rea-agents 5.0.0 → 6.0.0

package/dist/contracts/native/nativeToolContracts.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { nativeCallObservationInputSchema } from "../../domain/native/nativeCallObservation.js";
 import { nativeUiObservationInputSchema, nativeUiScenarioInputSchema, } from "../../domain/native/nativeUiObservation.js";
 import { nativeOutputSchemas } from "../toolOutputSchemas.js";
 import { jsonValueSchema } from "../../domain/jsonValue.js";
@@ -16,15 +17,29 @@ const examples = {
         steps: [{ kind: "wait", milliseconds: 100 }],
     },
     demangle_swift: { symbols: ["$s4Test3fooyyF"] },
+    observe_native_calls: {
+        breakpoints: [
+            {
+                kind: "objc-method",
+                class_name: "NSURLSession",
+                selector: "dataTaskWithRequest:completionHandler:",
+            },
+            { kind: "function", name: "open", module: "libsystem_kernel.dylib" },
+        ],
+        arguments: ["--help"],
+        duration_ms: 5000,
+        backtrace_frames: 4,
+    },
 };
 const native = (name, description, inputSchema) => {
     const outputSchema = requireOutputSchema(nativeOutputSchemas, name);
+    const strictInputSchema = inputSchema.strict();
     return {
         name,
         ...toolContractMetadata(name),
         description,
         kind: "native-provider",
-        inputSchema,
+        inputSchema: strictInputSchema,
         outputSchema,
         examples: [
             {
@@ -47,6 +62,7 @@ export const swiftSymbolsSchema = z
 export const NATIVE_TOOL_CONTRACTS = [
     native("observe_native_ui", "Observe an already-running native app by PID and window ID, bound to the active Mach-O target. Captures a bounded accessibility tree and selected-window screenshot; OS permission denial fails without broad capture or target launch.", nativeUiObservationInputSchema),
     native("capture_native_ui_scenario", "Run selected-element press, increment/decrement scroll, AXValue text entry and bounded wait steps in one exact native app window. Returns ordered before/after captures and action/capture failures. Actions can change app data, network activity and persistent state; application state is left as-is and restoration is not attempted.", nativeUiScenarioInputSchema),
+    native("observe_native_calls", "Launch the active Mach-O as an owned process under LLDB and record each entry into caller-selected functions or Objective-C methods: thread, module, symbol, load and file address, raw argument registers, selector, receiver class and optional caller frames. Every hit auto-continues. No expression is evaluated and no other process is attached. The process is killed when max_events or duration_ms is reached; exit status, captured stdout/stderr, unresolved breakpoints and limitations are returned inline. The process runs with the current user's permissions and may change files, show UI or use the network. A hardened-runtime target needs the get-task-allow entitlement.", nativeCallObservationInputSchema),
     native("inspect_macho", "Inspect Mach-O slices, load commands, imports, exports, dependencies, build metadata, segments, sections, permissions, and exact command provenance without launching Hopper.", z.object({})),
     native("inspect_signature", "Inspect the active artifact's code-signing identity, hashes, authorities, requirements, entitlements, hardened-runtime state, and exact command provenance.", z.object({})),
     native("inspect_plist", "Parse Info.plist from the active artifact by default, or pass any local plist path. Returns normalized JSON rather than plutil text.", z.object({

package/dist/contracts/officialToolContracts.js

@@ -8,15 +8,18 @@ import { nativeInstructionInputSchema } from "../domain/native/nativeInstruction
 import { functionInstructionInputSchema } from "./functionInstructionContract.js";
 import { HOPPER_MEMORY_TOOL_DEFINITIONS } from "./hopperMemoryContracts.js";
 import { analysisSearchInput } from "./analysisSearchContract.js";
-const official = (name, description, inputSchema) => ({
-    name,
-    ...toolContractMetadata(name),
-    description,
-    kind: "official-proxy",
-    inputSchema,
-    outputSchema: requireOutputSchema(officialOutputSchemas, name),
-    examples: examplesFor(name, inputSchema),
-});
+const official = (name, description, inputSchema) => {
+    const strictInputSchema = inputSchema.strict();
+    return {
+        name,
+        ...toolContractMetadata(name),
+        description,
+        kind: "official-proxy",
+        inputSchema: strictInputSchema,
+        outputSchema: requireOutputSchema(officialOutputSchemas, name),
+        examples: examplesFor(name, strictInputSchema),
+    };
+};
 /** Bridge operations exposed without additional application composition. */
 export const OFFICIAL_TOOL_CONTRACTS = [
     official("annotate_native_function", "Atomically update one function name and/or entry comments, read them back, and return a refreshed complete function dossier. Ghidra changes its ephemeral session analysis database only; original executable bytes remain unchanged. Empty comment text clears that comment. Edits remain available to subsequent MCP calls until close; CLI returns the updated dossier before discarding its session. Invalid edits roll back the entire operation. Windows P0 and providers without this capability are unsupported.", nativeFunctionAnnotationsInputSchema),

package/dist/contracts/process/processCaptureExample.js

@@ -0,0 +1,2 @@
+/** Minimal valid process capture retained as a public contract example. */
+export { EMPTY_PROCESS_CAPTURE_EXAMPLE } from "../../domain/process/processCaptureExample.js";

package/dist/contracts/sessionLifecycleInputs.js

@@ -1,17 +1,34 @@
 import { executableFormatHintSchema } from "../domain/dosCom.js";
+import { isAbsoluteLocalPath } from "../domain/localPath.js";
 import { z } from "zod";
 import { analysisProviderSelectorSchema } from "./providerSelection.js";
+/** Caller-supplied analysis snapshot path; must name its destination absolutely. */
+const snapshotPathSchema = z
+    .string()
+    .min(1)
+    .refine(isAbsoluteLocalPath, {
+    message: "snapshot_path must be an absolute local filesystem path (for example /tmp/rea/analysis.json or C:\\rea\\analysis.json)",
+})
+    .describe("Absolute local filesystem path for the analysis snapshot; relative paths are rejected.");
+/** Caller-supplied analysis target path; must name the target absolutely. */
+const binaryTargetPathSchema = z
+    .string()
+    .min(1)
+    .refine(isAbsoluteLocalPath, {
+    message: "path must be an absolute local filesystem path (for example /tmp/fixture.bin or C:\\analysis\\fixture.bin)",
+})
+    .describe("Absolute local filesystem path for the analysis target; relative paths are rejected.");
 /** Input contract for opening a target with an optional staged snapshot. */
-export const openBinaryInputSchema = z.object({
-    path: z.string().min(1),
+export const openBinaryInputSchema = z.strictObject({
+    path: binaryTargetPathSchema,
     format: executableFormatHintSchema
         .optional()
         .describe("Explicit headerless DOS COM interpretation; omission preserves header-based detection"),
     provider_id: analysisProviderSelectorSchema.optional(),
-    snapshot_path: z.string().min(1).optional(),
+    snapshot_path: snapshotPathSchema.optional(),
 });
 /** Input contract for closing a target after an optional atomic snapshot. */
-export const closeBinaryInputSchema = z.object({
-    snapshot_path: z.string().min(1).optional(),
+export const closeBinaryInputSchema = z.strictObject({
+    snapshot_path: snapshotPathSchema.optional(),
     overwrite: z.boolean().default(false),
 });

package/dist/contracts/sessionStatusContract.js

@@ -1,10 +1,18 @@
 import { z } from "zod";
+import { isAbsoluteLocalPath } from "../domain/localPath.js";
 /** Optional expectations used to compare the live session with its caller. */
-export const binarySessionInputSchema = z.object({
+export const binarySessionInputSchema = z.strictObject({
     expected_package_version: z.string().min(1).optional(),
     expected_catalog_digest: z
         .string()
         .regex(/^[a-f0-9]{64}$/u)
         .optional(),
-    expected_server_path: z.string().min(1).optional(),
+    expected_server_path: z
+        .string()
+        .min(1)
+        .refine(isAbsoluteLocalPath, {
+        message: "expected_server_path must be an absolute local filesystem path (for example /opt/rea/dist/main.js)",
+    })
+        .describe("Absolute local filesystem path expected for the running server; relative paths are rejected.")
+        .optional(),
 });

package/dist/contracts/sessionToolContracts.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { isAbsoluteLocalPath } from "../domain/localPath.js";
 import { sessionOutputSchemas, requireOutputSchema, } from "./toolOutputSchemas.js";
 import { addressContextInputSchema, artifactComparisonInputSchema, binarySessionInputSchema, bundleComparisonInputSchema, callPathInputSchema, changedBehaviorInputSchema, closeBinaryInputSchema, functionComparisonInputSchema, importEvidenceBundleInputSchema, listUnknownsInputSchema, navigationContextInputSchema, openBinaryInputSchema, processComparisonInputSchema, processScenarioSchema, reconstructionVerificationInputSchema, recordUnknownInputSchema, getEvidenceBundleInputSchema, staticRuntimeCorrelationInputSchema, updateUnknownInputSchema, verifyUnknownResolutionInputSchema, } from "./sessionToolSchemas.js";
 import { examplesFor } from "./toolContractHelpers.js";
@@ -14,7 +15,13 @@ const session = (name, description, inputSchema) => ({
 });
 /** Session-owned Evidence bundle export options. */
 export const exportEvidenceBundleInputSchema = z.strictObject({
-    path: z.string().min(1),
+    path: z
+        .string()
+        .min(1)
+        .refine(isAbsoluteLocalPath, {
+        message: "path must be an absolute local filesystem path (for example /tmp/rea/evidence.json or C:\\rea\\evidence.json)",
+    })
+        .describe("Absolute local filesystem path for the exported evidence bundle; relative paths are rejected."),
     overwrite: z.boolean().default(false),
 });
 /** Target lifecycle tools available only on the long-lived MCP adapter. */

package/dist/contracts/sessionToolSchemas.js

@@ -1,12 +1,13 @@
 import { z } from "zod";
+import { isAbsoluteLocalPath } from "../domain/localPath.js";
 import { artifactComparisonInputSchema } from "../domain/artifactComparison.js";
 import { bundleComparisonInputSchema } from "../domain/bundleComparison.js";
 import { callPathInputSchema } from "../domain/callPath.js";
 import { changedBehaviorInputSchema } from "../domain/changedBehavior.js";
 import { functionComparisonInputSchema } from "../domain/functionComparison.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";
-import { processScenarioSchema } from "../domain/processCapture.js";
-import { processTraceSpecificationSchema } from "../domain/processTraceComparison.js";
+import { processScenarioSchema } from "../domain/process/processCapture.js";
+import { processTraceSpecificationSchema } from "../domain/process/processTraceComparison.js";
 import { recordUnknownInputSchema } from "../domain/residualUnknown.js";
 import { reconstructionVerificationInputSchema } from "../domain/reconstructionVerification.js";
 import { staticRuntimeCorrelationInputSchema } from "../domain/staticRuntimeCorrelation.js";
@@ -28,7 +29,13 @@ export const addressContextInputSchema = z.strictObject({
 });
 /** Session-owned Evidence bundle import options. */
 export const importEvidenceBundleInputSchema = z.strictObject({
-    path: z.string().min(1),
+    path: z
+        .string()
+        .min(1)
+        .refine(isAbsoluteLocalPath, {
+        message: "path must be an absolute local filesystem path (for example /tmp/evidence.json or C:\\rea\\evidence.json)",
+    })
+        .describe("Absolute local filesystem path for the evidence bundle to import; relative paths are rejected."),
 });
 /** Evidence references for deterministic process comparison. */
 export const processComparisonInputSchema = z.strictObject({

package/dist/contracts/toolContractExamples.js

@@ -47,7 +47,7 @@ export const TOOL_EXAMPLE_OVERRIDES = {
     open_binary: { path: "/tmp/fixture" },
     export_evidence_bundle: { path: "/tmp/evidence.json" },
     inspect_address_context: { address: "0x1000" },
-    import_evidence_bundle: { path: "evidence.json" },
+    import_evidence_bundle: { path: "/tmp/evidence.json" },
     capture_process_scenario: {
         executable: "/usr/bin/true",
         working_directory: "/tmp",

package/dist/contracts/toolContracts.js

@@ -1,3 +1,5 @@
+import { EVM_TOOL_CONTRACTS } from "./evm/evmToolContracts.js";
+import { BINARY_DIAGNOSTICS_TOOL_CONTRACTS } from "./native/binaryDiagnosticsToolContracts.js";
 import { NATIVE_TOOL_CONTRACTS } from "./native/nativeToolContracts.js";
 import { ARTIFACT_TOOL_CONTRACTS } from "./artifactToolContracts.js";
 import { MANAGED_TOOL_CONTRACTS } from "./managed/managedToolContracts.js";
@@ -10,6 +12,7 @@ import { JAVASCRIPT_RUNTIME_OBSERVATION_TOOL_CONTRACTS } from "./javascript/java
 import { APPLICATION_TOOL_CONTRACTS } from "./applicationToolContracts.js";
 import { WEB_SCRIPT_TOOL_CONTRACTS } from "./webScriptToolContracts.js";
 import { WEB_RUNTIME_TOOL_CONTRACTS } from "./webRuntimeToolContracts.js";
+import { WEB_NETWORK_CAPTURE_TOOL_CONTRACTS } from "./webNetworkCaptureToolContracts.js";
 import { JAVASCRIPT_RECOVERY_TOOL_CONTRACTS } from "./javascript/javascriptRecoveryToolContracts.js";
 import { OFFICIAL_TOOL_CONTRACTS } from "./officialToolContracts.js";
 import { ENHANCED_TOOL_CONTRACTS } from "./enhancedToolContracts.js";
@@ -19,7 +22,9 @@ export const TOOL_CONTRACTS = [
     ...OFFICIAL_TOOL_CONTRACTS,
     ...ENHANCED_TOOL_CONTRACTS,
     ...NATIVE_TOOL_CONTRACTS,
+    ...BINARY_DIAGNOSTICS_TOOL_CONTRACTS,
     ...ARTIFACT_TOOL_CONTRACTS,
+    ...EVM_TOOL_CONTRACTS,
     ...MANAGED_TOOL_CONTRACTS,
     ...ANDROID_TOOL_CONTRACTS,
     ...FIRMWARE_TOOL_CONTRACTS,
@@ -30,6 +35,7 @@ export const TOOL_CONTRACTS = [
     ...APPLICATION_TOOL_CONTRACTS,
     ...WEB_SCRIPT_TOOL_CONTRACTS,
     ...WEB_RUNTIME_TOOL_CONTRACTS,
+    ...WEB_NETWORK_CAPTURE_TOOL_CONTRACTS,
     ...JAVASCRIPT_RECOVERY_TOOL_CONTRACTS,
     ...SESSION_TOOL_CONTRACTS,
 ];

package/dist/contracts/toolEffects.js

@@ -18,6 +18,16 @@ const browserEvidence = effects({
 const sessionEvidence = effects({ mutatesSession: true });
 /** Explicit effect audit for every public tool. */
 export const TOOL_EFFECTS = {
+    inspect_evm_interface: effects({
+        mutatesSession: true,
+        writesFilesystem: true,
+        launchesProcess: true,
+    }),
+    inspect_web_network_capture: effects({
+        mutatesSession: true,
+        writesFilesystem: true,
+        launchesProcess: true,
+    }),
     observe_web_execution: effects({
         mutatesTarget: true,
         mutatesSession: true,
@@ -37,6 +47,16 @@ export const TOOL_EFFECTS = {
         launchesProcess: true,
         accessesNetwork: true,
     }),
+    inspect_recorded_crash: effects({
+        mutatesSession: true,
+        writesFilesystem: true,
+        launchesProcess: true,
+    }),
+    inspect_binary_layout: effects({
+        mutatesSession: true,
+        writesFilesystem: true,
+        launchesProcess: true,
+    }),
     inspect_firmware_regions: effects({
         mutatesSession: true,
         launchesProcess: true,
@@ -152,6 +172,15 @@ export const TOOL_EFFECTS = {
         mayDiscardData: true,
         idempotent: false,
     }),
+    // The owned process can change files, show UI and use the network.
+    observe_native_calls: effects({
+        mutatesSession: true,
+        writesFilesystem: true,
+        launchesProcess: true,
+        accessesNetwork: true,
+        changesUiState: true,
+        idempotent: false,
+    }),
     inspect_macho: nativeEvidence,
     inspect_signature: nativeEvidence,
     inspect_plist: nativeEvidence,
@@ -171,6 +200,7 @@ export const TOOL_EFFECTS = {
     decode_interface_builder: evidence,
     inspect_asset_catalog: nativeEvidence,
     inspect_keyed_archive: evidence,
+    trace_dylib_resolution: evidence,
     inspect_managed_artifact: evidence,
     inspect_managed_members: evidence,
     inspect_managed_native_boundaries: evidence,

package/dist/contracts/toolOutputSchemaGroups.js

@@ -4,17 +4,19 @@ import { nativeLoadImageSchema } from "../domain/native/nativeLoadImage.js";
 import { nativeUiResultSchema } from "../domain/native/nativeUiObservation.js";
 import { nativeValueTraceSchema } from "../domain/native/nativeValueTrace.js";
 import { nativeDataTypeSchema } from "../domain/native/nativeDataType.js";
+import { nativeCallObservationResultSchema } from "../domain/native/nativeCallObservation.js";
 import { nativeInstructionSchema, nativeCallTargetsSchema, } from "../domain/native/nativeInstruction.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";
 import { residualUnknownSchema } from "../domain/residualUnknown.js";
 import { evidenceBundleSchema } from "../domain/evidenceBundle.js";
-import { processCaptureComparisonSchema, processCaptureSchema, } from "../domain/processCapture.js";
+import { processCaptureComparisonSchema, processCaptureSchema, } from "../domain/process/processCapture.js";
 import { functionInstructionWindowSchema, referenceKindSchema, } from "../domain/hopperValues.js";
 import { nativeApiInspectionResultSchema } from "../domain/native/nativeApiBoundary.js";
 import { demangleSwiftSchema, inspectMachoSchema, inspectPlistSchema, inspectSignatureSchema, listArchitecturesSchema, } from "../domain/native/nativeInspection.js";
 import { artifactExtractionResultSchema } from "../domain/artifactGraph.js";
 import { artifactInspectionResultSchema } from "../domain/artifactInspection.js";
 import { interfaceBuilderAnalysisSchema } from "../domain/apple/interfaceBuilderGraph.js";
+import { dylibResolutionResultSchema } from "../domain/apple/dylibResolution.js";
 import { keyedArchiveResultSchema } from "../domain/apple/keyedArchive.js";
 import { appleAssetCatalogResultSchema } from "../domain/apple/appleAssetCatalog.js";
 import { managedArtifactInspectionSchema, managedMemberInspectionSchema, managedNativeBoundaryInspectionSchema, } from "../domain/managed/managedArtifact.js";
@@ -235,6 +237,7 @@ export const enhancedOutputSchemas = {
 export const nativeOutputSchemas = {
     observe_native_ui: resultOf(nativeUiResultSchema),
     capture_native_ui_scenario: resultOf(nativeUiResultSchema),
+    observe_native_calls: resultOf(nativeCallObservationResultSchema),
     inspect_macho: resultOf(inspectMachoSchema),
     inspect_signature: resultOf(inspectSignatureSchema),
     inspect_plist: resultOf(inspectPlistSchema),
@@ -248,6 +251,7 @@ export const artifactOutputSchemas = {
     decode_interface_builder: resultOf(interfaceBuilderAnalysisSchema),
     inspect_keyed_archive: resultOf(keyedArchiveResultSchema),
     inspect_asset_catalog: resultOf(appleAssetCatalogResultSchema),
+    trace_dylib_resolution: resultOf(dylibResolutionResultSchema),
 };
 /** Exact Evidence schema for execution-free managed static analysis. */
 export const managedOutputSchemas = {

package/dist/contracts/toolOutputSchemaPrimitives.js

@@ -305,7 +305,7 @@ export const sessionProvider = z
         negotiated_protocol_version: z.string().nullable(),
         client: z.object({ name: z.string(), version: z.string() }).nullable(),
         skill: z.object({ name: z.string(), expected_version: z.string() }),
-        catalog: z.record(z.string(), z.json()),
+        catalog: z.record(z.string(), jsonValueSchema),
         protocol_features: z.object({
             progress: z.boolean(),
             cancellation: z.boolean(),

package/dist/contracts/webNetworkCaptureToolContracts.js

@@ -0,0 +1,24 @@
+import { inspectWebNetworkCaptureInputSchema, webNetworkCaptureSchema, } from "../domain/webNetworkCapture.js";
+import { toolContractMetadata } from "./toolEffects.js";
+import { evidenceResultOf } from "./toolOutputSchemas.js";
+/** Historical inspection is distinct from live browser capture and runtime authority. */
+export const WEB_NETWORK_CAPTURE_TOOL_CONTRACTS = [
+    {
+        name: "inspect_web_network_capture",
+        ...toolContractMetadata("inspect_web_network_capture"),
+        description: "Inspect retained local HAR 1.2 or native mitmproxy capture records without contacting recorded URLs. Returns original ordinals, pointers/byte ranges, preserved producer fields, precise numeric representations and exact exposed binary bytes inline. Excludes known transport credentials and explicitly marked values. Decodes every record before optional ordinal selection; malformed or oversized captures return no partial success. Duplicate HAR members are invalid; prototype-named __proto__ members are unsupported by the current shared JSON boundary. Uses pinned upstream parsers, owned temporary files and bounded offline processes. Native mitmproxy requires caller-supplied mitmdump 12.2.3 on Linux. Browser transaction IDs, runtime attribution and original bytes of HAR Unicode text remain unknown.",
+        kind: "browser-provider",
+        inputSchema: inspectWebNetworkCaptureInputSchema,
+        outputSchema: evidenceResultOf(webNetworkCaptureSchema),
+        examples: [
+            {
+                title: "Inspect historical HAR entries",
+                input: {
+                    capture_path: "/captures/session.har",
+                    format: "har",
+                    record_ordinals: [0, 2],
+                },
+            },
+        ],
+    },
+];

package/dist/domain/analysisErrorBase.js

@@ -2,10 +2,14 @@
 const ANALYSIS_ERROR_TAGS = [
     "AnalysisProtocolError",
     "AnalysisInputError",
+    "AnalysisAccessDeniedError",
+    "AnalysisArtifactChangedError",
     "AnalysisOutputError",
     "AnalysisCapabilityUnavailableError",
+    "AnalysisUnsupportedTargetError",
     "AnalysisCancelledError",
     "AnalysisTimeoutError",
+    "AnalysisResourceConstraintError",
     "ProviderSelectionError",
     "ProviderAdapterError",
     "BrowserObservationError",
@@ -26,8 +30,19 @@ const ANALYSIS_ERROR_TAGS = [
 ];
 /** Base class for expected analysis, provider, and session failures. */
 export class AnalysisError extends Error {
+    capturedOutput;
+    constructor(message, options) {
+        super(message, options);
+        this.capturedOutput =
+            options?.capturedOutput === undefined
+                ? undefined
+                : { ...options.capturedOutput };
+    }
     userMessage = undefined;
     userCategory = undefined;
     cleanupIncomplete = false;
     cleanupResources = [];
+    executionFailure = undefined;
+    partialObservation = undefined;
+    cleanupReport = undefined;
 }

package/dist/domain/analysisErrorCore.js

@@ -1,4 +1,32 @@
-import { AnalysisError } from "./analysisErrorBase.js";
+import { AnalysisError, } from "./analysisErrorBase.js";
+/** A readable supplied artifact lies outside this operation's supported target formats. */
+export class AnalysisUnsupportedTargetError extends AnalysisError {
+    operation;
+    path;
+    reason;
+    _tag = "AnalysisUnsupportedTargetError";
+    constructor(operation, path, reason, options) {
+        super(`Unsupported target for ${operation} at ${path}: ${reason}`, options);
+        this.operation = operation;
+        this.path = path;
+        this.reason = reason;
+    }
+}
+/** Provider reported a resource failure, distinct from malformed input or unsupported coverage. */
+export class AnalysisResourceConstraintError extends AnalysisError {
+    operation;
+    resource;
+    reason;
+    reportedLimits;
+    _tag = "AnalysisResourceConstraintError";
+    constructor(operation, resource, reason, reportedLimits, options) {
+        super(`Resource constraint during ${operation}: ${reason}`, options);
+        this.operation = operation;
+        this.resource = resource;
+        this.reason = reason;
+        this.reportedLimits = reportedLimits;
+    }
+}
 /** Provider-neutral invalid analysis input or output at an application boundary. */
 export class AnalysisProtocolError extends AnalysisError {
     _tag = "AnalysisProtocolError";
@@ -44,8 +72,8 @@ export class AnalysisCapabilityUnavailableError extends AnalysisError {
 export class AnalysisCancelledError extends AnalysisError {
     operation;
     _tag = "AnalysisCancelledError";
-    constructor(operation) {
-        super(`Analysis operation was cancelled: ${operation}`);
+    constructor(operation, options) {
+        super(`Analysis operation was cancelled: ${operation}`, options);
         this.operation = operation;
     }
 }
@@ -54,9 +82,35 @@ export class AnalysisTimeoutError extends AnalysisError {
     operation;
     timeoutMs;
     _tag = "AnalysisTimeoutError";
-    constructor(operation, timeoutMs) {
-        super(`Analysis operation timed out after ${String(timeoutMs)}ms: ${operation}`);
+    constructor(operation, timeoutMs, options) {
+        super(`Analysis operation timed out after ${String(timeoutMs)}ms: ${operation}`, options);
         this.operation = operation;
         this.timeoutMs = timeoutMs;
     }
 }
+/** Host filesystem permissions denied the selected read; this is not malformed caller input. */
+export class AnalysisAccessDeniedError extends AnalysisError {
+    operation;
+    path;
+    systemCode;
+    _tag = "AnalysisAccessDeniedError";
+    constructor(operation, path, systemCode, options) {
+        super(`Host filesystem read access denied (${systemCode}) for ${path} during ${operation}`, options);
+        this.operation = operation;
+        this.path = path;
+        this.systemCode = systemCode;
+    }
+}
+/** Selected artifact acquisition observed a change, so no stable identity can be reported. */
+export class AnalysisArtifactChangedError extends AnalysisError {
+    operation;
+    path;
+    reason;
+    _tag = "AnalysisArtifactChangedError";
+    constructor(operation, path, reason, options) {
+        super(`Selected artifact changed during acquisition: ${reason}`, options);
+        this.operation = operation;
+        this.path = path;
+        this.reason = reason;
+    }
+}

package/dist/domain/analysisErrorPresentation.js

@@ -1,4 +1,4 @@
-import { AnalysisInputError } from "./analysisErrorCore.js";
+import { AnalysisAccessDeniedError, AnalysisArtifactChangedError, AnalysisInputError, AnalysisUnsupportedTargetError, AnalysisResourceConstraintError, } from "./analysisErrorCore.js";
 import { ArtifactOperationError } from "./artifactOperationError.js";
 import { BinaryTargetError, ConfigurationError, NoBinaryOpenError, } from "./configurationErrors.js";
 import { BrowserObservationError } from "./browserObservationError.js";
@@ -9,6 +9,14 @@ import { UnknownRegistryError } from "./unknownRegistryError.js";
 import {} from "./analysisErrorBase.js";
 import {} from "./analysisErrorProjection.js";
 export const analysisErrorRemediationAction = (error) => {
+    if (error instanceof AnalysisUnsupportedTargetError)
+        return "Select a target supported by this operation or choose an operation supporting the reported target format.";
+    if (error instanceof AnalysisResourceConstraintError)
+        return error.resource === "cpu"
+            ? "Review the reported worker CPU limits and observed signal. Retry with sufficient CPU time or a smaller artifact; REA retains tighter inherited limits."
+            : error.resource === "file-size"
+                ? "Review the reported worker file-size limits and write failure. Retry with a sufficient file-size allowance for the evidence reply; REA retains tighter inherited limits."
+                : "Review the reported worker memory limits and available host memory. Retry with sufficient memory or a smaller artifact; REA retains tighter inherited limits.";
     if (error instanceof HopperTimeoutError)
         return error.providerState === "busy"
             ? "Check binary_session.analysis_activity, wait for the active Hopper request to finish, then retry."
@@ -26,6 +34,10 @@ export const analysisErrorRemediationAction = (error) => {
     if (error instanceof BinaryTargetError &&
         error.constraint === "directory_requires_file")
         return "For a JavaScript/Electron application directory, call analyze_javascript_application with input_path or run `rea analyze <directory>`. For binary analysis, select its executable file.";
+    if (error instanceof AnalysisAccessDeniedError)
+        return "Check the current process's read access to the selected path. Retry with a readable local file.";
+    if (error instanceof AnalysisArtifactChangedError)
+        return "Wait until the selected file is stable, then retry this operation.";
     if (error instanceof AnalysisInputError)
         return "Correct the listed arguments and retry.";
     if (error instanceof UnknownRegistryError && error.reason === "not-found")
@@ -73,17 +85,29 @@ const artifactErrorCategory = (reason) => {
 };
 const STATIC_ERROR_CATEGORIES = {
     AnalysisInputError: "invalid_input",
+    AnalysisAccessDeniedError: "unavailable",
+    AnalysisArtifactChangedError: "integrity_mismatch",
     AnalysisCapabilityUnavailableError: "unsupported_provider",
+    AnalysisUnsupportedTargetError: "unsupported_target",
     ProviderSelectionError: "unsupported_provider",
     EvidenceIntegrityError: "integrity_mismatch",
     AnalysisCancelledError: "cancelled",
     HopperCancelledError: "cancelled",
     AnalysisTimeoutError: "timeout",
+    AnalysisResourceConstraintError: "resource_constraint",
     HopperTimeoutError: "timeout",
     NoBinaryOpenError: "unavailable",
     BinaryTargetError: "unavailable",
 };
 export const analysisErrorUserMessage = (error) => {
+    if (error instanceof AnalysisUnsupportedTargetError)
+        return error.message;
+    if (error instanceof AnalysisResourceConstraintError)
+        return error.reason;
+    if (error instanceof AnalysisAccessDeniedError)
+        return "Host filesystem permissions denied read access to the selected path.";
+    if (error instanceof AnalysisArtifactChangedError)
+        return "The selected artifact changed during acquisition; no stable snapshot was decoded.";
     if (error instanceof AnalysisInputError)
         return "Analysis input is invalid. Check the arguments and try again.";
     const hopperMessage = hopperErrorUserMessage(error);
@@ -202,10 +226,14 @@ const evidenceFileMessage = (reason) => {
 const KNOWN_ERROR_TAGS = {
     AnalysisProtocolError: true,
     AnalysisInputError: true,
+    AnalysisAccessDeniedError: true,
+    AnalysisArtifactChangedError: true,
     AnalysisOutputError: true,
     AnalysisCapabilityUnavailableError: true,
+    AnalysisUnsupportedTargetError: true,
     AnalysisCancelledError: true,
     AnalysisTimeoutError: true,
+    AnalysisResourceConstraintError: true,
     ProviderSelectionError: true,
     ProviderAdapterError: true,
     BrowserObservationError: true,