rea-agents 2.5.0 → 3.1.0

package/dist/application/BinarySessionRecords.js

@@ -1,24 +1,37 @@
 import { createEvidence } from "../domain/evidence.js";
-import { evidenceBundleForTarget } from "../domain/evidenceBundle.js";
-import { EvidenceIntegrityError, } from "../domain/errors.js";
+import { evidenceBundleForTarget, serializeEvidenceBundle, } from "../domain/evidenceBundle.js";
+import { EvidenceIntegrityError, EvidenceLimitError, } from "../domain/errors.js";
 import { parseInvestigationWorkspace, } from "../domain/investigationWorkspace.js";
 import { parseReconstructionCoverageWorkspace, } from "../domain/reconstructionCoverage.js";
-import { err } from "../domain/result.js";
+import { err, ok } from "../domain/result.js";
 import { AnalysisSnapshotCache } from "./AnalysisSnapshotCache.js";
 import { EvidenceLedger } from "./EvidenceLedger.js";
 import { UNKNOWN_REGISTRY_PROVIDER, unknownEvidenceLinks, unknownMutationEvidence, } from "./UnknownEvidence.js";
 /** Owns session evidence, snapshots, workspaces, and residual unknowns. */
 export class BinarySessionRecords {
+    static MAX_RETAINED_BUNDLES = 16;
+    static MAX_RETAINED_BUNDLE_BYTES = 64 * 1024 * 1024;
     #evidence = new EvidenceLedger({
         maxRecords: 10_000,
         maxBytes: 64 * 1024 * 1024,
     });
     #snapshot = new AnalysisSnapshotCache();
+    #retainedBundles = new Map();
+    #retainedBundleBytes = 0;
     #investigationWorkspaces = new Map();
     #coverageWorkspaces = new Map();
     #snapshotInvalidated = false;
+    #snapshotListeners = new Set();
+    /** Observe changes to the mutable current analysis snapshot resource. */
+    onAnalysisSnapshotChanged(listener) {
+        this.#snapshotListeners.add(listener);
+        return () => this.#snapshotListeners.delete(listener);
+    }
     recordEvidence(evidence) {
-        return this.#evidence.record(evidence);
+        const recorded = this.#evidence.record(evidence);
+        if (recorded.ok && recorded.value === "added")
+            this.#emitSnapshotChanged();
+        return recorded;
     }
     hasEvidence(evidenceId) {
         return this.#evidence.has(evidenceId);
@@ -29,8 +42,52 @@ export class BinarySessionRecords {
     exportEvidenceBundle() {
         return this.#evidence.export();
     }
+    snapshotEvidenceBundle() {
+        const bundle = this.#evidence.export();
+        const encoded = serializeEvidenceBundle(bundle);
+        const digest = createHash("sha256").update(encoded).digest("hex");
+        const existing = this.#retainedBundles.get(digest);
+        if (existing === undefined) {
+            if (this.#retainedBundles.size >= BinarySessionRecords.MAX_RETAINED_BUNDLES)
+                return err(new EvidenceLimitError("records", BinarySessionRecords.MAX_RETAINED_BUNDLES));
+            const bytes = Buffer.byteLength(encoded);
+            if (this.#retainedBundleBytes + bytes >
+                BinarySessionRecords.MAX_RETAINED_BUNDLE_BYTES)
+                return err(new EvidenceLimitError("bytes", BinarySessionRecords.MAX_RETAINED_BUNDLE_BYTES));
+            this.#retainedBundles.set(digest, encoded);
+            this.#retainedBundleBytes += bytes;
+        }
+        return ok({
+            bundleDigest: digest,
+            bundleVersion: 2,
+            bytes: Buffer.byteLength(existing ?? encoded),
+            records: bundle.records.length,
+            unknowns: bundle.unknowns.length,
+            scope: "session",
+            survivesSession: false,
+            uri: `rea://evidence-bundle/${digest}`,
+        });
+    }
+    retainedEvidenceBundle(digest) {
+        return this.#retainedBundles.get(digest);
+    }
+    /** Release one immutable bundle so bounded retention has an explicit recovery path. */
+    releaseEvidenceBundle(bundleDigest) {
+        const encoded = this.#retainedBundles.get(bundleDigest);
+        if (encoded === undefined)
+            return false;
+        this.#retainedBundles.delete(bundleDigest);
+        this.#retainedBundleBytes -= Buffer.byteLength(encoded);
+        this.#emitSnapshotChanged();
+        return true;
+    }
     importEvidenceBundle(bundle) {
-        return this.#evidence.import(bundle);
+        const imported = this.#evidence.import(bundle);
+        if (!imported.ok)
+            return imported;
+        if (imported.value.changed)
+            this.#emitSnapshotChanged();
+        return ok(imported.value.recordsAdded);
     }
     exportAnalysisSnapshot() {
         const active = this.activeAnalysisBinding();
@@ -48,36 +105,65 @@ export class BinarySessionRecords {
         const active = this.activeAnalysisBinding();
         if (active?.profile === null)
             return err(new EvidenceIntegrityError("Analysis snapshot profile_mismatch: the active target has no concrete analysis profile"));
-        return this.#snapshot.import(snapshot, active === undefined
+        const imported = this.#snapshot.import(snapshot, active === undefined
             ? undefined
-            : { target: active.target, profile: active.profile }, (bundle) => this.#evidence.import(bundle));
+            : { target: active.target, profile: active.profile }, (bundle) => {
+            const imported = this.#evidence.import(bundle);
+            return imported.ok ? ok(imported.value.recordsAdded) : imported;
+        });
+        if (imported.ok)
+            this.#emitSnapshotChanged();
+        return imported;
     }
     matchesSnapshot(target, profile) {
         return this.#snapshot.matches(target, profile ?? undefined);
     }
     selectSnapshot(target, profile) {
         this.#snapshot.select(target, profile);
+        this.#emitSnapshotChanged();
     }
     lookupSnapshot(target, profile, operation, parameters) {
         return this.#snapshot.lookup(target, profile, operation, parameters);
     }
     recordSnapshot(input) {
         this.#snapshot.record(input);
+        this.#emitSnapshotChanged();
     }
     invalidateSnapshot() {
         this.#snapshot.clear();
         this.#snapshotInvalidated = true;
+        this.#emitSnapshotChanged();
     }
     resetSnapshotInvalidation() {
+        if (!this.#snapshotInvalidated)
+            return;
         this.#snapshotInvalidated = false;
+        this.#emitSnapshotChanged();
     }
     clearSnapshot() {
         this.#snapshot.clear();
+        this.#emitSnapshotChanged();
     }
     clearSessionRecords() {
         this.#evidence.clear();
         this.#snapshot.clear();
         this.#snapshotInvalidated = false;
+        this.#retainedBundles.clear();
+        this.#retainedBundleBytes = 0;
+        this.#emitSnapshotChanged();
+    }
+    #emitSnapshotChanged() {
+        for (const listener of this.#snapshotListeners) {
+            try {
+                const notification = listener();
+                if (notification !== undefined)
+                    void notification.catch(() => undefined);
+            }
+            catch {
+                // External resource observers are best-effort; one callback must not
+                // make a committed evidence mutation appear to fail.
+            }
+        }
     }
     retainInvestigationWorkspace(workspace) {
         const parsed = parseInvestigationWorkspace(workspace);
@@ -111,10 +197,16 @@ export class BinarySessionRecords {
     }
     recordUnknown(input) {
         const target = this.activeAnalysisBinding()?.target;
-        return this.#evidence.recordUnknown(input, unknownMutationEvidence(target, input));
+        const recorded = this.#evidence.recordUnknown(input, unknownMutationEvidence(target, input));
+        if (recorded.ok)
+            this.#emitSnapshotChanged();
+        return recorded;
     }
     recordEvidenceWithUnknown(evidence, input) {
-        return this.#evidence.recordWithUnknown(evidence, input, unknownMutationEvidence(undefined, input));
+        const recorded = this.#evidence.recordWithUnknown(evidence, input, unknownMutationEvidence(undefined, input));
+        if (recorded.ok)
+            this.#emitSnapshotChanged();
+        return recorded;
     }
     updateUnknown(input) {
         const target = this.activeAnalysisBinding()?.target;
@@ -133,7 +225,10 @@ export class BinarySessionRecords {
                 "Registry mutation evidence records analyst intent, not proof of the answer.",
             ],
         });
-        return this.#evidence.updateUnknown(input, evidence);
+        const updated = this.#evidence.updateUnknown(input, evidence);
+        if (updated.ok)
+            this.#emitSnapshotChanged();
+        return updated;
     }
     listUnknowns(filters = {}) {
         return this.#evidence.listUnknowns(filters);
@@ -147,3 +242,4 @@ const sortedWorkspaces = (workspaces) => [...workspaces]
     .sort((left, right) => left.workspace_id.localeCompare(right.workspace_id) ||
     left.revision - right.revision)
     .map((workspace) => structuredClone(workspace));
+import { createHash } from "node:crypto";

package/dist/application/BinarySessionStatus.js

@@ -1,14 +1,20 @@
 /** Project internal provider routing state into the caller-visible session status. */
-export const binarySessionStatus = ({ target, route, router, runtimeAvailability, runId, runtimeLineageSnapshots, requestActivitySnapshots, }) => {
+export const binarySessionStatus = ({ target, route, router, runtimeUnavailability, runId, runtimeLineageSnapshots, requestActivitySnapshots, }) => {
     const configuredProvider = router.configuredIdentity();
     const provider = providerSummary(configuredProvider);
     const providers = router.providerIdentities(route).map(providerSummary);
     const capabilities = [...(route.capabilities?.values() ?? [])]
         .sort((left, right) => left.operation.localeCompare(right.operation))
-        .map((descriptor) => ({
-        ...descriptor,
-        ...runtimeAvailability.get(descriptor.operation),
-    }))
+        .map((descriptor) => {
+        const unavailable = runtimeUnavailability.get(descriptor.operation);
+        return unavailable === undefined
+            ? descriptor
+            : {
+                ...descriptor,
+                available: false,
+                reason: unavailable.reason,
+            };
+    })
         .map(capabilityStatus);
     const analysisProviderBinding = route.binding === null
         ? null

package/dist/application/BrowserEvidence.js

@@ -21,9 +21,7 @@ export const createBrowserEvidence = (operation, input, result, provider) => cre
 });
 const browserParameters = (input) => {
     if (!("cdp_endpoint" in input)) {
-        if ("before_scenario" in input &&
-            input.before_scenario !== undefined &&
-            input.after_scenario !== undefined)
+        if ("before_scenario" in input)
             return {
                 comparison_kind: "browser_scenario",
                 before_browser: input.before_scenario.browser,
@@ -89,9 +87,9 @@ const browserParameters = (input) => {
         include_storage_keys: input.include_storage_keys,
         include_storage_fingerprints: input.include_storage_fingerprints,
         limits: input.limits,
-        ...(input.include_script_sources && "source_capture_approved" in input
+        source_capture_approved: input.source_capture_approved,
+        ...(input.include_script_sources && "analysis_limits" in input
             ? {
-                source_capture_approved: input.source_capture_approved,
                 fetch_source_maps: input.fetch_source_maps,
                 source_map_fetch_approved: input.source_map_fetch_approved,
                 analysis_limits: input.analysis_limits,

package/dist/application/CapabilityClientRequirements.js

@@ -0,0 +1,26 @@
+/** Empty MCP client feature declaration used when the caller supplies none. */
+export const NO_CLIENT_FEATURES = {
+    elicitation_form: false,
+    elicitation_url: false,
+    roots: false,
+    sampling: false,
+};
+const CLIENT_FEATURE_REQUIREMENTS = {
+    capture_process_scenario: {
+        required: [],
+        optional: ["elicitation_form"],
+    },
+};
+/** Project a tool's client requirements against the negotiated feature set. */
+export const clientRequirementsFor = (name, clientFeatures) => {
+    const requirements = CLIENT_FEATURE_REQUIREMENTS[name] ?? {
+        required: [],
+        optional: [],
+    };
+    return {
+        required: [...requirements.required],
+        optional: [...requirements.optional],
+        missing_required: requirements.required.filter((feature) => !clientFeatures[feature]),
+        missing_optional: requirements.optional.filter((feature) => !clientFeatures[feature]),
+    };
+};

package/dist/application/CapabilityInventory.js

@@ -1,28 +1,13 @@
 import { z } from "zod";
-import { TOOL_CONTRACTS } from "../contracts/toolContracts.js";
+import { providerCapability, } from "../contracts/toolOutputSchemaPrimitives.js";
+import { GENERATED_MCP_TOOL_CATALOG } from "../generatedMcpToolCatalog.js";
+import { clientRequirementsFor, NO_CLIENT_FEATURES, } from "./CapabilityClientRequirements.js";
 const statusSchema = z.object({
     open: z.boolean(),
     kind: z.enum(["executable", "database", "archive", "artifact"]).optional(),
     format: z.string().optional(),
-    capabilities: z.array(z.object({
-        operation: z.string(),
-        available: z.boolean(),
-        reason: z.string().nullable(),
-        availability_code: z.string().nullable().optional(),
-    })),
+    capabilities: z.array(providerCapability),
 });
-const NO_CLIENT_FEATURES = {
-    elicitation_form: false,
-    elicitation_url: false,
-    roots: false,
-    sampling: false,
-};
-const CLIENT_FEATURE_REQUIREMENTS = {
-    capture_process_scenario: {
-        required: [],
-        optional: ["elicitation_form"],
-    },
-};
 const ENHANCED_REQUIREMENTS = {
     swift_classes: ["list_procedures"],
     get_objc_classes: ["list_names"],
@@ -38,6 +23,7 @@ const ENHANCED_REQUIREMENTS = {
         "list_strings",
     ],
     analyze_function: ["analyze_function"],
+    inspect_native_api: ["analyze_function"],
     trace_feature: [
         "list_strings",
         "list_procedures",
@@ -45,18 +31,25 @@ const ENHANCED_REQUIREMENTS = {
         "resolve_containing_procedure",
     ],
 };
+const NAVIGATION_CONTEXT_MODES = [
+    {
+        name: "current_selection",
+        requirements: [
+            "current_document",
+            "current_address",
+            "resolve_containing_procedure",
+        ],
+    },
+    {
+        name: "explicit_document",
+        requirements: ["current_address", "resolve_containing_procedure"],
+    },
+];
 /** Build stable per-operation availability for discovery and tool visibility. */
 export const buildCapabilityInventory = (sessionStatus, policy, clientFeatures = NO_CLIENT_FEATURES) => {
     const status = statusSchema.parse(sessionStatus);
-    const descriptors = new Map(status.capabilities.map((descriptor) => [
-        descriptor.operation,
-        {
-            available: descriptor.available,
-            reason: descriptor.reason,
-            availability_code: descriptor.availability_code ?? null,
-        },
-    ]));
-    return TOOL_CONTRACTS.map((contract) => {
+    const descriptors = new Map(status.capabilities.map((descriptor) => [descriptor.operation, descriptor]));
+    return GENERATED_MCP_TOOL_CATALOG.map((contract) => {
         const availability = availabilityFor({
             name: contract.name,
             kind: contract.kind,
@@ -67,16 +60,15 @@ export const buildCapabilityInventory = (sessionStatus, policy, clientFeatures =
         });
         const clientRequirements = clientRequirementsFor(contract.name, clientFeatures);
         const clientBlocked = clientRequirements.missing_required.length > 0;
-        return {
+        const facts = {
             name: contract.name,
             surface: contract.kind,
-            available: availability.reason === "available" && !clientBlocked,
-            reason: clientBlocked
-                ? "client_capability_missing"
-                : availability.reason,
-            remediation: clientBlocked
-                ? `Use an MCP client that supports: ${clientRequirements.missing_required.join(", ")}.`
-                : availability.remediation,
+            ...(availability.defaultModeAvailable === undefined
+                ? {}
+                : { default_mode_available: availability.defaultModeAvailable }),
+            ...(availability.modes === undefined
+                ? {}
+                : { modes: [...availability.modes] }),
             client_requirements: clientRequirements,
             effects: { ...contract.effects },
             annotations: {
@@ -86,21 +78,31 @@ export const buildCapabilityInventory = (sessionStatus, policy, clientFeatures =
                 open_world: contract.annotations.openWorldHint ?? true,
             },
         };
+        if (clientBlocked)
+            return {
+                ...facts,
+                available: false,
+                reason: "client_capability_missing",
+                remediation: `Use an MCP client that supports: ${clientRequirements.missing_required.join(", ")}.`,
+            };
+        return availability.reason === "available"
+            ? {
+                ...facts,
+                available: true,
+                reason: availability.reason,
+                remediation: null,
+            }
+            : {
+                ...facts,
+                available: false,
+                reason: availability.reason,
+                remediation: availability.remediation,
+            };
     }).sort((left, right) => left.name.localeCompare(right.name));
 };
-const clientRequirementsFor = (name, clientFeatures) => {
-    const requirements = CLIENT_FEATURE_REQUIREMENTS[name] ?? {
-        required: [],
-        optional: [],
-    };
-    return {
-        required: [...requirements.required],
-        optional: [...requirements.optional],
-        missing_required: requirements.required.filter((feature) => !clientFeatures[feature]),
-        missing_optional: requirements.optional.filter((feature) => !clientFeatures[feature]),
-    };
-};
 const availabilityFor = (context) => {
+    if (context.name === "get_navigation_context")
+        return navigationContextAvailability(context.descriptors);
     const javascriptApplication = javascriptApplicationAvailability(context);
     if (javascriptApplication !== null)
         return javascriptApplication;
@@ -155,13 +157,9 @@ const policyAvailability = ({ name, kind, policy, }) => {
             reason: "policy_disabled",
             remediation: "Configure or grant an evidence_read root.",
         };
-    if (kind === "electron-provider")
-        return policy.electronObservationEnabled === true
-            ? { reason: "available", remediation: null }
-            : {
-                reason: "policy_disabled",
-                remediation: "Enable Electron observation and configure a loopback CDP endpoint and canonical file roots.",
-            };
+    const electron = electronPolicyAvailability(name, kind, policy);
+    if (electron !== null)
+        return electron;
     if (kind === "runtime-provider")
         return policy.v8InspectorObservationEnabled === true
             ? { reason: "available", remediation: null }
@@ -173,6 +171,23 @@ const policyAvailability = ({ name, kind, policy, }) => {
         return { reason: "available", remediation: null };
     return null;
 };
+const electronPolicyAvailability = (name, kind, policy) => {
+    if (kind !== "electron-provider")
+        return null;
+    if (name === "capture_electron_scenario")
+        return policy.electronAutomationEnabled === true
+            ? { reason: "available", remediation: null }
+            : {
+                reason: "policy_disabled",
+                remediation: "Enable active Electron automation and configure exact executable and application roots.",
+            };
+    return policy.electronObservationEnabled === true
+        ? { reason: "available", remediation: null }
+        : {
+            reason: "policy_disabled",
+            remediation: "Enable Electron observation and configure a loopback CDP endpoint and canonical file roots.",
+        };
+};
 const browserPolicyAvailability = (name, kind, policy) => {
     if (name === "capture_browser_scenario")
         return policy.browserScenarioEnabled === true
@@ -240,6 +255,9 @@ const composedAvailability = (name, descriptors) => {
             reason: "provider_missing",
             remediation: "No provider composition is declared for this operation.",
         };
+    return composedAvailabilityFor(requirements, descriptors);
+};
+const composedAvailabilityFor = (requirements, descriptors) => {
     const missing = requirements.find((operation) => !descriptors.has(operation));
     if (missing !== undefined)
         return {
@@ -258,3 +276,70 @@ const composedAvailability = (name, descriptors) => {
         };
     return { reason: "available", remediation: null };
 };
+const navigationContextAvailability = (descriptors) => {
+    const modeResults = NAVIGATION_CONTEXT_MODES.map((mode) => {
+        const availability = composedAvailabilityFor(mode.requirements, descriptors);
+        if (availability.reason === "available")
+            return {
+                name: mode.name,
+                available: true,
+                reason: availability.reason,
+                missing_operations: [],
+                remediation: null,
+            };
+        return {
+            name: mode.name,
+            available: false,
+            reason: availability.reason,
+            missing_operations: mode.requirements.filter((operation) => {
+                const descriptor = descriptors.get(operation);
+                return descriptor === undefined || descriptor.available === false;
+            }),
+            remediation: availability.remediation,
+        };
+    });
+    const modes = modeResults.map((mode) => mode.available
+        ? {
+            name: mode.name,
+            available: true,
+            missing_operations: [],
+            remediation: null,
+        }
+        : {
+            name: mode.name,
+            available: false,
+            missing_operations: [...mode.missing_operations],
+            remediation: mode.remediation,
+        });
+    const availableMode = modeResults.find((mode) => mode.available);
+    const failures = modeResults.flatMap((mode) => mode.available ? [] : [mode]);
+    const failure = failures.sort((left, right) => navigationFailurePriority(left.reason) -
+        navigationFailurePriority(right.reason))[0];
+    const specificFailureRemediation = failure?.reason === "provider_missing" ? undefined : failure?.remediation;
+    const facts = {
+        defaultModeAvailable: modes[0]?.available ?? false,
+        modes,
+    };
+    if (availableMode !== undefined)
+        return { ...facts, reason: "available", remediation: null };
+    return {
+        ...facts,
+        reason: failure?.reason ?? "provider_missing",
+        remediation: specificFailureRemediation ??
+            `Configure a provider for one of: ${modes
+                .flatMap((mode) => mode.missing_operations)
+                .join(", ")}.`,
+    };
+};
+const navigationFailurePriority = (reason) => {
+    switch (reason) {
+        case "unsupported_host":
+            return 0;
+        case "provider_unavailable":
+            return 1;
+        case "provider_missing":
+            return 2;
+        default:
+            return 3;
+    }
+};

package/dist/application/ClientRegistrationStatus.js

@@ -3,6 +3,7 @@ import { resolve } from "node:path";
 import { parse as parseToml } from "smol-toml";
 import { z } from "zod";
 import { PRODUCT_IDENTITY } from "../identity.js";
+import { MCP_STARTUP_POLICY } from "../mcpStartupPolicy.js";
 import { supportedClients } from "./SupportedClients.js";
 const objectSchema = z.record(z.string(), z.unknown());
 const registrationSchema = z
@@ -41,7 +42,9 @@ export const readClientRegistrationStatuses = async (home, currentCommandPath =
 };
 const registrationAligned = (registration, client, currentCommandPath) => {
     const command = [registration.command, ...registration.args];
-    if (client === "codex" && registration.startup_timeout_sec !== 30)
+    if (client === "codex" &&
+        registration.startup_timeout_sec !==
+            MCP_STARTUP_POLICY.codexStartupTimeoutSeconds)
         return false;
     if (command.length === 4 &&
         command[0] === "npx" &&

package/dist/application/CrossVersionInventory.js

@@ -6,6 +6,7 @@ import { err, ok } from "../domain/result.js";
 import { paginateArtifactInventory, } from "./ArtifactInventory.js";
 import { scanAuthorizedArtifactInventory } from "./AuthorizedArtifactInventory.js";
 import { ARTIFACT_GRAPH_PROVIDER } from "./InvestigationProviders.js";
+import { resolveArtifactIntegrityPolicy } from "./ArtifactInventory/policy.js";
 export const AUTOMATIC_RUN_LIMITATION = "Automatic cross-version runs compare shipped artifact structure only; they do not execute either version.";
 /** Start both independent version scans while preserving left/right identity. */
 export const scanVersionInventories = async (options, scanner = scanAuthorizedArtifactInventory) => {
@@ -27,12 +28,12 @@ export const scanVersions = async (input, inputRoots, signal, integrityContinueE
         if (signal?.aborted === true)
             return err(new AnalysisCancelledError("find_changed_behavior"));
         const limits = artifactLimits(input.options);
-        const integrity = {
-            mode: input.integrity_policy,
-            approved: input.integrity_continue_approved,
-            enabled: integrityContinueEnabled,
-            maxMismatches: input.max_integrity_mismatches,
-        };
+        const integrity = resolveArtifactIntegrityPolicy(input.integrity_policy === "fail"
+            ? { mode: "fail" }
+            : {
+                mode: input.integrity_policy,
+                maxMismatches: input.max_integrity_mismatches,
+            }, integrityContinueEnabled);
         return ok(await scanVersionInventories({
             leftPath: input.left_path,
             rightPath: input.right_path,

package/dist/application/DirectAnalysis.js

@@ -182,6 +182,7 @@ const executeAnalysisTool = async (input) => {
     const { session, tool, signal, evidenceProfile } = input;
     if (tool === "binary_overview" ||
         tool === "analyze_function" ||
+        tool === "inspect_native_api" ||
         tool === "trace_feature") {
         const result = await new EnhancedTools(session).execute(tool, input.arguments, signal);
         if (!result.ok)
@@ -247,15 +248,18 @@ const prepareSnapshot = async (options) => {
         return err(new EvidenceIntegrityError("Analysis snapshot target does not match the requested binary"));
     return ok({ snapshot: loaded.value });
 };
-const replayProviderFor = (session, tool) => tool === "binary_overview" || tool === "trace_feature"
+const replayProviderFor = (session, tool) => isWorkflowEvidenceTool(tool)
     ? REA_WORKFLOW_PROVIDER
     : session.providerIdentity(tool);
 const analysisProfileForEvidence = (session, tool) => {
-    if (tool !== "binary_overview" && tool !== "trace_feature")
+    if (!isWorkflowEvidenceTool(tool))
         return session.analysisProfile(tool);
     const upstream = session.analysisProfile();
     return upstream === undefined ? undefined : workflowAnalysisProfile(upstream);
 };
+const isWorkflowEvidenceTool = (tool) => tool === "binary_overview" ||
+    tool === "inspect_native_api" ||
+    tool === "trace_feature";
 const fileExists = async (path) => {
     try {
         await access(path);

package/dist/application/ElectronActiveEvidence.js

@@ -0,0 +1,55 @@
+import { createEvidence } from "../domain/evidence.js";
+import { jsonValueSchema } from "../domain/jsonValue.js";
+import { digestJson } from "./JavaScriptReplayPlanning.js";
+/** Create Evidence v2 without retaining arbitrary runtime argument values. */
+export const createElectronActiveEvidence = (input, result, provider) => createEvidence(undefined, provider, {
+    predicateType: "rea.electron-active-scenario/v1",
+    operation: "capture_electron_scenario",
+    parameters: parameters(input),
+    result: jsonValueSchema.parse(result),
+    confidence: "observed",
+    authority: "controlled-replay",
+    environment: {
+        id: `${result.application.electron_version}@${process.platform}`,
+        platform: process.platform,
+        architecture: process.arch,
+        isolation: "none",
+    },
+    limitations: result.limitations,
+});
+const scenarioProjection = (input) => ({
+    approved: input.approved,
+    schema_version: input.schema_version,
+    executable_path: input.executable_path,
+    application_path: input.application_path,
+    application_root: input.application_root,
+    args: redactArguments(input.args),
+    actions: input.actions.map(({ step_id, kind }) => ({ step_id, kind })),
+    limits: input.limits,
+});
+const parameters = (input) => ({
+    ...scenarioProjection(input),
+    scenario_sha256: digestJson(scenarioProjection(input)),
+});
+const redactArguments = (arguments_) => {
+    let redactNext = false;
+    return arguments_.map((argument) => {
+        if (redactNext) {
+            redactNext = false;
+            return "<redacted>";
+        }
+        if (sensitiveFlag.test(argument)) {
+            redactNext = true;
+            return argument;
+        }
+        return redactArgument(argument);
+    });
+};
+const sensitiveFlag = /^--?(?:password|token|secret|api[-_]?key|authorization|cookie)$/iu;
+const redactArgument = (argument) => {
+    if (/^--?(?:password|token|secret|api[-_]?key|authorization|cookie)=/iu.test(argument))
+        return `${argument.slice(0, argument.indexOf("=") + 1)}<redacted>`;
+    return argument.length > 256
+        ? `${argument.slice(0, 256)}<redacted>`
+        : argument;
+};

package/dist/application/ElectronActiveObservationPort.js

@@ -0,0 +1 @@
+export {};