mirror of
https://github.com/morluto/rea.git
synced 2026-10-12 02:19:24 +00:00
* feat(harmony): project HarmonyOS package inventory evidence First HarmonyOS increment from #1431: HAP, HSP, and App Pack roots are classified through the hardened ZIP reader and projected into an execution-free application graph with packaging-model hints, exact component paths and hashes, App Pack children by path, runtime-family hints, and path-based N-API bridge hypotheses. HarmonyOS .har stays unclassified by suffix because .har also names HTTP Archive JSON. Adds the project_harmony_application_graph tool (CLI and MCP), synthetic composition coverage, a pinned real-package verify lane, and docs. * refactor(domain): share application graph projection scaffolding The HarmonyOS projection mirrors the Android and Apple projections by design, which pushed jscpd duplication over its 2.5 percent budget. Extract the identical pieces (inventory input schema, projected component schema and occurrence flattening, bridge candidate schema factory, coverage assembly, comparator, canonical digest) into domain/mobileApplicationGraphProjection.ts and route all three projections plus the composition fixtures through it. Duplication drops from 2.52 to 2.49 percent with no behavior change: projection ids, classifications, and limitations are byte-identical. * fix(harmony): address review, stable app-pack roots, and rotated fixture - rebased onto main; the shared projection scaffolding now keeps main's nativeRuntimeConvention loop and the harmony runtime families adopt the same react-native/flutter/unity path conventions - the .app App Pack suffix is now a root-input rule only (verified ZIP magic in classifyRootFormat and BinaryTargetResolver); nested .app ZIP members inside other packages keep the generic zip classification, with a regression test, so existing inventories do not change - the signing limitation now states that an empty signing list does not mean unsigned because packaging-tool signatures live in the ZIP signing block, and the app-pack root rule is disclosed as suffix-based - repinned the real-package fixture to the current VHome 2.6.14-beta asset after the upstream deleted v5.0.111-beta and replaced the v2.6.14-beta asset within hours; the pin records both observed digests --------- Co-authored-by: morluto <[email protected]>
99 lines
3.2 KiB
TypeScript
99 lines
3.2 KiB
TypeScript
import { writeFile } from "node:fs/promises";
|
|
import { join } from "node:path";
|
|
|
|
import {
|
|
TextReader,
|
|
Uint8ArrayReader,
|
|
Uint8ArrayWriter,
|
|
ZipWriter,
|
|
} from "@zip.js/zip.js";
|
|
import { z } from "zod";
|
|
|
|
import { createDirectAnalysis } from "../../src/composition/directAnalysis.js";
|
|
import type { AnalysisError } from "../../src/domain/analysisErrorBase.js";
|
|
import { type Evidence, parseEvidence } from "../../src/domain/evidence.js";
|
|
import type { Result } from "../../src/domain/result.js";
|
|
import { createTestTempDirectory } from "../fixtures/temporaryDirectory.js";
|
|
|
|
const { runProviderAnalysis } = createDirectAnalysis({});
|
|
|
|
/** Assert a projection succeeded and return its Evidence for schema parsing. */
|
|
export const requireSuccessfulProjection = (
|
|
result: Result<Evidence, AnalysisError>,
|
|
): Evidence => {
|
|
if (!result.ok)
|
|
throw new TypeError("Expected application projection to succeed");
|
|
return result.value;
|
|
};
|
|
|
|
/** Write one synthetic ZIP application package from literal entries. */
|
|
export const writeApplicationZip = async (
|
|
prefix: string,
|
|
filename: string,
|
|
entries: ReadonlyArray<{
|
|
readonly path: string;
|
|
readonly content: string | Uint8Array;
|
|
}>,
|
|
): Promise<string> => {
|
|
const root = await createTestTempDirectory(prefix);
|
|
const path = join(root, filename);
|
|
const writer = new ZipWriter(new Uint8ArrayWriter());
|
|
for (const entry of entries)
|
|
await writer.add(
|
|
entry.path,
|
|
typeof entry.content === "string"
|
|
? new TextReader(entry.content)
|
|
: new Uint8ArrayReader(entry.content),
|
|
);
|
|
await writeFile(path, await writer.close());
|
|
return path;
|
|
};
|
|
|
|
/** Build inventory Evidence for a written package through the real pipeline. */
|
|
export const inventoryApplicationPackage = async (
|
|
path: string,
|
|
): Promise<Evidence> =>
|
|
parseEvidence(await runProviderAnalysis(path, "inventory_artifact", {}));
|
|
|
|
/**
|
|
* Project the same inventory Evidence twice and return the schema-parsed
|
|
* result, failing when the two projections are not byte-identical.
|
|
*/
|
|
export const requireDeterministicProjection = <Schema extends z.ZodType>(
|
|
project: (input: {
|
|
inventory_evidence: readonly Evidence[];
|
|
}) => Result<Evidence, AnalysisError>,
|
|
inventory: Evidence,
|
|
schema: Schema,
|
|
): z.output<Schema> => {
|
|
const left = requireSuccessfulProjection(
|
|
project({ inventory_evidence: [inventory] }),
|
|
);
|
|
const right = requireSuccessfulProjection(
|
|
project({ inventory_evidence: [inventory] }),
|
|
);
|
|
if (
|
|
JSON.stringify(left.normalized_result) !==
|
|
JSON.stringify(right.normalized_result)
|
|
)
|
|
throw new TypeError("Expected repeated projection to be identical");
|
|
return schema.parse(left.normalized_result);
|
|
};
|
|
|
|
/**
|
|
* Build inventory Evidence from a ZIP that is neither an APK nor an IPA.
|
|
* Both mobile projections must reject it with an AnalysisInputError.
|
|
*/
|
|
export const createNonApplicationZipInventory = async (
|
|
prefix: string,
|
|
): Promise<Evidence> => {
|
|
const root = await createTestTempDirectory(prefix);
|
|
const path = join(root, "fixture.zip");
|
|
const writer = new ZipWriter(new Uint8ArrayWriter());
|
|
await writer.add("one.js", new TextReader("one"));
|
|
await writeFile(path, await writer.close());
|
|
return parseEvidence(
|
|
await runProviderAnalysis(path, "inventory_artifact", {}),
|
|
);
|
|
};
|