rea-agents 2.4.0 → 3.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (231) hide show
  1. package/README.md +91 -19
  2. package/bridge/ghidra/ReaGhidraBridge.java +524 -4
  3. package/bridge/hopper_bridge.py +313 -28
  4. package/dist/application/AnalysisClientCleanup.js +14 -0
  5. package/dist/application/AnalysisContextQueries.js +130 -0
  6. package/dist/application/AnalysisSnapshotCache.js +4 -2
  7. package/dist/application/ApplicationWorkflowEvidenceResolver.js +31 -13
  8. package/dist/application/ArtifactInventory/scanCanonical.js +1 -1
  9. package/dist/application/BinarySession.js +20 -8
  10. package/dist/application/BinarySessionComposition.js +21 -0
  11. package/dist/application/BinarySessionRecords.js +79 -9
  12. package/dist/application/BinarySessionStatus.js +31 -1
  13. package/dist/application/BrowserEvidence.js +14 -0
  14. package/dist/application/BrowserScenarioCapturePort.js +1 -0
  15. package/dist/application/BrowserScenarioCaptureService.js +53 -0
  16. package/dist/application/BrowserScenarioEvidence.js +40 -0
  17. package/dist/application/CallPathTracing.js +160 -0
  18. package/dist/application/CapabilityInventory.js +84 -14
  19. package/dist/application/ClientRegistrationStatus.js +4 -1
  20. package/dist/application/CompositeProvider.js +10 -1
  21. package/dist/application/DirectAnalysis.js +13 -4
  22. package/dist/application/EnhancedLiteralTracing.js +118 -0
  23. package/dist/application/EnhancedTools.js +71 -127
  24. package/dist/application/EvidenceLedger.js +45 -16
  25. package/dist/application/JavaScriptApplicationWorkflowEvidence.js +13 -0
  26. package/dist/application/JavaScriptApplicationWorkflowService.js +27 -1
  27. package/dist/application/JavaScriptArtifactAnalysis.js +13 -4
  28. package/dist/application/JavaScriptRuntimeObservationEvidence.js +34 -0
  29. package/dist/application/JavaScriptRuntimeObservationPort.js +1 -0
  30. package/dist/application/JavaScriptRuntimeObservationService.js +46 -0
  31. package/dist/application/JavaScriptSemanticGraphAsyncProjection.js +147 -0
  32. package/dist/application/JavaScriptSemanticGraphBuilder.js +34 -6
  33. package/dist/application/JavaScriptSemanticGraphChildProcessProjection.js +156 -0
  34. package/dist/application/JavaScriptSemanticGraphConstruction.js +2 -2
  35. package/dist/application/JavaScriptSemanticGraphDataProjection.js +203 -0
  36. package/dist/application/JavaScriptSemanticGraphFingerprintProjection.js +25 -0
  37. package/dist/application/JavaScriptSemanticGraphFlowProjection.js +129 -8
  38. package/dist/application/JavaScriptSemanticGraphObjectProjection.js +81 -0
  39. package/dist/application/JavaScriptSemanticGraphProjection.js +14 -7
  40. package/dist/application/JavaScriptSemanticGraphResourceProjection.js +59 -0
  41. package/dist/application/JavaScriptSemanticGraphValueProjection.js +77 -0
  42. package/dist/application/LazyAnalysisProvider.js +77 -0
  43. package/dist/application/LoopbackReplay.js +1 -1
  44. package/dist/application/NativeApiInspection.js +80 -0
  45. package/dist/application/ProcessReactiveEffects.js +6 -0
  46. package/dist/application/ProcessReactiveHarness.js +16 -1
  47. package/dist/application/ProjectPermissionStore.js +1 -0
  48. package/dist/application/ReconstructionObligationAuthority.js +72 -0
  49. package/dist/application/ReconstructionObligationCandidates.js +265 -0
  50. package/dist/application/ReconstructionObligationLedgerDiagnostics.js +47 -0
  51. package/dist/application/ReconstructionObligationLedgerEvaluation.js +263 -0
  52. package/dist/application/ReconstructionObligationLedgerProjection.js +86 -0
  53. package/dist/application/ReconstructionObligationLedgerService.js +72 -0
  54. package/dist/application/ReconstructionObligationOriginalCases.js +33 -0
  55. package/dist/application/ReconstructionObligationPolicies.js +132 -0
  56. package/dist/application/ReconstructionReadinessService.js +48 -0
  57. package/dist/application/SessionProviderRouter.js +6 -6
  58. package/dist/application/SetupClientConfiguration.js +4 -2
  59. package/dist/application/runtime.js +26 -9
  60. package/dist/artifacts/ArtifactProvider.js +87 -22
  61. package/dist/browser/BrowserScenarioSecrets.js +53 -0
  62. package/dist/browser/BrowserScenarioSessionPort.js +1 -0
  63. package/dist/browser/CdpBrowserProvider.js +2 -2
  64. package/dist/browser/CdpCaptureDocuments.js +57 -0
  65. package/dist/browser/CdpCaptureStorage.js +71 -29
  66. package/dist/browser/CdpCaptureStorageFingerprints.js +328 -0
  67. package/dist/browser/CdpEndpoint.js +8 -6
  68. package/dist/browser/CdpPageCapture.js +2 -0
  69. package/dist/browser/JavaScriptRuntimeScope.js +38 -0
  70. package/dist/browser/PlaywrightBrowserScenarioProvider.js +259 -0
  71. package/dist/browser/PlaywrightExecutionBoundary.js +42 -0
  72. package/dist/browser/PlaywrightScenarioActions.js +62 -0
  73. package/dist/browser/PlaywrightScenarioArtifacts.js +238 -0
  74. package/dist/browser/PlaywrightScenarioBrowser.js +144 -0
  75. package/dist/browser/PlaywrightScenarioEvents.js +301 -0
  76. package/dist/browser/PlaywrightScenarioSession.js +300 -0
  77. package/dist/browser/V8InspectorCaptureProjection.js +110 -0
  78. package/dist/browser/V8InspectorEndpoint.js +72 -0
  79. package/dist/browser/V8InspectorProvider.js +267 -0
  80. package/dist/catalogIdentity.js +11 -3
  81. package/dist/cli/artifactCommands.js +44 -3
  82. package/dist/cli/coreAnalysisCommands.js +78 -0
  83. package/dist/cli.js +4 -0
  84. package/dist/cliApplicationCommands.js +30 -2
  85. package/dist/cliBrowserAdvancedCommands.js +17 -5
  86. package/dist/cliBrowserCommands.js +1 -0
  87. package/dist/cliBrowserScenarioCommands.js +43 -0
  88. package/dist/cliCommandNames.js +9 -0
  89. package/dist/cliJavaScriptRuntimeCommands.js +164 -0
  90. package/dist/cliObservationOptions.js +4 -0
  91. package/dist/cliPolicyCommands.js +1 -0
  92. package/dist/config/environment.js +12 -0
  93. package/dist/config/parseConfig.js +88 -17
  94. package/dist/contracts/analysisSearchContract.js +14 -0
  95. package/dist/contracts/applicationToolContracts.js +86 -2
  96. package/dist/contracts/applicationWorkflowInputContracts.js +18 -0
  97. package/dist/contracts/artifactToolContracts.js +29 -2
  98. package/dist/contracts/browserProviderToolContracts.js +7 -0
  99. package/dist/contracts/browserScenarioToolContracts.js +81 -0
  100. package/dist/contracts/browserToolContracts.js +88 -98
  101. package/dist/contracts/enhancedInputs.js +35 -6
  102. package/dist/contracts/functionInstructionContract.js +8 -0
  103. package/dist/contracts/functionWorkflowToolContracts.js +30 -0
  104. package/dist/contracts/hopperMemoryContracts.js +22 -0
  105. package/dist/contracts/javascriptApplicationWorkflowExamples.js +42 -0
  106. package/dist/contracts/javascriptRuntimeObservationToolContracts.js +58 -0
  107. package/dist/contracts/promptContracts.js +14 -15
  108. package/dist/contracts/reconstructionReadinessExample.js +436 -0
  109. package/dist/contracts/toolContractExamples.js +8 -0
  110. package/dist/contracts/toolContractTypes.js +1 -0
  111. package/dist/contracts/toolContracts.js +34 -25
  112. package/dist/contracts/toolEffects.js +25 -0
  113. package/dist/contracts/toolOutputSchemaGroups.js +120 -30
  114. package/dist/contracts/toolOutputSchemaPrimitives.js +37 -0
  115. package/dist/domain/analysisErrorPresentation.js +8 -2
  116. package/dist/domain/analysisErrorProjection.js +9 -0
  117. package/dist/domain/artifactInspection.js +347 -0
  118. package/dist/domain/browserCaptureComparison.js +82 -0
  119. package/dist/domain/browserObservation.js +8 -1
  120. package/dist/domain/browserObservationErrors.js +1 -0
  121. package/dist/domain/browserObservationSchemas.js +26 -0
  122. package/dist/domain/browserScenario.js +165 -0
  123. package/dist/domain/browserScenarioCapture.js +57 -0
  124. package/dist/domain/browserScenarioCaptureValues.js +204 -0
  125. package/dist/domain/browserScenarioDiff.js +324 -0
  126. package/dist/domain/browserScenarioDiffValues.js +157 -0
  127. package/dist/domain/browserScenarioNormalization.js +45 -0
  128. package/dist/domain/browserScenarioValues.js +372 -0
  129. package/dist/domain/bytecodeProvider.js +179 -0
  130. package/dist/domain/conformancePackage.js +169 -0
  131. package/dist/domain/conformanceReplay.js +104 -0
  132. package/dist/domain/conformanceTrustGate.js +193 -0
  133. package/dist/domain/customProtocolCapture.js +137 -0
  134. package/dist/domain/eventProcessTree.js +214 -0
  135. package/dist/domain/evidenceBundle.js +47 -0
  136. package/dist/domain/hopperStartupFailure.js +1 -1
  137. package/dist/domain/hopperValues.js +14 -1
  138. package/dist/domain/inputIssueProjection.js +7 -1
  139. package/dist/domain/javascriptRuntimeObservation.js +170 -0
  140. package/dist/domain/javascriptRuntimeReconciliationParsing.js +120 -2
  141. package/dist/domain/javascriptRuntimeReconciliationResult.js +3 -3
  142. package/dist/domain/javascriptRuntimeReconciliationRuntime.js +2 -2
  143. package/dist/domain/javascriptRuntimeReconciliationSchemas.js +1 -1
  144. package/dist/domain/javascriptSemanticAnalysis.js +13 -16
  145. package/dist/domain/javascriptSemanticAsyncEffects.js +253 -0
  146. package/dist/domain/javascriptSemanticChildProcesses.js +237 -0
  147. package/dist/domain/javascriptSemanticDataEffectHelpers.js +125 -0
  148. package/dist/domain/javascriptSemanticDataEffects.js +284 -0
  149. package/dist/domain/javascriptSemanticDerivedAnalysis.js +41 -0
  150. package/dist/domain/javascriptSemanticFingerprints.js +174 -0
  151. package/dist/domain/javascriptSemanticIr.js +21 -1
  152. package/dist/domain/javascriptSemanticObjects.js +115 -0
  153. package/dist/domain/javascriptSemanticPromises.js +290 -0
  154. package/dist/domain/javascriptSemanticResources.js +136 -0
  155. package/dist/domain/javascriptSourceParser.js +15 -0
  156. package/dist/domain/javascriptStaticAnalysis.js +12 -15
  157. package/dist/domain/javascriptStaticAnalysisBundler.js +38 -0
  158. package/dist/domain/javascriptStaticAnalysisCalls.js +23 -1
  159. package/dist/domain/javascriptStaticAnalysisHelpers.js +8 -0
  160. package/dist/domain/mobileApplicationInvestigation.js +159 -0
  161. package/dist/domain/nativeApiBoundary.js +130 -0
  162. package/dist/domain/objcSwiftMetadata.js +150 -0
  163. package/dist/domain/packageAnalysis.js +123 -0
  164. package/dist/domain/peInspection.js +196 -0
  165. package/dist/domain/processCapture.js +8 -2
  166. package/dist/domain/processReactiveScenario.js +1 -0
  167. package/dist/domain/processReactiveTransition.js +9 -4
  168. package/dist/domain/protocolCapture.js +243 -0
  169. package/dist/domain/providerCleanupError.js +11 -0
  170. package/dist/domain/reconstructionObligationLedgerSchemas.js +278 -0
  171. package/dist/domain/reconstructionReadiness.js +121 -0
  172. package/dist/domain/reconstructionReadinessFindingHelpers.js +17 -0
  173. package/dist/domain/reconstructionReadinessIntegrityFindings.js +118 -0
  174. package/dist/domain/reconstructionReadinessJourneyFindings.js +193 -0
  175. package/dist/domain/reconstructionReadinessSchemas.js +240 -0
  176. package/dist/domain/sourceToBundleComparison.js +335 -0
  177. package/dist/domain/sourceToBundleComparisonSchemas.js +133 -0
  178. package/dist/domain/sourceToBundleSignals.js +202 -0
  179. package/dist/domain/webCaptureDiff.js +141 -27
  180. package/dist/domain/webScreenshot.js +1 -1
  181. package/dist/dotnet/ManagedStaticProvider.js +34 -5
  182. package/dist/generatedMcpToolCatalog.js +37 -0
  183. package/dist/generatedPackageMetadata.js +4 -4
  184. package/dist/ghidra/GhidraDefaults.js +1 -1
  185. package/dist/ghidra/GhidraFunctionValues.js +40 -2
  186. package/dist/ghidra/GhidraProviderCapabilities.js +47 -38
  187. package/dist/hopper/HopperCleanup.js +158 -0
  188. package/dist/hopper/HopperClient.js +93 -99
  189. package/dist/hopper/HopperProvider.js +61 -30
  190. package/dist/hopper/HopperRequestQueue.js +215 -0
  191. package/dist/hopper/HopperResponseStream.js +46 -0
  192. package/dist/hopper/protocol.js +63 -20
  193. package/dist/main/transport.js +24 -27
  194. package/dist/main.js +14 -6
  195. package/dist/mcpDoctor.js +27 -4
  196. package/dist/mcpStartupPolicy.js +14 -0
  197. package/dist/process/ProcessCommandIdentity.js +19 -0
  198. package/dist/process/ProcessOwnership.js +11 -8
  199. package/dist/server/DynamicToolAvailability.js +70 -0
  200. package/dist/server/LazyToolCatalog.js +134 -0
  201. package/dist/server/createServer.js +92 -154
  202. package/dist/server/hydrateServerTools.js +191 -0
  203. package/dist/server/lifecycleProgress.js +10 -0
  204. package/dist/server/permissionFailure.js +12 -0
  205. package/dist/server/registerApplicationTools/compareSourceToBundle.js +35 -0
  206. package/dist/server/registerApplicationTools/helpers.js +11 -7
  207. package/dist/server/registerApplicationTools/obligationLedger.js +27 -0
  208. package/dist/server/registerApplicationTools/readiness.js +55 -0
  209. package/dist/server/registerApplicationTools.js +6 -0
  210. package/dist/server/registerArtifactTools.js +9 -1
  211. package/dist/server/registerBrowserScenarioTool.js +25 -0
  212. package/dist/server/registerBrowserTools.js +2 -2
  213. package/dist/server/registerCloseLifecycleTool.js +57 -0
  214. package/dist/server/registerEnhancedTools.js +28 -7
  215. package/dist/server/registerEvidenceResources.js +54 -101
  216. package/dist/server/registerEvidenceTools.js +9 -2
  217. package/dist/server/registerInvestigationTools.js +1 -2
  218. package/dist/server/registerJavaScriptApplicationGraphResource.js +0 -4
  219. package/dist/server/registerJavaScriptRuntimeObservationTools.js +37 -0
  220. package/dist/server/registerReconstructionObligationLedgerResource.js +32 -0
  221. package/dist/server/registerReconstructionReadinessResource.js +32 -0
  222. package/dist/server/registerSessionRecordTools.js +82 -12
  223. package/dist/server/registerSessionStatusTool.js +11 -8
  224. package/dist/server/registerSessionTools.js +32 -58
  225. package/dist/server/sessionAvailabilityPolicy.js +10 -8
  226. package/dist/server/toolRegistrationOptions.js +21 -6
  227. package/dist/server/toolResult.js +12 -0
  228. package/package.json +28 -11
  229. package/scripts/package-runner-bootstrap.mjs +72 -0
  230. package/scripts/rea.mjs +11 -1
  231. package/skills/reverse-engineer-anything/SKILL.md +10 -3
@@ -38,6 +38,9 @@ export const TOOL_EFFECTS = {
38
38
  procedure_callees: evidence,
39
39
  procedure_callers: evidence,
40
40
  procedure_info: evidence,
41
+ read_function_instructions: evidence,
42
+ read_bytes: evidence,
43
+ address_to_file_offset: evidence,
41
44
  procedure_references: evidence,
42
45
  procedure_pseudo_code: evidence,
43
46
  resolve_containing_procedure: evidence,
@@ -64,13 +67,17 @@ export const TOOL_EFFECTS = {
64
67
  find_xrefs_to_name: evidence,
65
68
  binary_overview: evidence,
66
69
  analyze_function: evidence,
70
+ inspect_native_api: effects({ mutatesSession: true, idempotent: false }),
67
71
  trace_feature: effects({ mutatesSession: true, idempotent: false }),
72
+ find_code_for_string: effects({ mutatesSession: true, idempotent: false }),
73
+ trace_call_path: effects({ mutatesSession: true, idempotent: false }),
68
74
  inspect_macho: nativeEvidence,
69
75
  inspect_signature: nativeEvidence,
70
76
  inspect_plist: nativeEvidence,
71
77
  list_architectures: nativeEvidence,
72
78
  demangle_swift: nativeEvidence,
73
79
  inventory_artifact: evidence,
80
+ inspect_artifact: evidence,
74
81
  extract_artifact: effects({ mutatesSession: true, writesFilesystem: true }),
75
82
  inspect_managed_artifact: evidence,
76
83
  inspect_managed_members: evidence,
@@ -88,14 +95,29 @@ export const TOOL_EFFECTS = {
88
95
  compare_web_captures: browserEvidence,
89
96
  capture_web_screenshot: browserEvidence,
90
97
  compare_web_screenshots: browserEvidence,
98
+ capture_browser_scenario: effects({
99
+ mutatesTarget: true,
100
+ mutatesSession: true,
101
+ writesFilesystem: true,
102
+ launchesProcess: true,
103
+ accessesNetwork: true,
104
+ changesUiState: true,
105
+ mayDiscardData: true,
106
+ idempotent: false,
107
+ }),
91
108
  list_electron_targets: browserEvidence,
92
109
  inspect_electron_page: browserEvidence,
110
+ list_javascript_runtime_targets: browserEvidence,
111
+ observe_javascript_runtime: browserEvidence,
93
112
  analyze_javascript_application: evidence,
94
113
  reconcile_javascript_runtime: evidence,
95
114
  trace_application_feature: evidence,
96
115
  trace_javascript_semantics: evidence,
97
116
  compare_application_versions: evidence,
117
+ compare_source_to_bundle: evidence,
98
118
  compare_javascript_export_shapes: evidence,
119
+ build_reconstruction_obligation_ledger: evidence,
120
+ evaluate_reconstruction_readiness: evidence,
99
121
  run_replay_machine: effects(),
100
122
  run_controlled_replay: effects({
101
123
  mutatesSession: true,
@@ -128,6 +150,9 @@ export const TOOL_EFFECTS = {
128
150
  writesFilesystem: true,
129
151
  mayDiscardData: true,
130
152
  }),
153
+ snapshot_evidence_bundle: effects({ mutatesSession: true }),
154
+ get_navigation_context: effects({ mutatesSession: true }),
155
+ inspect_address_context: effects({ mutatesSession: true }),
131
156
  import_evidence_bundle: effects({ mutatesSession: true }),
132
157
  capture_process_scenario: effects({
133
158
  mutatesSession: true,
@@ -1,10 +1,12 @@
1
1
  import { z } from "zod";
2
+ import { jsonValueSchema } from "../domain/jsonValue.js";
2
3
  import { processCaptureComparisonSchema, processCaptureSchema, } from "../domain/processCapture.js";
3
- import { evidenceBundleSchema } from "../domain/evidenceBundle.js";
4
4
  import { residualUnknownSchema } from "../domain/residualUnknown.js";
5
- import { referenceKindSchema } from "../domain/hopperValues.js";
5
+ import { functionInstructionWindowSchema, referenceKindSchema, } from "../domain/hopperValues.js";
6
+ import { nativeApiInspectionResultSchema } from "../domain/nativeApiBoundary.js";
6
7
  import { demangleSwiftSchema, inspectMachoSchema, inspectPlistSchema, inspectSignatureSchema, listArchitecturesSchema, } from "../domain/nativeInspection.js";
7
8
  import { artifactExtractionResultSchema, artifactInventoryResultSchema, } from "../domain/artifactGraph.js";
9
+ import { artifactInspectionResultSchema } from "../domain/artifactInspection.js";
8
10
  import { managedArtifactInspectionSchema, managedMemberInspectionSchema, managedNativeBoundaryInspectionSchema, } from "../domain/managedArtifact.js";
9
11
  import { managedMemberComparisonResultSchema } from "../domain/managedMemberComparison.js";
10
12
  import { managedNativeVerificationResultSchema } from "../domain/managedNativeVerification.js";
@@ -20,7 +22,15 @@ import { staticRuntimeCorrelationResultSchema } from "../domain/staticRuntimeCor
20
22
  import { reconstructionVerificationResultSchema } from "../domain/reconstructionVerification.js";
21
23
  import { replayMachineRunOutputSchema } from "../domain/replayMachineRun.js";
22
24
  import { analysisErrorProjectionSchema } from "./errorSchemas.js";
23
- import { addressList, addressedEntry, bounded, containingProcedureResolution, functionDossierOutput, graphNode, lifecycleResultOf, nullableText, pageOutput, procedureIdentity, procedureInfoOutput, evidenceResultOf as resultOf, searchPageOutput, segmentOutput, sessionProvider, providerIdentity, toolAvailability, symbolDiscoveryOutput, targetFormatSchema, targetKindSchema, } from "./toolOutputSchemaPrimitives.js";
25
+ import { addressList, analysisActivity, addressedEntry, bounded, containingProcedureResolution, clientFeatureAvailabilitySchema, functionDossierOutput, graphNode, lifecycleResultOf, nullableText, pageOutput, procedureIdentity, procedureInfoOutput, evidenceResultOf as resultOf, searchPageOutput, segmentOutput, sessionProvider, providerIdentity, toolAvailability, symbolDiscoveryOutput, targetFormatSchema, targetKindSchema, } from "./toolOutputSchemaPrimitives.js";
26
+ const contextFacetSchema = z.discriminatedUnion("state", [
27
+ z.object({ state: z.literal("available"), value: jsonValueSchema }),
28
+ z.object({
29
+ state: z.literal("unavailable"),
30
+ reason: z.string(),
31
+ remediation: z.string(),
32
+ }),
33
+ ]);
24
34
  /** Exact structured-content schemas shared by direct analysis providers. */
25
35
  export const officialOutputSchemas = {
26
36
  address_name: resultOf(nullableText),
@@ -43,6 +53,18 @@ export const officialOutputSchemas = {
43
53
  procedure_callees: resultOf(addressList),
44
54
  procedure_callers: resultOf(addressList),
45
55
  procedure_info: procedureInfoOutput,
56
+ read_function_instructions: resultOf(functionInstructionWindowSchema),
57
+ read_bytes: resultOf(z.object({
58
+ address: z.string(),
59
+ requested_bytes: z.number().int().min(1).max(4_096),
60
+ returned_bytes: z.number().int().min(0).max(4_096),
61
+ bytes_hex: z.string().regex(/^(?:[a-f0-9]{2})*$/u),
62
+ complete: z.boolean(),
63
+ })),
64
+ address_to_file_offset: resultOf(z.object({
65
+ address: z.string(),
66
+ file_offset: z.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
67
+ })),
46
68
  procedure_references: resultOf(z.object({
47
69
  procedure: procedureIdentity,
48
70
  direction: z.enum(["incoming", "outgoing"]),
@@ -69,6 +91,55 @@ export const officialOutputSchemas = {
69
91
  unset_bookmark: resultOf(z.boolean()),
70
92
  xrefs: resultOf(addressList),
71
93
  };
94
+ const literalTraceOutput = resultOf(z.object({
95
+ query: z.string(),
96
+ search_mode: z.literal("literal"),
97
+ operations_used: z.number().int().min(0),
98
+ operation_budget: z.number().int().min(1),
99
+ matches: z.array(z.object({
100
+ type: z.enum(["string", "procedure"]),
101
+ address: z.string(),
102
+ value: z.string(),
103
+ })),
104
+ references: z.array(z.object({
105
+ target_address: z.string(),
106
+ source_address: z.string(),
107
+ containing_procedure: containingProcedureResolution,
108
+ })),
109
+ truncated: z.boolean(),
110
+ residual_unknowns: z.array(z.string()),
111
+ }));
112
+ const callPathTraceOutput = resultOf(z.object({
113
+ start: z.string(),
114
+ goal: z.string().nullable(),
115
+ direction: z.enum(["forward", "backward"]),
116
+ goal_status: z.enum(["not_requested", "reached", "not_reached"]),
117
+ nodes: z.array(z.object({
118
+ address: z.string(),
119
+ depth: z.number().int().min(0),
120
+ })),
121
+ edges: z.array(z.object({
122
+ source_address: z.string(),
123
+ target_address: z.string(),
124
+ discovery_depth: z.number().int().min(1),
125
+ })),
126
+ traversal_path: z.array(z.string()),
127
+ failures: z.array(z.object({
128
+ address: z.string(),
129
+ error: analysisErrorProjectionSchema,
130
+ })),
131
+ frontier: z.array(z.string()),
132
+ limits: z.object({
133
+ max_depth: z.number().int().min(1),
134
+ max_nodes: z.number().int().min(1),
135
+ max_operations: z.number().int().min(1),
136
+ nodes_visited: z.number().int().min(1),
137
+ operations_used: z.number().int().min(0),
138
+ }),
139
+ truncated: z.boolean(),
140
+ residual_unknowns: z.array(z.string()),
141
+ limitations: z.array(z.string()),
142
+ }));
72
143
  /** Exact structured-content schemas for composed analysis workflows. */
73
144
  export const enhancedOutputSchemas = {
74
145
  swift_classes: symbolDiscoveryOutput("classes"),
@@ -126,24 +197,10 @@ export const enhancedOutputSchemas = {
126
197
  string_count: z.number().int().min(0),
127
198
  })),
128
199
  analyze_function: functionDossierOutput,
129
- trace_feature: resultOf(z.object({
130
- query: z.string(),
131
- search_mode: z.literal("literal"),
132
- operations_used: z.number().int().min(0),
133
- operation_budget: z.number().int().min(1),
134
- matches: z.array(z.object({
135
- type: z.enum(["string", "procedure"]),
136
- address: z.string(),
137
- value: z.string(),
138
- })),
139
- references: z.array(z.object({
140
- target_address: z.string(),
141
- source_address: z.string(),
142
- containing_procedure: containingProcedureResolution,
143
- })),
144
- truncated: z.boolean(),
145
- residual_unknowns: z.array(z.string()),
146
- })),
200
+ inspect_native_api: resultOf(nativeApiInspectionResultSchema),
201
+ trace_feature: literalTraceOutput,
202
+ find_code_for_string: literalTraceOutput,
203
+ trace_call_path: callPathTraceOutput,
147
204
  };
148
205
  /** Exact Evidence v2 schemas for provider-neutral native inspection. */
149
206
  export const nativeOutputSchemas = {
@@ -156,6 +213,7 @@ export const nativeOutputSchemas = {
156
213
  /** Exact Evidence v2 schemas for provider-neutral artifact graph operations. */
157
214
  export const artifactOutputSchemas = {
158
215
  inventory_artifact: resultOf(artifactInventoryResultSchema),
216
+ inspect_artifact: resultOf(artifactInspectionResultSchema),
159
217
  extract_artifact: resultOf(artifactExtractionResultSchema),
160
218
  };
161
219
  /** Exact Evidence v2 schema for execution-free managed static analysis. */
@@ -210,6 +268,7 @@ export const sessionOutputSchemas = {
210
268
  reasons: z.array(z.string()),
211
269
  remediation: z.string().nullable(),
212
270
  }),
271
+ analysis_activity: analysisActivity,
213
272
  recommended_actions: z.array(z.string()),
214
273
  }),
215
274
  z.object({
@@ -226,6 +285,7 @@ export const sessionOutputSchemas = {
226
285
  next_cursor: z.number().int().min(0).nullable(),
227
286
  has_more: z.boolean(),
228
287
  }),
288
+ client_features: clientFeatureAvailabilitySchema,
229
289
  }),
230
290
  z.union([
231
291
  sessionProvider.extend({
@@ -243,14 +303,34 @@ export const sessionOutputSchemas = {
243
303
  }),
244
304
  ]),
245
305
  ])),
246
- export_evidence_bundle: lifecycleResultOf(z.union([
247
- evidenceBundleSchema,
248
- z.object({
249
- path: z.string(),
250
- bytes: z.number().int().min(0),
251
- records: z.number().int().min(0),
252
- }),
253
- ])),
306
+ export_evidence_bundle: lifecycleResultOf(z.object({
307
+ path: z.string(),
308
+ bytes: z.number().int().min(0),
309
+ records: z.number().int().min(0),
310
+ unknowns: z.number().int().min(0),
311
+ })),
312
+ snapshot_evidence_bundle: lifecycleResultOf(z.object({
313
+ bundle_digest: z.string().regex(/^[a-f0-9]{64}$/u),
314
+ bundle_version: z.literal(2),
315
+ bytes: z.number().int().min(0),
316
+ records: z.number().int().min(0),
317
+ unknowns: z.number().int().min(0),
318
+ bundle_uri: z.string().regex(/^rea:\/\/evidence-bundle\/[a-f0-9]{64}$/u),
319
+ })),
320
+ get_navigation_context: lifecycleResultOf(z.object({
321
+ document: z.string(),
322
+ address: z.string(),
323
+ procedure: z.union([z.string(), z.null()]),
324
+ })),
325
+ inspect_address_context: lifecycleResultOf(z.object({
326
+ address: z.string(),
327
+ document: z.string().nullable(),
328
+ name: contextFacetSchema,
329
+ procedure: contextFacetSchema,
330
+ comment: contextFacetSchema,
331
+ inline_comment: contextFacetSchema,
332
+ bookmarks: contextFacetSchema,
333
+ })),
254
334
  import_evidence_bundle: lifecycleResultOf(z.object({
255
335
  imported: z.number().int().min(0),
256
336
  total: z.number().int().min(0),
@@ -264,7 +344,17 @@ export const sessionOutputSchemas = {
264
344
  build_call_path: resultOf(callPathResultSchema),
265
345
  correlate_static_and_runtime: resultOf(staticRuntimeCorrelationResultSchema),
266
346
  verify_reconstruction: resultOf(reconstructionVerificationResultSchema),
267
- list_unknowns: lifecycleResultOf(z.array(residualUnknownSchema)),
347
+ list_unknowns: lifecycleResultOf(z.object({
348
+ items: z.array(z.object({
349
+ unknown: residualUnknownSchema,
350
+ uri: z.string().regex(/^rea:\/\/unknown\/unk_[a-f0-9]{64}$/u),
351
+ })),
352
+ offset: z.number().int().min(0),
353
+ limit: z.number().int().min(1).max(500),
354
+ total: z.number().int().min(0),
355
+ next_offset: z.number().int().min(0).nullable(),
356
+ has_more: z.boolean(),
357
+ })),
268
358
  record_unknown: lifecycleResultOf(residualUnknownSchema),
269
359
  update_unknown: lifecycleResultOf(residualUnknownSchema),
270
360
  verify_unknown_resolution: lifecycleResultOf(z.object({
@@ -111,6 +111,22 @@ const analysisRun = z
111
111
  ]),
112
112
  })
113
113
  .nullable();
114
+ export const analysisActivity = z.object({
115
+ status: z.enum(["not_observed", "idle", "busy", "timed_out_busy"]),
116
+ providers: z.array(z.object({
117
+ provider: providerIdentity,
118
+ active: z
119
+ .object({
120
+ request_id: z.number().int().min(1),
121
+ operation: z.string().min(1),
122
+ elapsed_ms: z.number().int().min(0),
123
+ timeout_ms: z.number().int().min(0),
124
+ caller_state: z.enum(["waiting", "timed_out", "cancelled"]),
125
+ })
126
+ .nullable(),
127
+ queued_requests: z.number().int().min(0),
128
+ })),
129
+ });
114
130
  const providerRejectionCode = z.enum(PROVIDER_REJECTION_CODES);
115
131
  const providerDiagnostics = z.record(z.string(), z.json());
116
132
  const providerAvailability = z.discriminatedUnion("status", [
@@ -153,12 +169,26 @@ const providerTargetSupport = z.discriminatedUnion("status", [
153
169
  diagnostics: providerDiagnostics,
154
170
  }),
155
171
  ]);
172
+ const clientFeatureNameSchema = z.enum([
173
+ "elicitation_form",
174
+ "elicitation_url",
175
+ "roots",
176
+ "sampling",
177
+ ]);
178
+ /** Negotiated MCP client features that affect REA workflow availability. */
179
+ export const clientFeatureAvailabilitySchema = z.object({
180
+ elicitation_form: z.boolean(),
181
+ elicitation_url: z.boolean(),
182
+ roots: z.boolean(),
183
+ sampling: z.boolean(),
184
+ });
156
185
  export const toolAvailability = z.object({
157
186
  name: z.string(),
158
187
  surface: z.string(),
159
188
  available: z.boolean(),
160
189
  reason: z.enum([
161
190
  "available",
191
+ "client_capability_missing",
162
192
  "target_required",
163
193
  "provider_missing",
164
194
  "provider_unavailable",
@@ -167,6 +197,12 @@ export const toolAvailability = z.object({
167
197
  "policy_disabled",
168
198
  ]),
169
199
  remediation: z.string().nullable(),
200
+ client_requirements: z.object({
201
+ required: z.array(clientFeatureNameSchema),
202
+ optional: z.array(clientFeatureNameSchema),
203
+ missing_required: z.array(clientFeatureNameSchema),
204
+ missing_optional: z.array(clientFeatureNameSchema),
205
+ }),
170
206
  effects: z.strictObject({
171
207
  mutatesTarget: z.boolean(),
172
208
  mutatesSession: z.boolean(),
@@ -189,6 +225,7 @@ export const sessionProvider = z.object({
189
225
  providers: z.array(providerIdentity),
190
226
  capabilities: z.array(providerCapability),
191
227
  analysis_run: analysisRun,
228
+ analysis_activity: analysisActivity,
192
229
  analysis_provider_binding: z
193
230
  .object({
194
231
  provider: providerIdentity,
@@ -2,6 +2,8 @@ import { AnalysisInputError, ArtifactOperationError, BinaryTargetError, BrowserO
2
2
  export const analysisErrorRemediationAction = (error) => {
3
3
  if (error instanceof AnalysisInputError)
4
4
  return "Correct the listed arguments and retry.";
5
+ if (error instanceof UnknownRegistryError && error.reason === "not-found")
6
+ return "Check that the unknown_id belongs to this session, then retry.";
5
7
  if (error instanceof ReplayPlanStaleError)
6
8
  return "Review the rebuilt replay plan and explicitly approve its new digest.";
7
9
  if (error instanceof PermissionRequiredError)
@@ -64,7 +66,7 @@ const artifactErrorCategory = (reason) => {
64
66
  return "truncated";
65
67
  if (reason === "cancelled")
66
68
  return "cancelled";
67
- if (reason === "unavailable")
69
+ if (reason === "policy" || reason === "unavailable")
68
70
  return "unavailable";
69
71
  return "execution_failure";
70
72
  };
@@ -103,6 +105,8 @@ export const analysisErrorUserMessage = (error) => {
103
105
  return evidenceFileMessage(error.reason);
104
106
  if (error instanceof InvestigationWorkspaceError)
105
107
  return investigationWorkspaceMessage(error.reason);
108
+ if (error instanceof UnknownRegistryError && error.reason === "not-found")
109
+ return "The requested residual unknown does not exist in this session. Check the unknown_id and try again.";
106
110
  if (error instanceof UnknownRegistryError)
107
111
  return "Evidence state changed before the update completed. Refresh the current state and try again.";
108
112
  if (error instanceof ConfigurationError)
@@ -163,8 +167,10 @@ const artifactMessage = (reason) => {
163
167
  return "Artifact is too large to process safely. Narrow the requested path or use a smaller artifact.";
164
168
  if (reason === "path")
165
169
  return "Artifact path is not allowed. Choose a path inside the artifact and try again.";
170
+ if (reason === "policy")
171
+ return "Artifact integrity continuation is disabled by policy. Configure REA_ARTIFACT_INTEGRITY_CONTINUE_ENABLED=true and retry only if continuing after mismatches is approved.";
166
172
  if (reason === "unavailable")
167
- return "Artifact format is not available on this system. Choose another artifact or supported environment.";
173
+ return "Artifact processing is unavailable for the current target or policy. Check artifact support and required approvals.";
168
174
  if (reason === "format" || reason === "integrity")
169
175
  return "Artifact is invalid or has changed. Get a fresh copy and try again.";
170
176
  return "Artifact could not be read or written. Check file access and try again.";
@@ -21,6 +21,8 @@ export const projectAnalysisError = (error) => {
21
21
  };
22
22
  };
23
23
  const errorCode = (error) => {
24
+ if (error.cleanupIncomplete)
25
+ return "cleanup_incomplete";
24
26
  if (error instanceof ReplayPlanStaleError)
25
27
  return "plan_stale";
26
28
  if (error instanceof PermissionRequiredError)
@@ -150,6 +152,7 @@ const requestErrorDetails = (error) => {
150
152
  issues: error.issues.map((issue) => ({
151
153
  path: [...issue.path],
152
154
  reason: issue.reason,
155
+ ...(issue.message === undefined ? {} : { message: issue.message }),
153
156
  ...(issue.expected === undefined ? {} : { expected: issue.expected }),
154
157
  ...(issue.minimum === undefined ? {} : { minimum: issue.minimum }),
155
158
  ...(issue.maximum === undefined ? {} : { maximum: issue.maximum }),
@@ -221,6 +224,12 @@ const providerErrorDetails = (error) => {
221
224
  return {
222
225
  provider_id: error.providerId,
223
226
  operation: error.operation,
227
+ ...(error.cleanupIncomplete
228
+ ? {
229
+ cleanup: "incomplete",
230
+ resources: [...error.cleanupResources],
231
+ }
232
+ : {}),
224
233
  ...(error.diagnostics === undefined
225
234
  ? {}
226
235
  : { diagnostics: error.diagnostics }),