rea-agents 3.0.0 → 3.2.0

package/dist/application/NativeUiActionTrace.js

@@ -0,0 +1,394 @@
+import { z } from "zod";
+import { interfaceBuilderAnalysisSchema } from "../domain/interfaceBuilderGraph.js";
+import { nativeInvestigationGraphSchema, nativeInvestigationTraceSchema, traceNativeInvestigationGraph, joinInterfaceBuilderDispatch, } from "../domain/nativeInvestigationGraph.js";
+import { inspectNativeDispatchMetadata, nativeDispatchMetadataResultSchema, } from "../domain/objcSwiftMetadata.js";
+import { jsonValueSchema } from "../domain/jsonValue.js";
+import { parseRelatedAddresses } from "../domain/hopperValues.js";
+import { err, ok } from "../domain/result.js";
+import { AnalysisCancelledError, AnalysisOutputError, projectAnalysisError, } from "../domain/errors.js";
+const nativeNameSchema = z.array(z.union([
+    z.strictObject({ address: z.string(), name: z.string() }),
+    z.strictObject({ address: z.string(), value: z.string() }),
+]));
+/** Build a UI-to-code trace from the active app and selected native provider. */
+export const traceNativeUiAction = async (analysis, input, signal) => {
+    const [uiExecution, namesExecution] = await Promise.all([
+        analysis.execute("decode_interface_builder", {
+            max_documents: 64,
+            max_objects: input.max_nodes,
+            max_connections: input.max_edges,
+        }, signal === undefined ? {} : { signal }),
+        analysis.execute("list_names", {}, signal === undefined ? {} : { signal }),
+    ]);
+    if (!uiExecution.ok && uiExecution.error._tag === "AnalysisCancelledError")
+        return err(new AnalysisCancelledError("decode_interface_builder"));
+    if (!namesExecution.ok)
+        return err(namesExecution.error);
+    const parsedNames = nativeNameSchema.safeParse(namesExecution.value.result);
+    if (!parsedNames.success)
+        return err(new AnalysisOutputError("list_names", "provider returned an invalid name inventory"));
+    const targetSha256 = namesExecution.value.subject?.sha256;
+    if (targetSha256 === undefined)
+        return err(new AnalysisOutputError("list_names", "provider did not bind the name inventory to a target SHA-256"));
+    const metadata = nativeDispatchMetadataResultSchema.parse({
+        target_sha256: targetSha256,
+        provider: namesExecution.value.provider,
+        analysis_profile_digest: namesExecution.value.analysisProfile?.digest ?? null,
+        result: inspectNativeDispatchMetadata(parsedNames.data.map((entry) => ({
+            address: entry.address,
+            name: "name" in entry ? entry.name : entry.value,
+        })), parsedNames.data.length),
+    });
+    let graph = emptyGraph(targetSha256, namesExecution.value.provider);
+    const coverage = [];
+    if (uiExecution.ok) {
+        const decoded = interfaceBuilderAnalysisSchema.safeParse(uiExecution.value.result);
+        if (!decoded.success)
+            return err(new AnalysisOutputError("decode_interface_builder", "artifact provider returned an invalid interface graph"));
+        if (decoded.data.target_sha256 !== targetSha256)
+            return err(new AnalysisOutputError("decode_interface_builder", "UI and native provider results refer to different target SHA-256 values"));
+        graph = joinInterfaceBuilderDispatch(decoded.data.graph, metadata.result);
+        coverage.push({
+            facet: "interface_builder_archives",
+            status: decoded.data.documents.length > 0 ? "complete" : "unsupported",
+            reason: decoded.data.documents.length > 0
+                ? null
+                : "no_compiled_interface_builder_archives_found",
+            examined: decoded.data.documents.length,
+            omitted: 0,
+        });
+        const bounded = boundUiGraph(graph, input.max_nodes, input.max_edges);
+        graph = bounded.graph;
+        if (bounded.truncated)
+            coverage.push({
+                facet: "interface_builder_graph",
+                status: "partial",
+                reason: "native_trace_output_bounds_reached",
+                examined: decoded.data.graph.nodes.length + decoded.data.graph.edges.length,
+                omitted: bounded.omitted,
+            });
+    }
+    else {
+        coverage.push({
+            facet: "interface_builder_archives",
+            status: "unsupported",
+            reason: projectAnalysisError(uiExecution.error).message,
+            examined: 0,
+            omitted: 0,
+        });
+    }
+    const selected = resolveUiAction(graph, input.action);
+    if (selected.nodeId === null) {
+        coverage.push(...graph.coverage);
+        const trace = {
+            target_sha256: graph.target_sha256,
+            provider: graph.provider,
+            start: input.action,
+            direction: "forward",
+            nodes: selected.candidates,
+            edges: [],
+            unresolved: [],
+            reached_depth: 0,
+            truncated: graph.truncated,
+            reason: selected.reason,
+            coverage,
+            limitations: [
+                "The query did not identify one unique authored UI action; no handler path was inferred.",
+            ],
+        };
+        return ok(jsonValueSchema.parse(nativeInvestigationTraceSchema.parse(trace)));
+    }
+    const initial = traceNativeInvestigationGraph(graph, {
+        start: selected.nodeId,
+        direction: "forward",
+        limits: {
+            max_depth: input.max_depth,
+            max_nodes: input.max_nodes,
+            max_edges: input.max_edges,
+        },
+    });
+    const expanded = await addDirectCallees({
+        analysis,
+        graph,
+        initial,
+        input,
+        targetSha256,
+        signal,
+    });
+    if (expanded.error !== undefined)
+        return err(expanded.error);
+    coverage.push({
+        facet: "direct_native_calls",
+        status: "partial",
+        reason: "resolved_direct_calls_do_not_cover_all_indirect_dispatch",
+        examined: expanded.examined,
+        omitted: expanded.omitted,
+    });
+    coverage.push({
+        facet: "cross_function_value_flow",
+        status: "unsupported",
+        reason: "call edges identify control-flow candidates but do not recover argument, return, or shared-memory value relationships",
+        examined: 0,
+        omitted: 0,
+    });
+    const finalGraph = nativeInvestigationGraphSchema.parse({
+        ...graph,
+        nodes: expanded.nodes,
+        edges: expanded.edges,
+        coverage: [...graph.coverage, ...coverage],
+        truncated: graph.truncated || expanded.truncated,
+    });
+    const trace = traceNativeInvestigationGraph(finalGraph, {
+        start: selected.nodeId,
+        direction: "forward",
+        limits: {
+            max_depth: input.max_depth,
+            max_nodes: input.max_nodes,
+            max_edges: input.max_edges,
+        },
+    });
+    return ok(jsonValueSchema.parse(nativeInvestigationTraceSchema.parse({
+        ...trace,
+        truncated: trace.truncated || expanded.truncated || graph.truncated,
+        reason: expanded.truncated && trace.reason === null
+            ? "native_call_traversal_bound_reached"
+            : graph.truncated && trace.reason === null
+                ? "native_trace_output_bound_reached"
+                : trace.reason,
+    })));
+};
+const emptyGraph = (targetSha256, provider) => nativeInvestigationGraphSchema.parse({
+    target_sha256: targetSha256,
+    provider: {
+        id: provider.id,
+        version: provider.version,
+        tool_version: "rea-native-ui-trace/1",
+    },
+    nodes: [],
+    edges: [],
+    coverage: [],
+    truncated: false,
+});
+const boundUiGraph = (graph, maxNodes, maxEdges) => {
+    const nodes = graph.nodes.slice(0, maxNodes);
+    const nodeIds = new Set(nodes.map(({ id }) => id));
+    const eligibleEdges = graph.edges.filter((edge) => nodeIds.has(edge.from) && (edge.to === null || nodeIds.has(edge.to)));
+    const edges = eligibleEdges.slice(0, maxEdges);
+    const omitted = graph.nodes.length - nodes.length + graph.edges.length - edges.length;
+    const truncated = omitted > 0;
+    return {
+        graph: nativeInvestigationGraphSchema.parse({
+            ...graph,
+            nodes,
+            edges,
+            truncated: graph.truncated || truncated,
+        }),
+        truncated,
+        omitted,
+    };
+};
+const resolveUiAction = (graph, query) => {
+    const exactId = graph.nodes.find((node) => node.id === query);
+    if (exactId?.kind === "action")
+        return { nodeId: exactId.id, candidates: [], reason: null };
+    const actions = graph.nodes.filter((node) => node.kind === "action" &&
+        (node.name === query || node.attributes.selector === query));
+    if (actions.length === 1)
+        return { nodeId: actions[0]?.id ?? null, candidates: [], reason: null };
+    if (actions.length > 1)
+        return {
+            nodeId: null,
+            candidates: actions,
+            reason: "action_selector_matches_multiple_ui_connections",
+        };
+    const objectMatches = graph.nodes.filter((node) => ["control", "view", "view_controller", "scene"].includes(node.kind) &&
+        (node.id === query ||
+            node.attributes.interface_builder_object_id === query ||
+            node.id.endsWith(`:object:${query}`)));
+    const actionIds = new Set(graph.edges.flatMap((edge) => edge.resolution === "observed" &&
+        edge.relation === "target_action" &&
+        objectMatches.some(({ id }) => edge.from === id) &&
+        graph.nodes.some(({ id, kind }) => id === edge.to && kind === "action")
+        ? [edge.to]
+        : []));
+    if (actionIds.size === 1)
+        return { nodeId: [...actionIds][0] ?? null, candidates: [], reason: null };
+    if (actionIds.size > 1)
+        return {
+            nodeId: null,
+            candidates: graph.nodes.filter(({ id }) => actionIds.has(id)),
+            reason: "interface_object_has_multiple_action_connections",
+        };
+    return {
+        nodeId: null,
+        candidates: [],
+        reason: "ui_action_or_object_not_found",
+    };
+};
+const addDirectCallees = async (input) => {
+    const nodes = new Map(input.initial.nodes.map((node) => [node.id, node]));
+    const edges = new Map([...input.initial.edges, ...input.initial.unresolved].map((edge) => [
+        edge.id,
+        edge,
+    ]));
+    const addressNames = new Map();
+    const depthByNode = graphNodeDepths(input.initial.start, input.initial.nodes, input.initial.edges);
+    for (const node of nodes.values()) {
+        if (node.kind === "function" && node.location?.address !== null)
+            addressNames.set(node.location?.address ?? "", node.name);
+    }
+    const queue = input.initial.nodes.flatMap((node) => node.kind === "function" && node.location?.address != null
+        ? [
+            {
+                node,
+                address: node.location.address,
+                depth: depthByNode.get(node.id) ?? input.initial.reached_depth,
+            },
+        ]
+        : []);
+    const visited = new Set();
+    let queueIndex = 0;
+    let examined = 0;
+    let omitted = 0;
+    let truncated = false;
+    while (queueIndex < queue.length) {
+        const current = queue[queueIndex++];
+        if (current === undefined || visited.has(current.address))
+            continue;
+        visited.add(current.address);
+        if (current.depth >= input.input.max_depth) {
+            truncated = true;
+            omitted += 1;
+            continue;
+        }
+        if (nodes.size >= input.input.max_nodes) {
+            truncated = true;
+            omitted += queue.length - queueIndex + 1;
+            break;
+        }
+        const execution = await input.analysis.execute("procedure_callees", { procedure: current.address }, input.signal === undefined ? {} : { signal: input.signal });
+        examined += 1;
+        if (!execution.ok) {
+            if (execution.error._tag === "AnalysisCancelledError")
+                return { error: execution.error };
+            const id = `unknown-callees:${current.address}`;
+            edges.set(id, {
+                id,
+                from: current.node.id,
+                to: null,
+                relation: "direct_call",
+                resolution: "unresolved",
+                reason: projectAnalysisError(execution.error).message,
+                evidence: [],
+                limitations: [
+                    "The provider could not enumerate resolved direct callees.",
+                ],
+            });
+            continue;
+        }
+        const related = parseRelatedAddresses(execution.value.result, "callees");
+        if (!related.ok) {
+            const id = `unknown-callees:${current.address}`;
+            edges.set(id, {
+                id,
+                from: current.node.id,
+                to: null,
+                relation: "direct_call",
+                resolution: "unresolved",
+                reason: "provider_returned_unreadable_callee_relationships",
+                evidence: [],
+                limitations: [
+                    "The provider result could not be normalized into callee addresses.",
+                ],
+            });
+            continue;
+        }
+        for (const [index, address] of related.value.entries()) {
+            if (edges.size >= input.input.max_edges) {
+                truncated = true;
+                omitted += related.value.length - index;
+                break;
+            }
+            const targetId = `native:function:${address}`;
+            const evidence = [
+                {
+                    kind: "reference",
+                    description: `${execution.value.provider.name} resolved a direct callee from ${current.address} to ${address}`,
+                    location: { address: current.address, file_offset: null },
+                    artifact_path: null,
+                    artifact_sha256: input.targetSha256,
+                },
+            ];
+            if (!nodes.has(targetId)) {
+                if (nodes.size >= input.input.max_nodes) {
+                    truncated = true;
+                    omitted += 1;
+                    const id = `unknown-node-bound:${current.address}:${address}`;
+                    edges.set(id, {
+                        id,
+                        from: current.node.id,
+                        to: null,
+                        relation: "direct_call",
+                        resolution: "unresolved",
+                        reason: "native_trace_node_bound_reached",
+                        evidence,
+                        limitations: [],
+                    });
+                    continue;
+                }
+                const name = addressNames.get(address) ?? address;
+                const node = {
+                    id: targetId,
+                    kind: "function",
+                    name,
+                    location: { address, file_offset: null },
+                    attributes: { resolved_by: execution.value.provider.id },
+                    evidence,
+                };
+                nodes.set(targetId, node);
+                queue.push({ node, address, depth: current.depth + 1 });
+            }
+            const edgeId = `call:${current.address}:${address}`;
+            edges.set(edgeId, {
+                id: edgeId,
+                from: current.node.id,
+                to: targetId,
+                relation: "direct_call",
+                resolution: "observed",
+                evidence,
+                limitations: [
+                    "A resolved static call edge does not establish runtime reachability.",
+                ],
+            });
+        }
+    }
+    return {
+        nodes: [...nodes.values()],
+        edges: [...edges.values()],
+        examined,
+        omitted,
+        truncated,
+    };
+};
+const graphNodeDepths = (start, nodes, edges) => {
+    const known = new Set(nodes.map(({ id }) => id));
+    const depths = new Map([[start, 0]]);
+    const queue = [start];
+    for (let index = 0; index < queue.length; index += 1) {
+        const current = queue[index];
+        if (current === undefined)
+            continue;
+        const depth = depths.get(current) ?? 0;
+        for (const edge of edges) {
+            if (edge.resolution === "unresolved" ||
+                edge.from !== current ||
+                edge.to === null ||
+                !known.has(edge.to) ||
+                depths.has(edge.to))
+                continue;
+            depths.set(edge.to, depth + 1);
+            queue.push(edge.to);
+        }
+    }
+    return depths;
+};

package/dist/application/NodeRuntimeCharacterizationService.js

@@ -3,7 +3,7 @@ import { z } from "zod";
 import { nodeCharacterizationExecutionInputSchema, nodeCharacterizationExecutionOutputSchema, nodeCharacterizationPreparationInputSchema, nodeCharacterizationPreparationOutputSchema, } from "../domain/nodeRuntimeCharacterization.js";
 import { AnalysisInputError, AnalysisProtocolError, ReplayPlanStaleError, } from "../domain/errors.js";
 import { createEvidence } from "../domain/evidence.js";
-import { controlledReplayOutputSchema } from "../domain/javascriptReplay.js";
+import { controlledReplayOutputSchema, } from "../domain/javascriptReplay.js";
 import { createRuntimeCharacterizationPlan, } from "../domain/runtimeCharacterization.js";
 import { err, ok } from "../domain/result.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";
@@ -37,27 +37,28 @@ export const executeNodeCharacterization = async (dependencies, rawInput, option
     if (prepared.value.plan.plan_sha256 !== parsed.data.approved_plan_sha256)
         return err(new ReplayPlanStaleError(parsed.data.approved_plan_sha256, prepared.value.plan.plan_sha256));
     const plannedReplay = controlledReplayOutputSchema.parse(prepared.value.replay);
-    if (plannedReplay.phase !== "plan" || plannedReplay.plan === null)
+    if (plannedReplay.phase !== "plan")
         return err(new AnalysisProtocolError("Node characterization preparation did not produce a replay plan"));
     const host = new InstrumentedJavaScriptReplayHost(dependencies.host, parsed.data.preparation.instrumentation);
     const executed = await runControlledReplayValidated({ ...dependencies, host }, {
         ...parsed.data.preparation.replay,
         mode: "execute",
-        approved: true,
         plan_digest: plannedReplay.plan.plan_digest,
     }, options);
     if (!executed.ok)
         return executed;
+    const replayOutput = controlledReplayOutputSchema.parse(executed.value);
+    if (replayOutput.phase !== "execute")
+        return err(new AnalysisProtocolError("Node characterization execution omitted replay Evidence"));
     if (host.instrumentation === null)
         return err(new AnalysisProtocolError("Node characterization execution omitted instrumentation evidence"));
     return ok(jsonValueSchema.parse(nodeCharacterizationExecutionOutputSchema.parse({
-        schema_version: 1,
         phase: "execution",
         plan: prepared.value.plan,
         transformation: host.instrumentation.manifest,
         transformation_evidence: prepared.value.transformation_evidence,
-        evidence: createCharacterizationEvidence(prepared.value, controlledReplayOutputSchema.parse(executed.value)),
-        replay: controlledReplayOutputSchema.parse(executed.value),
+        evidence: createCharacterizationEvidence(prepared.value, replayOutput),
+        replay: replayOutput,
     })));
 };
 const prepareValidated = async (dependencies, input, options) => {
@@ -66,16 +67,13 @@ const prepareValidated = async (dependencies, input, options) => {
     if (!replay.ok)
         return replay;
     const output = controlledReplayOutputSchema.parse(replay.value);
-    if (output.phase !== "plan" ||
-        output.plan === null ||
-        host.instrumentation === null)
+    if (output.phase !== "plan" || host.instrumentation === null)
         return err(new AnalysisProtocolError("Node characterization preparation omitted committed plan evidence"));
     const module = output.plan.left.modules.find(({ alias }) => alias === input.selected_alias);
     if (module === undefined)
         return err(new AnalysisProtocolError("Node characterization replay plan omitted selected module"));
     const plan = createCharacterizationPlan(input, host.instrumentation, output.plan);
     return ok({
-        schema_version: 1,
         phase: "preparation",
         plan,
         transformation: host.instrumentation.manifest,
@@ -88,7 +86,7 @@ const createTransformationEvidence = (input, instrumentation) => createEvidence(
     sha256: input.instrumentation.artifact_sha256,
     format: "javascript-bundle",
 }, PROVIDER, {
-    predicateType: "rea.javascript-export-transformation/v1",
+    predicateType: "rea.javascript-export-transformation",
     operation: PREPARE_OPERATION,
     parameters: {
         selected_alias: input.selected_alias,
@@ -109,14 +107,12 @@ const createTransformationEvidence = (input, instrumentation) => createEvidence(
     ],
 });
 const createCharacterizationEvidence = (prepared, replay) => {
-    if (replay.phase !== "execute" || replay.evidence === null)
-        throw new AnalysisProtocolError("Node characterization execution omitted replay Evidence");
     return createEvidence({
         path: prepared.plan.artifact.path,
         sha256: prepared.plan.artifact.sha256,
         format: "javascript-bundle",
     }, PROVIDER, {
-        predicateType: "rea.runtime-characterization/v1",
+        predicateType: "rea.runtime-characterization",
         operation: EXECUTE_OPERATION,
         parameters: {
             plan_sha256: prepared.plan.plan_sha256,
@@ -142,7 +138,6 @@ const createCharacterizationEvidence = (prepared, replay) => {
     });
 };
 const createCharacterizationPlan = (input, instrumentation, replayPlan) => createRuntimeCharacterizationPlan({
-    schema_version: 1,
     preparation_sha256: digestPreparation(instrumentation.manifest.instrumented_sha256, replayPlan.plan_digest),
     artifact: {
         path: input.instrumentation.artifact_path,
@@ -191,6 +186,6 @@ const createCharacterizationPlan = (input, instrumentation, replayPlan) => creat
     },
 });
 const digestPreparation = (instrumentedSha256, replayPlanDigest) => createHash("sha256")
-    .update(`rea.node-characterization-preparation/v1\0${instrumentedSha256}\0${replayPlanDigest}`)
+    .update(`rea.node-characterization-preparation\0${instrumentedSha256}\0${replayPlanDigest}`)
     .digest("hex");
 const stableModuleId = (alias) => `module/${createHash("sha256").update(alias).digest("hex")}`;

package/dist/application/PermissionAuthority.js

@@ -1,7 +1,7 @@
 import { realpath } from "node:fs/promises";
 import { basename, dirname, join, resolve } from "node:path";
 import { consumePermission, clearSessionPermissions, createPermissionPolicy, evaluatePermission, grantPermission, reloadPermissionCeilings, revokePermission, } from "../domain/permissionPolicy.js";
-import { PermissionRequiredError } from "../domain/errors.js";
+import { PermissionRequiredError, } from "../domain/errors.js";
 import { err, ok } from "../domain/result.js";
 /** Failure to establish a filesystem object's canonical authorization identity. */
 export class PermissionPathError extends Error {
@@ -74,15 +74,15 @@ const errorReason = (error) => isNotFound(error) ? "not_found" : "io";
 export class PermissionAuthority {
     policy;
     configuredAuthority;
-    outsideCeilingRestartRequired;
-    constructor(policy, configuredAuthority, outsideCeilingRestartRequired = false) {
+    outsideCeilingRemediation;
+    constructor(policy, configuredAuthority, outsideCeilingRemediation = "configure") {
         this.policy = policy;
         this.configuredAuthority = configuredAuthority;
-        this.outsideCeilingRestartRequired = outsideCeilingRestartRequired;
+        this.outsideCeilingRemediation = outsideCeilingRemediation;
     }
     /** Create a connection-owned overlay for once and session grants. */
     createConnectionAuthority() {
-        return new PermissionAuthority(createPermissionPolicy([]), this.configuredAuthority ?? this, true);
+        return new PermissionAuthority(createPermissionPolicy([]), this.configuredAuthority ?? this, "restart");
     }
     /** Canonicalize and authorize one exact operation before its side effect. */
     async authorize(request, access, options = {}) {
@@ -168,8 +168,16 @@ export class PermissionAuthority {
         if (denied.allowed)
             return ok({ decision: denied, owner: this });
         const outsideAdministratorCeiling = denied.reason === "outside_administrator_ceiling";
-        return err(new PermissionRequiredError(request, denied.missing, ceilingFor(effective, request.capability), !outsideAdministratorCeiling && (options.elicitationSupported ?? false), options.restartRequired ??
-            (outsideAdministratorCeiling && this.outsideCeilingRestartRequired)));
+        const requestedRemediation = options.remediation ?? "configure";
+        const remediation = outsideAdministratorCeiling && requestedRemediation !== "restart"
+            ? this.outsideCeilingRemediation
+            : requestedRemediation;
+        return err(new PermissionRequiredError({
+            requested: request,
+            missing: denied.missing,
+            ceiling: ceilingFor(effective, request.capability),
+            remediation,
+        }));
     }
     /** Atomically replace optional persisted project grants. */
     async replaceProjectGrants(grants) {

package/dist/application/PermissionFailure.js

@@ -0,0 +1,5 @@
+import { AnalysisProtocolError, PermissionRequiredError, } from "../domain/errors.js";
+/** Preserve permission denials and project failed path resolution for callers. */
+export const projectPermissionFailure = (error) => error instanceof PermissionRequiredError
+    ? error
+    : new AnalysisProtocolError(error.message, { cause: error });

package/dist/application/ProcessCaptureAuthority.js

@@ -1,26 +1,24 @@
 import { realpath } from "node:fs/promises";
+import { isPathWithinRoot } from "../domain/localPath.js";
 import { ProcessCaptureError, processCaptureCancelled, } from "./ProcessCaptureError.js";
 import { canonicalizeConfiguredRoots } from "./ConfiguredRoots.js";
-const isWithin = (candidate, root) => candidate === root ||
-    candidate.startsWith(`${root.endsWith("/") ? root.slice(0, -1) : root}/`);
 export const assertRealPathAuthority = async (scenario, policy) => {
     const executable = await realpath(scenario.executable);
     const executableRoots = await canonicalizeConfiguredRoots(policy.executableRoots);
-    if (!executableRoots.some((root) => isWithin(executable, root)))
+    if (!executableRoots.some((root) => isPathWithinRoot(root, executable)))
         throw new ProcessCaptureError("resolved executable is outside approved roots");
     const workingDirectory = await realpath(scenario.working_directory);
     const workingRoots = await canonicalizeConfiguredRoots(policy.workingRoots);
-    if (!workingRoots.some((root) => isWithin(workingDirectory, root)))
+    if (!workingRoots.some((root) => isPathWithinRoot(root, workingDirectory)))
         throw new ProcessCaptureError("resolved working directory is outside approved roots");
     for (const root of scenario.filesystem_roots) {
         const resolvedRoot = await realpath(root);
-        if (!workingRoots.some((approved) => isWithin(resolvedRoot, approved)))
+        if (!workingRoots.some((approved) => isPathWithinRoot(approved, resolvedRoot)))
             throw new ProcessCaptureError("resolved filesystem root is outside approved roots");
     }
 };
-/** Expected refusal or runtime failure from the process capture adapter. */
+/** Reject cancellation before a process capture operation begins. */
 export const assertNotCancelled = (signal) => {
     if (signal?.aborted === true)
         throw processCaptureCancelled();
 };
-/** Runtime availability of the native PTY adapter on this host. */

package/dist/application/ProcessCaptureJournal.js

@@ -1,4 +1,5 @@
 import { normalizeProcessElapsedTime, normalizeProcessText, } from "./ProcessNormalization.js";
+import { scheduleProcessDelay } from "./ProcessTimer.js";
 /** Create one monotonic event journal for a process capture. */
 export const createProcessCaptureJournal = () => {
     const entries = [];
@@ -51,7 +52,7 @@ export const createProcessCaptureJournal = () => {
 export const scheduleScenarioInteractions = (options) => {
     const { scenario, getTerminal, timers, interactions, renderer, started } = options;
     for (const [eventIndex, event] of scenario.events.entries()) {
-        const timer = setTimeout(() => {
+        const timer = scheduleProcessDelay(event.at_ms, () => {
             options.dispatchedEventIndexes.add(eventIndex);
             const terminal = getTerminal();
             const dispatchedAt = Math.max(0, Date.now() - started);
@@ -89,7 +90,7 @@ export const scheduleScenarioInteractions = (options) => {
                 outcome,
             });
             options.recordEvent("interaction_events", sequence);
-        }, event.at_ms);
+        });
         timers.add(timer);
     }
 };