rea-agents 4.0.1 → 5.0.0

package/dist/application/ClientRegistrationStatus.js

@@ -1,4 +1,4 @@
-import { parseClientConfiguration } from "./ClientConfigurationDocument.js";
+import { effectiveClientServer, parseClientConfiguration, } from "./ClientConfigurationDocument.js";
 import { access, readFile } from "node:fs/promises";
 import { resolve } from "node:path";
 import { z } from "zod";
@@ -12,6 +12,7 @@ const registrationSchema = z
     args: z.array(z.string()).default([]),
     startup_timeout_sec: z.number().positive().optional(),
     type: z.string().optional(),
+    transport: z.string().optional(),
     tools: z.array(z.string()).optional(),
     disabled: z.boolean().optional(),
     enabled: z.boolean().optional(),
@@ -35,8 +36,7 @@ export const readClientRegistrationStatuses = async (home, currentCommandPath =
             continue;
         try {
             const content = await readFile(client.configPath, "utf8");
-            const { servers } = parseClientConfiguration(content, client.format);
-            const raw = servers[PRODUCT_IDENTITY.mcpServerKey];
+            const raw = effectiveClientServer(parseClientConfiguration(content, client.format), PRODUCT_IDENTITY.mcpServerKey);
             if (raw === undefined) {
                 statuses.push(unavailableStatus(client.name, client.configPath, "missing"));
                 continue;
@@ -62,11 +62,6 @@ const registrationAligned = (registration, client, currentCommandPath) => {
         return false;
     if (!isOwnedClientRegistrationCommand(command, currentCommandPath))
         return false;
-    if (command.length === 3 &&
-        command[2] === "mcp" &&
-        resolve(command[0] ?? "") === resolve(process.execPath) &&
-        resolve(command[1] ?? "") === currentCommandPath)
-        return true;
     if (client.name === "codex" &&
         registration.startup_timeout_sec !==
             MCP_STARTUP_POLICY.codexStartupTimeoutSeconds)
@@ -77,6 +72,13 @@ const registrationAligned = (registration, client, currentCommandPath) => {
         (registration.type !== "stdio" ||
             JSON.stringify(registration.tools) !== JSON.stringify(["*"])))
         return false;
+    if (client.format === "commandcode" && registration.transport !== "stdio")
+        return false;
+    if (command.length === 3 &&
+        command[2] === "mcp" &&
+        resolve(command[0] ?? "") === resolve(process.execPath) &&
+        resolve(command[1] ?? "") === currentCommandPath)
+        return true;
     if (command.length === 4 &&
         command[0] === "npx" &&
         command[1] === "-y" &&
@@ -108,6 +110,8 @@ const parseRegistration = (value, client) => {
     if ((client.format === "vscode" || client.format === "copilot_cli") &&
         registration.type !== "stdio")
         throw new TypeError("Expected an stdio registration");
+    if (client.format === "commandcode" && registration.transport !== "stdio")
+        throw new TypeError("Expected an stdio registration");
     return registration;
 };
 const remediation = "Run rea setup to refresh this registration, then restart the client.";
@@ -128,7 +132,9 @@ const exists = async (path) => {
         await access(path);
         return true;
     }
-    catch {
+    catch (cause) {
+        // best-effort cleanup: optional registration probing; absence means unregistered.
+        void cause;
         return false;
     }
 };

package/dist/application/DirectAnalysis.js

@@ -1,42 +1,46 @@
 import { parseConfig } from "../config.js";
 import { EnhancedTools } from "./EnhancedTools.js";
-import { createBinarySession, createManagedBinarySession } from "./runtime.js";
+import { executeFunctionAnalysisEvidence } from "./FunctionAnalysisEvidence.js";
 import { silentLogger } from "../logger.js";
 import { createEvidence } from "../domain/evidence.js";
-import { isManagedToolName, } from "../contracts/managedToolContracts.js";
-import { EvidenceIntegrityError, projectAnalysisError, } from "../domain/errors.js";
+import { isManagedToolName, } from "../contracts/managed/managedToolContracts.js";
+import { EvidenceIntegrityError } from "../domain/evidenceErrors.js";
+import { projectAnalysisError } from "../domain/analysisErrorProjection.js";
+import {} from "../domain/analysisErrorBase.js";
 import { access } from "node:fs/promises";
-import { readAnalysisSnapshot, writeAnalysisSnapshot, } from "./AnalysisSnapshotFiles.js";
+import { readAnalysisSnapshot, writeAnalysisSnapshot, } from "./binary/AnalysisSnapshotFiles.js";
 import { parseBinaryTarget } from "./BinaryTargetResolver.js";
 import { snapshotEvidenceForQuery, snapshotMatchesTarget, } from "../domain/analysisSnapshot.js";
 import { err, ok } from "../domain/result.js";
 import { REA_WORKFLOW_PROVIDER, workflowAnalysisProfile, } from "./InvestigationProviders.js";
 import { artifactInspectionResultSchema } from "../domain/artifactInspection.js";
-export { runCapabilityStatus, runProviderStatus, } from "./DirectAnalysisStatus.js";
 /**
  * Open one binary, execute one tool, and always release provider resources.
  * Unlike MCP mode, every CLI invocation is intentionally isolated and does not
  * retain a target or provider client for a subsequent command.
  */
-export const runDirectAnalysis = async (path, tool, arguments_, options = {}) => withProcessCancellation(options.signal, (signal) => runAnalysis(path, tool, arguments_, {
+export const runDirectAnalysis = async (dependencies, path, tool, arguments_, options = {}) => withProcessCancellation(options.signal, (signal) => runAnalysis(dependencies, path, tool, arguments_, {
     logger: options.logger ?? silentLogger,
     snapshotPath: options.snapshotPath,
     signal,
+    ...(options.formatHint === undefined
+        ? {}
+        : { formatHint: options.formatHint }),
     ...(options.providerId === undefined
         ? {}
         : { providerId: options.providerId }),
 }));
 /** Execute one provider-native semantic operation with atomic provenance. */
-export const runProviderAnalysis = async (...[path, tool, arguments_, logger = silentLogger, signal]) => isManagedToolName(tool)
-    ? runManagedProviderAnalysis(path, tool, signal)
-    : withProcessCancellation(signal, (operationSignal) => runAnalysis(path, tool, arguments_, {
+export const runProviderAnalysis = async (dependencies, ...[path, tool, arguments_, logger = silentLogger, signal]) => isManagedToolName(tool)
+    ? runManagedProviderAnalysis(dependencies, path, tool, signal)
+    : withProcessCancellation(signal, (operationSignal) => runAnalysis(dependencies, path, tool, arguments_, {
         logger,
         snapshotPath: undefined,
         signal: operationSignal,
     }));
 /** Execute managed metadata inspection in an isolated managed-only session. */
-export const runManagedProviderExecution = async (path, tool, signal) => withProcessCancellation(signal, async (operationSignal) => {
-    const session = createManagedBinarySession();
+export const runManagedProviderExecution = async (dependencies, path, tool, signal) => withProcessCancellation(signal, async (operationSignal) => {
+    const session = dependencies.createManagedBinarySession();
     try {
         const opened = await session.open(path, { signal: operationSignal });
         if (!opened.ok)
@@ -47,8 +51,8 @@ export const runManagedProviderExecution = async (path, tool, signal) => withPro
         await session.close();
     }
 });
-const runManagedProviderAnalysis = async (path, tool, signal) => {
-    const execution = await runManagedProviderExecution(path, tool, signal);
+const runManagedProviderAnalysis = async (dependencies, path, tool, signal) => {
+    const execution = await runManagedProviderExecution(dependencies, path, tool, signal);
     if (!execution.ok)
         return cliError(execution.error);
     const value = execution.value;
@@ -61,22 +65,28 @@ const runManagedProviderAnalysis = async (path, tool, signal) => {
         locations: value.locations,
     });
 };
-const runAnalysis = async (path, tool, arguments_, options) => {
+const runAnalysis = async (dependencies, path, tool, arguments_, options) => {
     const { logger, signal, snapshotPath } = options;
     const config = parseConfig(options.environment ?? process.env);
     if (!config.ok)
         return cliError(config.error);
-    const session = createBinarySession(config.value, logger);
+    const session = dependencies.createBinarySession(config.value, logger);
     try {
         const prepared = await prepareSnapshot({
             path,
             snapshotPath,
+            ...(options.formatHint === undefined
+                ? {}
+                : { formatHint: options.formatHint }),
         });
         if (!prepared.ok)
             return cliError(prepared.error);
         const { snapshot } = prepared.value;
         const opened = await session.open(path, {
             signal,
+            ...(options.formatHint === undefined
+                ? {}
+                : { formatHint: options.formatHint }),
             ...(snapshot === undefined ? {} : { snapshot }),
             ...(options.providerId === undefined
                 ? {}
@@ -86,7 +96,7 @@ const runAnalysis = async (path, tool, arguments_, options) => {
             return cliError(opened.error);
         const evidenceProfile = analysisProfileForEvidence(session, tool);
         const bindingProfile = session.analysisProfile();
-        if (tool !== "trace_native_ui_action" &&
+        if (canReplayDirectTool(session, tool) &&
             snapshot !== undefined &&
             evidenceProfile !== undefined &&
             bindingProfile !== undefined) {
@@ -127,10 +137,16 @@ const runAnalysis = async (path, tool, arguments_, options) => {
         await session.close();
     }
 };
+const canReplayDirectTool = (session, tool) => tool !== "trace_native_ui_action" && session.allowsSnapshotReplay(tool);
 const executeAnalysisTool = async (input) => {
     const { session, tool, signal, evidenceProfile } = input;
+    if (tool === "analyze_function") {
+        const result = await executeFunctionAnalysisEvidence(session, input.arguments, input.openedTarget, { signal });
+        return result.ok
+            ? { output: result.value, evidence: result.value }
+            : { output: cliError(result.error) };
+    }
     if (tool === "binary_overview" ||
-        tool === "analyze_function" ||
         tool === "inspect_native_api" ||
         tool === "inspect_native_dispatch_metadata" ||
         tool === "trace_feature" ||
@@ -139,9 +155,7 @@ const executeAnalysisTool = async (input) => {
         const result = await new EnhancedTools(session).execute(tool, input.arguments, signal);
         if (!result.ok)
             return { output: cliError(result.error) };
-        const evidence = createEvidence(input.openedTarget, tool === "analyze_function"
-            ? session.providerIdentity(tool)
-            : REA_WORKFLOW_PROVIDER, {
+        const evidence = createEvidence(input.openedTarget, REA_WORKFLOW_PROVIDER, {
             operation: tool,
             parameters: input.arguments,
             result: result.value,
@@ -193,7 +207,7 @@ const prepareSnapshot = async (options) => {
     const loaded = await readAnalysisSnapshot(snapshotPath);
     if (!loaded.ok)
         return loaded;
-    const target = await parseBinaryTarget(path);
+    const target = await parseBinaryTarget(path, process.cwd(), process.arch, undefined, options.formatHint);
     if (!target.ok)
         return target;
     if (!snapshotMatchesTarget(loaded.value.target, target.value))

package/dist/application/DirectAnalysisStatus.js

@@ -1,14 +1,13 @@
 import { parseConfig } from "../config.js";
-import { projectAnalysisError } from "../domain/errors.js";
+import { projectAnalysisError } from "../domain/analysisErrorProjection.js";
 import { jsonObjectSchema } from "../domain/jsonValue.js";
 import { createServerIdentity } from "../serverIdentity.js";
 import { silentLogger } from "../logger.js";
-import { createBinarySession } from "./runtime.js";
-const runSessionStatus = async (logger = silentLogger, environment = process.env) => {
+const runSessionStatus = async (dependencies, logger = silentLogger, environment = process.env) => {
     const config = parseConfig(environment);
     if (!config.ok)
         return { error: projectAnalysisError(config.error) };
-    const session = createBinarySession(config.value, logger);
+    const session = dependencies.createBinarySession(config.value, logger);
     try {
         return {
             ...jsonObjectSchema.parse(session.status()),
@@ -21,7 +20,7 @@ const runSessionStatus = async (logger = silentLogger, environment = process.env
         await session.close();
     }
 };
-/** List complete provider identities, capabilities, and availability. */
-export const runProviderStatus = (logger = silentLogger, environment = process.env) => runSessionStatus(logger, environment);
-/** List complete operation descriptors and availability. */
-export const runCapabilityStatus = (logger = silentLogger, environment = process.env) => runSessionStatus(logger, environment);
+/** List binary-session provider candidates and auxiliary operation availability. */
+export const runProviderStatus = (dependencies, logger = silentLogger, environment = process.env) => runSessionStatus(dependencies, logger, environment);
+/** List binary-session operation descriptors; this is not the full MCP catalog. */
+export const runCapabilityStatus = (dependencies, logger = silentLogger, environment = process.env) => runSessionStatus(dependencies, logger, environment);

package/dist/application/Doctor.js

@@ -2,6 +2,7 @@ import { constants } from "node:fs";
 import { access, readFile, readdir } from "node:fs/promises";
 import { homedir } from "node:os";
 import { delimiter, join } from "node:path";
+import { analysisErrorRemediationAction } from "../domain/analysisErrorPresentation.js";
 import { parseBinaryTarget } from "./BinaryTargetResolver.js";
 import { execFileOutput } from "../process/ExecFileOutput.js";
 import { probeHomebrew } from "./homebrew.js";
@@ -12,7 +13,7 @@ import { readClientRegistrationStatuses, } from "./ClientRegistrationStatus.js";
 import { collectDoctorDiagnostics, doctorHealthy, } from "./DoctorDiagnostics.js";
 import { normalizeDoctorScope, scopeDoctorChecks, } from "./DoctorScope.js";
 /** Deep provider IDs whose readiness can be selected explicitly by doctor. */
-export const DOCTOR_PROVIDER_IDS = ["hopper", "ghidra"];
+export const DOCTOR_PROVIDER_IDS = ["hopper", "ghidra", "ida"];
 /**
  * Check requirements and an optional target without mutating the host.
  * Every failed check includes remediation suitable for either the one-shot CLI
@@ -147,6 +148,32 @@ export const systemDoctorHost = (options = {}) => {
         async validTarget(path) {
             return (await parseBinaryTarget(path, process.cwd(), architecture)).ok;
         },
+        async inspectTarget(path) {
+            const result = await parseBinaryTarget(path, process.cwd(), architecture);
+            if (result.ok)
+                return {
+                    name: "target",
+                    ok: true,
+                    classification: "healthy",
+                    detail: path,
+                };
+            const error = result.error;
+            return {
+                name: "target",
+                ok: false,
+                classification: error.constraint === "directory_requires_file"
+                    ? "unsupported_target"
+                    : "config_drift",
+                detail: path,
+                details: {
+                    reason: error.reason,
+                    ...(error.constraint === undefined
+                        ? {}
+                        : { constraint: error.constraint }),
+                },
+                remediation: analysisErrorRemediationAction(error),
+            };
+        },
         executable: (path) => executableAvailable(path, platform, hostExecFileOutput, commandEnvironment),
         linuxDemoRuntimeCheck: options.linuxDemoRuntimeCheck ?? uncomposedLinuxDemoRuntimeCheck,
         supportedLinuxHopper: linuxHopperBinarySupported,
@@ -156,7 +183,9 @@ export const systemDoctorHost = (options = {}) => {
                     const prefix = (await hostExecFileOutput(command, ["--prefix", "--cask", "hopper-disassembler"], commandEnvironment)).stdout.trim();
                     return `${prefix}/Hopper Disassembler.app/Contents/MacOS/hopper`;
                 }
-                catch {
+                catch (cause) {
+                    // best-effort cleanup: optional Homebrew probing; absence means uninstalled.
+                    void cause;
                     return undefined;
                 }
             });
@@ -173,7 +202,9 @@ export const systemDoctorHost = (options = {}) => {
                     ...commandEnvironment,
                 })).stdout);
             }
-            catch {
+            catch (cause) {
+                // best-effort cleanup: optional version probing; failure means unavailable.
+                void cause;
                 return undefined;
             }
         },
@@ -184,7 +215,9 @@ export const systemDoctorHost = (options = {}) => {
                 return uniqueLines((await hostExecFileOutput(command, arguments_, commandEnvironment))
                     .stdout);
             }
-            catch {
+            catch (cause) {
+                // best-effort cleanup: optional path probing; failure means none found.
+                void cause;
                 return [];
             }
         },
@@ -199,7 +232,9 @@ const readMacosVersion = async (run = execFileOutput, options = { env: process.e
     try {
         return (await run("sw_vers", ["-productVersion"], options)).stdout.trim();
     }
-    catch {
+    catch (cause) {
+        // best-effort cleanup: optional OS version probing; failure means unknown.
+        void cause;
         return undefined;
     }
 };
@@ -211,7 +246,9 @@ const executableAvailable = async (path, platform = process.platform, run = exec
         const linked = await run("ldd", [path], options);
         return linuxSharedLibrariesAvailable(`${linked.stdout}\n${linked.stderr}`);
     }
-    catch {
+    catch (cause) {
+        // best-effort cleanup: optional executable probing; failure means unavailable.
+        void cause;
         return false;
     }
 };
@@ -231,8 +268,9 @@ const manualHopperPaths = async (home = homedir()) => {
                     paths.push(join(root, entry.name, "Contents/MacOS/hopper"));
             }
         }
-        catch {
+        catch (cause) {
             // A missing or unreadable optional application directory is not fatal.
+            void cause;
         }
     }
     return paths;
@@ -249,7 +287,9 @@ const installedSkillIdentity = async (home) => {
                 null,
         };
     }
-    catch {
+    catch (cause) {
+        // best-effort cleanup: optional skill probing; failure means unknown.
+        void cause;
         return undefined;
     }
 };

package/dist/application/DoctorDiagnostics.js

@@ -1,5 +1,5 @@
 import { homedir } from "node:os";
-import { supportsNodeVersion } from "../domain/runtimeVersion.js";
+import { SUPPORTED_NODE_VERSION_PROSE, supportsNodeVersion, } from "../domain/runtimeVersion.js";
 import { linuxHopperLauncherPath } from "./LinuxHopper.js";
 const DEFAULT_HOPPER = "/Applications/Hopper Disassembler.app/Contents/MacOS/hopper";
 const SYSTEM_LINUX_HOPPER = "/opt/hopper/bin/Hopper";
@@ -52,7 +52,7 @@ export const doctorHealthy = (checks, providers) => {
             providers.providerInspections.some(({ available }) => available)));
 };
 const nodeCheck = (host) => check("node", supportsNodeVersion(host.nodeVersion), host.nodeVersion, {
-    remediation: "Install Node.js 22.19+ or 24.11+.",
+    remediation: `Install ${SUPPORTED_NODE_VERSION_PROSE}.`,
     classification: "missing_dependency",
 });
 const hostCheck = async (host) => {
@@ -66,7 +66,7 @@ const hostCheck = async (host) => {
             ? `${host.platform} ${host.architecture}`
             : `${linuxDistribution.id} ${linuxDistribution.versionId ?? "unknown"}`);
     return check("host", supported, detail, {
-        remediation: "REA supports macOS 12+, Ubuntu 24.04+, Fedora 41+, 64-bit Arch Linux, and the experimental Windows x64 Ghidra P0 boundary.",
+        remediation: "REA supports macOS 12+, Ubuntu 24.04+, Fedora 41+, 64-bit Arch Linux, CachyOS, and the experimental Windows x64 Ghidra P0 boundary.",
         classification: "unsupported_host",
     });
 };
@@ -123,10 +123,12 @@ const optionalIlspyCheck = async (host) => {
 };
 const optionalTargetCheck = async (target, host) => target === undefined
     ? undefined
-    : check("target", await host.validTarget(target), target, {
-        remediation: "Supply a readable local app or program path.",
-        classification: "config_drift",
-    });
+    : host.inspectTarget !== undefined
+        ? host.inspectTarget(target)
+        : check("target", await host.validTarget(target), target, {
+            remediation: "Supply a readable local app or program path.",
+            classification: "config_drift",
+        });
 const check = (name, ok, detail, failure) => ({
     name,
     ok,

package/dist/application/DoctorScope.js

@@ -1,3 +1,4 @@
+import { uniqueSorted } from "../domain/canonicalOrdering.js";
 /** Normalize a caller-selected doctor readiness boundary. */
 export const normalizeDoctorScope = (requested, target) => ({
     mode: requested === undefined ? "audit-wide" : "explicit",
@@ -92,5 +93,4 @@ const selectedSkillCheck = (state, checks) => checks.find(({ name }) => name ===
         ? { detail: "Installed REA skill identity is aligned." }
         : { remediation: "Run rea setup to update the installed REA skill." }),
 };
-const uniqueSorted = (values) => [...new Set(values)].sort((left, right) => left.localeCompare(right));
 const doctorProviderCheckName = (providerId, name) => name === providerId || name.startsWith(`${providerId}-`);

package/dist/application/EnhancedLiteralTracing.js

@@ -1,5 +1,6 @@
 import { z } from "zod";
-import { AnalysisOutputError } from "../domain/errors.js";
+import { AnalysisOutputError } from "../domain/analysisErrorCore.js";
+import {} from "../domain/analysisErrorBase.js";
 import { err, ok } from "../domain/result.js";
 const LITERAL_SEARCH_SOURCES = [
     ["search_strings", "string"],

package/dist/application/EnhancedToolTypes.js

@@ -1,4 +1,5 @@
-import { AnalysisInputError } from "../domain/errors.js";
+import { AnalysisInputError } from "../domain/analysisErrorCore.js";
+import {} from "../domain/analysisErrorBase.js";
 import { err } from "../domain/result.js";
 import { enhancedInputSchemas, } from "../contracts/enhancedInputs.js";
 export const invalidEnhancedInput = (name, cause) => Promise.resolve(err(new AnalysisInputError(name, { cause })));

package/dist/application/EnhancedTools.js

@@ -1,17 +1,19 @@
 import { z } from "zod";
 import { enhancedInputSchemas } from "../contracts/enhancedInputs.js";
-import { AnalysisCancelledError, AnalysisOutputError, projectAnalysisError, } from "../domain/errors.js";
+import { AnalysisCancelledError, AnalysisOutputError, } from "../domain/analysisErrorCore.js";
+import { projectAnalysisError } from "../domain/analysisErrorProjection.js";
+import {} from "../domain/analysisErrorBase.js";
 import { addressDistance, functionDossierSchema, parseDocuments, parseFunctionDossier, parseListCount, parseRelatedAddresses, parseSegments, } from "../domain/hopperValues.js";
 import { err, ok } from "../domain/result.js";
 import { categorizeSwiftTypes, discoverObjcClasses, discoverObjcProtocols, } from "../domain/symbolAnalysis.js";
-import { inspectNativeDispatch } from "./NativeDispatchMetadataInspection.js";
-import { traceNativeValues } from "./NativeValueTrace.js";
-import { traceNativeUiAction } from "./NativeUiActionTrace.js";
+import { inspectNativeDispatch } from "./native/NativeDispatchMetadataInspection.js";
+import { traceNativeValues } from "./native/NativeValueTrace.js";
+import { traceNativeUiAction } from "./native/NativeUiActionTrace.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";
 import { invalidEnhancedInput, } from "./EnhancedToolTypes.js";
 import { traceCallPath } from "./CallPathTracing.js";
 import { traceLiteralFeature } from "./EnhancedLiteralTracing.js";
-import { projectNativeApiInspection } from "./NativeApiInspection.js";
+import { projectNativeApiInspection } from "./native/NativeApiInspection.js";
 /**
  * Composes direct provider operations into bounded reverse-engineering tools.
  * Direct callers use `execute`; adapters that own validation use

package/dist/application/EvidenceBundleCommands.js

@@ -1,8 +1,9 @@
-import { EvidenceIntegrityError, } from "../domain/errors.js";
+import { EvidenceIntegrityError } from "../domain/evidenceErrors.js";
+import {} from "../domain/analysisErrorBase.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";
 import { err, ok } from "../domain/result.js";
 import { compareBundles } from "../domain/bundleComparison.js";
-import { EvidenceLedger } from "./EvidenceLedger.js";
+import { EvidenceLedger } from "./investigation/EvidenceLedger.js";
 import { readEvidenceBundle, writeEvidenceBundle, } from "./EvidenceBundleFiles.js";
 /** Validate and merge one bundle using the session Evidence ledger. */
 export const importEvidenceBundleCommand = async (path) => {

package/dist/application/EvidenceBundleFiles.js

@@ -1,5 +1,5 @@
 import { parseEvidenceBundle, serializeEvidenceBundle, } from "../domain/evidenceBundle.js";
-import { EvidenceFileError, EvidenceIntegrityError } from "../domain/errors.js";
+import { EvidenceFileError, EvidenceIntegrityError, } from "../domain/evidenceErrors.js";
 import { err, ok } from "../domain/result.js";
 import { parseProcessCapture } from "../domain/processCapture.js";
 import { readJsonFile, writeTextFile } from "./JsonFiles.js";

package/dist/application/EvidenceInputResolver.js

@@ -0,0 +1,30 @@
+import { EvidenceReferenceError } from "../domain/evidenceErrors.js";
+import { err, ok } from "../domain/result.js";
+/** Resolve an exact reference without selecting a target or running analysis. */
+export const resolveEvidenceInput = (input, lookup) => {
+    if (!("kind" in input))
+        return ok(input);
+    const record = lookup?.(input.evidence_id);
+    if (record === undefined)
+        return err(new EvidenceReferenceError(input.evidence_id, "missing", "Evidence retained in this session", null));
+    if (record.evidence_id !== input.evidence_id)
+        return err(new EvidenceReferenceError(input.evidence_id, "identity_mismatch", input.evidence_id, record.evidence_id));
+    return ok(record);
+};
+/** Resolve an application's Evidence before its existing semantic validation. */
+export const resolveApplicationEvidenceRequest = (input, lookup) => {
+    const application = resolveEvidenceInput(input.application, lookup);
+    if (!application.ok)
+        return application;
+    return ok({ ...input, application: application.value });
+};
+/** Resolve explicitly paired Evidence without guessing another session's record. */
+export const resolvePairedEvidenceRequest = (input, lookup) => {
+    const left = resolveEvidenceInput(input.left, lookup);
+    if (!left.ok)
+        return left;
+    const right = resolveEvidenceInput(input.right, lookup);
+    if (!right.ok)
+        return right;
+    return ok({ ...input, left: left.value, right: right.value });
+};

package/dist/application/FilesystemSnapshot.js

@@ -5,6 +5,14 @@ import { dirname, join, relative, resolve } from "node:path";
 const hasSameIdentity = (before, after, expected) => before.dev === after.dev &&
     before.ino === after.ino &&
     (expected === "directory" ? after.isDirectory() : after.isSymbolicLink());
+const hasSameFileState = (before, after) => before.dev === after.dev &&
+    before.ino === after.ino &&
+    before.isFile() &&
+    after.isFile() &&
+    before.mode === after.mode &&
+    before.size === after.size &&
+    before.mtimeMs === after.mtimeMs &&
+    before.ctimeMs === after.ctimeMs;
 const lstatIfPresent = async (path) => {
     try {
         return await lstat(path);
@@ -15,11 +23,17 @@ const lstatIfPresent = async (path) => {
         throw cause;
     }
 };
-const hashFile = async (path, maxBytes, signal) => {
-    const handle = await open(path, fsConstants.O_RDONLY | (fsConstants.O_NOFOLLOW ?? 0));
+/** Hash a file only when its opened descriptor still matches the captured path state. */
+export const hashFile = async (path, expected, maxBytes, signal) => {
+    signal?.throwIfAborted();
+    const handle = await open(path, fsConstants.O_RDONLY |
+        (fsConstants.O_NOFOLLOW ?? 0) |
+        (fsConstants.O_NONBLOCK ?? 0));
     try {
+        signal?.throwIfAborted();
         const stats = await handle.stat();
-        if (!stats.isFile() || stats.size > maxBytes)
+        signal?.throwIfAborted();
+        if (!hasSameFileState(expected, stats) || stats.size > maxBytes)
             return null;
         const hash = createHash("sha256");
         const buffer = Buffer.allocUnsafe(Math.min(64 * 1024, maxBytes));
@@ -33,7 +47,8 @@ const hashFile = async (path, maxBytes, signal) => {
             position += bytesRead;
         }
         const after = await handle.stat();
-        if (after.size !== stats.size || after.mtimeMs !== stats.mtimeMs)
+        signal?.throwIfAborted();
+        if (!hasSameFileState(stats, after))
             return null;
         return hash.digest("hex");
     }
@@ -76,7 +91,7 @@ export const snapshotRoots = async (scenario, signal) => {
         }
         if (stats.isFile()) {
             const sha256 = remainingBytes >= stats.size
-                ? await hashFile(path, remainingBytes, signal)
+                ? await hashFile(path, stats, remainingBytes, signal)
                 : null;
             remainingBytes -= sha256 === null ? 0 : stats.size;
             if (sha256 === null)

package/dist/application/FunctionAnalysisEvidence.js

@@ -0,0 +1,32 @@
+import { toolContract } from "../contracts/toolContracts.js";
+import { AnalysisInputError } from "../domain/analysisErrorCore.js";
+import { createEvidence } from "../domain/evidence.js";
+import { parseFunctionDossier } from "../domain/hopperValues.js";
+import { jsonObjectSchema } from "../domain/jsonValue.js";
+import { err, ok } from "../domain/result.js";
+import { projectInputIssues } from "../domain/inputIssueProjection.js";
+/** Preserve the provider's observations when presenting a validated function dossier. */
+export const executeFunctionAnalysisEvidence = async (analysis, parameters, target, options) => {
+    const input = toolContract("analyze_function").inputSchema.safeParse(parameters);
+    if (!input.success)
+        return err(new AnalysisInputError("analyze_function", { cause: input.error }, projectInputIssues(input.error.issues, parameters)));
+    const arguments_ = jsonObjectSchema.parse(input.data);
+    const execution = await analysis.execute("analyze_function", arguments_, options);
+    if (!execution.ok)
+        return execution;
+    const dossier = parseFunctionDossier(execution.value.result);
+    if (!dossier.ok)
+        return dossier;
+    const observation = execution.value;
+    return ok(createEvidence(observation.subject ?? target, observation.provider, {
+        operation: "analyze_function",
+        parameters: arguments_,
+        result: dossier.value,
+        rawResult: observation.rawResult,
+        limitations: observation.limitations,
+        locations: observation.locations,
+        ...(observation.analysisProfile === undefined
+            ? {}
+            : { analysisProfile: observation.analysisProfile }),
+    }));
+};

package/dist/application/InventoryProjectionEvidence.js

@@ -1,5 +1,6 @@
 import { z } from "zod";
-import { AnalysisInputError, AnalysisProtocolError, } from "../domain/errors.js";
+import { AnalysisInputError, AnalysisProtocolError, } from "../domain/analysisErrorCore.js";
+import {} from "../domain/analysisErrorBase.js";
 import { createEvidence, } from "../domain/evidence.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";
 import { err, ok } from "../domain/result.js";

package/dist/application/InvestigationProviders.js

@@ -39,6 +39,12 @@ export const ANDROID_APPLICATION_PROVIDER = {
     name: "REA Android application workflows",
     version: "1",
 };
+/** Provider identity for verified publication of retained website scripts. */
+export const WEB_SCRIPT_EXPORT_PROVIDER = {
+    id: "rea-web-script-export",
+    name: "REA captured script export",
+    version: "1",
+};
 /** Provider identity for deterministic static JavaScript application analysis. */
 export const JAVASCRIPT_APPLICATION_PROVIDER = {
     id: "rea-javascript-application",

package/dist/application/JsonFiles.js

@@ -1,7 +1,7 @@
 import { link, lstat, mkdtemp, readFile, realpath, rm } from "node:fs/promises";
 import { basename, dirname, resolve } from "node:path";
 import writeFileAtomic from "write-file-atomic";
-import { EvidenceFileError } from "../domain/errors.js";
+import { EvidenceFileError } from "../domain/evidenceErrors.js";
 import { err, ok } from "../domain/result.js";
 /** Read JSON data from a regular file at the caller-supplied path. */
 export const readJsonFile = async (path) => {