rea-agents 3.2.1 → 4.0.0

package/dist/application/ElectronActiveEvidence.js

@@ -1,6 +1,6 @@
 import { createEvidence } from "../domain/evidence.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";
-import { digestJson } from "./JavaScriptReplayPlanning.js";
+import { digestCanonicalJson } from "../domain/browserScenarioNormalization.js";
 /** Create Evidence without retaining arbitrary runtime argument values. */
 export const createElectronActiveEvidence = (input, result, provider) => createEvidence(undefined, provider, {
     predicateType: "rea.electron-active-scenario",
@@ -10,41 +10,24 @@ export const createElectronActiveEvidence = (input, result, provider) => createE
     confidence: "observed",
     authority: "controlled-replay",
     environment: {
-        id: `${result.application.electron_version}@${process.platform}`,
-        platform: process.platform,
-        architecture: process.arch,
+        id: `${result.application.electron_version}@unknown`,
+        platform: "unknown",
+        architecture: "unknown",
         isolation: "none",
     },
-    limitations: result.limitations,
+    limitations: [
+        ...result.limitations,
+        "Application host platform and architecture were not observed.",
+    ],
 });
 const scenarioProjection = (input) => ({
     executable_path: input.executable_path,
     application_path: input.application_path,
     application_root: input.application_root,
-    args: redactArguments(input.args),
+    args: [...input.args],
     actions: input.actions.map(({ step_id, kind }) => ({ step_id, kind })),
 });
 const parameters = (input) => ({
     ...scenarioProjection(input),
-    scenario_sha256: digestJson(scenarioProjection(input)),
+    scenario_sha256: digestCanonicalJson(scenarioProjection(input)),
 });
-const redactArguments = (arguments_) => {
-    let redactNext = false;
-    return arguments_.map((argument) => {
-        if (redactNext) {
-            redactNext = false;
-            return "<redacted>";
-        }
-        if (sensitiveFlag.test(argument)) {
-            redactNext = true;
-            return argument;
-        }
-        return redactArgument(argument);
-    });
-};
-const sensitiveFlag = /^--?(?:password|token|secret|api[-_]?key|authorization|cookie)$/iu;
-const redactArgument = (argument) => {
-    if (/^--?(?:password|token|secret|api[-_]?key|authorization|cookie)=/iu.test(argument))
-        return `${argument.slice(0, argument.indexOf("=") + 1)}<redacted>`;
-    return argument;
-};

package/dist/application/ElectronActiveObservationService.js

@@ -1,27 +1,19 @@
-import { projectPermissionFailure } from "./PermissionFailure.js";
+import { dirname } from "node:path";
 import { realpath } from "node:fs/promises";
-import { digestJson } from "./JavaScriptReplayPlanning.js";
 import { AnalysisCapabilityUnavailableError, AnalysisInputError, } from "../domain/errors.js";
-import { isPathContained } from "../domain/permissionPolicy.js";
 import { err } from "../domain/result.js";
 import { createElectronActiveEvidence } from "./ElectronActiveEvidence.js";
 const OPERATION = "capture_electron_scenario";
 const PROVIDER_ID = "rea-playwright-electron-active";
 const canonicalizeInput = async (input) => {
     try {
-        const [executablePath, applicationPath, applicationRoot] = await Promise.all([
+        const [executablePath, applicationPath] = await Promise.all([
             realpath(input.executable_path),
             realpath(input.application_path),
-            realpath(input.application_root),
         ]);
-        if (!isPathContained(applicationRoot, applicationPath))
-            return err(new AnalysisInputError(OPERATION, undefined, [
-                {
-                    path: ["application_path"],
-                    reason: "invalid_value",
-                    message: "application_path must remain beneath application_root after symlink resolution",
-                },
-            ]));
+        const applicationRoot = input.application_root === undefined
+            ? dirname(applicationPath)
+            : await realpath(input.application_root);
         return {
             ok: true,
             value: {
@@ -42,37 +34,18 @@ const canonicalizeInput = async (input) => {
         ]));
     }
 };
-const authorize = async (authority, input) => {
+/** Canonicalize request paths and execute one provider-owned Electron run. */
+export const captureElectronScenario = async (provider, input, options = {}) => {
     const canonical = await canonicalizeInput(input);
     if (!canonical.ok)
         return canonical;
-    if (authority === undefined)
-        return err(new AnalysisCapabilityUnavailableError(PROVIDER_ID, OPERATION, "active Electron observation permission policy is not configured"));
-    const authorized = await authority.authorize({
-        capability: "electron_automate",
-        roots: [canonical.value.application_root],
-        executables: [canonical.value.executable_path],
-        environment_names: [],
-        network: "external",
-        mount: false,
-        operation_identity: `${OPERATION}:${digestJson(canonical.value)}`,
-    }, "write");
-    if (!authorized.ok)
-        return err(projectPermissionFailure(authorized.error));
-    return canonical;
-};
-/** Authorize and execute one bounded, provider-owned Electron experiment. */
-export const captureElectronScenario = async (provider, authority, input, options = {}) => {
-    const authorized = await authorize(authority, input);
-    if (!authorized.ok)
-        return authorized;
     if (provider === undefined)
         return err(new AnalysisCapabilityUnavailableError(PROVIDER_ID, OPERATION, "active Electron observation provider is not configured"));
-    const captured = await provider.capture(authorized.value, options);
+    const captured = await provider.capture(canonical.value, options);
     return captured.ok
         ? {
             ok: true,
-            value: createElectronActiveEvidence(authorized.value, captured.value, provider.identity()),
+            value: createElectronActiveEvidence(canonical.value, captured.value, provider.identity()),
         }
         : captured;
 };

package/dist/application/ElectronBoundaryAnalysis.js

@@ -84,6 +84,7 @@ export const summarizeElectronBoundaries = (analysis) => {
             context: "module-specifier",
             files,
             kind: "native-addon",
+            moduleKind: finding.module_kind,
         })).length,
     };
 };
@@ -103,6 +104,7 @@ const resolvesToFile = (input) => {
         sourcePath: input.file.path,
         context: input.context,
         files: input.files,
+        ...(input.moduleKind === undefined ? {} : { moduleKind: input.moduleKind }),
     }).resolved_path;
     return (resolved !== null &&
         (input.kind === undefined || input.files.get(resolved)?.kind === input.kind));

package/dist/application/ElectronBoundaryGraphNative.js

@@ -17,7 +17,7 @@ const addNativeBinding = (input) => {
     const source = electronFindingSourceNode(context, file, value.module_key);
     if (source === undefined)
         return;
-    const resolved = resolveArtifactPath(value.specifier, file.path, context.filesByPath);
+    const resolved = resolveArtifactPath(value.specifier, file.path, context.filesByPath, value.module_kind);
     const addon = resolved === null ? undefined : context.fileNodes.get(resolved);
     const binding = context.accumulator.addNode({
         kind: "native-export",

package/dist/application/ElectronEvidence.js

@@ -13,12 +13,17 @@ export const createElectronEvidence = (operation, input, result, provider) => cr
     environment: "target" in result
         ? {
             id: `${result.browser.product}@${result.browser.revision}`,
-            platform: process.platform,
-            architecture: process.arch,
+            platform: "unknown",
+            architecture: "unknown",
             isolation: "none",
         }
         : null,
-    limitations: result.limitations,
+    limitations: [
+        ...result.limitations,
+        ...("target" in result
+            ? ["Browser host platform and architecture were not observed."]
+            : []),
+    ],
 });
 const parameters = (input) => ({
     cdp_endpoint: input.cdp_endpoint,

package/dist/application/ElectronObservationService.js

@@ -1,10 +1,9 @@
-import { projectPermissionFailure } from "./PermissionFailure.js";
 import { AnalysisCapabilityUnavailableError, } from "../domain/errors.js";
 import { err, ok } from "../domain/result.js";
 import { createElectronEvidence } from "./ElectronEvidence.js";
-/** Authorize and list Electron file pages exposed by the selected endpoint. */
-export const listElectronTargets = async (provider, authority, input, options = {}) => {
-    const ready = await prepare(provider, authority, input, "list_electron_targets");
+/** List local file pages exposed by the explicitly selected endpoint. */
+export const listElectronTargets = async (provider, input, options = {}) => {
+    const ready = requireProvider(provider, "list_electron_targets");
     if (!ready.ok)
         return ready;
     const result = await ready.value.listTargets(input, options);
@@ -12,9 +11,9 @@ export const listElectronTargets = async (provider, authority, input, options =
         ? ok(createElectronEvidence("list_electron_targets", input, result.value, ready.value.identity()))
         : result;
 };
-/** Authorize and inspect one root-confined Electron page. */
-export const inspectElectronPage = async (provider, authority, input, options = {}) => {
-    const ready = await prepare(provider, authority, input, "inspect_electron_page");
+/** Inspect one local file page from the explicitly selected endpoint. */
+export const inspectElectronPage = async (provider, input, options = {}) => {
+    const ready = requireProvider(provider, "inspect_electron_page");
     if (!ready.ok)
         return ready;
     const result = await ready.value.inspectPage(input, options);
@@ -22,21 +21,6 @@ export const inspectElectronPage = async (provider, authority, input, options =
         ? ok(createElectronEvidence("inspect_electron_page", input, result.value, ready.value.identity()))
         : result;
 };
-const prepare = async (provider, authority, input, operation) => {
-    if (authority === undefined)
-        return err(new AnalysisCapabilityUnavailableError("rea-cdp-electron", operation, "Electron observation permission policy is not configured"));
-    const authorized = await authority.authorize({
-        capability: "electron_observe",
-        roots: [],
-        executables: [],
-        environment_names: [],
-        network: "loopback",
-        mount: false,
-        operation_identity: `${operation}:${"target_id" in input ? input.target_id : input.cdp_endpoint}`,
-    }, "read");
-    if (!authorized.ok)
-        return err(projectPermissionFailure(authorized.error));
-    return provider === undefined
-        ? err(new AnalysisCapabilityUnavailableError("rea-cdp-electron", operation, "Electron observation provider is not configured"))
-        : ok(provider);
-};
+const requireProvider = (provider, operation) => provider === undefined
+    ? err(new AnalysisCapabilityUnavailableError("rea-cdp-electron", operation, "Electron observation provider is not configured"))
+    : ok(provider);

package/dist/application/EnhancedLiteralTracing.js

@@ -1,17 +1,13 @@
 import { z } from "zod";
 import { AnalysisOutputError } from "../domain/errors.js";
 import { err, ok } from "../domain/result.js";
-const FEATURE_SEARCH_SOURCES = [
+const LITERAL_SEARCH_SOURCES = [
     ["search_strings", "string"],
     ["search_procedures", "procedure"],
 ];
-const STRING_SEARCH_SOURCES = [
-    ["search_strings", "string"],
-];
-/** Trace every matching feature or string literal through provider xrefs. */
-export const traceLiteralFeature = async (call, input, scope, signal) => {
-    const sources = scope === "feature" ? FEATURE_SEARCH_SOURCES : STRING_SEARCH_SOURCES;
-    const searched = await literalMatches(call, input, sources, signal);
+/** Trace matching strings and procedures through provider xrefs. */
+export const traceLiteralFeature = async (call, input, signal) => {
+    const searched = await literalMatches(call, input, LITERAL_SEARCH_SOURCES, signal);
     if (!searched.ok)
         return searched;
     const traced = await traceReferences(call, {

package/dist/application/EnhancedTools.js

@@ -4,7 +4,8 @@ import { AnalysisCancelledError, AnalysisOutputError, projectAnalysisError, } fr
 import { addressDistance, functionDossierSchema, parseDocuments, parseFunctionDossier, parseListCount, parseRelatedAddresses, parseSegments, } from "../domain/hopperValues.js";
 import { err, ok } from "../domain/result.js";
 import { categorizeSwiftTypes, discoverObjcClasses, discoverObjcProtocols, } from "../domain/symbolAnalysis.js";
-import { inspectNativeDispatchMetadata, nativeDispatchMetadataResultSchema, } from "../domain/objcSwiftMetadata.js";
+import { inspectNativeDispatch } from "./NativeDispatchMetadataInspection.js";
+import { traceNativeValues } from "./NativeValueTrace.js";
 import { traceNativeUiAction } from "./NativeUiActionTrace.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";
 import { invalidEnhancedInput, } from "./EnhancedToolTypes.js";
@@ -23,10 +24,14 @@ export class EnhancedTools {
     }
     /** Parse an untrusted direct-call input once, then dispatch exhaustively. */
     execute(name, input, signal) {
-        if (name === "trace_feature" ||
-            name === "find_code_for_string" ||
-            name === "trace_call_path")
+        if (name === "trace_feature" || name === "trace_call_path")
             return this.#executeTracing(name, input, signal);
+        if (name === "trace_native_values") {
+            const parsed = enhancedInputSchemas.trace_native_values.safeParse(input);
+            return parsed.success
+                ? this.executeValidated({ name, input: parsed.data }, signal)
+                : invalidEnhancedInput(name, parsed.error);
+        }
         if (name === "trace_native_ui_action") {
             const parsed = enhancedInputSchemas.trace_native_ui_action.safeParse(input);
             return parsed.success
@@ -106,11 +111,11 @@ export class EnhancedTools {
             case "inspect_native_api":
                 return this.#inspectNativeApi(call.input, signal);
             case "trace_feature":
-                return traceLiteralFeature((name, arguments_, operationSignal) => this.#call(name, arguments_, operationSignal), call.input, "feature", signal);
-            case "find_code_for_string":
-                return traceLiteralFeature((name, arguments_, operationSignal) => this.#call(name, arguments_, operationSignal), call.input, "string", signal);
+                return traceLiteralFeature((name, arguments_, operationSignal) => this.#call(name, arguments_, operationSignal), call.input, signal);
             case "trace_call_path":
                 return traceCallPath((name, arguments_, operationSignal) => this.#call(name, arguments_, operationSignal), call.input, signal);
+            case "trace_native_values":
+                return traceNativeValues(this.analysis, call.input, signal);
             case "trace_native_ui_action": {
                 return traceNativeUiAction(this.analysis, call.input, signal);
             }
@@ -123,13 +128,7 @@ export class EnhancedTools {
                 return invalidEnhancedInput(name, parsed.error);
             return this.executeValidated({ name, input: parsed.data }, signal);
         }
-        if (name === "trace_feature") {
-            const parsed = enhancedInputSchemas.trace_feature.safeParse(input);
-            if (!parsed.success)
-                return invalidEnhancedInput(name, parsed.error);
-            return this.executeValidated({ name, input: parsed.data }, signal);
-        }
-        const parsed = enhancedInputSchemas.find_code_for_string.safeParse(input);
+        const parsed = enhancedInputSchemas.trace_feature.safeParse(input);
         if (!parsed.success)
             return invalidEnhancedInput(name, parsed.error);
         return this.executeValidated({ name, input: parsed.data }, signal);
@@ -167,27 +166,8 @@ export class EnhancedTools {
         const names = await this.#allAddressed("list_names", signal);
         return names.ok ? ok(discoverObjcClasses(names.value, pattern)) : names;
     }
-    async #inspectNativeDispatchMetadata(maxRecords, signal) {
-        const execution = await this.analysis.execute("list_names", {}, signal === undefined ? {} : { signal });
-        if (!execution.ok)
-            return err(execution.error);
-        const names = z
-            .array(z.union([
-            z.strictObject({ address: z.string(), value: z.string() }),
-            z.strictObject({ address: z.string(), name: z.string() }),
-        ]))
-            .safeParse(execution.value.result);
-        if (!names.success)
-            return err(new AnalysisOutputError("list_names", "provider returned an invalid inventory"));
-        return ok(nativeDispatchMetadataResultSchema.parse({
-            target_sha256: execution.value.subject?.sha256 ?? null,
-            provider: execution.value.provider,
-            analysis_profile_digest: execution.value.analysisProfile?.digest ?? null,
-            result: inspectNativeDispatchMetadata(names.data.map((entry) => ({
-                address: entry.address,
-                name: "value" in entry ? entry.value : entry.name,
-            })), maxRecords),
-        }));
+    #inspectNativeDispatchMetadata(maxRecords, signal) {
+        return inspectNativeDispatch(this.analysis, maxRecords, signal);
     }
     async #objcProtocols(signal) {
         const names = await this.#allAddressed("list_names", signal);

package/dist/application/FilesystemSnapshot.js

@@ -1,4 +1,3 @@
-import { isPathWithinRoot } from "../domain/localPath.js";
 import { createHash } from "node:crypto";
 import { constants as fsConstants } from "node:fs";
 import { lstat, open, readdir, readlink } from "node:fs/promises";
@@ -65,18 +64,13 @@ export const snapshotRoots = async (scenario, signal) => {
                 truncated = true;
                 return;
             }
-            const safeTarget = isPathWithinRoot(root, target)
-                ? relative(root, target) || "."
-                : "<outside-declared-root>";
-            if (safeTarget === "<outside-declared-root>")
-                truncated = true;
             entries.push({
                 path: `${rootAlias}:${relativePath}`,
                 type: "symlink",
                 mode: stats.mode,
                 size: stats.size,
                 sha256: null,
-                symlink_target: safeTarget,
+                symlink_target: target,
             });
             return;
         }
@@ -117,7 +111,12 @@ export const snapshotRoots = async (scenario, signal) => {
         for (const child of children.sort())
             await visit(root, rootAlias, join(path, child), depth + 1);
     };
-    for (const [index, root] of scenario.filesystem_roots.entries())
+    for (const [index, root] of scenario.filesystem_observation_paths.entries()) {
+        if ((await lstatIfPresent(root)) === undefined) {
+            truncated = true;
+            continue;
+        }
         await visit(root, `root_${String(index)}`, root, 0);
+    }
     return { files: entries, truncated };
 };

package/dist/application/JavaScriptApplicationEvidenceGraph.js

@@ -76,7 +76,8 @@ const managedApplicationSource = (evidence) => {
 const assertApplicationSubject = (evidence, result) => {
     if (evidence.subject === null ||
         evidence.subject.digest.sha256 !== result.root_artifact_sha256 ||
-        evidence.subject.format !== result.format)
+        evidence.subject.format !== result.format ||
+        evidence.subject.local_path !== result.input_path)
         throw new TypeError("JavaScript application Evidence subject does not match its result");
 };
 const providerMatches = (evidence, provider) => evidence.provider.id === provider.id &&

package/dist/application/JavaScriptApplicationWorkflowService.js

@@ -41,7 +41,7 @@ export const traceApplicationFeatureEvidenceValidated = (input) => {
         }, result));
     }
     catch (cause) {
-        return workflowFailure(operation, cause);
+        return workflowFailure(operation, cause, input);
     }
 };
 /** Authenticate both graphs and derive a tiered cross-version change graph. */
@@ -82,7 +82,7 @@ export const compareApplicationVersionsEvidenceValidated = (input) => {
         }, result));
     }
     catch (cause) {
-        return workflowFailure(operation, cause);
+        return workflowFailure(operation, cause, input);
     }
 };
 /** Compare source and bundle inputs already parsed by a trusted adapter. */
@@ -104,7 +104,7 @@ export const compareSourceToBundleEvidenceValidated = (input) => {
         }, result));
     }
     catch (cause) {
-        return workflowFailure(operation, cause);
+        return workflowFailure(operation, cause, input);
     }
 };
 /**
@@ -148,9 +148,33 @@ export const compareJavaScriptExportShapesEvidenceValidated = (input) => {
         }, result));
     }
     catch (cause) {
-        return workflowFailure(operation, cause);
+        return workflowFailure(operation, cause, input);
     }
 };
-const workflowFailure = (operation, cause) => err(cause instanceof z.ZodError || cause instanceof TypeError
-    ? new AnalysisInputError(operation)
-    : new AnalysisProtocolError("JavaScript application workflow produced an invalid result", { cause }));
+const workflowFailure = (operation, cause, input) => cause instanceof z.ZodError
+    ? err(new AnalysisInputError(operation, undefined, projectInputIssues(cause.issues, input)))
+    : cause instanceof TypeError &&
+        SAFE_APPLICATION_INPUT_CONSTRAINTS.has(cause.message)
+        ? err(new AnalysisInputError(operation, undefined, [
+            { path: [], reason: "invalid_value", message: cause.message },
+        ]))
+        : err(new AnalysisProtocolError("JavaScript application workflow produced an invalid result", { cause }));
+const SAFE_APPLICATION_INPUT_CONSTRAINTS = new Set([
+    "Evidence semantic identifier does not match its record",
+    "Application workflow requires authenticated analyze_javascript_application, reconcile_javascript_runtime, or project_managed_application_graph Evidence",
+    "JavaScript application Evidence authority or confidence is invalid",
+    "JavaScript application Evidence predicate does not match its result shape",
+    "JavaScript application Evidence subject does not match its result",
+    "Runtime reconciliation Evidence authority or confidence is invalid",
+    "Runtime reconciliation result references Evidence outside its envelope",
+    "Runtime reconciliation application layer is missing",
+    "Managed application graph Evidence authority or confidence is invalid",
+    "Managed application graph result references Evidence outside its envelope",
+    "Native handoff Evidence requires an artifact subject",
+    "Native handoff Evidence must be unique",
+    ...[
+        "analyze_javascript_application",
+        "reconcile_javascript_runtime",
+        "project_managed_application_graph",
+    ].map((operation) => `Evidence does not match the supported ${operation} contract`),
+]);

package/dist/application/JavaScriptArtifactAnalysis.js

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import { analyzeParsedJavaScriptStaticSource } from "../domain/javascriptStaticAnalysis.js";
 import { analyzeParsedJavaScriptSemantics } from "../domain/javascriptSemanticAnalysis.js";
 import { parseJavaScriptSource } from "../domain/javascriptSourceParser.js";
+import { hasValidSourceMapContents } from "../domain/sourceMapContents.js";
 import { failedJavaScriptStaticAnalysis } from "../domain/javascriptStaticAnalysisHelpers.js";
 import { analyzeJavaScriptJsonModule } from "./JavaScriptJsonModules.js";
 /** Analyze every text source from the artifact without a result quota. */
@@ -176,14 +177,15 @@ const collectSourceMapOriginals = (file, maps) => {
         const names = map.sources;
         if (!Array.isArray(names))
             return invalidSourceMap(file, "Source map has no sources array.");
-        const contents = Array.isArray(map.sourcesContent)
-            ? map.sourcesContent
-            : [];
+        const contents = map.sourcesContent;
+        if (!hasValidSourceMapContents(names.length, contents))
+            return invalidSourceMap(file, "Source map sourcesContent must contain one string or null entry per source.");
         const root = typeof map.sourceRoot === "string" ? map.sourceRoot : "";
         for (const [index, raw] of names.entries()) {
             if (typeof raw !== "string")
                 return invalidSourceMap(file, "Source map contains a non-string source name.");
-            const content = typeof contents[index] === "string" ? contents[index] : null;
+            const rawContent = Array.isArray(contents) ? contents[index] : undefined;
+            const content = typeof rawContent === "string" ? rawContent : null;
             sources.push({
                 source: resolveSourceName(root, raw),
                 content,

package/dist/application/JavaScriptArtifactFiles.js

@@ -132,6 +132,11 @@ const expectedInventory = (snapshot) => {
         const node = nodes.get(occurrence.artifact_id);
         if (node === undefined)
             throw new ArtifactReaderFailure("integrity", `Artifact inventory node is missing: ${occurrence.logical_path}`);
+        // Inventory occurrences can have content identities for directories too.
+        // Suffixes only describe file candidates; a directory such as
+        // node_modules/@zip.js remains a graph node and must never be opened.
+        if (occurrence.entry_kind !== "file")
+            continue;
         if (occurrence.logical_path.toLowerCase().endsWith(".asar"))
             containers.set(occurrence.logical_path, {
                 path: occurrence.logical_path,