rea-agents 2.4.0 → 2.5.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +80 -18
- package/bridge/ghidra/ReaGhidraBridge.java +48 -1
- package/bridge/hopper_bridge.py +259 -24
- package/dist/application/AnalysisClientCleanup.js +14 -0
- package/dist/application/ApplicationWorkflowEvidenceResolver.js +31 -13
- package/dist/application/BinarySession.js +15 -4
- package/dist/application/BinarySessionStatus.js +31 -1
- package/dist/application/BrowserEvidence.js +14 -0
- package/dist/application/BrowserScenarioCapturePort.js +1 -0
- package/dist/application/BrowserScenarioCaptureService.js +53 -0
- package/dist/application/BrowserScenarioEvidence.js +40 -0
- package/dist/application/CallPathTracing.js +160 -0
- package/dist/application/CapabilityInventory.js +68 -12
- package/dist/application/CompositeProvider.js +10 -1
- package/dist/application/DirectAnalysis.js +7 -2
- package/dist/application/EnhancedLiteralTracing.js +118 -0
- package/dist/application/EnhancedTools.js +35 -121
- package/dist/application/JavaScriptApplicationWorkflowEvidence.js +13 -0
- package/dist/application/JavaScriptApplicationWorkflowService.js +27 -1
- package/dist/application/JavaScriptRuntimeObservationEvidence.js +34 -0
- package/dist/application/JavaScriptRuntimeObservationPort.js +1 -0
- package/dist/application/JavaScriptRuntimeObservationService.js +46 -0
- package/dist/application/JavaScriptSemanticGraphAsyncProjection.js +147 -0
- package/dist/application/JavaScriptSemanticGraphBuilder.js +34 -6
- package/dist/application/JavaScriptSemanticGraphChildProcessProjection.js +156 -0
- package/dist/application/JavaScriptSemanticGraphConstruction.js +2 -2
- package/dist/application/JavaScriptSemanticGraphDataProjection.js +203 -0
- package/dist/application/JavaScriptSemanticGraphFingerprintProjection.js +25 -0
- package/dist/application/JavaScriptSemanticGraphFlowProjection.js +129 -8
- package/dist/application/JavaScriptSemanticGraphObjectProjection.js +81 -0
- package/dist/application/JavaScriptSemanticGraphProjection.js +14 -7
- package/dist/application/JavaScriptSemanticGraphResourceProjection.js +59 -0
- package/dist/application/JavaScriptSemanticGraphValueProjection.js +77 -0
- package/dist/application/ProcessReactiveEffects.js +6 -0
- package/dist/application/ProcessReactiveHarness.js +16 -1
- package/dist/application/ProjectPermissionStore.js +1 -0
- package/dist/application/ReconstructionObligationAuthority.js +72 -0
- package/dist/application/ReconstructionObligationCandidates.js +265 -0
- package/dist/application/ReconstructionObligationLedgerDiagnostics.js +47 -0
- package/dist/application/ReconstructionObligationLedgerEvaluation.js +263 -0
- package/dist/application/ReconstructionObligationLedgerProjection.js +86 -0
- package/dist/application/ReconstructionObligationLedgerService.js +72 -0
- package/dist/application/ReconstructionObligationOriginalCases.js +33 -0
- package/dist/application/ReconstructionObligationPolicies.js +132 -0
- package/dist/application/ReconstructionReadinessService.js +48 -0
- package/dist/artifacts/ArtifactProvider.js +87 -22
- package/dist/browser/BrowserScenarioSecrets.js +53 -0
- package/dist/browser/BrowserScenarioSessionPort.js +1 -0
- package/dist/browser/CdpBrowserProvider.js +2 -2
- package/dist/browser/CdpCaptureDocuments.js +57 -0
- package/dist/browser/CdpCaptureStorage.js +71 -29
- package/dist/browser/CdpCaptureStorageFingerprints.js +328 -0
- package/dist/browser/CdpEndpoint.js +8 -6
- package/dist/browser/CdpPageCapture.js +2 -0
- package/dist/browser/JavaScriptRuntimeScope.js +38 -0
- package/dist/browser/PlaywrightBrowserScenarioProvider.js +253 -0
- package/dist/browser/PlaywrightExecutionBoundary.js +42 -0
- package/dist/browser/PlaywrightScenarioActions.js +62 -0
- package/dist/browser/PlaywrightScenarioArtifacts.js +238 -0
- package/dist/browser/PlaywrightScenarioBrowser.js +144 -0
- package/dist/browser/PlaywrightScenarioEvents.js +301 -0
- package/dist/browser/PlaywrightScenarioSession.js +300 -0
- package/dist/browser/V8InspectorCaptureProjection.js +110 -0
- package/dist/browser/V8InspectorEndpoint.js +72 -0
- package/dist/browser/V8InspectorProvider.js +267 -0
- package/dist/catalogIdentity.js +8 -0
- package/dist/cli/artifactCommands.js +39 -0
- package/dist/cli/coreAnalysisCommands.js +37 -0
- package/dist/cli.js +4 -0
- package/dist/cliApplicationCommands.js +30 -2
- package/dist/cliBrowserAdvancedCommands.js +17 -5
- package/dist/cliBrowserCommands.js +1 -0
- package/dist/cliBrowserScenarioCommands.js +43 -0
- package/dist/cliCommandNames.js +8 -0
- package/dist/cliJavaScriptRuntimeCommands.js +164 -0
- package/dist/cliObservationOptions.js +4 -0
- package/dist/cliPolicyCommands.js +1 -0
- package/dist/config/environment.js +12 -0
- package/dist/config/parseConfig.js +88 -17
- package/dist/contracts/analysisSearchContract.js +14 -0
- package/dist/contracts/applicationToolContracts.js +86 -2
- package/dist/contracts/applicationWorkflowInputContracts.js +18 -0
- package/dist/contracts/artifactToolContracts.js +22 -0
- package/dist/contracts/browserProviderToolContracts.js +7 -0
- package/dist/contracts/browserScenarioToolContracts.js +81 -0
- package/dist/contracts/browserToolContracts.js +88 -98
- package/dist/contracts/enhancedInputs.js +25 -6
- package/dist/contracts/functionInstructionContract.js +8 -0
- package/dist/contracts/hopperMemoryContracts.js +22 -0
- package/dist/contracts/javascriptApplicationWorkflowExamples.js +42 -0
- package/dist/contracts/javascriptRuntimeObservationToolContracts.js +58 -0
- package/dist/contracts/reconstructionReadinessExample.js +436 -0
- package/dist/contracts/toolContractExamples.js +5 -0
- package/dist/contracts/toolContractTypes.js +1 -0
- package/dist/contracts/toolContracts.js +13 -21
- package/dist/contracts/toolEffects.js +21 -0
- package/dist/contracts/toolOutputSchemaGroups.js +70 -20
- package/dist/contracts/toolOutputSchemaPrimitives.js +37 -0
- package/dist/domain/analysisErrorProjection.js +8 -0
- package/dist/domain/artifactInspection.js +347 -0
- package/dist/domain/browserCaptureComparison.js +82 -0
- package/dist/domain/browserObservation.js +8 -1
- package/dist/domain/browserObservationErrors.js +1 -0
- package/dist/domain/browserObservationSchemas.js +26 -0
- package/dist/domain/browserScenario.js +165 -0
- package/dist/domain/browserScenarioCapture.js +57 -0
- package/dist/domain/browserScenarioCaptureValues.js +204 -0
- package/dist/domain/browserScenarioDiff.js +324 -0
- package/dist/domain/browserScenarioDiffValues.js +157 -0
- package/dist/domain/browserScenarioNormalization.js +45 -0
- package/dist/domain/browserScenarioValues.js +372 -0
- package/dist/domain/hopperValues.js +10 -0
- package/dist/domain/javascriptRuntimeObservation.js +170 -0
- package/dist/domain/javascriptRuntimeReconciliationParsing.js +120 -2
- package/dist/domain/javascriptRuntimeReconciliationResult.js +3 -3
- package/dist/domain/javascriptRuntimeReconciliationRuntime.js +2 -2
- package/dist/domain/javascriptRuntimeReconciliationSchemas.js +1 -1
- package/dist/domain/javascriptSemanticAnalysis.js +5 -4
- package/dist/domain/javascriptSemanticAsyncEffects.js +253 -0
- package/dist/domain/javascriptSemanticChildProcesses.js +237 -0
- package/dist/domain/javascriptSemanticDataEffectHelpers.js +125 -0
- package/dist/domain/javascriptSemanticDataEffects.js +284 -0
- package/dist/domain/javascriptSemanticDerivedAnalysis.js +41 -0
- package/dist/domain/javascriptSemanticFingerprints.js +174 -0
- package/dist/domain/javascriptSemanticIr.js +21 -1
- package/dist/domain/javascriptSemanticObjects.js +115 -0
- package/dist/domain/javascriptSemanticPromises.js +290 -0
- package/dist/domain/javascriptSemanticResources.js +136 -0
- package/dist/domain/javascriptStaticAnalysis.js +4 -3
- package/dist/domain/javascriptStaticAnalysisBundler.js +38 -0
- package/dist/domain/javascriptStaticAnalysisCalls.js +23 -1
- package/dist/domain/javascriptStaticAnalysisHelpers.js +8 -0
- package/dist/domain/processCapture.js +8 -2
- package/dist/domain/processReactiveScenario.js +1 -0
- package/dist/domain/processReactiveTransition.js +9 -4
- package/dist/domain/providerCleanupError.js +11 -0
- package/dist/domain/reconstructionObligationLedgerSchemas.js +278 -0
- package/dist/domain/reconstructionReadiness.js +121 -0
- package/dist/domain/reconstructionReadinessFindingHelpers.js +17 -0
- package/dist/domain/reconstructionReadinessIntegrityFindings.js +118 -0
- package/dist/domain/reconstructionReadinessJourneyFindings.js +193 -0
- package/dist/domain/reconstructionReadinessSchemas.js +240 -0
- package/dist/domain/sourceToBundleComparison.js +335 -0
- package/dist/domain/sourceToBundleComparisonSchemas.js +133 -0
- package/dist/domain/sourceToBundleSignals.js +202 -0
- package/dist/domain/webCaptureDiff.js +141 -27
- package/dist/domain/webScreenshot.js +1 -1
- package/dist/generatedPackageMetadata.js +1 -1
- package/dist/ghidra/GhidraDefaults.js +1 -1
- package/dist/ghidra/GhidraFunctionValues.js +13 -1
- package/dist/ghidra/GhidraProviderCapabilities.js +7 -0
- package/dist/hopper/HopperCleanup.js +158 -0
- package/dist/hopper/HopperClient.js +69 -99
- package/dist/hopper/HopperProvider.js +20 -1
- package/dist/hopper/HopperRequestQueue.js +187 -0
- package/dist/hopper/HopperResponseStream.js +46 -0
- package/dist/hopper/protocol.js +1 -0
- package/dist/main/transport.js +24 -24
- package/dist/main.js +6 -0
- package/dist/mcpDoctor.js +25 -2
- package/dist/process/ProcessCommandIdentity.js +19 -0
- package/dist/process/ProcessOwnership.js +11 -8
- package/dist/server/DynamicToolAvailability.js +70 -0
- package/dist/server/createServer.js +46 -1
- package/dist/server/lifecycleProgress.js +10 -0
- package/dist/server/permissionFailure.js +12 -0
- package/dist/server/registerApplicationTools/compareSourceToBundle.js +35 -0
- package/dist/server/registerApplicationTools/helpers.js +11 -7
- package/dist/server/registerApplicationTools/obligationLedger.js +27 -0
- package/dist/server/registerApplicationTools/readiness.js +55 -0
- package/dist/server/registerApplicationTools.js +6 -0
- package/dist/server/registerArtifactTools.js +9 -1
- package/dist/server/registerBrowserScenarioTool.js +25 -0
- package/dist/server/registerBrowserTools.js +2 -2
- package/dist/server/registerCloseLifecycleTool.js +57 -0
- package/dist/server/registerEnhancedTools.js +16 -5
- package/dist/server/registerEvidenceResources.js +4 -0
- package/dist/server/registerEvidenceTools.js +9 -2
- package/dist/server/registerJavaScriptRuntimeObservationTools.js +37 -0
- package/dist/server/registerReconstructionObligationLedgerResource.js +39 -0
- package/dist/server/registerReconstructionReadinessResource.js +39 -0
- package/dist/server/registerSessionStatusTool.js +11 -8
- package/dist/server/registerSessionTools.js +11 -57
- package/dist/server/sessionAvailabilityPolicy.js +10 -8
- package/package.json +12 -6
- package/skills/reverse-engineer-anything/SKILL.md +2 -2
|
@@ -4,6 +4,7 @@ import { compareApplicationVersionsInputSchema } from "../domain/javascriptAppli
|
|
|
4
4
|
import { compareJavaScriptExportShapesInputSchema } from "../domain/javascriptExportShapeComparisonSchemas.js";
|
|
5
5
|
import { traceApplicationFeatureInputSchema } from "../domain/javascriptFeatureTraceSchemas.js";
|
|
6
6
|
import { javaScriptSemanticQueryInputSchema } from "../domain/javascriptSemanticQuerySchemas.js";
|
|
7
|
+
import { compareSourceToBundleInputSchema } from "../domain/sourceToBundleComparisonSchemas.js";
|
|
7
8
|
const evidenceIdSchema = z
|
|
8
9
|
.string()
|
|
9
10
|
.regex(/^ev_[a-f0-9]{64}$/u)
|
|
@@ -89,6 +90,23 @@ export const compareApplicationVersionsRequestSchema = z
|
|
|
89
90
|
input.right_evidence_id,
|
|
90
91
|
]);
|
|
91
92
|
});
|
|
93
|
+
/** Historical-source comparison accepting full application Evidence or a ledger reference. */
|
|
94
|
+
export const compareSourceToBundleRequestSchema = z
|
|
95
|
+
.strictObject({
|
|
96
|
+
reference: compareSourceToBundleInputSchema.shape.reference,
|
|
97
|
+
application: evidenceSchema.optional(),
|
|
98
|
+
application_evidence_id: evidenceIdSchema.optional(),
|
|
99
|
+
limits: compareSourceToBundleInputSchema.shape.limits,
|
|
100
|
+
unknown_registry_approved: compareSourceToBundleInputSchema.shape.unknown_registry_approved,
|
|
101
|
+
})
|
|
102
|
+
.superRefine((input, context) => {
|
|
103
|
+
requireExactlyOne(context, [
|
|
104
|
+
"application",
|
|
105
|
+
input.application,
|
|
106
|
+
"application_evidence_id",
|
|
107
|
+
input.application_evidence_id,
|
|
108
|
+
]);
|
|
109
|
+
});
|
|
92
110
|
/** MCP/CLI export-shape request accepting full Evidence or ledger references. */
|
|
93
111
|
export const compareJavaScriptExportShapesRequestSchema = z
|
|
94
112
|
.strictObject({
|
|
@@ -2,6 +2,7 @@ import { z } from "zod";
|
|
|
2
2
|
import { artifactOutputSchemas } from "./toolOutputSchemas.js";
|
|
3
3
|
import { jsonValueSchema } from "../domain/jsonValue.js";
|
|
4
4
|
import { toolContractMetadata } from "./toolEffects.js";
|
|
5
|
+
import { artifactInspectionLimitsSchema } from "../domain/artifactInspection.js";
|
|
5
6
|
const pageInput = {
|
|
6
7
|
node_offset: z.number().int().min(0).default(0),
|
|
7
8
|
node_limit: z.number().int().min(1).max(500).default(100),
|
|
@@ -59,9 +60,29 @@ export const artifactExtractionInputSchema = z.object({
|
|
|
59
60
|
limit: z.number().int().min(1).max(500).default(100),
|
|
60
61
|
...traversalLimitsInput,
|
|
61
62
|
});
|
|
63
|
+
/** Bounded provider-neutral inspection using one atomic inventory substep. */
|
|
64
|
+
export const artifactInspectionInputSchema = z
|
|
65
|
+
.object({
|
|
66
|
+
native_mount_approved: z.boolean().default(false),
|
|
67
|
+
integrity_policy: z.enum(["fail", "record-and-continue"]).default("fail"),
|
|
68
|
+
integrity_continue_approved: z.boolean().default(false),
|
|
69
|
+
max_integrity_mismatches: z.number().int().min(1).max(100).default(10),
|
|
70
|
+
...artifactInspectionLimitsSchema.shape,
|
|
71
|
+
...traversalLimitsInput,
|
|
72
|
+
})
|
|
73
|
+
.superRefine((input, context) => {
|
|
74
|
+
if (input.integrity_policy === "record-and-continue" &&
|
|
75
|
+
input.integrity_continue_approved !== true)
|
|
76
|
+
context.addIssue({
|
|
77
|
+
code: "custom",
|
|
78
|
+
path: ["integrity_continue_approved"],
|
|
79
|
+
message: "record-and-continue requires explicit approval",
|
|
80
|
+
});
|
|
81
|
+
});
|
|
62
82
|
const exampleInputSchema = z.record(z.string(), jsonValueSchema);
|
|
63
83
|
const examples = {
|
|
64
84
|
inventory_artifact: {},
|
|
85
|
+
inspect_artifact: {},
|
|
65
86
|
extract_artifact: {
|
|
66
87
|
approved: true,
|
|
67
88
|
output_root: "/tmp/rea-extracted",
|
|
@@ -90,5 +111,6 @@ const artifact = (name, description, inputSchema) => {
|
|
|
90
111
|
/** Artifact-graph inventory and explicitly approved safe extraction contracts. */
|
|
91
112
|
export const ARTIFACT_TOOL_CONTRACTS = [
|
|
92
113
|
artifact("inventory_artifact", "Inventory the active application or package as a deterministic, content-addressed artifact graph. Returns bounded node and edge pages without extracting or mounting by default.", artifactInventoryInputSchema),
|
|
114
|
+
artifact("inspect_artifact", "Inspect the active artifact through one bounded, cancellable inventory substep. Returns the full substep Evidence and its ID, observations, derived relationships, hypotheses, contradictions, unexplored branches, limitations, and format-specific next probes. Any substep failure fails the whole call.", artifactInspectionInputSchema),
|
|
93
115
|
artifact("extract_artifact", "Extract selected graph artifacts beneath an explicit output root. Requires approval, rejects traversal and symlink escapes, never overwrites, enforces bomb limits, and verifies cleanup.", artifactExtractionInputSchema),
|
|
94
116
|
];
|
|
@@ -0,0 +1,7 @@
|
|
|
1
|
+
import { BROWSER_SCENARIO_TOOL_CONTRACTS } from "./browserScenarioToolContracts.js";
|
|
2
|
+
import { BROWSER_TOOL_CONTRACTS } from "./browserToolContracts.js";
|
|
3
|
+
/** Complete ordered browser-provider contract inventory. */
|
|
4
|
+
export const BROWSER_PROVIDER_TOOL_CONTRACTS = [
|
|
5
|
+
...BROWSER_TOOL_CONTRACTS,
|
|
6
|
+
...BROWSER_SCENARIO_TOOL_CONTRACTS,
|
|
7
|
+
];
|
|
@@ -0,0 +1,81 @@
|
|
|
1
|
+
import { toolContractMetadata } from "./toolEffects.js";
|
|
2
|
+
import { evidenceResultOf } from "./toolOutputSchemas.js";
|
|
3
|
+
import { browserScenarioSchema } from "../domain/browserScenario.js";
|
|
4
|
+
import { browserScenarioCaptureSchema } from "../domain/browserScenarioCapture.js";
|
|
5
|
+
const example = {
|
|
6
|
+
schema_version: 1,
|
|
7
|
+
browser: {
|
|
8
|
+
mode: "launch",
|
|
9
|
+
executable_path: "/opt/chromium/chrome",
|
|
10
|
+
headless: true,
|
|
11
|
+
user_data: "temporary-owned",
|
|
12
|
+
cleanup: "close-and-delete-profile",
|
|
13
|
+
},
|
|
14
|
+
start_url: { url: "https://app.example.test/", query: [] },
|
|
15
|
+
allowed_origins: ["https://app.example.test"],
|
|
16
|
+
environment: {
|
|
17
|
+
viewport: { width: 1_280, height: 720, device_scale_factor: 1 },
|
|
18
|
+
locale: "en-US",
|
|
19
|
+
timezone: "UTC",
|
|
20
|
+
color_scheme: "light",
|
|
21
|
+
reduced_motion: "reduce",
|
|
22
|
+
service_workers: "block",
|
|
23
|
+
},
|
|
24
|
+
actions: [
|
|
25
|
+
{
|
|
26
|
+
step_id: "ready",
|
|
27
|
+
action: "wait_for",
|
|
28
|
+
locator: { kind: "test_id", value: "application-ready" },
|
|
29
|
+
state: "visible",
|
|
30
|
+
},
|
|
31
|
+
],
|
|
32
|
+
storage: { cookies: [], local_storage: [], session_storage: [] },
|
|
33
|
+
request_replay: { mode: "disabled" },
|
|
34
|
+
secrets: [],
|
|
35
|
+
redaction: {
|
|
36
|
+
secret_values: "replace-with-secret-reference",
|
|
37
|
+
query_parameter_names: [],
|
|
38
|
+
header_names: [
|
|
39
|
+
"authorization",
|
|
40
|
+
"cookie",
|
|
41
|
+
"proxy-authorization",
|
|
42
|
+
"set-cookie",
|
|
43
|
+
],
|
|
44
|
+
},
|
|
45
|
+
capture: {
|
|
46
|
+
after_each_step: ["screenshot", "url", "accessibility"],
|
|
47
|
+
at_end: ["dom", "history", "storage"],
|
|
48
|
+
events: ["console", "page-errors", "network", "websockets"],
|
|
49
|
+
},
|
|
50
|
+
limits: {
|
|
51
|
+
max_duration_ms: 60_000,
|
|
52
|
+
action_timeout_ms: 5_000,
|
|
53
|
+
navigation_timeout_ms: 10_000,
|
|
54
|
+
max_events: 2_000,
|
|
55
|
+
max_frames: 100,
|
|
56
|
+
max_workers: 20,
|
|
57
|
+
max_popups: 10,
|
|
58
|
+
max_websockets: 100,
|
|
59
|
+
max_dom_nodes: 10_000,
|
|
60
|
+
max_accessibility_nodes: 10_000,
|
|
61
|
+
max_screenshots: 16,
|
|
62
|
+
max_screenshot_bytes: 4_194_304,
|
|
63
|
+
max_storage_entries: 256,
|
|
64
|
+
max_total_metadata_bytes: 4_194_304,
|
|
65
|
+
},
|
|
66
|
+
approved: true,
|
|
67
|
+
};
|
|
68
|
+
/** Controlled browser scenario contract shared by MCP and catalog generation. */
|
|
69
|
+
export const BROWSER_SCENARIO_TOOL_CONTRACTS = [
|
|
70
|
+
{
|
|
71
|
+
name: "capture_browser_scenario",
|
|
72
|
+
...toolContractMetadata("capture_browser_scenario"),
|
|
73
|
+
description: "Run one approved, bounded browser scenario through Playwright. Launch mode owns and terminates a temporary browser profile; connect mode attaches to one exact loopback CDP target and disconnects without terminating the external browser. Only the fixed action vocabulary is accepted. Navigation, storage, requests, redirects, secrets, redaction, captures, and limits must be declared before execution. Returns step-indexed Evidence with screenshots, DOM, accessibility, URL/history/storage state, runtime events, explicit missing/truncated sections, and equality eligibility.",
|
|
74
|
+
kind: "browser-provider",
|
|
75
|
+
inputSchema: browserScenarioSchema,
|
|
76
|
+
outputSchema: evidenceResultOf(browserScenarioCaptureSchema),
|
|
77
|
+
examples: [
|
|
78
|
+
{ title: "Capture a deterministic browser scenario", input: example },
|
|
79
|
+
],
|
|
80
|
+
},
|
|
81
|
+
];
|
|
@@ -2,7 +2,7 @@ import { browserTargetListSchema, inspectWebPageInputSchema, listBrowserTargetsI
|
|
|
2
2
|
import { analyzeWebBundleInputSchema, webBundleAnalysisSchema, } from "../domain/webBundleAnalysis.js";
|
|
3
3
|
import { observeWebSessionInputSchema, webObservationSessionSchema, } from "../domain/browserSession.js";
|
|
4
4
|
import { discoverWebMcpToolsInputSchema, webMcpDiscoverySchema, } from "../domain/webMcpDiscovery.js";
|
|
5
|
-
import {
|
|
5
|
+
import { browserCaptureComparisonWireSchema, browserCaptureComparisonSchema, } from "../domain/browserCaptureComparison.js";
|
|
6
6
|
import { captureWebScreenshotInputSchema, compareWebScreenshotsInputSchema, webScreenshotDiffSchema, webScreenshotSchema, } from "../domain/webScreenshot.js";
|
|
7
7
|
import { toolContractMetadata } from "./toolEffects.js";
|
|
8
8
|
import { evidenceResultOf } from "./toolOutputSchemas.js";
|
|
@@ -12,11 +12,81 @@ const inspectionOutputSchema = evidenceResult(webPageInspectionSchema);
|
|
|
12
12
|
const bundleOutputSchema = evidenceResult(webBundleAnalysisSchema);
|
|
13
13
|
const observationSessionOutputSchema = evidenceResult(webObservationSessionSchema);
|
|
14
14
|
const webMcpOutputSchema = evidenceResult(webMcpDiscoverySchema);
|
|
15
|
-
const captureDiffOutputSchema = evidenceResult(
|
|
15
|
+
const captureDiffOutputSchema = evidenceResult(browserCaptureComparisonSchema);
|
|
16
16
|
const screenshotOutputSchema = evidenceResult(webScreenshotSchema);
|
|
17
17
|
const screenshotDiffOutputSchema = evidenceResult(webScreenshotDiffSchema);
|
|
18
18
|
const endpoint = "http://127.0.0.1:9222";
|
|
19
19
|
const origin = "https://app.example.test";
|
|
20
|
+
const scenarioUrl = {
|
|
21
|
+
url: `${origin}/`,
|
|
22
|
+
origin,
|
|
23
|
+
query_parameter_names: [],
|
|
24
|
+
redacted: false,
|
|
25
|
+
};
|
|
26
|
+
const scenarioCompleteness = {
|
|
27
|
+
status: "complete",
|
|
28
|
+
equality_eligible: true,
|
|
29
|
+
missing_sections: [],
|
|
30
|
+
truncated_sections: [],
|
|
31
|
+
};
|
|
32
|
+
const scenarioArtifacts = {
|
|
33
|
+
screenshot: { state: "not_requested" },
|
|
34
|
+
dom: { state: "not_requested" },
|
|
35
|
+
accessibility: { state: "not_requested" },
|
|
36
|
+
url: { state: "not_requested" },
|
|
37
|
+
history: { state: "not_requested" },
|
|
38
|
+
storage: { state: "not_requested" },
|
|
39
|
+
};
|
|
40
|
+
const exampleScenarioCapture = () => ({
|
|
41
|
+
schema_version: 1,
|
|
42
|
+
browser: {
|
|
43
|
+
mode: "connect",
|
|
44
|
+
process_ownership: "external",
|
|
45
|
+
cleanup: "disconnected-external",
|
|
46
|
+
product: "Chromium",
|
|
47
|
+
version: "149",
|
|
48
|
+
},
|
|
49
|
+
scenario: {
|
|
50
|
+
start_origin: origin,
|
|
51
|
+
allowed_origins: [origin],
|
|
52
|
+
action_count: 1,
|
|
53
|
+
secret_references: [],
|
|
54
|
+
},
|
|
55
|
+
duration_ms: 10,
|
|
56
|
+
steps: [
|
|
57
|
+
{
|
|
58
|
+
step_index: 0,
|
|
59
|
+
step_id: "scenario_start",
|
|
60
|
+
action: "scenario_start",
|
|
61
|
+
status: "completed",
|
|
62
|
+
elapsed_ms: 0,
|
|
63
|
+
before_url: scenarioUrl,
|
|
64
|
+
after_url: scenarioUrl,
|
|
65
|
+
error: null,
|
|
66
|
+
event_sequence_start: 1,
|
|
67
|
+
event_sequence_end: 0,
|
|
68
|
+
artifacts: scenarioArtifacts,
|
|
69
|
+
completeness: scenarioCompleteness,
|
|
70
|
+
},
|
|
71
|
+
{
|
|
72
|
+
step_index: 1,
|
|
73
|
+
step_id: "open-settings",
|
|
74
|
+
action: "click",
|
|
75
|
+
status: "completed",
|
|
76
|
+
elapsed_ms: 10,
|
|
77
|
+
before_url: scenarioUrl,
|
|
78
|
+
after_url: scenarioUrl,
|
|
79
|
+
error: null,
|
|
80
|
+
event_sequence_start: 1,
|
|
81
|
+
event_sequence_end: 0,
|
|
82
|
+
artifacts: scenarioArtifacts,
|
|
83
|
+
completeness: scenarioCompleteness,
|
|
84
|
+
},
|
|
85
|
+
],
|
|
86
|
+
events: { retained: 0, dropped: 0, items: [] },
|
|
87
|
+
completeness: scenarioCompleteness,
|
|
88
|
+
limitations: [],
|
|
89
|
+
});
|
|
20
90
|
/** Origin-scoped, passive browser reverse-engineering contracts. */
|
|
21
91
|
export const BROWSER_TOOL_CONTRACTS = [
|
|
22
92
|
{
|
|
@@ -64,6 +134,7 @@ export const BROWSER_TOOL_CONTRACTS = [
|
|
|
64
134
|
websocket_shape_approved: false,
|
|
65
135
|
include_script_sources: false,
|
|
66
136
|
include_storage_keys: false,
|
|
137
|
+
include_storage_fingerprints: false,
|
|
67
138
|
limits: {
|
|
68
139
|
max_frames: 200,
|
|
69
140
|
max_dom_nodes: 2_000,
|
|
@@ -175,16 +246,26 @@ export const BROWSER_TOOL_CONTRACTS = [
|
|
|
175
246
|
{
|
|
176
247
|
name: "compare_web_captures",
|
|
177
248
|
...toolContractMetadata("compare_web_captures"),
|
|
178
|
-
description: "Compare
|
|
249
|
+
description: "Compare either passive web captures or step-indexed browser scenarios. Scenario comparison aligns exact step IDs, records deterministic literal normalization, and exposes bounded artifact-level changes plus alignment failures. Missing or truncated evidence never proves equality.",
|
|
179
250
|
kind: "browser-provider",
|
|
180
|
-
inputSchema:
|
|
251
|
+
inputSchema: browserCaptureComparisonWireSchema,
|
|
181
252
|
outputSchema: captureDiffOutputSchema,
|
|
182
253
|
examples: [
|
|
183
254
|
{
|
|
184
|
-
title: "Compare two
|
|
255
|
+
title: "Compare two recorded browser scenarios",
|
|
185
256
|
input: {
|
|
186
|
-
|
|
187
|
-
|
|
257
|
+
before_scenario: exampleScenarioCapture(),
|
|
258
|
+
after_scenario: exampleScenarioCapture(),
|
|
259
|
+
normalization: {
|
|
260
|
+
rules: [
|
|
261
|
+
{
|
|
262
|
+
rule_id: "volatile-build-id",
|
|
263
|
+
artifacts: ["dom", "accessibility"],
|
|
264
|
+
match: "build-123",
|
|
265
|
+
replacement: "[BUILD_ID]",
|
|
266
|
+
},
|
|
267
|
+
],
|
|
268
|
+
},
|
|
188
269
|
max_changes: 2_000,
|
|
189
270
|
},
|
|
190
271
|
},
|
|
@@ -231,97 +312,6 @@ export const BROWSER_TOOL_CONTRACTS = [
|
|
|
231
312
|
],
|
|
232
313
|
},
|
|
233
314
|
];
|
|
234
|
-
function exampleCompleteness() {
|
|
235
|
-
return {
|
|
236
|
-
status: "complete_within_window",
|
|
237
|
-
conditions: ["complete_within_window"],
|
|
238
|
-
policy_filtered_sections: [],
|
|
239
|
-
attach_limited_sections: [],
|
|
240
|
-
truncated_sections: [],
|
|
241
|
-
unavailable_sections: [],
|
|
242
|
-
excluded: [],
|
|
243
|
-
dropped_events: {
|
|
244
|
-
scripts: 0,
|
|
245
|
-
network_requests: 0,
|
|
246
|
-
console_events: 0,
|
|
247
|
-
websocket_connections: 0,
|
|
248
|
-
websocket_frames: 0,
|
|
249
|
-
webmcp_tools: 0,
|
|
250
|
-
timeline_events: 0,
|
|
251
|
-
total: 0,
|
|
252
|
-
},
|
|
253
|
-
};
|
|
254
|
-
}
|
|
255
|
-
function exampleInspection() {
|
|
256
|
-
return {
|
|
257
|
-
schema_version: 2,
|
|
258
|
-
browser: {
|
|
259
|
-
product: "Chrome/1",
|
|
260
|
-
protocol_version: "1.3",
|
|
261
|
-
revision: "example",
|
|
262
|
-
user_agent: "Chrome",
|
|
263
|
-
js_version: "1",
|
|
264
|
-
},
|
|
265
|
-
target: {
|
|
266
|
-
target_id: "page-1",
|
|
267
|
-
type: "page",
|
|
268
|
-
title: "Example",
|
|
269
|
-
url: `${origin}/`,
|
|
270
|
-
origin,
|
|
271
|
-
attached: false,
|
|
272
|
-
},
|
|
273
|
-
capture_window: {
|
|
274
|
-
started_at: "2026-07-14T00:00:00.000Z",
|
|
275
|
-
ended_at: "2026-07-14T00:00:01.000Z",
|
|
276
|
-
observation_ms: 1_000,
|
|
277
|
-
},
|
|
278
|
-
completeness: exampleCompleteness(),
|
|
279
|
-
frames: [],
|
|
280
|
-
dom: { total_nodes: 0, nodes: [] },
|
|
281
|
-
accessibility: {
|
|
282
|
-
total_nodes: 0,
|
|
283
|
-
text_capture: {
|
|
284
|
-
status: "not_approved",
|
|
285
|
-
retained_bytes: 0,
|
|
286
|
-
excluded_fields: 0,
|
|
287
|
-
truncated_fields: 0,
|
|
288
|
-
},
|
|
289
|
-
nodes: [],
|
|
290
|
-
},
|
|
291
|
-
scripts: { total: 0, items: [] },
|
|
292
|
-
resources: [],
|
|
293
|
-
network: {
|
|
294
|
-
requests: [],
|
|
295
|
-
websocket_events: [],
|
|
296
|
-
coverage_started_at: "2026-07-14T00:00:00.000Z",
|
|
297
|
-
prior_activity_available: false,
|
|
298
|
-
},
|
|
299
|
-
console: {
|
|
300
|
-
events: [],
|
|
301
|
-
coverage_started_at: "2026-07-14T00:00:00.000Z",
|
|
302
|
-
prior_activity_available: false,
|
|
303
|
-
},
|
|
304
|
-
workers: [],
|
|
305
|
-
metadata: {
|
|
306
|
-
responses: [],
|
|
307
|
-
dom_urls: [],
|
|
308
|
-
agent_hints: [],
|
|
309
|
-
excluded_dom_urls: 0,
|
|
310
|
-
headers_allowlisted: true,
|
|
311
|
-
},
|
|
312
|
-
storage: {
|
|
313
|
-
origin,
|
|
314
|
-
usage_bytes: null,
|
|
315
|
-
quota_bytes: null,
|
|
316
|
-
local_storage_keys: [],
|
|
317
|
-
session_storage_keys: [],
|
|
318
|
-
indexed_db_names: [],
|
|
319
|
-
cache_names: [],
|
|
320
|
-
values_redacted: true,
|
|
321
|
-
},
|
|
322
|
-
limitations: [],
|
|
323
|
-
};
|
|
324
|
-
}
|
|
325
315
|
function exampleScreenshot() {
|
|
326
316
|
return {
|
|
327
317
|
uri: "rea://web-screenshot/sha256/153cf6c9a526a63053a37b10234c2fd85df38887c2dc0a800d90abfa6631d01c",
|
|
@@ -1,4 +1,14 @@
|
|
|
1
1
|
import { z } from "zod";
|
|
2
|
+
const traceLiteralInputSchema = z.object({
|
|
3
|
+
query: z.string().min(1),
|
|
4
|
+
case_sensitive: z.boolean().default(false),
|
|
5
|
+
limit: z.number().int().min(1).max(100).default(20),
|
|
6
|
+
max_operations: z.number().int().min(1).max(100).default(20),
|
|
7
|
+
unknown_registry_approved: z
|
|
8
|
+
.literal(true)
|
|
9
|
+
.optional()
|
|
10
|
+
.describe("Explicit approval to record bounded residuals durably"),
|
|
11
|
+
});
|
|
2
12
|
/** Input schemas shared by MCP registration and enhanced application dispatch. */
|
|
3
13
|
export const enhancedInputSchemas = {
|
|
4
14
|
swift_classes: z.object({ pattern: z.string().default("") }),
|
|
@@ -51,18 +61,25 @@ export const enhancedInputSchemas = {
|
|
|
51
61
|
basic_blocks: 0,
|
|
52
62
|
}),
|
|
53
63
|
}),
|
|
54
|
-
trace_feature:
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
64
|
+
trace_feature: traceLiteralInputSchema,
|
|
65
|
+
find_code_for_string: traceLiteralInputSchema,
|
|
66
|
+
trace_call_path: z.object({
|
|
67
|
+
start: z.string().describe("A provider-normalized procedure address"),
|
|
68
|
+
goal: z
|
|
69
|
+
.string()
|
|
70
|
+
.describe("An optional provider-normalized destination address")
|
|
71
|
+
.optional(),
|
|
72
|
+
direction: z.enum(["forward", "backward"]).default("forward"),
|
|
73
|
+
max_depth: z.number().int().min(1).max(10).default(5),
|
|
74
|
+
max_nodes: z.number().int().min(1).max(500).default(100),
|
|
75
|
+
max_operations: z.number().int().min(1).max(500).default(100),
|
|
59
76
|
unknown_registry_approved: z
|
|
60
77
|
.literal(true)
|
|
61
78
|
.optional()
|
|
62
79
|
.describe("Explicit approval to record bounded residuals durably"),
|
|
63
80
|
}),
|
|
64
81
|
};
|
|
65
|
-
/** Runtime parser for dispatching only the
|
|
82
|
+
/** Runtime parser for dispatching only the closed enhanced names. */
|
|
66
83
|
export const enhancedToolNameSchema = z.enum([
|
|
67
84
|
"swift_classes",
|
|
68
85
|
"get_objc_classes",
|
|
@@ -74,4 +91,6 @@ export const enhancedToolNameSchema = z.enum([
|
|
|
74
91
|
"binary_overview",
|
|
75
92
|
"analyze_function",
|
|
76
93
|
"trace_feature",
|
|
94
|
+
"find_code_for_string",
|
|
95
|
+
"trace_call_path",
|
|
77
96
|
]);
|
|
@@ -0,0 +1,8 @@
|
|
|
1
|
+
import { z } from "zod";
|
|
2
|
+
/** Provider-neutral input for one bounded raw function-instruction window. */
|
|
3
|
+
export const functionInstructionInputSchema = z.object({
|
|
4
|
+
procedure: z.string().describe("The procedure name or address"),
|
|
5
|
+
offset: z.number().int().min(0).max(100_000).default(0),
|
|
6
|
+
limit: z.number().int().min(1).max(500).default(64),
|
|
7
|
+
document: z.string().optional().describe("The document name"),
|
|
8
|
+
});
|
|
@@ -0,0 +1,22 @@
|
|
|
1
|
+
import { z } from "zod";
|
|
2
|
+
const document = z.string().optional().describe("The document name");
|
|
3
|
+
const address = z
|
|
4
|
+
.string()
|
|
5
|
+
.describe("A provider-normalized address; default memory uses 0x-prefixed hexadecimal");
|
|
6
|
+
/** Bounded Hopper memory and file-mapping contracts. */
|
|
7
|
+
export const HOPPER_MEMORY_TOOL_DEFINITIONS = [
|
|
8
|
+
{
|
|
9
|
+
name: "read_bytes",
|
|
10
|
+
description: "Read at most 4,096 analyzed bytes from one provider-normalized virtual address. The hexadecimal payload reports the exact returned length; incomplete reads remain explicit and unsupported provider APIs return typed capability unavailability.",
|
|
11
|
+
inputSchema: z.object({
|
|
12
|
+
address,
|
|
13
|
+
length: z.number().int().min(1).max(4_096).default(256),
|
|
14
|
+
document,
|
|
15
|
+
}),
|
|
16
|
+
},
|
|
17
|
+
{
|
|
18
|
+
name: "address_to_file_offset",
|
|
19
|
+
description: "Map one provider-normalized virtual address to its original nonnegative file offset. Unmapped addresses fail explicitly, and providers without an authoritative mapping API return typed capability unavailability.",
|
|
20
|
+
inputSchema: z.object({ address, document }),
|
|
21
|
+
},
|
|
22
|
+
];
|
|
@@ -1,6 +1,7 @@
|
|
|
1
1
|
import { createEvidence } from "../domain/evidence.js";
|
|
2
2
|
import { reconcileJavaScriptRuntime } from "../domain/javascriptRuntimeReconciliation.js";
|
|
3
3
|
import { JAVASCRIPT_APPLICATION_EVIDENCE_EXAMPLE, JAVASCRIPT_RUNTIME_RECONCILIATION_EXAMPLE, } from "./javascriptRuntimeReconciliationExample.js";
|
|
4
|
+
import { createHistoricalSourceGraph } from "../domain/referenceSourceGraph.js";
|
|
4
5
|
const reconciliation = reconcileJavaScriptRuntime(JAVASCRIPT_RUNTIME_RECONCILIATION_EXAMPLE);
|
|
5
6
|
const reconciliationEvidence = createEvidence(undefined, {
|
|
6
7
|
id: "rea-javascript-runtime-reconciliation",
|
|
@@ -47,6 +48,47 @@ export const JAVASCRIPT_APPLICATION_VERSION_COMPARISON_EXAMPLE = {
|
|
|
47
48
|
left_evidence_id: EXAMPLE_EVIDENCE_ID,
|
|
48
49
|
right_evidence_id: SECOND_EXAMPLE_EVIDENCE_ID,
|
|
49
50
|
};
|
|
51
|
+
/** Historical source inventory compared with one producer-returned graph ID. */
|
|
52
|
+
export const SOURCE_TO_BUNDLE_COMPARISON_EXAMPLE = {
|
|
53
|
+
reference: createHistoricalSourceGraph({
|
|
54
|
+
schema: "HistoricalSourceGraph/v1",
|
|
55
|
+
authority: "historical-reference",
|
|
56
|
+
root_alias: "$REFERENCE_ROOT",
|
|
57
|
+
inventory_state: "complete",
|
|
58
|
+
entries: [
|
|
59
|
+
{
|
|
60
|
+
path: "src",
|
|
61
|
+
kind: "directory",
|
|
62
|
+
classifications: ["source"],
|
|
63
|
+
tree_state: "enumerated",
|
|
64
|
+
limitations: [],
|
|
65
|
+
},
|
|
66
|
+
{
|
|
67
|
+
path: "src/main.ts",
|
|
68
|
+
kind: "file",
|
|
69
|
+
sha256: "2".repeat(64),
|
|
70
|
+
size: 128,
|
|
71
|
+
language: "TypeScript",
|
|
72
|
+
classifications: ["source"],
|
|
73
|
+
content_state: "hashed",
|
|
74
|
+
limitations: [],
|
|
75
|
+
},
|
|
76
|
+
],
|
|
77
|
+
relationships: [],
|
|
78
|
+
parse_failures: [],
|
|
79
|
+
exclusions: [],
|
|
80
|
+
languages: ["TypeScript"],
|
|
81
|
+
manifests: [],
|
|
82
|
+
vcs: { kind: "none", head: null, dirty: null },
|
|
83
|
+
provenance: {
|
|
84
|
+
importer: "rea",
|
|
85
|
+
importer_version: "1",
|
|
86
|
+
caller: "contract-example",
|
|
87
|
+
},
|
|
88
|
+
limitations: [],
|
|
89
|
+
}),
|
|
90
|
+
application_evidence_id: EXAMPLE_EVIDENCE_ID,
|
|
91
|
+
};
|
|
50
92
|
/** Exact static return-shape comparison using producer-returned Evidence IDs. */
|
|
51
93
|
export const JAVASCRIPT_EXPORT_SHAPE_COMPARISON_EXAMPLE = {
|
|
52
94
|
left_evidence_id: EXAMPLE_EVIDENCE_ID,
|
|
@@ -0,0 +1,58 @@
|
|
|
1
|
+
import { toolContractMetadata } from "./toolEffects.js";
|
|
2
|
+
import { evidenceResultOf } from "./toolOutputSchemas.js";
|
|
3
|
+
import { javascriptRuntimeObservationSchema, javascriptRuntimeTargetListSchema, listJavaScriptRuntimeTargetsInputSchema, observeJavaScriptRuntimeInputSchema, } from "../domain/javascriptRuntimeObservation.js";
|
|
4
|
+
const root = "/opt/example-app";
|
|
5
|
+
const endpoint = "http://127.0.0.1:9229";
|
|
6
|
+
/** Passive Node/Electron V8 Inspector discovery and observation contracts. */
|
|
7
|
+
export const JAVASCRIPT_RUNTIME_OBSERVATION_TOOL_CONTRACTS = [
|
|
8
|
+
{
|
|
9
|
+
name: "list_javascript_runtime_targets",
|
|
10
|
+
...toolContractMetadata("list_javascript_runtime_targets"),
|
|
11
|
+
description: "List attachable Node/Electron V8 Inspector targets from one approved literal-loopback endpoint. Only targets inside exact canonical file roots or exact HTTP(S) origins are retained; excluded target locations never enter Evidence.",
|
|
12
|
+
kind: "runtime-provider",
|
|
13
|
+
inputSchema: listJavaScriptRuntimeTargetsInputSchema,
|
|
14
|
+
outputSchema: evidenceResultOf(javascriptRuntimeTargetListSchema),
|
|
15
|
+
examples: [
|
|
16
|
+
{
|
|
17
|
+
title: "List approved Node Inspector targets",
|
|
18
|
+
input: {
|
|
19
|
+
inspector_endpoint: endpoint,
|
|
20
|
+
allowed_file_roots: [root],
|
|
21
|
+
allowed_origins: [],
|
|
22
|
+
approved: true,
|
|
23
|
+
offset: 0,
|
|
24
|
+
limit: 100,
|
|
25
|
+
},
|
|
26
|
+
},
|
|
27
|
+
],
|
|
28
|
+
},
|
|
29
|
+
{
|
|
30
|
+
name: "observe_javascript_runtime",
|
|
31
|
+
...toolContractMetadata("observe_javascript_runtime"),
|
|
32
|
+
description: "Attach passively to one exact approved Node/Electron V8 Inspector target and capture bounded Debugger.scriptParsed plus Runtime execution-context events. REA sends only Runtime.enable and Debugger.enable: it never evaluates, pauses, resumes, reads source, or instruments the target. require/import edges, EventEmitter activity, and Electron IPC remain explicit unknowns; reconcile the returned Evidence with static Application Graph Evidence using reconcile_javascript_runtime.",
|
|
33
|
+
kind: "runtime-provider",
|
|
34
|
+
inputSchema: observeJavaScriptRuntimeInputSchema,
|
|
35
|
+
outputSchema: evidenceResultOf(javascriptRuntimeObservationSchema),
|
|
36
|
+
examples: [
|
|
37
|
+
{
|
|
38
|
+
title: "Observe one approved Node runtime",
|
|
39
|
+
input: {
|
|
40
|
+
inspector_endpoint: endpoint,
|
|
41
|
+
allowed_file_roots: [root],
|
|
42
|
+
allowed_origins: [],
|
|
43
|
+
target_id: "TARGET_ID_FROM_LIST_JAVASCRIPT_RUNTIME_TARGETS",
|
|
44
|
+
runtime_kind: "node",
|
|
45
|
+
approved: true,
|
|
46
|
+
observation_ms: 100,
|
|
47
|
+
limits: {
|
|
48
|
+
max_events: 10_000,
|
|
49
|
+
max_scripts: 2_000,
|
|
50
|
+
max_execution_contexts: 1_000,
|
|
51
|
+
max_location_bytes: 16_384,
|
|
52
|
+
max_total_metadata_bytes: 4_194_304,
|
|
53
|
+
},
|
|
54
|
+
},
|
|
55
|
+
},
|
|
56
|
+
],
|
|
57
|
+
},
|
|
58
|
+
];
|