rea-agents 1.7.0 → 2.1.0

package/dist/domain/browserObservationSchemas.js

@@ -0,0 +1,286 @@
+import { z } from "zod";
+import { browserCompletenessSchema } from "./browserCompleteness.js";
+import { webTextArtifactSchema } from "./webContentArtifact.js";
+import { jsonShapeSchema } from "./jsonShape.js";
+const browserVersionSchema = z.object({
+    product: z.string(),
+    protocol_version: z.string(),
+    revision: z.string(),
+    user_agent: z.string(),
+    js_version: z.string(),
+});
+const browserTargetSchema = z.object({
+    target_id: z.string(),
+    type: z.string(),
+    title: z.string(),
+    url: z.string(),
+    origin: z.string(),
+    attached: z.boolean(),
+});
+/** Bounded and policy-filtered browser target discovery result. */
+export const browserTargetListSchema = z.object({
+    schema_version: z.literal(1),
+    browser: browserVersionSchema,
+    targets: z.object({
+        items: z.array(browserTargetSchema),
+        offset: z.number().int().min(0),
+        limit: z.number().int().min(1),
+        total: z.number().int().min(0),
+        next_offset: z.number().int().min(0).nullable(),
+        has_more: z.boolean(),
+    }),
+    excluded: z.object({
+        disallowed_origin: z.number().int().min(0),
+        unsupported_url: z.number().int().min(0),
+        non_page: z.number().int().min(0),
+    }),
+    limitations: z.array(z.string()),
+});
+const browserFrameSchema = z.object({
+    frame_id: z.string(),
+    parent_frame_id: z.string().nullable(),
+    url: z.string(),
+    origin: z.string().nullable(),
+});
+const browserDomNodeSchema = z.object({
+    index: z.number().int().min(0),
+    parent_index: z.number().int().min(-1),
+    node_type: z.number().int().min(0),
+    node_name: z.string(),
+    node_value_length: z.number().int().min(0),
+    attribute_names: z.array(z.string()),
+});
+const browserAxNodeSchema = z.object({
+    node_id: z.string(),
+    parent_id: z.string().nullable(),
+    role: z.string().nullable(),
+    name: z.string().nullable(),
+    description: z.string().nullable(),
+    ignored: z.boolean(),
+});
+const browserScriptSourceSchema = z.discriminatedUnion("included", [
+    z.object({ included: z.literal(false), reason: z.string() }),
+    z.object({
+        included: z.literal(true),
+        artifact: webTextArtifactSchema,
+    }),
+]);
+const browserResourceReconciliationSchema = z.discriminatedUnion("status", [
+    z.object({ status: z.literal("exact"), resource_key: z.string() }),
+    z.object({
+        status: z.literal("ambiguous"),
+        candidate_resource_keys: z.array(z.string()),
+    }),
+    z.object({
+        status: z.literal("unmatched"),
+        reason: z.literal("no_exact_sanitized_url"),
+    }),
+]);
+const browserScriptSchema = z.object({
+    script_key: z.string().regex(/^scr_[a-f0-9]{64}(?:_[0-9]+)?$/u),
+    frame_id: z.string().nullable().default(null),
+    url: z.string(),
+    origin: z.string().nullable(),
+    cdp_hash: z.string(),
+    length: z.number().int().min(0),
+    is_module: z.boolean(),
+    language: z.string().nullable(),
+    source_map_url: z.string().nullable(),
+    resource_reconciliation: browserResourceReconciliationSchema,
+    source: browserScriptSourceSchema,
+});
+const browserResourceSchema = z.object({
+    resource_key: z.string().regex(/^res_[a-f0-9]{64}$/u),
+    url: z.string(),
+    origin: z.string().nullable(),
+    type: z.string(),
+    mime_type: z.string(),
+    content_size: z.number().min(0).nullable(),
+});
+const browserNetworkRequestSchema = z.object({
+    request_id: z.string(),
+    url: z.string(),
+    origin: z.string().nullable(),
+    method: z.string(),
+    resource_type: z.string().nullable(),
+    status: z.number().nullable(),
+    mime_type: z.string().nullable(),
+    encoded_data_length: z.number().min(0).nullable(),
+    initiator: z.object({
+        type: z.string(),
+        url: z.string().nullable(),
+        line: z.number().int().min(0).nullable(),
+        column: z.number().int().min(0).nullable(),
+    }),
+    body_shapes: z.object({
+        status: z.enum([
+            "not_approved",
+            "included",
+            "partial",
+            "unavailable",
+            "truncated",
+        ]),
+        request: jsonShapeSchema.nullable(),
+        response: jsonShapeSchema.nullable(),
+    }),
+});
+const browserConsoleEventSchema = z.object({
+    type: z.string(),
+    timestamp: z.number(),
+    argument_types: z.array(z.string()),
+    url: z.string().nullable(),
+    line: z.number().int().min(0).nullable(),
+    column: z.number().int().min(0).nullable(),
+    text_capture: z.object({
+        status: z.enum(["not_approved", "included", "truncated"]),
+        values: z.array(z.object({
+            argument_index: z.number().int().min(0),
+            type: z.string(),
+            text: z.string(),
+        })),
+        retained_bytes: z.number().int().min(0),
+        truncated_values: z.number().int().min(0),
+    }),
+});
+const browserWebSocketEventSchema = z.object({
+    request_id: z.string(),
+    direction: z.enum(["sent", "received"]),
+    opcode: z.number().int().min(0),
+    payload_bytes: z.number().int().min(0),
+    payload_shape: z
+        .object({
+        format: z.enum(["json", "text", "binary"]),
+        json_shape: jsonShapeSchema.nullable(),
+        truncated: z.boolean(),
+    })
+        .nullable(),
+});
+const browserWorkerSchema = z.object({
+    target_id: z.string(),
+    type: z.string(),
+    url: z.string(),
+    origin: z.string().nullable(),
+    attached: z.boolean(),
+    opener_target_id: z.string().nullable().default(null),
+    parent_frame_id: z.string().nullable().default(null),
+});
+const browserCspSourceSchema = z.object({
+    kind: z.enum([
+        "keyword",
+        "scheme",
+        "approved_origin",
+        "external_origin",
+        "other",
+    ]),
+    value: z.string().nullable(),
+});
+const browserLinkMetadataSchema = z.object({
+    href: z.string().nullable(),
+    destination_scope: z.enum(["approved", "outside_policy", "unsupported"]),
+    rel: z.array(z.string()),
+    as: z.string().nullable(),
+    type: z.string().nullable(),
+    crossorigin: z.string().nullable(),
+});
+const browserAgentHintSchema = z.object({
+    mechanism: z.enum([
+        "link_rel",
+        "dom_link_rel",
+        "well_known_resource",
+        "response_header",
+    ]),
+    declaration: z.string(),
+    url: z.string().nullable(),
+    trust: z.literal("page-declared-untrusted"),
+});
+const browserSafeMetadataSchema = z.object({
+    responses: z.array(z.object({
+        request_id: z.string(),
+        url: z.string(),
+        mime_type: z.string().nullable(),
+        content_length: z.number().int().min(0).nullable(),
+        content_encoding: z.string().nullable(),
+        csp: z.object({
+            directives: z.array(z.object({
+                name: z.string(),
+                sources: z.array(browserCspSourceSchema),
+            })),
+            nonce_count: z.number().int().min(0),
+            hash_count: z.number().int().min(0),
+        }),
+        links: z.array(browserLinkMetadataSchema),
+        policies: z.object({
+            coop: z.string().nullable(),
+            coep: z.string().nullable(),
+            corp: z.string().nullable(),
+            referrer_policy: z.string().nullable(),
+            x_content_type_options: z.string().nullable(),
+            permissions_policy_features: z.array(z.string()),
+        }),
+    })),
+    dom_urls: z.array(z.object({
+        node_index: z.number().int().min(0),
+        attribute: z.enum(["href", "src", "action", "formaction", "poster"]),
+        url: z.string().nullable(),
+        destination_scope: z.enum(["approved", "outside_policy", "unsupported"]),
+    })),
+    agent_hints: z.array(browserAgentHintSchema),
+    excluded_dom_urls: z.number().int().min(0),
+    headers_allowlisted: z.literal(true),
+});
+/** Provider-neutral normalized result for one passive web-page observation. */
+export const webPageInspectionSchema = z.object({
+    schema_version: z.literal(2),
+    browser: browserVersionSchema,
+    target: browserTargetSchema,
+    capture_window: z.object({
+        started_at: z.iso.datetime(),
+        ended_at: z.iso.datetime(),
+        observation_ms: z.number().int().min(0),
+    }),
+    completeness: browserCompletenessSchema,
+    frames: z.array(browserFrameSchema),
+    dom: z.object({
+        total_nodes: z.number().int().min(0),
+        nodes: z.array(browserDomNodeSchema),
+    }),
+    accessibility: z.object({
+        total_nodes: z.number().int().min(0),
+        text_capture: z.object({
+            status: z.enum(["not_approved", "included", "truncated", "unavailable"]),
+            retained_bytes: z.number().int().min(0),
+            excluded_fields: z.number().int().min(0),
+            truncated_fields: z.number().int().min(0),
+        }),
+        nodes: z.array(browserAxNodeSchema),
+    }),
+    scripts: z.object({
+        total: z.number().int().min(0),
+        items: z.array(browserScriptSchema),
+    }),
+    resources: z.array(browserResourceSchema),
+    network: z.object({
+        requests: z.array(browserNetworkRequestSchema),
+        websocket_events: z.array(browserWebSocketEventSchema),
+        coverage_started_at: z.iso.datetime(),
+        prior_activity_available: z.literal(false),
+    }),
+    console: z.object({
+        events: z.array(browserConsoleEventSchema),
+        coverage_started_at: z.iso.datetime(),
+        prior_activity_available: z.literal(false),
+    }),
+    workers: z.array(browserWorkerSchema),
+    metadata: browserSafeMetadataSchema,
+    storage: z.object({
+        origin: z.string(),
+        usage_bytes: z.number().min(0).nullable(),
+        quota_bytes: z.number().min(0).nullable(),
+        local_storage_keys: z.array(z.string()),
+        session_storage_keys: z.array(z.string()),
+        indexed_db_names: z.array(z.string()),
+        cache_names: z.array(z.string()),
+        values_redacted: z.literal(true),
+    }),
+    limitations: z.array(z.string()),
+});

package/dist/domain/bundleComparison.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { z } from "zod";
-import { evidenceBundleSchema, parseEvidenceBundle, serializeEvidenceBundle, } from "./evidenceBundle.js";
+import { parseEvidenceBundle, serializeEvidenceBundle, } from "./evidenceBundle.js";
 const evidenceIdSchema = z.string().regex(/^ev_[a-f0-9]{64}$/u);
 const digestSchema = z.string().regex(/^[a-f0-9]{64}$/u);
 const classificationSchema = z.enum([
@@ -12,9 +12,9 @@ const classificationSchema = z.enum([
     "history_diverged",
 ]);
 /** Strict bounded input for canonical Evidence bundle comparison. */
-export const bundleComparisonInputSchema = z.object({
-    left: evidenceBundleSchema,
-    right: evidenceBundleSchema,
+export const bundleComparisonInputSchema = z.strictObject({
+    left_bundle_path: z.string().min(1).max(4_096),
+    right_bundle_path: z.string().min(1).max(4_096),
     record_pairs: z
         .array(z.object({
         left_evidence_id: evidenceIdSchema,

package/dist/domain/electronObservation.js

@@ -38,6 +38,7 @@ export const inspectElectronPageInputSchema = z
         max_dom_nodes: z.number().int().min(1).max(10_000).default(2_000),
         max_scripts: z.number().int().min(1).max(2_000).default(500),
         max_resources: z.number().int().min(1).max(10_000).default(2_000),
+        max_workers: z.number().int().min(1).max(5_000).default(500),
         max_script_source_bytes: z
             .number()
             .int()
@@ -56,6 +57,7 @@ export const inspectElectronPageInputSchema = z
         max_dom_nodes: 2_000,
         max_scripts: 500,
         max_resources: 2_000,
+        max_workers: 500,
         max_script_source_bytes: 1_024 * 1_024,
         max_total_script_source_bytes: 4 * 1_024 * 1_024,
     }),
@@ -143,6 +145,7 @@ export const electronPageInspectionSchema = z.object({
         total: z.number().int().min(0),
         items: z.array(z.object({
             script_key: z.string().regex(/^electron_script_[a-f0-9]{64}$/u),
+            frame_id: z.string().nullable().default(null),
             file_path: z.string(),
             cdp_hash: z.string(),
             length: z.number().int().min(0),
@@ -158,5 +161,15 @@ export const electronPageInspectionSchema = z.object({
         mime_type: z.string(),
         content_size: z.number().min(0).nullable(),
     })),
+    workers: z
+        .array(z.object({
+        target_id: z.string().min(1).max(256),
+        type: z.string().min(1).max(100),
+        file_path: z.string(),
+        attached: z.boolean(),
+        opener_target_id: z.string().min(1).max(256).nullable(),
+        parent_frame_id: z.string().min(1).max(256).nullable(),
+    }))
+        .default([]),
     limitations: z.array(z.string()),
 });

package/dist/domain/electronStaticAnalysis.js

@@ -0,0 +1,9 @@
+import { inspectElectronBrowserNode } from "./electronStaticAnalysisBrowser.js";
+import { inspectElectronIpcNode } from "./electronStaticAnalysisIpc.js";
+import { inspectElectronNativeNode } from "./electronStaticAnalysisNative.js";
+/** Collect Electron-specific syntax during the shared inert AST traversal. */
+export const inspectElectronStaticNode = (node, context) => {
+    inspectElectronBrowserNode(node, context);
+    inspectElectronIpcNode(node, context);
+    inspectElectronNativeNode(node, context);
+};

package/dist/domain/electronStaticAnalysisBrowser.js

@@ -0,0 +1,206 @@
+import * as t from "@babel/types";
+import { boundedExpression, collectContextBridgeMembers, electronStaticValue, objectProperty, } from "./electronStaticAnalysisValues.js";
+import { addLocatedFinding } from "./javascriptStaticAnalysisFindings.js";
+import { argumentNode, calleeName, compareCodePoints, propertyName, range, staticPath, staticPathResolutionContext, } from "./javascriptStaticAnalysisHelpers.js";
+const MAX_WEB_PREFERENCES = 64;
+/** Inspect BrowserWindow, contextBridge, and utility-process syntax. */
+export const inspectElectronBrowserNode = (node, context) => {
+    if (t.isNewExpression(node))
+        inspectBrowserWindow(node, context);
+    if (!t.isCallExpression(node))
+        return;
+    inspectContextBridge(node, context);
+    inspectUtilityProcess(node, context);
+};
+const inspectBrowserWindow = (node, context) => {
+    const name = calleeName(node.callee);
+    if (name !== "BrowserWindow" && !name.endsWith(".BrowserWindow"))
+        return;
+    const options = argumentNode(node.arguments[0]);
+    const collected = collectWindowOptions(context.source, options);
+    accountForStructure(context, collected.unknown, collected.omitted);
+    const finding = {
+        options_status: options === undefined
+            ? "missing"
+            : t.isObjectExpression(options)
+                ? "object-literal"
+                : "dynamic",
+        web_preferences_status: collected.status,
+        web_preferences: collected.preferences,
+        omitted_web_preferences: collected.omitted,
+        preload_path: collected.preloadPath,
+        preload_resolution_context: collected.preloadResolutionContext,
+        module_key: null,
+        location: range(node),
+    };
+    addLocatedFinding(context, {
+        collection: context.accumulator.browserWindows,
+        key: `electron-window\0${name}`,
+        node,
+        value: finding,
+    });
+};
+const collectWindowOptions = (source, options) => {
+    if (!t.isObjectExpression(options))
+        return {
+            status: options === undefined ? "missing" : "dynamic",
+            preferences: [],
+            preloadPath: null,
+            preloadResolutionContext: null,
+            unknown: options === undefined ? 0 : 1,
+            omitted: 0,
+        };
+    const property = objectProperty(options, "webPreferences");
+    if (property === undefined)
+        return {
+            status: "missing",
+            preferences: [],
+            preloadPath: null,
+            preloadResolutionContext: null,
+            unknown: 0,
+            omitted: 0,
+        };
+    if (!t.isObjectExpression(property.value))
+        return {
+            status: "dynamic",
+            preferences: [],
+            preloadPath: null,
+            preloadResolutionContext: null,
+            unknown: 1,
+            omitted: 0,
+        };
+    return collectWebPreferences(source, property.value);
+};
+const collectWebPreferences = (source, object) => {
+    const preferences = [];
+    let unknown = 0;
+    let preloadPath = null;
+    let preloadResolutionContext = null;
+    for (const property of object.properties) {
+        if (t.isSpreadElement(property)) {
+            unknown += 1;
+            preferences.push({
+                name: `[spread@${String(property.start ?? -1)}]`,
+                value: electronStaticValue(source, property.argument),
+            });
+            continue;
+        }
+        const name = propertyName(property.key);
+        if (name === "" || property.computed) {
+            unknown += 1;
+            preferences.push({
+                name: `[dynamic@${String(property.start ?? -1)}]`,
+                value: electronStaticValue(source, property),
+            });
+            continue;
+        }
+        if (t.isObjectMethod(property)) {
+            unknown += 1;
+            preferences.push({
+                name,
+                value: electronStaticValue(source, property),
+            });
+            continue;
+        }
+        const path = name === "preload" ? staticPath(property.value) : undefined;
+        if (path !== undefined) {
+            preloadPath = path;
+            preloadResolutionContext = staticPathResolutionContext(property.value);
+        }
+        const value = path === undefined
+            ? electronStaticValue(source, property.value)
+            : { status: "literal", value: path, expression: null };
+        if (value.status === "dynamic")
+            unknown += 1;
+        preferences.push({ name, value });
+    }
+    preferences.sort((left, right) => compareCodePoints(left.name, right.name));
+    return {
+        status: "object-literal",
+        preferences: preferences.slice(0, MAX_WEB_PREFERENCES),
+        preloadPath,
+        preloadResolutionContext,
+        unknown,
+        omitted: Math.max(0, preferences.length - MAX_WEB_PREFERENCES),
+    };
+};
+const inspectContextBridge = (node, context) => {
+    const name = calleeName(node.callee);
+    const main = name === "contextBridge.exposeInMainWorld" ||
+        name.endsWith(".contextBridge.exposeInMainWorld");
+    const isolated = name === "contextBridge.exposeInIsolatedWorld" ||
+        name.endsWith(".contextBridge.exposeInIsolatedWorld");
+    if (!main && !isolated)
+        return;
+    const keyNode = argumentNode(node.arguments[isolated ? 1 : 0]);
+    const apiNode = argumentNode(node.arguments[isolated ? 2 : 1]);
+    const key = electronStaticValue(context.source, keyNode);
+    const api = collectContextBridgeMembers(apiNode);
+    const worldId = isolated
+        ? electronStaticValue(context.source, argumentNode(node.arguments[0]))
+        : null;
+    const unknown = (key.status === "dynamic" ? 1 : 0) +
+        (worldId?.status === "dynamic" ? 1 : 0) +
+        api.unknown;
+    accountForStructure(context, unknown, api.omitted);
+    const finding = {
+        world: isolated ? "isolated" : "main",
+        world_id: worldId,
+        api_key: key.status === "literal" && typeof key.value === "string"
+            ? key.value
+            : null,
+        api_key_expression: key.status === "dynamic" ? key.expression : null,
+        api_status: api.status,
+        members: api.members,
+        unknown_members: api.unknown,
+        omitted_members: api.omitted,
+        module_key: null,
+        location: range(node),
+    };
+    addLocatedFinding(context, {
+        collection: context.accumulator.contextBridgeApis,
+        key: `context-bridge\0${isolated ? "isolated" : "main"}\0${finding.api_key ?? finding.api_key_expression ?? "[missing]"}`,
+        node,
+        value: finding,
+    });
+};
+const inspectUtilityProcess = (node, context) => {
+    const name = calleeName(node.callee);
+    if (name !== "utilityProcess.fork" && !name.endsWith(".utilityProcess.fork"))
+        return;
+    const moduleNode = argumentNode(node.arguments[0]);
+    const modulePath = moduleNode === undefined ? undefined : staticPath(moduleNode);
+    const moduleResolutionContext = modulePath === undefined || moduleNode === undefined
+        ? null
+        : staticPathResolutionContext(moduleNode);
+    const options = argumentNode(node.arguments[2]);
+    const serviceName = t.isObjectExpression(options) &&
+        objectProperty(options, "serviceName") !== undefined
+        ? staticPath(objectProperty(options, "serviceName")?.value ?? options)
+        : undefined;
+    if (modulePath === undefined)
+        context.accumulator.unknownFindings += 1;
+    const finding = {
+        module_path: modulePath ?? null,
+        module_resolution_context: moduleResolutionContext,
+        module_expression: modulePath === undefined
+            ? boundedExpression(context.source, moduleNode)
+            : null,
+        service_name: serviceName ?? null,
+        module_key: null,
+        location: range(node),
+    };
+    addLocatedFinding(context, {
+        collection: context.accumulator.utilityProcesses,
+        key: `electron-utility\0${modulePath ?? finding.module_expression ?? "[missing]"}`,
+        node,
+        value: finding,
+    });
+};
+const accountForStructure = (context, unknown, omitted) => {
+    context.accumulator.unknownFindings += unknown;
+    if (omitted === 0)
+        return;
+    context.accumulator.structuralTruncation = true;
+    context.accumulator.droppedFindings += omitted;
+};