rea-agents 3.2.0 → 4.0.0

package/dist/replay/JavaScriptReplayWorker.js

@@ -1,382 +0,0 @@
-import { Script, SourceTextModule, SyntheticModule, createContext, } from "node:vm";
-import { types } from "node:util";
-const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-const record = (value, label) => {
-    if (!isRecord(value))
-        throw new TypeError(`Invalid replay worker ${label}`);
-    return value;
-};
-const string = (value, label) => {
-    if (typeof value !== "string")
-        throw new TypeError(`Invalid replay worker ${label}`);
-    return value;
-};
-const integer = (value, label) => {
-    if (!Number.isSafeInteger(value) || Number(value) < 0)
-        throw new TypeError(`Invalid replay worker ${label}`);
-    return Number(value);
-};
-const parseWorkerModule = (value) => {
-    const module = record(value, "module");
-    const format = module.format;
-    if (format !== "esm" && format !== "commonjs-factory")
-        throw new TypeError("Invalid replay worker module format");
-    const dependencies = record(module.dependencies, "module dependencies");
-    if (Object.values(dependencies).some((dependency) => typeof dependency !== "string"))
-        throw new TypeError("Invalid replay worker module dependency");
-    return {
-        alias: string(module.alias, "module alias"),
-        format,
-        dependencies: Object.fromEntries(Object.entries(dependencies).map(([key, dependency]) => [
-            key,
-            string(dependency, "module dependency"),
-        ])),
-        source: string(module.source, "module source"),
-    };
-};
-const parseWorkerSide = (value) => {
-    const side = record(value, "side");
-    if (!Array.isArray(side.modules))
-        throw new TypeError("Invalid replay worker modules");
-    return {
-        modules: side.modules.map(parseWorkerModule),
-        entryAlias: string(side.entryAlias, "entry alias"),
-        entryExport: string(side.entryExport, "entry export"),
-    };
-};
-const parseWorkerRequest = (value) => {
-    const request = record(value, "request");
-    if (!Array.isArray(request.cases))
-        throw new TypeError("Invalid replay worker cases");
-    const determinism = record(request.determinism, "determinism");
-    const limits = record(request.limits, "limits");
-    return {
-        left: parseWorkerSide(request.left),
-        ...(request.right === undefined
-            ? {}
-            : { right: parseWorkerSide(request.right) }),
-        cases: request.cases.map((value) => {
-            const replayCase = record(value, "case");
-            if (!Array.isArray(replayCase.arguments))
-                throw new TypeError("Invalid replay worker case arguments");
-            return {
-                caseId: string(replayCase.caseId, "case ID"),
-                arguments: replayCase.arguments,
-                inputSha256: string(replayCase.inputSha256, "case digest"),
-            };
-        }),
-        determinism: {
-            clockIso: string(determinism.clockIso, "clock"),
-            randomSeed: integer(determinism.randomSeed, "random seed"),
-        },
-        limits: {
-            resultDepth: integer(limits.resultDepth, "result depth"),
-            resultNodes: integer(limits.resultNodes, "result nodes"),
-            exceptionBytes: integer(limits.exceptionBytes, "exception bytes"),
-        },
-    };
-};
-class ReplayDeniedError extends Error {
-    name = "ReplayDeniedError";
-}
-const main = async () => {
-    const chunks = [];
-    for await (const chunk of process.stdin)
-        chunks.push(Buffer.from(chunk));
-    const rawRequest = JSON.parse(Buffer.concat(chunks).toString("utf8"));
-    const request = parseWorkerRequest(rawRequest);
-    const left = [];
-    const right = [];
-    for (let index = 0; index < request.cases.length; index += 1) {
-        const replayCase = request.cases[index];
-        if (replayCase === undefined)
-            continue;
-        left.push(await runCase(request.left, replayCase, request, index));
-        if (request.right !== undefined)
-            right.push(await runCase(request.right, replayCase, request, index));
-    }
-    process.stdout.write(JSON.stringify({
-        left,
-        ...(request.right === undefined ? {} : { right }),
-    }));
-};
-const runCase = async (side, replayCase, request, index) => {
-    try {
-        const loaded = await loadEntry(side, request, index);
-        if (typeof loaded !== "function")
-            throw new TypeError(`Replay export is not callable: ${side.entryExport}`);
-        const returned = await Reflect.apply(loaded, undefined, [
-            ...replayCase.arguments,
-        ]);
-        try {
-            return {
-                case_id: replayCase.caseId,
-                outcome: "return",
-                value: projectValue(returned, request.limits.resultDepth, request.limits.resultNodes),
-                input_sha256: replayCase.inputSha256,
-                output_sha256: null,
-                truncated: false,
-            };
-        }
-        catch (error) {
-            return exceptionOutcome(replayCase, "serialization_error", error, request.limits.exceptionBytes);
-        }
-    }
-    catch (error) {
-        return exceptionOutcome(replayCase, error instanceof ReplayDeniedError ? "denied" : "exception", error, request.limits.exceptionBytes);
-    }
-};
-const loadEntry = async (side, request, caseIndex) => {
-    const modules = new Map(side.modules.map((module) => [module.alias, module]));
-    const context = deterministicContext(request, caseIndex);
-    const esmCache = new Map();
-    const commonJsCache = new Map();
-    const loadCommonJs = (alias) => {
-        const cached = commonJsCache.get(alias);
-        if (cached !== undefined)
-            return cached;
-        const descriptor = requiredModule(modules, alias);
-        if (descriptor.format !== "commonjs-factory")
-            throw new TypeError(`Synchronous require cannot load ESM module: ${alias}`);
-        const module = { exports: {} };
-        commonJsCache.set(alias, module.exports);
-        const requireModule = (specifier) => {
-            const dependency = descriptor.dependencies[specifier];
-            if (dependency === undefined)
-                throw new ReplayDeniedError(`Undeclared require: ${specifier}`);
-            return loadCommonJs(dependency);
-        };
-        installRspackHelpers(requireModule);
-        const source = normalizeFactorySource(descriptor.source);
-        const factory = new Script(`(${source})`, {
-            filename: `/modules/${alias}.js`,
-        }).runInContext(context);
-        if (typeof factory !== "function")
-            throw new TypeError(`CommonJS factory is not callable: ${alias}`);
-        Reflect.apply(factory, undefined, [module, module.exports, requireModule]);
-        commonJsCache.set(alias, module.exports);
-        return module.exports;
-    };
-    const loadEsm = async (alias) => {
-        const cached = esmCache.get(alias);
-        if (cached !== undefined)
-            return cached;
-        const descriptor = requiredModule(modules, alias);
-        let module;
-        if (descriptor.format === "commonjs-factory") {
-            const exports = loadCommonJs(alias);
-            const names = [...new Set(["default", ...Object.keys(exports)])];
-            module = new SyntheticModule(names, function () {
-                this.setExport("default", exports);
-                for (const name of Object.keys(exports))
-                    this.setExport(name, exports[name]);
-            }, { context, identifier: `rea:${alias}` });
-        }
-        else {
-            module = new SourceTextModule(descriptor.source, {
-                context,
-                identifier: `rea:${alias}`,
-                initializeImportMeta: (meta) => {
-                    meta.url = `rea:${alias}`;
-                },
-                importModuleDynamically: () => {
-                    throw new ReplayDeniedError("Dynamic import is unavailable in controlled replay");
-                },
-            });
-        }
-        esmCache.set(alias, module);
-        await module.link(async (specifier) => {
-            const dependency = descriptor.dependencies[specifier];
-            if (dependency === undefined)
-                throw new ReplayDeniedError(`Undeclared import: ${specifier}`);
-            return loadEsm(dependency);
-        });
-        await module.evaluate();
-        return module;
-    };
-    const entry = requiredModule(modules, side.entryAlias);
-    if (entry.format === "commonjs-factory") {
-        const exported = loadCommonJs(side.entryAlias);
-        return side.entryExport === "default"
-            ? (exported.default ?? exported)
-            : exported[side.entryExport];
-    }
-    const namespace = (await loadEsm(side.entryAlias)).namespace;
-    return Reflect.get(namespace, side.entryExport);
-};
-const deterministicContext = (request, caseIndex) => {
-    let state = (request.determinism.randomSeed + caseIndex) >>> 0;
-    const random = () => {
-        state ^= state << 13;
-        state ^= state >>> 17;
-        state ^= state << 5;
-        return (state >>> 0) / 0x1_0000_0000;
-    };
-    const epoch = Date.parse(request.determinism.clockIso);
-    class ReplayDate extends Date {
-        constructor(...arguments_) {
-            super(arguments_.length === 0 ? epoch : arguments_[0]);
-        }
-        static now() {
-            return epoch;
-        }
-    }
-    const replayMath = Object.create(Math);
-    Object.defineProperty(replayMath, "random", { value: random });
-    return createContext({ Date: ReplayDate, Math: replayMath }, {
-        name: "rea-controlled-replay",
-        codeGeneration: { strings: false, wasm: false },
-    });
-};
-const installRspackHelpers = (require_) => {
-    const defineExports = (exports, definitions) => {
-        for (const [name, getter] of Object.entries(definitions))
-            if (!Object.prototype.hasOwnProperty.call(exports, name))
-                Object.defineProperty(exports, name, { enumerable: true, get: getter });
-    };
-    const markModule = (exports) => {
-        Object.defineProperty(exports, "__esModule", { value: true });
-        Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-    };
-    const normalizeModule = (module) => {
-        const getter = () => (module.__esModule === true ? module.default : module);
-        Object.defineProperty(getter, "a", { get: getter });
-        return getter;
-    };
-    const passModule = (module) => module;
-    Object.defineProperties(require_, {
-        d: { value: defineExports },
-        r: { value: markModule },
-        n: { value: normalizeModule },
-        nmd: { value: passModule },
-    });
-};
-const requiredModule = (modules, alias) => {
-    const module = modules.get(alias);
-    if (module === undefined)
-        throw new TypeError(`Undeclared module alias: ${alias}`);
-    return module;
-};
-const normalizeFactorySource = (source) => /^\s*\d+\s*\(/u.test(source)
-    ? source.replace(/^\s*\d+\s*\(/u, "function(")
-    : source;
-const projectValue = (value, maximumDepth, maximumNodes) => projectValueRecursive(value, 0, new Set(), {
-    maximumDepth,
-    maximumNodes,
-    nodes: 0,
-});
-const projectValueRecursive = (candidate, depth, ancestors, context) => {
-    context.nodes += 1;
-    if (context.nodes > context.maximumNodes || depth > context.maximumDepth)
-        throw new RangeError("Replay result projection limit exceeded");
-    const leaf = projectLeaf(candidate);
-    if (leaf !== undefined)
-        return leaf;
-    if (typeof candidate !== "object" || candidate === null)
-        throw new TypeError(`Unsupported replay result type: ${typeof candidate}`);
-    if (types.isProxy(candidate))
-        throw new TypeError("Proxy replay results are unavailable");
-    if (ancestors.has(candidate))
-        throw new TypeError("Cyclic replay result");
-    ancestors.add(candidate);
-    try {
-        assertSupportedPrototype(candidate);
-        return projectComplexValue(candidate, depth, ancestors, context);
-    }
-    finally {
-        ancestors.delete(candidate);
-    }
-};
-const projectLeaf = (candidate) => {
-    if (candidate === null ||
-        typeof candidate === "string" ||
-        typeof candidate === "boolean")
-        return candidate;
-    if (typeof candidate === "number") {
-        if (!Number.isFinite(candidate))
-            throw new TypeError("Non-finite replay result number");
-        return candidate;
-    }
-    return undefined;
-};
-const assertSupportedPrototype = (candidate) => {
-    if (Array.isArray(candidate))
-        return;
-    const prototype = Object.getPrototypeOf(candidate);
-    if (prototype !== null && Object.getPrototypeOf(prototype) !== null)
-        throw new TypeError("Unsupported replay result prototype");
-};
-const projectComplexValue = (candidate, depth, ancestors, context) => {
-    const descriptors = Object.getOwnPropertyDescriptors(candidate);
-    const output = Array.isArray(candidate)
-        ? []
-        : {};
-    for (const [key, descriptor] of Object.entries(descriptors)) {
-        if (key === "length" && Array.isArray(candidate))
-            continue;
-        if (!("value" in descriptor))
-            throw new TypeError("Replay result accessors are unavailable");
-        if (Array.isArray(output)) {
-            if (!/^\d+$/u.test(key))
-                throw new TypeError("Replay arrays may only contain indexed values");
-            output[Number(key)] = projectValueRecursive(descriptor.value, depth + 1, ancestors, context);
-        }
-        else {
-            output[key] = projectValueRecursive(descriptor.value, depth + 1, ancestors, context);
-        }
-    }
-    return output;
-};
-const exceptionOutcome = (replayCase, outcome, error, maximumBytes) => {
-    const details = exceptionDetails(error);
-    const name = bounded(details.name, maximumBytes);
-    const message = bounded(details.message, maximumBytes);
-    const stack = details.stack === null ? null : bounded(details.stack, maximumBytes);
-    return {
-        case_id: replayCase.caseId,
-        outcome,
-        exception: { name, message, stack },
-        input_sha256: replayCase.inputSha256,
-        output_sha256: null,
-        truncated: false,
-    };
-};
-const exceptionDetails = (error) => {
-    if (typeof error !== "object" || error === null)
-        return { name: "Error", message: "Unknown replay exception", stack: null };
-    if (types.isProxy(error))
-        return { name: "Error", message: "Proxy replay exception", stack: null };
-    const own = Object.getOwnPropertyDescriptors(error);
-    const prototype = Object.getPrototypeOf(error);
-    const inherited = prototype === null ? {} : Object.getOwnPropertyDescriptors(prototype);
-    const stringValue = (descriptor) => descriptor !== undefined &&
-        "value" in descriptor &&
-        typeof descriptor.value === "string"
-        ? descriptor.value
-        : null;
-    return {
-        name: stringValue(own.name) ?? stringValue(inherited.name) ?? "Error",
-        message: stringValue(own.message) ?? "Unknown replay exception",
-        stack: stringValue(own.stack),
-    };
-};
-const bounded = (value, maximumBytes) => {
-    const bytes = Buffer.from(value);
-    if (bytes.byteLength <= maximumBytes)
-        return value;
-    const decoder = new TextDecoder("utf-8", { fatal: true });
-    for (let end = maximumBytes; end >= Math.max(0, maximumBytes - 3); end -= 1) {
-        try {
-            return decoder.decode(bytes.subarray(0, end));
-        }
-        catch {
-            /* try the preceding UTF-8 boundary */
-        }
-    }
-    return "";
-};
-void main().catch((error) => {
-    const message = error instanceof Error ? error.message : "Replay worker failed";
-    process.stderr.write(message);
-    process.exitCode = 70;
-});

package/dist/replay/JavaScriptReplayWorkerTypes.js

@@ -1 +0,0 @@
-export {};

package/dist/replay/LinuxJavaScriptReplayRunner.js

@@ -1,216 +0,0 @@
-import { temporaryFilterHandle } from "./ReplaySeccompFile.js";
-import { spawn } from "node:child_process";
-import { randomBytes } from "node:crypto";
-import { readFile } from "node:fs/promises";
-import { digestBytes, } from "../application/JavaScriptReplayPlanning.js";
-import { linuxX64ReplaySeccompDigest } from "./LinuxSeccompPolicy.js";
-import { resolveLinuxRuntimeClosure } from "./LinuxRuntimeClosure.js";
-import { assertRuntimeCommitment, systemdArguments, } from "./LinuxJavaScriptReplaySandbox.js";
-import { boundedCollector, killUnit, observeCleanup, observeUnitResult, } from "./ReplayProcessLifecycle.js";
-import { commitOutcomes, compareOutcomes, terminationResult, workerRequest, } from "./ReplayOutcome.js";
-import { parseReplayWorkerResponse, } from "./ReplayWorkerProtocol.js";
-const isAborted = (signal) => signal?.aborted === true;
-/** Run one prepared experiment under the exact Linux ADR-0002 boundary. */
-export class LinuxJavaScriptReplayRunner {
-    async execute(prepared, policy, signal) {
-        if (isAborted(signal))
-            return terminationResult({
-                prepared,
-                stderr: "",
-                termination: "cancelled",
-                cleanup: { state: "complete", residual_resources: [] },
-            });
-        const unit = `rea-replay-${randomBytes(8).toString("hex")}.service`;
-        const closure = await validateReplayCommitments(prepared, policy);
-        const encoded = buildWorkerPayload(prepared);
-        const filter = await temporaryFilterHandle();
-        try {
-            const replayProcess = launchReplayProcess({
-                prepared,
-                policy,
-                encoded,
-                closure,
-                filterPath: filter.path,
-                unit,
-                signal,
-            });
-            try {
-                const collected = await replayProcess.completion;
-                if (replayProcess.terminationRequest !== undefined)
-                    await replayProcess.terminationRequest;
-                const unitResult = await observeUnitResult(policy.systemctlPath, unit);
-                const cleanup = await observeCleanup(policy.systemctlPath, unit);
-                return resolveReplayResult({
-                    prepared,
-                    collected,
-                    unitResult,
-                    cleanup,
-                    termination: replayProcess.termination,
-                });
-            }
-            finally {
-                signal?.removeEventListener("abort", replayProcess.terminate);
-                if (replayProcess.timeout !== undefined)
-                    clearTimeout(replayProcess.timeout);
-                if (replayProcess.child !== undefined &&
-                    replayProcess.child.exitCode === null) {
-                    replayProcess.requestTermination();
-                    await replayProcess.terminationRequest;
-                }
-            }
-        }
-        finally {
-            await filter.close();
-        }
-    }
-}
-const validateReplayCommitments = async (prepared, policy) => {
-    const closure = await resolveLinuxRuntimeClosure(policy.nodePath);
-    assertRuntimeCommitment(prepared, closure);
-    const workerPath = prepared.publicPlan.runtime.worker.path;
-    if (digestBytes(await readFile(workerPath)) !==
-        prepared.publicPlan.runtime.worker.sha256)
-        throw new TypeError("Replay worker changed after approval");
-    if (linuxX64ReplaySeccompDigest() !== prepared.publicPlan.sandbox.seccomp_sha256)
-        throw new TypeError("Replay seccomp policy changed after approval");
-    return closure;
-};
-const buildWorkerPayload = (prepared) => {
-    const request = workerRequest(prepared);
-    const encoded = Buffer.from(JSON.stringify(request));
-    if (encoded.byteLength > prepared.publicPlan.limits.protocol_bytes)
-        throw new RangeError("Replay worker protocol input exceeds the committed limit");
-    return encoded;
-};
-const launchReplayProcess = (options) => {
-    const { prepared, policy, encoded, closure, filterPath, unit, signal } = options;
-    const arguments_ = systemdArguments({
-        unit,
-        policy,
-        prepared,
-        workerPath: prepared.publicPlan.runtime.worker.path,
-        closure,
-        filterPath,
-    });
-    let child;
-    let timeout;
-    let termination;
-    let terminationRequest;
-    const requestTermination = () => {
-        terminationRequest ??= killUnit(policy.systemctlPath, unit);
-        child?.kill("SIGKILL");
-    };
-    const terminate = () => {
-        termination ??= "cancelled";
-        requestTermination();
-    };
-    const completion = new Promise((resolve, reject) => {
-        child = spawn(policy.systemdRunPath, arguments_, {
-            stdio: ["pipe", "pipe", "pipe"],
-            env: replayProcessEnvironment(),
-        });
-        const output = boundedCollector(prepared.publicPlan.limits.output_bytes);
-        const diagnostics = boundedCollector(prepared.publicPlan.limits.stderr_bytes);
-        child.stdout?.on("data", output.append);
-        child.stderr?.on("data", diagnostics.append);
-        child.once("error", reject);
-        child.once("close", (code, signalName) => resolve({
-            code,
-            signal: signalName,
-            stdout: output.value(),
-            stderr: diagnostics.value(),
-            outputExceeded: output.exceeded(),
-        }));
-        child.stdin?.end(encoded);
-    });
-    signal?.addEventListener("abort", terminate, { once: true });
-    if (isAborted(signal))
-        terminate();
-    timeout = setTimeout(() => {
-        termination ??= "timeout";
-        requestTermination();
-    }, prepared.publicPlan.limits.wall_time_ms);
-    timeout.unref();
-    if (child === undefined || timeout === undefined)
-        throw new TypeError("Replay process was not launched");
-    return {
-        child,
-        completion,
-        timeout,
-        terminate,
-        requestTermination,
-        get terminationRequest() {
-            return terminationRequest;
-        },
-        get termination() {
-            return termination;
-        },
-    };
-};
-const replayProcessEnvironment = () => ({
-    PATH: "/usr/bin:/bin",
-    LANG: "C",
-    LC_ALL: "C",
-    TZ: "UTC",
-    ...(process.env.XDG_RUNTIME_DIR === undefined
-        ? {}
-        : { XDG_RUNTIME_DIR: process.env.XDG_RUNTIME_DIR }),
-    ...(process.env.DBUS_SESSION_BUS_ADDRESS === undefined
-        ? {}
-        : { DBUS_SESSION_BUS_ADDRESS: process.env.DBUS_SESSION_BUS_ADDRESS }),
-});
-const resolveReplayResult = (options) => {
-    const { prepared, collected, unitResult, cleanup, termination } = options;
-    if (termination !== undefined)
-        return terminationResult({
-            prepared,
-            stderr: collected.stderr,
-            termination,
-            cleanup,
-        });
-    if (collected.outputExceeded)
-        return terminationResult({
-            prepared,
-            stderr: collected.stderr,
-            termination: "protocol_error",
-            cleanup,
-            limitation: "Worker stdout exceeded the committed bound",
-        });
-    if (collected.code !== 0)
-        return terminationResult({
-            prepared,
-            stderr: collected.stderr,
-            termination: collected.code === 137 || unitResult === "oom-kill" ? "oom" : "crash",
-            cleanup,
-        });
-    let response;
-    try {
-        const rawResponse = JSON.parse(collected.stdout);
-        response = parseReplayWorkerResponse(rawResponse, prepared.publicPlan.cases, prepared.publicPlan.right === undefined ? "single" : "differential");
-    }
-    catch {
-        return terminationResult({
-            prepared,
-            stderr: collected.stderr,
-            termination: "protocol_error",
-            cleanup,
-        });
-    }
-    const outcomes = commitOutcomes(response.left);
-    const right = response.right === undefined ? undefined : commitOutcomes(response.right);
-    return {
-        plan_digest: prepared.publicPlan.plan_digest,
-        outcomes: [...outcomes, ...(right ?? [])],
-        ...(right === undefined
-            ? {}
-            : { comparison: compareOutcomes(outcomes, right) }),
-        stderr: collected.stderr,
-        termination: "completed",
-        cleanup,
-        limitations: [
-            "Controlled replay observes the isolated extracted modules, not the original application runtime.",
-            "Network and host filesystem access were unavailable; unsupported dependencies may change behavior.",
-        ],
-        reproducer: null,
-    };
-};