rea-agents 3.0.0 → 3.2.0

package/dist/artifacts/DirectoryArtifactReader.js

@@ -74,15 +74,20 @@ export class DirectoryArtifactReader {
         if (entry.kind !== "file")
             throw new ArtifactReaderFailure("format", "Only regular files can be opened");
         const handle = await open(entry.adapterKey, constants.O_RDONLY | constants.O_NOFOLLOW);
-        const observed = await handle.stat();
-        if (!observed.isFile() ||
-            entry.sourceIdentity === undefined ||
-            observed.dev !== entry.sourceIdentity.device ||
-            observed.ino !== entry.sourceIdentity.inode) {
-            await handle.close();
-            throw new ArtifactReaderFailure("integrity", `Directory entry changed before open: ${entry.path}`);
+        try {
+            const observed = await handle.stat();
+            if (!observed.isFile() ||
+                entry.sourceIdentity === undefined ||
+                observed.dev !== entry.sourceIdentity.device ||
+                observed.ino !== entry.sourceIdentity.inode) {
+                throw new ArtifactReaderFailure("integrity", `Directory entry changed before open: ${entry.path}`);
+            }
+            return handle.createReadStream({ autoClose: true });
+        }
+        catch (cause) {
+            await handle.close().catch(() => undefined);
+            throw cause;
         }
-        return handle.createReadStream({ autoClose: true });
     }
     close() {
         return Promise.resolve();

package/dist/artifacts/MachOSliceArtifactReader.js

@@ -13,11 +13,7 @@ export class MachOSliceArtifactReader {
         this.runner = runner;
     }
     async *entries(signal) {
-        const captured = await this.runner.run("lipo", ["-detailed_info", this.path], {
-            ...(signal === undefined ? {} : { signal }),
-            timeoutMs: 30_000,
-            maxOutputBytes: 4 * 1024 * 1024,
-        });
+        const captured = await this.runner.run("lipo", ["-detailed_info", this.path], signal === undefined ? {} : { signal });
         if (!captured.ok)
             throw new ArtifactReaderFailure(captured.error.reason === "cancelled" ? "cancelled" : "unavailable", "lipo could not enumerate universal Mach-O slices", { cause: captured.error });
         this.#command = {

package/dist/artifacts/NativeDmgArtifactReader.js

@@ -1,13 +1,12 @@
-import { execFile } from "node:child_process";
 import { mkdtemp, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { basename, join } from "node:path";
-import { promisify } from "node:util";
 import { parse } from "plist";
 import { z } from "zod";
 import { ArtifactReaderFailure, } from "./ArtifactReader.js";
 import { DirectoryArtifactReader } from "./DirectoryArtifactReader.js";
-const execFileAsync = promisify(execFile);
+import { execFileOutput } from "../process/ExecFileOutput.js";
+const DETACH_TIMEOUT_MS = 120_000;
 const attachOutputSchema = z.object({
     "system-entities": z.array(z.object({
         "dev-entry": z.string().startsWith("/dev/"),
@@ -15,11 +14,10 @@ const attachOutputSchema = z.object({
     })),
 });
 const systemHost = {
-    async run(arguments_, signal) {
+    async run(arguments_, signal, options) {
         try {
-            const { stdout } = await execFileAsync("/usr/bin/hdiutil", [...arguments_], {
-                encoding: "utf8",
-                timeout: 120_000,
+            const { stdout } = await execFileOutput("/usr/bin/hdiutil", [...arguments_], {
+                ...(options === undefined ? {} : { timeout: options.timeoutMs }),
                 ...(signal === undefined ? {} : { signal }),
             });
             return { stdout, exitCode: 0 };
@@ -48,7 +46,7 @@ export class NativeDmgArtifactReader {
     }
     /** Verify and attach one image beneath an exclusively owned temporary root. */
     static async create(path, signal, host = systemHost) {
-        if (process.platform !== "darwin")
+        if (process.platform !== "darwin" && host === systemHost)
             throw new ArtifactReaderFailure("unavailable", "Native DMG traversal is available only on macOS");
         const reader = new NativeDmgArtifactReader(path, host);
         await reader.attach(signal);
@@ -73,7 +71,9 @@ export class NativeDmgArtifactReader {
         let detachFailure;
         for (const device of [...this.#devices].reverse()) {
             try {
-                await runChecked(this.host, ["detach", device]);
+                await runChecked(this.host, ["detach", device], undefined, {
+                    timeoutMs: DETACH_TIMEOUT_MS,
+                });
                 this.#provenance.push(command(["detach", device], ["mount"]));
             }
             catch (cause) {
@@ -135,8 +135,8 @@ export class NativeDmgArtifactReader {
         }
     }
 }
-const runChecked = async (host, arguments_, signal) => {
-    const result = await host.run(arguments_, signal);
+const runChecked = async (host, arguments_, signal, options) => {
+    const result = await host.run(arguments_, signal, options);
     if (result.exitCode !== 0)
         throw new ArtifactReaderFailure("unavailable", `hdiutil ${arguments_[0] ?? "operation"} failed with a non-zero exit code`);
     return { stdout: result.stdout, exitCode: 0 };

package/dist/artifacts/NibArchive.js

@@ -0,0 +1,269 @@
+import { TextDecoder } from "node:util";
+const MAGIC = Buffer.from("NIBArchive", "ascii");
+const MAX_RECORDS = 1_000_000;
+/** Decode Apple's length-prefixed NIBArchive representation without loading UI classes. */
+export const decodeNibArchive = (bytes) => {
+    if (bytes.length < 50 || !bytes.subarray(0, MAGIC.length).equals(MAGIC))
+        throw new TypeError("NIBArchive magic or header is invalid");
+    const formatVersion = readU32(bytes, 10);
+    const coderVersion = readU32(bytes, 14);
+    if (formatVersion !== 1)
+        throw new TypeError(`Unsupported NIBArchive format version ${formatVersion}`);
+    const objectCount = readCount(bytes, 18, "object");
+    const objectsOffset = readOffset(bytes, 22, bytes.length, "object");
+    const keyCount = readCount(bytes, 26, "key");
+    const keysOffset = readOffset(bytes, 30, bytes.length, "key");
+    const valueCount = readCount(bytes, 34, "value");
+    const valuesOffset = readOffset(bytes, 38, bytes.length, "value");
+    const classCount = readCount(bytes, 42, "class");
+    const classesOffset = readOffset(bytes, 46, bytes.length, "class");
+    assertOrderedOffsets(bytes.length, [
+        objectsOffset,
+        keysOffset,
+        valuesOffset,
+        classesOffset,
+    ]);
+    const objectRecords = parseObjects(bytes, objectsOffset, keysOffset, objectCount, valueCount, classCount);
+    const keys = parseStrings(bytes, keysOffset, valuesOffset, keyCount, "key");
+    const classes = parseClasses(bytes, classesOffset, bytes.length, classCount);
+    const neededValues = valueIndexes(objectRecords, valueCount);
+    const values = parseValues(bytes, valuesOffset, classesOffset, valueCount, keyCount, neededValues);
+    for (const { value } of values.values()) {
+        if (typeof value === "object" &&
+            value !== null &&
+            !Array.isArray(value) &&
+            typeof value.$nib_object_ref === "number" &&
+            value.$nib_object_ref >= objectCount)
+            throw new TypeError("NIBArchive object reference is outside the object table");
+    }
+    const objects = objectRecords.flatMap((object, id) => {
+        const className = classes[object.class_index];
+        if (className === undefined)
+            return [];
+        const fields = {};
+        for (let index = object.value_start; index < object.value_start + object.value_count; index += 1) {
+            const value = values.get(index);
+            if (value === undefined)
+                continue;
+            const key = keys[value.key_index];
+            if (key !== undefined)
+                fields[key] = value.value;
+        }
+        return [{ id, class_name: className, values: fields }];
+    });
+    let connectionObjectCount = 0;
+    for (const object of objects)
+        if (/(?:Outlet|Connection|Segue|ActionConnection)/iu.test(object.class_name))
+            connectionObjectCount += 1;
+    return {
+        format_version: formatVersion,
+        coder_version: coderVersion,
+        object_count: objectCount,
+        connection_object_count: connectionObjectCount,
+        objects,
+        classes,
+        limitations: [
+            "NIBArchive class extensions and unsupported value encodings are retained as unavailable fields.",
+            "NIBArchive object relationships are decoded from serialized references; runtime object creation and execution are not performed.",
+        ],
+    };
+};
+const parseObjects = (bytes, start, end, count, valueCount, classCount) => {
+    const cursor = { offset: start };
+    const output = [];
+    for (let index = 0; index < count; index += 1) {
+        const classIndex = readVarint(bytes, cursor, end);
+        const valueStart = readVarint(bytes, cursor, end);
+        const countForObject = readVarint(bytes, cursor, end);
+        if (classIndex >= classCount ||
+            valueStart > valueCount ||
+            countForObject > valueCount - valueStart)
+            throw new TypeError(`NIBArchive object ${index} references an invalid table range`);
+        output.push({
+            class_index: classIndex,
+            value_start: valueStart,
+            value_count: countForObject,
+        });
+    }
+    if (cursor.offset > end)
+        throw new TypeError("NIBArchive object table overlaps the next table");
+    return output;
+};
+const parseStrings = (bytes, start, end, count, label) => {
+    const cursor = { offset: start };
+    const output = [];
+    for (let index = 0; index < count; index += 1) {
+        const length = readVarint(bytes, cursor, end);
+        const next = checkedEnd(cursor.offset, length, end, `${label} ${index}`);
+        const value = decodeUtf8(bytes, cursor.offset, next, `${label} ${index}`);
+        cursor.offset = next;
+        output.push(value);
+    }
+    return output;
+};
+const parseClasses = (bytes, start, end, count) => {
+    const cursor = { offset: start };
+    const output = [];
+    for (let index = 0; index < count; index += 1) {
+        const length = readVarint(bytes, cursor, end);
+        const extraCount = readVarint(bytes, cursor, end);
+        if (extraCount > 16)
+            throw new TypeError(`NIBArchive class ${index} has too many extension values`);
+        ensureRange(cursor.offset, extraCount * 4, end, `class ${index} extensions`);
+        cursor.offset += extraCount * 4;
+        const next = checkedEnd(cursor.offset, length, end, `class ${index}`);
+        const name = decodeUtf8(bytes, cursor.offset, next, `class ${index}`).replace(/\0+$/u, "");
+        cursor.offset = next;
+        output.push(name);
+    }
+    return output;
+};
+const parseValues = (bytes, start, end, count, keyCount, needed) => {
+    const cursor = { offset: start };
+    const output = new Map();
+    for (let index = 0; index < count; index += 1) {
+        const keyIndex = readVarint(bytes, cursor, end);
+        if (keyIndex >= keyCount)
+            throw new TypeError(`NIBArchive value ${index} references an invalid key`);
+        ensureRange(cursor.offset, 1, end, `value ${index} type`);
+        const type = bytes[cursor.offset++] ?? -1;
+        const value = readValue(bytes, cursor, end, type, index);
+        if (needed.has(index))
+            output.set(index, { key_index: keyIndex, value });
+    }
+    if (cursor.offset > end)
+        throw new TypeError("NIBArchive value table overlaps the next table");
+    return output;
+};
+const readValue = (bytes, cursor, end, type, index) => {
+    switch (type) {
+        case 0:
+            ensureRange(cursor.offset, 1, end, `value ${index}`);
+            return bytes.readInt8(cursor.offset++);
+        case 1:
+            ensureRange(cursor.offset, 2, end, `value ${index}`);
+            {
+                const value = bytes.readInt16LE(cursor.offset);
+                cursor.offset += 2;
+                return value;
+            }
+        case 2:
+            ensureRange(cursor.offset, 4, end, `value ${index}`);
+            {
+                const value = bytes.readInt32LE(cursor.offset);
+                cursor.offset += 4;
+                return value;
+            }
+        case 3:
+            ensureRange(cursor.offset, 8, end, `value ${index}`);
+            {
+                const value = bytes.readBigInt64LE(cursor.offset);
+                cursor.offset += 8;
+                return value <= BigInt(Number.MAX_SAFE_INTEGER) &&
+                    value >= BigInt(Number.MIN_SAFE_INTEGER)
+                    ? Number(value)
+                    : value.toString();
+            }
+        case 4:
+            return true;
+        case 5:
+            return false;
+        case 6:
+            ensureRange(cursor.offset, 4, end, `value ${index}`);
+            {
+                const value = bytes.readFloatLE(cursor.offset);
+                cursor.offset += 4;
+                return Number.isFinite(value) ? value : null;
+            }
+        case 7:
+            ensureRange(cursor.offset, 8, end, `value ${index}`);
+            {
+                const value = bytes.readDoubleLE(cursor.offset);
+                cursor.offset += 8;
+                return Number.isFinite(value) ? value : null;
+            }
+        case 8: {
+            const length = readVarint(bytes, cursor, end);
+            const next = checkedEnd(cursor.offset, length, end, `value ${index} data`);
+            const encoded = bytes.subarray(cursor.offset, next).toString("base64");
+            cursor.offset = next;
+            return { $nib_data_base64: encoded };
+        }
+        case 9:
+            return null;
+        case 10:
+            ensureRange(cursor.offset, 4, end, `value ${index} reference`);
+            {
+                const objectIndex = bytes.readUInt32LE(cursor.offset);
+                cursor.offset += 4;
+                return { $nib_object_ref: objectIndex };
+            }
+        default:
+            throw new TypeError(`NIBArchive value ${index} has unsupported type ${type}`);
+    }
+};
+const valueIndexes = (objects, total) => {
+    const indexes = new Set();
+    for (const object of objects)
+        for (let index = object.value_start; index < object.value_start + object.value_count; index += 1)
+            indexes.add(index);
+    if (indexes.size > total)
+        throw new TypeError("NIBArchive object value ranges exceed the value table");
+    return indexes;
+};
+const readCount = (bytes, offset, label) => {
+    const count = readU32(bytes, offset);
+    if (count > MAX_RECORDS)
+        throw new TypeError(`NIBArchive ${label} count exceeds the decoder bound`);
+    return count;
+};
+const readOffset = (bytes, offset, fileLength, label) => {
+    const value = readU32(bytes, offset);
+    if (value < 50 || value > fileLength)
+        throw new TypeError(`NIBArchive ${label} table offset is invalid`);
+    return value;
+};
+const readU32 = (bytes, offset) => {
+    ensureRange(offset, 4, bytes.length, "header");
+    return bytes.readUInt32LE(offset);
+};
+const decodeUtf8 = (bytes, start, end, label) => {
+    try {
+        return new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(start, end));
+    }
+    catch {
+        throw new TypeError(`NIBArchive ${label} is not valid UTF-8`);
+    }
+};
+const readVarint = (bytes, cursor, end) => {
+    let value = 0;
+    let shift = 0;
+    for (let index = 0; index < 5; index += 1) {
+        ensureRange(cursor.offset, 1, end, "variable integer");
+        const byte = bytes[cursor.offset++] ?? 0;
+        value += (byte & 0x7f) * 2 ** shift;
+        if ((byte & 0x80) !== 0) {
+            if (value > 0x7fff_ffff)
+                throw new TypeError("NIBArchive variable integer is out of range");
+            return value;
+        }
+        shift += 7;
+    }
+    throw new TypeError("NIBArchive variable integer is too long");
+};
+const checkedEnd = (start, length, limit, label) => {
+    if (!Number.isSafeInteger(length) || length < 0 || start + length > limit)
+        throw new TypeError(`NIBArchive ${label} exceeds its table`);
+    return start + length;
+};
+const ensureRange = (start, length, limit, label) => {
+    checkedEnd(start, length, limit, label);
+};
+const assertOrderedOffsets = (length, offsets) => {
+    let previous = 50;
+    for (const offset of offsets) {
+        if (offset < previous || offset > length)
+            throw new TypeError("NIBArchive table offsets are out of order");
+        previous = offset;
+    }
+};

package/dist/artifacts/SafeOutputTree.js

@@ -1,30 +1,23 @@
 import { createHash } from "node:crypto";
 import { constants } from "node:fs";
-import { lstat, mkdir, open, realpath, rm } from "node:fs/promises";
+import { lstat, mkdir, open, realpath, rm, } from "node:fs/promises";
 import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { streamChunkToBuffer } from "./StreamBytes.js";
 import { ArtifactPathRegistry, normalizeArtifactPath, } from "./ArtifactPaths.js";
-import { ArtifactReaderFailure, } from "./ArtifactReader.js";
+import { ArtifactReaderFailure } from "./ArtifactReader.js";
 /** Symlink-resistant materialization in an exclusively owned, initially absent tree. */
 export class SafeOutputTree {
     #registry = new ArtifactPathRegistry();
-    #limits;
     #outputRoot;
-    #stagingRoot;
-    #totalBytes = 0;
     #published = false;
     #cleanup = {
-        attempted: false,
-        verified: false,
-        residualPaths: [],
+        status: "not-required",
     };
-    constructor(outputRoot, stagingRoot, limits) {
+    constructor(outputRoot) {
         this.#outputRoot = outputRoot;
-        this.#stagingRoot = stagingRoot;
-        this.#limits = limits;
     }
     /** Exclusively create the absent destination as this operation's owned tree. */
-    static async create(outputRoot, limits) {
+    static async create(outputRoot) {
         if (!isAbsolute(outputRoot))
             throw new ArtifactReaderFailure("path", "Extraction output root must be absolute");
         const requested = resolve(outputRoot);
@@ -48,7 +41,7 @@ export class SafeOutputTree {
             finally {
                 await stagingHandle.close();
             }
-            return new SafeOutputTree(canonicalOutput, canonicalOutput, limits);
+            return new SafeOutputTree(canonicalOutput);
         }
         catch (cause) {
             await rm(canonicalOutput, { recursive: true, force: true });
@@ -61,10 +54,10 @@ export class SafeOutputTree {
     get cleanup() {
         return structuredClone(this.#cleanup);
     }
-    /** Stream one selected regular file with exact byte and digest verification. */
+    /** Stream one regular file with exact byte and digest verification. */
     async write(relativePath, source, expectedSha256, signal) {
         this.#assertWritable();
-        const path = normalizeArtifactPath(relativePath, this.#limits);
+        const path = normalizeArtifactPath(relativePath);
         this.#registry.add(path, "file");
         const destination = await this.#prepareParent(path);
         const handle = await open(destination, constants.O_CREAT |
@@ -80,10 +73,6 @@ export class SafeOutputTree {
                 abortIfNeeded(signal);
                 const chunk = streamChunkToBuffer(raw);
                 bytes += chunk.length;
-                if (bytes > this.#limits.maxEntryBytes)
-                    throw new ArtifactReaderFailure("limit", `Observed entry bytes exceed limit: ${path}`);
-                if (this.#totalBytes + bytes > this.#limits.maxTotalBytes)
-                    throw new ArtifactReaderFailure("limit", "Observed extraction bytes exceed cumulative limit");
                 hash.update(chunk);
                 await writeAll(handle, chunk);
             }
@@ -95,7 +84,6 @@ export class SafeOutputTree {
             const readback = await hashFile(destination, bytes, signal);
             if (readback.sha256 !== sha256 || readback.bytes !== bytes)
                 throw new ArtifactReaderFailure("integrity", `Durable readback verification failed: ${path}`);
-            this.#totalBytes += bytes;
             return { relativePath: path, sha256, bytesWritten: bytes };
         }
         catch (cause) {
@@ -107,9 +95,10 @@ export class SafeOutputTree {
     async commit() {
         this.#assertWritable();
         const parent = await open(dirname(this.#outputRoot), constants.O_RDONLY | constants.O_DIRECTORY);
-        const staging = await open(this.#stagingRoot, constants.O_RDONLY | constants.O_DIRECTORY);
+        let output;
         try {
-            await staging.sync();
+            output = await open(this.#outputRoot, constants.O_RDONLY | constants.O_DIRECTORY);
+            await output.sync();
             await parent.sync();
             this.#published = true;
         }
@@ -117,20 +106,21 @@ export class SafeOutputTree {
             throw new ArtifactReaderFailure("path", "Could not durably sync extraction output", { cause });
         }
         finally {
-            await Promise.allSettled([parent.close(), staging.close()]);
+            await Promise.allSettled([parent.close(), output?.close()]);
         }
     }
     /** Remove only this operation's unsealed tree and verify absence. */
     async rollback() {
         if (this.#published)
             return structuredClone(this.#cleanup);
-        await rm(this.#stagingRoot, { recursive: true, force: true });
-        const absent = await isAbsent(this.#stagingRoot);
-        this.#cleanup = {
-            attempted: true,
-            verified: absent,
-            residualPaths: absent ? [] : [basename(this.#stagingRoot)],
-        };
+        await rm(this.#outputRoot, { recursive: true, force: true });
+        const absent = await isAbsent(this.#outputRoot);
+        this.#cleanup = absent
+            ? { status: "complete", residualPaths: [] }
+            : {
+                status: "incomplete",
+                residualPaths: [basename(this.#outputRoot)],
+            };
         if (!absent)
             throw new ArtifactReaderFailure("integrity", "Extraction output cleanup could not be verified");
         return structuredClone(this.#cleanup);
@@ -140,7 +130,7 @@ export class SafeOutputTree {
         const fileName = parts.pop();
         if (fileName === undefined)
             throw new ArtifactReaderFailure("path", "Invalid extraction path");
-        let current = this.#stagingRoot;
+        let current = this.#outputRoot;
         for (const part of parts) {
             current = join(current, part);
             await mkdir(current, { mode: 0o700 }).catch((cause) => {

package/dist/browser/BrowserProcessStartup.js

@@ -69,7 +69,7 @@ const startupError = (options, startedAt, state) => new BrowserStartupError({
     elapsedMs: Math.max(0, Math.round(performance.now() - startedAt)),
     exitCode: options.child.exitCode,
     signalCode: options.child.signalCode,
-    stderr: boundedStderr(options.stderr()),
+    stderr: options.stderr(),
 }, state.failure === "spawn-error" ? { cause: state.cause } : undefined);
 const readDevtoolsPort = async (path) => {
     try {
@@ -83,6 +83,5 @@ const readDevtoolsPort = async (path) => {
         return null;
     }
 };
-const boundedStderr = (stderr) => stderr.length <= 65_536 ? stderr : stderr.slice(-65_536);
 const delay = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds));
 const browserStartupMessage = (failure, diagnostics) => `Chrome CDP startup ${failure}; executable=${diagnostics.executable}; elapsed_ms=${String(diagnostics.elapsedMs)}; exit_code=${diagnostics.exitCode === null ? "null" : String(diagnostics.exitCode)}; signal=${diagnostics.signalCode ?? "null"}; stderr=${diagnostics.stderr.length === 0 ? "<empty>" : diagnostics.stderr}`;

package/dist/browser/CdpAuthorizedMainFrame.js

@@ -0,0 +1,16 @@
+import { BrowserObservationError } from "../domain/errors.js";
+import { mainFrameUrl } from "./CdpCaptureDocuments.js";
+import { allowedSanitizedUrl, delayWithCancellation, isHttpUrl, } from "./CdpCaptureValues.js";
+/** Wait for the attached target's main frame to enter its approved origin. */
+export const authorizedMainFrame = async ({ connection, sessionId, signal, allowedOrigins, delayOperation, }) => {
+    for (let attempt = 0; attempt < 80; attempt += 1) {
+        const result = await connection.send("Page.getFrameTree", {}, sessionId, signal);
+        const url = mainFrameUrl(result);
+        if (allowedSanitizedUrl(url, allowedOrigins) !== undefined)
+            return result;
+        if (isHttpUrl(url))
+            throw new BrowserObservationError("inspect_web_page", "target_not_allowed");
+        await delayWithCancellation(25, delayOperation, signal);
+    }
+    throw new BrowserObservationError("inspect_web_page", "target_not_allowed");
+};

package/dist/browser/CdpBrowserProvider.js

@@ -33,19 +33,9 @@ export class CdpBrowserProvider {
             const discovery = await discoverCdpEndpoint(input.cdp_endpoint, "list_browser_targets", options.signal);
             const allowedOrigins = new Set(input.allowed_origins);
             const selected = selectTargets(discovery, allowedOrigins);
-            const items = selected.allowed.slice(input.offset, input.offset + input.limit);
-            const nextOffset = input.offset + items.length;
             return ok(browserTargetListSchema.parse({
-                schema_version: 1,
                 browser: discovery.version,
-                targets: {
-                    items,
-                    offset: input.offset,
-                    limit: input.limit,
-                    total: selected.allowed.length,
-                    next_offset: nextOffset < selected.allowed.length ? nextOffset : null,
-                    has_more: nextOffset < selected.allowed.length,
-                },
+                targets: selected.allowed,
                 excluded: selected.excluded,
                 limitations: [
                     "Only page targets whose current URL matches an approved exact origin are listed.",
@@ -76,7 +66,7 @@ export class CdpBrowserProvider {
             const sourceMaps = input.fetch_source_maps
                 ? await fetchWebSourceMaps(captured.sourceMapRequests, input, options.signal)
                 : undefined;
-            return ok(webBundleAnalysisSchema.parse(analyzeCapturedWebBundle(captured.inspection, input, sourceMaps)));
+            return ok(webBundleAnalysisSchema.parse(analyzeCapturedWebBundle(captured.inspection, sourceMaps)));
         }
         catch (cause) {
             return err(providerError(cause, "analyze_web_bundle"));
@@ -228,7 +218,7 @@ const selectTargets = (discovery, allowedOrigins) => {
         allowed.push({
             target_id: target.id,
             type: target.type,
-            title: target.title.slice(0, 16_384),
+            title: target.title,
             url: url.url,
             origin: url.origin,
             attached: target.attached,

package/dist/browser/CdpCanonicalJsonDigest.js

@@ -0,0 +1,9 @@
+import { createHash } from "node:crypto";
+import canonicalize from "canonicalize";
+/** Hash a value using the canonical JSON representation. */
+export const canonicalJsonDigest = (value) => {
+    const encoded = canonicalize(value);
+    if (encoded === undefined)
+        throw new TypeError("Expected canonical JSON");
+    return createHash("sha256").update(encoded).digest("hex");
+};