diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md index 0b468d258f..e46e10acb3 100644 --- a/THIRD_PARTY_NOTICES.md +++ b/THIRD_PARTY_NOTICES.md @@ -52,27 +52,27 @@ REA's adapters do not grant, replace, or waive these licenses. The upstream executables and their dependency graphs are supplied separately. Git submodules pin inspection sources; they are not included in the npm package. -| Project | License and source | REA relationship | -| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| Project | License and source | REA relationship | +| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Ghidra | [Apache-2.0](https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_12.1.4_build/LICENSE), with the government-work and component qualifications in its [NOTICE](https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_12.1.4_build/NOTICE) | Bring your own Ghidra; see [supported versions](docs/installation.md#ghidra). Copies of the 12.1.4 [LICENSE](licenses/ghidra-12.1.4-LICENSE.txt), [NOTICE](licenses/ghidra-12.1.4-NOTICE.txt), and [DISCLAIMER](licenses/ghidra-12.1.4-DISCLAIMER.txt) are retained for reference. | -| ghidra-nativeaot | [MIT](https://github.com/Washi1337/ghidra-nativeaot/blob/effeb734fc570c32650f88b159608979dc7b423e/LICENSE.md) | Pinned inspection source; derived parser attribution above. | -| JADX | [Apache-2.0](https://github.com/skylot/jadx/blob/v1.5.6/LICENSE) | The audited jadx-headless-mcp source uses JADX 1.5.6 for Android decompilation; the engine JAR is separately supplied. | -| jadx-headless-mcp | [Apache-2.0](https://github.com/1013503897/jadx-headless-mcp/blob/5844800a486d2248fa949b74c9896285f5b54de2/LICENSE) | v0.7.1; pinned submodule and user-supplied JAR. | -| Kuna | [Apache-2.0](https://github.com/Noelo-Lab/kuna/blob/v1.833/LICENSE), with its [NOTICE](https://github.com/Noelo-Lab/kuna/blob/v1.833/NOTICE) | Bring your own `kuna`; REA verified 1.833 and never downloads, installs or bundles it. REA invokes it as a separate process. | -| Apktool | [Apache-2.0](https://github.com/iBotPeaches/Apktool/blob/master/LICENSE.md) | User-supplied Android resource decoder. | -| Binwalk | [MIT](https://github.com/ReFirmLabs/binwalk/blob/4fdab3d464d97b68e0af9088df3f9e2e1545b21c/LICENSE) | v3.1.0; pinned submodule and user-supplied firmware engine. | -| Unblob | [MIT](https://github.com/onekey-sec/unblob/blob/1fcc7a0a584a70a96c31f5a276c20944d199a089/LICENSE) | 26.6.4; pinned submodule and user-supplied firmware engine. | -| Wakaru | [Apache-2.0](https://github.com/pionxzh/wakaru/blob/8219bf5016a063d7fb215101a8c45d5959ec733f/LICENSE) | v1.14.0; pinned source and separately obtained JavaScript reconstruction tooling. | -| WABT | [Apache-2.0](https://github.com/WebAssembly/wabt/blob/ff0ef7e0009402740c805a9744c09b05be063e48/LICENSE) | v1.0.42; external WebAssembly tools; [integration provenance](third_party/wabt/README.md). | -| pwntools | [MIT, with GPL/BSD component qualifications](https://github.com/Gallopsled/pwntools/blob/3ad86ec5adab1abf9781ca7552a6f5d7cff7a33c/LICENSE-pwntools.txt) | 4.15.0; caller-supplied offline ELF analysis package. | -| pyelftools | [Public-domain dedication and component notices](https://github.com/eliben/pyelftools/blob/v0.33/LICENSE) | 0.33; includes separately licensed bundled material, including Construct. | -| Unicorn | [GPL-2.0 and component notices](https://github.com/unicorn-engine/unicorn/blob/2.1.2/COPYING) | 2.1.2; used by the caller-supplied ELF analysis profile for instruction emulation. | -| pwndbg | [MIT](third_party/pwndbg/LICENSE.md) | 2026.09.15, commit `55596aa676a2756efb8d67034f31675170eabe48`; separately obtained debugger extension. | -| GNU GDB | [GPL-3.0-or-later](https://sourceware.org/git/?p=binutils-gdb.git;a=blob;f=gdb/COPYING) | Caller-supplied debugger for the optional pwndbg core-file workflow. | -| LLDB / LLVM | [Apache-2.0 with LLVM exceptions](https://github.com/llvm/llvm-project/blob/main/LICENSE.TXT) | Caller-supplied debugger; the installed distribution's component and historical notices also apply. | -| mitmproxy | [MIT](https://github.com/mitmproxy/mitmproxy/blob/6c09d56e4c29a92f5ad01b03199977584b8ea14f/LICENSE) | 12.2.3; separately supplied network capture proxy. | -| Android Debug Bridge (adb) | [Apache-2.0](https://android.googlesource.com/platform/packages/modules/adb/+/refs/heads/main/NOTICE) | User-supplied Android device tool. A complete Android SDK download has its own [SDK license terms](https://developer.android.com/studio/terms); adb's source license does not replace them. | -| ILSpy / ICSharpCode.Decompiler | [MIT](https://github.com/icsharpcode/ILSpy/blob/master/ICSharpCode.Decompiler/Properties/AssemblyInfo.cs) | Optional separately installed .NET decompiler; not a redistributed REA dependency. | +| ghidra-nativeaot | [MIT](https://github.com/Washi1337/ghidra-nativeaot/blob/effeb734fc570c32650f88b159608979dc7b423e/LICENSE.md) | Pinned inspection source; derived parser attribution above. | +| JADX | [Apache-2.0](https://github.com/skylot/jadx/blob/v1.5.6/LICENSE) | The audited jadx-headless-mcp source uses JADX 1.5.6 for Android decompilation; the engine JAR is separately supplied. | +| jadx-headless-mcp | [Apache-2.0](https://github.com/1013503897/jadx-headless-mcp/blob/5844800a486d2248fa949b74c9896285f5b54de2/LICENSE) | v0.7.1; pinned submodule and user-supplied JAR. | +| Kuna | [Apache-2.0](https://github.com/Noelo-Lab/kuna/blob/v1.833/LICENSE), with its [NOTICE](https://github.com/Noelo-Lab/kuna/blob/v1.833/NOTICE) | Bring your own `kuna`; REA verified 1.833 and never downloads, installs or bundles it. REA invokes it as a separate process. | +| Apktool | [Apache-2.0](https://github.com/iBotPeaches/Apktool/blob/master/LICENSE.md) | User-supplied Android resource decoder. | +| Binwalk | [MIT](https://github.com/ReFirmLabs/binwalk/blob/4fdab3d464d97b68e0af9088df3f9e2e1545b21c/LICENSE) | v3.1.0; pinned submodule and user-supplied firmware engine. | +| Unblob | [MIT](https://github.com/onekey-sec/unblob/blob/1fcc7a0a584a70a96c31f5a276c20944d199a089/LICENSE) | 26.6.4; pinned submodule and user-supplied firmware engine. | +| Wakaru | [Apache-2.0](https://github.com/pionxzh/wakaru/blob/8219bf5016a063d7fb215101a8c45d5959ec733f/LICENSE) | v1.14.0; pinned source and separately obtained JavaScript reconstruction tooling. | +| WABT | [Apache-2.0](https://github.com/WebAssembly/wabt/blob/ff0ef7e0009402740c805a9744c09b05be063e48/LICENSE) | v1.0.42; external WebAssembly tools; [integration provenance](third_party/wabt/README.md). | +| pwntools | [MIT, with GPL/BSD component qualifications](https://github.com/Gallopsled/pwntools/blob/3ad86ec5adab1abf9781ca7552a6f5d7cff7a33c/LICENSE-pwntools.txt) | 4.15.0; caller-supplied offline ELF analysis package. | +| pyelftools | [Public-domain dedication and component notices](https://github.com/eliben/pyelftools/blob/v0.33/LICENSE) | 0.33; includes separately licensed bundled material, including Construct. | +| Unicorn | [GPL-2.0 and component notices](https://github.com/unicorn-engine/unicorn/blob/2.1.2/COPYING) | 2.1.2; used by the caller-supplied ELF analysis profile for instruction emulation. | +| pwndbg | [MIT](third_party/pwndbg/LICENSE.md) | 2026.09.15, commit `55596aa676a2756efb8d67034f31675170eabe48`; separately obtained debugger extension. | +| GNU GDB | [GPL-3.0-or-later](https://sourceware.org/git/?p=binutils-gdb.git;a=blob;f=gdb/COPYING) | Caller-supplied debugger for the optional pwndbg core-file workflow. | +| LLDB / LLVM | [Apache-2.0 with LLVM exceptions](https://github.com/llvm/llvm-project/blob/main/LICENSE.TXT) | Caller-supplied debugger; the installed distribution's component and historical notices also apply. | +| mitmproxy | [MIT](https://github.com/mitmproxy/mitmproxy/blob/6c09d56e4c29a92f5ad01b03199977584b8ea14f/LICENSE) | 12.2.3; separately supplied network capture proxy. | +| Android Debug Bridge (adb) | [Apache-2.0](https://android.googlesource.com/platform/packages/modules/adb/+/refs/heads/main/NOTICE) | User-supplied Android device tool. A complete Android SDK download has its own [SDK license terms](https://developer.android.com/studio/terms); adb's source license does not replace them. | +| ILSpy / ICSharpCode.Decompiler | [MIT](https://github.com/icsharpcode/ILSpy/blob/master/ICSharpCode.Decompiler/Properties/AssemblyInfo.cs) | Optional separately installed .NET decompiler; not a redistributed REA dependency. | Ghidra's original notice credits software developed at the National Security Agency. It explains that US-government-created portions are not subject to US diff --git a/knip.json b/knip.json index 79472a53c5..74f7c04613 100644 --- a/knip.json +++ b/knip.json @@ -4,6 +4,9 @@ "src/main.ts", "src/cli.ts", "src/cliOutput.ts", + "src/cliBuiltinArguments.ts", + "src/cli/cliResultOutput.ts", + "src/mcpDoctor.ts", "src/composition/javascriptAnalysisWorkerProcess.ts", "src/composition/webBundleAnalysisWorkerProcess.ts", "src/contracts/errorSchemas.ts", diff --git a/src/application/javascript/JavaScriptArtifactGraphFindings.ts b/src/application/javascript/JavaScriptArtifactGraphFindings.ts index 3b4bc77ac2..3dd863e594 100644 --- a/src/application/javascript/JavaScriptArtifactGraphFindings.ts +++ b/src/application/javascript/JavaScriptArtifactGraphFindings.ts @@ -305,7 +305,8 @@ const addReference = ( range: input.value.location, coverage: input.coverage, relation: - input.value.operation === "load" && resolved?.file?.kind === "native-addon" + input.value.operation === "load" && + resolved?.file?.kind === "native-addon" ? "loads" : "imports", properties: { diff --git a/src/domain/reconstructionReadinessJourneyFindings.ts b/src/domain/reconstructionReadinessJourneyFindings.ts index e4d7d3afe7..4fb5a85715 100644 --- a/src/domain/reconstructionReadinessJourneyFindings.ts +++ b/src/domain/reconstructionReadinessJourneyFindings.ts @@ -390,7 +390,10 @@ const outcomeFindings = ( "surface-semantic-drift", "export-replay", "fail", - `CLI/MCP structured outcomes disagree: ${label}; sequences ${outcomes.map(({ sequence }) => sequence).sort((left, right) => left - right).join(", ")}.`, + `CLI/MCP structured outcomes disagree: ${label}; sequences ${outcomes + .map(({ sequence }) => sequence) + .sort((left, right) => left - right) + .join(", ")}.`, outcomeEvidence, ), ); diff --git a/src/ida/IdaDoctor.test.ts b/src/ida/IdaDoctor.test.ts index 0851bbe5f7..f925e79425 100644 --- a/src/ida/IdaDoctor.test.ts +++ b/src/ida/IdaDoctor.test.ts @@ -37,7 +37,8 @@ it.each([true, false])( const after = await readdir(root); expect(inspection.available).toBe(exists); expect( - inspection.checks.find(({ name }) => name === "private_workspace")?.detail, + inspection.checks.find(({ name }) => name === "private_workspace") + ?.detail, ).toContain(rawRoot); expect(after).toEqual(before); }, diff --git a/tests/boundary/cli/dispatcher.test.ts b/tests/boundary/cli/dispatcher.test.ts index 5e8234b6a1..9cbd1b37a3 100644 --- a/tests/boundary/cli/dispatcher.test.ts +++ b/tests/boundary/cli/dispatcher.test.ts @@ -1,4 +1,4 @@ -import { copyFile } from "node:fs/promises"; +import { copyFile, cp } from "node:fs/promises"; import { join, resolve } from "node:path"; import { pathToFileURL } from "node:url"; @@ -16,13 +16,13 @@ const installCliRuntime = async ( resultOutput = "export const createCliResultOutput = () => undefined;\n", ): Promise => { await workspace.mkdir("scripts"); - await workspace.mkdir("dist/cli-runtime"); + await workspace.mkdir("dist"); + // The bundle's entrypoints and shared chunks form one emitted runtime. + await cp("dist/cli-runtime", workspace.path("dist/cli-runtime"), { + recursive: true, + }); await Promise.all([ copyFile("scripts/rea.mjs", workspace.path("scripts/rea.mjs")), - copyFile( - "dist/cli-runtime/cliBuiltinArguments.js", - workspace.path("dist/cli-runtime/cliBuiltinArguments.js"), - ), workspace.write( "package.json", JSON.stringify({ type: "module", version: "1.0.0" }), @@ -117,33 +117,17 @@ describe("executable dispatcher", () => { workspaceCliTest( "reserves production MCP routing for bare mode arguments", async ({ processes, workspace }) => { - const scripts = await workspace.mkdir("scripts"); - await workspace.mkdir("dist"); - await workspace.mkdir("dist/cli-runtime"); + await installCliRuntime( + workspace, + 'export const closeCliJavaScriptResources = () => {}; export const createCli = () => ({ serve: (args) => process.stdout.write(JSON.stringify({ adapter: "cli", args })) });\n', + ); + const scripts = workspace.path("scripts"); await workspace.mkdir("dist/mcp"); await Promise.all([ - copyFile("scripts/rea.mjs", join(scripts, "rea.mjs")), - copyFile( - "dist/cli-runtime/cliBuiltinArguments.js", - workspace.path("dist/cli-runtime/cliBuiltinArguments.js"), - ), - workspace.write( - "package.json", - JSON.stringify({ type: "module", version: "1.0.0" }), - ), workspace.write( "dist/mcp/main.js", 'export const runEntrypoint = () => process.stdout.write(JSON.stringify({ adapter: "mcp" })); export const runMcpHttpEntrypoint = (args) => process.stdout.write(JSON.stringify({ adapter: "mcp-http", args }));\n', ), - workspace.write( - "dist/cli-runtime/cli.js", - 'export const closeCliJavaScriptResources = () => {}; export const createCli = () => ({ serve: (args) => process.stdout.write(JSON.stringify({ adapter: "cli", args })) });\n', - ), - workspace.write("dist/cli-runtime/cliOutput.js", CLI_OUTPUT_RUNTIME), - workspace.write( - "dist/cli-runtime/cliResultOutput.js", - "export const createCliResultOutput = () => undefined;\n", - ), workspace.write( "dist/cli-runtime/mcpDoctor.js", 'export const runProductionMcpDoctorCli = (args, input) => Promise.resolve({ output: JSON.stringify({ adapter: "mcp-doctor", args, stdoutIsTerminal: input.stdoutIsTerminal }), exitCode: 0 });\n', diff --git a/tests/boundary/cli/idaDoctorRegistration.test.ts b/tests/boundary/cli/idaDoctorRegistration.test.ts index c8521a869f..8a9a5b870c 100644 --- a/tests/boundary/cli/idaDoctorRegistration.test.ts +++ b/tests/boundary/cli/idaDoctorRegistration.test.ts @@ -43,9 +43,7 @@ cliTest.skipIf(process.platform !== "darwin").for([true, false])( const parent = join(root, "parent"); await mkdir(parent); // Keep the caller's spelling while every traversed component exists. - const workspaceRoot = usable - ? `${parent}/./` - : join(parent, "absent"); + const workspaceRoot = usable ? `${parent}/./` : join(parent, "absent"); const registration = join(root, "registration.json"); await writeFile( registration, diff --git a/tests/boundary/mcp/nativeUiFactsMcp.test.ts b/tests/boundary/mcp/nativeUiFactsMcp.test.ts index 1175ef8a7c..2e32f12100 100644 --- a/tests/boundary/mcp/nativeUiFactsMcp.test.ts +++ b/tests/boundary/mcp/nativeUiFactsMcp.test.ts @@ -219,23 +219,23 @@ it("keeps native UI availability after initial selection errors and preserves la await client.ping(); }); -it.each([ - "application-executable-unavailable", - "executable-path-unavailable", -])("preserves unknown executable identity from %s", async (code) => { - const { client, replies } = await connectNativeUi(); - const message = `Fixture ${code} diagnostic`; - replies.push({ ok: false, code, message }); - const response = await client.callTool({ - name: "observe_native_ui", - arguments: scope, - }); - expect(parseMcpToolError(response)).toMatchObject({ - error: { - code: "capability_unavailable", - message, - details: { reason: `${code}: ${message}` }, - }, - }); - await client.ping(); -}); +it.each(["application-executable-unavailable", "executable-path-unavailable"])( + "preserves unknown executable identity from %s", + async (code) => { + const { client, replies } = await connectNativeUi(); + const message = `Fixture ${code} diagnostic`; + replies.push({ ok: false, code, message }); + const response = await client.callTool({ + name: "observe_native_ui", + arguments: scope, + }); + expect(parseMcpToolError(response)).toMatchObject({ + error: { + code: "capability_unavailable", + message, + details: { reason: `${code}: ${message}` }, + }, + }); + await client.ping(); + }, +);