rea-agents 6.0.0 → 6.2.0

package/dist/android/JadxProvider.js

@@ -6,10 +6,11 @@ import { AnalysisError } from "../domain/analysisErrorBase.js";
 import { AnalysisCancelledError, AnalysisCapabilityUnavailableError, AnalysisOutputError, AnalysisInputError, AnalysisTimeoutError, } from "../domain/analysisErrorCore.js";
 import { ProviderAdapterError } from "../domain/providerAdapterError.js";
 import { ProviderCleanupError } from "../domain/providerCleanupError.js";
+import { projectAnalysisError } from "../domain/analysisErrorProjection.js";
 import { err, ok } from "../domain/result.js";
 import { PrivateRuntimeRoot } from "../process/PrivateRuntimeRoot.js";
 import { snapshotAndroidEngine, hashAndroidFile, snapshotAndroidTarget, } from "./AndroidTargetSnapshot.js";
-import { resolveJadxConfiguration } from "./JadxConfiguration.js";
+import { inspectJadxAvailability, resolveJadxConfiguration, } from "./JadxConfiguration.js";
 import { JadxSession } from "./JadxSession.js";
 const OPERATION_TIMEOUT_MS = 120_000;
 const BRIDGE_SOURCE = fileURLToPath(new URL("../../bridge/android/ReaJadxBridge.java", import.meta.url));
@@ -38,6 +39,19 @@ const executionError = (context) => {
         });
     if (cause instanceof z.ZodError)
         return new AnalysisOutputError(request.operation, "JADX response violated the pinned upstream protocol", { cause });
+    if (session !== undefined && !session.initialized()) {
+        const stderr = session.transport.diagnostics();
+        const reason = `Java could not start REA's Android bridge using ${session.transport.options.command}: ${cause instanceof Error ? cause.message : String(cause)}.${stderr.length === 0 ? "" : ` Java diagnostics: ${stderr}`} Select a full JDK including jdk.compiler via JAVA_HOME, or a working java on PATH; verify it with java --list-modules. A JRE cannot compile REA's source bridge. If the JDK works, verify the REA bridge and configured JADX JAR installation.`;
+        return new AnalysisCapabilityUnavailableError("jadx", request.operation, reason, {
+            cause,
+            userMessage: reason,
+            capturedOutput: {
+                stdout: "",
+                stderr,
+                truncated: session.transport.diagnosticsTruncated(),
+            },
+        });
+    }
     return new ProviderAdapterError("jadx", request.operation, {
         cause,
         diagnostics: {
@@ -46,14 +60,14 @@ const executionError = (context) => {
         },
     });
 };
-const cleanup = async (session, root, previous) => {
+const cleanup = async (resources) => {
+    const { session, root, previousError } = resources;
     const diagnostics = {
-        previous_error: previous.ok
-            ? null
-            : { tag: previous.error._tag, message: previous.error.message },
+        previous_error: previousError === undefined ? null : projectAnalysisError(previousError),
     };
     try {
         await session?.close();
+        resources.session = undefined;
     }
     catch (cause) {
         // Retain an uncertain workspace until the caller can resolve process ownership.
@@ -66,33 +80,38 @@ const cleanup = async (session, root, previous) => {
             provider_cleanup: cause instanceof ProviderCleanupError
                 ? (cause.diagnostics ?? null)
                 : null,
-        }, { cause }));
+        }, { cause: previousError ?? cause }));
     }
     try {
         await root?.close();
+        resources.root = undefined;
     }
     catch (cause) {
         return err(new ProviderCleanupError("jadx", [root?.path ?? "unknown"], {
             ...diagnostics,
             reason: cause instanceof Error ? cause.message : String(cause),
-        }, { cause }));
+        }, { cause: previousError ?? cause }));
     }
-    return previous;
+    return ok(undefined);
 };
 /** One serialized, immutable APK session per REA instance, retired on idle or shutdown. */
 export class JadxProvider {
     environment;
     launcher;
     #tail = Promise.resolve();
-    #cleanupFailure;
+    #pendingCleanup;
     #retained;
     #idle;
     #shutdown = new AbortController();
     #closePromise;
-    constructor(environment = process.env, launcher) {
+    constructor(environment, launcher) {
         this.environment = environment;
         this.launcher = launcher;
     }
+    /** Report actual local prerequisites without starting JADX or opening a target. */
+    inspectAvailability(signal) {
+        return inspectJadxAvailability(this.environment, signal);
+    }
     /** Serialize expensive work and bind both raw and normalized results to the APK. */
     async execute(target, request, options) {
         if (this.#shutdown.signal.aborted)
@@ -115,12 +134,13 @@ export class JadxProvider {
         try {
             if (signal.aborted)
                 return err(new AnalysisCancelledError(request.operation));
-            if (this.#cleanupFailure !== undefined)
-                return err(this.#cleanupFailure);
             clearTimeout(this.#idle);
+            if (this.#pendingCleanup !== undefined) {
+                const retired = await this.#retire();
+                if (!retired.ok)
+                    return retired;
+            }
             const outcome = await this.#execute(target, request, { signal });
-            if (!outcome.ok && outcome.error.cleanupIncomplete)
-                this.#cleanupFailure = outcome.error;
             if (outcome.ok)
                 this.#scheduleIdle();
             return outcome;
@@ -133,24 +153,39 @@ export class JadxProvider {
     close() {
         this.#shutdown.abort();
         clearTimeout(this.#idle);
-        this.#closePromise ??= this.#tail.then(() => this.#retire());
+        this.#closePromise ??= this.#tail
+            .then(async () => {
+            const retired = await this.#retire();
+            if (!retired.ok)
+                throw retired.error;
+        })
+            .catch((cause) => {
+            this.#closePromise = undefined;
+            throw cause;
+        });
         return this.#closePromise;
     }
     async #retire() {
-        if (this.#cleanupFailure !== undefined)
-            throw this.#cleanupFailure;
-        const retained = this.#retained;
-        this.#retained = undefined;
-        const result = await cleanup(retained?.session, retained?.root, ok(undefined));
-        if (!result.ok) {
-            this.#cleanupFailure = result.error;
-            throw result.error;
+        if (this.#pendingCleanup === undefined && this.#retained !== undefined) {
+            this.#pendingCleanup = {
+                session: this.#retained.session,
+                root: this.#retained.root,
+                previousError: undefined,
+            };
+            this.#retained = undefined;
         }
+        if (this.#pendingCleanup === undefined)
+            return ok(undefined);
+        const result = await cleanup(this.#pendingCleanup);
+        if (result.ok)
+            this.#pendingCleanup = undefined;
+        return result;
     }
     #scheduleIdle() {
         this.#idle = setTimeout(() => {
-            const retirement = this.#tail.then(() => this.#retire());
-            this.#tail = retirement.catch(() => undefined);
+            this.#tail = this.#tail.then(async () => {
+                await this.#retire();
+            });
         }, 60_000);
         this.#idle.unref();
     }
@@ -161,11 +196,10 @@ export class JadxProvider {
             : AbortSignal.any([options.signal, timeout]);
         let root;
         let session;
-        let outcome;
         try {
             if (target.format !== "apk")
                 throw new AnalysisCapabilityUnavailableError("jadx", request.operation, `Target ${target.path} is ${target.format}; provide one standalone APK.`);
-            const configuration = await resolveJadxConfiguration(this.environment, request.operation);
+            const configuration = await resolveJadxConfiguration(this.environment, request.operation, signal);
             signal.throwIfAborted();
             const jarHash = await hashAndroidFile(configuration.jar);
             const bridgeHash = await hashAndroidFile(BRIDGE_SOURCE);
@@ -193,8 +227,11 @@ export class JadxProvider {
                     this.environment.JAVA_HOME,
                 ],
             });
-            if (this.#retained !== undefined && this.#retained.key !== key)
-                await this.#retire();
+            if (this.#retained !== undefined && this.#retained.key !== key) {
+                const retired = await this.#retire();
+                if (!retired.ok)
+                    return retired;
+            }
             let retained = this.#retained;
             if (retained === undefined) {
                 root = await PrivateRuntimeRoot.create({ prefix: "rea-android-" });
@@ -230,7 +267,7 @@ export class JadxProvider {
             root = retained.root;
             session = retained.session;
             const { snapshot } = retained;
-            outcome = ok(await session.execute({
+            const outcome = ok(await session.execute({
                 request,
                 target,
                 snapshot,
@@ -243,18 +280,20 @@ export class JadxProvider {
             return outcome;
         }
         catch (cause) {
-            outcome = err(executionError({
+            const previousError = executionError({
                 cause,
                 request,
                 timeout,
                 signal: options?.signal,
                 session,
-            }));
+            });
+            // Admission can fail before selecting an existing session for execution.
+            root ??= this.#retained?.root;
+            session ??= this.#retained?.session;
+            this.#retained = undefined;
+            this.#pendingCleanup = { session, root, previousError };
+            const retired = await this.#retire();
+            return retired.ok ? err(previousError) : retired;
         }
-        // An existing session also needs retirement when admission fails before selection.
-        root ??= this.#retained?.root;
-        session ??= this.#retained?.session;
-        this.#retained = undefined;
-        return cleanup(session, root, outcome);
     }
 }

package/dist/android/JadxSession.js

@@ -1,17 +1,18 @@
 import { Client } from "@modelcontextprotocol/client";
 import { createAnalysisExecution, } from "../application/AnalysisProvider.js";
-import { AnalysisCapabilityUnavailableError, AnalysisOutputError, } from "../domain/analysisErrorCore.js";
+import { AnalysisCapabilityUnavailableError, AnalysisInputError, AnalysisOutputError, } from "../domain/analysisErrorCore.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";
 import { ProviderAdapterError } from "../domain/providerAdapterError.js";
 import { analyzeJadxRequest } from "./JadxAnalysis.js";
 import { JadxMcpTransport } from "./JadxMcpTransport.js";
-import { jadxLoadSchema, jadxRuntimeSchema, parseJadxEnvelope, parseJadxJson, } from "./JadxProtocol.js";
+import { jadxLoadSchema, jadxInputFailureSchema, jadxRuntimeSchema, parseJadxEnvelope, parseJadxJson, } from "./JadxProtocol.js";
 import { JADX_BRIDGE_IDENTITY, JADX_RELEASE, JADX_PROVIDER_IDENTITY, JADX_LIMITATIONS, } from "./JadxRelease.js";
 /** One owned engine connection; its wire protocol stays inside the Android adapter. */
 export class JadxSession {
     transport;
     #client = new Client({ name: "rea-android-adapter", version: "1" });
     #loaded;
+    #connected = false;
     constructor(options, launcher) {
         this.transport = new JadxMcpTransport(options, launcher);
     }
@@ -26,8 +27,10 @@ export class JadxSession {
             signal.throwIfAborted();
             this.transport.beginOperation();
             const raw = [];
-            if (this.#loaded === undefined)
+            if (!this.#connected) {
                 await this.#client.connect(this.transport, { timeout: 30_000 });
+                this.#connected = true;
+            }
             const server = this.#client.getServerVersion();
             if (server?.name !== JADX_BRIDGE_IDENTITY.name ||
                 server.version !== JADX_BRIDGE_IDENTITY.version)
@@ -73,6 +76,10 @@ export class JadxSession {
             signal.removeEventListener("abort", abort);
         }
     }
+    /** Whether the selected Java runtime established the REA bridge protocol. */
+    initialized() {
+        return this.#connected;
+    }
     /** Join owned cleanup even if SDK connection teardown itself fails. */
     async close() {
         try {
@@ -92,7 +99,18 @@ export class JadxSession {
                 input,
                 response: jsonValueSchema.parse(response),
             });
-            if (envelope.failed)
+            if (envelope.failed) {
+                if (envelope.text.startsWith("{")) {
+                    const failure = jadxInputFailureSchema.safeParse(parseJadxJson(envelope.text, request.operation));
+                    if (failure.success)
+                        throw new AnalysisInputError(request.operation, undefined, [
+                            {
+                                path: [failure.data.field],
+                                reason: "invalid_value",
+                                message: failure.data.message,
+                            },
+                        ]);
+                }
                 throw new ProviderAdapterError("jadx", request.operation, {
                     diagnostics: {
                         upstream_operation: name,
@@ -101,6 +119,7 @@ export class JadxSession {
                         target_sha256: target.sha256,
                     },
                 });
+            }
             return envelope.text;
         };
         return {

package/dist/application/AnalysisContextQueries.js

@@ -1,6 +1,7 @@
-import { AnalysisCapabilityUnavailableError, AnalysisOutputError, } from "../domain/analysisErrorCore.js";
+import { AnalysisOutputError } from "../domain/analysisErrorCore.js";
 import {} from "../domain/analysisErrorBase.js";
-import { parseDocuments } from "../domain/hopperValues.js";
+import { analysisBookmarkSchema } from "../domain/hopperValues.js";
+import { resolveAnalysisDocument } from "./AnalysisDocument.js";
 import { err, ok } from "../domain/result.js";
 const parameters = (document, address) => ({
     ...(document === undefined ? {} : { document }),
@@ -42,7 +43,7 @@ export const getNavigationContext = async (analysis, input, signal) => {
 };
 /** Inspect bounded provider-neutral facets at one explicit reproducible address. */
 export const inspectAddressContext = async (analysis, input, signal) => {
-    const document = await resolveDocument(analysis, input.document, signal);
+    const document = await resolveAnalysisDocument(analysis, input.document, signal);
     if (!document.ok)
         return document;
     const args = parameters(document.value, input.address);
@@ -75,30 +76,6 @@ export const inspectAddressContext = async (analysis, input, signal) => {
             : bookmarks,
     });
 };
-const resolveDocument = async (analysis, document, signal) => {
-    if (document !== undefined)
-        return ok(document);
-    const current = await analysis.execute("current_document", {}, executionOptions(signal));
-    if (!current.ok) {
-        if (!(current.error instanceof AnalysisCapabilityUnavailableError))
-            return current;
-        const listed = await analysis.execute("list_documents", {}, executionOptions(signal));
-        if (!listed.ok)
-            return listed;
-        const parsed = parseDocuments(listed.value.result);
-        if (!parsed.ok)
-            return err(new AnalysisOutputError("list_documents", "expected one document identity when resolving a headless provider", { cause: parsed.error }));
-        if (parsed.value.length !== 1)
-            return err(new AnalysisOutputError("list_documents", `expected exactly one document identity for a provider without current-document selection, received ${parsed.value.length}`));
-        const [documentName] = parsed.value;
-        if (documentName === undefined)
-            return err(new AnalysisOutputError("list_documents", "provider returned no document identity"));
-        return ok(documentName);
-    }
-    return typeof current.value.result === "string"
-        ? ok(current.value.result)
-        : err(new AnalysisOutputError("current_document", "expected a document identity string"));
-};
 const facet = (result, operation) => result?.ok === true
     ? { state: "available", value: result.value.result }
     : {
@@ -139,19 +116,15 @@ const matchingBookmarks = (value, address) => {
             reason: "list_bookmarks returned malformed output; expected an array.",
             remediation: "Retry list_bookmarks directly and report the provider output shape if it remains malformed.",
         };
-    if (!value.every(isBookmark))
+    const parsed = analysisBookmarkSchema.array().safeParse(value);
+    if (!parsed.success)
         return {
             state: "unavailable",
-            reason: "list_bookmarks returned malformed entries; expected address and name strings.",
+            reason: "list_bookmarks returned malformed entries; expected an address string and a string or null name.",
             remediation: "Retry list_bookmarks directly and report the provider output shape if it remains malformed.",
         };
     return {
         state: "available",
-        value: value.filter((bookmark) => bookmark.address === address),
+        value: parsed.data.filter((bookmark) => bookmark.address === address),
     };
 };
-const isBookmark = (value) => typeof value === "object" &&
-    value !== null &&
-    !Array.isArray(value) &&
-    typeof value.address === "string" &&
-    typeof value.name === "string";

package/dist/application/AnalysisDocument.js

@@ -0,0 +1,32 @@
+import { AnalysisCancelledError, AnalysisCapabilityUnavailableError, AnalysisOutputError, } from "../domain/analysisErrorCore.js";
+import { parseDocuments } from "../domain/hopperValues.js";
+import { err, ok } from "../domain/result.js";
+const executionOptions = (signal) => signal === undefined ? undefined : { signal };
+/** Resolve an explicit or provider-selected document without guessing among candidates. */
+export const resolveAnalysisDocument = async (analysis, document, signal) => {
+    if (document !== undefined)
+        return ok(document);
+    if (signal?.aborted === true)
+        return err(new AnalysisCancelledError("current_document"));
+    const current = await analysis.execute("current_document", {}, executionOptions(signal));
+    if (!current.ok) {
+        if (!(current.error instanceof AnalysisCapabilityUnavailableError))
+            return current;
+        const listed = await analysis.execute("list_documents", {}, executionOptions(signal));
+        if (!listed.ok)
+            return listed;
+        const parsed = parseDocuments(listed.value.result);
+        if (!parsed.ok)
+            return err(new AnalysisOutputError("list_documents", "expected one document identity when resolving a headless provider", { cause: parsed.error }));
+        if (parsed.value.length !== 1)
+            return err(new AnalysisOutputError("list_documents", `expected exactly one document identity for a provider without current-document selection, received ${parsed.value.length}`));
+        const [documentName] = parsed.value;
+        if (documentName === undefined || documentName.length === 0)
+            return err(new AnalysisOutputError("list_documents", "provider returned no document identity"));
+        return ok(documentName);
+    }
+    return typeof current.value.result === "string" &&
+        current.value.result.length > 0
+        ? ok(current.value.result)
+        : err(new AnalysisOutputError("current_document", "expected a nonempty document identity string"));
+};

package/dist/application/AppBundleExecutable.js

@@ -6,6 +6,7 @@ import { z } from "zod";
 import { BinaryTargetError } from "../domain/configurationErrors.js";
 import { isPathWithinRoot } from "../domain/localPath.js";
 import { parseXmlPropertyList } from "../domain/propertyListKeys.js";
+import { decodeXmlPlistText } from "../domain/propertyListXmlText.js";
 import { err, ok } from "../domain/result.js";
 const execFileAsync = promisify(execFile);
 const BUNDLE_LAYOUTS = [
@@ -18,23 +19,31 @@ const BUNDLE_LAYOUTS = [
     // iOS-style bundles, as extracted from an IPA, keep both at the root.
     { plist: ["Info.plist"], programs: [], programsLabel: "the bundle root" },
 ];
+const defaultFileSystem = { readFile, realpath };
 /**
  * Resolve an app bundle directory to its declared program file. macOS and
  * flat iOS-style layouts are read directly. An iOS app installed on a Mac is
  * a wrapper whose `Wrapper` directory holds the iOS bundle; that bundle is
  * found by listing `Wrapper`, never by following the `WrappedBundle` link.
  */
-export const resolveAppBundleExecutable = async (path) => {
-    const layout = await presentLayout(path);
-    if (layout !== undefined)
-        return resolveLayoutExecutable(path, layout);
-    const wrapped = await wrappedBundle(path);
-    if (wrapped !== undefined) {
-        const wrappedLayout = await presentLayout(wrapped);
-        if (wrappedLayout !== undefined)
-            return resolveLayoutExecutable(wrapped, wrappedLayout);
+export const resolveAppBundleExecutable = async (path, fileSystem = defaultFileSystem) => {
+    try {
+        const layout = await presentLayout(path);
+        if (layout !== undefined)
+            return resolveLayoutExecutable(path, layout, fileSystem);
+        const wrapped = await wrappedBundle(path);
+        if (wrapped !== undefined) {
+            const wrappedLayout = await presentLayout(wrapped);
+            if (wrappedLayout !== undefined)
+                return resolveLayoutExecutable(wrapped, wrappedLayout, fileSystem);
+        }
+    }
+    catch (cause) {
+        if (cause instanceof BinaryTargetError)
+            return err(cause);
+        return err(new BinaryTargetError(path, errorReason(cause, path), { cause }));
     }
-    return err(new BinaryTargetError(path, "app has no readable CFBundleExecutable", {
+    return err(new BinaryTargetError(path, `app Info.plist is missing or no supported bundle layout was found: ${path}`, {
         cause: new Error("No Contents/Info.plist, root Info.plist, or single Wrapper/*.app bundle was found"),
     }));
 };
@@ -56,13 +65,34 @@ const layoutPlistPresent = async (path) => {
     catch (cause) {
         if (isAbsence(cause))
             return false;
+        if (isPermissionDenied(cause))
+            throw new BinaryTargetError(path, `permission denied inspecting app Info.plist ${path}`, { cause });
         throw cause;
     }
 };
 const isAbsence = (cause) => {
-    const code = cause instanceof Error ? Reflect.get(cause, "code") : undefined;
+    const code = errorCode(cause);
     return code === "ENOENT" || code === "ENOTDIR";
 };
+const errorCode = (cause) => cause instanceof Error ? Reflect.get(cause, "code") : undefined;
+const codeDescription = (cause) => {
+    const code = errorCode(cause);
+    return typeof code === "string" || typeof code === "number"
+        ? ` (${String(code)})`
+        : "";
+};
+const isSystemErrorCode = (cause) => {
+    const code = errorCode(cause);
+    return (typeof code === "string" &&
+        /^[A-Z][A-Z0-9_]+$/u.test(code) &&
+        !code.startsWith("ERR_"));
+};
+const isPermissionDenied = (cause) => errorCode(cause) === "EACCES" || errorCode(cause) === "EPERM";
+const errorReason = (cause, path) => isPermissionDenied(cause)
+    ? `permission denied accessing app bundle path ${path}`
+    : isAbsence(cause)
+        ? `app bundle path is missing: ${path}`
+        : `could not inspect app bundle path ${path}`;
 /** The single real `.app` directory inside an iOS-on-Mac `Wrapper`. */
 const wrappedBundle = async (bundle) => {
     const wrapper = join(bundle, "Wrapper");
@@ -81,20 +111,32 @@ const wrappedBundle = async (bundle) => {
         ? join(wrapper, app.name)
         : undefined;
 };
-const resolveLayoutExecutable = async (bundle, layout) => {
+const resolveLayoutExecutable = async (bundle, layout, fileSystem) => {
     const plistPath = join(bundle, ...layout.plist);
+    let plist;
+    try {
+        plist = await fileSystem.readFile(plistPath);
+    }
+    catch (cause) {
+        return err(new BinaryTargetError(plistPath, isPermissionDenied(cause)
+            ? `permission denied reading app Info.plist ${plistPath}`
+            : isAbsence(cause)
+                ? `app Info.plist is missing: ${plistPath}`
+                : `could not read app Info.plist ${plistPath}${codeDescription(cause)}`, { cause }));
+    }
     let name;
     try {
-        const plist = await readFile(plistPath);
         name =
             plist.subarray(0, 6).toString("ascii") === "bplist"
-                ? await readBinaryPlistExecutable(plistPath)
-                : parseXmlPlistExecutable(plist.toString("utf8"));
+                ? await (fileSystem.decodeBinaryPlist ?? readBinaryPlistExecutable)(plistPath)
+                : parseXmlPlistExecutable(decodeXmlPlistText(plist));
     }
     catch (cause) {
-        return err(new BinaryTargetError(bundle, "app has no readable CFBundleExecutable", {
-            cause,
-        }));
+        return err(new BinaryTargetError(plistPath, isPermissionDenied(cause)
+            ? `permission denied decoding app Info.plist ${plistPath}${codeDescription(cause)}`
+            : isSystemErrorCode(cause)
+                ? `could not decode app Info.plist ${plistPath}${codeDescription(cause)}`
+                : `app Info.plist is malformed, unsupported, or lacks CFBundleExecutable: ${plistPath}${cause instanceof Error ? ` (${cause.message})` : ""}`, { cause }));
     }
     if (!isSafeExecutableName(name))
         return err(new BinaryTargetError(bundle, "app has an unsafe CFBundleExecutable"));
@@ -102,15 +144,19 @@ const resolveLayoutExecutable = async (bundle, layout) => {
     const executable = join(programs, name);
     try {
         const [canonicalPrograms, canonicalExecutable] = await Promise.all([
-            realpath(programs),
-            realpath(executable),
+            fileSystem.realpath(programs),
+            fileSystem.realpath(executable),
         ]);
         if (!isPathWithinRoot(canonicalPrograms, canonicalExecutable))
             return err(new BinaryTargetError(bundle, `app program file leaves ${layout.programsLabel}`));
         return ok({ executable: canonicalExecutable, infoPlist: plistPath });
     }
     catch (cause) {
-        return err(new BinaryTargetError(bundle, "app program file is missing", { cause }));
+        return err(new BinaryTargetError(executable, isPermissionDenied(cause)
+            ? `permission denied resolving app program file ${executable}`
+            : isAbsence(cause)
+                ? `app program file is missing: ${executable}`
+                : `could not resolve app program file ${executable}`, { cause }));
     }
 };
 /** Decode the top-level executable name with an XML parser, not a pattern. */

package/dist/application/BinaryTargetResolver.js

@@ -169,6 +169,9 @@ const readExecutableMetadata = async (handle, hostArchitecture) => {
     const prefix = Buffer.alloc(4096);
     const prefixRead = await handle.read(prefix, 0, prefix.length, 0);
     const bytes = prefix.subarray(0, prefixRead.bytesRead);
+    // Header commitments such as Mach-O load commands and FAT slices are
+    // checked against the whole file, not the probed prefix.
+    const fileSize = (await handle.stat()).size;
     if (bytes.length >= 2 && bytes[0] === 0x4d && bytes[1] === 0x5a) {
         const offset = mzWindowsHeaderOffset(bytes);
         if (offset !== null) {
@@ -182,7 +185,6 @@ const readExecutableMetadata = async (handle, hostArchitecture) => {
             ? bytes.readUInt16LE(24) + bytes.readUInt16LE(6) * 4
             : 0;
         const headerBytes = bytes.length >= 28 ? bytes.readUInt16LE(8) * 16 : 0;
-        const fileSize = (await handle.stat()).size;
         if (tableEnd > bytes.length &&
             tableEnd <= headerBytes &&
             tableEnd <= fileSize) {
@@ -201,11 +203,11 @@ const readExecutableMetadata = async (handle, hostArchitecture) => {
             if (count <= 128 && required > bytes.length) {
                 const header = Buffer.alloc(required);
                 const headerRead = await handle.read(header, 0, header.length, 0);
-                return parseExecutableHeader(header.subarray(0, headerRead.bytesRead), hostArchitecture);
+                return parseExecutableHeader(header.subarray(0, headerRead.bytesRead), hostArchitecture, fileSize);
             }
         }
     }
-    return parseExecutableHeader(bytes, hostArchitecture);
+    return parseExecutableHeader(bytes, hostArchitecture, fileSize);
 };
 const readPeMetadata = async (handle, offset) => {
     const fileHeader = Buffer.alloc(24);

package/dist/application/BrowserEvidence.js

@@ -27,21 +27,16 @@ export const createBrowserEvidence = (operation, input, result, provider) => cre
 });
 const browserParameters = (input, result) => {
     if (!("cdp_endpoint" in input)) {
-        if ("before_scenario" in input &&
-            input.before_scenario !== undefined &&
-            input.after_scenario !== undefined)
+        if ("before_scenario" in input)
             return {
                 comparison_kind: "browser_scenario",
                 before_browser: input.before_scenario.browser,
                 after_browser: input.after_scenario.browser,
                 before_start_origin: input.before_scenario.scenario.start_origin,
                 after_start_origin: input.after_scenario.scenario.start_origin,
-                normalization_sha256: commitBrowserScenarioNormalization(input.normalization ?? { rules: [] }).sha256,
+                normalization_sha256: commitBrowserScenarioNormalization(input.normalization).sha256,
             };
-        if (input.before !== undefined &&
-            input.after !== undefined &&
-            "inspection" in input.before &&
-            "inspection" in input.after)
+        if ("inspection" in input.before && "inspection" in input.after)
             return {
                 before_target_id: input.before.inspection.target.target_id,
                 before_capture_ended_at: input.before.inspection.capture_window.ended_at,

package/dist/application/BrowserScenarioEvidence.js

@@ -1,25 +1,9 @@
 import { canonicalDigest } from "../domain/comparisonSemantics.js";
-import { sanitizeBrowserUrl } from "../domain/browserObservation.js";
 import { createEvidence, } from "../domain/evidence.js";
-import { jsonValueSchema } from "../domain/jsonValue.js";
+import { jsonObjectSchema, jsonValueSchema } from "../domain/jsonValue.js";
 const browserScenarioParameters = (scenario) => ({
+    ...jsonObjectSchema.parse(scenario),
     scenario_sha256: canonicalDigest(scenario, "Browser scenario"),
-    browser_mode: scenario.browser.mode,
-    ...(scenario.browser.mode === "launch"
-        ? { browser_headless: scenario.browser.headless }
-        : {}),
-    start_url: sanitizeBrowserUrl(scenario.start_url.url),
-    environment: scenario.environment,
-    actions: scenario.actions.map(({ step_id, action }) => ({
-        step_id,
-        action,
-    })),
-    action_timeouts_ms: scenario.actions.map((item) => "timeout_ms" in item ? (item.timeout_ms ?? null) : null),
-    secret_declarations: scenario.secrets.map(({ secret_id, environment_variable }) => ({
-        secret_id,
-        environment_variable,
-    })),
-    capture: scenario.capture,
 });
 /** Create Evidence without retaining resolved scenario secret values. */
 export const createBrowserScenarioEvidence = (scenario, capture, provider) => createEvidence(undefined, provider, {