rea-agents 3.0.0 → 3.1.0

package/dist/process/WindowsAuthority.js

@@ -0,0 +1,32 @@
+/** Stable explanation used whenever the native Windows authority is absent. */
+export const WINDOWS_NATIVE_AUTHORITY_UNAVAILABLE_REASON = "Verified Windows native authority is unavailable: Job Object process ownership, private runtime DACL enforcement, and reparse-safe path admission are not implemented; chmod(0700) is insufficient for Windows private DACL proof, and taskkill is not a Job Object security proof";
+/**
+ * Describe native Windows controls without inferring them from taskkill,
+ * chmod, symlink creation, or a numeric POSIX open flag.
+ */
+export const windowsNativeCapabilities = (platform) => {
+    if (platform !== "win32") {
+        const notApplicable = {
+            available: false,
+            reason: "Windows native authority is not applicable on this host",
+            proof: "not-applicable",
+        };
+        return {
+            job_object_process_ownership: notApplicable,
+            private_runtime_dacl: notApplicable,
+            reparse_safe_path_admission: notApplicable,
+        };
+    }
+    const notProven = {
+        available: false,
+        reason: WINDOWS_NATIVE_AUTHORITY_UNAVAILABLE_REASON,
+        proof: "not-proven",
+    };
+    return {
+        job_object_process_ownership: notProven,
+        private_runtime_dacl: notProven,
+        reparse_safe_path_admission: notProven,
+    };
+};
+/** Whether every native control needed for Windows isolation is proven. */
+export const hasWindowsNativeAuthority = (platform) => Object.values(windowsNativeCapabilities(platform)).every(({ available }) => available);

package/dist/reference/ReferenceSourceReader.js

@@ -35,7 +35,7 @@ export const readReferenceSource = async (root, limits = DEFAULT_LIMITS, options
         bytesRead: 0,
         filesSeen: 0,
         truncated: false,
-        stopped: false,
+        stopReason: undefined,
     };
     const traversal = await traverse(state);
     if (!traversal.ok)
@@ -48,14 +48,14 @@ export const readReferenceSource = async (root, limits = DEFAULT_LIMITS, options
         truncated: state.truncated,
         limitations: [
             PATH_RACE_LIMITATION,
-            ...(state.stopped
+            ...(state.stopReason === "entry-limit"
                 ? ["Traversal stopped because the entry limit was reached."]
                 : []),
         ],
     });
 };
 const traverse = async (state) => {
-    while (state.pending.length > 0 && !state.stopped) {
+    while (state.pending.length > 0 && state.stopReason === undefined) {
         if (isAborted(state.signal))
             return err({
                 tag: "reference-source-reader",

package/dist/reference/ReferenceSourceReaderEntries.js

@@ -35,7 +35,7 @@ export const traverseDirectory = async (state, current) => {
         const result = await processEntry(state, current, name, directories);
         if (!result.ok)
             return result;
-        if (state.stopped)
+        if (state.stopReason !== undefined)
             break;
     }
     directories.reverse();
@@ -201,6 +201,6 @@ const reserveEntry = (state) => {
         return true;
     }
     state.truncated = true;
-    state.stopped = true;
+    state.stopReason = "entry-limit";
     return false;
 };

package/dist/replay/JavaScriptReplayWorker.js

@@ -1,5 +1,82 @@
 import { Script, SourceTextModule, SyntheticModule, createContext, } from "node:vm";
 import { types } from "node:util";
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const record = (value, label) => {
+    if (!isRecord(value))
+        throw new TypeError(`Invalid replay worker ${label}`);
+    return value;
+};
+const string = (value, label) => {
+    if (typeof value !== "string")
+        throw new TypeError(`Invalid replay worker ${label}`);
+    return value;
+};
+const integer = (value, label) => {
+    if (!Number.isSafeInteger(value) || Number(value) < 0)
+        throw new TypeError(`Invalid replay worker ${label}`);
+    return Number(value);
+};
+const parseWorkerModule = (value) => {
+    const module = record(value, "module");
+    const format = module.format;
+    if (format !== "esm" && format !== "commonjs-factory")
+        throw new TypeError("Invalid replay worker module format");
+    const dependencies = record(module.dependencies, "module dependencies");
+    if (Object.values(dependencies).some((dependency) => typeof dependency !== "string"))
+        throw new TypeError("Invalid replay worker module dependency");
+    return {
+        alias: string(module.alias, "module alias"),
+        format,
+        dependencies: Object.fromEntries(Object.entries(dependencies).map(([key, dependency]) => [
+            key,
+            string(dependency, "module dependency"),
+        ])),
+        source: string(module.source, "module source"),
+    };
+};
+const parseWorkerSide = (value) => {
+    const side = record(value, "side");
+    if (!Array.isArray(side.modules))
+        throw new TypeError("Invalid replay worker modules");
+    return {
+        modules: side.modules.map(parseWorkerModule),
+        entryAlias: string(side.entryAlias, "entry alias"),
+        entryExport: string(side.entryExport, "entry export"),
+    };
+};
+const parseWorkerRequest = (value) => {
+    const request = record(value, "request");
+    if (request.schemaVersion !== 1 || !Array.isArray(request.cases))
+        throw new TypeError("Unsupported replay worker protocol");
+    const determinism = record(request.determinism, "determinism");
+    const limits = record(request.limits, "limits");
+    return {
+        schemaVersion: 1,
+        left: parseWorkerSide(request.left),
+        ...(request.right === undefined
+            ? {}
+            : { right: parseWorkerSide(request.right) }),
+        cases: request.cases.map((value) => {
+            const replayCase = record(value, "case");
+            if (!Array.isArray(replayCase.arguments))
+                throw new TypeError("Invalid replay worker case arguments");
+            return {
+                caseId: string(replayCase.caseId, "case ID"),
+                arguments: replayCase.arguments,
+                inputSha256: string(replayCase.inputSha256, "case digest"),
+            };
+        }),
+        determinism: {
+            clockIso: string(determinism.clockIso, "clock"),
+            randomSeed: integer(determinism.randomSeed, "random seed"),
+        },
+        limits: {
+            resultDepth: integer(limits.resultDepth, "result depth"),
+            resultNodes: integer(limits.resultNodes, "result nodes"),
+            exceptionBytes: integer(limits.exceptionBytes, "exception bytes"),
+        },
+    };
+};
 class ReplayDeniedError extends Error {
     name = "ReplayDeniedError";
 }
@@ -7,9 +84,8 @@ const main = async () => {
     const chunks = [];
     for await (const chunk of process.stdin)
         chunks.push(Buffer.from(chunk));
-    const request = JSON.parse(Buffer.concat(chunks).toString("utf8"));
-    if (request.schemaVersion !== 1)
-        throw new TypeError("Unsupported replay worker protocol");
+    const rawRequest = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+    const request = parseWorkerRequest(rawRequest);
     const left = [];
     const right = [];
     for (let index = 0; index < request.cases.length; index += 1) {
@@ -66,18 +142,20 @@ const loadEntry = async (side, request, caseIndex) => {
             throw new TypeError(`Synchronous require cannot load ESM module: ${alias}`);
         const module = { exports: {} };
         commonJsCache.set(alias, module.exports);
-        const requireModule = ((specifier) => {
+        const requireModule = (specifier) => {
             const dependency = descriptor.dependencies[specifier];
             if (dependency === undefined)
                 throw new ReplayDeniedError(`Undeclared require: ${specifier}`);
             return loadCommonJs(dependency);
-        });
+        };
         installRspackHelpers(requireModule);
         const source = normalizeFactorySource(descriptor.source);
         const factory = new Script(`(${source})`, {
             filename: `/modules/${alias}.js`,
         }).runInContext(context);
-        factory(module, module.exports, requireModule);
+        if (typeof factory !== "function")
+            throw new TypeError(`CommonJS factory is not callable: ${alias}`);
+        Reflect.apply(factory, undefined, [module, module.exports, requireModule]);
         commonJsCache.set(alias, module.exports);
         return module.exports;
     };
@@ -126,7 +204,7 @@ const loadEntry = async (side, request, caseIndex) => {
             : exported[side.entryExport];
     }
     const namespace = (await loadEsm(side.entryAlias)).namespace;
-    return namespace[side.entryExport];
+    return Reflect.get(namespace, side.entryExport);
 };
 const deterministicContext = (request, caseIndex) => {
     let state = (request.determinism.randomSeed + caseIndex) >>> 0;
@@ -153,21 +231,27 @@ const deterministicContext = (request, caseIndex) => {
     });
 };
 const installRspackHelpers = (require_) => {
-    require_.d = (exports, definitions) => {
+    const defineExports = (exports, definitions) => {
         for (const [name, getter] of Object.entries(definitions))
             if (!Object.prototype.hasOwnProperty.call(exports, name))
                 Object.defineProperty(exports, name, { enumerable: true, get: getter });
     };
-    require_.r = (exports) => {
+    const markModule = (exports) => {
         Object.defineProperty(exports, "__esModule", { value: true });
         Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     };
-    require_.n = (module) => {
+    const normalizeModule = (module) => {
         const getter = () => (module.__esModule === true ? module.default : module);
         Object.defineProperty(getter, "a", { get: getter });
         return getter;
     };
-    require_.nmd = (module) => module;
+    const passModule = (module) => module;
+    Object.defineProperties(require_, {
+        d: { value: defineExports },
+        r: { value: markModule },
+        n: { value: normalizeModule },
+        nmd: { value: passModule },
+    });
 };
 const requiredModule = (modules, alias) => {
     const module = modules.get(alias);

package/dist/replay/JavaScriptReplayWorkerTypes.js

@@ -0,0 +1 @@
+export {};

package/dist/replay/LinuxJavaScriptReplayRunner.js

@@ -43,8 +43,7 @@ export class LinuxJavaScriptReplayRunner {
                 collected,
                 unitResult,
                 cleanup,
-                cancelled: replayProcess.cancelled,
-                timedOut: replayProcess.timedOut,
+                termination: replayProcess.termination,
             });
         }
         finally {
@@ -90,15 +89,14 @@ const launchReplayProcess = (options) => {
     });
     let child;
     let timeout;
-    let cancelled = false;
-    let timedOut = false;
+    let termination;
     let terminationRequest;
     const requestTermination = () => {
         terminationRequest ??= killUnit(policy.systemctlPath, unit);
         child?.kill("SIGKILL");
     };
     const terminate = () => {
-        cancelled = true;
+        termination ??= "cancelled";
         requestTermination();
     };
     const completion = new Promise((resolve, reject) => {
@@ -124,7 +122,7 @@ const launchReplayProcess = (options) => {
     if (isAborted(signal))
         terminate();
     timeout = setTimeout(() => {
-        timedOut = true;
+        termination ??= "timeout";
         requestTermination();
     }, prepared.publicPlan.limits.wall_time_ms);
     timeout.unref();
@@ -139,11 +137,8 @@ const launchReplayProcess = (options) => {
         get terminationRequest() {
             return terminationRequest;
         },
-        get cancelled() {
-            return cancelled;
-        },
-        get timedOut() {
-            return timedOut;
+        get termination() {
+            return termination;
         },
     };
 };
@@ -160,12 +155,12 @@ const replayProcessEnvironment = () => ({
         : { DBUS_SESSION_BUS_ADDRESS: process.env.DBUS_SESSION_BUS_ADDRESS }),
 });
 const resolveReplayResult = (options) => {
-    const { prepared, collected, unitResult, cleanup, cancelled, timedOut } = options;
-    if (cancelled || timedOut)
+    const { prepared, collected, unitResult, cleanup, termination } = options;
+    if (termination !== undefined)
         return terminationResult({
             prepared,
             stderr: collected.stderr,
-            termination: cancelled ? "cancelled" : "timeout",
+            termination,
             cleanup,
         });
     if (collected.outputExceeded)
@@ -186,7 +181,7 @@ const resolveReplayResult = (options) => {
     let response;
     try {
         const rawResponse = JSON.parse(collected.stdout);
-        response = parseReplayWorkerResponse(rawResponse, prepared.publicPlan.cases, prepared.publicPlan.right !== undefined);
+        response = parseReplayWorkerResponse(rawResponse, prepared.publicPlan.cases, prepared.publicPlan.right === undefined ? "single" : "differential");
     }
     catch {
         return terminationResult({

package/dist/replay/ReplayOutcome.js

@@ -33,18 +33,21 @@ const workerSide = (side, sources) => ({
     entryExport: side.entry_export,
 });
 export const commitOutcomes = (outcomes) => outcomes.map((outcome) => {
-    const semantic = outcome.value === undefined ? (outcome.exception ?? null) : outcome.value;
+    if (outcome.outcome === "return")
+        return {
+            case_id: outcome.case_id,
+            outcome: outcome.outcome,
+            value: jsonValueSchema.parse(outcome.value),
+            input_sha256: outcome.input_sha256,
+            output_sha256: digestJson(outcome.value),
+            truncated: false,
+        };
     return {
         case_id: outcome.case_id,
         outcome: outcome.outcome,
-        ...(outcome.value === undefined
-            ? {}
-            : { value: jsonValueSchema.parse(outcome.value) }),
-        ...(outcome.exception === undefined
-            ? {}
-            : { exception: outcome.exception }),
+        exception: outcome.exception,
         input_sha256: outcome.input_sha256,
-        output_sha256: digestJson(semantic),
+        output_sha256: digestJson(outcome.exception),
         truncated: false,
     };
 });
@@ -61,13 +64,21 @@ export const compareOutcomes = (left, right) => left.map((item, index) => ({
 }));
 export const terminationResult = (options) => {
     const { prepared, stderr, termination, cleanup, limitation } = options;
-    const outcomes = prepared.publicPlan.cases.map((item) => ({
-        case_id: item.case_id,
-        outcome: termination,
-        input_sha256: item.sha256,
-        output_sha256: null,
-        truncated: termination === "protocol_error",
-    }));
+    const outcomes = termination === "protocol_error"
+        ? prepared.publicPlan.cases.map((item) => ({
+            case_id: item.case_id,
+            outcome: termination,
+            input_sha256: item.sha256,
+            output_sha256: null,
+            truncated: true,
+        }))
+        : prepared.publicPlan.cases.map((item) => ({
+            case_id: item.case_id,
+            outcome: termination,
+            input_sha256: item.sha256,
+            output_sha256: null,
+            truncated: false,
+        }));
     const differential = prepared.publicPlan.right !== undefined;
     return {
         schema_version: 1,

package/dist/replay/ReplayWorkerProtocol.js

@@ -1,45 +1,50 @@
 import { z } from "zod";
-const workerOutcomeSchema = z
-    .object({
+const workerOutcomeFacts = {
     case_id: z.string(),
-    outcome: z.enum(["return", "exception", "serialization_error", "denied"]),
-    value: z.json().optional(),
-    exception: z
-        .object({
-        name: z.string(),
-        message: z.string(),
-        stack: z.string().nullable(),
-    })
-        .strict()
-        .optional(),
     input_sha256: z.string().regex(/^[a-f0-9]{64}$/u),
     output_sha256: z.null(),
     truncated: z.literal(false),
+};
+const exceptionSchema = z
+    .object({
+    name: z.string(),
+    message: z.string(),
+    stack: z.string().nullable(),
 })
-    .strict()
-    .superRefine((value, context) => {
-    if (value.outcome === "return" && value.value === undefined)
-        context.addIssue({ code: "custom", message: "Return value is missing" });
-    if (value.outcome !== "return" && value.exception === undefined)
-        context.addIssue({ code: "custom", message: "Exception is missing" });
-    if (value.outcome === "return" && value.exception !== undefined)
-        context.addIssue({ code: "custom", message: "Return has an exception" });
-});
-const workerResponseSchema = z
+    .strict();
+const workerOutcomeSchema = z.discriminatedUnion("outcome", [
+    z.strictObject({
+        ...workerOutcomeFacts,
+        outcome: z.literal("return"),
+        value: z.json(),
+    }),
+    z.strictObject({
+        ...workerOutcomeFacts,
+        outcome: z.enum(["exception", "serialization_error", "denied"]),
+        exception: z.object(exceptionSchema.shape).strict(),
+    }),
+]);
+const singleWorkerResponseSchema = z
+    .object({
+    schema_version: z.literal(1),
+    left: z.array(workerOutcomeSchema),
+})
+    .strict();
+const differentialWorkerResponseSchema = z
     .object({
     schema_version: z.literal(1),
     left: z.array(workerOutcomeSchema),
-    right: z.array(workerOutcomeSchema).optional(),
+    right: z.array(workerOutcomeSchema),
 })
     .strict();
 /** Strictly authenticate case ordering and commitments in worker output. */
-export const parseReplayWorkerResponse = (rawResponse, cases, differential) => {
-    const response = workerResponseSchema.parse(rawResponse);
-    if ((response.right !== undefined) !== differential)
-        throw new TypeError("Replay worker differential response is incomplete");
+export const parseReplayWorkerResponse = (rawResponse, cases, mode) => {
+    const response = mode === "single"
+        ? singleWorkerResponseSchema.parse(rawResponse)
+        : differentialWorkerResponseSchema.parse(rawResponse);
     validateOutcomeSequence(response.left, cases);
-    if (response.right !== undefined)
-        validateOutcomeSequence(response.right, cases);
+    if (mode === "differential")
+        validateOutcomeSequence(differentialWorkerResponseSchema.parse(response).right, cases);
     return response;
 };
 const validateOutcomeSequence = (outcomes, cases) => {