rea-agents 2.0.0 → 2.2.0

package/README.md

@@ -30,23 +30,24 @@
 
 See a feature in an app that you want in your own product? Give the app to your agent—even without its source code. With REA, the agent can investigate the feature, explain how it works, show its evidence, and build a version adapted to your stack and requirements.
 
-REA gives agents one consistent way to investigate software. Today that includes deep native analysis and function dossiers through Hopper or bring-your-own Ghidra on Linux, execution-free managed PE/CLI triage, reproducible Evidence v2 records, controlled process capture, passive website and Electron observation, bounded JavaScript/source-map reconstruction, and a versioned domain graph for connecting JavaScript application layers without confusing static inference with runtime observation. The longer-term toolkit extends the same agent workflow to APIs, protocols, mobile artifacts, firmware, richer runtime behavior, and differences between versions.
+REA gives agents one consistent way to investigate software. Today that includes deep native analysis and function dossiers through Hopper or bring-your-own Ghidra on Linux, plus an experimental Windows x64 Ghidra P0 for approved native PE applications; execution-free managed PE/CLI triage; reproducible Evidence v2 records; controlled process capture; passive website and Electron observation; bounded JavaScript/source-map reconstruction; and a versioned domain graph for connecting JavaScript application layers without confusing static inference with runtime observation. The longer-term toolkit extends the same agent workflow to APIs, protocols, mobile artifacts, firmware, richer runtime behavior, and differences between versions.
 
 Reverse engineering normally makes the operator choose a tool, learn its API, move evidence between programs, and decide what to inspect next. REA gives that work to the agent through commands, skills, structured results, and repeatable investigation workflows.
 
 ## Just ask your agent
 
-Install the REA skill:
+Run setup once. Agent integration installs an aligned MCP registration and the
+bundled routing skill together:
 
 ```bash
-npx skills add morluto/rea
+npx rea-agents setup
 ```
 
 Then ask:
 
 ```text
-Use REA to understand how search works in the Notes app, show me the
-evidence, and build a similar feature for my project.
+Understand how search works in the Notes app, show me the evidence, and build a
+similar feature for my project.
 ```
 
 Notes is only an example. Name any app you want to understand, or ask the agent to start with an overview.
@@ -85,17 +86,41 @@ REA shows how it reached its conclusions. It does not claim to recover original
 
 ## Quick start
 
-### Install the CLI — recommended
+### Run setup — recommended
 
 ```bash
-npm install --global rea-agents
-rea setup
+npx rea-agents setup
 ```
 
-Installing the CLI does not update Homebrew, Node.js, npm, Hopper, or agent configuration. `rea setup` detects what is already present, prints every proposed change, and asks before applying it.
+The npm package-runner prompt, when shown, approves downloading REA for this
+invocation; it does not approve any setup changes. The REA wizard separately
+shows its complete plan and asks before applying it. Setup does not update
+Homebrew, Node.js, or npm. `npx rea-agents setup` opens with the work it
+enables: investigate local apps from an agent, recover evidence through a
+deep-analysis provider, and reuse REA's guided workflow. It summarizes the
+detected agents, then asks which capabilities to set up: agent integration
+(MCP plus the matching guided workflow) and—when needed—the Hopper provider.
+Nothing is preselected. Choosing agent integration opens a second empty
+checklist for the specific detected agents that should receive a registration.
+
+REA keeps the journey inline so its history remains in the terminal. Selecting
+a capability does not select every detected target or authorize a change.
+Before anything changes, REA validates existing configuration, prints exact
+paths and external effects, and asks for final approval with **No** as the
+default. The screen keeps the available keys visible while you choose; Ctrl-C
+and declining leave the system unchanged.
 
 REA detects Claude Code, Claude Desktop, Codex, Cursor, Gemini CLI, Windsurf, and Devin. It configures the first six when detected; Devin is reported but left unchanged because it has no documented local MCP configuration boundary. Registrations are additive, backup-first, and read back after writing. You can safely rerun setup.
 
+Use `rea setup --dry-run` to inspect the plan, repeat `--client` to select exact
+agents, and `--accessible` for sequential vertical prompts. Machine output
+remains available through `--json`; prompt UI and progress go to stderr.
+
+After a successful setup, REA reports the capabilities now ready to use and a
+concrete next step, such as restarting a configured agent before asking it to
+investigate an application. It does not claim an integration or provider is
+ready unless setup and its final diagnostic check verified it.
+
 An optional curl wrapper installs the same CLI package and starts setup only when a terminal is available:
 
 ```bash
@@ -107,19 +132,21 @@ Pass installer options after `bash -s --`, for example `--dry-run`, `--no-setup`
 ### With an agent — recommended
 
 ```bash
-npx skills add morluto/rea
+npx rea-agents setup
 ```
 
-Ask your agent to set up REA. It will check your supported host, explain anything it needs to install, ask for approval, and guide you through system prompts. After setup, restart the agent if it asks you to load the full REA toolset.
+Choose Agent Integration in the reviewed setup plan. REA installs the pinned MCP
+registration and its matching routing skill as one transaction. After setup,
+restart the configured agent so it loads the aligned integration.
 
 Review the setup plan, approve it if appropriate, then describe the app or feature you want to understand. Hopper can run in its free demo mode; if it shows a first-run prompt, choose the demo or enter an existing license.
 
 ### From Terminal — no installation
 
 ```bash
-npx -y rea-agents setup
-npx -y rea-agents doctor
-npx -y rea-agents analyze /Applications/Notes.app
+npx rea-agents setup
+npx -y rea-agents@latest doctor
+npx -y rea-agents@latest analyze /Applications/Notes.app
 ```
 
 Review the setup plan before confirming it. Restart a configured agent so it loads REA.
@@ -146,10 +173,16 @@ an unrelated global package.
 
 Choose either the no-install commands or the global installation. You do not need both.
 
+`npm install rea-agents` without `--global` installs `rea` only into the
+current project's `node_modules/.bin`; it does not add `rea` to your shell
+`PATH`. Use the `npx` commands above for one-off runs or `--global` when you
+want a shell-visible `rea` command.
+
 ### Requirements
 
 - macOS 12 or newer
 - Ubuntu 24.04+, Fedora 41+, or 64-bit Arch Linux
+- Windows x64 for the experimental, Ghidra-only native PE P0 boundary
 - Node.js 22.19+ or 24.11+ (including newer releases)
 - npm; REA does not require or install a particular npm version
 
@@ -158,7 +191,7 @@ Deep binary operations use [Hopper](https://www.hopperapp.com/), a separate desk
 If something is not working, run:
 
 ```bash
-npx -y rea-agents doctor
+npx -y rea-agents@latest doctor
 ```
 
 `rea doctor --json` is read-only and distinguishes unsupported hosts, missing dependencies, a missing local analysis engine, configuration drift, and healthy checks. Paid-license activation is optional: on Linux, REA runs the supported Hopper demo build on a private Xvfb display and selects Hopper's offered demo mode for each analysis session.
@@ -188,7 +221,7 @@ REA defaults `HOPPER_LAUNCHER_PATH` to `/Applications/Hopper Disassembler.app/Co
 
 ### Ghidra read-only analysis provider
 
-The current Ghidra adapter supports the exact official Ghidra 12.1.2 release on Linux x64 with a 64-bit full JDK 21. Download and extract those projects yourself, then configure absolute paths:
+The Ghidra adapter supports the exact official Ghidra 12.1.2 release with a 64-bit full JDK 21 on Linux x64. It also provides an experimental Windows x64 P0 limited to approved native x86-64 PE applications. Download and extract those projects yourself, then configure absolute paths:
 
 ```bash
 export GHIDRA_INSTALL_DIR=/absolute/path/to/ghidra_12.1.2_PUBLIC
@@ -200,7 +233,9 @@ rea providers --json
 
 Doctor distinguishes missing configuration, a bad installation root, the wrong Ghidra or Java version, a JRE without `javac`, a missing `support/analyzeHeadless`, and an unsupported platform or architecture. Approved setup only copies the verified non-secret paths into detected MCP registrations; it does not modify the Ghidra installation or install/download Ghidra or Java.
 
-REA loads its packaged Java `HeadlessScript` with `-scriptPath`, imports the target into a mode-0700 temporary project, enables `-readOnly` and `-deleteProject`, caps auto-analysis at 300 seconds with two CPUs and a 2 GiB Java heap, and authenticates every request over a mode-0600 Unix socket. It isolates Ghidra home/cache/config/temp paths and removes the owned project, socket, process group, and runtime root on close, cancellation, timeout, or process exit.
+On Windows, set the same variables in PowerShell and run `rea doctor --json`; automated `rea setup` and Hopper installation remain unavailable. The P0 target boundary rejects DLLs, managed PE files, non-x86-64 images, mutable/hostile inputs, and non-PE formats. See the [Windows Ghidra P0 operations guide](docs/windows-ghidra-p0.md) for registration, exact limitations, CI evidence, and acceptance gates.
+
+REA loads its packaged Java `HeadlessScript` with `-scriptPath`, copies and digest-verifies the target in an ephemeral runtime, enables `-readOnly` and `-deleteProject`, caps auto-analysis at 300 seconds with two CPUs and a 2 GiB Java heap, and authenticates every request. Linux uses a mode-0600 Unix socket. Windows P0 uses token-authenticated IPv4 loopback and a token-free endpoint record because Node path-based IPC does not connect to Java AF_UNIX sockets on Windows. The bridge verifies Ghidra's imported-byte SHA-256 before serving any operation.
 
 The Ghidra adapter declares 18 direct and enhanced operations. Its ten inventory operations are `list_documents`, `list_procedures`, `list_strings`, `list_names`, `list_segments`, `address_name`, `procedure_address`, `resolve_containing_procedure`, `search_procedures`, and `search_strings`. It also admits `procedure_info`, `procedure_pseudo_code`, `procedure_assembly`, `procedure_callers`, `procedure_callees`, `procedure_references`, `xrefs`, and `analyze_function`. These capabilities enable the shared Swift/Objective-C inventory workflows, `binary_overview`, `batch_decompile`, `get_call_graph`, `find_xrefs_to_name`, `trace_feature`, and complete function dossiers. Default-space addresses are lowercase `0x` hexadecimal. Other spaces, including `EXTERNAL`, use `<percent-encoded-space>:0x<hex>`. Symbol results identify primary, dynamic, external, type, and source facts; procedures distinguish external functions and thunks; strings identify charset, missing-terminator state, byte length, and value truncation; memory-block ends are exclusive and permissions come directly from Ghidra.
 
@@ -208,6 +243,8 @@ The bridge serves operations only after auto-analysis completes. Each Program ow
 
 `npm run verify:ghidra` compiles source-owned x86-64 debug and stripped ELF, AArch64 ELF, x86-64 PE, and x86-64 Mach-O fixtures. Against real Ghidra 12.1.2 it validates every admitted operation, direct and indirect calls, imports/exports/thunks, typed references, strings/xrefs, multi-block CFG, cancellation, deadlines, concurrency, malformed inputs, and complete process/project cleanup. Set `REA_CC`, `REA_CLANG`, or `REA_LLD_LINK` only when the corresponding compiler command is not on `PATH`.
 
+`npm run verify:ghidra:windows` uses a deterministic source-owned native x86-64 PE application and requires all 18 operations, target/snapshot/import digest linkage, authenticated loopback transport, and cleanup on a controlled Windows x64 Ghidra 12.1.2 runner. This proof does not establish Job Object ownership, private DACLs, or reparse-point-safe authority.
+
 To remove only REA-owned MCP registrations and the managed skill:
 
 ```bash
@@ -331,14 +368,14 @@ REA handles the app analysis in steps 1–5. The agent performs step 6 with its
 | Managed PE/CLI            |     8 | PE/CLI identity, metadata members, CIL hashes, P/Invoke/native-boundary declarations and verification, application-graph projection, decompiler reconstruction import, token remapping, runtime-correlation plans, and version comparison |
 | Browser observation       |     8 | exact-origin CDP capture, bundle and source-map analysis, WebMCP discovery, session timelines, capture diff, and visual evidence                                                                                                          |
 | Electron analysis         |     4 | passive root-confined observation, bounded static application mapping, and evidence-backed static/runtime reconciliation                                                                                                                  |
-| Application workflows     |     3 | bounded cross-layer traces, unique-only version matching, and approved Linux-isolated extracted-module replay                                                                                                                             |
+| Application workflows     |     7 | bounded cross-layer traces, unique-only version matching, approved Linux-isolated extracted-module replay, managed-runtime characterization, and reconstruction coverage closure                                                          |
 | Workspace and observation |    18 | target lifecycle, Evidence v2 bundles, process/artifact/function comparison, evidence-linked residual-unknown lifecycle                                                                                                                   |
 
 The public interface describes what the agent is trying to learn. Providers decide how to answer. macOS utilities handle common semantic inspection without launching Hopper; Hopper handles deeper native analysis; the process harness implements controlled behavioral capture.
 
 ## Current status
 
-REA is already useful for native application, browser, and Electron investigation on supported macOS and Linux hosts:
+REA is already useful for native application, browser, and Electron investigation on supported macOS and Linux hosts, plus the bounded Windows Ghidra P0 described above:
 
 - Open Mach-O, ELF, PE, `.app`, ZIP, APK, IPA, ASAR, plist, JavaScript, source-map, and generic analysis-database targets; Hopper remains the only adapter that accepts legacy `.hop` databases.
 - Discover deep-analysis candidates without starting them, choose deterministically, and retain one immutable provider/profile binding until an explicit switch or close; provider failures never trigger transparent fallback.
@@ -348,7 +385,11 @@ REA is already useful for native application, browser, and Electron investigatio
 - Reconstruct bounded static package, entrypoint, Webpack/Rspack module, import, worker, endpoint, storage, source-map, BrowserWindow, preload, contextBridge, IPC, utility-process, and native-add-on structure from an approved local directory or ASAR through `analyze_javascript_application` or `rea analyze-javascript-application`. The AST-only [application service](docs/javascript-artifact-reconstruction.md) never executes bootstrap code, pairs only unique exact literal IPC channels, and reports dynamic or ambiguous channels as unresolved.
 - Reconcile that static graph with existing passive web or Electron Evidence through `reconcile_javascript_runtime` or `rea reconcile-javascript-runtime`. Exact captured bytes outrank caller-declared file/URL mappings; target, frame, script, worker, cache, and asset ambiguity stays explicit, source-map authority stays separate, and a module resident in an observed bundle is never reported as executed. See [JavaScript static/runtime reconciliation](docs/javascript-runtime-reconciliation.md).
 - Trace a literal route, string, API, IPC channel, module, or native export through authenticated application Evidence with explicit traversal bounds, then hand exact native artifact digests and requested exports to retained Ghidra or Hopper Evidence without automatic provider switching. Compare application versions using unique-only digest, source-map, structural, and semantic tiers; duplicate, incomplete, and truncated matches stay unknown. See [cross-layer JavaScript application workflows](docs/javascript-application-workflows.md).
-- Classify PE/CLI managed artifacts with `inspect_managed_artifact` / `rea inspect-managed-artifact`, inspect bounded metadata members, signatures, method-body CIL hashes, exception regions, call edges, and field-access anchors with `inspect_managed_members` / `rea inspect-managed-members`, inventory declared ModuleRef/ImplMap/PInvoke and non-IL method boundary indicators with `inspect_managed_native_boundaries` / `rea inspect-managed-native-boundaries`, then compare two authenticated member observations with `compare_managed_members` / `rea compare-managed-members`. `verify_managed_native_boundaries` / `rea verify-managed-native-boundaries` checks managed P/Invoke declarations against authenticated native export or function Evidence while keeping verified, inferred, contradicted, and unresolved states distinct. The comparison remaps build-local tokens using unique CIL/signature and structural method-shape tiers, never names alone. `project_managed_application_graph` / `rea project-managed-application-graph` projects authenticated managed artifact/member/native-boundary Evidence into the existing application graph for cross-layer feature tracing. `import_managed_reconstruction` / `rea import-managed-reconstruction` admits user-supplied decompiler C#/IL/pseudocode as analyst inference only after exact artifact SHA-256, MVID, signature, and normalized IL commitments match. Separately, `plan_managed_runtime_correlation` / `rea plan-managed-runtime-correlation` can admit a default-disabled, permission-gated runtime-correlation plan locked to the same build evidence. These paths never load the assembly, resolve CLR dependencies, execute target code, run a decompiler, or translate managed tokens into native addresses; native-body bridge mapping and an actual runtime executor remain future managed-code contracts.
+- Classify PE/CLI managed artifacts with `inspect_managed_artifact` / `rea inspect-managed-artifact`, inspect bounded metadata members, signatures, raw CIL hashes, limited decoded-instruction-tuple v1 hashes, separately reported exception regions, call edges, and field-access anchors with `inspect_managed_members` / `rea inspect-managed-members`, inventory declared ModuleRef/ImplMap/PInvoke and non-IL method boundary indicators with `inspect_managed_native_boundaries` / `rea inspect-managed-native-boundaries`, then compare two authenticated member observations with `compare_managed_members` / `rea compare-managed-members`. `verify_managed_native_boundaries` / `rea verify-managed-native-boundaries` checks managed P/Invoke declarations against authenticated native export or function Evidence while keeping verified, inferred, contradicted, and unresolved states distinct. The comparison treats build-local tokens as build-local and uses unique decoded-CIL/signature and structural method-shape tiers, never names alone; the v1 tuple hash does not itself resolve tokens or fully commit control flow. `project_managed_application_graph` / `rea project-managed-application-graph` projects authenticated managed artifact/member/native-boundary Evidence into the existing application graph for cross-layer feature tracing. `import_managed_reconstruction` / `rea import-managed-reconstruction` admits user-supplied decompiler C#/IL/pseudocode as analyst inference only after exact artifact SHA-256, MVID, signature, and the shipped v1 decoded-IL commitment match. Separately, `plan_managed_runtime_correlation` / `rea plan-managed-runtime-correlation` can admit a default-disabled, permission-gated runtime-correlation plan locked to the same build evidence. These paths never load the assembly, resolve CLR dependencies, execute target code, run a decompiler, or translate managed tokens into native addresses; full normalized-CIL v2 semantics, native-body bridge mapping, and an actual runtime executor remain future managed-code contracts.
+- Configure `REA_ILSPY_CMD_PATH=/absolute/path/to/ilspycmd` only when you want
+  doctor and `verify:managed` to inspect a bring-your-own ILSpy command as a
+  real reconstruction oracle. REA does not install ILSpy and does not treat
+  decompiler text as canonical metadata or CIL observation.
 - Traverse content-addressed artifact graphs without extraction; on macOS, read-only DMG traversal additionally requires `native_mount_approved: true` and `REA_ARTIFACT_NATIVE_MOUNT_ENABLED=true`. Materialize only approved occurrences into absent output roots.
 - Build bounded function dossiers with pseudocode, assembly, CFG edges, comments, calls, references, strings, and names.
 - Search and trace features across symbols, strings, metadata, references, and call paths.
@@ -418,17 +459,28 @@ Setup detects Claude Code, Claude Desktop, Codex, Cursor, Gemini CLI, Windsurf,
 
 ### Manual MCP configuration
 
+<!-- x-release-please-start-version -->
+
 ```json
 {
   "mcpServers": {
     "rea": {
       "command": "npx",
-      "args": ["-y", "rea-agents", "mcp"]
+      "args": ["-y", "rea-agents@2.2.0", "mcp"]
     }
   }
 }
 ```
 
+<!-- x-release-please-end -->
+
+Persistent registrations should use one exact package version. `rea setup`
+maintains that pin, upgrades the bundled skill at the same time, and gives Codex
+a 30-second startup allowance for a cold package-runner start. An interactive
+`rea upgrade` opens the updated setup plan after installing the new executable;
+structured or non-interactive upgrades tell you to run that sync explicitly.
+Restart clients whose approved registration changed.
+
 MCP clients that support prompts can also discover six ordered investigation
 workflows through `prompts/list`. Their optional identifier arguments use the
 current session for bounded `completion/complete` suggestions; see
@@ -464,20 +516,20 @@ The CLI and MCP server use the same application workflows and evidence contracts
 The agent workflow above is the easiest way to use REA. For a one-off overview from the Terminal:
 
 ```bash
-npx -y rea-agents analyze /Applications/Notes.app
-npx -y rea-agents inspect /Applications/Notes.app
-npx -y rea-agents inspect /Applications/Notes.app --detail detailed --limit 20
-npx -y rea-agents search /Applications/Notes.app "offline"
-npx -y rea-agents function /Applications/Notes.app 0x1000
-npx -y rea-agents xrefs /Applications/Notes.app 0x1000
-npx -y rea-agents trace /Applications/Notes.app "offline"
-npx -y rea-agents compare /absolute/path/to/left-evidence.json /absolute/path/to/right-evidence.json
-npx -y rea-agents investigate-versions /path/to/v1 /path/to/v2 /absolute/path/to/evidence/releases.json --yes
-npx -y rea-agents capabilities
-npx -y rea-agents providers
+npx -y rea-agents@latest analyze /Applications/Notes.app
+npx -y rea-agents@latest inspect /Applications/Notes.app
+npx -y rea-agents@latest inspect /Applications/Notes.app --detail detailed --limit 20
+npx -y rea-agents@latest search /Applications/Notes.app "offline"
+npx -y rea-agents@latest function /Applications/Notes.app 0x1000
+npx -y rea-agents@latest xrefs /Applications/Notes.app 0x1000
+npx -y rea-agents@latest trace /Applications/Notes.app "offline"
+npx -y rea-agents@latest compare /absolute/path/to/left-evidence.json /absolute/path/to/right-evidence.json
+npx -y rea-agents@latest investigate-versions /path/to/v1 /path/to/v2 /absolute/path/to/evidence/releases.json --yes
+npx -y rea-agents@latest capabilities
+npx -y rea-agents@latest providers
 ```
 
-Run `npx -y rea-agents --help` for direct decompilation, bounded search and
+Run `npx -y rea-agents@latest --help` for direct decompilation, bounded search and
 other options. `analyze` and `inspect` share the same overview workflow;
 `function`, `xrefs`, and `trace` return the same Evidence v2 envelopes as MCP.
 
@@ -566,6 +618,10 @@ environment allowlist in `REA_PROCESS_ALLOWED_ENV_JSON`. Because the current PTY
 adapter uses host networking, it also requires
 `REA_PROCESS_ALLOW_EXTERNAL_NETWORK=true`.
 
+Set `REA_PROCESS_CAPTURE_AUTO_GRANT=false` to configure those process-capture
+limits as a ceiling without implicitly granting them. This mode remains
+fail-closed until a narrower grant is established.
+
 Capture a scenario or compare two saved Process Capture v4 Evidence records:
 
 ```bash
@@ -579,18 +635,22 @@ first terminal, interaction, exit, filesystem, protocol, process, or shim
 divergence. See [Process Capture v4](docs/process-capture.md) for scenario
 fields, command-shim replay, checkpoint triggers, limits, and safety behavior.
 
-If the native PTY backend is unavailable, install Xcode command-line tools and
-run `npm run rebuild:native`. Linux source builds require Python, `make`, and a
-C++ toolchain. Compatible packaged binaries do not require this rebuild.
+REA installs a prebuilt PTY backend for supported macOS, Linux, and Windows
+architectures. If the capability check reports that the backend is unavailable,
+reinstall REA for the current platform and architecture.
 
 ASAR inventory verifies Electron integrity metadata for both archive entries
 and `.asar.unpacked` companion files. Integrity failures identify the logical
 path, declared and calculated SHA-256 values, and whether the entry was
-unpacked; REA does not silently accept the mismatched artifact.
+unpacked; REA does not silently accept the mismatched artifact. If a supplied
+ASAR declares unpacked companion bytes that are absent from the local artifact
+set, REA keeps that occurrence as `unavailable` and continues analyzing the
+embedded JavaScript instead of treating the missing native/resource bytes as
+verified or absent.
 
 ## Security model
 
-REA does not provide a hosted analysis service. Hopper and Ghidra bridge communication uses authenticated private local sockets. Dynamic capabilities are disabled by default and require both operator policy and explicit per-call approval. Shipped providers, passive observers, and Process Capture are not security sandboxes: providers and launched targets run with the current user's permissions. Extracted JavaScript replay is a distinct Linux-only capability that fails closed unless Bubblewrap namespaces, architecture-checked seccomp, private runtime mounts, and delegated cgroup limits are available; it never inherits browser, Electron, or Process Capture authority. See [ADR-0002](docs/adr/0002-controlled-replay-authority-and-sandbox.md). Report vulnerabilities through the private process in [SECURITY.md](SECURITY.md).
+REA does not provide a hosted analysis service. Hopper and Linux Ghidra bridge communication uses authenticated private local sockets. Windows Ghidra P0 uses authenticated IPv4 loopback but does not claim named-pipe DACL or hostile-local-user isolation. Dynamic capabilities are disabled by default and require both operator policy and explicit per-call approval. Shipped providers, passive observers, and Process Capture are not security sandboxes: providers and launched targets run with the current user's permissions. Extracted JavaScript replay is a distinct Linux-only capability that fails closed unless Bubblewrap namespaces, architecture-checked seccomp, private runtime mounts, and delegated cgroup limits are available; it never inherits browser, Electron, or Process Capture authority. See [ADR-0002](docs/adr/0002-controlled-replay-authority-and-sandbox.md). Report vulnerabilities through the private process in [SECURITY.md](SECURITY.md).
 
 ## FAQ
 
@@ -647,6 +707,11 @@ Any agent that can run a local MCP server can use the manual configuration. Setu
 
 See [CONTRIBUTING.md](CONTRIBUTING.md) for setup, architecture, tests, and release instructions. Generated API documentation is available under [`docs/api`](docs/api/index.html).
 
+`npm run verify:agent` runs brandless native, JavaScript-application, managed,
+and browser prompts through a real local Codex CLI. Its JSON report measures
+natural MCP use, first-tool routing, repeated calls, actual Codex token usage,
+completion quality, and explicit treatment of authority and unknowns.
+
 ## Project links
 
 [npm](https://www.npmjs.com/package/rea-agents) · [Issues](https://github.com/morluto/rea/issues) · [Security](SECURITY.md) · [Contributing](CONTRIBUTING.md) · [Hopper](https://www.hopperapp.com/) · [Ghidra](https://github.com/NationalSecurityAgency/ghidra)

package/bridge/ghidra/ReaGhidraBridge.java

@@ -7,15 +7,20 @@ import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.io.Reader;
 import java.math.BigInteger;
+import java.net.InetAddress;
+import java.net.InetSocketAddress;
 import java.net.StandardProtocolFamily;
 import java.net.UnixDomainSocketAddress;
 import java.nio.channels.Channels;
 import java.nio.channels.ServerSocketChannel;
 import java.nio.channels.SocketChannel;
 import java.nio.charset.StandardCharsets;
+import java.nio.file.AtomicMoveNotSupportedException;
 import java.nio.file.Files;
 import java.nio.file.LinkOption;
 import java.nio.file.Path;
+import java.nio.file.StandardCopyOption;
+import java.nio.file.StandardOpenOption;
 import java.nio.file.attribute.PosixFilePermissions;
 import java.security.MessageDigest;
 import java.util.ArrayList;
@@ -67,7 +72,7 @@ import ghidra.program.model.symbol.Symbol;
 import ghidra.program.model.symbol.SymbolIterator;
 
 public final class ReaGhidraBridge extends HeadlessScript {
-    private static final int BRIDGE_VERSION = 3;
+    private static final int BRIDGE_VERSION = 4;
     private static final int MAX_DESCRIPTOR_BYTES = 16 * 1024;
     private static final int MAX_REQUEST_CHARACTERS = 256 * 1024;
     private static final int MAX_RESPONSE_BYTES = 1024 * 1024;
@@ -85,9 +90,11 @@ public final class ReaGhidraBridge extends HeadlessScript {
     private static final Gson GSON = new GsonBuilder().serializeNulls().create();
     private static final Set<String> DESCRIPTOR_KEYS = Set.of(
         "schema_version",
-        "socket_path",
+        "transport",
+        "endpoint_path",
         "token",
         "run_id",
+        "target_sha256",
         "provider_version",
         "profile_digest"
     );
@@ -143,6 +150,16 @@ public final class ReaGhidraBridge extends HeadlessScript {
         if (!Application.getApplicationVersion().equals(descriptor.providerVersion)) {
             throw new IllegalStateException("Ghidra provider version does not match the session");
         }
+        String importedSha256 = currentProgram.getExecutableSHA256();
+        if (importedSha256 == null ||
+            !constantTimeEquals(
+                importedSha256.toLowerCase(Locale.ROOT),
+                descriptor.targetSha256
+            )) {
+            throw new IllegalStateException(
+                "Ghidra imported-byte digest does not match the admitted target"
+            );
+        }
         try {
             initializeDecompiler();
             serve(descriptor);
@@ -156,22 +173,77 @@ public final class ReaGhidraBridge extends HeadlessScript {
     }
 
     private void serve(SessionDescriptor descriptor) throws Exception {
-        Path socketPath = Path.of(descriptor.socketPath);
+        if (descriptor.transport.equals("unix-socket")) {
+            serveUnixSocket(descriptor);
+            return;
+        }
+        if (descriptor.transport.equals("authenticated-loopback-tcp")) {
+            serveLoopbackTcp(descriptor);
+            return;
+        }
+        throw new IllegalArgumentException("REA bridge transport is invalid");
+    }
+
+    private void serveUnixSocket(SessionDescriptor descriptor) throws Exception {
+        Path socketPath = Path.of(descriptor.endpointPath);
         Files.deleteIfExists(socketPath);
         try (ServerSocketChannel server = ServerSocketChannel.open(StandardProtocolFamily.UNIX)) {
             server.bind(UnixDomainSocketAddress.of(socketPath));
             Files.setPosixFilePermissions(socketPath, PosixFilePermissions.fromString("rw-------"));
-            try (SocketChannel client = server.accept();
-                 BufferedReader reader = new BufferedReader(Channels.newReader(client, StandardCharsets.UTF_8));
-                 BufferedWriter writer = new BufferedWriter(Channels.newWriter(client, StandardCharsets.UTF_8))) {
-                serveClient(descriptor, reader, writer);
-            }
+            acceptClient(server, descriptor);
         }
         finally {
             Files.deleteIfExists(socketPath);
         }
     }
 
+    private void serveLoopbackTcp(SessionDescriptor descriptor) throws Exception {
+        Path endpointPath = Path.of(descriptor.endpointPath);
+        Path pendingPath = endpointPath.resolveSibling(endpointPath.getFileName() + ".pending");
+        Files.deleteIfExists(endpointPath);
+        Files.deleteIfExists(pendingPath);
+        try (ServerSocketChannel server = ServerSocketChannel.open()) {
+            server.bind(new InetSocketAddress(InetAddress.getByName("127.0.0.1"), 0));
+            InetSocketAddress address = (InetSocketAddress) server.getLocalAddress();
+            JsonObject endpoint = new JsonObject();
+            endpoint.addProperty("schema_version", 1);
+            endpoint.addProperty("host", "127.0.0.1");
+            endpoint.addProperty("port", address.getPort());
+            Files.writeString(
+                pendingPath,
+                GSON.toJson(endpoint) + "\n",
+                StandardCharsets.UTF_8,
+                StandardOpenOption.CREATE_NEW,
+                StandardOpenOption.WRITE
+            );
+            try {
+                Files.move(pendingPath, endpointPath, StandardCopyOption.ATOMIC_MOVE);
+            }
+            catch (AtomicMoveNotSupportedException exception) {
+                Files.move(pendingPath, endpointPath);
+            }
+            acceptClient(server, descriptor);
+        }
+        finally {
+            Files.deleteIfExists(pendingPath);
+            Files.deleteIfExists(endpointPath);
+        }
+    }
+
+    private void acceptClient(
+            ServerSocketChannel server,
+            SessionDescriptor descriptor) throws Exception {
+        try (SocketChannel client = server.accept();
+             BufferedReader reader = new BufferedReader(
+                 Channels.newReader(client, StandardCharsets.UTF_8)
+             );
+             BufferedWriter writer = new BufferedWriter(
+                 Channels.newWriter(client, StandardCharsets.UTF_8)
+             )) {
+            serveClient(descriptor, reader, writer);
+        }
+    }
+
     private void serveClient(
             SessionDescriptor descriptor,
             BufferedReader reader,
@@ -270,6 +342,7 @@ public final class ReaGhidraBridge extends HeadlessScript {
             "default_address_space",
             currentProgram.getAddressFactory().getDefaultAddressSpace().getName()
         );
+        target.addProperty("sha256", descriptor.targetSha256);
 
         JsonObject result = new JsonObject();
         result.addProperty("name", "REA Ghidra bridge");
@@ -1586,13 +1659,15 @@ public final class ReaGhidraBridge extends HeadlessScript {
             JsonParser.parseString(Files.readString(path, StandardCharsets.UTF_8)),
             DESCRIPTOR_KEYS
         );
-        if (requireInteger(object, "schema_version") != 1) {
+        if (requireInteger(object, "schema_version") != 2) {
             throw new IllegalArgumentException("REA session descriptor version is invalid");
         }
         return new SessionDescriptor(
-            requireString(object, "socket_path"),
+            requireString(object, "transport"),
+            requireString(object, "endpoint_path"),
             requireString(object, "token"),
             requireString(object, "run_id"),
+            requireSha256(object, "target_sha256"),
             requireString(object, "provider_version"),
             requireString(object, "profile_digest")
         );
@@ -1662,6 +1737,14 @@ public final class ReaGhidraBridge extends HeadlessScript {
         return result;
     }
 
+    private static String requireSha256(JsonObject object, String name) {
+        String value = requireString(object, name);
+        if (!value.matches("[a-f0-9]{64}")) {
+            throw new IllegalArgumentException(name + " must be lowercase SHA-256");
+        }
+        return value;
+    }
+
     private static int requireInteger(JsonObject object, String name) {
         JsonElement value = object.get(name);
         if (value == null || !value.isJsonPrimitive() || !value.getAsJsonPrimitive().isNumber()) {
@@ -1795,9 +1878,11 @@ public final class ReaGhidraBridge extends HeadlessScript {
     private record InstructionScan(List<Instruction> instructions, boolean truncated) {}
     private record TruncatedValue(String value, boolean truncated) {}
     private record SessionDescriptor(
-        String socketPath,
+        String transport,
+        String endpointPath,
         String token,
         String runId,
+        String targetSha256,
         String providerVersion,
         String profileDigest
     ) {}

package/dist/application/AndroidApplicationService.js

@@ -0,0 +1,17 @@
+import { androidApplicationProjectionInputSchema, projectAndroidApplication, } from "../domain/androidApplication.js";
+import { ANDROID_APPLICATION_PROVIDER } from "./InvestigationProviders.js";
+import { projectInventoryEvidence } from "./InventoryProjectionEvidence.js";
+const OPERATION = "project_android_application_graph";
+/** Project authenticated APK inventory Evidence into Android application Evidence. */
+export const projectAndroidApplicationEvidence = (rawInput) => {
+    return projectInventoryEvidence({
+        rawInput,
+        schema: androidApplicationProjectionInputSchema,
+        project: projectAndroidApplication,
+        operation: OPERATION,
+        predicateType: "rea.android-application-graph/v1",
+        provider: ANDROID_APPLICATION_PROVIDER,
+        subjectFormat: () => "apk",
+        protocolError: "Android application projection produced an invalid result",
+    });
+};

package/dist/application/AppleApplicationService.js

@@ -0,0 +1,17 @@
+import { appleApplicationProjectionInputSchema, projectAppleApplication, } from "../domain/appleApplication.js";
+import { APPLE_APPLICATION_PROVIDER } from "./InvestigationProviders.js";
+import { projectInventoryEvidence } from "./InventoryProjectionEvidence.js";
+const OPERATION = "project_apple_application_graph";
+/** Project authenticated IPA inventory Evidence into Apple application evidence. */
+export const projectAppleApplicationEvidence = (rawInput) => {
+    return projectInventoryEvidence({
+        rawInput,
+        schema: appleApplicationProjectionInputSchema,
+        project: projectAppleApplication,
+        operation: OPERATION,
+        predicateType: "rea.apple-application-graph/v1",
+        provider: APPLE_APPLICATION_PROVIDER,
+        subjectFormat: () => "ipa",
+        protocolError: "Apple application projection produced an invalid result",
+    });
+};

package/dist/application/ArtifactExtraction.js

@@ -113,7 +113,7 @@ const createExtractionResult = (input, inventory, selected, extracted) => {
     });
 };
 const loadInventory = async (path, limits, selectedIds, signal) => {
-    const snapshot = await scanArtifactInventory(path, limits, signal);
+    const snapshot = await scanArtifactInventory(path, limits, { signal });
     const occurrences = new Map();
     const neededNodes = new Set();
     collectOccurrences(snapshot.occurrences, selectedIds, occurrences, neededNodes);

package/dist/application/ArtifactInventory/classify.js

@@ -0,0 +1,42 @@
+import { open } from "node:fs/promises";
+import { classifyArtifactPath } from "../ArtifactGraphConstruction.js";
+const classifyContainerExtension = (path) => {
+    const lower = path.toLowerCase();
+    for (const format of ["asar", "ipa", "apk", "zip", "dmg", "pkg"])
+        if (lower.endsWith(`.${format}`))
+            return format;
+    return undefined;
+};
+export const classifyRoot = async (path, directory) => {
+    if (directory)
+        return "directory";
+    const extensionFormat = classifyContainerExtension(path);
+    if (extensionFormat !== undefined)
+        return extensionFormat;
+    const handle = await open(path, "r");
+    try {
+        const magic = Buffer.alloc(4);
+        const observed = await handle.read(magic, 0, magic.length, 0);
+        if (observed.bytesRead === 4 &&
+            magic[0] === 0x50 &&
+            magic[1] === 0x4b &&
+            [0x03, 0x05, 0x07].includes(magic[2] ?? -1) &&
+            [0x04, 0x06, 0x08].includes(magic[3] ?? -1))
+            return "zip";
+        if (observed.bytesRead === 4) {
+            const header = magic.readUInt32BE(0);
+            if ([0xcafebabe, 0xbebafeca, 0xcafebabf, 0xbfbafeca].includes(header))
+                return "mach-o-universal";
+            if ([0xfeedface, 0xfeedfacf, 0xcefaedfe, 0xcffaedfe].includes(header))
+                return "mach-o";
+            if (magic.equals(Buffer.from([0x7f, 0x45, 0x4c, 0x46])))
+                return "elf";
+        }
+        if (observed.bytesRead >= 2 && magic[0] === 0x4d && magic[1] === 0x5a)
+            return "pe";
+    }
+    finally {
+        await handle.close();
+    }
+    return classifyArtifactPath(path).format;
+};

package/dist/application/ArtifactInventory/hash.js

@@ -0,0 +1,43 @@
+import { createHash } from "node:crypto";
+import { ArtifactReaderFailure, } from "../../artifacts/ArtifactReader.js";
+import { streamChunkToBuffer } from "../../artifacts/StreamBytes.js";
+export const abortIfNeeded = (signal) => {
+    if (signal?.aborted === true)
+        throw new ArtifactReaderFailure("cancelled", "Artifact inventory cancelled");
+};
+export const preflightEntry = (entry, limits) => {
+    if (entry.declaredSize !== null && entry.declaredSize > limits.maxEntryBytes)
+        throw new ArtifactReaderFailure("limit", `Entry exceeds byte limit: ${entry.path}`);
+    if (entry.declaredSize !== null &&
+        entry.compressedSize !== null &&
+        entry.compressedSize === 0 &&
+        entry.declaredSize > 0)
+        throw new ArtifactReaderFailure("limit", `Invalid compression ratio: ${entry.path}`);
+    if (entry.declaredSize !== null &&
+        entry.compressedSize !== null &&
+        entry.compressedSize > 0 &&
+        entry.declaredSize / entry.compressedSize > limits.maxCompressionRatio)
+        throw new ArtifactReaderFailure("limit", `Compression ratio exceeds limit: ${entry.path}`);
+};
+export const hashReadable = async (stream, maximum, signal) => {
+    const hash = createHash("sha256");
+    const prefixes = [];
+    let prefixBytes = 0;
+    let bytes = 0;
+    for await (const raw of stream) {
+        abortIfNeeded(signal);
+        const chunk = streamChunkToBuffer(raw);
+        bytes += chunk.length;
+        if (bytes > maximum) {
+            stream.destroy();
+            throw new ArtifactReaderFailure("limit", "Observed entry bytes exceed limit");
+        }
+        hash.update(chunk);
+        if (prefixBytes < 16) {
+            const selected = chunk.subarray(0, 16 - prefixBytes);
+            prefixes.push(selected);
+            prefixBytes += selected.length;
+        }
+    }
+    return { sha256: hash.digest("hex"), bytes, prefix: Buffer.concat(prefixes) };
+};