rea-agents 3.0.0 → 3.2.0

package/dist/contracts/managedWorkflowToolContracts.js

@@ -1,89 +1,79 @@
 import { z } from "zod";
-import { compareManagedMembersInputSchema } from "../domain/managedMemberComparison.js";
-import { managedNativeVerificationInputSchema } from "../domain/managedNativeVerification.js";
+import { evidenceSchema } from "../domain/evidence.js";
 import { managedReconstructionImportInputSchema } from "../domain/managedReconstruction.js";
 import { managedRuntimeCorrelationInputSchema } from "../domain/managedRuntimeCorrelation.js";
-import { projectManagedApplicationGraphInputSchema } from "../domain/managedApplicationGraph.js";
 import { managedWorkflowOutputSchemas } from "./toolOutputSchemas.js";
 import { MANAGED_MEMBER_COMPARISON_EXAMPLE, MANAGED_NATIVE_VERIFICATION_EXAMPLE, MANAGED_APPLICATION_GRAPH_EXAMPLE, MANAGED_RECONSTRUCTION_IMPORT_EXAMPLE, MANAGED_RUNTIME_CORRELATION_EXAMPLE, } from "./managedWorkflowExamples.js";
 import { toolContractMetadata } from "./toolEffects.js";
-const evidenceIdSchema = z.string().regex(/^ev_[a-f0-9]{64}$/u);
-const managedEvidenceIdSchema = evidenceIdSchema.describe("Session-owned inspect_managed_members Evidence ID");
-const managedArtifactEvidenceIdSchema = evidenceIdSchema.describe("Session-owned inspect_managed_artifact Evidence ID");
-const managedBoundaryEvidenceIdSchema = evidenceIdSchema.describe("Session-owned inspect_managed_native_boundaries Evidence ID");
-const nativeObservationEvidenceIdSchema = evidenceIdSchema.describe("Session-owned inspect_macho or analyze_function Evidence ID");
-/** MCP references for comparing two session-owned managed observations. */
+import { requireOutputSchema } from "./toolOutputSchemaPrimitives.js";
+/** Inputs for comparing two managed observations carried inline. */
 export const compareManagedMembersReferenceInputSchema = z
     .strictObject({
-    left_evidence_id: managedEvidenceIdSchema,
-    right_evidence_id: managedEvidenceIdSchema,
-    limits: compareManagedMembersInputSchema.shape.limits,
-    unknown_registry_approved: compareManagedMembersInputSchema.shape.unknown_registry_approved,
+    left: evidenceSchema,
+    right: evidenceSchema,
 })
     .superRefine((input, context) => {
-    if (input.left_evidence_id === input.right_evidence_id)
+    if (input.left.evidence_id === input.right.evidence_id)
         context.addIssue({
             code: "custom",
-            path: ["right_evidence_id"],
+            path: ["right"],
             message: "Managed member Evidence must be distinct",
         });
 });
 /** MCP reference for planning from one session-owned managed observation. */
-export const managedRuntimeCorrelationReferenceInputSchema = managedRuntimeCorrelationInputSchema
-    .omit({ static_members: true })
-    .extend({ static_members_evidence_id: managedEvidenceIdSchema });
-/** MCP reference for importing reconstruction against session Evidence. */
-export const managedReconstructionReferenceInputSchema = managedReconstructionImportInputSchema
-    .omit({ static_members: true })
-    .extend({ static_members_evidence_id: managedEvidenceIdSchema });
-/** MCP references for managed/native verification from session Evidence. */
+export const managedRuntimeCorrelationReferenceInputSchema = managedRuntimeCorrelationInputSchema.extend({
+    static_members: evidenceSchema,
+});
+/** Inline Evidence input for importing reconstruction. */
+export const managedReconstructionReferenceInputSchema = managedReconstructionImportInputSchema.extend({
+    static_members: evidenceSchema,
+});
+/** Inline Evidence inputs for managed/native verification. */
 export const managedNativeVerificationReferenceInputSchema = z
     .strictObject({
-    managed_boundaries_evidence_id: managedBoundaryEvidenceIdSchema,
-    native_observation_evidence_ids: z
-        .array(nativeObservationEvidenceIdSchema)
+    managed_boundaries: evidenceSchema,
+    native_observations: z
+        .array(evidenceSchema)
         .min(1)
-        .max(50)
-        .describe("Unique session-owned native observation Evidence IDs"),
-    limits: managedNativeVerificationInputSchema.shape.limits,
-    unknown_registry_approved: managedNativeVerificationInputSchema.shape.unknown_registry_approved,
+        .describe("Native function or export Evidence records"),
 })
     .superRefine((input, context) => {
-    const ids = new Set();
-    for (const [index, evidenceId,] of input.native_observation_evidence_ids.entries()) {
-        if (evidenceId === input.managed_boundaries_evidence_id)
+    const ids = new Set([input.managed_boundaries.evidence_id]);
+    for (const [index, evidence] of input.native_observations.entries()) {
+        if (evidence.evidence_id === input.managed_boundaries.evidence_id)
             context.addIssue({
                 code: "custom",
-                path: ["native_observation_evidence_ids", index],
+                path: ["native_observations", index],
                 message: "Native observation Evidence must be distinct from managed boundary Evidence",
             });
-        if (ids.has(evidenceId))
+        if (ids.has(evidence.evidence_id))
             context.addIssue({
                 code: "custom",
-                path: ["native_observation_evidence_ids", index],
+                path: ["native_observations", index],
                 message: "Native observation Evidence IDs must be unique",
             });
-        ids.add(evidenceId);
+        ids.add(evidence.evidence_id);
     }
 });
-/** MCP references for projecting managed Evidence into an application graph. */
+const managedApplicationGraphReferenceFacts = {};
+/** Inline Evidence sources for managed application graph projection. */
 export const managedApplicationGraphReferenceInputSchema = z
     .strictObject({
-    managed_artifact_evidence_id: managedArtifactEvidenceIdSchema.optional(),
-    managed_members_evidence_id: managedEvidenceIdSchema.optional(),
-    managed_native_boundaries_evidence_id: managedBoundaryEvidenceIdSchema.optional(),
-    limits: projectManagedApplicationGraphInputSchema.shape.limits,
+    ...managedApplicationGraphReferenceFacts,
+    managed_artifact: evidenceSchema.optional(),
+    managed_members: evidenceSchema.optional(),
+    managed_native_boundaries: evidenceSchema.optional(),
 })
     .superRefine((input, context) => {
     const ids = [
-        input.managed_artifact_evidence_id,
-        input.managed_members_evidence_id,
-        input.managed_native_boundaries_evidence_id,
+        input.managed_artifact?.evidence_id,
+        input.managed_members?.evidence_id,
+        input.managed_native_boundaries?.evidence_id,
     ].filter((id) => id !== undefined);
     if (ids.length === 0)
         context.addIssue({
             code: "custom",
-            message: "At least one managed Evidence ID is required",
+            message: "Provide at least one managed Evidence source",
         });
     if (new Set(ids).size !== ids.length)
         context.addIssue({
@@ -91,27 +81,17 @@ export const managedApplicationGraphReferenceInputSchema = z
             message: "Managed application graph Evidence IDs must be unique",
         });
 });
-const comparisonOutputSchema = managedWorkflowOutputSchemas.compare_managed_members;
-if (comparisonOutputSchema === undefined)
-    throw new Error("Missing managed workflow output schema for compare_managed_members");
-const runtimeOutputSchema = managedWorkflowOutputSchemas.plan_managed_runtime_correlation;
-if (runtimeOutputSchema === undefined)
-    throw new Error("Missing managed workflow output schema for plan_managed_runtime_correlation");
-const reconstructionOutputSchema = managedWorkflowOutputSchemas.import_managed_reconstruction;
-if (reconstructionOutputSchema === undefined)
-    throw new Error("Missing managed workflow output schema for import_managed_reconstruction");
-const nativeVerificationOutputSchema = managedWorkflowOutputSchemas.verify_managed_native_boundaries;
-if (nativeVerificationOutputSchema === undefined)
-    throw new Error("Missing managed workflow output schema for verify_managed_native_boundaries");
-const managedApplicationGraphOutputSchema = managedWorkflowOutputSchemas.project_managed_application_graph;
-if (managedApplicationGraphOutputSchema === undefined)
-    throw new Error("Missing managed workflow output schema for project_managed_application_graph");
+const comparisonOutputSchema = requireOutputSchema(managedWorkflowOutputSchemas, "compare_managed_members");
+const runtimeOutputSchema = requireOutputSchema(managedWorkflowOutputSchemas, "plan_managed_runtime_correlation");
+const reconstructionOutputSchema = requireOutputSchema(managedWorkflowOutputSchemas, "import_managed_reconstruction");
+const nativeVerificationOutputSchema = requireOutputSchema(managedWorkflowOutputSchemas, "verify_managed_native_boundaries");
+const managedApplicationGraphOutputSchema = requireOutputSchema(managedWorkflowOutputSchemas, "project_managed_application_graph");
 /** Provider-neutral managed-code workflow contracts. */
 export const MANAGED_WORKFLOW_TOOL_CONTRACTS = [
     {
         name: "compare_managed_members",
         ...toolContractMetadata("compare_managed_members"),
-        description: "Compare two authenticated inspect_managed_members Evidence records using unique-only decoded-CIL-v1/signature and structural method-shape tiers. Names are reported as observations but are not used as a matching basis; metadata tokens remain build-local coordinates bound to each artifact SHA-256 and MVID, and the v1 tuple digest does not itself remap them.",
+        description: "Compare two authenticated inspect_managed_members Evidence records using unique-only decoded-CIL/signature and structural method-shape tiers. Names are reported as observations but are not used as a matching basis; metadata tokens remain build-local coordinates bound to each artifact SHA-256 and MVID, and the tuple digest does not itself remap them.",
         kind: "application",
         inputSchema: compareManagedMembersReferenceInputSchema,
         outputSchema: comparisonOutputSchema,
@@ -119,9 +99,8 @@ export const MANAGED_WORKFLOW_TOOL_CONTRACTS = [
             {
                 title: "Compare two managed member observations",
                 input: {
-                    left_evidence_id: MANAGED_MEMBER_COMPARISON_EXAMPLE.left.evidence_id,
-                    right_evidence_id: MANAGED_MEMBER_COMPARISON_EXAMPLE.right.evidence_id,
-                    limits: MANAGED_MEMBER_COMPARISON_EXAMPLE.limits,
+                    left: MANAGED_MEMBER_COMPARISON_EXAMPLE.left,
+                    right: MANAGED_MEMBER_COMPARISON_EXAMPLE.right,
                 },
             },
         ],
@@ -137,9 +116,8 @@ export const MANAGED_WORKFLOW_TOOL_CONTRACTS = [
             {
                 title: "Verify a managed P/Invoke declaration against native Evidence",
                 input: {
-                    managed_boundaries_evidence_id: MANAGED_NATIVE_VERIFICATION_EXAMPLE.managed_boundaries.evidence_id,
-                    native_observation_evidence_ids: MANAGED_NATIVE_VERIFICATION_EXAMPLE.native_observations.map(({ evidence_id: evidenceId }) => evidenceId),
-                    limits: MANAGED_NATIVE_VERIFICATION_EXAMPLE.limits,
+                    managed_boundaries: MANAGED_NATIVE_VERIFICATION_EXAMPLE.managed_boundaries,
+                    native_observations: MANAGED_NATIVE_VERIFICATION_EXAMPLE.native_observations,
                 },
             },
         ],
@@ -147,7 +125,7 @@ export const MANAGED_WORKFLOW_TOOL_CONTRACTS = [
     {
         name: "import_managed_reconstruction",
         ...toolContractMetadata("import_managed_reconstruction"),
-        description: "Import decompiler-produced managed reconstruction against authenticated inspect_managed_members Evidence. The workflow locks each method to artifact SHA-256, MVID, metadata token, signature hash, and the limited member-result-v1 decoded-IL tuple hash, records the decompiler identity and options, and marks C# or pseudocode as analyst inference rather than canonical byte observation.",
+        description: "Import decompiler-produced managed reconstruction against authenticated inspect_managed_members Evidence. The workflow locks each method to artifact SHA-256, MVID, metadata token, signature hash, and the limited decoded-IL tuple hash, records the decompiler identity and options, and marks C# or pseudocode as analyst inference rather than canonical byte observation.",
         kind: "application",
         inputSchema: managedReconstructionReferenceInputSchema,
         outputSchema: reconstructionOutputSchema,
@@ -155,7 +133,7 @@ export const MANAGED_WORKFLOW_TOOL_CONTRACTS = [
             {
                 title: "Import a decompiler reconstruction for one managed method",
                 input: {
-                    static_members_evidence_id: MANAGED_RECONSTRUCTION_IMPORT_EXAMPLE.static_members.evidence_id,
+                    static_members: MANAGED_RECONSTRUCTION_IMPORT_EXAMPLE.static_members,
                     decompiler: MANAGED_RECONSTRUCTION_IMPORT_EXAMPLE.decompiler,
                     methods: MANAGED_RECONSTRUCTION_IMPORT_EXAMPLE.methods,
                     notes: MANAGED_RECONSTRUCTION_IMPORT_EXAMPLE.notes,
@@ -166,7 +144,7 @@ export const MANAGED_WORKFLOW_TOOL_CONTRACTS = [
     {
         name: "plan_managed_runtime_correlation",
         ...toolContractMetadata("plan_managed_runtime_correlation"),
-        description: "Prepare a separately authorized managed runtime-correlation admission plan from authenticated inspect_managed_members Evidence. The operation is default-disabled, requires the managed_runtime permission ceiling and grant, locks the exact artifact SHA-256, MVID, method signature, and limited member-result-v1 decoded-IL tuple hash, distinguishes attach/load/debugger/reflection/instrumentation effects, and records that no target code was executed.",
+        description: "Prepare a separately authorized managed runtime-correlation admission plan from authenticated inspect_managed_members Evidence. The operation is default-disabled, requires the managed_runtime permission ceiling and grant, locks the exact artifact SHA-256, MVID, method signature, and limited decoded-IL tuple hash, distinguishes attach/load/debugger/reflection/instrumentation effects, and records that no target code was executed.",
         kind: "application",
         inputSchema: managedRuntimeCorrelationReferenceInputSchema,
         outputSchema: runtimeOutputSchema,
@@ -174,7 +152,7 @@ export const MANAGED_WORKFLOW_TOOL_CONTRACTS = [
             {
                 title: "Plan an exact-build managed runtime correlation",
                 input: {
-                    static_members_evidence_id: MANAGED_RUNTIME_CORRELATION_EXAMPLE.static_members.evidence_id,
+                    static_members: MANAGED_RUNTIME_CORRELATION_EXAMPLE.static_members,
                     method: MANAGED_RUNTIME_CORRELATION_EXAMPLE.method,
                     requested_effect: MANAGED_RUNTIME_CORRELATION_EXAMPLE.requested_effect,
                     host: MANAGED_RUNTIME_CORRELATION_EXAMPLE.host,
@@ -194,8 +172,7 @@ export const MANAGED_WORKFLOW_TOOL_CONTRACTS = [
             {
                 title: "Project static managed observations into an application graph",
                 input: {
-                    managed_members_evidence_id: MANAGED_APPLICATION_GRAPH_EXAMPLE.managed_members.evidence_id,
-                    limits: MANAGED_APPLICATION_GRAPH_EXAMPLE.limits,
+                    managed_members: MANAGED_APPLICATION_GRAPH_EXAMPLE.managed_members,
                 },
             },
         ],

package/dist/contracts/nativeToolContracts.js

@@ -2,17 +2,16 @@ import { z } from "zod";
 import { nativeOutputSchemas } from "./toolOutputSchemas.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";
 import { toolContractMetadata } from "./toolEffects.js";
+import { requireOutputSchema } from "./toolOutputSchemaPrimitives.js";
 const examples = {
     inspect_macho: {},
     inspect_signature: {},
-    inspect_plist: { relative_path: "Contents/Info.plist" },
+    inspect_plist: { path: "/Applications/Example.app/Contents/Info.plist" },
     list_architectures: {},
     demangle_swift: { symbols: ["$s4Test3fooyyF"] },
 };
 const native = (name, description, inputSchema) => {
-    const outputSchema = nativeOutputSchemas[name];
-    if (outputSchema === undefined)
-        throw new Error(`Missing native output schema for ${name}`);
+    const outputSchema = requireOutputSchema(nativeOutputSchemas, name);
     return {
         name,
         ...toolContractMetadata(name),
@@ -33,16 +32,12 @@ const native = (name, description, inputSchema) => {
 /** Provider-neutral semantic operations backed initially by macOS utilities. */
 export const NATIVE_TOOL_CONTRACTS = [
     native("inspect_macho", "Inspect Mach-O slices, load commands, imports, exports, dependencies, build metadata, segments, sections, permissions, and exact command provenance without launching Hopper.", z.object({})),
-    native("inspect_signature", "Inspect the active artifact's code-signing identity, hashes, authorities, requirements, entitlements, hardened-runtime state, and bounded command provenance.", z.object({})),
-    native("inspect_plist", "Parse a plist at a bounded relative path beneath the active artifact container. Symlink and traversal escapes are rejected; output is normalized JSON rather than plutil text.", z.object({
-        relative_path: z
-            .string()
-            .min(1)
-            .max(1_024)
-            .default("Contents/Info.plist"),
+    native("inspect_signature", "Inspect the active artifact's code-signing identity, hashes, authorities, requirements, entitlements, hardened-runtime state, and exact command provenance.", z.object({})),
+    native("inspect_plist", "Parse Info.plist from the active artifact by default, or pass any local plist path. Returns normalized JSON rather than plutil text.", z.object({
+        path: z.string().min(1).optional(),
     })),
-    native("list_architectures", "List thin or universal Mach-O slices with offsets, sizes, alignment, explicit coverage, and bounded native-tool provenance.", z.object({})),
-    native("demangle_swift", "Demangle an ordered bounded batch of Swift symbols without requiring Hopper. Each input returns demangled, unchanged, or invalid status.", z.object({
-        symbols: z.array(z.string().min(1).max(4_096)).min(1).max(500),
+    native("list_architectures", "List thin or universal Mach-O slices with offsets, sizes, alignment, explicit coverage, and native-tool provenance.", z.object({})),
+    native("demangle_swift", "Demangle an ordered list of Swift symbols without requiring Hopper. Each input returns demangled, unchanged, or invalid status.", z.object({
+        symbols: z.array(z.string().min(1)).min(1),
     })),
 ];

package/dist/contracts/processCaptureExample.js

@@ -1,69 +1,2 @@
-import { digestProcessCommitment } from "../domain/processCapture.js";
-const normalization = {
-    paths: true,
-    pids: true,
-    ports: true,
-    time_bucket_ms: 10,
-    patterns: [],
-};
-const scenario = { executable_sha256: "0".repeat(64) };
-const comparisonContract = {};
-const shimPlan = [];
-const replayPlan = {};
-/** Minimal valid process capture used only in public contract examples. */
-export const EMPTY_PROCESS_CAPTURE_EXAMPLE = {
-    schema_version: 4,
-    manifest: {
-        rea_version: "1.1.0",
-        provider_version: "3",
-        platform: "fixture",
-        architecture: "fixture",
-        pty_backend: "node-pty",
-        started_at: "2026-01-01T00:00:00.000Z",
-        completed_at: "2026-01-01T00:00:00.001Z",
-        scenario,
-        comparison_contract: comparisonContract,
-        shim_plan: shimPlan,
-        replay_plan: replayPlan,
-        full_scenario_sha256: digestProcessCommitment(scenario),
-        comparison_contract_sha256: digestProcessCommitment(comparisonContract),
-        executable_sha256: "0".repeat(64),
-        normalization_sha256: digestProcessCommitment(normalization),
-        shim_plan_sha256: digestProcessCommitment(shimPlan),
-        replay_plan_sha256: digestProcessCommitment(replayPlan),
-    },
-    normalization,
-    frames: [],
-    rendered_frames: [],
-    interaction_events: [],
-    exit: { code: 0, signal: null, reason: "exited" },
-    settlement: {
-        state: "quiesced",
-        elapsed_ms: 50,
-        cleanup_outcome: "not_required",
-    },
-    process_samples: [],
-    filesystem_checkpoints: [
-        { name: "before", at_ms: 0, files: [], effects: [], truncated: false },
-        {
-            name: "after_settlement",
-            at_ms: 50,
-            files: [],
-            effects: [],
-            truncated: false,
-        },
-    ],
-    shim_events: [],
-    protocol_events: [],
-    replay_transitions: [],
-    files_before: [],
-    files_after: [],
-    filesystem_effects: [],
-    truncated: false,
-    limitations: [],
-    residual_unknowns: [],
-    cleanup: {
-        owned_process_group: "verified",
-        temporary_root: "removed",
-    },
-};
+/** Minimal valid process capture retained as a public contract example. */
+export { EMPTY_PROCESS_CAPTURE_EXAMPLE } from "../domain/processCaptureExample.js";