rea-agents 6.1.0 → 6.2.0

package/README.md

@@ -1,6 +1,6 @@
 <div align="center">
 
-**English** · [简体中文](README_zh.md) · [繁體中文](README_zh-TW.md) · [日本語](README_ja.md) · [한국어](README_ko.md) · [Türkçe](README_tr.md) · [Русский](README_ru.md) · [Tiếng Việt](README_vi.md) · [ไทย](README_th.md) · [Deutsch](README_de.md) · [Español](README_es.md) · [Українська](README_uk.md) · [Polski](README_pl.md) · [Português (Brasil)](README_pt-BR.md) · [العربية](README_ar.md) · [فارسی](README_fa.md)
+**English** · [简体中文](README_zh.md) · [繁體中文](README_zh-TW.md) · [日本語](README_ja.md) · [한국어](README_ko.md) · [Türkçe](README_tr.md) · [Русский](README_ru.md) · [Tiếng Việt](README_vi.md) · [ไทย](README_th.md) · [Deutsch](README_de.md) · [Español](README_es.md) · [Français](README_fr.md) · [Українська](README_uk.md) · [Polski](README_pl.md) · [Português (Brasil)](README_pt-BR.md) · [العربية](README_ar.md) · [فارسی](README_fa.md)
 
 # REA: Reverse Engineer Anything
 
@@ -157,7 +157,7 @@ Additional tools and host support depend on the target:
 | Websites               | Page structure, scripts, network observations and requested screenshots              | A Chrome-family browser; [browser analysis](https://rea.tools/guides/browser/)                                                        |
 | Saved network captures | Requests, responses, exposed payloads and source locations                           | HAR; mitmdump on Linux for native mitmproxy captures; [capture guide](docs/web-network-captures.md)                                   |
 | .NET assemblies        | Metadata, CIL instructions, declared native dependencies and build comparisons       | Static inspection; [managed-code guide](docs/managed-code-analysis.md)                                                                |
-| Android APKs           | Manifest declarations, classes, decompiled methods and references                    | Headless JADX and a full JDK on Linux/macOS; [Android guide](docs/android-analysis.md)                                                |
+| Android APKs           | Manifest declarations, classes, decompiled methods and references                    | Headless JADX and a full JDK on Linux/macOS/Windows x64; [Android guide](docs/android-analysis.md)                                    |
 | Firmware               | Regions, extraction results and native-analysis handoffs                             | Binwalk / Unblob on Linux; [firmware guide](docs/firmware-analysis.md)                                                                |
 | Packages and resources | File inventories, digests, plists, Apple bundle anatomy and extracted resources      | [Artifact and JavaScript guide](docs/javascript-artifact-reconstruction.md), [Apple applications](docs/apple-application-analysis.md) |
 | Process behavior       | Terminal output, interactions, exit and filesystem observations, and run comparisons | Linux/macOS with a native PTY; [process capture](docs/process-capture.md)                                                             |
@@ -298,7 +298,7 @@ For exact options, prerequisites and result contracts:
 - [Readiness and troubleshooting](docs/installation.md#check-readiness-for-your-task): diagnose one agent or analysis engine.
 - [CLI and Evidence](docs/cli.md): commands, provider selection, snapshots, import/export and exit statuses.
 - [MCP contracts](docs/mcp-contracts.md) and [agent prompts](docs/mcp-prompts.md): tool results, sessions and guided investigations.
-- [Tool catalog](docs/mcp-contracts.md#generated-catalog): build-generated inventory of tools, providers and CLI commands.
+- [Tool catalog](docs/mcp-contracts.md#generated-catalog): generated inventory of tools, providers and CLI commands.
 - [Roadmap](docs/roadmap.md): planned work and capability trackers.
 
 Report vulnerabilities through [SECURITY.md](SECURITY.md).
@@ -319,9 +319,9 @@ See [CONTRIBUTING.md](CONTRIBUTING.md) for development setup and checks,
 
 ## Star history
 
-🎉 **20,000 GitHub stars — thank you!**
+🎉 **30,000 GitHub stars — thank you!**
 
-Thanks to everyone using REA, reporting bugs, testing builds, and contributing fixes.
+Thanks to everyone using REA, reporting bugs, requesting features, testing builds, and contributing fixes.
 
 <a href="https://www.star-history.com/?repos=morluto%2Frea&amp;type=date">
   <picture>
@@ -335,6 +335,8 @@ Thanks to everyone using REA, reporting bugs, testing builds, and contributing f
 
 REA provides tools for lawful reverse-engineering research, analysis, and reconstruction. You are responsible for obtaining any required authorization and complying with applicable laws. The project does not endorse illegal or unauthorized use.
 
+REA is an open-source software project. We have not issued or endorsed any cryptocurrency or token. Tokens using the REA name are not affiliated with the project.
+
 ## License
 
 [MIT](LICENSE)

package/bridge/ghidra/ReaGhidraBridge.java

@@ -866,6 +866,7 @@ public final class ReaGhidraBridge extends HeadlessScript {
         JsonArray operands = new JsonArray();
         JsonArray references = new JsonArray();
         JsonArray destinations = new JsonArray();
+        JsonArray flowEvidence = new JsonArray();
         JsonObject flow = new JsonObject();
         flow.addProperty("kind", "unavailable");
         flow.addProperty("conditional", false);
@@ -881,7 +882,20 @@ public final class ReaGhidraBridge extends HeadlessScript {
             result.addProperty("mnemonic", instruction.getMnemonicString());
             result.addProperty("raw_disassembly", instruction.toString());
             RefType type = instruction.getFlowType();
-            flow.addProperty("kind", type.isCall() ? "call" : type.isJump() ? "jump" : type.isTerminal() ? "terminal" : "fallthrough");
+            JsonObject listingFlow = new JsonObject();
+            listingFlow.addProperty("source", "ghidra-listing-flow-type");
+            listingFlow.addProperty("value", type.getName());
+            flowEvidence.add(listingFlow);
+            boolean decodedReturn = false;
+            for (PcodeOp operation : instruction.getPcode()) {
+                if (operation.getOpcode() != PcodeOp.RETURN) continue;
+                decodedReturn = true;
+                JsonObject returnEvidence = new JsonObject();
+                returnEvidence.addProperty("source", "ghidra-instruction-pcode");
+                returnEvidence.addProperty("value", operation.getMnemonic());
+                flowEvidence.add(returnEvidence);
+            }
+            flow.addProperty("kind", type.isCall() ? "call" : type.isJump() ? "jump" : decodedReturn ? "return" : type.isTerminal() ? "terminal" : "fallthrough");
             flow.addProperty("conditional", type.isConditional());
             flow.addProperty("computed", type.isComputed());
             if (!type.isComputed()) for (Address target : instruction.getFlows()) destinations.add(canonicalAddress(target));
@@ -917,10 +931,13 @@ public final class ReaGhidraBridge extends HeadlessScript {
             }
         }
         flow.add("direct_destinations", destinations);
+        flow.add("classification_evidence", flowEvidence);
         result.add("operands", operands);
         result.add("flow", flow);
         result.add("references", references);
-        result.add("limitations", GSON.toJsonTree(List.of("Operand components are Ghidra Listing decoder tokens; effective memory base/index/displacement roles and per-instruction context mode are unavailable. The mode field is the program language variant.", "Terminal flow is not classified as a return without provider evidence.")));
+        List<String> limitations = new ArrayList<>(List.of("Operand components are Ghidra Listing decoder tokens; effective memory base/index/displacement roles and per-instruction context mode are unavailable. The mode field is the program language variant."));
+        if (flow.get("kind").getAsString().equals("terminal")) limitations.add("No RETURN operation was observed in the provider's instruction p-code; terminal classification remains generic.");
+        result.add("limitations", GSON.toJsonTree(limitations));
         return result;
     }
 
@@ -1629,9 +1646,20 @@ public final class ReaGhidraBridge extends HeadlessScript {
                 Function function = entry.function;
                 Symbol symbol = function.getSymbol();
                 String qualified = symbol == null ? function.getName() : symbol.getName(true);
-                if (function.getName().equals(value) || qualified.equals(value)) {
-                    matches.add(function);
+                boolean matchesName = function.getName().equals(value) || qualified.equals(value);
+                if (!matchesName) {
+                    // Imported labels (for example Mach-O _main) can share a
+                    // function entry without becoming its primary symbol. Only
+                    // exact entries qualify; an interior label is not a selector.
+                    for (Symbol entrySymbol : currentProgram.getSymbolTable().getSymbols(function.getEntryPoint())) {
+                        monitor.checkCancelled();
+                        if (entrySymbol.getName().equals(value) || entrySymbol.getName(true).equals(value)) {
+                            matchesName = true;
+                            break;
+                        }
+                    }
                 }
+                if (matchesName) matches.add(function);
             }
             if (matches.size() > 1)
                 throw new RequestFailure("ambiguous", "Ghidra procedure name is ambiguous: " + value +

package/bridge/hopper_bridge.py

@@ -553,7 +553,12 @@ def _search_results(document, kind, params):
         if not matches(item[1]):
             continue
         selected.append(item)
-    return [{"address": address, **_string_inventory(document)[address]} for address, _ in selected] if kind == "string" else [
+    if not selected:
+        return []
+    if kind == "string":
+        records = _string_inventory(document)
+        return [{"address": address, **records[address]} for address, _ in selected]
+    return [
             {
                 "address": address,
                 "value": value,

package/dist/android/JadxConfiguration.js

@@ -1,11 +1,16 @@
 import { constants } from "node:fs";
 import { access, realpath, stat } from "node:fs/promises";
-import { isAbsolute, join } from "node:path";
+import { delimiter, isAbsolute, join, resolve } from "node:path";
+import { systemWindowsNativeAuthority } from "../windows/WindowsNativeLoader.js";
 import { AnalysisCapabilityUnavailableError } from "../domain/analysisErrorCore.js";
+import { ZipArtifactReader } from "../artifacts/ZipArtifactReader.js";
 import { execFileOutput, execFileOutputFailure, } from "../process/ExecFileOutput.js";
 import { JADX_JAR_CONFIGURATION_REMEDIATION } from "./JadxRelease.js";
 const JAVA_MODULE_LISTING_TIMEOUT_MS = 10_000;
 const JAVA_MODULE_LISTING_MAX_OUTPUT_BYTES = 1024 * 1024;
+// Bound ZIP metadata allocation during discovery. The audited 0.7.1 JAR's
+// central directory occupies 2,294,350 bytes; class bodies are not read here.
+const JAR_METADATA_READ_MAX_BYTES = 8 * 1024 * 1024;
 class JadxConfigurationFailure extends Error {
     code;
     diagnostics;
@@ -74,16 +79,65 @@ export const resolveJadxConfiguration = async (environment, operation, signal) =
 const readJadxConfiguration = async (environment, signal) => {
     requireSupportedHost();
     const jar = await resolveJar(environment);
-    const java = resolveJava(environment);
+    const java = await resolveJava(environment, signal);
     await requireJavaHomeExecutable(environment.JAVA_HOME, java);
     const jvmArguments = resolveJvmArguments(environment);
     await inspectJavaRuntime(java, environment, signal);
+    await requireEngineArchive(jar, signal);
     return { jar, java, jvmArguments };
 };
+const requireEngineArchive = async (jar, signal) => {
+    // These classes are consumed directly by ReaJadxBridge.java. This checks the
+    // classpath inventory without loading engine code or starting a JADX session.
+    const missing = new Set([
+        "com/atxx/jhmcp/JadxSession.class",
+        "com/atxx/jhmcp/SessionHolder.class",
+        "jadx/api/JadxDecompiler.class",
+        "com/google/gson/Gson.class",
+        "io/modelcontextprotocol/kotlin/sdk/server/Server.class",
+    ]);
+    const reader = new ZipArtifactReader(jar, "zip", JAR_METADATA_READ_MAX_BYTES);
+    try {
+        for await (const entry of reader.entries(signal)) {
+            if (entry.kind === "file" && !entry.encrypted)
+                missing.delete(entry.path);
+            if (missing.size === 0)
+                return;
+        }
+    }
+    catch (cause) {
+        if (signal?.aborted === true)
+            throw cause;
+        const reason = cause instanceof Error ? cause.message : String(cause);
+        throw configurationFailure("version_unresolved", `Cannot inspect REA_JADX_MCP_JAR ${jar} as a Java archive: ${reason}. ${JADX_JAR_CONFIGURATION_REMEDIATION}`, {
+            jar_path: jar,
+            phase: "jar-inspection",
+            archive_error: reason,
+            maximum_metadata_read_bytes: JAR_METADATA_READ_MAX_BYTES,
+        }, cause);
+    }
+    finally {
+        await reader.close();
+    }
+    throw configurationFailure("unsupported_version", `REA_JADX_MCP_JAR ${jar} does not contain the required metadata bridge classes: ${[...missing].join(", ")}. ${JADX_JAR_CONFIGURATION_REMEDIATION}`, { jar_path: jar, phase: "jar-inspection", missing_classes: [...missing] });
+};
 const requireSupportedHost = () => {
     if (process.platform === "linux" || process.platform === "darwin")
         return;
-    throw configurationFailure("unsupported_host", `Android JADX subprocess ownership is unsupported on ${process.platform}; use Linux or macOS. The metadata bridge has real-provider verification on macOS arm64.`, { platform: process.platform });
+    if (process.platform === "win32" && process.arch === "x64") {
+        const loaded = systemWindowsNativeAuthority();
+        if (loaded.available && loaded.authority.inspection.protocolStdin === true)
+            return;
+        throw configurationFailure("runtime_missing", loaded.available
+            ? "The bundled Windows native artifact lacks owned protocol stdin; use a matching current Windows x64 REA package."
+            : loaded.reason, {
+            platform: process.platform,
+            architecture: process.arch,
+            phase: "process-ownership",
+            owned_protocol_stdin: false,
+        });
+    }
+    throw configurationFailure("unsupported_host", `Android JADX subprocess ownership is unsupported on ${process.platform}/${process.arch}; use Linux, macOS, or Windows x64 with its bundled native controls.`, { platform: process.platform });
 };
 const resolveJar = async (environment) => {
     const jar = environment.REA_JADX_MCP_JAR;
@@ -101,11 +155,37 @@ const resolveJar = async (environment) => {
         throw configurationFailure("executable_missing", `Cannot read REA_JADX_MCP_JAR ${jar}: ${cause instanceof Error ? cause.message : String(cause)}`, { jar_path: jar }, cause);
     }
 };
-const resolveJava = (environment) => {
-    if (environment.JAVA_HOME === undefined)
-        return "java";
+const resolveJava = async (environment, signal) => {
+    const executable = process.platform === "win32" ? "java.exe" : "java";
+    if (environment.JAVA_HOME === undefined) {
+        if (process.platform !== "win32")
+            return executable;
+        const path = Object.entries(environment).find(([key]) => key.toLowerCase() === "path")?.[1] ?? "";
+        for (const directory of [process.cwd(), ...path.split(delimiter)]) {
+            signal?.throwIfAborted();
+            // Windows PATH commonly quotes individual entries containing spaces.
+            const selected = directory.startsWith('"') && directory.endsWith('"')
+                ? directory.slice(1, -1)
+                : directory;
+            const candidate = resolve(selected, executable);
+            try {
+                await access(candidate, constants.R_OK | constants.X_OK);
+                if ((await stat(candidate)).isFile())
+                    return await realpath(candidate);
+            }
+            catch (cause) {
+                if (typeof cause === "object" &&
+                    cause !== null &&
+                    "code" in cause &&
+                    (cause.code === "ENOENT" || cause.code === "ENOTDIR"))
+                    continue;
+                throw configurationFailure("runtime_missing", `Cannot inspect selected Java executable ${candidate}: ${errorText(cause)}`, { java_executable: candidate }, cause);
+            }
+        }
+        throw configurationFailure("runtime_missing", "Cannot find java.exe on the selected Windows PATH. Select a full JDK with JAVA_HOME or PATH, then verify it with java --list-modules. REA does not install Java.", { java_executable: executable });
+    }
     if (isAbsolute(environment.JAVA_HOME))
-        return join(environment.JAVA_HOME, "bin", "java");
+        return join(environment.JAVA_HOME, "bin", executable);
     throw configurationFailure("open_options_invalid", "JAVA_HOME must select an existing JDK by absolute path; omit it to use java on PATH.", { java_home: environment.JAVA_HOME });
 };
 const requireJavaHomeExecutable = async (javaHome, java) => {

package/dist/android/JadxMcpTransport.js

@@ -1,5 +1,6 @@
 import { deserializeMessage, serializeMessage, } from "@modelcontextprotocol/client";
 import { randomUUID } from "node:crypto";
+import { finished } from "node:stream/promises";
 import { ProviderProcessSupervisor, spawnOwnedProviderProcess, } from "../process/ProviderProcess.js";
 import { cleanupOwnedProcessGroup } from "../process/ProcessOwnership.js";
 import { ProviderCleanupError } from "../domain/providerCleanupError.js";
@@ -71,7 +72,10 @@ export class JadxMcpTransport {
     }
     /** Verifies owned process exit before declaring the transport closed. */
     close() {
-        this.#closePromise ??= this.#stop();
+        this.#closePromise ??= this.#stop().catch((cause) => {
+            this.#closePromise = undefined;
+            throw cause;
+        });
         return this.#closePromise;
     }
     /** Captured provider stderr without persisting inherited environment values. */
@@ -102,8 +106,16 @@ export class JadxMcpTransport {
         process?.stderr?.off("data", this.#countStderr);
         process?.off("error", this.#error);
         process?.off("exit", this.#exit);
-        process?.stdin?.off("error", this.#error);
+        const input = process?.stdin;
+        // A job termination can complete an in-flight pipe write asynchronously.
+        // Observe its errors until the owned Writable has finished closing.
+        const inputClosed = input === undefined || input === null
+            ? undefined
+            : finished(input, { readable: false, cleanup: true }).catch(() => undefined);
         const stopped = await this.#supervisor?.stop();
+        input?.destroy();
+        await inputClosed;
+        input?.off("error", this.#error);
         this.onclose?.();
         if (stopped?.status === "incomplete")
             throw new ProviderCleanupError("jadx", [this.runId], {

package/dist/android/JadxProvider.js

@@ -6,6 +6,7 @@ import { AnalysisError } from "../domain/analysisErrorBase.js";
 import { AnalysisCancelledError, AnalysisCapabilityUnavailableError, AnalysisOutputError, AnalysisInputError, AnalysisTimeoutError, } from "../domain/analysisErrorCore.js";
 import { ProviderAdapterError } from "../domain/providerAdapterError.js";
 import { ProviderCleanupError } from "../domain/providerCleanupError.js";
+import { projectAnalysisError } from "../domain/analysisErrorProjection.js";
 import { err, ok } from "../domain/result.js";
 import { PrivateRuntimeRoot } from "../process/PrivateRuntimeRoot.js";
 import { snapshotAndroidEngine, hashAndroidFile, snapshotAndroidTarget, } from "./AndroidTargetSnapshot.js";
@@ -59,14 +60,14 @@ const executionError = (context) => {
         },
     });
 };
-const cleanup = async (session, root, previous) => {
+const cleanup = async (resources) => {
+    const { session, root, previousError } = resources;
     const diagnostics = {
-        previous_error: previous.ok
-            ? null
-            : { tag: previous.error._tag, message: previous.error.message },
+        previous_error: previousError === undefined ? null : projectAnalysisError(previousError),
     };
     try {
         await session?.close();
+        resources.session = undefined;
     }
     catch (cause) {
         // Retain an uncertain workspace until the caller can resolve process ownership.
@@ -79,30 +80,31 @@ const cleanup = async (session, root, previous) => {
             provider_cleanup: cause instanceof ProviderCleanupError
                 ? (cause.diagnostics ?? null)
                 : null,
-        }, { cause }));
+        }, { cause: previousError ?? cause }));
     }
     try {
         await root?.close();
+        resources.root = undefined;
     }
     catch (cause) {
         return err(new ProviderCleanupError("jadx", [root?.path ?? "unknown"], {
             ...diagnostics,
             reason: cause instanceof Error ? cause.message : String(cause),
-        }, { cause }));
+        }, { cause: previousError ?? cause }));
     }
-    return previous;
+    return ok(undefined);
 };
 /** One serialized, immutable APK session per REA instance, retired on idle or shutdown. */
 export class JadxProvider {
     environment;
     launcher;
     #tail = Promise.resolve();
-    #cleanupFailure;
+    #pendingCleanup;
     #retained;
     #idle;
     #shutdown = new AbortController();
     #closePromise;
-    constructor(environment = process.env, launcher) {
+    constructor(environment, launcher) {
         this.environment = environment;
         this.launcher = launcher;
     }
@@ -132,12 +134,13 @@ export class JadxProvider {
         try {
             if (signal.aborted)
                 return err(new AnalysisCancelledError(request.operation));
-            if (this.#cleanupFailure !== undefined)
-                return err(this.#cleanupFailure);
             clearTimeout(this.#idle);
+            if (this.#pendingCleanup !== undefined) {
+                const retired = await this.#retire();
+                if (!retired.ok)
+                    return retired;
+            }
             const outcome = await this.#execute(target, request, { signal });
-            if (!outcome.ok && outcome.error.cleanupIncomplete)
-                this.#cleanupFailure = outcome.error;
             if (outcome.ok)
                 this.#scheduleIdle();
             return outcome;
@@ -150,24 +153,39 @@ export class JadxProvider {
     close() {
         this.#shutdown.abort();
         clearTimeout(this.#idle);
-        this.#closePromise ??= this.#tail.then(() => this.#retire());
+        this.#closePromise ??= this.#tail
+            .then(async () => {
+            const retired = await this.#retire();
+            if (!retired.ok)
+                throw retired.error;
+        })
+            .catch((cause) => {
+            this.#closePromise = undefined;
+            throw cause;
+        });
         return this.#closePromise;
     }
     async #retire() {
-        if (this.#cleanupFailure !== undefined)
-            throw this.#cleanupFailure;
-        const retained = this.#retained;
-        this.#retained = undefined;
-        const result = await cleanup(retained?.session, retained?.root, ok(undefined));
-        if (!result.ok) {
-            this.#cleanupFailure = result.error;
-            throw result.error;
+        if (this.#pendingCleanup === undefined && this.#retained !== undefined) {
+            this.#pendingCleanup = {
+                session: this.#retained.session,
+                root: this.#retained.root,
+                previousError: undefined,
+            };
+            this.#retained = undefined;
         }
+        if (this.#pendingCleanup === undefined)
+            return ok(undefined);
+        const result = await cleanup(this.#pendingCleanup);
+        if (result.ok)
+            this.#pendingCleanup = undefined;
+        return result;
     }
     #scheduleIdle() {
         this.#idle = setTimeout(() => {
-            const retirement = this.#tail.then(() => this.#retire());
-            this.#tail = retirement.catch(() => undefined);
+            this.#tail = this.#tail.then(async () => {
+                await this.#retire();
+            });
         }, 60_000);
         this.#idle.unref();
     }
@@ -178,7 +196,6 @@ export class JadxProvider {
             : AbortSignal.any([options.signal, timeout]);
         let root;
         let session;
-        let outcome;
         try {
             if (target.format !== "apk")
                 throw new AnalysisCapabilityUnavailableError("jadx", request.operation, `Target ${target.path} is ${target.format}; provide one standalone APK.`);
@@ -210,8 +227,11 @@ export class JadxProvider {
                     this.environment.JAVA_HOME,
                 ],
             });
-            if (this.#retained !== undefined && this.#retained.key !== key)
-                await this.#retire();
+            if (this.#retained !== undefined && this.#retained.key !== key) {
+                const retired = await this.#retire();
+                if (!retired.ok)
+                    return retired;
+            }
             let retained = this.#retained;
             if (retained === undefined) {
                 root = await PrivateRuntimeRoot.create({ prefix: "rea-android-" });
@@ -247,7 +267,7 @@ export class JadxProvider {
             root = retained.root;
             session = retained.session;
             const { snapshot } = retained;
-            outcome = ok(await session.execute({
+            const outcome = ok(await session.execute({
                 request,
                 target,
                 snapshot,
@@ -260,18 +280,20 @@ export class JadxProvider {
             return outcome;
         }
         catch (cause) {
-            outcome = err(executionError({
+            const previousError = executionError({
                 cause,
                 request,
                 timeout,
                 signal: options?.signal,
                 session,
-            }));
+            });
+            // Admission can fail before selecting an existing session for execution.
+            root ??= this.#retained?.root;
+            session ??= this.#retained?.session;
+            this.#retained = undefined;
+            this.#pendingCleanup = { session, root, previousError };
+            const retired = await this.#retire();
+            return retired.ok ? err(previousError) : retired;
         }
-        // An existing session also needs retirement when admission fails before selection.
-        root ??= this.#retained?.root;
-        session ??= this.#retained?.session;
-        this.#retained = undefined;
-        return cleanup(session, root, outcome);
     }
 }

package/dist/application/BinaryTargetResolver.js

@@ -169,6 +169,9 @@ const readExecutableMetadata = async (handle, hostArchitecture) => {
     const prefix = Buffer.alloc(4096);
     const prefixRead = await handle.read(prefix, 0, prefix.length, 0);
     const bytes = prefix.subarray(0, prefixRead.bytesRead);
+    // Header commitments such as Mach-O load commands and FAT slices are
+    // checked against the whole file, not the probed prefix.
+    const fileSize = (await handle.stat()).size;
     if (bytes.length >= 2 && bytes[0] === 0x4d && bytes[1] === 0x5a) {
         const offset = mzWindowsHeaderOffset(bytes);
         if (offset !== null) {
@@ -182,7 +185,6 @@ const readExecutableMetadata = async (handle, hostArchitecture) => {
             ? bytes.readUInt16LE(24) + bytes.readUInt16LE(6) * 4
             : 0;
         const headerBytes = bytes.length >= 28 ? bytes.readUInt16LE(8) * 16 : 0;
-        const fileSize = (await handle.stat()).size;
         if (tableEnd > bytes.length &&
             tableEnd <= headerBytes &&
             tableEnd <= fileSize) {
@@ -201,11 +203,11 @@ const readExecutableMetadata = async (handle, hostArchitecture) => {
             if (count <= 128 && required > bytes.length) {
                 const header = Buffer.alloc(required);
                 const headerRead = await handle.read(header, 0, header.length, 0);
-                return parseExecutableHeader(header.subarray(0, headerRead.bytesRead), hostArchitecture);
+                return parseExecutableHeader(header.subarray(0, headerRead.bytesRead), hostArchitecture, fileSize);
             }
         }
     }
-    return parseExecutableHeader(bytes, hostArchitecture);
+    return parseExecutableHeader(bytes, hostArchitecture, fileSize);
 };
 const readPeMetadata = async (handle, offset) => {
     const fileHeader = Buffer.alloc(24);

package/dist/application/BrowserEvidence.js

@@ -27,21 +27,16 @@ export const createBrowserEvidence = (operation, input, result, provider) => cre
 });
 const browserParameters = (input, result) => {
     if (!("cdp_endpoint" in input)) {
-        if ("before_scenario" in input &&
-            input.before_scenario !== undefined &&
-            input.after_scenario !== undefined)
+        if ("before_scenario" in input)
             return {
                 comparison_kind: "browser_scenario",
                 before_browser: input.before_scenario.browser,
                 after_browser: input.after_scenario.browser,
                 before_start_origin: input.before_scenario.scenario.start_origin,
                 after_start_origin: input.after_scenario.scenario.start_origin,
-                normalization_sha256: commitBrowserScenarioNormalization(input.normalization ?? { rules: [] }).sha256,
+                normalization_sha256: commitBrowserScenarioNormalization(input.normalization).sha256,
             };
-        if (input.before !== undefined &&
-            input.after !== undefined &&
-            "inspection" in input.before &&
-            "inspection" in input.after)
+        if ("inspection" in input.before && "inspection" in input.after)
             return {
                 before_target_id: input.before.inspection.target.target_id,
                 before_capture_ended_at: input.before.inspection.capture_window.ended_at,

package/dist/application/BrowserScenarioEvidence.js

@@ -1,25 +1,9 @@
 import { canonicalDigest } from "../domain/comparisonSemantics.js";
-import { sanitizeBrowserUrl } from "../domain/browserObservation.js";
 import { createEvidence, } from "../domain/evidence.js";
-import { jsonValueSchema } from "../domain/jsonValue.js";
+import { jsonObjectSchema, jsonValueSchema } from "../domain/jsonValue.js";
 const browserScenarioParameters = (scenario) => ({
+    ...jsonObjectSchema.parse(scenario),
     scenario_sha256: canonicalDigest(scenario, "Browser scenario"),
-    browser_mode: scenario.browser.mode,
-    ...(scenario.browser.mode === "launch"
-        ? { browser_headless: scenario.browser.headless }
-        : {}),
-    start_url: sanitizeBrowserUrl(scenario.start_url.url),
-    environment: scenario.environment,
-    actions: scenario.actions.map(({ step_id, action }) => ({
-        step_id,
-        action,
-    })),
-    action_timeouts_ms: scenario.actions.map((item) => "timeout_ms" in item ? (item.timeout_ms ?? null) : null),
-    secret_declarations: scenario.secrets.map(({ secret_id, environment_variable }) => ({
-        secret_id,
-        environment_variable,
-    })),
-    capture: scenario.capture,
 });
 /** Create Evidence without retaining resolved scenario secret values. */
 export const createBrowserScenarioEvidence = (scenario, capture, provider) => createEvidence(undefined, provider, {