rea-agents 1.3.0 → 1.4.0

package/dist/domain/errors.js

@@ -1,5 +1,5 @@
 import { hopperStartupFailure, } from "./hopperStartupFailure.js";
-export { hopperStartupFailure } from "./hopperStartupFailure.js";
+export { hopperStartupFailure };
 /** Stable tags exposed by safe analysis-error projections. */
 const ANALYSIS_ERROR_TAGS = [
     "AnalysisProtocolError",
@@ -26,11 +26,14 @@ const ANALYSIS_ERROR_TAGS = [
     "ConfigurationError",
     "NoBinaryOpenError",
     "BinaryTargetError",
+    "PermissionRequiredError",
 ];
 /** Base class for expected analysis, provider, and session failures. */
 export class AnalysisError extends Error {
     userMessage = undefined;
     userCategory = undefined;
+    cleanupIncomplete = false;
+    cleanupResources = [];
 }
 /** Base class for failures produced specifically by the Hopper provider. */
 export class HopperError extends AnalysisError {
@@ -247,17 +250,224 @@ export class BinaryTargetError extends AnalysisError {
         this.path = path;
     }
 }
+/** Exact denied authority used by both CLI and MCP remediation. */
+export class PermissionRequiredError extends AnalysisError {
+    requested;
+    missing;
+    ceiling;
+    elicitationSupported;
+    restartRequired;
+    _tag = "PermissionRequiredError";
+    constructor(requested, missing, ceiling, elicitationSupported, restartRequired) {
+        super(`Permission required for ${requested.capability}`);
+        this.requested = requested;
+        this.missing = missing;
+        this.ceiling = ceiling;
+        this.elicitationSupported = elicitationSupported;
+        this.restartRequired = restartRequired;
+    }
+}
 /** Project expected failures into exhaustive, secret-safe caller fields. */
 export const projectAnalysisError = (error) => {
     assertKnownTag(error._tag);
-    const code = error instanceof HopperProcessError ? error.failureCode : undefined;
+    const code = errorCode(error);
+    const details = errorDetails(error);
     return {
+        code,
         category: errorCategory(error),
         message: userMessage(error),
-        ...(code === undefined ? {} : { code }),
+        retryable: RETRYABLE_CODES.has(code),
+        remediation: {
+            action: remediationAction(error),
+            restart_required: error instanceof PermissionRequiredError && error.restartRequired,
+            ...(error instanceof PermissionRequiredError
+                ? { elicitation_supported: error.elicitationSupported }
+                : {}),
+        },
+        ...(details === undefined ? {} : { details }),
     };
 };
+const errorCode = (error) => {
+    if (error instanceof PermissionRequiredError)
+        return "permission_required";
+    if (error instanceof ArtifactOperationError)
+        return error.reason === "integrity" && error.artifactDetails !== undefined
+            ? "artifact_integrity_mismatch"
+            : error.reason === "limit"
+                ? "truncated"
+                : error.reason === "cancelled"
+                    ? "cancelled"
+                    : "artifact_operation_failed";
+    if (error instanceof EvidenceFileError)
+        return error.reason === "outside-root"
+            ? "outside_approved_root"
+            : error.reason === "too-large"
+                ? "truncated"
+                : error.reason === "disabled"
+                    ? "capability_unavailable"
+                    : "execution_failure";
+    if (error instanceof InvestigationWorkspaceError) {
+        if (error.reason === "revision-conflict" ||
+            error.reason === "name-conflict")
+            return "revision_conflict";
+        if (error.reason === "too-large")
+            return "truncated";
+        if (error.reason === "disabled")
+            return "capability_unavailable";
+        if (error.reason === "outside-root")
+            return "outside_approved_root";
+        if (error.reason === "integrity" || error.reason === "invalid-json")
+            return "evidence_integrity_mismatch";
+        return "execution_failure";
+    }
+    if (error instanceof UnknownRegistryError)
+        return error.reason === "revision-conflict" ||
+            error.reason === "already-exists"
+            ? "revision_conflict"
+            : error.reason === "limit"
+                ? "truncated"
+                : error.reason === "integrity"
+                    ? "evidence_integrity_mismatch"
+                    : "execution_failure";
+    if (error._tag === "ProcessCaptureError")
+        return error.cleanupIncomplete
+            ? "cleanup_incomplete"
+            : error.userCategory === "cancelled"
+                ? "cancelled"
+                : error.userCategory === "permission_required"
+                    ? "permission_required"
+                    : "process_capture_failed";
+    switch (error._tag) {
+        case "AnalysisProtocolError":
+        case "AnalysisOutputError":
+        case "HopperProtocolError":
+            return "unreadable_output";
+        case "AnalysisInputError":
+            return "invalid_request";
+        case "AnalysisCapabilityUnavailableError":
+        case "ProviderSelectionError":
+            return "capability_unavailable";
+        case "AnalysisCancelledError":
+        case "HopperCancelledError":
+            return "cancelled";
+        case "AnalysisTimeoutError":
+        case "HopperTimeoutError":
+            return "provider_timeout";
+        case "HopperProcessError":
+        case "HopperStartError":
+            return "provider_unavailable";
+        case "ConfigurationError":
+            return "configuration_invalid";
+        case "NoBinaryOpenError":
+        case "BinaryTargetError":
+            return "target_unavailable";
+        case "EvidenceIntegrityError":
+            return "evidence_integrity_mismatch";
+        case "EvidenceLimitError":
+            return "truncated";
+        case "ProviderAdapterError":
+        case "HopperRemoteError":
+            return "execution_failure";
+        case "ArtifactOperationError":
+        case "EvidenceFileError":
+        case "InvestigationWorkspaceError":
+        case "UnknownRegistryError":
+        case "PermissionRequiredError":
+            throw new TypeError("Unhandled specialized analysis error");
+    }
+};
+const errorDetails = (error) => {
+    if (error instanceof PermissionRequiredError)
+        return {
+            capability: error.requested.capability,
+            requested: scopeDetails(error.requested),
+            missing: missingScopeDetails(error.missing),
+            ceiling: error.ceiling === null ? null : scopeDetails(error.ceiling),
+        };
+    if (error instanceof ArtifactOperationError && error.artifactDetails)
+        return {
+            logical_path: error.artifactDetails.logicalPath,
+            declared_sha256: error.artifactDetails.declaredSha256,
+            calculated_sha256: error.artifactDetails.calculatedSha256,
+            unpacked: error.artifactDetails.unpacked,
+        };
+    if (error instanceof ArtifactOperationError)
+        return {
+            operation: error.operation,
+            reason: error.reason,
+            ...(error.reason === "limit" ? { truncated: true } : {}),
+        };
+    if (error instanceof AnalysisCancelledError)
+        return { operation: error.operation, cleanup: "complete" };
+    if (error instanceof HopperCancelledError)
+        return { operation: "hopper", cleanup: "complete" };
+    if (error instanceof AnalysisTimeoutError)
+        return { operation: error.operation, timeout_ms: error.timeoutMs };
+    if (error instanceof HopperTimeoutError)
+        return { operation: "hopper", timeout_ms: error.timeoutMs };
+    if (error instanceof EvidenceLimitError)
+        return { limit: error.limit, maximum: error.maximum, truncated: true };
+    if (error instanceof InvestigationWorkspaceError)
+        return { operation: error.operation, reason: error.reason };
+    if (error instanceof UnknownRegistryError)
+        return { reason: error.reason };
+    if (error instanceof EvidenceFileError)
+        return { operation: error.operation, reason: error.reason };
+    if (error instanceof AnalysisCapabilityUnavailableError)
+        return { provider_id: error.providerId, operation: error.operation };
+    if (error instanceof ProviderAdapterError)
+        return { provider_id: error.providerId, operation: error.operation };
+    if (error instanceof HopperRemoteError)
+        return { provider_code: error.code, diagnostic_type: error.diagnosticType };
+    if (error instanceof HopperProcessError && error.failureCode !== undefined)
+        return { failure_code: error.failureCode, exit_code: error.exitCode };
+    if (error._tag === "ProcessCaptureError" && error.cleanupIncomplete)
+        return {
+            cleanup: "incomplete",
+            resources: [...error.cleanupResources],
+        };
+    if (error._tag === "ProcessCaptureError" &&
+        error.userCategory === "cancelled")
+        return { operation: "process_capture", cleanup: "complete" };
+    if (error instanceof BinaryTargetError)
+        return { path: error.path };
+    return undefined;
+};
+const scopeDetails = (scope) => ({
+    capability: scope.capability,
+    roots: [...scope.roots],
+    executables: [...scope.executables],
+    environment_names: [...scope.environment_names],
+    network: scope.network,
+    mount: scope.mount,
+});
+const missingScopeDetails = (scope) => ({
+    ...(scope.roots === undefined ? {} : { roots: [...scope.roots] }),
+    ...(scope.executables === undefined
+        ? {}
+        : { executables: [...scope.executables] }),
+    ...(scope.environment_names === undefined
+        ? {}
+        : { environment_names: [...scope.environment_names] }),
+    ...(scope.network === undefined ? {} : { network: scope.network }),
+    ...(scope.mount === undefined ? {} : { mount: scope.mount }),
+});
+const RETRYABLE_CODES = new Set([
+    "provider_timeout",
+    "cancelled",
+    "revision_conflict",
+    "provider_unavailable",
+]);
+const remediationAction = (error) => {
+    if (error instanceof PermissionRequiredError)
+        return error.elicitationSupported
+            ? "Approve the exact missing scope, then retry the operation."
+            : "Add the exact missing scope beneath the administrator ceiling, then retry.";
+    return userMessage(error);
+};
 const errorCategory = (error) => {
+    if (error instanceof PermissionRequiredError)
+        return "permission_required";
     if (error._tag === "ProcessCaptureError")
         return error.userCategory ?? "execution_failure";
     if (error instanceof HopperRemoteError &&
@@ -307,6 +517,8 @@ const STATIC_ERROR_CATEGORIES = {
     BinaryTargetError: "unavailable",
 };
 const userMessage = (error) => {
+    if (error instanceof PermissionRequiredError)
+        return "This operation needs additional local permission. Review the requested scope and remediation.";
     if (error instanceof AnalysisInputError)
         return "Analysis input is invalid. Check the arguments and try again.";
     if (error.userMessage !== undefined)
@@ -441,6 +653,7 @@ const KNOWN_ERROR_TAGS = {
     ConfigurationError: true,
     NoBinaryOpenError: true,
     BinaryTargetError: true,
+    PermissionRequiredError: true,
 };
 const assertKnownTag = (tag) => {
     if (KNOWN_ERROR_TAGS[tag] !== true)

package/dist/domain/investigationWorkspace.js

@@ -37,14 +37,27 @@ const DEFAULT_INVESTIGATION_RUN_OPTIONS = {
     change_limit: 500,
 };
 /** Explicit write approval and two local versions for an automatic run. */
-export const crossVersionInvestigationInputSchema = z.object({
+export const crossVersionInvestigationInputSchema = z
+    .object({
     approved: z.literal(true),
     workspace_path: z.string().min(1).max(4_096),
     workspace_name: z.string().trim().min(1).max(200).default("default"),
     expected_workspace_revision: z.number().int().min(1).optional(),
     left_path: z.string().min(1).max(4_096),
     right_path: z.string().min(1).max(4_096),
+    integrity_policy: z.enum(["fail", "record-and-continue"]).default("fail"),
+    integrity_continue_approved: z.boolean().default(false),
+    max_integrity_mismatches: z.number().int().min(1).max(100).default(10),
     options: investigationRunOptionsSchema.default(DEFAULT_INVESTIGATION_RUN_OPTIONS),
+})
+    .superRefine((input, context) => {
+    if (input.integrity_policy === "record-and-continue" &&
+        input.integrity_continue_approved !== true)
+        context.addIssue({
+            code: "custom",
+            path: ["integrity_continue_approved"],
+            message: "record-and-continue requires explicit approval",
+        });
 });
 const targetSchema = z.object({
     root_sha256: digestSchema,
@@ -58,13 +71,16 @@ const stageSchema = z.enum([
     "compare_artifacts",
     "find_changed_behavior",
 ]);
-export const investigationRunSchema = z.object({
+const investigationRunBaseSchema = z.object({
     schema_version: z.literal(1),
     run_id: z.string().regex(/^run_[a-f0-9]{64}$/u),
     request_sha256: digestSchema,
     left: targetSchema,
     right: targetSchema,
     options: investigationRunOptionsSchema,
+    integrity_policy: z.enum(["fail", "record-and-continue"]),
+    integrity_continue_approved: z.boolean(),
+    max_integrity_mismatches: z.number().int().min(1).max(100),
     status: z.enum(["running", "complete"]),
     completed_stages: z.array(stageSchema).max(4),
     left_inventory_evidence_ids: z.array(evidenceIdSchema).min(1).max(100),
@@ -73,6 +89,28 @@ export const investigationRunSchema = z.object({
     result_evidence_id: evidenceIdSchema.nullable(),
     limitations: z.array(z.string().max(4_096)).max(100),
 });
+export const investigationRunSchema = z
+    .union([
+    investigationRunBaseSchema.extend({
+        legacy_request_identity: z.literal(true),
+    }),
+    investigationRunBaseSchema,
+])
+    .superRefine((run, context) => {
+    if (!("legacy_request_identity" in run))
+        return;
+    const legacyIdentity = createLegacyInvestigationRunIdentity(run);
+    if (run.integrity_policy !== "fail" ||
+        run.integrity_continue_approved ||
+        run.max_integrity_mismatches !== 10 ||
+        run.run_id !== legacyIdentity.runId ||
+        run.request_sha256 !== legacyIdentity.requestSha256)
+        context.addIssue({
+            code: "custom",
+            path: ["legacy_request_identity"],
+            message: "Legacy request identity is valid only for migrated strict runs",
+        });
+});
 export const investigationRunSummarySchema = z.object({
     schema_version: z.literal(1),
     workspace_id: z.string().regex(/^ws_[a-f0-9]{64}$/u),
@@ -96,6 +134,18 @@ const investigationWorkspaceSchema = z.object({
     bundle: evidenceBundleSchema,
     runs: z.array(investigationRunSchema).max(1_000),
 });
+const legacyInvestigationRunSchema = investigationRunBaseSchema
+    .omit({
+    integrity_policy: true,
+    integrity_continue_approved: true,
+    max_integrity_mismatches: true,
+})
+    .strict();
+const legacyInvestigationWorkspaceSchema = investigationWorkspaceSchema
+    .extend({
+    runs: z.array(legacyInvestigationRunSchema).max(1_000),
+})
+    .strict();
 /** Derive a stable run identity from content commitments and bounded controls. */
 export const createInvestigationRunIdentity = (input) => {
     const requestSha256 = digestCanonical({
@@ -103,6 +153,11 @@ export const createInvestigationRunIdentity = (input) => {
         left: input.left,
         right: input.right,
         options: input.options,
+        integrity: {
+            policy: input.integrity_policy,
+            approved: input.integrity_continue_approved,
+            max_mismatches: input.max_integrity_mismatches,
+        },
     });
     return { runId: `run_${requestSha256}`, requestSha256 };
 };
@@ -126,6 +181,8 @@ export const reviseInvestigationWorkspace = (current, bundle, runs) => buildWork
 });
 /** Parse a workspace and verify identities, revision digest, and references. */
 export const parseInvestigationWorkspace = (input) => {
+    if (isLegacyWorkspace(input))
+        return migrateLegacyWorkspace(input);
     const parsed = investigationWorkspaceSchema.parse(input);
     const bundle = parseEvidenceBundle(parsed.bundle);
     const canonical = buildWorkspace({
@@ -170,8 +227,15 @@ const validateRunReferences = (workspace) => {
     const evidenceIds = new Set(workspace.bundle.records.map(({ evidence_id: id }) => id));
     for (const run of workspace.runs) {
         const expectedIdentity = createInvestigationRunIdentity(run);
-        if (run.run_id !== expectedIdentity.runId ||
-            run.request_sha256 !== expectedIdentity.requestSha256)
+        const legacyIdentity = createLegacyInvestigationRunIdentity(run);
+        if ((run.run_id !== expectedIdentity.runId ||
+            run.request_sha256 !== expectedIdentity.requestSha256) &&
+            (!("legacy_request_identity" in run) ||
+                run.integrity_policy !== "fail" ||
+                run.integrity_continue_approved ||
+                run.max_integrity_mismatches !== 10 ||
+                run.run_id !== legacyIdentity.runId ||
+                run.request_sha256 !== legacyIdentity.requestSha256))
             throw new TypeError("Investigation run identity is invalid");
         validateRunStages(run);
         const references = [
@@ -186,6 +250,69 @@ const validateRunReferences = (workspace) => {
             throw new TypeError("Investigation run references missing Evidence");
     }
 };
+/** Derive the pre-integrity-policy run identity for strict workspace migration. */
+export const createLegacyInvestigationRunIdentity = (input) => {
+    const requestSha256 = digestCanonical({
+        schema: "rea.cross-version-investigation-request/v1",
+        left: input.left,
+        right: input.right,
+        options: input.options,
+    });
+    return { runId: `run_${requestSha256}`, requestSha256 };
+};
+const isLegacyWorkspace = (input) => {
+    if (typeof input !== "object" || input === null || !("runs" in input))
+        return false;
+    const runs = input.runs;
+    return (Array.isArray(runs) &&
+        runs.some((run) => typeof run === "object" && run !== null && !("integrity_policy" in run)));
+};
+const migrateLegacyWorkspace = (input) => {
+    const parsed = legacyInvestigationWorkspaceSchema.parse(input);
+    const bundle = parseEvidenceBundle(parsed.bundle);
+    const runs = [...parsed.runs].sort((left, right) => left.run_id.localeCompare(right.run_id));
+    const semantic = {
+        workspace_version: 1,
+        workspace_id: parsed.workspace_id,
+        name: parsed.name,
+        revision: parsed.revision,
+        previous_revision_digest: parsed.previous_revision_digest,
+        bundle,
+        runs,
+    };
+    if (parsed.workspace_id !== workspaceIdFor(parsed.name))
+        throw new TypeError("Investigation workspace ID does not match its name");
+    if (parsed.revision_digest !== `wrev_${digestCanonical(semantic)}`)
+        throw new TypeError("Investigation workspace revision digest is invalid");
+    const canonical = legacyInvestigationWorkspaceSchema.parse({
+        ...semantic,
+        revision_digest: parsed.revision_digest,
+    });
+    if (JSON.stringify(parsed) !== JSON.stringify(canonical))
+        throw new TypeError("Investigation workspace is not canonical");
+    for (const run of runs) {
+        const identity = createLegacyInvestigationRunIdentity(run);
+        if (run.run_id !== identity.runId ||
+            run.request_sha256 !== identity.requestSha256)
+            throw new TypeError("Investigation run identity is invalid");
+    }
+    const migrated = buildWorkspace({
+        workspaceId: parsed.workspace_id,
+        name: parsed.name,
+        revision: parsed.revision,
+        previousRevisionDigest: parsed.previous_revision_digest,
+        bundle,
+        runs: runs.map((run) => ({
+            ...run,
+            legacy_request_identity: true,
+            integrity_policy: "fail",
+            integrity_continue_approved: false,
+            max_integrity_mismatches: 10,
+        })),
+    });
+    validateRunReferences(migrated);
+    return migrated;
+};
 const validateRunStages = (run) => {
     const expected = [
         "inventory_left",

package/dist/domain/permissionPolicy.js

@@ -0,0 +1,157 @@
+import { isAbsolute, relative, resolve, sep } from "node:path";
+import { err, ok } from "./result.js";
+/** A proposed grant exceeds the administrator-owned maximum authority. */
+export class PermissionGrantError extends Error {
+    reason;
+    missing;
+    _tag = "PermissionGrantError";
+    constructor(reason, missing) {
+        super(`Permission grant rejected: ${reason}`);
+        this.reason = reason;
+        this.missing = missing;
+    }
+}
+/** Create a fail-closed policy with no implicit grants. */
+export const createPermissionPolicy = (ceilings, grants = []) => ({
+    ceilings: ceilings.map(normalizeScope),
+    grants: grants.map(normalizeGrant),
+    revoked_grant_ids: new Set(),
+    consumed_grant_ids: new Set(),
+});
+/** Add one grant only when it is a subset of its administrator ceiling. */
+export const grantPermission = (policy, grant) => {
+    const normalized = normalizeGrant(grant);
+    if (normalized.lifetime === "once" && normalized.operation_identity === null)
+        return err(new PermissionGrantError("invalid_once_scope", {}));
+    const missing = missingFromScopes(normalized, policy.ceilings);
+    if (hasMissing(missing))
+        return err(new PermissionGrantError("outside_administrator_ceiling", missing));
+    return ok({ ...policy, grants: [...policy.grants, normalized] });
+};
+/** Evaluate exact requested authority against the ceiling and active grants. */
+export const evaluatePermission = (policy, request, now = new Date()) => {
+    const normalized = normalizeRequest(request);
+    const outsideCeiling = missingFromScopes(normalized, policy.ceilings);
+    if (hasMissing(outsideCeiling))
+        return {
+            allowed: false,
+            reason: "outside_administrator_ceiling",
+            missing: outsideCeiling,
+        };
+    const candidates = policy.grants.filter((grant) => grant.capability === normalized.capability &&
+        !policy.revoked_grant_ids.has(grant.grant_id) &&
+        !policy.consumed_grant_ids.has(grant.grant_id) &&
+        !isExpired(grant, now) &&
+        (grant.lifetime !== "once" ||
+            grant.operation_identity === normalized.operation_identity));
+    const selected = candidates.find((grant) => !hasMissing(missingFromScopes(normalized, [grant])));
+    if (selected !== undefined)
+        return {
+            allowed: true,
+            grant_id: selected.grant_id,
+            lifetime: selected.lifetime,
+        };
+    const coveringGrant = policy.grants.find((grant) => grant.capability === normalized.capability &&
+        (grant.lifetime !== "once" ||
+            grant.operation_identity === normalized.operation_identity) &&
+        !hasMissing(missingFromScopes(normalized, [grant])));
+    return {
+        allowed: false,
+        reason: coveringGrant !== undefined && isExpired(coveringGrant, now)
+            ? "grant_expired"
+            : candidates.length === 0 &&
+                policy.grants.some((grant) => grant.capability === normalized.capability)
+                ? "grant_revoked_or_consumed"
+                : "grant_required",
+        missing: missingFromScopes(normalized, candidates),
+    };
+};
+/** Consume an allowed one-shot decision; longer-lived grants are unchanged. */
+export const consumePermission = (policy, decision) => decision.lifetime === "once"
+    ? {
+        ...policy,
+        consumed_grant_ids: new Set([
+            ...policy.consumed_grant_ids,
+            decision.grant_id,
+        ]),
+    }
+    : policy;
+/** Revoke one grant for every future evaluation. */
+export const revokePermission = (policy, grantId) => ({
+    ...policy,
+    revoked_grant_ids: new Set([...policy.revoked_grant_ids, grantId]),
+});
+/** Drop connection-bound authority when an MCP or CLI session ends. */
+export const clearSessionPermissions = (policy) => ({
+    ...policy,
+    grants: policy.grants.filter(({ lifetime }) => lifetime !== "once" && lifetime !== "session"),
+});
+/** Atomically replace administrator ceilings while retaining auditable grants. */
+export const reloadPermissionCeilings = (policy, ceilings) => ({
+    ...policy,
+    ceilings: ceilings.map(normalizeScope),
+});
+const normalizeScope = (scope) => ({
+    capability: scope.capability,
+    roots: uniqueSorted(scope.roots.map((path) => resolve(path))),
+    executables: uniqueSorted(scope.executables.map((path) => resolve(path))),
+    environment_names: uniqueSorted(scope.environment_names),
+    network: scope.network,
+    mount: scope.mount,
+});
+const normalizeGrant = (grant) => ({
+    ...normalizeScope(grant),
+    grant_id: grant.grant_id,
+    lifetime: grant.lifetime,
+    operation_identity: grant.operation_identity,
+    expires_at: grant.expires_at,
+});
+const normalizeRequest = (request) => ({
+    ...normalizeScope(request),
+    operation_identity: request.operation_identity,
+});
+const missingFromScopes = (request, scopes) => {
+    const relevant = scopes.filter(({ capability }) => capability === request.capability);
+    const roots = request.roots.filter((path) => !relevant.some((scope) => containsAny(scope.roots, path)));
+    const executables = request.executables.filter((path) => !relevant.some((scope) => containsAny(scope.executables, path)));
+    const environmentNames = request.environment_names.filter((name) => !relevant.some((scope) => scope.environment_names.includes(name)));
+    const network = request.network === "none" ||
+        relevant.some((scope) => networkRank(scope.network) >= networkRank(request.network))
+        ? undefined
+        : request.network;
+    const mount = !request.mount || relevant.some((scope) => scope.mount)
+        ? undefined
+        : true;
+    return {
+        ...(roots.length === 0 ? {} : { roots }),
+        ...(executables.length === 0 ? {} : { executables }),
+        ...(environmentNames.length === 0
+            ? {}
+            : { environment_names: environmentNames }),
+        ...(network === undefined ? {} : { network }),
+        ...(mount === undefined ? {} : { mount }),
+    };
+};
+const HOST_PATH_OPERATIONS = { relative, isAbsolute, sep };
+/** Test whether a candidate is inside a root using one platform path flavor. */
+export const isPathContained = (root, candidate, operations = HOST_PATH_OPERATIONS) => {
+    const relation = operations.relative(root, candidate);
+    return (relation === "" ||
+        (relation !== ".." &&
+            !relation.startsWith(`..${operations.sep}`) &&
+            !operations.isAbsolute(relation)));
+};
+const containsAny = (roots, candidate) => roots.some((root) => isPathContained(root, candidate));
+const networkRank = (network) => {
+    switch (network) {
+        case "none":
+            return 0;
+        case "loopback":
+            return 1;
+        case "external":
+            return 2;
+    }
+};
+const isExpired = (grant, now) => grant.expires_at !== null && Date.parse(grant.expires_at) <= now.getTime();
+const hasMissing = (missing) => Object.keys(missing).length > 0;
+const uniqueSorted = (values) => [...new Set(values)].sort((left, right) => left.localeCompare(right));

package/dist/domain/processComparison.js

@@ -9,6 +9,7 @@ export const comparisonStatusSchema = z.enum([
     "changed",
     "truncated",
     "unknown",
+    "contradiction",
 ]);
 /** Pure normalized comparison between two captures. */
 export const processCaptureComparisonSchema = z

package/dist/domain/reconstructionVerification.js

@@ -261,7 +261,7 @@ const authorityLimitations = (claim, sources, sides) => {
 const classify = (observed, limitations, unknowns) => {
     if (limitations.length > 0)
         return "unknown";
-    if (["changed", "added", "removed"].includes(observed))
+    if (["changed", "added", "removed", "contradiction"].includes(observed))
         return "fail";
     if (observed === "unknown" || observed === "truncated" || unknowns.length > 0)
         return "unknown";

package/dist/domain/reconstructionVerificationSchemas.js

@@ -86,6 +86,7 @@ export const reconstructionClaimResultSchema = z.object({
         "changed",
         "truncated",
         "unknown",
+        "contradiction",
     ]),
     comparison_evidence_id: evidenceIdSchema,
     left_evidence_ids: z.array(evidenceIdSchema).min(1).max(100),

package/dist/domain/staticRuntimeCorrelation.js

@@ -260,7 +260,11 @@ const selectStatic = (evidence, selector) => {
     const status = matches[0].classification;
     return {
         status,
-        conclusion_kind: status === "unknown" ? "unresolved_branch" : "derived_relationship",
+        conclusion_kind: status === "contradiction"
+            ? "contradiction"
+            : status === "unknown"
+                ? "unresolved_branch"
+                : "derived_relationship",
     };
 };
 const parseStatic = (input) => {

package/dist/generatedPackageMetadata.js

@@ -0,0 +1,9 @@
+/** Generated from package.json and package-lock.json; do not edit. */
+export const PACKAGE_METADATA = {
+    name: "rea-agents",
+    version: "1.4.0",
+    serverSdkVersion: "2.0.0-beta.4",
+    clientSdkVersion: "2.0.0-beta.4",
+    coreSdkVersion: "2.0.0-beta.4",
+    skillVersion: "12",
+};