rea-agents 1.7.0 → 2.0.0

package/dist/domain/javascriptRuntimeStaticCandidates.js

@@ -0,0 +1,191 @@
+import { isAbsolute, posix, relative } from "node:path";
+import { compareCodePoints, } from "./javascriptApplicationGraph.js";
+/** Index statically reconstructed entities that can receive runtime matches. */
+export const collectStaticRuntimeCandidates = (layers) => layers
+    .flatMap((layer) => candidatesForLayer(layer))
+    .sort((left, right) => compareCodePoints(left.layer.layerId, right.layer.layerId) ||
+    compareCodePoints(left.node.node_id, right.node.node_id));
+/** Translate one already-authorized runtime location into artifact paths. */
+export const mappedRuntimePaths = (layer, entity) => {
+    const paths = [];
+    if (entity.location.kind === "file" && layer.result.format === "directory") {
+        const path = pathBelowRoot(layer.result.input_path, entity.location.value);
+        if (path !== null)
+            paths.push({ path, basis: "artifact-path" });
+    }
+    for (const mapping of layer.runtimeMappings) {
+        const suffix = mapping.kind === "file-root" && entity.location.kind === "file"
+            ? pathBelowRoot(mapping.root, entity.location.value)
+            : mapping.kind === "url-prefix" && entity.location.kind === "url"
+                ? pathBelowUrlPrefix(mapping.prefix, entity.location.value)
+                : null;
+        if (suffix === null)
+            continue;
+        const path = safeArtifactPath(mapping.artifact_prefix, suffix);
+        if (path === null)
+            continue;
+        paths.push({
+            path,
+            basis: mapping.kind === "file-root"
+                ? "operator-file-mapping"
+                : "operator-url-mapping",
+        });
+    }
+    return uniqueMappedPaths(paths);
+};
+/** Precompute the artifact prefixes exercised by a bounded runtime set. */
+export const createStaticRuntimeScope = (layer, entities) => ({
+    artifactPrefixes: activeArtifactPrefixes(layer, entities),
+    pathsByNodeId: indexStaticPaths(layer.graph),
+});
+/** Whether one static node falls under a mapping exercised by this runtime set. */
+export const staticNodeWithinRuntimeScope = (node, scope) => (scope.pathsByNodeId.get(node.node_id) ?? []).some((path) => scope.artifactPrefixes.some((prefix) => pathWithinPrefix(path, prefix)));
+const candidatesForLayer = (layer) => {
+    const graph = layer.graph;
+    const pathsByNodeId = indexStaticPaths(graph);
+    return graph.nodes.flatMap((node) => {
+        const category = candidateCategory(node);
+        if (category === null)
+            return [];
+        return [
+            {
+                layer,
+                node,
+                category,
+                paths: pathsByNodeId.get(node.node_id) ?? [],
+                digests: candidateDigests(node),
+            },
+        ];
+    });
+};
+const candidateCategory = (node) => {
+    if (node.kind === "electron-renderer")
+        return "renderer";
+    if (node.kind === "javascript-asset" || node.kind === "javascript-module")
+        return "javascript";
+    if (node.kind === "worker")
+        return "worker";
+    if (node.kind === "service-worker")
+        return "service-worker";
+    return null;
+};
+const indexStaticPaths = (graph) => {
+    const nodes = new Map(graph.nodes.map((candidate) => [candidate.node_id, candidate]));
+    const relatedBySource = new Map();
+    for (const edge of graph.edges) {
+        if (edge.relation !== "maps_to")
+            continue;
+        const target = nodes.get(edge.target_node_id);
+        if (target === undefined)
+            continue;
+        const related = relatedBySource.get(edge.source_node_id);
+        if (related === undefined)
+            relatedBySource.set(edge.source_node_id, [target]);
+        else
+            related.push(target);
+    }
+    return new Map(graph.nodes.map((node) => [
+        node.node_id,
+        uniqueSorted([
+            ...nodePaths(node),
+            ...(relatedBySource.get(node.node_id) ?? []).flatMap(nodePaths),
+        ]),
+    ]));
+};
+const nodePaths = (node) => {
+    const paths = [];
+    if (node.identity.strategy === "canonical-path")
+        paths.push(node.identity.path);
+    for (const observation of node.observations) {
+        for (const property of ["path", "resolved_path", "declared_path"])
+            if (typeof observation.properties[property] === "string")
+                paths.push(observation.properties[property]);
+        if (observation.evidence.location.available &&
+            observation.evidence.location.value.kind === "artifact-path")
+            paths.push(observation.evidence.location.value.path);
+    }
+    return paths
+        .map(normalizeArtifactPath)
+        .filter((path) => path !== null && path !== "artifact-root");
+};
+const candidateDigests = (node) => {
+    const values = [];
+    if (node.kind === "javascript-asset" &&
+        node.identity.strategy === "content-digest")
+        values.push({
+            sha256: node.identity.sha256,
+            basis: "content-sha256",
+        });
+    if (node.kind === "javascript-module")
+        for (const observation of node.observations) {
+            const digest = observation.properties.source_sha256;
+            if (typeof digest === "string" && /^[a-f0-9]{64}$/u.test(digest))
+                values.push({ sha256: digest, basis: "module-source-sha256" });
+        }
+    return [
+        ...new Map(values.map((value) => [`${value.basis}:${value.sha256}`, value])).values(),
+    ];
+};
+const pathBelowRoot = (root, value) => {
+    const remainder = relative(root, value);
+    if (remainder === "" ||
+        remainder.startsWith("..") ||
+        isAbsolute(remainder) ||
+        remainder.includes("\\"))
+        return null;
+    return normalizeArtifactPath(remainder);
+};
+const pathBelowUrlPrefix = (prefix, value) => {
+    let base;
+    let candidate;
+    try {
+        base = new URL(prefix);
+        candidate = new URL(value);
+    }
+    catch {
+        return null;
+    }
+    if (base.origin !== candidate.origin ||
+        !candidate.pathname.startsWith(base.pathname))
+        return null;
+    try {
+        return normalizeArtifactPath(decodeURIComponent(candidate.pathname.slice(base.pathname.length)));
+    }
+    catch {
+        return null;
+    }
+};
+const activeArtifactPrefixes = (layer, entities) => {
+    const prefixes = new Set();
+    if (layer.result.format === "directory" &&
+        entities.some(({ location }) => location.kind === "file" &&
+            pathBelowRoot(layer.result.input_path, location.value) !== null))
+        prefixes.add("");
+    for (const mapping of layer.runtimeMappings)
+        if (entities.some(({ location }) => mapping.kind === "file-root" && location.kind === "file"
+            ? pathBelowRoot(mapping.root, location.value) !== null
+            : mapping.kind === "url-prefix" && location.kind === "url"
+                ? pathBelowUrlPrefix(mapping.prefix, location.value) !== null
+                : false))
+            prefixes.add(mapping.artifact_prefix);
+    return [...prefixes].sort(compareCodePoints);
+};
+const pathWithinPrefix = (path, prefix) => prefix === "" || path === prefix || path.startsWith(`${prefix}/`);
+const safeArtifactPath = (prefix, suffix) => normalizeArtifactPath(prefix === "" ? suffix : posix.join(prefix, suffix));
+const normalizeArtifactPath = (value) => {
+    const normalized = posix
+        .normalize(value.replaceAll("\\", "/"))
+        .replace(/^\.\//u, "");
+    return normalized !== "" &&
+        normalized !== "." &&
+        normalized !== ".." &&
+        !normalized.startsWith("/") &&
+        !normalized.startsWith("../")
+        ? normalized
+        : null;
+};
+const uniqueMappedPaths = (values) => [
+    ...new Map(values.map((value) => [`${value.basis}:${value.path}`, value])).values(),
+].sort((left, right) => compareCodePoints(left.path, right.path) ||
+    compareCodePoints(left.basis, right.basis));
+const uniqueSorted = (values) => [...new Set(values)].sort(compareCodePoints);

package/dist/domain/javascriptStaticAnalysis.js

@@ -3,6 +3,8 @@ import * as t from "@babel/types";
 import { collectJavaScriptExports, fingerprintJavaScriptAst, } from "./javascriptAstFingerprint.js";
 import { STATIC_ROUTE_CALL_NAMES, argumentValue, calleeName, chunkRuntime, compareCodePoints, detectVendors, endpointArgument, failedJavaScriptStaticAnalysis, factoryRequireName, moduleFactory, modulePropertyName, prefixedArgument, propertyName, range, rangeForOffsets, registrationKey, sanitizeCandidate, sha256Text, sortedUnique, sourceSlice, staticArrayValues, staticPath, storageKind, stringValue, } from "./javascriptStaticAnalysisHelpers.js";
 import { createJavaScriptAnalysisAccumulator, } from "./javascriptStaticAnalysisState.js";
+import { addBoundedFinding, addLocatedFinding, finalizeLocatedFindings, moduleAtOffset, } from "./javascriptStaticAnalysisFindings.js";
+import { inspectElectronStaticNode } from "./electronStaticAnalysis.js";
 /** Parse one bounded JavaScript artifact and recover static structure only. */
 export const analyzeJavaScriptStaticSource = (source, limits) => {
     let file;
@@ -17,6 +19,11 @@ export const analyzeJavaScriptStaticSource = (source, limits) => {
         return failedJavaScriptStaticAnalysis();
     }
     const accumulator = createJavaScriptAnalysisAccumulator();
+    traverseStaticSource(source, file, accumulator, limits);
+    addSourceMapDirectives(source, accumulator, limits.maxFindings);
+    return finalizeStaticAnalysis(source, file, accumulator, limits);
+};
+const traverseStaticSource = (source, file, accumulator, limits) => {
     if (limits.now() > limits.deadline)
         accumulator.truncated = true;
     if (!accumulator.truncated)
@@ -31,7 +38,8 @@ export const analyzeJavaScriptStaticSource = (source, limits) => {
             inspectNode(source, node, accumulator, limits);
             return undefined;
         });
-    addSourceMapDirectives(source, accumulator, limits.maxFindings);
+};
+const finalizeStaticAnalysis = (source, file, accumulator, limits) => {
     const parserErrors = file.errors.length;
     const limitations = [
         ...(parserErrors === 0
@@ -51,7 +59,7 @@ export const analyzeJavaScriptStaticSource = (source, limits) => {
         ...(accumulator.unknownFindings === 0
             ? []
             : [
-                "One or more bundler registration keys were dynamic and remain unknown.",
+                "One or more static keys, expressions, or Electron boundary values were dynamic and remain unknown.",
             ]),
         "JavaScript syntax was parsed as data and was never evaluated.",
     ];
@@ -64,13 +72,21 @@ export const analyzeJavaScriptStaticSource = (source, limits) => {
         parse_error_count: parserErrors,
         visited_ast_nodes: Math.min(accumulator.visitedNodes, limits.maxAstNodes),
         dropped_findings: accumulator.droppedFindings,
-        references: finalizeLocated(accumulator.references, accumulator.modules),
-        endpoints: finalizeLocated(accumulator.endpoints, accumulator.modules),
-        storage: finalizeLocated(accumulator.storage, accumulator.modules),
+        references: finalizeLocatedFindings(accumulator.references, accumulator.modules),
+        endpoints: finalizeLocatedFindings(accumulator.endpoints, accumulator.modules),
+        storage: finalizeLocatedFindings(accumulator.storage, accumulator.modules),
         bundler_registrations: sortedUnique(accumulator.registrations, registrationKey),
-        role_paths: finalizeLocated(accumulator.roles, accumulator.modules),
+        role_paths: finalizeLocatedFindings(accumulator.roles, accumulator.modules),
         source_map_urls: accumulator.sourceMaps,
         vendors: detectVendors(source),
+        electron: {
+            browser_windows: finalizeLocatedFindings(accumulator.browserWindows, accumulator.modules),
+            context_bridge_apis: finalizeLocatedFindings(accumulator.contextBridgeApis, accumulator.modules),
+            ipc: finalizeLocatedFindings(accumulator.ipc, accumulator.modules),
+            sender_validations: finalizeLocatedFindings(accumulator.senderValidations, accumulator.modules),
+            utility_processes: finalizeLocatedFindings(accumulator.utilityProcesses, accumulator.modules),
+            native_addon_bindings: finalizeLocatedFindings(accumulator.nativeAddonBindings, accumulator.modules),
+        },
         limitations,
     };
 };
@@ -80,6 +96,7 @@ const inspectNode = (source, node, accumulator, limits) => {
         accumulator,
         maximum: limits.maxFindings,
     };
+    inspectElectronStaticNode(node, findings);
     if (t.isCallExpression(node)) {
         inspectBundlerRegistration(source, node, accumulator, limits);
         inspectCall(node, findings);
@@ -114,7 +131,7 @@ const inspectCall = (node, context) => {
     const { accumulator } = context;
     const name = calleeName(node.callee);
     const first = stringValue(node.arguments[0]);
-    const module = moduleAt(node.start, accumulator.modules);
+    const module = moduleAtOffset(node.start, accumulator.modules);
     const moduleRequire = module?.requireName !== null && name === module?.requireName;
     if (name === "require" ||
         name.endsWith(".require") ||
@@ -138,7 +155,7 @@ const inspectCall = (node, context) => {
     inspectEndpointCall(node, name, first, context);
     inspectStorageCall(node, name, first, context);
     if (name.endsWith("loadFile") && first !== undefined)
-        addLocated(context, {
+        addLocatedFinding(context, {
             collection: accumulator.roles,
             key: `role\0renderer\0${first}`,
             node,
@@ -221,7 +238,7 @@ const inspectBundlerRegistration = (source, call, accumulator, limits) => {
         modules: modules.sort((left, right) => compareCodePoints(left.module_key, right.module_key)),
         location: range(call),
     };
-    addBounded(accumulator, `registration\0${registrationKey(registration)}`, limits.maxFindings, () => accumulator.registrations.push(registration));
+    addBoundedFinding(accumulator, `registration\0${registrationKey(registration)}`, limits.maxFindings, () => accumulator.registrations.push(registration));
 };
 const inspectEndpointCall = (node, name, first, context) => {
     const route = STATIC_ROUTE_CALL_NAMES.some((candidate) => name === candidate || name.endsWith(`.${candidate}`));
@@ -257,7 +274,7 @@ const inspectRoleProperty = (node, context) => {
     const path = staticPath(node.value);
     if (path === undefined)
         return;
-    addLocated(context, {
+    addLocatedFinding(context, {
         collection: context.accumulator.roles,
         key: `role\0preload\0${path}`,
         node,
@@ -274,7 +291,7 @@ const inspectStorageCall = (node, name, first, context) => {
     const storage = storageKind(name);
     if (storage === undefined)
         return;
-    addLocated(context, {
+    addLocatedFinding(context, {
         collection: context.accumulator.storage,
         key: `storage\0${storage}\0${first ?? ""}`,
         node,
@@ -292,7 +309,7 @@ const addReference = (context, input) => {
     const expression = boundedSpecifier === null
         ? sourceSlice(context.source, input.node).slice(0, 4_096)
         : null;
-    addLocated(context, {
+    addLocatedFinding(context, {
         collection: context.accumulator.references,
         key: `reference\0${input.kind}\0${boundedSpecifier ?? expression}`,
         node: input.node,
@@ -305,7 +322,7 @@ const addReference = (context, input) => {
         },
     });
 };
-const addEndpoint = (context, input) => addLocated(context, {
+const addEndpoint = (context, input) => addLocatedFinding(context, {
     collection: context.accumulator.endpoints,
     key: `endpoint\0${input.kind}\0${input.value}`,
     node: input.node,
@@ -317,35 +334,6 @@ const addEndpoint = (context, input) => addLocated(context, {
         location: range(input.node),
     },
 });
-const addLocated = (context, input) => addBounded(context.accumulator, `${input.key}\0${String(input.node.start)}`, context.maximum, () => input.collection.push({
-    offset: input.node.start ?? -1,
-    value: input.value,
-}));
-const addBounded = (accumulator, key, maximum, add) => {
-    if (accumulator.seen.has(key))
-        return;
-    const count = accumulator.references.length +
-        accumulator.endpoints.length +
-        accumulator.storage.length +
-        accumulator.roles.length +
-        accumulator.sourceMaps.length +
-        accumulator.registrations.length;
-    if (count >= maximum) {
-        accumulator.droppedFindings += 1;
-        return;
-    }
-    accumulator.seen.add(key);
-    add();
-};
-const finalizeLocated = (values, modules) => values.map(({ offset, value }) => ({
-    ...value,
-    module_key: moduleAt(offset, modules)?.key ?? null,
-}));
-const moduleAt = (offset, modules) => {
-    if (offset === null || offset === undefined)
-        return undefined;
-    return modules.find(({ start, end }) => offset >= start && offset <= end);
-};
 const addSourceMapDirectives = (source, accumulator, maximum) => {
     for (const match of source.matchAll(/\/\/[#@]\s*sourceMappingURL\s*=\s*([^\s]+)/gu)) {
         const declared = match[1]?.slice(0, 4_096);
@@ -353,6 +341,6 @@ const addSourceMapDirectives = (source, accumulator, maximum) => {
             continue;
         const start = match.index;
         const location = rangeForOffsets(source, start, start + match[0].length);
-        addBounded(accumulator, `source-map\0${declared}`, maximum, () => accumulator.sourceMaps.push({ declared_url: declared, location }));
+        addBoundedFinding(accumulator, `source-map\0${declared}`, maximum, () => accumulator.sourceMaps.push({ declared_url: declared, location }));
     }
 };

package/dist/domain/javascriptStaticAnalysisFindings.js

@@ -0,0 +1,39 @@
+/** Add one module-attributable finding under the shared global finding bound. */
+export const addLocatedFinding = (context, input) => addBoundedFinding(context.accumulator, `${input.key}\0${String(input.node.start)}`, context.maximum, () => input.collection.push({
+    offset: input.node.start ?? -1,
+    value: input.value,
+}));
+/** Reserve one deterministic finding key before mutating an accumulator. */
+export const addBoundedFinding = (accumulator, key, maximum, add) => {
+    if (accumulator.seen.has(key))
+        return;
+    if (accumulatedFindingCount(accumulator) >= maximum) {
+        accumulator.droppedFindings += 1;
+        return;
+    }
+    accumulator.seen.add(key);
+    add();
+};
+/** Attach recovered bundle-module ownership to findings after traversal. */
+export const finalizeLocatedFindings = (values, modules) => values.map(({ offset, value }) => ({
+    ...value,
+    module_key: moduleAtOffset(offset, modules)?.key ?? null,
+}));
+/** Locate the recovered bundle factory containing one exact source offset. */
+export const moduleAtOffset = (offset, modules) => {
+    if (offset === null || offset === undefined)
+        return undefined;
+    return modules.find(({ start, end }) => offset >= start && offset <= end);
+};
+const accumulatedFindingCount = (accumulator) => accumulator.references.length +
+    accumulator.endpoints.length +
+    accumulator.storage.length +
+    accumulator.roles.length +
+    accumulator.sourceMaps.length +
+    accumulator.registrations.length +
+    accumulator.browserWindows.length +
+    accumulator.contextBridgeApis.length +
+    accumulator.ipc.length +
+    accumulator.senderValidations.length +
+    accumulator.utilityProcesses.length +
+    accumulator.nativeAddonBindings.length;

package/dist/domain/javascriptStaticAnalysisHelpers.js

@@ -15,11 +15,21 @@ export const failedJavaScriptStaticAnalysis = () => ({
     role_paths: [],
     source_map_urls: [],
     vendors: [],
+    electron: {
+        browser_windows: [],
+        context_bridge_apis: [],
+        ipc: [],
+        sender_validations: [],
+        utility_processes: [],
+        native_addon_bindings: [],
+    },
     limitations: [
         "JavaScript source could not be parsed; absence of findings is not evidence of absence.",
         "JavaScript syntax was parsed as data and was never evaluated.",
     ],
 });
+/** Normalize one Babel call/new argument into the inert node shared by inspectors. */
+export const argumentNode = (argument) => argument !== null && t.isNode(argument) ? argument : undefined;
 /** Recognize the bounded runtime name for a Webpack/Rspack push call. */
 export const chunkRuntime = (call) => {
     if (!t.isMemberExpression(call.callee) &&

package/dist/domain/javascriptStaticAnalysisState.js

@@ -6,6 +6,12 @@ export const createJavaScriptAnalysisAccumulator = () => ({
     roles: [],
     sourceMaps: [],
     registrations: [],
+    browserWindows: [],
+    contextBridgeApis: [],
+    ipc: [],
+    senderValidations: [],
+    utilityProcesses: [],
+    nativeAddonBindings: [],
     modules: [],
     seen: new Set(),
     visitedNodes: 0,