rea-agents 3.2.1 → 4.0.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "rea-agents",
   "mcpName": "io.github.morluto/rea",
-  "version": "3.2.1",
+  "version": "4.0.0",
   "description": "Reverse engineer anything from your terminal or agent with one CLI and MCP server.",
   "license": "MIT",
   "repository": {
@@ -42,6 +42,7 @@
     "dist",
     "install.sh",
     "bridge/hopper_bridge.py",
+    "bridge/native/ReaNativeUI.swift",
     "bridge/ghidra/ReaGhidraBridge.java",
     "scripts/rea.mjs",
     "scripts/electron-active-hook.cjs",
@@ -60,14 +61,15 @@
     "mcp-registry:check": "node scripts/verify-mcp-registry-metadata.mjs",
     "mcp-catalog:generate": "npm run build:cached && node scripts/generate-mcp-tool-catalog.mjs",
     "mcp-catalog:check": "node scripts/generate-mcp-tool-catalog.mjs --check",
-    "prebuild": "npm run deps:check && npm run metadata:check && node scripts/clean-build-output.mjs",
-    "build": "tsc -p tsconfig.build.json",
+    "prebuild": "npm run deps:check && npm run metadata:check",
+    "build": "node scripts/run-exclusive.mjs build npm run build:unlocked",
+    "build:unlocked": "node scripts/clean-build-output.mjs && tsc -p tsconfig.build.json",
     "precheck": "npm run deps:check",
     "check": "turbo run typecheck lint format:check knip metadata:check",
     "precheck:fast": "npm run deps:check",
-    "check:fast": "turbo run typecheck lint",
+    "check:fast": "turbo run typecheck lint --output-logs=errors-only",
     "precheck:changed": "npm run deps:check",
-    "check:changed": "turbo run typecheck lint && npm run test:changed",
+    "check:changed": "npm run check:fast && npm run test:changed",
     "precheck:test": "npm run deps:check",
     "check:test": "turbo run typecheck lint format:check knip metadata:check test:run",
     "precheck:pr": "npm run deps:check",
@@ -75,8 +77,8 @@
     "precheck:ci": "npm run deps:check",
     "check:ci": "turbo run typecheck lint format:check knip metadata:check jscpd scan:todos",
     "build:cached": "turbo run build",
-    "format": "prettier --write .",
-    "format:check": "prettier --check .",
+    "format": "oxfmt .",
+    "format:check": "oxfmt --check .",
     "lint": "oxlint",
     "lint:fix": "oxlint --fix",
     "knip": "knip",
@@ -84,20 +86,18 @@
     "jscpd": "jscpd src/ tests/",
     "scan:todos": "node scripts/scan-todos.mjs",
     "start": "node scripts/rea.mjs mcp",
-    "test": "node scripts/run-exclusive.mjs test npm run test:with-build",
+    "test": "npm run test:with-build",
     "test:with-build": "npm run build:cached && vitest run",
-    "test:run": "node scripts/run-exclusive.mjs test vitest run",
-    "test:local": "node scripts/run-exclusive.mjs test vitest run --changed --passWithNoTests --maxWorkers=1",
-    "pretest:fast": "npm run build:cached",
-    "test:fast": "vitest run --project domain --project services --project adapters --project composition --project boundary --project process-boundary --project mcp-boundary --project conformance",
+    "test:run": "vitest run",
+    "test:local": "node scripts/run-development-tests.mjs local",
+    "test:fast": "vitest run --project domain --project services --project adapters --project composition --project conformance --project evaluation",
     "pretest:boundary": "npm run build:cached",
     "test:boundary": "vitest run --project boundary --project process-boundary --project mcp-boundary --project process-global",
     "pretest:mcp": "npm run build:cached",
     "test:mcp": "vitest run --project mcp-boundary",
     "pretest:acceptance": "npm run build:cached",
     "test:acceptance": "vitest run --project acceptance",
-    "pretest:changed": "npm run build:cached",
-    "test:changed": "vitest run --project domain --project services --project adapters --project composition --project boundary --project process-boundary --project mcp-boundary --project conformance --project evaluation --changed",
+    "test:changed": "node scripts/run-development-tests.mjs changed",
     "pretest:integration": "npm run build:cached",
     "test:integration": "vitest run --project boundary --project process-boundary --project mcp-boundary --project process-global --project acceptance",
     "pretest:coverage": "npm run build:cached",
@@ -109,14 +109,18 @@
     "test:ci:merge": "vitest --merge-reports --coverage.enabled --coverage.provider=v8",
     "pretest:verbose": "npm run build:cached",
     "test:verbose": "vitest run --reporter=verbose",
-    "pretest:watch": "npm run build:cached",
-    "test:watch": "vitest --project domain --project services --project adapters --project composition --project boundary --project process-boundary --project mcp-boundary --project conformance --project evaluation --changed",
+    "test:watch": "vitest --project domain --project services --project adapters --project composition --project conformance --project evaluation --changed",
     "pretest:watch:all": "npm run build:cached",
     "test:watch:all": "vitest --changed",
     "typecheck": "tsc --noEmit",
     "verify:test-temp-hygiene": "npm run build:cached && node scripts/verify-test-temp-hygiene.mjs",
     "verify:hopper": "npm run verify:fixtures && npm run build:cached && node scripts/verify-real-hopper.mjs",
+    "verify:apple-dispatch": "npm run build:cached && node scripts/verify-apple-dispatch.mjs",
+    "verify:native-ui": "npm run build:cached && node scripts/verify-native-ui.mjs",
+    "verify:keyed-archive": "npm run build:cached && node scripts/verify-keyed-archive.mjs",
     "verify:ghidra": "npm run build:cached && node scripts/verify-real-ghidra.mjs",
+    "verify:ghidra:switch": "npm run build:cached && node scripts/verify-real-ghidra-switch.mjs",
+    "verify:ghidra:dos": "npm run build:cached && node scripts/verify-real-ghidra-dos.mjs",
     "verify:ghidra:aarch64-jump-table": "npm run build:cached && node scripts/verify-real-ghidra.mjs --aarch64-jump-table",
     "verify:interface-builder": "npm run build:cached && node scripts/verify-interface-builder.mjs",
     "verify:ghidra:cross-format": "npm run build:cached && node scripts/verify-real-ghidra.mjs --cross-format",
@@ -127,7 +131,6 @@
     "verify:javascript-runtime": "npm run build:cached && node scripts/verify-local-javascript-runtime.mjs",
     "verify:application-workflows": "npm run build:cached && node scripts/verify-local-application-workflows.mjs",
     "verify:managed": "npm run build:cached && node scripts/verify-managed-conformance.mjs",
-    "verify:replay": "npm run build:cached && node scripts/verify-real-javascript-replay.mjs",
     "verify:agent": "npm run build:cached && node scripts/verify-agent-experience.mjs",
     "verify:hopper:linux": "npm run verify:fixtures && npm run build:cached && node scripts/verify-real-hopper-linux.mjs",
     "verify:setup:linux": "npm run build:cached && node scripts/verify-linux-setup-e2e.mjs",
@@ -145,19 +148,22 @@
     "docs:api": "typedoc",
     "docs:api:cached": "turbo run docs:api",
     "docs:generate": "node scripts/run-exclusive.mjs docs npm run docs:generate:unlocked",
-    "docs:generate:unlocked": "npm run metadata:generate && npm run build:cached && node scripts/generate-mcp-tool-catalog.mjs && node scripts/generate-skill-metadata.mjs && node scripts/generate-product-catalog.mjs && node scripts/generate-completion-ledger.mjs && npm run docs:api:cached && node scripts/generate-error-schema.mjs",
+    "docs:generate:unlocked": "npm run metadata:generate && npm run build:cached && node scripts/generate-mcp-tool-catalog.mjs && node scripts/generate-skill-metadata.mjs && node scripts/generate-product-catalog.mjs && node scripts/generate-completion-ledger.mjs && node scripts/generate-error-schema.mjs",
     "docs:check": "node scripts/run-exclusive.mjs docs turbo run docs:check:built",
     "docs:check:built": "node scripts/generate-package-metadata.mjs --check && node scripts/generate-mcp-tool-catalog.mjs --check && node scripts/generate-skill-metadata.mjs --check && node scripts/generate-product-catalog.mjs --check && node scripts/generate-completion-ledger.mjs --check && node scripts/check-doc-facts.mjs && node scripts/generate-error-schema.mjs --check",
     "docs:error-schema": "npm run build:cached && node scripts/generate-error-schema.mjs",
     "prepack": "node scripts/prepack.mjs",
-    "prepare": "node scripts/prepare.mjs"
+    "prepare": "node scripts/prepare.mjs",
+    "verify:asset-catalog": "npm run build:cached && node scripts/verify-asset-catalog.mjs",
+    "verify:native-ui:permissions": "npm run build:cached && node scripts/verify-native-ui.mjs --allow-permission-denial",
+    "test:focused": "node scripts/run-development-tests.mjs focused"
   },
   "lint-staged": {
     "*.{cjs,cts,js,jsx,mjs,mts,ts,tsx}": [
-      "prettier --write",
+      "oxfmt",
       "oxlint --fix"
     ],
-    "*.{json,md,yml,yaml}": "prettier --write"
+    "*.{json,md,yml,yaml}": "oxfmt"
   },
   "dependencies": {
     "@babel/parser": "8.0.4",
@@ -172,12 +178,14 @@
     "@xterm/headless": "6.0.0",
     "@zip.js/zip.js": "2.8.26",
     "canonicalize": "3.0.0",
+    "cross-spawn": "7.0.6",
     "diff": "9.0.0",
     "graphology": "0.26.0",
     "graphology-shortest-path": "2.1.0",
     "ignore": "7.0.6",
     "incur": "0.4.13",
     "isomorphic-git": "1.38.7",
+    "jsonc-parser": "3.3.1",
     "pino": "9.14.0",
     "playwright-core": "1.58.2",
     "plist": "5.0.0",
@@ -189,17 +197,19 @@
   },
   "devDependencies": {
     "@fast-check/vitest": "0.4.1",
+    "@types/cross-spawn": "6.0.6",
     "@types/node": "24.10.1",
     "@types/semver": "7.7.1",
     "@types/write-file-atomic": "4.0.3",
     "@types/ws": "8.18.1",
     "@vitest/coverage-v8": "4.1.10",
+    "ajv": "8.20.0",
     "husky": "9.1.7",
     "jscpd": "5.0.12",
     "knip": "6.26.0",
     "lint-staged": "16.4.0",
+    "oxfmt": "0.72.0",
     "oxlint": "1.73.0",
-    "prettier": "3.6.2",
     "turbo": "2.10.5",
     "typedoc": "0.28.20",
     "typescript": "5.9.3",

package/skills/reverse-engineer-anything/SKILL.md

@@ -1,16 +1,16 @@
 ---
 name: reverse-engineer-anything
-description: Reverse engineer native, managed, Electron/JavaScript, packaged, and browser applications with REA. Use shipped-artifact or approved runtime evidence to explain features, compare versions, decompile code, or guide a reconstruction. Skip REA for ordinary source-repository architecture analysis.
+description: Reverse engineer native, managed, Electron/JavaScript, packaged, and browser applications with REA. Use shipped-artifact or requested runtime evidence to explain features, compare versions, decompile code, or guide a reconstruction. Skip REA for ordinary source-repository architecture analysis.
 metadata:
-  version: "23"
-  tool_count: 114
-  catalog_digest: "3e9ab4e05563ea2609b7cf4db67638a79cd8a74188c292718d99a63451d5b9db"
+  version: "24"
+  tool_count: 116
+  catalog_digest: "5bb3f994a3c4d0c87a34ff5aab4e28141b5fa6f3a98b5ae7e95686d85d9d983e"
 ---
 
 # REA
 
 Use REA when a claim depends on a shipped binary or package, decompilation,
-passive application runtime evidence, controlled replay, or comparison with
+passive application runtime evidence, or comparison with
 behavior not established by available source. For ordinary analysis of a
 complete source repository, use normal repository tools and do not run REA
 readiness or provider commands.
@@ -50,8 +50,12 @@ returned result leaves a specific question unanswered.
 
 Every conclusion must distinguish observations, inferences, and unknowns. Cite
 Evidence IDs, preserve limitations and incomplete coverage, and never imply
-that static analysis observed execution. Ask for approval only where a tool or
-policy requires it; approval never broadens a different authority boundary.
+that static analysis observed execution. Runtime requests execute the declared
+target and lifecycle; do not broaden the target or action beyond those fields.
+
+Within the user's requested investigation, call available analysis tools
+directly. REA does not require permission grants or per-call approval flags.
+Follow the declared request scope and the host's actual access requirements.
 
 ## Plan broader investigations
 
@@ -71,8 +75,10 @@ For requests that span multiple features or subsystems, use a staged workflow:
    they affect the question. Use format-aware inventory and parsers; do not
    infer behavior from filenames, strings, or layout alone.
 5. Corroborate a conclusion with the evidence type it requires. Use runtime
-   observation or controlled replay only when static evidence cannot answer the
-   question and the required authority is available.
+   observation only when static evidence cannot answer the question and the
+   required host runtime and OS access are available. For JavaScript behavior,
+   run probes against the actual app through the available browser, Electron,
+   or process capture workflow.
 6. Decompose work into independent questions. When parallel workers are
    available and the questions do not depend on one another, assign distinct
    scopes, point workers to existing evidence, and ask them to return sources,
@@ -96,8 +102,6 @@ as complete while required questions remain open.
   [references/runtime-observation.md](references/runtime-observation.md)
 - Evidence paging, comparisons, residual unknowns, and verification:
   [references/evidence-workflows.md](references/evidence-workflows.md)
-- Controlled JavaScript replay:
-  [references/controlled-replay.md](references/controlled-replay.md)
 
 ## Readiness and setup
 

package/skills/reverse-engineer-anything/references/evidence-workflows.md

@@ -7,8 +7,9 @@ is incomplete or paginated, continue only when the remaining data matters to
 the task; do not fetch a bundle or resource merely to read a result already
 returned inline.
 
-Use `record_unknown` only with explicit approval and name the authority or
-environment still required. Supply supporting and contradicting evidence IDs.
+Use `record_unknown` to track unresolved questions in the user's investigation
+and name the authority or environment still required. Supply supporting and
+contradicting evidence IDs. It updates the session registry directly.
 Use `update_unknown` with the current revision; reread after a stale revision
 instead of retrying blindly. Only qualifying observed evidence can verify a
 resolution.

package/skills/reverse-engineer-anything/references/javascript-applications.md

@@ -31,5 +31,6 @@ Include the complete Evidence records from both analysis calls. Accept variant
 pairing only through the tool's unique exact literal discriminant. Cite the
 comparison Evidence and report JSON Pointer changes; dynamic values, ambiguous
 variants, and incomplete parent-property coverage stay unknown. This is static
-inference, not runtime behavior. Use `run_controlled_replay` separately only
-when the user needs approved runtime semantics.
+inference, not runtime behavior. When runtime semantics are needed, run
+behavioral probes against the relevant application versions and capture them
+through the available browser, Electron, or process workflows.

package/skills/reverse-engineer-anything/references/native-and-artifacts.md

@@ -32,9 +32,11 @@ IDs when using them.
 Use `extract_artifact` when materialized files are needed. It takes no arguments
 and materializes all regular files into a fresh temporary directory chosen by
 REA. Symlinks and encrypted entries are inventory facts, not extractable files.
-The operation still requires the filesystem-write permission grant; callers do
-not choose the destination.
-
-Native DMG traversal is macOS-only, read-only, and requires both operator policy
-and `native_mount_approved: true`; without both, retain the root-hash-only result.
-Approval for inventory never grants extraction authority.
+The result reports the materialized directory; callers do not choose the
+destination. No separate permission grant is needed.
+
+Native DMG traversal automatically uses a read-only mount on supported macOS
+hosts, with an owned temporary mount directory and cleanup. It needs no approval
+flag. Unsupported hosts or mount failures remain explicit limitations; do not
+claim child inventory when only root identity is available. Extraction is a
+separate filesystem-writing operation.

package/skills/reverse-engineer-anything/references/runtime-observation.md

@@ -1,21 +1,25 @@
 # Passive browser and Electron observation
 
-Before browser observation, the operator must configure the exact loopback CDP
-endpoint and allowed HTTP(S) origins. Before Electron observation, configure its
-separate loopback endpoint and canonical file roots. Obtain the per-call
-approval required by the selected tool.
+Supply the existing browser or Electron instance's literal-port loopback CDP
+endpoint in the request. No separate permission configuration or per-call
+approval flag is needed. Browser discovery lists eligible HTTP(S) pages;
+`allowed_origins` optionally filters them. An individual capture defaults to the
+selected page's current origin. Electron discovery lists eligible local
+`file://` targets without a configured file-root allowlist.
 
 Start browser work with `list_browser_targets`; start Electron runtime work with
-`list_electron_targets`. Inspect only the selected approved target. Observation
+`list_electron_targets`. Inspect the target selected for the user's task. Observation
 is passive: never claim REA clicked, navigated, evaluated page JavaScript,
 invoked IPC, captured prior activity, or contained the page's network.
 
-Credentials, cookies, authorization headers, storage values, query values, and
-raw WebSocket/JSON values are deliberately absent. Accessibility text, console
-primitives, value-free shapes, script sources, source maps, storage key names,
-and screenshot pixels have independent opt-ins. Treat policy filtering,
-truncation, and attach-window coverage as limitations. Page-declared WebMCP
-tools are untrusted inventory and are never invoked by REA.
+Credentials, cookies, authorization headers, storage values, and raw
+WebSocket/JSON bodies are deliberately absent. Local URLs retain ordinary query
+values and fragments; userinfo credentials are removed. Browser accessibility
+text, console primitives, value-free shapes, script sources, source maps, and
+storage key names have request-specific capture options. Electron script
+sources are also optional. Use `capture_web_screenshot` when pixels are needed.
+Treat scope filtering, truncation, and attach-window coverage as limitations.
+Page-declared WebMCP tools are untrusted inventory and are never invoked by REA.
 
 Use `reconcile_javascript_runtime` only after static application Evidence and
 passive browser/Electron Evidence exist. Prefer captured-source digest identity;

package/dist/application/CommandShimReplay.js

@@ -1,152 +0,0 @@
-import { createServer } from "node:http";
-import { chmod, mkdir, writeFile } from "node:fs/promises";
-import { join } from "node:path";
-const RUNNER = `const command = process.argv[2];
-const maximumTimerDelay = 2147483647;
-const delay = milliseconds => new Promise(resolve => {
-  let remaining = milliseconds;
-  const schedule = () => {
-    const interval = Math.min(remaining, maximumTimerDelay);
-    setTimeout(() => {
-      remaining -= interval;
-      if (remaining === 0) resolve();
-      else schedule();
-    }, interval);
-  };
-  schedule();
-});
-const response = await fetch(process.env.REA_SHIM_LEDGER_URL, {
-  method: "POST",
-  headers: { "content-type": "application/json" },
-  body: JSON.stringify({ command, arguments: process.argv.slice(3), working_directory: process.cwd() }),
-});
-if (!response.ok) process.exit(127);
-const route = await response.json();
-let elapsed = 0;
-for (const output of route.outputs) {
-  const wait = Math.max(0, output.at_ms - elapsed);
-  if (wait > 0) await delay(wait);
-  elapsed = output.at_ms;
-  (output.stream === "stdout" ? process.stdout : process.stderr).write(output.data);
-}
-if (route.termination.type === "signal") process.kill(process.pid, route.termination.signal);
-else process.exit(route.termination.code);
-`;
-const shellQuote = (value) => `'${value.replaceAll("'", `'\\''`)}'`;
-/**
- * Start bounded executable replay wrappers and their private invocation ledger.
- *
- * Exact argument matching is deliberate: a fallback to the host executable
- * would make an unmatched dependency call look authoritative. Unmatched and
- * exhausted routes therefore fail visibly and remain part of the capture.
- */
-export const startCommandShimReplay = async (scenario, temporaryRoot, started, recordEvent = () => undefined) => {
-    const binPath = join(temporaryRoot, "shims");
-    await mkdir(binPath);
-    const runnerPath = join(temporaryRoot, "shim-runner.mjs");
-    await writeFile(runnerPath, RUNNER, { mode: 0o600, flag: "wx" });
-    for (const shim of scenario.command_shims) {
-        const path = join(binPath, shim.name);
-        const wrapper = `#!/bin/sh\nexec ${shellQuote(process.execPath)} ${shellQuote(runnerPath)} ${shellQuote(shim.name)} "$@"\n`;
-        await writeFile(path, wrapper, { mode: 0o700, flag: "wx" });
-        await chmod(path, 0o700);
-    }
-    const events = [];
-    let truncated = false;
-    const calls = new Map();
-    const server = createServer((request, response) => {
-        if (request.method !== "POST" || request.url !== "/invoke") {
-            response.writeHead(404).end();
-            return;
-        }
-        readInvocation(request)
-            .then((invocation) => {
-            const shim = scenario.command_shims.find(({ name }) => name === invocation.command);
-            const routeIndex = shim?.routes.findIndex(({ arguments: expected }) => JSON.stringify(expected) === JSON.stringify(invocation.arguments));
-            const key = `${invocation.command}:${String(routeIndex ?? -1)}`;
-            const used = calls.get(key) ?? 0;
-            const route = shim !== undefined && routeIndex !== undefined && routeIndex >= 0
-                ? shim.routes[routeIndex]
-                : undefined;
-            const outcome = route === undefined
-                ? "unmatched"
-                : used >= route.max_calls
-                    ? "exhausted"
-                    : "matched";
-            if (events.length >= scenario.limits.protocol_events)
-                truncated = true;
-            else {
-                const index = events.length;
-                events.push({
-                    sequence: index,
-                    at_ms: Math.max(0, Date.now() - started),
-                    command: invocation.command,
-                    route_index: routeIndex !== undefined && routeIndex >= 0 ? routeIndex : null,
-                    arguments: invocation.arguments,
-                    working_directory: invocation.working_directory,
-                    outcome,
-                });
-                recordEvent("shim_events", index);
-            }
-            if (outcome !== "matched" || route === undefined) {
-                response.writeHead(409).end();
-                return;
-            }
-            calls.set(key, used + 1);
-            response
-                .writeHead(200, { "content-type": "application/json" })
-                .end(JSON.stringify(route));
-        })
-            .catch(() => response.writeHead(400).end());
-    });
-    await listen(server);
-    const address = server.address();
-    if (address === null || typeof address === "string") {
-        await closeServer(server);
-        throw new Error("command shim ledger did not bind an IPv4 port");
-    }
-    return {
-        binPath,
-        url: `http://127.0.0.1:${String(address.port)}/invoke`,
-        events,
-        get truncated() {
-            return truncated;
-        },
-        close: () => closeServer(server),
-    };
-};
-const readInvocation = async (request) => {
-    const chunks = [];
-    let bytes = 0;
-    for await (const chunk of request) {
-        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-        bytes += buffer.length;
-        if (bytes > 64 * 1024)
-            throw new Error("shim invocation exceeds limit");
-        chunks.push(buffer);
-    }
-    const value = JSON.parse(Buffer.concat(chunks).toString("utf8"));
-    if (typeof value !== "object" ||
-        value === null ||
-        !("command" in value) ||
-        typeof value.command !== "string" ||
-        !("arguments" in value) ||
-        !Array.isArray(value.arguments) ||
-        !value.arguments.every((item) => typeof item === "string") ||
-        !("working_directory" in value) ||
-        typeof value.working_directory !== "string")
-        throw new Error("invalid shim invocation");
-    return {
-        command: value.command,
-        arguments: value.arguments,
-        working_directory: value.working_directory,
-    };
-};
-const listen = (server) => new Promise((resolveListen, rejectListen) => {
-    server.once("error", rejectListen);
-    server.listen(0, "127.0.0.1", () => {
-        server.off("error", rejectListen);
-        resolveListen();
-    });
-});
-const closeServer = (server) => new Promise((resolveClose, rejectClose) => server.close((cause) => cause === undefined ? resolveClose() : rejectClose(cause)));

package/dist/application/ConfiguredRoots.js

@@ -1,19 +0,0 @@
-import { realpath } from "node:fs/promises";
-/** Canonicalize configured policy roots while ignoring stale missing entries. */
-export const canonicalizeConfiguredRoots = async (roots) => {
-    const canonical = [];
-    for (const root of roots) {
-        try {
-            canonical.push(await realpath(root));
-        }
-        catch (cause) {
-            if (!isMissingPath(cause))
-                throw cause;
-        }
-    }
-    return canonical;
-};
-const isMissingPath = (cause) => typeof cause === "object" &&
-    cause !== null &&
-    "code" in cause &&
-    cause.code === "ENOENT";

package/dist/application/InstrumentedJavaScriptReplayHost.js

@@ -1,36 +0,0 @@
-import { instrumentJavaScriptExport, } from "../domain/javascriptExportInstrumentation.js";
-/** Decorate one exact replay source with deterministic in-memory instrumentation. */
-export class InstrumentedJavaScriptReplayHost {
-    delegate;
-    input;
-    instrumentation = null;
-    constructor(delegate, input) {
-        this.delegate = delegate;
-        this.input = input;
-    }
-    async readSource(path, maximumBytes) {
-        const source = await this.delegate.readSource(path, maximumBytes);
-        if (path !== this.input.artifact_path)
-            return source;
-        const instrumented = instrumentJavaScriptExport(source.bytes, this.input);
-        if (instrumented.bytes.byteLength > maximumBytes)
-            throw new RangeError("Instrumented JavaScript exceeds the replay module byte limit");
-        this.instrumentation = instrumented;
-        return { canonicalPath: source.canonicalPath, bytes: instrumented.bytes };
-    }
-    identifyExecutable(path, versionArguments) {
-        return this.delegate.identifyExecutable(path, versionArguments);
-    }
-    identifyWorker() {
-        return this.delegate.identifyWorker();
-    }
-    identifyRuntimeClosure(nodePath) {
-        return this.delegate.identifyRuntimeClosure(nodePath);
-    }
-    seccompDigest() {
-        return this.delegate.seccompDigest();
-    }
-    probe(policy) {
-        return this.delegate.probe(policy);
-    }
-}

package/dist/application/JavaScriptReplayPermission.js

@@ -1,16 +0,0 @@
-/** Build the exact permission request for one controlled replay operation. */
-export const replayPermissionRequest = (input, policy) => ({
-    capability: "javascript_replay",
-    roots: [...input.left.modules, ...(input.right?.modules ?? [])].map(({ path }) => path),
-    executables: [
-        policy.nodePath,
-        policy.bubblewrapPath,
-        policy.systemdRunPath,
-        policy.systemctlPath,
-        policy.shellPath,
-    ],
-    environment_names: [],
-    network: "none",
-    mount: true,
-    operation_identity: `run_controlled_replay:${input.mode === "plan" ? "plan" : input.plan_digest}`,
-});