rea-agents 2.0.0 → 2.2.0

package/dist/application/JavaScriptModuleRelationships.js

@@ -0,0 +1,262 @@
+import { posix } from "node:path";
+import { addAstContainsEdge, artifactLocalIdentity, } from "./JavaScriptArtifactGraphContext.js";
+import { astObservationEvidence, completeReconstructionCoverage, partialReconstructionCoverage, staticInferenceEvidence, } from "./JavaScriptArtifactGraphEvidence.js";
+import { resolveArtifactPathByContext } from "./JavaScriptArtifactPathResolution.js";
+/** Create one path-scoped source-module identity for every analyzed source file. */
+export const addJavaScriptSourceModules = (context) => {
+    for (const analyzed of context.analysis.files) {
+        const { file, semantic } = analyzed;
+        const asset = context.assetNodes.get(file.path);
+        const program = semantic?.ir.scopes.find(({ kind }) => kind === "program");
+        if (asset === undefined || semantic === null || program === undefined)
+            continue;
+        const exports = semantic.ir.moduleLinks
+            .flatMap(({ exportedName }) => exportedName === null ? [] : [exportedName])
+            .sort(compareCodePoints);
+        const retainedExports = [...new Set(exports)].slice(0, 128);
+        const source = context.accumulator.addNode({
+            kind: "javascript-module",
+            identity: artifactLocalIdentity(file.sha256, "source-module", `${file.container_sha256}:${file.path}`),
+            observations: [
+                {
+                    label: file.path,
+                    properties: {
+                        semantic_role: "source-module",
+                        path: file.path,
+                        container_sha256: file.container_sha256,
+                        logical_module_key: file.path,
+                        module_format: moduleFormat(file.path, semantic.ir),
+                        import_relationships: semantic.ir.moduleLinks.filter(({ kind }) => kind === "import" || kind === "require").length,
+                        export_relationships: exports.length,
+                        export_names: retainedExports,
+                        omitted_export_names: Math.max(0, exports.length - retainedExports.length),
+                    },
+                    evidence: astObservationEvidence({
+                        sha256: file.sha256,
+                        path: file.path,
+                        range: program.location,
+                        operation: "recover-source-module",
+                        coverage: semanticCoverage(semantic),
+                        limitations: semantic.ir.limitations,
+                    }),
+                },
+            ],
+        });
+        context.sourceModuleNodes.set(file.path, source);
+        addAstContainsEdge(context, {
+            source: asset,
+            target: source,
+            file,
+            range: program.location,
+            coverage: semanticCoverage(semantic),
+            properties: { logical_module_key: file.path },
+        });
+    }
+};
+/** Compose bounded CommonJS and ESM binding relationships across artifact files. */
+export const addJavaScriptModuleRelationships = (context) => {
+    for (const analyzed of context.analysis.files) {
+        const { file, semantic } = analyzed;
+        const source = context.sourceModuleNodes.get(file.path);
+        if (semantic === null || source === undefined)
+            continue;
+        for (const link of semantic.ir.moduleLinks) {
+            const input = { context, file, semantic, source, link };
+            if (isExportLink(link))
+                addExportRelationship(input);
+            else if (link.specifier !== null)
+                addImportRelationship(input, source, {
+                    specifier: link.specifier,
+                    importedPath: link.importedName === null ? [] : [link.importedName],
+                });
+        }
+    }
+};
+const addExportRelationship = (input) => {
+    const { context, file, semantic, source, link } = input;
+    if (link.exportedName === null)
+        return;
+    const exported = context.accumulator.addNode({
+        kind: "javascript-module",
+        identity: artifactLocalIdentity(file.sha256, "module-export", `${file.container_sha256}:${file.path}:${link.exportedName}`),
+        observations: [
+            {
+                label: `${file.path}:${link.exportedName}`,
+                properties: {
+                    semantic_role: "export-binding",
+                    module_path: file.path,
+                    relationship_kind: link.kind,
+                    exported_name: link.exportedName,
+                    local_name: link.localName,
+                    imported_name: link.importedName,
+                    declared_specifier: link.specifier,
+                },
+                evidence: astObservationEvidence({
+                    sha256: file.sha256,
+                    path: file.path,
+                    range: link.location,
+                    operation: "recover-module-export",
+                    coverage: semanticCoverage(semantic),
+                    limitations: semantic.ir.limitations,
+                }),
+            },
+        ],
+    });
+    context.accumulator.addEdge({
+        source_node_id: source.node_id,
+        target_node_id: exported.node_id,
+        relation: "exposes",
+        properties: relationshipProperties(link, null),
+        evidence: relationshipEvidence(input, "expose-module-export", []),
+    });
+    const origin = moduleOriginForExport(semantic.ir, link);
+    if (origin !== null)
+        addImportRelationship(input, exported, origin);
+};
+const addImportRelationship = (input, source, origin) => {
+    const target = resolveModuleTarget(input, origin.specifier);
+    input.context.accumulator.addEdge({
+        source_node_id: source.node_id,
+        target_node_id: target.node.node_id,
+        relation: "imports",
+        properties: relationshipProperties(input.link, target, origin),
+        evidence: relationshipEvidence(input, "resolve-semantic-module-relationship", target.limitations, target.status === "resolved"
+            ? "high"
+            : target.status === "external"
+                ? "medium"
+                : "low"),
+    });
+};
+const resolveModuleTarget = (input, specifier) => {
+    const resolution = resolveArtifactPathByContext({
+        declaredPath: specifier,
+        sourcePath: input.file.path,
+        context: "module-specifier",
+        files: input.context.filesByPath,
+        moduleKind: input.link.kind === "require" || input.link.kind === "commonjs-export"
+            ? "require"
+            : "import",
+    });
+    const path = resolution.resolved_path;
+    const file = path === null ? undefined : input.context.filesByPath.get(path);
+    const node = path === null
+        ? undefined
+        : (input.context.sourceModuleNodes.get(path) ??
+            input.context.fileNodes.get(path));
+    if (path !== null && file !== undefined && node !== undefined)
+        return {
+            node,
+            path,
+            file,
+            status: "resolved",
+            limitations: resolution.limitations,
+        };
+    return {
+        node: unresolvedModuleNode(input, specifier, resolution.resolution_status),
+        path: null,
+        file: null,
+        status: resolution.resolution_status,
+        limitations: resolution.limitations,
+    };
+};
+const unresolvedModuleNode = (input, specifier, status) => input.context.accumulator.addNode({
+    kind: "javascript-module",
+    identity: artifactLocalIdentity(input.file.sha256, "unresolved-semantic-module", `${status}:${specifier}`),
+    observations: [
+        {
+            label: specifier,
+            properties: {
+                semantic_role: "module-reference",
+                declared_specifier: specifier,
+                resolution_status: status,
+            },
+            evidence: staticInferenceEvidence({
+                sha256: input.file.sha256,
+                path: input.file.path,
+                range: input.link.location,
+                operation: "retain-unresolved-semantic-module",
+                coverage: semanticCoverage(input.semantic),
+                confidence: "low",
+                limitations: input.semantic.ir.limitations,
+            }),
+        },
+    ],
+});
+const moduleOriginForExport = (ir, link) => {
+    if (link.specifier !== null)
+        return {
+            specifier: link.specifier,
+            importedPath: link.importedName === null ? [] : [link.importedName],
+        };
+    if (link.localName === null)
+        return null;
+    const program = ir.scopes.find(({ kind }) => kind === "program");
+    const binding = ir.bindings.find(({ name, scopeId }) => name === link.localName && scopeId === program?.scopeId);
+    return binding?.provenance.status === "module" &&
+        binding.provenance.origins.length === 1
+        ? (binding.provenance.origins[0] ?? null)
+        : null;
+};
+const relationshipProperties = (link, target, origin) => ({
+    module_link_kind: link.kind,
+    specifier: origin?.specifier ?? link.specifier,
+    imported_name: origin?.importedPath.at(-1) ?? link.importedName,
+    imported_path: origin?.importedPath ?? [],
+    local_name: link.localName,
+    exported_name: link.exportedName,
+    resolved_path: target?.path ?? null,
+    resolution_status: target?.status ?? null,
+    target_file_kind: target?.file?.kind ?? null,
+    target_json_status: target?.file?.kind === "json" ? jsonStatus(target.file) : null,
+});
+const relationshipEvidence = (input, operation, limitations, confidence = "high") => staticInferenceEvidence({
+    sha256: input.file.sha256,
+    path: input.file.path,
+    range: input.link.location,
+    operation,
+    coverage: semanticCoverage(input.semantic),
+    confidence,
+    limitations: [...input.semantic.ir.limitations, ...limitations],
+});
+const semanticCoverage = (semantic) => {
+    const limits = Object.entries(semantic.limits).map(([name, value]) => ({
+        name: `semantic-${camelToKebab(name)}`,
+        value,
+        unit: "items",
+    }));
+    if (semantic.ir.coverage.status === "complete")
+        return completeReconstructionCoverage(limits);
+    return partialReconstructionCoverage(limits, semantic.ir.coverage.omittedCount, semantic.ir.coverage.status === "truncated");
+};
+const moduleFormat = (path, ir) => {
+    const extension = posix.extname(path).toLowerCase();
+    if (extension === ".mjs")
+        return "esm";
+    if (extension === ".cjs")
+        return "commonjs";
+    const esm = ir.moduleLinks.some(({ kind }) => ["import", "export", "re-export"].includes(kind));
+    const commonJs = ir.moduleLinks.some(({ kind }) => ["require", "commonjs-export"].includes(kind));
+    return esm && commonJs
+        ? "mixed"
+        : esm
+            ? "esm"
+            : commonJs
+                ? "commonjs"
+                : "unknown";
+};
+const jsonStatus = (file) => {
+    if (!file.text.included)
+        return "unavailable";
+    try {
+        JSON.parse(file.text.value);
+        return "included";
+    }
+    catch {
+        return "invalid";
+    }
+};
+const isExportLink = (link) => link.kind === "export" ||
+    link.kind === "re-export" ||
+    link.kind === "commonjs-export";
+const camelToKebab = (value) => value.replaceAll(/([a-z])([A-Z])/gu, "$1-$2").toLowerCase();
+const compareCodePoints = (left, right) => left < right ? -1 : left > right ? 1 : 0;

package/dist/application/JavaScriptReplayPermission.js

@@ -0,0 +1,16 @@
+/** Build the exact permission request for one controlled replay operation. */
+export const replayPermissionRequest = (input, policy) => ({
+    capability: "javascript_replay",
+    roots: [...input.left.modules, ...(input.right?.modules ?? [])].map(({ path }) => path),
+    executables: [
+        policy.nodePath,
+        policy.bubblewrapPath,
+        policy.systemdRunPath,
+        policy.systemctlPath,
+        policy.shellPath,
+    ],
+    environment_names: [],
+    network: "none",
+    mount: true,
+    operation_identity: `run_controlled_replay:${input.plan_digest ?? "plan"}`,
+});

package/dist/application/JavaScriptReplayService.js

@@ -6,6 +6,7 @@ import { createEvidence } from "../domain/evidence.js";
 import { projectInputIssues } from "../domain/inputIssueProjection.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";
 import { err, ok } from "../domain/result.js";
+import { replayPermissionRequest } from "./JavaScriptReplayPermission.js";
 import { digestBytes, prepareReplayPlan, } from "./JavaScriptReplayPlanning.js";
 const OPERATION = "run_controlled_replay";
 const isAborted = (signal) => signal?.aborted === true;
@@ -18,13 +19,46 @@ export const runControlledReplay = async (dependencies, rawInput, options = {})
 };
 /** Plan or execute replay input already parsed by a trusted adapter. */
 export const runControlledReplayValidated = async (dependencies, input, options = {}) => {
+    const authorized = await authorizeReplay(dependencies, input, options.signal);
+    if (!authorized.ok)
+        return authorized;
+    const prepared = await prepareValidatedReplay(dependencies, input, options.signal);
+    if (!prepared.ok)
+        return prepared;
+    if (isAborted(options.signal))
+        return err(new AnalysisCancelledError(OPERATION));
+    if (input.mode === "plan")
+        return ok(asJson({
+            phase: "plan",
+            plan: prepared.value.publicPlan,
+            source_evidence: [],
+            evidence: null,
+        }));
+    if (input.plan_digest !== prepared.value.publicPlan.plan_digest)
+        return err(new ReplayPlanStaleError(input.plan_digest ?? "", prepared.value.publicPlan.plan_digest));
+    const exportContext = await authorizeReproducerExport(dependencies.authority, input, prepared.value);
+    if (!exportContext.ok)
+        return exportContext;
+    const executed = await executeValidatedReplay(dependencies, prepared.value, exportContext.value, options);
+    if (!executed.ok)
+        return executed;
+    try {
+        return ok(buildReplayOutput(prepared.value, executed.value.executed, executed.value.sourceEvidence));
+    }
+    catch (cause) {
+        return err(new AnalysisProtocolError(cause instanceof z.ZodError
+            ? "Controlled replay produced an invalid bounded result"
+            : "Controlled replay could not establish or clean up its sandbox", { cause }));
+    }
+};
+const authorizeReplay = async (dependencies, input, signal) => {
     if (!dependencies.policy.enabled)
         return err(new AnalysisCapabilityUnavailableError("rea-javascript-replay", OPERATION, "controlled replay is disabled; configure exact roots and executables before enabling it"));
     if (dependencies.authority === undefined)
         return err(new AnalysisCapabilityUnavailableError("rea-javascript-replay", OPERATION, "JavaScript replay permission policy is not configured"));
-    if (isAborted(options.signal))
+    if (isAborted(signal))
         return err(new AnalysisCancelledError(OPERATION));
-    const request = permissionRequest(input, dependencies.policy);
+    const request = replayPermissionRequest(input, dependencies.policy);
     const authorized = input.mode === "plan"
         ? await dependencies.authority.explain(request, "read")
         : await dependencies.authority.authorize(request, "read");
@@ -34,51 +68,51 @@ export const runControlledReplayValidated = async (dependencies, input, options
             : new AnalysisProtocolError(authorized.error.message, {
                 cause: authorized.error,
             }));
-    let prepared;
+    return ok(true);
+};
+const prepareValidatedReplay = async (dependencies, input, signal) => {
+    if (isAborted(signal))
+        return err(new AnalysisCancelledError(OPERATION));
     try {
-        prepared = await prepareReplayPlan(input, dependencies.policy, dependencies.host);
+        return ok(await prepareReplayPlan(input, dependencies.policy, dependencies.host));
     }
     catch (cause) {
         return err(new AnalysisCapabilityUnavailableError("rea-javascript-replay", OPERATION, cause instanceof Error ? cause.message : "replay planning failed"));
     }
-    if (isAborted(options.signal))
-        return err(new AnalysisCancelledError(OPERATION));
-    if (input.mode === "plan")
-        return ok(asJson({
-            phase: "plan",
-            plan: prepared.publicPlan,
-            source_evidence: [],
-            evidence: null,
-        }));
-    if (input.plan_digest !== prepared.publicPlan.plan_digest)
-        return err(new ReplayPlanStaleError(input.plan_digest ?? "", prepared.publicPlan.plan_digest));
-    let canonicalExportPath;
-    if (input.reproducer_export !== undefined) {
-        if (input.reproducer_export.approved !== true)
-            return err(new AnalysisInputError(`${OPERATION}:reproducer_export`));
-        const exportAuthorized = await dependencies.authority.authorize({
-            capability: "evidence_write",
-            roots: [input.reproducer_export.path],
-            executables: [],
-            environment_names: [],
-            network: "none",
-            mount: false,
-            operation_identity: `${OPERATION}:reproducer:${prepared.publicPlan.plan_digest}`,
-        }, "write");
-        if (!exportAuthorized.ok)
-            return err(exportAuthorized.error instanceof PermissionRequiredError
-                ? exportAuthorized.error
-                : new AnalysisProtocolError(exportAuthorized.error.message, {
-                    cause: exportAuthorized.error,
-                }));
-        canonicalExportPath = exportAuthorized.value.request.roots[0];
-        if (canonicalExportPath !== input.reproducer_export.path)
-            return err(new AnalysisInputError(`${OPERATION}:reproducer_export:path`, {
-                cause: new TypeError(`Use the canonical reproducer path: ${canonicalExportPath ?? "unavailable"}`),
+};
+const authorizeReproducerExport = async (authority, input, prepared) => {
+    if (input.reproducer_export === undefined)
+        return ok(undefined);
+    if (input.reproducer_export.approved !== true)
+        return err(new AnalysisInputError(`${OPERATION}:reproducer_export`));
+    if (authority === undefined)
+        return err(new AnalysisCapabilityUnavailableError("rea-javascript-replay", OPERATION, "JavaScript replay permission policy is not configured"));
+    const exportAuthorized = await authority.authorize({
+        capability: "evidence_write",
+        roots: [input.reproducer_export.path],
+        executables: [],
+        environment_names: [],
+        network: "none",
+        mount: false,
+        operation_identity: `${OPERATION}:reproducer:${prepared.publicPlan.plan_digest}`,
+    }, "write");
+    if (!exportAuthorized.ok)
+        return err(exportAuthorized.error instanceof PermissionRequiredError
+            ? exportAuthorized.error
+            : new AnalysisProtocolError(exportAuthorized.error.message, {
+                cause: exportAuthorized.error,
             }));
-    }
-    if (isAborted(options.signal))
-        return err(new AnalysisCancelledError(OPERATION));
+    const canonicalExportPath = exportAuthorized.value.request.roots[0];
+    if (canonicalExportPath !== input.reproducer_export.path)
+        return err(new AnalysisInputError(`${OPERATION}:reproducer_export:path`, {
+            cause: new TypeError(`Use the canonical reproducer path: ${canonicalExportPath ?? "unavailable"}`),
+        }));
+    return ok({
+        path: canonicalExportPath,
+        includeSources: input.reproducer_export.include_sources === true,
+    });
+};
+const executeValidatedReplay = async (dependencies, prepared, exportContext, options) => {
     await options.progress?.report({
         phase: OPERATION,
         completed: 0,
@@ -98,106 +132,9 @@ export const runControlledReplayValidated = async (dependencies, input, options
         });
         if (executed.termination === "cancelled")
             return err(new AnalysisCancelledError(OPERATION));
-        if (input.reproducer_export !== undefined &&
-            canonicalExportPath !== undefined &&
-            executed.cleanup.state === "complete") {
-            const manifest = {
-                schema_version: 1,
-                plan: prepared.publicPlan,
-                result: executed,
-                sources: input.reproducer_export.include_sources
-                    ? {
-                        left: prepared.leftSources,
-                        ...(prepared.rightSources === undefined
-                            ? {}
-                            : { right: prepared.rightSources }),
-                    }
-                    : null,
-            };
-            const encoded = Buffer.from(`${JSON.stringify(manifest, null, 2)}\n`);
-            try {
-                await writeFileAtomic(canonicalExportPath, encoded, {
-                    mode: 0o600,
-                });
-                executed = replayExecutionResultSchema.parse({
-                    ...executed,
-                    reproducer: {
-                        state: "written",
-                        path: canonicalExportPath,
-                        sha256: digestBytes(encoded),
-                    },
-                });
-            }
-            catch (cause) {
-                executed = replayExecutionResultSchema.parse({
-                    ...executed,
-                    limitations: [
-                        ...executed.limitations,
-                        "Replay completed, but the separately approved reproducer export failed.",
-                    ],
-                    reproducer: {
-                        state: "failed",
-                        path: canonicalExportPath,
-                        error: cause instanceof Error
-                            ? cause.message
-                            : "unknown reproducer export failure",
-                    },
-                });
-            }
-        }
-        const leftCount = prepared.publicPlan.cases.length;
-        const sourceEvidence = [
-            createReplayEvidence(prepared, executed, "left", executed.outcomes.slice(0, leftCount)),
-            ...(prepared.publicPlan.right === undefined
-                ? []
-                : [
-                    createReplayEvidence(prepared, executed, "right", executed.outcomes.slice(leftCount)),
-                ]),
-        ];
-        const subject = prepared.publicPlan.left.modules[0];
-        const evidence = createEvidence(subject === undefined
-            ? undefined
-            : {
-                path: subject.canonical_path,
-                sha256: subject.sha256,
-                format: "javascript",
-            }, {
-            id: "rea-javascript-replay",
-            name: "REA isolated JavaScript replay",
-            version: "1",
-        }, {
-            predicateType: "javascript-controlled-replay",
-            operation: OPERATION,
-            parameters: {
-                replay_plan: jsonValueSchema.parse(JSON.parse(JSON.stringify(prepared.publicPlan))),
-            },
-            result: jsonValueSchema.parse(JSON.parse(JSON.stringify(executed))),
-            rawResult: jsonValueSchema.parse(JSON.parse(JSON.stringify({
-                cases: prepared.publicPlan.cases,
-                outcomes: executed.outcomes,
-                stderr: executed.stderr,
-            }))),
-            confidence: executed.comparison === undefined ? "observed" : "derived",
-            authority: "controlled-replay",
-            environment: {
-                id: prepared.publicPlan.plan_digest,
-                platform: process.platform,
-                architecture: process.arch,
-                isolation: "container",
-            },
-            limitations: executed.limitations,
-            locations: prepared.publicPlan.left.modules.map((module) => ({
-                kind: "artifact-path",
-                path: module.canonical_path,
-            })),
-            evidenceLinks: sourceEvidence.map(({ evidence_id: id }) => id),
-        });
-        return ok(asJson({
-            phase: "execute",
-            plan: null,
-            source_evidence: sourceEvidence.map((item) => replayEvidenceSchema.parse(item)),
-            evidence: replayEvidenceSchema.parse(evidence),
-        }));
+        executed = await applyReproducerExport(executed, exportContext, prepared);
+        const sourceEvidence = buildSourceEvidence(prepared, executed);
+        return ok({ executed, sourceEvidence });
     }
     catch (cause) {
         return err(new AnalysisProtocolError(cause instanceof z.ZodError
@@ -205,6 +142,110 @@ export const runControlledReplayValidated = async (dependencies, input, options
             : "Controlled replay could not establish or clean up its sandbox", { cause }));
     }
 };
+const applyReproducerExport = async (executed, exportContext, prepared) => {
+    if (exportContext === undefined || executed.cleanup.state !== "complete")
+        return executed;
+    const manifest = {
+        schema_version: 1,
+        plan: prepared.publicPlan,
+        result: executed,
+        sources: exportContext.includeSources
+            ? {
+                left: prepared.leftSources,
+                ...(prepared.rightSources === undefined
+                    ? {}
+                    : { right: prepared.rightSources }),
+            }
+            : null,
+    };
+    const encoded = Buffer.from(`${JSON.stringify(manifest, null, 2)}\n`);
+    try {
+        await writeFileAtomic(exportContext.path, encoded, {
+            mode: 0o600,
+        });
+        return replayExecutionResultSchema.parse({
+            ...executed,
+            reproducer: {
+                state: "written",
+                path: exportContext.path,
+                sha256: digestBytes(encoded),
+            },
+        });
+    }
+    catch (cause) {
+        return replayExecutionResultSchema.parse({
+            ...executed,
+            limitations: [
+                ...executed.limitations,
+                "Replay completed, but the separately approved reproducer export failed.",
+            ],
+            reproducer: {
+                state: "failed",
+                path: exportContext.path,
+                error: cause instanceof Error
+                    ? cause.message
+                    : "unknown reproducer export failure",
+            },
+        });
+    }
+};
+const buildSourceEvidence = (prepared, executed) => {
+    const leftCount = prepared.publicPlan.cases.length;
+    return [
+        createReplayEvidence(prepared, executed, "left", executed.outcomes.slice(0, leftCount)),
+        ...(prepared.publicPlan.right === undefined
+            ? []
+            : [
+                createReplayEvidence(prepared, executed, "right", executed.outcomes.slice(leftCount)),
+            ]),
+    ];
+};
+const buildReplayOutput = (prepared, executed, sourceEvidence) => {
+    const subject = prepared.publicPlan.left.modules[0];
+    const evidence = createEvidence(subject === undefined
+        ? undefined
+        : {
+            path: subject.canonical_path,
+            sha256: subject.sha256,
+            format: "javascript",
+        }, {
+        id: "rea-javascript-replay",
+        name: "REA isolated JavaScript replay",
+        version: "1",
+    }, {
+        predicateType: "javascript-controlled-replay",
+        operation: OPERATION,
+        parameters: {
+            replay_plan: jsonValueSchema.parse(JSON.parse(JSON.stringify(prepared.publicPlan))),
+        },
+        result: jsonValueSchema.parse(JSON.parse(JSON.stringify(executed))),
+        rawResult: jsonValueSchema.parse(JSON.parse(JSON.stringify({
+            cases: prepared.publicPlan.cases,
+            outcomes: executed.outcomes,
+            stderr: executed.stderr,
+        }))),
+        confidence: executed.comparison === undefined ? "observed" : "derived",
+        authority: "controlled-replay",
+        environment: {
+            id: prepared.publicPlan.plan_digest,
+            platform: process.platform,
+            architecture: process.arch,
+            isolation: "container",
+        },
+        limitations: executed.limitations,
+        locations: prepared.publicPlan.left.modules.map((module) => ({
+            kind: "artifact-path",
+            path: module.canonical_path,
+        })),
+        evidenceLinks: sourceEvidence.map(({ evidence_id: id }) => id),
+    });
+    return asJson({
+        phase: "execute",
+        plan: null,
+        source_evidence: sourceEvidence.map((item) => replayEvidenceSchema.parse(item)),
+        evidence: replayEvidenceSchema.parse(evidence),
+    });
+};
 const createReplayEvidence = (prepared, executed, side, outcomes) => {
     const manifest = side === "left" ? prepared.publicPlan.left : prepared.publicPlan.right;
     const subject = manifest?.modules[0];
@@ -249,18 +290,3 @@ const createReplayEvidence = (prepared, executed, side, outcomes) => {
     });
 };
 const asJson = (value) => jsonValueSchema.parse(JSON.parse(JSON.stringify(controlledReplayOutputSchema.parse(value))));
-const permissionRequest = (input, policy) => ({
-    capability: "javascript_replay",
-    roots: [...input.left.modules, ...(input.right?.modules ?? [])].map(({ path }) => path),
-    executables: [
-        policy.nodePath,
-        policy.bubblewrapPath,
-        policy.systemdRunPath,
-        policy.systemctlPath,
-        policy.shellPath,
-    ],
-    environment_names: [],
-    network: "none",
-    mount: true,
-    operation_identity: `${OPERATION}:${input.plan_digest ?? "plan"}`,
-});

package/dist/application/LinuxHopper.js

@@ -26,6 +26,16 @@ const SUPPORTED_RELEASES = {
         file_hash: "92d780b61cab38eda95dc4112dee4fbeb0920f46",
     },
 };
+/** Describe the release and package-manager commands without downloading or writing. */
+export const linuxHopperInstallDisclosure = (family, isRoot) => {
+    const release = SUPPORTED_RELEASES[family];
+    return {
+        downloadUrl: release.filename,
+        expectedBytes: Number(release.file_length),
+        expectedSha1: release.file_hash,
+        commands: linuxPackageManagerCommands(family, `<verified-hopper.${family}>`, isRoot).map(({ executable, args }) => `${executable} ${args.join(" ")}`),
+    };
+};
 /** Parse an os-release document without executing its shell syntax. */
 export const parseLinuxDistribution = (text) => {
     const fields = new Map();