rea-agents 2.5.0 → 3.1.0

package/dist/application/NativeApiInspection.js

@@ -0,0 +1,80 @@
+import { nativeApiInspectionResultSchema, } from "../domain/nativeApiBoundary.js";
+const unavailableBoundary = () => ({
+    available: false,
+    reason: "The selected provider did not expose a structured native API boundary model.",
+    residual_unknowns: [
+        "What are the function's return and parameter boundary types?",
+        "Does this function dispatch through a jump table with recoverable data addresses?",
+    ],
+});
+/** Project one analyzed-function dossier into inspectable native API substeps. */
+export const projectNativeApiInspection = (dossier) => {
+    const boundary = dossier.native_api ?? unavailableBoundary();
+    const unsupportedBranches = boundary.available
+        ? []
+        : ["structured-boundary-types", "jump-table-data-mapping"];
+    const residualUnknowns = boundary.available
+        ? availableResidualUnknowns(boundary)
+        : boundary.residual_unknowns;
+    return nativeApiInspectionResultSchema.parse({
+        schema_version: 1,
+        procedure: {
+            address: dossier.procedure.address,
+            name: dossier.procedure.name,
+        },
+        boundary,
+        substeps: [
+            {
+                operation: "analyze_function",
+                status: "completed",
+                observations: [
+                    "provider function dossier",
+                    "provider pseudocode classification",
+                    "provider control-flow observations",
+                ],
+            },
+            {
+                operation: "project_native_api_boundary",
+                status: boundary.available ? "completed" : "unsupported",
+                observations: boundary.available
+                    ? [
+                        "return and parameter boundary types",
+                        "confidence and inference evidence",
+                        "jump-table dispatch, data, and target addresses",
+                    ]
+                    : [boundary.reason],
+            },
+            {
+                operation: "preserve_residual_unknowns",
+                status: "completed",
+                observations: residualUnknowns.length === 0
+                    ? ["no additional structured-boundary unknowns"]
+                    : residualUnknowns,
+            },
+        ],
+        unsupported_branches: unsupportedBranches,
+        residual_unknowns: residualUnknowns,
+    });
+};
+const availableResidualUnknowns = (boundary) => {
+    const unknowns = [];
+    if (boundary.parameters_truncated)
+        unknowns.push("Which additional parameters were omitted by the native API boundary limit?");
+    if (boundary.jump_tables_truncated)
+        unknowns.push("Which additional jump tables were omitted by the native API boundary limit?");
+    for (const table of boundary.jump_tables) {
+        if (table.data_sources_truncated || table.mappings_truncated)
+            unknowns.push(`Which additional data sources or targets were omitted for the jump table dispatched at ${table.dispatch_address}?`);
+        if (table.data_sources.length === 0)
+            unknowns.push(`What backing data address produced the jump table dispatched at ${table.dispatch_address}?`);
+        if (table.data_sources.some(({ entry_count: count, entry_size_bytes: size }) => count === null || size === null))
+            unknowns.push(`What are the exact entry size and count for candidate jump-table data dispatched at ${table.dispatch_address}?`);
+        if (table.mappings.some(({ case_value: value }) => value === null))
+            unknowns.push(`Which source-level case values correspond to every target dispatched at ${table.dispatch_address}?`);
+    }
+    for (const value of [boundary.return_type, ...boundary.parameters]) {
+        if (value.confidence === "low")
+            unknowns.push(`Can the inferred ${value.role} type ${value.data_type} be confirmed with imported metadata or an ABI probe?`);
+    }
+    return [...new Set(unknowns)];
+};

package/dist/application/NodeRuntimeCharacterizationService.js

@@ -3,7 +3,7 @@ import { z } from "zod";
 import { nodeCharacterizationExecutionInputSchema, nodeCharacterizationExecutionOutputSchema, nodeCharacterizationPreparationInputSchema, nodeCharacterizationPreparationOutputSchema, } from "../domain/nodeRuntimeCharacterization.js";
 import { AnalysisInputError, AnalysisProtocolError, ReplayPlanStaleError, } from "../domain/errors.js";
 import { createEvidence } from "../domain/evidence.js";
-import { controlledReplayOutputSchema } from "../domain/javascriptReplay.js";
+import { controlledReplayOutputSchema, } from "../domain/javascriptReplay.js";
 import { createRuntimeCharacterizationPlan, } from "../domain/runtimeCharacterization.js";
 import { err, ok } from "../domain/result.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";
@@ -37,7 +37,7 @@ export const executeNodeCharacterization = async (dependencies, rawInput, option
     if (prepared.value.plan.plan_sha256 !== parsed.data.approved_plan_sha256)
         return err(new ReplayPlanStaleError(parsed.data.approved_plan_sha256, prepared.value.plan.plan_sha256));
     const plannedReplay = controlledReplayOutputSchema.parse(prepared.value.replay);
-    if (plannedReplay.phase !== "plan" || plannedReplay.plan === null)
+    if (plannedReplay.phase !== "plan")
         return err(new AnalysisProtocolError("Node characterization preparation did not produce a replay plan"));
     const host = new InstrumentedJavaScriptReplayHost(dependencies.host, parsed.data.preparation.instrumentation);
     const executed = await runControlledReplayValidated({ ...dependencies, host }, {
@@ -48,6 +48,9 @@ export const executeNodeCharacterization = async (dependencies, rawInput, option
     }, options);
     if (!executed.ok)
         return executed;
+    const replayOutput = controlledReplayOutputSchema.parse(executed.value);
+    if (replayOutput.phase !== "execute")
+        return err(new AnalysisProtocolError("Node characterization execution omitted replay Evidence"));
     if (host.instrumentation === null)
         return err(new AnalysisProtocolError("Node characterization execution omitted instrumentation evidence"));
     return ok(jsonValueSchema.parse(nodeCharacterizationExecutionOutputSchema.parse({
@@ -56,8 +59,8 @@ export const executeNodeCharacterization = async (dependencies, rawInput, option
         plan: prepared.value.plan,
         transformation: host.instrumentation.manifest,
         transformation_evidence: prepared.value.transformation_evidence,
-        evidence: createCharacterizationEvidence(prepared.value, controlledReplayOutputSchema.parse(executed.value)),
-        replay: controlledReplayOutputSchema.parse(executed.value),
+        evidence: createCharacterizationEvidence(prepared.value, replayOutput),
+        replay: replayOutput,
     })));
 };
 const prepareValidated = async (dependencies, input, options) => {
@@ -66,9 +69,7 @@ const prepareValidated = async (dependencies, input, options) => {
     if (!replay.ok)
         return replay;
     const output = controlledReplayOutputSchema.parse(replay.value);
-    if (output.phase !== "plan" ||
-        output.plan === null ||
-        host.instrumentation === null)
+    if (output.phase !== "plan" || host.instrumentation === null)
         return err(new AnalysisProtocolError("Node characterization preparation omitted committed plan evidence"));
     const module = output.plan.left.modules.find(({ alias }) => alias === input.selected_alias);
     if (module === undefined)
@@ -109,8 +110,6 @@ const createTransformationEvidence = (input, instrumentation) => createEvidence(
     ],
 });
 const createCharacterizationEvidence = (prepared, replay) => {
-    if (replay.phase !== "execute" || replay.evidence === null)
-        throw new AnalysisProtocolError("Node characterization execution omitted replay Evidence");
     return createEvidence({
         path: prepared.plan.artifact.path,
         sha256: prepared.plan.artifact.sha256,

package/dist/application/ProcessCaptureLifecycle.js

@@ -264,6 +264,11 @@ export const resolveProcessResult = (capture, executionFailure, cleanupFailure)
     return capture;
 };
 export const prepareProcessCapture = async (scenario, policy, signal, host = systemProcessPreparationHost) => {
+    if (policy.status === "disabled")
+        throw new ProcessCaptureError("process capture is disabled", {
+            userCategory: "permission_required",
+            userMessage: processPolicyMessage("process capture is disabled"),
+        });
     const decision = authorizeProcessScenario(scenario, policy);
     if (!decision.allowed)
         throw new ProcessCaptureError(decision.reason, {

package/dist/application/ProcessCli.js

@@ -128,7 +128,8 @@ const readJson = async (path) => {
     if (bytes.length > MAX_INPUT_BYTES)
         throw new ProcessCliFailure("truncated", "Process input file is too large. Reduce it below 64 MiB, then try again.");
     try {
-        return JSON.parse(bytes.toString("utf8"));
+        const parsed = JSON.parse(bytes.toString("utf8"));
+        return parsed;
     }
     catch {
         throw new ProcessCliFailure("invalid_input", "Process input file is not valid JSON. Repair the file, then try again.");

package/dist/application/ProcessHarness.js

@@ -184,13 +184,18 @@ const completeCapture = async (options) => {
         }
         throw processCaptureCancelled();
     }
+    const settlement = await observeSettlement(options.runId, selectCapturedProcessGroupIds(runtime.terminal.pid, options.samples), scenario.settle_ms, options.recordEvent);
+    runtime.checkpoints.trigger("settled");
+    const samplingPartial = (await runtime.stopSampler()).partial;
     if (runtime.reactive !== undefined) {
+        // Process, filesystem, shim, and protocol observations can be recorded
+        // during settlement after the PTY exits. Make target loss terminal only
+        // after that journal has drained, otherwise the coordinator's control
+        // priority discards a valid multi-source completion predicate.
+        await runtime.reactive.coordinator.drain();
         await runtime.reactive.coordinator.submit({ kind: "target_lost" });
         runtime.reactive.unsubscribe();
     }
-    const settlement = await observeSettlement(options.runId, selectCapturedProcessGroupIds(runtime.terminal.pid, options.samples), scenario.settle_ms, options.recordEvent);
-    runtime.checkpoints.trigger("settled");
-    const samplingPartial = (await runtime.stopSampler()).partial;
     assertNotCancelled(options.signal);
     const after = await snapshotRoots(scenario, options.signal);
     const renderedFrames = await runtime.renderer.frames();

package/dist/application/ProcessNormalization.js

@@ -39,9 +39,10 @@ export const normalizeProcessSamples = (samples, scenario, rootPid) => {
             mapping.set(identifier, mapping.size + 1);
     const normalizeCommand = (command) => {
         const normalized = normalizeProcessText(command, scenario, "<no-temporary-root>", rootPid);
-        return scenario.normalization.pids
+        const withNormalizedPids = scenario.normalization.pids
             ? normalizePidTokens(normalized, identifiers)
             : normalized;
+        return withNormalizedPids.trim();
     };
     return samples.map((sample) => ({
         at_ms: normalizeProcessElapsedTime(sample.at_ms, scenario.normalization.time_bucket_ms),

package/dist/application/ProjectPermissionStore.js

@@ -13,6 +13,7 @@ const grantSchema = z.object({
         "browser_observe",
         "browser_automate",
         "electron_observe",
+        "electron_automate",
         "evidence_read",
         "evidence_write",
         "investigation_input",

package/dist/application/ReferenceSourceImport.js

@@ -173,7 +173,7 @@ export const importReferenceSource = async (options) => {
     try {
         return ok(createHistoricalSourceGraph(input));
     }
-    catch (error) {
-        return err(failure("parse", error instanceof Error ? error.message : "Graph failed validation"));
+    catch (cause) {
+        return err(failure("parse", cause instanceof Error ? cause.message : "Graph failed validation"));
     }
 };

package/dist/application/SessionProviderRouter.js

@@ -26,7 +26,7 @@ export class SessionProviderRouter {
                 : (target, resolutionOptions) => provider.resolveAnalysisProfile?.(target, resolutionOptions) ??
                     Promise.resolve(ok({ profile: null, compatibility: {} })));
         return new SessionProviderRouter({
-            kind: "legacy",
+            kind: "single",
             provider,
             identity,
             capabilities,
@@ -61,7 +61,7 @@ export class SessionProviderRouter {
     }
     /** Provider identities exposed through the flat 1.x compatibility field. */
     providerIdentities(route) {
-        if (this.runtime.kind === "legacy") {
+        if (this.runtime.kind === "single") {
             if (route.capabilities === undefined)
                 return [route.identity];
             return uniqueProviderIdentities([...route.capabilities.values()].map(({ provider }) => provider));
@@ -86,7 +86,7 @@ export class SessionProviderRouter {
             compatibility: {},
             binding: null,
             selection: undefined,
-            createClient: (target, context) => createLegacyClient(runtime, target, undefined, context),
+            createClient: (target, context) => createSingleProviderClient(runtime, target, undefined, context),
         };
     }
     /** Resolve target routes before any provider client is created. */
@@ -122,12 +122,12 @@ export class SessionProviderRouter {
             compatibility: normalized.value.compatibility,
             binding: null,
             selection: undefined,
-            createClient: (openedTarget, context) => createLegacyClient(runtime, openedTarget, normalized.value.profile ?? undefined, context),
+            createClient: (openedTarget, context) => createSingleProviderClient(runtime, openedTarget, normalized.value.profile ?? undefined, context),
         });
     }
     /** Candidate status authoritative for the active or target-free route. */
     candidateStatuses(route) {
-        if (this.runtime.kind === "legacy")
+        if (this.runtime.kind === "single")
             return [];
         return route.selection?.candidates ?? this.runtime.registry.candidates();
     }
@@ -160,7 +160,7 @@ const selectableRoute = (auxiliaryProviders, selection) => {
             emptyClient(identity),
     };
 };
-const createLegacyClient = (runtime, target, profile, context) => typeof runtime.provider === "function"
+const createSingleProviderClient = (runtime, target, profile, context) => typeof runtime.provider === "function"
     ? runtime.provider(target, profile, context)
     : runtime.provider.createClient(target, profile, context);
 const emptyClient = (identity) => ({

package/dist/application/SetupClientConfiguration.js

@@ -1,10 +1,12 @@
 import { constants as fsConstants } from "node:fs";
 import { copyFile, mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { dirname } from "node:path";
+import canonicalize from "canonicalize";
 import { z } from "zod";
 import writeFileAtomic from "write-file-atomic";
 import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
 import { PRODUCT_IDENTITY } from "../identity.js";
+import { MCP_STARTUP_POLICY } from "../mcpStartupPolicy.js";
 import { resolveClientConfigTransactionPath } from "./ClientConfigPath.js";
 const defaultCommand = () => [
     "npx",
@@ -12,7 +14,6 @@ const defaultCommand = () => [
     PRODUCT_IDENTITY.registrationPackageSpecifier,
     "mcp",
 ];
-const CODEX_STARTUP_TIMEOUT_SECONDS = 30;
 /** Back up, atomically update, and semantically read back one JSON MCP configuration. */
 export const configureJsonClient = async (client, environment = {}, command = defaultCommand()) => {
     const transactionPath = await resolveClientConfigTransactionPath(client.configPath);
@@ -187,7 +188,11 @@ const objectSchema = z.record(z.string(), z.unknown());
 const parseOptionalObject = (value) => value === undefined ? {} : objectSchema.parse(value);
 const parseObject = (text) => objectSchema.parse(JSON.parse(text));
 const isMissing = (cause) => cause instanceof Error && "code" in cause && cause.code === "ENOENT";
-const sameConfiguration = (left, right) => JSON.stringify(left) === JSON.stringify(right);
+const sameConfiguration = (left, right) => {
+    const encodedLeft = canonicalize(left);
+    const encodedRight = canonicalize(right);
+    return encodedLeft !== undefined && encodedLeft === encodedRight;
+};
 const preserveConfigBackup = async (source, destination) => {
     try {
         await copyFile(source, destination, fsConstants.COPYFILE_EXCL);
@@ -214,7 +219,9 @@ const clientConfigurationDesired = (client, providerEnvironment, command) => {
         command: command[0] ?? PRODUCT_IDENTITY.cliBinary,
         args: command.slice(1),
         ...(client.name === "codex"
-            ? { startup_timeout_sec: CODEX_STARTUP_TIMEOUT_SECONDS }
+            ? {
+                startup_timeout_sec: MCP_STARTUP_POLICY.codexStartupTimeoutSeconds,
+            }
             : {}),
         ...(Object.keys(environment).length === 0 ? {} : { env: environment }),
     };

package/dist/application/WindowsCapabilities.js

@@ -2,6 +2,7 @@ import { constants } from "node:fs";
 import { mkdtemp, rm, symlink, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { windowsNativeCapabilities, } from "../process/WindowsAuthority.js";
 import { probeProcessCaptureCapability, } from "./ProcessCaptureCapability.js";
 /** Probe named prerequisites without converting missing controls into support. */
 export const probeWindowsCapabilities = async (dependencies = systemDependencies()) => {
@@ -17,11 +18,11 @@ export const probeWindowsCapabilities = async (dependencies = systemDependencies
             no_follow_open: dependencies.probeNoFollowOpen(),
             private_acl: dependencies.probePrivateAcl(),
             unix_domain_socket: dependencies.probeUnixDomainSocket(),
-            pty: {
-                available: pty.available,
-                reason: pty.available ? null : pty.reason,
-            },
+            pty: pty.available
+                ? { available: true, reason: null }
+                : { available: false, reason: pty.reason },
         },
+        security: windowsNativeCapabilities(dependencies.platform),
     };
 };
 const systemDependencies = () => ({

package/dist/application/runtime.js

@@ -1,12 +1,10 @@
-import { BinarySession } from "./BinarySession.js";
 import { HopperProvider } from "../hopper/HopperProvider.js";
 import { GhidraProvider } from "../ghidra/GhidraProvider.js";
-import { NativeMacOSProvider } from "../native/NativeMacOSProvider.js";
-import { ArtifactProvider } from "../artifacts/ArtifactProvider.js";
-import { ManagedStaticProvider } from "../dotnet/ManagedStaticProvider.js";
 import { silentLogger } from "../logger.js";
+import { GENERATED_AUXILIARY_PROVIDERS } from "../generatedMcpToolCatalog.js";
 import { AnalysisProviderRegistry } from "./AnalysisProviderRegistry.js";
-import { SessionProviderRouter } from "./SessionProviderRouter.js";
+import { composeBinarySession } from "./BinarySessionComposition.js";
+import { LazyAnalysisProvider } from "./LazyAnalysisProvider.js";
 /**
  * Compose the target-switching runtime shared directly by CLI and MCP adapters.
  * This is the sole production wiring point, so both adapters share identical
@@ -15,9 +13,28 @@ import { SessionProviderRouter } from "./SessionProviderRouter.js";
 export const createBinarySession = (config, logger = silentLogger) => {
     const hopper = new HopperProvider(config, logger);
     const ghidra = new GhidraProvider(config, logger);
-    return new BinarySession(SessionProviderRouter.selectable(new AnalysisProviderRegistry([hopper, ghidra], config.analysisProvider), [
-        new ArtifactProvider(config.artifactNativeMountEnabled, config.artifactIntegrityContinueEnabled),
-        new NativeMacOSProvider(),
-        new ManagedStaticProvider(),
+    const auxiliary = new Map(GENERATED_AUXILIARY_PROVIDERS.map((provider) => [
+        provider.identity.id,
+        provider,
     ]));
+    const lazyProvider = (id, load) => {
+        const generated = auxiliary.get(id);
+        if (generated === undefined)
+            throw new TypeError(`Missing generated provider metadata for ${id}`);
+        return new LazyAnalysisProvider({ ...generated, load });
+    };
+    return composeBinarySession(new AnalysisProviderRegistry([hopper, ghidra], config.analysisProvider), [
+        lazyProvider("rea-artifact-graph", async () => {
+            const { ArtifactProvider } = await import("../artifacts/ArtifactProvider.js");
+            return new ArtifactProvider(config.artifactNativeMountEnabled, config.artifactIntegrityContinueEnabled);
+        }),
+        lazyProvider("native-macos", async () => {
+            const { NativeMacOSProvider } = await import("../native/NativeMacOSProvider.js");
+            return new NativeMacOSProvider();
+        }),
+        lazyProvider("rea-dotnet-static", async () => {
+            const { ManagedStaticProvider } = await import("../dotnet/ManagedStaticProvider.js");
+            return new ManagedStaticProvider();
+        }),
+    ]);
 };

package/dist/artifacts/ArtifactProvider.js

@@ -8,6 +8,7 @@ import { ArtifactReaderFailure, } from "./ArtifactReader.js";
 import { ARTIFACT_GRAPH_PROVIDER } from "../application/InvestigationProviders.js";
 import { createEvidence } from "../domain/evidence.js";
 import { createArtifactInspection } from "../domain/artifactInspection.js";
+import { resolveArtifactIntegrityPolicy, resolveNativeMountPolicy, } from "../application/ArtifactInventory/policy.js";
 const IDENTITY = Object.freeze(ARTIFACT_GRAPH_PROVIDER);
 /** Read-only inventory and exclusively owned extraction provider. */
 export class ArtifactProvider {
@@ -180,16 +181,13 @@ class ArtifactClient {
             edgeLimit: parsed.edge_limit,
         }, {
             ...(options?.signal === undefined ? {} : { signal: options.signal }),
-            nativeMount: {
-                nativeMountApproved: parsed.native_mount_approved === true,
-                nativeMountEnabled: this.nativeMountEnabled,
-            },
-            integrity: {
-                mode: parsed.integrity_policy,
-                approved: parsed.integrity_continue_approved === true,
-                enabled: this.integrityContinueEnabled,
-                maxMismatches: parsed.max_integrity_mismatches,
-            },
+            nativeMount: resolveNativeMountPolicy(parsed.native_mount_approved === true, this.nativeMountEnabled),
+            integrity: resolveArtifactIntegrityPolicy(parsed.integrity_policy === "fail"
+                ? { mode: "fail" }
+                : {
+                    mode: parsed.integrity_policy,
+                    maxMismatches: parsed.max_integrity_mismatches,
+                }, this.integrityContinueEnabled),
         });
     }
 }

package/dist/artifacts/SafeOutputTree.js

@@ -14,9 +14,7 @@ export class SafeOutputTree {
     #totalBytes = 0;
     #published = false;
     #cleanup = {
-        attempted: false,
-        verified: false,
-        residualPaths: [],
+        status: "not-required",
     };
     constructor(outputRoot, stagingRoot, limits) {
         this.#outputRoot = outputRoot;
@@ -126,11 +124,12 @@ export class SafeOutputTree {
             return structuredClone(this.#cleanup);
         await rm(this.#stagingRoot, { recursive: true, force: true });
         const absent = await isAbsent(this.#stagingRoot);
-        this.#cleanup = {
-            attempted: true,
-            verified: absent,
-            residualPaths: absent ? [] : [basename(this.#stagingRoot)],
-        };
+        this.#cleanup = absent
+            ? { status: "complete", residualPaths: [] }
+            : {
+                status: "incomplete",
+                residualPaths: [basename(this.#stagingRoot)],
+            };
         if (!absent)
             throw new ArtifactReaderFailure("integrity", "Extraction output cleanup could not be verified");
         return structuredClone(this.#cleanup);

package/dist/browser/CdpCaptureStorageFingerprints.js

@@ -19,13 +19,16 @@ export const captureStorageFingerprints = async ({ context, origin, local, sessi
     await addIndexedDb(run, origin, indexedDbNames);
     await addCaches(run, caches);
     state.items.sort((left, right) => compareCodePoints(`${left.scope}:${left.identity_sha256}`, `${right.scope}:${right.identity_sha256}`));
-    return {
-        items: state.items,
-        complete: state.complete &&
-            !state.truncated &&
-            state.items.every(({ complete }) => complete),
-        truncated: state.truncated,
-    };
+    const complete = state.complete &&
+        !state.truncated &&
+        state.items.every(({ complete }) => complete);
+    return complete
+        ? { items: state.items, complete: true, truncated: false }
+        : {
+            items: state.items,
+            complete: false,
+            truncated: state.truncated,
+        };
 };
 const addStorageItems = (state, scope, items) => {
     for (const item of items)

package/dist/browser/CdpElectronInspection.js

@@ -44,7 +44,9 @@ export const inspectCdpElectronPage = async (context) => {
 };
 const runElectronInspection = async (context, state, startedAt) => {
     const frames = await authorizeInitialFrames(context, state);
-    const main = frames[0];
+    const main = frames.at(0);
+    if (main === undefined)
+        throw new BrowserObservationError("inspect_web_page", "target_not_allowed");
     state.mainFrameId = main.frame_id;
     await enableElectronCapture(context);
     await delayWithCancellation(context.input.observation_ms, "inspect_electron_page", context.signal);

package/dist/browser/JavaScriptRuntimeScope.js

@@ -36,3 +36,8 @@ export const authorizeRuntimeLocation = async (value, roots, origins) => {
         },
     };
 };
+/** Authorize a target whose Node Inspector URL omits its main entry path. */
+export const authorizeRuntimeTargetLocation = async (value, targetType, roots, origins) => 
+// A bare file:// URL contains no source identity. Do not attach to the
+// first configured root merely because the target happens to be Node.
+authorizeRuntimeLocation(value, roots, origins);

package/dist/browser/PlaywrightBrowserScenarioProvider.js

@@ -3,8 +3,14 @@ import { browserScenarioCaptureSchema, browserScenarioCompletenessSchema, browse
 import { AnalysisError, BrowserObservationError, ProviderAdapterError, } from "../domain/errors.js";
 import { err, ok } from "../domain/result.js";
 import { BrowserScenarioCaptureBudget } from "./PlaywrightScenarioArtifacts.js";
-import { PlaywrightScenarioSessionFactory } from "./PlaywrightScenarioSession.js";
 const OPERATION = "capture_browser_scenario";
+let defaultFactory;
+const lazyPlaywrightFactory = {
+    async open(scenario, options) {
+        defaultFactory ??= import("./PlaywrightScenarioSession.js").then(({ PlaywrightScenarioSessionFactory }) => new PlaywrightScenarioSessionFactory());
+        return (await defaultFactory).open(scenario, options);
+    },
+};
 export const PLAYWRIGHT_BROWSER_SCENARIO_PROVIDER_IDENTITY = Object.freeze({
     id: "rea-playwright-browser-scenario",
     name: "REA Playwright browser scenario capture provider",
@@ -234,7 +240,7 @@ const runScenario = async (factory, scenario, options) => {
 /** Controlled Playwright/CDP scenario driver with exact process ownership. */
 export class PlaywrightBrowserScenarioProvider {
     factory;
-    constructor(factory = new PlaywrightScenarioSessionFactory()) {
+    constructor(factory = lazyPlaywrightFactory) {
         this.factory = factory;
     }
     identity() {