rea-agents 2.4.0 → 2.5.0

package/dist/cliBrowserAdvancedCommands.js

@@ -5,7 +5,7 @@ import { CdpBrowserProvider } from "./browser/CdpBrowserProvider.js";
 import { logCliCommand } from "./cliLogging.js";
 import { parseConfig } from "./config.js";
 import { AnalysisInputError, projectAnalysisError } from "./domain/errors.js";
-import { compareWebCapturesInputSchema } from "./domain/webCaptureDiff.js";
+import { browserCaptureComparisonInputSchema } from "./domain/browserCaptureComparison.js";
 import { discoverWebMcpToolsInputSchema } from "./domain/webMcpDiscovery.js";
 import { captureWebScreenshotInputSchema, compareWebScreenshotsInputSchema, } from "./domain/webScreenshot.js";
 import { CLI_COMMANDS } from "./cliCommandNames.js";
@@ -92,7 +92,7 @@ const registerWebMcp = (cli, logger) => {
 };
 const registerCaptureDiff = (cli, logger) => {
     cli.command(CLI_COMMANDS.compareWebCaptures, {
-        description: "Compare two normalized web capture JSON values",
+        description: "Compare two normalized passive captures or recorded browser scenarios",
         args: z.object({
             beforeJson: z.string().describe("Earlier normalized web capture JSON"),
             afterJson: z.string().describe("Later normalized web capture JSON"),
@@ -105,15 +105,27 @@ const registerCaptureDiff = (cli, logger) => {
                 .max(20_000)
                 .default(2_000)
                 .describe("Maximum normalized changes to return"),
+            normalizationJson: z
+                .string()
+                .default('{"rules":[]}')
+                .describe("Recorded literal normalization policy for browser scenarios"),
         }),
         run: ({ args, options }) => logCliCommand(logger, "compare-web-captures", async () => {
             const before = parseJson(args.beforeJson);
             const after = parseJson(args.afterJson);
-            const parsed = compareWebCapturesInputSchema.safeParse({
-                before,
-                after,
+            const scenarioComparison = browserCaptureComparisonInputSchema.safeParse({
+                before_scenario: before,
+                after_scenario: after,
+                normalization: parseJson(options.normalizationJson),
                 max_changes: options.maxChanges,
             });
+            const parsed = scenarioComparison.success
+                ? scenarioComparison
+                : browserCaptureComparisonInputSchema.safeParse({
+                    before,
+                    after,
+                    max_changes: options.maxChanges,
+                });
             if (!parsed.success)
                 return inputError("compare_web_captures");
             const result = await compareWebCaptureEvidence(new CdpBrowserProvider(), parsed.data);

package/dist/cliBrowserCommands.js

@@ -93,6 +93,7 @@ const registerPageInspection = (cli, logger) => {
                 websocket_shape_approved: options.websocketShapeApproved,
                 include_script_sources: options.includeScriptSources,
                 include_storage_keys: options.includeStorageKeys,
+                include_storage_fingerprints: options.includeStorageFingerprints,
                 limits: {
                     max_frames: options.maxFrames,
                     max_dom_nodes: options.maxDomNodes,

package/dist/cliBrowserScenarioCommands.js

@@ -0,0 +1,43 @@
+import { Cli } from "incur";
+import { z } from "zod";
+import { captureBrowserScenario } from "./application/BrowserScenarioCaptureService.js";
+import { loadConfiguredPermissionAuthority } from "./application/PermissionConfiguration.js";
+import { PlaywrightBrowserScenarioProvider } from "./browser/PlaywrightBrowserScenarioProvider.js";
+import { CLI_COMMANDS } from "./cliCommandNames.js";
+import { parseCliJsonInput } from "./cliJsonInput.js";
+import { logCliCommand } from "./cliLogging.js";
+import { parseConfig } from "./config.js";
+import { AnalysisInputError, projectAnalysisError } from "./domain/errors.js";
+import { browserScenarioSchema } from "./domain/browserScenario.js";
+const OPERATION = "capture_browser_scenario";
+/** Register the one-shot controlled browser scenario command. */
+export const registerBrowserScenarioCommands = (cli, logger) => {
+    cli.command(CLI_COMMANDS.captureBrowserScenario, {
+        description: "Run one approved, bounded Playwright browser scenario and return Evidence",
+        args: z.object({
+            inputJson: z
+                .string()
+                .describe("Inline browser scenario JSON or JSON file path"),
+        }),
+        run: ({ args }) => logCliCommand(logger, CLI_COMMANDS.captureBrowserScenario, async () => {
+            const input = await parseCliJsonInput(args.inputJson, OPERATION);
+            if (!input.ok)
+                return input.error;
+            const scenario = browserScenarioSchema.safeParse(input.value);
+            if (!scenario.success)
+                return cliError(new AnalysisInputError(OPERATION));
+            const config = parseConfig(process.env);
+            if (!config.ok)
+                return cliError(config.error);
+            const authority = await loadConfiguredPermissionAuthority(config.value);
+            if (!authority.ok)
+                return cliError(authority.error);
+            const result = await captureBrowserScenario(new PlaywrightBrowserScenarioProvider(), authority.value, scenario.data);
+            return result.ok ? result.value : cliError(result.error);
+        }),
+    });
+};
+const cliError = (error) => ({
+    error: "Browser scenario capture failed",
+    ...projectAnalysisError(error),
+});

package/dist/cliCommandNames.js

@@ -12,9 +12,11 @@ export const CLI_COMMANDS = Object.freeze({
     capabilities: "capabilities",
     providers: "providers",
     function: "function",
+    instructions: "instructions",
     search: "search",
     importReferenceSource: "import-reference-source",
     inventoryArtifact: "inventory-artifact",
+    inspectArtifact: "inspect-artifact",
     extractArtifact: "extract-artifact",
     inspectManagedArtifact: "inspect-managed-artifact",
     inspectManagedMembers: "inspect-managed-members",
@@ -44,18 +46,24 @@ export const CLI_COMMANDS = Object.freeze({
     compareWebCaptures: "compare-web-captures",
     captureWebScreenshot: "capture-web-screenshot",
     compareWebScreenshots: "compare-web-screenshots",
+    captureBrowserScenario: "capture-browser-scenario",
     listElectronTargets: "list-electron-targets",
     inspectElectronPage: "inspect-electron-page",
+    listJavaScriptRuntimeTargets: "list-javascript-runtime-targets",
+    observeJavaScriptRuntime: "observe-javascript-runtime",
     analyzeJavaScriptApplication: "analyze-javascript-application",
     reconcileJavaScriptRuntime: "reconcile-javascript-runtime",
     traceApplicationFeature: "trace-application-feature",
     traceJavaScriptSemantics: "trace-javascript-semantics",
     compareApplicationVersions: "compare-application-versions",
+    compareSourceToBundle: "compare-source-to-bundle",
     compareJavaScriptExportShapes: "compare-javascript-export-shapes",
     runReplayMachine: "run-replay-machine",
     runControlledReplay: "run-controlled-replay",
     prepareNodeCharacterization: "prepare-node-characterization",
     executeNodeCharacterization: "execute-node-characterization",
+    buildReconstructionObligationLedger: "build-reconstruction-obligation-ledger",
+    evaluateReconstructionReadiness: "evaluate-reconstruction-readiness",
     commitReconstructionCoverage: "commit-reconstruction-coverage",
     queryReconstructionCoverage: "query-reconstruction-coverage",
 });

package/dist/cliJavaScriptRuntimeCommands.js

@@ -0,0 +1,164 @@
+import { Cli, z } from "incur";
+import { listJavaScriptRuntimeTargets, observeJavaScriptRuntime, } from "./application/JavaScriptRuntimeObservationService.js";
+import { loadConfiguredPermissionAuthority } from "./application/PermissionConfiguration.js";
+import { V8InspectorProvider } from "./browser/V8InspectorProvider.js";
+import { CLI_COMMANDS } from "./cliCommandNames.js";
+import { logCliCommand } from "./cliLogging.js";
+import { parseConfig } from "./config.js";
+import { javascriptRuntimeKindSchema, listJavaScriptRuntimeTargetsInputSchema, observeJavaScriptRuntimeInputSchema, } from "./domain/javascriptRuntimeObservation.js";
+import { AnalysisInputError, projectAnalysisError } from "./domain/errors.js";
+const scopeOptions = {
+    allowedFileRoots: z
+        .array(z.string().min(1))
+        .optional()
+        .describe("Exact roots; defaults to REA_V8_INSPECTOR_FILE_ROOTS_JSON"),
+    allowedOrigins: z
+        .array(z.string().min(1))
+        .optional()
+        .describe("Exact origins; defaults to REA_V8_INSPECTOR_ALLOWED_ORIGINS_JSON"),
+    approved: z.boolean().default(false).describe("Approve passive attachment"),
+};
+const listOptionsSchema = z.object({
+    ...scopeOptions,
+    offset: z
+        .number()
+        .int()
+        .min(0)
+        .default(0)
+        .describe("Zero-based target offset"),
+    limit: z
+        .number()
+        .int()
+        .min(1)
+        .max(200)
+        .default(100)
+        .describe("Maximum targets to return"),
+});
+const observeOptionsSchema = z.object({
+    ...scopeOptions,
+    runtimeKind: javascriptRuntimeKindSchema.describe("Declared target role; Inspector cannot authenticate the Electron role"),
+    observationMs: z
+        .number()
+        .int()
+        .min(0)
+        .max(10_000)
+        .default(100)
+        .describe("Bounded observation window in milliseconds"),
+    maxEvents: z
+        .number()
+        .int()
+        .min(1)
+        .max(50_000)
+        .default(10_000)
+        .describe("Maximum retained protocol events"),
+    maxScripts: z
+        .number()
+        .int()
+        .min(1)
+        .max(10_000)
+        .default(2_000)
+        .describe("Maximum retained scripts"),
+    maxExecutionContexts: z
+        .number()
+        .int()
+        .min(1)
+        .max(5_000)
+        .default(1_000)
+        .describe("Maximum retained execution contexts"),
+    maxLocationBytes: z
+        .number()
+        .int()
+        .min(64)
+        .max(65_536)
+        .default(16_384)
+        .describe("Maximum bytes in one protocol location"),
+    maxTotalMetadataBytes: z
+        .number()
+        .int()
+        .min(1_024)
+        .max(32 * 1_024 * 1_024)
+        .default(4 * 1_024 * 1_024)
+        .describe("Maximum retained metadata bytes"),
+});
+/** Register CLI equivalents of passive V8 Inspector tools. */
+export const registerJavaScriptRuntimeObservationCommands = (cli, logger) => {
+    cli.command(CLI_COMMANDS.listJavaScriptRuntimeTargets, {
+        description: "List approved Node/Electron V8 Inspector targets",
+        args: z.object({
+            endpoint: z.string().describe("Configured literal-loopback endpoint"),
+        }),
+        options: listOptionsSchema,
+        run: ({ args, options }) => logCliCommand(logger, CLI_COMMANDS.listJavaScriptRuntimeTargets, async () => {
+            const context = await runtimeContext();
+            if (!context.ok)
+                return context.error;
+            const parsed = listJavaScriptRuntimeTargetsInputSchema.safeParse({
+                inspector_endpoint: args.endpoint,
+                allowed_file_roots: options.allowedFileRoots ?? context.allowedFileRoots,
+                allowed_origins: options.allowedOrigins ?? context.allowedOrigins,
+                approved: options.approved,
+                offset: options.offset,
+                limit: options.limit,
+            });
+            if (!parsed.success)
+                return inputError("list_javascript_runtime_targets");
+            const result = await listJavaScriptRuntimeTargets(context.provider, context.authority, parsed.data);
+            return result.ok ? result.value : cliError(result.error);
+        }),
+    });
+    cli.command(CLI_COMMANDS.observeJavaScriptRuntime, {
+        description: "Passively observe one exact Node/Electron Inspector target",
+        args: z.object({
+            endpoint: z.string().describe("Configured literal-loopback endpoint"),
+            targetId: z
+                .string()
+                .describe("Target from list-javascript-runtime-targets"),
+        }),
+        options: observeOptionsSchema,
+        run: ({ args, options }) => logCliCommand(logger, CLI_COMMANDS.observeJavaScriptRuntime, async () => {
+            const context = await runtimeContext();
+            if (!context.ok)
+                return context.error;
+            const parsed = observeJavaScriptRuntimeInputSchema.safeParse({
+                inspector_endpoint: args.endpoint,
+                allowed_file_roots: options.allowedFileRoots ?? context.allowedFileRoots,
+                allowed_origins: options.allowedOrigins ?? context.allowedOrigins,
+                target_id: args.targetId,
+                runtime_kind: options.runtimeKind,
+                approved: options.approved,
+                observation_ms: options.observationMs,
+                limits: {
+                    max_events: options.maxEvents,
+                    max_scripts: options.maxScripts,
+                    max_execution_contexts: options.maxExecutionContexts,
+                    max_location_bytes: options.maxLocationBytes,
+                    max_total_metadata_bytes: options.maxTotalMetadataBytes,
+                },
+            });
+            if (!parsed.success)
+                return inputError("observe_javascript_runtime");
+            const result = await observeJavaScriptRuntime(context.provider, context.authority, parsed.data);
+            return result.ok ? result.value : cliError(result.error);
+        }),
+    });
+};
+const runtimeContext = async () => {
+    const config = parseConfig(process.env);
+    if (!config.ok)
+        return { ok: false, error: cliError(config.error) };
+    const authority = await loadConfiguredPermissionAuthority(config.value);
+    if (!authority.ok)
+        return { ok: false, error: cliError(authority.error) };
+    return {
+        ok: true,
+        authority: authority.value,
+        provider: new V8InspectorProvider(),
+        allowedFileRoots: config.value.v8InspectorFileRoots,
+        allowedOrigins: config.value.v8InspectorAllowedOrigins,
+    };
+};
+const inputError = (operation) => cliError(new AnalysisInputError(operation));
+const cliError = (error) => ({
+    error: "JavaScript runtime observation failed",
+    ...projectAnalysisError(error),
+});

package/dist/cliObservationOptions.js

@@ -54,6 +54,10 @@ export const browserPageInspectionOptions = z.object({
         .boolean()
         .default(false)
         .describe("Include storage key names without values"),
+    includeStorageFingerprints: z
+        .boolean()
+        .default(false)
+        .describe("Include content-derived storage fingerprints"),
     maxFrames: boundedCount("page frames", 1_000, 200),
     maxDomNodes: boundedCount("DOM nodes", 10_000, 2_000),
     maxAxNodes: boundedCount("accessibility nodes", 10_000, 2_000),

package/dist/cliPolicyCommands.js

@@ -9,6 +9,7 @@ import { CLI_COMMANDS } from "./cliCommandNames.js";
 const capabilitySchema = z.enum([
     "process_capture",
     "browser_observe",
+    "browser_automate",
     "electron_observe",
     "evidence_read",
     "evidence_write",

package/dist/config/environment.js

@@ -52,9 +52,21 @@ const environmentSchema = z
     REA_BROWSER_OBSERVE_ENABLED: z.enum(["true", "false"]).default("false"),
     REA_BROWSER_CDP_ENDPOINTS_JSON: z.string().default("[]"),
     REA_BROWSER_ALLOWED_ORIGINS_JSON: z.string().default("[]"),
+    REA_BROWSER_SCENARIO_ENABLED: z.enum(["true", "false"]).default("false"),
+    REA_BROWSER_SCENARIO_AUTO_GRANT: z.enum(["true", "false"]).default("false"),
+    REA_BROWSER_SCENARIO_EXECUTABLE_ROOTS_JSON: z.string().default("[]"),
+    REA_BROWSER_SCENARIO_CDP_ENDPOINTS_JSON: z.string().default("[]"),
+    REA_BROWSER_SCENARIO_ALLOWED_ORIGINS_JSON: z.string().default("[]"),
+    REA_BROWSER_SCENARIO_ALLOWED_ENV_JSON: z.string().default("[]"),
     REA_ELECTRON_OBSERVE_ENABLED: z.enum(["true", "false"]).default("false"),
     REA_ELECTRON_CDP_ENDPOINTS_JSON: z.string().default("[]"),
     REA_ELECTRON_FILE_ROOTS_JSON: z.string().default("[]"),
+    REA_V8_INSPECTOR_OBSERVE_ENABLED: z
+        .enum(["true", "false"])
+        .default("false"),
+    REA_V8_INSPECTOR_ENDPOINTS_JSON: z.string().default("[]"),
+    REA_V8_INSPECTOR_FILE_ROOTS_JSON: z.string().default("[]"),
+    REA_V8_INSPECTOR_ALLOWED_ORIGINS_JSON: z.string().default("[]"),
     REA_JAVASCRIPT_REPLAY_ENABLED: z.enum(["true", "false"]).default("false"),
     REA_JAVASCRIPT_REPLAY_ROOTS_JSON: z.string().default("[]"),
     REA_JAVASCRIPT_REPLAY_NODE_PATH: z

package/dist/config/parseConfig.js

@@ -37,18 +37,9 @@ const parseAllArrays = (env) => {
     const secretPatterns = parseStringArray(env.REA_REFERENCE_SECRET_PATTERNS_JSON, "REA_REFERENCE_SECRET_PATTERNS_JSON");
     if (!secretPatterns.ok)
         return secretPatterns;
-    const browserEndpoints = parseBrowserArray(env.REA_BROWSER_CDP_ENDPOINTS_JSON, "REA_BROWSER_CDP_ENDPOINTS_JSON", browserEndpointSchema, 16);
-    if (!browserEndpoints.ok)
-        return browserEndpoints;
-    const browserOrigins = parseBrowserArray(env.REA_BROWSER_ALLOWED_ORIGINS_JSON, "REA_BROWSER_ALLOWED_ORIGINS_JSON", browserOriginSchema, 32);
-    if (!browserOrigins.ok)
-        return browserOrigins;
-    const electronEndpoints = parseBrowserArray(env.REA_ELECTRON_CDP_ENDPOINTS_JSON, "REA_ELECTRON_CDP_ENDPOINTS_JSON", browserEndpointSchema, 16);
-    if (!electronEndpoints.ok)
-        return electronEndpoints;
-    const electronFileRoots = parseElectronFileRoots(env.REA_ELECTRON_FILE_ROOTS_JSON);
-    if (!electronFileRoots.ok)
-        return electronFileRoots;
+    const observations = parseObservationArrays(env);
+    if (!observations.ok)
+        return observations;
     const javascriptReplayRoots = parseAbsoluteRoots(env.REA_JAVASCRIPT_REPLAY_ROOTS_JSON, "REA_JAVASCRIPT_REPLAY_ROOTS_JSON");
     if (!javascriptReplayRoots.ok)
         return javascriptReplayRoots;
@@ -65,12 +56,57 @@ const parseAllArrays = (env) => {
         analysisSnapshotRoots: analysisSnapshotRoots.value,
         referenceRoots: referenceRoots.value,
         secretPatterns: secretPatterns.value,
+        ...observations.value,
+        javascriptReplayRoots: javascriptReplayRoots.value,
+        managedRuntimeRoots: managedRuntimeRoots.value,
+    });
+};
+const parseObservationArrays = (env) => {
+    const browserEndpoints = parseBrowserArray(env.REA_BROWSER_CDP_ENDPOINTS_JSON, "REA_BROWSER_CDP_ENDPOINTS_JSON", browserEndpointSchema, 16);
+    if (!browserEndpoints.ok)
+        return browserEndpoints;
+    const browserOrigins = parseBrowserArray(env.REA_BROWSER_ALLOWED_ORIGINS_JSON, "REA_BROWSER_ALLOWED_ORIGINS_JSON", browserOriginSchema, 32);
+    if (!browserOrigins.ok)
+        return browserOrigins;
+    const browserScenarioExecutableRoots = parseAbsoluteRoots(env.REA_BROWSER_SCENARIO_EXECUTABLE_ROOTS_JSON, "REA_BROWSER_SCENARIO_EXECUTABLE_ROOTS_JSON");
+    if (!browserScenarioExecutableRoots.ok)
+        return browserScenarioExecutableRoots;
+    const browserScenarioEndpoints = parseBrowserArray(env.REA_BROWSER_SCENARIO_CDP_ENDPOINTS_JSON, "REA_BROWSER_SCENARIO_CDP_ENDPOINTS_JSON", browserEndpointSchema, 16);
+    if (!browserScenarioEndpoints.ok)
+        return browserScenarioEndpoints;
+    const browserScenarioOrigins = parseBrowserArray(env.REA_BROWSER_SCENARIO_ALLOWED_ORIGINS_JSON, "REA_BROWSER_SCENARIO_ALLOWED_ORIGINS_JSON", browserOriginSchema, 32);
+    if (!browserScenarioOrigins.ok)
+        return browserScenarioOrigins;
+    const browserScenarioEnvironment = parseStringArray(env.REA_BROWSER_SCENARIO_ALLOWED_ENV_JSON, "REA_BROWSER_SCENARIO_ALLOWED_ENV_JSON");
+    if (!browserScenarioEnvironment.ok)
+        return browserScenarioEnvironment;
+    const electronEndpoints = parseBrowserArray(env.REA_ELECTRON_CDP_ENDPOINTS_JSON, "REA_ELECTRON_CDP_ENDPOINTS_JSON", browserEndpointSchema, 16);
+    if (!electronEndpoints.ok)
+        return electronEndpoints;
+    const electronFileRoots = parseElectronFileRoots(env.REA_ELECTRON_FILE_ROOTS_JSON);
+    if (!electronFileRoots.ok)
+        return electronFileRoots;
+    const v8InspectorEndpoints = parseBrowserArray(env.REA_V8_INSPECTOR_ENDPOINTS_JSON, "REA_V8_INSPECTOR_ENDPOINTS_JSON", browserEndpointSchema, 16);
+    if (!v8InspectorEndpoints.ok)
+        return v8InspectorEndpoints;
+    const v8InspectorFileRoots = parseAbsoluteRoots(env.REA_V8_INSPECTOR_FILE_ROOTS_JSON, "REA_V8_INSPECTOR_FILE_ROOTS_JSON");
+    if (!v8InspectorFileRoots.ok)
+        return v8InspectorFileRoots;
+    const v8InspectorOrigins = parseBrowserArray(env.REA_V8_INSPECTOR_ALLOWED_ORIGINS_JSON, "REA_V8_INSPECTOR_ALLOWED_ORIGINS_JSON", browserOriginSchema, 32);
+    if (!v8InspectorOrigins.ok)
+        return v8InspectorOrigins;
+    return ok({
         browserEndpoints: browserEndpoints.value,
         browserOrigins: browserOrigins.value,
+        browserScenarioExecutableRoots: browserScenarioExecutableRoots.value,
+        browserScenarioEndpoints: browserScenarioEndpoints.value,
+        browserScenarioOrigins: browserScenarioOrigins.value,
+        browserScenarioEnvironment: browserScenarioEnvironment.value,
         electronEndpoints: electronEndpoints.value,
         electronFileRoots: electronFileRoots.value,
-        javascriptReplayRoots: javascriptReplayRoots.value,
-        managedRuntimeRoots: managedRuntimeRoots.value,
+        v8InspectorEndpoints: v8InspectorEndpoints.value,
+        v8InspectorFileRoots: v8InspectorFileRoots.value,
+        v8InspectorOrigins: v8InspectorOrigins.value,
     });
 };
 const parseAbsoluteRoots = (value, name) => {
@@ -98,6 +134,19 @@ const appendBrowserObservationCeiling = (ceilings, env, arrays) => {
         network: browserNetworkScope(arrays.browserOrigins),
     }));
 };
+const appendBrowserScenarioCeiling = (ceilings, env, arrays) => {
+    if (env.REA_BROWSER_SCENARIO_ENABLED !== "true")
+        return;
+    ceilings.push(permissionScope("browser_automate", [], {
+        executables: arrays.browserScenarioExecutableRoots,
+        environment_names: arrays.browserScenarioEnvironment,
+        origins: [
+            ...arrays.browserScenarioEndpoints,
+            ...arrays.browserScenarioOrigins,
+        ],
+        network: browserNetworkScope(arrays.browserScenarioOrigins),
+    }));
+};
 const appendElectronObservationCeiling = (ceilings, env, arrays) => {
     if (env.REA_ELECTRON_OBSERVE_ENABLED !== "true")
         return;
@@ -106,6 +155,14 @@ const appendElectronObservationCeiling = (ceilings, env, arrays) => {
         network: "loopback",
     }));
 };
+const appendV8InspectorObservationCeiling = (ceilings, env, arrays) => {
+    if (env.REA_V8_INSPECTOR_OBSERVE_ENABLED !== "true")
+        return;
+    ceilings.push(permissionScope("v8_inspector_observe", arrays.v8InspectorFileRoots, {
+        origins: [...arrays.v8InspectorEndpoints, ...arrays.v8InspectorOrigins],
+        network: "loopback",
+    }));
+};
 const appendNativeMountCeiling = (ceilings, env) => {
     if (env.REA_ARTIFACT_NATIVE_MOUNT_ENABLED === "true")
         ceilings.push(permissionScope("native_mount", [], { mount: true }));
@@ -147,7 +204,9 @@ const buildPermissionCeilings = (env, arrays) => {
     ];
     appendProcessCaptureCeiling(ceilings, env, arrays);
     appendBrowserObservationCeiling(ceilings, env, arrays);
+    appendBrowserScenarioCeiling(ceilings, env, arrays);
     appendElectronObservationCeiling(ceilings, env, arrays);
+    appendV8InspectorObservationCeiling(ceilings, env, arrays);
     appendNativeMountCeiling(ceilings, env);
     appendJavaScriptReplayCeiling(ceilings, env, arrays);
     appendManagedRuntimeCeiling(ceilings, env, arrays);
@@ -186,9 +245,20 @@ const buildAppConfig = (env, arrays, permissionCeilings) => ({
     browserObservationEnabled: env.REA_BROWSER_OBSERVE_ENABLED === "true",
     browserCdpEndpoints: arrays.browserEndpoints,
     browserAllowedOrigins: arrays.browserOrigins,
+    browserScenarioPolicy: {
+        enabled: env.REA_BROWSER_SCENARIO_ENABLED === "true",
+        executableRoots: arrays.browserScenarioExecutableRoots,
+        cdpEndpoints: arrays.browserScenarioEndpoints,
+        allowedOrigins: arrays.browserScenarioOrigins,
+        allowedEnvironment: arrays.browserScenarioEnvironment,
+    },
     electronObservationEnabled: env.REA_ELECTRON_OBSERVE_ENABLED === "true",
     electronCdpEndpoints: arrays.electronEndpoints,
     electronFileRoots: arrays.electronFileRoots,
+    v8InspectorObservationEnabled: env.REA_V8_INSPECTOR_OBSERVE_ENABLED === "true",
+    v8InspectorEndpoints: arrays.v8InspectorEndpoints,
+    v8InspectorFileRoots: arrays.v8InspectorFileRoots,
+    v8InspectorAllowedOrigins: arrays.v8InspectorOrigins,
     javascriptReplayPolicy: {
         enabled: env.REA_JAVASCRIPT_REPLAY_ENABLED === "true",
         roots: arrays.javascriptReplayRoots,
@@ -204,9 +274,10 @@ const buildAppConfig = (env, arrays, permissionCeilings) => ({
         executablePath: env.REA_MANAGED_RUNTIME_EXECUTABLE_PATH,
     },
     permissionCeilings,
-    administratorPermissionGrants: administratorGrants(env.REA_PROCESS_CAPTURE_AUTO_GRANT === "true"
-        ? permissionCeilings
-        : permissionCeilings.filter(({ capability }) => capability !== "process_capture")),
+    administratorPermissionGrants: administratorGrants(permissionCeilings.filter(({ capability }) => (capability !== "process_capture" ||
+        env.REA_PROCESS_CAPTURE_AUTO_GRANT === "true") &&
+        (capability !== "browser_automate" ||
+            env.REA_BROWSER_SCENARIO_AUTO_GRANT === "true"))),
     permissionProjectRoot: env.REA_PERMISSION_PROJECT_ROOT,
     permissionProjectStore: env.REA_PERMISSION_PROJECT_STORE,
 });

package/dist/contracts/analysisSearchContract.js

@@ -0,0 +1,14 @@
+import { z } from "zod";
+/** Shared bounded provider search input fields. */
+export const analysisSearchInput = {
+    pattern: z
+        .string()
+        .min(1)
+        .max(256)
+        .describe("The literal text or bounded regex pattern to search for"),
+    mode: z.enum(["literal", "regex"]).default("literal"),
+    case_sensitive: z.boolean().default(false).describe("Whether to match case"),
+    offset: z.number().int().min(0).default(0),
+    limit: z.number().int().min(1).max(100).default(100),
+    document: z.string().optional().describe("The document name"),
+};

package/dist/contracts/applicationToolContracts.js

@@ -1,20 +1,43 @@
 import { applicationVersionComparisonResultSchema } from "../domain/javascriptApplicationVersionComparisonSchemas.js";
+import { z } from "zod";
 import { applicationFeatureTraceResultSchema } from "../domain/javascriptFeatureTraceSchemas.js";
 import { javaScriptSemanticTraceResultSchema } from "../domain/javascriptSemanticTraceSchemas.js";
 import { javaScriptExportShapeComparisonResultSchema } from "../domain/javascriptExportShapeComparisonSchemas.js";
-import { compareApplicationVersionsRequestSchema, compareJavaScriptExportShapesRequestSchema, traceApplicationFeatureRequestSchema, traceJavaScriptSemanticsRequestSchema, } from "./applicationWorkflowInputContracts.js";
+import { sourceToBundleComparisonResultSchema } from "../domain/sourceToBundleComparisonSchemas.js";
+import { compareApplicationVersionsRequestSchema, compareJavaScriptExportShapesRequestSchema, compareSourceToBundleRequestSchema, traceApplicationFeatureRequestSchema, traceJavaScriptSemanticsRequestSchema, } from "./applicationWorkflowInputContracts.js";
 import { controlledReplayInputSchema, controlledReplayOutputSchema, } from "../domain/javascriptReplay.js";
 import { nodeCharacterizationExecutionInputSchema, nodeCharacterizationExecutionOutputSchema, nodeCharacterizationPreparationInputSchema, nodeCharacterizationPreparationOutputSchema, } from "../domain/nodeRuntimeCharacterization.js";
 import { reconstructionCoverageCommitInputSchema, reconstructionCoverageCommitOutputSchema, reconstructionCoverageQueryInputSchema, } from "../application/ReconstructionCoverageService.js";
 import { reconstructionClosureResultSchema } from "../domain/reconstructionCoverage.js";
+import { reconstructionObligationLedgerInputSchema, reconstructionObligationLedgerPageSchema, } from "../domain/reconstructionObligationLedgerSchemas.js";
+import { reconstructionReadinessInputSchema, reconstructionReadinessReportSchema, } from "../domain/reconstructionReadinessSchemas.js";
 import { jsonObjectSchema } from "../domain/jsonValue.js";
 import { toolContractMetadata } from "./toolEffects.js";
 import { evidenceResultOf } from "./toolOutputSchemas.js";
-import { JAVASCRIPT_APPLICATION_VERSION_COMPARISON_EXAMPLE, JAVASCRIPT_EXPORT_SHAPE_COMPARISON_EXAMPLE, JAVASCRIPT_FEATURE_TRACE_EXAMPLE, } from "./javascriptApplicationWorkflowExamples.js";
+import { JAVASCRIPT_APPLICATION_VERSION_COMPARISON_EXAMPLE, JAVASCRIPT_EXPORT_SHAPE_COMPARISON_EXAMPLE, JAVASCRIPT_FEATURE_TRACE_EXAMPLE, SOURCE_TO_BUNDLE_COMPARISON_EXAMPLE, } from "./javascriptApplicationWorkflowExamples.js";
+import { RECONSTRUCTION_READINESS_EXAMPLE } from "./reconstructionReadinessExample.js";
 const traceOutputSchema = evidenceResultOf(applicationFeatureTraceResultSchema);
 const semanticTraceOutputSchema = evidenceResultOf(javaScriptSemanticTraceResultSchema);
 const comparisonOutputSchema = evidenceResultOf(applicationVersionComparisonResultSchema);
+const sourceToBundleOutputSchema = evidenceResultOf(sourceToBundleComparisonResultSchema);
 const exportShapeComparisonOutputSchema = evidenceResultOf(javaScriptExportShapeComparisonResultSchema);
+const reconstructionObligationLedgerOutputSchema = evidenceResultOf(reconstructionObligationLedgerPageSchema);
+const reconstructionReadinessOutputSchema = evidenceResultOf(reconstructionReadinessReportSchema
+    .pick({
+    schema: true,
+    schema_version: true,
+    report_id: true,
+    source_digest: true,
+    report_digest: true,
+    status: true,
+    summary: true,
+    metrics: true,
+})
+    .extend({
+    report_resource_uri: z
+        .string()
+        .regex(/^rea:\/\/evidence\/ev_[a-f0-9]{64}\/reconstruction-readiness-report$/u),
+}));
 const HASH = "0".repeat(64);
 const NODE_PREPARATION_EXAMPLE = jsonObjectSchema.parse({
     preparation_approved: true,
@@ -128,6 +151,20 @@ export const APPLICATION_TOOL_CONTRACTS = [
             },
         ],
     },
+    {
+        name: "compare_source_to_bundle",
+        ...toolContractMetadata("compare_source_to_bundle"),
+        description: "Compare a cryptographically committed HistoricalSourceGraph/v1 with authenticated JavaScript Application Graph Evidence supplied directly or by session Evidence ID. Uses explicit exact-digest, source-map path, current-path, suffix, and basename signals with stable weights. Classifies unchanged, modified, removed, split, merged, duplicated, and unknown; incomplete coverage and ambiguous weak signals never become absence or forced matches.",
+        kind: "application",
+        inputSchema: compareSourceToBundleRequestSchema,
+        outputSchema: sourceToBundleOutputSchema,
+        examples: [
+            {
+                title: "Compare committed historical source with a shipped bundle graph",
+                input: SOURCE_TO_BUNDLE_COMPARISON_EXAMPLE,
+            },
+        ],
+    },
     {
         name: "compare_javascript_export_shapes",
         ...toolContractMetadata("compare_javascript_export_shapes"),
@@ -226,6 +263,53 @@ export const APPLICATION_TOOL_CONTRACTS = [
             },
         ],
     },
+    {
+        name: "build_reconstruction_obligation_ledger",
+        ...toolContractMetadata("build_reconstruction_obligation_ledger"),
+        description: "Generate one deterministic page of a ReconstructionObligationLedger/v1 from an authenticated Evidence v2 bundle, reviewed obligations, and an explicit reconstruction manifest. Static candidates remain candidates; duplicate ownership, missing original or reconstruction cases, missing parser/type, weak verifier authority, unenumerated claims, contradictions, dependencies, and residual unknowns fail closed. Every page carries the same full-ledger closure digest and typed per-obligation diagnostics.",
+        kind: "application",
+        inputSchema: reconstructionObligationLedgerInputSchema,
+        outputSchema: reconstructionObligationLedgerOutputSchema,
+        examples: [
+            {
+                title: "Generate the first obligation-ledger page",
+                input: {
+                    evidence_bundle: {
+                        bundle_version: 2,
+                        artifacts: [],
+                        providers: [],
+                        environments: [],
+                        scenarios: [],
+                        captures: [],
+                        unknowns: [],
+                        records: [],
+                    },
+                    reviewed_obligations: [],
+                    manifest: {
+                        schema_version: 1,
+                        bindings: [],
+                        contradictions: [],
+                    },
+                    limits: { max_obligations: 1_000 },
+                    page: { offset: 0, limit: 50 },
+                },
+            },
+        ],
+    },
+    {
+        name: "evaluate_reconstruction_readiness",
+        ...toolContractMetadata("evaluate_reconstruction_readiness"),
+        description: "Evaluate the fixed nine-stage public reconstruction journey into a deterministic ReconstructionReadinessReport/v1. Exact capability limits, provider routing, CLI/MCP status parity, bounded authority, partial-order comparison, contradictions, obligation closure, cleanup, and replay digests fail closed. Aggregate pass is emitted only when every required stage and check passes with attributable Evidence.",
+        kind: "application",
+        inputSchema: reconstructionReadinessInputSchema,
+        outputSchema: reconstructionReadinessOutputSchema,
+        examples: [
+            {
+                title: "Evaluate the complete synthetic reconstruction journey",
+                input: RECONSTRUCTION_READINESS_EXAMPLE,
+            },
+        ],
+    },
     {
         name: "commit_reconstruction_coverage",
         ...toolContractMetadata("commit_reconstruction_coverage"),