rea-agents 3.0.0 → 3.2.0

package/dist/domain/webBundleAnalysis.js

@@ -1,56 +1,9 @@
 import { z } from "zod";
-import { inspectWebPageInputSchema } from "./browserObservation.js";
+import { inspectWebPageWithSourceInputSchema } from "./browserObservation.js";
 import { webTextArtifactSchema } from "./webContentArtifact.js";
-const webBundleLimitsSchema = z.object({
-    max_findings: z.number().int().min(1).max(10_000).default(1_000),
-    max_ast_nodes: z.number().int().min(1).max(2_000_000).default(250_000),
-    max_source_maps: z.number().int().min(1).max(1_000).default(100),
-    max_source_map_bytes: z
-        .number()
-        .int()
-        .min(1)
-        .max(16 * 1_024 * 1_024)
-        .default(4 * 1_024 * 1_024),
-    max_total_source_map_bytes: z
-        .number()
-        .int()
-        .min(1)
-        .max(64 * 1_024 * 1_024)
-        .default(16 * 1_024 * 1_024),
-    max_source_map_mappings: z.number().int().min(1).max(100_000).default(10_000),
-    max_original_sources: z.number().int().min(1).max(20_000).default(2_000),
-});
-/** Capture-and-analyze input with separate source and source-map approvals. */
-export const analyzeWebBundleInputSchema = inspectWebPageInputSchema
-    .safeExtend({
-    include_script_sources: z.literal(true).default(true),
-    source_capture_approved: z.literal(true),
+/** Capture-and-analyze input with optional source-map fetching. */
+export const analyzeWebBundleInputSchema = inspectWebPageWithSourceInputSchema.safeExtend({
     fetch_source_maps: z.boolean().default(false),
-    source_map_fetch_approved: z.boolean().default(false),
-    analysis_limits: webBundleLimitsSchema.default({
-        max_findings: 1_000,
-        max_ast_nodes: 250_000,
-        max_source_maps: 100,
-        max_source_map_bytes: 4 * 1_024 * 1_024,
-        max_total_source_map_bytes: 16 * 1_024 * 1_024,
-        max_source_map_mappings: 10_000,
-        max_original_sources: 2_000,
-    }),
-})
-    .superRefine((input, context) => {
-    if (input.fetch_source_maps && !input.source_map_fetch_approved)
-        context.addIssue({
-            code: "custom",
-            path: ["source_map_fetch_approved"],
-            message: "Source-map network fetch requires separate approval",
-        });
-    if (input.analysis_limits.max_source_map_bytes >
-        input.analysis_limits.max_total_source_map_bytes)
-        context.addIssue({
-            code: "custom",
-            path: ["analysis_limits", "max_source_map_bytes"],
-            message: "Per-map source-map byte limit cannot exceed the aggregate limit",
-        });
 });
 const sourceLocationSchema = z.object({
     script_key: z.string(),
@@ -69,72 +22,91 @@ const findingSchema = z.object({
     mechanism: z.string(),
     location: sourceLocationSchema,
 });
-const sourceMapSchema = z.object({
-    script_key: z.string(),
-    declared_url: z.string(),
-    status: z.enum([
-        "included",
-        "fetch_failed",
-        "invalid",
-        "policy_filtered",
-        "truncated",
-    ]),
+const originalSourceSchema = z.object({
+    source: z.string(),
     artifact: webTextArtifactSchema.nullable(),
-    original_sources: z.array(z.object({
-        source: z.string(),
-        artifact: webTextArtifactSchema.nullable(),
-    })),
-    original_module_edges: z.array(z.object({
-        from_source: z.string(),
-        kind: z.enum(["static_import", "dynamic_import", "require"]),
-        specifier: z.string(),
-        resolved_source: z.string().nullable(),
-    })),
-    mappings: z.array(z.object({
-        generated_line: z.number().int().min(1),
-        generated_column: z.number().int().min(0),
-        source: z.string(),
-        original_line: z.number().int().min(1),
-        original_column: z.number().int().min(0),
-        name: z.string().nullable(),
-    })),
-    limitation: z.string().nullable(),
 });
+const originalModuleEdgeSchema = z.object({
+    from_source: z.string(),
+    kind: z.enum(["static_import", "dynamic_import", "require"]),
+    specifier: z.string(),
+    resolved_source: z.string().nullable(),
+});
+const sourceMapMappingSchema = z.object({
+    generated_line: z.number().int().min(1),
+    generated_column: z.number().int().min(0),
+    source: z.string(),
+    original_line: z.number().int().min(1),
+    original_column: z.number().int().min(0),
+    name: z.string().nullable(),
+});
+const sourceMapContextShape = {
+    script_key: z.string(),
+    declared_url: z.string(),
+};
+const parsedSourceMapShape = {
+    artifact: webTextArtifactSchema,
+    original_sources: z.array(originalSourceSchema),
+    original_module_edges: z.array(originalModuleEdgeSchema),
+    mappings: z.array(sourceMapMappingSchema),
+};
+const sourceMapSchema = z.union([
+    z.object({
+        ...sourceMapContextShape,
+        ...parsedSourceMapShape,
+        status: z.literal("included"),
+        limitation: z.null(),
+    }),
+    z.object({
+        ...sourceMapContextShape,
+        ...parsedSourceMapShape,
+        status: z.enum(["fetch_failed", "invalid", "policy_filtered"]),
+        artifact: z.null(),
+        original_sources: z.tuple([]),
+        original_module_edges: z.tuple([]),
+        mappings: z.tuple([]),
+        limitation: z.string(),
+    }),
+]);
 const webTextArtifactSummarySchema = z.object({
-    uri: z.string().regex(/^rea:\/\/web-content\/sha256\/[a-f0-9]{64}$/u),
     sha256: z.string().regex(/^[a-f0-9]{64}$/u),
     bytes: z.number().int().min(0),
-    media_type: z.string().min(1).max(256),
+    media_type: z.string().min(1),
     charset: z.literal("utf-8"),
     text_available: z.literal(true),
 });
-const sourceMapsSchema = z
+export const webSourceMapsSchema = z
     .object({
-    status: z.enum([
-        "not_requested",
-        "included",
-        "partial",
-        "unavailable",
-        "truncated",
-    ]),
+    status: z.enum(["not_requested", "included", "partial", "unavailable"]),
     requested: z.number().int().min(0),
     processed: z.number().int().min(0),
-    dropped: z.number().int().min(0),
-    dropped_script_keys: z.array(z.string()),
     items: z.array(sourceMapSchema),
 })
     .superRefine((sourceMaps, context) => {
-    if (sourceMaps.requested !== sourceMaps.processed + sourceMaps.dropped ||
-        sourceMaps.processed !== sourceMaps.items.length ||
-        sourceMaps.dropped !== sourceMaps.dropped_script_keys.length)
+    if (sourceMaps.requested !== sourceMaps.processed ||
+        sourceMaps.processed !== sourceMaps.items.length)
         context.addIssue({
             code: "custom",
             message: "Source-map coverage counts are inconsistent",
         });
+    const statuses = sourceMaps.items.map(({ status }) => status);
+    const included = statuses.filter((status) => status === "included").length;
+    const allowedStatuses = sourceMaps.items.length === 0
+        ? ["not_requested", "unavailable"]
+        : included === sourceMaps.items.length
+            ? ["included"]
+            : included > 0
+                ? ["partial"]
+                : ["unavailable"];
+    if (!allowedStatuses.includes(sourceMaps.status))
+        context.addIssue({
+            code: "custom",
+            message: "Source-map status contradicts retained coverage",
+            path: ["status"],
+        });
 });
-/** Provider-neutral result of bounded JavaScript bundle reverse engineering. */
+/** Provider-neutral result of JavaScript bundle reverse engineering. */
 export const webBundleAnalysisSchema = z.object({
-    schema_version: z.literal(1),
     capture: z.object({
         target_url: z.string(),
         scripts_observed: z.number().int().min(0),
@@ -171,7 +143,7 @@ export const webBundleAnalysisSchema = z.object({
             trust: z.literal("page-declared-untrusted"),
             location: sourceLocationSchema,
         })),
-        source_maps: sourceMapsSchema,
+        source_maps: webSourceMapsSchema,
     }),
     inferences: z.array(z.object({
         kind: z.enum(["vendor_fingerprint", "route_framework", "bundle_runtime"]),
@@ -185,11 +157,10 @@ export const webBundleAnalysisSchema = z.object({
         affected_script_keys: z.array(z.string()),
     })),
     completeness: z.object({
-        status: z.enum(["complete_within_limits", "truncated", "partial"]),
+        status: z.enum(["complete", "partial"]),
         parsed_scripts: z.number().int().min(0),
         parse_failures: z.number().int().min(0),
         visited_ast_nodes: z.number().int().min(0),
-        dropped_findings: z.number().int().min(0),
     }),
     limitations: z.array(z.string()),
 });

package/dist/domain/webBundleAnalyzer.js

@@ -1,17 +1,15 @@
 import { analyzeScript, emptyAccumulator, isIncludedScript, } from "./webBundleAnalyzerInspection.js";
 import { buildWebBundleAnalysis } from "./webBundleAnalyzerResult.js";
 /** Analyze captured, explicitly approved JavaScript source without execution. */
-export const analyzeCapturedWebBundle = (inspection, input, sourceMaps = {
+export const analyzeCapturedWebBundle = (inspection, sourceMaps = {
     status: "not_requested",
     requested: 0,
     processed: 0,
-    dropped: 0,
-    dropped_script_keys: [],
     items: [],
 }) => {
     const accumulator = emptyAccumulator();
     const sourceScripts = inspection.scripts.items.filter(isIncludedScript);
     for (const script of sourceScripts)
-        analyzeScript(script, input, accumulator);
+        analyzeScript(script, accumulator);
     return buildWebBundleAnalysis(inspection, sourceScripts, sourceMaps, accumulator);
 };

package/dist/domain/webBundleAnalyzerAst.js

@@ -44,19 +44,6 @@ export const resolveSpecifier = (specifier, base) => {
         return null;
     }
 };
-export const sanitizeCandidate = (value) => {
-    const bounded = value.slice(0, 4_096);
-    try {
-        const parsed = new URL(bounded, "https://rea.invalid");
-        const sanitized = sanitizeBrowserUrl(parsed.href).url;
-        return parsed.origin === "https://rea.invalid"
-            ? sanitized.replace("https://rea.invalid", "")
-            : sanitized;
-    }
-    catch {
-        return bounded.split("#", 1)[0]?.split("?", 1)[0] ?? "";
-    }
-};
 export const location = (scriptKey, node) => ({
     script_key: scriptKey,
     ...locationFields(node),

package/dist/domain/webBundleAnalyzerInspection.js

@@ -1,7 +1,8 @@
 import { parse } from "@babel/parser";
 import * as t from "@babel/types";
-import { calleeName, endpointArgument, location, locationFields, objectString, objectValue, propertyName, resolveSpecifier, sanitizeCandidate, stringArgument, } from "./webBundleAnalyzerAst.js";
-export const analyzeScript = (script, input, accumulator) => {
+import { sanitizeEndpointCandidate } from "./browserObservation.js";
+import { calleeName, endpointArgument, location, locationFields, objectString, objectValue, propertyName, resolveSpecifier, stringArgument, } from "./webBundleAnalyzerAst.js";
+export const analyzeScript = (script, accumulator) => {
     let file;
     try {
         file = parse(script.source.artifact.text, {
@@ -15,18 +16,14 @@ export const analyzeScript = (script, input, accumulator) => {
         return;
     }
     accumulator.parsedScripts += 1;
-    detectVendorFingerprints(script, accumulator, input.analysis_limits.max_findings);
+    detectVendorFingerprints(script, accumulator);
     t.traverseFast(file, (node) => {
         accumulator.visitedNodes += 1;
-        if (accumulator.visitedNodes > input.analysis_limits.max_ast_nodes) {
-            accumulator.astLimitReached = true;
-            return t.traverseFast.stop;
-        }
-        inspectNode(script, node, accumulator, input.analysis_limits.max_findings);
+        inspectNode(script, node, accumulator);
         return undefined;
     });
 };
-const inspectNode = (script, node, accumulator, maximumFindings) => {
+const inspectNode = (script, node, accumulator) => {
     if ((t.isImportDeclaration(node) || t.isExportAllDeclaration(node)) &&
         node.source !== undefined)
         addEdge({
@@ -35,7 +32,6 @@ const inspectNode = (script, node, accumulator, maximumFindings) => {
             kind: "static_import",
             node,
             accumulator,
-            maximumFindings,
         });
     else if (t.isExportNamedDeclaration(node) && node.source != null)
         addEdge({
@@ -44,7 +40,6 @@ const inspectNode = (script, node, accumulator, maximumFindings) => {
             kind: "static_import",
             node,
             accumulator,
-            maximumFindings,
         });
     else if (t.isImportExpression(node) && t.isStringLiteral(node.source))
         addEdge({
@@ -53,14 +48,13 @@ const inspectNode = (script, node, accumulator, maximumFindings) => {
             kind: "dynamic_import",
             node,
             accumulator,
-            maximumFindings,
         });
     if (t.isObjectProperty(node))
-        inspectRouteProperty(script, node, accumulator, maximumFindings);
+        inspectRouteProperty(script, node, accumulator);
     if (t.isCallExpression(node) || t.isNewExpression(node))
-        inspectCall(script, node, accumulator, maximumFindings);
+        inspectCall(script, node, accumulator);
 };
-const inspectCall = (script, node, accumulator, maximumFindings) => {
+const inspectCall = (script, node, accumulator) => {
     const name = calleeName(node.callee);
     const first = stringArgument(node.arguments[0]);
     if ((name === "require" || name.endsWith(".require")) && first !== undefined)
@@ -70,7 +64,6 @@ const inspectCall = (script, node, accumulator, maximumFindings) => {
             kind: "require",
             node,
             accumulator,
-            maximumFindings,
         });
     if ((name === "importScripts" || name.endsWith(".importScripts")) &&
         first !== undefined)
@@ -80,7 +73,6 @@ const inspectCall = (script, node, accumulator, maximumFindings) => {
             kind: "worker_import",
             node,
             accumulator,
-            maximumFindings,
         });
     if (routeCallNames.some((candidate) => name === candidate || name.endsWith(`.${candidate}`))) {
         if (first !== undefined)
@@ -91,14 +83,12 @@ const inspectCall = (script, node, accumulator, maximumFindings) => {
                 mechanism: `call:${name}`,
                 node,
                 accumulator,
-                maximumFindings,
             });
         addRouteFrameworkInference({
             script,
             name,
             node,
             accumulator,
-            maximumFindings,
         });
     }
     const endpoint = endpointArgument(name, node.arguments);
@@ -110,13 +100,12 @@ const inspectCall = (script, node, accumulator, maximumFindings) => {
             mechanism: `call:${name}`,
             node,
             accumulator,
-            maximumFindings,
         });
     if (name.endsWith("modelContext.registerTool") ||
         name === "modelContext.registerTool")
-        addWebMcpDeclaration(script, node, accumulator, maximumFindings);
+        addWebMcpDeclaration(script, node, accumulator);
 };
-const inspectRouteProperty = (script, node, accumulator, maximumFindings) => {
+const inspectRouteProperty = (script, node, accumulator) => {
     const key = propertyName(node.key);
     if ((key === "path" || key === "route") && t.isStringLiteral(node.value))
         addFinding({
@@ -126,30 +115,28 @@ const inspectRouteProperty = (script, node, accumulator, maximumFindings) => {
             mechanism: `property:${key}`,
             node,
             accumulator,
-            maximumFindings,
         });
 };
 const addEdge = (context) => {
-    const bounded = context.specifier.slice(0, 4_096);
-    const key = `edge\0${context.script.script_key}\0${context.kind}\0${bounded}`;
-    addBounded(context.accumulator, key, context.maximumFindings, () => context.accumulator.edges.push({
+    const key = `edge\0${context.script.script_key}\0${context.kind}\0${context.specifier}`;
+    addUnique(context.accumulator, key, () => context.accumulator.edges.push({
         from_script_key: context.script.script_key,
         kind: context.kind,
-        specifier: bounded,
-        resolved_url: resolveSpecifier(bounded, context.script.url),
+        specifier: context.specifier,
+        resolved_url: resolveSpecifier(context.specifier, context.script.url),
         location: location(context.script.script_key, context.node),
     }));
 };
 const addFinding = (context) => {
-    const value = sanitizeCandidate(context.rawValue);
+    const value = sanitizeEndpointCandidate(context.rawValue);
     const key = `finding\0${context.mechanism}\0${context.script.script_key}\0${value}`;
-    addBounded(context.accumulator, key, context.maximumFindings, () => context.collection.push({
+    addUnique(context.accumulator, key, () => context.collection.push({
         value,
         mechanism: context.mechanism,
         location: location(context.script.script_key, context.node),
     }));
 };
-const addWebMcpDeclaration = (script, node, accumulator, maximumFindings) => {
+const addWebMcpDeclaration = (script, node, accumulator) => {
     const declaration = node.arguments[0];
     if (!t.isObjectExpression(declaration))
         return;
@@ -169,23 +156,21 @@ const addWebMcpDeclaration = (script, node, accumulator, maximumFindings) => {
             : [])
         : [];
     const key = `webmcp\0${script.script_key}\0${name ?? ""}\0${schemaPropertyNames.join("\0")}`;
-    addBounded(accumulator, key, maximumFindings, () => accumulator.webMcp.push({
-        name: name?.slice(0, 256) ?? null,
-        description: description?.slice(0, 2_048) ?? null,
-        schema_property_names: [...new Set(schemaPropertyNames)]
-            .sort()
-            .slice(0, 256),
+    addUnique(accumulator, key, () => accumulator.webMcp.push({
+        name: name ?? null,
+        description: description ?? null,
+        schema_property_names: [...new Set(schemaPropertyNames)].sort(),
         trust: "page-declared-untrusted",
         location: location(script.script_key, node),
     }));
 };
-const detectVendorFingerprints = (script, accumulator, maximumFindings) => {
+const detectVendorFingerprints = (script, accumulator) => {
     const text = script.source.artifact.text;
     for (const detector of vendorDetectors) {
         if (!detector.patterns.some((pattern) => text.includes(pattern)))
             continue;
         const key = `vendor\0${script.script_key}\0${detector.value}`;
-        addBounded(accumulator, key, maximumFindings, () => accumulator.inferences.push({
+        addUnique(accumulator, key, () => accumulator.inferences.push({
             kind: detector.kind,
             value: detector.value,
             confidence: detector.confidence,
@@ -199,7 +184,7 @@ const addRouteFrameworkInference = (context) => {
         ? "React Router-compatible route API"
         : "Generic route registration API";
     const key = `route-framework\0${context.script.script_key}\0${value}`;
-    addBounded(context.accumulator, key, context.maximumFindings, () => context.accumulator.inferences.push({
+    addUnique(context.accumulator, key, () => context.accumulator.inferences.push({
         kind: "route_framework",
         value,
         confidence: "medium",
@@ -211,18 +196,9 @@ const addRouteFrameworkInference = (context) => {
         ],
     }));
 };
-const addBounded = (accumulator, key, maximum, add) => {
+const addUnique = (accumulator, key, add) => {
     if (accumulator.seen.has(key))
         return;
-    const findings = accumulator.edges.length +
-        accumulator.routes.length +
-        accumulator.endpoints.length +
-        accumulator.webMcp.length +
-        accumulator.inferences.length;
-    if (findings >= maximum) {
-        accumulator.droppedFindings += 1;
-        return;
-    }
     accumulator.seen.add(key);
     add();
 };
@@ -243,8 +219,6 @@ export const emptyAccumulator = () => ({
     visitedNodes: 0,
     parsedScripts: 0,
     parseFailures: 0,
-    droppedFindings: 0,
-    astLimitReached: false,
 });
 export const isIncludedScript = (script) => script.source.included;
 const routeCallNames = [

package/dist/domain/webBundleAnalyzerResult.js

@@ -7,11 +7,7 @@ export const buildWebBundleAnalysis = (inspection, sourceScripts, sourceMaps, ac
     const partial = accumulator.parseFailures > 0 ||
         unavailable.length > 0 ||
         sourceMapIncomplete;
-    const truncated = accumulator.astLimitReached ||
-        accumulator.droppedFindings > 0 ||
-        sourceMaps.status === "truncated";
     return webBundleAnalysisSchema.parse({
-        schema_version: 1,
         capture: buildCaptureObservation(inspection, sourceScripts),
         observations: {
             chunks: {
@@ -31,12 +27,10 @@ export const buildWebBundleAnalysis = (inspection, sourceScripts, sourceMaps, ac
             sourceMaps,
         }),
         completeness: buildCompleteness({
-            truncated,
             partial,
             parsedScripts: accumulator.parsedScripts,
             parseFailures: accumulator.parseFailures,
             visitedNodes: accumulator.visitedNodes,
-            droppedFindings: accumulator.droppedFindings,
         }),
         limitations: bundleLimitations(),
     });
@@ -69,7 +63,7 @@ const buildUnknowns = (input) => [
         : [
             {
                 dimension: "script_source",
-                reason: "Source artifact was not captured within approved limits",
+                reason: "Source artifact was not captured",
                 affected_script_keys: input.unavailable,
             },
         ]),
@@ -88,30 +82,19 @@ const buildUnknowns = (input) => [
         : [
             {
                 dimension: "source_maps",
-                reason: input.sourceMaps.status === "truncated"
-                    ? "Source-map evidence was truncated by approved limits"
-                    : "One or more requested source maps were unavailable or incomplete",
-                affected_script_keys: [
-                    ...new Set([
-                        ...input.sourceMaps.items
-                            .filter(({ status }) => status !== "included")
-                            .map(({ script_key }) => script_key),
-                        ...input.sourceMaps.dropped_script_keys,
-                    ]),
-                ].sort(),
+                reason: "One or more requested source maps were unavailable or incomplete",
+                affected_script_keys: input.sourceMaps.items
+                    .filter(({ status }) => status !== "included")
+                    .map(({ script_key }) => script_key)
+                    .sort(),
             },
         ]),
 ];
 const buildCompleteness = (input) => ({
-    status: input.truncated
-        ? "truncated"
-        : input.partial
-            ? "partial"
-            : "complete_within_limits",
+    status: input.partial ? "partial" : "complete",
     parsed_scripts: input.parsedScripts,
     parse_failures: input.parseFailures,
     visited_ast_nodes: input.visitedNodes,
-    dropped_findings: input.droppedFindings,
 });
 const bundleLimitations = () => [
     "Static bundle findings are observations or bounded inferences; REA does not execute captured JavaScript.",