rea-agents 6.2.0 → 6.4.0

package/dist/filesystem/StableFileHash.js

@@ -0,0 +1,46 @@
+import { createHash } from "node:crypto";
+import { stat } from "node:fs/promises";
+import { openRegularFile, RegularFileChangedError, sameRegularFileState, } from "./RegularFile.js";
+/** Hash one regular file from its admitted descriptor and verify its path state. */
+export const hashStableFile = async (path, signal) => {
+    const handle = await openRegularFile(path, {
+        symlinks: "follow",
+        signal,
+    });
+    try {
+        const initial = await handle.stat();
+        if (!Number.isSafeInteger(initial.size) || initial.size < 0)
+            throw new RangeError(`Regular file size cannot be represented safely: ${path}`);
+        const hash = createHash("sha256");
+        const chunk = Buffer.allocUnsafe(64 * 1024);
+        let position = 0;
+        while (position <= initial.size) {
+            signal?.throwIfAborted();
+            const length = Math.min(chunk.length, initial.size - position + 1);
+            if (length <= 0)
+                break;
+            const read = await handle.read(chunk, 0, length, position);
+            signal?.throwIfAborted();
+            if (read.bytesRead === 0)
+                break;
+            hash.update(chunk.subarray(0, read.bytesRead));
+            position += read.bytesRead;
+            if (position > initial.size)
+                throw new RegularFileChangedError(path);
+        }
+        signal?.throwIfAborted();
+        const [opened, currentPath] = await Promise.all([
+            handle.stat(),
+            stat(path),
+        ]);
+        signal?.throwIfAborted();
+        if (position !== initial.size ||
+            !sameRegularFileState(initial, opened) ||
+            !sameRegularFileState(initial, currentPath))
+            throw new RegularFileChangedError(path);
+        return { sha256: hash.digest("hex"), bytes: position };
+    }
+    finally {
+        await handle.close();
+    }
+};

package/dist/filesystem/readFileHandleChunks.js

@@ -0,0 +1,26 @@
+import { Readable } from "node:stream";
+/** Stream positional reads while leaving descriptor cleanup to its owner. */
+export const readFileHandleChunks = (handle, options = {}) => {
+    const start = options.start ?? 0;
+    const end = options.end ?? Infinity;
+    if (!Number.isSafeInteger(start) ||
+        start < 0 ||
+        (end !== Infinity && (!Number.isSafeInteger(end) || end < start)))
+        throw new RangeError("Invalid file read range");
+    return Readable.from((async function* () {
+        let position = start;
+        while (position <= end) {
+            options.signal?.throwIfAborted();
+            const chunk = Buffer.allocUnsafe(Math.min(64 * 1024, end - position + 1));
+            const { bytesRead } = await handle.read(chunk, 0, chunk.length, position);
+            options.signal?.throwIfAborted();
+            if (bytesRead === 0)
+                return;
+            position += bytesRead;
+            yield chunk.subarray(0, bytesRead);
+        }
+    })(), {
+        objectMode: false,
+        ...(options.signal === undefined ? {} : { signal: options.signal }),
+    });
+};

package/dist/firmware/FirmwareCommand.js

@@ -76,15 +76,35 @@ export const runFirmwareCommand = async (context) => {
             NO_COLOR: "1",
         },
     });
+    let diagnosticTruncated = false;
     const supervisor = new ProviderProcessSupervisor({
         ...spawned,
         ownsProcessLifetime: true,
         cleanup: spawned.cleanup ?? (() => cleanupOwnedProcessGroup(spawned.ownership)),
+    }, {
+        maxDiagnosticBytes: FIRMWARE_LIMITS.diagnosticBytes,
+        onDiagnostic: (event) => {
+            if (event.type === "output" && event.truncated === true)
+                diagnosticTruncated = true;
+        },
     });
+    const checkDiagnostics = () => {
+        if (diagnosticTruncated) {
+            const snapshot = supervisor.snapshot();
+            throw new AnalysisOutputError(operation, `Tool diagnostics exceeded the ${FIRMWARE_LIMITS.diagnosticBytes}-byte capture budget`, {
+                capturedOutput: {
+                    stdout: snapshot.stdout.text,
+                    stderr: snapshot.stderr.text,
+                    truncated: true,
+                },
+            });
+        }
+    };
     let failure;
     try {
         const deadline = Date.now() + FIRMWARE_LIMITS.timeoutMs;
-        while (!(await supervisor.waitForExit(100))) {
+        while (!(await supervisor.waitForOutputClose(100))) {
+            checkDiagnostics();
             if (signal.aborted)
                 throw new AnalysisCancelledError(operation);
             if (Date.now() >= deadline)
@@ -92,6 +112,7 @@ export const runFirmwareCommand = async (context) => {
             if (context.outputBudget !== undefined)
                 await inventoryFirmwareOutput(context.outputBudget.root, context.outputBudget.bytes, context.outputBudget.entries, operation, signal);
         }
+        checkDiagnostics();
         if (signal.aborted)
             throw new AnalysisCancelledError(operation);
     }
@@ -100,8 +121,8 @@ export const runFirmwareCommand = async (context) => {
     }
     const stopped = await supervisor.stop();
     const snapshot = supervisor.snapshot();
-    supervisor.dispose();
-    if (stopped.status === "incomplete")
+    if (stopped.status === "incomplete") {
+        context.retainCleanup(supervisor);
         throw new ProviderCleanupError(engine, [runId, context.cwd], {
             reason: stopped.reason,
             leader_pid: spawned.ownership.leaderPid,
@@ -114,6 +135,7 @@ export const runFirmwareCommand = async (context) => {
             stderr_bytes: snapshot.stderr.bytes,
             previous_error: failure instanceof Error ? failure.message : null,
         });
+    }
     if (failure !== undefined)
         throw failure;
     if (snapshot.exitCode !== 0 &&

package/dist/firmware/FirmwareFiles.js

@@ -1,12 +1,16 @@
 import { createHash } from "node:crypto";
 import { constants, createReadStream, createWriteStream } from "node:fs";
-import { chmod, lstat, open, readdir, readlink, realpath, } from "node:fs/promises";
+import { chmod, lstat, opendir, open, readlink, realpath, } from "node:fs/promises";
 import { isAbsolute, join, relative, resolve, sep } from "node:path";
 import { Transform } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { AnalysisCancelledError, AnalysisInputError, AnalysisOutputError, } from "../domain/analysisErrorCore.js";
 import { readBoundedFileBytes } from "../process/BoundedFileBytes.js";
 import { FIRMWARE_LIMITS } from "./FirmwareRelease.js";
+const throwIfFirmwareInventoryCancelled = (signal, operation) => {
+    if (signal?.aborted === true)
+        throw new AnalysisCancelledError(operation);
+};
 /** Hash a regular tool or extracted file without retaining its bytes in memory. */
 export const hashFirmwareFile = async (path, signal) => {
     const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
@@ -120,8 +124,7 @@ export const inventoryFirmwareOutput = async (root, maxBytes, maxEntries, operat
     let bytes = 0;
     let count = 0;
     while (pending.length > 0) {
-        if (signal?.aborted === true)
-            throw new AnalysisCancelledError(operation);
+        throwIfFirmwareInventoryCancelled(signal, operation);
         const directory = pending.pop();
         if (directory === undefined)
             break;
@@ -134,15 +137,27 @@ export const inventoryFirmwareOutput = async (root, maxBytes, maxEntries, operat
             !directoryStat.isDirectory() ||
             directoryStat.isSymbolicLink())
             continue;
-        const names = await readdir(directory).catch((cause) => {
+        const handle = await opendir(directory).catch((cause) => {
             if (cause instanceof Error && "code" in cause && cause.code === "ENOENT")
-                return [];
+                return undefined;
             throw cause;
         });
+        if (handle === undefined)
+            continue;
+        const names = [];
+        try {
+            for await (const entry of handle) {
+                throwIfFirmwareInventoryCancelled(signal, operation);
+                count++;
+                if (count > maxEntries)
+                    throw new AnalysisOutputError(operation, `Staging entry budget exceeded (${maxEntries})`);
+                names.push(entry.name);
+            }
+        }
+        finally {
+            await handle.close().catch(() => undefined);
+        }
         for (const name of names.sort()) {
-            count++;
-            if (count > maxEntries)
-                throw new AnalysisOutputError(operation, `Staging entry budget exceeded (${maxEntries})`);
             const path = join(directory, name);
             const stat = await lstat(path).catch((cause) => {
                 if (cause instanceof Error &&

package/dist/firmware/FirmwareProvider.js

@@ -3,9 +3,11 @@ import { z } from "zod";
 import { createAnalysisExecution, } from "../application/AnalysisProvider.js";
 import { firmwareResultSchemas, } from "../domain/firmware/firmwareAnalysis.js";
 import { AnalysisError } from "../domain/analysisErrorBase.js";
+import { analysisErrorWithCleanupFailure } from "../domain/analysisErrorCleanup.js";
 import { AnalysisCancelledError, AnalysisInputError, AnalysisOutputError, AnalysisTimeoutError, } from "../domain/analysisErrorCore.js";
 import { ProviderAdapterError } from "../domain/providerAdapterError.js";
 import { ProviderCleanupError } from "../domain/providerCleanupError.js";
+import { jsonValueSchema } from "../domain/jsonValue.js";
 import { err, ok } from "../domain/result.js";
 import { PrivateRuntimeRoot } from "../process/PrivateRuntimeRoot.js";
 import { publishFirmwareExtraction } from "./FirmwarePublication.js";
@@ -14,6 +16,19 @@ import { admitFirmwareVersion } from "./FirmwareVersion.js";
 import { firmwareToolUnavailable, resolveFirmwareCommand, runFirmwareCommand, readFirmwareCommandReport, } from "./FirmwareCommand.js";
 import { inventoryFirmwareOutput, snapshotFirmware } from "./FirmwareFiles.js";
 import { normalizeBinwalkReport, normalizeUnblobReport, } from "./FirmwareReports.js";
+const combineCleanupFailures = (failures) => {
+    if (failures.length < 2)
+        return failures[0];
+    return new ProviderCleanupError("firmware", failures.flatMap((failure) => [...failure.cleanupResources]), {
+        reason: "Multiple owned firmware resources could not be cleaned",
+        failures: failures.map((failure) => ({
+            engine: failure.providerId,
+            operation: failure.operation,
+            resources: [...failure.cleanupResources],
+            reason: failure.diagnostics?.reason ?? failure.message,
+        })),
+    }, { operation: "close_firmware", cause: new AggregateError(failures) });
+};
 const waitForPredecessor = (predecessor, operation, signal) => new Promise((resolve, reject) => {
     const abort = () => reject(new AnalysisCancelledError(operation));
     signal?.addEventListener("abort", abort, { once: true });
@@ -35,13 +50,16 @@ export class FirmwareProvider {
     environment;
     launcher;
     #tail = Promise.resolve();
-    #cleanupFailure;
+    #closed = false;
+    #pendingCleanup = new Map();
     constructor(environment = process.env, launcher) {
         this.environment = environment;
         this.launcher = launcher;
     }
     /** Inspect regions or explicitly extract selected bytes without changing the source. */
     async execute(request, options) {
+        if (this.#closed)
+            return err(new AnalysisCancelledError(request.operation));
         const predecessor = this.#tail;
         let release = () => { };
         this.#tail = new Promise((resolve) => {
@@ -58,12 +76,65 @@ export class FirmwareProvider {
                 : new AnalysisCancelledError(request.operation));
         }
         try {
+            if (this.#closed)
+                return err(new AnalysisCancelledError(request.operation));
+            const cleanup = await this.#retryCleanup();
+            if (cleanup.processUnverified && cleanup.failure !== undefined)
+                return err(cleanup.failure);
             return await this.#execute(request, options);
         }
         finally {
             release();
         }
     }
+    /** Retry every retained owner, reporting failures without discarding other roots. */
+    async close() {
+        this.#closed = true;
+        await this.#tail;
+        const cleanup = await this.#retryCleanup();
+        if (cleanup.failure !== undefined)
+            throw cleanup.failure;
+    }
+    async #retryCleanup() {
+        const failures = [];
+        let processUnverified = false;
+        for (const [path, pending] of this.#pendingCleanup) {
+            try {
+                const stopped = await pending.supervisor?.stop();
+                if (stopped?.status === "incomplete") {
+                    processUnverified = true;
+                    failures.push(new ProviderCleanupError(pending.engine, [path], { reason: stopped.reason }, { operation: pending.operation }));
+                    continue;
+                }
+                delete pending.supervisor;
+            }
+            catch (cause) {
+                processUnverified = true;
+                failures.push(new ProviderCleanupError(pending.engine, [path], { reason: cause instanceof Error ? cause.message : String(cause) }, { operation: pending.operation, cause }));
+                continue;
+            }
+            try {
+                if (pending.tree !== undefined) {
+                    await pending.tree.rollback();
+                    delete pending.tree;
+                }
+            }
+            catch (cause) {
+                failures.push(new ProviderCleanupError(pending.engine, [path, pending.tree?.outputRoot ?? path], { reason: cause instanceof Error ? cause.message : String(cause) }, { operation: pending.operation, cause }));
+            }
+            try {
+                await pending.root.close();
+                if (pending.tree === undefined)
+                    this.#pendingCleanup.delete(path);
+            }
+            catch (cause) {
+                // A verified stopped process cannot use this root. Keep ownership for
+                // later removal without blocking a new operation's disjoint workspace.
+                failures.push(new ProviderCleanupError(pending.engine, [path], { reason: cause instanceof Error ? cause.message : String(cause) }, { operation: pending.operation, cause }));
+            }
+        }
+        return { failure: combineCleanupFailures(failures), processUnverified };
+    }
     async #execute(request, options) {
         let root;
         const engineName = request.operation === "inspect_firmware_regions" ? "binwalk" : "unblob";
@@ -73,12 +144,11 @@ export class FirmwareProvider {
             : AbortSignal.any([options.signal, deadline]);
         let outcome;
         try {
-            if (this.#cleanupFailure !== undefined)
-                return err(this.#cleanupFailure);
             if (signal.aborted)
                 throw new AnalysisCancelledError(request.operation);
             const command = await resolveFirmwareCommand(this.environment, engineName, request.operation);
             root = await PrivateRuntimeRoot.create({ prefix: "rea-firmware-" });
+            const ownedRoot = root;
             const target = await snapshotFirmware(request, root.path, signal);
             const run = (args, outputBudget) => runFirmwareCommand({
                 engine: engineName,
@@ -88,6 +158,14 @@ export class FirmwareProvider {
                 cwd: root?.path ?? "",
                 environment: this.environment,
                 signal,
+                retainCleanup: (supervisor) => {
+                    this.#pendingCleanup.set(ownedRoot.path, {
+                        supervisor,
+                        root: ownedRoot,
+                        engine: engineName,
+                        operation: request.operation,
+                    });
+                },
                 ...(this.launcher === undefined ? {} : { launcher: this.launcher }),
                 ...(outputBudget === undefined
                     ? {}
@@ -186,6 +264,15 @@ export class FirmwareProvider {
                     selection: target.selection,
                     engine,
                     signal,
+                    retainCleanup: (tree) => {
+                        const pending = this.#pendingCleanup.get(ownedRoot.path) ?? {
+                            root: ownedRoot,
+                            engine: engineName,
+                            operation: request.operation,
+                        };
+                        pending.tree = tree;
+                        this.#pendingCleanup.set(ownedRoot.path, pending);
+                    },
                 });
                 raw = { report, execution: processRun, version_execution: versionRun };
             }
@@ -229,36 +316,73 @@ export class FirmwareProvider {
                                             : String(cause),
                                     },
                                 }));
-            if (!outcome.ok && outcome.error.cleanupIncomplete) {
-                this.#cleanupFailure =
-                    root === undefined ||
-                        outcome.error.cleanupResources.includes(root.path)
-                        ? outcome.error
-                        : new ProviderCleanupError(engineName, [...outcome.error.cleanupResources, root.path], outcome.error instanceof ProviderAdapterError
-                            ? (outcome.error.diagnostics ?? {
-                                reason: outcome.error.message,
-                            })
-                            : { reason: outcome.error.message }, { cause: outcome.error });
-            }
         }
-        // Never remove a workspace while process ownership remains uncertain.
-        if (this.#cleanupFailure !== undefined)
-            return err(this.#cleanupFailure);
-        try {
-            await root?.close();
-        }
-        catch (cause) {
-            this.#cleanupFailure = new ProviderCleanupError(engineName, [
-                root?.path ?? "unknown",
-                ...(outcome.ok && request.operation === "extract_firmware"
-                    ? [request.input.output_directory]
-                    : []),
-            ], {
-                reason: cause instanceof Error ? cause.message : String(cause),
-                previous_result: outcome.ok ? outcome.value.result : null,
+        const finished = await finishFirmwareWorkspace(root, outcome, engineName, request);
+        if (!finished.ok &&
+            finished.error.cleanupIncomplete &&
+            root !== undefined &&
+            !this.#pendingCleanup.has(root.path))
+            this.#pendingCleanup.set(root.path, {
+                root,
+                engine: engineName,
+                operation: request.operation,
             });
-            return err(this.#cleanupFailure);
-        }
-        return outcome;
+        return finished;
     }
 }
+/** Keep a completed extraction beside cleanup failure, or skip removal when ownership is uncertain. */
+export const finishFirmwareWorkspace = async (root, outcome, engineName, request) => {
+    if (!outcome.ok && outcome.error.cleanupIncomplete) {
+        if (root === undefined ||
+            outcome.error.cleanupResources.includes(root.path))
+            return outcome;
+        return err(new ProviderCleanupError(engineName, [...outcome.error.cleanupResources, root.path], outcome.error instanceof ProviderAdapterError
+            ? (outcome.error.diagnostics ?? { reason: outcome.error.message })
+            : { reason: outcome.error.message }, {
+            cause: outcome.error,
+            operation: request.operation,
+            ...(outcome.error.partialObservation === undefined
+                ? {}
+                : { partialObservation: outcome.error.partialObservation }),
+        }));
+    }
+    try {
+        await root?.close();
+    }
+    catch (cause) {
+        const cleanup = new ProviderCleanupError(engineName, [
+            root?.path ?? "unknown",
+            ...(outcome.ok && request.operation === "extract_firmware"
+                ? [request.input.output_directory]
+                : []),
+        ], { reason: cause instanceof Error ? cause.message : String(cause) }, {
+            cause,
+            operation: request.operation,
+            ...(outcome.ok
+                ? {
+                    partialObservation: completedFirmwareObservation(outcome.value),
+                }
+                : outcome.error.partialObservation === undefined
+                    ? {}
+                    : { partialObservation: outcome.error.partialObservation }),
+        });
+        return err(outcome.ok
+            ? cleanup
+            : analysisErrorWithCleanupFailure(outcome.error, cleanup, request.operation));
+    }
+    return outcome;
+};
+const completedFirmwareObservation = (execution) => ({
+    kind: "firmware",
+    result: execution.result,
+    provenance: jsonValueSchema.parse({
+        raw_result: execution.rawResult,
+        provider: execution.provider,
+        subject: execution.subject,
+        locations: execution.locations,
+        limitations: execution.limitations,
+        ...(execution.analysisProfile === undefined
+            ? {}
+            : { analysis_profile: execution.analysisProfile }),
+    }),
+});

package/dist/firmware/FirmwarePublication.js

@@ -1,13 +1,16 @@
 import { createReadStream } from "node:fs";
 import { join } from "node:path";
 import { SafeOutputTree } from "../artifacts/SafeOutputTree.js";
+import { SafeOutputTreeCreationFailure } from "../artifacts/SafeOutputTreeCreationFailure.js";
 import { AnalysisOutputError } from "../domain/analysisErrorCore.js";
 import { ProviderCleanupError } from "../domain/providerCleanupError.js";
+import { jsonValueSchema } from "../domain/jsonValue.js";
 import { firmwareResultSchemas } from "../domain/firmware/firmwareAnalysis.js";
 import { hashFirmwareFile } from "./FirmwareFiles.js";
 /** Publish verified regular files, preserving links as metadata and rolling back failed writes. */
 export const publishFirmwareExtraction = async (context) => {
     let tree;
+    let result;
     try {
         const materialized = new Set(context.entries
             .filter((entry) => entry.kind === "file")
@@ -37,7 +40,7 @@ export const publishFirmwareExtraction = async (context) => {
                 (context.normalized.sizes.has(logicalPath) &&
                     context.normalized.sizes.get(logicalPath) !== entry.size))
                 throw new AnalysisOutputError("extract_firmware", `Extracted bytes disagree with provider report: ${entry.relativePath}`);
-            await tree.write(entry.relativePath, createReadStream(entry.path), sha256, context.signal);
+            await tree.write(entry.relativePath, createReadStream(entry.path), { sha256, bytes: entry.size }, context.signal);
             files.push({
                 relative_path: entry.relativePath,
                 path: join(tree.outputRoot, entry.relativePath),
@@ -50,7 +53,7 @@ export const publishFirmwareExtraction = async (context) => {
                 original_file_range: null,
             });
         }
-        const result = firmwareResultSchemas.extract_firmware.parse({
+        result = firmwareResultSchemas.extract_firmware.parse({
             engine: context.engine,
             selection: context.selection,
             output_directory: tree.outputRoot,
@@ -68,17 +71,35 @@ export const publishFirmwareExtraction = async (context) => {
         return result;
     }
     catch (cause) {
+        if (cause instanceof SafeOutputTreeCreationFailure)
+            tree = cause.tree;
         try {
             await tree?.rollback();
         }
         catch (cleanupCause) {
+            if (tree !== undefined)
+                context.retainCleanup(tree);
+            const publishedResult = tree?.published === true && result !== undefined
+                ? {
+                    kind: "firmware",
+                    result: jsonValueSchema.parse(result),
+                }
+                : undefined;
             throw new ProviderCleanupError("unblob", [context.outputDirectory], {
                 reason: cleanupCause instanceof Error
                     ? cleanupCause.message
                     : String(cleanupCause),
                 previous_error: cause instanceof Error ? cause.message : String(cause),
-            }, { cause: cleanupCause });
+            }, {
+                cause: cleanupCause,
+                operation: "extract_firmware",
+                ...(publishedResult === undefined
+                    ? {}
+                    : { partialObservation: publishedResult }),
+            });
         }
+        if (tree?.published === true && result !== undefined)
+            return result;
         throw cause;
     }
 };

package/dist/firmware/FirmwareRelease.js

@@ -27,6 +27,7 @@ export const UNBLOB_PROVIDER_IDENTITY = {
 export const FIRMWARE_LIMITS = {
     inputBytes: 128 * 1024 * 1024,
     reportBytes: 8 * 1024 * 1024,
+    diagnosticBytes: 8 * 1024 * 1024,
     addressSpaceBytes: 1024 * 1024 * 1024,
     timeoutMs: 120_000,
 };

package/dist/generatedPackageMetadata.js

@@ -1,9 +1,9 @@
 /** Generated from package.json and package-lock.json; do not edit. */
 export const PACKAGE_METADATA = {
     name: "rea-agents",
-    version: "6.2.0", // x-release-please-version
+    version: "6.4.0", // x-release-please-version
     serverSdkVersion: "2.3.1",
     clientSdkVersion: "2.3.1",
     coreSdkVersion: "2.3.1",
-    skillVersion: "34",
+    skillVersion: "37",
 };

package/dist/ghidra/GhidraAnalysisProfile.js

@@ -1,24 +1,45 @@
 import { createAnalysisProfile } from "../domain/analysisProfile.js";
-import { AnalysisCancelledError } from "../domain/analysisErrorCore.js";
+import { AnalysisCancelledError, AnalysisUnsupportedTargetError, } from "../domain/analysisErrorCore.js";
 import { ProviderAdapterError } from "../domain/providerAdapterError.js";
 import {} from "../domain/analysisErrorBase.js";
 import { err, ok } from "../domain/result.js";
+import { ghidraMipsProfileParameters, ghidraMipsUnsupportedReason, } from "./GhidraMipsProfile.js";
+import { NATIVE_AOT_MAX_REPORT_BYTES, NATIVE_AOT_MAX_SOURCE_BYTES, NATIVE_AOT_MAX_WORKING_MEMORY_BYTES, NATIVE_AOT_MAX_WORK_UNITS, NATIVE_AOT_PROFILE_CONTRACT_REVISION, } from "../domain/native/nativeAotPe.js";
 /** Resolve version-bound, deterministic semantics before Ghidra imports a target. */
-export const resolveGhidraAnalysisProfile = (target, identity, installation, signal) => {
+export const resolveGhidraAnalysisProfile = (target, identity, installation, signal, languageOverride) => {
     if (signal?.aborted === true)
         return Promise.resolve(err(new AnalysisCancelledError("open_binary")));
     if (target.kind !== "executable")
         return Promise.resolve(ok({ profile: null }));
     if (installation.status === "unavailable")
         return Promise.resolve(err(new ProviderAdapterError(identity.id, "resolve_analysis_profile")));
+    const mipsReason = ghidraMipsUnsupportedReason(target);
+    if (mipsReason !== null)
+        return Promise.resolve(err(new AnalysisUnsupportedTargetError("resolve_analysis_profile", target.path, mipsReason)));
     const provider = { ...identity, version: installation.providerVersion };
     const dosMz = target.format === "dos-mz";
     const dosCom = target.format === "dos-com";
     const dos = dosMz || dosCom;
+    // DOS imports already force an admitted loader, language, and context.
+    if (dos && languageOverride !== undefined)
+        return Promise.resolve(err(new AnalysisUnsupportedTargetError("resolve_analysis_profile", target.path, "REA_GHIDRA_LANGUAGE_ID cannot override the admitted DOS real-mode import.")));
     return Promise.resolve(ok({
         profile: createAnalysisProfile(provider, {
             target_kind: target.kind,
             target_format: target.format,
+            ...(target.format === "pe"
+                ? {
+                    executable_role: target.executableRole ?? null,
+                    managed: target.managed ?? null,
+                    native_aot_metadata: {
+                        contract_revision: NATIVE_AOT_PROFILE_CONTRACT_REVISION,
+                        source_bytes: NATIVE_AOT_MAX_SOURCE_BYTES,
+                        work_units: NATIVE_AOT_MAX_WORK_UNITS,
+                        working_memory_bytes: NATIVE_AOT_MAX_WORKING_MEMORY_BYTES,
+                        report_bytes: NATIVE_AOT_MAX_REPORT_BYTES,
+                    },
+                }
+                : {}),
             architecture: target.architecture ?? null,
             available_architectures: [
                 ...(target.availableArchitectures ?? []),
@@ -28,8 +49,13 @@ export const resolveGhidraAnalysisProfile = (target, identity, installation, sig
             load_image_observations: "source-mappings-entry-context-v2",
             function_body_evidence: "complete-inclusive-ranges-v1",
             function_references: "complete-body-and-entry-reference-manager-v2",
+            string_inventory_evidence: "defined-data-coverage-v1",
             location_resolution: "explicit-address-exact-entry-symbol-first-v3",
             instruction_flow_evidence: "decoded-return-pcode-v1",
+            function_boundary_observations: "ghidra-terminal-call-limitations-v1",
+            no_return_repair: installation.platform === "win32"
+                ? "disabled-windows-p0"
+                : "returning-imports-decoded-return-v2",
             process_launch: installation.platform === "win32"
                 ? "official-headless-script-v1"
                 : "inspected-jvm-launch-support-v1",
@@ -47,8 +73,17 @@ export const resolveGhidraAnalysisProfile = (target, identity, installation, sig
                 : dosCom
                     ? "BinaryLoader"
                     : "auto-from-header",
-            language_id: dos ? "x86:LE:16:Real Mode" : "auto-from-header",
-            compiler_spec_id: dos ? "default" : "auto-default",
+            language_id: dos
+                ? "x86:LE:16:Real Mode"
+                : (languageOverride?.languageId ?? "auto-from-header"),
+            compiler_spec_id: dos
+                ? "default"
+                : languageOverride === undefined
+                    ? "auto-default"
+                    : (languageOverride.compilerSpecId ?? "language-default"),
+            ...(languageOverride === undefined
+                ? {}
+                : { language_selection: "configured-v1" }),
             ...(dos
                 ? {
                     load_segment: "0x1000",
@@ -68,6 +103,22 @@ export const resolveGhidraAnalysisProfile = (target, identity, installation, sig
                 }
                 : {}),
             analyzer_preset: "ghidra-default",
+            ...ghidraMipsProfileParameters(target),
         }),
     }));
 };
+/** Read the import-language commitment back from a resolved profile. */
+export const ghidraProfileLanguageOverride = (parameters) => {
+    if (parameters.language_selection !== "configured-v1")
+        return undefined;
+    const languageId = parameters.language_id;
+    const compilerSpecId = parameters.compiler_spec_id;
+    if (typeof languageId !== "string" || typeof compilerSpecId !== "string")
+        return undefined;
+    return compilerSpecId === "language-default"
+        ? { languageId }
+        : { languageId, compilerSpecId };
+};
+/** Whether a committed profile and the active configuration select the same language. */
+export const sameGhidraLanguageOverride = (left, right) => left?.languageId === right?.languageId &&
+    left?.compilerSpecId === right?.compilerSpecId;