chore: merge main into codex/audit-settings-applicability

src/application/AnalysisSettings.test.ts

@@ -6,6 +6,31 @@ import {
 } from "../config/runtimeAnalysisSettings.js";
 import { parseConfig } from "../config/parseConfig.js";
 
+it.each([
+  ["inspect_native_api", [64, 7]],
+  ["trace_native_ui_action", []],
+] as const)(
+  "reports the decompiler budgets consumed by %s",
+  (operation, values) => {
+    const store = new AnalysisSettings({
+      REA_GHIDRA_DECOMPILE_TIMEOUT_SECONDS: "7",
+      REA_GHIDRA_DECOMPILE_MAX_PAYLOAD_MIB: "64",
+    });
+    expect(
+      store
+        .inspect({
+          provider: "ghidra",
+          operation,
+          settings: [
+            "ghidra.decompile_max_payload_mib",
+            "ghidra.decompile_timeout_seconds",
+          ],
+        })
+        .settings.map(({ value }) => value),
+    ).toEqual(values);
+  },
+);
+
 it("updates atomically, restores launch values, and refuses stale or invalid writes", () => {
   const store = new AnalysisSettings({ REA_ASAR_MAX_HEADER_BYTES: "20000000" });
   const inspect = () => store.inspect({ settings: ["asar.max_header_bytes"] });

src/captures/TsharkCaptureProvider.ts

@@ -369,10 +369,7 @@ export class TsharkCaptureProvider implements PacketCapturePort {
         resourcePath = "path" in input ? input.path : command;
         // TShark resolves `-e` aliases before emitting canonical field names;
         // the command arguments, not output names, own field selection.
-        const matchingPackets = parsePacketOutput(
-          output.stdout.text,
-          input.packet_limit,
-        );
+        const matchingPackets = parsePacketOutput(output.stdout.text);
         const start = Math.min(input.match_offset, matchingPackets.length);
         const end =
           input.match_limit === null

src/captures/parsePacketOutput.ts

@@ -6,7 +6,7 @@ import { packetFieldsSchema } from "../domain/captures/packetCapture.js";
 const producerSchema = z.array(
   z.object({ _source: z.object({ layers: packetFieldsSchema }) }),
 );
-export const parsePacketOutput = (text: string, packetLimit: number | null) => {
+export const parsePacketOutput = (text: string) => {
   const decoded: unknown = JSON.parse(text);
   const packets = producerSchema
     .parse(decoded)
@@ -19,11 +19,6 @@ export const parsePacketOutput = (text: string, packetLimit: number | null) => {
         "inspect_packet_capture",
         "TShark returned unordered frames.",
       );
-    if (packetLimit !== null && frame > BigInt(packetLimit))
-      throw new AnalysisOutputError(
-        "inspect_packet_capture",
-        "TShark returned a frame beyond the selected input packet limit.",
-      );
     previous = frame;
   }
   return packets;

src/domain/analysisSettingDefinitions.ts

@@ -57,6 +57,16 @@ const timer = {
   unit: "ms",
   appliesAt: "next_operation",
 } as const;
+
+/** Operations that invoke Ghidra's decompiler directly or through a workflow. */
+const ghidraDecompileOperations = [
+  "procedure_pseudo_code",
+  "analyze_function",
+  "inspect_native_api",
+  "decompile_all",
+  "trace_native_values",
+] as const;
+
 /** Metadata aggregates existing owner definitions; no environment mutation or engine discovery. */
 export const ANALYSIS_SETTINGS = {
   "ghidra.decompile_max_payload_mib": {
@@ -67,14 +77,7 @@ export const ANALYSIS_SETTINGS = {
     unit: "MiB",
     appliesAt: "next_operation",
     provider: "ghidra",
-    operations: [
-      "procedure_pseudo_code",
-      "analyze_function",
-      "inspect_native_api",
-      "decompile_all",
-      "trace_native_values",
-      "trace_native_ui_action",
-    ],
+    operations: ghidraDecompileOperations,
   },
   "asar.max_listing_bytes": {
     environment: "REA_ASAR_MAX_LISTING_BYTES",
@@ -212,12 +215,7 @@ export const ANALYSIS_SETTINGS = {
     unit: "seconds",
     appliesAt: "next_operation",
     provider: "ghidra",
-    operations: [
-      "procedure_pseudo_code",
-      "analyze_function",
-      "decompile_all",
-      "trace_native_values",
-    ],
+    operations: ghidraDecompileOperations,
   },
   "jadx.operation_timeout_ms": {
     ...timer,

tests/boundary/captures/captureProvider.test.ts

@@ -247,26 +247,6 @@ it("preserves TShark canonical output for a caller-selected field alias", async
   expect(report.tool.arguments).toContain("bootp.type");
 });
 
-it("refuses producer frames outside the selected input read scope before paging", async () => {
-  const f = await fixture("many");
-  const request = { path: f.path, fields: ["ip.addr"], match_limit: 1 };
-  expect(
-    await f.service.inspect({ ...request, packet_limit: 10 }),
-  ).toMatchObject({
-    ok: false,
-    error: { _tag: "AnalysisOutputError", operation: "inspect_packet_capture" },
-  });
-  const admitted = await f.service.inspect({ ...request, packet_limit: 90 });
-  if (!admitted.ok) throw admitted.error;
-  const report = packetCaptureSchema.parse(admitted.value.normalized_result);
-  expect(report.output_window).toEqual({
-    matching_packets: 90,
-    returned_packets: 1,
-    has_more: true,
-  });
-  expect(report.packets[0]?.["frame.number"]).toEqual(["1"]);
-});
-
 it("returns canonical alias output through the public packet-capture CLI", async () => {
   const f = await fixture("alias-canonical");
   const cli = Cli.create("capture-alias-test", { sync: false });

tests/boundary/captures/packetOutput.test.ts

@@ -17,7 +17,7 @@ it("preserves repeated field values and missing fields while discarding export i
     },
     { _source: { layers: { "frame.number": ["7"] } } },
   ]);
-  expect(parsePacketOutput(output, 7)).toEqual([
+  expect(parsePacketOutput(output)).toEqual([
     { "frame.number": ["2"], "ip.addr": ["192.0.2.1", "192.0.2.2"] },
     { "frame.number": ["7"] },
   ]);
@@ -49,7 +49,7 @@ it.each([
 ])("rejects malformed producer fields: $layers", ({ layers, issue }) => {
   let failure: unknown;
   try {
-    parsePacketOutput(JSON.stringify([{ _source: { layers } }]), null);
+    parsePacketOutput(JSON.stringify([{ _source: { layers } }]));
   } catch (error) {
     failure = error;
   }
@@ -72,7 +72,6 @@ it.each([
           _source: { layers: { "frame.number": frame } },
         })),
       ),
-      null,
     );
   } catch (error) {
     failure = error;
@@ -89,18 +88,7 @@ it("preserves canonical field names emitted for a selected alias", () => {
       },
     },
   ]);
-  expect(parsePacketOutput(output, null)).toEqual([
+  expect(parsePacketOutput(output)).toEqual([
     { "frame.number": ["1"], "dhcp.type": ["1"] },
   ]);
 });
-
-it("validates every frame against the input read limit while allowing filtered gaps", () => {
-  const output = JSON.stringify(
-    [2, 7].map((frame) => ({
-      _source: { layers: { "frame.number": [String(frame)] } },
-    })),
-  );
-  expect(parsePacketOutput(output, 7)).toHaveLength(2);
-  expect(() => parsePacketOutput(output, 6)).toThrow(AnalysisOutputError);
-  expect(parsePacketOutput(output, null)).toHaveLength(2);
-});