rea-agents 3.1.0 → 3.2.1

package/dist/browser/WebSourceMapFetcher.js

@@ -1,105 +1,65 @@
 import { AnyMap, eachMapping } from "@jridgewell/trace-mapping";
 import { sanitizeBrowserUrl } from "../domain/browserObservation.js";
+import { webSourceMapsSchema } from "../domain/webBundleAnalysis.js";
 import { createWebTextArtifact } from "../domain/webContentArtifact.js";
 /** Fetch and validate approved source maps without browser credentials. */
 export const fetchWebSourceMaps = async (requests, input, signal, host = { fetch: globalThis.fetch }) => {
     const items = [];
-    let remainingBytes = input.analysis_limits.max_total_source_map_bytes;
-    for (const request of requests.slice(0, input.analysis_limits.max_source_maps)) {
+    for (const request of requests) {
         if (signal?.aborted === true)
             throw signal.reason;
-        if (remainingBytes === 0)
-            break;
-        const fetched = await fetchOne(request, {
-            input,
-            maximumBytes: Math.min(input.analysis_limits.max_source_map_bytes, remainingBytes),
-            signal,
-            host,
-        });
-        items.push(fetched.item);
-        remainingBytes = Math.max(0, remainingBytes - fetched.bytesRead);
+        items.push(await fetchOne(request, input, signal, host));
     }
     const included = items.filter(({ status }) => status === "included").length;
-    const dropped = requests.length - items.length;
-    const truncated = dropped > 0 || items.some(({ status }) => status === "truncated");
-    return {
-        status: truncated
-            ? "truncated"
-            : items.length === 0
-                ? "unavailable"
-                : included === items.length
-                    ? "included"
-                    : included > 0
-                        ? "partial"
-                        : "unavailable",
+    return webSourceMapsSchema.parse({
+        status: items.length === 0
+            ? "unavailable"
+            : included === items.length
+                ? "included"
+                : included > 0
+                    ? "partial"
+                    : "unavailable",
         requested: requests.length,
         processed: items.length,
-        dropped,
-        dropped_script_keys: requests
-            .slice(items.length)
-            .map(({ scriptKey }) => scriptKey),
         items,
-    };
+    });
 };
-const fetchOne = async (request, context) => {
-    const { input, maximumBytes, signal, host } = context;
-    const base = emptyItem(request);
+const fetchOne = async (request, input, signal, host) => {
     if (!approvedUrl(request.fetchUrl, input.allowed_origins))
-        return {
-            item: {
-                ...base,
-                status: "policy_filtered",
-                limitation: "Declared source-map URL is outside the approved exact origins.",
-            },
-            bytesRead: 0,
-        };
+        return emptySourceMapItem(request, "policy_filtered", "Declared source-map URL is outside the approved exact origins.");
     try {
         const response = await fetchFollowingApprovedRedirects(request.fetchUrl, input.allowed_origins, signal, host);
         if (response === undefined)
-            return {
-                item: {
-                    ...base,
-                    status: "policy_filtered",
-                    limitation: "A source-map redirect left the approved exact origins.",
-                },
-                bytesRead: 0,
-            };
+            return emptySourceMapItem(request, "policy_filtered", "A source-map redirect left the approved exact origins.");
         if (!response.ok)
-            return {
-                item: {
-                    ...base,
-                    status: "fetch_failed",
-                    limitation: `Source-map server returned HTTP ${String(response.status)}.`,
-                },
-                bytesRead: 0,
-            };
-        const body = await boundedResponseText(response, maximumBytes);
-        return {
-            item: normalizeSourceMap(request, body.text, input),
-            bytesRead: body.bytes,
-        };
+            return emptySourceMapItem(request, "fetch_failed", `Source-map server returned HTTP ${String(response.status)}.`);
+        return normalizeSourceMap(request, await response.text());
     }
     catch (cause) {
         if (signal?.aborted === true)
             throw cause;
-        return {
-            item: {
-                ...base,
-                status: isLimitError(cause) ? "truncated" : "fetch_failed",
-                limitation: isLimitError(cause)
-                    ? "Source-map response exceeded the remaining approved byte budget."
-                    : "Source-map fetch or validation failed.",
-            },
-            bytesRead: cause instanceof SourceMapByteLimitError ? cause.bytesRead : 0,
-        };
+        return emptySourceMapItem(request, "fetch_failed", "Source-map fetch or validation failed.");
     }
 };
 const fetchFollowingApprovedRedirects = async (initialUrl, allowedOrigins, signal, host) => {
     let current = initialUrl;
-    for (let redirect = 0; redirect <= 5; redirect += 1) {
+    const visited = new Set();
+    for (;;) {
         if (!approvedUrl(current, allowedOrigins))
             return undefined;
-        const response = await timedFetch(current, signal, host);
+        if (visited.has(current))
+            throw new Error("source_map_redirect_loop");
+        visited.add(current);
+        const response = await host.fetch(current, {
+            method: "GET",
+            headers: {
+                Accept: "application/json, application/source-map+json;q=0.9",
+            },
+            redirect: "manual",
+            credentials: "omit",
+            referrerPolicy: "no-referrer",
+            ...(signal === undefined ? {} : { signal }),
+        });
         if (response.status < 300 || response.status >= 400)
             return response;
         const location = response.headers.get("location");
@@ -107,66 +67,12 @@ const fetchFollowingApprovedRedirects = async (initialUrl, allowedOrigins, signa
             return response;
         current = new URL(location, current).href;
     }
-    throw new Error("source_map_redirect_limit");
 };
-const timedFetch = async (url, signal, host) => {
-    const timeout = AbortSignal.timeout(5_000);
-    return await host.fetch(url, {
-        method: "GET",
-        headers: { Accept: "application/json, application/source-map+json;q=0.9" },
-        redirect: "manual",
-        credentials: "omit",
-        referrerPolicy: "no-referrer",
-        signal: signal === undefined ? timeout : AbortSignal.any([signal, timeout]),
-    });
-};
-const boundedResponseText = async (response, maximumBytes) => {
-    const declared = Number(response.headers.get("content-length"));
-    if (Number.isFinite(declared) && declared > maximumBytes)
-        throw new SourceMapByteLimitError(0);
-    if (response.body === null)
-        return { text: "", bytes: 0 };
-    const reader = response.body.getReader();
-    const decoder = new TextDecoder("utf-8", { fatal: true });
-    let bytes = 0;
-    let text = "";
-    for (;;) {
-        const chunk = await reader.read();
-        if (chunk.done)
-            break;
-        bytes += chunk.value.byteLength;
-        if (bytes > maximumBytes) {
-            await reader.cancel();
-            throw new SourceMapByteLimitError(bytes);
-        }
-        text += decoder.decode(chunk.value, { stream: true });
-    }
-    text += decoder.decode();
-    return { text, bytes };
-};
-class SourceMapByteLimitError extends RangeError {
-    bytesRead;
-    constructor(bytesRead) {
-        super("source_map_bytes");
-        this.bytesRead = bytesRead;
-    }
-}
-const normalizeSourceMap = (request, text, input) => {
-    const base = emptyItem(request);
+const normalizeSourceMap = (request, text) => {
     if (!validSourceMapEnvelope(text))
-        return {
-            ...base,
-            status: "invalid",
-            limitation: "Source-map JSON is not a bounded version 3 map.",
-        };
+        return emptySourceMapItem(request, "invalid", "Source-map JSON is not a version 3 map.");
     try {
         const map = new AnyMap(text, request.fetchUrl);
-        if (map.sources.length > input.analysis_limits.max_original_sources)
-            return {
-                ...base,
-                status: "truncated",
-                limitation: "Source map exceeds the original-source inventory limit.",
-            };
         const resolvedBySource = new Map();
         const originalSources = map.sources.map((source, index) => {
             const content = map.sourcesContent?.[index];
@@ -181,57 +87,35 @@ const normalizeSourceMap = (request, text, input) => {
             };
         });
         const mappings = [];
-        let totalMappings = 0;
         eachMapping(map, (mapping) => {
             if (mapping.source === null ||
                 mapping.originalLine === null ||
                 mapping.originalColumn === null)
                 return;
-            totalMappings += 1;
-            if (mappings.length >= input.analysis_limits.max_source_map_mappings)
-                return;
             mappings.push({
                 generated_line: mapping.generatedLine,
                 generated_column: mapping.generatedColumn,
                 source: sanitizeSource(resolvedBySource.get(mapping.source) ?? mapping.source),
                 original_line: mapping.originalLine,
                 original_column: mapping.originalColumn,
-                name: mapping.name?.slice(0, 1_024) ?? null,
+                name: mapping.name ?? null,
             });
         });
-        const modules = originalModuleEdges(originalSources, input.analysis_limits.max_findings);
-        const mappingTruncated = totalMappings > mappings.length;
-        const limitations = [
-            ...(mappingTruncated
-                ? [
-                    `Mappings were truncated from ${String(totalMappings)} to ${String(mappings.length)}.`,
-                ]
-                : []),
-            ...(modules.truncated
-                ? [
-                    `Original module edges were truncated to ${String(modules.edges.length)}.`,
-                ]
-                : []),
-        ];
-        return {
-            ...base,
-            status: mappingTruncated || modules.truncated ? "truncated" : "included",
+        const modules = originalModuleEdges(originalSources);
+        const parsed = {
+            ...sourceMapContext(request),
             artifact: createWebTextArtifact(text, "application/source-map+json"),
             original_sources: originalSources,
-            original_module_edges: modules.edges,
+            original_module_edges: modules,
             mappings,
-            limitation: limitations.length === 0 ? null : limitations.join(" "),
         };
+        return { ...parsed, status: "included", limitation: null };
     }
     catch {
-        return {
-            ...base,
-            status: "invalid",
-            limitation: "Source-map mappings could not be decoded safely.",
-        };
+        return emptySourceMapItem(request, "invalid", "Source-map mappings could not be decoded safely.");
     }
 };
-const originalModuleEdges = (sources, maximum) => {
+const originalModuleEdges = (sources) => {
     const edges = [];
     const seen = new Set();
     for (const source of sources) {
@@ -239,15 +123,13 @@ const originalModuleEdges = (sources, maximum) => {
             continue;
         for (const detector of originalImportDetectors) {
             for (const match of source.artifact.text.matchAll(detector.pattern)) {
-                const specifier = match[1]?.slice(0, 4_096);
+                const specifier = match[1];
                 if (specifier === undefined)
                     continue;
                 const key = `${source.source}\0${detector.kind}\0${specifier}`;
                 if (seen.has(key))
                     continue;
                 seen.add(key);
-                if (edges.length >= maximum)
-                    return { edges, truncated: true };
                 edges.push({
                     from_source: source.source,
                     kind: detector.kind,
@@ -257,7 +139,7 @@ const originalModuleEdges = (sources, maximum) => {
             }
         }
     }
-    return { edges, truncated: false };
+    return edges;
 };
 const validSourceMapEnvelope = (text) => {
     let parsed;
@@ -271,22 +153,19 @@ const validSourceMapEnvelope = (text) => {
         return false;
     if (typeof parsed.mappings === "string")
         return Array.isArray(parsed.sources) && Array.isArray(parsed.names);
-    if (!Array.isArray(parsed.sections) || parsed.sections.length > 10_000)
+    if (!Array.isArray(parsed.sections))
         return false;
     const pending = [...parsed.sections];
-    let visited = 0;
     while (pending.length > 0) {
         const section = pending.pop();
         if (!isRecord(section) || !isRecord(section.offset) || !("map" in section))
             return false;
-        visited += 1;
-        if (visited > 10_000)
-            return false;
         const map = section.map;
         if (!isRecord(map) || map.version !== 3)
             return false;
         if (Array.isArray(map.sections))
-            pending.push(...map.sections);
+            for (const child of map.sections)
+                pending.push(child);
         else if (typeof map.mappings !== "string" ||
             !Array.isArray(map.sources) ||
             !Array.isArray(map.names))
@@ -306,26 +185,28 @@ const approvedUrl = (value, allowedOrigins) => {
         return false;
     }
 };
-const emptyItem = (request) => ({
+const sourceMapContext = (request) => ({
     script_key: request.scriptKey,
     declared_url: request.declaredUrl,
-    status: "fetch_failed",
+});
+const emptySourceMapItem = (request, status, limitation) => ({
+    ...sourceMapContext(request),
+    status,
     artifact: null,
     original_sources: [],
     original_module_edges: [],
     mappings: [],
-    limitation: null,
+    limitation,
 });
 const sanitizeSource = (value) => {
-    const bounded = value.slice(0, 4_096);
     try {
-        const parsed = new URL(bounded);
+        const parsed = new URL(value);
         return parsed.protocol === "http:" || parsed.protocol === "https:"
             ? sanitizeBrowserUrl(parsed.href).url
             : `${parsed.protocol}//${parsed.host}${parsed.pathname}`;
     }
     catch {
-        return bounded.split("#", 1)[0]?.split("?", 1)[0] ?? "";
+        return value.split("#", 1)[0]?.split("?", 1)[0] ?? "";
     }
 };
 const resolveOriginalSource = (specifier, base) => {
@@ -340,7 +221,6 @@ const sourceMediaType = (source) => source?.endsWith(".ts") || source?.endsWith(
     ? "text/typescript"
     : "text/javascript";
 const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-const isLimitError = (value) => value instanceof RangeError;
 const originalImportDetectors = [
     {
         kind: "static_import",

package/dist/catalogIdentity.js

@@ -32,52 +32,6 @@ const promptCatalog = PROMPT_CONTRACTS.map((contract) => ({
     arguments: contract.arguments,
     steps: contract.steps,
 })).sort((left, right) => left.name.localeCompare(right.name));
-/** Canonical fixed resources exposed by every target-free MCP session. */
-export const MCP_RESOURCE_CATALOG = [
-    { name: "server-identity", uri: "rea://server/identity" },
-    { name: "analysis-snapshot", uri: "rea://snapshot/current" },
-];
-/** Canonical resource templates exposed by every target-free MCP session. */
-export const MCP_RESOURCE_TEMPLATE_CATALOG = [
-    { name: "session-evidence", uri_template: "rea://evidence/{evidenceId}" },
-    {
-        name: "evidence-section",
-        uri_template: "rea://evidence/{evidenceId}/section/{section}",
-    },
-    { name: "residual-unknown", uri_template: "rea://unknown/{unknownId}" },
-    {
-        name: "evidence-bundle",
-        uri_template: "rea://evidence-bundle/{bundleDigest}",
-    },
-    {
-        name: "artifact-page",
-        uri_template: "rea://artifact/{manifestId}/{collection}",
-    },
-    {
-        name: "function-dossier",
-        uri_template: "rea://function/{targetSha256}/{address}",
-    },
-    {
-        name: "investigation-workspace-revision",
-        uri_template: "rea://workspace/{workspaceId}/revision/{revision}",
-    },
-    {
-        name: "reconstruction-coverage-revision",
-        uri_template: "rea://reconstruction-coverage/{workspaceId}/revision/{revision}",
-    },
-    {
-        name: "reconstruction-obligation-ledger-page",
-        uri_template: "rea://evidence/{evidenceId}/reconstruction-obligation-ledger",
-    },
-    {
-        name: "reconstruction-readiness-report",
-        uri_template: "rea://evidence/{evidenceId}/reconstruction-readiness-report",
-    },
-    {
-        name: "javascript-application-graph-page",
-        uri_template: "rea://evidence/{evidenceId}/application-graph/{collection}/offset/{offset}/limit/{limit}",
-    },
-];
 const digest = (value) => {
     const encoded = canonicalize(value);
     if (encoded === undefined)
@@ -90,22 +44,14 @@ export const CATALOG_IDENTITY = {
         cli_commands: CLI_COMMAND_NAMES.length,
         mcp_tools: toolCatalog.length,
         mcp_prompts: promptCatalog.length,
-        mcp_resources: MCP_RESOURCE_CATALOG.length,
-        mcp_resource_templates: MCP_RESOURCE_TEMPLATE_CATALOG.length,
     },
     digests: {
         tools_sha256: digest(toolCatalog),
         prompts_sha256: digest(promptCatalog),
-        resources_sha256: digest({
-            resourceCatalog: MCP_RESOURCE_CATALOG,
-            resourceTemplateCatalog: MCP_RESOURCE_TEMPLATE_CATALOG,
-        }),
         combined_sha256: digest({
             cli: CLI_COMMAND_NAMES,
             tools: toolCatalog,
             prompts: promptCatalog,
-            resources: MCP_RESOURCE_CATALOG,
-            resource_templates: MCP_RESOURCE_TEMPLATE_CATALOG,
         }),
     },
     tools: toolCatalog.map(({ name, surface, effects, annotations }) => ({

package/dist/cli/artifactCommands.js

@@ -1,123 +1,95 @@
 import { z } from "incur";
 import { runProviderAnalysis } from "../application/DirectAnalysis.js";
+import { createArtifactExtractionDestination } from "../application/ArtifactExtractionDestination.js";
 import { logCliCommand } from "../cliLogging.js";
 import { CLI_COMMANDS } from "../cliCommandNames.js";
 export const registerArtifactCommands = (cli, logger) => {
-    registerInventoryCommand(cli, logger);
     registerInspectionCommand(cli, logger);
     registerExtractionCommand(cli, logger);
+    registerInterfaceBuilderCommand(cli, logger);
 };
-const registerInventoryCommand = (cli, logger) => {
-    cli.command(CLI_COMMANDS.inventoryArtifact, {
-        description: "Build a bounded deterministic artifact graph",
+const registerInterfaceBuilderCommand = (cli, logger) => {
+    cli.command(CLI_COMMANDS.decodeInterfaceBuilder, {
+        description: "Decode compiled storyboard and nib archives from an app bundle",
         args: z.object({
-            path: z.string().describe("Application or package path"),
+            path: z.string().describe("Apple .app bundle path"),
         }),
         options: z.object({
-            offset: z
+            maxDocuments: z
                 .number()
                 .int()
-                .min(0)
-                .default(0)
-                .describe("Zero-based offset for graph nodes, occurrences, and edges"),
-            limit: z
+                .min(1)
+                .max(64)
+                .default(64)
+                .describe("Maximum archives to decode"),
+            maxObjects: z
                 .number()
                 .int()
                 .min(1)
-                .max(500)
-                .default(100)
-                .describe("Maximum nodes, occurrences, and edges per result section"),
-            integrityPolicy: z
-                .enum(["fail", "record-and-continue"])
-                .default("fail")
-                .describe("Behavior when declared artifact integrity does not match"),
-            integrityContinueApproved: z
-                .boolean()
-                .default(false)
-                .describe("Approve continuing after recorded integrity mismatches"),
-            maxIntegrityMismatches: z
+                .max(20_000)
+                .default(20_000)
+                .describe("Maximum graph objects"),
+            maxConnections: z
                 .number()
                 .int()
                 .min(1)
-                .max(100)
-                .default(10)
-                .describe("Maximum integrity mismatches to record before stopping"),
-            nativeMountApproved: z
-                .boolean()
-                .default(false)
-                .describe("Approve read-only native mounting when required"),
+                .max(40_000)
+                .default(40_000)
+                .describe("Maximum decoded connections"),
         }),
         alias: {
-            integrityPolicy: "integrity-policy",
-            integrityContinueApproved: "integrity-continue-approved",
-            maxIntegrityMismatches: "max-integrity-mismatches",
-            nativeMountApproved: "native-mount-approved",
+            maxDocuments: "max-documents",
+            maxObjects: "max-objects",
+            maxConnections: "max-connections",
         },
-        run: ({ args, options }) => logCliCommand(logger, "inventory-artifact", () => runProviderAnalysis(args.path, "inventory_artifact", {
-            node_offset: options.offset,
-            node_limit: options.limit,
-            occurrence_offset: options.offset,
-            occurrence_limit: options.limit,
-            edge_offset: options.offset,
-            edge_limit: options.limit,
-            integrity_policy: options.integrityPolicy,
-            integrity_continue_approved: options.integrityContinueApproved,
-            max_integrity_mismatches: options.maxIntegrityMismatches,
-            native_mount_approved: options.nativeMountApproved,
+        run: ({ args, options }) => logCliCommand(logger, "decode-interface-builder", () => runProviderAnalysis(args.path, "decode_interface_builder", {
+            max_documents: options.maxDocuments,
+            max_objects: options.maxObjects,
+            max_connections: options.maxConnections,
         }, logger)),
     });
 };
 const registerExtractionCommand = (cli, logger) => {
     cli.command(CLI_COMMANDS.extractArtifact, {
-        description: "Extract explicitly selected artifact occurrences safely",
+        description: "Extract all regular artifact contents safely",
         args: z.object({
             path: z.string().describe("Application or package path"),
-            outputRoot: z.string().describe("Absent absolute output root"),
-        }),
-        options: z.object({
-            occurrenceIds: z
-                .array(z.string().regex(/^occ_[a-f0-9]{64}$/u))
-                .min(1)
-                .max(500)
-                .describe("Exact artifact occurrence IDs selected for extraction"),
         }),
-        alias: { occurrenceIds: "occurrence-ids" },
-        run: ({ args, options }) => logCliCommand(logger, "extract-artifact", () => runProviderAnalysis(args.path, "extract_artifact", {
-            approved: true,
-            output_root: args.outputRoot,
-            occurrence_ids: options.occurrenceIds,
+        options: z.object({}),
+        run: ({ args }) => logCliCommand(logger, "extract-artifact", () => runProviderAnalysis(args.path, "extract_artifact", {
+            output_root: createArtifactExtractionDestination(),
         }, logger)),
     });
 };
 const registerInspectionCommand = (cli, logger) => {
     cli.command(CLI_COMMANDS.inspectArtifact, {
-        description: "Inspect one artifact with bounded observations and explicit next probes",
+        description: "Inspect one artifact and return all available observations and next probes",
         args: z.object({
             path: z.string().describe("Application or package path"),
         }),
         options: z.object({
-            maxObservations: z
-                .number()
-                .int()
-                .min(1)
-                .max(500)
-                .default(100)
-                .describe("Maximum retained observations"),
-            maxRelationships: z
-                .number()
-                .int()
-                .min(1)
-                .max(500)
-                .default(100)
-                .describe("Maximum retained derived relationships"),
+            integrityPolicy: z
+                .enum(["fail", "record-and-continue"])
+                .default("fail")
+                .describe("Behavior when declared artifact integrity does not match"),
+            integrityContinueApproved: z
+                .boolean()
+                .default(false)
+                .describe("Approve continuing after recorded integrity mismatches"),
+            nativeMountApproved: z
+                .boolean()
+                .default(false)
+                .describe("Approve read-only native mounting when required"),
         }),
         alias: {
-            maxObservations: "max-observations",
-            maxRelationships: "max-relationships",
+            integrityPolicy: "integrity-policy",
+            integrityContinueApproved: "integrity-continue-approved",
+            nativeMountApproved: "native-mount-approved",
         },
         run: ({ args, options }) => logCliCommand(logger, "inspect-artifact", () => runProviderAnalysis(args.path, "inspect_artifact", {
-            max_observations: options.maxObservations,
-            max_relationships: options.maxRelationships,
+            integrity_policy: options.integrityPolicy,
+            integrity_continue_approved: options.integrityContinueApproved,
+            native_mount_approved: options.nativeMountApproved,
         }, logger)),
     });
 };