rea-agents 1.7.0 → 2.1.0

package/dist/cliSetup.js

@@ -0,0 +1,289 @@
+import { cancel, confirm, intro, isCancel, multiselect, outro, } from "@clack/prompts";
+import { SUPPORTED_CLIENT_DEFINITIONS } from "./application/SupportedClients.js";
+const clientDisplayNames = new Map(SUPPORTED_CLIENT_DEFINITIONS.map(({ name, displayName }) => [
+    name,
+    displayName,
+]));
+const promptStreams = {
+    input: process.stdin,
+    output: process.stderr,
+    withGuide: true,
+};
+const agentAccessCapabilityId = "agent_access";
+/** Run the inline setup picker, exact preflight, and default-No consent. */
+export const confirmInteractiveSetup = async (actions, accessible) => {
+    intro("REA setup", promptStreams);
+    renderValueIntroduction();
+    renderDetectedSummary(actions);
+    renderKeyboardHelp(accessible);
+    const selectedActionIds = await selectSetupActions(actions, accessible);
+    if (selectedActionIds === undefined)
+        return cancelledDecision();
+    if (selectedActionIds.length === 0) {
+        cancel("Nothing selected. No changes were made.", promptStreams);
+        return { approved: false, selectedActionIds };
+    }
+    const selected = new Set(selectedActionIds);
+    const selectedActions = actions.filter(({ id }) => selected.has(id));
+    renderPreflight(selectedActions);
+    const approved = await confirm({
+        ...promptStreams,
+        message: selectedActions.length === 1
+            ? "Apply this change?"
+            : `Apply these ${String(selectedActions.length)} changes?`,
+        initialValue: false,
+        active: "Yes, apply",
+        inactive: "No, cancel",
+    });
+    if (isCancel(approved) || !approved) {
+        cancel("Setup cancelled. No changes were made.", promptStreams);
+        return { approved: false, selectedActionIds };
+    }
+    return { approved: true, selectedActionIds };
+};
+/** Render stable, append-only progress for real setup operations. */
+export const renderSetupProgress = (event) => {
+    const symbol = event.state === "started"
+        ? "◇"
+        : event.state === "completed"
+            ? "◆"
+            : event.state === "warning"
+                ? "!"
+                : "✗";
+    const suffix = event.detail === undefined ? "" : ` · ${event.detail}`;
+    writeLine(`${symbol}  ${event.label}${suffix}`);
+};
+/** Finish an interactive setup journey without exposing the full doctor catalog. */
+export const renderInteractiveSetupResult = (result) => {
+    if (result.status === "ready") {
+        const changedClients = Object.entries(result.clients)
+            .filter(([, client]) => client.status === "configured")
+            .map(([client]) => clientDisplayNames.get(client) ?? client);
+        const readyClients = readyAgentClients(result, changedClients);
+        renderReadyCapabilities(result, readyClients);
+        outro(changedClients.length === 0
+            ? "REA is ready for local app analysis."
+            : `Restart ${changedClients.join(", ")} to load REA.`, promptStreams);
+        return;
+    }
+    if (result.status === "planned")
+        return;
+    writeLine(`!  ${result.remediation ?? "Setup needs attention."}`);
+    outro("Run `rea doctor` for the remaining checks.", promptStreams);
+};
+/** Keep default non-TTY output actionable without emitting the full catalog. */
+export const conciseSetupResult = (result) => ({
+    status: result.status,
+    plannedActions: result.plannedActions,
+    appliedActions: result.appliedActions,
+    clients: result.clients,
+    doctor: {
+        healthy: result.doctor.healthy,
+        checks: result.doctor.checks.filter(({ ok }) => !ok),
+    },
+    ...(result.code === undefined ? {} : { code: result.code }),
+    ...(result.remediation === undefined
+        ? {}
+        : { remediation: result.remediation }),
+});
+const selectSetupActions = async (actions, accessible) => {
+    const clientActions = actions.filter(({ kind }) => kind === "configure_client");
+    const componentActions = actions.filter(({ kind }) => kind !== "configure_client");
+    const capabilities = setupCapabilities(clientActions, componentActions);
+    const selectedCapabilities = accessible
+        ? await selectCapabilitiesAccessibly(capabilities)
+        : await selectCapabilities(capabilities);
+    if (selectedCapabilities === undefined)
+        return undefined;
+    const selectedCapabilityIds = new Set(selectedCapabilities);
+    const selectedActionIds = componentActions
+        .filter(({ id }) => selectedCapabilityIds.has(id))
+        .map(({ id }) => id);
+    if (!selectedCapabilityIds.has(agentAccessCapabilityId))
+        return selectedActionIds;
+    const selectedClients = accessible
+        ? await selectClientsAccessibly(clientActions)
+        : await selectClients(clientActions);
+    return selectedClients === undefined
+        ? undefined
+        : [...selectedClients, ...selectedActionIds];
+};
+const setupCapabilities = (clientActions, componentActions) => [
+    ...(clientActions.length === 0
+        ? []
+        : [
+            {
+                id: agentAccessCapabilityId,
+                label: "Coding-agent access (MCP)",
+                hint: `${String(clientActions.length)} detected ${clientActions.length === 1 ? "agent" : "agents"}`,
+            },
+        ]),
+    ...componentActions.map((action) => ({
+        id: action.id,
+        label: `${action.label} (${actionModality(action)})`,
+        hint: `${action.operation} · ${action.target}`,
+    })),
+];
+const selectCapabilities = async (capabilities) => {
+    const selection = await multiselect({
+        ...promptStreams,
+        message: "What should REA set up?",
+        options: capabilities.map((capability) => ({
+            value: capability.id,
+            label: capability.label,
+            hint: capability.hint,
+        })),
+        required: false,
+        maxItems: Math.max(3, Math.min(capabilities.length, (process.stderr.rows ?? 24) - 8)),
+        showInstructions: true,
+    });
+    return isCancel(selection) ? undefined : selection;
+};
+const selectCapabilitiesAccessibly = async (capabilities) => {
+    const selected = [];
+    for (const capability of capabilities) {
+        const included = await confirm({
+            ...promptStreams,
+            message: `Set up ${capability.label}? ${capability.hint}`,
+            initialValue: false,
+            vertical: true,
+        });
+        if (isCancel(included))
+            return undefined;
+        if (included)
+            selected.push(capability.id);
+    }
+    return selected;
+};
+const selectClients = async (actions) => {
+    const selection = await multiselect({
+        ...promptStreams,
+        message: "Which agents should use REA?",
+        options: actions.map((action) => ({
+            value: action.id,
+            label: `${action.label} (detected)`,
+            hint: `${action.operation} · ${action.target}`,
+        })),
+        required: false,
+        maxItems: Math.max(3, Math.min(actions.length, (process.stderr.rows ?? 24) - 8)),
+        showInstructions: true,
+    });
+    return isCancel(selection) ? undefined : selection;
+};
+const selectClientsAccessibly = async (actions) => {
+    const selected = [];
+    for (const action of actions) {
+        const included = await confirm({
+            ...promptStreams,
+            message: `Configure ${action.label}? ${action.target}`,
+            initialValue: false,
+            vertical: true,
+        });
+        if (isCancel(included))
+            return undefined;
+        if (included)
+            selected.push(action.id);
+    }
+    return selected;
+};
+const renderValueIntroduction = () => {
+    writeLine("│  Understand local apps and binaries from your coding agent.");
+    writeLine("│");
+    writeLine("│  • Trace how a feature works with local evidence.");
+    writeLine("│  • Use the same analysis capabilities from REA's CLI and supported agents.");
+    writeLine("│  • Keep analyzed targets on this machine instead of uploading them to a hosted service.");
+};
+const renderDetectedSummary = (actions) => {
+    const clients = actions.filter(({ kind }) => kind === "configure_client");
+    writeLine("│");
+    if (clients.length === 0) {
+        writeLine("◆  No agent integrations need configuration");
+    }
+    else {
+        writeLine(`◆  Found ${String(clients.length)} supported ${clients.length === 1 ? "agent" : "agents"}`);
+        writeLine(`│  ${humanList(clients.map(({ label }) => label))}`);
+    }
+};
+const renderKeyboardHelp = (accessible) => {
+    writeLine("│");
+    writeLine(accessible
+        ? "│  Keys: Enter answer · Ctrl-C cancel"
+        : "│  Keys: ↑/↓ navigate · Space toggle · Enter confirm · Ctrl-C cancel");
+};
+const renderReadyCapabilities = (result, readyClients) => {
+    writeLine("◆  What you can do now");
+    const providers = readyProviders(result);
+    if (providers.length > 0)
+        writeLine(`│  Deep analysis: ${humanList(providers)}`);
+    if (readyClients.length > 0)
+        writeLine(`│  Agent access: ${humanList(readyClients)}`);
+    if (result.doctor.identity?.skill.state === "aligned")
+        writeLine("│  Guided reverse-engineering workflows: installed");
+    if (providers.length > 0)
+        writeLine("│  CLI: rea analyze /path/to/app");
+    const firstClient = readyClients[0];
+    if (firstClient !== undefined)
+        writeLine(`│  Try in ${firstClient}: "Use REA to explain how a feature works in /path/to/app."`);
+};
+const readyAgentClients = (result, changedClients) => {
+    const alignedClients = (result.doctor.identity?.registrations ?? [])
+        .filter(({ state }) => state === "aligned")
+        .map(({ client }) => clientDisplayNames.get(client) ?? client);
+    return [...new Set([...alignedClients, ...changedClients])];
+};
+const readyProviders = (result) => {
+    const providers = [
+        ...(result.doctor.hopperPath === undefined ? [] : ["Hopper"]),
+        ...(result.doctor.providerInspections ?? [])
+            .filter(({ available }) => available)
+            .map(({ id }) => displayProviderId(id)),
+    ];
+    return [...new Set(providers)];
+};
+const displayProviderId = (id) => id.length === 0 ? id : `${id[0]?.toUpperCase() ?? ""}${id.slice(1)}`;
+const actionModality = (action) => {
+    if (action.kind === "configure_client")
+        return "MCP";
+    if (action.kind === "install_hopper")
+        return "provider";
+    return "skill";
+};
+const humanList = (values) => {
+    if (values.length < 2)
+        return values[0] ?? "";
+    if (values.length === 2)
+        return `${values[0]} and ${values[1]}`;
+    return `${values.slice(0, -1).join(", ")}, and ${values.at(-1)}`;
+};
+const renderPreflight = (actions) => {
+    writeLine("│");
+    writeLine("◆  Ready to review");
+    for (const action of actions) {
+        writeLine("│");
+        writeLine(`│  ${action.operation.toUpperCase()}  ${action.label}`);
+        writeLine(`│          ${action.target}`);
+        if (action.backupPath !== undefined)
+            writeLine(`│          backup: ${action.backupPath}`);
+        for (const origin of action.networkOrigins ?? [])
+            writeLine(`│          network: ${origin}`);
+        if (action.integrity !== undefined)
+            writeLine(`│          integrity: ${action.integrity}`);
+        for (const command of action.commands ?? [])
+            writeLine(`│          command: ${command}`);
+        writeLine(`│          ${action.detail}`);
+        if (action.external)
+            writeLine("│          external software");
+    }
+    writeLine("│");
+    writeLine("│  REA will preserve unrelated configuration and will not install or upgrade Node.js, npm, Homebrew, Java, or Ghidra.");
+};
+const cancelledDecision = () => {
+    cancel("Setup cancelled. No changes were made.", promptStreams);
+    return {
+        approved: false,
+        selectedActionIds: [],
+    };
+};
+const writeLine = (line) => {
+    process.stderr.write(`${line}\n`);
+};

package/dist/config/environment.js

@@ -0,0 +1,107 @@
+import { z } from "zod";
+import { isAbsolute } from "node:path";
+import { ConfigurationError } from "../domain/errors.js";
+import { err, ok } from "../domain/result.js";
+import { analysisProviderSelectorSchema } from "../contracts/providerSelection.js";
+const environmentSchema = z
+    .object({
+    REA_ANALYSIS_PROVIDER: analysisProviderSelectorSchema.default("auto"),
+    GHIDRA_INSTALL_DIR: z
+        .string()
+        .min(1)
+        .refine(isAbsolute, "GHIDRA_INSTALL_DIR must be absolute")
+        .optional(),
+    JAVA_HOME: z
+        .string()
+        .min(1)
+        .refine(isAbsolute, "JAVA_HOME must be absolute")
+        .optional(),
+    REA_ILSPY_CMD_PATH: z
+        .string()
+        .min(1)
+        .refine(isAbsolute, "REA_ILSPY_CMD_PATH must be absolute")
+        .optional(),
+    HOPPER_LAUNCHER_PATH: z.string().min(1).optional(),
+    HOPPER_TARGET_PATH: z.string().min(1).optional(),
+    HOPPER_TARGET_KIND: z
+        .enum(["executable", "database"])
+        .default("executable"),
+    HOPPER_LOADER_ARGS_JSON: z.string().optional(),
+    REA_LOG_LEVEL: z
+        .enum(["trace", "debug", "info", "warn", "error", "fatal", "silent"])
+        .default("info"),
+    REA_PROCESS_CAPTURE_ENABLED: z.enum(["true", "false"]).default("false"),
+    REA_PROCESS_CAPTURE_AUTO_GRANT: z.enum(["true", "false"]).default("true"),
+    REA_ARTIFACT_NATIVE_MOUNT_ENABLED: z
+        .enum(["true", "false"])
+        .default("false"),
+    REA_ARTIFACT_INTEGRITY_CONTINUE_ENABLED: z
+        .enum(["true", "false"])
+        .default("false"),
+    REA_PROCESS_ALLOW_EXTERNAL_NETWORK: z
+        .enum(["true", "false"])
+        .default("false"),
+    REA_PROCESS_EXECUTABLE_ROOTS_JSON: z.string().default("[]"),
+    REA_PROCESS_WORKING_ROOTS_JSON: z.string().default("[]"),
+    REA_PROCESS_ALLOWED_ENV_JSON: z.string().default("[]"),
+    REA_EVIDENCE_ROOTS_JSON: z.string().default("[]"),
+    REA_INVESTIGATION_INPUT_ROOTS_JSON: z.string().default("[]"),
+    REA_ANALYSIS_SNAPSHOT_ROOTS_JSON: z.string().default("[]"),
+    REA_REFERENCE_ROOTS_JSON: z.string().default("[]"),
+    REA_REFERENCE_SECRET_PATTERNS_JSON: z.string().default("[]"),
+    REA_BROWSER_OBSERVE_ENABLED: z.enum(["true", "false"]).default("false"),
+    REA_BROWSER_CDP_ENDPOINTS_JSON: z.string().default("[]"),
+    REA_BROWSER_ALLOWED_ORIGINS_JSON: z.string().default("[]"),
+    REA_ELECTRON_OBSERVE_ENABLED: z.enum(["true", "false"]).default("false"),
+    REA_ELECTRON_CDP_ENDPOINTS_JSON: z.string().default("[]"),
+    REA_ELECTRON_FILE_ROOTS_JSON: z.string().default("[]"),
+    REA_JAVASCRIPT_REPLAY_ENABLED: z.enum(["true", "false"]).default("false"),
+    REA_JAVASCRIPT_REPLAY_ROOTS_JSON: z.string().default("[]"),
+    REA_JAVASCRIPT_REPLAY_NODE_PATH: z
+        .string()
+        .min(1)
+        .refine(isAbsolute, "REA_JAVASCRIPT_REPLAY_NODE_PATH must be absolute")
+        .default(process.execPath),
+    REA_JAVASCRIPT_REPLAY_BWRAP_PATH: z
+        .string()
+        .min(1)
+        .refine(isAbsolute, "REA_JAVASCRIPT_REPLAY_BWRAP_PATH must be absolute")
+        .default("/usr/bin/bwrap"),
+    REA_JAVASCRIPT_REPLAY_SYSTEMD_RUN_PATH: z
+        .string()
+        .min(1)
+        .refine(isAbsolute, "REA_JAVASCRIPT_REPLAY_SYSTEMD_RUN_PATH must be absolute")
+        .default("/usr/bin/systemd-run"),
+    REA_JAVASCRIPT_REPLAY_SYSTEMCTL_PATH: z
+        .string()
+        .min(1)
+        .refine(isAbsolute, "REA_JAVASCRIPT_REPLAY_SYSTEMCTL_PATH must be absolute")
+        .default("/usr/bin/systemctl"),
+    REA_JAVASCRIPT_REPLAY_SHELL_PATH: z
+        .string()
+        .min(1)
+        .refine(isAbsolute, "REA_JAVASCRIPT_REPLAY_SHELL_PATH must be absolute")
+        .default("/usr/bin/bash"),
+    REA_MANAGED_RUNTIME_ENABLED: z.enum(["true", "false"]).default("false"),
+    REA_MANAGED_RUNTIME_ROOTS_JSON: z.string().default("[]"),
+    REA_MANAGED_RUNTIME_EXECUTABLE_PATH: z
+        .string()
+        .min(1)
+        .refine(isAbsolute, "REA_MANAGED_RUNTIME_EXECUTABLE_PATH must be absolute")
+        .default("/usr/bin/dotnet"),
+    REA_PERMISSION_PROJECT_ROOT: z.string().min(1).optional(),
+    REA_PERMISSION_PROJECT_STORE: z.string().min(1).optional(),
+})
+    .refine((value) => (value.REA_PERMISSION_PROJECT_ROOT === undefined) ===
+    (value.REA_PERMISSION_PROJECT_STORE === undefined), {
+    message: "REA_PERMISSION_PROJECT_ROOT and REA_PERMISSION_PROJECT_STORE must be configured together",
+});
+export const parseEnvironment = (environment) => {
+    const parsed = environmentSchema.safeParse(environment);
+    if (!parsed.success) {
+        return err(new ConfigurationError("Invalid REA environment configuration", {
+            cause: parsed.error,
+        }));
+    }
+    return ok(parsed.data);
+};

package/dist/config/parseConfig.js

@@ -0,0 +1,228 @@
+import { isAbsolute } from "node:path";
+import { ConfigurationError } from "../domain/errors.js";
+import { err, ok } from "../domain/result.js";
+import { parseEnvironment } from "./environment.js";
+import { parseStringArray, parseBrowserArray, parseElectronFileRoots, parseLoaderArgs, } from "./parsers.js";
+import { filePolicy, permissionScope, administratorGrants, browserNetworkScope, } from "./permissions.js";
+import { browserEndpointSchema, browserOriginSchema, } from "../domain/browserObservation.js";
+const DEFAULT_HOPPER_LAUNCHER_PATH = "/Applications/Hopper Disassembler.app/Contents/MacOS/hopper";
+const defaultHopperLauncherPath = () => process.platform === "linux"
+    ? "/opt/hopper/bin/Hopper"
+    : DEFAULT_HOPPER_LAUNCHER_PATH;
+const parseAllArrays = (env) => {
+    const loaderArgs = parseLoaderArgs(env.HOPPER_LOADER_ARGS_JSON);
+    if (!loaderArgs.ok)
+        return loaderArgs;
+    const executableRoots = parseStringArray(env.REA_PROCESS_EXECUTABLE_ROOTS_JSON, "REA_PROCESS_EXECUTABLE_ROOTS_JSON");
+    if (!executableRoots.ok)
+        return executableRoots;
+    const workingRoots = parseStringArray(env.REA_PROCESS_WORKING_ROOTS_JSON, "REA_PROCESS_WORKING_ROOTS_JSON");
+    if (!workingRoots.ok)
+        return workingRoots;
+    const allowedEnvironment = parseStringArray(env.REA_PROCESS_ALLOWED_ENV_JSON, "REA_PROCESS_ALLOWED_ENV_JSON");
+    if (!allowedEnvironment.ok)
+        return allowedEnvironment;
+    const evidenceRoots = parseStringArray(env.REA_EVIDENCE_ROOTS_JSON, "REA_EVIDENCE_ROOTS_JSON");
+    if (!evidenceRoots.ok)
+        return evidenceRoots;
+    const investigationInputRoots = parseStringArray(env.REA_INVESTIGATION_INPUT_ROOTS_JSON, "REA_INVESTIGATION_INPUT_ROOTS_JSON");
+    if (!investigationInputRoots.ok)
+        return investigationInputRoots;
+    const analysisSnapshotRoots = parseStringArray(env.REA_ANALYSIS_SNAPSHOT_ROOTS_JSON, "REA_ANALYSIS_SNAPSHOT_ROOTS_JSON");
+    if (!analysisSnapshotRoots.ok)
+        return analysisSnapshotRoots;
+    const referenceRoots = parseStringArray(env.REA_REFERENCE_ROOTS_JSON, "REA_REFERENCE_ROOTS_JSON");
+    if (!referenceRoots.ok)
+        return referenceRoots;
+    const secretPatterns = parseStringArray(env.REA_REFERENCE_SECRET_PATTERNS_JSON, "REA_REFERENCE_SECRET_PATTERNS_JSON");
+    if (!secretPatterns.ok)
+        return secretPatterns;
+    const browserEndpoints = parseBrowserArray(env.REA_BROWSER_CDP_ENDPOINTS_JSON, "REA_BROWSER_CDP_ENDPOINTS_JSON", browserEndpointSchema, 16);
+    if (!browserEndpoints.ok)
+        return browserEndpoints;
+    const browserOrigins = parseBrowserArray(env.REA_BROWSER_ALLOWED_ORIGINS_JSON, "REA_BROWSER_ALLOWED_ORIGINS_JSON", browserOriginSchema, 32);
+    if (!browserOrigins.ok)
+        return browserOrigins;
+    const electronEndpoints = parseBrowserArray(env.REA_ELECTRON_CDP_ENDPOINTS_JSON, "REA_ELECTRON_CDP_ENDPOINTS_JSON", browserEndpointSchema, 16);
+    if (!electronEndpoints.ok)
+        return electronEndpoints;
+    const electronFileRoots = parseElectronFileRoots(env.REA_ELECTRON_FILE_ROOTS_JSON);
+    if (!electronFileRoots.ok)
+        return electronFileRoots;
+    const javascriptReplayRoots = parseAbsoluteRoots(env.REA_JAVASCRIPT_REPLAY_ROOTS_JSON, "REA_JAVASCRIPT_REPLAY_ROOTS_JSON");
+    if (!javascriptReplayRoots.ok)
+        return javascriptReplayRoots;
+    const managedRuntimeRoots = parseAbsoluteRoots(env.REA_MANAGED_RUNTIME_ROOTS_JSON, "REA_MANAGED_RUNTIME_ROOTS_JSON");
+    if (!managedRuntimeRoots.ok)
+        return managedRuntimeRoots;
+    return ok({
+        loaderArgs: loaderArgs.value,
+        executableRoots: executableRoots.value,
+        workingRoots: workingRoots.value,
+        allowedEnvironment: allowedEnvironment.value,
+        evidenceRoots: evidenceRoots.value,
+        investigationInputRoots: investigationInputRoots.value,
+        analysisSnapshotRoots: analysisSnapshotRoots.value,
+        referenceRoots: referenceRoots.value,
+        secretPatterns: secretPatterns.value,
+        browserEndpoints: browserEndpoints.value,
+        browserOrigins: browserOrigins.value,
+        electronEndpoints: electronEndpoints.value,
+        electronFileRoots: electronFileRoots.value,
+        javascriptReplayRoots: javascriptReplayRoots.value,
+        managedRuntimeRoots: managedRuntimeRoots.value,
+    });
+};
+const parseAbsoluteRoots = (value, name) => {
+    const parsed = parseStringArray(value, name);
+    if (!parsed.ok)
+        return parsed;
+    return parsed.value.some((root) => !isAbsolute(root))
+        ? err(new ConfigurationError(`${name} must encode absolute roots`))
+        : parsed;
+};
+const appendProcessCaptureCeiling = (ceilings, env, arrays) => {
+    if (env.REA_PROCESS_CAPTURE_ENABLED !== "true")
+        return;
+    ceilings.push(permissionScope("process_capture", arrays.workingRoots, {
+        executables: arrays.executableRoots,
+        environment_names: arrays.allowedEnvironment,
+        network: env.REA_PROCESS_ALLOW_EXTERNAL_NETWORK === "true" ? "external" : "none",
+    }));
+};
+const appendBrowserObservationCeiling = (ceilings, env, arrays) => {
+    if (env.REA_BROWSER_OBSERVE_ENABLED !== "true")
+        return;
+    ceilings.push(permissionScope("browser_observe", [], {
+        origins: [...arrays.browserEndpoints, ...arrays.browserOrigins],
+        network: browserNetworkScope(arrays.browserOrigins),
+    }));
+};
+const appendElectronObservationCeiling = (ceilings, env, arrays) => {
+    if (env.REA_ELECTRON_OBSERVE_ENABLED !== "true")
+        return;
+    ceilings.push(permissionScope("electron_observe", arrays.electronFileRoots, {
+        origins: arrays.electronEndpoints,
+        network: "loopback",
+    }));
+};
+const appendNativeMountCeiling = (ceilings, env) => {
+    if (env.REA_ARTIFACT_NATIVE_MOUNT_ENABLED === "true")
+        ceilings.push(permissionScope("native_mount", [], { mount: true }));
+};
+const appendJavaScriptReplayCeiling = (ceilings, env, arrays) => {
+    if (env.REA_JAVASCRIPT_REPLAY_ENABLED !== "true")
+        return;
+    ceilings.push(permissionScope("javascript_replay", arrays.javascriptReplayRoots, {
+        executables: [
+            env.REA_JAVASCRIPT_REPLAY_NODE_PATH,
+            env.REA_JAVASCRIPT_REPLAY_BWRAP_PATH,
+            env.REA_JAVASCRIPT_REPLAY_SYSTEMD_RUN_PATH,
+            env.REA_JAVASCRIPT_REPLAY_SYSTEMCTL_PATH,
+            env.REA_JAVASCRIPT_REPLAY_SHELL_PATH,
+        ],
+        network: "none",
+        mount: true,
+    }));
+};
+const appendManagedRuntimeCeiling = (ceilings, env, arrays) => {
+    if (env.REA_MANAGED_RUNTIME_ENABLED !== "true")
+        return;
+    ceilings.push(permissionScope("managed_runtime", arrays.managedRuntimeRoots, {
+        executables: [env.REA_MANAGED_RUNTIME_EXECUTABLE_PATH],
+        network: "none",
+    }));
+};
+const buildPermissionCeilings = (env, arrays) => {
+    const ceilings = [
+        permissionScope("evidence_read", arrays.evidenceRoots),
+        permissionScope("evidence_write", arrays.evidenceRoots),
+        permissionScope("investigation_input", arrays.investigationInputRoots),
+        permissionScope("investigation_workspace_read", arrays.evidenceRoots),
+        permissionScope("investigation_workspace_write", arrays.evidenceRoots),
+        permissionScope("snapshot_read", arrays.analysisSnapshotRoots),
+        permissionScope("snapshot_write", arrays.analysisSnapshotRoots),
+        permissionScope("artifact_extract", ["/"]),
+        permissionScope("reference_read", arrays.referenceRoots),
+    ];
+    appendProcessCaptureCeiling(ceilings, env, arrays);
+    appendBrowserObservationCeiling(ceilings, env, arrays);
+    appendElectronObservationCeiling(ceilings, env, arrays);
+    appendNativeMountCeiling(ceilings, env);
+    appendJavaScriptReplayCeiling(ceilings, env, arrays);
+    appendManagedRuntimeCeiling(ceilings, env, arrays);
+    return ceilings;
+};
+const buildAppConfig = (env, arrays, permissionCeilings) => ({
+    analysisProvider: env.REA_ANALYSIS_PROVIDER,
+    ghidraInstallDir: env.GHIDRA_INSTALL_DIR,
+    ghidraJavaHome: env.JAVA_HOME,
+    ilspyCmdPath: env.REA_ILSPY_CMD_PATH,
+    hopperLauncherPath: env.HOPPER_LAUNCHER_PATH ?? defaultHopperLauncherPath(),
+    hopperTargetPath: env.HOPPER_TARGET_PATH,
+    hopperTargetKind: env.HOPPER_TARGET_KIND,
+    hopperLoaderArgs: arrays.loaderArgs,
+    logLevel: env.REA_LOG_LEVEL,
+    processExecutionPolicy: {
+        enabled: env.REA_PROCESS_CAPTURE_ENABLED === "true",
+        executableRoots: arrays.executableRoots,
+        workingRoots: arrays.workingRoots,
+        allowedEnvironment: arrays.allowedEnvironment,
+        allowExternalNetwork: env.REA_PROCESS_ALLOW_EXTERNAL_NETWORK === "true",
+    },
+    artifactNativeMountEnabled: env.REA_ARTIFACT_NATIVE_MOUNT_ENABLED === "true",
+    artifactIntegrityContinueEnabled: env.REA_ARTIFACT_INTEGRITY_CONTINUE_ENABLED === "true",
+    evidenceFilePolicy: filePolicy(arrays.evidenceRoots),
+    investigationInputRoots: arrays.investigationInputRoots,
+    analysisSnapshotFilePolicy: filePolicy(arrays.analysisSnapshotRoots),
+    referenceSourcePolicy: {
+        roots: arrays.referenceRoots,
+        secretPatterns: arrays.secretPatterns,
+        maxBytes: 16 * 1024 * 1024,
+        maxEntries: 10_000,
+        maxDepth: 32,
+        maxPathBytes: 4_096,
+    },
+    browserObservationEnabled: env.REA_BROWSER_OBSERVE_ENABLED === "true",
+    browserCdpEndpoints: arrays.browserEndpoints,
+    browserAllowedOrigins: arrays.browserOrigins,
+    electronObservationEnabled: env.REA_ELECTRON_OBSERVE_ENABLED === "true",
+    electronCdpEndpoints: arrays.electronEndpoints,
+    electronFileRoots: arrays.electronFileRoots,
+    javascriptReplayPolicy: {
+        enabled: env.REA_JAVASCRIPT_REPLAY_ENABLED === "true",
+        roots: arrays.javascriptReplayRoots,
+        nodePath: env.REA_JAVASCRIPT_REPLAY_NODE_PATH,
+        bubblewrapPath: env.REA_JAVASCRIPT_REPLAY_BWRAP_PATH,
+        systemdRunPath: env.REA_JAVASCRIPT_REPLAY_SYSTEMD_RUN_PATH,
+        systemctlPath: env.REA_JAVASCRIPT_REPLAY_SYSTEMCTL_PATH,
+        shellPath: env.REA_JAVASCRIPT_REPLAY_SHELL_PATH,
+    },
+    managedRuntimePolicy: {
+        enabled: env.REA_MANAGED_RUNTIME_ENABLED === "true",
+        roots: arrays.managedRuntimeRoots,
+        executablePath: env.REA_MANAGED_RUNTIME_EXECUTABLE_PATH,
+    },
+    permissionCeilings,
+    administratorPermissionGrants: administratorGrants(env.REA_PROCESS_CAPTURE_AUTO_GRANT === "true"
+        ? permissionCeilings
+        : permissionCeilings.filter(({ capability }) => capability !== "process_capture")),
+    permissionProjectRoot: env.REA_PERMISSION_PROJECT_ROOT,
+    permissionProjectStore: env.REA_PERMISSION_PROJECT_STORE,
+});
+/**
+ * Parse provider and authority configuration once at the composition root.
+ * Explicit loader arguments override REA's header-derived defaults for a
+ * supported target, allowing callers to refine Hopper's loader behavior without
+ * bypassing REA's path and executable-header checks.
+ */
+export const parseConfig = (environment) => {
+    const envResult = parseEnvironment(environment);
+    if (!envResult.ok)
+        return envResult;
+    const arraysResult = parseAllArrays(envResult.value);
+    if (!arraysResult.ok)
+        return arraysResult;
+    const permissionCeilings = buildPermissionCeilings(envResult.value, arraysResult.value);
+    return ok(buildAppConfig(envResult.value, arraysResult.value, permissionCeilings));
+};