feat(analysis): make resource budgets recoverable across CLI and MCP (#9706)

* refactor(analysis): centralize resource budgets and recovery facts

* feat(analysis): expose ASAR and Ghidra runtime admission controls

* feat(artifacts): expose reader admission and preserve limited recognition

* feat(javascript): expose recoverable semantic precision budgets

* feat(web): add recoverable source-map budgets and compact retained views

* feat(web): make historical capture decoding budgets recoverable

* fix(desktop): enforce selected view policies across capture and export

* feat(runtime): make Frida and LLDB retention budgets selectable

* feat(native): expose diagnostic budgets and preserve exhaustion causes

* feat(managed): expose recoverable snapshot and representation budgets

* feat(metadata): make Go and Rust inspection budgets recoverable

* feat(wasm): expose representation and producer admissions

* feat(evm): expose per-call worker resource budgets

* feat(android): make resource and string-pool omissions recoverable

* feat(producers): expose command and recorded-capture budgets

* docs(analysis): record recovery contracts and integrated validation

* fix(docs): link calibration oracle from published verification pages

* fix(docs): restore desktop task anchors and receipt links

* test(analysis): align fixtures with selectable budget contracts

* fix(analysis): remove source-location projector dependency cycle

* test(analysis): refresh budget recovery and verifier regressions

* test(analysis): preserve format and publication recovery expectations

* test(windows): align conformance with owned runtime admission

* fix(desktop): preserve selected alias kinds in exported state

* test(analysis): align provider fixtures with recoverable budgets

* test(desktop): validate emitted alias metadata structurally

* fix(ghidra): classify bounded Windows endpoint refusals

* test(cli): assert selectable artifact admission recovery

* fix(cli): preserve capture provenance in environment builds

src/cli/binaryDiagnosticsCommands.ts

@@ -5,6 +5,8 @@ import { inspectBinaryHardeningInputSchema } from "../domain/native/binaryHarden
 import { inspectByteEntropyInputSchema } from "../domain/native/byteEntropy.js";
 import { z } from "incur";
 import { cliDecimalField } from "./options.js";
+import { producerLimitsOption } from "./producerLimitsOption.js";
+import { pwntoolsProducerLimitsSchema } from "../domain/native/pwntoolsResourceLimits.js";
 import {
   createByteEntropyService,
   createRecordedCrashService,
@@ -272,6 +274,12 @@ export const registerBinaryDiagnosticsCommands = (
       maxEntries: cliDecimalField(
         inspectKernelModuleInputSchema.shape.max_entries,
       ),
+      maxModinfoKeyBytes: cliDecimalField(
+        inspectKernelModuleInputSchema.shape.max_modinfo_key_bytes,
+      ),
+      maxModinfoValueBytes: cliDecimalField(
+        inspectKernelModuleInputSchema.shape.max_modinfo_value_bytes,
+      ),
     }),
     run: ({ args, options }) =>
       withCommandCancellation(async (signal) => {
@@ -288,6 +296,8 @@ export const registerBinaryDiagnosticsCommands = (
                     path: absoluteCallerPath(args.path),
                     max_file_bytes: options.maxFileBytes,
                     max_entries: options.maxEntries,
+                    max_modinfo_key_bytes: options.maxModinfoKeyBytes,
+                    max_modinfo_value_bytes: options.maxModinfoValueBytes,
                   },
                   { signal },
                 ),
@@ -745,6 +755,7 @@ export const registerBinaryDiagnosticsCommands = (
       ),
     }),
     options: z.object({
+      producerLimits: producerLimitsOption(pwntoolsProducerLimitsSchema),
       pwntoolsTimeoutMs: cliDecimalField(
         inspectBinaryLayoutInputSchema.shape.pwntools_timeout_ms,
       ),
@@ -755,6 +766,9 @@ export const registerBinaryDiagnosticsCommands = (
           const result = await service.inspectAndClose(
             {
               path: absoluteCallerPath(args.path),
+              ...(options.producerLimits === undefined
+                ? {}
+                : { producer_limits: options.producerLimits }),
               ...(options.pwntoolsTimeoutMs === undefined
                 ? {}
                 : { pwntools_timeout_ms: options.pwntoolsTimeoutMs }),
@@ -777,6 +791,7 @@ export const registerBinaryDiagnosticsCommands = (
       ),
     }),
     options: z.object({
+      producerLimits: producerLimitsOption(pwntoolsProducerLimitsSchema),
       debuggerContext: z
         .boolean()
         .default(false)
@@ -792,6 +807,9 @@ export const registerBinaryDiagnosticsCommands = (
             {
               path: absoluteCallerPath(args.path),
               include_debugger_context: options.debuggerContext,
+              ...(options.producerLimits === undefined
+                ? {}
+                : { producer_limits: options.producerLimits }),
               ...(options.pwntoolsTimeoutMs === undefined
                 ? {}
                 : { pwntools_timeout_ms: options.pwntoolsTimeoutMs }),