rea-agents 2.4.0 → 2.5.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (186) hide show
  1. package/README.md +80 -18
  2. package/bridge/ghidra/ReaGhidraBridge.java +48 -1
  3. package/bridge/hopper_bridge.py +259 -24
  4. package/dist/application/AnalysisClientCleanup.js +14 -0
  5. package/dist/application/ApplicationWorkflowEvidenceResolver.js +31 -13
  6. package/dist/application/BinarySession.js +15 -4
  7. package/dist/application/BinarySessionStatus.js +31 -1
  8. package/dist/application/BrowserEvidence.js +14 -0
  9. package/dist/application/BrowserScenarioCapturePort.js +1 -0
  10. package/dist/application/BrowserScenarioCaptureService.js +53 -0
  11. package/dist/application/BrowserScenarioEvidence.js +40 -0
  12. package/dist/application/CallPathTracing.js +160 -0
  13. package/dist/application/CapabilityInventory.js +68 -12
  14. package/dist/application/CompositeProvider.js +10 -1
  15. package/dist/application/DirectAnalysis.js +7 -2
  16. package/dist/application/EnhancedLiteralTracing.js +118 -0
  17. package/dist/application/EnhancedTools.js +35 -121
  18. package/dist/application/JavaScriptApplicationWorkflowEvidence.js +13 -0
  19. package/dist/application/JavaScriptApplicationWorkflowService.js +27 -1
  20. package/dist/application/JavaScriptRuntimeObservationEvidence.js +34 -0
  21. package/dist/application/JavaScriptRuntimeObservationPort.js +1 -0
  22. package/dist/application/JavaScriptRuntimeObservationService.js +46 -0
  23. package/dist/application/JavaScriptSemanticGraphAsyncProjection.js +147 -0
  24. package/dist/application/JavaScriptSemanticGraphBuilder.js +34 -6
  25. package/dist/application/JavaScriptSemanticGraphChildProcessProjection.js +156 -0
  26. package/dist/application/JavaScriptSemanticGraphConstruction.js +2 -2
  27. package/dist/application/JavaScriptSemanticGraphDataProjection.js +203 -0
  28. package/dist/application/JavaScriptSemanticGraphFingerprintProjection.js +25 -0
  29. package/dist/application/JavaScriptSemanticGraphFlowProjection.js +129 -8
  30. package/dist/application/JavaScriptSemanticGraphObjectProjection.js +81 -0
  31. package/dist/application/JavaScriptSemanticGraphProjection.js +14 -7
  32. package/dist/application/JavaScriptSemanticGraphResourceProjection.js +59 -0
  33. package/dist/application/JavaScriptSemanticGraphValueProjection.js +77 -0
  34. package/dist/application/ProcessReactiveEffects.js +6 -0
  35. package/dist/application/ProcessReactiveHarness.js +16 -1
  36. package/dist/application/ProjectPermissionStore.js +1 -0
  37. package/dist/application/ReconstructionObligationAuthority.js +72 -0
  38. package/dist/application/ReconstructionObligationCandidates.js +265 -0
  39. package/dist/application/ReconstructionObligationLedgerDiagnostics.js +47 -0
  40. package/dist/application/ReconstructionObligationLedgerEvaluation.js +263 -0
  41. package/dist/application/ReconstructionObligationLedgerProjection.js +86 -0
  42. package/dist/application/ReconstructionObligationLedgerService.js +72 -0
  43. package/dist/application/ReconstructionObligationOriginalCases.js +33 -0
  44. package/dist/application/ReconstructionObligationPolicies.js +132 -0
  45. package/dist/application/ReconstructionReadinessService.js +48 -0
  46. package/dist/artifacts/ArtifactProvider.js +87 -22
  47. package/dist/browser/BrowserScenarioSecrets.js +53 -0
  48. package/dist/browser/BrowserScenarioSessionPort.js +1 -0
  49. package/dist/browser/CdpBrowserProvider.js +2 -2
  50. package/dist/browser/CdpCaptureDocuments.js +57 -0
  51. package/dist/browser/CdpCaptureStorage.js +71 -29
  52. package/dist/browser/CdpCaptureStorageFingerprints.js +328 -0
  53. package/dist/browser/CdpEndpoint.js +8 -6
  54. package/dist/browser/CdpPageCapture.js +2 -0
  55. package/dist/browser/JavaScriptRuntimeScope.js +38 -0
  56. package/dist/browser/PlaywrightBrowserScenarioProvider.js +253 -0
  57. package/dist/browser/PlaywrightExecutionBoundary.js +42 -0
  58. package/dist/browser/PlaywrightScenarioActions.js +62 -0
  59. package/dist/browser/PlaywrightScenarioArtifacts.js +238 -0
  60. package/dist/browser/PlaywrightScenarioBrowser.js +144 -0
  61. package/dist/browser/PlaywrightScenarioEvents.js +301 -0
  62. package/dist/browser/PlaywrightScenarioSession.js +300 -0
  63. package/dist/browser/V8InspectorCaptureProjection.js +110 -0
  64. package/dist/browser/V8InspectorEndpoint.js +72 -0
  65. package/dist/browser/V8InspectorProvider.js +267 -0
  66. package/dist/catalogIdentity.js +8 -0
  67. package/dist/cli/artifactCommands.js +39 -0
  68. package/dist/cli/coreAnalysisCommands.js +37 -0
  69. package/dist/cli.js +4 -0
  70. package/dist/cliApplicationCommands.js +30 -2
  71. package/dist/cliBrowserAdvancedCommands.js +17 -5
  72. package/dist/cliBrowserCommands.js +1 -0
  73. package/dist/cliBrowserScenarioCommands.js +43 -0
  74. package/dist/cliCommandNames.js +8 -0
  75. package/dist/cliJavaScriptRuntimeCommands.js +164 -0
  76. package/dist/cliObservationOptions.js +4 -0
  77. package/dist/cliPolicyCommands.js +1 -0
  78. package/dist/config/environment.js +12 -0
  79. package/dist/config/parseConfig.js +88 -17
  80. package/dist/contracts/analysisSearchContract.js +14 -0
  81. package/dist/contracts/applicationToolContracts.js +86 -2
  82. package/dist/contracts/applicationWorkflowInputContracts.js +18 -0
  83. package/dist/contracts/artifactToolContracts.js +22 -0
  84. package/dist/contracts/browserProviderToolContracts.js +7 -0
  85. package/dist/contracts/browserScenarioToolContracts.js +81 -0
  86. package/dist/contracts/browserToolContracts.js +88 -98
  87. package/dist/contracts/enhancedInputs.js +25 -6
  88. package/dist/contracts/functionInstructionContract.js +8 -0
  89. package/dist/contracts/hopperMemoryContracts.js +22 -0
  90. package/dist/contracts/javascriptApplicationWorkflowExamples.js +42 -0
  91. package/dist/contracts/javascriptRuntimeObservationToolContracts.js +58 -0
  92. package/dist/contracts/reconstructionReadinessExample.js +436 -0
  93. package/dist/contracts/toolContractExamples.js +5 -0
  94. package/dist/contracts/toolContractTypes.js +1 -0
  95. package/dist/contracts/toolContracts.js +13 -21
  96. package/dist/contracts/toolEffects.js +21 -0
  97. package/dist/contracts/toolOutputSchemaGroups.js +70 -20
  98. package/dist/contracts/toolOutputSchemaPrimitives.js +37 -0
  99. package/dist/domain/analysisErrorProjection.js +8 -0
  100. package/dist/domain/artifactInspection.js +347 -0
  101. package/dist/domain/browserCaptureComparison.js +82 -0
  102. package/dist/domain/browserObservation.js +8 -1
  103. package/dist/domain/browserObservationErrors.js +1 -0
  104. package/dist/domain/browserObservationSchemas.js +26 -0
  105. package/dist/domain/browserScenario.js +165 -0
  106. package/dist/domain/browserScenarioCapture.js +57 -0
  107. package/dist/domain/browserScenarioCaptureValues.js +204 -0
  108. package/dist/domain/browserScenarioDiff.js +324 -0
  109. package/dist/domain/browserScenarioDiffValues.js +157 -0
  110. package/dist/domain/browserScenarioNormalization.js +45 -0
  111. package/dist/domain/browserScenarioValues.js +372 -0
  112. package/dist/domain/hopperValues.js +10 -0
  113. package/dist/domain/javascriptRuntimeObservation.js +170 -0
  114. package/dist/domain/javascriptRuntimeReconciliationParsing.js +120 -2
  115. package/dist/domain/javascriptRuntimeReconciliationResult.js +3 -3
  116. package/dist/domain/javascriptRuntimeReconciliationRuntime.js +2 -2
  117. package/dist/domain/javascriptRuntimeReconciliationSchemas.js +1 -1
  118. package/dist/domain/javascriptSemanticAnalysis.js +5 -4
  119. package/dist/domain/javascriptSemanticAsyncEffects.js +253 -0
  120. package/dist/domain/javascriptSemanticChildProcesses.js +237 -0
  121. package/dist/domain/javascriptSemanticDataEffectHelpers.js +125 -0
  122. package/dist/domain/javascriptSemanticDataEffects.js +284 -0
  123. package/dist/domain/javascriptSemanticDerivedAnalysis.js +41 -0
  124. package/dist/domain/javascriptSemanticFingerprints.js +174 -0
  125. package/dist/domain/javascriptSemanticIr.js +21 -1
  126. package/dist/domain/javascriptSemanticObjects.js +115 -0
  127. package/dist/domain/javascriptSemanticPromises.js +290 -0
  128. package/dist/domain/javascriptSemanticResources.js +136 -0
  129. package/dist/domain/javascriptStaticAnalysis.js +4 -3
  130. package/dist/domain/javascriptStaticAnalysisBundler.js +38 -0
  131. package/dist/domain/javascriptStaticAnalysisCalls.js +23 -1
  132. package/dist/domain/javascriptStaticAnalysisHelpers.js +8 -0
  133. package/dist/domain/processCapture.js +8 -2
  134. package/dist/domain/processReactiveScenario.js +1 -0
  135. package/dist/domain/processReactiveTransition.js +9 -4
  136. package/dist/domain/providerCleanupError.js +11 -0
  137. package/dist/domain/reconstructionObligationLedgerSchemas.js +278 -0
  138. package/dist/domain/reconstructionReadiness.js +121 -0
  139. package/dist/domain/reconstructionReadinessFindingHelpers.js +17 -0
  140. package/dist/domain/reconstructionReadinessIntegrityFindings.js +118 -0
  141. package/dist/domain/reconstructionReadinessJourneyFindings.js +193 -0
  142. package/dist/domain/reconstructionReadinessSchemas.js +240 -0
  143. package/dist/domain/sourceToBundleComparison.js +335 -0
  144. package/dist/domain/sourceToBundleComparisonSchemas.js +133 -0
  145. package/dist/domain/sourceToBundleSignals.js +202 -0
  146. package/dist/domain/webCaptureDiff.js +141 -27
  147. package/dist/domain/webScreenshot.js +1 -1
  148. package/dist/generatedPackageMetadata.js +1 -1
  149. package/dist/ghidra/GhidraDefaults.js +1 -1
  150. package/dist/ghidra/GhidraFunctionValues.js +13 -1
  151. package/dist/ghidra/GhidraProviderCapabilities.js +7 -0
  152. package/dist/hopper/HopperCleanup.js +158 -0
  153. package/dist/hopper/HopperClient.js +69 -99
  154. package/dist/hopper/HopperProvider.js +20 -1
  155. package/dist/hopper/HopperRequestQueue.js +187 -0
  156. package/dist/hopper/HopperResponseStream.js +46 -0
  157. package/dist/hopper/protocol.js +1 -0
  158. package/dist/main/transport.js +24 -24
  159. package/dist/main.js +6 -0
  160. package/dist/mcpDoctor.js +25 -2
  161. package/dist/process/ProcessCommandIdentity.js +19 -0
  162. package/dist/process/ProcessOwnership.js +11 -8
  163. package/dist/server/DynamicToolAvailability.js +70 -0
  164. package/dist/server/createServer.js +46 -1
  165. package/dist/server/lifecycleProgress.js +10 -0
  166. package/dist/server/permissionFailure.js +12 -0
  167. package/dist/server/registerApplicationTools/compareSourceToBundle.js +35 -0
  168. package/dist/server/registerApplicationTools/helpers.js +11 -7
  169. package/dist/server/registerApplicationTools/obligationLedger.js +27 -0
  170. package/dist/server/registerApplicationTools/readiness.js +55 -0
  171. package/dist/server/registerApplicationTools.js +6 -0
  172. package/dist/server/registerArtifactTools.js +9 -1
  173. package/dist/server/registerBrowserScenarioTool.js +25 -0
  174. package/dist/server/registerBrowserTools.js +2 -2
  175. package/dist/server/registerCloseLifecycleTool.js +57 -0
  176. package/dist/server/registerEnhancedTools.js +16 -5
  177. package/dist/server/registerEvidenceResources.js +4 -0
  178. package/dist/server/registerEvidenceTools.js +9 -2
  179. package/dist/server/registerJavaScriptRuntimeObservationTools.js +37 -0
  180. package/dist/server/registerReconstructionObligationLedgerResource.js +39 -0
  181. package/dist/server/registerReconstructionReadinessResource.js +39 -0
  182. package/dist/server/registerSessionStatusTool.js +11 -8
  183. package/dist/server/registerSessionTools.js +11 -57
  184. package/dist/server/sessionAvailabilityPolicy.js +10 -8
  185. package/package.json +12 -6
  186. package/skills/reverse-engineer-anything/SKILL.md +2 -2
@@ -4,6 +4,7 @@ import { compareApplicationVersionsInputSchema } from "../domain/javascriptAppli
4
4
  import { compareJavaScriptExportShapesInputSchema } from "../domain/javascriptExportShapeComparisonSchemas.js";
5
5
  import { traceApplicationFeatureInputSchema } from "../domain/javascriptFeatureTraceSchemas.js";
6
6
  import { javaScriptSemanticQueryInputSchema } from "../domain/javascriptSemanticQuerySchemas.js";
7
+ import { compareSourceToBundleInputSchema } from "../domain/sourceToBundleComparisonSchemas.js";
7
8
  const evidenceIdSchema = z
8
9
  .string()
9
10
  .regex(/^ev_[a-f0-9]{64}$/u)
@@ -89,6 +90,23 @@ export const compareApplicationVersionsRequestSchema = z
89
90
  input.right_evidence_id,
90
91
  ]);
91
92
  });
93
+ /** Historical-source comparison accepting full application Evidence or a ledger reference. */
94
+ export const compareSourceToBundleRequestSchema = z
95
+ .strictObject({
96
+ reference: compareSourceToBundleInputSchema.shape.reference,
97
+ application: evidenceSchema.optional(),
98
+ application_evidence_id: evidenceIdSchema.optional(),
99
+ limits: compareSourceToBundleInputSchema.shape.limits,
100
+ unknown_registry_approved: compareSourceToBundleInputSchema.shape.unknown_registry_approved,
101
+ })
102
+ .superRefine((input, context) => {
103
+ requireExactlyOne(context, [
104
+ "application",
105
+ input.application,
106
+ "application_evidence_id",
107
+ input.application_evidence_id,
108
+ ]);
109
+ });
92
110
  /** MCP/CLI export-shape request accepting full Evidence or ledger references. */
93
111
  export const compareJavaScriptExportShapesRequestSchema = z
94
112
  .strictObject({
@@ -2,6 +2,7 @@ import { z } from "zod";
2
2
  import { artifactOutputSchemas } from "./toolOutputSchemas.js";
3
3
  import { jsonValueSchema } from "../domain/jsonValue.js";
4
4
  import { toolContractMetadata } from "./toolEffects.js";
5
+ import { artifactInspectionLimitsSchema } from "../domain/artifactInspection.js";
5
6
  const pageInput = {
6
7
  node_offset: z.number().int().min(0).default(0),
7
8
  node_limit: z.number().int().min(1).max(500).default(100),
@@ -59,9 +60,29 @@ export const artifactExtractionInputSchema = z.object({
59
60
  limit: z.number().int().min(1).max(500).default(100),
60
61
  ...traversalLimitsInput,
61
62
  });
63
+ /** Bounded provider-neutral inspection using one atomic inventory substep. */
64
+ export const artifactInspectionInputSchema = z
65
+ .object({
66
+ native_mount_approved: z.boolean().default(false),
67
+ integrity_policy: z.enum(["fail", "record-and-continue"]).default("fail"),
68
+ integrity_continue_approved: z.boolean().default(false),
69
+ max_integrity_mismatches: z.number().int().min(1).max(100).default(10),
70
+ ...artifactInspectionLimitsSchema.shape,
71
+ ...traversalLimitsInput,
72
+ })
73
+ .superRefine((input, context) => {
74
+ if (input.integrity_policy === "record-and-continue" &&
75
+ input.integrity_continue_approved !== true)
76
+ context.addIssue({
77
+ code: "custom",
78
+ path: ["integrity_continue_approved"],
79
+ message: "record-and-continue requires explicit approval",
80
+ });
81
+ });
62
82
  const exampleInputSchema = z.record(z.string(), jsonValueSchema);
63
83
  const examples = {
64
84
  inventory_artifact: {},
85
+ inspect_artifact: {},
65
86
  extract_artifact: {
66
87
  approved: true,
67
88
  output_root: "/tmp/rea-extracted",
@@ -90,5 +111,6 @@ const artifact = (name, description, inputSchema) => {
90
111
  /** Artifact-graph inventory and explicitly approved safe extraction contracts. */
91
112
  export const ARTIFACT_TOOL_CONTRACTS = [
92
113
  artifact("inventory_artifact", "Inventory the active application or package as a deterministic, content-addressed artifact graph. Returns bounded node and edge pages without extracting or mounting by default.", artifactInventoryInputSchema),
114
+ artifact("inspect_artifact", "Inspect the active artifact through one bounded, cancellable inventory substep. Returns the full substep Evidence and its ID, observations, derived relationships, hypotheses, contradictions, unexplored branches, limitations, and format-specific next probes. Any substep failure fails the whole call.", artifactInspectionInputSchema),
93
115
  artifact("extract_artifact", "Extract selected graph artifacts beneath an explicit output root. Requires approval, rejects traversal and symlink escapes, never overwrites, enforces bomb limits, and verifies cleanup.", artifactExtractionInputSchema),
94
116
  ];
@@ -0,0 +1,7 @@
1
+ import { BROWSER_SCENARIO_TOOL_CONTRACTS } from "./browserScenarioToolContracts.js";
2
+ import { BROWSER_TOOL_CONTRACTS } from "./browserToolContracts.js";
3
+ /** Complete ordered browser-provider contract inventory. */
4
+ export const BROWSER_PROVIDER_TOOL_CONTRACTS = [
5
+ ...BROWSER_TOOL_CONTRACTS,
6
+ ...BROWSER_SCENARIO_TOOL_CONTRACTS,
7
+ ];
@@ -0,0 +1,81 @@
1
+ import { toolContractMetadata } from "./toolEffects.js";
2
+ import { evidenceResultOf } from "./toolOutputSchemas.js";
3
+ import { browserScenarioSchema } from "../domain/browserScenario.js";
4
+ import { browserScenarioCaptureSchema } from "../domain/browserScenarioCapture.js";
5
+ const example = {
6
+ schema_version: 1,
7
+ browser: {
8
+ mode: "launch",
9
+ executable_path: "/opt/chromium/chrome",
10
+ headless: true,
11
+ user_data: "temporary-owned",
12
+ cleanup: "close-and-delete-profile",
13
+ },
14
+ start_url: { url: "https://app.example.test/", query: [] },
15
+ allowed_origins: ["https://app.example.test"],
16
+ environment: {
17
+ viewport: { width: 1_280, height: 720, device_scale_factor: 1 },
18
+ locale: "en-US",
19
+ timezone: "UTC",
20
+ color_scheme: "light",
21
+ reduced_motion: "reduce",
22
+ service_workers: "block",
23
+ },
24
+ actions: [
25
+ {
26
+ step_id: "ready",
27
+ action: "wait_for",
28
+ locator: { kind: "test_id", value: "application-ready" },
29
+ state: "visible",
30
+ },
31
+ ],
32
+ storage: { cookies: [], local_storage: [], session_storage: [] },
33
+ request_replay: { mode: "disabled" },
34
+ secrets: [],
35
+ redaction: {
36
+ secret_values: "replace-with-secret-reference",
37
+ query_parameter_names: [],
38
+ header_names: [
39
+ "authorization",
40
+ "cookie",
41
+ "proxy-authorization",
42
+ "set-cookie",
43
+ ],
44
+ },
45
+ capture: {
46
+ after_each_step: ["screenshot", "url", "accessibility"],
47
+ at_end: ["dom", "history", "storage"],
48
+ events: ["console", "page-errors", "network", "websockets"],
49
+ },
50
+ limits: {
51
+ max_duration_ms: 60_000,
52
+ action_timeout_ms: 5_000,
53
+ navigation_timeout_ms: 10_000,
54
+ max_events: 2_000,
55
+ max_frames: 100,
56
+ max_workers: 20,
57
+ max_popups: 10,
58
+ max_websockets: 100,
59
+ max_dom_nodes: 10_000,
60
+ max_accessibility_nodes: 10_000,
61
+ max_screenshots: 16,
62
+ max_screenshot_bytes: 4_194_304,
63
+ max_storage_entries: 256,
64
+ max_total_metadata_bytes: 4_194_304,
65
+ },
66
+ approved: true,
67
+ };
68
+ /** Controlled browser scenario contract shared by MCP and catalog generation. */
69
+ export const BROWSER_SCENARIO_TOOL_CONTRACTS = [
70
+ {
71
+ name: "capture_browser_scenario",
72
+ ...toolContractMetadata("capture_browser_scenario"),
73
+ description: "Run one approved, bounded browser scenario through Playwright. Launch mode owns and terminates a temporary browser profile; connect mode attaches to one exact loopback CDP target and disconnects without terminating the external browser. Only the fixed action vocabulary is accepted. Navigation, storage, requests, redirects, secrets, redaction, captures, and limits must be declared before execution. Returns step-indexed Evidence with screenshots, DOM, accessibility, URL/history/storage state, runtime events, explicit missing/truncated sections, and equality eligibility.",
74
+ kind: "browser-provider",
75
+ inputSchema: browserScenarioSchema,
76
+ outputSchema: evidenceResultOf(browserScenarioCaptureSchema),
77
+ examples: [
78
+ { title: "Capture a deterministic browser scenario", input: example },
79
+ ],
80
+ },
81
+ ];
@@ -2,7 +2,7 @@ import { browserTargetListSchema, inspectWebPageInputSchema, listBrowserTargetsI
2
2
  import { analyzeWebBundleInputSchema, webBundleAnalysisSchema, } from "../domain/webBundleAnalysis.js";
3
3
  import { observeWebSessionInputSchema, webObservationSessionSchema, } from "../domain/browserSession.js";
4
4
  import { discoverWebMcpToolsInputSchema, webMcpDiscoverySchema, } from "../domain/webMcpDiscovery.js";
5
- import { compareWebCapturesInputSchema, webCaptureDiffSchema, } from "../domain/webCaptureDiff.js";
5
+ import { browserCaptureComparisonWireSchema, browserCaptureComparisonSchema, } from "../domain/browserCaptureComparison.js";
6
6
  import { captureWebScreenshotInputSchema, compareWebScreenshotsInputSchema, webScreenshotDiffSchema, webScreenshotSchema, } from "../domain/webScreenshot.js";
7
7
  import { toolContractMetadata } from "./toolEffects.js";
8
8
  import { evidenceResultOf } from "./toolOutputSchemas.js";
@@ -12,11 +12,81 @@ const inspectionOutputSchema = evidenceResult(webPageInspectionSchema);
12
12
  const bundleOutputSchema = evidenceResult(webBundleAnalysisSchema);
13
13
  const observationSessionOutputSchema = evidenceResult(webObservationSessionSchema);
14
14
  const webMcpOutputSchema = evidenceResult(webMcpDiscoverySchema);
15
- const captureDiffOutputSchema = evidenceResult(webCaptureDiffSchema);
15
+ const captureDiffOutputSchema = evidenceResult(browserCaptureComparisonSchema);
16
16
  const screenshotOutputSchema = evidenceResult(webScreenshotSchema);
17
17
  const screenshotDiffOutputSchema = evidenceResult(webScreenshotDiffSchema);
18
18
  const endpoint = "http://127.0.0.1:9222";
19
19
  const origin = "https://app.example.test";
20
+ const scenarioUrl = {
21
+ url: `${origin}/`,
22
+ origin,
23
+ query_parameter_names: [],
24
+ redacted: false,
25
+ };
26
+ const scenarioCompleteness = {
27
+ status: "complete",
28
+ equality_eligible: true,
29
+ missing_sections: [],
30
+ truncated_sections: [],
31
+ };
32
+ const scenarioArtifacts = {
33
+ screenshot: { state: "not_requested" },
34
+ dom: { state: "not_requested" },
35
+ accessibility: { state: "not_requested" },
36
+ url: { state: "not_requested" },
37
+ history: { state: "not_requested" },
38
+ storage: { state: "not_requested" },
39
+ };
40
+ const exampleScenarioCapture = () => ({
41
+ schema_version: 1,
42
+ browser: {
43
+ mode: "connect",
44
+ process_ownership: "external",
45
+ cleanup: "disconnected-external",
46
+ product: "Chromium",
47
+ version: "149",
48
+ },
49
+ scenario: {
50
+ start_origin: origin,
51
+ allowed_origins: [origin],
52
+ action_count: 1,
53
+ secret_references: [],
54
+ },
55
+ duration_ms: 10,
56
+ steps: [
57
+ {
58
+ step_index: 0,
59
+ step_id: "scenario_start",
60
+ action: "scenario_start",
61
+ status: "completed",
62
+ elapsed_ms: 0,
63
+ before_url: scenarioUrl,
64
+ after_url: scenarioUrl,
65
+ error: null,
66
+ event_sequence_start: 1,
67
+ event_sequence_end: 0,
68
+ artifacts: scenarioArtifacts,
69
+ completeness: scenarioCompleteness,
70
+ },
71
+ {
72
+ step_index: 1,
73
+ step_id: "open-settings",
74
+ action: "click",
75
+ status: "completed",
76
+ elapsed_ms: 10,
77
+ before_url: scenarioUrl,
78
+ after_url: scenarioUrl,
79
+ error: null,
80
+ event_sequence_start: 1,
81
+ event_sequence_end: 0,
82
+ artifacts: scenarioArtifacts,
83
+ completeness: scenarioCompleteness,
84
+ },
85
+ ],
86
+ events: { retained: 0, dropped: 0, items: [] },
87
+ completeness: scenarioCompleteness,
88
+ limitations: [],
89
+ });
20
90
  /** Origin-scoped, passive browser reverse-engineering contracts. */
21
91
  export const BROWSER_TOOL_CONTRACTS = [
22
92
  {
@@ -64,6 +134,7 @@ export const BROWSER_TOOL_CONTRACTS = [
64
134
  websocket_shape_approved: false,
65
135
  include_script_sources: false,
66
136
  include_storage_keys: false,
137
+ include_storage_fingerprints: false,
67
138
  limits: {
68
139
  max_frames: 200,
69
140
  max_dom_nodes: 2_000,
@@ -175,16 +246,26 @@ export const BROWSER_TOOL_CONTRACTS = [
175
246
  {
176
247
  name: "compare_web_captures",
177
248
  ...toolContractMetadata("compare_web_captures"),
178
- description: "Compare two normalized web captures across DOM, scripts, resources, network, safe metadata, and optional WebMCP inventories. Stable observed changes are distinguished from unknown absence caused by incomplete capture coverage.",
249
+ description: "Compare either passive web captures or step-indexed browser scenarios. Scenario comparison aligns exact step IDs, records deterministic literal normalization, and exposes bounded artifact-level changes plus alignment failures. Missing or truncated evidence never proves equality.",
179
250
  kind: "browser-provider",
180
- inputSchema: compareWebCapturesInputSchema,
251
+ inputSchema: browserCaptureComparisonWireSchema,
181
252
  outputSchema: captureDiffOutputSchema,
182
253
  examples: [
183
254
  {
184
- title: "Compare two normalized captures",
255
+ title: "Compare two recorded browser scenarios",
185
256
  input: {
186
- before: { inspection: exampleInspection() },
187
- after: { inspection: exampleInspection() },
257
+ before_scenario: exampleScenarioCapture(),
258
+ after_scenario: exampleScenarioCapture(),
259
+ normalization: {
260
+ rules: [
261
+ {
262
+ rule_id: "volatile-build-id",
263
+ artifacts: ["dom", "accessibility"],
264
+ match: "build-123",
265
+ replacement: "[BUILD_ID]",
266
+ },
267
+ ],
268
+ },
188
269
  max_changes: 2_000,
189
270
  },
190
271
  },
@@ -231,97 +312,6 @@ export const BROWSER_TOOL_CONTRACTS = [
231
312
  ],
232
313
  },
233
314
  ];
234
- function exampleCompleteness() {
235
- return {
236
- status: "complete_within_window",
237
- conditions: ["complete_within_window"],
238
- policy_filtered_sections: [],
239
- attach_limited_sections: [],
240
- truncated_sections: [],
241
- unavailable_sections: [],
242
- excluded: [],
243
- dropped_events: {
244
- scripts: 0,
245
- network_requests: 0,
246
- console_events: 0,
247
- websocket_connections: 0,
248
- websocket_frames: 0,
249
- webmcp_tools: 0,
250
- timeline_events: 0,
251
- total: 0,
252
- },
253
- };
254
- }
255
- function exampleInspection() {
256
- return {
257
- schema_version: 2,
258
- browser: {
259
- product: "Chrome/1",
260
- protocol_version: "1.3",
261
- revision: "example",
262
- user_agent: "Chrome",
263
- js_version: "1",
264
- },
265
- target: {
266
- target_id: "page-1",
267
- type: "page",
268
- title: "Example",
269
- url: `${origin}/`,
270
- origin,
271
- attached: false,
272
- },
273
- capture_window: {
274
- started_at: "2026-07-14T00:00:00.000Z",
275
- ended_at: "2026-07-14T00:00:01.000Z",
276
- observation_ms: 1_000,
277
- },
278
- completeness: exampleCompleteness(),
279
- frames: [],
280
- dom: { total_nodes: 0, nodes: [] },
281
- accessibility: {
282
- total_nodes: 0,
283
- text_capture: {
284
- status: "not_approved",
285
- retained_bytes: 0,
286
- excluded_fields: 0,
287
- truncated_fields: 0,
288
- },
289
- nodes: [],
290
- },
291
- scripts: { total: 0, items: [] },
292
- resources: [],
293
- network: {
294
- requests: [],
295
- websocket_events: [],
296
- coverage_started_at: "2026-07-14T00:00:00.000Z",
297
- prior_activity_available: false,
298
- },
299
- console: {
300
- events: [],
301
- coverage_started_at: "2026-07-14T00:00:00.000Z",
302
- prior_activity_available: false,
303
- },
304
- workers: [],
305
- metadata: {
306
- responses: [],
307
- dom_urls: [],
308
- agent_hints: [],
309
- excluded_dom_urls: 0,
310
- headers_allowlisted: true,
311
- },
312
- storage: {
313
- origin,
314
- usage_bytes: null,
315
- quota_bytes: null,
316
- local_storage_keys: [],
317
- session_storage_keys: [],
318
- indexed_db_names: [],
319
- cache_names: [],
320
- values_redacted: true,
321
- },
322
- limitations: [],
323
- };
324
- }
325
315
  function exampleScreenshot() {
326
316
  return {
327
317
  uri: "rea://web-screenshot/sha256/153cf6c9a526a63053a37b10234c2fd85df38887c2dc0a800d90abfa6631d01c",
@@ -1,4 +1,14 @@
1
1
  import { z } from "zod";
2
+ const traceLiteralInputSchema = z.object({
3
+ query: z.string().min(1),
4
+ case_sensitive: z.boolean().default(false),
5
+ limit: z.number().int().min(1).max(100).default(20),
6
+ max_operations: z.number().int().min(1).max(100).default(20),
7
+ unknown_registry_approved: z
8
+ .literal(true)
9
+ .optional()
10
+ .describe("Explicit approval to record bounded residuals durably"),
11
+ });
2
12
  /** Input schemas shared by MCP registration and enhanced application dispatch. */
3
13
  export const enhancedInputSchemas = {
4
14
  swift_classes: z.object({ pattern: z.string().default("") }),
@@ -51,18 +61,25 @@ export const enhancedInputSchemas = {
51
61
  basic_blocks: 0,
52
62
  }),
53
63
  }),
54
- trace_feature: z.object({
55
- query: z.string().min(1),
56
- case_sensitive: z.boolean().default(false),
57
- limit: z.number().int().min(1).max(100).default(20),
58
- max_operations: z.number().int().min(1).max(100).default(20),
64
+ trace_feature: traceLiteralInputSchema,
65
+ find_code_for_string: traceLiteralInputSchema,
66
+ trace_call_path: z.object({
67
+ start: z.string().describe("A provider-normalized procedure address"),
68
+ goal: z
69
+ .string()
70
+ .describe("An optional provider-normalized destination address")
71
+ .optional(),
72
+ direction: z.enum(["forward", "backward"]).default("forward"),
73
+ max_depth: z.number().int().min(1).max(10).default(5),
74
+ max_nodes: z.number().int().min(1).max(500).default(100),
75
+ max_operations: z.number().int().min(1).max(500).default(100),
59
76
  unknown_registry_approved: z
60
77
  .literal(true)
61
78
  .optional()
62
79
  .describe("Explicit approval to record bounded residuals durably"),
63
80
  }),
64
81
  };
65
- /** Runtime parser for dispatching only the eight closed enhanced names. */
82
+ /** Runtime parser for dispatching only the closed enhanced names. */
66
83
  export const enhancedToolNameSchema = z.enum([
67
84
  "swift_classes",
68
85
  "get_objc_classes",
@@ -74,4 +91,6 @@ export const enhancedToolNameSchema = z.enum([
74
91
  "binary_overview",
75
92
  "analyze_function",
76
93
  "trace_feature",
94
+ "find_code_for_string",
95
+ "trace_call_path",
77
96
  ]);
@@ -0,0 +1,8 @@
1
+ import { z } from "zod";
2
+ /** Provider-neutral input for one bounded raw function-instruction window. */
3
+ export const functionInstructionInputSchema = z.object({
4
+ procedure: z.string().describe("The procedure name or address"),
5
+ offset: z.number().int().min(0).max(100_000).default(0),
6
+ limit: z.number().int().min(1).max(500).default(64),
7
+ document: z.string().optional().describe("The document name"),
8
+ });
@@ -0,0 +1,22 @@
1
+ import { z } from "zod";
2
+ const document = z.string().optional().describe("The document name");
3
+ const address = z
4
+ .string()
5
+ .describe("A provider-normalized address; default memory uses 0x-prefixed hexadecimal");
6
+ /** Bounded Hopper memory and file-mapping contracts. */
7
+ export const HOPPER_MEMORY_TOOL_DEFINITIONS = [
8
+ {
9
+ name: "read_bytes",
10
+ description: "Read at most 4,096 analyzed bytes from one provider-normalized virtual address. The hexadecimal payload reports the exact returned length; incomplete reads remain explicit and unsupported provider APIs return typed capability unavailability.",
11
+ inputSchema: z.object({
12
+ address,
13
+ length: z.number().int().min(1).max(4_096).default(256),
14
+ document,
15
+ }),
16
+ },
17
+ {
18
+ name: "address_to_file_offset",
19
+ description: "Map one provider-normalized virtual address to its original nonnegative file offset. Unmapped addresses fail explicitly, and providers without an authoritative mapping API return typed capability unavailability.",
20
+ inputSchema: z.object({ address, document }),
21
+ },
22
+ ];
@@ -1,6 +1,7 @@
1
1
  import { createEvidence } from "../domain/evidence.js";
2
2
  import { reconcileJavaScriptRuntime } from "../domain/javascriptRuntimeReconciliation.js";
3
3
  import { JAVASCRIPT_APPLICATION_EVIDENCE_EXAMPLE, JAVASCRIPT_RUNTIME_RECONCILIATION_EXAMPLE, } from "./javascriptRuntimeReconciliationExample.js";
4
+ import { createHistoricalSourceGraph } from "../domain/referenceSourceGraph.js";
4
5
  const reconciliation = reconcileJavaScriptRuntime(JAVASCRIPT_RUNTIME_RECONCILIATION_EXAMPLE);
5
6
  const reconciliationEvidence = createEvidence(undefined, {
6
7
  id: "rea-javascript-runtime-reconciliation",
@@ -47,6 +48,47 @@ export const JAVASCRIPT_APPLICATION_VERSION_COMPARISON_EXAMPLE = {
47
48
  left_evidence_id: EXAMPLE_EVIDENCE_ID,
48
49
  right_evidence_id: SECOND_EXAMPLE_EVIDENCE_ID,
49
50
  };
51
+ /** Historical source inventory compared with one producer-returned graph ID. */
52
+ export const SOURCE_TO_BUNDLE_COMPARISON_EXAMPLE = {
53
+ reference: createHistoricalSourceGraph({
54
+ schema: "HistoricalSourceGraph/v1",
55
+ authority: "historical-reference",
56
+ root_alias: "$REFERENCE_ROOT",
57
+ inventory_state: "complete",
58
+ entries: [
59
+ {
60
+ path: "src",
61
+ kind: "directory",
62
+ classifications: ["source"],
63
+ tree_state: "enumerated",
64
+ limitations: [],
65
+ },
66
+ {
67
+ path: "src/main.ts",
68
+ kind: "file",
69
+ sha256: "2".repeat(64),
70
+ size: 128,
71
+ language: "TypeScript",
72
+ classifications: ["source"],
73
+ content_state: "hashed",
74
+ limitations: [],
75
+ },
76
+ ],
77
+ relationships: [],
78
+ parse_failures: [],
79
+ exclusions: [],
80
+ languages: ["TypeScript"],
81
+ manifests: [],
82
+ vcs: { kind: "none", head: null, dirty: null },
83
+ provenance: {
84
+ importer: "rea",
85
+ importer_version: "1",
86
+ caller: "contract-example",
87
+ },
88
+ limitations: [],
89
+ }),
90
+ application_evidence_id: EXAMPLE_EVIDENCE_ID,
91
+ };
50
92
  /** Exact static return-shape comparison using producer-returned Evidence IDs. */
51
93
  export const JAVASCRIPT_EXPORT_SHAPE_COMPARISON_EXAMPLE = {
52
94
  left_evidence_id: EXAMPLE_EVIDENCE_ID,
@@ -0,0 +1,58 @@
1
+ import { toolContractMetadata } from "./toolEffects.js";
2
+ import { evidenceResultOf } from "./toolOutputSchemas.js";
3
+ import { javascriptRuntimeObservationSchema, javascriptRuntimeTargetListSchema, listJavaScriptRuntimeTargetsInputSchema, observeJavaScriptRuntimeInputSchema, } from "../domain/javascriptRuntimeObservation.js";
4
+ const root = "/opt/example-app";
5
+ const endpoint = "http://127.0.0.1:9229";
6
+ /** Passive Node/Electron V8 Inspector discovery and observation contracts. */
7
+ export const JAVASCRIPT_RUNTIME_OBSERVATION_TOOL_CONTRACTS = [
8
+ {
9
+ name: "list_javascript_runtime_targets",
10
+ ...toolContractMetadata("list_javascript_runtime_targets"),
11
+ description: "List attachable Node/Electron V8 Inspector targets from one approved literal-loopback endpoint. Only targets inside exact canonical file roots or exact HTTP(S) origins are retained; excluded target locations never enter Evidence.",
12
+ kind: "runtime-provider",
13
+ inputSchema: listJavaScriptRuntimeTargetsInputSchema,
14
+ outputSchema: evidenceResultOf(javascriptRuntimeTargetListSchema),
15
+ examples: [
16
+ {
17
+ title: "List approved Node Inspector targets",
18
+ input: {
19
+ inspector_endpoint: endpoint,
20
+ allowed_file_roots: [root],
21
+ allowed_origins: [],
22
+ approved: true,
23
+ offset: 0,
24
+ limit: 100,
25
+ },
26
+ },
27
+ ],
28
+ },
29
+ {
30
+ name: "observe_javascript_runtime",
31
+ ...toolContractMetadata("observe_javascript_runtime"),
32
+ description: "Attach passively to one exact approved Node/Electron V8 Inspector target and capture bounded Debugger.scriptParsed plus Runtime execution-context events. REA sends only Runtime.enable and Debugger.enable: it never evaluates, pauses, resumes, reads source, or instruments the target. require/import edges, EventEmitter activity, and Electron IPC remain explicit unknowns; reconcile the returned Evidence with static Application Graph Evidence using reconcile_javascript_runtime.",
33
+ kind: "runtime-provider",
34
+ inputSchema: observeJavaScriptRuntimeInputSchema,
35
+ outputSchema: evidenceResultOf(javascriptRuntimeObservationSchema),
36
+ examples: [
37
+ {
38
+ title: "Observe one approved Node runtime",
39
+ input: {
40
+ inspector_endpoint: endpoint,
41
+ allowed_file_roots: [root],
42
+ allowed_origins: [],
43
+ target_id: "TARGET_ID_FROM_LIST_JAVASCRIPT_RUNTIME_TARGETS",
44
+ runtime_kind: "node",
45
+ approved: true,
46
+ observation_ms: 100,
47
+ limits: {
48
+ max_events: 10_000,
49
+ max_scripts: 2_000,
50
+ max_execution_contexts: 1_000,
51
+ max_location_bytes: 16_384,
52
+ max_total_metadata_bytes: 4_194_304,
53
+ },
54
+ },
55
+ },
56
+ ],
57
+ },
58
+ ];