feat(settings): read per-call REA_ limits from the operation snapshot

Part of #9881. Move the limits checked on each call into update_analysis_settings, keep their REA_ seeds and bounds, and reject updates outside the allowed range.

src/native/pwntools/PwntoolsFailures.ts

@@ -1,3 +1,4 @@
+import { analysisSettingLimit } from "../../domain/analysisSettingDefinitions.js";
 import {
   PWNTOOLS_LIMITS,
   resolvePwntoolsLimits,
@@ -296,7 +297,12 @@ const classifyPwntoolsDecoderFailure = (
           ...(cause.reason === "limit"
             ? {
                 userMessage: `${cause.message} Selected producer_limits.input_bytes is ${String(limits.input_bytes)} bytes. ${budgetRecovery}`,
-                remediationAction: `Increase producer_limits.input_bytes above ${String(limits.input_bytes)} on the next call (CLI --producer-limits JSON). No restart is required. Changing REA_PWNTOOLS_MAX_INPUT_BYTES affects the launch default instead. CPU, memory, output and transport allowances remain independent.`,
+                remediationAction: `pwntools.max_input_bytes is the launch default of ${String(PWNTOOLS_LIMITS.input_bytes)} bytes and can be changed at runtime with update_analysis_settings. The launch seed is REA_PWNTOOLS_MAX_INPUT_BYTES. producer_limits.input_bytes overrides that default on the next call (CLI --producer-limits JSON). The effective input_bytes for this call is ${String(limits.input_bytes)}. CPU, memory, output and transport allowances remain independent.`,
+                limit: analysisSettingLimit(
+                  "pwntools.max_input_bytes",
+                  limits.input_bytes,
+                  undefined,
+                ),
               }
             : {}),
         },

src/native/pwntools/PwntoolsInputLimit.test.ts

@@ -14,6 +14,7 @@ describe("pwntools input bound", () => {
     expect(pwntoolsInputBytes({})).toEqual({
       configured: true,
       bytes: PWNTOOLS_LIMITS.input_bytes,
+      source: "default",
     });
     expect(PWNTOOLS_LIMITS.input_bytes).toBe(32 * 1024 * 1024);
   });
@@ -25,7 +26,7 @@ describe("pwntools input bound", () => {
     ["1073741824", 1024 * 1024 * 1024],
   ] as const)("accepts %s as %s bytes", (value, expected) => {
     expect(pwntoolsInputBytes({ REA_PWNTOOLS_MAX_INPUT_BYTES: value })).toEqual(
-      { configured: true, bytes: expected },
+      { configured: true, bytes: expected, source: "setting" },
     );
   });
 

src/native/pwntools/PwntoolsInputLimit.ts

@@ -1,5 +1,6 @@
 import { z } from "zod";
 
+import { currentAnalysisOperationSnapshot } from "../../domain/analysisOperationSnapshot.js";
 import { PWNTOOLS_LIMITS } from "../../domain/native/pwntoolsResourceLimits.js";
 
 // The artifact is read into one in-memory buffer and staged again as a private
@@ -20,7 +21,11 @@ const CONSTRAINT =
 
 /** Resolved input bound, or the reason the caller's override cannot be used. */
 export type PwntoolsInputBytes =
-  | { readonly configured: true; readonly bytes: number }
+  | {
+      readonly configured: true;
+      readonly bytes: number;
+      readonly source: "default" | "setting" | "runtime";
+    }
   | { readonly configured: false; readonly error: string };
 
 /**
@@ -30,11 +35,19 @@ export type PwntoolsInputBytes =
 export const pwntoolsInputBytes = (
   environment: Readonly<NodeJS.ProcessEnv>,
 ): PwntoolsInputBytes => {
+  const override =
+    currentAnalysisOperationSnapshot()?.overrides["pwntools.max_input_bytes"];
+  if (override !== undefined)
+    return { configured: true, bytes: override, source: "runtime" };
   const value = environment.REA_PWNTOOLS_MAX_INPUT_BYTES;
   if (value === undefined)
-    return { configured: true, bytes: PWNTOOLS_LIMITS.input_bytes };
+    return {
+      configured: true,
+      bytes: PWNTOOLS_LIMITS.input_bytes,
+      source: "default",
+    };
   const parsed = pwntoolsInputBytesSchema.safeParse(value);
   return parsed.success
-    ? { configured: true, bytes: parsed.data }
+    ? { configured: true, bytes: parsed.data, source: "setting" }
     : { configured: false, error: CONSTRAINT };
 };