rea-agents 2.5.0 → 3.0.0

package/dist/domain/eventProcessTree.js

@@ -0,0 +1,214 @@
+import { z } from "zod";
+/** Event types for event-backed process-tree capture. */
+export const processEventTypeSchema = z.enum([
+    "spawn",
+    "exit",
+    "re_exec",
+    "reparent",
+    "signal",
+    "name_change",
+    "thread_create",
+    "thread_exit",
+]);
+/** A single event-backed process-tree event. */
+export const processTreeEventSchema = z.strictObject({
+    /** Monotonic event sequence number. */
+    sequence: z.number().int().nonnegative(),
+    /** Event timestamp in milliseconds. */
+    at_ms: z.number().int().nonnegative(),
+    /** Event type. */
+    type: processEventTypeSchema,
+    /** Process ID. */
+    pid: z.number().int().positive(),
+    /** Parent process ID. */
+    ppid: z.number().int().nullable(),
+    /** Process name if known. */
+    process_name: z.string().nullable(),
+    /** Executable path if known. */
+    executable: z.string().nullable(),
+    /** Command line arguments. */
+    arguments: z.array(z.string()).default([]),
+    /** Previous PID (for reparent events). */
+    previous_pid: z.number().int().nullable(),
+    /** Previous PPID (for reparent events). */
+    previous_ppid: z.number().int().nullable(),
+    /** Exit code (for exit events). */
+    exit_code: z.number().int().nullable(),
+    /** Signal number (for signal events). */
+    signal: z.number().int().nullable(),
+    /** Thread ID (for thread events). */
+    tid: z.number().int().nullable(),
+});
+/** Process node in a reconstructed tree. */
+export const processNodeSchema = z.strictObject({
+    pid: z.number().int().positive(),
+    ppid: z.number().int().nullable(),
+    process_name: z.string().nullable(),
+    executable: z.string().nullable(),
+    arguments: z.array(z.string()).default([]),
+    children: z.array(z.number().int()).default([]),
+    spawn_time_ms: z.number().int().nullable(),
+    exit_time_ms: z.number().int().nullable(),
+    exit_code: z.number().int().nullable(),
+    is_re_exec: z.boolean().default(false),
+    is_reparented: z.boolean().default(false),
+    previous_ppid: z.number().int().nullable(),
+});
+/** Result of event-backed process-tree reconstruction. */
+export const processTreeReconstructionSchema = z.strictObject({
+    /** Root PID of the process tree. */
+    root_pid: z.number().int().positive(),
+    /** All reconstructed process nodes. */
+    processes: z.array(processNodeSchema).min(0).max(10_000),
+    /** Events that were consumed. */
+    events_consumed: z.number().int().nonnegative(),
+    /** Events that could not be matched. */
+    events_unmatched: z.number().int().nonnegative(),
+    /** Short-lived descendants that were missed by sampling. */
+    short_lived_descendants: z.number().int().nonnegative(),
+    /** Whether any re-exec was detected. */
+    has_re_exec: z.boolean().default(false),
+    /** Whether any reparenting was detected. */
+    has_reparenting: z.boolean().default(false),
+});
+/** Reconstruct a process tree from event-backed capture. */
+export function reconstructProcessTree(events, rootPid) {
+    const nodes = new Map();
+    const children = new Map();
+    let eventsConsumed = 0;
+    let eventsUnmatched = 0;
+    let hasReExec = false;
+    let hasReparenting = false;
+    let shortLivedDescendants = 0;
+    const sorted = [...events].sort((a, b) => a.at_ms - b.at_ms);
+    for (const event of sorted) {
+        eventsConsumed++;
+        let node = nodes.get(event.pid);
+        switch (event.type) {
+            case "spawn": {
+                if (!node) {
+                    node = {
+                        pid: event.pid,
+                        ppid: event.ppid,
+                        process_name: event.process_name,
+                        executable: event.executable,
+                        arguments: event.arguments,
+                        children: [],
+                        spawn_time_ms: event.at_ms,
+                        exit_time_ms: null,
+                        exit_code: null,
+                        is_re_exec: false,
+                        is_reparented: false,
+                        previous_ppid: null,
+                    };
+                    nodes.set(event.pid, node);
+                }
+                if (event.ppid !== null) {
+                    const parentChildren = children.get(event.ppid) ?? [];
+                    parentChildren.push(event.pid);
+                    children.set(event.ppid, parentChildren);
+                }
+                break;
+            }
+            case "exit": {
+                if (node) {
+                    node.exit_time_ms = event.at_ms;
+                    node.exit_code = event.exit_code;
+                    if (node.spawn_time_ms !== null &&
+                        event.at_ms - node.spawn_time_ms < 100)
+                        shortLivedDescendants++;
+                }
+                else {
+                    eventsUnmatched++;
+                }
+                break;
+            }
+            case "re_exec": {
+                if (node) {
+                    node.is_re_exec = true;
+                    node.executable = event.executable ?? node.executable;
+                    node.arguments = event.arguments;
+                    hasReExec = true;
+                }
+                else {
+                    eventsUnmatched++;
+                }
+                break;
+            }
+            case "reparent": {
+                if (node) {
+                    node.previous_ppid = node.ppid;
+                    node.ppid = event.ppid;
+                    node.is_reparented = true;
+                    hasReparenting = true;
+                }
+                else {
+                    eventsUnmatched++;
+                }
+                break;
+            }
+            case "signal":
+            case "name_change":
+            case "thread_create":
+            case "thread_exit":
+                // These events are recorded but don't modify the tree structure
+                break;
+        }
+    }
+    // Attach children to nodes
+    for (const [pid, childPids] of children) {
+        const node = nodes.get(pid);
+        if (node)
+            node.children = childPids;
+    }
+    return {
+        root_pid: rootPid,
+        processes: [...nodes.values()],
+        events_consumed: eventsConsumed,
+        events_unmatched: eventsUnmatched,
+        short_lived_descendants: shortLivedDescendants,
+        has_re_exec: hasReExec,
+        has_reparenting: hasReparenting,
+    };
+}
+/** Get all descendant PIDs of a given root PID. */
+export function getDescendants(processes, rootPid) {
+    const byPid = new Map(processes.map((p) => [p.pid, p]));
+    const visited = new Set();
+    const result = [];
+    const queue = [rootPid];
+    while (queue.length > 0) {
+        const pid = queue.shift();
+        if (visited.has(pid))
+            continue;
+        visited.add(pid);
+        const node = byPid.get(pid);
+        if (node) {
+            for (const child of node.children) {
+                if (!visited.has(child)) {
+                    result.push(child);
+                    queue.push(child);
+                }
+            }
+        }
+    }
+    return result;
+}
+/** Check if a process tree contains a specific PID. */
+export function containsProcess(processes, pid) {
+    return processes.some((p) => p.pid === pid);
+}
+/** Get the maximum tree depth from the root. */
+export function maxTreeDepth(processes, rootPid) {
+    const byPid = new Map(processes.map((p) => [p.pid, p]));
+    function depth(pid, visited) {
+        if (visited.has(pid))
+            return 0;
+        visited.add(pid);
+        const node = byPid.get(pid);
+        if (!node || node.children.length === 0)
+            return 0;
+        return 1 + Math.max(...node.children.map((c) => depth(c, visited)));
+    }
+    return depth(rootPid, new Set());
+}

package/dist/domain/evidenceBundle.js

@@ -163,6 +163,53 @@ const validateVerifiedResolution = (unknown, evidenceById) => {
     if (qualifies !== true)
         throw new TypeError(`Residual unknown ${unknown.unknown_id} has no qualifying resolution evidence`);
 };
+/**
+ * Validate one new residual-unknown revision against an already valid ledger.
+ * This keeps ordinary mutations proportional to the affected revision while
+ * full bundle imports continue to validate the complete graph.
+ */
+export const validateResidualUnknownAddition = (unknown, evidenceById, currentHeads) => {
+    const current = currentHeads.get(unknown.unknown_id);
+    if (current === undefined
+        ? unknown.revision !== 1 || unknown.previous_revision_digest !== null
+        : unknown.revision !== current.revision + 1 ||
+            unknown.previous_revision_digest !== current.revision_digest)
+        throw new TypeError(`Residual unknown ${unknown.unknown_id} revision chain is broken`);
+    for (const evidenceId of referencedEvidenceIds(unknown))
+        if (!evidenceById.has(evidenceId))
+            throw new TypeError(`Residual unknown references missing evidence ${evidenceId}`);
+    for (const relationship of unknown.relationships)
+        if (relationship.unknown_id !== unknown.unknown_id &&
+            !currentHeads.has(relationship.unknown_id))
+            throw new TypeError(`Residual unknown references missing unknown ${relationship.unknown_id}`);
+    if (unknown.resolution?.disposition === "verified")
+        validateVerifiedResolution(unknown, evidenceById);
+    for (const relationship of unknown.relationships)
+        if (relationship.type === "depends-on" &&
+            reachesUnknown(relationship.unknown_id, unknown.unknown_id, currentHeads, unknown))
+            throw new TypeError("Residual unknown dependency graph contains a cycle");
+};
+const reachesUnknown = (start, goal, currentHeads, candidate) => {
+    const pending = [start];
+    const visited = new Set();
+    while (pending.length > 0) {
+        const id = pending.pop();
+        if (id === undefined)
+            break;
+        if (id === goal)
+            return true;
+        if (visited.has(id))
+            continue;
+        visited.add(id);
+        const unknown = id === candidate.unknown_id ? candidate : currentHeads.get(id);
+        if (unknown === undefined)
+            continue;
+        for (const relationship of unknown.relationships)
+            if (relationship.type === "depends-on")
+                pending.push(relationship.unknown_id);
+    }
+    return false;
+};
 const evidenceQualifies = (unknown, evidence) => {
     if (unknown.required_authority !== null &&
         evidence.authority !== unknown.required_authority)

package/dist/domain/hopperStartupFailure.js

@@ -27,7 +27,7 @@ const failures = [
     [
         75,
         "hopper_exited_during_startup",
-        "Hopper exited before the REA bridge was ready. Run rea doctor and retry the analysis.",
+        "Hopper exited before the REA bridge was ready. In CI, run rea doctor --provider hopper --detail full --json; if Hopper showed a UI or license prompt, complete it in the runner user session, otherwise close stale Hopper sessions and retry.",
     ],
     [
         76,

package/dist/domain/hopperValues.js

@@ -1,6 +1,8 @@
 import { z } from "zod";
+import { jsonValueSchema } from "./jsonValue.js";
 import { AnalysisOutputError, HopperProtocolError } from "./errors.js";
 import { err, ok } from "./result.js";
+import { nativeApiBoundarySchema } from "./nativeApiBoundary.js";
 /** Return a bounded byte distance between canonical addresses in one space. */
 export const addressDistance = (start, end) => {
     const left = addressCoordinate(start);
@@ -236,6 +238,7 @@ export const functionDossierSchema = z
     instruction_scan: z
         .object({ scanned: z.number().int().min(0), truncated: z.boolean() })
         .strict(),
+    native_api: nativeApiBoundarySchema.optional(),
     limitations: z.array(z.string()).default([]),
 })
     .strict();
@@ -243,7 +246,7 @@ export const functionDossierSchema = z
 export const parseFunctionDossier = (value) => {
     const parsed = functionDossierSchema.safeParse(value);
     return parsed.success
-        ? ok(parsed.data)
+        ? ok(jsonValueSchema.parse(parsed.data))
         : err(new AnalysisOutputError("analyze_function", "provider output did not match the dossier contract", { cause: parsed.error }));
 };
 /** Parse page entries and continuation metadata returned by list operations. */

package/dist/domain/inputIssueProjection.js

@@ -31,7 +31,13 @@ const projectIssue = (issue, input) => {
                 expected: issue.values.filter(isSafeExpected),
             },
         ];
-    return [{ path, reason: "invalid_value" }];
+    return [
+        {
+            path,
+            reason: "invalid_value",
+            ...(issue.message.length > 0 ? { message: issue.message } : {}),
+        },
+    ];
 };
 const valueAtPath = (input, path) => {
     let current = input;

package/dist/domain/javascriptSemanticAnalysis.js

@@ -1,4 +1,3 @@
-import { parse } from "@babel/parser";
 import * as t from "@babel/types";
 import { DEFAULT_JAVASCRIPT_SEMANTIC_LIMITS, failedJavaScriptSemanticIr, } from "./javascriptSemanticIr.js";
 import { collectSemanticModuleLink, collectSemanticCallable, collectSemanticReferences, immutableSemanticBindings, immutableSemanticScopes, reachSemanticLimit, semanticModuleOrigin, semanticStaticPropertyName, } from "./javascriptSemanticProjection.js";
@@ -7,20 +6,17 @@ import { traverseJavaScriptAst } from "./javascriptSemanticTraversal.js";
 import { collectSemanticReturns, resolveSemanticModuleCallables, } from "./javascriptSemanticReturns.js";
 import { collectJavaScriptDerivedSemantics } from "./javascriptSemanticDerivedAnalysis.js";
 import { compareCodePoints, propertyName, range, } from "./javascriptStaticAnalysisHelpers.js";
+import { parseJavaScriptSource, } from "./javascriptSourceParser.js";
 /** Recover bounded lexical bindings, aliases, constants, and module links. */
 export const analyzeJavaScriptSemantics = (source, inputLimits = {}) => {
+    const file = parseJavaScriptSource(source);
+    return file === null
+        ? failedJavaScriptSemanticIr()
+        : analyzeParsedJavaScriptSemantics(file, inputLimits);
+};
+/** Recover semantics from an already parsed JavaScript artifact. */
+export const analyzeParsedJavaScriptSemantics = (file, inputLimits = {}) => {
     const limits = { ...DEFAULT_JAVASCRIPT_SEMANTIC_LIMITS, ...inputLimits };
-    let file;
-    try {
-        file = parse(source, {
-            sourceType: "unambiguous",
-            errorRecovery: true,
-            plugins: ["jsx", "typescript"],
-        });
-    }
-    catch {
-        return failedJavaScriptSemanticIr();
-    }
     const state = createState(file.program, limits);
     collectDefinitions(file.program, state);
     const references = collectSemanticReferences(file.program, state);

package/dist/domain/javascriptSourceParser.js

@@ -0,0 +1,15 @@
+import { parse } from "@babel/parser";
+/** Parse JavaScript or TypeScript once without retaining unused comment nodes. */
+export const parseJavaScriptSource = (source) => {
+    try {
+        return parse(source, {
+            sourceType: "unambiguous",
+            errorRecovery: true,
+            attachComment: false,
+            plugins: ["jsx", "typescript"],
+        });
+    }
+    catch {
+        return null;
+    }
+};

package/dist/domain/javascriptStaticAnalysis.js

@@ -1,4 +1,3 @@
-import { parse } from "@babel/parser";
 import * as t from "@babel/types";
 import { inspectElectronStaticNode } from "./electronStaticAnalysis.js";
 import { detectVendors, failedJavaScriptStaticAnalysis, registrationKey, sortedUnique, stringValue, } from "./javascriptStaticAnalysisHelpers.js";
@@ -6,19 +5,16 @@ import { addReference, addSourceMapDirectives, inspectCall, inspectRouteProperty
 import { inspectBundlerRegistration, inspectEsbuildWrapper, } from "./javascriptStaticAnalysisBundler.js";
 import { finalizeLocatedFindings } from "./javascriptStaticAnalysisFindings.js";
 import { createJavaScriptAnalysisAccumulator, } from "./javascriptStaticAnalysisState.js";
+import { parseJavaScriptSource, } from "./javascriptSourceParser.js";
 /** Parse one bounded JavaScript artifact and recover static structure only. */
 export const analyzeJavaScriptStaticSource = (source, limits) => {
-    let file;
-    try {
-        file = parse(source, {
-            sourceType: "unambiguous",
-            errorRecovery: true,
-            plugins: ["jsx", "typescript"],
-        });
-    }
-    catch {
-        return failedJavaScriptStaticAnalysis();
-    }
+    const file = parseJavaScriptSource(source);
+    return file === null
+        ? failedJavaScriptStaticAnalysis()
+        : analyzeParsedJavaScriptStaticSource(source, file, limits);
+};
+/** Recover static structure from an already parsed JavaScript artifact. */
+export const analyzeParsedJavaScriptStaticSource = (source, file, limits) => {
     const accumulator = createJavaScriptAnalysisAccumulator();
     traverseStaticSource(source, file, accumulator, limits);
     addSourceMapDirectives(source, accumulator, limits.maxFindings);

package/dist/domain/mobileApplicationInvestigation.js

@@ -0,0 +1,159 @@
+import { z } from "zod";
+/** Supported mobile artifact formats. */
+export const mobileArtifactFormatSchema = z.enum([
+    "apk",
+    "aab",
+    "ipa",
+    "dex",
+    "native_lib",
+]);
+/** Mobile platform. */
+export const mobilePlatformSchema = z.enum([
+    "android",
+    "ios",
+    "cross_platform",
+]);
+/** Android manifest entry. */
+export const androidManifestSchema = z.strictObject({
+    package_name: z.string().min(1),
+    version_name: z.string().nullable(),
+    version_code: z.number().int().nullable(),
+    min_sdk: z.number().int().nullable(),
+    target_sdk: z.number().int().nullable(),
+    permissions: z.array(z.string()).default([]),
+    activities: z.array(z.string()).default([]),
+    services: z.array(z.string()).default([]),
+    receivers: z.array(z.string()).default([]),
+    providers: z.array(z.string()).default([]),
+});
+/** iOS app manifest (Info.plist). */
+export const iosManifestSchema = z.strictObject({
+    bundle_identifier: z.string().min(1),
+    bundle_version: z.string().nullable(),
+    short_version: z.string().nullable(),
+    minimum_os_version: z.string().nullable(),
+    supported_platforms: z.array(z.string()).default([]),
+    ui_required_device_capabilities: z.array(z.string()).default([]),
+    app_permissions: z.array(z.string()).default([]),
+});
+/** Signing information. */
+export const signingInfoSchema = z.strictObject({
+    is_signed: z.boolean().default(false),
+    signer_identity: z.string().nullable(),
+    certificate_fingerprint: z.string().nullable(),
+    signature_scheme: z.string().nullable(),
+    is_debuggable: z.boolean().default(false),
+});
+/** Native library entry. */
+export const nativeLibrarySchema = z.strictObject({
+    path: z.string().min(1),
+    architecture: z.string().nullable(),
+    size: z.number().int().nonnegative(),
+    digest: z
+        .string()
+        .regex(/^[a-f0-9]{64}$/u)
+        .nullable(),
+});
+/** Resource entry within a mobile artifact. */
+export const mobileResourceSchema = z.strictObject({
+    path: z.string().min(1),
+    type: z.enum([
+        "layout",
+        "drawable",
+        "string",
+        "asset",
+        "raw",
+        "native_lib",
+        "manifest",
+        "entitlements",
+        "provisioning",
+        "other",
+    ]),
+    size: z.number().int().nonnegative(),
+});
+/** Static analysis result for a mobile artifact. */
+export const mobileArtifactManifestSchema = z.strictObject({
+    format: mobileArtifactFormatSchema,
+    platform: mobilePlatformSchema,
+    app_name: z.string().nullable(),
+    android_manifest: androidManifestSchema.nullable(),
+    ios_manifest: iosManifestSchema.nullable(),
+    signing: signingInfoSchema,
+    resources: z.array(mobileResourceSchema).default([]),
+    native_libraries: z.array(nativeLibrarySchema).default([]),
+    total_size: z.number().int().nonnegative(),
+    architectures: z.array(z.string()).default([]),
+});
+/** Detect mobile artifact format from file extension. */
+export function detectMobileFormat(path) {
+    const lower = path.toLowerCase();
+    if (lower.endsWith(".apk"))
+        return "apk";
+    if (lower.endsWith(".aab"))
+        return "aab";
+    if (lower.endsWith(".ipa"))
+        return "ipa";
+    if (lower.endsWith(".dex"))
+        return "dex";
+    if (lower.endsWith(".so") || lower.endsWith(".dylib") || lower.endsWith(".a"))
+        return "native_lib";
+    return null;
+}
+/** Detect platform from format. */
+export function detectPlatform(format) {
+    switch (format) {
+        case "apk":
+        case "aab":
+        case "dex":
+            return "android";
+        case "ipa":
+            return "ios";
+        case "native_lib":
+            return "cross_platform";
+    }
+}
+/** Classify a resource by its path. */
+export function classifyMobileResource(path) {
+    const lower = path.toLowerCase();
+    if (lower.includes("androidmanifest.xml"))
+        return "manifest";
+    if (lower.includes(".entitlements"))
+        return "entitlements";
+    if (lower.includes("provisioning") || lower.includes(".mobileprovision"))
+        return "provisioning";
+    if (lower.includes("/layout/"))
+        return "layout";
+    if (lower.includes("/drawable/") || lower.includes("/mipmap/"))
+        return "drawable";
+    if (lower.includes("/values/"))
+        return "string";
+    if (lower.includes("assets/") || lower.includes("raw/"))
+        return "asset";
+    if (lower.endsWith(".so") || lower.endsWith(".dylib"))
+        return "native_lib";
+    if (lower.endsWith(".xml"))
+        return "layout";
+    return "other";
+}
+/** Get all native libraries for a specific architecture. */
+export function nativeLibsByArchitecture(manifest, arch) {
+    return manifest.native_libraries.filter((l) => l.architecture === arch);
+}
+/** Check if an Android artifact has internet permission. */
+export function hasInternetPermission(manifest) {
+    if (!manifest.android_manifest)
+        return false;
+    return manifest.android_manifest.permissions.some((p) => p.includes("INTERNET") || p.includes("android.permission.INTERNET"));
+}
+/** Get all unique architectures across native libraries. */
+export function getAllArchitectures(manifest) {
+    const archs = new Set();
+    for (const lib of manifest.native_libraries) {
+        if (lib.architecture)
+            archs.add(lib.architecture);
+    }
+    for (const arch of manifest.architectures) {
+        archs.add(arch);
+    }
+    return [...archs];
+}