wowdump 0.2.1 → 0.3.2

package/dist/cli.js

@@ -0,0 +1,563 @@
+#!/usr/bin/env node
+import { spawn } from "node:child_process";
+import { existsSync, realpathSync, readFileSync } from "node:fs";
+import { readFile, readdir } from "node:fs/promises";
+import { basename, dirname, extname, isAbsolute, join, resolve } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { Command } from "commander";
+import { WindowsBrokerManager } from "./reader/launcher.js";
+import { initializeWowdumpHome, bootstrapToolchain, resolveToolchain, resolveWowdumpHome } from "./toolchain.js";
+import { runDisassembly } from "./analysis/disassemble.js";
+import { RUNTIME_EXPORT_SCRIPT } from "./analysis/runtime-script.js";
+import { ProfileEngine } from "./core/profile-engine.js";
+import { ReaderProfileAdapter } from "./adapters/reader.js";
+import { enumerateWindowsProcesses } from "./reader/windows.js";
+export function parseBuildInfo(content, file) {
+    const lines = content.split(/\r?\n/).filter(line => line.trim());
+    const headers = lines[0]?.split("|") ?? [];
+    const versionIndex = headers.indexOf("Version!STRING:0");
+    const activeIndex = headers.indexOf("Active!DEC:1");
+    const productIndex = headers.indexOf("Product!STRING:0");
+    if (versionIndex < 0 || activeIndex < 0 || productIndex < 0)
+        return null;
+    const row = lines.slice(1).map(line => line.split("|")).find(values => values[activeIndex] === "1" && values[productIndex] === "wow");
+    const version = row?.[versionIndex]?.trim();
+    const product = row?.[productIndex]?.trim();
+    if (!version || !product)
+        return null;
+    return { fileVersion: version, product, buildKey: `retail@${version}`, buildInfoFile: file };
+}
+async function discoverWowTargets(selectedPid, elevatedModules) {
+    if (process.platform !== "win32")
+        return [];
+    const targets = [];
+    const rows = enumerateWindowsProcesses()
+        .filter(item => /^Wow\.exe$/i.test(item.name))
+        .filter(item => selectedPid === undefined || item.pid === selectedPid);
+    for (const item of rows) {
+        const pid = item.pid;
+        const name = item.name;
+        if (!Number.isSafeInteger(pid) || pid < 1 || !/^Wow\.exe$/i.test(name) || (selectedPid !== undefined && pid !== selectedPid))
+            continue;
+        let path = item.path;
+        let moduleBase = null;
+        let moduleSize = null;
+        let diagnostic;
+        if ((!path || !moduleBase) && elevatedModules) {
+            try {
+                const elevated = elevatedModules(pid);
+                const response = await elevated;
+                const modules = response && typeof response === "object" && Array.isArray(response.modules)
+                    ? response.modules
+                    : [];
+                const main = modules.find(module => /^Wow\.exe$/i.test(String(module.name ?? ""))) ?? modules[0];
+                if (!path && typeof main?.path === "string" && main.path)
+                    path = main.path;
+                if (!moduleBase && typeof main?.base === "string")
+                    moduleBase = main.base;
+                if (moduleSize === null && Number.isFinite(Number(main?.size)))
+                    moduleSize = Number(main?.size);
+            }
+            catch (error) {
+                diagnostic = diagnostic ?? (error instanceof Error ? error.message : String(error));
+            }
+        }
+        let buildInfoFile = null;
+        let fileVersion = null;
+        let product = null;
+        if (path) {
+            const candidates = [join(dirname(path), ".build.info"), join(dirname(dirname(path)), ".build.info")];
+            for (const candidate of candidates) {
+                try {
+                    const text = await readFile(candidate, "utf8");
+                    const parsed = parseBuildInfo(text, candidate);
+                    if (parsed) {
+                        fileVersion = parsed.fileVersion;
+                        product = parsed.product;
+                        buildInfoFile = parsed.buildInfoFile;
+                        break;
+                    }
+                }
+                catch { /* try the next parent directory */ }
+            }
+        }
+        targets.push({ pid, name, path, moduleBase, moduleSize, fileVersion, product, buildKey: fileVersion ? `retail@${fileVersion}` : null, ...(buildInfoFile ? { buildInfoFile } : {}), ...(diagnostic ? { diagnostics: { frida: diagnostic } } : {}) });
+    }
+    return targets;
+}
+function packageVersion() {
+    const override = process.env.WOWDUMP_VERSION?.trim();
+    if (override)
+        return override;
+    try {
+        const packageFile = fileURLToPath(new URL("../package.json", import.meta.url));
+        const packageJson = JSON.parse(readFileSync(packageFile, "utf8"));
+        return typeof packageJson.version === "string" ? packageJson.version : "0.0.0";
+    }
+    catch {
+        return "0.0.0";
+    }
+}
+function installedDistDirectory() {
+    return fileURLToPath(new URL(".", import.meta.url));
+}
+class CliError extends Error {
+    code;
+    details;
+    constructor(code, message, details) {
+        super(message);
+        this.name = "CliError";
+        this.code = code;
+        this.details = details;
+    }
+}
+function positiveInteger(value, field) {
+    const result = Number(value);
+    if (!Number.isSafeInteger(result) || result <= 0)
+        throw new CliError("ARGUMENT_INVALID", `${field} must be a positive integer`);
+    return result;
+}
+function nonNegativeInteger(value, field) {
+    const result = Number(value);
+    if (!Number.isSafeInteger(result) || result < 0)
+        throw new CliError("ARGUMENT_INVALID", `${field} must be a non-negative integer`);
+    return result;
+}
+function jsonRecord(value, field) {
+    let decoded;
+    try {
+        decoded = JSON.parse(value);
+    }
+    catch {
+        throw new CliError("ARGUMENT_INVALID", `${field} must be valid JSON`);
+    }
+    if (!decoded || typeof decoded !== "object" || Array.isArray(decoded)) {
+        throw new CliError("ARGUMENT_INVALID", `${field} must be a JSON object`);
+    }
+    return decoded;
+}
+function writeJson(io, value) {
+    io.stdout.write(`${JSON.stringify(value, null, 2)}\n`);
+}
+async function defaultSidecar(file, args, input) {
+    return new Promise(resolveResult => {
+        const child = spawn(file, args, { windowsHide: true, stdio: ["pipe", "pipe", "pipe"] });
+        let stdout = "";
+        let stderr = "";
+        child.stdout.setEncoding("utf8");
+        child.stderr.setEncoding("utf8");
+        child.stdout.on("data", value => { stdout += value; });
+        child.stderr.on("data", value => { stderr += value; });
+        child.once("error", error => resolveResult({ exitCode: 1, stdout, stderr: `${stderr}${error.message}` }));
+        child.once("exit", code => resolveResult({ exitCode: code ?? 1, stdout, stderr }));
+        if (input !== undefined)
+            child.stdin.end(input);
+        else
+            child.stdin.end();
+    });
+}
+function brokerCommandLine(env, packageDist) {
+    const configured = env.WOWDUMP_READER_COMMAND?.trim();
+    if (configured)
+        return { file: configured, args: [] };
+    const candidate = join(packageDist, "reader-main.js");
+    return existsSync(candidate) ? { file: process.execPath, args: [candidate, "--request-stdio"] } : null;
+}
+async function defaultBroker(invocation, env, packageDist, sidecar) {
+    const command = brokerCommandLine(env, packageDist);
+    if (!command) {
+        throw new CliError("BROKER_NOT_CONFIGURED", "reader broker entry was not found", { expected: join(packageDist, "reader-main.js"), environment: "WOWDUMP_READER_COMMAND" });
+    }
+    const result = await (sidecar ?? defaultSidecar)(command.file, command.args, `${JSON.stringify(invocation)}\n`);
+    if (result.exitCode !== 0)
+        throw new CliError("BROKER_FAILED", result.stderr.trim() || `reader broker exited with ${result.exitCode}`);
+    const line = result.stdout.split(/\r?\n/).find(value => value.trim());
+    if (!line)
+        throw new CliError("BROKER_PROTOCOL_ERROR", "reader broker returned no JSON response");
+    try {
+        return JSON.parse(line);
+    }
+    catch {
+        throw new CliError("BROKER_PROTOCOL_ERROR", "reader broker returned invalid JSON", { stdout: result.stdout });
+    }
+}
+async function runFridaWorker(worker, input, timeoutMs, broker) {
+    if (process.platform !== "win32") {
+        throw new CliError("PLATFORM_UNSUPPORTED", "elevated Frida broker is currently supported on Windows only");
+    }
+    const raw = await broker({ command: "frida", payload: { worker, input, timeoutMs } });
+    const response = raw && typeof raw === "object" ? raw : {};
+    if (response.ok === false) {
+        const error = response.error && typeof response.error === "object" ? response.error : {};
+        throw new CliError("BROKER_FAILED", String(error.message ?? "elevated Frida worker failed"), { response });
+    }
+    return {
+        exitCode: Number.isSafeInteger(Number(response.exitCode)) ? Number(response.exitCode) : 1,
+        stdout: typeof response.stdout === "string" ? response.stdout : "",
+        stderr: typeof response.stderr === "string" ? response.stderr : ""
+    };
+}
+const windowsBrokerManagers = new Map();
+function persistentWindowsBroker(home, packageDist) {
+    const key = resolve(home).toLowerCase();
+    let manager = windowsBrokerManagers.get(key);
+    if (!manager) {
+        manager = new WindowsBrokerManager({ home, readerEntry: join(packageDist, "reader-main.js") });
+        windowsBrokerManagers.set(key, manager);
+    }
+    return manager;
+}
+async function listProfileFiles(directory) {
+    try {
+        const entries = await readdir(directory, { withFileTypes: true });
+        return entries
+            .filter(entry => entry.isFile() && extname(entry.name).toLowerCase() === ".json")
+            .map(entry => join(directory, entry.name))
+            .sort((left, right) => left.localeCompare(right));
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return [];
+        throw error;
+    }
+}
+async function readProfileSummary(file) {
+    const profile = jsonRecord(await readFile(file, "utf8"), file);
+    return {
+        id: typeof profile.id === "string" ? profile.id : basename(file, extname(file)),
+        file,
+        buildKey: profile.buildKey ?? null,
+        confidence: profile.confidence ?? "unverified",
+        executableSha256: profile.executableSha256
+            ?? (profile.executable && typeof profile.executable === "object" && !Array.isArray(profile.executable)
+                ? profile.executable.sha256 ?? null
+                : null)
+    };
+}
+function profileFile(profileRoot, idOrFile) {
+    if (isAbsolute(idOrFile))
+        return resolve(idOrFile);
+    const safeId = idOrFile.replace(/\.json$/i, "");
+    if (!/^[A-Za-z0-9_.@-]+$/.test(safeId))
+        throw new CliError("ARGUMENT_INVALID", "profile ID contains unsupported characters");
+    return join(profileRoot, `${safeId}.json`);
+}
+function selected(source, keys) {
+    return Object.fromEntries(keys.filter(key => source[key] !== undefined).map(key => [key, source[key]]));
+}
+function requireRuntimeConfirmation(options) {
+    if (options.confirm === true)
+        return;
+    throw new CliError("CONFIRMATION_REQUIRED", "runtime export requires --confirm", {
+        pid: options.pid,
+        buildKey: options.build,
+        operation: "runtime",
+        kind: options.kind,
+        maxHooks: options.maxHooks,
+        durationMs: options.durationMs,
+        maxEvents: options.maxEvents,
+        cleanupDeadlineMs: options.cleanupDeadlineMs
+    });
+}
+export function createWowdumpCli(dependencies = {}) {
+    const io = dependencies.io ?? { stdout: process.stdout, stderr: process.stderr };
+    const env = dependencies.env ?? process.env;
+    const cwd = resolve(dependencies.cwd ?? process.cwd());
+    const packageDist = installedDistDirectory();
+    const home = resolveWowdumpHome(env);
+    const broker = dependencies.broker ?? (process.platform === "win32" && !dependencies.sidecar
+        ? (invocation => persistentWindowsBroker(home, packageDist).request(invocation))
+        : (invocation => defaultBroker(invocation, env, packageDist, dependencies.sidecar)));
+    const baseSidecar = dependencies.sidecar ?? defaultSidecar;
+    const sidecar = async (file, args, input) => {
+        const worker = args.length === 1 && /\.m?js$/i.test(args[0] ?? "") ? args[0] : undefined;
+        if (worker && input !== undefined)
+            return runFridaWorker(worker, input, 120_000, broker);
+        return baseSidecar(file, args, input);
+    };
+    const profileEngine = new ProfileEngine();
+    const profileAdapter = new ReaderProfileAdapter(broker);
+    const program = new Command()
+        .name("wowdump")
+        .description("Build-aware WoW native memory analysis CLI")
+        .version(packageVersion())
+        .showHelpAfterError()
+        .configureOutput({ writeOut: value => io.stdout.write(value), writeErr: value => io.stderr.write(value) });
+    program.command("targets")
+        .description("Discover running WoW targets, executable paths, and build versions")
+        .option("--pid <pid>", "select one process ID")
+        .action(async (options) => {
+        const selectedPid = options.pid ? positiveInteger(options.pid, "pid") : undefined;
+        const targets = await discoverWowTargets(selectedPid, async (pid) => broker({ command: "modules", payload: { pid } }));
+        if (selectedPid !== undefined && targets.length === 0)
+            throw new CliError("TARGET_NOT_FOUND", `Wow.exe process ${selectedPid} was not found`);
+        writeJson(io, {
+            ok: targets.length > 0,
+            command: "targets",
+            selected: targets.length === 1 ? targets[0] : null,
+            requiresSelection: selectedPid === undefined && targets.length > 1,
+            targets
+        });
+    });
+    program.command("target")
+        .description("Show target, reader broker, profile, monitor, and Frida state")
+        .option("--pid <pid>", "target process ID")
+        .option("--build <buildKey>", "expected build key")
+        .action(async (options) => {
+        const payload = {
+            ...(options.pid ? { pid: positiveInteger(options.pid, "pid") } : {}),
+            ...(options.build ? { buildKey: options.build } : {})
+        };
+        const status = await broker({ command: "status", payload });
+        writeJson(io, { ok: true, command: "target", home, broker: status, toolchain: resolveToolchain({ home, env }) });
+    });
+    program.command("profiles")
+        .description("List profiles or describe one profile")
+        .argument("[id-or-file]", "profile ID or absolute JSON file")
+        .option("--directory <path>", "profile directory", join(home, "profiles"))
+        .action(async (idOrFile, options) => {
+        const directory = resolve(options.directory);
+        if (idOrFile) {
+            const file = profileFile(directory, idOrFile);
+            const profile = jsonRecord(await readFile(file, "utf8"), file);
+            writeJson(io, { ok: true, command: "profiles.describe", file, profile });
+            return;
+        }
+        const files = await listProfileFiles(directory);
+        writeJson(io, { ok: true, command: "profiles.list", directory, profiles: await Promise.all(files.map(readProfileSummary)) });
+    });
+    const memory = program.command("memory").description("Read or monitor profile-defined native memory");
+    memory.command("read")
+        .description("Perform one bounded read")
+        .requiredOption("--pid <pid>", "target process ID")
+        .option("--build <buildKey>", "expected build key")
+        .option("--profile <id>", "profile ID")
+        .option("--field <name...>", "field names")
+        .option("--address <hex>", "explicit address as hexadecimal text")
+        .option("--size <bytes>", "bounded byte count")
+        .option("--request <json>", "complete read request as JSON")
+        .action(async (options) => {
+        const requested = options.request ? jsonRecord(options.request, "request") : undefined;
+        const payload = requested ?? {
+            pid: positiveInteger(options.pid, "pid"),
+            ...(options.build ? { buildKey: options.build } : {}),
+            ...(options.profile ? { profileId: options.profile } : {}),
+            ...(options.field ? { fields: options.field } : {}),
+            ...(options.address ? { address: options.address } : {}),
+            ...(options.size ? { size: positiveInteger(options.size, "size") } : {})
+        };
+        const pid = positiveInteger(String(payload.pid ?? options.pid), "pid");
+        const profileId = typeof payload.profileId === "string" ? payload.profileId : (typeof options.profile === "string" ? options.profile : undefined);
+        if (profileId && payload.address === undefined) {
+            const profileFilePath = profileFile(join(home, "profiles"), profileId);
+            const profile = jsonRecord(await readFile(profileFilePath, "utf8"), profileFilePath);
+            const result = await profileEngine.read({
+                pid,
+                buildKey: typeof payload.buildKey === "string" ? payload.buildKey : undefined,
+                profile,
+                fields: Array.isArray(payload.fields) ? payload.fields.map(String) : undefined
+            }, profileAdapter);
+            writeJson(io, { ...result, profileFile: profileFilePath });
+            return;
+        }
+        writeJson(io, await broker({ command: "read", payload }));
+    });
+    const watch = memory.command("watch").description("Manage broker-owned memory monitors");
+    watch.command("start")
+        .description("Start a monitor")
+        .requiredOption("--pid <pid>", "target process ID")
+        .option("--build <buildKey>", "expected build key")
+        .option("--profile <id>", "profile ID")
+        .option("--field <name...>", "field names")
+        .option("--address <hex>", "explicit address as hexadecimal text")
+        .option("--size <bytes>", "bounded byte count")
+        .option("--interval <ms>", "sample interval", "250")
+        .option("--max-samples <count>", "sample limit", "1000")
+        .option("--all-samples", "emit unchanged samples")
+        .action(async (options) => {
+        if (options.profile)
+            throw new CliError("PROFILE_WATCH_UNSUPPORTED", "profile watch requires a fixed address; use repeated memory read calls for dynamic pointer fields");
+        writeJson(io, await broker({ command: "watch.start", payload: {
+                pid: positiveInteger(options.pid, "pid"),
+                ...(options.build ? { buildKey: options.build } : {}),
+                ...(options.profile ? { profileId: options.profile } : {}),
+                ...(options.field ? { fields: options.field } : {}),
+                ...(options.address ? { address: options.address } : {}),
+                ...(options.size ? { size: positiveInteger(options.size, "size") } : {}),
+                intervalMs: positiveInteger(options.interval, "interval"),
+                maxSamples: positiveInteger(options.maxSamples, "max-samples"),
+                changeOnly: options.allSamples !== true
+            } }));
+    });
+    watch.command("poll")
+        .description("Poll monitor events")
+        .requiredOption("--id <watchId>", "monitor ID")
+        .option("--after <sequence>", "sequence cursor", "0")
+        .action(async (options) => writeJson(io, await broker({ command: "watch.poll", payload: {
+            watchId: options.id,
+            afterSequence: nonNegativeInteger(options.after, "after")
+        } })));
+    watch.command("stop")
+        .description("Stop a monitor and release its resources")
+        .requiredOption("--id <watchId>", "monitor ID")
+        .action(async (options) => writeJson(io, await broker({ command: "watch.stop", payload: { watchId: options.id } })));
+    const analyze = program.command("analyze").description("Run Frida evidence export and runtime-guided disassembly");
+    analyze.command("disassemble")
+        .description("Decode Frida text evidence and produce a Reader profile")
+        .requiredOption("--exe <path>", "path to Wow.exe")
+        .requiredOption("--build <buildKey>", "build key")
+        .requiredOption("--runtime-export <file>", "Frida runtime text JSON")
+        .option("--ida-evidence <file>", "JSON produced by an IDA Pro MCP analysis")
+        .option("--output <file>", "profile output JSON")
+        .option("--max-instructions <count>", "maximum decoded instructions", "256")
+        .option("--dry-run", "validate inputs without writing a profile")
+        .action(async (options) => writeJson(io, await runDisassembly({
+        exe: options.exe,
+        buildKey: options.build,
+        runtimeExport: options.runtimeExport,
+        ...(options.idaEvidence ? { idaEvidence: options.idaEvidence } : {}),
+        ...(options.output ? { output: options.output } : {}),
+        maxInstructions: positiveInteger(options.maxInstructions, "max-instructions"),
+        dryRun: options.dryRun === true
+    })));
+    analyze.command("runtime")
+        .description("Read runtime evidence through the elevated Frida broker")
+        .requiredOption("--pid <pid>", "target process ID")
+        .requiredOption("--build <buildKey>", "build key")
+        .option("--build-key <buildKey>", "alias for --build")
+        .option("--kind <kind>", "text or providers", "providers")
+        .option("--worker <path>", "Frida worker entry")
+        .option("--profile <path>", "existing reader profile containing candidate RVAs")
+        .option("--max-hooks <count>", "maximum hooks", "1")
+        .option("--duration-ms <ms>", "maximum duration", "5000")
+        .option("--max-events <count>", "maximum events", "100")
+        .option("--cleanup-deadline-ms <ms>", "cleanup deadline", "2000")
+        .option("--confirm", "confirm the exact bounded Frida operation")
+        .action(async (options) => {
+        const normalized = {
+            pid: positiveInteger(options.pid, "pid"),
+            build: options.build ?? options.buildKey,
+            kind: options.kind,
+            maxHooks: positiveInteger(options.maxHooks, "max-hooks"),
+            durationMs: positiveInteger(options.durationMs, "duration-ms"),
+            maxEvents: positiveInteger(options.maxEvents, "max-events"),
+            cleanupDeadlineMs: positiveInteger(options.cleanupDeadlineMs, "cleanup-deadline-ms"),
+            confirm: options.confirm === true
+        };
+        if (!["text", "providers"].includes(normalized.kind))
+            throw new CliError("ARGUMENT_INVALID", "kind must be text or providers");
+        requireRuntimeConfirmation(normalized);
+        const worker = resolve(options.worker ?? env.WOWDUMP_FRIDA_WORKER ?? join(packageDist, "frida-worker.js"));
+        if (!existsSync(worker))
+            throw new CliError("FRIDA_WORKER_NOT_FOUND", `Frida worker was not found: ${worker}`);
+        const profile = options.profile
+            ? jsonRecord(await readFile(resolve(options.profile), "utf8"), options.profile)
+            : undefined;
+        const request = {
+            command: "dynamic-script",
+            pid: normalized.pid,
+            build: normalized.build,
+            source: RUNTIME_EXPORT_SCRIPT,
+            exportName: "collect",
+            args: {
+                kind: normalized.kind,
+                maxHooks: normalized.maxHooks,
+                durationMs: normalized.durationMs,
+                maxEvents: normalized.maxEvents,
+                cleanupDeadlineMs: normalized.cleanupDeadlineMs,
+                ...(profile ? { profile } : {})
+            },
+            callArgs: [],
+            durationMs: normalized.durationMs
+        };
+        const result = await sidecar(process.execPath, [worker], `${JSON.stringify(request)}\n`);
+        if (result.exitCode !== 0)
+            throw new CliError("FRIDA_WORKER_FAILED", result.stderr.trim() || `Frida worker exited with ${result.exitCode}`);
+        const line = result.stdout.split(/\r?\n/).find(value => value.trim());
+        const value = line ? jsonRecord(line, "runtime result") : { ok: true, stdout: result.stdout };
+        writeJson(io, { ...value, command: "analyze.runtime" });
+    });
+    analyze.command("dynamic")
+        .description("Run a caller-supplied GumJS script through Frida")
+        .requiredOption("--pid <pid>", "target process ID")
+        .requiredOption("--build <buildKey>", "build key")
+        .requiredOption("--script <path>", "GumJS script file")
+        .option("--export <name>", "rpc.exports function to call")
+        .option("--args <json>", "JSON object exposed as __WOWDUMP_INPUT__", "{}")
+        .option("--call-args <json>", "JSON array passed to the exported function", "[]")
+        .option("--duration-ms <ms>", "maximum script duration", "5000")
+        .option("--confirm", "confirm the exact Frida operation")
+        .action(async (options) => {
+        const normalized = {
+            pid: positiveInteger(options.pid, "pid"),
+            build: options.build,
+            script: resolve(options.script),
+            ...(options.export ? { exportName: options.export } : {}),
+            args: jsonRecord(options.args, "args"),
+            callArgs: JSON.parse(options.callArgs),
+            durationMs: positiveInteger(options.durationMs, "duration-ms"),
+            confirm: options.confirm === true
+        };
+        if (!Array.isArray(normalized.callArgs))
+            throw new CliError("ARGUMENT_INVALID", "call-args must be a JSON array");
+        requireRuntimeConfirmation(normalized);
+        if (!existsSync(normalized.script))
+            throw new CliError("FRIDA_SCRIPT_NOT_FOUND", `Frida script was not found: ${normalized.script}`);
+        const worker = resolve(env.WOWDUMP_FRIDA_WORKER ?? join(packageDist, "frida-worker.js"));
+        if (!existsSync(worker))
+            throw new CliError("FRIDA_WORKER_NOT_FOUND", `Frida worker was not found: ${worker}`);
+        const request = { command: "dynamic-script", ...selected(normalized, ["pid", "build", "script", "exportName", "args", "callArgs", "durationMs"]) };
+        const result = await sidecar(process.execPath, [worker], `${JSON.stringify(request)}\n`);
+        if (result.exitCode !== 0)
+            throw new CliError("FRIDA_WORKER_FAILED", result.stderr.trim() || `Frida worker exited with ${result.exitCode}`);
+        const line = result.stdout.split(/\r?\n/).find(value => value.trim());
+        writeJson(io, line ? JSON.parse(line) : { ok: true, command: "analyze.dynamic", stdout: result.stdout });
+    });
+    program.command("init")
+        .description("Initialize WOWDUMP_HOME without overwriting existing files")
+        .option("--skip-toolchain-download", "kept for compatibility; no external toolchain is installed")
+        .action(async (options) => {
+        const installMissing = options.skipToolchainDownload !== true && env.WOWDUMP_SKIP_TOOLCHAIN_DOWNLOAD !== "1";
+        const result = await bootstrapToolchain({ home, env, installMissing });
+        writeJson(io, {
+            ok: result.toolchain.ready,
+            command: "init",
+            ...result,
+            toolchain: result.toolchain
+        });
+    });
+    return program;
+}
+export async function runWowdumpCli(argv = process.argv, dependencies = {}) {
+    const io = dependencies.io ?? { stdout: process.stdout, stderr: process.stderr };
+    try {
+        await createWowdumpCli(dependencies).parseAsync([...argv]);
+        return 0;
+    }
+    catch (error) {
+        const failure = error;
+        io.stderr.write(`${JSON.stringify({
+            ok: false,
+            error: {
+                code: typeof failure.code === "string" ? failure.code : "CLI_FAILED",
+                message: error instanceof Error ? error.message : String(error),
+                ...(failure.details !== undefined ? { details: failure.details } : {})
+            }
+        })}\n`);
+        return 1;
+    }
+}
+let invokedFile = "";
+if (process.argv[1]) {
+    const invokedPath = resolve(process.argv[1]);
+    try {
+        invokedFile = pathToFileURL(realpathSync(invokedPath)).href;
+    }
+    catch {
+        invokedFile = pathToFileURL(invokedPath).href;
+    }
+}
+if (invokedFile === import.meta.url) {
+    await initializeWowdumpHome();
+    process.exitCode = await runWowdumpCli();
+}