TypeScript Frida CLI Architecture

Define a process-discovery query and result model that does not expose Frida-specific types.

Implement a Frida-backed adapter that enumerates local Windows processes.

Apply deterministic filtering and sorting to process-discovery results.

Implement shared CLI/REPL commands that list processes and select a target by PID.

Test the process-discovery handler with a fake process provider.

Run an integration check that discovers a controlled local test process through the real Frida adapter.

Resolve a loaded module export to a runtime address without assuming a fixed Windows load address.

Install an Interceptor hook and capture one function invocation in an authorized test process.

Decode primitive arguments and guarded pointer values according to a declared native function signature.

Capture a native function return value without changing the target function’s behavior.

Serialize intercepted-call data into a typed trace event and deliver it to the host.

Convert missing modules, missing exports, invalid signatures, and unsafe reads into structured diagnostic errors.

Implement add-probe, list-probes, and remove-probe handlers over an idempotent probe registry and register them for CLI/REPL use.

Interpret the Windows x64 calling-convention, pointer, handle, string, status, and return-value details needed to trace common Win32 APIs with Frida.

Trace CreateFileW calls and decode nullable UTF-16 path arguments safely.

Trace a selected Windows Registry API and decode its handle, string, and status fields.

Capture return values and Windows last-error information at the correct interception phase.

Create a declarative trace specification that maps an API name to its module, signature, and argument decoders.

Apply event sampling and bounded string reads to reduce tracing overhead and unsafe memory access.

Use thread identifiers and optional backtraces to add execution context to a Windows API trace event.

Implement a trace-api command that resolves a declarative trace specification and installs it through the existing probe-management use cases.

Define a versioned recording envelope containing session identity, sequence, timestamp, source, and event payload.

Validate agent-originated events before they enter the recording pipeline.

Apply configurable redaction and event-size limits before trace data can reach persistent storage.

Define a recorder port and implement an append-only NDJSON file adapter.

Preserve event ordering while applying bounded buffering and backpressure in the host.

Implement start-recording and stop-recording use cases with explicit lifecycle rules and register them for CLI/REPL use.

Implement a replay command that reads an NDJSON recording and produces a concise process, probe, and API-activity summary.

Test the instrumentation-session state machine across attach, hook, record, stop, and detach transitions.

Implement graceful shutdown that removes probes, unloads the agent, closes the recorder, and restores the terminal.

Run an end-to-end test through public application handlers that discovers and attaches to the fixture, records both a function-interception event and a Windows API event, and then detaches cleanly.

Define a plugin contract for adding a command and trace specification without modifying existing feature handlers.

Implement and integration-test a GetEnvironmentVariableW tracing plugin as an independent vertical slice.

Enforce architectural dependency rules with automated static checks.

Package the host CLI and bundled Frida agent as a runnable distribution with a sample configuration for local Windows use.