rea-agents 3.0.0 → 3.2.0

package/dist/domain/browserObservation.js

@@ -18,15 +18,10 @@ const parseExactOrigin = (value) => {
         return undefined;
     return url.origin;
 };
-const MAX_BROWSER_URL_CHARS = 65_536;
-const MAX_SANITIZED_BROWSER_URL_CHARS = 131_072;
-const MAX_QUERY_PARAMETER_NAMES = 256;
-const MAX_QUERY_PARAMETER_NAME_CHARS = 256;
 /** Exact normalized HTTP(S) authority used for browser observation scope. */
 export const browserOriginSchema = z
     .string()
     .min(1)
-    .max(2_048)
     .transform((value, context) => {
     const origin = parseExactOrigin(value);
     if (origin === undefined) {
@@ -44,7 +39,6 @@ export const isLiteralLoopbackHostname = (hostname) => hostname === "127.0.0.1"
 export const browserEndpointSchema = z
     .string()
     .min(1)
-    .max(2_048)
     .transform((value, context) => {
     let url;
     try {
@@ -73,215 +67,60 @@ export const browserEndpointSchema = z
 export const browserAllowedOriginsSchema = z
     .array(browserOriginSchema)
     .min(1)
-    .max(32)
-    .transform((origins) => [...new Set(origins)].sort());
-const approvedBrowserInput = {
+    .transform((origins) => Array.from(new Set(origins)).sort());
+const browserInput = {
     cdp_endpoint: browserEndpointSchema,
     allowed_origins: browserAllowedOriginsSchema,
-    approved: z
-        .literal(true)
-        .describe("Explicit approval for browser observation"),
 };
-/** Public input for bounded discovery of allowed page targets. */
+/** Public input for complete discovery of allowed page targets. */
 export const listBrowserTargetsInputSchema = z.object({
-    ...approvedBrowserInput,
-    offset: z.number().int().min(0).default(0),
-    limit: z.number().int().min(1).max(200).default(100),
+    ...browserInput,
 });
-const browserInspectionLimitsSchema = z.object({
-    max_frames: z.number().int().min(1).max(1_000).default(200),
-    max_dom_nodes: z.number().int().min(1).max(10_000).default(2_000),
-    max_ax_nodes: z.number().int().min(1).max(10_000).default(2_000),
-    max_ax_text_field_bytes: z
-        .number()
-        .int()
-        .min(1)
-        .max(16 * 1_024)
-        .default(1_024),
-    max_total_ax_text_bytes: z
-        .number()
-        .int()
-        .min(1)
-        .max(1_024 * 1_024)
-        .default(64 * 1_024),
-    max_scripts: z.number().int().min(1).max(1_000).default(200),
-    max_resources: z.number().int().min(1).max(10_000).default(2_000),
-    max_workers: z.number().int().min(1).max(5_000).default(500),
-    max_storage_keys: z.number().int().min(1).max(10_000).default(1_000),
-    max_script_source_bytes: z
-        .number()
-        .int()
-        .min(1)
-        .max(4 * 1_024 * 1_024)
-        .default(1_024 * 1_024),
-    max_total_script_source_bytes: z
-        .number()
-        .int()
-        .min(1)
-        .max(16 * 1_024 * 1_024)
-        .default(4 * 1_024 * 1_024),
-    max_network_events: z.number().int().min(1).max(10_000).default(1_000),
-    max_console_events: z.number().int().min(1).max(2_000).default(200),
-    max_console_text_field_bytes: z
-        .number()
-        .int()
-        .min(1)
-        .max(16 * 1_024)
-        .default(1_024),
-    max_total_console_text_bytes: z
-        .number()
-        .int()
-        .min(1)
-        .max(1_024 * 1_024)
-        .default(64 * 1_024),
-    max_json_body_bytes: z
-        .number()
-        .int()
-        .min(1)
-        .max(4 * 1_024 * 1_024)
-        .default(1_024 * 1_024),
-    max_total_json_body_bytes: z
-        .number()
-        .int()
-        .min(1)
-        .max(16 * 1_024 * 1_024)
-        .default(4 * 1_024 * 1_024),
-    max_json_shape_nodes: z.number().int().min(1).max(100_000).default(5_000),
-    max_json_shape_depth: z.number().int().min(1).max(100).default(20),
-    max_websocket_events: z.number().int().min(1).max(5_000).default(500),
-    max_websocket_shape_bytes: z
-        .number()
-        .int()
-        .min(1)
-        .max(1_024 * 1_024)
-        .default(64 * 1_024),
-    max_total_websocket_shape_bytes: z
-        .number()
-        .int()
-        .min(1)
-        .max(16 * 1_024 * 1_024)
-        .default(1_024 * 1_024),
-});
-const DEFAULT_BROWSER_INSPECTION_LIMITS = {
-    max_frames: 200,
-    max_dom_nodes: 2_000,
-    max_ax_nodes: 2_000,
-    max_ax_text_field_bytes: 1_024,
-    max_total_ax_text_bytes: 64 * 1_024,
-    max_scripts: 200,
-    max_resources: 2_000,
-    max_workers: 500,
-    max_storage_keys: 1_000,
-    max_script_source_bytes: 1_024 * 1_024,
-    max_total_script_source_bytes: 4 * 1_024 * 1_024,
-    max_network_events: 1_000,
-    max_console_events: 200,
-    max_console_text_field_bytes: 1_024,
-    max_total_console_text_bytes: 64 * 1_024,
-    max_json_body_bytes: 1_024 * 1_024,
-    max_total_json_body_bytes: 4 * 1_024 * 1_024,
-    max_json_shape_nodes: 5_000,
-    max_json_shape_depth: 20,
-    max_websocket_events: 500,
-    max_websocket_shape_bytes: 64 * 1_024,
-    max_total_websocket_shape_bytes: 1_024 * 1_024,
-};
-/** Public input for one passive, bounded inspection of an existing page. */
-export const inspectWebPageInputSchema = z
-    .object({
-    ...approvedBrowserInput,
-    target_id: z.string().trim().min(1).max(256),
-    observation_ms: z.number().int().min(0).max(10_000).default(500),
+const inspectWebPageInputFacts = {
+    ...browserInput,
+    target_id: z.string().trim().min(1),
+    observation_ms: z.number().int().min(0).default(500),
     include_accessibility_text: z.boolean().default(false),
     include_console_text: z.boolean().default(false),
-    console_text_approved: z.boolean().default(false),
     include_json_body_shapes: z.boolean().default(false),
-    json_body_schema_approved: z.boolean().default(false),
     include_websocket_shapes: z.boolean().default(false),
-    websocket_shape_approved: z.boolean().default(false),
-    include_script_sources: z.boolean().default(false),
     include_storage_keys: z.boolean().default(false),
     include_storage_fingerprints: z.boolean().default(false),
-    limits: browserInspectionLimitsSchema.default(DEFAULT_BROWSER_INSPECTION_LIMITS),
-})
-    .superRefine((input, context) => {
+};
+const inspectWebPageWithoutSourceSchema = z.strictObject({
+    ...inspectWebPageInputFacts,
+    include_script_sources: z.literal(false).default(false),
+});
+const inspectWebPageWithSourceShapeSchema = z.strictObject({
+    ...inspectWebPageInputFacts,
+    include_script_sources: z.literal(true).default(true),
+});
+const refineInspectWebPageInput = (input, context) => {
     if (input.include_storage_fingerprints && !input.include_storage_keys)
         context.addIssue({
             code: "custom",
             path: ["include_storage_fingerprints"],
             message: "Storage fingerprints require storage key capture",
         });
-    if (input.limits.max_script_source_bytes >
-        input.limits.max_total_script_source_bytes)
-        context.addIssue({
-            code: "custom",
-            path: ["limits", "max_script_source_bytes"],
-            message: "Per-script source limit cannot exceed the total source limit",
-        });
-    for (const [include, approved, path, message] of [
-        [
-            input.include_console_text,
-            input.console_text_approved,
-            "console_text_approved",
-            "Console text capture requires separate approval",
-        ],
-        [
-            input.include_json_body_shapes,
-            input.json_body_schema_approved,
-            "json_body_schema_approved",
-            "JSON body schema capture requires separate approval",
-        ],
-        [
-            input.include_websocket_shapes,
-            input.websocket_shape_approved,
-            "websocket_shape_approved",
-            "WebSocket shape capture requires separate approval",
-        ],
-    ])
-        if (include && !approved)
-            context.addIssue({ code: "custom", path: [path], message });
-    if (input.limits.max_console_text_field_bytes >
-        input.limits.max_total_console_text_bytes)
-        context.addIssue({
-            code: "custom",
-            path: ["limits", "max_console_text_field_bytes"],
-            message: "Per-field console text limit cannot exceed the total text limit",
-        });
-    if (input.limits.max_json_body_bytes > input.limits.max_total_json_body_bytes)
-        context.addIssue({
-            code: "custom",
-            path: ["limits", "max_json_body_bytes"],
-            message: "Per-body JSON limit cannot exceed the total body limit",
-        });
-    if (input.limits.max_websocket_shape_bytes >
-        input.limits.max_total_websocket_shape_bytes)
-        context.addIssue({
-            code: "custom",
-            path: ["limits", "max_websocket_shape_bytes"],
-            message: "Per-frame WebSocket limit cannot exceed the total frame limit",
-        });
-    if (input.limits.max_ax_text_field_bytes >
-        input.limits.max_total_ax_text_bytes)
-        context.addIssue({
-            code: "custom",
-            path: ["limits", "max_ax_text_field_bytes"],
-            message: "Per-field accessibility text limit cannot exceed the total text limit",
-        });
-});
+};
+/** Caller schema for source-capturing inspection and bundle analysis. */
+export const inspectWebPageWithSourceInputSchema = inspectWebPageWithSourceShapeSchema.superRefine(refineInspectWebPageInput);
+/** Caller-visible schema for one passive inspection. */
+export const inspectWebPageInputSchema = z.union([
+    inspectWebPageWithoutSourceSchema.superRefine(refineInspectWebPageInput),
+    inspectWebPageWithSourceInputSchema,
+]);
 export const sanitizedBrowserUrlSchema = z.object({
-    url: z.string().max(MAX_SANITIZED_BROWSER_URL_CHARS),
-    origin: z.string().max(2_048).nullable(),
-    query_parameter_names: z
-        .array(z.string().max(MAX_QUERY_PARAMETER_NAME_CHARS))
-        .max(MAX_QUERY_PARAMETER_NAMES),
+    url: z.string(),
+    origin: z.string().nullable(),
+    query_parameter_names: z.array(z.string()),
     redacted: z.boolean(),
 });
 /** Remove credentials and query values before a browser URL becomes durable. */
 export const sanitizeBrowserUrl = (value) => {
     let parsed;
-    const wasTruncated = value.length > MAX_BROWSER_URL_CHARS;
     try {
-        parsed = new URL(value.slice(0, MAX_BROWSER_URL_CHARS));
+        parsed = new URL(value);
     }
     catch {
         return {
@@ -293,11 +132,7 @@ export const sanitizeBrowserUrl = (value) => {
     }
     const hadCredentials = parsed.username !== "" || parsed.password !== "";
     const hadFragment = parsed.hash !== "";
-    const names = [
-        ...new Set([...parsed.searchParams.keys()].map((name) => name.slice(0, MAX_QUERY_PARAMETER_NAME_CHARS))),
-    ]
-        .sort()
-        .slice(0, MAX_QUERY_PARAMETER_NAMES);
+    const names = [...new Set(parsed.searchParams.keys())].sort();
     parsed.username = "";
     parsed.password = "";
     parsed.hash = "";
@@ -308,6 +143,19 @@ export const sanitizeBrowserUrl = (value) => {
         url: parsed.href,
         origin: parsed.origin === "null" ? null : parsed.origin,
         query_parameter_names: names,
-        redacted: wasTruncated || hadCredentials || hadFragment || names.length > 0,
+        redacted: hadCredentials || hadFragment || names.length > 0,
     };
 };
+/** Remove credentials, fragments, and query values from endpoint candidates. */
+export const sanitizeEndpointCandidate = (value) => {
+    try {
+        const parsed = new URL(value, "https://rea.invalid");
+        const sanitized = sanitizeBrowserUrl(parsed.href).url;
+        return parsed.origin === "https://rea.invalid"
+            ? sanitized.replace("https://rea.invalid", "")
+            : sanitized;
+    }
+    catch {
+        return value.split("#", 1)[0]?.split("?", 1)[0] ?? "";
+    }
+};

package/dist/domain/browserObservationSchemas.js

@@ -17,18 +17,10 @@ const browserTargetSchema = z.object({
     origin: z.string(),
     attached: z.boolean(),
 });
-/** Bounded and policy-filtered browser target discovery result. */
+/** Complete policy-filtered browser target discovery result. */
 export const browserTargetListSchema = z.object({
-    schema_version: z.literal(1),
     browser: browserVersionSchema,
-    targets: z.object({
-        items: z.array(browserTargetSchema),
-        offset: z.number().int().min(0),
-        limit: z.number().int().min(1),
-        total: z.number().int().min(0),
-        next_offset: z.number().int().min(0).nullable(),
-        has_more: z.boolean(),
-    }),
+    targets: z.array(browserTargetSchema),
     excluded: z.object({
         disallowed_origin: z.number().int().min(0),
         unsupported_url: z.number().int().min(0),
@@ -119,13 +111,7 @@ const browserNetworkRequestSchema = z.object({
         column: z.number().int().min(0).nullable(),
     }),
     body_shapes: z.object({
-        status: z.enum([
-            "not_approved",
-            "included",
-            "partial",
-            "unavailable",
-            "truncated",
-        ]),
+        status: z.enum(["not_approved", "included", "partial", "unavailable"]),
         request: jsonShapeSchema.nullable(),
         response: jsonShapeSchema.nullable(),
     }),
@@ -138,14 +124,13 @@ const browserConsoleEventSchema = z.object({
     line: z.number().int().min(0).nullable(),
     column: z.number().int().min(0).nullable(),
     text_capture: z.object({
-        status: z.enum(["not_approved", "included", "truncated"]),
+        status: z.enum(["not_approved", "included"]),
         values: z.array(z.object({
             argument_index: z.number().int().min(0),
             type: z.string(),
             text: z.string(),
         })),
         retained_bytes: z.number().int().min(0),
-        truncated_values: z.number().int().min(0),
     }),
 });
 const browserWebSocketEventSchema = z.object({
@@ -157,7 +142,6 @@ const browserWebSocketEventSchema = z.object({
         .object({
         format: z.enum(["json", "text", "binary"]),
         json_shape: jsonShapeSchema.nullable(),
-        truncated: z.boolean(),
     })
         .nullable(),
 });
@@ -236,7 +220,6 @@ const browserSafeMetadataSchema = z.object({
 });
 /** Provider-neutral normalized result for one passive web-page observation. */
 export const webPageInspectionSchema = z.object({
-    schema_version: z.literal(2),
     browser: browserVersionSchema,
     target: browserTargetSchema,
     capture_window: z.object({
@@ -253,10 +236,9 @@ export const webPageInspectionSchema = z.object({
     accessibility: z.object({
         total_nodes: z.number().int().min(0),
         text_capture: z.object({
-            status: z.enum(["not_approved", "included", "truncated", "unavailable"]),
+            status: z.enum(["not_approved", "included", "unavailable"]),
             retained_bytes: z.number().int().min(0),
             excluded_fields: z.number().int().min(0),
-            truncated_fields: z.number().int().min(0),
         }),
         nodes: z.array(browserAxNodeSchema),
     }),

package/dist/domain/browserScenario.js

@@ -1,26 +1,23 @@
 import { z } from "zod";
-import { BROWSER_SCENARIO_LIMITS, browserScenarioActionSchema, browserScenarioAllowedOriginsSchema, browserScenarioBrowserSchema, browserScenarioCaptureLimitsSchema, browserScenarioCaptureSchema, browserScenarioEnvironmentSchema, browserScenarioRedactionSchema, browserScenarioRequestReplaySchema, browserScenarioSecretSchema, browserScenarioStorageSchema, browserScenarioUrlSchema, } from "./browserScenarioValues.js";
-export { BROWSER_SCENARIO_LIMITS, browserScenarioActionSchema, browserScenarioUrlSchema, browserScenarioValueSchema, } from "./browserScenarioValues.js";
-const scenarioShapeSchema = z.strictObject({
-    schema_version: z.literal(1),
-    browser: browserScenarioBrowserSchema,
-    start_url: browserScenarioUrlSchema,
-    allowed_origins: browserScenarioAllowedOriginsSchema,
+import { browserScenarioActionSchema, browserScenarioAllowedOriginsSchema, browserScenarioBrowserSchema, browserScenarioCaptureSchema, browserScenarioEnvironmentSchema, browserScenarioRedactionSchema, browserScenarioRequestReplaySchema, browserScenarioSecretSchema, browserScenarioStorageSchema, browserScenarioUrlSchema, } from "./browserScenarioValues.js";
+export { browserScenarioActionSchema, browserScenarioUrlSchema, browserScenarioValueSchema, } from "./browserScenarioValues.js";
+export const browserScenarioInputSchema = z.strictObject({
+    browser: browserScenarioBrowserSchema.describe("Required launch/connect authority. Launch uses the approved executable and an owned temporary profile; connect uses one approved loopback CDP endpoint and target."),
+    start_url: browserScenarioUrlSchema.describe("Required initial HTTP(S) URL. Query values must be declared separately as public literals or secret references."),
+    allowed_origins: browserScenarioAllowedOriginsSchema.describe("Required exact HTTP(S) origins for the start URL and every later navigation, storage seed, and replay route."),
     environment: browserScenarioEnvironmentSchema,
     actions: z
         .array(browserScenarioActionSchema)
         .min(1)
-        .max(BROWSER_SCENARIO_LIMITS.actions),
+        .describe("Required sequence of explicit browser actions."),
     storage: browserScenarioStorageSchema,
     request_replay: browserScenarioRequestReplaySchema,
     secrets: z
         .array(browserScenarioSecretSchema)
-        .max(BROWSER_SCENARIO_LIMITS.secrets)
-        .default([]),
+        .default([])
+        .describe("Optional references to approved environment variables. Secret values are never supplied inline; declarations are required only when an action, URL, storage value, or replay route references a secret."),
     redaction: browserScenarioRedactionSchema,
     capture: browserScenarioCaptureSchema,
-    limits: browserScenarioCaptureLimitsSchema,
-    approved: z.literal(true),
 });
 const addIssue = (context, path, message) => context.addIssue({ code: "custom", path, message });
 const assertUnique = (values, path, label, context) => {
@@ -161,5 +158,5 @@ const validateBrowserScenario = (scenario, context) => {
     validateSecretReferences(scenario, references, context);
     validateRedactionCoverage(scenario, context);
 };
-/** Strict provider-neutral contract for one bounded browser capture scenario. */
-export const browserScenarioSchema = scenarioShapeSchema.superRefine(validateBrowserScenario);
+/** Strict provider-neutral contract for one controlled browser scenario. */
+export const browserScenarioSchema = browserScenarioInputSchema.superRefine(validateBrowserScenario);

package/dist/domain/browserScenarioCapture.js

@@ -1,32 +1,31 @@
 import { z } from "zod";
 import { browserScenarioCompletenessSchema, browserScenarioEventSchema, browserScenarioStepSchema, } from "./browserScenarioCaptureValues.js";
-export { browserScenarioCompletenessSchema, browserScenarioEventSchema, browserScenarioStepSchema, browserStepArtifactsSchema, captureStateSchema, } from "./browserScenarioCaptureValues.js";
-/** Step-indexed, explicitly bounded browser scenario observation. */
+export { classifyBrowserScenarioCompleteness, browserScenarioCompletenessSchema, browserScenarioEventSchema, browserScenarioStepSchema, browserStepArtifactsSchema, captureStateSchema, } from "./browserScenarioCaptureValues.js";
+/** Step-indexed browser scenario observation. */
 export const browserScenarioCaptureSchema = z
     .strictObject({
-    schema_version: z.literal(1),
     browser: z.strictObject({
         mode: z.enum(["launch", "connect"]),
         process_ownership: z.enum(["provider-owned", "external"]),
         cleanup: z.enum(["terminated-owned-process", "disconnected-external"]),
-        product: z.string().min(1).max(1_024),
-        version: z.string().min(1).max(256),
+        product: z.string().min(1),
+        version: z.string().min(1),
     }),
     scenario: z.strictObject({
-        start_origin: z.string().min(1).max(2_048),
-        allowed_origins: z.array(z.string().min(1).max(2_048)).min(1).max(32),
-        action_count: z.number().int().min(1).max(128),
-        secret_references: z.array(z.string().min(1).max(64)).max(64),
+        start_origin: z.string().min(1),
+        allowed_origins: z.array(z.string().min(1)).min(1),
+        action_count: z.number().int().min(1),
+        secret_references: z.array(z.string().min(1)),
     }),
     duration_ms: z.number().int().min(0),
-    steps: z.array(browserScenarioStepSchema).min(1).max(129),
+    steps: z.array(browserScenarioStepSchema).min(1),
     events: z.strictObject({
         retained: z.number().int().min(0),
         dropped: z.number().int().min(0),
-        items: z.array(browserScenarioEventSchema).max(100_000),
+        items: z.array(browserScenarioEventSchema),
     }),
     completeness: browserScenarioCompletenessSchema,
-    limitations: z.array(z.string().min(1).max(2_048)).max(64),
+    limitations: z.array(z.string().min(1)),
 })
     .superRefine((capture, context) => {
     if (capture.events.retained !== capture.events.items.length)