feat(analysis): make resource budgets recoverable across CLI and MCP (#9706)

* refactor(analysis): centralize resource budgets and recovery facts

* feat(analysis): expose ASAR and Ghidra runtime admission controls

* feat(artifacts): expose reader admission and preserve limited recognition

* feat(javascript): expose recoverable semantic precision budgets

* feat(web): add recoverable source-map budgets and compact retained views

* feat(web): make historical capture decoding budgets recoverable

* fix(desktop): enforce selected view policies across capture and export

* feat(runtime): make Frida and LLDB retention budgets selectable

* feat(native): expose diagnostic budgets and preserve exhaustion causes

* feat(managed): expose recoverable snapshot and representation budgets

* feat(metadata): make Go and Rust inspection budgets recoverable

* feat(wasm): expose representation and producer admissions

* feat(evm): expose per-call worker resource budgets

* feat(android): make resource and string-pool omissions recoverable

* feat(producers): expose command and recorded-capture budgets

* docs(analysis): record recovery contracts and integrated validation

* fix(docs): link calibration oracle from published verification pages

* fix(docs): restore desktop task anchors and receipt links

* test(analysis): align fixtures with selectable budget contracts

* fix(analysis): remove source-location projector dependency cycle

* test(analysis): refresh budget recovery and verifier regressions

* test(analysis): preserve format and publication recovery expectations

* test(windows): align conformance with owned runtime admission

* fix(desktop): preserve selected alias kinds in exported state

* test(analysis): align provider fixtures with recoverable budgets

* test(desktop): validate emitted alias metadata structurally

* fix(ghidra): classify bounded Windows endpoint refusals

* test(cli): assert selectable artifact admission recovery

* fix(cli): preserve capture provenance in environment builds
This commit is contained in:
morluto authored and GitHub committed 2026-11-10 05:11:20 -05:00
1 parent 55b6d2ca20
commit cb4e5cfbff
515 files changed
+21066 -3637

No files matched your search

@@ -67,8 +67,6 @@ interface SymbolicReadBoundary {
}
type SymbolicNamespace = Extract<SymbolicValue, { kind: "namespace" }>;
const SYMBOLIC_DEPTH_LIMIT = 128;
const emptyEnvironment: SymbolicEnvironment = { values: new Map() };
const containsOwnedReturn = (root: t.Node): boolean => {
@@ -120,9 +118,13 @@ export class JavaScriptSymbolicBindings {
readonly tableAliases: ReadonlySet<string>;
readonly modules: Map<string, SymbolicValue>;
}> = [];
#remainingEvaluations = 1_000_000;
#remainingEvaluations: number;
#depth = 0;
truncated = false;
readonly resourceLimits = new Set<"wrapper_visits" | "wrapper_depth">();
get truncated(): boolean {
return this.resourceLimits.size > 0;
}
unresolved = false;
constructor(
@@ -132,6 +134,7 @@ export class JavaScriptSymbolicBindings {
indexJavaScriptElectronIdentitySteps(program, state),
),
) {
this.#remainingEvaluations = state.precision.wrapper_visits;
this.#electronIdentity = electronIdentity;
const shapes = createSemanticExpressionShapeResolver(state);
const defineProperty = createGlobalReferenceReader(state, [
@@ -218,9 +221,11 @@ export class JavaScriptSymbolicBindings {
#admitEvaluation(): boolean {
if (
--this.#remainingEvaluations < 0 ||
this.#depth >= SYMBOLIC_DEPTH_LIMIT
this.#depth >= this.state.precision.wrapper_depth
) {
this.truncated = true;
this.resourceLimits.add(
this.#remainingEvaluations < 0 ? "wrapper_visits" : "wrapper_depth",
);
return false;
}
return true;
@@ -269,7 +274,7 @@ export class JavaScriptSymbolicBindings {
: 0);
if (cost > this.#remainingEvaluations) {
this.#remainingEvaluations = 0;
this.truncated = true;
this.resourceLimits.add("wrapper_visits");
return symbolicUnknown("symbolic condition resource limit");
}
this.#remainingEvaluations -= cost;
@@ -319,7 +324,7 @@ export class JavaScriptSymbolicBindings {
first === undefined ? undefined : this.#completionGroups.get(first);
if (group === undefined || group.members.size !== values.length) return [];
if (values.length > this.#remainingEvaluations) {
this.truncated = true;
this.resourceLimits.add("wrapper_visits");
this.#remainingEvaluations = 0;
return [];
}
@@ -981,7 +986,7 @@ export class JavaScriptSymbolicBindings {
current = current.parent
) {
if (--this.#remainingEvaluations < 0) {
this.truncated = true;
this.resourceLimits.add("wrapper_visits");
return false;
}
if (current.activation === activation) return true;
@@ -1000,7 +1005,7 @@ export class JavaScriptSymbolicBindings {
current = current.caller
) {
if (--this.#remainingEvaluations < 0) {
this.truncated = true;
this.resourceLimits.add("wrapper_visits");
return undefined;
}
const point = current.point;
@@ -1031,7 +1036,7 @@ export class JavaScriptSymbolicBindings {
const boundary =
read === undefined ? undefined : this.#namespaceReadBoundary(value, read);
if (this.#remainingEvaluations <= 0) {
this.truncated = true;
this.resourceLimits.add("wrapper_visits");
return undefined;
}
const sourcePoint = boundary?.node[boundary.edge];
@@ -1049,7 +1054,7 @@ export class JavaScriptSymbolicBindings {
if (commonThrough != null) {
if (writes.length > this.#remainingEvaluations) {
this.#remainingEvaluations = 0;
this.truncated = true;
this.resourceLimits.add("wrapper_visits");
return undefined;
}
this.#remainingEvaluations -= writes.length;
@@ -1147,7 +1152,7 @@ export class JavaScriptSymbolicBindings {
) {
if (variants.length > this.#remainingEvaluations) {
this.#remainingEvaluations = 0;
this.truncated = true;
this.resourceLimits.add("wrapper_visits");
} else {
this.#remainingEvaluations -= variants.length;
const exits = variants as readonly SymbolicNamespace[];
@@ -1277,8 +1282,13 @@ export class JavaScriptSymbolicBindings {
...(unresolvedFallthrough ? { conditionUnresolved: true } : {}),
});
for (const statement of statements) {
if (--this.#remainingEvaluations < 0 || depth >= 128) {
this.truncated = true;
if (
--this.#remainingEvaluations < 0 ||
depth >= this.state.precision.wrapper_depth
) {
this.resourceLimits.add(
this.#remainingEvaluations < 0 ? "wrapper_visits" : "wrapper_depth",
);
return {
values: [...possible, symbolicUnknown("symbolic resource limit")],
fallsThrough: false,