rea-agents 3.1.0 → 3.2.0

package/dist/cliJavaScriptRuntimeCommands.js

@@ -5,101 +5,32 @@ import { V8InspectorProvider } from "./browser/V8InspectorProvider.js";
 import { CLI_COMMANDS } from "./cliCommandNames.js";
 import { logCliCommand } from "./cliLogging.js";
 import { parseConfig } from "./config.js";
-import { v8InspectorLocationScopes } from "./config/passiveObservation.js";
 import { javascriptRuntimeKindSchema, listJavaScriptRuntimeTargetsInputSchema, observeJavaScriptRuntimeInputSchema, } from "./domain/javascriptRuntimeObservation.js";
 import { AnalysisCapabilityUnavailableError, AnalysisInputError, projectAnalysisError, } from "./domain/errors.js";
-const scopeOptions = {
-    allowedFileRoots: z
-        .array(z.string().min(1))
-        .optional()
-        .describe("Exact roots; defaults to REA_V8_INSPECTOR_FILE_ROOTS_JSON"),
-    allowedOrigins: z
-        .array(z.string().min(1))
-        .optional()
-        .describe("Exact origins; defaults to REA_V8_INSPECTOR_ALLOWED_ORIGINS_JSON"),
-    approved: z.boolean().default(false).describe("Approve passive attachment"),
-};
-const listOptionsSchema = z.object({
-    ...scopeOptions,
-    offset: z
-        .number()
-        .int()
-        .min(0)
-        .default(0)
-        .describe("Zero-based target offset"),
-    limit: z
-        .number()
-        .int()
-        .min(1)
-        .max(200)
-        .default(100)
-        .describe("Maximum targets to return"),
-});
 const observeOptionsSchema = z.object({
-    ...scopeOptions,
-    runtimeKind: javascriptRuntimeKindSchema.describe("Declared target role; Inspector cannot authenticate the Electron role"),
+    runtimeKind: javascriptRuntimeKindSchema
+        .optional()
+        .describe("Declared target role; Inspector cannot authenticate the Electron role"),
     observationMs: z
         .number()
         .int()
         .min(0)
-        .max(10_000)
         .default(100)
-        .describe("Bounded observation window in milliseconds"),
-    maxEvents: z
-        .number()
-        .int()
-        .min(1)
-        .max(50_000)
-        .default(10_000)
-        .describe("Maximum retained protocol events"),
-    maxScripts: z
-        .number()
-        .int()
-        .min(1)
-        .max(10_000)
-        .default(2_000)
-        .describe("Maximum retained scripts"),
-    maxExecutionContexts: z
-        .number()
-        .int()
-        .min(1)
-        .max(5_000)
-        .default(1_000)
-        .describe("Maximum retained execution contexts"),
-    maxLocationBytes: z
-        .number()
-        .int()
-        .min(64)
-        .max(65_536)
-        .default(16_384)
-        .describe("Maximum bytes in one protocol location"),
-    maxTotalMetadataBytes: z
-        .number()
-        .int()
-        .min(1_024)
-        .max(32 * 1_024 * 1_024)
-        .default(4 * 1_024 * 1_024)
-        .describe("Maximum retained metadata bytes"),
+        .describe("Observation window in milliseconds"),
 });
 /** Register CLI equivalents of passive V8 Inspector tools. */
 export const registerJavaScriptRuntimeObservationCommands = (cli, logger) => {
     cli.command(CLI_COMMANDS.listJavaScriptRuntimeTargets, {
-        description: "List approved Node/Electron V8 Inspector targets",
+        description: "List Node/Electron V8 Inspector targets",
         args: z.object({
-            endpoint: z.string().describe("Configured literal-loopback endpoint"),
+            endpoint: z.string().describe("Literal-loopback Inspector endpoint"),
         }),
-        options: listOptionsSchema,
-        run: ({ args, options }) => logCliCommand(logger, CLI_COMMANDS.listJavaScriptRuntimeTargets, async () => {
+        run: ({ args }) => logCliCommand(logger, CLI_COMMANDS.listJavaScriptRuntimeTargets, async () => {
             const context = await runtimeContext("list_javascript_runtime_targets");
             if (!context.ok)
                 return context.error;
             const parsed = listJavaScriptRuntimeTargetsInputSchema.safeParse({
                 inspector_endpoint: args.endpoint,
-                allowed_file_roots: options.allowedFileRoots ?? context.allowedFileRoots,
-                allowed_origins: options.allowedOrigins ?? context.allowedOrigins,
-                approved: options.approved,
-                offset: options.offset,
-                limit: options.limit,
             });
             if (!parsed.success)
                 return inputError("list_javascript_runtime_targets");
@@ -110,7 +41,7 @@ export const registerJavaScriptRuntimeObservationCommands = (cli, logger) => {
     cli.command(CLI_COMMANDS.observeJavaScriptRuntime, {
         description: "Passively observe one exact Node/Electron Inspector target",
         args: z.object({
-            endpoint: z.string().describe("Configured literal-loopback endpoint"),
+            endpoint: z.string().describe("Literal-loopback Inspector endpoint"),
             targetId: z
                 .string()
                 .describe("Target from list-javascript-runtime-targets"),
@@ -122,19 +53,9 @@ export const registerJavaScriptRuntimeObservationCommands = (cli, logger) => {
                 return context.error;
             const parsed = observeJavaScriptRuntimeInputSchema.safeParse({
                 inspector_endpoint: args.endpoint,
-                allowed_file_roots: options.allowedFileRoots ?? context.allowedFileRoots,
-                allowed_origins: options.allowedOrigins ?? context.allowedOrigins,
                 target_id: args.targetId,
                 runtime_kind: options.runtimeKind,
-                approved: options.approved,
                 observation_ms: options.observationMs,
-                limits: {
-                    max_events: options.maxEvents,
-                    max_scripts: options.maxScripts,
-                    max_execution_contexts: options.maxExecutionContexts,
-                    max_location_bytes: options.maxLocationBytes,
-                    max_total_metadata_bytes: options.maxTotalMetadataBytes,
-                },
             });
             if (!parsed.success)
                 return inputError("observe_javascript_runtime");
@@ -151,18 +72,15 @@ const runtimeContext = async (operation) => {
     if (policy.status === "disabled")
         return {
             ok: false,
-            error: cliError(new AnalysisCapabilityUnavailableError("rea-v8-inspector", operation, "V8 Inspector observation is disabled; configure exact endpoints and file or origin scopes before enabling it")),
+            error: cliError(new AnalysisCapabilityUnavailableError("rea-v8-inspector", operation, "V8 Inspector observation is disabled; enable REA_V8_INSPECTOR_OBSERVE_ENABLED to authorize loopback endpoints")),
         };
     const authority = await loadConfiguredPermissionAuthority(config.value);
     if (!authority.ok)
         return { ok: false, error: cliError(authority.error) };
-    const scopes = v8InspectorLocationScopes(policy.locations);
     return {
         ok: true,
         authority: authority.value,
         provider: new V8InspectorProvider(),
-        allowedFileRoots: scopes.fileRoots,
-        allowedOrigins: scopes.allowedOrigins,
     };
 };
 const inputError = (operation) => cliError(new AnalysisInputError(operation));

package/dist/cliJsonInput.js

@@ -1,7 +1,6 @@
-import { readFile, stat } from "node:fs/promises";
+import { readFile } from "node:fs/promises";
 import { AnalysisInputError, projectAnalysisError } from "./domain/errors.js";
-const MAX_JSON_INPUT_BYTES = 64 * 1_024 * 1_024;
-/** Parse bounded inline JSON or one bounded local JSON file for a CLI workflow. */
+/** Parse inline JSON or one local JSON file for a CLI workflow. */
 export const parseCliJsonInput = async (value, operation) => {
     const inline = parseJson(value);
     if (inline !== undefined)
@@ -9,15 +8,7 @@ export const parseCliJsonInput = async (value, operation) => {
     if (["{", "["].includes(value.trimStart()[0] ?? ""))
         return { ok: false, error: inputError(operation) };
     try {
-        const metadata = await stat(value);
-        if (!metadata.isFile())
-            return jsonFileError(value, operation, "not-file");
-        if (metadata.size > MAX_JSON_INPUT_BYTES)
-            return jsonFileError(value, operation, "too-large");
-        const bytes = await readFile(value);
-        if (bytes.byteLength > MAX_JSON_INPUT_BYTES)
-            return jsonFileError(value, operation, "too-large");
-        const parsed = parseJson(bytes.toString("utf8"));
+        const parsed = parseJson(await readFile(value, "utf8"));
         return parsed === undefined
             ? jsonFileError(value, operation, "invalid-json")
             : { ok: true, value: parsed };
@@ -47,8 +38,7 @@ const jsonFileError = (path, operation, reason) => ({
         ...projectAnalysisError(new AnalysisInputError(operation, undefined, reason === "invalid-json"
             ? [{ path: [], reason: "invalid_format", expected: "JSON" }]
             : [])),
-        input_path: path,
+        ...(path === undefined ? {} : { input_path: path }),
         input_reason: reason,
-        maximum_input_bytes: MAX_JSON_INPUT_BYTES,
     },
 });

package/dist/cliObservationOptions.js

@@ -1,59 +1,41 @@
 import { z } from "incur";
-const boundedCount = (subject, maximum, fallback, minimum = 1) => z
+/** Accept an agent-selected browser observation duration without an artificial ceiling. */
+export const observationDuration = (fallback, minimum = 0) => z
     .number()
     .int()
     .min(minimum)
-    .max(maximum)
     .default(fallback)
-    .describe(`Maximum ${subject}`);
-const boundedBytes = (subject, maximum, fallback) => boundedCount(`${subject} in bytes`, maximum, fallback);
-const positiveCount = (subject, fallback) => z.number().int().min(1).default(fallback).describe(`Maximum ${subject}`);
-const browserScopeOptions = {
+    .describe("Observation duration in milliseconds");
+/** Shared passive browser origin options. */
+export const browserScopeOptions = {
     allowedOrigins: z
         .array(z.string().min(1))
         .optional()
         .describe("Exact origins to observe; defaults to REA_BROWSER_ALLOWED_ORIGINS_JSON"),
-    approved: z.boolean().default(false).describe("Approve passive observation"),
 };
 export const browserPageInspectionOptions = z.object({
     ...browserScopeOptions,
-    observationMs: boundedCount("observation duration in milliseconds", 10_000, 500, 0),
+    observationMs: observationDuration(500),
     includeAccessibilityText: z
         .boolean()
         .default(false)
-        .describe("Include bounded accessibility text"),
+        .describe("Include accessibility text"),
     includeConsoleText: z
         .boolean()
         .default(false)
-        .describe("Include bounded console message text"),
-    consoleTextApproved: z
-        .boolean()
-        .default(false)
-        .describe("Approve capturing console message text"),
+        .describe("Include console message text"),
     includeJsonBodyShapes: z
         .boolean()
         .default(false)
         .describe("Include structural shapes of JSON response bodies"),
-    jsonBodySchemaApproved: z
-        .boolean()
-        .default(false)
-        .describe("Approve inspecting JSON response bodies for structural shapes"),
     includeWebsocketShapes: z
         .boolean()
         .default(false)
         .describe("Include structural shapes of WebSocket payloads"),
-    websocketShapeApproved: z
-        .boolean()
-        .default(false)
-        .describe("Approve inspecting WebSocket payloads for structural shapes"),
     includeScriptSources: z
         .boolean()
         .default(false)
-        .describe("Include bounded JavaScript source text"),
-    sourceCaptureApproved: z
-        .boolean()
-        .default(false)
-        .describe("Approve capturing bounded script source text"),
+        .describe("Include JavaScript source text"),
     includeStorageKeys: z
         .boolean()
         .default(false)
@@ -62,84 +44,17 @@ export const browserPageInspectionOptions = z.object({
         .boolean()
         .default(false)
         .describe("Include content-derived storage fingerprints"),
-    maxFrames: boundedCount("page frames", 1_000, 200),
-    maxDomNodes: boundedCount("DOM nodes", 10_000, 2_000),
-    maxAxNodes: boundedCount("accessibility nodes", 10_000, 2_000),
-    maxAxTextFieldBytes: boundedBytes("one accessibility text field", 16 * 1_024, 1_024),
-    maxTotalAxTextBytes: boundedBytes("total accessibility text", 1_024 * 1_024, 64 * 1_024),
-    maxScripts: boundedCount("scripts", 1_000, 200),
-    maxResources: boundedCount("resources", 10_000, 2_000),
-    maxWorkers: boundedCount("workers", 5_000, 500),
-    maxStorageKeys: boundedCount("storage keys", 10_000, 1_000),
-    maxScriptSourceBytes: boundedBytes("one script source", 4 * 1_024 * 1_024, 1_024 * 1_024),
-    maxTotalScriptSourceBytes: boundedBytes("total script source", 16 * 1_024 * 1_024, 4 * 1_024 * 1_024),
-    maxNetworkEvents: boundedCount("network events", 10_000, 1_000),
-    maxConsoleEvents: boundedCount("console events", 2_000, 200),
-    maxConsoleTextFieldBytes: boundedBytes("one console text field", 16 * 1_024, 1_024),
-    maxTotalConsoleTextBytes: boundedBytes("total console text", 1_024 * 1_024, 64 * 1_024),
-    maxJsonBodyBytes: boundedBytes("one JSON response body", 4 * 1_024 * 1_024, 1_024 * 1_024),
-    maxTotalJsonBodyBytes: boundedBytes("total JSON response bodies", 16 * 1_024 * 1_024, 4 * 1_024 * 1_024),
-    maxJsonShapeNodes: boundedCount("JSON shape nodes", 100_000, 5_000),
-    maxJsonShapeDepth: boundedCount("JSON shape depth", 100, 20),
-    maxWebsocketEvents: boundedCount("WebSocket events", 5_000, 500),
-    maxWebsocketShapeBytes: boundedBytes("one WebSocket shape", 1_024 * 1_024, 64 * 1_024),
-    maxTotalWebsocketShapeBytes: boundedBytes("total WebSocket shapes", 16 * 1_024 * 1_024, 1_024 * 1_024),
 });
-const electronScopeOptions = {
-    allowedFileRoots: z
-        .array(z.string().min(1))
-        .optional()
-        .describe("Filesystem roots; defaults to REA_ELECTRON_FILE_ROOTS_JSON"),
-    approved: z.boolean().default(false).describe("Approve passive observation"),
-};
 export const electronPageInspectionOptions = z.object({
-    ...electronScopeOptions,
-    observationMs: boundedCount("observation duration in milliseconds", 10_000, 100, 0),
+    observationMs: observationDuration(100),
     includeScriptSources: z
         .boolean()
         .default(false)
-        .describe("Include bounded JavaScript source text"),
-    sourceCaptureApproved: z
-        .boolean()
-        .default(false)
-        .describe("Approve capturing bounded script source text"),
-    maxFrames: boundedCount("page frames", 1_000, 200),
-    maxDomNodes: boundedCount("DOM nodes", 10_000, 2_000),
-    maxScripts: boundedCount("scripts", 2_000, 500),
-    maxResources: boundedCount("resources", 10_000, 2_000),
-    maxWorkers: boundedCount("workers", 5_000, 500),
-    maxScriptSourceBytes: boundedBytes("one captured script source", 4 * 1_024 * 1_024, 1_024 * 1_024),
-    maxTotalScriptSourceBytes: boundedBytes("total captured script source", 16 * 1_024 * 1_024, 4 * 1_024 * 1_024),
+        .describe("Include JavaScript source text"),
 });
 export const javascriptApplicationOptions = z.object({
-    approved: z
-        .boolean()
-        .default(false)
-        .describe("Approve reading the application artifact"),
     artifactFormat: z
         .enum(["auto", "asar", "directory"])
         .default("auto")
         .describe("Application artifact format"),
-    sourceMapReadApproved: z
-        .boolean()
-        .default(false)
-        .describe("Approve reading local source maps referenced by the application"),
-    maxEntries: positiveCount("artifact entries to inspect", 8_000),
-    maxTotalArtifactBytes: positiveCount("total uncompressed artifact content to inspect", 512 * 1_024 * 1_024),
-    maxArtifactEntryBytes: positiveCount("uncompressed content for one artifact entry", 128 * 1_024 * 1_024),
-    maxCompressionRatio: z
-        .number()
-        .min(1)
-        .default(1_000)
-        .describe("Maximum accepted compressed-to-uncompressed expansion ratio"),
-    maxDepth: positiveCount("artifact directory depth", 64),
-    maxPathBytes: positiveCount("encoded artifact path length", 4_096),
-    maxTextFiles: positiveCount("text files to parse", 5_000),
-    maxTotalTextBytes: positiveCount("total text content to parse", 128 * 1_024 * 1_024),
-    maxTextFileBytes: positiveCount("size of one parsed text file", 8 * 1_024 * 1_024),
-    maxAstNodes: positiveCount("JavaScript AST nodes to parse", 2_000_000),
-    maxFindings: positiveCount("static-analysis findings to return", 8_000),
-    maxModules: positiveCount("application modules to project", 20_000),
-    maxSourceMapSources: positiveCount("original sources from source maps", 5_000),
-    maxParseMilliseconds: positiveCount("JavaScript parsing time in milliseconds", 30_000),
 });

package/dist/cliPolicyCommands.js

@@ -5,24 +5,9 @@ import { readProjectPermissionStore, revokeProjectPermissionGrant, } from "./app
 import { logCliCommand } from "./cliLogging.js";
 import { parseConfig } from "./config.js";
 import { PermissionRequiredError, projectAnalysisError, } from "./domain/errors.js";
+import { PERMISSION_CAPABILITIES, } from "./domain/permissionPolicy.js";
 import { CLI_COMMANDS } from "./cliCommandNames.js";
-const capabilitySchema = z.enum([
-    "process_capture",
-    "browser_observe",
-    "browser_automate",
-    "electron_observe",
-    "electron_automate",
-    "evidence_read",
-    "evidence_write",
-    "investigation_input",
-    "investigation_workspace_read",
-    "investigation_workspace_write",
-    "snapshot_read",
-    "snapshot_write",
-    "artifact_extract",
-    "native_mount",
-    "reference_read",
-]);
+const capabilitySchema = z.enum(PERMISSION_CAPABILITIES);
 /** Require an explicit decision before a project permission grant is removed. */
 export const approvePolicyRevocation = async (options) => {
     if (options.approved)

package/dist/cliProcessCommands.js

@@ -6,16 +6,16 @@ import { parseCliJsonInput } from "./cliJsonInput.js";
 import { replayMachineRunInputSchema, runReplayMachine, } from "./domain/replayMachineRun.js";
 import { AnalysisInputError, projectAnalysisError } from "./domain/errors.js";
 import { projectInputIssues } from "./domain/inputIssueProjection.js";
-/** Register Process Capture v4 one-shot commands through shared application services. */
+/** Register process capture one-shot commands through shared application services. */
 export const registerProcessCommands = (cli, logger) => {
     registerReplayMachineCommand(cli, logger);
     cli.command(CLI_COMMANDS.captureProcess, {
-        description: "Capture one approved Process Capture v4 JSON scenario",
+        description: "Capture one approved process capture JSON scenario",
         args: z.object({ scenario: z.string().describe("Scenario JSON path") }),
         run: ({ args }) => logCliCommand(logger, "capture-process", () => captureProcessScenarioFile(args.scenario)),
     });
     cli.command(CLI_COMMANDS.compareProcessCaptures, {
-        description: "Compare two Process Capture v4 Evidence JSON files",
+        description: "Compare two process capture Evidence JSON files",
         args: z.object({
             left: z.string().describe("Left capture Evidence JSON path"),
             right: z.string().describe("Right capture Evidence JSON path"),

package/dist/cliSetup.js

@@ -1,5 +1,4 @@
 import { cancel, confirm, intro, isCancel, multiselect, outro, } from "@clack/prompts";
-import { projectDoctorReport } from "./application/DoctorProjection.js";
 import { SUPPORTED_CLIENT_DEFINITIONS } from "./application/SupportedClients.js";
 const clientDisplayNames = new Map(SUPPORTED_CLIENT_DEFINITIONS.map(({ name, displayName }) => [
     name,
@@ -72,18 +71,6 @@ export const renderInteractiveSetupResult = (result) => {
     writeLine(`!  ${result.remediation ?? "Setup needs attention."}`);
     outro("Run `rea doctor` for the remaining checks.", promptStreams);
 };
-/** Keep default non-TTY output actionable without emitting the full catalog. */
-export const conciseSetupResult = (result) => ({
-    status: result.status,
-    plannedActions: result.plannedActions,
-    appliedActions: result.appliedActions,
-    clients: result.clients,
-    doctor: projectDoctorReport(result.doctor, "summary"),
-    ...(result.code === undefined ? {} : { code: result.code }),
-    ...(result.remediation === undefined
-        ? {}
-        : { remediation: result.remediation }),
-});
 const selectSetupActions = async (actions, accessible) => {
     const clientActions = actions.filter(({ kind }) => kind === "configure_client");
     const componentActions = actions.filter(({ kind }) => kind !== "configure_client");

package/dist/config/browserScenario.js

@@ -8,10 +8,10 @@ export const parseBrowserScenarioPolicy = (env) => {
     const executableRoots = parseAbsoluteRoots(env.REA_BROWSER_SCENARIO_EXECUTABLE_ROOTS_JSON, "REA_BROWSER_SCENARIO_EXECUTABLE_ROOTS_JSON");
     if (!executableRoots.ok)
         return executableRoots;
-    const cdpEndpoints = parseBrowserArray(env.REA_BROWSER_SCENARIO_CDP_ENDPOINTS_JSON, "REA_BROWSER_SCENARIO_CDP_ENDPOINTS_JSON", browserEndpointSchema, 16);
+    const cdpEndpoints = parseBrowserArray(env.REA_BROWSER_SCENARIO_CDP_ENDPOINTS_JSON, "REA_BROWSER_SCENARIO_CDP_ENDPOINTS_JSON", browserEndpointSchema);
     if (!cdpEndpoints.ok)
         return cdpEndpoints;
-    const allowedOrigins = parseBrowserArray(env.REA_BROWSER_SCENARIO_ALLOWED_ORIGINS_JSON, "REA_BROWSER_SCENARIO_ALLOWED_ORIGINS_JSON", browserOriginSchema, 32);
+    const allowedOrigins = parseBrowserArray(env.REA_BROWSER_SCENARIO_ALLOWED_ORIGINS_JSON, "REA_BROWSER_SCENARIO_ALLOWED_ORIGINS_JSON", browserOriginSchema);
     if (!allowedOrigins.ok)
         return allowedOrigins;
     const allowedEnvironment = parseStringArray(env.REA_BROWSER_SCENARIO_ALLOWED_ENV_JSON, "REA_BROWSER_SCENARIO_ALLOWED_ENV_JSON");

package/dist/config/environment.js

@@ -44,10 +44,6 @@ const environmentSchema = z
     REA_PROCESS_EXECUTABLE_ROOTS_JSON: z.string().default("[]"),
     REA_PROCESS_WORKING_ROOTS_JSON: z.string().default("[]"),
     REA_PROCESS_ALLOWED_ENV_JSON: z.string().default("[]"),
-    REA_EVIDENCE_ROOTS_JSON: z.string().default("[]"),
-    REA_INVESTIGATION_INPUT_ROOTS_JSON: z.string().default("[]"),
-    REA_ANALYSIS_SNAPSHOT_ROOTS_JSON: z.string().default("[]"),
-    REA_REFERENCE_ROOTS_JSON: z.string().default("[]"),
     REA_REFERENCE_SECRET_PATTERNS_JSON: z.string().default("[]"),
     REA_BROWSER_OBSERVE_ENABLED: z.enum(["true", "false"]).default("false"),
     REA_BROWSER_CDP_ENDPOINTS_JSON: z.string().default("[]"),
@@ -59,8 +55,6 @@ const environmentSchema = z
     REA_BROWSER_SCENARIO_ALLOWED_ORIGINS_JSON: z.string().default("[]"),
     REA_BROWSER_SCENARIO_ALLOWED_ENV_JSON: z.string().default("[]"),
     REA_ELECTRON_OBSERVE_ENABLED: z.enum(["true", "false"]).default("false"),
-    REA_ELECTRON_CDP_ENDPOINTS_JSON: z.string().default("[]"),
-    REA_ELECTRON_FILE_ROOTS_JSON: z.string().default("[]"),
     REA_ELECTRON_AUTOMATE_ENABLED: z.enum(["true", "false"]).default("false"),
     REA_ELECTRON_AUTOMATE_AUTO_GRANT: z
         .enum(["true", "false"])
@@ -70,9 +64,6 @@ const environmentSchema = z
     REA_V8_INSPECTOR_OBSERVE_ENABLED: z
         .enum(["true", "false"])
         .default("false"),
-    REA_V8_INSPECTOR_ENDPOINTS_JSON: z.string().default("[]"),
-    REA_V8_INSPECTOR_FILE_ROOTS_JSON: z.string().default("[]"),
-    REA_V8_INSPECTOR_ALLOWED_ORIGINS_JSON: z.string().default("[]"),
     REA_JAVASCRIPT_REPLAY_ENABLED: z.enum(["true", "false"]).default("false"),
     REA_JAVASCRIPT_REPLAY_ROOTS_JSON: z.string().default("[]"),
     REA_JAVASCRIPT_REPLAY_NODE_PATH: z

package/dist/config/parseConfig.js

@@ -2,7 +2,7 @@ import { ConfigurationError } from "../domain/errors.js";
 import { ok } from "../domain/result.js";
 import { parseEnvironment } from "./environment.js";
 import { parseStringArray, parseAbsoluteRoots, parseLoaderArgs, } from "./parsers.js";
-import { filePolicy, permissionScope, administratorGrants, } from "./permissions.js";
+import { permissionScope, administratorGrants } from "./permissions.js";
 import { appendElectronAutomationCeiling, parseElectronAutomationPolicy, } from "./electronAutomation.js";
 import { appendBrowserScenarioCeiling, parseBrowserScenarioPolicy, } from "./browserScenario.js";
 import { appendManagedRuntimeCeiling, parseManagedRuntimePolicy, } from "./managedRuntime.js";
@@ -17,18 +17,6 @@ const parseAllArrays = (env) => {
     const loaderArgs = parseLoaderArgs(env.HOPPER_LOADER_ARGS_JSON);
     if (!loaderArgs.ok)
         return loaderArgs;
-    const evidenceRoots = parseStringArray(env.REA_EVIDENCE_ROOTS_JSON, "REA_EVIDENCE_ROOTS_JSON");
-    if (!evidenceRoots.ok)
-        return evidenceRoots;
-    const investigationInputRoots = parseStringArray(env.REA_INVESTIGATION_INPUT_ROOTS_JSON, "REA_INVESTIGATION_INPUT_ROOTS_JSON");
-    if (!investigationInputRoots.ok)
-        return investigationInputRoots;
-    const analysisSnapshotRoots = parseStringArray(env.REA_ANALYSIS_SNAPSHOT_ROOTS_JSON, "REA_ANALYSIS_SNAPSHOT_ROOTS_JSON");
-    if (!analysisSnapshotRoots.ok)
-        return analysisSnapshotRoots;
-    const referenceRoots = parseStringArray(env.REA_REFERENCE_ROOTS_JSON, "REA_REFERENCE_ROOTS_JSON");
-    if (!referenceRoots.ok)
-        return referenceRoots;
     const secretPatterns = parseStringArray(env.REA_REFERENCE_SECRET_PATTERNS_JSON, "REA_REFERENCE_SECRET_PATTERNS_JSON");
     if (!secretPatterns.ok)
         return secretPatterns;
@@ -37,10 +25,6 @@ const parseAllArrays = (env) => {
         return managedRuntimeRoots;
     return ok({
         loaderArgs: loaderArgs.value,
-        evidenceRoots: evidenceRoots.value,
-        investigationInputRoots: investigationInputRoots.value,
-        analysisSnapshotRoots: analysisSnapshotRoots.value,
-        referenceRoots: referenceRoots.value,
         secretPatterns: secretPatterns.value,
         managedRuntimeRoots: managedRuntimeRoots.value,
     });
@@ -51,15 +35,7 @@ const appendNativeMountCeiling = (ceilings, env) => {
 };
 const buildPermissionCeilings = (env, arrays, policies) => {
     const ceilings = [
-        permissionScope("evidence_read", arrays.evidenceRoots),
-        permissionScope("evidence_write", arrays.evidenceRoots),
-        permissionScope("investigation_input", arrays.investigationInputRoots),
-        permissionScope("investigation_workspace_read", arrays.evidenceRoots),
-        permissionScope("investigation_workspace_write", arrays.evidenceRoots),
-        permissionScope("snapshot_read", arrays.analysisSnapshotRoots),
-        permissionScope("snapshot_write", arrays.analysisSnapshotRoots),
         permissionScope("artifact_extract", ["/"]),
-        permissionScope("reference_read", arrays.referenceRoots),
     ];
     appendProcessCaptureCeiling(ceilings, policies.processCapture);
     appendPassiveObservationCeilings(ceilings, policies.passiveObservation);
@@ -83,16 +59,8 @@ const buildAppConfig = (env, arrays, permissionCeilings, policies) => ({
     processExecutionPolicy: policies.processCapture,
     artifactNativeMountEnabled: env.REA_ARTIFACT_NATIVE_MOUNT_ENABLED === "true",
     artifactIntegrityContinueEnabled: env.REA_ARTIFACT_INTEGRITY_CONTINUE_ENABLED === "true",
-    evidenceFilePolicy: filePolicy(arrays.evidenceRoots),
-    investigationInputRoots: arrays.investigationInputRoots,
-    analysisSnapshotFilePolicy: filePolicy(arrays.analysisSnapshotRoots),
     referenceSourcePolicy: {
-        roots: arrays.referenceRoots,
         secretPatterns: arrays.secretPatterns,
-        maxBytes: 16 * 1024 * 1024,
-        maxEntries: 10_000,
-        maxDepth: 32,
-        maxPathBytes: 4_096,
     },
     browserObservationPolicy: policies.passiveObservation.browser,
     browserScenarioPolicy: policies.browserScenario,

package/dist/config/parsers.js

@@ -2,18 +2,14 @@ import { z } from "zod";
 import { isAbsolute } from "node:path";
 import { ConfigurationError } from "../domain/errors.js";
 import { err, ok } from "../domain/result.js";
-import { electronFileRootsSchema } from "../domain/electronObservation.js";
 export const parseStringArray = (encoded, name) => {
     try {
-        const parsed = z
-            .array(z.string().min(1))
-            .max(128)
-            .safeParse(JSON.parse(encoded));
+        const parsed = z.array(z.string().min(1)).safeParse(JSON.parse(encoded));
         return parsed.success
             ? ok(parsed.data)
-            : err(new ConfigurationError(parsed.error.issues.some(({ code }) => code === "too_big")
-                ? `${name} must encode at most 128 strings`
-                : `${name} must encode an array of strings`, { cause: parsed.error }));
+            : err(new ConfigurationError(`${name} must encode an array of strings`, {
+                cause: parsed.error,
+            }));
     }
     catch (cause) {
         return err(new ConfigurationError(`${name} must be valid JSON`, { cause }));
@@ -28,12 +24,9 @@ export const parseAbsoluteRoots = (encoded, name) => {
         ? err(new ConfigurationError(`${name} must encode absolute roots`))
         : parsed;
 };
-export const parseBrowserArray = (encoded, name, itemSchema, maximum) => {
+export const parseBrowserArray = (encoded, name, itemSchema) => {
     try {
-        const parsed = z
-            .array(itemSchema)
-            .max(maximum)
-            .safeParse(JSON.parse(encoded));
+        const parsed = z.array(itemSchema).safeParse(JSON.parse(encoded));
         return parsed.success
             ? ok([...new Set(parsed.data)].sort())
             : err(new ConfigurationError(`${name} must encode valid browser scopes`, {
@@ -44,20 +37,6 @@ export const parseBrowserArray = (encoded, name, itemSchema, maximum) => {
         return err(new ConfigurationError(`${name} must be valid JSON`, { cause }));
     }
 };
-export const parseElectronFileRoots = (encoded) => {
-    try {
-        const decoded = JSON.parse(encoded);
-        if (Array.isArray(decoded) && decoded.length === 0)
-            return ok([]);
-        const parsed = electronFileRootsSchema.safeParse(decoded);
-        return parsed.success
-            ? ok(parsed.data)
-            : err(new ConfigurationError("REA_ELECTRON_FILE_ROOTS_JSON must encode absolute roots", { cause: parsed.error }));
-    }
-    catch (cause) {
-        return err(new ConfigurationError("REA_ELECTRON_FILE_ROOTS_JSON must be valid JSON", { cause }));
-    }
-};
 export const parseLoaderArgs = (encoded) => {
     if (encoded === undefined)
         return ok([]);