windows-exe-decompiler-mcp-server 0.1.0

package/dist/workflows/triage.d.ts

@@ -0,0 +1,659 @@
+/**
+ * Triage workflow implementation
+ * Quick threat assessment workflow that completes within 5 minutes
+ * Requirements: 15.1, 15.2, 15.4, 15.5
+ */
+import { z } from 'zod';
+import type { ToolDefinition, ToolArgs, WorkerResult } from '../types.js';
+import type { WorkspaceManager } from '../workspace-manager.js';
+import type { DatabaseManager } from '../database.js';
+import type { CacheManager } from '../cache-manager.js';
+/**
+ * Input schema for triage workflow
+ * Requirements: 15.1
+ */
+export declare const TriageWorkflowInputSchema: z.ZodObject<{
+    sample_id: z.ZodString;
+    force_refresh: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+}, "strip", z.ZodTypeAny, {
+    sample_id: string;
+    force_refresh: boolean;
+}, {
+    sample_id: string;
+    force_refresh?: boolean | undefined;
+}>;
+export type TriageWorkflowInput = z.infer<typeof TriageWorkflowInputSchema>;
+/**
+ * Output schema for triage workflow
+ * Requirements: 15.2, 15.4, 15.5
+ */
+export declare const TriageWorkflowOutputSchema: z.ZodObject<{
+    ok: z.ZodBoolean;
+    data: z.ZodOptional<z.ZodObject<{
+        summary: z.ZodString;
+        confidence: z.ZodNumber;
+        threat_level: z.ZodEnum<["clean", "suspicious", "malicious", "unknown"]>;
+        iocs: z.ZodObject<{
+            suspicious_imports: z.ZodArray<z.ZodString, "many">;
+            suspicious_strings: z.ZodArray<z.ZodString, "many">;
+            yara_matches: z.ZodArray<z.ZodString, "many">;
+            yara_low_confidence: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            urls: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            ip_addresses: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            file_paths: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            registry_keys: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            high_value_iocs: z.ZodOptional<z.ZodObject<{
+                suspicious_apis: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                commands: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                pipes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                urls: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                network: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            }, "strip", z.ZodTypeAny, {
+                network?: string[] | undefined;
+                urls?: string[] | undefined;
+                suspicious_apis?: string[] | undefined;
+                commands?: string[] | undefined;
+                pipes?: string[] | undefined;
+            }, {
+                network?: string[] | undefined;
+                urls?: string[] | undefined;
+                suspicious_apis?: string[] | undefined;
+                commands?: string[] | undefined;
+                pipes?: string[] | undefined;
+            }>>;
+            compiler_artifacts: z.ZodOptional<z.ZodObject<{
+                cargo_paths: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                rust_markers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                library_profile: z.ZodOptional<z.ZodObject<{
+                    ecosystems: z.ZodArray<z.ZodString, "many">;
+                    top_crates: z.ZodArray<z.ZodString, "many">;
+                    notable_libraries: z.ZodArray<z.ZodString, "many">;
+                    evidence: z.ZodArray<z.ZodString, "many">;
+                }, "strip", z.ZodTypeAny, {
+                    evidence: string[];
+                    ecosystems: string[];
+                    top_crates: string[];
+                    notable_libraries: string[];
+                }, {
+                    evidence: string[];
+                    ecosystems: string[];
+                    top_crates: string[];
+                    notable_libraries: string[];
+                }>>;
+            }, "strip", z.ZodTypeAny, {
+                cargo_paths?: string[] | undefined;
+                rust_markers?: string[] | undefined;
+                library_profile?: {
+                    evidence: string[];
+                    ecosystems: string[];
+                    top_crates: string[];
+                    notable_libraries: string[];
+                } | undefined;
+            }, {
+                cargo_paths?: string[] | undefined;
+                rust_markers?: string[] | undefined;
+                library_profile?: {
+                    evidence: string[];
+                    ecosystems: string[];
+                    top_crates: string[];
+                    notable_libraries: string[];
+                } | undefined;
+            }>>;
+        }, "strip", z.ZodTypeAny, {
+            suspicious_imports: string[];
+            suspicious_strings: string[];
+            yara_matches: string[];
+            yara_low_confidence?: string[] | undefined;
+            urls?: string[] | undefined;
+            ip_addresses?: string[] | undefined;
+            file_paths?: string[] | undefined;
+            registry_keys?: string[] | undefined;
+            high_value_iocs?: {
+                network?: string[] | undefined;
+                urls?: string[] | undefined;
+                suspicious_apis?: string[] | undefined;
+                commands?: string[] | undefined;
+                pipes?: string[] | undefined;
+            } | undefined;
+            compiler_artifacts?: {
+                cargo_paths?: string[] | undefined;
+                rust_markers?: string[] | undefined;
+                library_profile?: {
+                    evidence: string[];
+                    ecosystems: string[];
+                    top_crates: string[];
+                    notable_libraries: string[];
+                } | undefined;
+            } | undefined;
+        }, {
+            suspicious_imports: string[];
+            suspicious_strings: string[];
+            yara_matches: string[];
+            yara_low_confidence?: string[] | undefined;
+            urls?: string[] | undefined;
+            ip_addresses?: string[] | undefined;
+            file_paths?: string[] | undefined;
+            registry_keys?: string[] | undefined;
+            high_value_iocs?: {
+                network?: string[] | undefined;
+                urls?: string[] | undefined;
+                suspicious_apis?: string[] | undefined;
+                commands?: string[] | undefined;
+                pipes?: string[] | undefined;
+            } | undefined;
+            compiler_artifacts?: {
+                cargo_paths?: string[] | undefined;
+                rust_markers?: string[] | undefined;
+                library_profile?: {
+                    evidence: string[];
+                    ecosystems: string[];
+                    top_crates: string[];
+                    notable_libraries: string[];
+                } | undefined;
+            } | undefined;
+        }>;
+        evidence: z.ZodArray<z.ZodString, "many">;
+        evidence_weights: z.ZodObject<{
+            import: z.ZodNumber;
+            string: z.ZodNumber;
+            runtime: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            string: number;
+            runtime: number;
+            import: number;
+        }, {
+            string: number;
+            runtime: number;
+            import: number;
+        }>;
+        inference: z.ZodOptional<z.ZodObject<{
+            classification: z.ZodEnum<["benign", "suspicious", "malicious", "unknown"]>;
+            hypotheses: z.ZodArray<z.ZodString, "many">;
+            false_positive_risks: z.ZodArray<z.ZodString, "many">;
+            intent_assessment: z.ZodOptional<z.ZodObject<{
+                label: z.ZodEnum<["dual_use_tool", "operator_utility", "malware_like_payload", "unknown"]>;
+                confidence: z.ZodNumber;
+                evidence: z.ZodArray<z.ZodString, "many">;
+                counter_evidence: z.ZodArray<z.ZodString, "many">;
+            }, "strip", z.ZodTypeAny, {
+                label: "unknown" | "dual_use_tool" | "operator_utility" | "malware_like_payload";
+                confidence: number;
+                evidence: string[];
+                counter_evidence: string[];
+            }, {
+                label: "unknown" | "dual_use_tool" | "operator_utility" | "malware_like_payload";
+                confidence: number;
+                evidence: string[];
+                counter_evidence: string[];
+            }>>;
+            tooling_assessment: z.ZodOptional<z.ZodObject<{
+                help_text_detected: z.ZodBoolean;
+                cli_surface_detected: z.ZodBoolean;
+                framework_hints: z.ZodArray<z.ZodString, "many">;
+                toolchain_markers: z.ZodArray<z.ZodString, "many">;
+                library_profile: z.ZodOptional<z.ZodObject<{
+                    ecosystems: z.ZodArray<z.ZodString, "many">;
+                    top_crates: z.ZodArray<z.ZodString, "many">;
+                    notable_libraries: z.ZodArray<z.ZodString, "many">;
+                    evidence: z.ZodArray<z.ZodString, "many">;
+                }, "strip", z.ZodTypeAny, {
+                    evidence: string[];
+                    ecosystems: string[];
+                    top_crates: string[];
+                    notable_libraries: string[];
+                }, {
+                    evidence: string[];
+                    ecosystems: string[];
+                    top_crates: string[];
+                    notable_libraries: string[];
+                }>>;
+            }, "strip", z.ZodTypeAny, {
+                help_text_detected: boolean;
+                cli_surface_detected: boolean;
+                framework_hints: string[];
+                toolchain_markers: string[];
+                library_profile?: {
+                    evidence: string[];
+                    ecosystems: string[];
+                    top_crates: string[];
+                    notable_libraries: string[];
+                } | undefined;
+            }, {
+                help_text_detected: boolean;
+                cli_surface_detected: boolean;
+                framework_hints: string[];
+                toolchain_markers: string[];
+                library_profile?: {
+                    evidence: string[];
+                    ecosystems: string[];
+                    top_crates: string[];
+                    notable_libraries: string[];
+                } | undefined;
+            }>>;
+        }, "strip", z.ZodTypeAny, {
+            classification: "unknown" | "suspicious" | "malicious" | "benign";
+            hypotheses: string[];
+            false_positive_risks: string[];
+            intent_assessment?: {
+                label: "unknown" | "dual_use_tool" | "operator_utility" | "malware_like_payload";
+                confidence: number;
+                evidence: string[];
+                counter_evidence: string[];
+            } | undefined;
+            tooling_assessment?: {
+                help_text_detected: boolean;
+                cli_surface_detected: boolean;
+                framework_hints: string[];
+                toolchain_markers: string[];
+                library_profile?: {
+                    evidence: string[];
+                    ecosystems: string[];
+                    top_crates: string[];
+                    notable_libraries: string[];
+                } | undefined;
+            } | undefined;
+        }, {
+            classification: "unknown" | "suspicious" | "malicious" | "benign";
+            hypotheses: string[];
+            false_positive_risks: string[];
+            intent_assessment?: {
+                label: "unknown" | "dual_use_tool" | "operator_utility" | "malware_like_payload";
+                confidence: number;
+                evidence: string[];
+                counter_evidence: string[];
+            } | undefined;
+            tooling_assessment?: {
+                help_text_detected: boolean;
+                cli_surface_detected: boolean;
+                framework_hints: string[];
+                toolchain_markers: string[];
+                library_profile?: {
+                    evidence: string[];
+                    ecosystems: string[];
+                    top_crates: string[];
+                    notable_libraries: string[];
+                } | undefined;
+            } | undefined;
+        }>>;
+        recommendation: z.ZodString;
+        raw_results: z.ZodObject<{
+            fingerprint: z.ZodOptional<z.ZodAny>;
+            runtime: z.ZodOptional<z.ZodAny>;
+            imports: z.ZodOptional<z.ZodAny>;
+            strings: z.ZodOptional<z.ZodAny>;
+            yara: z.ZodOptional<z.ZodAny>;
+        }, "strip", z.ZodTypeAny, {
+            strings?: any;
+            runtime?: any;
+            imports?: any;
+            fingerprint?: any;
+            yara?: any;
+        }, {
+            strings?: any;
+            runtime?: any;
+            imports?: any;
+            fingerprint?: any;
+            yara?: any;
+        }>;
+    }, "strip", z.ZodTypeAny, {
+        summary: string;
+        confidence: number;
+        evidence: string[];
+        threat_level: "unknown" | "clean" | "suspicious" | "malicious";
+        iocs: {
+            suspicious_imports: string[];
+            suspicious_strings: string[];
+            yara_matches: string[];
+            yara_low_confidence?: string[] | undefined;
+            urls?: string[] | undefined;
+            ip_addresses?: string[] | undefined;
+            file_paths?: string[] | undefined;
+            registry_keys?: string[] | undefined;
+            high_value_iocs?: {
+                network?: string[] | undefined;
+                urls?: string[] | undefined;
+                suspicious_apis?: string[] | undefined;
+                commands?: string[] | undefined;
+                pipes?: string[] | undefined;
+            } | undefined;
+            compiler_artifacts?: {
+                cargo_paths?: string[] | undefined;
+                rust_markers?: string[] | undefined;
+                library_profile?: {
+                    evidence: string[];
+                    ecosystems: string[];
+                    top_crates: string[];
+                    notable_libraries: string[];
+                } | undefined;
+            } | undefined;
+        };
+        evidence_weights: {
+            string: number;
+            runtime: number;
+            import: number;
+        };
+        recommendation: string;
+        raw_results: {
+            strings?: any;
+            runtime?: any;
+            imports?: any;
+            fingerprint?: any;
+            yara?: any;
+        };
+        inference?: {
+            classification: "unknown" | "suspicious" | "malicious" | "benign";
+            hypotheses: string[];
+            false_positive_risks: string[];
+            intent_assessment?: {
+                label: "unknown" | "dual_use_tool" | "operator_utility" | "malware_like_payload";
+                confidence: number;
+                evidence: string[];
+                counter_evidence: string[];
+            } | undefined;
+            tooling_assessment?: {
+                help_text_detected: boolean;
+                cli_surface_detected: boolean;
+                framework_hints: string[];
+                toolchain_markers: string[];
+                library_profile?: {
+                    evidence: string[];
+                    ecosystems: string[];
+                    top_crates: string[];
+                    notable_libraries: string[];
+                } | undefined;
+            } | undefined;
+        } | undefined;
+    }, {
+        summary: string;
+        confidence: number;
+        evidence: string[];
+        threat_level: "unknown" | "clean" | "suspicious" | "malicious";
+        iocs: {
+            suspicious_imports: string[];
+            suspicious_strings: string[];
+            yara_matches: string[];
+            yara_low_confidence?: string[] | undefined;
+            urls?: string[] | undefined;
+            ip_addresses?: string[] | undefined;
+            file_paths?: string[] | undefined;
+            registry_keys?: string[] | undefined;
+            high_value_iocs?: {
+                network?: string[] | undefined;
+                urls?: string[] | undefined;
+                suspicious_apis?: string[] | undefined;
+                commands?: string[] | undefined;
+                pipes?: string[] | undefined;
+            } | undefined;
+            compiler_artifacts?: {
+                cargo_paths?: string[] | undefined;
+                rust_markers?: string[] | undefined;
+                library_profile?: {
+                    evidence: string[];
+                    ecosystems: string[];
+                    top_crates: string[];
+                    notable_libraries: string[];
+                } | undefined;
+            } | undefined;
+        };
+        evidence_weights: {
+            string: number;
+            runtime: number;
+            import: number;
+        };
+        recommendation: string;
+        raw_results: {
+            strings?: any;
+            runtime?: any;
+            imports?: any;
+            fingerprint?: any;
+            yara?: any;
+        };
+        inference?: {
+            classification: "unknown" | "suspicious" | "malicious" | "benign";
+            hypotheses: string[];
+            false_positive_risks: string[];
+            intent_assessment?: {
+                label: "unknown" | "dual_use_tool" | "operator_utility" | "malware_like_payload";
+                confidence: number;
+                evidence: string[];
+                counter_evidence: string[];
+            } | undefined;
+            tooling_assessment?: {
+                help_text_detected: boolean;
+                cli_surface_detected: boolean;
+                framework_hints: string[];
+                toolchain_markers: string[];
+                library_profile?: {
+                    evidence: string[];
+                    ecosystems: string[];
+                    top_crates: string[];
+                    notable_libraries: string[];
+                } | undefined;
+            } | undefined;
+        } | undefined;
+    }>>;
+    warnings: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    errors: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    metrics: z.ZodOptional<z.ZodObject<{
+        elapsed_ms: z.ZodNumber;
+        tool: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        elapsed_ms: number;
+        tool: string;
+    }, {
+        elapsed_ms: number;
+        tool: string;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    ok: boolean;
+    metrics?: {
+        elapsed_ms: number;
+        tool: string;
+    } | undefined;
+    data?: {
+        summary: string;
+        confidence: number;
+        evidence: string[];
+        threat_level: "unknown" | "clean" | "suspicious" | "malicious";
+        iocs: {
+            suspicious_imports: string[];
+            suspicious_strings: string[];
+            yara_matches: string[];
+            yara_low_confidence?: string[] | undefined;
+            urls?: string[] | undefined;
+            ip_addresses?: string[] | undefined;
+            file_paths?: string[] | undefined;
+            registry_keys?: string[] | undefined;
+            high_value_iocs?: {
+                network?: string[] | undefined;
+                urls?: string[] | undefined;
+                suspicious_apis?: string[] | undefined;
+                commands?: string[] | undefined;
+                pipes?: string[] | undefined;
+            } | undefined;
+            compiler_artifacts?: {
+                cargo_paths?: string[] | undefined;
+                rust_markers?: string[] | undefined;
+                library_profile?: {
+                    evidence: string[];
+                    ecosystems: string[];
+                    top_crates: string[];
+                    notable_libraries: string[];
+                } | undefined;
+            } | undefined;
+        };
+        evidence_weights: {
+            string: number;
+            runtime: number;
+            import: number;
+        };
+        recommendation: string;
+        raw_results: {
+            strings?: any;
+            runtime?: any;
+            imports?: any;
+            fingerprint?: any;
+            yara?: any;
+        };
+        inference?: {
+            classification: "unknown" | "suspicious" | "malicious" | "benign";
+            hypotheses: string[];
+            false_positive_risks: string[];
+            intent_assessment?: {
+                label: "unknown" | "dual_use_tool" | "operator_utility" | "malware_like_payload";
+                confidence: number;
+                evidence: string[];
+                counter_evidence: string[];
+            } | undefined;
+            tooling_assessment?: {
+                help_text_detected: boolean;
+                cli_surface_detected: boolean;
+                framework_hints: string[];
+                toolchain_markers: string[];
+                library_profile?: {
+                    evidence: string[];
+                    ecosystems: string[];
+                    top_crates: string[];
+                    notable_libraries: string[];
+                } | undefined;
+            } | undefined;
+        } | undefined;
+    } | undefined;
+    warnings?: string[] | undefined;
+    errors?: string[] | undefined;
+}, {
+    ok: boolean;
+    metrics?: {
+        elapsed_ms: number;
+        tool: string;
+    } | undefined;
+    data?: {
+        summary: string;
+        confidence: number;
+        evidence: string[];
+        threat_level: "unknown" | "clean" | "suspicious" | "malicious";
+        iocs: {
+            suspicious_imports: string[];
+            suspicious_strings: string[];
+            yara_matches: string[];
+            yara_low_confidence?: string[] | undefined;
+            urls?: string[] | undefined;
+            ip_addresses?: string[] | undefined;
+            file_paths?: string[] | undefined;
+            registry_keys?: string[] | undefined;
+            high_value_iocs?: {
+                network?: string[] | undefined;
+                urls?: string[] | undefined;
+                suspicious_apis?: string[] | undefined;
+                commands?: string[] | undefined;
+                pipes?: string[] | undefined;
+            } | undefined;
+            compiler_artifacts?: {
+                cargo_paths?: string[] | undefined;
+                rust_markers?: string[] | undefined;
+                library_profile?: {
+                    evidence: string[];
+                    ecosystems: string[];
+                    top_crates: string[];
+                    notable_libraries: string[];
+                } | undefined;
+            } | undefined;
+        };
+        evidence_weights: {
+            string: number;
+            runtime: number;
+            import: number;
+        };
+        recommendation: string;
+        raw_results: {
+            strings?: any;
+            runtime?: any;
+            imports?: any;
+            fingerprint?: any;
+            yara?: any;
+        };
+        inference?: {
+            classification: "unknown" | "suspicious" | "malicious" | "benign";
+            hypotheses: string[];
+            false_positive_risks: string[];
+            intent_assessment?: {
+                label: "unknown" | "dual_use_tool" | "operator_utility" | "malware_like_payload";
+                confidence: number;
+                evidence: string[];
+                counter_evidence: string[];
+            } | undefined;
+            tooling_assessment?: {
+                help_text_detected: boolean;
+                cli_surface_detected: boolean;
+                framework_hints: string[];
+                toolchain_markers: string[];
+                library_profile?: {
+                    evidence: string[];
+                    ecosystems: string[];
+                    top_crates: string[];
+                    notable_libraries: string[];
+                } | undefined;
+            } | undefined;
+        } | undefined;
+    } | undefined;
+    warnings?: string[] | undefined;
+    errors?: string[] | undefined;
+}>;
+export type TriageWorkflowOutput = z.infer<typeof TriageWorkflowOutputSchema>;
+/**
+ * Tool definition for triage workflow
+ */
+export declare const triageWorkflowToolDefinition: ToolDefinition;
+export declare function extractCrateNameFromCargoPath(input: string): string | null;
+declare function analyzeSuspiciousStrings(strings: unknown[]): {
+    suspicious: string[];
+    urls: string[];
+    ips: string[];
+    paths: string[];
+    registry: string[];
+    commands: string[];
+    pipes: string[];
+    cargoPaths: string[];
+    rustMarkers: string[];
+    crateNames: string[];
+    libraryHints: string[];
+};
+interface YaraSignal {
+    rule: string;
+    level: 'low' | 'medium' | 'high' | 'unknown';
+    score: number;
+    stringOnly: boolean;
+    generic: boolean;
+}
+interface IntentAssessment {
+    label: 'dual_use_tool' | 'operator_utility' | 'malware_like_payload' | 'unknown';
+    confidence: number;
+    evidence: string[];
+    counter_evidence: string[];
+}
+export interface LibraryProfile {
+    ecosystems: string[];
+    top_crates: string[];
+    notable_libraries: string[];
+    evidence: string[];
+}
+export declare function buildLibraryProfile(stringAnalysis: Pick<ReturnType<typeof analyzeSuspiciousStrings>, 'cargoPaths' | 'crateNames' | 'libraryHints' | 'rustMarkers'>, runtime: any): LibraryProfile | undefined;
+export declare function applyIntentAwareYaraAdjustments(yaraSignals: YaraSignal[], intentAssessment: IntentAssessment): YaraSignal[];
+export declare function calculateThreatLevelV2(yaraSignals: YaraSignal[], suspiciousImports: string[], suspiciousStrings: string[], intentAssessment: IntentAssessment): {
+    level: 'clean' | 'suspicious' | 'malicious' | 'unknown';
+    confidence: number;
+};
+/**
+ * Execute triage workflow
+ * Requirements: 15.1, 15.2, 15.4, 15.5
+ *
+ * This is a standalone function that can be called by other workflows
+ */
+export declare function triageWorkflow(sampleId: string, workspaceManager: WorkspaceManager, database: DatabaseManager, cacheManager: CacheManager): Promise<TriageWorkflowOutput>;
+/**
+ * Create triage workflow handler
+ * Requirements: 15.1, 15.2, 15.4, 15.5
+ */
+export declare function createTriageWorkflowHandler(workspaceManager: WorkspaceManager, database: DatabaseManager, cacheManager: CacheManager): (args: ToolArgs) => Promise<WorkerResult>;
+export {};
+//# sourceMappingURL=triage.d.ts.map