rea-agents 3.0.0 → 3.2.0

package/dist/cliApplicationCommands.js

@@ -1,22 +1,26 @@
 import { Cli, z } from "incur";
 import { compareApplicationVersionsEvidenceValidated, compareJavaScriptExportShapesEvidenceValidated, compareSourceToBundleEvidenceValidated, traceApplicationFeatureEvidenceValidated, } from "./application/JavaScriptApplicationWorkflowService.js";
 import { traceJavaScriptSemanticsEvidenceValidated } from "./application/JavaScriptSemanticTraceService.js";
-import { resolveCompareApplicationVersionsRequest, resolveCompareJavaScriptExportShapesRequest, resolveCompareSourceToBundleRequest, resolveTraceApplicationFeatureRequest, resolveTraceJavaScriptSemanticsRequest, } from "./application/ApplicationWorkflowEvidenceResolver.js";
-import { readEvidenceBundle } from "./application/EvidenceBundleFiles.js";
 import { runControlledReplay } from "./application/JavaScriptReplayService.js";
 import { executeNodeCharacterization, prepareNodeCharacterization, } from "./application/NodeRuntimeCharacterizationService.js";
-import { commitReconstructionCoverage, queryReconstructionCoverage, reconstructionCoverageCommitInputSchema, reconstructionCoverageQueryInputSchema, } from "./application/ReconstructionCoverageService.js";
-import { buildReconstructionObligationLedgerEvidenceValidated, resolveReconstructionObligationLedgerRequest, } from "./application/ReconstructionObligationLedgerService.js";
-import { evaluateReconstructionReadinessValidated, resolveReconstructionReadinessRequest, } from "./application/ReconstructionReadinessService.js";
-import { authorizeFileReadWithDeferredWrite, authorizeRootPermission, } from "./application/DeferredFileAuthorization.js";
+import { evaluateReconstructionCoverage, reconstructionCoverageEvaluationInputSchema, } from "./application/ReconstructionCoverageService.js";
+import { buildReconstructionObligationLedgerEvidenceValidated } from "./application/ReconstructionObligationLedgerService.js";
 import { loadConfiguredPermissionAuthority } from "./application/PermissionConfiguration.js";
 import { CLI_COMMANDS } from "./cliCommandNames.js";
 import { parseCliJsonInput } from "./cliJsonInput.js";
 import { logCliCommand } from "./cliLogging.js";
 import { AnalysisInputError, projectAnalysisError, } from "./domain/errors.js";
+import { jsonValueSchema } from "./domain/jsonValue.js";
 import { parseConfig } from "./config.js";
 import { LinuxJavaScriptReplayRunner } from "./replay/LinuxJavaScriptReplayRunner.js";
 import { SystemJavaScriptReplayHost } from "./replay/SystemJavaScriptReplayHost.js";
+import { traceApplicationFeatureInputSchema } from "./domain/javascriptFeatureTraceSchemas.js";
+import { traceJavaScriptSemanticsInputSchema } from "./domain/javascriptSemanticTraceSchemas.js";
+import { compareApplicationVersionsInputSchema } from "./domain/javascriptApplicationVersionComparisonSchemas.js";
+import { compareSourceToBundleInputSchema } from "./domain/sourceToBundleComparisonSchemas.js";
+import { compareJavaScriptExportShapesInputSchema } from "./domain/javascriptExportShapeComparisonSchemas.js";
+import { projectInputIssues } from "./domain/inputIssueProjection.js";
+import { reconstructionObligationLedgerInputSchema } from "./domain/reconstructionObligationLedgerSchemas.js";
 /** Register CLI equivalents of provider-neutral application graph workflows. */
 export const registerApplicationCommands = (cli, logger) => {
     registerJsonCommand({
@@ -24,7 +28,7 @@ export const registerApplicationCommands = (cli, logger) => {
         logger,
         name: CLI_COMMANDS.traceApplicationFeature,
         description: "Trace a typed seed through authenticated application Evidence JSON",
-        resolveInput: resolveTraceApplicationFeatureRequest,
+        inputSchema: traceApplicationFeatureInputSchema,
         workflow: traceApplicationFeatureEvidenceValidated,
     });
     registerJsonCommand({
@@ -32,7 +36,7 @@ export const registerApplicationCommands = (cli, logger) => {
         logger,
         name: CLI_COMMANDS.traceJavaScriptSemantics,
         description: "Trace bounded static semantic relations through authenticated application Evidence",
-        resolveInput: resolveTraceJavaScriptSemanticsRequest,
+        inputSchema: traceJavaScriptSemanticsInputSchema,
         workflow: traceJavaScriptSemanticsEvidenceValidated,
     });
     registerJsonCommand({
@@ -40,7 +44,7 @@ export const registerApplicationCommands = (cli, logger) => {
         logger,
         name: CLI_COMMANDS.compareApplicationVersions,
         description: "Compare two authenticated JavaScript Application Graph versions",
-        resolveInput: resolveCompareApplicationVersionsRequest,
+        inputSchema: compareApplicationVersionsInputSchema,
         workflow: compareApplicationVersionsEvidenceValidated,
     });
     registerJsonCommand({
@@ -48,7 +52,7 @@ export const registerApplicationCommands = (cli, logger) => {
         logger,
         name: CLI_COMMANDS.compareSourceToBundle,
         description: "Compare committed historical source with authenticated application Evidence",
-        resolveInput: resolveCompareSourceToBundleRequest,
+        inputSchema: compareSourceToBundleInputSchema,
         workflow: compareSourceToBundleEvidenceValidated,
     });
     registerJsonCommand({
@@ -56,7 +60,7 @@ export const registerApplicationCommands = (cli, logger) => {
         logger,
         name: CLI_COMMANDS.compareJavaScriptExportShapes,
         description: "Compare exact static JavaScript export return shapes without execution",
-        resolveInput: resolveCompareJavaScriptExportShapesRequest,
+        inputSchema: compareJavaScriptExportShapesInputSchema,
         workflow: compareJavaScriptExportShapesEvidenceValidated,
     });
     cli.command(CLI_COMMANDS.runControlledReplay, {
@@ -75,7 +79,7 @@ export const registerApplicationCommands = (cli, logger) => {
             if (!authority.ok)
                 return projectAnalysisError(authority.error);
             const result = await runControlledReplay({
-                policy: config.value.javascriptReplayPolicy,
+                policy: () => config.value.javascriptReplayPolicy,
                 host: new SystemJavaScriptReplayHost(),
                 runner: new LinuxJavaScriptReplayRunner(),
                 authority: authority.value,
@@ -98,24 +102,20 @@ export const registerApplicationCommands = (cli, logger) => {
         workflow: (config, authority, input) => executeNodeCharacterization(replayDependencies(config, authority), input),
     });
     registerObligationLedgerCommand(cli, logger);
-    registerReadinessCommand(cli, logger);
-    registerCoverageCommands(cli, logger);
+    registerCoverageCommand(cli, logger);
 };
 const registerObligationLedgerCommand = (cli, logger) => registerJsonCommand({
     cli,
     logger,
     name: CLI_COMMANDS.buildReconstructionObligationLedger,
     description: "Generate a deterministic Evidence-backed reconstruction obligation ledger page",
-    resolveInput: resolveReconstructionObligationLedgerRequest,
-    workflow: buildReconstructionObligationLedgerEvidenceValidated,
-});
-const registerReadinessCommand = (cli, logger) => registerJsonCommand({
-    cli,
-    logger,
-    name: CLI_COMMANDS.evaluateReconstructionReadiness,
-    description: "Evaluate a complete Evidence-backed reconstruction readiness journey",
-    resolveInput: resolveReconstructionReadinessRequest,
-    workflow: evaluateReconstructionReadinessValidated,
+    inputSchema: reconstructionObligationLedgerInputSchema,
+    workflow: (input) => {
+        const result = buildReconstructionObligationLedgerEvidenceValidated(input);
+        return result.ok
+            ? { ok: true, value: jsonValueSchema.parse(result.value) }
+            : result;
+    },
 });
 const registerAuthorizedJsonCommand = ({ cli, logger, name, description, workflow, }) => {
     cli.command(name, {
@@ -135,57 +135,19 @@ const registerAuthorizedJsonCommand = ({ cli, logger, name, description, workflo
         }),
     });
 };
-const registerCoverageCommands = (cli, logger) => {
-    registerAuthorizedJsonCommand({
-        cli,
-        logger,
-        name: CLI_COMMANDS.commitReconstructionCoverage,
-        description: "Commit one canonical reconstruction coverage workspace revision",
-        workflow: async (config, authority, input) => {
-            const parsed = reconstructionCoverageCommitInputSchema.safeParse(input);
-            if (!parsed.success)
-                return {
-                    ok: false,
-                    error: new AnalysisInputError(CLI_COMMANDS.commitReconstructionCoverage, { cause: parsed.error }),
-                };
-            const authorization = await authorizeFileReadWithDeferredWrite(authority, {
-                path: parsed.data.workspace_path,
-                readCapability: "investigation_workspace_read",
-                writeCapability: "investigation_workspace_write",
-                operation: CLI_COMMANDS.commitReconstructionCoverage,
-            });
-            if (!authorization.ok)
-                return authorization;
-            const write = await authorization.value.authorizeWrite();
-            if (!write.ok)
-                return write;
-            return commitReconstructionCoverage(parsed.data, config.evidenceFilePolicy);
-        },
-    });
-    registerAuthorizedJsonCommand({
-        cli,
-        logger,
-        name: CLI_COMMANDS.queryReconstructionCoverage,
-        description: "Evaluate one fail-closed reconstruction coverage boundary",
-        workflow: async (config, authority, input) => {
-            const parsed = reconstructionCoverageQueryInputSchema.safeParse(input);
-            if (!parsed.success)
-                return {
-                    ok: false,
-                    error: new AnalysisInputError(CLI_COMMANDS.queryReconstructionCoverage, { cause: parsed.error }),
-                };
-            const authorized = await authorizeRootPermission(authority, {
-                capability: "investigation_workspace_read",
-                roots: [parsed.data.workspace_path],
-                access: "read",
-                operation: CLI_COMMANDS.queryReconstructionCoverage,
-            });
-            if (!authorized.ok)
-                return authorized;
-            return queryReconstructionCoverage(parsed.data, config.evidenceFilePolicy, Date.now());
-        },
-    });
-};
+const registerCoverageCommand = (cli, logger) => registerJsonCommand({
+    cli,
+    logger,
+    name: CLI_COMMANDS.evaluateReconstructionCoverage,
+    description: "Evaluate inline fail-closed reconstruction coverage",
+    inputSchema: reconstructionCoverageEvaluationInputSchema,
+    workflow: (input) => {
+        const result = evaluateReconstructionCoverage(input);
+        return result.ok
+            ? { ok: true, value: jsonValueSchema.parse(result.value) }
+            : result;
+    },
+});
 const configuredAuthority = async () => {
     const configured = await loadConfiguredAuthority();
     return configured.ok
@@ -193,40 +155,28 @@ const configuredAuthority = async () => {
         : { ok: false, error: projectAnalysisError(configured.error) };
 };
 const replayDependencies = (config, authority) => ({
-    policy: config.javascriptReplayPolicy,
+    policy: () => config.javascriptReplayPolicy,
     host: new SystemJavaScriptReplayHost(),
     runner: new LinuxJavaScriptReplayRunner(),
     authority,
 });
-const registerJsonCommand = ({ cli, logger, name, description, resolveInput, workflow, }) => {
+const registerJsonCommand = ({ cli, logger, name, description, inputSchema, workflow, }) => {
     cli.command(name, {
         description,
         args: z.object({
             inputJson: z.string().describe("Inline workflow JSON or JSON file path"),
         }),
-        options: z.object({
-            evidenceBundle: z
-                .string()
-                .optional()
-                .describe("Authorized Evidence bundle used to resolve Evidence IDs"),
-        }),
-        run: ({ args, options }) => logCliCommand(logger, name, async () => {
+        run: ({ args }) => logCliCommand(logger, name, async () => {
             const input = await parseCliJsonInput(args.inputJson, name);
             if (!input.ok)
                 return input.error;
-            const lookup = await loadEvidenceLookup(options.evidenceBundle, name);
-            if (!lookup.ok)
-                return {
-                    error: "Application workflow failed",
-                    ...projectAnalysisError(lookup.error),
-                };
-            const resolved = resolveInput(input.value, lookup.value);
-            if (!resolved.ok)
+            const parsed = inputSchema.safeParse(input.value);
+            if (!parsed.success)
                 return {
                     error: "Application workflow failed",
-                    ...projectAnalysisError(resolved.error),
+                    ...projectAnalysisError(new AnalysisInputError(name, undefined, projectInputIssues(parsed.error.issues, input.value))),
                 };
-            const result = workflow(resolved.value);
+            const result = workflow(parsed.data);
             return result.ok
                 ? result.value
                 : {
@@ -236,26 +186,6 @@ const registerJsonCommand = ({ cli, logger, name, description, resolveInput, wor
         }),
     });
 };
-const loadEvidenceLookup = async (bundlePath, operation) => {
-    if (bundlePath === undefined)
-        return { ok: true, value: undefined };
-    const configured = await loadConfiguredAuthority();
-    if (!configured.ok)
-        return configured;
-    const authorized = await authorizeRootPermission(configured.authority, {
-        capability: "evidence_read",
-        roots: [bundlePath],
-        access: "read",
-        operation,
-    });
-    if (!authorized.ok)
-        return authorized;
-    const loaded = await readEvidenceBundle(bundlePath, configured.config.evidenceFilePolicy);
-    if (!loaded.ok)
-        return loaded;
-    const records = new Map(loaded.value.records.map((record) => [record.evidence_id, record]));
-    return { ok: true, value: (evidenceId) => records.get(evidenceId) };
-};
 const loadConfiguredAuthority = async () => {
     const config = parseConfig(process.env);
     if (!config.ok)

package/dist/cliBrowserAdvancedCommands.js

@@ -1,21 +1,14 @@
 import { Cli, z } from "incur";
+import { browserContext, browserCliError } from "./cliBrowserContext.js";
+import { browserScopeOptions } from "./cliObservationOptions.js";
 import { captureWebScreenshot, compareWebCaptureEvidence, compareWebScreenshotEvidence, discoverWebMcpTools, } from "./application/BrowserObservationService.js";
-import { loadConfiguredPermissionAuthority } from "./application/PermissionConfiguration.js";
 import { CdpBrowserProvider } from "./browser/CdpBrowserProvider.js";
 import { logCliCommand } from "./cliLogging.js";
-import { parseConfig } from "./config.js";
-import { AnalysisInputError, projectAnalysisError } from "./domain/errors.js";
+import { AnalysisInputError } from "./domain/errors.js";
 import { browserCaptureComparisonInputSchema } from "./domain/browserCaptureComparison.js";
 import { discoverWebMcpToolsInputSchema } from "./domain/webMcpDiscovery.js";
 import { captureWebScreenshotInputSchema, compareWebScreenshotsInputSchema, } from "./domain/webScreenshot.js";
 import { CLI_COMMANDS } from "./cliCommandNames.js";
-const scopeOptions = {
-    allowedOrigins: z
-        .array(z.string().min(1))
-        .optional()
-        .describe("Exact origins to observe; defaults to REA_BROWSER_ALLOWED_ORIGINS_JSON"),
-    approved: z.boolean().default(false).describe("Approve passive observation"),
-};
 /** Register WebMCP, capture-diff, and screenshot CLI equivalents. */
 export const registerAdvancedBrowserCommands = (cli, logger) => {
     registerWebMcp(cli, logger);
@@ -31,62 +24,28 @@ const registerWebMcp = (cli, logger) => {
             targetId: z.string().describe("Target ID from list-browser-targets"),
         }),
         options: z.object({
-            ...scopeOptions,
+            ...browserScopeOptions,
             observationMs: z
                 .number()
                 .int()
                 .min(0)
-                .max(10_000)
                 .default(100)
                 .describe("Observation duration in milliseconds"),
-            maxTools: z
-                .number()
-                .int()
-                .min(1)
-                .max(5_000)
-                .default(500)
-                .describe("Maximum page-declared WebMCP tools to return"),
-            maxSchemaBytes: z
-                .number()
-                .int()
-                .min(1)
-                .max(1_024 * 1_024)
-                .default(256 * 1_024)
-                .describe("Maximum serialized size of one declared tool schema"),
-            maxSchemaNodes: z
-                .number()
-                .int()
-                .min(1)
-                .max(100_000)
-                .default(5_000)
-                .describe("Maximum nodes in one declared tool schema"),
-            maxSchemaDepth: z
-                .number()
-                .int()
-                .min(1)
-                .max(100)
-                .default(20)
-                .describe("Maximum nesting depth in one declared tool schema"),
         }),
         run: ({ args, options }) => logCliCommand(logger, "discover-webmcp-tools", async () => {
-            const context = await browserContext();
+            const context = await browserContext("discover_webmcp_tools");
             if (!context.ok)
                 return context.error;
             const parsed = discoverWebMcpToolsInputSchema.safeParse({
                 cdp_endpoint: args.endpoint,
                 allowed_origins: options.allowedOrigins ?? context.allowedBrowserOrigins,
                 target_id: args.targetId,
-                approved: options.approved,
                 observation_ms: options.observationMs,
-                max_tools: options.maxTools,
-                max_schema_bytes: options.maxSchemaBytes,
-                max_schema_nodes: options.maxSchemaNodes,
-                max_schema_depth: options.maxSchemaDepth,
             });
             if (!parsed.success)
                 return inputError("discover_webmcp_tools");
             const result = await discoverWebMcpTools(context.provider, context.authority, parsed.data);
-            return result.ok ? result.value : cliError(result.error);
+            return result.ok ? result.value : browserCliError(result.error);
         }),
     });
 };
@@ -98,13 +57,6 @@ const registerCaptureDiff = (cli, logger) => {
             afterJson: z.string().describe("Later normalized web capture JSON"),
         }),
         options: z.object({
-            maxChanges: z
-                .number()
-                .int()
-                .min(1)
-                .max(20_000)
-                .default(2_000)
-                .describe("Maximum normalized changes to return"),
             normalizationJson: z
                 .string()
                 .default('{"rules":[]}')
@@ -117,19 +69,17 @@ const registerCaptureDiff = (cli, logger) => {
                 before_scenario: before,
                 after_scenario: after,
                 normalization: parseJson(options.normalizationJson),
-                max_changes: options.maxChanges,
             });
             const parsed = scenarioComparison.success
                 ? scenarioComparison
                 : browserCaptureComparisonInputSchema.safeParse({
                     before,
                     after,
-                    max_changes: options.maxChanges,
                 });
             if (!parsed.success)
                 return inputError("compare_web_captures");
             const result = await compareWebCaptureEvidence(new CdpBrowserProvider(), parsed.data);
-            return result.ok ? result.value : cliError(result.error);
+            return result.ok ? result.value : browserCliError(result.error);
         }),
     });
 };
@@ -141,35 +91,21 @@ const registerScreenshot = (cli, logger) => {
             targetId: z.string().describe("Target ID from list-browser-targets"),
         }),
         options: z.object({
-            ...scopeOptions,
-            screenshotApproved: z
-                .boolean()
-                .default(false)
-                .describe("Approve capturing the visible page viewport"),
-            maximumImageBytes: z
-                .number()
-                .int()
-                .min(1)
-                .max(8 * 1_024 * 1_024)
-                .default(4 * 1_024 * 1_024)
-                .describe("Maximum captured PNG size"),
+            ...browserScopeOptions,
         }),
         run: ({ args, options }) => logCliCommand(logger, "capture-web-screenshot", async () => {
-            const context = await browserContext();
+            const context = await browserContext("capture_web_screenshot");
             if (!context.ok)
                 return context.error;
             const parsed = captureWebScreenshotInputSchema.safeParse({
                 cdp_endpoint: args.endpoint,
                 allowed_origins: options.allowedOrigins ?? context.allowedBrowserOrigins,
                 target_id: args.targetId,
-                approved: options.approved,
-                screenshot_approved: options.screenshotApproved,
-                maximum_image_bytes: options.maximumImageBytes,
             });
             if (!parsed.success)
                 return inputError("capture_web_screenshot");
             const result = await captureWebScreenshot(context.provider, context.authority, parsed.data);
-            return result.ok ? result.value : cliError(result.error);
+            return result.ok ? result.value : browserCliError(result.error);
         }),
     });
 };
@@ -188,42 +124,20 @@ const registerScreenshotDiff = (cli, logger) => {
                 .max(255)
                 .default(0)
                 .describe("Per-channel difference threshold for changed pixels"),
-            maximumPixels: z
-                .number()
-                .int()
-                .min(1)
-                .max(32_000_000)
-                .default(16_000_000)
-                .describe("Maximum decoded pixels per screenshot"),
         }),
         run: ({ args, options }) => logCliCommand(logger, "compare-web-screenshots", async () => {
             const parsed = compareWebScreenshotsInputSchema.safeParse({
                 before: parseJson(args.beforeJson),
                 after: parseJson(args.afterJson),
                 channel_threshold: options.channelThreshold,
-                maximum_pixels: options.maximumPixels,
             });
             if (!parsed.success)
                 return inputError("compare_web_screenshots");
             const result = await compareWebScreenshotEvidence(new CdpBrowserProvider(), parsed.data);
-            return result.ok ? result.value : cliError(result.error);
+            return result.ok ? result.value : browserCliError(result.error);
         }),
     });
 };
-const browserContext = async () => {
-    const config = parseConfig(process.env);
-    if (!config.ok)
-        return { ok: false, error: cliError(config.error) };
-    const authority = await loadConfiguredPermissionAuthority(config.value);
-    if (!authority.ok)
-        return { ok: false, error: cliError(authority.error) };
-    return {
-        ok: true,
-        authority: authority.value,
-        provider: new CdpBrowserProvider(),
-        allowedBrowserOrigins: config.value.browserAllowedOrigins,
-    };
-};
 const parseJson = (value) => {
     try {
         return JSON.parse(value);
@@ -232,8 +146,4 @@ const parseJson = (value) => {
         return undefined;
     }
 };
-const inputError = (operation) => cliError(new AnalysisInputError(operation));
-const cliError = (error) => ({
-    error: "Browser observation failed",
-    ...projectAnalysisError(error),
-});
+const inputError = (operation) => browserCliError(new AnalysisInputError(operation));