rea-agents 3.1.0 → 3.2.0

package/dist/browser/PngVisualDiff.js

@@ -1,12 +1,11 @@
 import { inflateSync } from "node:zlib";
 import { decodeCanonicalBase64 } from "../domain/webScreenshot.js";
-/** Compare two validated screenshots using bounded, deterministic RGBA metrics. */
+/** Compare two validated screenshots using deterministic RGBA metrics. */
 export const comparePngScreenshots = (input) => {
-    const before = decodePng(input.before, input.maximum_pixels);
-    const after = decodePng(input.after, input.maximum_pixels);
+    const before = decodePng(input.before);
+    const after = decodePng(input.after);
     if (before.width !== after.width || before.height !== after.height)
         return {
-            schema_version: 1,
             status: "dimension_mismatch",
             before: dimensions(before),
             after: dimensions(after),
@@ -35,21 +34,30 @@ export const comparePngScreenshots = (input) => {
             changedPixels += 1;
     }
     const pixels = before.width * before.height;
-    return {
-        schema_version: 1,
-        status: changedPixels === 0 ? "identical" : "different",
+    const context = {
         before: dimensions(before),
         after: dimensions(after),
         channel_threshold: input.channel_threshold,
         compared_pixels: pixels,
-        changed_pixels: changedPixels,
-        changed_ratio: changedPixels / pixels,
         maximum_channel_delta: maximumDelta,
         mean_absolute_channel_delta: totalDelta / (pixels * 4),
         limitations: limitations(),
     };
+    if (changedPixels === 0)
+        return {
+            ...context,
+            status: "identical",
+            changed_pixels: 0,
+            changed_ratio: 0,
+        };
+    return {
+        ...context,
+        status: "different",
+        changed_pixels: changedPixels,
+        changed_ratio: changedPixels / pixels,
+    };
 };
-const decodePng = (artifact, maximumPixels) => {
+const decodePng = (artifact) => {
     const bytes = decodeCanonicalBase64(artifact.data_base64);
     if (bytes === undefined || !bytes.subarray(0, 8).equals(PNG_SIGNATURE))
         throw new TypeError("Invalid PNG signature");
@@ -68,7 +76,7 @@ const decodePng = (artifact, maximumPixels) => {
             throw new TypeError("Truncated PNG data");
         const data = bytes.subarray(dataStart, dataEnd);
         if (type === "IHDR")
-            header = parseHeader(data, maximumPixels);
+            header = parseHeader(data);
         else if (type === "IDAT")
             compressed.push(data);
         else if (type === "IEND") {
@@ -92,7 +100,7 @@ const decodePng = (artifact, maximumPixels) => {
         rgba: unfilter(raw, header.width, header.height, header.channels),
     };
 };
-const parseHeader = (data, maximumPixels) => {
+const parseHeader = (data) => {
     if (data.byteLength !== 13)
         throw new TypeError("Invalid PNG header");
     const width = data.readUInt32BE(0);
@@ -101,13 +109,13 @@ const parseHeader = (data, maximumPixels) => {
     const colorType = data[9];
     if (width === 0 ||
         height === 0 ||
-        width * height > maximumPixels ||
+        !Number.isSafeInteger(width * height) ||
         bitDepth !== 8 ||
         (colorType !== 2 && colorType !== 6) ||
         data[10] !== 0 ||
         data[11] !== 0 ||
         data[12] !== 0)
-        throw new TypeError("Unsupported or oversized PNG");
+        throw new TypeError("Unsupported PNG");
     return { width, height, channels: colorType === 6 ? 4 : 3 };
 };
 const unfilter = (raw, width, height, channels) => {

package/dist/browser/SensitiveTextCapture.js

@@ -6,20 +6,3 @@ export const redactSensitiveText = (value) => value
     .replace(SECRET_ASSIGNMENT, (_match, name) => `${name}=[REDACTED]`)
     .replace(BEARER, "Bearer [REDACTED]")
     .replace(JWT, "[REDACTED_JWT]");
-/** Return a UTF-8-bounded prefix without splitting a code point. */
-export const boundedSensitiveText = (value, maximumBytes) => {
-    const redacted = redactSensitiveText(value);
-    const total = Buffer.byteLength(redacted);
-    if (total <= maximumBytes)
-        return { text: redacted, bytes: total, truncated: false };
-    let text = "";
-    let bytes = 0;
-    for (const character of redacted) {
-        const size = Buffer.byteLength(character);
-        if (bytes + size > maximumBytes)
-            break;
-        text += character;
-        bytes += size;
-    }
-    return { text, bytes, truncated: true };
-};

package/dist/browser/V8InspectorCaptureProjection.js

@@ -2,8 +2,6 @@ import { createHash } from "node:crypto";
 import { authorizeRuntimeLocation } from "./JavaScriptRuntimeScope.js";
 /** Empty durable-location exclusion counters. */
 export const createInspectorExclusionCounts = () => ({
-    outside_file_roots: 0,
-    outside_origins: 0,
     unsupported_location: 0,
 });
 /** Stable safety and protocol limitations shared by target-list Evidence. */
@@ -11,15 +9,15 @@ export const describeInspectorTargetLimitations = () => [
     "REA attaches to an already-running exact target and never launches, resumes, evaluates, pauses, or mutates it.",
     "Only Runtime.enable and Debugger.enable are sent; source text, object values, EventEmitter activity, and Electron IPC are not inspected.",
     "Target IDs and locations are authorized, but the Inspector protocol does not authenticate an operating-system process ID or Electron role.",
-    "Some Electron main targets report only file://; for those targets, the first approved file root is recorded as a scope fallback and script locations are authorized independently.",
+    "Every target exposed by the selected Inspector endpoint is eligible for observation; target IDs and locations are not authenticated as operating-system process identity.",
     "No runtime graph depth is traversed because passive Inspector events do not establish require/import caller edges.",
 ];
 /** Canonically authorize, deduplicate, and sort one bounded raw capture. */
-export const finalizeInspectorCapture = async ({ input, runtime, target, roots, state, }) => {
+export const finalizeInspectorCapture = async ({ input, runtime, target, state, }) => {
     const exclusions = createInspectorExclusionCounts();
     const scripts = new Map();
     for (const draft of state.scripts) {
-        const decision = await authorizeRuntimeLocation(draft.rawUrl, roots, input.allowed_origins);
+        const decision = await authorizeRuntimeLocation(draft.rawUrl);
         if (!decision.allowed) {
             exclusions[decision.reason] += 1;
             continue;
@@ -45,15 +43,16 @@ export const finalizeInspectorCapture = async ({ input, runtime, target, roots,
             ? 1
             : 0);
     return {
-        schema_version: 1,
         runtime,
         target: {
             target_id: target.id,
             protocol_type: target.type,
             attached: target.attached,
             location: target.location,
-            runtime_kind: input.runtime_kind,
-            runtime_kind_authority: "caller-declared-unverified",
+            runtime_kind: input.runtime_kind ?? "unknown",
+            runtime_kind_authority: input.runtime_kind === undefined
+                ? "not-declared"
+                : "caller-declared-unverified",
         },
         capture: {
             observation_ms: input.observation_ms,

package/dist/browser/V8InspectorEndpoint.js

@@ -1,30 +1,28 @@
 import { z } from "zod";
 import { BrowserObservationError, } from "../domain/errors.js";
-import { parseCdpEndpointValue, readBoundedCdpJson } from "./CdpEndpoint.js";
-const MAX_VERSION_BYTES = 64 * 1_024;
-const MAX_TARGET_LIST_BYTES = 2 * 1_024 * 1_024;
+import { parseCdpEndpointValue, readCdpJson } from "./CdpEndpoint.js";
 const versionSchema = z
     .object({
-    Browser: z.string().min(1).max(1_024),
-    "Protocol-Version": z.string().min(1).max(100),
-    "V8-Version": z.string().max(1_024).optional(),
+    Browser: z.string().min(1),
+    "Protocol-Version": z.string().min(1),
+    "V8-Version": z.string().optional(),
 })
     .passthrough();
 const targetSchema = z
     .object({
-    id: z.string().min(1).max(256),
-    type: z.string().min(1).max(100),
-    url: z.string().max(65_536),
+    id: z.string().min(1),
+    type: z.string().min(1),
+    url: z.string(),
     attached: z.boolean().default(false),
-    webSocketDebuggerUrl: z.string().min(1).max(2_048),
+    webSocketDebuggerUrl: z.string().min(1),
 })
     .passthrough();
-const targetsSchema = z.array(targetSchema).max(1_000);
-/** Discover bounded Node/Electron Inspector targets from one loopback endpoint. */
+const targetsSchema = z.array(targetSchema);
+/** Discover Node/Electron Inspector targets from one loopback endpoint. */
 export const discoverV8Inspector = async (endpoint, operation, signal) => {
     const [versionInput, targetsInput] = await Promise.all([
-        readBoundedCdpJson(new URL("/json/version", endpoint), MAX_VERSION_BYTES, operation, signal),
-        readBoundedCdpJson(new URL("/json/list", endpoint), MAX_TARGET_LIST_BYTES, operation, signal),
+        readCdpJson(new URL("/json/version", endpoint), operation, signal),
+        readCdpJson(new URL("/json/list", endpoint), operation, signal),
     ]);
     const version = parseCdpEndpointValue(versionSchema, versionInput, operation);
     const targets = parseCdpEndpointValue(targetsSchema, targetsInput, operation);

package/dist/browser/V8InspectorProvider.js

@@ -1,9 +1,9 @@
 import { javascriptRuntimeObservationSchema, javascriptRuntimeTargetListSchema, } from "../domain/javascriptRuntimeObservation.js";
 import { AnalysisError, BrowserObservationError, ProviderAdapterError, } from "../domain/errors.js";
 import { err, ok } from "../domain/result.js";
-import { boundedText, numberValue, recordValue, stringValue, delayWithCancellation, } from "./CdpCaptureValues.js";
+import { numberValue, recordValue, stringValue, delayWithCancellation, } from "./CdpCaptureValues.js";
 import { CdpConnection } from "./CdpConnection.js";
-import { authorizeRuntimeTargetLocation, canonicalRuntimeRoots, } from "./JavaScriptRuntimeScope.js";
+import { authorizeRuntimeTargetLocation } from "./JavaScriptRuntimeScope.js";
 import { createInspectorExclusionCounts, describeInspectorTargetLimitations, finalizeInspectorCapture, } from "./V8InspectorCaptureProjection.js";
 import { discoverV8Inspector, } from "./V8InspectorEndpoint.js";
 /** Public identity committed by passive V8 Inspector observations. */
@@ -19,12 +19,11 @@ export class V8InspectorProvider {
     }
     async listTargets(input, options = {}) {
         try {
-            const roots = await canonicalRuntimeRoots(input.allowed_file_roots);
             const discovery = await discoverV8Inspector(input.inspector_endpoint, "list_javascript_runtime_targets", options.signal);
             const allowed = [];
             const excluded = createInspectorExclusionCounts();
             for (const target of discovery.targets) {
-                const decision = await authorizeRuntimeTargetLocation(target.url, target.type, roots, input.allowed_origins);
+                const decision = await authorizeRuntimeTargetLocation(target.url);
                 if (!decision.allowed) {
                     excluded[decision.reason] += 1;
                     continue;
@@ -36,21 +35,9 @@ export class V8InspectorProvider {
                 allowed.push({ ...target, location: decision.location });
             }
             allowed.sort((left, right) => left.id < right.id ? -1 : left.id > right.id ? 1 : 0);
-            const items = allowed
-                .slice(input.offset, input.offset + input.limit)
-                .map(projectTarget);
-            const nextOffset = input.offset + items.length;
             return ok(javascriptRuntimeTargetListSchema.parse({
-                schema_version: 1,
                 runtime: discovery.runtime,
-                targets: {
-                    items,
-                    offset: input.offset,
-                    limit: input.limit,
-                    total: allowed.length,
-                    next_offset: nextOffset < allowed.length ? nextOffset : null,
-                    has_more: nextOffset < allowed.length,
-                },
+                targets: allowed.map(projectTarget),
                 excluded: { ...excluded, unconnectable: 0 },
                 limitations: describeInspectorTargetLimitations(),
             }));
@@ -62,10 +49,10 @@ export class V8InspectorProvider {
     async observe(input, options = {}) {
         let connection;
         try {
-            const roots = await canonicalRuntimeRoots(input.allowed_file_roots);
             const discovery = await discoverV8Inspector(input.inspector_endpoint, "observe_javascript_runtime", options.signal);
-            const target = await authorizedTarget(discovery.targets, input, roots);
-            assertRuntimeKind(target, input.runtime_kind);
+            const target = await authorizedTarget(discovery.targets, input);
+            if (input.runtime_kind !== undefined)
+                assertRuntimeKind(target, input.runtime_kind);
             connection = await CdpConnection.connect(target.webSocketUrl, "observe_javascript_runtime", options.signal);
             const state = emptyCaptureState();
             const removeListener = connection.onEvent((event) => ingestEvent(event, input, state));
@@ -81,7 +68,6 @@ export class V8InspectorProvider {
                 input,
                 runtime: discovery.runtime,
                 target,
-                roots,
                 state,
             });
             return ok(javascriptRuntimeObservationSchema.parse(result));
@@ -100,11 +86,11 @@ const projectTarget = (target) => ({
     attached: target.attached,
     location: target.location,
 });
-const authorizedTarget = async (targets, input, roots) => {
+const authorizedTarget = async (targets, input) => {
     const target = targets.find(({ id }) => id === input.target_id);
     if (target === undefined)
         throw new BrowserObservationError("observe_javascript_runtime", "target_not_found");
-    const decision = await authorizeRuntimeTargetLocation(target.url, target.type, roots, input.allowed_origins);
+    const decision = await authorizeRuntimeTargetLocation(target.url);
     if (target.attached ||
         !decision.allowed ||
         decision.location.kind === "builtin")
@@ -138,17 +124,13 @@ const ingestEvent = (event, input, state) => {
         event.method !== "Runtime.executionContextsCleared")
         return;
     state.eventsObserved += 1;
-    if (state.eventsObserved > input.limits.max_events) {
-        drop(state, "max_events");
-        return;
-    }
     if (event.method === "Debugger.scriptParsed") {
         ingestScript(event, input, state);
         return;
     }
     if (event.method === "Debugger.scriptFailedToParse") {
         state.invalidScripts += 1;
-        retainEvent(state, 0, input);
+        retainEvent(state, 0);
         return;
     }
     ingestContext(event, input, state);
@@ -157,34 +139,27 @@ const ingestScript = (event, input, state) => {
     state.scriptsObserved += 1;
     const value = recordValue(event.params);
     const rawUrl = stringValue(value?.url);
-    if (rawUrl === undefined ||
-        rawUrl === "" ||
-        Buffer.byteLength(rawUrl) > input.limits.max_location_bytes) {
+    if (rawUrl === undefined || rawUrl === "") {
         state.invalidScripts += 1;
-        retainEvent(state, 0, input);
-        return;
-    }
-    if (state.scripts.length >= input.limits.max_scripts) {
-        drop(state, "max_scripts");
+        retainEvent(state, 0);
         return;
     }
     const draft = {
         rawUrl,
         executionContextKey: contextKey(value?.executionContextId),
-        cdpHash: boundedText(value?.hash, 512),
+        cdpHash: stringValue(value?.hash) ?? null,
         length: nonnegativeInteger(value?.length),
         isModule: value?.isModule === true,
     };
     const bytes = metadataBytes(draft);
-    if (!retainEvent(state, bytes, input))
-        return;
+    retainEvent(state, bytes);
     state.scripts.push(draft);
 };
 const ingestContext = (event, input, state) => {
     if (event.method === "Runtime.executionContextsCleared") {
         for (const context of state.contexts.values())
             context.state = "cleared";
-        retainEvent(state, 0, input);
+        retainEvent(state, 0);
         return;
     }
     const parameters = recordValue(event.params);
@@ -195,42 +170,26 @@ const ingestContext = (event, input, state) => {
         ? runtimeContext?.id
         : runtimeContext?.executionContextId);
     if (key === null) {
-        retainEvent(state, 0, input);
-        return;
-    }
-    if (state.contexts.size >= input.limits.max_execution_contexts &&
-        !state.contexts.has(key)) {
-        drop(state, "max_execution_contexts");
+        retainEvent(state, 0);
         return;
     }
     const origin = event.method === "Runtime.executionContextCreated"
-        ? boundedText(runtimeContext?.origin, 4_096)
+        ? (stringValue(runtimeContext?.origin) ?? null)
         : null;
     const draft = {
         contextKey: key,
         state: event.method === "Runtime.executionContextCreated"
             ? "created"
             : "destroyed",
-        origin: origin !== null && input.allowed_origins.includes(origin) ? origin : null,
+        origin: origin === "" ? null : origin,
     };
     const bytes = metadataBytes(draft);
-    if (!retainEvent(state, bytes, input))
-        return;
+    retainEvent(state, bytes);
     state.contexts.set(key, draft);
 };
-const retainEvent = (state, bytes, input) => {
-    if (state.metadataBytes + bytes > input.limits.max_total_metadata_bytes) {
-        drop(state, "max_total_metadata_bytes");
-        return false;
-    }
+const retainEvent = (state, bytes) => {
     state.metadataBytes += bytes;
     state.eventsRetained += 1;
-    return true;
-};
-const drop = (state, reason) => {
-    state.eventsDropped += 1;
-    state.truncated = true;
-    state.truncationReasons.add(reason);
 };
 const waitForCapture = async (connection, observationMs, signal) => {
     let removeDisconnect = () => undefined;