mirror of
https://github.com/morluto/rea.git
synced 2026-11-03 05:16:16 +00:00
Summarize saved Wireshark4.x captures with enforced native resource limits, serialized admission, stable snapshot verification and retained fact/text pages. Preserve complete inventories within resource budgets and source uncertainty; report cleanup failure with partial Evidence and retained ownership. Verified six recorded corpora /13026 packets with independent Scapy/Python oracles, real CLI/MCP/schema parity,60 SNI names,132 DNS addresses and1000 URIs. Real TShark CI now exercises summary/paging. Actual Windows/Bun Wireshark remains unverified; macOS capture requires a separate enforceable-bound decision. Co-authored-by: 3QL <85309073+3QL@users.noreply.github.com> Co-authored-by: N0zoM1z0 <161784452+N0zoM1z0@users.noreply.github.com>
37 lines
1.4 KiB
TypeScript
37 lines
1.4 KiB
TypeScript
import type { PcapAnalysisPort } from "./PcapAnalysisPort.js";
|
|
import type { ExecutionOptions } from "../AnalysisProvider.js";
|
|
import {
|
|
pcapRequestSchema,
|
|
type PcapOperation,
|
|
} from "../../domain/pcap/pcapAnalysis.js";
|
|
import {
|
|
AnalysisCancelledError,
|
|
AnalysisInputError,
|
|
} from "../../domain/analysisErrorCore.js";
|
|
import type { AnalysisError } from "../../domain/analysisErrorBase.js";
|
|
import type { Evidence } from "../../domain/evidence.js";
|
|
import { createPcapEvidence } from "../../domain/pcap/pcapEvidence.js";
|
|
import { err, ok, type Result } from "../../domain/result.js";
|
|
|
|
/** Shared CLI/MCP admission, execution, and Evidence composition for pcap. */
|
|
export class PcapAnalysisService {
|
|
constructor(readonly provider: PcapAnalysisPort) {}
|
|
|
|
/** Run one caller-selected pcap request and retain capture identity inline. */
|
|
async execute(
|
|
operation: PcapOperation,
|
|
input: unknown,
|
|
options?: ExecutionOptions,
|
|
): Promise<Result<Evidence, AnalysisError>> {
|
|
if (options?.signal?.aborted === true)
|
|
return err(new AnalysisCancelledError(operation));
|
|
const request = pcapRequestSchema.safeParse({ operation, input });
|
|
if (!request.success)
|
|
return err(new AnalysisInputError(operation, { cause: request.error }));
|
|
const executed = await this.provider.execute(request.data, options);
|
|
if (!executed.ok) return executed;
|
|
const execution = executed.value;
|
|
return ok(createPcapEvidence(request.data, execution));
|
|
}
|
|
}
|