "./CdpCaptureEventTypes.js";
7
7
  /** Event accumulator that validates and normalizes payloads at ingestion. */
8
8
  export class CdpCaptureEvents {
9
+ #scriptMetadataBudgetExclusionsRecorded = false;
9
10
  scripts = new Map();
11
+ scriptMetadataBudgetOmissionsById = new Map();
12
+ rejectedScriptMetadataBudgetCount = 0;
13
+ rejectedSourceMapMetadataBudgetCount = 0;
14
+ scriptMetadataBytesById = new Map();
15
+ retainedScriptMetadataBytes = 0;
10
16
  executionContextFrames = new Map();
11
17
  network = new Map();
18
+ networkRequestTimestamps = new Map();
19
+ malformedRedirectRequestIds = new Set();
12
20
  allowedWebSockets = new Set();
13
21
  console = [];
14
22
  websockets = [];
@@ -37,8 +45,16 @@ export class CdpCaptureEvents {
37
45
  this.navigationDuringCapture = false;
38
46
  this.committedDocument = undefined;
39
47
  this.scripts.clear();
48
+ this.scriptMetadataBudgetOmissionsById.clear();
49
+ this.rejectedScriptMetadataBudgetCount = 0;
50
+ this.rejectedSourceMapMetadataBudgetCount = 0;
51
+ this.scriptMetadataBytesById.clear();
52
+ this.retainedScriptMetadataBytes = 0;
53
+ this.#scriptMetadataBudgetExclusionsRecorded = false;
40
54
  this.executionContextFrames.clear();
41
55
  this.network.clear();
56
+ this.networkRequestTimestamps.clear();
57
+ this.malformedRedirectRequestIds.clear();
42
58
  this.allowedWebSockets.clear();
43
59
  this.console.length = 0;
44
60
  this.websockets.length = 0;
@@ -63,6 +79,19 @@ export class CdpCaptureEvents {
63
79
  // compared against itself rather than the document we just left.
64
80
  this.committedDocument = undefined;
65
81
  }
82
+ /** Record final script metadata omissions after all scriptParsed replacements. */
83
+ recordScriptMetadataBudgetExclusions() {
84
+ if (this.#scriptMetadataBudgetExclusionsRecorded)
85
+ return;
86
+ this.#scriptMetadataBudgetExclusionsRecorded = true;
87
+ const omittedScripts = this.rejectedScriptMetadataBudgetCount;
88
+ const omittedSourceMaps = this.rejectedSourceMapMetadataBudgetCount +
89
+ this.scriptMetadataBudgetOmissionsById.size;
90
+ if (omittedScripts > 0)
91
+ this.completeness.exclude("scripts", "resource_budget_exhausted", omittedScripts);
92
+ if (omittedSourceMaps > 0)
93
+ this.completeness.exclude("source_maps", "resource_budget_exhausted", omittedSourceMaps);
94
+ }
66
95
  ingest(event) {
67
96
  const params = recordValue(event.params);
68
97
  if (params === undefined)
@@ -119,14 +148,19 @@ export class CdpCaptureEvents {
119
148
  if (!this.input.include_json_body_shapes)
120
149
  return [];
121
150
  return [...this.network.values()]
151
+ .filter((request) => !this.malformedRedirectRequestIds.has(request.request_id))
122
152
  .filter((request) => isJsonMediaType(request.mime_type))
123
153
  .map((request) => request.request_id);
124
154
  }
125
155
  responseBodyUnavailable(requestId) {
156
+ if (this.malformedRedirectRequestIds.has(requestId))
157
+ return;
126
158
  bodyShapes.updateResponseBodyShape(this, requestId, null);
127
159
  this.completeness.unavailable("json_body_shapes");
128
160
  }
129
161
  ingestResponseBody(requestId, value) {
162
+ if (this.malformedRedirectRequestIds.has(requestId))
163
+ return;
130
164
  bodyShapes.ingestResponseBodyShape(this, requestId, value);
131
165
  }
132
166
  }
@@ -48,7 +48,7 @@ export class CdpConnection {
48
48
  /** Subscribe to an unexpected transport loss while an operation is active. */
49
49
  onDisconnect(listener) {
50
50
  if (this.#closed) {
51
- listener();
51
+ listener(this.#transportError(this.#transportFailure));
52
52
  return () => undefined;
53
53
  }
54
54
  this.#disconnectListeners.add(listener);
@@ -85,6 +85,7 @@ export class CdpConnection {
85
85
  signal?.addEventListener("abort", onAbort, { once: true });
86
86
  this.#pending.set(id, {
87
87
  method,
88
+ ...(sessionId === undefined ? {} : { sessionId }),
88
89
  resolve,
89
90
  reject,
90
91
  removeAbort: () => signal?.removeEventListener("abort", onAbort),
@@ -171,17 +172,34 @@ export class CdpConnection {
171
172
  const pending = this.#pending.get(id);
172
173
  if (pending === undefined)
173
174
  return;
174
- this.#complete(id, pending);
175
- if ("error" in message) {
176
- const reported = message.error;
177
- pending.reject(new CdpCommandRejection(this.operation, pending.method, isRecord(reported) && typeof reported.code === "number"
178
- ? reported.code
179
- : null, isRecord(reported) && typeof reported.message === "string"
180
- ? reported.message
181
- : null));
175
+ const hasResult = "result" in message;
176
+ const hasError = "error" in message;
177
+ if (("sessionId" in message &&
178
+ (typeof message.sessionId !== "string" ||
179
+ message.sessionId !== pending.sessionId)) ||
180
+ hasResult === hasError) {
181
+ this.#failPending("protocol_error");
182
182
  return;
183
183
  }
184
- pending.resolve("result" in message ? message.result : {});
184
+ if (hasResult) {
185
+ if (!isRecord(message.result)) {
186
+ this.#failPending("protocol_error");
187
+ return;
188
+ }
189
+ this.#complete(id, pending);
190
+ pending.resolve(message.result);
191
+ return;
192
+ }
193
+ const reported = message.error;
194
+ if (!isRecord(reported) ||
195
+ typeof reported.code !== "number" ||
196
+ !Number.isSafeInteger(reported.code) ||
197
+ typeof reported.message !== "string") {
198
+ this.#failPending("protocol_error");
199
+ return;
200
+ }
201
+ this.#complete(id, pending);
202
+ pending.reject(new CdpCommandRejection(this.operation, pending.method, reported.code, reported.message));
185
203
  }
186
204
  #complete(id, pending) {
187
205
  pending.removeAbort();
@@ -211,8 +229,9 @@ export class CdpConnection {
211
229
  this.#failPending(reason);
212
230
  if (wasClosed)
213
231
  return;
232
+ const error = this.#transportError(reason);
214
233
  for (const listener of this.#disconnectListeners)
215
- listener();
234
+ listener(error);
216
235
  this.#disconnectListeners.clear();
217
236
  }
218
237
  #transportError(reason) {
@@ -1,4 +1,4 @@
1
- import { BrowserObservationError } from "../domain/browserObservationError.js";
1
+ import { CdpCommandRejection } from "./CdpCommandRejection.js";
2
2
  import { CdpConnection } from "./CdpConnection.js";
3
3
  /** Execute an optional CDP method while preserving transport and cancellation failures. */
4
4
  export const optionalCdpCommand = async (context, method, parameters, limitations) => {
@@ -6,8 +6,7 @@ export const optionalCdpCommand = async (context, method, parameters, limitation
6
6
  return await context.connection.send(method, parameters, context.sessionId, context.signal);
7
7
  }
8
8
  catch (cause) {
9
- if (!(cause instanceof BrowserObservationError) ||
10
- cause.reason !== "protocol_error")
9
+ if (!(cause instanceof CdpCommandRejection) || cause.code !== -32_601)
11
10
  throw cause;
12
11
  limitations.push(`${method} was unavailable from this browser target.`);
13
12
  return undefined;
@@ -6,6 +6,7 @@ import { CdpCaptureEvents } from "./CdpCaptureEvents.js";
6
6
  import { authorizedMainFrame } from "./CdpAuthorizedMainFrame.js";
7
7
  import { captureStorage } from "./CdpCaptureStorage.js";
8
8
  import { optionalCdpCommand } from "./CdpOptionalCommand.js";
9
+ import { CdpCommandRejection } from "./CdpCommandRejection.js";
9
10
  import { captureAccessibility, captureDom, captureFrames, captureResources, mainFrameUrl, } from "./CdpCaptureDocuments.js";
10
11
  import { allowedSanitizedUrl, delayWithCancellation, } from "./CdpCaptureValues.js";
11
12
  import { captureScripts } from "./CdpPageCaptureScripts.js";
@@ -85,6 +86,7 @@ const captureAuthorizedPage = async (state) => {
85
86
  if (state.events.navigationDuringCapture || completedUrl !== attachedUrl)
86
87
  throw new BrowserObservationError("inspect_web_page", "target_changed");
87
88
  await report(context.progress, 3, "Normalizing browser evidence");
89
+ state.events.recordScriptMetadataBudgetExclusions();
88
90
  return {
89
91
  inspection: normalizedInspection(state, {
90
92
  attachedUrl,
@@ -105,7 +107,27 @@ const captureJsonResponseBodies = async (state) => {
105
107
  const requestId = requestIds[index];
106
108
  if (requestId === undefined)
107
109
  continue;
108
- const result = await optionalCdpCommand(state.context, "Network.getResponseBody", { requestId }, state.limitations);
110
+ const request = state.events.network.get(requestId);
111
+ if (request === undefined)
112
+ continue;
113
+ if (request.encoded_data_length === null) {
114
+ state.events.responseBodyUnavailable(requestId);
115
+ continue;
116
+ }
117
+ let result;
118
+ try {
119
+ result = await optionalCdpCommand(state.context, "Network.getResponseBody", { requestId }, state.limitations);
120
+ }
121
+ catch (cause) {
122
+ if (!(cause instanceof CdpCommandRejection) ||
123
+ cause.command !== "Network.getResponseBody" ||
124
+ cause.code !== -32_000 ||
125
+ cause.reportedMessage === null)
126
+ throw cause;
127
+ state.events.responseBodyUnavailable(requestId);
128
+ state.limitations.push(`Response body unavailable for request ${requestId}: ${cause.userMessage}`);
129
+ continue;
130
+ }
109
131
  if (result !== undefined) {
110
132
  state.events.ingestResponseBody(requestId, result);
111
133
  continue;
@@ -58,6 +58,21 @@ const hookEventSchema = z.strictObject({
58
58
  });
59
59
  const hookSnapshotSchema = z.strictObject({
60
60
  events: z.array(hookEventSchema),
61
+ retention_budget_bytes: z.number().int().min(0),
62
+ estimated_retained_bytes: z.number().int().min(0),
63
+ event_serialized_byte_upper_bound: z.number().int().min(0),
64
+ retained: z.number().int().min(0),
65
+ dropped: z.number().int().min(0),
66
+ dropped_ipc: z.number().int().min(0),
67
+ dropped_runtime: z.number().int().min(0),
68
+ dropped_event_families: z.array(z.strictObject({
69
+ family: z.string().min(1),
70
+ count: z.number().int().min(1),
71
+ })),
72
+ dropped_event_roles: z.array(z.strictObject({
73
+ role: z.string().min(1),
74
+ count: z.number().int().min(1),
75
+ })),
61
76
  observed: z.number().int().min(0),
62
77
  observed_ipc: z.number().int().min(0),
63
78
  observed_runtime: z.number().int().min(0),
@@ -72,6 +87,8 @@ const metricSchema = z.strictObject({
72
87
  const windowMetadataSchema = z.strictObject({
73
88
  window_id: z.string(),
74
89
  web_contents_id: z.string(),
90
+ url: z.string(),
91
+ title: z.string(),
75
92
  visible: z.boolean().nullable(),
76
93
  destroyed: z.boolean(),
77
94
  });
@@ -79,12 +96,12 @@ const windowMetadataSchema = z.strictObject({
79
96
  export const runElectronActions = async (application, input, options) => {
80
97
  const actions = [];
81
98
  for (const action of input.actions) {
82
- if (options.signal?.aborted === true)
83
- throw new BrowserObservationError(OPERATION, "cancelled");
84
99
  const actionStartedAt = Date.now();
85
100
  const windowIndex = actionWindowIndex(action);
86
101
  let selectedWindow;
87
102
  try {
103
+ if (options.signal?.aborted === true)
104
+ throw new BrowserObservationError(OPERATION, "cancelled");
88
105
  selectedWindow =
89
106
  windowIndex === null
90
107
  ? undefined
@@ -200,16 +217,12 @@ const emitDeepLink = (application, action) => application.evaluate(({ app }, pay
200
217
  /** Read the current Electron windows, metrics, and hook snapshot. */
201
218
  // oxlint-disable-next-line max-lines-per-function -- one state read must share one capture boundary.
202
219
  export const readApplicationState = async (application) => {
203
- const pages = application.windows();
204
- const pageSnapshotsPromise = Promise.all(pages.map(async (page, index) => ({
205
- index,
206
- url: page.url(),
207
- title: await page.title(),
208
- })));
209
220
  const windowMetadataPromise = application
210
221
  .evaluate(({ BrowserWindow }) => BrowserWindow.getAllWindows().map((window) => ({
211
222
  window_id: `window:${String(window.id)}`,
212
223
  web_contents_id: `webContents:${String(window.webContents.id)}`,
224
+ url: window.webContents.getURL(),
225
+ title: window.webContents.getTitle(),
213
226
  visible: window.isDestroyed() ? null : window.isVisible(),
214
227
  destroyed: window.isDestroyed(),
215
228
  })))
@@ -234,6 +247,15 @@ export const readApplicationState = async (application) => {
234
247
  ? candidate()
235
248
  : {
236
249
  events: [],
250
+ retention_budget_bytes: 0,
251
+ estimated_retained_bytes: 0,
252
+ event_serialized_byte_upper_bound: 0,
253
+ retained: 0,
254
+ dropped: 0,
255
+ dropped_ipc: 0,
256
+ dropped_runtime: 0,
257
+ dropped_event_families: [],
258
+ dropped_event_roles: [],
237
259
  observed: 0,
238
260
  observed_ipc: 0,
239
261
  observed_runtime: 0,
@@ -241,27 +263,14 @@ export const readApplicationState = async (application) => {
241
263
  };
242
264
  })
243
265
  .then((value) => hookSnapshotSchema.parse(value));
244
- const [pageSnapshots, windowMetadata, processMetrics, electronVersion, hookSnapshot,] = await Promise.all([
245
- pageSnapshotsPromise,
266
+ const [windowMetadata, processMetrics, electronVersion, hookSnapshot] = await Promise.all([
246
267
  windowMetadataPromise,
247
268
  processMetricsPromise,
248
269
  electronVersionPromise,
249
270
  hookSnapshotPromise,
250
271
  ]);
251
272
  return {
252
- windows: pageSnapshots.map((page) => {
253
- const metadata = windowMetadata[page.index];
254
- if (metadata === undefined)
255
- throw new BrowserObservationError(OPERATION, "window_metadata_missing");
256
- return {
257
- window_id: metadata.window_id,
258
- web_contents_id: metadata.web_contents_id,
259
- url: page.url,
260
- title: page.title,
261
- visible: metadata.visible,
262
- destroyed: metadata.destroyed,
263
- };
264
- }),
273
+ windows: windowMetadata,
265
274
  metrics: processMetrics,
266
275
  electronVersion,
267
276
  hookSnapshot,