rea-agents 6.0.0 → 6.2.0

package/dist/domain/analysisView/javascriptApplicationView.js

@@ -0,0 +1,238 @@
+import { AnalysisInputError, } from "../analysisErrorCore.js";
+import { uniqueSorted } from "../canonicalOrdering.js";
+import { jsonObjectSchema } from "../jsonValue.js";
+import { err, ok } from "../result.js";
+import { completeWithinViewCoverage as completeCoverage, pageViewCoverage as pageCoverage, } from "./analysisViewCoverage.js";
+const OPERATION = "inspect_analysis_view";
+const inputError = (issues) => new AnalysisInputError(OPERATION, undefined, issues);
+const jsIncompatible = (detail) => inputError([
+    {
+        path: ["view"],
+        reason: "invalid_value",
+        message: detail,
+    },
+]);
+/** Exact module path or original source-map reference, when available. */
+export const javascriptModulePath = (node) => {
+    if (node.identity.strategy === "canonical-path")
+        return node.identity.path;
+    if (node.identity.strategy === "source-map-original")
+        return node.identity.original_source;
+    for (const observation of node.observations) {
+        const path = observation.properties.path;
+        if (typeof path === "string")
+            return path;
+        const location = observation.evidence.location;
+        if (location.available && location.value.kind === "artifact-path")
+            return location.value.path;
+        if (location.available && location.value.kind === "source-range")
+            return location.value.source;
+    }
+    return null;
+};
+const moduleEntries = (nodes) => nodes
+    .filter((node) => node.kind === "javascript-asset" ||
+    node.kind === "javascript-module" ||
+    node.kind === "source-module")
+    .map((node) => ({ node, path: javascriptModulePath(node) }));
+const exportNames = (node) => {
+    const names = new Set();
+    for (const observation of node.observations) {
+        const value = observation.properties.export_names ?? observation.properties.exports;
+        if (!Array.isArray(value))
+            continue;
+        for (const entry of value)
+            if (typeof entry === "string")
+                names.add(entry);
+    }
+    return [...names];
+};
+const nodeHashes = (node) => {
+    const hashes = new Set();
+    const { identity } = node;
+    if (identity.strategy === "content-digest")
+        hashes.add(identity.sha256);
+    if (identity.strategy === "canonical-path")
+        hashes.add(identity.artifact_sha256);
+    if (identity.strategy === "source-map-original") {
+        hashes.add(identity.source_map_sha256);
+        if (identity.source_sha256 !== null)
+            hashes.add(identity.source_sha256);
+    }
+    for (const observation of node.observations) {
+        for (const key of [
+            "sha256",
+            "container_sha256",
+            "entry_sha256",
+            "source_sha256",
+        ]) {
+            const value = observation.properties[key];
+            if (typeof value === "string" && /^[a-f0-9]{64}$/u.test(value))
+                hashes.add(value);
+        }
+    }
+    return [...hashes];
+};
+const sourceRanges = (node) => node.observations.flatMap((observation) => {
+    const location = observation.evidence.location;
+    return location.available && location.value.kind === "source-range"
+        ? [location.value]
+        : [];
+});
+const moduleItem = (node) => ({
+    node_id: node.node_id,
+    kind: node.kind,
+    path: javascriptModulePath(node),
+    identity: node.identity,
+    hashes: [...nodeHashes(node)],
+    exports: [...exportNames(node)],
+    source_ranges: [...sourceRanges(node)],
+    observations: node.observations.map((observation) => ({
+        observation_id: observation.observation_id,
+        label: observation.label,
+        properties: observation.properties,
+        evidence: {
+            ...observation.evidence,
+            location: observation.evidence.location,
+        },
+    })),
+});
+const applicationUnknownCount = (analysis) => analysis.graph.nodes.reduce((count, node) => count + Number(node.kind === "unknown"), 0);
+const javascriptUnknowns = (analysis) => {
+    const unknowns = [
+        ...analysis.limitations,
+        ...analysis.graph.limitations,
+        ...analysis.semantic_graph.limitations,
+    ];
+    if (analysis.graph.coverage.status !== "complete")
+        unknowns.push(`graph.coverage.status is ${analysis.graph.coverage.status}`);
+    if (analysis.semantic_graph.coverage.status !== "complete")
+        unknowns.push(`semantic_graph.coverage.status is ${analysis.semantic_graph.coverage.status}`);
+    if (applicationUnknownCount(analysis) > 0)
+        unknowns.push(`${String(applicationUnknownCount(analysis))} application graph unknowns remain in the parent Evidence.`);
+    if (analysis.semantic_graph.unknowns.length > 0)
+        unknowns.push(`${String(analysis.semantic_graph.unknowns.length)} semantic graph unknowns remain in the parent Evidence.`);
+    return unknowns;
+};
+const parentFields = (parent, analysis) => ({
+    parent_evidence_id: parent.evidenceId,
+    parent_operation: "analyze_javascript_application",
+    parent_digest: parent.evidenceId.slice(3),
+    artifact: {
+        path: analysis.input_path,
+        sha256: analysis.root_artifact_sha256,
+    },
+    limitations: uniqueSorted([
+        ...parent.limitations,
+        ...analysis.limitations,
+        ...analysis.graph.limitations,
+        ...analysis.semantic_graph.limitations,
+    ]),
+    unknowns: uniqueSorted([...javascriptUnknowns(analysis)]),
+});
+const selectModule = (modules, selector) => {
+    if ("node_id" in selector) {
+        const matches = modules.filter(({ node }) => node.node_id === selector.node_id);
+        if (matches.length === 1) {
+            const selected = matches[0];
+            if (selected !== undefined)
+                return ok(selected.node);
+        }
+        return err(inputError([
+            {
+                path: ["view", "selector", "node_id"],
+                reason: "invalid_value",
+                message: `No module has node_id ${JSON.stringify(selector.node_id)}. Page the modules collection to inspect available identities.`,
+            },
+        ]));
+    }
+    if ("path" in selector) {
+        const matches = modules.filter((entry) => entry.path === selector.path);
+        if (matches.length === 1) {
+            const selected = matches[0];
+            if (selected !== undefined)
+                return ok(selected.node);
+        }
+        if (matches.length === 0)
+            return err(inputError([
+                {
+                    path: ["view", "selector", "path"],
+                    reason: "invalid_value",
+                    message: `No module has path ${JSON.stringify(selector.path)}. Page the modules collection to inspect exact paths and node_id values.`,
+                },
+            ]));
+        return err(inputError([
+            {
+                path: ["view", "selector", "path"],
+                reason: "invalid_value",
+                message: `Multiple modules have path ${JSON.stringify(selector.path)}; select one by node_id.`,
+                expected: matches.map((entry) => ({ node_id: entry.node.node_id })),
+            },
+        ]));
+    }
+    return err(jsIncompatible("Module items are selected by exact path or node_id."));
+};
+/** Project one JavaScript application view without re-running reconstruction. */
+export const projectJavaScriptApplicationView = (parent, analysis, view) => {
+    const shared = parentFields(parent, analysis);
+    const modules = moduleEntries(analysis.graph.nodes);
+    if (view.kind === "summary")
+        return ok({
+            kind: "summary",
+            view,
+            summary: {
+                input_path: analysis.input_path,
+                format: analysis.format,
+                root_artifact_sha256: analysis.root_artifact_sha256,
+                statistics: jsonObjectSchema.parse(analysis.statistics),
+                electron: jsonObjectSchema.parse(analysis.summary),
+                coverage: jsonObjectSchema.parse({
+                    application: analysis.graph.coverage,
+                    semantic: {
+                        ...analysis.semantic_graph.coverage,
+                        families: analysis.semantic_graph.coverage.families.map(({ unknown_ids, ...family }) => ({
+                            ...family,
+                            unknown_count: unknown_ids.length,
+                        })),
+                    },
+                    application_unknowns: applicationUnknownCount(analysis),
+                    semantic_unknowns: analysis.semantic_graph.unknowns.length,
+                }),
+                limitation_count: analysis.limitations.length,
+            },
+            coverage: completeCoverage(modules.length, analysis.graph.nodes.length),
+            ...shared,
+        });
+    if (view.kind === "facet")
+        return err(jsIncompatible("facet views apply to inspect_binary_layout Evidence (mitigations or linkage)."));
+    if (view.kind === "item") {
+        if (view.collection !== "modules")
+            return err(jsIncompatible("Section and symbol collections apply to inspect_binary_layout Evidence."));
+        const selected = selectModule(modules, view.selector);
+        if (!selected.ok)
+            return selected;
+        return ok({
+            kind: "item",
+            view,
+            item: moduleItem(selected.value),
+            coverage: completeCoverage(1, modules.length),
+            ...shared,
+        });
+    }
+    if (view.collection !== "modules")
+        return err(jsIncompatible("Section and symbol collections apply to inspect_binary_layout Evidence."));
+    const items = modules
+        .slice(view.offset, view.offset + view.limit)
+        .map(({ node, path }) => ({
+        node_id: node.node_id,
+        kind: node.kind,
+        path,
+    }));
+    return ok({
+        kind: "page",
+        view,
+        items,
+        coverage: pageCoverage(view.offset, items.length, modules.length),
+        ...shared,
+    });
+};

package/dist/domain/android/androidAnalysis.js

@@ -1,9 +1,7 @@
 import { z } from "zod";
+import { localPathStringSchema } from "../localPath.js";
 const target = {
-    path: z
-        .string()
-        .min(1)
-        .describe("Local APK path; the target is never executed"),
+    path: localPathStringSchema.describe("Local APK path; the target is never executed"),
 };
 const classTarget = {
     ...target,

package/dist/domain/android/androidApplication.js

@@ -5,6 +5,7 @@ import { parseArtifactInventoryEvidence } from "../artifactInventoryEvidence.js"
 import { evidenceSchema } from "../evidence.js";
 import { digestSchema } from "../digests.js";
 import { prefixedDigestSchema } from "../digests.js";
+import { bridgeCandidateCoverageSchema, projectCartesianCandidates, } from "../bridgeCandidateProjection.js";
 const evidenceIdSchema = prefixedDigestSchema("ev");
 const pathSchema = z.string().min(1);
 const componentSchema = z.strictObject({
@@ -52,6 +53,7 @@ export const androidApplicationProjectionResultSchema = z.strictObject({
             "unity-convention",
         ]),
     })),
+    bridge_candidate_coverage: bridgeCandidateCoverageSchema,
     coverage: z.strictObject({
         status: z.enum(["complete-within-inventory", "partial"]),
         inventory_complete: z.boolean(),
@@ -75,7 +77,7 @@ export const projectAndroidApplication = (input) => {
             path: occurrence.logical_path,
             artifact_id: node.artifact_id,
             sha256: node.sha256,
-            format: node.format,
+            format: occurrence.artifact_format,
         };
     });
     const classified = classify(all);
@@ -88,6 +90,11 @@ export const projectAndroidApplication = (input) => {
         "Manifest, resource, signing, and bytecode semantics require a dedicated Android provider; this projection reports exact inventory paths and hashes only.",
         "Runtime families are inferred from inventory formats and paths; filename suffixes do not establish valid DEX or JVM class bytes.",
         "Bridge candidates are path-based hypotheses, not decoded JNI declarations or observed runtime calls.",
+        ...(bridgeProjection.coverage.status === "partial"
+            ? [
+                `Bridge candidate pairs exceeded the projection safety budget; ${bridgeProjection.coverage.omitted_candidates} hypotheses are omitted. Component arrays still include every component from the supplied inventory pages.`,
+            ]
+            : []),
     ];
     const withoutId = {
         root_sha256: inventory.manifest.root_sha256,
@@ -98,8 +105,9 @@ export const projectAndroidApplication = (input) => {
         components,
         runtime_families: runtimeFamilies(all),
         bridge_candidates: bridgeProjection.candidates,
+        bridge_candidate_coverage: bridgeProjection.coverage,
         coverage: {
-            status: inventory.complete
+            status: inventory.complete && bridgeProjection.coverage.status === "complete"
                 ? "complete-within-inventory"
                 : "partial",
             inventory_complete: inventory.complete,
@@ -141,14 +149,14 @@ const runtimeFamilies = (all) => {
     return [...families].sort(compare);
 };
 const bridgeCandidates = (managed, native) => {
-    const candidates = managed.flatMap((source) => native.map((target) => ({
-        managed_path: source.path,
-        native_path: target.path,
-        basis: bridgeBasis(target.path),
-    })));
-    return {
-        candidates,
-    };
+    return projectCartesianCandidates({
+        groups: [{ left: managed, right: native }],
+        createCandidate: (managed_path, target) => ({
+            managed_path,
+            native_path: target.path,
+            basis: bridgeBasis(target.path),
+        }),
+    });
 };
 const bridgeBasis = (path) => {
     const lower = path.toLowerCase();

package/dist/domain/apple/appleApplication.js

@@ -6,6 +6,7 @@ import { parseArtifactInventoryEvidence } from "../artifactInventoryEvidence.js"
 import { evidenceSchema } from "../evidence.js";
 import { digestSchema } from "../digests.js";
 import { prefixedDigestSchema } from "../digests.js";
+import { bridgeCandidateCoverageSchema, projectCartesianCandidates, } from "../bridgeCandidateProjection.js";
 const evidenceIdSchema = prefixedDigestSchema("ev");
 const pathSchema = z.string().min(1);
 const APPLE_ROOT_FORMATS = ["ipa", "directory", "zip", "dmg"];
@@ -52,6 +53,7 @@ export const appleApplicationProjectionResultSchema = z.strictObject({
             "unity-convention",
         ]),
     })),
+    bridge_candidate_coverage: bridgeCandidateCoverageSchema,
     coverage: z.strictObject({
         status: z.enum(["complete-within-inventory", "partial"]),
         inventory_complete: z.boolean(),
@@ -83,7 +85,7 @@ export const projectAppleApplication = (input) => {
                 path: occurrence.logical_path,
                 artifact_id: node.artifact_id,
                 sha256: node.sha256,
-                format: node.format,
+                format: occurrence.artifact_format,
             },
         };
     });
@@ -110,6 +112,7 @@ export const projectAppleApplication = (input) => {
         sidecars: entries.some(({ path }) => isSidecar(path)),
         symlinks: entries.some(({ kind }) => kind === "symlink"),
         unattributed,
+        bridgeCandidateCoverage: bridgeProjection.coverage,
     });
     const withoutId = {
         root_sha256: inventory.manifest.root_sha256,
@@ -127,8 +130,9 @@ export const projectAppleApplication = (input) => {
             .sort(compare),
         runtime_families: runtimeFamilies,
         bridge_candidates: bridgeProjection.candidates,
+        bridge_candidate_coverage: bridgeProjection.coverage,
         coverage: {
-            status: complete
+            status: complete && bridgeProjection.coverage.status === "complete"
                 ? "complete-within-inventory"
                 : "partial",
             inventory_complete: inventory.complete,
@@ -137,9 +141,11 @@ export const projectAppleApplication = (input) => {
     };
     return appleApplicationProjectionResultSchema.parse({
         ...withoutId,
-        projection_id: `aap_${digest(withoutId)}`,
+        projection_id: appleProjectionId(withoutId),
     });
 };
+/** Identify the complete projection, including source Evidence provenance. */
+export const appleProjectionId = (projection) => `aap_${digest(projection)}`;
 /**
  * IPA projection keeps every archive component, as before. Directory, ZIP,
  * and DMG inventories can hold installers and other siblings, so only
@@ -204,21 +210,37 @@ const identifyRuntimeFamilies = (all) => {
         families.add("unity");
     return [...families].sort(compare);
 };
-/** Pair scripts and native code only within the same application root. */
+/** Pair scripts and native code within matching application-root groups. */
 const identifyBridgeCandidates = (scripts, native, roots) => {
     const owner = (path) => roots.find((root) => isWithin(path, root)) ?? null;
-    return {
-        candidates: scripts.flatMap((script) => {
-            const root = owner(script.path);
-            return native
-                .filter(({ path }) => owner(path) === root)
-                .map((item) => ({
-                source_path: script.path,
-                native_path: item.path,
-                basis: bridgeBasis(item.path),
-            }));
+    const scriptGroups = [];
+    for (const script of scripts) {
+        const root = owner(script.path);
+        const last = scriptGroups.at(-1);
+        if (last?.root === root)
+            last.left.push(script);
+        else
+            scriptGroups.push({ root, left: [script] });
+    }
+    const nativeByRoot = new Map();
+    for (const item of native) {
+        const root = owner(item.path);
+        const scoped = nativeByRoot.get(root) ?? [];
+        scoped.push(item);
+        nativeByRoot.set(root, scoped);
+    }
+    const groups = scriptGroups.map(({ root, left }) => ({
+        left,
+        right: nativeByRoot.get(root) ?? [],
+    }));
+    return projectCartesianCandidates({
+        groups,
+        createCandidate: (source_path, item) => ({
+            source_path,
+            native_path: item.path,
+            basis: bridgeBasis(item.path),
         }),
-    };
+    });
 };
 const bridgeBasis = (path) => {
     const lower = path.toLowerCase();
@@ -264,6 +286,11 @@ const projectionLimitations = (facts) => [
             "AppleDouble sidecar entries (._* files and __MACOSX/) describe neighbouring files and are excluded from bundle roles.",
         ]
         : []),
+    ...(facts.bridgeCandidateCoverage.status === "partial"
+        ? [
+            `Bridge candidate pairs exceeded the projection safety budget; ${facts.bridgeCandidateCoverage.omitted_candidates} hypotheses are omitted. Component arrays still include every component from the supplied inventory pages.`,
+        ]
+        : []),
     "Bundle roles follow path conventions. Read each info_plist_path with inspect_plist for CFBundleExecutable, identifiers, and declared services.",
     "Bundle identifiers and signing claims require dedicated plist and CMS parsing; this projection reports only exact paths and hashes.",
     "Bridge candidates are path-based hypotheses, not observed runtime calls.",

package/dist/domain/apple/dyldEnvironment.js

@@ -0,0 +1,73 @@
+/** Retain recognized image-selection settings separately from diagnostic observations. */
+export const embeddedDyldOverrides = (environment, platforms) => {
+    const overrides = [];
+    for (const setting of environment) {
+        const delimiter = setting.indexOf("=");
+        if (delimiter <= 0)
+            continue;
+        const variable = setting.slice(0, delimiter);
+        const value = setting.slice(delimiter + 1);
+        const effect = overrideEffect(variable, value);
+        if (effect === undefined)
+            continue;
+        // ROOT_PATH is accepted only for simulator processes. Missing or unknown
+        // platform metadata cannot establish that dyld ignores it.
+        if (variable === "DYLD_ROOT_PATH" &&
+            platforms.length > 0 &&
+            platforms.every((platform) => platform >= 1 && platform <= 12) &&
+            !platforms.some((platform) => [7, 8, 9, 12].includes(platform)))
+            continue;
+        overrides.push({ variable, value, ...effect });
+    }
+    return overrides;
+};
+const overrideEffect = (variable, value) => {
+    switch (variable) {
+        // Empty directory components still produce /leaf candidates in dyld.
+        // In particular, an empty fallback value is not a no-op.
+        case "DYLD_LIBRARY_PATH":
+            return { phase: "override", scope: "library" };
+        case "DYLD_FRAMEWORK_PATH":
+            return { phase: "override", scope: "framework" };
+        case "DYLD_FALLBACK_LIBRARY_PATH":
+            return { phase: "fallback", scope: "library" };
+        case "DYLD_FALLBACK_FRAMEWORK_PATH":
+            return { phase: "fallback", scope: "framework" };
+        // Versioned paths map discovered images to their reported install names,
+        // so the directory's kind does not establish the replaced image's kind.
+        case "DYLD_VERSIONED_LIBRARY_PATH":
+        case "DYLD_VERSIONED_FRAMEWORK_PATH":
+        case "DYLD_IMAGE_SUFFIX":
+            // Versioned paths scan directories; suffixes create path variants.
+            // Empty directories cannot be scanned and empty suffixes repeat a path.
+            return /[^:]/u.test(value)
+                ? { phase: "override", scope: "all" }
+                : undefined;
+        case "DYLD_INSERT_LIBRARIES":
+            return value === "" ? undefined : { phase: "override", scope: "all" };
+        case "DYLD_ROOT_PATH":
+        case "DYLD_OVERLAY_PATH":
+            return value === "" ? undefined : { phase: "override", scope: "prefix" };
+        default:
+            return undefined;
+    }
+};
+const isFrameworkInstallName = (name, overrides) => {
+    const separator = name.lastIndexOf(".framework/");
+    if (separator < 0)
+        return false;
+    const framework = name.slice(0, separator).split("/").at(-1);
+    const leaf = name.slice(name.lastIndexOf("/") + 1);
+    return (leaf === framework ||
+        overrides.some(({ variable, value }) => variable === "DYLD_IMAGE_SUFFIX" && leaf === `${framework}${value}`));
+};
+/** Select only settings that can affect this dependency at its reached search phase. */
+export const hasApplicableDyldOverrides = (overrides, installName, ordinarySearchFoundImage) => {
+    const kind = isFrameworkInstallName(installName, overrides)
+        ? "framework"
+        : "library";
+    return overrides.some(({ phase, scope }) => (phase === "override" || !ordinarySearchFoundImage) &&
+        (scope === "all" ||
+            scope === kind ||
+            (scope === "prefix" && !installName.startsWith("@"))));
+};