rea-agents 1.0.0 → 1.2.0

package/dist/server/registerProcessComparisonTool.js

@@ -4,14 +4,14 @@ import { SESSION_TOOL_CONTRACTS } from "../contracts/toolContracts.js";
 import { createEvidence } from "../domain/evidence.js";
 import { EvidenceIntegrityError } from "../domain/errors.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";
-import { compareProcessCaptures, processCaptureSchema, } from "../domain/processCapture.js";
+import { compareProcessCaptures, processCaptureSchema, parseProcessCapture, } from "../domain/processCapture.js";
 import { recordDerivedEvidence } from "./recordDerivedEvidence.js";
 import { err } from "../domain/result.js";
 import { PROCESS_PROVIDER } from "./sessionToolPolicies.js";
 import { toCallToolResult } from "./toolResult.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
 /** Register deterministic process-capture comparison and contradiction tracking. */
-export const registerProcessComparisonTool = (server, session, contract) => {
+export const registerProcessComparisonTool = (server, session, contract, now = Date.now) => {
     server.registerTool(contract.name, toolRegistrationOptions(contract), (input) => {
         const parsed = z
             .object({
@@ -19,15 +19,29 @@ export const registerProcessComparisonTool = (server, session, contract) => {
             left: processCaptureSchema,
             right_evidence_id: z.string(),
             right: processCaptureSchema,
+            max_capture_age_ms: z.number().int().nonnegative().optional(),
             unknown_registry_approved: z.literal(true).optional(),
         })
             .parse(input);
         const validated = validateCaptureSources(session, parsed);
         if (!validated.ok)
             return toCallToolResult(validated, contract);
-        const comparison = compareProcessCaptures(parsed.left, parsed.right);
+        let comparison;
+        try {
+            comparison = compareProcessCaptures(parsed.left, parsed.right, {
+                ...(parsed.max_capture_age_ms === undefined
+                    ? {}
+                    : { maxCaptureAgeMs: parsed.max_capture_age_ms }),
+                now,
+            });
+        }
+        catch (cause) {
+            return toCallToolResult(err(new EvidenceIntegrityError(cause instanceof Error
+                ? cause.message
+                : "Invalid Process Capture v4")), contract);
+        }
         const evidence = createEvidence(undefined, PROCESS_PROVIDER, {
-            predicateType: "rea.process-comparison/v1",
+            predicateType: "rea.process-comparison/v3",
             operation: contract.name,
             parameters: {
                 left_evidence_id: parsed.left_evidence_id,
@@ -50,17 +64,23 @@ const validateCaptureSources = (session, parsed) => {
         [parsed.right_evidence_id, parsed.right],
     ]) {
         const evidence = session.evidenceById(evidenceId);
-        const result = processCaptureSchema.safeParse(evidence?.normalized_result);
+        let evidenceCapture;
+        try {
+            evidenceCapture = parseProcessCapture(evidence?.normalized_result);
+        }
+        catch {
+            evidenceCapture = undefined;
+        }
         if (evidence === undefined ||
             evidence.operation !== "capture_process_scenario" ||
-            evidence.predicate_type !== "rea.process-capture/v2" ||
+            evidence.predicate_type !== "rea.process-capture/v4" ||
             evidence.provider.id !== PROCESS_PROVIDER.id ||
             evidence.provider.name !== PROCESS_PROVIDER.name ||
             evidence.provider.version !== PROCESS_PROVIDER.version ||
             evidence.confidence !== "observed" ||
             evidence.authority !== "controlled-replay" ||
-            !result.success ||
-            canonicalJson(result.data) !== canonicalJson(capture))
+            evidenceCapture === undefined ||
+            canonicalJson(evidenceCapture) !== canonicalJson(capture))
             return err(new EvidenceIntegrityError("Process comparison payload does not match its source Evidence"));
     }
     return { ok: true, value: null };

package/dist/server/registerSessionTools.js

@@ -5,12 +5,11 @@ import { logToolExecution } from "./toolLogging.js";
 import { ok } from "../domain/result.js";
 import { processScenarioSchema } from "../domain/processCapture.js";
 import { captureProcessScenario } from "../application/ProcessHarness.js";
-import { createEvidence } from "../domain/evidence.js";
-import { jsonValueSchema } from "../domain/jsonValue.js";
 import { recordUnknownInputSchema, updateUnknownInputSchema, } from "../domain/residualUnknown.js";
 import { readEvidenceBundle, writeEvidenceBundle, } from "../application/EvidenceBundleFiles.js";
 import { UnknownRegistryError } from "../domain/errors.js";
-import { DENY_EVIDENCE_FILE_POLICY, DENY_PROCESS_POLICY, PROCESS_PROVIDER, } from "./sessionToolPolicies.js";
+import { DENY_EVIDENCE_FILE_POLICY, DENY_PROCESS_POLICY, } from "./sessionToolPolicies.js";
+import { createProcessCaptureEvidence } from "../application/ProcessEvidence.js";
 import { registerProcessComparisonTool } from "./registerProcessComparisonTool.js";
 import { registerArtifactComparisonTool } from "./registerArtifactComparisonTool.js";
 import { registerFunctionComparisonTool } from "./registerFunctionComparisonTool.js";
@@ -45,13 +44,6 @@ const recordProcessResidualUnknowns = (session, scenario, evidence, residuals) =
     }
     return ok(null);
 };
-const processEvidenceParameters = (scenario) => ({
-    executable_name: scenario.executable.split("/").at(-1) ?? scenario.executable,
-    argument_count: scenario.arguments.length,
-    event_count: scenario.events.length,
-    filesystem_root_count: scenario.filesystem_roots.length,
-    normalization: scenario.normalization,
-});
 const registerProcessTools = ({ server, session, logger, processPolicy, captureContract, }) => {
     server.registerTool(captureContract.name, {
         description: captureContract.description,
@@ -63,21 +55,7 @@ const registerProcessTools = ({ server, session, logger, processPolicy, captureC
         const captured = await logToolExecution(logger, captureContract.name, () => captureProcessScenario(scenario, processPolicy, context.mcpReq.signal));
         if (!captured.ok)
             return toCallToolResult(captured, captureContract);
-        const evidence = createEvidence(undefined, PROCESS_PROVIDER, {
-            predicateType: "rea.process-capture/v2",
-            operation: captureContract.name,
-            parameters: processEvidenceParameters(scenario),
-            result: jsonValueSchema.parse(captured.value),
-            confidence: "observed",
-            authority: "controlled-replay",
-            environment: {
-                id: `${process.platform}-${process.arch}`,
-                platform: process.platform,
-                architecture: process.arch,
-                isolation: "process",
-            },
-            limitations: captured.value.limitations,
-        });
+        const evidence = createProcessCaptureEvidence(scenario, captured.value);
         const recorded = session.recordEvidence(evidence);
         if (!recorded.ok)
             return toCallToolResult(recorded, captureContract);

package/dist/server/sessionToolPolicies.js

@@ -14,12 +14,7 @@ export const DENY_EVIDENCE_FILE_POLICY = {
     maxStringLength: 1024 * 1024,
     maxNodes: 1_000_000,
 };
-/** Provider identity for controlled process-capture evidence. */
-export const PROCESS_PROVIDER = {
-    id: "rea-process",
-    name: "REA deterministic process harness",
-    version: "1",
-};
+export { PROCESS_PROVIDER } from "../application/ProcessEvidence.js";
 /** Provider identity for deterministic cross-artifact comparisons. */
 export const ARTIFACT_COMPARISON_PROVIDER = {
     id: "rea-artifact-comparison",

package/install.sh

@@ -3,196 +3,111 @@ set -euo pipefail
 
 PACKAGE="rea-agents"
 REPOSITORY="morluto/rea"
-NODE_FORMULA="node@24"
-NODE_VERSION="24.18.0"
-temporary_directory=""
-node_destination=""
-node_stage=""
-node_backup=""
-node_version=""
-
-cleanup() {
-  if [[ -n "$temporary_directory" && -d "$temporary_directory" ]]; then
-    rm -rf -- "$temporary_directory"
-  fi
-  if [[ -n "$node_stage" && -e "$node_stage" ]]; then
-    rm -rf -- "$node_stage"
-  fi
-  if [[ -n "$node_backup" && -e "$node_backup" && ! -e "$node_destination" ]]; then
-    mv -- "$node_backup" "$node_destination"
-  fi
-}
-trap cleanup EXIT HUP INT TERM
+version="${REA_VERSION:-}"
+dry_run=false
+start_setup=true
+verbose=false
 
 fail() {
   printf 'REA installation failed: %s\n' "$1" >&2
   exit 1
 }
 
-version_at_least() {
-  local actual="$1" required_major="$2" required_minor="$3"
-  local major minor
-  major="${actual%%.*}"
-  minor="${actual#*.}"
-  minor="${minor%%.*}"
-  [[ "$major" =~ ^[0-9]+$ && "$minor" =~ ^[0-9]+$ ]] || return 1
-  ((major > required_major || (major == required_major && minor >= required_minor)))
+usage() {
+  cat <<'EOF'
+Usage: install.sh [--version VERSION] [--dry-run] [--no-setup] [--no-prompt] [--verbose]
+
+Installs only the REA CLI. Run `rea setup` separately to configure Hopper and coding agents.
+EOF
 }
 
-platform="$(uname -s)"
-if [[ "$platform" == "Darwin" ]]; then
-  macos_version="$(sw_vers -productVersion 2>/dev/null)" || fail "could not determine the macOS version."
-  macos_major="${macos_version%%.*}"
-  [[ "$macos_major" =~ ^[0-9]+$ && "$macos_major" -ge 12 ]] || fail "macOS 12 or newer is required."
-elif [[ "$platform" == "Linux" ]]; then
-  [[ "$(uname -m)" == "x86_64" || "$(uname -m)" == "aarch64" ]] || fail "64-bit x86 or ARM Linux is required."
-  [[ -r /etc/os-release ]] || fail "could not identify the Linux distribution."
-  linux_id="$(sed -n 's/^ID=//p' /etc/os-release | tr -d '"')"
-  linux_version="$(sed -n 's/^VERSION_ID=//p' /etc/os-release | tr -d '"')"
-  case "$linux_id" in
-    ubuntu) [[ "${linux_version%%.*}" -ge 24 ]] || fail "Ubuntu 24.04 or newer is required." ;;
-    fedora) [[ "${linux_version%%.*}" -ge 41 ]] || fail "Fedora 41 or newer is required." ;;
-    arch) ;;
-    *) fail "supported Linux distributions are Ubuntu 24.04+, Fedora 41+, and Arch Linux." ;;
+while (($# > 0)); do
+  case "$1" in
+    --version)
+      (($# >= 2)) || fail "--version requires a value."
+      version="$2"
+      shift 2
+      ;;
+    --dry-run)
+      dry_run=true
+      shift
+      ;;
+    --no-setup|--no-prompt)
+      start_setup=false
+      shift
+      ;;
+    --verbose)
+      verbose=true
+      shift
+      ;;
+    --help|-h)
+      usage
+      exit 0
+      ;;
+    *) fail "unknown option: $1" ;;
   esac
-else
-  fail "REA supports macOS and selected 64-bit Linux distributions."
-fi
-command -v curl >/dev/null 2>&1 || fail "curl is required."
-command -v shasum >/dev/null 2>&1 || command -v sha256sum >/dev/null 2>&1 || fail "shasum or sha256sum is required."
+done
 
-if [[ "$platform" == "Darwin" ]] && ! command -v brew >/dev/null 2>&1; then
-  printf 'Installing Homebrew prerequisite...\n'
-  NONINTERACTIVE=1 /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)" || fail "Homebrew installation did not complete."
-  if [[ -x /opt/homebrew/bin/brew ]]; then
-    PATH="/opt/homebrew/bin:$PATH"
-  elif [[ -x /usr/local/bin/brew ]]; then
-    PATH="/usr/local/bin:$PATH"
-  fi
-fi
-if [[ "$platform" == "Darwin" ]]; then
-  command -v brew >/dev/null 2>&1 || fail "Homebrew is not available after installation."
+if [[ "$verbose" == true ]]; then
+  set -x
 fi
 
-node_compatible=false
-if command -v node >/dev/null 2>&1; then
-  node_version="$(node -p 'process.versions.node' 2>/dev/null || true)"
-fi
-if version_at_least "$node_version" 24 18 && [[ "$node_version" =~ ^24\. ]]; then
-  node_compatible=true
-fi
-if [[ "$node_compatible" != true ]]; then
-  if [[ "$platform" == "Darwin" ]]; then
-    brew install "$NODE_FORMULA" || fail "Node.js 24 installation failed."
-    node_prefix="$(brew --prefix "$NODE_FORMULA")" || fail "could not locate Node.js 24."
-    PATH="$node_prefix/bin:$PATH"
-  else
-    machine="$(uname -m)"
-    node_arch="$([[ "$machine" == "x86_64" ]] && printf 'x64' || printf 'arm64')"
-    node_archive="node-v${NODE_VERSION}-linux-${node_arch}.tar.xz"
-    node_base="https://nodejs.org/dist/v${NODE_VERSION}"
-    temporary_directory="$(mktemp -d "${TMPDIR:-/tmp}/rea-install.XXXXXX")" || fail "could not create a temporary directory."
-    curl -fsSL "$node_base/$node_archive" -o "$temporary_directory/$node_archive" || fail "Node.js download failed."
-    curl -fsSL "$node_base/SHASUMS256.txt" -o "$temporary_directory/SHASUMS256.txt" || fail "Node.js checksum download failed."
-    expected_checksum="$(awk -v archive="$node_archive" '$2 == archive { print $1 }' "$temporary_directory/SHASUMS256.txt")"
-    [[ "$expected_checksum" =~ ^[a-f0-9]{64}$ ]] || fail "Node.js checksum metadata was malformed."
-    if command -v shasum >/dev/null 2>&1; then
-      actual_checksum="$(shasum -a 256 "$temporary_directory/$node_archive" | awk '{ print $1 }')"
-    else
-      actual_checksum="$(sha256sum "$temporary_directory/$node_archive" | awk '{ print $1 }')"
-    fi
-    [[ "$actual_checksum" == "$expected_checksum" ]] || fail "Node.js checksum verification failed."
-    node_destination="$HOME/.local/share/rea/node"
-    node_stage="$HOME/.local/share/rea/node.new.$$"
-    node_backup="$HOME/.local/share/rea/node.backup.$$"
-    [[ ! -L "$node_destination" ]] || fail "refusing to replace a symlinked Node.js installation."
-    mkdir -p "$HOME/.local/share/rea"
-    rm -rf -- "$node_stage" "$node_backup"
-    mkdir "$node_stage"
-    tar -xJf "$temporary_directory/$node_archive" --strip-components=1 -C "$node_stage" || fail "Node.js extraction failed."
-    if [[ -e "$node_destination" ]]; then
-      mv -- "$node_destination" "$node_backup"
-    fi
-    if ! mv -- "$node_stage" "$node_destination"; then
-      [[ ! -e "$node_backup" ]] || mv -- "$node_backup" "$node_destination"
-      fail "Node.js installation replacement failed."
-    fi
-    node_stage=""
-    rm -rf -- "$node_backup"
-    node_backup=""
-    PATH="$node_destination/bin:$PATH"
-  fi
-fi
+platform="$(uname -s)"
+[[ "$platform" == "Darwin" || "$platform" == "Linux" ]] || fail "REA supports macOS and selected 64-bit Linux distributions."
+command -v curl >/dev/null 2>&1 || fail "curl is required."
+command -v node >/dev/null 2>&1 || fail "Node.js 22.19+ or 24.11+ is required; install it from https://nodejs.org and retry."
+command -v npm >/dev/null 2>&1 || fail "npm is required; install it with Node.js and retry."
+
 node_version="$(node -p 'process.versions.node' 2>/dev/null || true)"
-if ! command -v node >/dev/null 2>&1 || ! version_at_least "$node_version" 24 18 || [[ ! "$node_version" =~ ^24\. ]]; then
-  fail "Node.js 24.18 or newer is not active on PATH."
-fi
-command -v npm >/dev/null 2>&1 || fail "npm is missing from the Node.js installation."
-npm_version="$(npm --version)"
-if [[ ! "$npm_version" =~ ^11\. ]] || ! version_at_least "$npm_version" 11 16; then
-  if [[ "$platform" == "Linux" ]]; then
-    npm install --global --prefix "$HOME/.local" npm@11 || fail "npm 11 installation failed."
-  else
-    npm install --global npm@11 || fail "npm 11 installation failed."
-  fi
-fi
-npm_version="$(npm --version)"
-if [[ ! "$npm_version" =~ ^11\. ]] || ! version_at_least "$npm_version" 11 16; then
-  fail "npm 11.16 or newer is not active on PATH."
+IFS=. read -r node_major node_minor _node_patch <<<"$node_version"
+[[ "$node_major" =~ ^[0-9]+$ && "$node_minor" =~ ^[0-9]+$ ]] || fail "could not determine the active Node.js version."
+if ! ((node_major == 22 && node_minor >= 19 || node_major >= 24)); then
+  fail "Node.js $node_version is unsupported; use Node.js 22.19+ or 24.11+."
 fi
-if [[ -n "$temporary_directory" ]]; then
-  rm -rf -- "$temporary_directory"
-  temporary_directory=""
+if ((node_major == 24 && node_minor < 11)); then
+  fail "Node.js $node_version is unsupported; use Node.js 24.11 or newer."
 fi
 
-if [[ -n "${REA_VERSION:-}" ]]; then
-  version="$REA_VERSION"
-  [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]] || fail "REA_VERSION must be an exact semantic version."
+if [[ -n "$version" ]]; then
+  [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]] || fail "version must be an exact semantic version."
 else
-  release_json="$(curl -fsSL -H 'Accept: application/vnd.github+json' "https://api.github.com/repos/$REPOSITORY/releases/latest")" || fail "could not resolve the latest GitHub release."
+  release_json="$(curl -fsSL --proto '=https' --tlsv1.2 --retry 3 -H 'Accept: application/vnd.github+json' "https://api.github.com/repos/$REPOSITORY/releases/latest")" || fail "could not resolve the latest GitHub release."
   tag="$(printf '%s' "$release_json" | node -e 'let s="";process.stdin.on("data",c=>s+=c).on("end",()=>{const v=JSON.parse(s).tag_name;if(typeof v!=="string")process.exit(1);process.stdout.write(v)})')" || fail "GitHub returned malformed release metadata."
   [[ "$tag" =~ ^rea-agents-([0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?)$ ]] || fail "latest release tag is not a valid rea-agents release."
   version="${BASH_REMATCH[1]}"
 fi
 
-printf 'Installing %s@%s...\n' "$PACKAGE" "$version"
+prefix_args=()
 if [[ "$platform" == "Linux" ]]; then
-  mkdir -p "$HOME/.local/bin"
-  PATH="$HOME/.local/bin:$PATH"
-  npm install --global --prefix "$HOME/.local" "$PACKAGE@$version" || fail "npm package installation failed."
+  prefix_args=(--prefix "$HOME/.local")
+  install_bin="$HOME/.local/bin/rea"
 else
-  npm install --global "$PACKAGE@$version" || fail "npm package installation failed."
+  npm_prefix="$(npm prefix --global)" || fail "could not determine the npm global prefix."
+  install_bin="$npm_prefix/bin/rea"
 fi
-command -v rea >/dev/null 2>&1 || fail "the rea command is not available after installation."
-installed_version="$(rea --version 2>/dev/null | tr -d '[:space:]')" || fail "could not read the installed REA version."
-[[ "$installed_version" == "$version" ]] || fail "installed version $installed_version does not match $version."
 
-temporary_directory="$(mktemp -d "${TMPDIR:-/tmp}/rea-install.XXXXXX")" || fail "could not create a temporary directory."
-setup_output="$temporary_directory/setup.json"
-doctor_output="$temporary_directory/doctor.json"
-rea setup --yes --json >"$setup_output" || fail "REA setup command failed."
-rea doctor --json >"$doctor_output" || fail "REA doctor command failed."
-result="$(node - "$setup_output" "$doctor_output" <<'NODE'
-const fs = require("node:fs");
-const [setupPath, doctorPath] = process.argv.slice(2);
-try {
-  const setup = JSON.parse(fs.readFileSync(setupPath, "utf8"));
-  const doctor = JSON.parse(fs.readFileSync(doctorPath, "utf8"));
-  if (!Array.isArray(doctor.checks) || typeof doctor.healthy !== "boolean") process.exit(2);
-  if (setup.status !== "ready" && setup.status !== "needs_human") process.exit(2);
-  const activation = setup.actions.includes("installed_hopper");
-  if (!doctor.healthy && !activation) process.exit(3);
-  process.stdout.write(activation ? "activation" : "ready");
-} catch { process.exit(2); }
-NODE
-)" || fail "setup or doctor reported an unhealthy required component or malformed output."
+printf 'REA install plan\n'
+printf '  Version: %s\n' "$version"
+printf '  Runtime: Node.js %s\n' "$node_version"
+printf '  Command: npm install --global %s@%s\n' "$PACKAGE" "$version"
+printf '  Binary:  %s\n' "$install_bin"
+printf '  Setup:   %s\n' "$([[ "$start_setup" == true ]] && printf 'start when a terminal is available' || printf 'skipped')"
 
-if [[ "$result" == "activation" ]]; then
-  printf 'REA %s is installed and coding agents are configured.\n' "$version"
-  printf 'One user action remains: open Hopper, complete its activation, then run: rea doctor --json\n'
-else
-  printf 'REA %s is installed and ready. Run rea doctor --json at any time.\n' "$version"
+if [[ "$dry_run" == true ]]; then
+  printf 'Dry run complete; no changes made.\n'
+  exit 0
 fi
-if [[ "$platform" == "Linux" ]]; then
-  printf 'Add %s to PATH to run rea from future shells.\n' "$HOME/.local/bin"
+
+printf 'Installing %s@%s...\n' "$PACKAGE" "$version"
+npm install --global "${prefix_args[@]}" "$PACKAGE@$version" || fail "npm package installation failed."
+[[ -x "$install_bin" ]] || fail "the rea command was not installed at $install_bin."
+installed_version="$("$install_bin" --version 2>/dev/null | tr -d '[:space:]')" || fail "could not read the installed REA version."
+[[ "$installed_version" == "$version" ]] || fail "installed version $installed_version does not match $version."
+
+printf 'REA %s is installed.\n' "$version"
+if [[ "$start_setup" == true && -r /dev/tty && -w /dev/tty && -t 1 ]]; then
+  printf 'Starting REA setup...\n'
+  "$install_bin" setup </dev/tty >/dev/tty
+else
+  printf 'Run %s setup to configure Hopper and coding agents.\n' "$install_bin"
 fi

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rea-agents",
-  "version": "1.0.0",
+  "version": "1.2.0",
   "description": "Reverse engineer anything from your terminal or coding agent with one CLI and MCP server.",
   "license": "MIT",
   "repository": {
@@ -33,8 +33,7 @@
     "rea": "scripts/rea.mjs"
   },
   "engines": {
-    "node": ">=24.18.0 <25",
-    "npm": ">=11.16.0 <12"
+    "node": "^22.19.0 || >=24.11.0"
   },
   "packageManager": "npm@11.16.0",
   "files": [
@@ -42,6 +41,7 @@
     "install.sh",
     "bridge/hopper_bridge.py",
     "scripts/rea.mjs",
+    "scripts/prepare-node-pty.mjs",
     "scripts/rebuild-native.mjs",
     "skills",
     "README.md",
@@ -60,6 +60,7 @@
     "scan:todos": "node scripts/scan-todos.mjs",
     "start": "node dist/main.js",
     "pretest": "npm run build",
+    "postinstall": "node scripts/prepare-node-pty.mjs",
     "test": "vitest run",
     "pretest:coverage": "npm run build",
     "test:coverage": "vitest run --coverage.enabled --coverage.provider=v8",
@@ -87,6 +88,8 @@
     "@babel/types": "8.0.4",
     "@electron/asar": "4.2.0",
     "@modelcontextprotocol/server": "2.0.0-beta.3",
+    "@xterm/addon-serialize": "0.14.0",
+    "@xterm/headless": "6.0.0",
     "@zip.js/zip.js": "2.8.26",
     "canonicalize": "3.0.0",
     "diff": "9.0.0",
@@ -99,7 +102,7 @@
     "pino": "9.14.0",
     "plist": "5.0.0",
     "smol-toml": "^1.7.0",
-    "write-file-atomic": "8.0.0",
+    "write-file-atomic": "7.0.0",
     "ws": "8.21.0",
     "zod": "4.4.3"
   },

package/scripts/prepare-node-pty.mjs

@@ -0,0 +1,35 @@
+#!/usr/bin/env node
+
+import { chmod, lstat } from "node:fs/promises";
+import { createRequire } from "node:module";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+if (process.platform !== "win32") {
+  const require = createRequire(import.meta.url);
+  const packageRoot = dirname(
+    require.resolve("node-pty/package.json", {
+      paths: [dirname(fileURLToPath(import.meta.url))],
+    }),
+  );
+  const helperPath = join(
+    packageRoot,
+    "prebuilds",
+    `${process.platform}-${process.arch}`,
+    "spawn-helper",
+  );
+
+  try {
+    const helper = await lstat(helperPath);
+    if (!helper.isFile() || helper.isSymbolicLink()) {
+      throw new Error("node-pty spawn helper is not a regular file");
+    }
+    await chmod(helperPath, helper.mode | 0o111);
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+      // Source builds place their correctly-modeled helper under build/Release.
+    } else {
+      throw error;
+    }
+  }
+}

package/skills/rea-analysis/SKILL.md

@@ -2,7 +2,7 @@
 name: rea-analysis
 description: Reverse engineer apps with REA. Explore how features work, then build a version tailored to your project.
 metadata:
-  version: "10"
+  version: "11"
   tool_count: 68
 ---
 
@@ -36,13 +36,19 @@ REA accepts a `.app` bundle directly. Do not expose its internal `Contents/MacOS
 
 Briefly tell the user what you will investigate. Open the app with `open_binary`, begin with `binary_overview`, and narrow the investigation around the requested feature. Use decompilation, strings, names, callers, callees, and cross-references as needed.
 
-For applications, ZIP/APK/IPA packages, or Electron ASAR archives, call
+For applications, ZIP/APK/IPA packages, Electron ASAR archives, or DMGs, call
 `inventory_artifact` before extraction. Follow its deterministic occurrence
 pages and cite graph manifest IDs. `extract_artifact` requires explicit user
 approval, an absent absolute output root, and selected occurrence IDs; never
 extract every entry implicitly. Symlinks and encrypted entries are inventory
-facts, not extractable files. Nested containers require a separate deliberate
-inventory step.
+facts, not extractable files. Inventory traverses discovered ASARs within the
+same graph and shared limits, including ASARs inside an approved mounted DMG.
+
+Native DMG traversal is macOS-only, read-only, and disabled by default. Use it
+only when the user approves that inventory call with
+`native_mount_approved: true` and the operator has separately enabled
+`REA_ARTIFACT_NATIVE_MOUNT_ENABLED=true`. Without both gates, retain the DMG
+root-hash-only result. Never imply that approval changes extraction authority.
 
 Explain conclusions in plain language. Point to the relevant decompiled code, strings, names, and connections so the user can see how the explanation was reached. Do not claim to recover original source code or automatically clone an application.
 
@@ -57,6 +63,15 @@ requires per-call approval plus operator policy, and uses host networking only
 when the operator explicitly permits it. It is behavioral evidence, not a
 security sandbox.
 
+`capture_process_scenario` produces Process Capture v4 only. If a boundary
+reports Process Capture v3, tell the user or calling agent to rerun the original
+scenario; v3 cannot be upgraded because it lacks required manifest and
+settlement evidence. Treat the v4 manifest commitments as compatibility and
+provenance evidence, and distinguish root exit from descendant settlement.
+When comparing stored captures, set `max_capture_age_ms` when the task requires
+fresh behavioral evidence. Different scenario and executable digests are
+allowed, but schema and comparison-contract digests must be compatible.
+
 Do not let unanswered questions disappear. Use `record_unknown` only with
 explicit approval, attach supporting and contradicting evidence IDs, and record
 the authority/environment still required. Use `update_unknown` with the current