rea-agents 1.0.0 → 1.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +49 -18
- package/dist/application/ArtifactInventory.js +80 -44
- package/dist/application/CommandShimReplay.js +136 -0
- package/dist/application/Doctor.js +4 -4
- package/dist/application/EvidenceBundleFiles.js +13 -4
- package/dist/application/MacHopper.js +175 -0
- package/dist/application/ProcessCaptureAuthority.js +25 -0
- package/dist/application/ProcessCaptureCapability.js +23 -0
- package/dist/application/ProcessCaptureError.js +5 -0
- package/dist/application/ProcessCaptureLifecycle.js +269 -0
- package/dist/application/ProcessCheckpoints.js +129 -0
- package/dist/application/ProcessCli.js +61 -0
- package/dist/application/ProcessEvidence.js +38 -0
- package/dist/application/ProcessHarness.js +252 -272
- package/dist/application/ProcessNormalization.js +10 -1
- package/dist/application/ProcessOwnership.js +39 -1
- package/dist/application/ProcessSampling.js +39 -23
- package/dist/application/Setup.js +104 -100
- package/dist/application/SetupSkill.js +44 -0
- package/dist/application/TerminalRenderer.js +92 -0
- package/dist/application/runtime.js +1 -1
- package/dist/artifacts/ArtifactProvider.js +18 -6
- package/dist/artifacts/ArtifactReader.js +3 -1
- package/dist/artifacts/AsarArtifactReader.js +8 -1
- package/dist/artifacts/DirectoryArtifactReader.js +1 -0
- package/dist/artifacts/MachOSliceArtifactReader.js +1 -0
- package/dist/artifacts/NativeDmgArtifactReader.js +151 -0
- package/dist/artifacts/ZipArtifactReader.js +1 -0
- package/dist/cli.js +60 -26
- package/dist/cliProcessCommands.js +19 -0
- package/dist/config.js +2 -0
- package/dist/contracts/artifactToolContracts.js +1 -0
- package/dist/contracts/investigationExamples.js +3 -3
- package/dist/contracts/processCaptureExample.js +50 -7
- package/dist/contracts/toolContracts.js +3 -2
- package/dist/domain/changedBehavior.js +2 -2
- package/dist/domain/errors.js +11 -3
- package/dist/domain/processCapture.js +99 -293
- package/dist/domain/processCaptureValidation.js +124 -0
- package/dist/domain/processComparison.js +176 -32
- package/dist/domain/processScenario.js +370 -0
- package/dist/domain/reconstructionVerification.js +3 -3
- package/dist/domain/runtimeVersion.js +8 -0
- package/dist/domain/staticRuntimeCorrelation.js +3 -2
- package/dist/identity.js +1 -0
- package/dist/server/registerProcessComparisonTool.js +28 -8
- package/dist/server/registerSessionTools.js +3 -25
- package/dist/server/sessionToolPolicies.js +1 -6
- package/install.sh +79 -164
- package/package.json +7 -4
- package/scripts/prepare-node-pty.mjs +35 -0
- package/skills/rea-analysis/SKILL.md +19 -4
|
@@ -0,0 +1,61 @@
|
|
|
1
|
+
import { readFile } from "node:fs/promises";
|
|
2
|
+
import { parseConfig } from "../config.js";
|
|
3
|
+
import { createEvidence, parseEvidence } from "../domain/evidence.js";
|
|
4
|
+
import { jsonValueSchema } from "../domain/jsonValue.js";
|
|
5
|
+
import { compareProcessCaptures, LEGACY_PROCESS_CAPTURE_MESSAGE, parseProcessScenario, parseProcessCapture, } from "../domain/processCapture.js";
|
|
6
|
+
import { captureProcessScenario } from "./ProcessHarness.js";
|
|
7
|
+
import { PROCESS_PROVIDER, createProcessCaptureEvidence, } from "./ProcessEvidence.js";
|
|
8
|
+
const MAX_INPUT_BYTES = 64 * 1024 * 1024;
|
|
9
|
+
/** Capture one JSON scenario through the same policy and evidence contract as MCP. */
|
|
10
|
+
export const captureProcessScenarioFile = async (path) => {
|
|
11
|
+
const scenario = parseProcessScenario(await readJson(path));
|
|
12
|
+
const config = parseConfig(process.env);
|
|
13
|
+
if (!config.ok)
|
|
14
|
+
throw config.error;
|
|
15
|
+
const captured = await captureProcessScenario(scenario, config.value.processExecutionPolicy);
|
|
16
|
+
if (!captured.ok)
|
|
17
|
+
throw captured.error;
|
|
18
|
+
return createProcessCaptureEvidence(scenario, captured.value);
|
|
19
|
+
};
|
|
20
|
+
/** Compare two capture Evidence files and emit derived comparison Evidence. */
|
|
21
|
+
export const compareProcessEvidenceFiles = async (leftPath, rightPath) => {
|
|
22
|
+
const left = parseCaptureEvidence(await readJson(leftPath));
|
|
23
|
+
const right = parseCaptureEvidence(await readJson(rightPath));
|
|
24
|
+
const comparison = compareProcessCaptures(left.capture, right.capture);
|
|
25
|
+
return createEvidence(undefined, PROCESS_PROVIDER, {
|
|
26
|
+
predicateType: "rea.process-comparison/v3",
|
|
27
|
+
operation: "compare_process_captures",
|
|
28
|
+
parameters: {
|
|
29
|
+
left_evidence_id: left.id,
|
|
30
|
+
right_evidence_id: right.id,
|
|
31
|
+
left_normalization: left.capture.normalization,
|
|
32
|
+
right_normalization: right.capture.normalization,
|
|
33
|
+
},
|
|
34
|
+
result: jsonValueSchema.parse(comparison),
|
|
35
|
+
confidence: "derived",
|
|
36
|
+
authority: "analyst-inference",
|
|
37
|
+
limitations: comparison.limitations,
|
|
38
|
+
evidenceLinks: [left.id, right.id],
|
|
39
|
+
});
|
|
40
|
+
};
|
|
41
|
+
const parseCaptureEvidence = (input) => {
|
|
42
|
+
const evidence = parseEvidence(input);
|
|
43
|
+
if (evidence.operation !== "capture_process_scenario" ||
|
|
44
|
+
evidence.predicate_type !== "rea.process-capture/v4" ||
|
|
45
|
+
evidence.provider.id !== PROCESS_PROVIDER.id ||
|
|
46
|
+
evidence.provider.version !== PROCESS_PROVIDER.version) {
|
|
47
|
+
if (evidence.predicate_type === "rea.process-capture/v3")
|
|
48
|
+
throw new TypeError(LEGACY_PROCESS_CAPTURE_MESSAGE);
|
|
49
|
+
throw new TypeError("Expected REA Process Capture v4 Evidence");
|
|
50
|
+
}
|
|
51
|
+
return {
|
|
52
|
+
id: evidence.evidence_id,
|
|
53
|
+
capture: parseProcessCapture(evidence.normalized_result),
|
|
54
|
+
};
|
|
55
|
+
};
|
|
56
|
+
const readJson = async (path) => {
|
|
57
|
+
const bytes = await readFile(path);
|
|
58
|
+
if (bytes.length > MAX_INPUT_BYTES)
|
|
59
|
+
throw new TypeError("Process JSON input exceeds byte limit");
|
|
60
|
+
return JSON.parse(bytes.toString("utf8"));
|
|
61
|
+
};
|
|
@@ -0,0 +1,38 @@
|
|
|
1
|
+
import { createEvidence } from "../domain/evidence.js";
|
|
2
|
+
import { jsonValueSchema } from "../domain/jsonValue.js";
|
|
3
|
+
import { parseProcessCapture } from "../domain/processCapture.js";
|
|
4
|
+
/** Provider identity for controlled Process Capture v4 evidence. */
|
|
5
|
+
export const PROCESS_PROVIDER = {
|
|
6
|
+
id: "rea-process",
|
|
7
|
+
name: "REA deterministic process harness",
|
|
8
|
+
version: "3",
|
|
9
|
+
};
|
|
10
|
+
/** Project one process scenario into secret-free Evidence parameters. */
|
|
11
|
+
const processEvidenceParameters = (scenario) => ({
|
|
12
|
+
executable_name: scenario.executable.split("/").at(-1) ?? scenario.executable,
|
|
13
|
+
argument_count: scenario.arguments.length,
|
|
14
|
+
event_count: scenario.events.length,
|
|
15
|
+
filesystem_root_count: scenario.filesystem_roots.length,
|
|
16
|
+
checkpoint_count: scenario.checkpoints.length,
|
|
17
|
+
command_shim_count: scenario.command_shims.length,
|
|
18
|
+
normalization: scenario.normalization,
|
|
19
|
+
});
|
|
20
|
+
/** Create one canonical observed Process Capture v4 Evidence record. */
|
|
21
|
+
export const createProcessCaptureEvidence = (scenario, capture) => {
|
|
22
|
+
const validatedCapture = parseProcessCapture(capture);
|
|
23
|
+
return createEvidence(undefined, PROCESS_PROVIDER, {
|
|
24
|
+
predicateType: "rea.process-capture/v4",
|
|
25
|
+
operation: "capture_process_scenario",
|
|
26
|
+
parameters: processEvidenceParameters(scenario),
|
|
27
|
+
result: jsonValueSchema.parse(validatedCapture),
|
|
28
|
+
confidence: "observed",
|
|
29
|
+
authority: "controlled-replay",
|
|
30
|
+
environment: {
|
|
31
|
+
id: `${process.platform}-${process.arch}`,
|
|
32
|
+
platform: process.platform,
|
|
33
|
+
architecture: process.arch,
|
|
34
|
+
isolation: "process",
|
|
35
|
+
},
|
|
36
|
+
limitations: validatedCapture.limitations,
|
|
37
|
+
});
|
|
38
|
+
};
|