860fdd8fbe
* refactor(macho): extract non-throwing container and slice load-command readers Split readMachoImage into readMachoContainer, which classifies a file as thin, FAT or not Mach-O and keeps FAT range issues per slice, and readSliceLoadCommands, which reads one slice header and frames its load commands, returning every command framed before a failure. readMachoImage keeps its strict policy on top of them: commands framed before a framing defect still decode first, an unsupported FAT slice still yields to a later malformed one, and the first FAT range issue is still reported. A characterization test pins that precedence for inputs with several defects; it passes against both the previous and the new implementation. Part of #4306. * feat(macho): report per-slice encryption status in inspect_macho inspect_macho now reports the LC_ENCRYPTION_INFO(_64) state of every slice in a new `encryption` collection, read in process from load commands without reading code bytes. - Each slice is encrypted, not-encrypted, absent, malformed or unknown. Absent requires a completed load-command walk; malformed and unknown carry a reason and keep commands read before the failure. - The named range is end-exclusive in slice and input-file coordinates and maps to file-backed segment fragments, VM addresses and the overlapping nonempty sections. - A ciphertext range adds a limitation naming its input-file bytes. - The in-process read and the native tools are bracketed by one regular file descriptor and stat identity checks; a change reports artifact_changed. A missing or inaccessible target keeps the tool facts and reports encryption as non-exhaustive, never absent. - Retained Evidence recorded before this field is parsed by the owning schema and reports encryption as unknown in the macho view and in managed/native verification. Fixes #4306 * fix(macho): keep slice facts and failures under large tables and close errors - Frame load commands through a visitor instead of retaining every command, restoring the pre-refactor memory profile (2M eight-byte commands: peak heap 370 MiB -> 0.9 MiB). - Confirm a large FAT container from a valid slice's Mach-O header so a sibling's range fault stays per slice instead of hiding healthy slices. - Name only sections whose bytes the range and their segment both cover. - Throw inspection failures inside the owned descriptor callback so a close failure keeps them as its primary error. * fix(macho): map encrypted ranges only within segment VM extents mapRange gave every file-backed segment fragment VM addresses, even for a segment with no VM size, whose file bytes dyld never maps, and past vmsize when a segment declared more file bytes than memory. Read vmsize with the segment. A segment with no VM size keeps its fragment with null VM addresses. A file size beyond the VM size, or a VM range past the address space, makes the mapping unknown with a reason while the slice keeps its encryption status. The docs also claimed the encryption read never reads code bytes. Like every Mach-O container read, a 0xcafebabe input of at most 16 MiB is read whole to rule out a JVM class file; say so. * fix(macho): read encryption through the admitted descriptor facts Main's withArtifactRegularFile now hands callers the admitted handle and its initial stats. Use those facts instead of re-stating the handle, and pass the legacy Evidence payload straight to createEvidence. * fix(macho): retain a finished report when the target close fails The file owner keeps the completed callback value when the descriptor close fails or cancellation arrives during close. inspect_macho now validates that value and retains the report as the error's partial observation, as inspect_signature does, instead of returning only the cleanup or cancellation error. * test(native): supply readEncryption in merged dyld refusal cases main's new dyld refusal cases build NativeMachoInspectionContext without the encryption reader this branch requires. * test(views): bind the Mach-O encryption page to its facet main's facet-ownership case builds inspect_macho Evidence without the encryption coverage this branch requires; the fixture now carries one slice row and the loop checks the encryption page like the other facets. * fix(macho): bound encryption commands and range mapping across slices A slice retains at most two encryption load commands, since a second one already makes it malformed; the reason keeps the full count. Range mapping in every slice shares one budget of segment and section records, charged from each segment command's capacity before it is decoded. A slice past the budget keeps its encryption status and reports an unknown mapping. * style(macho): format encryption reader and binding test * fix(macho): stop retaining segments past the mapping budget Segment commands are collected during framing only while their mapping records still fit in the budget shared by all slices, and the budget is charged only when the slice maps its range. * docs(macho): clarify retained mapping allowance * fix(ci): own the Mach-O encryption test in Apple scope --------- Co-authored-by: t <t@t> Co-authored-by: gensokyo-dev <[email protected]>
601 lines
24 KiB
JavaScript
601 lines
24 KiB
JavaScript
// These boundaries require native Windows launch verification even where
|
|
// broad process ownership would otherwise suppress host fanout on the fast tier.
|
|
export const WINDOWS_EXECUTABLE_SELECTION_INPUTS = [
|
|
"src/process/WindowsExecutable*.ts",
|
|
"src/adb/AdbConfiguration.ts",
|
|
"src/apktool/ApktoolConfiguration.ts",
|
|
"src/application/UpdateCommandRunner.ts",
|
|
"tests/boundary/process/windowsExecutableSelection.test.ts",
|
|
];
|
|
|
|
// Ownership of the native-host, real-provider and website verification lanes.
|
|
// Shared build inputs are classified once in plan.mjs rather than repeated in
|
|
// every workflow.
|
|
export const SCOPES = {
|
|
readiness: [
|
|
"tests/conformance/readiness/**",
|
|
"scripts/verify-reconstruction-readiness.mjs",
|
|
],
|
|
reverse_tools: [
|
|
".github/workflows/mutation.yml",
|
|
"src/application/reverse/**",
|
|
"src/application/binary/BinarySession.ts",
|
|
"src/cutter/**",
|
|
"src/gdb/**",
|
|
"src/frida/frida-bindings.d.ts",
|
|
"src/objdump/**",
|
|
"src/cli/reverseEngineeringCommands.ts",
|
|
"src/process/ownedDebuggerSession.ts",
|
|
"src/rizin/**",
|
|
"src/contracts/*ToolContracts.ts",
|
|
"src/server/registerCutterTools.ts",
|
|
"src/server/externalMutationAdmission.ts",
|
|
"src/server/registerGdbTools.ts",
|
|
"src/server/registerReverseEngineeringTools.ts",
|
|
"src/server/providerEnvironment.ts",
|
|
"src/process/ExecFileOutput.ts",
|
|
"src/process/ExecFileOutput.test.ts",
|
|
"tests/composition/analysis-sessions/binarySession.test.ts",
|
|
"tests/boundary/filesystem/directAnalysisSnapshotReplay.test.ts",
|
|
"tests/boundary/filesystem/reverseToolsMutationConfig.test.ts",
|
|
"tests/boundary/filesystem/mutationWorkflow.test.ts",
|
|
"src/server/registerRizinDebugTools.ts",
|
|
"tests/boundary/providers/CutterBridge*.test.ts",
|
|
"tests/boundary/providers/cutterBridgeProducer.test.ts",
|
|
"tests/boundary/providers/GdbSession*.test.ts",
|
|
"tests/boundary/providers/GdbCommandQueue.test.ts",
|
|
"tests/boundary/providers/gdbTestHelpers.ts",
|
|
"tests/boundary/providers/RizinDebugSessionCoverage.part*.test.ts",
|
|
"tests/boundary/providers/RizinCommandTimeout.test.ts",
|
|
"tests/boundary/providers/RizinTimeoutEvidence.test.ts",
|
|
"tests/boundary/providers/RizinDebugSession*.test.ts",
|
|
"tests/boundary/providers/RizinInferiorTty.test.ts",
|
|
"tests/boundary/providers/RizinTestInferiorTty.ts",
|
|
"tests/boundary/process/ownedDebuggerSession.test.ts",
|
|
"tests/boundary/cli/gdbStartupCleanupCli.test.ts",
|
|
"tests/boundary/cli/reverseEngineeringCommands.test.ts",
|
|
"tests/boundary/mcp/cutter*.test.ts",
|
|
"tests/boundary/mcp/gdbCancellationMcp.test.ts",
|
|
"tests/boundary/mcp/debuggerCancellationMcp.test.ts",
|
|
"tests/boundary/mcp/rizinDebuggerCancellationMcp.test.ts",
|
|
"tests/boundary/mcp/rizinPendingOutput.test.ts",
|
|
"tests/boundary/mcp/reverseEngineeringPartialMcp.test.ts",
|
|
"tests/boundary/mcp/workflowSnapshotReplayMcp.test.ts",
|
|
"tests/boundary/mcp/reverseEngineeringEnvironmentMcp.test.ts",
|
|
"tests/support/reverseEngineering*.ts",
|
|
"tests/support/ownedRizinCommandEvidenceTests.ts",
|
|
"tests/support/reverseDebuggerMcpTestHelpers.ts",
|
|
"tests/processOwnershipRunner.ts",
|
|
"tests/composition/reverseEngineering*.test.ts",
|
|
"vitest.reverse-tools.config.ts",
|
|
"vitest.reverse-tools-semantics.config.ts",
|
|
"stryker.config.mjs",
|
|
"stryker.semantics.config.mjs",
|
|
"tsconfig.reverse-tools-mutation.json",
|
|
"scripts/prepare-reverse-tools-mutation.mjs",
|
|
"scripts/lib/reverse-tools-mutation-targets.mjs",
|
|
],
|
|
// Apple artifact CLI/MCP lane on macOS, including its focused regressions.
|
|
apple: [
|
|
"src/hopper/BridgeLauncher.ts",
|
|
"src/domain/hopperErrors.ts",
|
|
"tests/boundary/providers/hopper/hopperMacLaunchArguments.test.ts",
|
|
"tests/acceptance/providers/hopperStartupRecovery.test.ts",
|
|
"tests/boundary/providers/hopper/hopperClient.helperFailure.test.ts",
|
|
"tests/boundary/providers/hopper/bridgeBootstrapCleanup.test.ts",
|
|
"tests/boundary/providers/hopper/bridgeTargetLease.integration.test.ts",
|
|
"src/artifacts/NativeDmg*.ts",
|
|
"src/native/Apple*",
|
|
"src/native/NativeMacOS*",
|
|
"src/native/NativeUi*",
|
|
"src/native/Lldb*",
|
|
"bridge/native/**",
|
|
"bridge/process/**",
|
|
"scripts/verify/apple/**",
|
|
"tests/acceptance/artifactDmgAttachmentRecoveryCli.test.ts",
|
|
"tests/boundary/providers/native/nativeDmgArtifactReader.test.ts",
|
|
"tests/process-global/dmgCancellationReason.test.ts",
|
|
"tests/boundary/filesystem/installScript.test.ts",
|
|
"tests/boundary/filesystem/nibNativeHierarchy.test.ts",
|
|
"tests/boundary/filesystem/interfaceBuilderBundle.test.ts",
|
|
"tests/boundary/cli/nativePlistCli.test.ts",
|
|
"tests/boundary/cli/nativePlistPrototypeKeyCli.test.ts",
|
|
"tests/boundary/cli/nativePlistSelectionFailureCli.test.ts",
|
|
"tests/boundary/cli/nativeDemangleCli.test.ts",
|
|
"tests/boundary/cli/nativeDispatchPropertyAttributes.test.ts",
|
|
"tests/boundary/mcp/nativeDemangleMcp.test.ts",
|
|
"tests/boundary/providers/native/nativeSignatureTargetBinding.test.ts",
|
|
"tests/boundary/cli/nativeSignatureCli.test.ts",
|
|
"tests/boundary/cli/nativeMachoArm64_32Cli.test.ts",
|
|
"tests/boundary/cli/nativeMachoEncryptionCli.test.ts",
|
|
"tests/boundary/mcp/nativeSignatureTargetBindingMcp.test.ts",
|
|
"src/process/capture/FilesystemSnapshot.test.ts",
|
|
"tests/process-global/filesystemSnapshotFallbackCancellation.test.ts",
|
|
"tests/boundary/process/darwinProcessRunTokenReader.test.ts",
|
|
"tests/boundary/process/directAnalysisSignals.test.ts",
|
|
"tests/boundary/process/processCaptureLifecycle.test.ts",
|
|
"tests/boundary/process/processCli.test.ts",
|
|
"tests/boundary/mcp/sessionMcp.test.ts",
|
|
],
|
|
// Four-host installed-package matrix and the Windows curated lane.
|
|
package: [
|
|
...WINDOWS_EXECUTABLE_SELECTION_INPUTS,
|
|
// Both host compilers must be exercised when their installation, options,
|
|
// or entrypoints change; Linux's accelerated checker cannot stand in for Go.
|
|
"scripts/run-typescript.*",
|
|
"scripts/run-turbo.mjs",
|
|
"turbo.json",
|
|
"tsconfig.json",
|
|
"tsconfig.build.json",
|
|
"tsconfig.frida-verification.json",
|
|
"package-lock.json",
|
|
".nvmrc",
|
|
".npmrc",
|
|
".github/actions/publish-mcp/**",
|
|
".github/actions/prepare-release-package/**",
|
|
".github/workflows/release-recovery.yml",
|
|
"scripts/ci/release-recovery.mjs",
|
|
"scripts/ci/verified-package.mjs",
|
|
"scripts/ci/qualified-package-envelope.mjs",
|
|
"scripts/ci/prepare-npm-publication.mjs",
|
|
"scripts/ci/npm-release.*",
|
|
"scripts/ci/npm-release-state.*",
|
|
"scripts/verify-release-artifact.mjs",
|
|
"scripts/lib/release-package-canary.mjs",
|
|
"scripts/lib/verify-package-core.*",
|
|
"tests/boundary/mcp/packageCatalogVerification.test.ts",
|
|
"scripts/verify-published-package.mjs",
|
|
"tests/boundary/filesystem/releaseRecovery.test.ts",
|
|
"tests/boundary/filesystem/mcpRegistryPublication.test.ts",
|
|
"tests/boundary/filesystem/npmRelease.test.ts",
|
|
"tests/boundary/process/releaseArtifactCanary.test.ts",
|
|
"src/windows/**",
|
|
"src/domain/windowsNativeArtifact*.ts",
|
|
"src/domain/dosMz*.ts",
|
|
"src/domain/peCoffHeader*.ts",
|
|
"src/domain/result.ts",
|
|
"scripts/lib/verifier-source-loader.mjs",
|
|
"tests/boundary/process/windowsNativeArtifactVerifier.test.ts",
|
|
"scripts/lib/windows-native-inspection-workspace.*",
|
|
"tests/boundary/process/windowsNativeInspectionWorkspace.test.ts",
|
|
"scripts/lib/windows-owned-command.mjs",
|
|
"scripts/run-exclusive-command.mjs",
|
|
"tests/process-global/runnerCancellation.test.ts",
|
|
"tests/process-global/windowsOwnedCommand.test.ts",
|
|
"src/ghidra/GhidraBridgeSources.ts",
|
|
"native/windows/**",
|
|
"src/process/capture/FilesystemSnapshot.ts",
|
|
"src/process/capture/FilesystemSnapshot.test.ts",
|
|
"tests/process-global/filesystemSnapshotFallbackCancellation.test.ts",
|
|
"src/inspector/**",
|
|
"scripts/verify/inspector/**",
|
|
"scripts/verify-package.mjs",
|
|
"scripts/verify-package-*",
|
|
"scripts/verify-packed-bridge.*",
|
|
"scripts/verify-windows-*.mjs",
|
|
"scripts/build-windows-native.mjs",
|
|
"scripts/windows-capabilities.mjs",
|
|
"scripts/prepack.mjs",
|
|
"scripts/prepare.mjs",
|
|
"scripts/lib/release-proposal.mjs",
|
|
"patches/release-please+17.3.0.patch",
|
|
"tests/boundary/filesystem/releaseProposal.test.ts",
|
|
"scripts/rea.mjs",
|
|
"scripts/lib/cli-process-environment.mjs",
|
|
"install.sh",
|
|
"src/config/**",
|
|
"src/application/Setup*.ts",
|
|
"src/application/Uninstall*.ts",
|
|
"src/application/ClientConfiguration*.ts",
|
|
"src/application/ClientRegistration*.ts",
|
|
"src/application/DshCordis*.ts",
|
|
"src/cli/interactiveSetup.ts",
|
|
"src/cli/setupCommands.ts",
|
|
"tests/boundary/filesystem/typescriptCompiler.test.ts",
|
|
"tests/boundary/filesystem/binaryTarget.test.ts",
|
|
"src/contracts/sessionPathInputs.test.ts",
|
|
"tests/boundary/filesystem/directAnalysisSnapshotReplay.test.ts",
|
|
"tests/boundary/mcp/rawBinaryMcp.test.ts",
|
|
"tests/boundary/filesystem/safeOutputTree.test.ts",
|
|
"tests/boundary/providers/native/artifactProvider.archiveSafety.test.ts",
|
|
"tests/boundary/providers/native/artifactProvider.extractionCompleteness.test.ts",
|
|
"tests/boundary/filesystem/setupUnavailableProvider.test.ts",
|
|
"tests/boundary/filesystem/windowsNpxRegistration.test.ts",
|
|
"tests/boundary/filesystem/claudeDesktopSkillUninstallWindows.test.ts",
|
|
"tests/boundary/filesystem/clientConfigurationEnvironment.test.ts",
|
|
"tests/boundary/filesystem/clientConfigurationLayeredEnvironment.test.ts",
|
|
"tests/acceptance/setup/registrationRuntimeEnvironmentCli.test.ts",
|
|
"tests/boundary/android/workspaceGuardianRetry.test.ts",
|
|
"src/android/JadxWorkspaceRoot.ts",
|
|
"scripts/rea-android-workspace-guardian.mjs",
|
|
"tests/acceptance/setup/homeDirectoryFallback.test.ts",
|
|
"tests/boundary/filesystem/javascriptApplicationWorkflows.test.ts",
|
|
"src/domain/javascript/javascriptRuntimeStaticCandidates.ts",
|
|
"tests/boundary/filesystem/webScriptManifestPaths.test.ts",
|
|
"tests/boundary/process/ProcessEvidence.host.test.ts",
|
|
"tests/boundary/process/packageNpmInvocation.test.ts",
|
|
"tests/boundary/process/packedBridgeVerification.test.ts",
|
|
"tests/boundary/process/windowsOutputCapture.test.ts",
|
|
"tests/acceptance/webModuleCli.test.ts",
|
|
"tests/acceptance/webSourceLocationCli.test.ts",
|
|
"tests/boundary/cli/referenceSourceImportStatus.test.ts",
|
|
"tests/boundary/filesystem/asarInventoryFreshness.test.ts",
|
|
"tests/boundary/filesystem/javascript-applications/javascriptArtifactReconstruction.test.ts",
|
|
"tests/conformance/providers/ghidra/windowsCapabilities.test.ts",
|
|
"src/ghidra/GhidraInstallation.test.ts",
|
|
"tests/boundary/filesystem/ghidraJavaProbe.test.ts",
|
|
"tests/boundary/providers/ghidra/ghidraTransport.test.ts",
|
|
"tests/boundary/providers/ghidra/ghidraTargetSnapshot.test.ts",
|
|
"tests/boundary/providers/ghidra/ghidraLauncher.test.ts",
|
|
"tests/boundary/providers/hopper/hopperClient.cleanupRetry.test.ts",
|
|
"src/windows/WindowsNativeLoader.test.ts",
|
|
"src/windows/WindowsOwnedProcess.test.ts",
|
|
"src/ghidra/GhidraLauncherEnvironment.test.ts",
|
|
"src/process/ProcessOwnership.test.ts",
|
|
"src/process/ProcessOwnership.part2.test.ts",
|
|
"src/process/ProcessOwnership.part3.test.ts",
|
|
"src/process/ProcessOwnership.validation.test.ts",
|
|
"src/application/Update.test.ts",
|
|
"tests/process-global/updateMaintenance.test.ts",
|
|
"tests/conformance/providers/ghidra/realGhidraWindowsWorkflow.test.ts",
|
|
"tests/boundary/filesystem/directoryArtifactReaderOpen.test.ts",
|
|
"tests/boundary/filesystem/javascriptPackagePrecedence.test.ts",
|
|
"tests/boundary/filesystem/javascriptArtifactContentIdentity.test.ts",
|
|
"tests/boundary/process/sourceMapUncHosts.test.ts",
|
|
],
|
|
// Native SQLite runtime compatibility for the producer, public adapters,
|
|
// fixtures, shared lifecycle, and the package script that defines its suite.
|
|
sqlite: [
|
|
"src/sqlite/**",
|
|
"src/domain/sqlite/**",
|
|
"src/contracts/sqlite/**",
|
|
"src/application/sqlite/**",
|
|
"src/composition/sqlite.ts",
|
|
"src/cli/sqliteCommands.ts",
|
|
"src/server/registerSqliteTools.ts",
|
|
"src/application/DirectAnalysisStatus*.ts",
|
|
"src/application/CapabilityInventory*.ts",
|
|
"src/application/AnalysisProvider*.ts",
|
|
"src/contracts/toolContracts.ts",
|
|
"src/contracts/toolContractTypes.ts",
|
|
"src/contracts/toolEffects*.ts",
|
|
"src/contracts/toolOutputSchemaPrimitives.ts",
|
|
"src/domain/analysisError*.ts",
|
|
"src/domain/evidence*.ts",
|
|
"src/domain/inputIssueProjection*.ts",
|
|
"src/domain/jsonSerialization*.ts",
|
|
"src/domain/jsonValue*.ts",
|
|
"src/domain/localPath*.ts",
|
|
"src/domain/providerAdapterError*.ts",
|
|
"src/domain/providerCleanupError*.ts",
|
|
"src/domain/result*.ts",
|
|
"src/process/OwnedCommand*.ts",
|
|
"src/process/ProviderProcess*.ts",
|
|
"src/process/PrivateRuntimeRoot*.ts",
|
|
"src/artifacts/ArtifactReader*.ts",
|
|
"src/artifacts/ArtifactResourceScope*.ts",
|
|
"src/artifacts/ArtifactPaths*.ts",
|
|
"src/artifacts/readStableArtifact*.ts",
|
|
"src/filesystem/OwnedFileHandle*.ts",
|
|
"src/server/EvidenceMcpServer*.ts",
|
|
"src/server/analysisAdmission*.ts",
|
|
"src/server/contractToolHandler*.ts",
|
|
"src/server/toolRegistrationOptions*.ts",
|
|
"src/server/createServer*.ts",
|
|
"src/cli.ts",
|
|
"src/cliCommandNames.ts",
|
|
"src/cliLogging.ts",
|
|
"src/cli/commandCancellation.ts",
|
|
"tests/boundary/sqlite/**",
|
|
"tests/fixtures/sqlite/**",
|
|
"tests/acceptance/sqliteDatabaseCli.test.ts",
|
|
"tests/boundary/mcp/serverLifecycleMcp.test.ts",
|
|
".github/workflows/sqlite-runtime.yml",
|
|
],
|
|
browser: [
|
|
".github/workflows/real-browser.yml",
|
|
"scripts/verify-real-browser.mjs",
|
|
"scripts/verify-browser-network.mjs",
|
|
"scripts/verify-browser-scripts.mjs",
|
|
"scripts/verify-browser-modules.mjs",
|
|
"scripts/verify-browser-dom-destinations.mjs",
|
|
"scripts/lib/browser-*.mjs",
|
|
"scripts/fixtures/browser-network-site.mjs",
|
|
"scripts/fixtures/browser-script-site.mjs",
|
|
"scripts/fixtures/browser-module-site.mjs",
|
|
"scripts/fixtures/browser-verifier-site.mjs",
|
|
"scripts/fixtures/page-cdp-proxy.mjs",
|
|
"src/browser/**",
|
|
"src/domain/browser*.ts",
|
|
"src/domain/webScript*.ts",
|
|
"src/domain/webModule*.ts",
|
|
"src/application/WebModule*.ts",
|
|
"src/composition/webModules.ts",
|
|
"src/artifacts/readStableArtifact.ts",
|
|
"src/artifacts/ArtifactPaths.ts",
|
|
"src/application/WebScriptExportService.ts",
|
|
"src/contracts/webScriptToolContracts.ts",
|
|
"src/server/registerWebScriptTool.ts",
|
|
"src/server/registerWebModuleTool.ts",
|
|
"src/server/createServer.ts",
|
|
"src/cli/webModuleCommands.ts",
|
|
"src/cli.ts",
|
|
"src/cliCommandNames.ts",
|
|
"src/contracts/toolEffects.ts",
|
|
"src/cli/webScriptCommands.ts",
|
|
],
|
|
binary_layout: [
|
|
".github/workflows/real-binary-layout.yml",
|
|
"bridge/pwntools/**",
|
|
"src/native/pwntools/**",
|
|
"src/domain/native/binaryLayout*",
|
|
"src/application/binaryDiagnostics/**",
|
|
"src/contracts/native/binaryDiagnosticsToolContracts.ts",
|
|
"src/composition/binaryDiagnostics.ts",
|
|
"src/server/registerBinaryDiagnosticsTools.ts",
|
|
"src/server/createServer.ts",
|
|
"src/cli/binaryDiagnosticsCommands.ts",
|
|
"src/cli.ts",
|
|
"src/cliCommandNames.ts",
|
|
"src/contracts/toolContracts.ts",
|
|
"src/contracts/toolEffects.ts",
|
|
"src/process/OwnedCommand.ts",
|
|
"src/process/ProviderProcess.ts",
|
|
"src/process/ProviderDeadline.ts",
|
|
"src/process/ProcessOwnership*.ts",
|
|
"src/process/PrivateRuntimeRoot.ts",
|
|
"src/artifacts/readStableArtifact*.ts",
|
|
"src/artifacts/ArtifactReader.ts",
|
|
"src/domain/analysisError*.ts",
|
|
"scripts/verify-binary-layout.mjs",
|
|
"scripts/lib/elf-section-name-fixtures.mjs",
|
|
"scripts/lib/large-result-mcp.mjs",
|
|
"scripts/fixtures/binary-layout*",
|
|
],
|
|
evm: [
|
|
".github/workflows/real-evm-interface.yml",
|
|
"src/evm/**",
|
|
"src/domain/evm/**",
|
|
"src/application/evm/**",
|
|
"src/contracts/evm/**",
|
|
"src/composition/evm.ts",
|
|
"src/cli/evmCommands.ts",
|
|
"src/server/registerEvmTools.ts",
|
|
"src/server/createServer.ts",
|
|
"src/cli.ts",
|
|
"src/cliCommandNames.ts",
|
|
"src/contracts/toolContracts.ts",
|
|
"src/contracts/toolEffects.ts",
|
|
"src/process/OwnedCommand.ts",
|
|
"src/process/ProviderProcess.ts",
|
|
"src/process/ProcessOwnership*.ts",
|
|
"src/process/ProviderDeadline.ts",
|
|
"src/process/PrivateRuntimeRoot.ts",
|
|
"src/artifacts/readStableArtifact*.ts",
|
|
"src/artifacts/ArtifactReader.ts",
|
|
"scripts/verify-evm-interface.mjs",
|
|
"scripts/verify-solidity-metadata.mjs",
|
|
"scripts/fixtures/evm-interface.sol",
|
|
"third_party/evmole/**",
|
|
],
|
|
apk_signature: [
|
|
".github/workflows/real-apk-signature.yml",
|
|
"src/domain/apkSignature/**",
|
|
"src/apkSignature/**",
|
|
"src/application/apkSignature/**",
|
|
"src/composition/apkSignature.ts",
|
|
"src/contracts/apkSignature/**",
|
|
"src/cli/apkSignatureCommands.ts",
|
|
"src/server/registerApkSignatureTools.ts",
|
|
"src/server/createServer.ts",
|
|
"src/domain/analysisView/apkSignatureView.ts",
|
|
"src/domain/analysisView/analysisView.ts",
|
|
"src/application/analysisView/**",
|
|
"src/cli/analysisEvidenceDelivery.ts",
|
|
"src/artifacts/**",
|
|
"scripts/verify-apk-signature.mjs",
|
|
"tests/fixtures/apkSignature/**",
|
|
"tests/acceptance/apkSignature*.test.ts",
|
|
],
|
|
javascript_recovery: [
|
|
".github/workflows/real-javascript-recovery.yml",
|
|
"src/javascript/recovery/**",
|
|
"src/domain/javascript/**",
|
|
"src/application/javascript/JavaScriptRecovery*.ts",
|
|
"src/composition/javascriptRecovery.ts",
|
|
"src/contracts/javascript/javascriptRecoveryToolContracts.ts",
|
|
"src/cli/javascriptRecoveryCommands.ts",
|
|
"src/cli/javascriptApplicationAnalysis.ts",
|
|
"src/server/registerJavaScriptRecoveryTool.ts",
|
|
"src/server/createServer.ts",
|
|
"src/server/sessionAvailabilityPolicy.ts",
|
|
"src/application/CapabilityInventory.ts",
|
|
"src/cli.ts",
|
|
"src/cliCommandNames.ts",
|
|
"src/contracts/toolContracts.ts",
|
|
"src/contracts/toolEffects.ts",
|
|
"scripts/rea.mjs",
|
|
"scripts/lib/cli-process-environment.mjs",
|
|
"src/process/**",
|
|
"src/artifacts/SafeOutputTree.ts",
|
|
"scripts/verify/javascript/recovery.mjs",
|
|
"scripts/fixtures/javascript-recovery/**",
|
|
"third_party/wakaru",
|
|
],
|
|
recorded_crash: [
|
|
".github/workflows/real-recorded-crash.yml",
|
|
"bridge/pwntools/**",
|
|
"bridge/pwndbg/**",
|
|
"src/native/pwntools/**",
|
|
"src/native/pwndbg/**",
|
|
"src/domain/native/recordedCrash*",
|
|
"src/application/binaryDiagnostics/**",
|
|
"src/contracts/native/binaryDiagnosticsToolContracts.ts",
|
|
"src/contracts/toolEffects.ts",
|
|
"src/contracts/toolOutputSchemaGroups.ts",
|
|
"src/composition/binaryDiagnostics.ts",
|
|
"src/server/registerRecordedCrashTools.ts",
|
|
"src/server/createServer.ts",
|
|
"src/server/sessionAvailabilityPolicy.ts",
|
|
"src/cli/binaryDiagnosticsCommands.ts",
|
|
"src/cliCommandNames.ts",
|
|
"src/process/**",
|
|
"src/artifacts/readStableArtifact*.ts",
|
|
"src/domain/analysisError*.ts",
|
|
"scripts/verify-recorded-crash.mjs",
|
|
"scripts/verify/recorded-crash/**",
|
|
"scripts/lib/recorded-core-fixtures.py",
|
|
"scripts/fixtures/recorded-crash.c",
|
|
"third_party/pwndbg/**",
|
|
],
|
|
web_network: [
|
|
".github/workflows/real-web-network-captures.yml",
|
|
"bridge/mitmproxy/**",
|
|
"src/browser/history/**",
|
|
"src/domain/webNetworkCapture*.ts",
|
|
"src/domain/analysisError*.ts",
|
|
"src/contracts/errorSchemas.ts",
|
|
"src/domain/explicitSensitive*.ts",
|
|
"src/application/WebNetworkCapture*",
|
|
"src/composition/webNetworkCaptures.ts",
|
|
"src/cli/webNetworkCaptureCommands.ts",
|
|
"src/server/registerWebNetworkCaptureTool.ts",
|
|
"src/server/createServer.ts",
|
|
"src/server/toolRegistrationOptions.ts",
|
|
"src/cli.ts",
|
|
"src/cliCommandNames.ts",
|
|
"src/contracts/toolContracts.ts",
|
|
"src/contracts/toolEffects.ts",
|
|
"src/process/OwnedCommand.ts",
|
|
"src/process/ProviderProcess.ts",
|
|
"src/process/ProviderDeadline.ts",
|
|
"src/process/ProcessOwnership*.ts",
|
|
"src/process/PrivateRuntimeRoot.ts",
|
|
"src/process/capture/ProcessCaptureLifecycle.ts",
|
|
"src/artifacts/readStableArtifact*.ts",
|
|
"src/artifacts/ArtifactReader.ts",
|
|
"src/contracts/webNetworkCaptureToolContracts.ts",
|
|
"scripts/verify-web-network-captures.mjs",
|
|
"scripts/fixtures/generate-mitmproxy-capture.py",
|
|
],
|
|
web_runtime: [
|
|
".github/workflows/real-web-runtime.yml",
|
|
"scripts/verify-browser-runtime.mjs",
|
|
"scripts/lib/browser-runtime-*.mjs",
|
|
"src/process/ProviderProcess.ts",
|
|
"src/process/ProcessOwnership*.ts",
|
|
"scripts/fixtures/browser-runtime-site.mjs",
|
|
"src/browser/execution/**",
|
|
"src/browser/CdpConnection.ts",
|
|
"src/browser/CdpEndpoint.ts",
|
|
"src/browser/CdpTarget*.ts",
|
|
"src/browser/CdpCaptureValues.ts",
|
|
"src/browser/CdpAuthorized*.ts",
|
|
"src/domain/webRuntime.ts",
|
|
"src/domain/webExecution.ts",
|
|
"src/domain/webEventListeners.ts",
|
|
"src/domain/browserObservationError*.ts",
|
|
"src/application/WebRuntime*.ts",
|
|
"src/composition/webRuntime.ts",
|
|
"src/contracts/webRuntimeToolContracts.ts",
|
|
"src/contracts/toolEffects.ts",
|
|
"src/server/registerWebRuntimeTools.ts",
|
|
"src/server/createServer.ts",
|
|
"src/cli/webRuntimeCommands.ts",
|
|
"src/cli/commandCancellation.ts",
|
|
"src/cli.ts",
|
|
],
|
|
web_source_map: [
|
|
".github/workflows/real-web-source-map.yml",
|
|
"scripts/verify-browser-source-maps.mjs",
|
|
"scripts/lib/browser-source-map-e2e.mjs",
|
|
"scripts/fixtures/browser-source-map-site.mjs",
|
|
"src/javascript/sourceMaps/**",
|
|
"src/browser/assets/**",
|
|
"src/domain/webSource*.ts",
|
|
"src/domain/webScript*.ts",
|
|
"src/application/WebSourceLocation*.ts",
|
|
"src/application/ValidateSelectedWebScript.ts",
|
|
"src/composition/webSourceLocations.ts",
|
|
"src/server/registerWebSourceLocationTool.ts",
|
|
"src/server/createServer.ts",
|
|
"src/contracts/webScriptToolContracts.ts",
|
|
"src/process/**",
|
|
"src/cli/webSourceLocationCommands.ts",
|
|
"src/cli.ts",
|
|
"src/artifacts/readStableArtifact.ts",
|
|
],
|
|
agentenv: [
|
|
".github/workflows/real-agentenv.yml",
|
|
"scripts/verify-agentenv-environment.mjs",
|
|
"src/{application,server}/environment/**",
|
|
"src/application/{JsonInputFile,OwnedJsonInput,RegularFileRead}.ts",
|
|
"src/artifacts/{SafeOutputTree*,ArtifactResourceScope,StreamBytes}.ts",
|
|
"src/cliJsonInput.ts",
|
|
"src/server/http/**",
|
|
"src/{cli,cliCommandNames,cli/environmentCommands}.ts",
|
|
"src/config/{environmentName,mcpHttpEndpoint}.ts",
|
|
"src/domain/analysisView/{environmentManifest*,EnvironmentManifest*,environmentState*,EnvironmentState*,recordedResponseBody,scenarioCaptureRecords,WebNetworkProjectionAccumulator,analysisViewDataAdmission}.ts",
|
|
"src/process/{OwnedCommand,ProviderProcess,PrivateRuntimeRoot}.ts",
|
|
"src/process/ProcessOwnership*.ts",
|
|
"tests/fixtures/historicalHar.ts",
|
|
],
|
|
nativeaot: [
|
|
"bridge/nativeaot/**",
|
|
"scripts/generate-nativeaot-fixtures.mjs",
|
|
"scripts/lib/nativeaot-build.*",
|
|
"tests/fixtures/nativeaot/**",
|
|
".github/workflows/nativeaot-fixtures.yml",
|
|
],
|
|
ghidra_bridge: [
|
|
"bridge/ghidra/**",
|
|
"src/ghidra/GhidraBridgeSources.ts",
|
|
"src/ghidra/GhidraJavaProperties.ts",
|
|
"src/ghidra/GhidraReleasePolicy.ts",
|
|
"scripts/verify-ghidra-bridge-sources.mjs",
|
|
".github/workflows/ghidra-bridge-sources.yml",
|
|
],
|
|
website: [
|
|
"website/**",
|
|
"scripts/*website*.py",
|
|
"README*.md",
|
|
"docs/readme/README*.md",
|
|
".github/workflows/website-check.yml",
|
|
".github/workflows/website-pages.yml",
|
|
],
|
|
};
|
|
|
|
export const CI_FLAGS = [
|
|
...new Set([
|
|
"code",
|
|
"runtime",
|
|
"package",
|
|
"apple",
|
|
"fixtures",
|
|
"readiness",
|
|
"docs",
|
|
"workflows",
|
|
...Object.keys(SCOPES),
|
|
]),
|
|
];
|
|
|
|
// Verifier entrypoints that only manual, licensed, or self-hosted workflows
|
|
// run. No selected CI lane executes them, so their edits need only the static
|
|
// checks and the source-test suite. Shared helpers under scripts/lib remain
|
|
// broad inputs.
|
|
export const MANUAL_VERIFIERS = [
|
|
"scripts/verify-real-electron.mjs",
|
|
"scripts/verify-real-ghidra*.mjs",
|
|
"scripts/verify-real-hopper*.mjs",
|
|
"scripts/verify-real-ida.mjs",
|
|
"scripts/verify-*-client.mjs",
|
|
"scripts/verify-native-agent-client.mjs",
|
|
"scripts/verify-jeb.mjs",
|
|
"scripts/verify-apktool.mjs",
|
|
"scripts/verify-adb.mjs",
|
|
"scripts/verify-agent-experience.mjs",
|
|
"scripts/verify-packaged-ghidra-windows.mjs",
|
|
"scripts/verify-wasm-artifact.mjs",
|
|
"scripts/verify-packaged-wasm-artifact.mjs",
|
|
];
|