rea-agents 3.0.0 → 3.2.0

package/dist/domain/browserScenarioValues.js

@@ -1,27 +1,17 @@
 import { z } from "zod";
 import { browserAllowedOriginsSchema, browserEndpointSchema, browserOriginSchema, } from "./browserObservation.js";
-export const BROWSER_SCENARIO_LIMITS = {
-    actions: 128,
-    secrets: 64,
-    storageEntries: 512,
-    replayRoutes: 256,
-    durationMs: 300_000,
-    actionTimeoutMs: 60_000,
-};
 export const scenarioIdentifierSchema = z
     .string()
-    .regex(/^[A-Za-z][A-Za-z0-9._-]{0,63}$/u);
+    .regex(/^[A-Za-z][A-Za-z0-9._-]*$/u);
 const absoluteExecutablePathSchema = z
     .string()
     .min(1)
-    .max(4_096)
     .refine((value) => value.startsWith("/") ||
     /^[A-Za-z]:[\\/]/u.test(value) ||
     value.startsWith("\\\\"), "Expected an absolute browser executable path");
 const browserScenarioBaseUrlSchema = z
     .string()
     .min(1)
-    .max(65_536)
     .transform((value, context) => {
     let url;
     try {
@@ -47,7 +37,7 @@ const browserScenarioBaseUrlSchema = z
 export const browserScenarioValueSchema = z.discriminatedUnion("source", [
     z.strictObject({
         source: z.literal("literal"),
-        value: z.string().max(65_536),
+        value: z.string(),
         classification: z.literal("public"),
     }),
     z.strictObject({
@@ -56,13 +46,13 @@ export const browserScenarioValueSchema = z.discriminatedUnion("source", [
     }),
 ]);
 const queryEntrySchema = z.strictObject({
-    name: z.string().min(1).max(256),
+    name: z.string().min(1),
     value: browserScenarioValueSchema,
 });
 /** URL whose values remain explicit public literals or declared secret references. */
 export const browserScenarioUrlSchema = z.strictObject({
     url: browserScenarioBaseUrlSchema,
-    query: z.array(queryEntrySchema).max(64).default([]),
+    query: z.array(queryEntrySchema).default([]),
 });
 export const browserScenarioBrowserSchema = z.discriminatedUnion("mode", [
     z.strictObject({
@@ -75,35 +65,47 @@ export const browserScenarioBrowserSchema = z.discriminatedUnion("mode", [
     z.strictObject({
         mode: z.literal("connect"),
         cdp_endpoint: browserEndpointSchema,
-        target_id: z.string().trim().min(1).max(256),
+        target_id: z.string().trim().min(1),
         ownership: z.literal("external"),
         cleanup: z.literal("disconnect-only"),
     }),
 ]);
-export const browserScenarioEnvironmentSchema = z.strictObject({
-    viewport: z.strictObject({
-        width: z.number().int().min(320).max(7_680),
-        height: z.number().int().min(240).max(4_320),
-        device_scale_factor: z.number().min(0.5).max(4).default(1),
-    }),
+export const browserScenarioEnvironmentSchema = z
+    .strictObject({
+    viewport: z
+        .strictObject({
+        width: z.number().int().positive().default(1_280),
+        height: z.number().int().positive().default(720),
+        device_scale_factor: z.number().positive().default(1),
+    })
+        .default({ width: 1_280, height: 720, device_scale_factor: 1 }),
     locale: z
         .string()
         .min(2)
-        .max(64)
-        .regex(/^[A-Za-z0-9]+(?:-[A-Za-z0-9]+)*$/u),
+        .regex(/^[A-Za-z0-9]+(?:-[A-Za-z0-9]+)*$/u)
+        .default("en-US"),
     timezone: z
         .string()
         .min(1)
-        .max(128)
-        .regex(/^[A-Za-z0-9_+-]+(?:\/[A-Za-z0-9_+-]+)*$/u),
-    color_scheme: z.enum(["light", "dark", "no-preference"]),
-    reduced_motion: z.enum(["reduce", "no-preference"]),
-    service_workers: z.literal("block"),
-});
+        .regex(/^[A-Za-z0-9_+-]+(?:\/[A-Za-z0-9_+-]+)*$/u)
+        .default("UTC"),
+    color_scheme: z.enum(["light", "dark", "no-preference"]).default("light"),
+    reduced_motion: z.enum(["reduce", "no-preference"]).default("reduce"),
+    service_workers: z.literal("block").default("block"),
+})
+    .default({
+    viewport: { width: 1_280, height: 720, device_scale_factor: 1 },
+    locale: "en-US",
+    timezone: "UTC",
+    color_scheme: "light",
+    reduced_motion: "reduce",
+    service_workers: "block",
+})
+    .describe("Optional deterministic browser settings. Defaults to 1280x720, en-US, UTC, light mode, reduced motion, and blocked service workers.");
 const locatorSchema = z.discriminatedUnion("kind", [
     z.strictObject({
         kind: z.literal("test_id"),
-        value: z.string().min(1).max(512),
+        value: z.string().min(1),
     }),
     z.strictObject({
         kind: z.literal("role"),
@@ -123,13 +125,12 @@ const locatorSchema = z.discriminatedUnion("kind", [
             "tab",
             "textbox",
         ]),
-        name: z.string().min(1).max(1_024),
+        name: z.string().min(1),
         exact: z.literal(true),
     }),
     z.strictObject({
         kind: z.literal("css"),
-        selector: z.string().min(1).max(4_096),
-        approved: z.literal(true),
+        selector: z.string().min(1),
     }),
 ]);
 const stepBase = {
@@ -138,8 +139,8 @@ const stepBase = {
         .number()
         .int()
         .min(1)
-        .max(BROWSER_SCENARIO_LIMITS.actionTimeoutMs)
-        .optional(),
+        .optional()
+        .describe("Optional action deadline in milliseconds; omitted means wait until completion or request cancellation."),
 };
 export const browserScenarioActionSchema = z.discriminatedUnion("action", [
     z.strictObject({
@@ -153,7 +154,7 @@ export const browserScenarioActionSchema = z.discriminatedUnion("action", [
         action: z.literal("click"),
         locator: locatorSchema,
         button: z.enum(["left", "middle", "right"]).default("left"),
-        click_count: z.number().int().min(1).max(3).default(1),
+        click_count: z.number().int().positive().default(1),
     }),
     z.strictObject({
         ...stepBase,
@@ -165,7 +166,7 @@ export const browserScenarioActionSchema = z.discriminatedUnion("action", [
         ...stepBase,
         action: z.literal("press"),
         locator: locatorSchema,
-        key: z.string().min(1).max(64),
+        key: z.string().min(1),
     }),
     z.strictObject({
         ...stepBase,
@@ -191,44 +192,43 @@ export const browserScenarioActionSchema = z.discriminatedUnion("action", [
             .number()
             .int()
             .min(1)
-            .max(BROWSER_SCENARIO_LIMITS.actionTimeoutMs),
+            .describe("Wait this many milliseconds; the wait ends early on cancellation."),
     }),
 ]);
 const storageEntrySchema = z.strictObject({
-    name: z.string().min(1).max(1_024),
+    name: z.string().min(1),
     value: browserScenarioValueSchema,
 });
-export const browserScenarioStorageSchema = z.strictObject({
+export const browserScenarioStorageSchema = z
+    .strictObject({
     cookies: z
         .array(z.strictObject({
-        name: z.string().min(1).max(1_024),
+        name: z.string().min(1),
         value: browserScenarioValueSchema,
         destination: browserScenarioUrlSchema,
         http_only: z.boolean(),
         secure: z.boolean(),
         same_site: z.enum(["Strict", "Lax", "None"]),
     }))
-        .max(128)
         .default([]),
     local_storage: z
         .array(z.strictObject({
         origin: browserOriginSchema,
-        entries: z.array(storageEntrySchema).max(128),
+        entries: z.array(storageEntrySchema),
     }))
-        .max(32)
         .default([]),
     session_storage: z
         .array(z.strictObject({
         origin: browserOriginSchema,
-        entries: z.array(storageEntrySchema).max(128),
+        entries: z.array(storageEntrySchema),
     }))
-        .max(32)
         .default([]),
-});
+})
+    .default({ cookies: [], local_storage: [], session_storage: [] })
+    .describe("Optional initial cookies, local storage, or session storage. Defaults to empty; every supplied value and origin must be explicitly declared and approved.");
 const headerNameSchema = z
     .string()
     .min(1)
-    .max(256)
     .regex(/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/u)
     .transform((value) => value.toLowerCase());
 const replayHeaderSchema = z.strictObject({
@@ -239,7 +239,7 @@ const replayResponseSchema = z.discriminatedUnion("kind", [
     z.strictObject({
         kind: z.literal("response"),
         status: z.number().int().min(100).max(599),
-        headers: z.array(replayHeaderSchema).max(64).default([]),
+        headers: z.array(replayHeaderSchema).default([]),
         body: browserScenarioValueSchema.optional(),
     }),
     z.strictObject({
@@ -260,20 +260,20 @@ const replayRouteSchema = z.strictObject({
     request: browserScenarioUrlSchema,
     response: replayResponseSchema,
 });
-export const browserScenarioRequestReplaySchema = z.discriminatedUnion("mode", [
+export const browserScenarioRequestReplaySchema = z
+    .discriminatedUnion("mode", [
     z.strictObject({ mode: z.literal("disabled") }),
     z.strictObject({
         mode: z.literal("exact"),
         unmatched: z.enum(["abort", "passthrough-approved-origins"]),
-        routes: z
-            .array(replayRouteSchema)
-            .min(1)
-            .max(BROWSER_SCENARIO_LIMITS.replayRoutes),
+        routes: z.array(replayRouteSchema).min(1),
     }),
-]);
+])
+    .default({ mode: "disabled" })
+    .describe("Optional exact request replay. Defaults to disabled; replay routes and unmatched-request behavior must be explicitly declared when enabled.");
 export const browserScenarioSecretSchema = z.strictObject({
     secret_id: scenarioIdentifierSchema,
-    environment_variable: z.string().regex(/^[A-Z_][A-Z0-9_]{0,127}$/u),
+    environment_variable: z.string().regex(/^[A-Z_][A-Z0-9_]*$/u),
     purpose: z.enum(["input", "storage", "request-replay"]),
     redaction: z.literal("replace-with-secret-reference"),
 });
@@ -283,20 +283,20 @@ const REQUIRED_REDACTED_HEADERS = [
     "proxy-authorization",
     "set-cookie",
 ];
-const normalizedNames = (maximum) => z
+const normalizedNames = () => z
     .array(z
     .string()
     .trim()
     .min(1)
-    .max(256)
     .transform((value) => value.toLowerCase()))
-    .max(maximum)
     .transform((values) => [...new Set(values)].sort());
 export const browserScenarioRedactionSchema = z
     .strictObject({
-    secret_values: z.literal("replace-with-secret-reference"),
-    query_parameter_names: normalizedNames(128).default([]),
-    header_names: normalizedNames(128).default([...REQUIRED_REDACTED_HEADERS]),
+    secret_values: z
+        .literal("replace-with-secret-reference")
+        .default("replace-with-secret-reference"),
+    query_parameter_names: normalizedNames().default([]),
+    header_names: normalizedNames().default([...REQUIRED_REDACTED_HEADERS]),
 })
     .superRefine(({ header_names: names }, context) => {
     for (const required of REQUIRED_REDACTED_HEADERS)
@@ -306,7 +306,13 @@ export const browserScenarioRedactionSchema = z
                 path: ["header_names"],
                 message: `Required credential header ${required} must be redacted`,
             });
-});
+})
+    .default({
+    secret_values: "replace-with-secret-reference",
+    query_parameter_names: [],
+    header_names: [...REQUIRED_REDACTED_HEADERS],
+})
+    .describe("Redaction policy. Secret values and credential headers are always redacted; list query parameter names when a secret is used in a URL.");
 const snapshotKindSchema = z.enum([
     "screenshot",
     "dom",
@@ -315,10 +321,12 @@ const snapshotKindSchema = z.enum([
     "history",
     "storage",
 ]);
-export const browserScenarioCaptureSchema = z.strictObject({
-    after_each_step: z.array(snapshotKindSchema).max(6),
-    at_end: z.array(snapshotKindSchema).max(6),
-    events: z.array(z.enum([
+export const browserScenarioCaptureSchema = z
+    .strictObject({
+    after_each_step: z.array(snapshotKindSchema).default([]),
+    at_end: z.array(snapshotKindSchema).default(["url"]),
+    events: z
+        .array(z.enum([
         "console",
         "page-errors",
         "network",
@@ -327,46 +335,9 @@ export const browserScenarioCaptureSchema = z.strictObject({
         "workers",
         "popups",
         "downloads",
-    ])),
-});
-export const browserScenarioCaptureLimitsSchema = z.strictObject({
-    max_duration_ms: z
-        .number()
-        .int()
-        .min(100)
-        .max(BROWSER_SCENARIO_LIMITS.durationMs),
-    action_timeout_ms: z
-        .number()
-        .int()
-        .min(1)
-        .max(BROWSER_SCENARIO_LIMITS.actionTimeoutMs),
-    navigation_timeout_ms: z
-        .number()
-        .int()
-        .min(1)
-        .max(BROWSER_SCENARIO_LIMITS.actionTimeoutMs),
-    max_events: z.number().int().min(1).max(100_000),
-    max_frames: z.number().int().min(1).max(1_000),
-    max_workers: z.number().int().min(0).max(1_000),
-    max_popups: z.number().int().min(0).max(100),
-    max_websockets: z.number().int().min(0).max(10_000),
-    max_dom_nodes: z.number().int().min(1).max(100_000),
-    max_accessibility_nodes: z.number().int().min(1).max(100_000),
-    max_screenshots: z.number().int().min(0).max(256),
-    max_screenshot_bytes: z
-        .number()
-        .int()
-        .min(1)
-        .max(8 * 1_024 * 1_024),
-    max_storage_entries: z
-        .number()
-        .int()
-        .min(0)
-        .max(BROWSER_SCENARIO_LIMITS.storageEntries),
-    max_total_metadata_bytes: z
-        .number()
-        .int()
-        .min(1_024)
-        .max(64 * 1_024 * 1_024),
-});
+    ]))
+        .default([]),
+})
+    .default({ after_each_step: [], at_end: ["url"], events: [] })
+    .describe("Optional retained artifacts and event families. Defaults to only a final sanitized URL; request screenshots, DOM, accessibility, history, storage, and event capture explicitly.");
 export const browserScenarioAllowedOriginsSchema = browserAllowedOriginsSchema;

package/dist/domain/browserSession.js

@@ -1,14 +1,12 @@
 import { z } from "zod";
 import { browserAllowedOriginsSchema, browserEndpointSchema, } from "./browserObservation.js";
 import { browserCompletenessSchema } from "./browserCompleteness.js";
-/** Input for a bounded, navigation-aware browser observation window. */
-export const observeWebSessionInputSchema = z.object({
+/** Input for a navigation-aware browser observation window. */
+export const observeWebSessionInputSchema = z.strictObject({
     cdp_endpoint: browserEndpointSchema,
     allowed_origins: browserAllowedOriginsSchema,
-    target_id: z.string().trim().min(1).max(256),
-    approved: z.literal(true),
-    observation_ms: z.number().int().min(1).max(60_000).default(10_000),
-    max_timeline_events: z.number().int().min(1).max(20_000).default(2_000),
+    target_id: z.string().trim().min(1),
+    observation_ms: z.number().int().min(1).default(10_000),
 });
 const timelineEventSchema = z.object({
     sequence: z.number().int().min(1),
@@ -34,7 +32,6 @@ const timelineEventSchema = z.object({
 });
 /** Navigation-aware session result for external user actions. */
 export const webObservationSessionSchema = z.object({
-    schema_version: z.literal(1),
     browser: z.object({
         product: z.string(),
         protocol_version: z.string(),

package/dist/domain/bundleComparison.js

@@ -11,19 +11,16 @@ const classificationSchema = z.enum([
     "history_advanced",
     "history_diverged",
 ]);
-/** Strict bounded input for canonical Evidence bundle comparison. */
+/** Strict input for canonical Evidence bundle comparison. */
 export const bundleComparisonInputSchema = z.strictObject({
-    left_bundle_path: z.string().min(1).max(4_096),
-    right_bundle_path: z.string().min(1).max(4_096),
+    left_bundle_path: z.string().min(1),
+    right_bundle_path: z.string().min(1),
     record_pairs: z
         .array(z.object({
         left_evidence_id: evidenceIdSchema,
         right_evidence_id: evidenceIdSchema,
     }))
-        .max(500)
         .default([]),
-    offset: z.number().int().min(0).default(0),
-    limit: z.number().int().min(1).max(500).default(100),
 });
 const bundleChangeSchema = z.object({
     entity: z.enum(["evidence", "residual_unknown"]),
@@ -57,27 +54,18 @@ export const bundleComparisonResultSchema = z.object({
         unknowns_diverged: z.number().int().min(0),
         unresolved: z.number().int().min(0),
     }),
-    changes: z.object({
-        items: z.array(bundleChangeSchema).max(500),
-        offset: z.number().int().min(0),
-        limit: z.number().int().min(1).max(500),
-        total: z.number().int().min(0),
-        next_offset: z.number().int().min(0).nullable(),
-    }),
+    changes: z.array(bundleChangeSchema),
     limitations: z.array(z.string()),
 });
-const MAX_ENTITIES = 100_000;
 /** Compare canonical bundle membership and only explicitly paired observations. */
-export const compareBundles = (...[leftInput, rightInput, recordPairs, offset, limit]) => {
+export const compareBundles = (leftInput, rightInput, recordPairs = []) => {
     const left = parseEvidenceBundle(leftInput);
     const right = parseEvidenceBundle(rightInput);
-    enforceBounds(left, right);
     const leftDigest = bundleDigest(left);
     const rightDigest = bundleDigest(right);
     const recordResult = compareRecords(left, right, recordPairs);
     const unknownResult = compareUnknowns(left, right);
     const changes = [...recordResult.changes, ...unknownResult.changes].sort(compareChanges);
-    const page = changes.slice(offset, offset + limit);
     const unresolved = changes.filter(({ conclusion_kind: kind }) => kind !== "observed_change").length;
     return bundleComparisonResultSchema.parse({
         status: leftDigest === rightDigest && changes.length === 0
@@ -92,13 +80,7 @@ export const compareBundles = (...[leftInput, rightInput, recordPairs, offset, l
             ...unknownResult.summary,
             unresolved,
         },
-        changes: {
-            items: page,
-            offset,
-            limit,
-            total: changes.length,
-            next_offset: offset + page.length < changes.length ? offset + page.length : null,
-        },
+        changes,
         limitations: changes.some(({ limitations }) => limitations.length > 0)
             ? [
                 "One-sided membership proves only bundle inclusion or omission, not behavioral absence.",
@@ -237,14 +219,6 @@ const historyEvidenceIds = (history) => [
         ...(item.resolution?.evidence_ids ?? []),
     ])),
 ].sort(ascii);
-const enforceBounds = (left, right) => {
-    const total = left.records.length +
-        right.records.length +
-        left.unknowns.length +
-        right.unknowns.length;
-    if (total > MAX_ENTITIES)
-        throw new TypeError(`Bundle comparison exceeds ${MAX_ENTITIES} entities`);
-};
 const bundleDigest = (bundle) => createHash("sha256").update(serializeEvidenceBundle(bundle)).digest("hex");
 const same = (left, right) => left.length === right.length &&
     left.every((value, index) => value === right[index]);

package/dist/domain/bytecodeProvider.js

@@ -58,7 +58,7 @@ export const bytecodeAnalysisSchema = z.strictObject({
     /** Bytecode family. */
     family: bytecodeFamilySchema,
     /** All discovered artifacts. */
-    artifacts: z.array(bytecodeArtifactSchema).min(0).max(10_000),
+    artifacts: z.array(bytecodeArtifactSchema),
     /** Total symbols across all artifacts. */
     total_symbols: z.number().int().nonnegative(),
     /** Symbols classified as application code. */
@@ -109,71 +109,70 @@ export function detectArtifactFormat(path) {
         return "zipapp";
     return null;
 }
+const STANDARD_LIBRARY_PATH_MARKERS = [
+    "/stdlib/",
+    "/site-packages/",
+    "java/",
+    "javax/",
+    "sun/",
+];
+const STANDARD_LIBRARY_SYMBOL_MARKERS = ["java.", "javax.", "sun.", "__"];
+const GENERATED_PATH_MARKERS = [
+    "/generated/",
+    "_generated",
+    "/build/",
+    "/target/",
+    "/dist-packages/",
+    "/__pycache__/",
+];
+const GENERATED_SYMBOL_MARKERS = ["Generated", "_generated"];
+const VENDORED_PATH_MARKERS = [
+    "/vendor/",
+    "/vendored/",
+    "/third_party/",
+    "/3rdparty/",
+    "/node_modules/",
+];
+const BUNDLED_PATH_MARKERS = ["/bundle/", "/bundled/", ".jar!", ".war!"];
+const includesAny = (value, markers) => markers.some((marker) => value.includes(marker));
+const startsWithAny = (value, markers) => markers.some((marker) => value.startsWith(marker));
 /** Classify bytecode symbol provenance. */
 export function classifyProvenance(path, symbolName) {
     const lower = path.toLowerCase();
-    // Standard library paths
-    if (lower.includes("/stdlib/") ||
-        lower.includes("/site-packages/") ||
-        lower.includes("java/") ||
-        lower.includes("javax/") ||
-        lower.includes("sun/") ||
-        symbolName.startsWith("java.") ||
-        symbolName.startsWith("javax.") ||
-        symbolName.startsWith("sun.") ||
-        symbolName.startsWith("__")) {
+    if (includesAny(lower, STANDARD_LIBRARY_PATH_MARKERS) ||
+        startsWithAny(symbolName, STANDARD_LIBRARY_SYMBOL_MARKERS))
         return "standard_library";
-    }
-    // Generated code
-    if (lower.includes("/generated/") ||
-        lower.includes("_generated") ||
-        lower.includes("/build/") ||
-        lower.includes("/target/") ||
-        lower.includes("/dist-packages/") ||
-        lower.includes("/__pycache__/") ||
-        symbolName.includes("Generated") ||
-        symbolName.includes("_generated")) {
+    if (includesAny(lower, GENERATED_PATH_MARKERS) ||
+        includesAny(symbolName, GENERATED_SYMBOL_MARKERS))
         return "generated";
-    }
-    // Vendored code
-    if (lower.includes("/vendor/") ||
-        lower.includes("/vendored/") ||
-        lower.includes("/third_party/") ||
-        lower.includes("/3rdparty/") ||
-        lower.includes("/node_modules/") ||
-        lower.includes("/vendor/")) {
+    if (includesAny(lower, VENDORED_PATH_MARKERS))
         return "vendored";
-    }
-    // Bundled code
-    if (lower.includes("/bundle/") ||
-        lower.includes("/bundled/") ||
-        lower.includes(".jar!") ||
-        lower.includes(".war!")) {
+    if (includesAny(lower, BUNDLED_PATH_MARKERS))
         return "bundled";
-    }
     return "application";
 }
 /** Analyze a set of bytecode artifacts and produce a summary. */
 export function analyzeBytecodeArtifacts(artifacts, family) {
-    const applicationSymbols = artifacts
-        .flatMap((a) => a.symbols)
-        .filter((s) => s.provenance === "application").length;
-    const generatedSymbols = artifacts
-        .flatMap((a) => a.symbols)
-        .filter((s) => s.provenance === "generated").length;
-    const vendoredSymbols = artifacts
-        .flatMap((a) => a.symbols)
-        .filter((s) => s.provenance === "vendored").length;
-    const standardLibrarySymbols = artifacts
-        .flatMap((a) => a.symbols)
-        .filter((s) => s.provenance === "standard_library").length;
+    const totals = artifacts.reduce((counts, artifact) => {
+        counts.total += artifact.symbols.length;
+        for (const symbol of artifact.symbols)
+            counts[symbol.provenance] += 1;
+        return counts;
+    }, {
+        total: 0,
+        application: 0,
+        generated: 0,
+        vendored: 0,
+        standard_library: 0,
+        bundled: 0,
+    });
     return {
         family,
-        artifacts: artifacts.slice(0, 10_000),
-        total_symbols: artifacts.reduce((sum, a) => sum + a.symbols.length, 0),
-        application_symbols: applicationSymbols,
-        generated_symbols: generatedSymbols,
-        vendored_symbols: vendoredSymbols,
-        standard_library_symbols: standardLibrarySymbols,
+        artifacts: [...artifacts],
+        total_symbols: totals.total,
+        application_symbols: totals.application,
+        generated_symbols: totals.generated,
+        vendored_symbols: totals.vendored,
+        standard_library_symbols: totals.standard_library,
     };
 }