rea-agents 1.7.0 → 2.0.0

package/dist/contracts/toolOutputSchemas.js

@@ -1,11 +1,16 @@
 import { z } from "zod";
-import { evidenceEnvelopeSchema } from "../domain/evidence.js";
 import { processCaptureComparisonSchema, processCaptureSchema, } from "../domain/processCapture.js";
 import { evidenceBundleSchema } from "../domain/evidenceBundle.js";
 import { residualUnknownSchema } from "../domain/residualUnknown.js";
 import { functionDossierSchema, localVariableSchema, procedureClassificationSchema, procedureIdentitySchema, referenceKindSchema, } from "../domain/hopperValues.js";
 import { demangleSwiftSchema, inspectMachoSchema, inspectPlistSchema, inspectSignatureSchema, listArchitecturesSchema, } from "../domain/nativeInspection.js";
 import { artifactExtractionResultSchema, artifactInventoryResultSchema, } from "../domain/artifactGraph.js";
+import { managedArtifactInspectionSchema, managedMemberInspectionSchema, managedNativeBoundaryInspectionSchema, } from "../domain/managedArtifact.js";
+import { managedMemberComparisonResultSchema } from "../domain/managedMemberComparison.js";
+import { managedNativeVerificationResultSchema } from "../domain/managedNativeVerification.js";
+import { managedReconstructionImportResultSchema } from "../domain/managedReconstruction.js";
+import { managedRuntimeCorrelationResultSchema } from "../domain/managedRuntimeCorrelation.js";
+import { managedApplicationGraphResultSchema } from "../domain/managedApplicationGraph.js";
 import { artifactComparisonResultSchema } from "../domain/artifactComparison.js";
 import { functionComparisonResultSchema } from "../domain/functionComparison.js";
 import { bundleComparisonResultSchema } from "../domain/bundleComparison.js";
@@ -16,9 +21,13 @@ import { reconstructionVerificationResultSchema } from "../domain/reconstruction
 import { analysisErrorProjectionSchema } from "./errorSchemas.js";
 import { analysisProfileSchema } from "../domain/analysisProfile.js";
 import { PROVIDER_REJECTION_CODES, } from "./providerSelection.js";
-const resultOf = (schema) => evidenceEnvelopeSchema
-    .omit({ normalized_result: true })
-    .extend({ normalized_result: schema });
+/** Compact MCP result with an immutable link to complete session Evidence. */
+export const evidenceResultOf = (schema) => z.strictObject({
+    result: schema,
+    evidence_id: z.string().regex(/^ev_[a-f0-9]{64}$/u),
+    evidence_uri: z.string().regex(/^rea:\/\/evidence\/ev_[a-f0-9]{64}$/u),
+});
+const resultOf = evidenceResultOf;
 const lifecycleResultOf = (schema) => z.object({ result: schema });
 /** Resolve a required named output schema or reject contract drift. */
 export const requireOutputSchema = (schemas, name) => {
@@ -154,6 +163,16 @@ const sessionProvider = z.object({
             "policy_disabled",
         ]),
         remediation: z.string().nullable(),
+        effects: z.strictObject({
+            mutatesTarget: z.boolean(),
+            mutatesSession: z.boolean(),
+            writesFilesystem: z.boolean(),
+            launchesProcess: z.boolean(),
+            accessesNetwork: z.boolean(),
+            changesUiState: z.boolean(),
+            mayDiscardData: z.boolean(),
+            idempotent: z.boolean(),
+        }),
         annotations: z.object({
             read_only: z.boolean(),
             destructive: z.boolean(),
@@ -456,6 +475,20 @@ export const artifactOutputSchemas = {
     inventory_artifact: resultOf(artifactInventoryResultSchema),
     extract_artifact: resultOf(artifactExtractionResultSchema),
 };
+/** Exact Evidence v2 schema for execution-free managed static analysis. */
+export const managedOutputSchemas = {
+    inspect_managed_artifact: resultOf(managedArtifactInspectionSchema),
+    inspect_managed_members: resultOf(managedMemberInspectionSchema),
+    inspect_managed_native_boundaries: resultOf(managedNativeBoundaryInspectionSchema),
+};
+/** Exact Evidence v2 schema for provider-neutral managed workflows. */
+export const managedWorkflowOutputSchemas = {
+    compare_managed_members: resultOf(managedMemberComparisonResultSchema),
+    verify_managed_native_boundaries: resultOf(managedNativeVerificationResultSchema),
+    import_managed_reconstruction: resultOf(managedReconstructionImportResultSchema),
+    plan_managed_runtime_correlation: resultOf(managedRuntimeCorrelationResultSchema),
+    project_managed_application_graph: resultOf(managedApplicationGraphResultSchema),
+};
 /** Exact structured-content schemas for target lifecycle operations. */
 export const sessionOutputSchemas = {
     open_binary: lifecycleResultOf(z.object({
@@ -497,33 +530,15 @@ export const sessionOutputSchemas = {
         imported: z.number().int().min(0),
         total: z.number().int().min(0),
     })),
-    capture_process_scenario: lifecycleResultOf(evidenceEnvelopeSchema
-        .omit({ normalized_result: true })
-        .extend({ normalized_result: processCaptureSchema })),
-    compare_process_captures: lifecycleResultOf(evidenceEnvelopeSchema.omit({ normalized_result: true }).extend({
-        normalized_result: processCaptureComparisonSchema,
-    })),
-    compare_artifacts: lifecycleResultOf(evidenceEnvelopeSchema.omit({ normalized_result: true }).extend({
-        normalized_result: artifactComparisonResultSchema,
-    })),
-    compare_functions: lifecycleResultOf(evidenceEnvelopeSchema.omit({ normalized_result: true }).extend({
-        normalized_result: functionComparisonResultSchema,
-    })),
-    compare_bundles: lifecycleResultOf(evidenceEnvelopeSchema.omit({ normalized_result: true }).extend({
-        normalized_result: bundleComparisonResultSchema,
-    })),
-    find_changed_behavior: lifecycleResultOf(evidenceEnvelopeSchema.omit({ normalized_result: true }).extend({
-        normalized_result: changedBehaviorResultSchema,
-    })),
-    build_call_path: lifecycleResultOf(evidenceEnvelopeSchema.omit({ normalized_result: true }).extend({
-        normalized_result: callPathResultSchema,
-    })),
-    correlate_static_and_runtime: lifecycleResultOf(evidenceEnvelopeSchema.omit({ normalized_result: true }).extend({
-        normalized_result: staticRuntimeCorrelationResultSchema,
-    })),
-    verify_reconstruction: lifecycleResultOf(evidenceEnvelopeSchema.omit({ normalized_result: true }).extend({
-        normalized_result: reconstructionVerificationResultSchema,
-    })),
+    capture_process_scenario: resultOf(processCaptureSchema),
+    compare_process_captures: resultOf(processCaptureComparisonSchema),
+    compare_artifacts: resultOf(artifactComparisonResultSchema),
+    compare_functions: resultOf(functionComparisonResultSchema),
+    compare_bundles: resultOf(bundleComparisonResultSchema),
+    find_changed_behavior: resultOf(changedBehaviorResultSchema),
+    build_call_path: resultOf(callPathResultSchema),
+    correlate_static_and_runtime: resultOf(staticRuntimeCorrelationResultSchema),
+    verify_reconstruction: resultOf(reconstructionVerificationResultSchema),
     list_unknowns: lifecycleResultOf(z.array(residualUnknownSchema)),
     record_unknown: lifecycleResultOf(residualUnknownSchema),
     update_unknown: lifecycleResultOf(residualUnknownSchema),

package/dist/doctorRuntime.js

@@ -1,6 +1,47 @@
-import { systemDoctorHost } from "./application/Doctor.js";
+import { systemDoctorHost, } from "./application/Doctor.js";
 import { inspectSystemGhidraProvider } from "./ghidra/GhidraDoctor.js";
+import { parseConfig } from "./config.js";
+import { SystemJavaScriptReplayHost } from "./replay/SystemJavaScriptReplayHost.js";
 /** Compose provider diagnostics at the outer CLI adapter boundary. */
 export const createSystemDoctorHost = () => systemDoctorHost({
     providerInspections: async () => [await inspectSystemGhidraProvider()],
+    javascriptReplayCheck: inspectJavaScriptReplay,
 });
+const inspectJavaScriptReplay = async () => {
+    const config = parseConfig(process.env);
+    if (!config.ok)
+        return {
+            name: "javascript-replay",
+            ok: false,
+            classification: "config_drift",
+            detail: config.error.message,
+            remediation: "Fix the reported REA_JAVASCRIPT_REPLAY_* configuration.",
+        };
+    if (!config.value.javascriptReplayPolicy.enabled)
+        return {
+            name: "javascript-replay",
+            ok: true,
+            classification: "healthy",
+            detail: "disabled by default; no extracted-module execution path is admitted",
+        };
+    try {
+        await new SystemJavaScriptReplayHost().probe(config.value.javascriptReplayPolicy);
+        return {
+            name: "javascript-replay",
+            ok: true,
+            classification: "healthy",
+            detail: "Linux namespace, seccomp, and delegated cgroup probes passed",
+        };
+    }
+    catch (cause) {
+        return {
+            name: "javascript-replay",
+            ok: false,
+            classification: process.platform === "linux"
+                ? "missing_dependency"
+                : "unsupported_host",
+            detail: cause instanceof Error ? cause.message : "sandbox probe failed",
+            remediation: "Install and configure compatible Bubblewrap and systemd user cgroup delegation, or disable controlled replay.",
+        };
+    }
+};

package/dist/domain/artifactComparison.js

@@ -1,7 +1,6 @@
 import canonicalize from "canonicalize";
 import { z } from "zod";
 import {} from "./artifactGraph.js";
-import { evidenceSchema } from "./evidence.js";
 import { parseArtifactInventoryEvidence, } from "./artifactInventoryEvidence.js";
 const evidenceIdSchema = z.string().regex(/^ev_[a-f0-9]{64}$/u);
 const comparisonStatusSchema = z.enum([
@@ -32,9 +31,9 @@ const comparisonDimensionSchema = z.enum([
     "integrity",
 ]);
 /** Strict Evidence-backed input for deterministic artifact comparison. */
-export const artifactComparisonInputSchema = z.object({
-    left: z.union([evidenceSchema, z.array(evidenceSchema).min(1).max(100)]),
-    right: z.union([evidenceSchema, z.array(evidenceSchema).min(1).max(100)]),
+export const artifactComparisonInputSchema = z.strictObject({
+    left_evidence_ids: z.array(evidenceIdSchema).min(1).max(100),
+    right_evidence_ids: z.array(evidenceIdSchema).min(1).max(100),
     offset: z.number().int().min(0).default(0),
     limit: z.number().int().min(1).max(500).default(100),
     unknown_registry_approved: z

package/dist/domain/browserObservation.js

@@ -382,6 +382,7 @@ const browserResourceReconciliationSchema = z.discriminatedUnion("status", [
 ]);
 const browserScriptSchema = z.object({
     script_key: z.string().regex(/^scr_[a-f0-9]{64}(?:_[0-9]+)?$/u),
+    frame_id: z.string().nullable().default(null),
     url: z.string(),
     origin: z.string().nullable(),
     cdp_hash: z.string(),
@@ -464,6 +465,8 @@ const browserWorkerSchema = z.object({
     url: z.string(),
     origin: z.string().nullable(),
     attached: z.boolean(),
+    opener_target_id: z.string().nullable().default(null),
+    parent_frame_id: z.string().nullable().default(null),
 });
 const browserCspSourceSchema = z.object({
     kind: z.enum([

package/dist/domain/bundleComparison.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { z } from "zod";
-import { evidenceBundleSchema, parseEvidenceBundle, serializeEvidenceBundle, } from "./evidenceBundle.js";
+import { parseEvidenceBundle, serializeEvidenceBundle, } from "./evidenceBundle.js";
 const evidenceIdSchema = z.string().regex(/^ev_[a-f0-9]{64}$/u);
 const digestSchema = z.string().regex(/^[a-f0-9]{64}$/u);
 const classificationSchema = z.enum([
@@ -12,9 +12,9 @@ const classificationSchema = z.enum([
     "history_diverged",
 ]);
 /** Strict bounded input for canonical Evidence bundle comparison. */
-export const bundleComparisonInputSchema = z.object({
-    left: evidenceBundleSchema,
-    right: evidenceBundleSchema,
+export const bundleComparisonInputSchema = z.strictObject({
+    left_bundle_path: z.string().min(1).max(4_096),
+    right_bundle_path: z.string().min(1).max(4_096),
     record_pairs: z
         .array(z.object({
         left_evidence_id: evidenceIdSchema,

package/dist/domain/electronObservation.js

@@ -38,6 +38,7 @@ export const inspectElectronPageInputSchema = z
         max_dom_nodes: z.number().int().min(1).max(10_000).default(2_000),
         max_scripts: z.number().int().min(1).max(2_000).default(500),
         max_resources: z.number().int().min(1).max(10_000).default(2_000),
+        max_workers: z.number().int().min(1).max(5_000).default(500),
         max_script_source_bytes: z
             .number()
             .int()
@@ -56,6 +57,7 @@ export const inspectElectronPageInputSchema = z
         max_dom_nodes: 2_000,
         max_scripts: 500,
         max_resources: 2_000,
+        max_workers: 500,
         max_script_source_bytes: 1_024 * 1_024,
         max_total_script_source_bytes: 4 * 1_024 * 1_024,
     }),
@@ -143,6 +145,7 @@ export const electronPageInspectionSchema = z.object({
         total: z.number().int().min(0),
         items: z.array(z.object({
             script_key: z.string().regex(/^electron_script_[a-f0-9]{64}$/u),
+            frame_id: z.string().nullable().default(null),
             file_path: z.string(),
             cdp_hash: z.string(),
             length: z.number().int().min(0),
@@ -158,5 +161,15 @@ export const electronPageInspectionSchema = z.object({
         mime_type: z.string(),
         content_size: z.number().min(0).nullable(),
     })),
+    workers: z
+        .array(z.object({
+        target_id: z.string().min(1).max(256),
+        type: z.string().min(1).max(100),
+        file_path: z.string(),
+        attached: z.boolean(),
+        opener_target_id: z.string().min(1).max(256).nullable(),
+        parent_frame_id: z.string().min(1).max(256).nullable(),
+    }))
+        .default([]),
     limitations: z.array(z.string()),
 });

package/dist/domain/electronStaticAnalysis.js

@@ -0,0 +1,9 @@
+import { inspectElectronBrowserNode } from "./electronStaticAnalysisBrowser.js";
+import { inspectElectronIpcNode } from "./electronStaticAnalysisIpc.js";
+import { inspectElectronNativeNode } from "./electronStaticAnalysisNative.js";
+/** Collect Electron-specific syntax during the shared inert AST traversal. */
+export const inspectElectronStaticNode = (node, context) => {
+    inspectElectronBrowserNode(node, context);
+    inspectElectronIpcNode(node, context);
+    inspectElectronNativeNode(node, context);
+};

package/dist/domain/electronStaticAnalysisBrowser.js

@@ -0,0 +1,194 @@
+import * as t from "@babel/types";
+import { boundedExpression, collectContextBridgeMembers, electronStaticValue, objectProperty, } from "./electronStaticAnalysisValues.js";
+import { addLocatedFinding } from "./javascriptStaticAnalysisFindings.js";
+import { argumentNode, calleeName, compareCodePoints, propertyName, range, staticPath, } from "./javascriptStaticAnalysisHelpers.js";
+const MAX_WEB_PREFERENCES = 64;
+/** Inspect BrowserWindow, contextBridge, and utility-process syntax. */
+export const inspectElectronBrowserNode = (node, context) => {
+    if (t.isNewExpression(node))
+        inspectBrowserWindow(node, context);
+    if (!t.isCallExpression(node))
+        return;
+    inspectContextBridge(node, context);
+    inspectUtilityProcess(node, context);
+};
+const inspectBrowserWindow = (node, context) => {
+    const name = calleeName(node.callee);
+    if (name !== "BrowserWindow" && !name.endsWith(".BrowserWindow"))
+        return;
+    const options = argumentNode(node.arguments[0]);
+    const collected = collectWindowOptions(context.source, options);
+    accountForStructure(context, collected.unknown, collected.omitted);
+    const finding = {
+        options_status: options === undefined
+            ? "missing"
+            : t.isObjectExpression(options)
+                ? "object-literal"
+                : "dynamic",
+        web_preferences_status: collected.status,
+        web_preferences: collected.preferences,
+        omitted_web_preferences: collected.omitted,
+        preload_path: collected.preloadPath,
+        module_key: null,
+        location: range(node),
+    };
+    addLocatedFinding(context, {
+        collection: context.accumulator.browserWindows,
+        key: `electron-window\0${name}`,
+        node,
+        value: finding,
+    });
+};
+const collectWindowOptions = (source, options) => {
+    if (!t.isObjectExpression(options))
+        return {
+            status: options === undefined ? "missing" : "dynamic",
+            preferences: [],
+            preloadPath: null,
+            unknown: options === undefined ? 0 : 1,
+            omitted: 0,
+        };
+    const property = objectProperty(options, "webPreferences");
+    if (property === undefined)
+        return {
+            status: "missing",
+            preferences: [],
+            preloadPath: null,
+            unknown: 0,
+            omitted: 0,
+        };
+    if (!t.isObjectExpression(property.value))
+        return {
+            status: "dynamic",
+            preferences: [],
+            preloadPath: null,
+            unknown: 1,
+            omitted: 0,
+        };
+    return collectWebPreferences(source, property.value);
+};
+const collectWebPreferences = (source, object) => {
+    const preferences = [];
+    let unknown = 0;
+    let preloadPath = null;
+    for (const property of object.properties) {
+        if (t.isSpreadElement(property)) {
+            unknown += 1;
+            preferences.push({
+                name: `[spread@${String(property.start ?? -1)}]`,
+                value: electronStaticValue(source, property.argument),
+            });
+            continue;
+        }
+        const name = propertyName(property.key);
+        if (name === "" || property.computed) {
+            unknown += 1;
+            preferences.push({
+                name: `[dynamic@${String(property.start ?? -1)}]`,
+                value: electronStaticValue(source, property),
+            });
+            continue;
+        }
+        if (t.isObjectMethod(property)) {
+            unknown += 1;
+            preferences.push({
+                name,
+                value: electronStaticValue(source, property),
+            });
+            continue;
+        }
+        const path = name === "preload" ? staticPath(property.value) : undefined;
+        if (path !== undefined)
+            preloadPath = path;
+        const value = path === undefined
+            ? electronStaticValue(source, property.value)
+            : { status: "literal", value: path, expression: null };
+        if (value.status === "dynamic")
+            unknown += 1;
+        preferences.push({ name, value });
+    }
+    preferences.sort((left, right) => compareCodePoints(left.name, right.name));
+    return {
+        status: "object-literal",
+        preferences: preferences.slice(0, MAX_WEB_PREFERENCES),
+        preloadPath,
+        unknown,
+        omitted: Math.max(0, preferences.length - MAX_WEB_PREFERENCES),
+    };
+};
+const inspectContextBridge = (node, context) => {
+    const name = calleeName(node.callee);
+    const main = name === "contextBridge.exposeInMainWorld" ||
+        name.endsWith(".contextBridge.exposeInMainWorld");
+    const isolated = name === "contextBridge.exposeInIsolatedWorld" ||
+        name.endsWith(".contextBridge.exposeInIsolatedWorld");
+    if (!main && !isolated)
+        return;
+    const keyNode = argumentNode(node.arguments[isolated ? 1 : 0]);
+    const apiNode = argumentNode(node.arguments[isolated ? 2 : 1]);
+    const key = electronStaticValue(context.source, keyNode);
+    const api = collectContextBridgeMembers(apiNode);
+    const worldId = isolated
+        ? electronStaticValue(context.source, argumentNode(node.arguments[0]))
+        : null;
+    const unknown = (key.status === "dynamic" ? 1 : 0) +
+        (worldId?.status === "dynamic" ? 1 : 0) +
+        api.unknown;
+    accountForStructure(context, unknown, api.omitted);
+    const finding = {
+        world: isolated ? "isolated" : "main",
+        world_id: worldId,
+        api_key: key.status === "literal" && typeof key.value === "string"
+            ? key.value
+            : null,
+        api_key_expression: key.status === "dynamic" ? key.expression : null,
+        api_status: api.status,
+        members: api.members,
+        unknown_members: api.unknown,
+        omitted_members: api.omitted,
+        module_key: null,
+        location: range(node),
+    };
+    addLocatedFinding(context, {
+        collection: context.accumulator.contextBridgeApis,
+        key: `context-bridge\0${isolated ? "isolated" : "main"}\0${finding.api_key ?? finding.api_key_expression ?? "[missing]"}`,
+        node,
+        value: finding,
+    });
+};
+const inspectUtilityProcess = (node, context) => {
+    const name = calleeName(node.callee);
+    if (name !== "utilityProcess.fork" && !name.endsWith(".utilityProcess.fork"))
+        return;
+    const moduleNode = argumentNode(node.arguments[0]);
+    const modulePath = moduleNode === undefined ? undefined : staticPath(moduleNode);
+    const options = argumentNode(node.arguments[2]);
+    const serviceName = t.isObjectExpression(options) &&
+        objectProperty(options, "serviceName") !== undefined
+        ? staticPath(objectProperty(options, "serviceName")?.value ?? options)
+        : undefined;
+    if (modulePath === undefined)
+        context.accumulator.unknownFindings += 1;
+    const finding = {
+        module_path: modulePath ?? null,
+        module_expression: modulePath === undefined
+            ? boundedExpression(context.source, moduleNode)
+            : null,
+        service_name: serviceName ?? null,
+        module_key: null,
+        location: range(node),
+    };
+    addLocatedFinding(context, {
+        collection: context.accumulator.utilityProcesses,
+        key: `electron-utility\0${modulePath ?? finding.module_expression ?? "[missing]"}`,
+        node,
+        value: finding,
+    });
+};
+const accountForStructure = (context, unknown, omitted) => {
+    context.accumulator.unknownFindings += unknown;
+    if (omitted === 0)
+        return;
+    context.accumulator.structuralTruncation = true;
+    context.accumulator.droppedFindings += omitted;
+};

package/dist/domain/electronStaticAnalysisIpc.js

@@ -0,0 +1,171 @@
+import * as t from "@babel/types";
+import { boundedExpression, electronStaticValue, handlerKind, } from "./electronStaticAnalysisValues.js";
+import { addLocatedFinding } from "./javascriptStaticAnalysisFindings.js";
+import { argumentNode, calleeName, propertyName, range, } from "./javascriptStaticAnalysisHelpers.js";
+/** Inspect Electron IPC operations and validation candidates. */
+export const inspectElectronIpcNode = (node, context) => {
+    if (t.isCallExpression(node)) {
+        inspectIpcCall(node, context);
+        inspectValidationCall(node, context);
+    }
+    if (t.isBinaryExpression(node))
+        inspectValidationComparison(node, context);
+};
+const inspectIpcCall = (node, context) => {
+    const name = calleeName(node.callee);
+    const descriptor = ipcDescriptor(name);
+    if (descriptor === undefined)
+        return;
+    const channelNode = argumentNode(node.arguments[0]);
+    const channelValue = electronStaticValue(context.source, channelNode);
+    const channel = channelValue.status === "literal" && typeof channelValue.value === "string"
+        ? channelValue.value
+        : null;
+    const channelExpression = channel === null
+        ? channelValue.status === "dynamic"
+            ? channelValue.expression
+            : boundedExpression(context.source, channelNode)
+        : null;
+    const hasHandler = descriptor.mode === "listen" || descriptor.mode === "handle";
+    const handlerNode = hasHandler ? argumentNode(node.arguments[1]) : undefined;
+    if (channel === null)
+        context.accumulator.unknownFindings += 1;
+    if (hasHandler && handlerNode === undefined)
+        context.accumulator.unknownFindings += 1;
+    const finding = {
+        ...descriptor,
+        channel,
+        channel_expression: channelExpression,
+        handler_kind: hasHandler ? handlerKind(handlerNode) : null,
+        handler_location: handlerNode === undefined ? null : range(handlerNode),
+        module_key: null,
+        location: range(node),
+    };
+    addLocatedFinding(context, {
+        collection: context.accumulator.ipc,
+        key: `electron-ipc\0${descriptor.side}\0${descriptor.operation}\0${channel ?? channelExpression ?? "[missing]"}`,
+        node,
+        value: finding,
+    });
+};
+const inspectValidationComparison = (node, context) => {
+    if (!["==", "===", "!=", "!==", "in"].includes(node.operator))
+        return;
+    const left = senderSubject(node.left);
+    const right = senderSubject(node.right);
+    if (left === undefined && right === undefined)
+        return;
+    const expected = left === undefined ? node.left : node.right;
+    addValidation(context, node, {
+        subject: left ?? right ?? "sender-frame",
+        mechanism: `comparison:${node.operator}`,
+        expected: electronStaticValue(context.source, expected),
+    });
+};
+const inspectValidationCall = (node, context) => {
+    if (!t.isMemberExpression(node.callee) &&
+        !t.isOptionalMemberExpression(node.callee))
+        return;
+    const method = propertyName(node.callee.property);
+    if (!["startsWith", "endsWith", "includes"].includes(method))
+        return;
+    const subject = t.isNode(node.callee.object)
+        ? senderSubject(node.callee.object)
+        : undefined;
+    if (subject === undefined)
+        return;
+    addValidation(context, node, {
+        subject,
+        mechanism: `call:${method}`,
+        expected: electronStaticValue(context.source, argumentNode(node.arguments[0])),
+    });
+};
+const addValidation = (context, node, input) => {
+    if (input.expected.status === "dynamic")
+        context.accumulator.unknownFindings += 1;
+    const finding = {
+        ...input,
+        enforcement: "unknown",
+        module_key: null,
+        location: range(node),
+    };
+    addLocatedFinding(context, {
+        collection: context.accumulator.senderValidations,
+        key: `electron-validation\0${input.subject}\0${input.mechanism}\0${input.expected.status === "literal" ? String(input.expected.value) : input.expected.expression}`,
+        node,
+        value: finding,
+    });
+};
+const ipcDescriptor = (name) => {
+    const renderer = suffixOperation(name, "ipcRenderer");
+    if (renderer !== undefined) {
+        switch (renderer) {
+            case "send":
+                return { side: "renderer", operation: "send", mode: "send" };
+            case "sendSync":
+                return { side: "renderer", operation: "send-sync", mode: "send" };
+            case "invoke":
+                return { side: "renderer", operation: "invoke", mode: "invoke" };
+            case "postMessage":
+                return {
+                    side: "renderer",
+                    operation: "post-message",
+                    mode: "send",
+                };
+            case "sendToHost":
+                return {
+                    side: "renderer",
+                    operation: "send-to-host",
+                    mode: "send",
+                };
+            case "on":
+                return { side: "renderer", operation: "on", mode: "listen" };
+            case "once":
+                return { side: "renderer", operation: "once", mode: "listen" };
+        }
+    }
+    const main = suffixOperation(name, "ipcMain");
+    switch (main) {
+        case "on":
+            return { side: "main", operation: "on", mode: "listen" };
+        case "once":
+            return { side: "main", operation: "once", mode: "listen" };
+        case "handle":
+            return { side: "main", operation: "handle", mode: "handle" };
+        case "handleOnce":
+            return { side: "main", operation: "handle-once", mode: "handle" };
+        default:
+            return undefined;
+    }
+};
+const suffixOperation = (name, object) => {
+    const marker = `${object}.`;
+    const index = name.lastIndexOf(marker);
+    if (index < 0)
+        return undefined;
+    const prefix = name.slice(0, index);
+    if (prefix !== "" && !prefix.endsWith("."))
+        return undefined;
+    const operation = name.slice(index + marker.length);
+    return operation.includes(".") ? undefined : operation;
+};
+const senderSubject = (node) => {
+    const name = t.isCallExpression(node)
+        ? calleeName(node.callee)
+        : calleeName(node);
+    if (/(?:^|\.)sender\.getURL$/u.test(name))
+        return "sender-url";
+    if (/(?:^|\.)senderFrame\.origin$/u.test(name))
+        return "sender-origin";
+    if (/(?:^|\.)senderFrame\.url$/u.test(name))
+        return "sender-url";
+    if (/(?:^|\.)senderFrame$/u.test(name))
+        return "sender-frame";
+    if (/(?:^|\.)sender\.id$/u.test(name))
+        return "sender-id";
+    if (/(?:^|\.)frameId$/u.test(name))
+        return "frame-id";
+    if (/(?:^|\.)processId$/u.test(name))
+        return "process-id";
+    return undefined;
+};