rea-agents 2.5.0 → 3.1.0

package/dist/application/ElectronActiveObservationService.js

@@ -0,0 +1,81 @@
+import { realpath } from "node:fs/promises";
+import { digestJson } from "./JavaScriptReplayPlanning.js";
+import { AnalysisCapabilityUnavailableError, AnalysisInputError, AnalysisProtocolError, PermissionRequiredError, } from "../domain/errors.js";
+import { isPathContained } from "../domain/permissionPolicy.js";
+import { err } from "../domain/result.js";
+import { createElectronActiveEvidence } from "./ElectronActiveEvidence.js";
+const OPERATION = "capture_electron_scenario";
+const PROVIDER_ID = "rea-playwright-electron-active";
+const canonicalizeInput = async (input) => {
+    try {
+        const [executablePath, applicationPath, applicationRoot] = await Promise.all([
+            realpath(input.executable_path),
+            realpath(input.application_path),
+            realpath(input.application_root),
+        ]);
+        if (!isPathContained(applicationRoot, applicationPath))
+            return err(new AnalysisInputError(OPERATION, undefined, [
+                {
+                    path: ["application_path"],
+                    reason: "invalid_value",
+                    message: "application_path must remain beneath application_root after symlink resolution",
+                },
+            ]));
+        return {
+            ok: true,
+            value: {
+                ...input,
+                executable_path: executablePath,
+                application_path: applicationPath,
+                application_root: applicationRoot,
+            },
+        };
+    }
+    catch (cause) {
+        return err(new AnalysisInputError(OPERATION, { cause }, [
+            {
+                path: ["application_path"],
+                reason: "invalid_format",
+                message: "Electron executable, application, and root must resolve to existing paths",
+            },
+        ]));
+    }
+};
+const authorize = async (authority, input) => {
+    const canonical = await canonicalizeInput(input);
+    if (!canonical.ok)
+        return canonical;
+    if (authority === undefined)
+        return err(new AnalysisCapabilityUnavailableError(PROVIDER_ID, OPERATION, "active Electron observation permission policy is not configured"));
+    const authorized = await authority.authorize({
+        capability: "electron_automate",
+        roots: [canonical.value.application_root],
+        executables: [canonical.value.executable_path],
+        environment_names: [],
+        network: "external",
+        mount: false,
+        operation_identity: `${OPERATION}:${digestJson(canonical.value)}`,
+    }, "write");
+    if (!authorized.ok)
+        return err(authorized.error instanceof PermissionRequiredError
+            ? authorized.error
+            : new AnalysisProtocolError(authorized.error.message, {
+                cause: authorized.error,
+            }));
+    return canonical;
+};
+/** Authorize and execute one bounded, provider-owned Electron experiment. */
+export const captureElectronScenario = async (provider, authority, input, options = {}) => {
+    const authorized = await authorize(authority, input);
+    if (!authorized.ok)
+        return authorized;
+    if (provider === undefined)
+        return err(new AnalysisCapabilityUnavailableError(PROVIDER_ID, OPERATION, "active Electron observation provider is not configured"));
+    const captured = await provider.capture(authorized.value, options);
+    return captured.ok
+        ? {
+            ok: true,
+            value: createElectronActiveEvidence(authorized.value, captured.value, provider.identity()),
+        }
+        : captured;
+};

package/dist/application/EnhancedTools.js

@@ -1,12 +1,14 @@
 import { enhancedInputSchemas } from "../contracts/enhancedInputs.js";
 import { AnalysisCancelledError, AnalysisOutputError, projectAnalysisError, } from "../domain/errors.js";
-import { addressDistance, parseDocuments, parseFunctionDossier, parseListCount, parseRelatedAddresses, parseSegments, } from "../domain/hopperValues.js";
+import { addressDistance, functionDossierSchema, parseDocuments, parseFunctionDossier, parseListCount, parseRelatedAddresses, parseSegments, } from "../domain/hopperValues.js";
 import { err, ok } from "../domain/result.js";
 import { categorizeSwiftTypes, discoverObjcClasses, discoverObjcProtocols, discoverSwiftClasses, } from "../domain/symbolAnalysis.js";
+import { jsonValueSchema } from "../domain/jsonValue.js";
 import { invalidEnhancedInput, } from "./EnhancedToolTypes.js";
 import { readAllAddressed } from "./EnhancedToolPagination.js";
 import { traceCallPath } from "./CallPathTracing.js";
 import { traceLiteralFeature } from "./EnhancedLiteralTracing.js";
+import { projectNativeApiInspection } from "./NativeApiInspection.js";
 /**
  * Composes direct provider operations into bounded reverse-engineering tools.
  * Direct callers use `execute`; adapters that own validation use
@@ -23,6 +25,8 @@ export class EnhancedTools {
             name === "find_code_for_string" ||
             name === "trace_call_path")
             return this.#executeTracing(name, input, signal);
+        if (name === "analyze_function" || name === "inspect_native_api")
+            return this.#executeFunctionAnalysis(name, input, signal);
         switch (name) {
             case "swift_classes": {
                 const parsed = enhancedInputSchemas.swift_classes.safeParse(input);
@@ -64,12 +68,6 @@ export class EnhancedTools {
                     ? this.executeValidated({ name, input: parsed.data }, signal)
                     : invalidEnhancedInput(name, parsed.error);
             }
-            case "analyze_function": {
-                const parsed = enhancedInputSchemas.analyze_function.safeParse(input);
-                return parsed.success
-                    ? this.executeValidated({ name, input: parsed.data }, signal)
-                    : invalidEnhancedInput(name, parsed.error);
-            }
         }
     }
     /** Dispatch input already parsed by a trusted adapter boundary. */
@@ -93,6 +91,8 @@ export class EnhancedTools {
                 return this.#binaryOverview(call.input, signal);
             case "analyze_function":
                 return this.#analyzeFunction(call.input, signal);
+            case "inspect_native_api":
+                return this.#inspectNativeApi(call.input, signal);
             case "trace_feature":
                 return traceLiteralFeature((name, arguments_, operationSignal) => this.#call(name, arguments_, operationSignal), call.input, "feature", signal);
             case "find_code_for_string":
@@ -102,23 +102,55 @@ export class EnhancedTools {
         }
     }
     #executeTracing(name, input, signal) {
-        const parsed = enhancedInputSchemas[name].safeParse(input);
+        if (name === "trace_call_path") {
+            const parsed = enhancedInputSchemas.trace_call_path.safeParse(input);
+            if (!parsed.success)
+                return invalidEnhancedInput(name, parsed.error);
+            return this.executeValidated({ name, input: parsed.data }, signal);
+        }
+        if (name === "trace_feature") {
+            const parsed = enhancedInputSchemas.trace_feature.safeParse(input);
+            if (!parsed.success)
+                return invalidEnhancedInput(name, parsed.error);
+            return this.executeValidated({ name, input: parsed.data }, signal);
+        }
+        const parsed = enhancedInputSchemas.find_code_for_string.safeParse(input);
         if (!parsed.success)
             return invalidEnhancedInput(name, parsed.error);
-        if (name === "trace_call_path")
-            return this.executeValidated({
-                name,
-                input: enhancedInputSchemas.trace_call_path.parse(parsed.data),
-            }, signal);
-        return this.executeValidated({
-            name,
-            input: enhancedInputSchemas[name].parse(parsed.data),
-        }, signal);
+        return this.executeValidated({ name, input: parsed.data }, signal);
+    }
+    #executeFunctionAnalysis(name, input, signal) {
+        if (name === "analyze_function") {
+            const parsed = enhancedInputSchemas.analyze_function.safeParse(input);
+            if (!parsed.success)
+                return invalidEnhancedInput(name, parsed.error);
+            return this.executeValidated({ name, input: parsed.data }, signal);
+        }
+        const parsed = enhancedInputSchemas.inspect_native_api.safeParse(input);
+        if (!parsed.success)
+            return invalidEnhancedInput(name, parsed.error);
+        return this.executeValidated({ name, input: parsed.data }, signal);
     }
     async #analyzeFunction(input, signal) {
         const result = await this.#call("analyze_function", input, signal);
         return result.ok ? parseFunctionDossier(result.value) : result;
     }
+    async #inspectNativeApi(input, signal) {
+        const analysisInput = enhancedInputSchemas.analyze_function.parse({
+            procedure: input.procedure,
+            include_assembly: true,
+            max_pseudocode_chars: input.max_pseudocode_chars,
+            max_instructions: input.max_instructions,
+        });
+        const result = await this.#call("analyze_function", analysisInput, signal);
+        if (!result.ok)
+            return result;
+        const parsed = parseFunctionDossier(result.value);
+        if (!parsed.ok)
+            return parsed;
+        const dossier = functionDossierSchema.parse(parsed.value);
+        return ok(jsonValueSchema.parse(projectNativeApiInspection(dossier)));
+    }
     async #swiftClasses(pattern, signal) {
         const procedures = await this.#allAddressed("list_procedures", signal);
         return procedures.ok

package/dist/application/EvidenceBundleCommands.js

@@ -12,7 +12,11 @@ export const importEvidenceBundleCommand = async (path, policy) => {
     const ledger = createLedger();
     const imported = ledger.import(loaded.value);
     return imported.ok
-        ? ok({ imported: imported.value, total: ledger.export().records.length })
+        ? ok({
+            imported: imported.value.recordsAdded,
+            unknowns_added: imported.value.unknownsAdded,
+            total: ledger.export().records.length,
+        })
         : imported;
 };
 /** Validate a source bundle and atomically export canonical bytes. */

package/dist/application/EvidenceLedger.js

@@ -1,5 +1,5 @@
 import canonicalize from "canonicalize";
-import { createEvidenceBundle, parseEvidenceBundle, } from "../domain/evidenceBundle.js";
+import { createEvidenceBundle, parseEvidenceBundle, validateResidualUnknownAddition, } from "../domain/evidenceBundle.js";
 import { EvidenceIntegrityError, EvidenceLimitError, UnknownRegistryError, } from "../domain/errors.js";
 import { parseEvidence } from "../domain/evidence.js";
 import { createResidualUnknown, updateResidualUnknown, } from "../domain/residualUnknown.js";
@@ -63,6 +63,7 @@ export class EvidenceLedger {
             pending.set(evidence.evidence_id, evidence);
         }
         const pendingUnknowns = new Map(this.#unknownRevisions);
+        let unknownsAdded = 0;
         for (const unknown of bundle.unknowns) {
             const key = unknownRevisionKey(unknown);
             const existing = pendingUnknowns.get(key);
@@ -70,6 +71,8 @@ export class EvidenceLedger {
                 existing.revision_digest !== unknown.revision_digest)
                 return err(new EvidenceIntegrityError("Conflicting unknown revision"));
             pendingUnknowns.set(key, unknown);
+            if (existing === undefined)
+                unknownsAdded += 1;
         }
         const checked = this.#validateCandidate(pending, pendingUnknowns);
         if (!checked.ok) {
@@ -81,7 +84,11 @@ export class EvidenceLedger {
         }
         const added = pending.size - this.#records.size;
         this.#commit(pending, pendingUnknowns, checked.value);
-        return ok(added);
+        return ok({
+            recordsAdded: added,
+            unknownsAdded,
+            changed: added > 0 || unknownsAdded > 0,
+        });
     }
     /** Export records in deterministic, semantically irrelevant ID order. */
     export() {
@@ -142,26 +149,19 @@ export class EvidenceLedger {
         catch (cause) {
             return err(new UnknownRegistryError("invalid-transition", { cause }));
         }
-        const pendingRecords = new Map(this.#records);
-        pendingRecords.set(evidence.evidence_id, evidence);
         const existingUnknown = this.#unknownHeads.get(unknown.unknown_id);
         if (existingUnknown !== undefined) {
             if (existingUnknown.revision !== 1 ||
                 existingUnknown.revision_digest !== unknown.revision_digest)
                 return err(new UnknownRegistryError("already-exists"));
-            const checked = this.#validateCandidate(pendingRecords, this.#unknownRevisions);
+            const checked = this.#appendIncremental([evidence]);
             if (!checked.ok)
                 return checked;
-            this.#commit(pendingRecords, this.#unknownRevisions, checked.value);
             return ok(null);
         }
-        pendingRecords.set(mutation.evidence_id, mutation);
-        const pendingUnknowns = new Map(this.#unknownRevisions);
-        pendingUnknowns.set(unknownRevisionKey(unknown), unknown);
-        const checked = this.#validateCandidate(pendingRecords, pendingUnknowns);
+        const checked = this.#appendIncremental([evidence, mutation], unknown);
         if (!checked.ok)
             return checked;
-        this.#commit(pendingRecords, pendingUnknowns, checked.value);
         return ok(structuredClone(unknown));
     }
     /** Apply one approved full-state update using optimistic revision matching. */
@@ -218,16 +218,52 @@ export class EvidenceLedger {
                 cause,
             }));
         }
-        const pendingRecords = new Map(this.#records);
-        pendingRecords.set(mutationEvidence.evidence_id, mutationEvidence);
-        const pendingUnknowns = new Map(this.#unknownRevisions);
-        pendingUnknowns.set(unknownRevisionKey(unknown), unknown);
-        const checked = this.#validateCandidate(pendingRecords, pendingUnknowns);
+        const checked = this.#appendIncremental([mutationEvidence], unknown);
         if (!checked.ok)
             return checked;
-        this.#commit(pendingRecords, pendingUnknowns, checked.value);
         return ok(structuredClone(unknown));
     }
+    #appendIncremental(records, unknown) {
+        const additions = new Map();
+        let addedBytes = 0;
+        for (const evidence of records) {
+            const existing = additions.get(evidence.evidence_id) ??
+                this.#records.get(evidence.evidence_id);
+            if (existing !== undefined) {
+                if (!recordsAgree(existing, evidence))
+                    return err(new EvidenceIntegrityError("Conflicting evidence record"));
+                continue;
+            }
+            additions.set(evidence.evidence_id, evidence);
+            addedBytes += serializedBytes(evidence);
+        }
+        const unknownKey = unknown === undefined ? undefined : unknownRevisionKey(unknown);
+        if (unknownKey !== undefined && this.#unknownRevisions.has(unknownKey))
+            return err(new UnknownRegistryError("integrity"));
+        const unknownBytes = unknown === undefined ? 0 : serializedBytes(unknown);
+        if (this.#exceedsRecordLimit(this.#records.size + additions.size, this.#unknownRevisions.size + (unknown === undefined ? 0 : 1)))
+            return err(new EvidenceLimitError("records", this.limits.maxRecords));
+        if (this.#bytes + addedBytes + unknownBytes > this.limits.maxBytes)
+            return err(new EvidenceLimitError("bytes", this.limits.maxBytes));
+        if (unknown !== undefined)
+            try {
+                validateResidualUnknownAddition(unknown, {
+                    get: (id) => additions.get(id) ?? this.#records.get(id),
+                    has: (id) => additions.has(id) || this.#records.has(id),
+                }, this.#unknownHeads);
+            }
+            catch (cause) {
+                return err(new UnknownRegistryError("integrity", { cause }));
+            }
+        for (const [id, evidence] of additions)
+            this.#records.set(id, evidence);
+        if (unknown !== undefined && unknownKey !== undefined) {
+            this.#unknownRevisions.set(unknownKey, unknown);
+            this.#unknownHeads.set(unknown.unknown_id, unknown);
+        }
+        this.#bytes += addedBytes + unknownBytes;
+        return ok(undefined);
+    }
     #validateCandidate(records, unknowns) {
         if (this.#exceedsRecordLimit(records.size, unknowns.size))
             return err(new EvidenceLimitError("records", this.limits.maxRecords));

package/dist/application/JavaScriptArtifactAnalysis.js

@@ -1,7 +1,9 @@
 import { createHash } from "node:crypto";
-import { analyzeJavaScriptStaticSource } from "../domain/javascriptStaticAnalysis.js";
-import { analyzeJavaScriptSemantics } from "../domain/javascriptSemanticAnalysis.js";
+import { analyzeParsedJavaScriptStaticSource } from "../domain/javascriptStaticAnalysis.js";
+import { analyzeParsedJavaScriptSemantics } from "../domain/javascriptSemanticAnalysis.js";
 import { DEFAULT_JAVASCRIPT_SEMANTIC_LIMITS, } from "../domain/javascriptSemanticIr.js";
+import { parseJavaScriptSource } from "../domain/javascriptSourceParser.js";
+import { failedJavaScriptStaticAnalysis } from "../domain/javascriptStaticAnalysisHelpers.js";
 import { analyzeJavaScriptJsonModule } from "./JavaScriptJsonModules.js";
 /** Analyze selected text files under one shared AST, finding, module, and time budget. */
 export const analyzeJavaScriptArtifactFiles = (fileSet, input, now) => {
@@ -70,7 +72,14 @@ const analyzeArtifactFile = (file, context) => {
         state.truncatedScopes += 1;
         return;
     }
-    const analysis = analyzeJavaScriptStaticSource(file.text.value, {
+    const parsed = parseJavaScriptSource(file.text.value);
+    if (parsed === null) {
+        const analysis = failedJavaScriptStaticAnalysis();
+        state.files.push({ file, javascript: analysis, semantic: null });
+        state.parseFailures += 1;
+        return;
+    }
+    const analysis = analyzeParsedJavaScriptStaticSource(file.text.value, parsed, {
         maxAstNodes: remainingNodes,
         maxFindings: remainingFindings,
         maxModules: remainingModules,
@@ -88,7 +97,7 @@ const analyzeArtifactFile = (file, context) => {
         maxModuleLinks: semanticFindingBudget,
     };
     const semantics = analysis.parse_status === "complete" || analysis.parse_status === "partial"
-        ? analyzeJavaScriptSemantics(file.text.value, semanticLimits)
+        ? analyzeParsedJavaScriptSemantics(parsed, semanticLimits)
         : null;
     state.files.push({
         file,

package/dist/application/JavaScriptReplayPermission.js

@@ -12,5 +12,5 @@ export const replayPermissionRequest = (input, policy) => ({
     environment_names: [],
     network: "none",
     mount: true,
-    operation_identity: `run_controlled_replay:${input.plan_digest ?? "plan"}`,
+    operation_identity: `run_controlled_replay:${input.mode === "plan" ? "plan" : input.plan_digest}`,
 });

package/dist/application/JavaScriptReplayService.js

@@ -19,10 +19,10 @@ export const runControlledReplay = async (dependencies, rawInput, options = {})
 };
 /** Plan or execute replay input already parsed by a trusted adapter. */
 export const runControlledReplayValidated = async (dependencies, input, options = {}) => {
-    const authorized = await authorizeReplay(dependencies, input, options.signal);
+    const authorized = await authorizeReplay(dependencies, dependencies.policy(), input, options.signal);
     if (!authorized.ok)
         return authorized;
-    const prepared = await prepareValidatedReplay(dependencies, input, options.signal);
+    const prepared = await prepareValidatedReplay(dependencies, authorized.value, input, options.signal);
     if (!prepared.ok)
         return prepared;
     if (isAborted(options.signal))
@@ -35,11 +35,17 @@ export const runControlledReplayValidated = async (dependencies, input, options
             evidence: null,
         }));
     if (input.plan_digest !== prepared.value.publicPlan.plan_digest)
-        return err(new ReplayPlanStaleError(input.plan_digest ?? "", prepared.value.publicPlan.plan_digest));
+        return err(new ReplayPlanStaleError(input.plan_digest, prepared.value.publicPlan.plan_digest));
     const exportContext = await authorizeReproducerExport(dependencies.authority, input, prepared.value);
     if (!exportContext.ok)
         return exportContext;
-    const executed = await executeValidatedReplay(dependencies, prepared.value, exportContext.value, options);
+    const executed = await executeValidatedReplay({
+        runner: dependencies.runner,
+        policy: authorized.value,
+        prepared: prepared.value,
+        exportContext: exportContext.value,
+        options,
+    });
     if (!executed.ok)
         return executed;
     try {
@@ -51,14 +57,14 @@ export const runControlledReplayValidated = async (dependencies, input, options
             : "Controlled replay could not establish or clean up its sandbox", { cause }));
     }
 };
-const authorizeReplay = async (dependencies, input, signal) => {
-    if (!dependencies.policy.enabled)
+const authorizeReplay = async (dependencies, policy, input, signal) => {
+    if (policy.status === "disabled")
         return err(new AnalysisCapabilityUnavailableError("rea-javascript-replay", OPERATION, "controlled replay is disabled; configure exact roots and executables before enabling it"));
     if (dependencies.authority === undefined)
         return err(new AnalysisCapabilityUnavailableError("rea-javascript-replay", OPERATION, "JavaScript replay permission policy is not configured"));
     if (isAborted(signal))
         return err(new AnalysisCancelledError(OPERATION));
-    const request = replayPermissionRequest(input, dependencies.policy);
+    const request = replayPermissionRequest(input, policy);
     const authorized = input.mode === "plan"
         ? await dependencies.authority.explain(request, "read")
         : await dependencies.authority.authorize(request, "read");
@@ -68,13 +74,13 @@ const authorizeReplay = async (dependencies, input, signal) => {
             : new AnalysisProtocolError(authorized.error.message, {
                 cause: authorized.error,
             }));
-    return ok(true);
+    return ok(policy);
 };
-const prepareValidatedReplay = async (dependencies, input, signal) => {
+const prepareValidatedReplay = async (dependencies, policy, input, signal) => {
     if (isAborted(signal))
         return err(new AnalysisCancelledError(OPERATION));
     try {
-        return ok(await prepareReplayPlan(input, dependencies.policy, dependencies.host));
+        return ok(await prepareReplayPlan(input, policy, dependencies.host));
     }
     catch (cause) {
         return err(new AnalysisCapabilityUnavailableError("rea-javascript-replay", OPERATION, cause instanceof Error ? cause.message : "replay planning failed"));
@@ -83,8 +89,6 @@ const prepareValidatedReplay = async (dependencies, input, signal) => {
 const authorizeReproducerExport = async (authority, input, prepared) => {
     if (input.reproducer_export === undefined)
         return ok(undefined);
-    if (input.reproducer_export.approved !== true)
-        return err(new AnalysisInputError(`${OPERATION}:reproducer_export`));
     if (authority === undefined)
         return err(new AnalysisCapabilityUnavailableError("rea-javascript-replay", OPERATION, "JavaScript replay permission policy is not configured"));
     const exportAuthorized = await authority.authorize({
@@ -112,7 +116,8 @@ const authorizeReproducerExport = async (authority, input, prepared) => {
         includeSources: input.reproducer_export.include_sources === true,
     });
 };
-const executeValidatedReplay = async (dependencies, prepared, exportContext, options) => {
+const executeValidatedReplay = async (context) => {
+    const { runner, policy, prepared, exportContext, options } = context;
     await options.progress?.report({
         phase: OPERATION,
         completed: 0,
@@ -122,7 +127,7 @@ const executeValidatedReplay = async (dependencies, prepared, exportContext, opt
     if (isAborted(options.signal))
         return err(new AnalysisCancelledError(OPERATION));
     try {
-        let executed = replayExecutionResultSchema.parse(await dependencies.runner.execute(prepared, dependencies.policy, options.signal));
+        let executed = replayExecutionResultSchema.parse(await runner.execute(prepared, policy, options.signal));
         await options.progress?.report({
             phase: OPERATION,
             completed: 1,
@@ -289,4 +294,7 @@ const createReplayEvidence = (prepared, executed, side, outcomes) => {
         })),
     });
 };
-const asJson = (value) => jsonValueSchema.parse(JSON.parse(JSON.stringify(controlledReplayOutputSchema.parse(value))));
+const asJson = (value) => {
+    const serialized = JSON.parse(JSON.stringify(controlledReplayOutputSchema.parse(value)));
+    return jsonValueSchema.parse(serialized);
+};

package/dist/application/LazyAnalysisProvider.js

@@ -0,0 +1,77 @@
+/**
+ * Preserve synchronous provider discovery while loading implementation modules
+ * only when a target-bound client first executes.
+ */
+export class LazyAnalysisProvider {
+    #providerIdentity;
+    #capabilityDescriptors;
+    #loadProvider;
+    #provider;
+    constructor(options) {
+        this.#providerIdentity = options.identity;
+        this.#capabilityDescriptors = options.capabilities;
+        this.#loadProvider = options.load;
+    }
+    /** Return generated provider identity without loading its implementation. */
+    identity() {
+        return this.#providerIdentity;
+    }
+    /** Return generated capability metadata without loading its implementation. */
+    capabilities() {
+        return this.#capabilityDescriptors;
+    }
+    /** Create a client whose implementation is loaded on first execution. */
+    createClient(target, profile, context) {
+        return new LazyAnalysisClient(async () => {
+            const provider = await this.#load();
+            return provider.createClient(target, profile, context);
+        });
+    }
+    async #load() {
+        this.#provider ??= this.#loadProvider().catch((cause) => {
+            this.#provider = undefined;
+            throw cause;
+        });
+        return this.#provider;
+    }
+}
+class LazyAnalysisClient {
+    #loadClient;
+    #client;
+    #loading;
+    #closed = false;
+    constructor(loadClient) {
+        this.#loadClient = loadClient;
+    }
+    execute = async (operation, parameters, options) => {
+        const client = await this.#load();
+        return client.execute(operation, parameters, options);
+    };
+    runtimeLineageSnapshots() {
+        return this.#client?.runtimeLineageSnapshots?.() ?? [];
+    }
+    requestActivitySnapshots() {
+        return this.#client?.requestActivitySnapshots?.() ?? [];
+    }
+    async close() {
+        this.#closed = true;
+        if (this.#loading === undefined)
+            return;
+        const client = await this.#loading;
+        await client.close();
+    }
+    async #load() {
+        if (this.#closed)
+            throw new Error("Lazy analysis client is closed");
+        this.#loading ??= this.#loadClient()
+            .then((client) => {
+            this.#client = client;
+            return client;
+        })
+            .catch((cause) => {
+            this.#loading = undefined;
+            throw cause;
+        });
+        return this.#loading;
+    }
+}

package/dist/application/LoopbackReplay.js

@@ -374,11 +374,11 @@ export const startLoopbackReplay = async (scenario, recordEvent = () => undefine
         async close() {
             closePromise ??= (async () => {
                 recorder.stopMachineAdmission();
+                await recorder.drainMachine();
                 for (const client of websocket.clients)
                     client.terminate();
                 await new Promise((resolveClose) => websocket.close(() => resolveClose()));
                 await closeReplayServer(server);
-                await recorder.drainMachine();
             })();
             await closePromise;
         },

package/dist/application/ManagedRuntimeCorrelationService.js

@@ -6,6 +6,10 @@ import { err, ok } from "../domain/result.js";
 import { MANAGED_WORKFLOW_PROVIDER } from "./InvestigationProviders.js";
 import { digestJson } from "./JavaScriptReplayPlanning.js";
 const OPERATION = "plan_managed_runtime_correlation";
+/** A managed-runtime policy that grants no runtime-correlation authority. */
+export const MANAGED_RUNTIME_DISABLED = {
+    status: "disabled",
+};
 /** Create a separately authorized, non-executing managed runtime plan Evidence. */
 export const planManagedRuntimeCorrelationEvidence = async (dependencies, rawInput) => {
     const parsed = managedRuntimeCorrelationInputSchema.safeParse(rawInput);
@@ -15,12 +19,12 @@ export const planManagedRuntimeCorrelationEvidence = async (dependencies, rawInp
 };
 /** Plan runtime correlation from input parsed by a trusted adapter. */
 export const planManagedRuntimeCorrelationEvidenceValidated = async (dependencies, input) => {
-    if (!dependencies.policy.enabled)
+    const policy = dependencies.policy();
+    if (policy.status === "disabled")
         return err(new AnalysisCapabilityUnavailableError(MANAGED_WORKFLOW_PROVIDER.id, OPERATION, "managed runtime correlation is disabled; configure exact roots and runtime executable before enabling it"));
     if (dependencies.authority === undefined)
         return err(new AnalysisCapabilityUnavailableError(MANAGED_WORKFLOW_PROVIDER.id, OPERATION, "managed runtime permission policy is not configured"));
-    let staticEvidence;
-    let artifactPath;
+    let staticEvidence, artifactPath;
     try {
         staticEvidence = parseEvidence(input.static_members);
         artifactPath = artifactPathFor(staticEvidence);
@@ -31,7 +35,7 @@ export const planManagedRuntimeCorrelationEvidenceValidated = async (dependencie
     const authorized = await dependencies.authority.explain({
         capability: "managed_runtime",
         roots: [artifactPath],
-        executables: [dependencies.policy.executablePath],
+        executables: [policy.executablePath],
         environment_names: [],
         network: "none",
         mount: false,
@@ -44,7 +48,7 @@ export const planManagedRuntimeCorrelationEvidenceValidated = async (dependencie
                 cause: authorized.error,
             }));
     try {
-        const result = planManagedRuntimeCorrelation(input, dependencies.policy.executablePath, authorized.value.grant_id);
+        const result = planManagedRuntimeCorrelation(input, policy.executablePath, authorized.value.grant_id);
         return ok(createEvidence({
             path: result.static_observation.artifact_path,
             sha256: result.static_observation.artifact_sha256,