rea-agents 2.3.0 → 2.5.0

package/dist/domain/javascriptSemanticResources.js

@@ -0,0 +1,136 @@
+import * as t from "@babel/types";
+import { semanticStaticPropertyName } from "./javascriptSemanticProjection.js";
+import { resolveSemanticBindingState, } from "./javascriptSemanticState.js";
+import { dataEffectLimitReached, outerDataEffectBinding, traverseDataEffects, } from "./javascriptSemanticDataEffectHelpers.js";
+import { range } from "./javascriptStaticAnalysisHelpers.js";
+const ACQUIRE_METHODS = [
+    "open",
+    "openSync",
+    "createReadStream",
+    "createWriteStream",
+    "connect",
+    "createConnection",
+];
+const RELEASE_METHODS = ["close", "destroy", "end"];
+/** Recover built-in filesystem/network acquisition and local release handles. */
+export const collectJavaScriptSemanticResources = (program, state, callables) => {
+    const context = {
+        state,
+        callableIds: new Set(callables.map(({ callableId }) => callableId)),
+        callableStack: [],
+        ancestors: [],
+    };
+    const acquisitions = collectAcquisitions(program, context);
+    return [
+        ...acquisitions.map(immutableAcquisition),
+        ...collectReleases(program, context, acquisitions),
+    ];
+};
+const collectAcquisitions = (program, context) => {
+    const output = [];
+    traverseDataEffects(program, context, (node) => {
+        if (!t.isCallExpression(node) && !t.isOptionalCallExpression(node))
+            return;
+        const method = acquisitionMethod(node.callee, context.state);
+        if (method === null)
+            return;
+        if (resourceLimitReached(output.length, context.state))
+            return;
+        output.push({
+            node,
+            method,
+            ownerCallableId: context.callableStack.at(-1) ?? null,
+            resultBindingId: outerDataEffectBinding(node, context),
+        });
+    });
+    return output;
+};
+const collectReleases = (program, context, acquisitions) => {
+    const byBinding = new Map();
+    for (const acquisition of acquisitions) {
+        if (acquisition.resultBindingId === null)
+            continue;
+        const existing = byBinding.get(acquisition.resultBindingId) ?? [];
+        existing.push(acquisition);
+        byBinding.set(acquisition.resultBindingId, existing);
+    }
+    const output = [];
+    traverseDataEffects(program, context, (node) => {
+        if (!t.isCallExpression(node) && !t.isOptionalCallExpression(node))
+            return;
+        const member = memberCallee(node);
+        if (member === null || !t.isIdentifier(member.object))
+            return;
+        const method = RELEASE_METHODS.find((candidate) => candidate ===
+            semanticStaticPropertyName(member.property, member.computed));
+        if (method === undefined)
+            return;
+        const binding = resolveSemanticBindingState(context.state, member.object, member.object.name);
+        const linked = binding === undefined ? [] : (byBinding.get(binding.bindingId) ?? []);
+        if (linked.length === 0)
+            return;
+        if (resourceLimitReached(acquisitions.length + output.length, context.state))
+            return;
+        output.push({
+            resourceId: `resource:release:${String(node.start ?? -1)}:${String(node.end ?? -1)}`,
+            kind: "release",
+            method,
+            location: range(node),
+            ownerCallableId: context.callableStack.at(-1) ?? null,
+            resultBindingId: binding?.bindingId ?? null,
+            linkedResourceIds: linked.map(resourceCandidateId).sort(),
+            resolution: linked.length === 1 ? "complete" : "partial",
+        });
+    });
+    return output;
+};
+const immutableAcquisition = (candidate) => ({
+    resourceId: resourceCandidateId(candidate),
+    kind: "acquire",
+    method: candidate.method,
+    location: range(candidate.node),
+    ownerCallableId: candidate.ownerCallableId,
+    resultBindingId: candidate.resultBindingId,
+    linkedResourceIds: [],
+    resolution: "complete",
+});
+const acquisitionMethod = (callee, state) => {
+    if (t.isIdentifier(callee)) {
+        const binding = resolveSemanticBindingState(state, callee, callee.name);
+        return methodFromBinding(binding);
+    }
+    if (!t.isMemberExpression(callee) && !t.isOptionalMemberExpression(callee))
+        return null;
+    const method = ACQUIRE_METHODS.find((candidate) => candidate ===
+        semanticStaticPropertyName(callee.property, callee.computed));
+    if (method === undefined || !t.isIdentifier(callee.object))
+        return null;
+    const binding = resolveSemanticBindingState(state, callee.object, callee.object.name);
+    return resourceNamespace(binding) ? method : null;
+};
+const methodFromBinding = (binding) => {
+    for (const { specifier, importedPath } of binding?.directOrigins ?? []) {
+        if (!resourceModule(specifier))
+            continue;
+        const method = ACQUIRE_METHODS.find((candidate) => candidate === importedPath.at(-1));
+        if (method !== undefined)
+            return method;
+    }
+    return null;
+};
+const resourceNamespace = (binding) => binding?.directOrigins.some(({ specifier, importedPath }) => resourceModule(specifier) && importedPath.length === 0) ?? false;
+const resourceModule = (specifier) => [
+    "fs",
+    "fs/promises",
+    "net",
+    "node:fs",
+    "node:fs/promises",
+    "node:net",
+    "node:tls",
+    "tls",
+].includes(specifier);
+const resourceLimitReached = (retained, state) => dataEffectLimitReached(retained, state.limits.maxResourceOperations, "maxResourceOperations", state);
+const resourceCandidateId = (candidate) => `resource:acquire:${String(candidate.node.start ?? -1)}:${String(candidate.node.end ?? -1)}`;
+const memberCallee = (node) => t.isMemberExpression(node.callee) || t.isOptionalMemberExpression(node.callee)
+    ? node.callee
+    : null;

package/dist/domain/javascriptStaticAnalysis.js

@@ -3,7 +3,7 @@ import * as t from "@babel/types";
 import { inspectElectronStaticNode } from "./electronStaticAnalysis.js";
 import { detectVendors, failedJavaScriptStaticAnalysis, registrationKey, sortedUnique, stringValue, } from "./javascriptStaticAnalysisHelpers.js";
 import { addReference, addSourceMapDirectives, inspectCall, inspectRouteProperty, inspectRoleProperty, } from "./javascriptStaticAnalysisCalls.js";
-import { inspectBundlerRegistration } from "./javascriptStaticAnalysisBundler.js";
+import { inspectBundlerRegistration, inspectEsbuildWrapper, } from "./javascriptStaticAnalysisBundler.js";
 import { finalizeLocatedFindings } from "./javascriptStaticAnalysisFindings.js";
 import { createJavaScriptAnalysisAccumulator, } from "./javascriptStaticAnalysisState.js";
 /** Parse one bounded JavaScript artifact and recover static structure only. */
@@ -100,10 +100,11 @@ const inspectNode = (source, node, accumulator, limits) => {
     inspectElectronStaticNode(node, findings);
     if (t.isCallExpression(node)) {
         inspectBundlerRegistration(source, node, accumulator, limits);
-        inspectCall(node, findings);
+        inspectEsbuildWrapper(source, node, accumulator, limits);
+        inspectCall(source, node, findings);
     }
     else if (t.isNewExpression(node))
-        inspectCall(node, findings);
+        inspectCall(source, node, findings);
     if ((t.isImportDeclaration(node) || t.isExportAllDeclaration(node)) &&
         node.source !== undefined)
         addReference(findings, {

package/dist/domain/javascriptStaticAnalysisBundler.js

@@ -61,6 +61,44 @@ export const inspectBundlerRegistration = (source, call, accumulator, limits) =>
     };
     addBoundedFinding(accumulator, `registration\0${registrationKey(registration)}`, limits.maxFindings, () => accumulator.registrations.push(registration));
 };
+/** Inspect esbuild helper wrappers and recover their literal module tables. */
+export const inspectEsbuildWrapper = (source, call, accumulator, limits) => {
+    const name = calleeName(call.callee);
+    const wrapperKind = name === "__commonJS" || name.endsWith(".__commonJS")
+        ? "commonjs"
+        : name === "__esm" || name.endsWith(".__esm")
+            ? "esm"
+            : null;
+    const table = call.arguments[0];
+    if (wrapperKind === null || !t.isObjectExpression(table))
+        return;
+    const recovered = recoverBundlerModules(source, table, accumulator, limits);
+    if (recovered.modules.length === 0)
+        return;
+    if (recovered.omittedAsyncChunkKeys > 0) {
+        accumulator.droppedFindings += recovered.omittedAsyncChunkKeys;
+        accumulator.structuralTruncation = true;
+    }
+    accumulator.unknownFindings += recovered.unknownAsyncChunkKeys;
+    const registration = {
+        bundler: "esbuild",
+        runtime: `esbuild-${wrapperKind}`,
+        chunk_keys: [`${wrapperKind}@${String(call.start ?? 0)}`],
+        omitted_chunk_keys: 0,
+        unknown_chunk_keys: 0,
+        runtime_require_name: null,
+        runtime_module_cache_status: "not-observed",
+        entry_module_keys: [],
+        omitted_entry_module_keys: 0,
+        unknown_entry_module_keys: 0,
+        async_chunk_keys: recovered.asyncChunkKeys,
+        omitted_async_chunk_keys: recovered.omittedAsyncChunkKeys,
+        unknown_async_chunk_keys: recovered.unknownAsyncChunkKeys,
+        modules: recovered.modules.sort((left, right) => compareCodePoints(left.module_key, right.module_key)),
+        location: range(call),
+    };
+    addBoundedFinding(accumulator, `registration\0${registrationKey(registration)}`, limits.maxFindings, () => accumulator.registrations.push(registration));
+};
 const recoverBundlerModules = (source, table, accumulator, limits) => {
     const modules = [];
     const asyncChunkKeys = [];

package/dist/domain/javascriptStaticAnalysisCalls.js

@@ -2,7 +2,7 @@ import * as t from "@babel/types";
 import { addBoundedFinding, addLocatedFinding, moduleAtOffset, } from "./javascriptStaticAnalysisFindings.js";
 import { STATIC_ROUTE_CALL_NAMES, argumentValue, calleeName, endpointArgument as endpointArgumentHelper, prefixedArgument, propertyName, range, rangeForOffsets, sanitizeCandidate, sourceSlice, staticPath, staticPathResolutionContext, storageKind, stringValue, } from "./javascriptStaticAnalysisHelpers.js";
 /** Inspect one call or new expression for references, endpoints, storage, and roles. */
-export const inspectCall = (node, context) => {
+export const inspectCall = (source, node, context) => {
     const { accumulator } = context;
     const name = calleeName(node.callee);
     const first = stringValue(node.arguments[0]);
@@ -22,6 +22,8 @@ export const inspectCall = (node, context) => {
             kind: "dynamic-import",
             specifier: chunkLoad.specifier,
         });
+    for (const specifier of vitePreloadDependencySpecifiers(source, node, name))
+        addReference(context, { node, kind: "dynamic-import", specifier });
     if (name === "Worker" || name.endsWith(".Worker"))
         addReference(context, { node, kind: "worker", specifier: first });
     if (name.endsWith("serviceWorker.register"))
@@ -73,6 +75,26 @@ const chunkLoadSpecifier = (node, name, moduleRequireName) => {
         return null;
     return { specifier: prefixedArgument("chunk:", node.arguments[0]) };
 };
+const vitePreloadDependencySpecifiers = (source, node, name) => {
+    if (name !== "__vite__mapDeps" || !t.isArrayExpression(node.arguments[0]))
+        return [];
+    const indexes = node.arguments[0].elements.flatMap((element) => t.isNumericLiteral(element) ? [element.value] : []);
+    if (indexes.length !== node.arguments[0].elements.length)
+        return [];
+    const table = vitePreloadDependencyTable(source);
+    return indexes.flatMap((index) => table[index] ?? []);
+};
+const vitePreloadDependencyTable = (source) => {
+    const match = /\.\s*f\s*\|\|\s*\(\s*[^)]*?\.f\s*=\s*\[([\s\S]*?)\]\s*\)/u.exec(source);
+    const body = match?.[1];
+    if (body === undefined)
+        return [];
+    return [
+        ...body.matchAll(/"([^"\\]*(?:\\.[^"\\]*)*)"|'([^'\\]*(?:\\.[^'\\]*)*)'/gu),
+    ]
+        .map((literal) => (literal[1] ?? literal[2] ?? "").slice(0, 4_096))
+        .slice(0, 256);
+};
 const inspectEndpointCall = (node, name, first, context) => {
     const route = STATIC_ROUTE_CALL_NAMES.some((candidate) => name === candidate || name.endsWith(`.${candidate}`));
     if (route && first !== undefined)

package/dist/domain/javascriptStaticAnalysisHelpers.js

@@ -294,6 +294,12 @@ export const rangeForOffsets = (source, start, end) => ({
     start: pointForOffset(source, start),
     end: pointForOffset(source, end),
 });
+/** Compare two exact source ranges. */
+export const sourceRangesEqual = (left, right) => left !== null &&
+    left.start.line === right.start.line &&
+    left.start.column === right.start.column &&
+    left.end.line === right.end.line &&
+    left.end.column === right.end.column;
 const pointForOffset = (source, offset) => {
     const before = source.slice(0, offset);
     const lines = before.split("\n");
@@ -335,6 +341,8 @@ const vendorPatterns = [
     { name: "webpack", patterns: ["__webpack_require__", "webpackChunk"] },
     { name: "Rspack", patterns: ["__webpack_require__.f", "rspackChunk"] },
     { name: "Vite", patterns: ["__vite__", "import.meta.hot"] },
+    { name: "Rollup", patterns: ["ROLLUP_FILE_URL", "import.meta.ROLLUP"] },
+    { name: "esbuild", patterns: ["__commonJS", "__esm"] },
     { name: "React", patterns: ["React.createElement", "react/jsx-runtime"] },
     { name: "Vue", patterns: ["__VUE__", "createApp("] },
     { name: "Next.js", patterns: ["__NEXT_DATA__", "/_next/"] },

package/dist/domain/processCapture.js

@@ -1,6 +1,7 @@
 import { z } from "zod";
 import { jsonValueSchema } from "./jsonValue.js";
 import { LEGACY_PROCESS_CAPTURE_MESSAGE, normalizationSchema, } from "./processScenario.js";
+import { PROCESS_REACTIVE_LIMITS } from "./processReactiveScenario.js";
 export * from "./processScenario.js";
 /** Capture collection whose members participate in global observation order. */
 export const PROCESS_CAPTURE_EVENT_COLLECTIONS = [
@@ -76,7 +77,7 @@ export const processCaptureSchema = z.object({
         sequence: z.number().int().nonnegative(),
         scheduled_at_ms: z.number().int().nonnegative(),
         dispatched_at_ms: z.number().int().nonnegative(),
-        type: z.enum(["input", "resize", "signal"]),
+        type: z.enum(["input", "resize", "stdin_close", "signal"]),
         data: z.string(),
         outcome: z.enum(["dispatched", "target_exited", "failed"]),
     })),
@@ -145,6 +146,75 @@ export const processCaptureSchema = z.object({
         sensitive_aliases: z.array(z.string().min(1).max(64)).max(32),
     }))
         .default([]),
+    reactive_run: z
+        .object({
+        status: z.enum(["running", "finished"]),
+        outcome: z
+            .enum([
+            "passed",
+            "predicate_timeout",
+            "scenario_deadline",
+            "ambiguous_match",
+            "action_rejected",
+            "target_lost",
+            "capture_incomplete",
+            "cancelled",
+            "cleanup_failed",
+        ])
+            .nullable(),
+        active_state: z.string().min(1).max(64),
+        controls: z
+            .array(z.object({
+            sequence: z.number().int().nonnegative(),
+            kind: z.enum([
+                "state_deadline",
+                "scenario_deadline",
+                "target_lost",
+                "cancelled",
+                "cleanup_failed",
+            ]),
+            after_capture_order: z.number().int().min(-1),
+        }))
+            .default([]),
+        transitions: z
+            .array(z.object({
+            sequence: z.number().int().nonnegative(),
+            transition_id: z.string().min(1).max(64),
+            state_before: z.string().min(1).max(64),
+            state_after: z.string().min(1).max(64).nullable(),
+            outcome: z
+                .enum([
+                "passed",
+                "predicate_timeout",
+                "scenario_deadline",
+                "ambiguous_match",
+                "action_rejected",
+                "target_lost",
+                "capture_incomplete",
+                "cancelled",
+                "cleanup_failed",
+            ])
+                .nullable(),
+            trigger_event_ids: z
+                .array(z.string().min(1))
+                .max(PROCESS_REACTIVE_LIMITS.predicates),
+            action_event_ids: z
+                .array(z.string().min(1))
+                .max(PROCESS_REACTIVE_LIMITS.actionsPerTransition),
+            action_types: z
+                .array(z.enum([
+                "send_input",
+                "resize",
+                "close_stdin",
+                "send_signal",
+                "checkpoint",
+            ]))
+                .max(PROCESS_REACTIVE_LIMITS.actionsPerTransition),
+        }))
+            .max(PROCESS_REACTIVE_LIMITS.transitions),
+    })
+        .nullable()
+        .default(null),
     event_journal: z
         .array(z.object({
         capture_order: z.number().int().nonnegative(),

package/dist/domain/processCaptureReactiveValidation.js

@@ -0,0 +1,175 @@
+import canonicalize from "canonicalize";
+import { projectProcessObservation, } from "./processObservation.js";
+import { commitProcessReactiveProposal, createProcessReactiveSnapshot, reduceProcessReactiveScenario, } from "./processReactiveRuntime.js";
+import { processReactiveScenarioSchema, } from "./processReactiveScenario.js";
+const admittedCollection = (collection) => [
+    "frames",
+    "interaction_events",
+    "process_samples",
+    "filesystem_checkpoints",
+    "shim_events",
+    "protocol_events",
+].includes(collection);
+const reactiveObservations = (capture) => (capture.event_journal ?? []).flatMap((location) => {
+    if (!admittedCollection(location.collection))
+        return [];
+    const observation = projectProcessObservation(capture, location);
+    return observation === null ? [] : [observation];
+});
+const validateTransitionDeclaration = (transition, next, context) => {
+    const { index, scenario, require } = context;
+    const path = `reactive_run.transitions[${String(index)}]`;
+    const declared = scenario.states
+        .find(({ id }) => id === transition.state_before)
+        ?.on.find(({ id }) => id === transition.transition_id);
+    require(declared !==
+        undefined, path, "reactive transition is not declared by its recorded source state");
+    if (declared !== undefined) {
+        const stateAfter = declared.target.kind === "goto" ? declared.target.state : null;
+        const outcome = declared.target.kind === "finish" ? declared.target.outcome : null;
+        require(transition.state_after === stateAfter &&
+            transition.outcome ===
+                outcome, path, "reactive transition target or outcome differs from the committed graph");
+        require(canonicalize(transition.action_types) ===
+            canonicalize(declared.actions.map(({ type }) => type)), `${path}.action_types`, "reactive transition actions differ from the committed graph");
+    }
+    require(transition.sequence ===
+        index, `${path}.sequence`, "reactive transition sequence must be contiguous from zero");
+    if (next !== undefined)
+        require(transition.state_after ===
+            next.state_before, `reactive_run.transitions[${String(index + 1)}].state_before`, "reactive transition states must be contiguous");
+};
+const validateTransitionDeclarations = (run, scenario, require) => {
+    require(run.transitions[0]?.state_before === scenario.initial_state ||
+        run.transitions.length ===
+            0, "reactive_run.transitions[0].state_before", "reactive transition journal must start at the declared initial state");
+    for (const [index, transition] of run.transitions.entries())
+        validateTransitionDeclaration(transition, run.transitions[index + 1], {
+            index,
+            scenario,
+            require,
+        });
+};
+const commitRecordedEffects = (options) => commitProcessReactiveProposal(options.scenario, options.proposal, options.recordedFailure === undefined
+    ? options.proposal.effects.map((_, index) => {
+        const eventId = options.expected?.action_event_ids[index];
+        const observation = eventId === undefined
+            ? undefined
+            : options.observations.get(eventId);
+        return observation === undefined
+            ? { status: "rejected" }
+            : { status: "succeeded", observation };
+    })
+    : [
+        options.recordedFailure === "target_lost"
+            ? { status: "target_lost" }
+            : { status: "rejected" },
+    ], { committedSensitiveInputs: true });
+const replayTransitions = (scenario, run, observations, require) => {
+    const observationsById = new Map(observations.map((observation) => [observation.event_id, observation]));
+    let snapshot = createProcessReactiveSnapshot(scenario);
+    let transitionIndex = 0;
+    const advance = (input) => {
+        let decision = reduceProcessReactiveScenario(scenario, snapshot, input);
+        if (decision.kind === "proposal") {
+            const proposal = decision;
+            decision = commitRecordedEffects({
+                scenario,
+                proposal: decision,
+                expected: run.transitions[transitionIndex],
+                observations: observationsById,
+                recordedFailure: run.transitions[transitionIndex] === undefined &&
+                    decision.effects.length > 0 &&
+                    (run.outcome === "action_rejected" || run.outcome === "target_lost")
+                    ? run.outcome
+                    : undefined,
+            });
+            require(decision.kind !== "finished" ||
+                decision.outcome !== "action_rejected" ||
+                run.outcome ===
+                    "action_rejected", `reactive_run.transitions[${String(transitionIndex)}].action_event_ids`, `recorded action observations do not match proposed effects: ${canonicalize({
+                effects: proposal.effects,
+                observations: run.transitions[transitionIndex]?.action_event_ids.map((eventId) => observationsById.get(eventId)),
+            })}`);
+        }
+        if (decision.kind === "transition") {
+            const expected = run.transitions[transitionIndex];
+            require(expected !== undefined &&
+                canonicalize(decision.record) ===
+                    canonicalize(expected), `reactive_run.transitions[${String(transitionIndex)}]`, "reactive transition differs from deterministic journal replay");
+            transitionIndex += 1;
+        }
+        snapshot = decision.snapshot;
+    };
+    const advanceControl = (control, index) => {
+        require(snapshot.status !== "finished" ||
+            control.kind ===
+                "cleanup_failed", `reactive_run.controls[${String(index)}]`, "reactive control cannot follow a finished run");
+        advance(control.kind === "state_deadline"
+            ? {
+                kind: control.kind,
+                state_id: snapshot.active_state,
+                state_entry_capture_order: snapshot.state_entry_capture_order,
+            }
+            : { kind: control.kind });
+    };
+    let controlIndex = 0;
+    for (const observation of observations) {
+        while ((run.controls[controlIndex]?.after_capture_order ??
+            Number.MAX_SAFE_INTEGER) < observation.capture_order) {
+            const control = run.controls[controlIndex];
+            advanceControl(control, controlIndex);
+            controlIndex += 1;
+        }
+        advance({ kind: "observation", observation });
+    }
+    for (; controlIndex < run.controls.length; controlIndex += 1) {
+        const control = run.controls[controlIndex];
+        advanceControl(control, controlIndex);
+    }
+    require(transitionIndex ===
+        run.transitions
+            .length, "reactive_run.transitions", `reactive transition journal is not reproduced by deterministic replay (replayed ${String(transitionIndex)} of ${String(run.transitions.length)}; outcome ${snapshot.outcome})`);
+    return snapshot;
+};
+const validateControls = (run, observations, require) => {
+    const admittedOrders = new Set([
+        -1,
+        ...observations.map(({ capture_order }) => capture_order),
+    ]);
+    for (const [index, control] of run.controls.entries()) {
+        require(control.sequence ===
+            index, `reactive_run.controls[${String(index)}].sequence`, "reactive control sequence must be contiguous");
+        require(admittedOrders.has(control.after_capture_order), `reactive_run.controls[${String(index)}].after_capture_order`, "reactive control cutoff must identify the last admitted observation");
+        require(index === 0 ||
+            control.after_capture_order >=
+                run.controls[index - 1]
+                    .after_capture_order, `reactive_run.controls[${String(index)}].after_capture_order`, "reactive control cutoffs must be ordered");
+    }
+};
+/** Validate one capture's reactive journal by replaying the production reducer. */
+export const validateProcessCaptureReactiveRun = (capture, require) => {
+    const declared = capture.manifest.scenario["reactive"];
+    const run = capture.reactive_run;
+    const declaredReactive = declared !== undefined && declared !== null;
+    require(declaredReactive ===
+        (run !==
+            null), "reactive_run", "reactive result presence must match the committed scenario");
+    if (run === null)
+        return;
+    const parsed = processReactiveScenarioSchema.safeParse(declared);
+    require(parsed.success, "manifest.scenario.reactive", "committed reactive scenario does not satisfy its declared schema");
+    if (!parsed.success)
+        return;
+    require(run.status === "finished" &&
+        run.outcome !==
+            null, "reactive_run.outcome", "completed capture requires a finished reactive outcome");
+    validateTransitionDeclarations(run, parsed.data, require);
+    const observations = reactiveObservations(capture);
+    validateControls(run, observations, require);
+    const snapshot = replayTransitions(parsed.data, run, observations, require);
+    require(snapshot.outcome ===
+        run.outcome, "reactive_run.outcome", "reactive outcome differs from deterministic journal replay");
+    require(snapshot.active_state ===
+        run.active_state, "reactive_run.active_state", "reactive active state differs from deterministic journal replay");
+};

package/dist/domain/processCaptureValidation.js

@@ -1,3 +1,4 @@
+import { validateProcessCaptureReactiveRun } from "./processCaptureReactiveValidation.js";
 import { replayMachineSchema } from "./replayMachine.js";
 import { digestProcessCommitment } from "./processScenario.js";
 const orderedTimestamps = (values) => values.every((value, index) => index === 0 || value.at_ms >= values[index - 1].at_ms);
@@ -209,5 +210,6 @@ export const validateProcessCapture = (capture) => {
     validateLifecycle(capture, require);
     validateShimEvents(capture, require);
     validateReplayEvents(capture, require);
+    validateProcessCaptureReactiveRun(capture, require);
     return issues;
 };

package/dist/domain/processObservation.js

@@ -60,13 +60,22 @@ const atMilliseconds = (value) => {
         }
     return null;
 };
-const subjectFor = (source, value) => {
+/** Derive the stable capture-local identity for one normalized observation. */
+export const processObservationSubject = (source, value) => {
     if (typeof value !== "object" || value === null || Array.isArray(value))
         return null;
-    if (source === "process" && typeof value["pid"] === "number")
-        return `process:${String(value["pid"])}`;
-    if (source === "filesystem" && typeof value["name"] === "string")
-        return `checkpoint:${value["name"]}`;
+    if (source === "process" && "pid" in value && typeof value.pid === "number")
+        return `process:${String(value.pid)}`;
+    if (source === "filesystem" &&
+        "name" in value &&
+        typeof value.name === "string")
+        return `checkpoint:${value.name}`;
+    if (source === "shim" &&
+        "command" in value &&
+        typeof value.command === "string")
+        return "route_index" in value && typeof value.route_index === "number"
+            ? `shim:${value.command}:route:${String(value.route_index)}`
+            : `shim:${value.command}:unmatched`;
     return null;
 };
 const projectedRecord = (capture, location) => {
@@ -133,7 +142,7 @@ const projectedRecord = (capture, location) => {
     return {
         source: projected.source,
         captured_at_ms: atMilliseconds(payload),
-        subject_id: subjectFor(projected.source, payload),
+        subject_id: processObservationSubject(projected.source, payload),
         payload,
     };
 };

package/dist/domain/processReactiveRuntime.js

@@ -2,6 +2,22 @@ import { matchProcessReactiveTrigger } from "./processReactiveMatching.js";
 import { PROCESS_REACTIVE_LIMITS, } from "./processReactiveScenario.js";
 export { commitProcessReactiveProposal } from "./processReactiveTransition.js";
 const counterValue = (counters, id) => counters.find((counter) => counter.id === id)?.count ?? 0;
+const observeInput = (snapshot, observation) => {
+    const duplicate = snapshot.observations.find(({ event_id }) => event_id === observation.event_id);
+    if (duplicate !== undefined)
+        return { kind: "invalid" };
+    const prior = snapshot.observations.at(-1);
+    if ((prior !== undefined && observation.capture_order <= prior.capture_order) ||
+        snapshot.observations.length >= PROCESS_REACTIVE_LIMITS.retainedObservations)
+        return { kind: "invalid" };
+    return {
+        kind: "new",
+        snapshot: {
+            ...snapshot,
+            observations: [...snapshot.observations, observation],
+        },
+    };
+};
 /** Create the initial immutable reducer state for one validated scenario. */
 export const createProcessReactiveSnapshot = (scenario) => ({
     status: "running",
@@ -35,6 +51,8 @@ const reduceControlInput = (snapshot, input) => {
             : { kind: "waiting", snapshot, evaluations: [] };
     if (input.kind === "scenario_deadline")
         return finishedDecision(snapshot, "scenario_deadline");
+    if (input.kind === "target_lost")
+        return finishedDecision(snapshot, "target_lost");
     return finishedDecision(snapshot, "cancelled");
 };
 /** Advance one validated scenario using only an observation or explicit deadline. */
@@ -44,17 +62,10 @@ export const reduceProcessReactiveScenario = (scenario, snapshot, input) => {
         return controlDecision;
     if (input.kind !== "observation")
         return finishedDecision(snapshot, "capture_incomplete");
-    const prior = snapshot.observations.at(-1);
-    if ((prior !== undefined &&
-        input.observation.capture_order <= prior.capture_order) ||
-        snapshot.observations.some(({ event_id }) => event_id === input.observation.event_id))
-        return finishedDecision(snapshot, "capture_incomplete");
-    if (snapshot.observations.length >= PROCESS_REACTIVE_LIMITS.retainedObservations)
+    const admitted = observeInput(snapshot, input.observation);
+    if (admitted.kind === "invalid")
         return finishedDecision(snapshot, "capture_incomplete");
-    const observed = {
-        ...snapshot,
-        observations: [...snapshot.observations, input.observation],
-    };
+    const observed = admitted.snapshot;
     const state = scenario.states.find(({ id }) => id === observed.active_state);
     if (state === undefined)
         return finishedDecision(observed, "target_lost");

package/dist/domain/processReactiveScenario.js

@@ -128,6 +128,7 @@ const processReactiveActionSchema = z.discriminatedUnion("type", [
         columns: z.number().int().min(1).max(1_000),
         rows: z.number().int().min(1).max(1_000),
     }),
+    z.strictObject({ type: z.literal("close_stdin") }),
     z.strictObject({
         type: z.literal("send_signal"),
         target: signalTargetSchema,