wowdump 0.2.0 → 0.3.1

package/skills/wowdump/SKILL.md

@@ -0,0 +1,15 @@
+---
+name: wowdump
+description: "使用 wowdump Node CLI 进行只读的 WoW 原生内存分析、Ghidra 静态取证、受限 profile 读取，以及经过明确确认的运行时验证。"
+---
+
+# wowdump
+
+`wowdump` 是唯一用户入口。按依赖顺序完成：
+
+1. 用 Ghidra 静态分析发现段、函数、签名和候选 RVA。
+2. 用经过确认的 Frida 短时导出运行中模块的基址和对应字节，验证这些 RVA。
+3. 把通过验证的 RVA、字段、约束和证据落盘为 `reader_ready` profile。
+4. 后续只用 broker-backed reader 读取和监控，不再启动 Frida。
+
+每一步都保留 build、文件哈希、模块基址、RVA、命令和证据来源。详细命令和字段格式见同目录的 `commands.md`。

package/skills/wowdump/commands.md

@@ -0,0 +1,44 @@
+# wowdump 命令参考
+
+## 1. 静态发现
+
+```powershell
+wowdump analyze static --exe "C:\path with spaces\Wow.exe" --build "retail@VERSION"
+```
+
+输出是候选 profile：包含 `module.imageBase`、段范围、函数/字符串/交叉引用，以及由 `address - imageBase` 得到的候选 RVA。此阶段只读磁盘文件，不连接游戏；结果 `confidence` 为 `candidate`。
+
+## 2. Frida 运行时导出
+
+运行时导出必须先确认准确的 PID、build、目标操作、Hook 数、持续时间、事件上限和清理期限：
+
+```powershell
+wowdump analyze runtime-export --pid 1234 --build "retail@VERSION" --static-profile .wowdump\profiles\static.json --kind providers --confirm
+```
+
+Frida 只负责一次性验证：获取 `Wow.exe` 的 `moduleBase`/`moduleSize`，读取静态 profile 指定 RVA 的现场字节或运行时事件，并把 `runtimeAddress = moduleBase + rva` 写入导出证据。完成后卸载脚本并断开连接。
+
+## 3. 验证并落盘
+
+```powershell
+wowdump analyze verify --static-profile .wowdump\profiles\static.json --runtime-export .wowdump\runtime\export.json --output .wowdump\profiles\verified.json
+```
+
+验证 build key、可执行文件 SHA256、模块基址、段边界、RVA 入口字节和字段约束。只有检查全部通过的记录才可标为 `reader_ready`；不匹配项原样保留，不能静默升级置信度。
+
+## 4. 后续只读 reader
+
+```powershell
+wowdump target
+wowdump profiles reader-ready
+wowdump memory read --pid 1234 --profile reader-ready
+wowdump memory watch start --pid 1234 --profile reader-ready
+wowdump memory watch poll --id WATCH_ID
+wowdump memory watch stop --id WATCH_ID
+```
+
+reader 从 profile 取 `moduleName`、`root.rva`、指针链、字段偏移和校验规则，先计算 `moduleBase + rva`，再执行只读 `ReadProcessMemory`。没有 `reader_ready`、build 不匹配或身份变化时返回结构化错误，不猜测地址。
+
+## 5. 工具链和 broker
+
+`npm install`/`wowdump init` 会探测 JDK/Ghidra；缺失依赖下载到 `WOWDUMP_HOME/toolchains`。Skill 默认安装到 `~/.agents/skills/wowdump`，可用 `WOWDUMP_SKILL_HOME` 覆盖。Windows 首次 reader 调用由 Node 触发 UAC，broker 复用句柄和监控状态，空闲 20 分钟后退出。

package/dist/analysis-path.js

@@ -1,38 +0,0 @@
-import { existsSync } from "node:fs";
-import { dirname, join, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-function worktreeFormalRoot(start) {
-    const normalized = resolve(start).replaceAll("\\", "/");
-    const marker = "/.worktrees/";
-    const index = normalized.toLowerCase().lastIndexOf(marker);
-    return index >= 0 ? join(normalized.slice(0, index), "analyze", "vm") : undefined;
-}
-function existingAnalysisRoot(start) {
-    let current = resolve(start);
-    while (true) {
-        const candidate = join(current, "analyze", "vm");
-        if (existsSync(candidate))
-            return candidate;
-        const parent = dirname(current);
-        if (parent === current)
-            return undefined;
-        current = parent;
-    }
-}
-/** Resolve the one formal evidence root even when the process runs in a Comet worktree. */
-export function resolveAnalysisDir(configured = process.env.WOW_ANALYZE_DIR, cwd = process.cwd(), moduleUrl = import.meta.url) {
-    if (configured)
-        return resolve(cwd, configured);
-    const anchors = [resolve(cwd), dirname(fileURLToPath(moduleUrl))];
-    for (const anchor of anchors) {
-        const formalRoot = worktreeFormalRoot(anchor);
-        if (formalRoot)
-            return formalRoot;
-    }
-    for (const anchor of anchors) {
-        const formalRoot = existingAnalysisRoot(anchor);
-        if (formalRoot)
-            return formalRoot;
-    }
-    return join(anchors[0], "analyze", "vm");
-}

package/dist/analysis-process-log.js

@@ -1,146 +0,0 @@
-import { createHash } from "node:crypto";
-import { mkdir, open, readFile, truncate } from "node:fs/promises";
-import { join, resolve } from "node:path";
-import { acquireProcessLogLock } from "./process-log-lock.js";
-export class AnalysisProcessLog {
-    fileName;
-    tail = Promise.resolve();
-    root;
-    constructor(root, fileName = "wow-analysis-process-68974.jsonl") {
-        this.fileName = fileName;
-        this.root = resolve(root);
-    }
-    append(input) {
-        const operation = this.tail.then(() => this.appendOwned(input));
-        this.tail = operation.catch(() => undefined);
-        return operation;
-    }
-    async flush() { await this.tail; }
-    async appendOwned(input) {
-        await mkdir(this.root, { recursive: true });
-        const release = await acquireProcessLogLock(join(this.root, ".wow-analysis-process.lock"));
-        try {
-            const file = join(this.root, this.fileName);
-            const seq = await nextSequence(file);
-            const event = {
-                seq,
-                timestamp: new Date().toISOString(),
-                buildKey: input.buildKey ?? "retail@12.0.7.68974",
-                phase: input.phase ?? "verify",
-                action: input.action,
-                tool: input.tool ?? "frida-mcp",
-                target: input.target ?? { name: "Wow.exe", va: null, rva: null, imageBase: "0x140000000", moduleBase: null, runtimeAddress: null },
-                command: input.command ?? null,
-                inputs: input.inputs ?? [],
-                inputHashes: input.inputHashes ?? {},
-                result: input.result ?? {},
-                status: input.status,
-                durationMs: input.durationMs ?? 0,
-                artifacts: input.artifacts ?? [],
-                error: input.error ?? null,
-                nextAction: input.nextAction ?? null
-            };
-            const handle = await open(file, "a", 0o600);
-            try {
-                await handle.write(`${JSON.stringify(event)}\n`, null, "utf8");
-                await handle.sync();
-            }
-            finally {
-                await handle.close();
-            }
-        }
-        finally {
-            await release();
-        }
-    }
-}
-async function nextSequence(file) {
-    try {
-        await recoverIncompleteTail(file);
-        const text = await readFile(file, "utf8");
-        let highest = 0;
-        for (const line of text.split(/\r?\n/)) {
-            if (!line)
-                continue;
-            const value = JSON.parse(line);
-            if (Number.isSafeInteger(value.seq))
-                highest = Math.max(highest, Number(value.seq));
-        }
-        return highest + 1;
-    }
-    catch (error) {
-        if (error.code === "ENOENT")
-            return 1;
-        throw error;
-    }
-}
-async function recoverIncompleteTail(file) {
-    const content = await readFile(file).catch(error => {
-        if (error.code === "ENOENT")
-            return Buffer.alloc(0);
-        throw error;
-    });
-    if (content.length === 0 || content.at(-1) === 0x0a)
-        return;
-    const offset = content.lastIndexOf(0x0a) + 1;
-    const tail = content.subarray(offset);
-    if (!isIncompleteJsonTail(tail))
-        return;
-    const sha256 = createHash("sha256").update(tail).digest("hex");
-    const quarantine = `${file}.tail-${sha256}.quarantine.json`;
-    const evidence = Buffer.from(`${JSON.stringify({ schemaVersion: 1, kind: "analysis-process-incomplete-tail", sourcePath: resolve(file), byteOffset: offset, bytes: tail.length, sha256, encoding: "base64", data: tail.toString("base64") })}\n`, "utf8");
-    try {
-        const handle = await open(quarantine, "wx", 0o600);
-        try {
-            await handle.write(evidence);
-            await handle.sync();
-        }
-        finally {
-            await handle.close();
-        }
-    }
-    catch (error) {
-        if (error.code !== "EEXIST")
-            throw error;
-        const prior = await readFile(quarantine);
-        if (!prior.equals(evidence))
-            throw new Error(`process log quarantine conflict: ${quarantine}`);
-    }
-    await truncate(file, offset);
-    const handle = await open(file, "r+");
-    try {
-        await handle.sync();
-    }
-    finally {
-        await handle.close();
-    }
-}
-function isIncompleteJsonTail(tail) {
-    const text = tail.toString("utf8").trimStart();
-    if (!text.startsWith("{"))
-        return false;
-    const stack = [];
-    let inString = false;
-    let escaped = false;
-    for (const character of text) {
-        if (inString) {
-            if (escaped)
-                escaped = false;
-            else if (character === "\\")
-                escaped = true;
-            else if (character === '"')
-                inString = false;
-            continue;
-        }
-        if (character === '"')
-            inString = true;
-        else if (character === "{" || character === "[")
-            stack.push(character);
-        else if (character === "}" || character === "]") {
-            const expected = character === "}" ? "{" : "[";
-            if (stack.pop() !== expected)
-                return false;
-        }
-    }
-    return inString || escaped || stack.length > 0;
-}

package/dist/broker-client.js

@@ -1,411 +0,0 @@
-import { connect } from "node:net";
-import { spawn } from "node:child_process";
-import { randomUUID } from "node:crypto";
-import { isAbsolute } from "node:path";
-import { join } from "node:path";
-import { homedir, tmpdir } from "node:os";
-import { open, readFile, stat, unlink } from "node:fs/promises";
-import { BROKER_DEFAULT_TIMEOUT_MS, BROKER_PROTOCOL_VERSION, FrameDecoder, BrokerProtocolError, canonicalArtifactRoot, encodeFrame, pipeNameForSid, sidHash } from "./broker-protocol.js";
-export class BrokerBootstrapCoordinator {
-    platform;
-    constructor(platform) {
-        this.platform = platform;
-    }
-    async start(options) {
-        if (!isAbsolute(options.executable) || !isAbsolute(options.workdir))
-            throw new BrokerProtocolError("BROKER_EXECUTABLE_INVALID", "Broker executable and workdir must be absolute configured paths");
-        const hash = sidHash(options.sid);
-        const pipeName = options.pipeName ?? pipeNameForSid(options.sid);
-        const bootstrapNonce = options.nonce?.() ?? randomUUID();
-        const artifactRoot = canonicalArtifactRoot(options.artifactRoot ?? process.env.WOWDUMP_RUNTIME_DIR ?? defaultRuntimeRoot());
-        const timeoutMs = options.timeoutMs ?? 10_000;
-        const deadline = Date.now() + Math.max(0, timeoutMs);
-        const beforeDeadline = (operation, task) => runBootstrapBeforeDeadline(deadline, operation, task);
-        const mutex = await beforeDeadline("acquire bootstrap mutex", () => this.platform.acquireBootstrapMutex(`wowdump-frida-bootstrap-${hash}`));
-        if (!mutex) {
-            let ready;
-            try {
-                ready = await beforeDeadline("wait for existing Broker readiness", () => this.platform.waitReady(pipeName, remainingBootstrapMs(deadline)));
-            }
-            catch (error) {
-                throw new BrokerProtocolError("BOOTSTRAP_TIMEOUT", error instanceof Error ? error.message : "Broker ready timeout", "Inspect the active Broker bootstrap and retry.");
-            }
-            this.validateReady(ready, { hash, pipeName, artifactRoot });
-            return ready;
-        }
-        try {
-            const input = { pipeName, sidHash: hash, bootstrapNonce, artifactRoot, executable: options.executable, workdir: options.workdir, argv: options.argv ?? [] };
-            let elevation;
-            try {
-                if (await beforeDeadline("check process elevation", () => this.platform.isElevated()))
-                    await beforeDeadline("launch Broker directly", () => this.platform.launchDirect(input));
-                else {
-                    elevation = normalizeElevationResult(await beforeDeadline("launch elevated Broker", () => this.platform.launchElevated(input)));
-                    if (elevation.status === "cancelled")
-                        throw elevationError("UAC_CANCELLED", "Broker elevation was cancelled", elevation, "Start the Broker again and approve UAC.");
-                    if (elevation.status === "failed")
-                        throw elevationError("UAC_FAILED", "Broker elevation failed", elevation, "Inspect Windows elevation logs and retry.");
-                }
-            }
-            catch (error) {
-                if (error instanceof BrokerProtocolError)
-                    throw error;
-                throw new BrokerProtocolError("BOOTSTRAP_SPAWN_FAILED", error instanceof Error ? error.message : String(error), "Verify Broker executable configuration and retry.");
-            }
-            let ready;
-            try {
-                ready = await beforeDeadline("wait for Broker readiness", () => this.platform.waitReady(pipeName, remainingBootstrapMs(deadline)));
-            }
-            catch (error) {
-                const detail = elevation ? ` (${elevationDiagnostic(elevation)})` : "";
-                throw new BrokerProtocolError("BOOTSTRAP_TIMEOUT", `${error instanceof Error ? error.message : "Broker ready timeout"}${detail}`, "Inspect Broker startup logs and retry.");
-            }
-            this.validateReady(ready, { hash, pipeName, bootstrapNonce, artifactRoot });
-            return ready;
-        }
-        finally {
-            const release = Promise.resolve().then(() => mutex.release());
-            try {
-                await beforeDeadline("release bootstrap mutex", () => release);
-            }
-            catch { /* release is best-effort and must not mask the bootstrap result */ }
-        }
-    }
-    validateReady(ready, expected) {
-        let readyArtifactRoot = "";
-        try {
-            readyArtifactRoot = canonicalArtifactRoot(ready.artifactRoot);
-        }
-        catch { /* normalize all identity failures below */ }
-        if (ready.protocolVersion !== BROKER_PROTOCOL_VERSION || ready.sidHash !== expected.hash || ready.pipeName !== expected.pipeName ||
-            (expected.bootstrapNonce !== undefined && ready.bootstrapNonce !== expected.bootstrapNonce) || !ready.instanceId || !ready.elevated ||
-            readyArtifactRoot !== expected.artifactRoot) {
-            throw new BrokerProtocolError("READY_IDENTITY_MISMATCH", "Broker ready identity did not match bootstrap inputs", "Terminate the untrusted child and restart Broker.");
-        }
-    }
-}
-function remainingBootstrapMs(deadline) { return Math.max(0, deadline - Date.now()); }
-function runBootstrapBeforeDeadline(deadline, operation, task) {
-    const remaining = remainingBootstrapMs(deadline);
-    if (remaining <= 0)
-        return Promise.reject(bootstrapTimeout(operation));
-    return new Promise((resolve, reject) => {
-        let settled = false;
-        const timer = setTimeout(() => {
-            if (settled)
-                return;
-            settled = true;
-            reject(bootstrapTimeout(operation));
-        }, remaining);
-        Promise.resolve().then(task).then(value => { if (!settled) {
-            settled = true;
-            clearTimeout(timer);
-            resolve(value);
-        } }, error => { if (!settled) {
-            settled = true;
-            clearTimeout(timer);
-            reject(error);
-        } });
-    });
-}
-function bootstrapTimeout(operation) {
-    return new BrokerProtocolError("BOOTSTRAP_TIMEOUT", `Broker bootstrap deadline expired during ${operation}`, "Inspect Broker startup logs and retry.");
-}
-export class WindowsBrokerBootstrapPlatform {
-    options;
-    constructor(options = {}) {
-        this.options = options;
-    }
-    async acquireBootstrapMutex(name) {
-        const path = join(this.options.directory ?? tmpdir(), `${name}.lock`);
-        const pipeName = bootstrapPipeName(name);
-        for (let attempt = 0; attempt < 2; attempt += 1) {
-            try {
-                const handle = await open(path, "wx");
-                try {
-                    await handle.writeFile(JSON.stringify({ pid: process.pid, pipeName, acquiredAt: new Date().toISOString() }), "utf8");
-                }
-                catch (error) {
-                    await handle.close().catch(() => undefined);
-                    await unlink(path).catch(() => undefined);
-                    throw error;
-                }
-                return { release: async () => { await handle.close().catch(() => undefined); await unlink(path).catch(() => undefined); } };
-            }
-            catch (error) {
-                if (error?.code !== "EEXIST" || attempt !== 0)
-                    return null;
-                if (!await staleBootstrapLock(path, pipeName, this.options))
-                    return null;
-                await unlink(path).catch(() => undefined);
-            }
-        }
-        return null;
-    }
-    async isElevated() { return isWindowsProcessElevated(); }
-    async launchDirect(input) {
-        const child = spawn(input.executable, brokerChildArguments(input), { cwd: input.workdir, detached: true, windowsHide: true, stdio: "ignore", env: brokerLaunchEnvironment({ WOW_BROKER_SID_HASH: input.sidHash, WOW_BROKER_ARTIFACT_ROOT: input.artifactRoot }) });
-        child.unref();
-    }
-    async launchElevated(input) {
-        const args = brokerChildArguments(input);
-        const environment = brokerLaunchEnvironment({ WOW_BROKER_LAUNCH_FILE: input.executable, WOW_BROKER_LAUNCH_ARGS: serializeWindowsArgumentList(args), WOW_BROKER_LAUNCH_CWD: input.workdir, WOW_BROKER_SID_HASH: input.sidHash, WOW_BROKER_ARTIFACT_ROOT: input.artifactRoot });
-        const result = await runProcess("powershell.exe", brokerElevatedPowerShellArguments(), environment);
-        return brokerElevationResultFromProcess(result);
-    }
-    async waitReady(pipeName, timeoutMs) {
-        const deadline = Date.now() + timeoutMs;
-        while (Date.now() < deadline) {
-            const transport = new NamedPipeClientTransport(pipeName);
-            try {
-                const client = new BrokerClient(transport, `bootstrap-${process.pid}`);
-                const result = await client.request("broker_status", { timeoutMs: Math.min(500, Math.max(1, deadline - Date.now())) });
-                if (result && typeof result === "object" && !Array.isArray(result))
-                    return result;
-            }
-            catch {
-                await delay(25);
-            }
-            finally {
-                await transport.close();
-            }
-        }
-        throw new Error("Broker ready deadline expired");
-    }
-}
-export function brokerChildArguments(input) {
-    return [
-        ...input.argv,
-        "--pipe", input.pipeName,
-        "--bootstrap-nonce", input.bootstrapNonce,
-        "--sid-hash", input.sidHash,
-        "--artifact-root", input.artifactRoot
-    ];
-}
-export function brokerElevatedPowerShellArguments() {
-    const command = [
-        "try {",
-        "$startInfo = [System.Diagnostics.ProcessStartInfo]::new();",
-        "$startInfo.FileName = $env:WOW_BROKER_LAUNCH_FILE;",
-        "$startInfo.Arguments = $env:WOW_BROKER_LAUNCH_ARGS;",
-        "$startInfo.WorkingDirectory = $env:WOW_BROKER_LAUNCH_CWD;",
-        "$startInfo.UseShellExecute = $true;",
-        "$startInfo.Verb = 'runas';",
-        "$startInfo.WindowStyle = [System.Diagnostics.ProcessWindowStyle]::Hidden;",
-        "$child = [System.Diagnostics.Process]::Start($startInfo); [Console]::Error.WriteLine('__WOW_BROKER_ELEVATION_STARTED__ pid=' + $child.Id); exit 0",
-        "} catch {",
-        "$root = $_.Exception; $cursor = $root; $native = $null;",
-        "while ($null -ne $cursor) { if ($null -ne $cursor.PSObject.Properties['NativeErrorCode']) { $native = $cursor.NativeErrorCode; break }; $cursor = $cursor.InnerException };",
-        "$nativeText = if ($null -eq $native) { 'null' } else { [string][int]$native };",
-        "$hresultText = if ($null -eq $root) { 'null' } else { [string][int]$root.HResult };",
-        "$typeText = if ($null -eq $root) { 'unknown' } else { $root.GetType().FullName -replace '[^A-Za-z0-9_.+]', '_' };",
-        "[Console]::Error.WriteLine('__WOW_BROKER_ELEVATION_ERROR__ nativeErrorCode=' + $nativeText + ' hresult=' + $hresultText + ' type=' + $typeText); exit 1",
-        "}"
-    ].join(" ");
-    return ["-NoProfile", "-NonInteractive", "-WindowStyle", "Hidden", "-Command", command];
-}
-const ELEVATION_ERROR_MARKER = /__WOW_BROKER_ELEVATION_ERROR__\s+nativeErrorCode=(null|-?\d+)\s+hresult=(?:null|-?\d+)\s+type=[A-Za-z0-9_.+]+/;
-const ELEVATION_STARTED_MARKER = /__WOW_BROKER_ELEVATION_STARTED__\s+pid=(\d+)/;
-export function brokerElevationResultFromProcess(result) {
-    const marker = ELEVATION_ERROR_MARKER.exec(result.stderr);
-    const started = ELEVATION_STARTED_MARKER.exec(result.stderr);
-    const nativeErrorCode = marker && marker[1] !== "null" ? Number.parseInt(marker[1], 10) : null;
-    return {
-        status: result.code === 0 ? "started" : nativeErrorCode === 1223 ? "cancelled" : "failed",
-        exitCode: result.code,
-        stderr: sanitizeDiagnostic(result.stderr),
-        cause: result.cause ? sanitizeDiagnostic(result.cause) : null,
-        nativeErrorCode,
-        childPid: started ? Number.parseInt(started[1], 10) : null
-    };
-}
-/** Serialize argv as one Windows command line for ProcessStartInfo.Arguments. */
-export function serializeWindowsArgumentList(args) {
-    return args.map(quoteWindowsArgument).join(" ");
-}
-function quoteWindowsArgument(value) {
-    if (value.length === 0)
-        return '""';
-    let result = '"';
-    let slashes = 0;
-    for (const character of value) {
-        if (character === "\\") {
-            slashes += 1;
-            continue;
-        }
-        if (character === '"') {
-            result += "\\".repeat(slashes * 2 + 1) + '"';
-            slashes = 0;
-            continue;
-        }
-        result += "\\".repeat(slashes) + character;
-        slashes = 0;
-    }
-    result += "\\".repeat(slashes * 2) + '"';
-    return result;
-}
-const BROKER_ENV_ALLOWLIST = ["SystemRoot", "WINDIR", "ComSpec", "PATH", "PATHEXT", "TEMP", "TMP", "USERPROFILE", "LOCALAPPDATA", "APPDATA", "ProgramData", "WOWDUMP_RUNTIME_DIR", "WOWDUMP_PROFILE_DIR", "WOWDUMP_GAME_ROOTS", "WOWDUMP_BROKER_IDLE_MS", "WOW_ANALYZE_DIR"];
-export function brokerLaunchEnvironment(required, source = process.env) {
-    const environment = {};
-    for (const key of BROKER_ENV_ALLOWLIST)
-        if (source[key] !== undefined)
-            environment[key] = source[key];
-    for (const [key, value] of Object.entries(required)) {
-        if (!key.startsWith("WOW_BROKER_") || key === "WOW_BROKER_ELEVATED" || value === undefined)
-            continue;
-        environment[key] = value;
-    }
-    return environment;
-}
-function bootstrapPipeName(lockName) {
-    const match = /^wowdump-frida-bootstrap-([a-f0-9]{24})$/i.exec(lockName);
-    return match ? `\\\\.\\pipe\\wowdump-frida-${match[1].toLowerCase()}` : undefined;
-}
-async function staleBootstrapLock(lockPath, pipeName, options) {
-    let metadata;
-    try {
-        const raw = await readFile(lockPath, "utf8");
-        const parsed = JSON.parse(raw);
-        if (parsed && typeof parsed === "object")
-            metadata = parsed;
-    }
-    catch { /* an empty/corrupt lock is handled by the age and pipe checks below */ }
-    const pid = typeof metadata?.pid === "number" && Number.isInteger(metadata.pid) ? metadata.pid : undefined;
-    if (pid !== undefined && (options.processProbe ?? processAlive)(pid))
-        return false;
-    if (pipeName && await (options.pipeProbe ?? pipeReachable)(pipeName))
-        return false;
-    try {
-        const ageMs = Date.now() - (await stat(lockPath)).mtimeMs;
-        return ageMs >= (options.staleAfterMs ?? 2_000);
-    }
-    catch {
-        return false;
-    }
-}
-function processAlive(pid) {
-    if (pid <= 0 || pid === process.pid)
-        return pid === process.pid;
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch (error) {
-        return error?.code === "EPERM";
-    }
-}
-function pipeReachable(pipeName) {
-    return new Promise(resolve => {
-        const socket = connect(pipeName);
-        const finish = (value) => { socket.destroy(); resolve(value); };
-        const timer = setTimeout(() => finish(false), 100);
-        socket.once("connect", () => { clearTimeout(timer); finish(true); });
-        socket.once("error", () => { clearTimeout(timer); finish(false); });
-    });
-}
-export async function isWindowsProcessElevated(options = {}) {
-    if ((options.platform ?? process.platform) !== "win32")
-        return false;
-    const result = await (options.queryGroups ?? (() => runProcess("whoami.exe", ["/groups"], process.env)))();
-    return result.code === 0 && /\bS-1-16-12288\b/.test(result.stdout);
-}
-async function runProcess(file, args, env) {
-    return new Promise(resolve => {
-        const child = spawn(file, args, { env, windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
-        let stdout = "";
-        let stderr = "";
-        child.stdout.setEncoding("utf8");
-        child.stderr.setEncoding("utf8");
-        child.stdout.on("data", chunk => { stdout += chunk; });
-        child.stderr.on("data", chunk => { stderr += chunk; });
-        child.on("error", error => resolve({ code: null, stdout, stderr, cause: sanitizeDiagnostic(error.message) || error.name }));
-        child.on("exit", code => resolve({ code, stdout, stderr, cause: null }));
-    });
-}
-function normalizeElevationResult(result) {
-    return typeof result === "string" ? { status: result, exitCode: null, stderr: "", cause: null, nativeErrorCode: null, childPid: null } : result;
-}
-function elevationDiagnostic(result) {
-    const fields = [`status=${result.status}`, `exitCode=${result.exitCode === null ? "null" : result.exitCode}`];
-    if (result.childPid !== undefined && result.childPid !== null)
-        fields.push(`childPid=${result.childPid}`);
-    if (result.nativeErrorCode !== null)
-        fields.push(`nativeErrorCode=${result.nativeErrorCode}`);
-    if (result.stderr)
-        fields.push(`stderr=${JSON.stringify(sanitizeDiagnostic(result.stderr, 512))}`);
-    if (result.cause)
-        fields.push(`cause=${JSON.stringify(sanitizeDiagnostic(result.cause, 512))}`);
-    return fields.join(", ");
-}
-function elevationError(code, summary, result, nextAction) {
-    const details = [`exitCode=${result.exitCode === null ? "null" : result.exitCode}`];
-    if (result.nativeErrorCode !== null)
-        details.push(`nativeErrorCode=${result.nativeErrorCode}`);
-    if (result.stderr)
-        details.push(`stderr=${JSON.stringify(sanitizeDiagnostic(result.stderr))}`);
-    if (result.cause)
-        details.push(`cause=${JSON.stringify(sanitizeDiagnostic(result.cause))}`);
-    const error = new BrokerProtocolError(code, `${summary} (${details.join(", ")})`, nextAction);
-    error.exitCode = result.exitCode;
-    error.stderr = sanitizeDiagnostic(result.stderr);
-    error.cause = result.cause ? sanitizeDiagnostic(result.cause) : null;
-    error.nativeErrorCode = result.nativeErrorCode;
-    return error;
-}
-function sanitizeDiagnostic(value, maxLength = 2_048) {
-    const normalized = value.replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g, "").replace(/\s+/g, " ").trim();
-    const suffix = "...[truncated]";
-    return normalized.length <= maxLength ? normalized : `${normalized.slice(0, Math.max(0, maxLength - suffix.length))}${suffix}`;
-}
-function delay(ms) { return new Promise(resolve => setTimeout(resolve, ms)); }
-function defaultRuntimeRoot() { return join(process.env.LOCALAPPDATA || join(homedir(), "AppData", "Local"), "wowdump"); }
-export class NamedPipeClientTransport {
-    pipeName;
-    constructor(pipeName) {
-        this.pipeName = pipeName;
-    }
-    request(frame, timeoutMs) {
-        return new Promise((resolve, reject) => {
-            const socket = connect(this.pipeName);
-            const chunks = [];
-            const decoder = new FrameDecoder();
-            const timer = setTimeout(() => { socket.destroy(); reject(new BrokerProtocolError("REQUEST_TIMEOUT", "Broker request timed out", "Query request_status before retrying mutating work.")); }, timeoutMs);
-            socket.on("connect", () => socket.write(frame));
-            socket.on("data", chunk => { chunks.push(chunk); try {
-                if (decoder.push(chunk).length) {
-                    clearTimeout(timer);
-                    socket.end();
-                    resolve(Buffer.concat(chunks));
-                }
-            }
-            catch (error) {
-                clearTimeout(timer);
-                socket.destroy();
-                reject(error);
-            } });
-            socket.on("error", error => { clearTimeout(timer); reject(error); });
-        });
-    }
-    async close() { }
-}
-export class BrokerClient {
-    transport;
-    clientId;
-    constructor(transport, clientId = randomUUID()) {
-        this.transport = transport;
-        this.clientId = clientId;
-    }
-    async request(operation, options = {}) {
-        const request = { schemaVersion: 1, protocolVersion: BROKER_PROTOCOL_VERSION, requestId: options.requestId ?? randomUUID(), clientId: this.clientId, operation, pid: options.pid ?? null, buildKey: options.buildKey ?? null, payload: options.payload ?? {} };
-        const raw = await this.transport.request(encodeFrame(request), options.timeoutMs ?? BROKER_DEFAULT_TIMEOUT_MS);
-        const decoder = new FrameDecoder();
-        const values = decoder.push(raw);
-        if (values.length !== 1)
-            throw new BrokerProtocolError("FRAME_INVALID", "expected one Broker response frame");
-        const response = values[0];
-        if (response.ok === false)
-            throw new BrokerProtocolError(response.error.code, response.error.message, response.error.nextAction);
-        return response.result;
-    }
-    close() { return this.transport.close(); }
-}