From 211d4b221997cd0b5bbb3cf481b7c66f85d5c84c Mon Sep 17 00:00:00 2001
From: morluto <76467478+morluto@users.noreply.github.com>
Date: Thu, 22 Oct 2026 05:47:11 +0800
Subject: [PATCH] perf(pcap): retain compact executable identity

---
 src/captures/TsharkCaptureProvider.ts | 14 ++++++++++----
 src/pcap/PcapConfiguration.test.ts    | 11 +++++++++++
 src/pcap/PcapConfiguration.ts         | 16 +++++++++++-----
 src/pcap/PcapProvider.ts              |  9 +++++----
 4 files changed, 37 insertions(+), 13 deletions(-)

diff --git a/src/captures/TsharkCaptureProvider.ts b/src/captures/TsharkCaptureProvider.ts
index f3b5f4f078..f99491bbb7 100644
--- a/src/captures/TsharkCaptureProvider.ts
+++ b/src/captures/TsharkCaptureProvider.ts
@@ -60,6 +60,7 @@ import { PrivateRuntimeRoot } from "../process/PrivateRuntimeRoot.js";
 import {
   TSHARK_COMMAND_ENV,
   assertWiresharkExecutableIdentity,
+  wiresharkExecutableIdentity,
   locateWiresharkTool,
   parseWiresharkVersion,
   selectWiresharkTool,
@@ -156,11 +157,12 @@ export class TsharkCaptureProvider implements PacketCapturePort {
         );
       const command = await realpath(configured);
       await access(command, constants.X_OK);
-      const tool = await this.#resources.read(
+      const toolSnapshot = await this.#resources.read(
         command,
         64 * 1024 * 1024,
         options?.signal,
       );
+      const tool = wiresharkExecutableIdentity(toolSnapshot);
       const configuredLimiter =
         this.environment.REA_TSHARK_PRLIMIT_COMMAND ?? "/usr/bin/prlimit";
       if (!isAbsolute(configuredLimiter))
@@ -230,9 +232,13 @@ export class TsharkCaptureProvider implements PacketCapturePort {
             "Configured resource limiter changed during analysis.",
             { capturedOutput },
           );
-        assertWiresharkExecutableIdentity(operation, command, tool, current, {
-          capturedOutput,
-        });
+        assertWiresharkExecutableIdentity(
+          operation,
+          command,
+          tool,
+          wiresharkExecutableIdentity(current),
+          { capturedOutput },
+        );
         phase = previousPhase;
         resourcePath = "path" in input ? input.path : command;
         if (output.exitCode !== 0)
diff --git a/src/pcap/PcapConfiguration.test.ts b/src/pcap/PcapConfiguration.test.ts
index c9834956e2..f0c9ec48cc 100644
--- a/src/pcap/PcapConfiguration.test.ts
+++ b/src/pcap/PcapConfiguration.test.ts
@@ -11,6 +11,7 @@ import {
   parseWiresharkVersion,
   resolvePcapTools,
   selectWiresharkTool,
+  wiresharkExecutableIdentity,
 } from "./PcapConfiguration.js";
 import { parseCapinfosOutput, parseTsharkJsonOutput } from "./PcapOutput.js";
 
@@ -157,6 +158,16 @@ describe("parseWiresharkVersion", () => {
   });
 });
 
+it("projects executable snapshots to compact identity facts", () => {
+  const bytes = new Uint8Array(64);
+  const identity = wiresharkExecutableIdentity({
+    bytes,
+    sha256: "a".repeat(64),
+  });
+  expect(identity).toEqual({ bytes: 64, sha256: "a".repeat(64) });
+  expect(Object.values(identity)).not.toContain(bytes);
+});
+
 const REAL_CAPINFOS = [
   "File name:           /work/rich-capture.pcap",
   "File type:           Wireshark/tcpdump/... - pcap",
diff --git a/src/pcap/PcapConfiguration.ts b/src/pcap/PcapConfiguration.ts
index 1ef05d81e4..9e53ba879c 100644
--- a/src/pcap/PcapConfiguration.ts
+++ b/src/pcap/PcapConfiguration.ts
@@ -9,10 +9,19 @@ import type { JsonValue } from "../domain/jsonValue.js";
 import { AnalysisArtifactChangedError } from "../domain/analysisErrorCore.js";
 
 export interface WiresharkExecutableIdentity {
-  readonly bytes: Uint8Array;
+  readonly bytes: number;
   readonly sha256: string;
 }
 
+/** Retain only identity facts after a bounded executable read. */
+export const wiresharkExecutableIdentity = (snapshot: {
+  readonly bytes: Uint8Array;
+  readonly sha256: string;
+}): WiresharkExecutableIdentity => ({
+  bytes: snapshot.bytes.byteLength,
+  sha256: snapshot.sha256,
+});
+
 /** Shared identity owner used to verify each caller-selected tool run. */
 export const assertWiresharkExecutableIdentity = (
   operation: string,
@@ -21,10 +30,7 @@ export const assertWiresharkExecutableIdentity = (
   actual: WiresharkExecutableIdentity,
   options?: AnalysisErrorOptions,
 ): void => {
-  if (
-    actual.bytes.byteLength !== expected.bytes.byteLength ||
-    actual.sha256 !== expected.sha256
-  )
+  if (actual.bytes !== expected.bytes || actual.sha256 !== expected.sha256)
     throw new AnalysisArtifactChangedError(
       operation,
       path,
diff --git a/src/pcap/PcapProvider.ts b/src/pcap/PcapProvider.ts
index 48d7545e19..557acddbfa 100644
--- a/src/pcap/PcapProvider.ts
+++ b/src/pcap/PcapProvider.ts
@@ -29,6 +29,7 @@ import {
   resolvePcapTools,
   pcapConfigurationAvailability,
   pcapToolUnavailable,
+  wiresharkExecutableIdentity,
   type PcapToolSelection,
   type WiresharkExecutableIdentity,
 } from "./PcapConfiguration.js";
@@ -207,7 +208,7 @@ export class PcapProvider {
           operation,
           selected.path,
           selected.identity,
-          before,
+          wiresharkExecutableIdentity(before),
         );
       }
       output = await runPcapCommand({
@@ -250,7 +251,7 @@ export class PcapProvider {
           operation,
           selected.path,
           selected.identity,
-          after,
+          wiresharkExecutableIdentity(after),
           {
             capturedOutput: {
               stdout: output.stdout,
@@ -309,14 +310,14 @@ export class PcapProvider {
       const path = locateWiresharkTool(selected, this.environment);
       if (path === undefined) continue;
       const resolvedPath = await realpath(path);
-      const identity = await this.#resources.read(
+      const snapshot = await this.#resources.read(
         resolvedPath,
         64 * 1024 * 1024,
         signal,
       );
       this.wiresharkIdentities.set(selected.command, {
         path: resolvedPath,
-        identity,
+        identity: wiresharkExecutableIdentity(snapshot),
       });
     }
     const identity = await inspectPcapClient(