perf(pcap): retain compact executable identity

src/captures/TsharkCaptureProvider.ts

@@ -60,6 +60,7 @@ import { PrivateRuntimeRoot } from "../process/PrivateRuntimeRoot.js";
 import {
   TSHARK_COMMAND_ENV,
   assertWiresharkExecutableIdentity,
+  wiresharkExecutableIdentity,
   locateWiresharkTool,
   parseWiresharkVersion,
   selectWiresharkTool,
@@ -156,11 +157,12 @@ export class TsharkCaptureProvider implements PacketCapturePort {
         );
       const command = await realpath(configured);
       await access(command, constants.X_OK);
-      const tool = await this.#resources.read(
+      const toolSnapshot = await this.#resources.read(
         command,
         64 * 1024 * 1024,
         options?.signal,
       );
+      const tool = wiresharkExecutableIdentity(toolSnapshot);
       const configuredLimiter =
         this.environment.REA_TSHARK_PRLIMIT_COMMAND ?? "/usr/bin/prlimit";
       if (!isAbsolute(configuredLimiter))
@@ -230,9 +232,13 @@ export class TsharkCaptureProvider implements PacketCapturePort {
             "Configured resource limiter changed during analysis.",
             { capturedOutput },
           );
-        assertWiresharkExecutableIdentity(operation, command, tool, current, {
-          capturedOutput,
-        });
+        assertWiresharkExecutableIdentity(
+          operation,
+          command,
+          tool,
+          wiresharkExecutableIdentity(current),
+          { capturedOutput },
+        );
         phase = previousPhase;
         resourcePath = "path" in input ? input.path : command;
         if (output.exitCode !== 0)

src/pcap/PcapConfiguration.test.ts

@@ -11,6 +11,7 @@ import {
   parseWiresharkVersion,
   resolvePcapTools,
   selectWiresharkTool,
+  wiresharkExecutableIdentity,
 } from "./PcapConfiguration.js";
 import { parseCapinfosOutput, parseTsharkJsonOutput } from "./PcapOutput.js";
 
@@ -157,6 +158,16 @@ describe("parseWiresharkVersion", () => {
   });
 });
 
+it("projects executable snapshots to compact identity facts", () => {
+  const bytes = new Uint8Array(64);
+  const identity = wiresharkExecutableIdentity({
+    bytes,
+    sha256: "a".repeat(64),
+  });
+  expect(identity).toEqual({ bytes: 64, sha256: "a".repeat(64) });
+  expect(Object.values(identity)).not.toContain(bytes);
+});
+
 const REAL_CAPINFOS = [
   "File name:           /work/rich-capture.pcap",
   "File type:           Wireshark/tcpdump/... - pcap",

src/pcap/PcapConfiguration.ts

@@ -9,10 +9,19 @@ import type { JsonValue } from "../domain/jsonValue.js";
 import { AnalysisArtifactChangedError } from "../domain/analysisErrorCore.js";
 
 export interface WiresharkExecutableIdentity {
-  readonly bytes: Uint8Array;
+  readonly bytes: number;
   readonly sha256: string;
 }
 
+/** Retain only identity facts after a bounded executable read. */
+export const wiresharkExecutableIdentity = (snapshot: {
+  readonly bytes: Uint8Array;
+  readonly sha256: string;
+}): WiresharkExecutableIdentity => ({
+  bytes: snapshot.bytes.byteLength,
+  sha256: snapshot.sha256,
+});
+
 /** Shared identity owner used to verify each caller-selected tool run. */
 export const assertWiresharkExecutableIdentity = (
   operation: string,
@@ -21,10 +30,7 @@ export const assertWiresharkExecutableIdentity = (
   actual: WiresharkExecutableIdentity,
   options?: AnalysisErrorOptions,
 ): void => {
-  if (
-    actual.bytes.byteLength !== expected.bytes.byteLength ||
-    actual.sha256 !== expected.sha256
-  )
+  if (actual.bytes !== expected.bytes || actual.sha256 !== expected.sha256)
     throw new AnalysisArtifactChangedError(
       operation,
       path,

src/pcap/PcapProvider.ts

@@ -29,6 +29,7 @@ import {
   resolvePcapTools,
   pcapConfigurationAvailability,
   pcapToolUnavailable,
+  wiresharkExecutableIdentity,
   type PcapToolSelection,
   type WiresharkExecutableIdentity,
 } from "./PcapConfiguration.js";
@@ -207,7 +208,7 @@ export class PcapProvider {
           operation,
           selected.path,
           selected.identity,
-          before,
+          wiresharkExecutableIdentity(before),
         );
       }
       output = await runPcapCommand({
@@ -250,7 +251,7 @@ export class PcapProvider {
           operation,
           selected.path,
           selected.identity,
-          after,
+          wiresharkExecutableIdentity(after),
           {
             capturedOutput: {
               stdout: output.stdout,
@@ -309,14 +310,14 @@ export class PcapProvider {
       const path = locateWiresharkTool(selected, this.environment);
       if (path === undefined) continue;
       const resolvedPath = await realpath(path);
-      const identity = await this.#resources.read(
+      const snapshot = await this.#resources.read(
         resolvedPath,
         64 * 1024 * 1024,
         signal,
       );
       this.wiresharkIdentities.set(selected.command, {
         path: resolvedPath,
-        identity,
+        identity: wiresharkExecutableIdentity(snapshot),
       });
     }
     const identity = await inspectPcapClient(