every-app-is-open-source 0.1.0__py3-none-any.whl

eaos/__init__.py

@@ -0,0 +1,3 @@
+"""Small, evidence-linked native-analysis tools for AI agents."""
+
+__version__ = "0.1.0"

eaos/backend.py

@@ -0,0 +1,246 @@
+"""Small PyGhidra adapter. A digest-keyed persistent project lives beside the binary."""
+from __future__ import annotations
+
+import fcntl
+import hashlib
+import json
+import os
+import re
+import subprocess
+import sys
+import time
+from pathlib import Path
+
+from .evidence import Evidence
+from .swift import decode_small_string
+from .runtime import configure
+
+
+class Backend:
+    def __init__(self, target: str):
+        self.target = Path(target).expanduser().resolve(strict=True)
+        if not self.target.is_file():
+            raise ValueError("Target must be a regular file")
+        self.digest = hashlib.sha256(self.target.read_bytes()).hexdigest()
+        self.directory = self.target.parent / 'eaos-analysis' / self.digest
+        self.directory.mkdir(parents=True, exist_ok=True)
+        self.evidence = Evidence(self.directory / 'evidence', self.digest)
+        self.program = self.project = self.consumer = self.decompiler = None
+        self.lock = None
+
+    def _load(self):
+        if self.program is not None:
+            return
+        self.lock = (self.directory / 'session.lock').open('a+')
+        try:
+            fcntl.flock(self.lock, fcntl.LOCK_EX | fcntl.LOCK_NB)
+        except BlockingIOError:
+            self.lock.close()
+            self.lock = None
+            raise RuntimeError("Program is already open in another EAOS process; close it before retrying")
+        tools, ghidra, jdk = configure()
+        from pyghidra.launcher import HeadlessPyGhidraLauncher
+        import pyghidra
+        if not pyghidra.started():
+            launcher = HeadlessPyGhidraLauncher(install_dir=ghidra)
+            state = tools / 'java-state'; state.mkdir(parents=True, exist_ok=True)
+            launcher.add_vmargs('-Xmx4G', f'-Duser.home={state}')
+            launcher.start()
+        from ghidra.util.task import TaskMonitor
+        from ghidra.program.util import GhidraProgramUtilities
+        from ghidra.app.decompiler import DecompInterface
+        monitor = TaskMonitor.DUMMY
+        project_dir = self.directory / 'ghidra'; project_dir.mkdir(exist_ok=True)
+        self.project = pyghidra.open_project(project_dir, 'program', create=True)
+        started = time.monotonic()
+        imported = self.project.getProjectData().getFile('/'+self.target.name) is None
+        if imported:
+            results = pyghidra.program_loader().project(self.project).source(str(self.target)).name(self.target.name).load()
+            try:
+                results.getPrimary().save(monitor)
+            finally:
+                results.close()
+        self.program, self.consumer = pyghidra.consume_program(self.project, '/'+self.target.name)
+        analyzed = False
+        if imported or not GhidraProgramUtilities.isAnalyzed(self.program):
+            log = pyghidra.analyze(self.program)
+            (self.directory / 'analysis.log').write_text(str(log))
+            self.program.save('EAOS initial analysis', monitor)
+            analyzed = True
+        metadata_path = self.directory / 'analysis.json'
+        metadata = json.loads(metadata_path.read_text()) if metadata_path.exists() else {}
+        metadata.update(target=str(self.target), sha256=self.digest,
+            ghidra_version='12.1.4', language=str(self.program.getLanguageID()))
+        if analyzed:
+            metadata['analysis_count'] = metadata.get('analysis_count', 0) + 1
+            metadata['analysis_seconds'] = time.monotonic() - started
+        metadata_path.write_text(json.dumps(metadata, indent=2))
+        self.decompiler = DecompInterface()
+        self.decompiler.openProgram(self.program)
+
+    def close(self):
+        if self.decompiler is not None:
+            self.decompiler.dispose()
+            self.decompiler = None
+        if self.program is not None:
+            self.program.release(self.consumer)
+            self.program = None
+        if self.project is not None:
+            self.project.close()
+            self.project = None
+        if self.lock is not None:
+            fcntl.flock(self.lock, fcntl.LOCK_UN); self.lock.close(); self.lock = None
+
+    def result(self, operation, classification, data, limitations=None, preview=None):
+        evidence = self.evidence.save(operation, classification, data, limitations)
+        return {'classification': classification, 'data': data if preview is None else preview,
+                'limitations': limitations or [],
+                'evidence': {'id': evidence['id'], 'uri': evidence['uri']}}
+
+    def address(self, address):
+        result = self.program.getAddressFactory().getAddress(str(address))
+        if result is None:
+            raise ValueError('Invalid program address')
+        return result
+
+    def function(self, address):
+        addr = self.address(address)
+        fn = self.program.getFunctionManager().getFunctionContaining(addr)
+        if fn is None:
+            raise ValueError('No analyzed function contains this address; inspect references or memory')
+        return fn
+
+    def fn_info(self, fn):
+        return {'address': str(fn.getEntryPoint()), 'name': str(fn.getName()),
+                'signature': str(fn.getSignature()), 'size': int(fn.getBody().getNumAddresses())}
+
+    def open_program(self, full=False):
+        self._load()
+        blocks = [{'name':str(b.getName()),'start':str(b.getStart()),'end':str(b.getEnd()),
+            'read':bool(b.isRead()),'write':bool(b.isWrite()),'execute':bool(b.isExecute())}
+            for b in self.program.getMemory().getBlocks()]
+        data = {'target': str(self.target), 'sha256': self.digest,
+                'language': str(self.program.getLanguageID()),
+                'function_count': int(self.program.getFunctionManager().getFunctionCount()),
+                'memory': blocks, 'cache':json.loads((self.directory/'analysis.json').read_text())}
+        preview = data if full else {k:data[k] for k in ('sha256','language','function_count')}
+        if not full:
+            preview['analysis_count'] = data['cache'].get('analysis_count')
+            preview['memory'] = [{'name':b['name'],'start':b['start'],'end':b['end'],
+                'permissions': ''.join(c if b[k] else '-' for c,k in [('r','read'),('w','write'),('x','execute')])} for b in blocks]
+        return self.result('open_program','computed',data,
+            ['Recovered functions/types are computed, not original source.'], preview)
+
+    def search(self, kind='strings', pattern='', offset=0, limit=30, full=False):
+        self._load()
+        if not 0 <= offset or not 1 <= limit <= 200:
+            raise ValueError('offset must be nonnegative and limit 1..200')
+        pattern = pattern.casefold()
+        rows = []
+        if kind == 'functions':
+            for fn in self.program.getFunctionManager().getFunctions(True):
+                item = self.fn_info(fn)
+                if pattern in (item['name']+' '+item['signature']).casefold(): rows.append(item)
+        elif kind == 'strings':
+            from java.lang import String
+            for item in self.program.getListing().getDefinedData(True):
+                value = item.getValue()
+                if not isinstance(value, (str, String)): continue
+                text = str(value)
+                if pattern not in text.casefold(): continue
+                refs = list(self.program.getReferenceManager().getReferencesTo(item.getAddress()))
+                rows.append({'address':str(item.getAddress()),'text':text,
+                    'references':[{'address':str(r.getFromAddress()),
+                       'function':self.fn_info(fn) if (fn:=self.program.getFunctionManager().getFunctionContaining(r.getFromAddress())) else None}
+                       for r in refs]})
+        else:
+            raise ValueError('kind must be strings or functions')
+        page = rows[offset:offset+limit]
+        data = {'kind':kind,'matches':len(rows),'items':page,
+                'next_offset':offset+limit if offset+limit<len(rows) else None}
+        preview = json.loads(json.dumps(data))
+        if not full:
+            for item in preview['items']:
+                item.pop('signature',None); item.pop('size',None)
+                for ref in item.get('references',[]):
+                    if ref['function']:
+                        ref['function'] = {'address':ref['function']['address']}
+        return self.result('search','computed',data,
+            ['Only Ghidra-defined strings/functions; other text may be absent.'], preview)
+
+    def inspect(self, addresses, mode='decompile', full=False):
+        self._load()
+        if not 1 <= len(addresses) <= 8: raise ValueError('Supply 1..8 addresses')
+        if mode not in {'decompile','assembly','references','calls','all'}:
+            raise ValueError('mode must be decompile, assembly, references, calls or all')
+        from ghidra.util.task import TaskMonitor
+        rows = []
+        for address in addresses:
+            addr = self.address(address)
+            if mode == 'references':
+                refs = [{'from':str(r.getFromAddress()),'to':str(r.getToAddress()),
+                    'type':str(r.getReferenceType()),
+                    'function':self.fn_info(fn) if (fn:=self.program.getFunctionManager().getFunctionContaining(r.getFromAddress())) else None}
+                    for r in self.program.getReferenceManager().getReferencesTo(addr)]
+                rows.append({'address':str(addr),'references':refs});continue
+            fn = self.function(address); row = self.fn_info(fn)
+            if mode in {'decompile','all'}:
+                result = self.decompiler.decompileFunction(fn, 60, TaskMonitor.DUMMY)
+                if not result.decompileCompleted(): raise RuntimeError(str(result.getErrorMessage()))
+                code = str(result.getDecompiledFunction().getC())
+                row['pseudocode'] = code
+                path = self.directory/'evidence'/f'function-{fn.getEntryPoint()}.c'
+                path.write_text(code)
+            if mode in {'assembly','all'}:
+                row['instructions'] = [{'address':str(i.getAddress()), 'text':str(i),
+                    'bytes':bytes((int(b)&255) for b in i.getBytes()).hex()}
+                    for i in self.program.getListing().getInstructions(fn.getBody(),True)]
+            if mode in {'calls','all'} or (mode=='decompile' and full):
+                row['callers'] = sorted([self.fn_info(f) for f in fn.getCallingFunctions(TaskMonitor.DUMMY)],key=lambda f:f['address'])
+                row['callees'] = sorted([self.fn_info(f) for f in fn.getCalledFunctions(TaskMonitor.DUMMY)],key=lambda f:f['address'])
+            rows.append(row)
+        preview = json.loads(json.dumps(rows))
+        for row in preview:
+            if 'pseudocode' in row:
+                cap = 32000 if full else 5000
+                row['truncated'] = len(row['pseudocode']) > cap
+                row['pseudocode'] = row['pseudocode'][:cap]
+            for field in ['instructions','references','callers','callees']:
+                if field in row:
+                    count = 500 if full else (64 if field=='instructions' else 30)
+                    row[field+'_total'] = len(row[field]);row[field] = row[field][:count]
+        return self.result('inspect','fact' if mode=='assembly' else 'computed',rows,
+            ['Pseudocode, types and call graph are computed static interpretations; indirect calls may be unresolved.'] if mode!='assembly' else [], preview)
+
+    def read_memory(self, address, length=64, format='hex'):
+        self._load()
+        if format not in {'hex','utf8','both'}: raise ValueError('format must be hex, utf8 or both')
+        if not 1 <= length <= 65536: raise ValueError('length must be 1..65536')
+        import jpype
+        raw = jpype.JArray(jpype.JByte)(length)
+        count = self.program.getMemory().getBytes(self.address(address),raw)
+        data = bytes(int(x)&255 for x in raw[:count])
+        record = {'address':address,'length':count,'hex':data.hex(),
+            'utf8':data.decode('utf-8',errors='replace')}
+        preview = {k:v for k,v in record.items() if k not in {'hex','utf8'} or format=='both' or k==format}
+        return self.result('read_memory','fact',record,preview=preview)
+
+    def calculate(self, expression):
+        process = subprocess.run([sys.executable,'-I',str(Path(__file__).with_name('calculator.py'))],
+            input=json.dumps({'expression':expression}),capture_output=True,text=True,timeout=4)
+        if process.returncode: raise ValueError(process.stderr.strip())
+        return self.result('calculate','computed',{'expression':expression,'value':process.stdout.strip()},
+            ['Arithmetic establishes the supplied expression, not whether its premises match the binary.'])
+
+    def decode_swift_string(self, words=None, address=None):
+        limitations = ['Supports Swift small String storage only; no pointer-backed or Objective-C tagged strings.']
+        if address is not None:
+            raw = bytes.fromhex(self.read_memory(address,16)['data']['hex'])
+            words = [int.from_bytes(raw[:8],'little'),int.from_bytes(raw[8:],'little')]
+        else:
+            limitations.append('Words were supplied by the caller; their presence in this binary is not established.')
+        if words is None: raise ValueError('Supply words or a program address')
+        return self.result('decode_swift_string','computed',decode_small_string(words),limitations)
+
+    def read_evidence(self, id, offset=0, limit=12000):
+        return self.evidence.read(id,offset,limit)

eaos/calculator.py

@@ -0,0 +1,50 @@
+"""Pure bounded calculator. Executed in a time-limited child process by the tool."""
+import ast
+import json
+import sys
+
+NAMES = {k: v for k, v in dict(int=int, str=str, bytes=bytes, len=len, hex=hex,
+    bin=bin, abs=abs, min=min, max=max, round=round, sum=sum, list=list, tuple=tuple,
+    chr=chr, ord=ord, range=range, enumerate=enumerate, zip=zip, sorted=sorted,
+    float=float).items()}
+ATTRS = {'to_bytes','from_bytes','fromhex','hex','decode','encode','replace','split','join','strip'}
+ALLOWED = (ast.Expression,ast.Constant,ast.List,ast.Tuple,ast.Dict,ast.Set,ast.Load,
+    ast.Store,ast.BinOp,ast.UnaryOp,ast.BoolOp,ast.Compare,ast.IfExp,ast.Subscript,
+    ast.Slice,ast.Call,ast.Name,ast.Attribute,ast.keyword,ast.Add,ast.Sub,ast.Mult,
+    ast.Div,ast.FloorDiv,ast.Mod,ast.Pow,ast.BitAnd,ast.BitOr,ast.BitXor,ast.LShift,
+    ast.RShift,ast.UAdd,ast.USub,ast.Invert,ast.And,ast.Or,ast.Not,ast.Eq,ast.NotEq,
+    ast.Lt,ast.LtE,ast.Gt,ast.GtE,ast.In,ast.NotIn,ast.ListComp,ast.SetComp,
+    ast.DictComp,ast.GeneratorExp,ast.comprehension,ast.Lambda,ast.arguments,ast.arg)
+
+
+def calculate(expression):
+    if len(expression) > 10000:
+        raise ValueError("Expression too long")
+    tree = ast.parse(expression, mode='eval')
+    nodes = list(ast.walk(tree))
+    if len(nodes) > 2000:
+        raise ValueError("Expression too complex")
+    bound = {n.arg for n in nodes if isinstance(n, ast.arg)} | {
+        n.id for n in nodes if isinstance(n, ast.Name) and isinstance(n.ctx, ast.Store)}
+    for node in nodes:
+        if not isinstance(node, ALLOWED):
+            raise ValueError("Unsupported expression")
+        if isinstance(node, ast.Name) and node.id not in NAMES and node.id not in bound:
+            raise ValueError("Unsupported name")
+        if isinstance(node, ast.Attribute) and node.attr not in ATTRS:
+            raise ValueError("Unsupported attribute")
+    return repr(eval(compile(tree, '<calculator>', 'eval'), {'__builtins__': {}, **NAMES}, {}))
+
+
+if __name__ == '__main__':
+    try:
+        import resource
+        resource.setrlimit(resource.RLIMIT_CPU, (2, 2))
+        # Darwin advertises RLIMIT_AS but rejects setting it (EINVAL). Keep the
+        # CPU limit and caller's four-second timeout there; do not fail every sum.
+        if sys.platform != 'darwin':
+            resource.setrlimit(resource.RLIMIT_AS, (512*1024*1024, 512*1024*1024))
+        print(calculate(json.load(sys.stdin)['expression']))
+    except Exception as exc:
+        print(str(exc), file=sys.stderr)
+        sys.exit(1)

eaos/cli.py

@@ -0,0 +1,97 @@
+"""CLI and stdio MCP, using only the standard library for transport."""
+from __future__ import annotations
+
+import argparse
+import json
+import os
+from pathlib import Path
+import subprocess
+import sys
+
+from .backend import Backend
+
+
+def schema(properties=None, required=None):
+    return {'type':'object','properties':properties or {},'required':required or [],'additionalProperties':False}
+
+
+S = {'type':'string'}
+B = {'type':'boolean','default':False}
+TOOLS = [
+    ('open_program','Selected target, memory map and analysis cache. full=true includes all metadata.',schema({'full':B})),
+    ('search','Substring search of strings (with xrefs) or functions. Page with next_offset; full=true for signatures.',schema({'kind':{'type':'string','enum':['strings','functions']},'pattern':S,'offset':{'type':'integer','minimum':0},'limit':{'type':'integer','minimum':1,'maximum':200},'full':B})),
+    ('inspect','Batch addresses. Default computed pseudocode. mode=calls, references, assembly or all; full=true expands. Omitted detail: read_evidence.',schema({'addresses':{'type':'array','items':S,'minItems':1,'maxItems':8},'mode':{'type':'string','enum':['decompile','assembly','references','calls','all']},'full':B},['addresses'])),
+    ('read_memory','Fact: literal bytes at a virtual address. Default hex; format=utf8 or both for text display.',schema({'address':S,'length':{'type':'integer','minimum':1,'maximum':65536},'format':{'type':'string','enum':['hex','utf8','both']}},['address'])),
+    ('calculate','Pure Python arithmetic/bytes expression. No imports, filesystem, network or program execution. Useful for numeric tables and packed constants.',schema({'expression':S},['expression'])),
+    ('decode_swift_string','Decode 64-bit little-endian Swift small String storage. Supply address or two unsigned words. Reject unsupported pointer layouts instead of inventing text.',schema({'words':{'type':'array','items':{'anyOf':[S,{'type':'integer'}]},'minItems':2,'maxItems':2},'address':S})),
+    ('read_evidence','Retrieve a content-checked evidence record by its returned id, with character paging. Never reads arbitrary paths.',schema({'id':S,'offset':{'type':'integer','minimum':0},'limit':{'type':'integer','minimum':1,'maximum':40000}},['id'])),
+]
+
+
+def protect_stdout():
+    sys.stdout.flush()
+    duplicate = os.dup(1)
+    os.dup2(2, 1)
+    sys.stdout = os.fdopen(duplicate, 'w', encoding='utf-8', buffering=1)
+
+
+def serve(backend):
+    catalog = [{'name':name,'description':description,'inputSchema':spec} for name,description,spec in TOOLS]
+    allowed = {t['name'] for t in catalog}
+    for line in sys.stdin:
+        try:
+            request = json.loads(line)
+        except ValueError:
+            continue
+        if 'id' not in request:
+            continue
+        try:
+            method = request['method']
+            if method == 'initialize':
+                result = {'protocolVersion':request.get('params',{}).get('protocolVersion','2024-11-05'),
+                    'capabilities':{'tools':{}},'serverInfo':{'name':'every-app-is-open-source','version':'0.1.0'}}
+            elif method == 'ping': result = {}
+            elif method == 'tools/list': result = {'tools':catalog}
+            elif method == 'tools/call':
+                name = request['params']['name']
+                if name not in allowed: raise ValueError('Unknown tool')
+                try:
+                    output = getattr(backend,name)(**request['params'].get('arguments',{}))
+                    result = {'content':[{'type':'text','text':json.dumps(output,ensure_ascii=False,separators=(',',':'))}]}
+                except Exception as exc:
+                    result = {'isError':True,'content':[{'type':'text','text':json.dumps({'error':str(exc),'classification':'fact','scope':'tool failure; no analysis claim'})}]}
+            else: raise ValueError('Unsupported method')
+            response = {'jsonrpc':'2.0','id':request['id'],'result':result}
+        except Exception as exc:
+            response = {'jsonrpc':'2.0','id':request['id'],'error':{'code':-32603,'message':str(exc)}}
+        print(json.dumps(response,ensure_ascii=False),flush=True)
+
+
+def main():
+    parser = argparse.ArgumentParser(description='Every App Is Open Source: small native analysis tools')
+    sub = parser.add_subparsers(dest='command',required=True)
+    setup = sub.add_parser('setup',help='Download verified Java/Ghidra and build the Apple Silicon decompiler')
+    setup.add_argument('--rebuild',action='store_true',help='Rebuild the ARM64 decompiler')
+    setup.add_argument('--archive-cache',type=Path,
+                       help='Use an existing directory of checksum-verified runtime archives')
+    server = sub.add_parser('mcp'); server.add_argument('binary')
+    call = sub.add_parser('call');call.add_argument('binary');call.add_argument('tool',choices=[t[0] for t in TOOLS]);call.add_argument('--args',default='{}')
+    args = parser.parse_args()
+    if args.command == 'setup':
+        from .runtime import install
+        try:
+            install(args.rebuild, args.archive_cache.expanduser().resolve() if args.archive_cache else None)
+        except (RuntimeError,OSError,subprocess.CalledProcessError) as exc:
+            parser.exit(1, f'EAOS setup failed: {exc}\n')
+        return
+    protect_stdout()
+    backend = Backend(args.binary)
+    try:
+        if args.command == 'mcp': serve(backend)
+        else: print(json.dumps(getattr(backend,args.tool)(**json.loads(args.args)),ensure_ascii=False,indent=2))
+    finally:
+        backend.close()
+
+
+if __name__ == '__main__':
+    main()

eaos/distributions.json

@@ -0,0 +1,10 @@
+{
+  "ghidra.zip": {
+    "sha256": "ddac49f903da9d5bac833e5cc79395098b9c33cfd3279be5f31bd00387d2d4db",
+    "bytes": 569649598
+  },
+  "jdk.tar.gz": {
+    "sha256": "3623232f33a9c3baadf304480b2535f9a3cba8a58d42ecbb438ba267315d9998",
+    "bytes": 200073404
+  }
+}

eaos/evidence.py

@@ -0,0 +1,47 @@
+"""Durable, content-checked evidence stored alongside the input program."""
+from __future__ import annotations
+
+import hashlib
+import json
+import re
+from pathlib import Path
+
+
+class Evidence:
+    def __init__(self, directory: Path, target_sha256: str):
+        self.directory = directory
+        directory.mkdir(parents=True, exist_ok=True)
+        self.target_sha256 = target_sha256
+
+    def save(self, operation: str, classification: str, data, limitations=None):
+        if classification not in {"fact", "computed", "guess"}:
+            raise ValueError("Unknown evidence classification")
+        payload = {"target_sha256": self.target_sha256,
+                  "operation": operation, "classification": classification,
+                  "limitations": limitations or [], "data": data}
+        canonical = json.dumps(payload, ensure_ascii=False, sort_keys=True, separators=(',', ':')).encode()
+        identifier = hashlib.sha256(canonical).hexdigest()[:32]
+        path = self.directory / f"{identifier}.json"
+        record = {"id": identifier, **payload}
+        raw = json.dumps(record, ensure_ascii=False, indent=2, sort_keys=True).encode()
+        if path.exists() and path.read_bytes() != raw:
+            raise ValueError('Evidence identity collision or existing record changed')
+        path.write_bytes(raw)
+        digest = hashlib.sha256(raw).hexdigest()
+        (self.directory / f"{identifier}.sha256").write_text(digest + "\n")
+        return {"id": identifier, "path": str(path), "uri": path.as_uri(),
+                "sha256": digest, "target_sha256": self.target_sha256}
+
+    def read(self, identifier: str, offset: int = 0, limit: int = 12000):
+        if not re.fullmatch(r"[0-9a-f]{32}", identifier):
+            raise ValueError("Use an evidence id returned by this program's tools")
+        if offset < 0 or not 1 <= limit <= 40000:
+            raise ValueError("offset must be nonnegative; limit must be 1..40000")
+        path = self.directory / f"{identifier}.json"
+        raw = path.read_bytes()
+        if hashlib.sha256(raw).hexdigest() != (path.with_suffix('.sha256')).read_text().strip():
+            raise ValueError("Evidence hash mismatch")
+        text = raw.decode()
+        return {"classification": "fact", "id": identifier, "uri": path.as_uri(),
+                "offset": offset, "text": text[offset:offset+limit],
+                "next_offset": offset + limit if offset + limit < len(text) else None}

eaos/runtime.py

@@ -0,0 +1,189 @@
+"""Verified Java/Ghidra installation shared by wheels and checkout setup."""
+from pathlib import Path
+from importlib.resources import files
+from importlib.metadata import version, PackageNotFoundError
+import fcntl
+import hashlib
+import json
+import os
+import platform
+import shutil
+import subprocess
+import sys
+import tarfile
+import tempfile
+import urllib.request
+
+GHIDRA = 'ghidra_12.1.4_PUBLIC'
+JDK = 'jdk-21.0.12.1+1'
+BUILD_ARGS = ['make','-B','-o','xml.cc','-o','grammar.cc','-o','pcodeparse.cc',
+    '-o','slghparse.cc','-o','slghscan.cc','-j4','ghidra_opt',
+    'CXX=clang++ -std=c++11','ARCH_TYPE=-arch arm64',
+    'ADDITIONAL_FLAGS=-mmacosx-version-min=11.0 -w']
+
+
+def digest(path):
+    with path.open('rb') as source:
+        return hashlib.file_digest(source, 'sha256').hexdigest()
+
+
+def verify_archive(path, pin):
+    if path.stat().st_size != pin['bytes'] or digest(path) != pin['sha256']:
+        raise RuntimeError(f'Archive integrity check failed: {path}. Keep it for inspection; supply a valid archive before retrying.')
+
+
+def download(url, destination, pin):
+    """An interrupted or corrupt download never becomes the cached archive."""
+    destination.parent.mkdir(parents=True, exist_ok=True)
+    temporary = None
+    try:
+        with tempfile.NamedTemporaryFile(dir=destination.parent, suffix='.part', delete=False) as out:
+            temporary = Path(out.name)
+            request = urllib.request.Request(url, headers={'User-Agent':'EAOS-setup'})
+            with urllib.request.urlopen(request, timeout=60) as response:
+                shutil.copyfileobj(response, out, length=1024*1024)
+        verify_archive(temporary, pin)
+        temporary.replace(destination)
+    finally:
+        if temporary is not None:
+            temporary.unlink(missing_ok=True)
+
+
+def archive_url(name):
+    if name == 'jdk.tar.gz':
+        return 'https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.12.1%2B1/OpenJDK21U-jdk_aarch64_mac_hotspot_21.0.12.1_1.tar.gz'
+    request = urllib.request.Request(
+        'https://api.github.com/repos/NationalSecurityAgency/ghidra/releases/tags/Ghidra_12.1.4_build',
+        headers={'User-Agent':'EAOS-setup'})
+    with urllib.request.urlopen(request, timeout=60) as response:
+        release = json.load(response)
+    matches = [a['browser_download_url'] for a in release['assets']
+        if a['name'].startswith(GHIDRA+'_') and a['name'].endswith('.zip')]
+    if len(matches) != 1:
+        raise RuntimeError('Pinned Ghidra release asset is missing or ambiguous')
+    return matches[0]
+
+
+def unpack(archive, tools, directory):
+    """Commit a complete extraction; leave an existing runtime untouched."""
+    destination = tools/directory
+    if destination.exists():
+        raise RuntimeError(f'Refusing to replace an existing runtime: {destination}')
+    with tempfile.TemporaryDirectory(dir=tools, prefix='.unpack-') as temporary:
+        staging = Path(temporary)
+        if archive.name.endswith('.zip'):
+            subprocess.run(['/usr/bin/ditto','-x','-k',str(archive),str(staging)],check=True)
+        else:
+            with tarfile.open(archive) as source:
+                source.extractall(staging,filter='data')
+        extracted = staging/directory
+        required = extracted/'Ghidra/application.properties' if directory == GHIDRA else extracted/'Contents/Home/bin/java'
+        if not required.is_file():
+            raise RuntimeError(f'Archive is missing its expected runtime: {directory}')
+        extracted.rename(destination)
+
+
+def runtime_directory():
+    """Installed packages never derive writable storage from site-packages."""
+    override = os.environ.get('EAOS_RUNTIME_DIR')
+    if override:
+        return Path(override).expanduser().resolve()
+    source = Path(__file__).resolve()
+    checkout = source.parents[2]
+    if source.parent.parent.name == 'src' and (checkout/'install.sh').is_file():
+        return checkout/'.tools'
+    return Path.home()/'Library/Application Support/Every App Is Open Source/runtimes'
+
+
+def prerequisites():
+    if platform.system() != 'Darwin' or platform.machine() != 'arm64':
+        raise RuntimeError('Only Apple Silicon macOS is currently supported; no runtime downloads were started.')
+    subprocess.run(['/usr/bin/xcode-select','-p'],stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL,check=True)
+    for tool in ['make','clang++']:
+        subprocess.run(['/usr/bin/xcrun','--find',tool],stdout=subprocess.DEVNULL,check=True)
+
+
+def configure():
+    tools = runtime_directory()
+    ghidra = tools/GHIDRA
+    java = tools/JDK/'Contents/Home'
+    required = [java/'bin/java', ghidra/'Ghidra/application.properties',
+                ghidra/'Ghidra/Features/Decompiler/os/mac_arm_64/decompile']
+    if not all(path.is_file() for path in required):
+        raise RuntimeError('Java/Ghidra setup is incomplete. Run eaos setup first. Runtime directory: '+str(tools))
+    # Match the checkout launcher: prefer our verified managed runtimes over
+    # unrelated JAVA_HOME/GHIDRA_INSTALL_DIR values inherited from a client.
+    os.environ['JAVA_HOME'] = str(java)
+    os.environ['GHIDRA_INSTALL_DIR'] = str(ghidra)
+    return tools, ghidra, java
+
+
+def install(rebuild=False, archive_cache=None):
+    prerequisites()
+    tools = runtime_directory()
+    tools.mkdir(parents=True, exist_ok=True)
+    with (tools/'setup.lock').open('a+') as lock:
+        try:
+            fcntl.flock(lock,fcntl.LOCK_EX | fcntl.LOCK_NB)
+        except BlockingIOError:
+            raise RuntimeError('Another installation is running in '+str(tools)) from None
+        return install_locked(tools, rebuild, archive_cache)
+
+
+def install_locked(tools, rebuild=False, archive_cache=None):
+    pins = json.loads(files('eaos').joinpath('distributions.json').read_text())
+    archives = {};downloaded = []
+    for name,directory in [('ghidra.zip',GHIDRA),('jdk.tar.gz',JDK)]:
+        destination = tools/directory
+        required = destination/'Ghidra/application.properties' if directory == GHIDRA else destination/'Contents/Home/bin/java'
+        if destination.exists():
+            if not required.is_file():
+                raise RuntimeError(f'Incomplete runtime at {destination}; move it aside before retrying.')
+            continue
+        archive = (archive_cache or tools/'distributions')/name
+        if not archive.is_file():
+            if archive_cache is not None:
+                raise RuntimeError(f'Missing archive in supplied cache: {archive}')
+            print(f'Downloading pinned {name} ({pins[name]["bytes"]:,} bytes)…',flush=True)
+            download(archive_url(name),archive,pins[name]);downloaded.append(name)
+        verify_archive(archive,pins[name]);archives[name]=str(archive)
+        print(f'Extracting verified {name}…',flush=True)
+        unpack(archive,tools,directory)
+    ghidra = tools/GHIDRA;java = tools/JDK/'Contents/Home'
+    properties = (ghidra/'Ghidra/application.properties').read_text()
+    if 'application.version=12.1.4' not in properties.splitlines():
+        raise RuntimeError('Unexpected Ghidra version')
+    output = ghidra/'Ghidra/Features/Decompiler/os/mac_arm_64/decompile'
+    rebuilt = rebuild or not output.is_file()
+    if rebuilt:
+        print('Building the Apple Silicon decompiler; log: '+str(tools/'decompiler-build.log'),flush=True)
+        cpp = ghidra/'Ghidra/Features/Decompiler/src/decompile/cpp'
+        # Keep release-generated parsers; no Bison, CMake or other build installs.
+        with (tools/'decompiler-build.log').open('w') as log:
+            subprocess.run(BUILD_ARGS,cwd=cpp,stdout=log,stderr=subprocess.STDOUT,check=True)
+        output.parent.mkdir(parents=True,exist_ok=True)
+        temporary = output.with_name('.eaos-decompile')
+        try:
+            shutil.copy2(cpp/'ghidra_opt',temporary);temporary.replace(output)
+        finally:temporary.unlink(missing_ok=True)
+    check = subprocess.check_output(['file',str(output)],text=True).strip()
+    if 'arm64' not in check:
+        raise RuntimeError('Decompiler is not an ARM64 executable: '+check)
+    java_check = subprocess.run([str(java/'bin/java'),'-version'],capture_output=True,text=True,check=True)
+    if 'version "21.' not in java_check.stderr:
+        raise RuntimeError('Unexpected Java version: '+java_check.stderr)
+    try:
+        pyghidra_version = version('pyghidra')
+    except PackageNotFoundError:
+        pyghidra_version = None  # The checkout installs bindings after native setup.
+    report = {'ghidra':str(ghidra),'java_home':str(java),'java_version':java_check.stderr.splitlines()[0],
+        'python':platform.python_version(),'pyghidra':pyghidra_version,
+        'python_executable':sys.executable,'package_location':str(Path(__file__).resolve().parent),
+        'decompiler':check,'decompiler_sha256':digest(output),'decompiler_built':rebuilt,
+        'verified_archives':archives,'downloaded':downloaded}
+    temporary = tools/'setup.json.part'
+    temporary.write_text(json.dumps(report,indent=2)+'\n')
+    temporary.replace(tools/'setup.json')
+    print('Ready. Java and Ghidra: '+str(tools),flush=True)
+    print('Receipt: '+str(tools/'setup.json'),flush=True)
+    return report

eaos/swift.py

@@ -0,0 +1,20 @@
+"""Decode the documented Swift small String bit layout; do not guess pointers."""
+
+
+def decode_small_string(words):
+    if len(words) != 2:
+        raise ValueError("Supply two 64-bit words in memory order")
+    values = [int(w, 0) if isinstance(w, str) else int(w) for w in words]
+    if any(w < 0 or w >= 1 << 64 for w in values):
+        raise ValueError("Words must be unsigned 64-bit values")
+    raw = b''.join(w.to_bytes(8, 'little') for w in values)
+    tag = raw[15]
+    if tag & 0xA0 != 0xA0:
+        raise ValueError("Not a supported small Swift String discriminator; pointer-backed strings require memory inspection")
+    size = tag & 0x0F
+    payload = raw[:size]
+    text = payload.decode('utf-8', errors='strict')
+    if tag & 0x40 and not payload.isascii():
+        raise ValueError("ASCII discriminator conflicts with payload")
+    return {"text": text, "utf8_bytes": size, "discriminator": hex(tag),
+            "raw_hex": raw.hex(), "layout": "Swift small String, 64-bit little endian"}

every_app_is_open_source-0.1.0.dist-info/METADATA

@@ -0,0 +1,151 @@
+Metadata-Version: 2.4
+Name: every-app-is-open-source
+Version: 0.1.0
+Summary: Small, evidence-linked reverse-engineering tools for agents
+Author-email: thomasisalwayslate <148886635+thomasisalwayslate@users.noreply.github.com>
+License-Expression: Apache-2.0
+Project-URL: Homepage, https://github.com/thomasisalwayslate/every-app-is-open-source
+Requires-Python: <3.14,>=3.13
+Description-Content-Type: text/markdown
+License-File: LICENSE
+License-File: NOTICE
+Requires-Dist: pyghidra==3.1.0
+Requires-Dist: jpype1==1.5.2
+Requires-Dist: packaging==26.3
+Dynamic: license-file
+
+# Every App Is Open Source
+
+**Same answers as REA. 36% cheaper. 27% faster.**
+
+I built this to give an AI agent the tools to take a compiled program apart and work out what it does, without the source code. Ghidra does the actual decompiling. My part is everything around it: a small set of tools, short replies by default, honest labels on every answer, and evidence you can trace back to the binary.
+
+Then I tested it against [REA](https://github.com/morluto/rea), the 300,000-star tool everyone's using, and against the community [GhidraMCP](https://github.com/LaurieWired/GhidraMCP). On a secretly modified Doom, all three got every answer right. Mine was the cheapest and the fastest.
+
+> The name is a provocation, not a license. This shows you how an app works. It doesn't give you the right to copy it.
+
+## Results
+
+Same model for everyone (gpt-6.1-sol, high effort), fresh sessions, six questions, three runs per tool:
+
+| Tool | Correct | Median time per run | Tokens, 3 runs | API-equivalent cost, 3 runs |
+|---|---:|---:|---:|---:|
+| **Every App Is Open Source** | **18/18** | **121.8s** | **1,728,000** | **$0.70** |
+| Community GhidraMCP | 18/18 | 146.2s | 2,337,886 | $0.84 |
+| REA 6.7.0 + its bundled skill | 18/18 | 166.7s | 3,603,877 | $1.09 |
+
+**How I kept it honest:**
+- **Doom's answers are all over the internet, so I changed them.** I built Chocolate Doom with eight gameplay rules secretly altered and stripped its function names. An agent answering from memory gets the original values, and those are now wrong.
+- **I froze the questions and the answer key before the first run.** The answer key comes from running the modified game code, not from me reading it.
+- **Everyone got the same head start.** All three began with the program already analyzed, outside the timer.
+- **REA ran the way people actually install it,** with its bundled skill and its full tool catalog.
+
+**What this doesn't prove:** all three scored 100%, so mine isn't smarter, just cheaper and faster. It's one game, three runs per tool, compiled programs only.
+
+My first version actually lost to GhidraMCP on cost. I read the logs, cut the repeated metadata and the detail nobody had asked for yet, then retested on new questions and a new build. Everything is kept, including the round I lost.
+
+[Full results](reports/round2/results.md) · [Every run](reports/round2/results.json) · [Answer-by-answer check](reports/round2/answer-review.json) · [Frozen protocol](benchmark/protocol-round2.json) · [The round I lost](reports/results.md)
+
+## Install
+
+You need an Apple Silicon Mac, [uv](https://docs.astral.sh/uv/) and Apple's Command Line Tools (`xcode-select --install`).
+
+```sh
+uvx --python 3.13 --from every-app-is-open-source eaos setup
+```
+
+That downloads checksum-pinned Ghidra 12.1.4 and Java 21, and builds Ghidra's Apple Silicon decompiler, because the official download doesn't include one. Everything lands in `~/Library/Application Support/Every App Is Open Source/`. Nothing global, no shell profile edits, no touching your agent's settings. It takes under a minute, and running it again reuses what's there.
+
+## Use it
+
+Point your agent at one program:
+
+```sh
+uvx --python 3.13 --from every-app-is-open-source eaos mcp /absolute/path/to/program
+```
+
+For an MCP client config, the command is `uvx` and the arguments are:
+
+```json
+["--python", "3.13", "--from", "every-app-is-open-source", "eaos", "mcp", "/absolute/path/to/program"]
+```
+
+Or try a single tool from the terminal:
+
+```sh
+uvx --python 3.13 --from every-app-is-open-source eaos call /absolute/path/to/program open_program
+```
+
+The server only sees the one program you give it. It can't read other files on your machine.
+
+## The seven tools
+
+I counted every tool call the agents made across my earlier 24 test runs and built only what they actually used.
+
+| Tool | What it does |
+|---|---|
+| `open_program` | What the program is: architecture, memory layout, analysis status |
+| `search` | Find text inside the program and where it's used, or find functions |
+| `inspect` | Decompiled code, raw instructions, callers and callees |
+| `read_memory` | Read the actual bytes at an address |
+| `calculate` | Safe arithmetic and byte decoding, so the agent doesn't do math in its head |
+| `decode_swift_string` | Recover text hidden inside Swift code on Apple platforms |
+| `read_evidence` | Pull up the full saved evidence behind any reply, hash-checked |
+
+## Never "exact" for a guess
+
+That was REA's worst habit: a name-based guess labelled "observed, exact." Here, every answer says what it is:
+
+- **fact**: read straight from the binary
+- **computed**: worked out deterministically, like decompiled code or a decoded string
+- **guess**: an interpretation with nothing solid behind it
+
+Decompiled code is computed, not the original source. When a tool fails, it says it failed.
+
+## Analyze once, reuse forever
+
+Ghidra's analysis is slow, so each program gets its own `eaos-analysis/<sha256>/` folder right next to it, holding the analyzed project and every piece of evidence. Opening the same program again reuses all of it.
+
+One Ghidra quirk: it won't create projects inside a folder whose name starts with a dot, like `.cache`. Keep the program you're analyzing out of those.
+
+## From a checkout
+
+If you'd rather run it from the repo:
+
+```sh
+./install.sh
+./eaos mcp /absolute/path/to/program
+```
+
+Same requirements. Java, Ghidra and Python all install inside the checkout.
+
+## What's next
+
+I only claim "better" where I've measured it:
+
+| Area | Status |
+|---|---|
+| Compiled programs | ✅ Beat REA and GhidraMCP on cost and speed, on modified Doom |
+| JavaScript / Electron apps | Next: VS Code, with its own hidden answer key |
+| Android apps | Planned |
+| .NET apps | Planned |
+| Websites, watching apps run | Planned |
+
+Each one gets the same treatment: a secretly modified target, a frozen answer key and a fair fight against REA, before I claim anything.
+
+## Rerun my test
+
+```sh
+uv run python -m unittest discover -s tests -v
+python3 benchmark/build_doom.py
+```
+
+`build_doom.py` makes a fresh build with new random changes, so you get your own answer key. The binary and answer key from my run stay private, since publishing them would spoil the test. In the saved reports, file paths from my machine are shortened to `<repo>`.
+
+## Credits
+
+Ghidra and PyGhidra do the heavy lifting; they're the work of their own contributors. The comparison baseline is LaurieWired's GhidraMCP. The test target is Chocolate Doom, based on id Software's Doom and released under GPLv2.
+
+## License
+
+[Apache 2.0](LICENSE). If you build on this, keep the [NOTICE](NOTICE) file. Before you point it at anything, read the [disclaimer](DISCLAIMER.md).

every_app_is_open_source-0.1.0.dist-info/RECORD

@@ -0,0 +1,15 @@
+eaos/__init__.py,sha256=KGP0y-awfQFFRKsNDjRDRGBTKLr1nC4hSmjzolQ91QM,89
+eaos/backend.py,sha256=q--HSnl_tQN1nmn3izeuksrKzvi4OwvdJkti0eWL-aE,13477
+eaos/calculator.py,sha256=jvktzy_TOo0edUHn04Z7dVNK5M0GxWGc-2MbJ6xivso,2529
+eaos/cli.py,sha256=I3AnfxMdTUKR8pbzpCv7C80r4Txk5kRXAm6rDYpCWtY,5591
+eaos/distributions.json,sha256=D17G5md2pnh3mPHKhV6ZH0YBZ-IfBEgHLvqGIzVI7tk,258
+eaos/evidence.py,sha256=do29Hv-g0-YAR0oC2HhyxwPt4hWKM7UyVSLX4ZTEoSE,2448
+eaos/runtime.py,sha256=QKWcUzC-7YQmoogZfhK1eDqUfgbJbvN7U58BJjiPM90,9167
+eaos/swift.py,sha256=9xfXN5NX7M2EeuYy0QnFOa9ffmm_6EXg7ZhdplahCzY,1006
+every_app_is_open_source-0.1.0.dist-info/licenses/LICENSE,sha256=yVuuHRzgI17MzTVgt3LsHvuX80innw--CmNPDCzO_iw,11358
+every_app_is_open_source-0.1.0.dist-info/licenses/NOTICE,sha256=JDnaDWl6m2Cha5CvOyqRBuy0fXz3flC2iQ86Hk_HQ0w,324
+every_app_is_open_source-0.1.0.dist-info/METADATA,sha256=QkGqKaGvuNI1RXRqfcMawFHnvSnUCFcDtid0xbbvE6c,7280
+every_app_is_open_source-0.1.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+every_app_is_open_source-0.1.0.dist-info/entry_points.txt,sha256=munXUOz9BrB9TnziGx42RQB1XH1MVd2SDdzaiduW_uM,39
+every_app_is_open_source-0.1.0.dist-info/top_level.txt,sha256=TINcf2knZ4iq3rc398i6PR8SetMMRVJDKQaoXPFd6Ck,5
+every_app_is_open_source-0.1.0.dist-info/RECORD,,

every_app_is_open_source-0.1.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.0.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

every_app_is_open_source-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+eaos = eaos.cli:main

every_app_is_open_source-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,202 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+

every_app_is_open_source-0.1.0.dist-info/licenses/NOTICE

@@ -0,0 +1,7 @@
+Every App Is Open Source
+Copyright 2026 thomasisalwayslate
+https://github.com/thomasisalwayslate/every-app-is-open-source
+
+This product includes software developed by thomasisalwayslate.
+If you redistribute this software or build on it, keep this NOTICE file,
+as required by section 4(d) of the Apache License, Version 2.0.

every_app_is_open_source-0.1.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+eaos