OpenSource/reverse-engineering-anything
1
0 Fork 0
mirror of https://github.com/morluto/rea.git synced 2026-11-07 07:16:13 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
e9ea9d6f50b155a44af4b3ff4afbb5597c9d55f9
reverse-engineering-anything/scripts/ci/scopes.mjs
T
Entrpi 81f9f71f6d feat(rizin): select the decoder and map address for one-shot commands (#8991) 
* feat(rizin): select the decoder and map address for one-shot commands

execute_rizin_command and rea execute-rizin-command accept optional
asm_arch, asm_bits, asm_cpu and base_address (CLI --asm-arch,
--asm-bits, --asm-cpu and --base-address). REA passes them to Rizin
before the artifact path as -a, -b, -e asm.cpu= and -m. Rizin 0.9.1
refuses -e asm.arch= and -e asm.bits= at startup, while -a and -b work
in 0.7.4 and 0.9.1. Rizin applies -e settings after -a and -b.
base_address is the address of file offset 0, as in REA's raw-binary
inputs.

REA checks only the spelling, because Rizin owns the arch and CPU
vocabulary and its builds differ. The Homebrew build of Rizin 0.9.1
has no xtensa or riscv plugin; the official static Linux build of
0.7.4 has both. Evidence records each input and the complete argument
list. When any input is set, Evidence also states that REA does not
confirm the decoder or map that Rizin used: Rizin uses another value
for one it cannot apply and exits 0. Rizin 0.9.1 keeps its default and
reports the value on stderr, and Rizin 0.7.4 turned -b 8 for arm into
16 without a message. Calls without these inputs keep their argument
list and Evidence.

The real-provider gate tests/boundary/providers/RizinDecoderInputs.test.ts
checks the effect of each flag through MCP with Rizin's own e asm.*,
omlj and byte reads. It skips when no Rizin is on PATH. It passes with
Rizin 0.9.1 (Homebrew, macOS arm64) and 0.7.4 (official static build,
Linux x86_64).

* docs(rizin): map multi-segment ESP32 images with om

An ESP32-family app or bootloader image holds several segments, each
loaded at its own address, so one base_address cannot map it. The
recipe removes the default map with om-* and adds one om map per
segment, using the segment offsets from the image format or from
esptool image-info. It does not depend on an ESP image reader in REA.

The offsets were checked against esptool 4.12.0 image_info on a
synthetic two-segment ESP32 image. Rizin 0.9.1 and 0.7.4 mapped its
segments at their load addresses. Rizin 0.7.4, whose static Linux
build has the xtensa plugin, decoded the IRAM segment as nop.n, nop.n,
ret.n and nop.n.

* fix(rizin): read the file at base_address when a loader would claim it

On Rizin 0.9.1, base_address could read 0xff at the mapped address with
exit 0. -m maps the file, but Rizin still runs its format loaders, and
a loose one can claim a raw image. Rizin 0.9.1's AVR loader matches
when bytes 1 and 3 look like rjmp and turns io.va off, so reads use
file offsets. The BIOS loader, in 0.7.4 and 0.9.1, matches a 64 KiB
file with a jmp 16 bytes from its end and maps it at another address.
An acceptance run on a raw ESP32-S3 segment hit the first case.

With base_address, REA now passes -n together with -m. Rizin then skips
the loaders and maps the whole file at the address: rizin.c calls
rz_io_map_new at the -m address and leaves io.va at its default. The
input therefore means a raw image, and Rizin loads no sections, symbols
or entry point, even from an ELF file. Evidence states this in its own
limitation, and the decoder limitation no longer covers the map.

The real-provider gate adds an AVR-like and a BIOS-like image and reads
below the base, at it, at the end of the image and past it. Without -n
it fails on Rizin 0.9.1. It passes with Rizin 0.9.1 (Homebrew, macOS
arm64) and 0.7.4 (official static build, Linux x86_64). The ESP om
recipe now starts with e io.va=true, because reads use the maps only
while io.va is on.

* fix(rizin): advertise name patterns that compile in v mode

The asm_arch and asm_cpu pattern ended its character class with an
unescaped '-', which JavaScript's v (unicodeSets) mode rejects, so
clients compiling advertised patterns in that mode could not use
execute_rizin_command's schema. Escaping it keeps the same names valid
in every mode, as main's own patterns write it.

* fix(rizin): state what the decoder and map inputs leave unconfirmed

The base_address limitation reported a map REA never observes and left
out that -n keeps Rizin's default arch, bits and byte order. The asm_*
limitation implied Rizin replaces a bad CPU, but e asm.cpu echoes any
value. Compact schemas drop property descriptions, so the tool
description now carries the raw-loading warning. The real-provider
gate checks that asm_cpu changes a decode, and a base_address-only call.

* docs(rizin): record the gate's full run on Rizin 0.7.4

* test(rizin): follow the test guide in the decoder input tests

Focused tests resolve execute_rizin_command from its contract family,
the harness owns the temporary directory before setup can fail, and
guidance is compared with its owner, not with sentences from it.
2026-11-06 20:48:59 +08:00

737 lines
30 KiB
JavaScript
Raw Blame History

// These boundaries require native Windows launch verification even where
// broad process ownership would otherwise suppress host fanout on the fast tier.
export const WINDOWS_EXECUTABLE_SELECTION_INPUTS = [
"src/process/WindowsExecutable*.ts",
"src/adb/AdbConfiguration.ts",
"src/apktool/ApktoolConfiguration.ts",
"src/application/UpdateCommandRunner.ts",
"tests/boundary/process/windowsExecutableSelection.test.ts",
];
// Inputs whose changes must select both real capture lanes, even at shared boundaries.
const CAPTURE_SHARED_INPUTS = [
"src/process/LinuxResourceLimits*",
"scripts/ci/require-provider-tests.mjs",
];
// Ownership of the native-host, real-provider and website verification lanes.
// Shared build inputs are classified once in plan.mjs rather than repeated in
// every workflow.
const PATH_SCOPES = {
python: [
"bridge/**/*.py",
"tests/support/analysis-efficiency/**",
"scripts/run-python-tests.py",
],
packet_capture: [
"tests/boundary/captures/**",
"tests/boundary/cli/captureCleanup.test.ts",
"tests/boundary/mcp/packetCaptureMcp.test.ts",
"tests/boundary/pcap/**",
"tests/acceptance/pcapVerifier.test.ts",
"tests/fixtures/pcap/offlineHttpCapture.ts",
"src/captures/**",
"src/pcap/**",
"src/domain/pcap/**",
"src/domain/analysisView/pcapCaptureView.ts",
"src/application/pcap/**",
"src/contracts/pcap/**",
"src/server/registerPcapTools.ts",
"src/domain/captures/**",
"src/application/captures/**",
"src/contracts/captures/**",
"src/composition/captures.ts",
"src/cli/captureCommands.ts",
"src/server/registerCaptureTools.ts",
...CAPTURE_SHARED_INPUTS,
"scripts/verify-packet-capture.mjs",
"scripts/verify-pcap.mjs",
".github/workflows/real-packet-capture.yml",
],
signal_recording: [
"tests/boundary/signals/**",
"tests/boundary/cli/signalCleanup.test.ts",
"tests/boundary/mcp/signalRecordingMcp.test.ts",
"src/signals/**",
"src/domain/signals/**",
"src/application/signals/**",
"src/contracts/signals/**",
"src/composition/signals.ts",
"src/cli/signalCommands.ts",
"src/server/registerSignalTools.ts",
...CAPTURE_SHARED_INPUTS,
"scripts/verify-signal-recording.mjs",
".github/workflows/real-signal-recording.yml",
],
readiness: [
"tests/conformance/readiness/**",
"scripts/verify-reconstruction-readiness.mjs",
],
reverse_tools: [
".github/workflows/mutation.yml",
"src/application/reverse/**",
"src/application/binary/BinarySession.ts",
"src/cutter/**",
"src/gdb/**",
"src/frida/frida-bindings.d.ts",
"src/objdump/**",
"src/cli/reverseEngineeringCommands.ts",
"src/process/ownedDebuggerCleanupError.ts",
"src/process/ownedDebuggerSession.ts",
"src/rizin/**",
"src/contracts/*ToolContracts.ts",
"src/server/registerCutterTools.ts",
"src/server/externalMutationAdmission.ts",
"src/server/registerGdbTools.ts",
"src/server/registerReverseEngineeringTools.ts",
"src/server/providerEnvironment.ts",
"src/process/ExecFileOutput.ts",
"src/process/ExecFileOutput.test.ts",
"tests/composition/analysis-sessions/binarySession.test.ts",
"tests/boundary/filesystem/directAnalysisSnapshotReplay.test.ts",
"tests/boundary/filesystem/reverseToolsMutationConfig.test.ts",
"tests/boundary/filesystem/mutationWorkflow.test.ts",
"src/server/registerRizinDebugTools.ts",
"tests/boundary/providers/CutterBridge*.test.ts",
"tests/boundary/providers/cutterBridgeProducer.test.ts",
"tests/boundary/providers/GdbSession*.test.ts",
"tests/boundary/providers/GdbCommandQueue.test.ts",
"tests/boundary/providers/gdbTestHelpers.ts",
"tests/boundary/providers/RizinDebugSessionCoverage.part*.test.ts",
"tests/boundary/providers/RizinCommandTimeout.test.ts",
"tests/boundary/providers/RizinTimeoutEvidence.test.ts",
"tests/boundary/providers/RizinDebugSession*.test.ts",
"tests/boundary/providers/RizinInferiorTty.test.ts",
"tests/boundary/providers/RizinDecoderInputs.test.ts",
"tests/boundary/providers/RizinTestInferiorTty.ts",
"tests/boundary/process/ownedDebuggerSession.test.ts",
"tests/boundary/cli/debuggerOneShotExit.test.ts",
"tests/boundary/cli/gdbStartupCleanupCli.test.ts",
"tests/boundary/cli/reverseEngineeringCommands.test.ts",
"tests/boundary/mcp/cutter*.test.ts",
"tests/boundary/mcp/gdbCancellationMcp.test.ts",
"tests/boundary/mcp/debuggerCancellationMcp.test.ts",
"tests/boundary/mcp/rizinDebuggerCancellationMcp.test.ts",
"tests/boundary/mcp/rizinPendingOutput.test.ts",
"tests/boundary/mcp/reverseEngineeringPartialMcp.test.ts",
"tests/boundary/mcp/workflowSnapshotReplayMcp.test.ts",
"tests/boundary/mcp/reverseEngineeringEnvironmentMcp.test.ts",
"tests/support/reverseEngineering*.ts",
"tests/support/ownedRizinCommandEvidenceTests.ts",
"tests/support/reverseDebuggerMcpTestHelpers.ts",
"tests/processOwnershipRunner.ts",
"tests/composition/reverseEngineering*.test.ts",
"vitest.reverse-tools.config.ts",
"vitest.reverse-tools-semantics.config.ts",
"stryker.config.mjs",
"stryker.semantics.config.mjs",
"tsconfig.reverse-tools-mutation.json",
"scripts/prepare-reverse-tools-mutation.mjs",
"scripts/lib/reverse-tools-mutation-targets.mjs",
],
// Apple artifact CLI/MCP lane on macOS, including its focused regressions.
apple: [
"src/artifacts/InesArtifactReader.ts",
"src/domain/inesContainer.ts",
"tests/fixtures/ines.ts",
"tests/acceptance/inesContainer.test.ts",
"tests/boundary/filesystem/inesArtifact.test.ts",
"tests/boundary/filesystem/inesCancellation.test.ts",
"src/hopper/BridgeLauncher.ts",
"src/domain/hopperErrors.ts",
"tests/boundary/providers/hopper/hopperMacLaunchArguments.test.ts",
"tests/acceptance/providers/hopperStartupRecovery.test.ts",
"tests/boundary/providers/hopper/hopperClient.helperFailure.test.ts",
"tests/boundary/providers/hopper/bridgeBootstrapCleanup.test.ts",
"tests/boundary/providers/hopper/bridgeTargetLease.integration.test.ts",
"src/artifacts/NativeDmg*.ts",
"src/native/Apple*",
"src/native/NativeMacOS*",
"src/native/NativeUi*",
"src/native/Lldb*",
"bridge/native/**",
"bridge/process/**",
"scripts/verify/apple/**",
"tests/acceptance/artifactDmgAttachmentRecoveryCli.test.ts",
"tests/boundary/providers/native/nativeDmgArtifactReader.test.ts",
"tests/process-global/dmgCancellationReason.test.ts",
"tests/boundary/filesystem/installScript.test.ts",
"tests/boundary/filesystem/nibNativeHierarchy.test.ts",
"tests/boundary/filesystem/interfaceBuilderBundle.test.ts",
"tests/boundary/cli/nativePlistCli.test.ts",
"tests/boundary/cli/nativePlistPrototypeKeyCli.test.ts",
"tests/boundary/cli/nativePlistSelectionFailureCli.test.ts",
"tests/boundary/cli/nativeDemangleCli.test.ts",
"tests/boundary/cli/nativeDispatchPropertyAttributes.test.ts",
"tests/boundary/mcp/nativeDemangleMcp.test.ts",
"tests/boundary/mcp/nativeMachoSummaryMcp.test.ts",
"tests/boundary/providers/native/nativeSignatureTargetBinding.test.ts",
"tests/boundary/providers/native/nativeUiOffscreenWindow.test.ts",
"tests/boundary/process/nativeUiVerifierLane.test.ts",
"tests/conformance/native/ui-offscreen.swift",
"tests/boundary/cli/nativeSignatureCli.test.ts",
"tests/boundary/cli/nativeMachoArm64_32Cli.test.ts",
"tests/boundary/cli/nativeMachoEncryptionCli.test.ts",
"tests/boundary/mcp/nativeSignatureTargetBindingMcp.test.ts",
"src/process/capture/FilesystemSnapshot.test.ts",
"tests/process-global/filesystemSnapshotFallbackCancellation.test.ts",
"tests/boundary/process/darwinProcessRunTokenReader.test.ts",
"tests/boundary/process/directAnalysisSignals.test.ts",
"tests/boundary/process/processCaptureLifecycle.test.ts",
"tests/boundary/process/processCli.test.ts",
"tests/boundary/mcp/sessionMcp.test.ts",
],
// Four-host installed-package matrix and the Windows curated lane.
package: [
...WINDOWS_EXECUTABLE_SELECTION_INPUTS,
// Both host compilers must be exercised when their installation, options,
// or entrypoints change; Linux's accelerated checker cannot stand in for Go.
"scripts/run-typescript.*",
"scripts/run-turbo.mjs",
"turbo.json",
"tsconfig.json",
"tsconfig.build.json",
"tsconfig.frida-verification.json",
"package-lock.json",
".nvmrc",
".npmrc",
".github/actions/publish-mcp/**",
".github/actions/prepare-release-package/**",
".github/workflows/release-recovery.yml",
"scripts/ci/release-recovery.mjs",
"scripts/ci/verified-package.mjs",
"scripts/ci/qualified-package-envelope.mjs",
"scripts/ci/prepare-npm-publication.mjs",
"scripts/ci/npm-release.*",
"scripts/ci/npm-release-state.*",
"scripts/verify-release-artifact.mjs",
"scripts/lib/release-package-canary.mjs",
"scripts/lib/verify-package-core.*",
"tests/boundary/mcp/packageCatalogVerification.test.ts",
"scripts/verify-published-package.mjs",
"tests/boundary/filesystem/releaseRecovery.test.ts",
"tests/boundary/filesystem/mcpRegistryPublication.test.ts",
"tests/boundary/filesystem/npmRelease.test.ts",
"tests/boundary/process/releaseArtifactCanary.test.ts",
"src/windows/**",
"src/domain/windowsNativeArtifact*.ts",
"src/domain/dosMz*.ts",
"src/domain/peCoffHeader*.ts",
"src/domain/result.ts",
"scripts/lib/verifier-source-loader.mjs",
"tests/boundary/process/windowsNativeArtifactVerifier.test.ts",
"scripts/lib/windows-native-inspection-workspace.*",
"tests/boundary/process/windowsNativeInspectionWorkspace.test.ts",
"scripts/lib/windows-owned-command.mjs",
"scripts/run-exclusive-command.mjs",
"tests/process-global/runnerCancellation.test.ts",
"tests/process-global/windowsOwnedCommand.test.ts",
"src/ghidra/GhidraBridgeSources.ts",
"native/windows/**",
"src/process/capture/FilesystemSnapshot.ts",
"src/process/capture/FilesystemSnapshot.test.ts",
"tests/process-global/filesystemSnapshotFallbackCancellation.test.ts",
"src/inspector/**",
"scripts/verify/inspector/**",
"scripts/verify-package.mjs",
"scripts/verify-package-*",
"scripts/verify-packed-bridge.*",
"scripts/verify-windows-*.mjs",
"scripts/build-windows-native.mjs",
"scripts/windows-capabilities.mjs",
"scripts/prepack.mjs",
"scripts/prepare.mjs",
"scripts/lib/release-proposal.mjs",
"patches/release-please+17.3.0.patch",
"tests/boundary/filesystem/releaseProposal.test.ts",
"scripts/rea.mjs",
"scripts/lib/cli-process-environment.mjs",
"install.sh",
"src/config/**",
"src/application/Setup*.ts",
"src/application/Uninstall*.ts",
"src/application/ClientConfiguration*.ts",
"src/application/ClientRegistration*.ts",
"src/application/DshCordis*.ts",
"src/cli/interactiveSetup.ts",
"src/cli/setupCommands.ts",
"tests/boundary/filesystem/typescriptCompiler.test.ts",
"tests/boundary/filesystem/binaryTarget.test.ts",
"src/contracts/sessionPathInputs.test.ts",
"tests/boundary/filesystem/directAnalysisSnapshotReplay.test.ts",
"tests/boundary/mcp/rawBinaryMcp.test.ts",
"tests/boundary/filesystem/safeOutputTree.test.ts",
"tests/boundary/providers/native/artifactProvider.archiveSafety.test.ts",
"tests/boundary/providers/native/artifactProvider.extractionCompleteness.test.ts",
"tests/boundary/filesystem/setupUnavailableProvider.test.ts",
"tests/boundary/filesystem/windowsNpxRegistration.test.ts",
"tests/boundary/filesystem/claudeDesktopSkillUninstallWindows.test.ts",
"tests/boundary/filesystem/clientConfigurationEnvironment.test.ts",
"tests/boundary/filesystem/clientConfigurationLayeredEnvironment.test.ts",
"tests/acceptance/setup/registrationRuntimeEnvironmentCli.test.ts",
"tests/boundary/android/workspaceGuardianRetry.test.ts",
"src/android/JadxWorkspaceRoot.ts",
"scripts/rea-android-workspace-guardian.mjs",
"tests/acceptance/setup/homeDirectoryFallback.test.ts",
"tests/boundary/filesystem/javascriptApplicationWorkflows.test.ts",
"src/domain/javascript/javascriptRuntimeStaticCandidates.ts",
"tests/boundary/filesystem/webScriptManifestPaths.test.ts",
"tests/boundary/process/ProcessEvidence.host.test.ts",
"tests/boundary/process/packageNpmInvocation.test.ts",
"tests/boundary/process/packedBridgeVerification.test.ts",
"tests/boundary/process/windowsOutputCapture.test.ts",
"tests/acceptance/webModuleCli.test.ts",
"tests/acceptance/webSourceLocationCli.test.ts",
"tests/boundary/cli/referenceSourceImportStatus.test.ts",
"tests/boundary/filesystem/asarInventoryFreshness.test.ts",
"tests/boundary/filesystem/javascript-applications/javascriptArtifactReconstruction.test.ts",
"tests/conformance/providers/ghidra/windowsCapabilities.test.ts",
"src/ghidra/GhidraInstallation.test.ts",
"tests/boundary/filesystem/ghidraJavaProbe.test.ts",
"tests/boundary/providers/ghidra/ghidraTransport.test.ts",
"tests/boundary/providers/ghidra/ghidraTargetSnapshot.test.ts",
"tests/boundary/providers/ghidra/ghidraLauncher.test.ts",
"tests/boundary/providers/hopper/hopperClient.cleanupRetry.test.ts",
"src/windows/WindowsNativeLoader.test.ts",
"src/windows/WindowsOwnedProcess.test.ts",
"src/ghidra/GhidraLauncherEnvironment.test.ts",
"src/process/ProcessOwnership.test.ts",
"src/process/ProcessOwnership.part2.test.ts",
"src/process/ProcessOwnership.part3.test.ts",
"src/process/ProcessOwnership.validation.test.ts",
"src/application/Update.test.ts",
"tests/process-global/updateMaintenance.test.ts",
"tests/conformance/providers/ghidra/realGhidraWindowsWorkflow.test.ts",
"tests/boundary/filesystem/directoryArtifactReaderOpen.test.ts",
"tests/boundary/filesystem/javascriptPackagePrecedence.test.ts",
"tests/boundary/filesystem/javascriptArtifactContentIdentity.test.ts",
"tests/boundary/process/sourceMapUncHosts.test.ts",
],
// Native SQLite runtime compatibility for the producer, public adapters,
// fixtures, shared lifecycle, and the package script that defines its suite.
sqlite: [
"src/sqlite/**",
"src/domain/sqlite/**",
"src/contracts/sqlite/**",
"src/application/sqlite/**",
"src/composition/sqlite.ts",
"src/cli/sqliteCommands.ts",
"src/server/registerSqliteTools.ts",
"src/application/DirectAnalysisStatus*.ts",
"src/application/CapabilityInventory*.ts",
"src/application/AnalysisProvider*.ts",
"src/contracts/toolContracts.ts",
"src/contracts/toolContractTypes.ts",
"src/contracts/toolEffects*.ts",
"src/contracts/toolOutputSchemaPrimitives.ts",
"src/domain/analysisError*.ts",
"src/domain/evidence*.ts",
"src/domain/inputIssueProjection*.ts",
"src/domain/jsonSerialization*.ts",
"src/domain/jsonValue*.ts",
"src/domain/localPath*.ts",
"src/domain/providerAdapterError*.ts",
"src/domain/providerCleanupError*.ts",
"src/domain/result*.ts",
"src/process/OwnedCommand*.ts",
"src/process/ProviderProcess*.ts",
"src/process/PrivateRuntimeRoot*.ts",
"src/artifacts/ArtifactReader*.ts",
"src/artifacts/ArtifactResourceScope*.ts",
"src/artifacts/ArtifactPaths*.ts",
"src/artifacts/readStableArtifact*.ts",
"src/filesystem/OwnedFileHandle*.ts",
"src/server/EvidenceMcpServer*.ts",
"src/server/analysisAdmission*.ts",
"src/server/contractToolHandler*.ts",
"src/server/toolRegistrationOptions*.ts",
"src/server/createServer*.ts",
"src/cli.ts",
"src/cliCommandNames.ts",
"src/cliLogging.ts",
"src/cli/commandCancellation.ts",
"tests/boundary/sqlite/**",
"tests/fixtures/sqlite/**",
"tests/acceptance/sqliteDatabaseCli.test.ts",
"tests/boundary/mcp/serverLifecycleMcp.test.ts",
".github/workflows/sqlite-runtime.yml",
],
browser: [
".github/workflows/real-browser.yml",
"scripts/verify-real-browser.mjs",
"scripts/verify-browser-network.mjs",
"scripts/verify-browser-request.mjs",
"scripts/verify-browser-scripts.mjs",
"scripts/verify-browser-modules.mjs",
"scripts/verify-browser-dom-destinations.mjs",
"scripts/lib/browser-*.mjs",
"scripts/fixtures/browser-network-site.mjs",
"scripts/fixtures/browser-request-site.mjs",
"scripts/fixtures/browser-script-site.mjs",
"scripts/fixtures/browser-module-site.mjs",
"scripts/fixtures/browser-verifier-site.mjs",
"scripts/fixtures/page-cdp-proxy.mjs",
"src/browser/**",
"src/domain/browser*.ts",
"src/domain/webCaptureDiffSchemas.ts",
"src/domain/webScreenshot.ts",
"src/domain/webScript*.ts",
"src/domain/webModule*.ts",
"src/domain/analysisView/environment*.ts",
"src/domain/analysisView/{EnvironmentManifest*,EnvironmentState*}.ts",
"src/domain/analysisView/{scenarioCaptureRecords,recordedResponseBody,recordedExchangeBody,recordedMediaType,webNetworkRouteTemplates,WebNetworkProjectionAccumulator}.ts",
"src/application/BrowserScenario*.ts",
"src/application/environment/**",
"src/application/WebModule*.ts",
"src/composition/browserScenario.ts",
"src/composition/webModules.ts",
"src/artifacts/readStableArtifact.ts",
"src/artifacts/ArtifactPaths.ts",
"src/application/WebScriptExportService.ts",
"src/contracts/webScriptToolContracts.ts",
"src/server/registerWebScriptTool.ts",
"src/server/registerWebModuleTool.ts",
"src/server/createServer.ts",
"src/cli/webModuleCommands.ts",
"src/cliBrowserScenarioCommands.ts",
"src/cli/environmentCommands.ts",
"src/cli.ts",
"src/cliCommandNames.ts",
"src/contracts/toolEffects.ts",
"src/cli/webScriptCommands.ts",
],
binary_layout: [
".github/workflows/real-binary-layout.yml",
"bridge/pwntools/**",
"src/native/pwntools/**",
"src/domain/native/binaryLayout*",
"src/application/binaryDiagnostics/**",
"src/contracts/native/binaryDiagnosticsToolContracts.ts",
"src/composition/binaryDiagnostics.ts",
"src/server/registerBinaryDiagnosticsTools.ts",
"src/server/createServer.ts",
"src/cli/binaryDiagnosticsCommands.ts",
"src/cli.ts",
"src/cliCommandNames.ts",
"src/contracts/toolContracts.ts",
"src/contracts/toolEffects.ts",
"src/process/OwnedCommand.ts",
"src/process/ProviderProcess.ts",
"src/process/ProviderDeadline.ts",
"src/process/ProcessOwnership*.ts",
"src/process/PrivateRuntimeRoot.ts",
"src/artifacts/readStableArtifact*.ts",
"src/artifacts/ArtifactReader.ts",
"src/domain/analysisError*.ts",
"scripts/verify-binary-layout.mjs",
"scripts/lib/elf-section-name-fixtures.mjs",
"scripts/lib/large-result-mcp.mjs",
"scripts/fixtures/binary-layout*",
],
evm: [
".github/workflows/real-evm-interface.yml",
"src/evm/**",
"src/domain/evm/**",
"src/application/evm/**",
"src/contracts/evm/**",
"src/composition/evm.ts",
"src/cli/evmCommands.ts",
"src/server/registerEvmTools.ts",
"src/server/createServer.ts",
"src/cli.ts",
"src/cliCommandNames.ts",
"src/contracts/toolContracts.ts",
"src/contracts/toolEffects.ts",
"src/process/OwnedCommand.ts",
"src/process/ProviderProcess.ts",
"src/process/ProcessOwnership*.ts",
"src/process/ProviderDeadline.ts",
"src/process/PrivateRuntimeRoot.ts",
"src/artifacts/readStableArtifact*.ts",
"src/artifacts/ArtifactReader.ts",
"scripts/verify-evm-interface.mjs",
"scripts/verify-solidity-metadata.mjs",
"scripts/fixtures/evm-interface.sol",
"third_party/evmole/**",
],
apk_signature: [
".github/workflows/real-apk-signature.yml",
"src/domain/apkSignature/**",
"src/apkSignature/**",
"src/application/apkSignature/**",
"src/composition/apkSignature.ts",
"src/contracts/apkSignature/**",
"src/cli/apkSignatureCommands.ts",
"src/server/registerApkSignatureTools.ts",
"src/server/createServer.ts",
"src/domain/analysisView/apkSignatureView.ts",
"src/domain/analysisView/analysisView.ts",
"src/application/analysisView/**",
"src/cli/analysisEvidenceDelivery.ts",
"src/artifacts/**",
"scripts/verify-apk-signature.mjs",
"tests/fixtures/apkSignature/**",
"tests/acceptance/apkSignature*.test.ts",
],
javascript_recovery: [
".github/workflows/real-javascript-recovery.yml",
"src/javascript/recovery/**",
"src/domain/javascript/**",
"src/application/javascript/JavaScriptRecovery*.ts",
"src/composition/javascriptRecovery.ts",
"src/contracts/javascript/javascriptRecoveryToolContracts.ts",
"src/cli/javascriptRecoveryCommands.ts",
"src/cli/javascriptApplicationAnalysis.ts",
"src/server/registerJavaScriptRecoveryTool.ts",
"src/server/createServer.ts",
"src/server/sessionAvailabilityPolicy.ts",
"src/application/CapabilityInventory.ts",
"src/cli.ts",
"src/cliCommandNames.ts",
"src/contracts/toolContracts.ts",
"src/contracts/toolEffects.ts",
"scripts/rea.mjs",
"scripts/lib/cli-process-environment.mjs",
"src/process/**",
"src/artifacts/SafeOutputTree.ts",
"scripts/verify/javascript/recovery.mjs",
"scripts/fixtures/javascript-recovery/**",
"third_party/wakaru",
],
recorded_crash: [
".github/workflows/real-recorded-crash.yml",
"bridge/pwntools/**",
"bridge/pwndbg/**",
"src/native/pwntools/**",
"src/native/pwndbg/**",
"src/domain/native/recordedCrash*",
"src/application/binaryDiagnostics/**",
"src/contracts/native/binaryDiagnosticsToolContracts.ts",
"src/contracts/toolEffects.ts",
"src/contracts/toolOutputSchemaGroups.ts",
"src/composition/binaryDiagnostics.ts",
"src/server/registerRecordedCrashTools.ts",
"src/server/createServer.ts",
"src/server/sessionAvailabilityPolicy.ts",
"src/cli/binaryDiagnosticsCommands.ts",
"src/cliCommandNames.ts",
"src/process/**",
"src/artifacts/readStableArtifact*.ts",
"src/domain/analysisError*.ts",
"scripts/verify-recorded-crash.mjs",
"scripts/verify/recorded-crash/**",
"scripts/lib/recorded-core-fixtures.py",
"scripts/fixtures/recorded-crash.c",
"third_party/pwndbg/**",
],
web_network: [
".github/workflows/real-web-network-captures.yml",
"bridge/mitmproxy/**",
"src/browser/history/**",
"src/domain/webNetworkCapture*.ts",
"src/domain/analysisError*.ts",
"src/contracts/errorSchemas.ts",
"src/domain/explicitSensitive*.ts",
"src/application/WebNetworkCapture*",
"src/composition/webNetworkCaptures.ts",
"src/cli/webNetworkCaptureCommands.ts",
"src/server/registerWebNetworkCaptureTool.ts",
"src/server/createServer.ts",
"src/server/toolRegistrationOptions.ts",
"src/cli.ts",
"src/cliCommandNames.ts",
"src/contracts/toolContracts.ts",
"src/contracts/toolEffects.ts",
"src/process/OwnedCommand.ts",
"src/process/ProviderProcess.ts",
"src/process/ProviderDeadline.ts",
"src/process/ProcessOwnership*.ts",
"src/process/PrivateRuntimeRoot.ts",
"src/process/capture/ProcessCaptureLifecycle.ts",
"src/artifacts/readStableArtifact*.ts",
"src/artifacts/ArtifactReader.ts",
"src/contracts/webNetworkCaptureToolContracts.ts",
"scripts/verify-web-network-captures.mjs",
"scripts/fixtures/generate-mitmproxy-capture.py",
],
web_runtime: [
".github/workflows/real-web-runtime.yml",
"scripts/verify-browser-runtime.mjs",
"scripts/lib/browser-runtime-*.mjs",
"src/process/ProviderProcess.ts",
"src/process/ProcessOwnership*.ts",
"scripts/fixtures/browser-runtime-site.mjs",
"src/browser/execution/**",
"src/browser/CdpConnection.ts",
"src/browser/CdpEndpoint.ts",
"src/browser/CdpTarget*.ts",
"src/browser/CdpCaptureValues.ts",
"src/browser/CdpAuthorized*.ts",
"src/domain/webRuntime.ts",
"src/domain/webExecution.ts",
"src/domain/webEventListeners.ts",
"src/domain/browserObservationError*.ts",
"src/application/WebRuntime*.ts",
"src/composition/webRuntime.ts",
"src/contracts/webRuntimeToolContracts.ts",
"src/contracts/toolEffects.ts",
"src/server/registerWebRuntimeTools.ts",
"src/server/createServer.ts",
"src/cli/webRuntimeCommands.ts",
"src/cli/commandCancellation.ts",
"src/cli.ts",
],
web_source_map: [
".github/workflows/real-web-source-map.yml",
"scripts/verify-browser-source-maps.mjs",
"scripts/lib/browser-source-map-e2e.mjs",
"scripts/lib/browser-nested-source-map-e2e.mjs",
"scripts/lib/browser-runtime-fixture-lifecycle.mjs",
"scripts/fixtures/browser-source-map-site.mjs",
"src/javascript/sourceMaps/**",
"src/browser/assets/**",
"src/domain/webSource*.ts",
"src/domain/webScript*.ts",
"src/application/WebSourceLocation*.ts",
"src/application/ValidateSelectedWebScript.ts",
"src/composition/webSourceLocations.ts",
"src/server/registerWebSourceLocationTool.ts",
"src/server/createServer.ts",
"src/contracts/webScriptToolContracts.ts",
"src/process/**",
"src/cli/webSourceLocationCommands.ts",
"src/cli.ts",
"src/artifacts/readStableArtifact.ts",
],
agentenv: [
".github/workflows/real-agentenv.yml",
"scripts/verify-agentenv-environment.mjs",
"src/{application,server}/environment/**",
"src/application/{JsonInputFile,OwnedJsonInput,RegularFileRead}.ts",
"src/artifacts/{SafeOutputTree*,ArtifactResourceScope,StreamBytes}.ts",
"src/cliJsonInput.ts",
"src/server/http/**",
"src/{cli,cliCommandNames,cli/environmentCommands}.ts",
"src/config/{environmentName,mcpHttpEndpoint}.ts",
"src/domain/analysisView/{environmentManifest*,EnvironmentManifest*,environmentState*,EnvironmentState*,recordedResponseBody,scenarioCaptureRecords,WebNetworkProjectionAccumulator,analysisViewDataAdmission}.ts",
"src/process/{OwnedCommand,ProviderProcess,PrivateRuntimeRoot}.ts",
"src/process/ProcessOwnership*.ts",
"tests/fixtures/historicalHar.ts",
],
nativeaot: [
"bridge/nativeaot/**",
"scripts/generate-nativeaot-fixtures.mjs",
"scripts/lib/nativeaot-build.*",
"tests/fixtures/nativeaot/**",
".github/workflows/nativeaot-fixtures.yml",
],
ghidra_bridge: [
"bridge/ghidra/**",
"src/ghidra/GhidraBridgeSources.ts",
"src/ghidra/GhidraJavaProperties.ts",
"src/ghidra/GhidraReleasePolicy.ts",
"scripts/verify-ghidra-bridge-sources.mjs",
"tests/conformance/ghidra/ReaArmContextProbe.java",
"tests/conformance/ghidra/ReaDecodeProbe.java",
".github/workflows/ghidra-bridge-sources.yml",
],
website: [
"website/**",
"scripts/*website*.py",
"README*.md",
"docs/readme/README*.md",
".github/workflows/website-check.yml",
".github/workflows/website-pages.yml",
],
};
// Each lane owns its path inputs, selection policy, and required jobs. The
// workflow stays explicit; contract tests bind it to this registry.
const sameJobs = (paths, jobs, selection = {}) => ({
paths,
required: { fast: jobs, full: jobs },
...selection,
});
export const CI_LANES = {
code: {
paths: [],
required: {
fast: ["build", "test-shard", "test-source"],
full: ["build", "test-shard"],
},
},
runtime: sameJobs([], ["windows-native-build", "package-e2e"]),
package: sameJobs(PATH_SCOPES.package, ["windows-curated"], {
testInputs: true,
}),
apple: sameJobs(PATH_SCOPES.apple, ["apple-artifacts"], { testInputs: true }),
fixtures: sameJobs([], ["conformance-fixtures"]),
readiness: sameJobs(PATH_SCOPES.readiness, ["reconstruction-readiness"]),
docs: sameJobs([], ["docs"]),
workflows: sameJobs([], ["static"]),
python: {
paths: PATH_SCOPES.python,
earlyAll: true,
required: { fast: ["python"], full: ["static-deep"] },
},
packet_capture: sameJobs(PATH_SCOPES.packet_capture, ["packet_capture"], {
testInputs: true,
earlyInputs: CAPTURE_SHARED_INPUTS,
}),
signal_recording: sameJobs(
PATH_SCOPES.signal_recording,
["signal_recording"],
{ testInputs: true, earlyInputs: CAPTURE_SHARED_INPUTS },
),
reverse_tools: sameJobs(
PATH_SCOPES.reverse_tools,
["reverse-tools-quality"],
{ earlyAll: true },
),
sqlite: sameJobs(PATH_SCOPES.sqlite, ["sqlite-runtime"], {
testInputs: true,
}),
browser: sameJobs(PATH_SCOPES.browser, ["browser"]),
binary_layout: sameJobs(PATH_SCOPES.binary_layout, ["binary_layout"]),
evm: sameJobs(PATH_SCOPES.evm, ["evm"]),
apk_signature: sameJobs(PATH_SCOPES.apk_signature, ["apk_signature"]),
javascript_recovery: sameJobs(PATH_SCOPES.javascript_recovery, [
"javascript_recovery",
]),
recorded_crash: sameJobs(PATH_SCOPES.recorded_crash, ["recorded_crash"]),
web_network: sameJobs(PATH_SCOPES.web_network, ["web_network"]),
web_runtime: sameJobs(PATH_SCOPES.web_runtime, ["web_runtime"]),
web_source_map: sameJobs(PATH_SCOPES.web_source_map, ["web_source_map"]),
agentenv: sameJobs(PATH_SCOPES.agentenv, ["agentenv"]),
nativeaot: sameJobs(PATH_SCOPES.nativeaot, ["nativeaot"]),
ghidra_bridge: sameJobs(PATH_SCOPES.ghidra_bridge, ["ghidra_bridge"]),
website: sameJobs(PATH_SCOPES.website, ["website"], {
earlyInputs: [".agents/skills/reverse-engineer-anything/**"],
}),
};
// An input owner omitted from the registry must never silently lose a lane.
for (const [name, paths] of Object.entries(PATH_SCOPES))
if (!Object.hasOwn(CI_LANES, name) || CI_LANES[name].paths !== paths)
throw new Error(`CI lane registry does not own input scope: ${name}`);
export const CI_FLAGS = Object.keys(CI_LANES);
// Verifier entrypoints that only manual, licensed, or self-hosted workflows
// run. No selected CI lane executes them, so their edits need only the static
// checks and the source-test suite. Shared helpers under scripts/lib remain
// broad inputs.
export const MANUAL_VERIFIERS = [
"scripts/verify-real-electron.mjs",
"scripts/verify-real-ghidra*.mjs",
"scripts/verify-real-hopper*.mjs",
"scripts/verify-real-ida.mjs",
"scripts/verify-*-client.mjs",
"scripts/verify-native-agent-client.mjs",
"scripts/verify-jeb.mjs",
"scripts/verify-apktool.mjs",
"scripts/verify-adb.mjs",
"scripts/verify-agent-experience.mjs",
"scripts/verify-packaged-ghidra-windows.mjs",
"scripts/verify-wasm-artifact.mjs",
"scripts/verify-packaged-wasm-artifact.mjs",
];
Reference in new issue View Git Blame Copy Permalink