rea-agents 6.3.0 → 6.4.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (487) hide show
  1. package/README.md +7 -4
  2. package/bridge/ghidra/ReaGhidraApplySeeds.java +151 -0
  3. package/bridge/ghidra/ReaGhidraBridge.java +597 -209
  4. package/bridge/ghidra/ReaGhidraNoReturnFix.java +123 -0
  5. package/dist/adb/AdbConfiguration.js +88 -0
  6. package/dist/adb/AdbDeviceOutput.js +186 -0
  7. package/dist/adb/AdbProvider.js +1190 -0
  8. package/dist/adb/AdbShellOutput.js +309 -0
  9. package/dist/android/AndroidTargetSnapshot.js +104 -22
  10. package/dist/android/JadxConfiguration.js +44 -24
  11. package/dist/android/JadxProvider.js +51 -19
  12. package/dist/apktool/ApktoolConfiguration.js +84 -0
  13. package/dist/apktool/ApktoolDecodeOutput.js +59 -0
  14. package/dist/apktool/ApktoolProvider.js +506 -0
  15. package/dist/application/AnalysisProvider.js +8 -2
  16. package/dist/application/AppBundleExecutable.js +27 -22
  17. package/dist/application/BinaryTargetResolver.js +22 -2
  18. package/dist/application/CapabilityInventory.js +11 -1
  19. package/dist/application/ClientConfigurationDocument.js +70 -0
  20. package/dist/application/ClientConfigurationFiles.js +91 -0
  21. package/dist/application/ClientRegistrationEnvironment.js +35 -0
  22. package/dist/application/ClientRegistrationStatus.js +66 -31
  23. package/dist/application/DirectAnalysis.js +2 -2
  24. package/dist/application/DirectAnalysisCleanup.js +1 -1
  25. package/dist/application/DirectAnalysisStatus.js +1 -1
  26. package/dist/application/Doctor.js +5 -3
  27. package/dist/application/DoctorDiagnostics.js +1 -1
  28. package/dist/application/EvidenceBundleCommands.js +6 -12
  29. package/dist/application/GeminiClientSettings.js +139 -0
  30. package/dist/application/HermesClientHome.js +115 -0
  31. package/dist/application/HopperDownload.js +39 -0
  32. package/dist/application/InvestigationProviders.js +6 -0
  33. package/dist/application/JsonFiles.js +6 -5
  34. package/dist/{cliJsonFile.js → application/JsonInputFile.js} +108 -35
  35. package/dist/application/LinuxHopper.js +4 -12
  36. package/dist/application/MacHopper.js +172 -149
  37. package/dist/application/MipsElfAbiFlags.js +140 -0
  38. package/dist/application/ProviderOperationExecution.js +31 -0
  39. package/dist/application/ReconstructionObligationCandidates.js +9 -3
  40. package/dist/application/ReferenceSourceImport.js +76 -29
  41. package/dist/application/ReferenceSourceImportEntries.js +18 -9
  42. package/dist/application/ReferenceSourceImportPolicy.js +99 -23
  43. package/dist/application/ReferenceSourceImportTypes.js +30 -22
  44. package/dist/application/ReferenceSourceVcsAdapter.js +145 -30
  45. package/dist/application/RegularFileRead.js +93 -7
  46. package/dist/application/Setup.js +54 -6
  47. package/dist/application/SetupClientConfiguration.js +116 -16
  48. package/dist/application/SetupHost.js +102 -24
  49. package/dist/application/SetupPlan.js +5 -8
  50. package/dist/application/SetupSkill.js +58 -39
  51. package/dist/application/SupportedClients.js +290 -65
  52. package/dist/application/Uninstall.js +158 -10
  53. package/dist/application/UpdateMaintenance.js +17 -21
  54. package/dist/application/Utf8JsonInput.js +7 -0
  55. package/dist/application/WebScriptExportService.js +131 -65
  56. package/dist/application/WebSourceLocationService.js +3 -0
  57. package/dist/application/adb/AdbDeviceAnalysisPort.js +1 -0
  58. package/dist/application/adb/AdbDeviceAnalysisService.js +13 -0
  59. package/dist/application/analysisView/AnalysisViewService.js +40 -2
  60. package/dist/application/apktool/ApktoolResourceAnalysisPort.js +1 -0
  61. package/dist/application/apktool/ApktoolResourceAnalysisService.js +13 -0
  62. package/dist/application/binary/AnalysisClientCleanup.js +0 -24
  63. package/dist/application/binary/BinarySession.js +2 -1
  64. package/dist/application/binaryDiagnostics/BinaryLayoutService.js +2 -1
  65. package/dist/application/binaryDiagnostics/PeResourcesPort.js +1 -0
  66. package/dist/application/binaryDiagnostics/PeResourcesService.js +111 -0
  67. package/dist/application/binaryDiagnostics/RecordedCrashService.js +2 -1
  68. package/dist/application/evm/EvmInterfaceService.js +3 -0
  69. package/dist/application/firmware/FirmwareAnalysisService.js +3 -0
  70. package/dist/application/investigation/InspectEvidenceBundle.js +18 -0
  71. package/dist/application/javascript/ElectronBoundaryGraphContext.js +3 -2
  72. package/dist/application/javascript/ElectronBoundaryGraphIpc.js +2 -2
  73. package/dist/application/javascript/ElectronBoundaryGraphNative.js +19 -6
  74. package/dist/application/javascript/ElectronBoundaryGraphWindows.js +3 -3
  75. package/dist/application/javascript/JavaScriptApplicationService.js +22 -11
  76. package/dist/application/javascript/JavaScriptApplicationWorkflowEvidence.js +5 -6
  77. package/dist/application/javascript/JavaScriptArtifactAnalysis.js +171 -30
  78. package/dist/application/javascript/JavaScriptArtifactGraphAccumulator.js +14 -16
  79. package/dist/application/javascript/JavaScriptArtifactGraphBuilder.js +67 -19
  80. package/dist/application/javascript/JavaScriptArtifactGraphBundlers.js +4 -3
  81. package/dist/application/javascript/JavaScriptArtifactGraphContext.js +11 -5
  82. package/dist/application/javascript/JavaScriptArtifactGraphFindings.js +19 -16
  83. package/dist/application/javascript/JavaScriptArtifactGraphStructure.js +92 -10
  84. package/dist/application/javascript/JavaScriptArtifactPathResolution.js +258 -235
  85. package/dist/application/javascript/JavaScriptArtifactReconstruction.js +115 -26
  86. package/dist/application/javascript/JavaScriptArtifactReconstructionInput.js +4 -1
  87. package/dist/application/javascript/JavaScriptModuleRelationships.js +6 -4
  88. package/dist/application/javascript/JavaScriptRecoveryService.js +3 -0
  89. package/dist/application/javascript/JavaScriptSemanticGraphAsyncProjection.js +9 -3
  90. package/dist/application/javascript/JavaScriptSemanticGraphBuilder.js +199 -61
  91. package/dist/application/javascript/JavaScriptSemanticGraphConstruction.js +12 -19
  92. package/dist/application/javascript/JavaScriptSemanticGraphDataProjection.js +4 -1
  93. package/dist/application/javascript/JavaScriptSemanticGraphFlowProjection.js +5 -3
  94. package/dist/application/javascript/JavaScriptSemanticGraphObjectProjection.js +5 -3
  95. package/dist/application/javascript/JavaScriptSemanticGraphValueProjection.js +19 -8
  96. package/dist/application/jeb/JebAnalysisPort.js +1 -0
  97. package/dist/application/jeb/JebAnalysisService.js +13 -0
  98. package/dist/application/managed/ManagedApplicationGraphService.js +1 -1
  99. package/dist/application/native/NativeUiActionTrace.js +16 -8
  100. package/dist/application/native/NativeValueTrace.js +23 -6
  101. package/dist/application/process/ProcessCli.js +25 -20
  102. package/dist/artifacts/ArtifactPaths.js +129 -8
  103. package/dist/artifacts/ArtifactProvider.js +20 -15
  104. package/dist/artifacts/ArtifactReader.js +23 -0
  105. package/dist/artifacts/ArtifactResourceScope.js +100 -0
  106. package/dist/artifacts/AsarArtifactReader.js +176 -102
  107. package/dist/artifacts/AsarHeader.js +24 -0
  108. package/dist/artifacts/DirectoryArtifactReader.js +168 -65
  109. package/dist/artifacts/MachOSliceArtifactReader.js +116 -39
  110. package/dist/artifacts/NativeDmgArtifactReader.js +29 -22
  111. package/dist/artifacts/SafeOutputTree.js +245 -70
  112. package/dist/artifacts/SafeOutputTreeCleanup.js +45 -0
  113. package/dist/artifacts/SafeOutputTreeCreationFailure.js +20 -0
  114. package/dist/artifacts/SafeOutputTreeIdentity.js +42 -0
  115. package/dist/artifacts/SafeOutputTreeReadback.js +33 -0
  116. package/dist/artifacts/ZipArtifactReader.js +77 -27
  117. package/dist/artifacts/apple/InterfaceBuilderAnalysis.js +58 -18
  118. package/dist/artifacts/apple/InterfaceBuilderDecodeBudget.js +62 -24
  119. package/dist/artifacts/apple/KeyedArchiveReader.js +32 -13
  120. package/dist/artifacts/extraction/ArtifactExtraction.js +110 -86
  121. package/dist/artifacts/inventory/ArtifactGraphConstruction.js +110 -43
  122. package/dist/artifacts/inventory/ArtifactInventory.js +5 -4
  123. package/dist/artifacts/inventory/classify.js +75 -32
  124. package/dist/artifacts/inventory/hashStableRootArtifact.js +48 -15
  125. package/dist/artifacts/inventory/reader.js +13 -5
  126. package/dist/artifacts/inventory/scanCanonical.js +62 -25
  127. package/dist/artifacts/inventory/scanReader.js +38 -11
  128. package/dist/artifacts/javascript/JavaScriptArtifactFiles.js +15 -9
  129. package/dist/artifacts/javascript/JavaScriptSourceAnalysis.js +3 -0
  130. package/dist/browser/BrowserScenarioPartialObservation.js +8 -2
  131. package/dist/browser/BrowserScenarioSecrets.js +52 -37
  132. package/dist/browser/CdpBrowserProvider.js +5 -0
  133. package/dist/browser/CdpCaptureDocuments.js +40 -6
  134. package/dist/browser/CdpCaptureDomSvg.js +210 -0
  135. package/dist/browser/CdpCaptureEventBodyShapes.js +4 -8
  136. package/dist/browser/CdpCaptureEventHandlers.js +26 -9
  137. package/dist/browser/CdpCaptureEvents.js +4 -9
  138. package/dist/browser/CdpConnection.js +22 -5
  139. package/dist/browser/CdpPageCapture.js +1 -1
  140. package/dist/browser/CdpTargetSession.js +30 -34
  141. package/dist/browser/CdpWebMcpDiscovery.js +32 -10
  142. package/dist/browser/ElectronFileScope.js +99 -9
  143. package/dist/browser/PlaywrightBrowserScenarioProvider.js +60 -4
  144. package/dist/browser/PlaywrightElectronActiveProvider.js +11 -6
  145. package/dist/browser/PlaywrightScenarioArtifacts.js +5 -5
  146. package/dist/browser/PlaywrightScenarioBrowser.js +69 -7
  147. package/dist/browser/PlaywrightScenarioSession.js +127 -54
  148. package/dist/browser/PlaywrightScenarioStorage.js +507 -0
  149. package/dist/browser/PngVisualDiff.js +198 -29
  150. package/dist/browser/WebSourceMapFetcher.js +3 -3
  151. package/dist/browser/assets/LocalWebScriptArtifacts.js +3 -1
  152. package/dist/browser/assets/PublishWebScripts.js +75 -20
  153. package/dist/browser/assets/WebArtifactReads.js +23 -1
  154. package/dist/browser/assets/WebSourceLocationArtifacts.js +1 -0
  155. package/dist/browser/execution/CdpExecutionCapture.js +3 -3
  156. package/dist/browser/execution/CdpPreciseCoverage.js +5 -8
  157. package/dist/browser/history/HarCapture.js +14 -0
  158. package/dist/browser/history/HarCaptureProcess.js +2 -10
  159. package/dist/browser/history/MitmproxyCaptureAdapter.js +3 -1
  160. package/dist/browser/modules/WebModuleArtifacts.js +1 -0
  161. package/dist/cli/adbCommands.js +337 -0
  162. package/dist/cli/analysisViewCommands.js +39 -1
  163. package/dist/cli/apktoolCommands.js +53 -0
  164. package/dist/cli/artifactCommands.js +8 -11
  165. package/dist/cli/binaryDiagnosticsCommands.js +19 -1
  166. package/dist/cli/browserAdvancedCommands.js +65 -36
  167. package/dist/cli/coreBinaryCommands.js +0 -5
  168. package/dist/cli/coreNativeCommands.js +1 -14
  169. package/dist/cli/electronCommands.js +6 -1
  170. package/dist/cli/evmCommands.js +13 -4
  171. package/dist/cli/firmwareCommands.js +7 -2
  172. package/dist/cli/javascriptApplicationAnalysis.js +17 -1
  173. package/dist/cli/javascriptRecoveryCommands.js +22 -15
  174. package/dist/cli/jebCommands.js +99 -0
  175. package/dist/cli/jsonOutput.js +11 -4
  176. package/dist/cli/referenceSourceImportStatus.js +7 -0
  177. package/dist/cli/setupCommands.js +15 -3
  178. package/dist/cli/utilityCommands.js +66 -18
  179. package/dist/cli/webScriptCommands.js +20 -1
  180. package/dist/cli/webSourceLocationCommands.js +21 -9
  181. package/dist/cli.js +6 -0
  182. package/dist/cliBrowserScenarioCommands.js +2 -1
  183. package/dist/cliCommandNames.js +32 -0
  184. package/dist/cliJsonInput.js +2 -2
  185. package/dist/cliObservationOptions.js +3 -0
  186. package/dist/composition/adb.js +3 -0
  187. package/dist/composition/apktool.js +3 -0
  188. package/dist/composition/binaryDiagnostics.js +4 -0
  189. package/dist/composition/directAnalysis.js +12 -4
  190. package/dist/composition/javascriptAnalysisWorkerProcess.js +48 -0
  191. package/dist/composition/jeb.js +6 -0
  192. package/dist/config/environment.js +10 -0
  193. package/dist/config/ghidraLanguageOverride.js +9 -0
  194. package/dist/config/mcpInputSchemaProfile.js +27 -0
  195. package/dist/config/parseConfig.js +28 -1
  196. package/dist/contracts/adb/adbToolContracts.js +353 -0
  197. package/dist/contracts/advertisedInputExamples.js +48 -0
  198. package/dist/contracts/analysisDetail.js +10 -0
  199. package/dist/contracts/analysisViewToolContracts.js +17 -2
  200. package/dist/contracts/apktool/apktoolToolContracts.js +33 -0
  201. package/dist/contracts/artifactToolContracts.js +8 -5
  202. package/dist/contracts/browserToolContracts.js +1 -1
  203. package/dist/contracts/compactInputSchema.js +256 -0
  204. package/dist/contracts/functionWorkflowToolContracts.js +1 -1
  205. package/dist/contracts/inputSchemaPresentation.js +10 -10
  206. package/dist/contracts/javascript/electronToolContracts.js +15 -3
  207. package/dist/contracts/javascript/javascriptRecoveryToolContracts.js +1 -1
  208. package/dist/contracts/jeb/jebToolContracts.js +64 -0
  209. package/dist/contracts/native/binaryDiagnosticsToolContracts.js +25 -3
  210. package/dist/contracts/officialToolContracts.js +5 -5
  211. package/dist/contracts/sessionToolContracts.js +2 -2
  212. package/dist/contracts/sessionToolSchemas.js +6 -2
  213. package/dist/contracts/toolContractExamples.js +6 -0
  214. package/dist/contracts/toolContractTypes.js +3 -0
  215. package/dist/contracts/toolContracts.js +6 -0
  216. package/dist/contracts/toolEffects.js +167 -0
  217. package/dist/contracts/toolOutputSchemaGroups.js +5 -3
  218. package/dist/contracts/toolSchemaMetadata.js +82 -7
  219. package/dist/domain/adb/adbDeviceAnalysis.js +583 -0
  220. package/dist/domain/analysisErrorCleanup.js +29 -0
  221. package/dist/domain/analysisErrorPresentation.js +18 -6
  222. package/dist/domain/analysisErrorProjection.js +4 -1
  223. package/dist/domain/analysisSnapshot.js +2 -1
  224. package/dist/domain/analysisView/analysisView.js +52 -2
  225. package/dist/domain/analysisView/binaryLayoutView.js +2 -0
  226. package/dist/domain/analysisView/javascriptApplicationView.js +2 -0
  227. package/dist/domain/analysisView/nativeFunctionView.js +155 -0
  228. package/dist/domain/android/androidApplication.js +25 -20
  229. package/dist/domain/apktool/apktoolResourceAnalysis.js +77 -0
  230. package/dist/domain/apple/appleApplication.js +40 -23
  231. package/dist/domain/apple/appleBundleAnatomy.js +95 -28
  232. package/dist/domain/apple/dyldPaths.js +9 -1
  233. package/dist/domain/apple/dylibResolution.js +2 -2
  234. package/dist/domain/apple/interfaceBuilderGraph.js +22 -19
  235. package/dist/domain/apple/interfaceBuilderKeyedArchive.js +10 -1
  236. package/dist/domain/artifactComparison.js +35 -7
  237. package/dist/domain/artifactGraph.js +5 -3
  238. package/dist/domain/artifactIdentity.js +30 -2
  239. package/dist/domain/artifactInspection.js +3 -43
  240. package/dist/domain/artifactIntegrityPolicy.js +10 -0
  241. package/dist/domain/artifactInventoryEvidence.js +11 -12
  242. package/dist/domain/artifactPathSyntax.js +1 -1
  243. package/dist/domain/binaryTarget.js +16 -0
  244. package/dist/domain/binaryTargetTypes.js +8 -1
  245. package/dist/domain/browserObservationSchemas.js +8 -4
  246. package/dist/domain/canonicalJsonDigestSteps.js +34 -12
  247. package/dist/domain/compactStringIdentity.js +9 -0
  248. package/dist/domain/evidence.js +2 -1
  249. package/dist/domain/evidenceRecordSummary.js +144 -0
  250. package/dist/domain/inputIssueProjection.js +16 -1
  251. package/dist/domain/javascript/electronStaticAnalysisBrowser.js +12 -13
  252. package/dist/domain/javascript/electronStaticAnalysisIpc.js +11 -20
  253. package/dist/domain/javascript/electronStaticAnalysisNative.js +70 -40
  254. package/dist/domain/javascript/electronStaticAnalysisValues.js +16 -0
  255. package/dist/domain/javascript/javascriptAnalysisResourceControls.js +45 -0
  256. package/dist/domain/javascript/javascriptApplicationAnalysis.js +4 -1
  257. package/dist/domain/javascript/javascriptApplicationChangeGraph.js +6 -6
  258. package/dist/domain/javascript/javascriptApplicationGraph.js +79 -18
  259. package/dist/domain/javascript/javascriptApplicationProjectionResources.js +35 -0
  260. package/dist/domain/javascript/javascriptApplicationVersionItems.js +28 -12
  261. package/dist/domain/javascript/javascriptApplicationVersionKeys.js +9 -1
  262. package/dist/domain/javascript/javascriptAstFingerprint.js +58 -31
  263. package/dist/domain/javascript/javascriptAstValues.js +32 -0
  264. package/dist/domain/javascript/javascriptElectronMemberWrites.js +50 -0
  265. package/dist/domain/javascript/javascriptModuleSemanticIr.js +15 -0
  266. package/dist/domain/javascript/javascriptNativeHandoff.js +6 -1
  267. package/dist/domain/javascript/javascriptRpcEndpoints.js +253 -0
  268. package/dist/domain/javascript/javascriptRuntimeLoadState.js +1 -3
  269. package/dist/domain/javascript/javascriptRuntimeReconciliationGraph.js +7 -2
  270. package/dist/domain/javascript/javascriptRuntimeStaticCandidates.js +8 -11
  271. package/dist/domain/javascript/javascriptSemanticAnalysis.js +190 -33
  272. package/dist/domain/javascript/javascriptSemanticCallableResults.js +42 -0
  273. package/dist/domain/javascript/javascriptSemanticCalls.js +8 -1
  274. package/dist/domain/javascript/javascriptSemanticDerivedAnalysis.js +15 -4
  275. package/dist/domain/javascript/javascriptSemanticFileProjection.js +1 -0
  276. package/dist/domain/javascript/javascriptSemanticFingerprints.js +42 -41
  277. package/dist/domain/javascript/javascriptSemanticGraph.js +69 -23
  278. package/dist/domain/javascript/javascriptSemanticGraphSchemas.js +2 -10
  279. package/dist/domain/javascript/javascriptSemanticIterationSources.js +40 -7
  280. package/dist/domain/javascript/javascriptSemanticMemberMutations.js +341 -87
  281. package/dist/domain/javascript/javascriptSemanticMutationValues.js +78 -35
  282. package/dist/domain/javascript/javascriptSemanticObjectReferences.js +381 -0
  283. package/dist/domain/javascript/javascriptSemanticObjects.js +7 -1
  284. package/dist/domain/javascript/javascriptSemanticProjection.js +52 -14
  285. package/dist/domain/javascript/javascriptSemanticPropertyPaths.js +77 -0
  286. package/dist/domain/javascript/javascriptSemanticQuery.js +27 -29
  287. package/dist/domain/javascript/javascriptSemanticQueryIdentity.js +1 -3
  288. package/dist/domain/javascript/javascriptSemanticReturnedReferences.js +219 -0
  289. package/dist/domain/javascript/javascriptSemanticReturns.js +13 -23
  290. package/dist/domain/javascript/javascriptSemanticState.js +22 -2
  291. package/dist/domain/javascript/javascriptSemanticTraversal.js +19 -1
  292. package/dist/domain/javascript/javascriptSemanticValues.js +47 -19
  293. package/dist/domain/javascript/javascriptSourceAnalysis.js +1 -0
  294. package/dist/domain/javascript/javascriptStaticAnalysis.js +29 -17
  295. package/dist/domain/javascript/javascriptStaticAnalysisBundler.js +8 -6
  296. package/dist/domain/javascript/javascriptStaticAnalysisCalls.js +49 -5
  297. package/dist/domain/javascript/javascriptStaticAnalysisFindings.js +8 -4
  298. package/dist/domain/javascript/javascriptStaticAnalysisState.js +1 -0
  299. package/dist/domain/jeb/jebAnalysis.js +114 -0
  300. package/dist/domain/jsonShape.js +63 -52
  301. package/dist/domain/jsonValue.js +3 -0
  302. package/dist/domain/managed/managedApplicationGraph.js +37 -0
  303. package/dist/domain/managed/managedApplicationGraphCoverage.js +8 -2
  304. package/dist/domain/managed/managedApplicationGraphNodes.js +32 -22
  305. package/dist/domain/managed/managedArtifact.js +1 -0
  306. package/dist/domain/managed/managedInspectionEvidence.js +13 -0
  307. package/dist/domain/native/nativeAotPe.js +1408 -0
  308. package/dist/domain/native/nativeInstruction.js +21 -0
  309. package/dist/domain/native/nativeMetadataRecovery.js +79 -6
  310. package/dist/domain/native/peResources.js +94 -0
  311. package/dist/domain/nativeConvention.js +33 -0
  312. package/dist/domain/process/processCapture.js +91 -1
  313. package/dist/domain/process/processCaptureExample.js +24 -0
  314. package/dist/domain/process/processCaptureValidation.js +79 -0
  315. package/dist/domain/process/processScenario.js +59 -7
  316. package/dist/domain/propertyListKeys.js +3 -1
  317. package/dist/domain/referenceSourceGraph.js +25 -16
  318. package/dist/domain/referenceSourceImportParsing.js +6 -3
  319. package/dist/domain/referenceSourcePathIdentity.js +22 -0
  320. package/dist/domain/referenceSourceRequireBindings.js +137 -0
  321. package/dist/domain/webBundleAnalyzerInspection.js +14 -2
  322. package/dist/domain/webCaptureDiff.js +102 -4
  323. package/dist/domain/webScriptExportError.js +10 -4
  324. package/dist/domain/webScriptExportPlan.js +7 -13
  325. package/dist/domain/zipPackageFormat.js +4 -1
  326. package/dist/domain/zodCollectionSteps.js +24 -0
  327. package/dist/dotnet/ManagedArtifactInspector.js +55 -43
  328. package/dist/dotnet/ManagedDecodeBudget.js +80 -0
  329. package/dist/dotnet/ManagedMemberInspector.js +13 -6
  330. package/dist/dotnet/ManagedMemberInspectorCore.js +2 -2
  331. package/dist/dotnet/ManagedMemberInstructionDecoder.js +4 -2
  332. package/dist/dotnet/ManagedMemberRows.js +9 -4
  333. package/dist/dotnet/ManagedMetadataHeaps.js +15 -5
  334. package/dist/dotnet/ManagedMetadataInventoryRows.js +20 -11
  335. package/dist/dotnet/ManagedMetadataLayout.js +10 -4
  336. package/dist/dotnet/ManagedMethodBodyReader.js +8 -3
  337. package/dist/dotnet/ManagedNativeBoundaryHelpers.js +3 -2
  338. package/dist/dotnet/ManagedNativeBoundaryInspector.js +49 -34
  339. package/dist/dotnet/ManagedPeReader.js +41 -25
  340. package/dist/dotnet/ManagedReaderFailure.js +2 -1
  341. package/dist/dotnet/ManagedStaticProvider.js +55 -24
  342. package/dist/evaluation/AgentEvaluationReport.js +9 -5
  343. package/dist/evaluation/CodexAgentEval.js +43 -13
  344. package/dist/evm/EvmoleFailures.js +0 -2
  345. package/dist/evm/EvmoleInterfaceProvider.js +67 -2
  346. package/dist/filesystem/OwnedDirectoryHandle.js +29 -0
  347. package/dist/filesystem/OwnedFileHandle.js +36 -0
  348. package/dist/filesystem/RegularFile.js +33 -1
  349. package/dist/filesystem/StableFileHash.js +46 -0
  350. package/dist/filesystem/readFileHandleChunks.js +26 -0
  351. package/dist/firmware/FirmwareCommand.js +25 -3
  352. package/dist/firmware/FirmwareFiles.js +23 -8
  353. package/dist/firmware/FirmwareProvider.js +156 -32
  354. package/dist/firmware/FirmwarePublication.js +24 -3
  355. package/dist/firmware/FirmwareRelease.js +1 -0
  356. package/dist/generatedPackageMetadata.js +2 -2
  357. package/dist/ghidra/GhidraAnalysisProfile.js +55 -4
  358. package/dist/ghidra/GhidraAnalysisSeeds.js +211 -0
  359. package/dist/ghidra/GhidraClient.js +76 -4
  360. package/dist/ghidra/GhidraDiagnostics.js +11 -8
  361. package/dist/ghidra/GhidraFunctionValues.js +26 -2
  362. package/dist/ghidra/GhidraInstallation.js +1 -1
  363. package/dist/ghidra/GhidraInventoryValues.js +23 -1
  364. package/dist/ghidra/GhidraLanguageCatalog.js +99 -0
  365. package/dist/ghidra/GhidraLauncher.js +80 -39
  366. package/dist/ghidra/GhidraLoadImageAttest.js +49 -2
  367. package/dist/ghidra/GhidraMipsProfile.js +79 -0
  368. package/dist/ghidra/GhidraProvider.js +57 -9
  369. package/dist/ghidra/GhidraProviderCapabilities.js +18 -8
  370. package/dist/ghidra/GhidraProviderClient.js +282 -21
  371. package/dist/ghidra/GhidraSessionValues.js +9 -2
  372. package/dist/hopper/HopperAnalysisProfile.js +2 -0
  373. package/dist/hopper/HopperClient.js +15 -6
  374. package/dist/hopper/HopperMachOImage.js +2 -0
  375. package/dist/hopper/HopperProvider.js +13 -2
  376. package/dist/ida/IdaOperationRunner.js +8 -2
  377. package/dist/ida/IdaProvider.js +7 -0
  378. package/dist/ida/IdaSessionClient.js +3 -1
  379. package/dist/ida/IdaWorkspace.js +4 -2
  380. package/dist/javascript/analysis/JavaScriptAnalysisTransfer.js +326 -0
  381. package/dist/javascript/analysis/JavaScriptAnalysisWorker.js +520 -0
  382. package/dist/javascript/analysis/JavaScriptAnalysisWorkerProtocol.js +63 -0
  383. package/dist/javascript/analysis/JavaScriptAnalysisWorkerSchemas.js +521 -0
  384. package/dist/javascript/analysis/JavaScriptAnalysisWorkerServer.js +116 -0
  385. package/dist/javascript/recovery/RecoveryFiles.js +18 -7
  386. package/dist/javascript/recovery/WakaruCommand.js +22 -9
  387. package/dist/javascript/recovery/WakaruExecution.js +11 -7
  388. package/dist/javascript/recovery/WakaruProvider.js +139 -16
  389. package/dist/javascript/recovery/WakaruPublication.js +14 -4
  390. package/dist/javascript/recovery/WakaruRelease.js +10 -3
  391. package/dist/javascript/recovery/WakaruReport.js +12 -7
  392. package/dist/javascript/recovery/WakaruVersion.js +24 -0
  393. package/dist/javascript/sourceMaps/SourceMapCommand.js +16 -3
  394. package/dist/javascript/sourceMaps/SourceMapDecoder.js +63 -7
  395. package/dist/javascript/sourceMaps/SourceMapFormat.js +15 -4
  396. package/dist/jeb/JebMcpConnection.js +179 -0
  397. package/dist/jeb/JebMcpEndpoint.js +40 -0
  398. package/dist/jeb/JebProvider.js +299 -0
  399. package/dist/mcpDoctor.js +15 -6
  400. package/dist/native/AppleDispatchCoverage.js +25 -12
  401. package/dist/native/AppleDispatchMetadata.js +14 -7
  402. package/dist/native/AppleMachoFixups.js +71 -15
  403. package/dist/native/AppleMachoSelection.js +23 -3
  404. package/dist/native/NativeMacOSProvider.js +91 -16
  405. package/dist/native/NativeMachoInspection.js +11 -7
  406. package/dist/native/NativeUiHelperRuntime.js +6 -1
  407. package/dist/native/NativeUiObservation.js +4 -3
  408. package/dist/native/pe/PeResourceLayout.js +120 -0
  409. package/dist/native/pe/PeResourceParser.js +286 -0
  410. package/dist/native/pe/PeResourcesProvider.js +63 -0
  411. package/dist/process/BoundedFileBytes.js +30 -7
  412. package/dist/process/DarwinProcessRunTokenReader.js +8 -3
  413. package/dist/process/OwnedCommand.js +4 -3
  414. package/dist/process/ProcessOwnership.js +104 -112
  415. package/dist/process/ProcessOwnershipObservation.js +96 -39
  416. package/dist/process/ProcessOwnershipProcessTree.js +4 -4
  417. package/dist/process/ProcessRunTokenObservations.js +48 -0
  418. package/dist/process/ProviderDiagnosticRedaction.js +17 -0
  419. package/dist/process/ProviderProcess.js +4 -3
  420. package/dist/process/capture/FilesystemSnapshot.js +28 -4
  421. package/dist/process/capture/ProcessCaptureLifecycle.js +350 -59
  422. package/dist/process/capture/ProcessCaptureProgress.js +62 -0
  423. package/dist/process/capture/ProcessHarness.js +194 -26
  424. package/dist/process/capture/ProcessNormalization.js +3 -1
  425. package/dist/process/capture/ProcessScenarioRuntimeValidation.js +5 -2
  426. package/dist/process/capture/TerminalRenderer.js +24 -7
  427. package/dist/reference/ReferenceSourceReader.js +22 -5
  428. package/dist/reference/ReferenceSourceReaderEntries.js +114 -51
  429. package/dist/reference/ReferenceSourceReaderErrors.js +12 -0
  430. package/dist/reference/ReferenceSourceReaderFile.js +50 -10
  431. package/dist/reference/ReferenceSourceReaderValidate.js +4 -4
  432. package/dist/server/EvidenceMcpServer.js +36 -1
  433. package/dist/server/admittedToolOperation.js +9 -0
  434. package/dist/server/contractToolHandler.js +21 -0
  435. package/dist/server/createServer.js +97 -25
  436. package/dist/server/registerAdbTools.js +36 -0
  437. package/dist/server/registerAnalysisViewTool.js +4 -9
  438. package/dist/server/registerAndroidTools.js +3 -12
  439. package/dist/server/registerApktoolTools.js +14 -0
  440. package/dist/server/registerApplicationTools/compareExportShapes.js +4 -6
  441. package/dist/server/registerApplicationTools/compareSourceToBundle.js +4 -5
  442. package/dist/server/registerApplicationTools/compareVersions.js +3 -2
  443. package/dist/server/registerApplicationTools/coverage.js +3 -2
  444. package/dist/server/registerApplicationTools/obligationLedger.js +3 -2
  445. package/dist/server/registerApplicationTools/projectMobileApplicationGraph.js +3 -2
  446. package/dist/server/registerApplicationTools/traceFeature.js +3 -2
  447. package/dist/server/registerApplicationTools/traceSemantics.js +4 -5
  448. package/dist/server/registerArtifactComparisonTool.js +5 -2
  449. package/dist/server/registerBinaryDiagnosticsTools.js +16 -4
  450. package/dist/server/registerBrowserScenarioTool.js +10 -7
  451. package/dist/server/registerBrowserTools.js +12 -9
  452. package/dist/server/registerBundleComparisonTool.js +16 -2
  453. package/dist/server/registerCloseLifecycleTool.js +32 -3
  454. package/dist/server/registerElectronTools.js +28 -10
  455. package/dist/server/registerEvmTools.js +4 -9
  456. package/dist/server/registerFirmwareTools.js +3 -11
  457. package/dist/server/registerFunctionComparisonTool.js +5 -2
  458. package/dist/server/registerJavaScriptRecoveryTool.js +4 -9
  459. package/dist/server/registerJavaScriptRuntimeObservationTools.js +9 -6
  460. package/dist/server/registerJebTools.js +16 -0
  461. package/dist/server/registerManagedWorkflowTools/compareManagedMembers.js +4 -6
  462. package/dist/server/registerManagedWorkflowTools/importManagedReconstruction.js +3 -2
  463. package/dist/server/registerManagedWorkflowTools/projectManagedApplicationGraph.js +3 -2
  464. package/dist/server/registerManagedWorkflowTools/verifyManagedNativeBoundaries.js +3 -2
  465. package/dist/server/registerPeResourcesTool.js +9 -0
  466. package/dist/server/registerProcessComparisonTool.js +5 -2
  467. package/dist/server/registerRecordedCrashTools.js +4 -9
  468. package/dist/server/registerSessionRecordTools.js +2 -1
  469. package/dist/server/registerSessionTools.js +49 -18
  470. package/dist/server/registerWebModuleTool.js +4 -9
  471. package/dist/server/registerWebNetworkCaptureTool.js +4 -9
  472. package/dist/server/registerWebRuntimeTools.js +6 -5
  473. package/dist/server/registerWebScriptTool.js +6 -3
  474. package/dist/server/registerWebSourceLocationTool.js +4 -9
  475. package/dist/server/toolResult.js +21 -2
  476. package/dist/windows/WindowsPrivateRuntime.js +12 -5
  477. package/install.sh +7 -4
  478. package/licenses/nativeaot-parser-MIT.txt +28 -0
  479. package/native/windows/build/manifest.json +2 -2
  480. package/native/windows/build/rea-windows-x64.node +0 -0
  481. package/package.json +33 -5
  482. package/scripts/rea.mjs +16 -1
  483. package/skills/reverse-engineer-anything/SKILL.md +52 -51
  484. package/skills/reverse-engineer-anything/references/connection-and-recovery.md +127 -0
  485. package/skills/reverse-engineer-anything/references/evidence-workflows.md +8 -0
  486. package/skills/reverse-engineer-anything/references/javascript-applications.md +92 -13
  487. package/skills/reverse-engineer-anything/references/native-and-artifacts.md +22 -1
@@ -1,7 +1,7 @@
1
1
  import * as t from "@babel/types";
2
2
  import { semanticCapturePosition, semanticEscapeFollowsCapture, semanticBindingPrecedesCapture, } from "./javascriptSemanticMutationInitializers.js";
3
3
  import { semanticSlotAtPath } from "./javascriptSemanticSlots.js";
4
- import { invalidateSemanticEscapedPath, invalidateSemanticMutationPath, } from "./javascriptSemanticMutationValues.js";
4
+ import { invalidateSemanticEscapedPath, invalidateSemanticMutationPaths, } from "./javascriptSemanticMutationValues.js";
5
5
  import { resolveSemanticBindingState, } from "./javascriptSemanticState.js";
6
6
  import { semanticRequireOrigin } from "./javascriptSemanticRequireOrigin.js";
7
7
  import { compareUnicodeCodePoints } from "../unicodeCodePointOrder.js";
@@ -91,21 +91,33 @@ const evaluateBinding = (binding, context) => {
91
91
  const initializer = binding.initializers[0];
92
92
  if (initializer === undefined)
93
93
  return { status: "unknown", reason: "Missing binding initializer." };
94
- const nested = nestedContext(context, binding.bindingId);
95
- let value = projectValue(evaluateExpression(initializer.node, nested), initializer.projection);
96
- if (!isPrimitive(value)) {
97
- const captureContext = primitiveCaptureContext(initializer.node, nested);
98
- if (captureContext !== undefined) {
99
- const captured = projectValue(evaluateExpression(initializer.node, captureContext), initializer.projection);
100
- if (isPrimitive(captured))
101
- value = captured;
94
+ context.bindings.add(binding.bindingId);
95
+ let value;
96
+ try {
97
+ const nested = nestedContext(context);
98
+ value = projectValue(evaluateExpression(initializer.node, nested), initializer.projection);
99
+ if (!isPrimitive(value)) {
100
+ const captureContext = primitiveCaptureContext(initializer.node, nested);
101
+ if (captureContext !== undefined) {
102
+ const captured = projectValue(evaluateExpression(initializer.node, captureContext), initializer.projection);
103
+ if (isPrimitive(captured))
104
+ value = captured;
105
+ }
102
106
  }
103
107
  }
104
- const mutated = binding.mutatedPaths.reduce(invalidateSemanticMutationPath, value);
105
- const projected = binding.escapedPaths.reduce((value, escape) => context.capturePoint !== undefined &&
106
- semanticEscapeFollowsCapture(binding, context.capturePoint, escape.node, context.state.parentsByNode)
107
- ? value
108
- : invalidateSemanticEscapedPath(value, escape.path), mutated);
108
+ finally {
109
+ context.bindings.delete(binding.bindingId);
110
+ }
111
+ let projected = invalidateSemanticMutationPaths(value, binding.mutatedPaths);
112
+ for (const escape of binding.escapedPaths) {
113
+ // Escapes only invalidate object references; other lattice values survive.
114
+ if (projected.status !== "object" && projected.status !== "array")
115
+ break;
116
+ if (context.capturePoint !== undefined &&
117
+ semanticEscapeFollowsCapture(binding, context.capturePoint, escape.node, context.state.parentsByNode))
118
+ continue;
119
+ projected = invalidateSemanticEscapedPath(projected, escape.path);
120
+ }
109
121
  // Point-local memoization also bounds failed speculative captures. Only a
110
122
  // primitive result is allowed back into ordinary value evaluation.
111
123
  if (context.capturePoint !== undefined ||
@@ -395,6 +407,17 @@ const projectValue = (value, projection) => {
395
407
  };
396
408
  };
397
409
  const provenanceForBinding = (binding, context) => {
410
+ const provenance = provenanceForBindingValue(binding, context);
411
+ const assigned = binding.definitions.some(({ kind }) => kind === "assignment");
412
+ const conditionallyInitialized = binding.initializers.some(({ node }) => context.state.conditionalInitializers.has(node));
413
+ if (provenance.status !== "module" ||
414
+ (!assigned && !conditionallyInitialized))
415
+ return provenance;
416
+ return semanticAmbiguousProvenance(provenance.origins, assigned
417
+ ? `Binding ${binding.name} may be reassigned.`
418
+ : `Binding ${binding.name} is conditionally initialized.`);
419
+ };
420
+ const provenanceForBindingValue = (binding, context) => {
398
421
  if (context.bindings.has(binding.bindingId))
399
422
  return semanticUnresolvedProvenance("cycle", `Alias cycle at ${binding.name}.`);
400
423
  if (binding.directOrigins.length > 0)
@@ -408,7 +431,14 @@ const provenanceForBinding = (binding, context) => {
408
431
  return semanticUnresolvedProvenance("unknown", "Missing binding initializer.");
409
432
  if (initializer.projection.includes(null))
410
433
  return semanticUnresolvedProvenance("unknown", "Dynamic provenance projection.");
411
- const resolved = provenanceForExpression(initializer.node, nestedContext(context, binding.bindingId));
434
+ context.bindings.add(binding.bindingId);
435
+ let resolved;
436
+ try {
437
+ resolved = provenanceForExpression(initializer.node, nestedContext(context));
438
+ }
439
+ finally {
440
+ context.bindings.delete(binding.bindingId);
441
+ }
412
442
  if (resolved.status !== "module" || initializer.projection.length === 0)
413
443
  return resolved;
414
444
  return semanticOriginsProvenance(resolved.origins.map((origin) => ({
@@ -491,16 +521,14 @@ const mergeValues = (values) => {
491
521
  ? primitiveSet(primitives)
492
522
  : { status: "ambiguous", reason: "Branches have incompatible values." };
493
523
  };
494
- const nestedContext = (context, bindingId) => ({
524
+ const nestedContext = (context) => ({
495
525
  state: context.state,
496
526
  primitiveBindingValues: context.primitiveBindingValues,
497
527
  ...(context.capturePoint === undefined
498
528
  ? {}
499
529
  : { capturePoint: context.capturePoint }),
500
530
  expressionDepth: context.expressionDepth + 1,
501
- bindings: bindingId === undefined
502
- ? context.bindings
503
- : new Set([...context.bindings, bindingId]),
531
+ bindings: context.bindings,
504
532
  });
505
533
  const isPrimitive = (value) => value.status === "literal" || value.status === "union";
506
534
  const primitiveCaptureContext = (node, context) => {
@@ -0,0 +1 @@
1
+ export {};
@@ -1,13 +1,15 @@
1
1
  import * as t from "@babel/types";
2
- import { traverseJavaScriptAst } from "./javascriptSemanticTraversal.js";
2
+ import { ELECTRON_IDENTITY_LIMITATION, ELECTRON_MODULE, } from "./javascriptElectronMemberWrites.js";
3
+ import { completeSemanticSteps, traverseJavaScriptAstSteps, } from "./javascriptSemanticTraversal.js";
3
4
  import { inspectElectronStaticNode } from "./electronStaticAnalysis.js";
4
5
  import { detectVendors, failedJavaScriptStaticAnalysis, registrationKey, sortedUnique, stringValue, } from "./javascriptStaticAnalysisHelpers.js";
5
- import { addReference, addSourceMapDirectives, inspectCall, inspectRouteProperty, inspectRoleProperty, } from "./javascriptStaticAnalysisCalls.js";
6
+ import { addReference, addSourceMapDirectives, inspectCall, inspectRouteProperty, inspectRoleProperty, inspectRpcNode, } from "./javascriptStaticAnalysisCalls.js";
6
7
  import { inspectBundlerRegistration, inspectEsbuildWrapper, } from "./javascriptStaticAnalysisBundler.js";
7
8
  import { finalizeLocatedFindings } from "./javascriptStaticAnalysisFindings.js";
8
9
  import { createJavaScriptAnalysisAccumulator, } from "./javascriptStaticAnalysisState.js";
9
- import { classifyParsedJavaScriptOpenReceivers, } from "./javascriptSemanticAnalysis.js";
10
+ import { classifyParsedJavaScriptElectronBindingsSteps, classifyParsedJavaScriptRpcClientRootsSteps, classifyParsedJavaScriptOpenReceivers, } from "./javascriptSemanticAnalysis.js";
10
11
  import { parseJavaScriptSource, } from "./javascriptSourceParser.js";
12
+ import { createJavaScriptRpcScan } from "./javascriptRpcEndpoints.js";
11
13
  /** Parse one JavaScript artifact and recover static structure only. */
12
14
  export const analyzeJavaScriptStaticSource = (source) => {
13
15
  const file = parseJavaScriptSource(source);
@@ -16,21 +18,31 @@ export const analyzeJavaScriptStaticSource = (source) => {
16
18
  : analyzeParsedJavaScriptStaticSource(source, file, classifyParsedJavaScriptOpenReceivers(file));
17
19
  };
18
20
  /** Recover static structure from an already parsed JavaScript artifact. */
19
- export const analyzeParsedJavaScriptStaticSource = (source, file, openReceiverFacts) => {
21
+ export const analyzeParsedJavaScriptStaticSource = (source, file, openReceiverFacts) => completeSemanticSteps(analyzeParsedJavaScriptStaticSourceSteps(source, file, openReceiverFacts));
22
+ /** Static analysis that yields during its source traversal; results are unchanged. */
23
+ export function* analyzeParsedJavaScriptStaticSourceSteps(source, file, openReceiverFacts) {
20
24
  const accumulator = createJavaScriptAnalysisAccumulator(source.length);
21
- traverseStaticSource(source, file, accumulator, openReceiverFacts);
25
+ const electronBindings = yield* classifyParsedJavaScriptElectronBindingsSteps(file);
26
+ const clientRoots = yield* classifyParsedJavaScriptRpcClientRootsSteps(file);
27
+ yield* traverseStaticSourceSteps(file, {
28
+ source,
29
+ accumulator,
30
+ ...(openReceiverFacts === undefined ? {} : { openReceiverFacts }),
31
+ electronBindings,
32
+ rpcScan: createJavaScriptRpcScan(source, clientRoots),
33
+ });
22
34
  addSourceMapDirectives(source, file.comments ?? [], accumulator);
23
35
  return finalizeStaticAnalysis(source, file, accumulator);
24
- };
25
- const traverseStaticSource = (source, file, accumulator, openReceiverFacts) => {
26
- traverseJavaScriptAst(file, {
36
+ }
37
+ function* traverseStaticSourceSteps(file, findings) {
38
+ yield* traverseJavaScriptAstSteps(file, {
27
39
  enter: (node) => {
28
- accumulator.visitedNodes += 1;
29
- inspectNode(source, node, accumulator, openReceiverFacts);
40
+ findings.accumulator.visitedNodes += 1;
41
+ inspectNode(node, findings);
30
42
  return undefined;
31
43
  },
32
44
  });
33
- };
45
+ }
34
46
  const finalizeStaticAnalysis = (source, file, accumulator) => {
35
47
  const parserErrors = file.errors.length;
36
48
  const limitations = [
@@ -44,6 +56,9 @@ const finalizeStaticAnalysis = (source, file, accumulator) => {
44
56
  : [
45
57
  "One or more static keys, expressions, or Electron boundary values were dynamic and remain unknown.",
46
58
  ]),
59
+ ...(accumulator.references.some(({ value }) => value.specifier !== null && ELECTRON_MODULE.test(value.specifier))
60
+ ? [ELECTRON_IDENTITY_LIMITATION]
61
+ : []),
47
62
  "JavaScript syntax was parsed as data and was never evaluated.",
48
63
  ];
49
64
  return {
@@ -70,12 +85,8 @@ const finalizeStaticAnalysis = (source, file, accumulator) => {
70
85
  limitations,
71
86
  };
72
87
  };
73
- const inspectNode = (source, node, accumulator, openReceiverFacts) => {
74
- const findings = {
75
- source,
76
- accumulator,
77
- ...(openReceiverFacts === undefined ? {} : { openReceiverFacts }),
78
- };
88
+ const inspectNode = (node, findings) => {
89
+ const { source, accumulator } = findings;
79
90
  inspectElectronStaticNode(node, findings);
80
91
  if (t.isCallExpression(node)) {
81
92
  inspectBundlerRegistration(source, node, accumulator);
@@ -110,4 +121,5 @@ const inspectNode = (source, node, accumulator, openReceiverFacts) => {
110
121
  inspectRouteProperty(node, findings);
111
122
  inspectRoleProperty(node, findings);
112
123
  }
124
+ inspectRpcNode(node, findings);
113
125
  };
@@ -15,7 +15,7 @@ export const inspectBundlerRegistration = (source, call, accumulator) => {
15
15
  const runtimeValue = runtimeMetadata(entry.elements[2]);
16
16
  if (!t.isArrayExpression(chunkIds) || !t.isObjectExpression(table))
17
17
  return;
18
- const recovered = recoverBundlerModules(source, table, accumulator);
18
+ const recovered = recoverBundlerModules(source, table, runtime, accumulator);
19
19
  const chunkKeys = staticArrayValues(chunkIds);
20
20
  accumulator.unknownFindings += chunkKeys.unknown;
21
21
  accumulator.unknownFindings +=
@@ -55,13 +55,14 @@ export const inspectEsbuildWrapper = (source, call, accumulator) => {
55
55
  const table = call.arguments[0];
56
56
  if (wrapperKind === null || !t.isObjectExpression(table))
57
57
  return;
58
- const recovered = recoverBundlerModules(source, table, accumulator);
58
+ const runtime = `esbuild-${wrapperKind}`;
59
+ const recovered = recoverBundlerModules(source, table, runtime, accumulator);
59
60
  if (recovered.modules.length === 0)
60
61
  return;
61
62
  accumulator.unknownFindings += recovered.unknownAsyncChunkKeys;
62
63
  const registration = {
63
64
  bundler: "esbuild",
64
- runtime: `esbuild-${wrapperKind}`,
65
+ runtime,
65
66
  chunk_keys: [`${wrapperKind}@${String(call.start ?? 0)}`],
66
67
  unknown_chunk_keys: 0,
67
68
  runtime_require_name: null,
@@ -75,12 +76,12 @@ export const inspectEsbuildWrapper = (source, call, accumulator) => {
75
76
  };
76
77
  addFindingOnce(accumulator, `registration\0${registrationKey(registration)}`, () => accumulator.registrations.push(registration));
77
78
  };
78
- const recoverBundlerModules = (source, table, accumulator) => {
79
+ const recoverBundlerModules = (source, table, runtime, accumulator) => {
79
80
  const modules = [];
80
81
  const asyncChunkKeys = [];
81
82
  let unknownAsyncChunkKeys = 0;
82
83
  for (const property of table.properties) {
83
- const recovered = recoverBundlerModule(source, property, accumulator);
84
+ const recovered = recoverBundlerModule(source, property, runtime, accumulator);
84
85
  if (recovered === null)
85
86
  continue;
86
87
  modules.push(recovered.module);
@@ -93,7 +94,7 @@ const recoverBundlerModules = (source, table, accumulator) => {
93
94
  unknownAsyncChunkKeys,
94
95
  };
95
96
  };
96
- const recoverBundlerModule = (source, property, accumulator) => {
97
+ const recoverBundlerModule = (source, property, runtime, accumulator) => {
97
98
  const factory = moduleFactory(property);
98
99
  if (factory === undefined)
99
100
  return null;
@@ -109,6 +110,7 @@ const recoverBundlerModule = (source, property, accumulator) => {
109
110
  start: factory.start,
110
111
  end: factory.end,
111
112
  key,
113
+ runtime,
112
114
  requireName,
113
115
  };
114
116
  accumulator.moduleRangeIndex.add(moduleRange);
@@ -32,6 +32,8 @@ export const inspectCall = (source, node, context) => {
32
32
  addReference(context, { node, kind: "service-worker", specifier: first });
33
33
  inspectEndpointCall(node, name, first, context);
34
34
  inspectStorageCall(node, name, first, context);
35
+ if (first === "audio" || first === "video")
36
+ noteMediaElementPreloads(node, accumulator);
35
37
  if (name.endsWith("loadFile") && first !== undefined)
36
38
  addLocatedFinding(context, {
37
39
  collection: accumulator.roles,
@@ -61,6 +63,18 @@ export const inspectCall = (source, node, context) => {
61
63
  },
62
64
  });
63
65
  };
66
+ // Element factories such as jsx("audio", props) and createElement("video",
67
+ // props) carry the HTML media `preload` hint ("none", "metadata", "auto"),
68
+ // which never names an Electron preload script.
69
+ const noteMediaElementPreloads = (node, accumulator) => {
70
+ const props = node.arguments[1];
71
+ if (!t.isObjectExpression(props))
72
+ return;
73
+ for (const property of props.properties)
74
+ if (t.isObjectProperty(property) &&
75
+ semanticStaticPropertyName(property.key, property.computed) === "preload")
76
+ accumulator.mediaElementPreloads.add(property);
77
+ };
64
78
  const requireCallSpecifier = (node, name, moduleRequireName) => {
65
79
  if (name === "require" || name.endsWith(".require"))
66
80
  return { specifier: argumentValue(node.arguments[0]) };
@@ -114,6 +128,12 @@ const inspectEndpointCall = (node, name, first, context) => {
114
128
  mechanism: `call:${name}`,
115
129
  });
116
130
  };
131
+ /** Record tRPC procedures, tRPC link URLs and named GraphQL operations. */
132
+ export const inspectRpcNode = (node, context) => {
133
+ const rpc = context.rpcScan.inspect(node);
134
+ if (rpc !== undefined)
135
+ addEndpoint(context, { node, kind: "network", ...rpc });
136
+ };
117
137
  export const inspectRouteProperty = (node, context) => {
118
138
  const key = semanticStaticPropertyName(node.key, node.computed);
119
139
  if ((key === "path" || key === "route") && t.isStringLiteral(node.value))
@@ -127,6 +147,8 @@ export const inspectRouteProperty = (node, context) => {
127
147
  export const inspectRoleProperty = (node, context) => {
128
148
  if (semanticStaticPropertyName(node.key, node.computed) !== "preload")
129
149
  return;
150
+ if (context.accumulator.mediaElementPreloads.has(node))
151
+ return;
130
152
  const path = staticPath(node.value);
131
153
  if (path === undefined)
132
154
  return;
@@ -213,13 +235,35 @@ export const addSourceMapDirectives = (source, comments, accumulator) => {
213
235
  end === undefined ||
214
236
  end === null)
215
237
  continue;
216
- const match = /^(?:\/\/|\/\*)[#@]\s*sourceMappingURL\s*=\s*([^\s*]+)/u.exec(source.slice(start, end));
217
- if (match === null)
238
+ const commentSource = source.slice(start, end);
239
+ if (!(commentSource.startsWith("//") || commentSource.startsWith("/*")) ||
240
+ !(commentSource[2] === "#" || commentSource[2] === "@"))
241
+ continue;
242
+ // Single-class searches avoid regex backtracking over unbounded whitespace
243
+ // or inline URLs, which can exhaust the engine stack on two-byte strings.
244
+ const nameOffset = commentSource.slice(3).search(/\S/u);
245
+ if (nameOffset === -1)
246
+ continue;
247
+ const nameStart = 3 + nameOffset;
248
+ if (!commentSource.startsWith("sourceMappingURL", nameStart))
249
+ continue;
250
+ const nameEnd = nameStart + "sourceMappingURL".length;
251
+ const equalsOffset = commentSource.slice(nameEnd).search(/\S/u);
252
+ if (equalsOffset === -1)
253
+ continue;
254
+ const equalsStart = nameEnd + equalsOffset;
255
+ if (!commentSource.startsWith("=", equalsStart))
256
+ continue;
257
+ const urlOffset = commentSource.slice(equalsStart + 1).search(/\S/u);
258
+ if (urlOffset === -1)
218
259
  continue;
219
- const declared = match[1];
220
- if (declared === undefined || declared.length === 0)
260
+ const declaredStart = equalsStart + 1 + urlOffset;
261
+ const terminator = commentSource.slice(declaredStart).search(/[\s*]/u);
262
+ const declaredEnd = terminator === -1 ? commentSource.length : declaredStart + terminator;
263
+ if (declaredEnd === declaredStart)
221
264
  continue;
222
- const location = rangeForOffsets(source, start, start + match[0].length);
265
+ const declared = commentSource.slice(declaredStart, declaredEnd);
266
+ const location = rangeForOffsets(source, start, start + declaredEnd);
223
267
  addFindingOnce(accumulator, `source-map\0${declared}`, () => accumulator.sourceMaps.push({ declared_url: declared, location }));
224
268
  }
225
269
  };
@@ -76,7 +76,11 @@ export const addFindingOnce = (accumulator, key, add) => {
76
76
  add();
77
77
  };
78
78
  /** Attach recovered bundle-module ownership to findings after traversal. */
79
- export const finalizeLocatedFindings = (values, modules) => values.map(({ offset, value }) => ({
80
- ...value,
81
- module_key: modules.find(offset)?.key ?? null,
82
- }));
79
+ export const finalizeLocatedFindings = (values, modules) => values.map(({ offset, value }) => {
80
+ const module = modules.find(offset);
81
+ return {
82
+ ...value,
83
+ module_key: module?.key ?? null,
84
+ ...(module === undefined ? {} : { module_runtime: module.runtime }),
85
+ };
86
+ });
@@ -14,6 +14,7 @@ export const createJavaScriptAnalysisAccumulator = (sourceLength) => ({
14
14
  utilityProcesses: [],
15
15
  nativeAddonBindings: [],
16
16
  moduleRangeIndex: new JavaScriptModuleRangeIndex(sourceLength),
17
+ mediaElementPreloads: new WeakSet(),
17
18
  seen: new Set(),
18
19
  visitedNodes: 0,
19
20
  unknownFindings: 0,
@@ -0,0 +1,114 @@
1
+ import { z } from "zod";
2
+ import { localPathStringSchema } from "../localPath.js";
3
+ /**
4
+ * Caller intent for JEB-backed inspection, independent of the engine build.
5
+ *
6
+ * JEB resolves paths on the host running the JEB client that serves MCP; REA
7
+ * never launches the engine or opens the target itself.
8
+ */
9
+ export const jebInputSchemas = {
10
+ inspect_jeb_client: z.strictObject({}),
11
+ open_jeb_project: z.strictObject({
12
+ path: localPathStringSchema.describe("Artifact file or existing .jdb2 project database, resolved by the running JEB client"),
13
+ }),
14
+ list_jeb_units: z.strictObject({
15
+ filter: z
16
+ .string()
17
+ .optional()
18
+ .describe("Wildcard filter matched against unit paths; '*' allowed"),
19
+ parent_unit_path: z
20
+ .string()
21
+ .min(1)
22
+ .optional()
23
+ .describe("Restrict results to descendants of this unit path"),
24
+ index: z
25
+ .number()
26
+ .int()
27
+ .nonnegative()
28
+ .default(0)
29
+ .describe("Zero-based index of the first result to return"),
30
+ count: z
31
+ .number()
32
+ .int()
33
+ .min(1)
34
+ .max(100)
35
+ .default(100)
36
+ .describe("Maximum results to return; the engine protocol caps pages at 100"),
37
+ }),
38
+ decompile_jeb_item: z.strictObject({
39
+ unit_path: z
40
+ .string()
41
+ .min(1)
42
+ .optional()
43
+ .describe("Target code unit; the engine's first code unit in the project when omitted"),
44
+ item_address: z
45
+ .string()
46
+ .min(1)
47
+ .describe("Type or method address within the unit, as listed by the engine"),
48
+ item_kind: z.enum(["type", "method"]).describe("Kind of item to decompile"),
49
+ }),
50
+ };
51
+ /** Validate operation and input together so their types remain correlated. */
52
+ export const jebRequestSchema = z.discriminatedUnion("operation", [
53
+ z.strictObject({
54
+ operation: z.literal("inspect_jeb_client"),
55
+ input: jebInputSchemas.inspect_jeb_client,
56
+ }),
57
+ z.strictObject({
58
+ operation: z.literal("open_jeb_project"),
59
+ input: jebInputSchemas.open_jeb_project,
60
+ }),
61
+ z.strictObject({
62
+ operation: z.literal("list_jeb_units"),
63
+ input: jebInputSchemas.list_jeb_units,
64
+ }),
65
+ z.strictObject({
66
+ operation: z.literal("decompile_jeb_item"),
67
+ input: jebInputSchemas.decompile_jeb_item,
68
+ }),
69
+ ]);
70
+ const engine = z.strictObject({
71
+ name: z.string().min(1),
72
+ version: z.string().nullable(),
73
+ endpoint: z.string().min(1),
74
+ gui_client: z.boolean().nullable(),
75
+ });
76
+ const unit = z.strictObject({
77
+ unit_path: z.string(),
78
+ unit_type: z.string(),
79
+ });
80
+ /** Portable JEB observations with explicit identity and coverage limitations. */
81
+ export const jebResultSchemas = {
82
+ inspect_jeb_client: z.strictObject({
83
+ engine,
84
+ startup_ts: z.number().int().nonnegative().nullable(),
85
+ message: z.string().nullable(),
86
+ }),
87
+ open_jeb_project: z.strictObject({
88
+ engine,
89
+ project_name: z.string().nullable(),
90
+ creation_datetime: z.string().nullable(),
91
+ input_files: z.array(z.strictObject({
92
+ file_name: z.string(),
93
+ file_size: z.number().int().nonnegative(),
94
+ contents_sha256_hash: z.string(),
95
+ })),
96
+ units: z.array(unit),
97
+ }),
98
+ list_jeb_units: z.strictObject({
99
+ engine,
100
+ filter: z.string().nullable(),
101
+ parent_unit_path: z.string().nullable(),
102
+ index: z.number().int().nonnegative(),
103
+ count: z.number().int().positive(),
104
+ units: z.array(unit),
105
+ coverage: z.enum(["complete", "partial"]),
106
+ }),
107
+ decompile_jeb_item: z.strictObject({
108
+ engine,
109
+ unit_path: z.string().nullable(),
110
+ item_address: z.string(),
111
+ item_kind: z.enum(["type", "method"]),
112
+ text: z.string(),
113
+ }),
114
+ };
@@ -23,6 +23,7 @@ export const jsonShapeSchema = z.object({
23
23
  observations: z.number().int().min(1),
24
24
  })),
25
25
  });
26
+ const arrayElementKey = Symbol("array-element");
26
27
  /** Parse approved JSON and immediately discard values after iterative shape inference. */
27
28
  export const inferJsonShape = (text) => {
28
29
  let root;
@@ -34,8 +35,31 @@ export const inferJsonShape = (text) => {
34
35
  void cause;
35
36
  return null;
36
37
  }
37
- const properties = new Map();
38
- const pending = [{ value: root, path: [], depth: 0 }];
38
+ const rootShape = {
39
+ path: [],
40
+ types: new Set(),
41
+ observations: 0,
42
+ };
43
+ // Each structural path owns one accumulator, shared by all matching array rows.
44
+ const childShape = (parent, key) => {
45
+ const children = (parent.children ??= new Map());
46
+ const existing = children.get(key);
47
+ if (existing !== undefined)
48
+ return existing;
49
+ const node = {
50
+ path: [
51
+ ...parent.path,
52
+ typeof key === "string"
53
+ ? { kind: "property", name: key }
54
+ : { kind: "array-element" },
55
+ ],
56
+ types: new Set(),
57
+ observations: 0,
58
+ };
59
+ children.set(key, node);
60
+ return node;
61
+ };
62
+ const pending = [{ value: root, shape: rootShape }];
39
63
  let nodeCount = 0;
40
64
  let maxDepthObserved = 0;
41
65
  while (pending.length > 0) {
@@ -43,29 +67,15 @@ export const inferJsonShape = (text) => {
43
67
  if (current === undefined)
44
68
  break;
45
69
  nodeCount += 1;
46
- maxDepthObserved = Math.max(maxDepthObserved, current.depth);
47
- if (current.path.length > 0) {
48
- const key = JSON.stringify(current.path);
49
- const type = jsonValueType(current.value);
50
- const existing = properties.get(key);
51
- if (existing === undefined)
52
- properties.set(key, {
53
- path: current.path,
54
- types: new Set([type]),
55
- observations: 1,
56
- });
57
- else {
58
- existing.types.add(type);
59
- existing.observations += 1;
60
- }
61
- }
70
+ maxDepthObserved = Math.max(maxDepthObserved, current.shape.path.length);
71
+ current.shape.types.add(jsonValueType(current.value));
72
+ current.shape.observations += 1;
62
73
  if (Array.isArray(current.value)) {
74
+ if (current.value.length === 0)
75
+ continue;
76
+ const shape = childShape(current.shape, arrayElementKey);
63
77
  for (let index = current.value.length - 1; index >= 0; index -= 1)
64
- pending.push({
65
- value: current.value[index],
66
- path: [...current.path, { kind: "array-element" }],
67
- depth: current.depth + 1,
68
- });
78
+ pending.push({ value: current.value[index], shape });
69
79
  continue;
70
80
  }
71
81
  if (!isRecord(current.value))
@@ -76,25 +86,31 @@ export const inferJsonShape = (text) => {
76
86
  if (entry === undefined)
77
87
  continue;
78
88
  const [name, value] = entry;
79
- const path = [
80
- ...current.path,
81
- { kind: "property", name },
82
- ];
83
- pending.push({ value, path, depth: current.depth + 1 });
89
+ pending.push({ value, shape: childShape(current.shape, name) });
84
90
  }
85
91
  }
86
- return jsonShapeSchema.parse({
92
+ // Preorder over sorted siblings gives canonical paths without repeatedly
93
+ // comparing their shared prefixes. Each returned path owns its segments.
94
+ const properties = [];
95
+ const shapes = orderedChildren(rootShape);
96
+ while (shapes.length > 0) {
97
+ const shape = shapes.pop();
98
+ if (shape === undefined)
99
+ break;
100
+ properties.push({
101
+ path: shape.path.map((segment) => ({ ...segment })),
102
+ types: [...shape.types].sort(),
103
+ observations: shape.observations,
104
+ });
105
+ for (const child of orderedChildren(shape))
106
+ shapes.push(child);
107
+ }
108
+ return {
87
109
  root_type: jsonValueType(root),
88
110
  node_count: nodeCount,
89
111
  max_depth_observed: maxDepthObserved,
90
- properties: [...properties.values()]
91
- .map((value) => ({
92
- path: value.path,
93
- types: [...value.types].sort(),
94
- observations: value.observations,
95
- }))
96
- .sort((left, right) => compareShapePaths(left.path, right.path)),
97
- });
112
+ properties,
113
+ };
98
114
  };
99
115
  const jsonValueType = (value) => {
100
116
  if (value === null)
@@ -113,18 +129,13 @@ const jsonValueType = (value) => {
113
129
  }
114
130
  };
115
131
  const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
116
- const compareShapePaths = (left, right) => {
117
- for (let index = 0; index < Math.min(left.length, right.length); index += 1) {
118
- const a = left[index];
119
- const b = right[index];
120
- if (a === undefined || b === undefined)
121
- break;
122
- const order = compareUnicodeCodePoints(a.kind, b.kind) ||
123
- (a.kind === "property" && b.kind === "property"
124
- ? compareUnicodeCodePoints(a.name, b.name)
125
- : 0);
126
- if (order !== 0)
127
- return order;
128
- }
129
- return left.length - right.length;
130
- };
132
+ /** Reverse sibling order for the traversal stack; array elements sort first. */
133
+ const orderedChildren = (node) => [...(node.children ?? [])]
134
+ .sort(([left], [right]) => left === right
135
+ ? 0
136
+ : left === arrayElementKey
137
+ ? 1
138
+ : right === arrayElementKey
139
+ ? -1
140
+ : compareUnicodeCodePoints(right, left))
141
+ .map(([, child]) => child);
@@ -64,6 +64,9 @@ export function* jsonValueValidationSteps(root) {
64
64
  return finish(undefined);
65
65
  }
66
66
  const preserveJsonValue = (value) => {
67
+ const immutableCandidate = value;
68
+ if (isImmutableJsonSnapshot(immutableCandidate))
69
+ return value;
67
70
  if (Array.isArray(value))
68
71
  return value.map(preserveJsonValue);
69
72
  if (value !== null && typeof value === "object")