rea-agents 6.5.0 → 6.7.0

package/dist/dotnet/ManagedTypeReferences.js

@@ -0,0 +1,94 @@
+import { managedDecodeBudget } from "./ManagedDecodeBudget.js";
+import { metadataCodedTokenInvalidReason, metadataRowCursor, metadataToken, readMetadataString, } from "./ManagedMetadataHeaps.js";
+import { readManagedValue } from "./ManagedReaderFailure.js";
+import { metadataRowOffset } from "./ManagedMetadataLayout.js";
+/** Own each TypeRef source tuple and scope validation once per inspection. */
+export const managedTypeReferences = (bytes, layout, issues) => {
+    const rows = new Map();
+    const names = new Map();
+    const checked = new Map();
+    const read = (row) => {
+        const cached = rows.get(row);
+        if (cached !== undefined)
+            return cached;
+        // Admit the parsed row, validation entry and bounded walk bookkeeping.
+        managedDecodeBudget(layout).reserve(384, null);
+        const value = readManagedValue(() => {
+            const cursor = metadataRowCursor(bytes, layout, 1, row);
+            const raw = cursor.readIndex(layout.codedIndexSize("ResolutionScope"));
+            const reason = metadataCodedTokenInvalidReason(raw, 2, [0, 26, 35, 1], layout.rowCounts);
+            if (reason !== null)
+                issues.push({
+                    code: "invalid-row",
+                    scope: `metadata.TypeRef:${metadataToken(1, row)}`,
+                    offset: cursor.start,
+                    detail: `TypeRef ResolutionScope coded index 0x${raw.toString(16)} is invalid: ${reason}`,
+                });
+            return {
+                nameIndex: cursor.readIndex(layout.stringIndexSize),
+                namespaceIndex: cursor.readIndex(layout.stringIndexSize),
+                enclosingRow: raw !== 0 && (raw & 3) === 3 ? Math.floor(raw / 4) : null,
+                scopeValid: reason === null,
+            };
+        }, issues) ?? null;
+        rows.set(row, value);
+        return value;
+    };
+    const validate = (row) => {
+        const prior = checked.get(row);
+        if (prior !== undefined)
+            return prior;
+        const path = [];
+        const seen = new Set();
+        let current = row;
+        let valid = true;
+        while (current !== null) {
+            const known = checked.get(current);
+            if (known !== undefined) {
+                valid = known;
+                break;
+            }
+            if (seen.has(current)) {
+                issues.push({
+                    code: "invalid-row",
+                    scope: `metadata.TypeRef:${metadataToken(1, current)}`,
+                    offset: metadataRowOffset(layout, 1, current),
+                    detail: "TypeRef ResolutionScope chain contains a cycle",
+                });
+                valid = false;
+                break;
+            }
+            seen.add(current);
+            path.push(current);
+            const value = read(current);
+            if (value === null || !value.scopeValid) {
+                valid = false;
+                break;
+            }
+            current = value.enclosingRow;
+        }
+        for (const visited of path)
+            checked.set(visited, valid);
+        return valid;
+    };
+    return (row) => {
+        const cached = names.get(row);
+        if (cached !== undefined)
+            return cached;
+        const value = read(row);
+        if (value === null)
+            return null;
+        const scopeValid = validate(row);
+        // Scope validation loads only scalar row facts. The digest owner's nesting
+        // cap determines which names are requested, rather than preloading parents.
+        managedDecodeBudget(layout).reserve(128, null);
+        const named = readManagedValue(() => ({
+            namespace: readMetadataString(bytes, layout, value.namespaceIndex, layout.strings.size),
+            name: readMetadataString(bytes, layout, value.nameIndex, layout.strings.size),
+            enclosingRow: value.enclosingRow,
+            scopeValid,
+        }), issues) ?? null;
+        names.set(row, named);
+        return named;
+    };
+};

package/dist/electron/ElectronFuseFailures.js

@@ -0,0 +1,105 @@
+import { ArtifactReaderFailure } from "../artifacts/ArtifactReader.js";
+import { ArtifactFileCleanupFailure, artifactFileCancellationCause, bindArtifactFileCleanup, } from "../artifacts/ArtifactFileOperation.js";
+import { ProviderCleanupError } from "../domain/providerCleanupError.js";
+import { analysisErrorWithCleanupFailure } from "../domain/analysisErrorCleanup.js";
+import { regularFileCancellation } from "../filesystem/OwnedRegularFile.js";
+import { AnalysisError } from "../domain/analysisErrorBase.js";
+import { AnalysisAccessDeniedError, AnalysisArtifactChangedError, AnalysisCancelledError, AnalysisInputError, AnalysisOutputError, AnalysisResourceConstraintError, AnalysisUnsupportedTargetError, } from "../domain/analysisErrorCore.js";
+import { ProviderAdapterError } from "../domain/providerAdapterError.js";
+import { ZodError } from "zod";
+import { RegularFileChangedError, NonRegularFileReadError, } from "../filesystem/RegularFile.js";
+import { ElectronFusePathFailure } from "./ElectronFusePath.js";
+import { ElectronFuseFormatFailure, ElectronFuseResourceFailure, } from "./ElectronFuseReader.js";
+/** Bundled fuse-wire reader. It does not flip fuses or launch the application. */
+export const ELECTRON_FUSE_PROVIDER_IDENTITY = {
+    id: "electron-fuses",
+    name: "REA Electron fuse reader",
+    version: "1",
+};
+const OPERATION = "inspect_electron_fuses";
+/** Translate the shared fuse reader without replacing its producing outcome or cleanup owner. */
+export const electronFuseFailure = (cause, path, operation = OPERATION) => {
+    if (cause instanceof AnalysisError)
+        return cause;
+    if (cause instanceof ArtifactReaderFailure && cause.cleanup !== undefined) {
+        const cleanup = new ProviderCleanupError(ELECTRON_FUSE_PROVIDER_IDENTITY.id, cause.cleanup.resources, { reason: cause.cleanup.reason }, { operation, cause });
+        bindArtifactFileCleanup(cause, cleanup);
+        if (cause instanceof ArtifactFileCleanupFailure) {
+            const outcome = cause.fileCleanupFailure.outcome;
+            const primary = outcome.kind === "failed"
+                ? electronFuseFailure(outcome.cause, path, operation)
+                : cause.fileCleanupFailure.completionCancellation === undefined
+                    ? undefined
+                    : new AnalysisCancelledError(operation, {
+                        cause: cause.fileCleanupFailure.completionCancellation.reason,
+                    });
+            if (primary !== undefined)
+                return analysisErrorWithCleanupFailure(primary, cleanup, operation).bindCleanupDependencies([primary, cleanup]);
+        }
+        return cleanup;
+    }
+    if (cause instanceof ArtifactReaderFailure && cause.reason === "cancelled")
+        return new AnalysisCancelledError(operation, {
+            cause: artifactFileCancellationCause(cause),
+        });
+    const cancellation = regularFileCancellation(cause);
+    if (cancellation !== undefined)
+        return new AnalysisCancelledError(operation, {
+            cause: cancellation.reason,
+        });
+    if (cause instanceof ElectronFusePathFailure)
+        return new AnalysisInputError(operation, { cause }, [
+            { path: ["path"], reason: cause.reason, message: cause.message },
+        ]);
+    if (cause instanceof ElectronFuseResourceFailure)
+        return new AnalysisResourceConstraintError(operation, cause.boundary === "file-size" ? "file-size" : "capacity", cause.message, cause.boundary === "file-size"
+            ? { maximum_input_bytes: 1024 * 1024 * 1024 }
+            : { maximum_sentinels_per_slice: 32 }, { cause });
+    if (cause instanceof ElectronFuseFormatFailure)
+        return cause.kind === "unsupported"
+            ? new AnalysisUnsupportedTargetError(operation, path, cause.message, {
+                cause,
+            })
+            : new AnalysisInputError(operation, { cause }, [
+                {
+                    path: ["path"],
+                    reason: "invalid_format",
+                    message: `Selected artifact ${path}: ${cause.message}`,
+                },
+            ]);
+    if (cause instanceof RegularFileChangedError)
+        return new AnalysisArtifactChangedError(operation, path, cause.message, {
+            cause,
+        });
+    if (cause instanceof NonRegularFileReadError)
+        return new AnalysisInputError(operation, { cause }, [
+            {
+                path: ["path"],
+                reason: "invalid_format",
+                message: cause.message,
+            },
+        ]);
+    if (cause instanceof ZodError)
+        return new AnalysisOutputError(operation, "Electron fuse reader produced a report outside its schema.", { cause });
+    if (cause instanceof Error && "code" in cause) {
+        if (cause.code === "EACCES" || cause.code === "EPERM")
+            return new AnalysisAccessDeniedError(operation, path, cause.code, {
+                cause,
+            });
+        if (["ENOENT", "ENOTDIR", "ELOOP", "ENAMETOOLONG"].includes(String(cause.code)))
+            return new AnalysisInputError(operation, { cause }, [
+                {
+                    path: ["path"],
+                    reason: "invalid_value",
+                    message: `Selected artifact could not be read (${String(cause.code)}): ${path}.`,
+                },
+            ]);
+    }
+    return new ProviderAdapterError(ELECTRON_FUSE_PROVIDER_IDENTITY.id, operation, {
+        cause,
+        diagnostics: {
+            path,
+            reason: cause instanceof Error ? cause.message : String(cause),
+        },
+    });
+};

package/dist/electron/ElectronFusePath.js

@@ -1,3 +1,4 @@
+import { assertArtifactReadActive } from "../artifacts/ArtifactFileOperation.js";
 import { lstat, readlink } from "node:fs/promises";
 import { basename, dirname, isAbsolute, sep } from "node:path";
 import { isPathWithinRoot } from "../domain/localPath.js";
@@ -18,7 +19,7 @@ export class ElectronFusePathFailure extends Error {
  * binary reached through `Versions/Current` without leaving the framework.
  */
 export const resolveElectronFuseTarget = async (selectedPath, signal) => {
-    signal?.throwIfAborted();
+    assertArtifactReadActive(signal);
     const metadata = await lstat(selectedPath, { bigint: true });
     let file;
     if (metadata.isSymbolicLink())
@@ -67,7 +68,7 @@ const resolveDirectorySuffix = async (selectedPath, signal) => {
     const pending = [];
     const nodes = [];
     while (true) {
-        signal?.throwIfAborted();
+        assertArtifactReadActive(signal);
         const name = basename(path);
         // lstat("link/") follows a link; inspect the named component itself.
         if (name !== "")
@@ -114,7 +115,7 @@ const resolveInside = async (root, relativePath, signal) => {
     let hops = 0;
     let last;
     while (pending.length > 0) {
-        signal?.throwIfAborted();
+        assertArtifactReadActive(signal);
         const segment = pending.shift() ?? "";
         if (segment === ".")
             continue;

package/dist/electron/ElectronFuseProvider.js

@@ -1,113 +1,88 @@
-import { AnalysisError } from "../domain/analysisErrorBase.js";
-import { AnalysisAccessDeniedError, AnalysisArtifactChangedError, AnalysisCancelledError, AnalysisInputError, AnalysisOutputError, AnalysisResourceConstraintError, AnalysisUnsupportedTargetError, } from "../domain/analysisErrorCore.js";
+import { createElectronFuseEvidence } from "../domain/electron/electronFuseEvidence.js";
+import { ArtifactResourceScope } from "../artifacts/ArtifactResourceScope.js";
+import { assertArtifactReadActive, ArtifactFileCancelled, ArtifactFileCleanupFailure, } from "../artifacts/ArtifactFileOperation.js";
+import { AnalysisOutputError } from "../domain/analysisErrorCore.js";
 import { describeElectronFuseFindings, electronFuseReportSchema, } from "../domain/electron/electronFuses.js";
-import { ProviderAdapterError } from "../domain/providerAdapterError.js";
 import { err, ok } from "../domain/result.js";
-import { ZodError } from "zod";
-import { RegularFileChangedError } from "../filesystem/RegularFile.js";
-import { NonRegularFileReadError } from "../filesystem/RegularFile.js";
-import { ElectronFusePathFailure, resolveElectronFuseTarget, } from "./ElectronFusePath.js";
-import { electronFuseReadLimitation, ElectronFuseFormatFailure, ElectronFuseResourceFailure, readElectronFuseImage, } from "./ElectronFuseReader.js";
-/** Bundled fuse-wire reader. It does not flip fuses or launch the application. */
-export const ELECTRON_FUSE_PROVIDER_IDENTITY = {
-    id: "electron-fuses",
-    name: "REA Electron fuse reader",
-    version: "1",
-};
+import { resolveElectronFuseTarget } from "./ElectronFusePath.js";
+import { electronFuseReadLimitation, readElectronFuseImage, } from "./ElectronFuseReader.js";
+import { ELECTRON_FUSE_PROVIDER_IDENTITY, electronFuseFailure, } from "./ElectronFuseFailures.js";
+export { ELECTRON_FUSE_PROVIDER_IDENTITY };
 const OPERATION = "inspect_electron_fuses";
 /** Read packaged Electron fuse wires from one selected local file or app bundle. */
 export class ElectronFuseProvider {
     identity = ELECTRON_FUSE_PROVIDER_IDENTITY;
+    #resources = new ArtifactResourceScope();
+    /** Retry the same failed descriptor owners, awaiting active reads first. */
+    async close() {
+        try {
+            await this.#resources.close();
+        }
+        catch (cause) {
+            throw electronFuseFailure(cause, "artifact-resources");
+        }
+    }
     async inspect(input, options) {
         try {
-            options?.signal?.throwIfAborted();
+            return await this.#resources.run(() => this.#inspectFile(input, options));
+        }
+        catch (cause) {
+            return err(electronFuseFailure(cause, input.path));
+        }
+    }
+    async #inspectFile(input, options) {
+        let resolvedPath = input.path;
+        let completed;
+        try {
+            assertArtifactReadActive(options?.signal);
             const located = await resolveElectronFuseTarget(input.path, options?.signal);
-            options?.signal?.throwIfAborted();
+            assertArtifactReadActive(options?.signal);
+            resolvedPath = located.file.path;
             const image = await readElectronFuseImage(located.file.path, {
+                resources: this.#resources,
                 selection: located.file,
                 ...(options?.signal === undefined ? {} : { signal: options.signal }),
             });
-            const findings = describeElectronFuseFindings(image.slices, image.format);
-            const parsed = electronFuseReportSchema.safeParse({
-                artifact: {
-                    selected_path: located.selectedPath,
-                    resolved_path: located.file.path,
-                    sha256: image.sha256,
-                    bytes: image.bytes,
-                    format: image.format,
-                },
-                slices: image.slices,
-                runtime_implications: findings.runtime_implications,
-                limitations: [...findings.limitations, electronFuseReadLimitation()],
-            });
-            if (!parsed.success)
-                throw new AnalysisOutputError(OPERATION, "Electron fuse reader produced a report outside its schema.", { cause: parsed.error });
-            options?.signal?.throwIfAborted();
-            return ok(parsed.data);
+            completed = reportFor(image, located.selectedPath, resolvedPath);
+            assertArtifactReadActive(options?.signal);
+            return ok(completed);
         }
         catch (cause) {
-            return err(failureFor(cause, input.path, options?.signal));
+            const failure = electronFuseFailure(cause, input.path);
+            // Only this reader's completed physical outcome supplies partial fuse facts.
+            const outcome = cause instanceof ArtifactFileCleanupFailure
+                ? cause
+                    .fileCleanupFailure.outcome
+                : cause instanceof ArtifactFileCancelled
+                    ? cause
+                        .fileCancellation.outcome
+                    : undefined;
+            const report = completed ??
+                (outcome?.kind === "completed"
+                    ? reportFor(outcome.value, input.path, resolvedPath)
+                    : undefined);
+            if (report !== undefined) {
+                failure.retainPartialObservation(createElectronFuseEvidence(input, report, this.identity));
+            }
+            return err(failure);
         }
     }
 }
-const failureFor = (cause, path, signal) => {
-    if (cause instanceof AnalysisError)
-        return cause;
-    if (signal?.aborted)
-        return new AnalysisCancelledError(OPERATION);
-    if (cause instanceof ElectronFusePathFailure)
-        return new AnalysisInputError(OPERATION, { cause }, [
-            { path: ["path"], reason: cause.reason, message: cause.message },
-        ]);
-    if (cause instanceof ElectronFuseResourceFailure)
-        return new AnalysisResourceConstraintError(OPERATION, cause.boundary === "file-size" ? "file-size" : "capacity", cause.message, cause.boundary === "file-size"
-            ? { maximum_input_bytes: 1024 * 1024 * 1024 }
-            : { maximum_sentinels_per_slice: 32 }, { cause });
-    if (cause instanceof ElectronFuseFormatFailure)
-        return cause.kind === "unsupported"
-            ? new AnalysisUnsupportedTargetError(OPERATION, path, cause.message, {
-                cause,
-            })
-            : new AnalysisInputError(OPERATION, { cause }, [
-                {
-                    path: ["path"],
-                    reason: "invalid_format",
-                    message: `Selected artifact ${path}: ${cause.message}`,
-                },
-            ]);
-    if (cause instanceof RegularFileChangedError)
-        return new AnalysisArtifactChangedError(OPERATION, path, cause.message, {
-            cause,
-        });
-    if (cause instanceof NonRegularFileReadError)
-        return new AnalysisInputError(OPERATION, { cause }, [
-            {
-                path: ["path"],
-                reason: "invalid_format",
-                message: cause.message,
-            },
-        ]);
-    if (cause instanceof ZodError)
-        return new AnalysisOutputError(OPERATION, "Electron fuse reader produced a report outside its schema.", { cause });
-    if (cause instanceof Error && "code" in cause) {
-        if (cause.code === "EACCES" || cause.code === "EPERM")
-            return new AnalysisAccessDeniedError(OPERATION, path, cause.code, {
-                cause,
-            });
-        if (["ENOENT", "ENOTDIR", "ELOOP", "ENAMETOOLONG"].includes(String(cause.code)))
-            return new AnalysisInputError(OPERATION, { cause }, [
-                {
-                    path: ["path"],
-                    reason: "invalid_value",
-                    message: `Selected artifact could not be read (${String(cause.code)}): ${path}.`,
-                },
-            ]);
-    }
-    return new ProviderAdapterError(ELECTRON_FUSE_PROVIDER_IDENTITY.id, OPERATION, {
-        cause,
-        diagnostics: {
-            path,
-            reason: cause instanceof Error ? cause.message : String(cause),
+const reportFor = (image, selectedPath, resolvedPath) => {
+    const findings = describeElectronFuseFindings(image.slices, image.format);
+    const parsed = electronFuseReportSchema.safeParse({
+        artifact: {
+            selected_path: selectedPath,
+            resolved_path: resolvedPath,
+            sha256: image.sha256,
+            bytes: image.bytes,
+            format: image.format,
         },
+        slices: image.slices,
+        runtime_implications: findings.runtime_implications,
+        limitations: [...findings.limitations, electronFuseReadLimitation()],
     });
+    if (!parsed.success)
+        throw new AnalysisOutputError(OPERATION, "Electron fuse reader produced a report outside its schema.", { cause: parsed.error });
+    return parsed.data;
 };

package/dist/electron/ElectronFuseReader.js

@@ -1,8 +1,12 @@
+import { readElfFixedHeader } from "../domain/elfFixedHeader.js";
+import { decodePeMachine } from "../domain/peMachine.js";
 import { createHash } from "node:crypto";
 import { lstat } from "node:fs/promises";
 import { hasMachoMagic, readMachoImage, } from "../artifacts/apple/MachoLoadCommandReader.js";
 import { electronFuseName, electronFuseState, ELECTRON_FUSE_SENTINEL, } from "../domain/electron/electronFuses.js";
-import { openRegularFile, RegularFileChangedError, sameRegularFileState, } from "../filesystem/RegularFile.js";
+import { RegularFileChangedError, sameRegularFileState, } from "../filesystem/RegularFile.js";
+import { ArtifactResourceScope } from "../artifacts/ArtifactResourceScope.js";
+import { assertArtifactReadActive, withArtifactRegularFile, } from "../artifacts/ArtifactFileOperation.js";
 /** Admission and search bounds for one Electron executable. */
 export const ELECTRON_FUSE_LIMITS = {
     maximumFileBytes: 1024 * 1024 * 1024,
@@ -36,13 +40,13 @@ export class ElectronFuseResourceFailure extends Error {
  */
 export const readElectronFuseImage = async (path, options) => {
     const signal = options?.signal;
-    signal?.throwIfAborted();
+    assertArtifactReadActive(signal);
     const selection = options?.selection;
     const recheckPath = async (candidate) => {
-        signal?.throwIfAborted();
+        assertArtifactReadActive(signal);
         try {
             const metadata = await lstat(candidate, { bigint: true });
-            signal?.throwIfAborted();
+            assertArtifactReadActive(signal);
             return metadata;
         }
         catch (cause) {
@@ -80,15 +84,14 @@ export const readElectronFuseImage = async (path, options) => {
         chunkBytes < 1 ||
         chunkBytes > ELECTRON_FUSE_LIMITS.chunkBytes)
         throw new TypeError(`chunkBytes must be an integer between 1 and ${ELECTRON_FUSE_LIMITS.chunkBytes}.`);
-    const handle = await openRegularFile(path, { symlinks: "reject", signal });
-    try {
-        const opened = await handle.stat({ bigint: true });
+    return withArtifactRegularFile(path, options?.resources ?? new ArtifactResourceScope(), signal, async (owned) => {
+        const opened = await owned.stat({ bigint: true });
         if (!sameRegularFileState(before, opened))
             throw new RegularFileChangedError(path);
         await assertPathNodes();
-        const readAt = readerFor(handle, size, path, signal);
+        const readAt = readerFor(owned, size, path, signal);
         const container = await identifyContainer(readAt, size, path);
-        const scanned = await scanSlices(handle, path, size, container.slices, chunkBytes, signal);
+        const scanned = await scanSlices(owned, path, size, container.slices, chunkBytes, signal);
         const current = await recheckPath(path);
         if (!sameRegularFileState(before, current))
             throw new RegularFileChangedError(path);
@@ -99,15 +102,12 @@ export const readElectronFuseImage = async (path, options) => {
             format: container.format,
             slices: scanned.slices,
         };
-    }
-    finally {
-        await handle.close();
-    }
+    });
 };
 /** Sentence describing the file and sentinel bounds enforced by this reader. */
 export const electronFuseReadLimitation = () => `The selected file is admitted as one regular file of at most 1 GiB. Sentinel search uses ${ELECTRON_FUSE_LIMITS.chunkBytes}-byte windows, and each slice keeps at most ${ELECTRON_FUSE_LIMITS.maximumSentinelsPerSlice} sentinels.`;
 const readerFor = (handle, size, path, signal) => async (offset, length) => {
-    signal?.throwIfAborted();
+    assertArtifactReadActive(signal);
     if (length <= 0 || offset < 0 || offset >= size)
         return new Uint8Array();
     const bounded = Math.min(length, size - offset);
@@ -121,15 +121,28 @@ const identifyContainer = async (readAt, size, path) => {
     const head = await readAt(0, Math.min(size, 8));
     if (hasMachoMagic(head))
         return identifyMacho(readAt, size, head, path);
-    if (isElf(head))
+    if (isElf(head)) {
+        const header = await readAt(0, 64);
+        const parsed = readElfFixedHeader(Buffer.from(header), size);
         return {
             format: "elf",
-            slices: [{ index: 0, fileOffset: 0, size, architecture: null }],
+            slices: [
+                {
+                    index: 0,
+                    fileOffset: 0,
+                    size,
+                    architecture: parsed.ok ? parsed.value.architecture : null,
+                },
+            ],
         };
-    if (await isPe(readAt, size))
+    }
+    const pe = await identifyPe(readAt, size);
+    if (pe !== undefined)
         return {
             format: "pe",
-            slices: [{ index: 0, fileOffset: 0, size, architecture: null }],
+            slices: [
+                { index: 0, fileOffset: 0, size, architecture: pe.architecture },
+            ],
         };
     throw new ElectronFuseFormatFailure("unsupported", `Selected artifact ${path} does not contain a Mach-O, ELF, or PE container.`);
 };
@@ -176,7 +189,7 @@ const scanSlices = async (handle, path, size, ranges, chunkBytes, signal) => {
     const chunk = Buffer.allocUnsafe(chunkBytes);
     let position = 0;
     while (position < size) {
-        signal?.throwIfAborted();
+        assertArtifactReadActive(signal);
         const length = Math.min(chunkBytes, size - position);
         const read = await handle.read(chunk, 0, length, position);
         if (read.bytesRead !== length)
@@ -275,7 +288,7 @@ const parseWire = async (handle, path, sentinelOffset, sliceEnd, signal) => {
     };
 };
 const readExact = async (handle, path, offset, length, signal) => {
-    signal?.throwIfAborted();
+    assertArtifactReadActive(signal);
     const buffer = Buffer.alloc(length);
     const read = await handle.read(buffer, 0, length, offset);
     if (read.bytesRead !== length)
@@ -293,24 +306,27 @@ const isFat = (head) => {
     const magic = Buffer.from(head.buffer, head.byteOffset, 4).readUInt32BE(0);
     return FAT_MAGICS.has(magic);
 };
-const isPe = async (readAt, size) => {
+const identifyPe = async (readAt, size) => {
     if (size < 64)
-        return false;
+        return undefined;
     const header = await readAt(0, 64);
     if (header.length < 64 || header[0] !== 0x4d || header[1] !== 0x5a)
-        return false;
+        return undefined;
     const offset = Buffer.from(header.buffer, header.byteOffset, header.byteLength).readUInt32LE(0x3c);
     if (!Number.isSafeInteger(offset) ||
         offset < 64 ||
         offset > ELECTRON_FUSE_LIMITS.maximumPeHeaderOffset ||
         offset > size - 4)
-        return false;
-    const signature = await readAt(offset, 4);
-    return (signature.length === 4 &&
-        signature[0] === 0x50 &&
-        signature[1] === 0x45 &&
-        signature[2] === 0 &&
-        signature[3] === 0);
+        return undefined;
+    const bytes = Buffer.from(await readAt(offset, 24));
+    if (bytes.length < 4 || bytes.readUInt32LE(0) !== 0x00004550)
+        return undefined;
+    // A signature establishes the existing scan boundary; only a complete COFF
+    // header establishes its machine. Managed OS overrides need separate proof.
+    const machine = bytes.length === 24 ? decodePeMachine(bytes.readUInt16LE(4)) : undefined;
+    return {
+        architecture: machine?.nativeOsOverride === false ? machine.architecture : null,
+    };
 };
 const isMissingPath = (cause) => cause instanceof Error &&
     "code" in cause &&

package/dist/evm/EvmoleFailures.js

@@ -30,6 +30,7 @@ export const evmInterfaceFailure = (cause, phase, path, workerLimits, limiter =
             }, { operation: "inspect_evm_interface", cause });
         if (cause.reason === "cancelled")
             return new AnalysisCancelledError("inspect_evm_interface", {
+                cause: cause.cancellation?.reason,
                 ...outputOptions,
                 ...cleanupOptions,
             });

package/dist/evm/EvmoleInterfaceProvider.js

@@ -11,7 +11,7 @@ import { ArtifactReaderFailure } from "../artifacts/ArtifactReader.js";
 import { OwnedCommandFailure, ownedCommandResources, } from "../process/OwnedCommand.js";
 import { AnalysisCancelledError, AnalysisCapabilityUnavailableError, AnalysisUnsupportedTargetError, AnalysisInputError, AnalysisOutputError, } from "../domain/analysisErrorCore.js";
 import { projectAnalysisError } from "../domain/analysisErrorProjection.js";
-import { createEvidence } from "../domain/evidence.js";
+import { evmInterfaceEvidence } from "../application/evm/EvmInterfaceEvidence.js";
 import { evmInterfaceSchema } from "../domain/evm/evmInterface.js";
 import { solidityMetadataSchema } from "../domain/evm/solidityMetadata.js";
 import { ProviderAdapterError } from "../domain/providerAdapterError.js";
@@ -54,18 +54,9 @@ const compactErrorProjection = (error) => {
     delete details.captured_output;
     return { ...projection, details };
 };
-const evmExecutionEvidence = (input, execution) => createEvidence(execution.subject ?? undefined, execution.provider, {
-    operation: OPERATION,
-    parameters: input,
-    result: execution.result,
-    ...(execution.rawResult === null ? {} : { rawResult: execution.rawResult }),
-    confidence: "inferred",
-    locations: execution.locations,
-    limitations: execution.limitations,
-});
 const evmCleanupFailure = (input, result, resources, reason, output, cause) => {
     const partialObservation = result.ok
-        ? evmExecutionEvidence(input, result.value)
+        ? evmInterfaceEvidence(input, result.value)
         : result.error.partialObservation;
     const capturedOutput = result.ok
         ? output
@@ -128,7 +119,9 @@ export class EvmoleInterfaceProvider {
         let result;
         try {
             if (options?.signal?.aborted)
-                throw new AnalysisCancelledError(OPERATION);
+                throw new AnalysisCancelledError(OPERATION, {
+                    cause: options.signal.reason,
+                });
             if (process.platform !== "linux" || process.arch !== "x64")
                 throw new AnalysisCapabilityUnavailableError(EVMOLE_PROVIDER_IDENTITY.id, OPERATION, HOST_REQUIREMENT, { userMessage: HOST_REQUIREMENT });
             try {
@@ -219,7 +212,7 @@ export class EvmoleInterfaceProvider {
                 const cleanup = cause instanceof ArtifactReaderFailure ? cause.cleanup : undefined;
                 if (options?.signal?.aborted)
                     throw new AnalysisCancelledError(OPERATION, {
-                        cause,
+                        cause: options.signal.reason,
                         capturedOutput,
                         ...(cleanup === undefined ? {} : { cleanup }),
                     });
@@ -379,9 +372,13 @@ export class EvmoleInterfaceProvider {
             }
         }
         return result.ok && options?.signal?.aborted
-            ? err(new AnalysisCancelledError(OPERATION, retainedOutput === undefined
-                ? undefined
-                : { capturedOutput: retainedOutput }))
+            ? err(new AnalysisCancelledError(OPERATION, {
+                cause: options.signal.reason,
+                partialObservation: evmInterfaceEvidence(input, result.value),
+                ...(retainedOutput === undefined
+                    ? {}
+                    : { capturedOutput: retainedOutput }),
+            }))
             : result;
     }
     async close() {