rea-agents 3.0.0 → 3.2.0

package/dist/application/Doctor.js

@@ -2,9 +2,8 @@ import { constants } from "node:fs";
 import { access, readFile, readdir } from "node:fs/promises";
 import { homedir } from "node:os";
 import { delimiter, join } from "node:path";
-import { execFile } from "node:child_process";
-import { promisify } from "node:util";
-import { parseBinaryTarget } from "../domain/binaryTarget.js";
+import { parseBinaryTarget } from "./BinaryTargetResolver.js";
+import { execFileOutput } from "../process/ExecFileOutput.js";
 import { probeHomebrew } from "./homebrew.js";
 import { linuxHopperBinarySupported, linuxSharedLibrariesAvailable, readLinuxDistribution, } from "./LinuxHopper.js";
 import { CATALOG_IDENTITY } from "../catalogIdentity.js";
@@ -13,7 +12,6 @@ import { readClientRegistrationStatuses, } from "./ClientRegistrationStatus.js";
 import { inspectRuntimeExecutables, } from "./RuntimeExecutableDiagnostics.js";
 import { collectDoctorDiagnostics, doctorHealthy, } from "./DoctorDiagnostics.js";
 import { normalizeDoctorScope, scopeDoctorChecks, } from "./DoctorScope.js";
-const execFileAsync = promisify(execFile);
 /** Deep provider IDs whose readiness can be selected explicitly by doctor. */
 export const DOCTOR_PROVIDER_IDS = ["hopper", "ghidra"];
 /**
@@ -56,14 +54,14 @@ export const runDoctor = async (target, host = systemDoctorHost(), requestedScop
 };
 const collectDoctorIdentity = async (host, runtimeExecutables) => {
     const installationPaths = (await host.installationPaths?.()) ?? [];
-    const installedSkillIdentity = await readInstalledSkillIdentity(host);
+    const installedSkillIdentity = await host.installedSkillIdentity?.();
     const skillAligned = skillIdentityAligned(installedSkillIdentity);
     const registrations = (await host.clientRegistrations?.()) ?? [];
     return {
         checks: [
             ...(skillAligned ? [] : [skillIdentityCheck(installedSkillIdentity)]),
             ...registrations
-                .filter(({ state }) => state !== "aligned")
+                .filter((registration) => registration.state !== "aligned")
                 .map(registrationCheck),
         ],
         value: {
@@ -73,7 +71,7 @@ const collectDoctorIdentity = async (host, runtimeExecutables) => {
             catalog: CATALOG_IDENTITY,
             live_server: {
                 state: "unknown",
-                remediation: "Compare rea://server/identity or binary_session from the active client; an on-disk registration cannot prove the running server version.",
+                remediation: "Call binary_session in the active client to inspect the running server identity.",
             },
             installations: {
                 paths: installationPaths,
@@ -97,15 +95,6 @@ const collectDoctorIdentity = async (host, runtimeExecutables) => {
         },
     };
 };
-const readInstalledSkillIdentity = async (host) => {
-    const observed = await host.installedSkillIdentity?.();
-    if (observed !== undefined)
-        return observed;
-    const legacyVersion = await host.installedSkillVersion?.();
-    return legacyVersion === undefined
-        ? undefined
-        : { version: legacyVersion, toolCount: null, catalogDigest: null };
-};
 const skillIdentityAligned = (identity) => identity?.version === PRODUCT_IDENTITY.skillVersion &&
     identity.toolCount === CATALOG_IDENTITY.counts.mcp_tools &&
     identity.catalogDigest === CATALOG_IDENTITY.digests.combined_sha256;
@@ -123,8 +112,7 @@ const registrationCheck = (registration) => ({
     ok: false,
     classification: "config_drift",
     detail: registration.config_path,
-    remediation: registration.remediation ??
-        "Run rea setup, then restart the affected client.",
+    remediation: registration.remediation,
 });
 const installationState = (paths) => paths.length === 0 ? "unknown" : paths.length === 1 ? "single" : "multiple";
 /** Create diagnostics backed by the current process and host commands. */
@@ -149,7 +137,7 @@ export const systemDoctorHost = (options = {}) => ({
     async brewHopperPath() {
         return probeHomebrew(async (command) => {
             try {
-                const prefix = (await execFileAsync(command, [
+                const prefix = (await execFileOutput(command, [
                     "--prefix",
                     "--cask",
                     "hopper-disassembler",
@@ -171,7 +159,7 @@ export const systemDoctorHost = (options = {}) => ({
     async ilspyCmdVersion(path) {
         try {
             await access(path, constants.X_OK);
-            return firstIlspyVersionLine((await execFileAsync(path, ["--version"], { timeout: 10_000 })).stdout);
+            return firstIlspyVersionLine((await execFileOutput(path, ["--version"], { timeout: 10_000 })).stdout);
         }
         catch {
             return undefined;
@@ -189,19 +177,18 @@ export const systemDoctorHost = (options = {}) => ({
         try {
             const command = process.platform === "win32" ? "where" : "which";
             const arguments_ = process.platform === "win32" ? ["rea"] : ["-a", "rea"];
-            return uniqueLines((await execFileAsync(command, arguments_)).stdout);
+            return uniqueLines((await execFileOutput(command, arguments_)).stdout);
         }
         catch {
             return [];
         }
     },
-    installedSkillVersion,
     installedSkillIdentity,
     clientRegistrations: () => readClientRegistrationStatuses(homedir()),
 });
 const readMacosVersion = async () => {
     try {
-        return (await execFileAsync("sw_vers", ["-productVersion"])).stdout.trim();
+        return (await execFileOutput("sw_vers", ["-productVersion"])).stdout.trim();
     }
     catch {
         return undefined;
@@ -212,7 +199,7 @@ const executableAvailable = async (path) => {
         await access(path, constants.X_OK);
         if (process.platform !== "linux")
             return true;
-        const linked = await execFileAsync("ldd", [path]);
+        const linked = await execFileOutput("ldd", [path]);
         return linuxSharedLibrariesAvailable(`${linked.stdout}\n${linked.stderr}`);
     }
     catch {
@@ -242,14 +229,6 @@ const manualHopperPaths = async () => {
     return paths;
 };
 const readInstalledSkill = () => readFile(join(homedir(), ".agents/skills", PRODUCT_IDENTITY.skillName, "SKILL.md"), "utf8");
-const installedSkillVersion = async () => {
-    try {
-        return /^\s{2}version:\s*"([^"]+)"\s*$/mu.exec(await readInstalledSkill())?.[1];
-    }
-    catch {
-        return undefined;
-    }
-};
 const installedSkillIdentity = async () => {
     try {
         const content = await readInstalledSkill();

package/dist/application/DoctorDiagnostics.js

@@ -70,9 +70,8 @@ const runtimeChecks = (inventory) => {
     const detail = broken.length === 0
         ? `${String(inventory.candidates.length)} runtime executable candidates passed bounded version probes.`
         : `${String(broken.length)} of ${String(inventory.candidates.length)} runtime executable candidates failed bounded version probes: ${broken
-            .slice(0, 5)
             .map(({ lexical_path: path }) => path)
-            .join(", ")}${broken.length > 5 ? ", …" : ""}`;
+            .join(", ")}`;
     return [
         check("node-toolchains", broken.length === 0, detail, {
             remediation: "Select a verified healthy Node toolchain or repair the failing installation, then rerun rea doctor. Do not create compatibility-library symlinks.",

package/dist/application/DoctorScope.js

@@ -88,7 +88,7 @@ const registrationCheck = (status) => ({
     ok: false,
     classification: "config_drift",
     detail: status.config_path,
-    remediation: status.remediation ?? "Run rea setup, then restart the affected client.",
+    remediation: status.remediation,
 });
 const selectedSkillCheck = (state, checks) => checks.find(({ name }) => name === "skill:identity") ?? {
     name: "skill:identity",

package/dist/application/ElectronActiveEvidence.js

@@ -0,0 +1,50 @@
+import { createEvidence } from "../domain/evidence.js";
+import { jsonValueSchema } from "../domain/jsonValue.js";
+import { digestJson } from "./JavaScriptReplayPlanning.js";
+/** Create Evidence without retaining arbitrary runtime argument values. */
+export const createElectronActiveEvidence = (input, result, provider) => createEvidence(undefined, provider, {
+    predicateType: "rea.electron-active-scenario",
+    operation: "capture_electron_scenario",
+    parameters: parameters(input),
+    result: jsonValueSchema.parse(result),
+    confidence: "observed",
+    authority: "controlled-replay",
+    environment: {
+        id: `${result.application.electron_version}@${process.platform}`,
+        platform: process.platform,
+        architecture: process.arch,
+        isolation: "none",
+    },
+    limitations: result.limitations,
+});
+const scenarioProjection = (input) => ({
+    executable_path: input.executable_path,
+    application_path: input.application_path,
+    application_root: input.application_root,
+    args: redactArguments(input.args),
+    actions: input.actions.map(({ step_id, kind }) => ({ step_id, kind })),
+});
+const parameters = (input) => ({
+    ...scenarioProjection(input),
+    scenario_sha256: digestJson(scenarioProjection(input)),
+});
+const redactArguments = (arguments_) => {
+    let redactNext = false;
+    return arguments_.map((argument) => {
+        if (redactNext) {
+            redactNext = false;
+            return "<redacted>";
+        }
+        if (sensitiveFlag.test(argument)) {
+            redactNext = true;
+            return argument;
+        }
+        return redactArgument(argument);
+    });
+};
+const sensitiveFlag = /^--?(?:password|token|secret|api[-_]?key|authorization|cookie)$/iu;
+const redactArgument = (argument) => {
+    if (/^--?(?:password|token|secret|api[-_]?key|authorization|cookie)=/iu.test(argument))
+        return `${argument.slice(0, argument.indexOf("=") + 1)}<redacted>`;
+    return argument;
+};

package/dist/application/ElectronActiveObservationPort.js

@@ -0,0 +1 @@
+export {};

package/dist/application/ElectronActiveObservationService.js

@@ -0,0 +1,78 @@
+import { projectPermissionFailure } from "./PermissionFailure.js";
+import { realpath } from "node:fs/promises";
+import { digestJson } from "./JavaScriptReplayPlanning.js";
+import { AnalysisCapabilityUnavailableError, AnalysisInputError, } from "../domain/errors.js";
+import { isPathContained } from "../domain/permissionPolicy.js";
+import { err } from "../domain/result.js";
+import { createElectronActiveEvidence } from "./ElectronActiveEvidence.js";
+const OPERATION = "capture_electron_scenario";
+const PROVIDER_ID = "rea-playwright-electron-active";
+const canonicalizeInput = async (input) => {
+    try {
+        const [executablePath, applicationPath, applicationRoot] = await Promise.all([
+            realpath(input.executable_path),
+            realpath(input.application_path),
+            realpath(input.application_root),
+        ]);
+        if (!isPathContained(applicationRoot, applicationPath))
+            return err(new AnalysisInputError(OPERATION, undefined, [
+                {
+                    path: ["application_path"],
+                    reason: "invalid_value",
+                    message: "application_path must remain beneath application_root after symlink resolution",
+                },
+            ]));
+        return {
+            ok: true,
+            value: {
+                ...input,
+                executable_path: executablePath,
+                application_path: applicationPath,
+                application_root: applicationRoot,
+            },
+        };
+    }
+    catch (cause) {
+        return err(new AnalysisInputError(OPERATION, { cause }, [
+            {
+                path: ["application_path"],
+                reason: "invalid_format",
+                message: "Electron executable, application, and root must resolve to existing paths",
+            },
+        ]));
+    }
+};
+const authorize = async (authority, input) => {
+    const canonical = await canonicalizeInput(input);
+    if (!canonical.ok)
+        return canonical;
+    if (authority === undefined)
+        return err(new AnalysisCapabilityUnavailableError(PROVIDER_ID, OPERATION, "active Electron observation permission policy is not configured"));
+    const authorized = await authority.authorize({
+        capability: "electron_automate",
+        roots: [canonical.value.application_root],
+        executables: [canonical.value.executable_path],
+        environment_names: [],
+        network: "external",
+        mount: false,
+        operation_identity: `${OPERATION}:${digestJson(canonical.value)}`,
+    }, "write");
+    if (!authorized.ok)
+        return err(projectPermissionFailure(authorized.error));
+    return canonical;
+};
+/** Authorize and execute one bounded, provider-owned Electron experiment. */
+export const captureElectronScenario = async (provider, authority, input, options = {}) => {
+    const authorized = await authorize(authority, input);
+    if (!authorized.ok)
+        return authorized;
+    if (provider === undefined)
+        return err(new AnalysisCapabilityUnavailableError(PROVIDER_ID, OPERATION, "active Electron observation provider is not configured"));
+    const captured = await provider.capture(authorized.value, options);
+    return captured.ok
+        ? {
+            ok: true,
+            value: createElectronActiveEvidence(authorized.value, captured.value, provider.identity()),
+        }
+        : captured;
+};

package/dist/application/ElectronBoundaryAnalysis.js

@@ -70,12 +70,13 @@ export const summarizeElectronBoundaries = (analysis) => {
         },
         sender_validation_observations: validations.length,
         utility_processes: utilities.length,
-        resolved_utility_entrypoints: utilities.filter(({ file, finding }) => resolvesToFile({
-            file,
-            specifier: finding.module_path,
-            context: finding.module_resolution_context ?? "module-specifier",
-            files,
-        })).length,
+        resolved_utility_entrypoints: utilities.filter(({ file, finding }) => finding.module_path !== null &&
+            resolvesToFile({
+                file,
+                specifier: finding.module_path,
+                context: finding.module_resolution_context,
+                files,
+            })).length,
         native_addon_bindings: nativeBindings.length,
         resolved_native_addon_bindings: nativeBindings.filter(({ file, finding }) => resolvesToFile({
             file,
@@ -97,8 +98,6 @@ const isPairableRendererTransmission = (record) => isRendererTransmission(record
 const isMainHandler = ({ finding }) => finding.side === "main" &&
     (finding.mode === "listen" || finding.mode === "handle");
 const resolvesToFile = (input) => {
-    if (input.specifier === null)
-        return false;
     const resolved = resolveArtifactPathByContext({
         declaredPath: input.specifier,
         sourcePath: input.file.path,

package/dist/application/ElectronBoundaryGraphContext.js

@@ -9,7 +9,7 @@ export const electronObservationIdentity = (context, scope, key) => ({
     strategy: "observation-fingerprint",
     stability: "observation-only",
     observation_sha256: sha256Text(`${context.snapshot.manifest.root_sha256}\0${scope}\0${key}`),
-    scope: scope.slice(0, 4_096),
+    scope,
 });
 /** Add a direct AST syntax relationship. */
 export const addElectronAstEdge = (context, input) => {

package/dist/application/ElectronBoundaryGraphIpc.js

@@ -96,7 +96,7 @@ const addHandlerNode = (input) => {
     const handlerRange = finding.handler_location ?? finding.location;
     const handler = context.accumulator.addNode({
         kind: "ipc-handler",
-        identity: artifactLocalIdentity(file.sha256, "electron-ipc-handler", `${finding.side}:${finding.operation}:${finding.channel ?? finding.channel_expression ?? "[missing]"}:${electronRangeKey(handlerRange)}`),
+        identity: artifactLocalIdentity(file.sha256, "electron-ipc-handler", `${finding.side}:${finding.operation}:${finding.channel ?? finding.channel_expression}:${electronRangeKey(handlerRange)}`),
         observations: [
             {
                 label: finding.channel,
@@ -177,7 +177,7 @@ const addValidationObservations = (state) => {
         const { file, javascript } = analyzed;
         if (javascript === null)
             continue;
-        const coverage = javascriptAnalysisCoverage(javascript, state.context.input);
+        const coverage = javascriptAnalysisCoverage(javascript);
         for (const validation of javascript.electron.sender_validations) {
             const handlerRecord = containingHandler(state.records, file, validation);
             const target = handlerRecord === undefined
@@ -238,5 +238,5 @@ const coverageFor = (context, file) => {
     const javascript = context.analysis.files.find(({ file: candidate }) => candidate.path === file.path)?.javascript;
     return javascript === null || javascript === undefined
         ? undefined
-        : javascriptAnalysisCoverage(javascript, context.input);
+        : javascriptAnalysisCoverage(javascript);
 };

package/dist/application/ElectronBoundaryGraphNative.js

@@ -7,7 +7,7 @@ export const addElectronNativeBoundaries = (context) => {
         const { file, javascript } = analyzed;
         if (javascript === null)
             continue;
-        const coverage = javascriptAnalysisCoverage(javascript, context.input);
+        const coverage = javascriptAnalysisCoverage(javascript);
         for (const value of javascript.electron.native_addon_bindings)
             addNativeBinding({ context, file, value, coverage });
     }
@@ -29,7 +29,6 @@ const addNativeBinding = (input) => {
                     specifier: value.specifier,
                     binding_kind: value.binding_kind,
                     requested_members: value.members,
-                    members_truncated: value.members_truncated,
                     resolved_path: resolved,
                     native_export_verification: "not-performed",
                 },

package/dist/application/ElectronBoundaryGraphWindows.js

@@ -8,7 +8,7 @@ export const addElectronWindowBoundaries = (context) => {
         const { file, javascript } = analyzed;
         if (javascript === null)
             continue;
-        const coverage = javascriptAnalysisCoverage(javascript, context.input);
+        const coverage = javascriptAnalysisCoverage(javascript);
         for (const value of javascript.electron.browser_windows) {
             const source = electronFindingSourceNode(context, file, value.module_key);
             if (source !== undefined)
@@ -39,7 +39,6 @@ const addBrowserWindow = (input) => {
                     options_status: value.options_status,
                     web_preferences_status: value.web_preferences_status,
                     web_preferences: value.web_preferences,
-                    omitted_web_preferences: value.omitted_web_preferences,
                     preload_path: value.preload_path,
                     preload_resolution_context: value.preload_resolution_context,
                     absence_means_default: false,
@@ -70,13 +69,13 @@ const addBrowserWindow = (input) => {
     addWindowPreload(input, window);
 };
 const addWindowPreload = (input, window) => {
-    const declared = input.value.preload_path;
-    if (declared === null)
+    if (input.value.preload_path === null)
         return;
+    const { preload_path: declared, preload_resolution_context: resolutionContext, } = input.value;
     const resolution = resolveArtifactPathByContext({
         declaredPath: declared,
         sourcePath: input.file.path,
-        context: input.value.preload_resolution_context ?? "module-specifier",
+        context: resolutionContext,
         files: input.context.filesByPath,
     });
     const role = createElectronRoleNode(input.context, {
@@ -127,7 +126,6 @@ const addContextBridge = (input) => {
                     api_status: value.api_status,
                     members: value.members,
                     unknown_members: value.unknown_members,
-                    omitted_members: value.omitted_members,
                 },
                 evidence: astObservationEvidence({
                     sha256: file.sha256,
@@ -158,7 +156,7 @@ const addUtilityProcess = (input) => {
     const { context, file, value, coverage } = input;
     const utility = context.accumulator.addNode({
         kind: "electron-utility",
-        identity: artifactLocalIdentity(file.sha256, "electron-utility-process", `${value.module_path ?? value.module_expression ?? "[missing]"}:${electronRangeKey(value.location)}`),
+        identity: artifactLocalIdentity(file.sha256, "electron-utility-process", `${value.module_path ?? value.module_expression}:${electronRangeKey(value.location)}`),
         observations: [
             {
                 label: value.service_name ?? value.module_path,
@@ -196,7 +194,7 @@ const addUtilityProcess = (input) => {
     const resolution = resolveArtifactPathByContext({
         declaredPath: value.module_path,
         sourcePath: file.path,
-        context: value.module_resolution_context ?? "module-specifier",
+        context: value.module_resolution_context,
         files: context.filesByPath,
     });
     const resolved = resolution.resolved_path;

package/dist/application/ElectronEvidence.js

@@ -1,10 +1,10 @@
 import { createEvidence, } from "../domain/evidence.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";
-/** Create Evidence v2 for one root-confined Electron observation. */
+/** Create Evidence for one Electron observation. */
 export const createElectronEvidence = (operation, input, result, provider) => createEvidence(undefined, provider, {
     predicateType: operation === "list_electron_targets"
-        ? "rea.electron-target-list/v1"
-        : "rea.electron-page-inspection/v1",
+        ? "rea.electron-target-list"
+        : "rea.electron-page-inspection",
     operation,
     parameters: parameters(input),
     result: jsonValueSchema.parse(result),
@@ -22,14 +22,11 @@ export const createElectronEvidence = (operation, input, result, provider) => cr
 });
 const parameters = (input) => ({
     cdp_endpoint: input.cdp_endpoint,
-    allowed_file_roots: input.allowed_file_roots,
     ...("target_id" in input
         ? {
             target_id: input.target_id,
             observation_ms: input.observation_ms,
             include_script_sources: input.include_script_sources,
-            source_capture_approved: input.source_capture_approved,
-            limits: input.limits,
         }
-        : { offset: input.offset, limit: input.limit }),
+        : {}),
 });

package/dist/application/ElectronObservationService.js

@@ -1,7 +1,8 @@
-import { AnalysisCapabilityUnavailableError, AnalysisProtocolError, PermissionRequiredError, } from "../domain/errors.js";
+import { projectPermissionFailure } from "./PermissionFailure.js";
+import { AnalysisCapabilityUnavailableError, } from "../domain/errors.js";
 import { err, ok } from "../domain/result.js";
 import { createElectronEvidence } from "./ElectronEvidence.js";
-/** Authorize and list root-confined Electron page targets. */
+/** Authorize and list Electron file pages exposed by the selected endpoint. */
 export const listElectronTargets = async (provider, authority, input, options = {}) => {
     const ready = await prepare(provider, authority, input, "list_electron_targets");
     if (!ready.ok)
@@ -26,20 +27,15 @@ const prepare = async (provider, authority, input, operation) => {
         return err(new AnalysisCapabilityUnavailableError("rea-cdp-electron", operation, "Electron observation permission policy is not configured"));
     const authorized = await authority.authorize({
         capability: "electron_observe",
-        roots: input.allowed_file_roots,
+        roots: [],
         executables: [],
         environment_names: [],
-        origins: [input.cdp_endpoint],
         network: "loopback",
         mount: false,
         operation_identity: `${operation}:${"target_id" in input ? input.target_id : input.cdp_endpoint}`,
     }, "read");
     if (!authorized.ok)
-        return err(authorized.error instanceof PermissionRequiredError
-            ? authorized.error
-            : new AnalysisProtocolError(authorized.error.message, {
-                cause: authorized.error,
-            }));
+        return err(projectPermissionFailure(authorized.error));
     return provider === undefined
         ? err(new AnalysisCapabilityUnavailableError("rea-cdp-electron", operation, "Electron observation provider is not configured"))
         : ok(provider);

package/dist/application/EnhancedLiteralTracing.js

@@ -1,86 +1,78 @@
+import { z } from "zod";
 import { AnalysisOutputError } from "../domain/errors.js";
-import { parseAddressedPage } from "../domain/hopperValues.js";
 import { err, ok } from "../domain/result.js";
 const FEATURE_SEARCH_SOURCES = [
-    ["list_strings", "string"],
-    ["list_procedures", "procedure"],
+    ["search_strings", "string"],
+    ["search_procedures", "procedure"],
 ];
 const STRING_SEARCH_SOURCES = [
-    ["list_strings", "string"],
+    ["search_strings", "string"],
 ];
-/** Trace a bounded feature or string literal through provider xrefs. */
+/** Trace every matching feature or string literal through provider xrefs. */
 export const traceLiteralFeature = async (call, input, scope, signal) => {
     const sources = scope === "feature" ? FEATURE_SEARCH_SOURCES : STRING_SEARCH_SOURCES;
     const searched = await literalMatches(call, input, sources, signal);
     if (!searched.ok)
         return searched;
-    const residual = new Set();
     const traced = await traceReferences(call, {
         matches: searched.value.matches,
-        limit: input.limit,
-        operationBudget: input.max_operations - searched.value.operations,
         ...(signal === undefined ? {} : { signal }),
     });
     if (!traced.ok)
         return traced;
-    for (const reason of traced.value.residual)
-        residual.add(reason);
-    const operations = searched.value.operations + traced.value.operations;
-    if (operations >= input.max_operations)
-        residual.add("Investigation reached the operation budget.");
-    if (searched.value.matches.length >= input.limit)
-        residual.add("Literal matches reached the configured limit.");
     return ok({
         query: input.query,
         search_mode: "literal",
-        operations_used: operations,
-        operation_budget: input.max_operations,
         matches: searched.value.matches,
         references: traced.value.references,
-        truncated: residual.size > 0,
-        residual_unknowns: [...residual],
+        truncated: false,
+        residual_unknowns: [],
     });
 };
 const literalMatches = async (call, input, sources, signal) => {
-    let operations = 0;
     const matches = [];
-    const needle = input.case_sensitive ? input.query : input.query.toLowerCase();
-    for (const [tool, type] of sources) {
-        let offset = 0;
-        while (operations < input.max_operations && matches.length < input.limit) {
-            operations += 1;
-            const result = await call(tool, { offset, limit: 500 }, signal);
+    const needles = [...new Set(input.query.trim().split(/\s+/u))];
+    const matched = new Set();
+    for (const needle of needles) {
+        for (const [tool, type] of sources) {
+            const result = await call(tool, {
+                pattern: needle,
+                mode: "literal",
+                case_sensitive: input.case_sensitive,
+            }, signal);
             if (!result.ok)
                 return result;
-            const page = parseAddressedPage(result.value);
-            if (!page.ok)
-                return page;
-            for (const item of page.value.items) {
-                const haystack = input.case_sensitive
-                    ? item.name
-                    : item.name.toLowerCase();
-                if (haystack.includes(needle))
-                    matches.push({ type, address: item.address, value: item.name });
-                if (matches.length >= input.limit)
-                    break;
-            }
-            if (!page.value.hasMore || page.value.nextOffset === null)
-                break;
-            offset = page.value.nextOffset;
+            const items = z
+                .array(z.object({ address: z.string(), value: z.string() }))
+                .safeParse(result.value);
+            if (!items.success)
+                return err(new AnalysisOutputError(tool, "provider returned an invalid search result"));
+            addPageMatches({
+                items: items.data.map(({ address, value: name }) => ({
+                    address,
+                    name,
+                })),
+                type,
+                matches,
+                matched,
+            });
         }
     }
-    return ok({ matches, operations });
+    return ok({ matches });
+};
+const addPageMatches = (input) => {
+    const { items, type, matches, matched } = input;
+    for (const item of items) {
+        const key = `${type}\u0000${item.address}`;
+        if (matched.has(key))
+            continue;
+        matches.push({ type, address: item.address, value: item.name });
+        matched.add(key);
+    }
 };
 const traceReferences = async (call, request) => {
-    let operations = 0;
     const references = [];
-    const residual = new Set();
     for (const match of request.matches) {
-        if (operations >= request.operationBudget) {
-            residual.add("Reference traversal stopped at the operation budget.");
-            break;
-        }
-        operations += 1;
         const xrefs = await call("xrefs", { address: match.address }, request.signal);
         if (!xrefs.ok)
             return xrefs;
@@ -89,11 +81,6 @@ const traceReferences = async (call, request) => {
         for (const source of xrefs.value) {
             if (typeof source !== "string")
                 return err(new AnalysisOutputError("xrefs", "provider returned a non-address value"));
-            if (operations >= request.operationBudget) {
-                residual.add("Containing-procedure resolution stopped at the operation budget.");
-                break;
-            }
-            operations += 1;
             const resolved = await call("resolve_containing_procedure", { address: source }, request.signal);
             if (!resolved.ok)
                 return resolved;
@@ -102,17 +89,7 @@ const traceReferences = async (call, request) => {
                 source_address: source,
                 containing_procedure: resolved.value,
             });
-            if (references.length >= request.limit) {
-                residual.add("Reference results reached the configured limit.");
-                break;
-            }
         }
-        if (references.length >= request.limit)
-            break;
     }
-    return ok({
-        references,
-        operations,
-        residual: [...residual],
-    });
+    return ok({ references });
 };