omnius 1.0.892 → 1.0.893

package/assets/rea/skills/reverse-engineer-anything/references/connection-and-recovery.md

@@ -0,0 +1,127 @@
+# Connection and task recovery
+
+Read this guide only for an observed connection, command, approval or provider
+blocker. Keep the user's target and question in view. Explain what prevented the
+operation and the next useful step; after repair, continue the investigation.
+
+Commands below use an installed `rea`. If none is available, use the package
+invocation in `SKILL.md` when acquiring REA is authorized. Follow the connected
+server's schemas and the installed CLI's help rather than assuming repository
+main and an older release expose the same arguments.
+
+## Choose the remedy from the observed failure
+
+| Observation                                                     | Meaning and next step                                                                                                                                                                                                                                                                                                 |
+| --------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| No REA tools in the active session                              | Inspect registration with `rea doctor --client codex --json`. A skill installation alone does not register MCP.                                                                                                                                                                                                       |
+| Missing, malformed or stale registration                        | Prepare a scoped setup plan; apply only authorized changes with backups.                                                                                                                                                                                                                                              |
+| Aligned registration, but no connected tools                    | Restart/reconnect the client. Doctor checks registration; it cannot establish the current agent's connection. Inspect the client's launch error if reconnection fails.                                                                                                                                                |
+| `MCP tool call requires approval, but approval policy is never` | Codex rejected the call before REA executed it. Do not install an engine or repeat setup to solve this client-policy decision. See the approval section below.                                                                                                                                                        |
+| REA returns `provider_unavailable` or an unavailable tool entry | Read that operation's provider diagnostics or `binary_session.result.tool_availability`. Expand each group's tool names and inherit the shared client requirements unless overridden. Use the operation's availability, reason, and remediation; a complete tool catalog does not imply every operation is available. |
+| `rea` is missing in a child shell, or Node is incompatible      | Inspect the actual shell PATH and launcher/runtime. A prefix installation may be absent from a login shell's PATH; this does not establish a broken MCP registration.                                                                                                                                                 |
+
+If the client cannot launch its shell/sandbox helper or read the installed skill,
+inspect its launch diagnostic. For example, Codex can refuse helper aliases when
+CODEX_HOME is under `/tmp`; use an authorized profile outside the OS temporary
+directory. REA setup cannot repair the client's executor. Preserve the sandbox
+instead of silently disabling it to make an analysis command work.
+
+Static JavaScript and ordinary ZIP inventory need neither Hopper nor Ghidra.
+HAR inspection is offline and does not require a live browser. Native
+decompilation, Android analysis and firmware extraction have their own
+bring-your-own prerequisites. Use supported inventory/static evidence when it
+answers part of the question, and name the unavailable evidence separately.
+Do not substitute another target. Label observations from ordinary shell tools
+as such; only actual REA output supplies REA Evidence.
+
+## Repair registration when needed
+
+For Codex:
+
+```bash
+rea doctor --client codex --json
+rea setup --client codex --dry-run --json
+```
+
+Use the current supported client's ID: `claude_code`, `claude_desktop`, `codex`,
+`cursor`, `gemini_cli`, `windsurf`, `devin`, `opencode`, `antigravity`,
+`copilot_cli`, `commandcode`, `qwen_code`, `vscode`, `trae`, `grok_build`, `omp`, `pi`,
+`hermes`, `qoder`, `droid`, `zcode`, `dsh`, or `grok_bot`. If unknown, inspect `doctor --json` before choosing a
+scope. `grok_bot` uses a chat registration step rather than local `mcp.json`.
+For unsupported clients, use version-pinned manual stdio registration or CLI.
+
+Show the plan's exact paths, backups, changes and bundled-skill replacement.
+Obtain approval for writes when that concrete scope is not already authorized,
+then apply the same scope with `rea setup --client codex --yes`. Add
+`--install-hopper` only when separately needed and explicitly approved. Do not
+install or upgrade unrelated prerequisites. Restart/reconnect, verify tools
+actually appear, and resume the original task. If they remain absent, inspect
+the launch failure rather than looping through setup.
+
+## Codex tool approval is separate from REA readiness
+
+REA tools have no permission-grant handshake. Codex can still require approval
+because an operation creates owned resources, launches a helper or has cleanup
+effects. An advertised tool or successful doctor result does not override that
+client policy. `workspace-write` alone does not resolve an MCP approval
+rejection, and `approval_policy = "never"` does not mean every MCP tool is
+preapproved.
+
+When interactive approval is available, use the client's approval flow for the
+requested operation. In an unattended run, continue through an authorized CLI
+workflow if the execution environment permits it, or report the blocked
+operation and the approval needed to proceed. Do not retry the same rejected
+call, silently broaden approvals, or rewrite MCP effects as read-only.
+
+For an operator who explicitly wants to preapprove named operations in a
+disposable Codex profile, current Codex supports per-tool configuration. For
+example, opening and closing an analysis session can be scoped independently:
+
+```toml
+[mcp_servers.rea.tools.open_binary]
+approval_mode = "approve"
+
+[mcp_servers.rea.tools.close_binary]
+approval_mode = "approve"
+```
+
+Use the actual server ID and only the operations whose effects were approved;
+this example does not approve inspection, extraction or runtime execution.
+Show the proposed config edit and preserve unrelated entries and backups before
+writing. Managed policy can constrain client settings. Consult the
+[Codex configuration reference](https://learn.chatgpt.com/docs/config-file/config-reference)
+for the installed client's supported settings. This is an optional recovery
+choice, not a prerequisite for every REA task.
+
+## Continue through an installed CLI
+
+Check the command environment only if the launcher fails:
+
+```bash
+command -v rea
+command -v node
+node --version
+rea --version
+```
+
+Use the public launcher at its known installation path with a supported existing
+Node on PATH when the child shell loses a prefix installation. Avoid internal
+`dist/cli.js` entrypoints or global toolchain changes. MCP may have its own valid
+launcher even when a shell cannot resolve `rea`.
+
+For a user-supplied JavaScript tree or ASAR, select output files in the authorized
+workspace and save complete Evidence before reading a view:
+
+```bash
+rea analyze-javascript-application /absolute/path/to/app --json > app-evidence.json
+jq -c '{source: {kind: "inline", evidence: .}, view: {kind: "summary"}}' app-evidence.json > app-view.json
+rea inspect-analysis-view app-view.json
+```
+
+These commands do not register MCP or install an analysis engine. CLI JavaScript
+JSON is complete and can be very large; redirect it rather than loading it into
+context. Use an existing JSON processor if `jq` is absent, without installing
+one just for this recipe. Inspect a module page or item using the same inline
+source and the [JavaScript recipes](javascript-applications.md). Preserve graph
+coverage, limitations and unknowns. Native CLI analysis still requires its
+selected engine, and all CLI operations retain the host's execution permissions.

package/assets/rea/skills/reverse-engineer-anything/references/evidence-workflows.md

@@ -0,0 +1,71 @@
+# Evidence, comparison, and verification workflows
+
+Evidence-producing tools return the complete Evidence record directly in MCP
+`structuredContent` and CLI JSON. Read `normalized_result` for operation data,
+and cite `evidence_id` when another tool or your explanation needs a stable
+reference. Preserve authority, limitations, coverage, and residual unknowns. If a result
+is incomplete or paginated, continue only when the remaining data matters to
+the task; do not fetch a bundle or resource merely to read a result already
+returned inline. When complete `inspect_binary_layout` or
+`analyze_javascript_application` Evidence is already retained, call
+`inspect_analysis_view` for a summary, one section/symbol/module, or a stable
+page instead of repeating the producer.
+
+Completed `inspect_artifact` inventory also supports a summary and
+`view: {kind: "inventory", collection: "occurrences", logical_paths: ["package.json", "main.js"]}`.
+Omit `logical_paths` to page all available occurrences; `[]` selects none.
+Other inventory collections are `nodes`, `edges` and
+`integrity_contradictions`. Keep `source_complete` separate from page exhaustion:
+a missing match in partial source Evidence does not establish absence. Use the
+returned parent Evidence ID for subsequent views and export before closing the
+session when the source must survive it.
+When `tools/list` advertises `inspect_artifact.detail`, request `"summary"` to
+retain its complete source and receive that view immediately. Without that
+advertised choice, keep the existing complete call. CLI inspection returns
+portable complete Evidence; save it before projecting a selected inline view.
+
+Use `record_unknown` to track unresolved questions in the user's investigation
+and name the authority or environment still required. Supply supporting and
+contradicting evidence IDs. It updates the session registry directly.
+Use `update_unknown` with the current revision; reread after a stale revision
+instead of retrying blindly. Only qualifying observed evidence can verify a
+resolution.
+
+Use comparisons with complete, compatible page sets when claiming equivalence
+or absence:
+
+- `compare_artifacts` compares inventory pages by occurrence path, content,
+  metadata, and graph relations.
+- `compare_functions` compares explicit function Evidence, not fuzzy
+  whole-binary matches.
+- `compare_bundles` compares canonical bundle membership and unknown history.
+- `find_changed_behavior` combines existing comparisons; static differences
+  remain candidates, not causal proof.
+- `build_call_path` needs explicit function dossiers from one artifact/provider;
+  an incomplete frontier makes absence unknown.
+- `correlate_static_and_runtime` uses explicit mappings; matching patterns are
+  hypotheses, not causality.
+- `verify_reconstruction` evaluates a finite typed specification. A pass covers
+  only declared comparable claims, not global equivalence.
+
+Process captures are opt-in behavioral evidence, not a security sandbox. V3
+captures cannot be upgraded to V4; rerun the original scenario. Distinguish root
+exit from descendant settlement and require freshness when the task needs it.
+A timed-out target that must write a final report needs `finalization_ms`: REA
+sends SIGTERM to the captured root, keeps observing, and sends SIGKILL once
+only if the target has not exited by the end of the interval.
+`exit.finalization.signals` lists each attempt with its delivery result; the
+observed exit signal stays in `exit.signal`, `exit.code` is null for every
+deadline exit, and the code of a finalizer that exited on its own is in
+`exit.finalization.exit_code` (null on a signal exit or when no exit was
+observed).
+
+Use `inspect_analysis_view` with `view: {kind: "api-surface"}` on retained
+`inspect_web_network_capture` HAR Evidence to group observed request lines by
+method, origin and path template. Format matches are inferences, not handler
+identity or schemas. Group pages cite parent record ordinals; consult record
+coverage and exclusions before claiming completeness. No requests are replayed.
+When the connected schema advertises `include_query_parameter_names`, select
+it in the view for distinct observed names with original record ordinals. Query
+values are omitted; the names establish neither required parameters nor a
+complete server schema. Keep the original parent Evidence for exact URLs.

package/assets/rea/skills/reverse-engineer-anything/references/javascript-applications.md

@@ -0,0 +1,218 @@
+# JavaScript and Electron application artifacts
+
+For captured or bundled JavaScript that needs readable source recovery, use
+`recover_javascript_sources` with an absolute `path` and absent
+`output_directory`. Supply related runtime/shared/lazy files in
+`additional_paths` when advertised, then analyze the returned `analysis_input`
+directory together. Each input retains its own snapshot, digest and byte-range
+provenance; inputs and recovered code are never executed. Recovery requires a
+caller-supplied Wakaru on Linux x64; see [the recovery guide](https://github.com/morluto/rea/blob/main/docs/javascript-recovery.md).
+
+Use `analyze_javascript_application` directly on the operator-supplied ASAR or
+extracted tree. When the question concerns known source paths and the connected
+schema advertises `source_paths`, select exact inventoried paths such as
+`["package.json", "main.js", "preload.js"]`. Include supporting manifests or
+source maps explicitly; dependencies are not implicitly analyzed. REA retains
+the complete artifact inventory and identity but reads source text and analyzes
+only selected files. The result and summary record `source_selection`; files
+outside scope and their relationships remain unknown, so partial application
+coverage does not mean the selected source failed. Use repeated `--source-path`
+on either static application CLI route. Omit the selection when the question
+requires complete application analysis. `detail: "summary"` reduces delivery
+and does not by itself reduce analysis work.
+
+Exact `#alias` specifiers resolve through the importer's
+enclosing package `imports` map to package-local files; nested `node_modules`
+packages use their own map. Wildcard, recursive, and external-package import
+targets stay unresolved with that limitation. When size is unknown or large and the connected schema advertises
+`detail`, request `detail: "summary"`. This returns an `inspect_analysis_view`
+Evidence record with a distinct ID and a `normalized_result.parent_evidence_id`
+for the complete retained application analysis. Source-map contents are part of
+that static analysis. Read findings, coverage, limitations and unknowns, then
+follow a specific unanswered question. Older servers without `detail` return
+the complete application Evidence inline when it fits.
+
+When the connected schema advertises `max_heap_mb` and `analysis_timeout_ms`,
+these select the isolated source analyzer's old-space heap and per-source
+deadline. Defaults are 1024 MiB and 300000 ms. They do not change the MCP
+process heap. A Bun-hosted REA does not enforce the heap choice; on Windows it
+instead limits the analyzer's committed memory to that choice plus a 512 MiB
+runtime reserve.
+Resource-limited analyses preserve completed static facts and
+report partial semantic coverage with specific unknown scopes; this does not
+mean the source is malformed. Inspect those limits before retrying a source.
+When expanded relationships exceed the parent's available memory, inspect the
+file's modules item view for retained `static_analysis` and
+`semantic_module_analysis`. Their facts remain available even when graph links
+are unknown. Cumulative result exhaustion can stop analysis before every file
+is examined; the inventory and remaining unknown scopes distinguish that case.
+Timeout or cancellation after source analysis begins retains partial Evidence
+in the same session. A returned `error.details.partial_observation` reference
+can be supplied directly to `inspect_analysis_view`. If the SDK cancels locally, retrieve its recorded ID from
+the Evidence bundle before inspecting the partial analysis.
+
+## Read a module without repeating analysis
+
+Use the actual returned parent ID, on the same connection, as `source.evidence_id`.
+The following IDs are placeholders to replace with returned values. When the
+module's node ID is not already known, page identities before selecting an item.
+Pages return only node IDs, paths and roles; choose a useful page size and follow
+`coverage.next_offset` when another page matters:
+
+```json
+{
+  "source": {
+    "kind": "retained-evidence",
+    "evidence_id": "ev_ACTUAL_PARENT_ID"
+  },
+  "view": { "kind": "page", "collection": "modules", "offset": 0, "limit": 16 }
+}
+```
+
+Select the relevant page entry by its exact `node_id` and recorded role:
+
+```json
+{
+  "source": {
+    "kind": "retained-evidence",
+    "evidence_id": "ev_ACTUAL_PARENT_ID"
+  },
+  "view": {
+    "kind": "item",
+    "collection": "modules",
+    "selector": { "node_id": "jag_node_ACTUAL_NODE_ID" }
+  }
+}
+```
+
+Module pages include asset, bundled and source module roles, so one path can
+identify several entries. Use `selector.path` only when uniqueness is established;
+the returned node ID avoids needing a complete inventory to prove uniqueness. On ambiguity,
+select the matching node ID from the page or the error's candidates. Follow
+`next_offset` when another page matters. An item exposes that module node's
+recorded observations, identity, hashes, exports and source ranges; it does not
+include every child syntax observation, related edge or original source file.
+An absent item fact is not evidence of absence from the whole application.
+
+For canonical identities and retained source-range counts, use a typed reference
+page instead of reading every full item:
+
+```json
+{
+  "source": {
+    "kind": "retained-evidence",
+    "evidence_id": "ev_ACTUAL_PARENT_ID"
+  },
+  "view": {
+    "kind": "javascript",
+    "collection": "modules",
+    "projection": "references",
+    "where": { "path": "main.js", "kind": "javascript-module" },
+    "offset": 0,
+    "limit": 16
+  }
+}
+```
+
+Filters match exact retained strings; omit a filter to include all values, use
+`path: null` for unavailable paths, and `path: ""` for a recorded empty path.
+Rows preserve canonical `identity` and distinct observation support states in
+`basis`. `retained_source_range_count` counts retained source-range observations,
+not runtime imports or unique reference sites. Use a row's `node_id` with the item
+view above for exact locations and full supporting observations. Follow
+`coverage.next_offset`; page exhaustion describes matching retained rows only.
+Check `source_coverage` for source selection, partial/unknown graph coverage and
+unknown counts before drawing a negative conclusion.
+
+## Trace only the remaining question
+
+Use `trace_application_feature` on the parent application Evidence for one
+literal node ID, route, string, API, IPC channel, module, or native export.
+Select `incoming` for relationships leading to the seed, `outgoing` for those
+leaving it, and `both` when the question needs both. Trace traversal includes
+containment relationships, so even a narrow seed can expand many nodes; a
+bidirectional trace can reach unrelated sibling modules. A module item or page
+is preferable when its observations already answer the question. Do not treat
+all reached nodes as participants in the feature.
+
+Reuse retained parent Evidence when the server advertises it, or supply complete
+Evidence inline. Include Hopper or Ghidra Evidence only when its artifact digest
+matches exactly.
+
+## Recover an oversized display
+
+An oversized response reports `resource_constraint` and
+`details.resource: "transport"`. Reuse
+`details.reported_limits.evidence_reference` with `inspect_analysis_view` for a
+summary, one module, or a stable page of module identities.
+`export_evidence_bundle` writes the complete canonical session to a
+caller-selected file. These workflows keep the original Evidence and coverage;
+a broad follow-up can also exceed framing.
+
+A client can truncate a successful result inside its text envelope without a
+REA `resource_constraint`. Treat a truncation notice or incomplete JSON as a
+display limitation; do not claim the full record was examined. Reuse the known
+parent ID for smaller views, or export complete Evidence to a selected file
+while the session remains open. If the parent ID was lost from the preview,
+use the prior analysis summary or explicit ledger entries to recover it; do
+not invent an ID or rerun analysis just to reproduce the same display.
+
+BrowserWindow preferences, preload and contextBridge surfaces, IPC
+registrations, utility processes, and native binding requests are static syntax
+observations. Only a unique exact literal IPC channel match supports an inferred
+pairing. Dynamic or ambiguous channels remain unresolved. A requested `.node`
+member is not a verified native export. Never claim runtime reachability,
+registration, defaults, or policy enforcement from static analysis.
+
+For version comparison, analyze each version once, then call
+`compare_application_versions`. Accept only its digest, source-map, structural
+fingerprint, or non-module semantic matches. Module ordinals and minified names
+are not persistent identity. Report added or removed only with complete
+opposite-side coverage; otherwise report unknown.
+
+When the question asks how one exact exported callable's returned object shape
+changed, analyze each version once and then call
+`compare_javascript_export_shapes` with explicit module paths and export names.
+Use the returned IDs on the same connection, or complete inline Evidence
+records, from both analysis calls. Accept variant
+pairing only through the tool's unique exact literal discriminant. Read
+`property_inventories` and each change's `presence` before treating `unknown` as
+"the name was not observed": inventories list observed property names even when
+values stay unknown, with a `source_range` for each paired or unpaired variant.
+Array holes and mutation-invalidated slots are not observed properties.
+Complete parent coverage reports presence-only
+`added`/`removed` independently of unresolved values. Cite the
+comparison Evidence and report JSON Pointer changes; dynamic values, ambiguous
+variants, and incomplete parent-property coverage stay unknown. This is static
+inference, not runtime behavior. When runtime semantics are needed, run
+behavioral probes against the relevant application versions and capture them
+through the available browser, Electron, or process workflows.
+
+## Reusing application Evidence
+
+When advertised by the connected server, application trace and compare tools
+accept complete inline Evidence or
+`{"kind":"retained-evidence","evidence_id":"ev_<64 lowercase hex characters>"}`
+for their application input (`application`, or `left`/`right`). `inspect_analysis_view`
+uses the same retained-reference form in `source`, or portable inline Evidence,
+to project a summary, module page, or one module with its recorded observations.
+This notation is
+a template: replace it with the actual returned ID. Versions before 4.1.0 accept only full
+inline Evidence. Use the exact ID
+returned by the producer on the same MCP connection. Resolution does not run
+analysis or select a provider; findings remain inline. Native observation
+arrays still take full Evidence. `close_binary` clears retained references;
+export a bundle before closing, or supply portable inline Evidence in another
+connection. A missing reference includes its ID and recovery guidance.
+
+For exact file/native metadata or processing gaps, use
+`view: {kind: "javascript-facts", where: {paths: ["package.json"]}, property_keys: ["name", "operation", "analysis_status"], limit: 32}`.
+Rows retain canonical node/observation identity and original Evidence. Paths
+match Evidence artifact-path/source-range locations; missing properties remain
+omitted and source coverage stays separate from page exhaustion. Batch paths and
+select only needed property keys; complete Evidence remains accessible by export.
+If names are unknown, opt into `include_available_property_keys: true`; it lists
+the original keys per returned observation without unselected values. Keep each
+row's node/observation identity paired when composing facts.
+These rows select application-graph observations; semantic relationships and
+semantic unknown records remain in the complete parent Evidence and trace tools.