rea-agents 1.7.0 → 2.0.0

package/dist/dotnet/ManagedStaticProvider.js

@@ -0,0 +1,203 @@
+import { createHash } from "node:crypto";
+import { readFile, stat } from "node:fs/promises";
+import { createAnalysisExecution, } from "../application/AnalysisProvider.js";
+import { MANAGED_STATIC_PROVIDER } from "../application/InvestigationProviders.js";
+import { MANAGED_TOOL_CONTRACTS, managedArtifactInputSchema, managedMemberInputSchema, managedNativeBoundaryInputSchema, } from "../contracts/managedToolContracts.js";
+import { AnalysisCancelledError, AnalysisCapabilityUnavailableError, EvidenceIntegrityError, ProviderAdapterError, } from "../domain/errors.js";
+import { err, ok } from "../domain/result.js";
+import { inspectManagedArtifactBytes } from "./ManagedArtifactInspector.js";
+import { inspectManagedMembersBytes } from "./ManagedMemberInspector.js";
+import { inspectManagedNativeBoundariesBytes } from "./ManagedNativeBoundaryInspector.js";
+const IDENTITY = Object.freeze(MANAGED_STATIC_PROVIDER);
+/** Execution-free managed PE/CLI auxiliary provider. */
+export class ManagedStaticProvider {
+    #capabilities = Object.freeze(MANAGED_TOOL_CONTRACTS.map((contract) => Object.freeze({
+        provider: IDENTITY,
+        operation: contract.name,
+        inputContractVersion: 1,
+        outputContractVersion: 1,
+        available: true,
+        reason: null,
+        pagination: "offset",
+        exhaustive: false,
+        effects: Object.freeze({
+            mutatesArtifact: false,
+            launchesProcess: false,
+            mayShowUi: false,
+            mayAccessNetwork: false,
+            mayWriteFilesystem: false,
+            changesPermissions: false,
+            requiresRoot: false,
+        }),
+        limits: Object.freeze({
+            maxResults: 500,
+            maxPayloadBytes: 4 * 1024 * 1024,
+            timeoutMs: null,
+        }),
+        limitations: limitationsFor(contract.name),
+    })));
+    identity() {
+        return IDENTITY;
+    }
+    capabilities() {
+        return this.#capabilities;
+    }
+    createClient(target) {
+        return new ManagedStaticClient(target);
+    }
+}
+class ManagedStaticClient {
+    target;
+    constructor(target) {
+        this.target = target;
+    }
+    async execute(operation, parameters, options) {
+        if (operation === "health")
+            return ok(createAnalysisExecution(null, IDENTITY));
+        if (!isManagedOperation(operation))
+            return err(new AnalysisCapabilityUnavailableError(IDENTITY.id, operation, "Operation is not implemented by the managed static provider."));
+        if (this.target.format !== "pe")
+            return err(new AnalysisCapabilityUnavailableError(IDENTITY.id, operation, `Managed static triage requires a PE target; observed ${this.target.format}.`));
+        try {
+            if (options?.signal?.aborted === true)
+                return err(new AnalysisCancelledError(operation));
+            const maxFileBytes = maxRequestedFileBytes(operation, parameters);
+            const metadata = await stat(this.target.path);
+            if (metadata.size > maxFileBytes)
+                return err(new AnalysisCapabilityUnavailableError(IDENTITY.id, operation, `Artifact size ${String(metadata.size)} exceeds max_file_bytes ${String(maxFileBytes)}.`));
+            const bytes = await readFile(this.target.path, options?.signal === undefined ? undefined : { signal: options.signal });
+            if (bytes.length > maxFileBytes)
+                return err(new AnalysisCapabilityUnavailableError(IDENTITY.id, operation, `Artifact grew beyond max_file_bytes ${String(maxFileBytes)} while it was read.`));
+            const observedDigest = createHash("sha256").update(bytes).digest("hex");
+            if (observedDigest !== this.target.sha256)
+                return err(new EvidenceIntegrityError(`Managed artifact digest changed after open: expected ${this.target.sha256}, observed ${observedDigest} at ${this.target.path}`));
+            const result = inspectManagedOperation(operation, parameters, bytes, this.target);
+            return ok(createAnalysisExecution(result, IDENTITY, {
+                rawResult: null,
+                limitations: result.limitations,
+                subject: this.target,
+                locations: managedLocations(result),
+            }));
+        }
+        catch (cause) {
+            if (options?.signal?.aborted === true)
+                return err(new AnalysisCancelledError(operation));
+            return err(new ProviderAdapterError(IDENTITY.id, operation, { cause }));
+        }
+    }
+    close() {
+        return Promise.resolve();
+    }
+}
+const isManagedOperation = (operation) => MANAGED_TOOL_CONTRACTS.some(({ name }) => name === operation);
+const limitationsFor = (operation) => Object.freeze(operation === "inspect_managed_artifact"
+    ? [
+        "This capability inventories PE/CLI identity only; inspect_managed_members admits bounded metadata members, signatures, and CIL anchors.",
+        "It never loads the target assembly, resolves dependencies through a CLR, decompiles C#, or executes target code.",
+    ]
+    : operation === "inspect_managed_native_boundaries"
+        ? [
+            "This capability inventories managed declarations for native boundaries only; native exports, thunks, and addresses require separate native-provider evidence.",
+            "It never loads the target assembly, resolves dependencies through a CLR, decompiles C#, or executes target code.",
+        ]
+        : [
+            "This capability decodes bounded PE/CLI metadata members, signatures, and file-backed method bodies; decompiled C# and cross-build matching are separate future contracts.",
+            "It never loads the target assembly, resolves dependencies through a CLR, decompiles C#, or executes target code.",
+        ]);
+const maxRequestedFileBytes = (operation, parameters) => {
+    if (operation === "inspect_managed_artifact")
+        return managedArtifactInputSchema.parse(parameters).max_file_bytes;
+    if (operation === "inspect_managed_native_boundaries")
+        return managedNativeBoundaryInputSchema.parse(parameters).max_file_bytes;
+    return managedMemberInputSchema.parse(parameters).max_file_bytes;
+};
+const inspectManagedOperation = (operation, parameters, bytes, target) => {
+    if (operation === "inspect_managed_artifact") {
+        const input = managedArtifactInputSchema.parse(parameters);
+        return inspectManagedArtifactBytes(bytes, target, {
+            referenceOffset: input.reference_offset,
+            referenceLimit: input.reference_limit,
+            resourceOffset: input.resource_offset,
+            resourceLimit: input.resource_limit,
+            attributeOffset: input.attribute_offset,
+            attributeLimit: input.attribute_limit,
+            maxMetadataBytes: input.max_metadata_bytes,
+            maxTableRows: input.max_table_rows,
+            maxHeapItemBytes: input.max_heap_item_bytes,
+        });
+    }
+    if (operation === "inspect_managed_native_boundaries") {
+        const input = managedNativeBoundaryInputSchema.parse(parameters);
+        return inspectManagedNativeBoundariesBytes(bytes, target, {
+            moduleRefOffset: input.module_ref_offset,
+            moduleRefLimit: input.module_ref_limit,
+            importOffset: input.import_offset,
+            importLimit: input.import_limit,
+            implementationOffset: input.implementation_offset,
+            implementationLimit: input.implementation_limit,
+            maxMetadataBytes: input.max_metadata_bytes,
+            maxTableRows: input.max_table_rows,
+            maxHeapItemBytes: input.max_heap_item_bytes,
+        });
+    }
+    const input = managedMemberInputSchema.parse(parameters);
+    return inspectManagedMembersBytes(bytes, target, {
+        typeOffset: input.type_offset,
+        typeLimit: input.type_limit,
+        methodOffset: input.method_offset,
+        methodLimit: input.method_limit,
+        fieldOffset: input.field_offset,
+        fieldLimit: input.field_limit,
+        memberRefOffset: input.member_ref_offset,
+        memberRefLimit: input.member_ref_limit,
+        edgeOffset: input.edge_offset,
+        edgeLimit: input.edge_limit,
+        instructionAnchorLimit: input.instruction_anchor_limit,
+        maxMetadataBytes: input.max_metadata_bytes,
+        maxTableRows: input.max_table_rows,
+        maxHeapItemBytes: input.max_heap_item_bytes,
+        maxMethodBodyBytes: input.max_method_body_bytes,
+        maxMethodInstructions: input.max_method_instructions,
+    });
+};
+const managedLocations = (result) => {
+    if ("pe" in result) {
+        if (result.pe.cli === null)
+            return [{ kind: "file-offset", offset: 0 }];
+        return [
+            {
+                kind: "file-offset-range",
+                start: result.pe.cli.header_offset,
+                end: result.pe.cli.header_offset + result.pe.cli.header_size,
+            },
+            ...[result.module, result.assembly]
+                .filter((value) => value !== null)
+                .map((value) => ({
+                kind: "file-offset",
+                offset: value.row_offset,
+            })),
+        ];
+    }
+    if ("methods" in result)
+        return [
+            ...(result.module === null
+                ? [{ kind: "file-offset", offset: 0 }]
+                : [{ kind: "file-offset", offset: result.module.row_offset }]),
+            ...result.methods.items
+                .filter((method) => method.body.file_offset !== null)
+                .slice(0, 8)
+                .map((method) => ({
+                kind: "file-offset",
+                offset: method.body.file_offset ?? 0,
+            })),
+        ];
+    return [
+        ...(result.module === null
+            ? [{ kind: "file-offset", offset: 0 }]
+            : [{ kind: "file-offset", offset: result.module.row_offset }]),
+        ...result.pinvoke_imports.items.slice(0, 8).map((mapping) => ({
+            kind: "file-offset",
+            offset: mapping.row_offset,
+        })),
+    ];
+};

package/dist/generatedPackageMetadata.js

@@ -1,9 +1,9 @@
 /** Generated from package.json and package-lock.json; do not edit. */
 export const PACKAGE_METADATA = {
     name: "rea-agents",
-    version: "1.7.0",
+    version: "2.0.0",
     serverSdkVersion: "2.0.0-beta.4",
     clientSdkVersion: "2.0.0-beta.4",
     coreSdkVersion: "2.0.0-beta.4",
-    skillVersion: "14",
+    skillVersion: "20",
 };

package/dist/ghidra/GhidraProvider.js

@@ -307,6 +307,12 @@ export class GhidraProvider {
             ...(this.config.ghidraJavaHome === undefined
                 ? {}
                 : { javaHome: this.config.ghidraJavaHome }),
+            ...(this.installationHost?.platform === undefined
+                ? {}
+                : { platform: this.installationHost.platform }),
+            ...(this.installationHost?.architecture === undefined
+                ? {}
+                : { architecture: this.installationHost.architecture }),
         };
         this.#installation ??=
             this.installationHost === undefined

package/dist/main.js

@@ -89,6 +89,14 @@ export const run = async (dependencies = runtimeDependencies()) => {
         roots: [...config.value.analysisSnapshotFilePolicy.roots],
     };
     const runtimeInvestigationRoots = [...config.value.investigationInputRoots];
+    const runtimeJavascriptReplayPolicy = {
+        ...config.value.javascriptReplayPolicy,
+        roots: [...config.value.javascriptReplayPolicy.roots],
+    };
+    const runtimeManagedRuntimePolicy = {
+        ...config.value.managedRuntimePolicy,
+        roots: [...config.value.managedRuntimePolicy.roots],
+    };
     const liveServers = new Set();
     let handle;
     try {
@@ -103,6 +111,8 @@ export const run = async (dependencies = runtimeDependencies()) => {
                 browserObservation,
                 electronObservation,
                 artifactIntegrityContinueEnabled: () => currentConfig.artifactIntegrityContinueEnabled,
+                javascriptReplayPolicy: runtimeJavascriptReplayPolicy,
+                managedRuntimePolicy: runtimeManagedRuntimePolicy,
                 availabilityPolicy: () => ({
                     processCaptureEnabled: currentConfig.processExecutionPolicy.enabled,
                     evidenceFileRoots: currentConfig.evidenceFilePolicy.roots.length,
@@ -112,6 +122,8 @@ export const run = async (dependencies = runtimeDependencies()) => {
                     electronObservationEnabled: currentConfig.electronObservationEnabled &&
                         currentConfig.electronCdpEndpoints.length > 0 &&
                         currentConfig.electronFileRoots.length > 0,
+                    javascriptReplayEnabled: currentConfig.javascriptReplayPolicy.enabled,
+                    managedRuntimeEnabled: currentConfig.managedRuntimePolicy.enabled,
                 }),
             });
             liveServers.add(server);
@@ -162,6 +174,8 @@ export const run = async (dependencies = runtimeDependencies()) => {
             Object.assign(runtimeEvidencePolicy, refreshed.value.evidenceFilePolicy);
             Object.assign(runtimeSnapshotPolicy, refreshed.value.analysisSnapshotFilePolicy);
             runtimeInvestigationRoots.splice(0, runtimeInvestigationRoots.length, ...refreshed.value.investigationInputRoots);
+            Object.assign(runtimeJavascriptReplayPolicy, refreshed.value.javascriptReplayPolicy);
+            Object.assign(runtimeManagedRuntimePolicy, refreshed.value.managedRuntimePolicy);
             for (const server of liveServers)
                 server.sendToolListChanged();
         });

package/dist/replay/JavaScriptReplayWorker.js

@@ -0,0 +1,286 @@
+import { Script, SourceTextModule, SyntheticModule, createContext, } from "node:vm";
+import { types } from "node:util";
+class ReplayDeniedError extends Error {
+    name = "ReplayDeniedError";
+}
+const main = async () => {
+    const chunks = [];
+    for await (const chunk of process.stdin)
+        chunks.push(Buffer.from(chunk));
+    const request = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+    if (request.schemaVersion !== 1)
+        throw new TypeError("Unsupported replay worker protocol");
+    const left = [];
+    const right = [];
+    for (let index = 0; index < request.cases.length; index += 1) {
+        const replayCase = request.cases[index];
+        if (replayCase === undefined)
+            continue;
+        left.push(await runCase(request.left, replayCase, request, index));
+        if (request.right !== undefined)
+            right.push(await runCase(request.right, replayCase, request, index));
+    }
+    process.stdout.write(JSON.stringify({
+        schema_version: 1,
+        left,
+        ...(request.right === undefined ? {} : { right }),
+    }));
+};
+const runCase = async (side, replayCase, request, index) => {
+    try {
+        const loaded = await loadEntry(side, request, index);
+        if (typeof loaded !== "function")
+            throw new TypeError(`Replay export is not callable: ${side.entryExport}`);
+        const returned = await Reflect.apply(loaded, undefined, [
+            ...replayCase.arguments,
+        ]);
+        try {
+            return {
+                case_id: replayCase.caseId,
+                outcome: "return",
+                value: projectValue(returned, request.limits.resultDepth, request.limits.resultNodes),
+                input_sha256: replayCase.inputSha256,
+                output_sha256: null,
+                truncated: false,
+            };
+        }
+        catch (error) {
+            return exceptionOutcome(replayCase, "serialization_error", error, request.limits.exceptionBytes);
+        }
+    }
+    catch (error) {
+        return exceptionOutcome(replayCase, error instanceof ReplayDeniedError ? "denied" : "exception", error, request.limits.exceptionBytes);
+    }
+};
+const loadEntry = async (side, request, caseIndex) => {
+    const modules = new Map(side.modules.map((module) => [module.alias, module]));
+    const context = deterministicContext(request, caseIndex);
+    const esmCache = new Map();
+    const commonJsCache = new Map();
+    const loadCommonJs = (alias) => {
+        const cached = commonJsCache.get(alias);
+        if (cached !== undefined)
+            return cached;
+        const descriptor = requiredModule(modules, alias);
+        if (descriptor.format !== "commonjs-factory")
+            throw new TypeError(`Synchronous require cannot load ESM module: ${alias}`);
+        const module = { exports: {} };
+        commonJsCache.set(alias, module.exports);
+        const requireModule = ((specifier) => {
+            const dependency = descriptor.dependencies[specifier];
+            if (dependency === undefined)
+                throw new ReplayDeniedError(`Undeclared require: ${specifier}`);
+            return loadCommonJs(dependency);
+        });
+        installRspackHelpers(requireModule);
+        const source = normalizeFactorySource(descriptor.source);
+        const factory = new Script(`(${source})`, {
+            filename: `/modules/${alias}.js`,
+        }).runInContext(context);
+        factory(module, module.exports, requireModule);
+        commonJsCache.set(alias, module.exports);
+        return module.exports;
+    };
+    const loadEsm = async (alias) => {
+        const cached = esmCache.get(alias);
+        if (cached !== undefined)
+            return cached;
+        const descriptor = requiredModule(modules, alias);
+        let module;
+        if (descriptor.format === "commonjs-factory") {
+            const exports = loadCommonJs(alias);
+            const names = [...new Set(["default", ...Object.keys(exports)])];
+            module = new SyntheticModule(names, function () {
+                this.setExport("default", exports);
+                for (const name of Object.keys(exports))
+                    this.setExport(name, exports[name]);
+            }, { context, identifier: `rea:${alias}` });
+        }
+        else {
+            module = new SourceTextModule(descriptor.source, {
+                context,
+                identifier: `rea:${alias}`,
+                initializeImportMeta: (meta) => {
+                    meta.url = `rea:${alias}`;
+                },
+                importModuleDynamically: () => {
+                    throw new ReplayDeniedError("Dynamic import is unavailable in controlled replay");
+                },
+            });
+        }
+        esmCache.set(alias, module);
+        await module.link(async (specifier) => {
+            const dependency = descriptor.dependencies[specifier];
+            if (dependency === undefined)
+                throw new ReplayDeniedError(`Undeclared import: ${specifier}`);
+            return loadEsm(dependency);
+        });
+        await module.evaluate();
+        return module;
+    };
+    const entry = requiredModule(modules, side.entryAlias);
+    if (entry.format === "commonjs-factory") {
+        const exported = loadCommonJs(side.entryAlias);
+        return side.entryExport === "default"
+            ? (exported.default ?? exported)
+            : exported[side.entryExport];
+    }
+    const namespace = (await loadEsm(side.entryAlias)).namespace;
+    return namespace[side.entryExport];
+};
+const deterministicContext = (request, caseIndex) => {
+    let state = (request.determinism.randomSeed + caseIndex) >>> 0;
+    const random = () => {
+        state ^= state << 13;
+        state ^= state >>> 17;
+        state ^= state << 5;
+        return (state >>> 0) / 0x1_0000_0000;
+    };
+    const epoch = Date.parse(request.determinism.clockIso);
+    class ReplayDate extends Date {
+        constructor(...arguments_) {
+            super(arguments_.length === 0 ? epoch : arguments_[0]);
+        }
+        static now() {
+            return epoch;
+        }
+    }
+    const replayMath = Object.create(Math);
+    Object.defineProperty(replayMath, "random", { value: random });
+    return createContext({ Date: ReplayDate, Math: replayMath }, {
+        name: "rea-controlled-replay",
+        codeGeneration: { strings: false, wasm: false },
+    });
+};
+const installRspackHelpers = (require_) => {
+    require_.d = (exports, definitions) => {
+        for (const [name, getter] of Object.entries(definitions))
+            if (!Object.prototype.hasOwnProperty.call(exports, name))
+                Object.defineProperty(exports, name, { enumerable: true, get: getter });
+    };
+    require_.r = (exports) => {
+        Object.defineProperty(exports, "__esModule", { value: true });
+        Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+    };
+    require_.n = (module) => {
+        const getter = () => (module.__esModule === true ? module.default : module);
+        Object.defineProperty(getter, "a", { get: getter });
+        return getter;
+    };
+    require_.nmd = (module) => module;
+};
+const requiredModule = (modules, alias) => {
+    const module = modules.get(alias);
+    if (module === undefined)
+        throw new TypeError(`Undeclared module alias: ${alias}`);
+    return module;
+};
+const normalizeFactorySource = (source) => /^\s*\d+\s*\(/u.test(source)
+    ? source.replace(/^\s*\d+\s*\(/u, "function(")
+    : source;
+const projectValue = (value, maximumDepth, maximumNodes) => {
+    let nodes = 0;
+    const visit = (candidate, depth, ancestors) => {
+        nodes += 1;
+        if (nodes > maximumNodes || depth > maximumDepth)
+            throw new RangeError("Replay result projection limit exceeded");
+        if (candidate === null ||
+            typeof candidate === "string" ||
+            typeof candidate === "boolean")
+            return candidate;
+        if (typeof candidate === "number") {
+            if (!Number.isFinite(candidate))
+                throw new TypeError("Non-finite replay result number");
+            return candidate;
+        }
+        if (typeof candidate !== "object")
+            throw new TypeError(`Unsupported replay result type: ${typeof candidate}`);
+        if (types.isProxy(candidate))
+            throw new TypeError("Proxy replay results are unavailable");
+        if (ancestors.has(candidate))
+            throw new TypeError("Cyclic replay result");
+        ancestors.add(candidate);
+        try {
+            const descriptors = Object.getOwnPropertyDescriptors(candidate);
+            const output = Array.isArray(candidate)
+                ? []
+                : {};
+            if (!Array.isArray(candidate)) {
+                const prototype = Object.getPrototypeOf(candidate);
+                if (prototype !== null && Object.getPrototypeOf(prototype) !== null)
+                    throw new TypeError("Unsupported replay result prototype");
+            }
+            for (const [key, descriptor] of Object.entries(descriptors)) {
+                if (key === "length" && Array.isArray(candidate))
+                    continue;
+                if (!("value" in descriptor))
+                    throw new TypeError("Replay result accessors are unavailable");
+                if (Array.isArray(output)) {
+                    if (!/^\d+$/u.test(key))
+                        throw new TypeError("Replay arrays may only contain indexed values");
+                    output[Number(key)] = visit(descriptor.value, depth + 1, ancestors);
+                }
+                else
+                    output[key] = visit(descriptor.value, depth + 1, ancestors);
+            }
+            return output;
+        }
+        finally {
+            ancestors.delete(candidate);
+        }
+    };
+    return visit(value, 0, new Set());
+};
+const exceptionOutcome = (replayCase, outcome, error, maximumBytes) => {
+    const details = exceptionDetails(error);
+    const name = bounded(details.name, maximumBytes);
+    const message = bounded(details.message, maximumBytes);
+    const stack = details.stack === null ? null : bounded(details.stack, maximumBytes);
+    return {
+        case_id: replayCase.caseId,
+        outcome,
+        exception: { name, message, stack },
+        input_sha256: replayCase.inputSha256,
+        output_sha256: null,
+        truncated: false,
+    };
+};
+const exceptionDetails = (error) => {
+    if (typeof error !== "object" || error === null)
+        return { name: "Error", message: "Unknown replay exception", stack: null };
+    if (types.isProxy(error))
+        return { name: "Error", message: "Proxy replay exception", stack: null };
+    const own = Object.getOwnPropertyDescriptors(error);
+    const prototype = Object.getPrototypeOf(error);
+    const inherited = prototype === null ? {} : Object.getOwnPropertyDescriptors(prototype);
+    const stringValue = (descriptor) => descriptor !== undefined &&
+        "value" in descriptor &&
+        typeof descriptor.value === "string"
+        ? descriptor.value
+        : null;
+    return {
+        name: stringValue(own.name) ?? stringValue(inherited.name) ?? "Error",
+        message: stringValue(own.message) ?? "Unknown replay exception",
+        stack: stringValue(own.stack),
+    };
+};
+const bounded = (value, maximumBytes) => {
+    const bytes = Buffer.from(value);
+    if (bytes.byteLength <= maximumBytes)
+        return value;
+    const decoder = new TextDecoder("utf-8", { fatal: true });
+    for (let end = maximumBytes; end >= Math.max(0, maximumBytes - 3); end -= 1) {
+        try {
+            return decoder.decode(bytes.subarray(0, end));
+        }
+        catch {
+            /* try the preceding UTF-8 boundary */
+        }
+    }
+    return "";
+};
+void main().catch((error) => {
+    const message = error instanceof Error ? error.message : "Replay worker failed";
+    process.stderr.write(message.slice(0, 4096));
+    process.exitCode = 70;
+});