rea-agents 3.1.0 → 3.2.1

package/dist/domain/processScenario.js

@@ -1,11 +1,11 @@
 import { createHash } from "node:crypto";
-import { resolve } from "node:path";
+import { isPathWithinRoot } from "./localPath.js";
 import canonicalize from "canonicalize";
 import { z } from "zod";
 import { processReactiveScenarioSchema, } from "./processReactiveScenario.js";
 import { replayMachineSchema } from "./replayMachine.js";
-const positiveBudget = z.number().int().positive();
-const timedEventBase = { at_ms: z.number().int().nonnegative() };
+const positiveBudget = z.number().int().safe().positive();
+const timedEventBase = { at_ms: z.number().int().safe().nonnegative() };
 const environmentName = z.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/u);
 const reservedEnvironment = new Set([
     "HOME",
@@ -19,25 +19,19 @@ export const normalizationSchema = z.object({
     paths: z.boolean(),
     pids: z.boolean(),
     ports: z.boolean(),
-    time_bucket_ms: positiveBudget.max(60_000),
+    time_bucket_ms: positiveBudget,
     patterns: z.array(z.object({
-        pattern: z.string().max(500),
-        replacement: z.string().max(100),
+        pattern: z.string(),
+        replacement: z.string(),
     })),
 });
-const checkpointNameSchema = z
-    .string()
-    .regex(/^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/u);
-const commandNameSchema = z
-    .string()
-    .regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u);
+const checkpointNameSchema = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9_-]*$/u);
+const commandNameSchema = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/u);
 const outputChunkSchema = z.object({
-    at_ms: z.number().int().nonnegative().max(300_000),
+    at_ms: z.number().int().safe().nonnegative(),
     stream: z.enum(["stdout", "stderr"]),
-    data: z.string().max(1_000_000),
+    data: z.string(),
 });
-/** Actionable refusal shared by CLI, MCP, and Evidence import boundaries. */
-export const LEGACY_PROCESS_CAPTURE_MESSAGE = "Process Capture v3 is unsupported. Re-run the scenario with this REA version using capture_process_scenario to produce Process Capture v4; captures cannot be upgraded because v4 requires new manifest and settlement evidence.";
 /** Compute a canonical SHA-256 commitment independent of object key order. */
 export const digestProcessCommitment = (value) => {
     const serialized = canonicalize(value);
@@ -62,7 +56,7 @@ const reactiveScenarioCommitment = (scenario) => scenario === null
             })),
         })),
     };
-/** Build the secret-safe scenario projection committed by Process Capture v4. */
+/** Build the secret-safe scenario projection committed by process-capture Evidence. */
 export const processScenarioCommitment = (scenario, executableSha256) => ({
     ...scenario,
     environment: Object.fromEntries(Object.entries(scenario.environment).map(([name, value]) => [
@@ -70,7 +64,6 @@ export const processScenarioCommitment = (scenario, executableSha256) => ({
         scenario.secret_aliases.includes(name) ? "<redacted-secret>" : value,
     ])),
     reactive: reactiveScenarioCommitment(scenario.reactive),
-    unknown_registry_approved: scenario.unknown_registry_approved === true,
     executable_sha256: executableSha256 ?? null,
 });
 /** Project observation settings shared by authority and reconstruction. */
@@ -93,31 +86,24 @@ export const processComparisonContract = (scenario) => ({
     reactive: reactiveScenarioCommitment(scenario.reactive),
 });
 /**
- * Boundary schema for one explicitly approved, bounded process experiment.
+ * Boundary schema for one bounded process experiment.
  * Defaults are part of the evidence contract and must remain deterministic.
  */
 export const processScenarioSchema = z
     .object({
-    approved: z
-        .literal(true)
-        .describe("Explicit per-call acknowledgement that this operation launches the target"),
-    unknown_registry_approved: z
-        .literal(true)
-        .optional()
-        .describe("Explicit approval to record capture residuals durably"),
     executable: z.string().startsWith("/"),
-    arguments: z.array(z.string()).max(256).default([]),
+    arguments: z.array(z.string()).default([]),
     working_directory: z.string().startsWith("/"),
     environment: z.record(environmentName, z.string()).default({}),
-    inherit_environment: z.array(environmentName).max(64).default([]),
-    secret_aliases: z.array(environmentName).max(64).default([]),
+    inherit_environment: z.array(environmentName).default([]),
+    secret_aliases: z.array(environmentName).default([]),
     network_access: z.literal("host").default("host"),
-    filesystem_roots: z.array(z.string().startsWith("/")).max(16).default([]),
+    filesystem_roots: z.array(z.string().startsWith("/")).default([]),
     terminal: z
         .object({
-        columns: z.number().int().min(1).max(1_000).default(80),
-        rows: z.number().int().min(1).max(1_000).default(24),
-        scrollback: z.number().int().min(0).max(10_000).default(1_000),
+        columns: z.number().int().min(1).max(65_535).default(80),
+        rows: z.number().int().min(1).max(65_535).default(24),
+        scrollback: z.number().int().min(0).default(1_000),
     })
         .default({ columns: 80, rows: 24, scrollback: 1_000 }),
     checkpoints: z
@@ -126,26 +112,25 @@ export const processScenarioSchema = z
         trigger: z.discriminatedUnion("type", [
             z.object({
                 type: z.literal("time"),
-                at_ms: z.number().int().nonnegative().max(300_000),
+                at_ms: z.number().int().safe().nonnegative(),
             }),
             z.object({
                 type: z.literal("terminal_literal"),
-                value: z.string().min(1).max(10_000),
-                occurrence: z.number().int().positive().max(1_000).default(1),
+                value: z.string().min(1),
+                occurrence: positiveBudget.default(1),
             }),
             z.object({ type: z.literal("root_exit") }),
             z.object({ type: z.literal("settled") }),
         ]),
     }))
-        .max(64)
         .default([]),
     command_shims: z
         .array(z.object({
         name: commandNameSchema,
         routes: z
             .array(z.object({
-            arguments: z.array(z.string()).max(256),
-            outputs: z.array(outputChunkSchema).max(1_000).default([]),
+            arguments: z.array(z.string()),
+            outputs: z.array(outputChunkSchema).default([]),
             termination: z.discriminatedUnion("type", [
                 z.object({
                     type: z.literal("exit"),
@@ -156,12 +141,10 @@ export const processScenarioSchema = z
                     signal: z.enum(["SIGINT", "SIGTERM", "SIGKILL"]),
                 }),
             ]),
-            max_calls: z.number().int().positive().max(100).default(1),
+            max_calls: positiveBudget.default(1),
         }))
-            .min(1)
-            .max(100),
+            .min(1),
     }))
-        .max(32)
         .default([]),
     events: z
         .array(z.discriminatedUnion("type", [
@@ -174,8 +157,8 @@ export const processScenarioSchema = z
         z.object({
             ...timedEventBase,
             type: z.literal("resize"),
-            columns: z.number().int().min(1).max(1_000),
-            rows: z.number().int().min(1).max(1_000),
+            columns: z.number().int().min(1).max(65_535),
+            rows: z.number().int().min(1).max(65_535),
         }),
         z.object({
             ...timedEventBase,
@@ -183,26 +166,24 @@ export const processScenarioSchema = z
             signal: z.enum(["SIGINT", "SIGTERM", "SIGKILL"]),
         }),
     ]))
-        .max(1_000)
         .default([]),
-    timeout_ms: positiveBudget.max(300_000).default(30_000),
-    idle_timeout_ms: positiveBudget.max(300_000).default(30_000),
-    settle_ms: z.number().int().nonnegative().max(10_000).default(100),
+    timeout_ms: positiveBudget.default(30_000),
+    idle_timeout_ms: positiveBudget.default(30_000),
+    settle_ms: z.number().int().safe().nonnegative().default(100),
     limits: z
         .object({
-        output_bytes: positiveBudget.max(10_000_000).default(1_000_000),
-        frames: positiveBudget.max(100_000).default(10_000),
-        files: positiveBudget.max(100_000).default(10_000),
-        file_bytes: positiveBudget.max(100_000_000).default(10_000_000),
-        processes: positiveBudget.max(10_000).default(1_000),
-        protocol_events: positiveBudget.max(100_000).default(10_000),
-        protocol_body_bytes: positiveBudget.max(10_000_000).default(1_000_000),
-        connections: positiveBudget.max(1_000).default(100),
-        filesystem_depth: z.number().int().min(1).max(64).default(16),
+        output_bytes: positiveBudget.default(1_000_000),
+        files: positiveBudget.default(10_000),
+        file_bytes: positiveBudget.default(10_000_000),
+        processes: positiveBudget.default(1_000),
+        protocol_events: positiveBudget.default(10_000),
+        protocol_body_bytes: positiveBudget.default(1_000_000),
+        connections: positiveBudget.default(100),
+        filesystem_depth: z.number().int().safe().nonnegative().default(16),
     })
+        .strict()
         .default({
         output_bytes: 1_000_000,
-        frames: 10_000,
         files: 10_000,
         file_bytes: 10_000_000,
         processes: 1_000,
@@ -216,13 +197,12 @@ export const processScenarioSchema = z
         paths: z.boolean().default(true),
         pids: z.boolean().default(true),
         ports: z.boolean().default(true),
-        time_bucket_ms: positiveBudget.max(60_000).default(10),
+        time_bucket_ms: positiveBudget.default(10),
         patterns: z
             .array(z.object({
-            pattern: z.string().max(500),
-            replacement: z.string().max(100),
+            pattern: z.string(),
+            replacement: z.string(),
         }))
-            .max(32)
             .default([]),
     })
         .default({
@@ -237,39 +217,27 @@ export const processScenarioSchema = z
         machine: replayMachineSchema.nullable().default(null),
         http: z
             .array(z.object({
-            method: z.string().max(16),
+            method: z.string(),
             path: z.string().startsWith("/"),
             status: z.number().int().min(100).max(599),
-            body: z.string().max(1_000_000),
+            body: z.string(),
             request_headers: z.record(z.string(), z.string()).default({}),
-            request_body: z.string().max(1_000_000).optional(),
+            request_body: z.string().optional(),
             response_headers: z.record(z.string(), z.string()).default({}),
-            delay_ms: z.number().int().nonnegative().max(30_000).default(0),
+            delay_ms: z.number().int().safe().nonnegative().default(0),
             disconnect: z.boolean().default(false),
-            max_calls: z.number().int().min(1).max(100).default(1),
+            max_calls: positiveBudget.default(1),
         }))
-            .max(100)
-            .default([]),
-        websocket_messages: z
-            .array(z.string().max(1_000_000))
-            .max(100)
             .default([]),
+        websocket_messages: z.array(z.string()).default([]),
         websocket_connections: z
             .array(z.object({
-            messages: z
-                .array(z.object({
-                data: z.string().max(1_000_000),
-                delay_ms: z
-                    .number()
-                    .int()
-                    .nonnegative()
-                    .max(30_000)
-                    .default(0),
-            }))
-                .max(100),
+            messages: z.array(z.object({
+                data: z.string(),
+                delay_ms: z.number().int().safe().nonnegative().default(0),
+            })),
             disconnect_after: z.boolean().default(false),
         }))
-            .max(100)
             .default([]),
     })
         .default({
@@ -366,8 +334,6 @@ export const processScenarioSchema = z
 const eventsOutOfOrder = (event, previous) => event !== undefined && previous !== undefined && event.at_ms < previous.at_ms;
 /** Parse untrusted process scenario input and apply safe default budgets. */
 export const parseProcessScenario = (input) => processScenarioSchema.parse(input);
-const isWithin = (candidate, root) => resolve(candidate) === resolve(root) ||
-    resolve(candidate).startsWith(`${resolve(root)}${resolve(root).endsWith("/") ? "" : "/"}`);
 /** Evaluate scenario authority before any process or filesystem side effect occurs. */
 export const authorizeProcessScenario = (scenario, policy) => {
     if (policy.status === "disabled")
@@ -377,10 +343,10 @@ export const authorizeProcessScenario = (scenario, policy) => {
             allowed: false,
             reason: "host network access is not approved by operator policy",
         };
-    if (!policy.executableRoots.some((root) => isWithin(scenario.executable, root))) {
+    if (!policy.executableRoots.some((root) => isPathWithinRoot(root, scenario.executable))) {
         return { allowed: false, reason: "executable is outside approved roots" };
     }
-    if (!policy.workingRoots.some((root) => isWithin(scenario.working_directory, root))) {
+    if (!policy.workingRoots.some((root) => isPathWithinRoot(root, scenario.working_directory))) {
         return {
             allowed: false,
             reason: "working directory is outside approved roots",
@@ -396,7 +362,7 @@ export const authorizeProcessScenario = (scenario, policy) => {
             reason: "scenario requests an environment variable not allowed by policy",
         };
     }
-    if (scenario.filesystem_roots.some((path) => !policy.workingRoots.some((root) => isWithin(path, root)))) {
+    if (scenario.filesystem_roots.some((path) => !policy.workingRoots.some((root) => isPathWithinRoot(root, path)))) {
         return {
             allowed: false,
             reason: "filesystem root is outside approved roots",

package/dist/domain/processTraceComparison.js

@@ -1,17 +1,9 @@
-import { validateProcessCapture } from "./processCaptureValidation.js";
 import { evaluateProcessTraceSide, processTraceComparisonResultSchema, } from "./processTraceEvaluation.js";
 import { processTraceSpecificationSchema, } from "./processTraceSpecification.js";
 export { processTraceComparisonResultSchema, } from "./processTraceEvaluation.js";
 export { processTraceSourceSchema, processTraceSpecificationSchema, } from "./processTraceSpecification.js";
 /** Compare two captures against an explicit finite trace language. */
 export const compareProcessTraces = (left, right, specificationInput) => {
-    const captureIssues = [
-        ...validateProcessCapture(left),
-        ...validateProcessCapture(right),
-    ];
-    const firstCaptureIssue = captureIssues.at(0);
-    if (firstCaptureIssue !== undefined)
-        throw new TypeError(`Invalid Process Capture v4: ${firstCaptureIssue.path}`);
     const specification = processTraceSpecificationSchema.parse(specificationInput);
     const leftEvaluation = evaluateProcessTraceSide(left, specification);
     const rightEvaluation = evaluateProcessTraceSide(right, specification);

package/dist/domain/processTraceEvaluation.js

@@ -7,12 +7,22 @@ const matchedEventSchema = z.strictObject({
     event_id: identifierSchema,
     location: locationSchema,
 });
-const sideResultSchema = z.strictObject({
-    status: z.enum(["pass", "fail", "unknown"]),
-    matched_variant: identifierSchema.nullable(),
+const sideResultShape = {
     satisfied_constraints: z.array(z.string()),
     raw_trace: z.array(matchedEventSchema),
-});
+};
+const sideResultSchema = z.union([
+    z.strictObject({
+        ...sideResultShape,
+        status: z.literal("pass"),
+        matched_variant: identifierSchema.nullable(),
+    }),
+    z.strictObject({
+        ...sideResultShape,
+        status: z.enum(["fail", "unknown"]),
+        matched_variant: z.null(),
+    }),
+]);
 const diagnosticSchema = z.strictObject({
     kind: z.enum([
         "journal",

package/dist/domain/processTraceSpecification.js

@@ -2,7 +2,7 @@ import canonicalize from "canonicalize";
 import { z } from "zod";
 import { jsonValueSchema } from "./jsonValue.js";
 import { comparableProcessObservationPayload, processObservationSourceSchema, } from "./processObservation.js";
-const identifierSchema = z.string().regex(/^[A-Za-z][A-Za-z0-9._-]{0,63}$/u);
+const identifierSchema = z.string().regex(/^[A-Za-z][A-Za-z0-9._-]*$/u);
 /** Process observation families admitted by a declared trace specification. */
 export const processTraceSourceSchema = processObservationSourceSchema;
 const cardinalitySchema = z.discriminatedUnion("kind", [
@@ -10,13 +10,13 @@ const cardinalitySchema = z.discriminatedUnion("kind", [
     z.strictObject({ kind: z.literal("optional") }),
     z.strictObject({
         kind: z.literal("exact"),
-        count: z.number().int().min(0).max(10_000),
+        count: z.number().int().min(0),
     }),
     z
         .strictObject({
         kind: z.literal("range"),
-        min: z.number().int().min(0).max(10_000),
-        max: z.number().int().min(0).max(10_000),
+        min: z.number().int().min(0),
+        max: z.number().int().min(0),
     })
         .refine(({ min, max }) => min <= max, {
         message: "cardinality min must not exceed max",
@@ -35,7 +35,6 @@ const eventDeclarationSchema = z.strictObject({
         "dispatched_at_ms",
         "elapsed_ms",
     ]))
-        .max(5)
         .refine((values) => new Set(values).size === values.length, {
         message: "ignored event fields must be unique",
     })
@@ -49,39 +48,34 @@ const partialOrderLanguageSchema = z.strictObject({
         before: identifierSchema,
         after: identifierSchema,
     }))
-        .max(4_096)
         .default([]),
     not_before: z
         .array(z.strictObject({
         event: identifierSchema,
         anchor: identifierSchema,
     }))
-        .max(4_096)
         .default([]),
     unordered_groups: z
-        .array(z.strictObject({ events: z.array(identifierSchema).min(2).max(256) }))
-        .max(256)
+        .array(z.strictObject({ events: z.array(identifierSchema).min(2) }))
         .default([]),
-    prefix: z.array(identifierSchema).max(4_096).default([]),
-    suffix: z.array(identifierSchema).max(4_096).default([]),
+    prefix: z.array(identifierSchema).default([]),
+    suffix: z.array(identifierSchema).default([]),
 });
 const finiteTraceTokenSchema = z.union([
     identifierSchema,
-    z.strictObject({ unordered: z.array(identifierSchema).min(2).max(256) }),
+    z.strictObject({ unordered: z.array(identifierSchema).min(2) }),
 ]);
 const finiteTraceLanguageSchema = z.strictObject({
     kind: z.literal("finite_traces"),
     variants: z
         .array(z.strictObject({
         id: identifierSchema,
-        trace: z.array(finiteTraceTokenSchema).max(4_096),
+        trace: z.array(finiteTraceTokenSchema),
     }))
-        .min(1)
-        .max(64),
+        .min(1),
 });
 const specificationShapeSchema = z.strictObject({
-    version: z.literal(1),
-    events: z.array(eventDeclarationSchema).min(1).max(256),
+    events: z.array(eventDeclarationSchema).min(1),
     language: z.discriminatedUnion("kind", [
         partialOrderLanguageSchema,
         finiteTraceLanguageSchema,

package/dist/domain/protocolCapture.js

@@ -59,7 +59,7 @@ export const protocolCaptureSchema = z.strictObject({
     /** Protocol family for this capture. */
     family: protocolFamilySchema,
     /** Captured messages in order. */
-    messages: z.array(protocolMessageSchema).min(0).max(10_000),
+    messages: z.array(protocolMessageSchema).min(0),
     /** Aggregated schema hypotheses across all messages. */
     inferred_schema: z.array(schemaHypothesisSchema).default([]),
     /** Whether any message was truncated. */
@@ -171,7 +171,7 @@ export function decodeMessagePack(rawPayload) {
     }
     return {
         decoded_fields: fields,
-        truncated: rawPayload.length > 10_000,
+        truncated: false,
     };
 }
 /** Decode a gRPC frame (5-byte header + protobuf payload). */
@@ -210,7 +210,7 @@ export function decodeGrpcFrame(rawPayload) {
                 inferred: false,
             },
         ],
-        truncated: length > 10_000,
+        truncated: false,
     };
 }
 /** Infer schema hypotheses from a set of decoded messages. */