reverseport 0.0.0-stage → 1.2.0

package/bridge/mitmproxy/capture.py

@@ -0,0 +1,208 @@
+"""REA offline adapter using mitmproxy's unchanged native tnetstring decoder.
+
+No FlowReader migrations, HAR conversion, proxy listener, or target requests.
+The containing mitmdump process and its configuration directory are REA-owned.
+"""
+
+import base64
+import hashlib
+import json
+import math
+import re
+import resource
+from pathlib import Path
+
+from mitmproxy import ctx, version
+from mitmproxy.io import tnetstring
+
+PROFILE = "12.2.3"
+OUTPUT_BYTES = 96 * 1024 * 1024
+CREDENTIALS = {b"authorization", b"proxy-authorization", b"cookie", b"set-cookie"}
+
+
+class CaptureFailure(Exception):
+    def __init__(self, reason, message, pointer=""):
+        self.reason, self.pointer = reason, pointer
+        super().__init__(message)
+
+
+def pointer(parent, key):
+    return parent + "/" + str(key).replace("~", "~0").replace("/", "~1")
+
+
+class BoundedReader:
+    """Refuse malicious declared lengths before the upstream parser allocates."""
+    def __init__(self, handle, size):
+        self.handle, self.size = handle, size
+
+    def read(self, count):
+        if count < 0 or count > self.size - self.handle.tell():
+            raise CaptureFailure("format", "Native record declares bytes beyond the retained capture.")
+        return self.handle.read(count)
+
+
+def project_record(state, secrets):
+    binaries, numbers, redactions = [], [], []
+    byte_secrets = []
+    for secret in secrets:
+        try:
+            byte_secrets.append(secret.encode("utf-8", errors="strict"))
+        except UnicodeEncodeError:
+            # Non-scalar JSON strings have no UTF-8 byte representation.
+            # Keep them in secrets for the ordinary string projection.
+            pass
+
+    def redact(text, path, original):
+        if any(secret in text or secret in original for secret in secrets):
+            redactions.append({"pointer": path, "reason": "explicit-sensitive-value"})
+            return None
+        return text
+
+    def transport_value(value, path, transport_url):
+        if not (transport_url or re.fullmatch(r"/(?:backup/)*request/(?:path|authority)", path)):
+            return value, False
+        binary = isinstance(value, bytes)
+        pattern = rb"^([\x00-\x20]*(?:[a-z][a-z0-9+.-]*:)?//)[^/?#]*@" if binary else r"^([\x00-\x20]*(?:[a-z][a-z0-9+.-]*:)?//)[^/?#]*@"
+        replacement = rb"\1" if binary else r"\1"
+        separator = b"@" if binary else "@"
+        safe_url = re.sub(pattern, replacement, value, flags=re.I)
+        if path.endswith("/authority") and separator in safe_url:
+            safe_url = safe_url.rsplit(separator, 1)[1]
+        changed = safe_url != value
+        if changed:
+            redactions.append({"pointer": path, "reason": "transport-credential"})
+        return safe_url, changed
+
+    def validate_omitted(value, path, depth):
+        before = len(binaries), len(numbers), len(redactions)
+        visit(value, path, depth)
+        del binaries[before[0]:]
+        del numbers[before[1]:]
+        del redactions[before[2]:]
+
+    def visit(value, path, depth=0, credential=False, transport_url=False):
+        if depth > 64:
+            raise CaptureFailure("input-limit", "Native capture exceeds the 64-level evidence nesting budget.", path)
+        if credential:
+            validate_omitted(value, path, depth)
+            redactions.append({"pointer": path, "reason": "transport-credential"})
+            if isinstance(value, bytes):
+                binaries.append({"pointer": path, "representation": "producer-bytes", "state": "redacted", "content_base64": None, "bytes": None, "sha256": None})
+            return None
+        if isinstance(value, bytes):
+            safe_bytes, credential_url = transport_value(value, path, transport_url)
+            content_base64 = base64.b64encode(value).decode("ascii")
+            digest = hashlib.sha256(value).hexdigest()
+            hidden = any(secret in value or secret in safe_bytes for secret in byte_secrets) or any(secret in content_base64 or secret in digest for secret in secrets)
+            safe_text = None
+            try:
+                safe_text = safe_bytes.decode("utf-8", errors="strict")
+            except UnicodeDecodeError:
+                pass
+            if hidden:
+                redactions.append({"pointer": path, "reason": "explicit-sensitive-value"})
+            exclude = hidden or credential_url
+            binaries.append({"pointer": path, "representation": "producer-bytes", "state": "redacted" if exclude else "retained", "content_base64": None if exclude else content_base64, "bytes": None if exclude else len(value), "sha256": None if exclude else digest})
+            if hidden:
+                return None
+            return safe_text
+        if isinstance(value, str):
+            safe_text, _ = transport_value(value, path, transport_url)
+            return redact(safe_text, path, value)
+        if isinstance(value, bool) or value is None:
+            return value
+        if isinstance(value, (int, float)):
+            literal = repr(value)
+            if any(secret in literal for secret in secrets):
+                redactions.append({"pointer": path, "reason": "explicit-sensitive-value"})
+                return None
+            numbers.append({"pointer": path, "producer_type": "integer" if isinstance(value, int) else "float", "literal": literal})
+            return value if (abs(value) <= 9007199254740991 if isinstance(value, int) else math.isfinite(value)) else None
+        if isinstance(value, (list, tuple)):
+            fields = re.fullmatch(r"/(?:backup/)*(?:request|response)/(?:headers|trailers)", path)
+            if fields:
+                result = []
+                for index, field in enumerate(value):
+                    if not isinstance(field, (list, tuple)) or len(field) != 2 or not isinstance(field[0], bytes):
+                        raise CaptureFailure("format", "Native header/trailer is not an ordered byte pair.", pointer(path, index))
+                    result.append([visit(field[0], pointer(pointer(path, index), 0), depth + 2), visit(field[1], pointer(pointer(path, index), 1), depth + 2, field[0].lower() in CREDENTIALS, field[0].lower() in {b"location", b"referer", b"origin"})])
+                return result
+            return [visit(item, pointer(path, index), depth + 1) for index, item in enumerate(value)]
+        if isinstance(value, dict):
+            result = {}
+            for key, item in value.items():
+                if not isinstance(key, str):
+                    raise CaptureFailure("format", "Native record has a non-string dictionary key.", path)
+                if any(secret in key for secret in secrets):
+                    # Validate the omitted subtree too, then discard all of its
+                    # coordinates rather than inventing a replacement identity.
+                    validate_omitted(item, pointer(path, key), depth + 1)
+                    redactions.append({"pointer": path, "reason": "explicit-sensitive-value", "scope": "property-name"})
+                    continue
+                result[key] = visit(item, pointer(path, key), depth + 1)
+            return result
+        raise CaptureFailure("decoder", "Native parser returned an unexpected value type: " + type(value).__name__ + ".", path)
+
+    return {"reported": visit(state, ""), "binary_fields": binaries, "numeric_literals": numbers, "redactions": redactions}
+
+
+def decode(request):
+    if version.VERSION != PROFILE:
+        raise CaptureFailure("unsupported", "Expected mitmproxy " + PROFILE + "; observed " + version.VERSION + ".")
+    records = []
+    capture = Path(request["snapshot_path"])
+    size = capture.stat().st_size
+    with capture.open("rb") as handle:
+        reader = BoundedReader(handle, size)
+        while handle.tell() < size:
+            start = handle.tell()
+            try:
+                state = tnetstring.load(reader)
+            except CaptureFailure:
+                raise
+            except RecursionError:
+                raise CaptureFailure("input-limit", "Native parser exceeded its recursion budget at byte offset " + str(start) + ".") from None
+            except (ValueError, IndexError, UnicodeError, EOFError):
+                raise CaptureFailure("format", "Malformed native record at byte offset " + str(start) + ".") from None
+            if not isinstance(state, dict):
+                raise CaptureFailure("format", "Native flow record must be a dictionary at byte offset " + str(start) + ".")
+            records.append({"ordinal": len(records), "location": {"kind": "byte-range", "offset": start, "bytes": handle.tell() - start}, **project_record(state, request["sensitive_values"]), "limitations": ["Fields are original native states without FlowReader migration. Binary fields contain exact producer bytes; reported UTF-8 strings for those fields are derived display views. Unknown flow/version extensions are retained without interpretation."]})
+    return {"decoder": {"id": "mitmproxy-native-tnetstring", "name": "REA offline native mitmproxy adapter", "version": PROFILE}, "container": {"reported": None, "numeric_literals": [], "redactions": [], "records_pointer": None}, "total_records": len(records), "records": records}
+
+
+def failure_reply(error):
+    """Keep producer constraints, resource exhaustion and adapter defects distinct."""
+    if isinstance(error, CaptureFailure):
+        return {"ok": False, "reason": error.reason, "message": str(error), "pointer": error.pointer}
+    if isinstance(error, MemoryError):
+        return {"ok": False, "reason": "resource-limit", "message": "Native decoder exhausted its 768 MiB address-space budget.", "pointer": ""}
+    return {"ok": False, "reason": "decoder", "message": "Offline native decoder failed unexpectedly: " + type(error).__name__ + ".", "pointer": ""}
+
+
+class OfflineCapture:
+    def load(self, loader):
+        loader.add_option("rea_request_path", str, "", "REA private offline capture request")
+
+    def running(self):
+        resource.setrlimit(resource.RLIMIT_AS, (768 * 1024 * 1024, 768 * 1024 * 1024))
+        resource.setrlimit(resource.RLIMIT_CPU, (30, 30))
+        resource.setrlimit(resource.RLIMIT_FSIZE, (OUTPUT_BYTES, OUTPUT_BYTES))
+        resource.setrlimit(resource.RLIMIT_CORE, (0, 0))
+        request = json.loads(Path(ctx.options.rea_request_path).read_text(encoding="utf-8"))
+        try:
+            response = {"ok": True, "value": decode(request)}
+        except Exception as error:
+            response = failure_reply(error)
+        try:
+            try:
+                output = json.dumps(response, ensure_ascii=True, allow_nan=False, separators=(",", ":")).encode("ascii")
+            except Exception as error:
+                output = json.dumps(failure_reply(error), separators=(",", ":")).encode("ascii")
+            if len(output) > OUTPUT_BYTES:
+                output = b'{"ok":false,"reason":"limit","message":"Native reply exceeds the complete-evidence output budget.","pointer":""}'
+            Path(request["reply_path"]).write_bytes(output)
+        finally:
+            ctx.master.shutdown()
+
+
+addons = [OfflineCapture()]

package/bridge/native/NativeUIChildren.swift

@@ -0,0 +1,27 @@
+import Foundation
+
+struct ChildBatch<Element> {
+  let values: [Element]
+  let complete: Bool
+}
+
+struct ChildCount {
+  let value: Int?
+  let error: Int32?
+}
+
+func serializeHelperOutput(_ value: Any) throws -> Data {
+  try JSONSerialization.data(withJSONObject: value, options: [.sortedKeys, .withoutEscapingSlashes])
+}
+
+func captureChildCount(status: Int32, success: Int32, value: Int) -> ChildCount {
+  guard status == success else { return ChildCount(value: nil, error: status) }
+  return ChildCount(value: value, error: nil)
+}
+
+func captureChildValues<Element>(requestedCount: Int, copy: () -> [Element]?) -> ChildBatch<Element> {
+  guard requestedCount > 0 else { return ChildBatch(values: [], complete: true) }
+  let returned = copy() ?? []
+  let values = Array(returned.prefix(requestedCount))
+  return ChildBatch(values: values, complete: values.count == requestedCount)
+}

package/bridge/native/ReaNativeUI.swift

@@ -0,0 +1,171 @@
+import AppKit
+import ApplicationServices
+import CryptoKit
+import ScreenCaptureKit
+import Darwin
+
+struct Request: Decodable {
+  var pid: Int32
+  var window_id: UInt32
+  var executable: String
+  var sha256: String
+  var launch_time: Double?
+  var screenshot: Bool
+  var accessibility: Bool
+  var max_nodes: Int
+  var action: Action?
+}
+struct Action: Decodable { var kind: String; var path: [Int]?; var direction: String?; var text: String? }
+struct BoundaryFailure: Error { var code: String; var message: String }
+func fail(_ code: String, _ message: String) throws -> Never { throw BoundaryFailure(code: code, message: message) }
+func attribute(_ element: AXUIElement, _ key: String) -> CFTypeRef? {
+  var value: CFTypeRef?
+  return AXUIElementCopyAttributeValue(element, key as CFString, &value) == .success ? value : nil
+}
+func childCount(_ element: AXUIElement) -> ChildCount {
+  var count = 0
+  let status = AXUIElementGetAttributeValueCount(element, kAXChildrenAttribute as CFString, &count)
+  return captureChildCount(status: status.rawValue, success: AXError.success.rawValue, value: count)
+}
+func children(_ element: AXUIElement, count: Int) -> ChildBatch<AXUIElement> {
+  captureChildValues(requestedCount: count) {
+    var value: CFArray?
+    guard AXUIElementCopyAttributeValues(element, kAXChildrenAttribute as CFString, 0, count, &value) == .success else { return nil }
+    return value as? [AXUIElement]
+  }
+}
+func text(_ element: AXUIElement, _ key: String) -> Any { (attribute(element, key) as? String) ?? NSNull() as Any }
+func windowBounds(_ element: AXUIElement) -> CGRect? {
+  guard let p = attribute(element, kAXPositionAttribute), let s = attribute(element, kAXSizeAttribute),
+    CFGetTypeID(p) == AXValueGetTypeID(), CFGetTypeID(s) == AXValueGetTypeID() else { return nil }
+  var point = CGPoint.zero; var size = CGSize.zero
+  guard AXValueGetValue(p as! AXValue, .cgPoint, &point), AXValueGetValue(s as! AXValue, .cgSize, &size) else { return nil }
+  return CGRect(origin: point, size: size)
+}
+func observe(_ request: Request) async throws -> [String: Any] {
+  guard let app = NSRunningApplication(processIdentifier: request.pid), let url = app.executableURL else {
+    try fail("target-mismatch", "Selected PID does not expose an application executable URL")
+  }
+  guard let canonicalPointer = realpath(url.path, nil) else { try fail("target-mismatch", "Running executable path cannot be resolved") }
+  defer { free(canonicalPointer) }
+  let canonicalExecutable = String(cString: canonicalPointer)
+  guard canonicalExecutable == request.executable else {
+    try fail("target-mismatch", "Selected PID executable \(canonicalExecutable) differs from active target \(request.executable)")
+  }
+  guard let launch = app.launchDate?.timeIntervalSince1970 else {
+    try fail("process-identity-unavailable", "Selected application does not expose a launch time; stable PID reuse checks are unavailable")
+  }
+  if let expected = request.launch_time, expected != launch { try fail("process-replaced", "Selected process was replaced") }
+  let executableSize = (try FileManager.default.attributesOfItem(atPath: url.path)[.size] as? NSNumber)?.int64Value ?? -1
+  guard executableSize >= 0 && executableSize <= 256 * 1024 * 1024 else { try fail("target-limit", "Running executable exceeds the 256 MiB identity-check budget") }
+  let executableBytes = try Data(contentsOf: url, options: .mappedIfSafe)
+  guard SHA256.hash(data: executableBytes).map({ String(format: "%02x", $0) }).joined() == request.sha256 else {
+    try fail("target-mismatch", "Running executable bytes differ from the active target digest")
+  }
+  guard let windows = CGWindowListCopyWindowInfo([.optionIncludingWindow], request.window_id) as? [[String: Any]],
+    windows.count == 1, let window = windows.first,
+    (window[kCGWindowOwnerPID as String] as? NSNumber)?.int32Value == request.pid,
+    (window[kCGWindowLayer as String] as? NSNumber)?.intValue == 0,
+    let boundsDictionary = window[kCGWindowBounds as String] as? [String: Any],
+    let bounds = CGRect(dictionaryRepresentation: boundsDictionary as CFDictionary) else {
+    try fail("window-mismatch", "Selected window is absent or belongs to another process")
+  }
+  if request.screenshot && !CGPreflightScreenCaptureAccess() {
+    try fail("screen-recording-denied", "Grant Screen Recording to the REA host in System Settings > Privacy & Security, then retry; no broad capture fallback is used")
+  }
+  var selected: AXUIElement?
+  if request.accessibility || request.action != nil {
+    guard AXIsProcessTrusted() else { try fail("accessibility-denied", "Grant Accessibility to the REA host in System Settings > Privacy & Security, then retry") }
+    let application = AXUIElementCreateApplication(request.pid)
+    AXUIElementSetMessagingTimeout(application, 2)
+    guard let axWindows = attribute(application, kAXWindowsAttribute) as? [AXUIElement] else {
+      try fail("accessibility-unavailable", "Selected application does not expose accessibility windows")
+    }
+    let matches = axWindows.filter { windowBounds($0) == bounds }
+    guard matches.count == 1 else { try fail("ambiguous-window", "Accessibility window geometry does not identify exactly one selected window; selected CG bounds \(bounds), AX candidates \(axWindows.map { String(describing: windowBounds($0)) })") }
+    selected = matches[0]
+  }
+  if let action = request.action, let root = selected {
+    var element = root
+    for index in action.path ?? [] {
+      var selectedChild: CFArray?
+      let count = childCount(element)
+      guard let available = count.value else {
+        try fail("element-count-unavailable", "Cannot validate selected accessibility path because child count failed with AXError \(count.error ?? -1)")
+      }
+      guard index >= 0 && index < available,
+        AXUIElementCopyAttributeValues(element, kAXChildrenAttribute as CFString, index, 1, &selectedChild) == .success,
+        let item = (selectedChild as? [AXUIElement])?.first else { try fail("element-missing", "Selected accessibility path no longer exists") }
+      element = item
+    }
+    var owner: pid_t = 0
+    guard AXUIElementGetPid(element, &owner) == .success && owner == request.pid else { try fail("element-owner-mismatch", "Selected element belongs to another process") }
+    let outcome: AXError
+    switch action.kind {
+    case "click": outcome = AXUIElementPerformAction(element, kAXPressAction as CFString)
+    case "scroll": outcome = AXUIElementPerformAction(element, (action.direction == "increment" ? kAXIncrementAction : kAXDecrementAction) as CFString)
+    case "key-entry": outcome = AXUIElementSetAttributeValue(element, kAXValueAttribute as CFString, (action.text ?? "") as CFString)
+    default: try fail("unsupported-action", "Only selected-element press, increment/decrement and text-value entry are admitted")
+    }
+    guard outcome == .success else { try fail("action-failed", "Accessibility action failed with AXError \(outcome.rawValue)") }
+  }
+  var nodes: [[String: Any]] = []; var truncated = false; var gaps: [String] = []
+  if request.accessibility, let root = selected {
+    var pending: [(AXUIElement, [Int])] = [(root, [])]
+    while let (element, path) = pending.popLast() {
+      if nodes.count >= request.max_nodes { truncated = true; break }
+      let childCountResult = childCount(element)
+      var actions: CFArray?
+      AXUIElementCopyActionNames(element, &actions)
+      nodes.append(["path": path, "role": text(element, kAXRoleAttribute), "title": text(element, kAXTitleAttribute), "value": text(element, kAXValueAttribute), "actions": actions as? [String] ?? [], "children_count": childCountResult.value.map { $0 as Any } ?? NSNull()])
+      guard let totalChildren = childCountResult.value else {
+        truncated = true
+        gaps.append("AX child count unavailable at path \(path): AXError \(childCountResult.error ?? -1)")
+        continue
+      }
+      if path.count >= 32 { if totalChildren > 0 { truncated = true }; continue }
+      let available = max(0, request.max_nodes - nodes.count - pending.count)
+      let count = min(available, totalChildren)
+      let batch = children(element, count: count)
+      if !batch.complete { truncated = true }
+      if totalChildren > count { truncated = true }
+      for (index, item) in batch.values.enumerated().reversed() {
+        pending.append((item, path + [index]))
+      }
+    }
+  }
+  var screenshot: Any = NSNull()
+  if request.screenshot {
+    guard #available(macOS 14, *) else { try fail("unsupported-host", "Selected-window screenshots require macOS 14 or later") }
+    let content = try await SCShareableContent.excludingDesktopWindows(true, onScreenWindowsOnly: false)
+    guard let scWindow = content.windows.first(where: { $0.windowID == request.window_id && $0.owningApplication?.processID == request.pid }) else {
+      try fail("capture-window-missing", "Selected window disappeared before capture")
+    }
+    guard bounds.width > 0 && bounds.height > 0 && bounds.width <= 100000 && bounds.height <= 100000 else { try fail("window-bounds", "Selected window has invalid or oversized geometry") }
+    let filter = SCContentFilter(desktopIndependentWindow: scWindow)
+    let configuration = SCStreamConfiguration()
+    let scale = min(1, 2048 / max(bounds.width, bounds.height))
+    configuration.width = max(1, Int(bounds.width * scale)); configuration.height = max(1, Int(bounds.height * scale))
+    configuration.showsCursor = false
+    let image = try await SCScreenshotManager.captureImage(contentFilter: filter, configuration: configuration)
+    guard let png = NSBitmapImageRep(cgImage: image).representation(using: .png, properties: [:]) else {
+      try fail("capture-failed", "Selected-window PNG encoding failed")
+    }
+    screenshot = ["mime_type": "image/png", "base64": png.base64EncodedString(), "sha256": SHA256.hash(data: png).map({ String(format: "%02x", $0) }).joined(), "width": image.width, "height": image.height]
+  }
+  return ["window": ["pid": request.pid, "window_id": request.window_id, "executable": request.executable, "launch_time": launch, "title": window[kCGWindowName as String] as? String ?? ""], "nodes": nodes, "truncated": truncated, "screenshot": screenshot, "gaps": request.accessibility ? gaps : ["Accessibility capture was disabled"]]
+}
+Task { @MainActor in
+  do {
+    let request = try JSONDecoder().decode(Request.self, from: Data(CommandLine.arguments[1].utf8))
+    let result = try await observe(request)
+    let output = try serializeHelperOutput(["ok": true, "result": result])
+    FileHandle.standardOutput.write(output)
+  } catch {
+    let failure = error as? BoundaryFailure
+    let output: [String: Any] = ["ok": false, "code": failure?.code ?? "capture-failed", "message": failure?.message ?? error.localizedDescription]
+    if let data = try? serializeHelperOutput(output) { FileHandle.standardOutput.write(data) }
+  }
+  exit(0)
+}
+RunLoop.main.run()