windows-exe-decompiler-mcp-server 0.1.0

package/dist/tools/sandbox-execute.d.ts

@@ -0,0 +1,441 @@
+/**
+ * sandbox.execute tool
+ * Dynamic-analysis execution entrypoint supporting simulation-first and Speakeasy user-mode emulation.
+ */
+import { z } from 'zod';
+import type { ToolDefinition, ToolArgs, WorkerResult } from '../types.js';
+import type { WorkspaceManager } from '../workspace-manager.js';
+import type { DatabaseManager } from '../database.js';
+import type { PolicyGuard } from '../policy-guard.js';
+export declare const SandboxExecuteInputSchema: z.ZodObject<{
+    sample_id: z.ZodString;
+    mode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["safe_simulation", "memory_guided", "speakeasy", "live_local"]>>>;
+    timeout_sec: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    network: z.ZodDefault<z.ZodOptional<z.ZodEnum<["disabled", "fake", "enabled"]>>>;
+    max_scan_bytes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    approved: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    require_user_approval: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    persist_artifact: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+}, "strip", z.ZodTypeAny, {
+    sample_id: string;
+    network: "enabled" | "fake" | "disabled";
+    mode: "safe_simulation" | "memory_guided" | "speakeasy" | "live_local";
+    require_user_approval: boolean;
+    approved: boolean;
+    persist_artifact: boolean;
+    timeout_sec: number;
+    max_scan_bytes: number;
+}, {
+    sample_id: string;
+    network?: "enabled" | "fake" | "disabled" | undefined;
+    mode?: "safe_simulation" | "memory_guided" | "speakeasy" | "live_local" | undefined;
+    require_user_approval?: boolean | undefined;
+    approved?: boolean | undefined;
+    persist_artifact?: boolean | undefined;
+    timeout_sec?: number | undefined;
+    max_scan_bytes?: number | undefined;
+}>;
+export type SandboxExecuteInput = z.infer<typeof SandboxExecuteInputSchema>;
+export declare const SandboxExecuteOutputSchema: z.ZodObject<{
+    ok: z.ZodBoolean;
+    data: z.ZodOptional<z.ZodObject<{
+        run_id: z.ZodString;
+        status: z.ZodEnum<["completed", "failed", "timeout", "denied"]>;
+        mode: z.ZodString;
+        backend: z.ZodString;
+        simulated: z.ZodBoolean;
+        timeout_sec: z.ZodNumber;
+        event_count: z.ZodNumber;
+        timeline: z.ZodArray<z.ZodObject<{
+            event_type: z.ZodString;
+            category: z.ZodString;
+            indicator: z.ZodString;
+            confidence: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            confidence: number;
+            indicator: string;
+            category: string;
+            event_type: string;
+        }, {
+            confidence: number;
+            indicator: string;
+            category: string;
+            event_type: string;
+        }>, "many">;
+        iocs: z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString, "many">>;
+        capabilities: z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            evidence_count: z.ZodNumber;
+            confidence: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            name: string;
+            confidence: number;
+            evidence_count: number;
+        }, {
+            name: string;
+            confidence: number;
+            evidence_count: number;
+        }>, "many">;
+        memory_regions: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            region_type: z.ZodString;
+            purpose: z.ZodString;
+            source: z.ZodString;
+            confidence: z.ZodNumber;
+            start_offset: z.ZodOptional<z.ZodNumber>;
+            end_offset: z.ZodOptional<z.ZodNumber>;
+            indicators: z.ZodArray<z.ZodString, "many">;
+        }, "strip", z.ZodTypeAny, {
+            indicators: string[];
+            region_type: string;
+            purpose: string;
+            source: string;
+            confidence: number;
+            start_offset?: number | undefined;
+            end_offset?: number | undefined;
+        }, {
+            indicators: string[];
+            region_type: string;
+            purpose: string;
+            source: string;
+            confidence: number;
+            start_offset?: number | undefined;
+            end_offset?: number | undefined;
+        }>, "many">>;
+        api_resolution: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            api: z.ZodString;
+            provenance: z.ZodString;
+            confidence: z.ZodNumber;
+            sources: z.ZodArray<z.ZodString, "many">;
+        }, "strip", z.ZodTypeAny, {
+            confidence: number;
+            api: string;
+            sources: string[];
+            provenance: string;
+        }, {
+            confidence: number;
+            api: string;
+            sources: string[];
+            provenance: string;
+        }>, "many">>;
+        execution_hypotheses: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            stage: z.ZodString;
+            description: z.ZodString;
+            source: z.ZodString;
+            confidence: z.ZodNumber;
+            indicators: z.ZodArray<z.ZodString, "many">;
+        }, "strip", z.ZodTypeAny, {
+            stage: string;
+            indicators: string[];
+            description: string;
+            source: string;
+            confidence: number;
+        }, {
+            stage: string;
+            indicators: string[];
+            description: string;
+            source: string;
+            confidence: number;
+        }>, "many">>;
+        risk: z.ZodObject<{
+            score: z.ZodNumber;
+            level: z.ZodEnum<["clean", "low", "medium", "high"]>;
+            confidence: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            level: "high" | "low" | "medium" | "clean";
+            score: number;
+            confidence: number;
+        }, {
+            level: "high" | "low" | "medium" | "clean";
+            score: number;
+            confidence: number;
+        }>;
+        environment: z.ZodObject<{
+            network_policy: z.ZodString;
+            executed: z.ZodBoolean;
+            isolation: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            executed: boolean;
+            network_policy: string;
+            isolation: string;
+        }, {
+            executed: boolean;
+            network_policy: string;
+            isolation: string;
+        }>;
+        evidence: z.ZodRecord<z.ZodString, z.ZodAny>;
+        inference: z.ZodObject<{
+            classification: z.ZodString;
+            summary: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            summary: string;
+            classification: string;
+        }, {
+            summary: string;
+            classification: string;
+        }>;
+    }, "strip", z.ZodTypeAny, {
+        status: "timeout" | "failed" | "completed" | "denied";
+        backend: string;
+        run_id: string;
+        timeline: {
+            confidence: number;
+            indicator: string;
+            category: string;
+            event_type: string;
+        }[];
+        environment: {
+            executed: boolean;
+            network_policy: string;
+            isolation: string;
+        };
+        mode: string;
+        risk: {
+            level: "high" | "low" | "medium" | "clean";
+            score: number;
+            confidence: number;
+        };
+        evidence: Record<string, any>;
+        inference: {
+            summary: string;
+            classification: string;
+        };
+        iocs: Record<string, string[]>;
+        capabilities: {
+            name: string;
+            confidence: number;
+            evidence_count: number;
+        }[];
+        timeout_sec: number;
+        simulated: boolean;
+        event_count: number;
+        memory_regions?: {
+            indicators: string[];
+            region_type: string;
+            purpose: string;
+            source: string;
+            confidence: number;
+            start_offset?: number | undefined;
+            end_offset?: number | undefined;
+        }[] | undefined;
+        api_resolution?: {
+            confidence: number;
+            api: string;
+            sources: string[];
+            provenance: string;
+        }[] | undefined;
+        execution_hypotheses?: {
+            stage: string;
+            indicators: string[];
+            description: string;
+            source: string;
+            confidence: number;
+        }[] | undefined;
+    }, {
+        status: "timeout" | "failed" | "completed" | "denied";
+        backend: string;
+        run_id: string;
+        timeline: {
+            confidence: number;
+            indicator: string;
+            category: string;
+            event_type: string;
+        }[];
+        environment: {
+            executed: boolean;
+            network_policy: string;
+            isolation: string;
+        };
+        mode: string;
+        risk: {
+            level: "high" | "low" | "medium" | "clean";
+            score: number;
+            confidence: number;
+        };
+        evidence: Record<string, any>;
+        inference: {
+            summary: string;
+            classification: string;
+        };
+        iocs: Record<string, string[]>;
+        capabilities: {
+            name: string;
+            confidence: number;
+            evidence_count: number;
+        }[];
+        timeout_sec: number;
+        simulated: boolean;
+        event_count: number;
+        memory_regions?: {
+            indicators: string[];
+            region_type: string;
+            purpose: string;
+            source: string;
+            confidence: number;
+            start_offset?: number | undefined;
+            end_offset?: number | undefined;
+        }[] | undefined;
+        api_resolution?: {
+            confidence: number;
+            api: string;
+            sources: string[];
+            provenance: string;
+        }[] | undefined;
+        execution_hypotheses?: {
+            stage: string;
+            indicators: string[];
+            description: string;
+            source: string;
+            confidence: number;
+        }[] | undefined;
+    }>>;
+    warnings: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    errors: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    artifacts: z.ZodOptional<z.ZodArray<z.ZodAny, "many">>;
+    metrics: z.ZodOptional<z.ZodObject<{
+        elapsed_ms: z.ZodNumber;
+        tool: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        elapsed_ms: number;
+        tool: string;
+    }, {
+        elapsed_ms: number;
+        tool: string;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    ok: boolean;
+    metrics?: {
+        elapsed_ms: number;
+        tool: string;
+    } | undefined;
+    data?: {
+        status: "timeout" | "failed" | "completed" | "denied";
+        backend: string;
+        run_id: string;
+        timeline: {
+            confidence: number;
+            indicator: string;
+            category: string;
+            event_type: string;
+        }[];
+        environment: {
+            executed: boolean;
+            network_policy: string;
+            isolation: string;
+        };
+        mode: string;
+        risk: {
+            level: "high" | "low" | "medium" | "clean";
+            score: number;
+            confidence: number;
+        };
+        evidence: Record<string, any>;
+        inference: {
+            summary: string;
+            classification: string;
+        };
+        iocs: Record<string, string[]>;
+        capabilities: {
+            name: string;
+            confidence: number;
+            evidence_count: number;
+        }[];
+        timeout_sec: number;
+        simulated: boolean;
+        event_count: number;
+        memory_regions?: {
+            indicators: string[];
+            region_type: string;
+            purpose: string;
+            source: string;
+            confidence: number;
+            start_offset?: number | undefined;
+            end_offset?: number | undefined;
+        }[] | undefined;
+        api_resolution?: {
+            confidence: number;
+            api: string;
+            sources: string[];
+            provenance: string;
+        }[] | undefined;
+        execution_hypotheses?: {
+            stage: string;
+            indicators: string[];
+            description: string;
+            source: string;
+            confidence: number;
+        }[] | undefined;
+    } | undefined;
+    warnings?: string[] | undefined;
+    errors?: string[] | undefined;
+    artifacts?: any[] | undefined;
+}, {
+    ok: boolean;
+    metrics?: {
+        elapsed_ms: number;
+        tool: string;
+    } | undefined;
+    data?: {
+        status: "timeout" | "failed" | "completed" | "denied";
+        backend: string;
+        run_id: string;
+        timeline: {
+            confidence: number;
+            indicator: string;
+            category: string;
+            event_type: string;
+        }[];
+        environment: {
+            executed: boolean;
+            network_policy: string;
+            isolation: string;
+        };
+        mode: string;
+        risk: {
+            level: "high" | "low" | "medium" | "clean";
+            score: number;
+            confidence: number;
+        };
+        evidence: Record<string, any>;
+        inference: {
+            summary: string;
+            classification: string;
+        };
+        iocs: Record<string, string[]>;
+        capabilities: {
+            name: string;
+            confidence: number;
+            evidence_count: number;
+        }[];
+        timeout_sec: number;
+        simulated: boolean;
+        event_count: number;
+        memory_regions?: {
+            indicators: string[];
+            region_type: string;
+            purpose: string;
+            source: string;
+            confidence: number;
+            start_offset?: number | undefined;
+            end_offset?: number | undefined;
+        }[] | undefined;
+        api_resolution?: {
+            confidence: number;
+            api: string;
+            sources: string[];
+            provenance: string;
+        }[] | undefined;
+        execution_hypotheses?: {
+            stage: string;
+            indicators: string[];
+            description: string;
+            source: string;
+            confidence: number;
+        }[] | undefined;
+    } | undefined;
+    warnings?: string[] | undefined;
+    errors?: string[] | undefined;
+    artifacts?: any[] | undefined;
+}>;
+export declare const sandboxExecuteToolDefinition: ToolDefinition;
+export declare function createSandboxExecuteHandler(workspaceManager: WorkspaceManager, database: DatabaseManager, policyGuard: PolicyGuard): (args: ToolArgs) => Promise<WorkerResult>;
+//# sourceMappingURL=sandbox-execute.d.ts.map