rea-agents 6.1.0 → 6.2.0

package/dist/dotnet/ManagedNativeBoundaryHelpers.js

@@ -2,62 +2,69 @@ import { managedNativeBoundaryInspectionSchema, } from "../domain/managed/manage
 import {} from "./ManagedMetadataLayout.js";
 import { metadataRowCursor, metadataCodedToken, metadataCodedTokenInvalidReason, metadataToken, readMetadataString, } from "./ManagedMetadataHeaps.js";
 import { managedTableRowCounts } from "./ManagedMetadataInventory.js";
+import { readManagedValue } from "./ManagedReaderFailure.js";
 const flagsHex = (value) => `0x${value.toString(16).padStart(4, "0")}`;
-export const parseModuleRefs = (bytes, layout, heapExtent) => {
+export const parseModuleRefs = (bytes, layout, heapExtent, issues) => {
     const refs = [];
     const table = layout.table(26);
     for (let row = 1; row <= (table?.rowCount ?? 0); row += 1) {
-        const cursor = metadataRowCursor(bytes, layout, 26, row);
-        refs.push({
-            token: metadataToken(26, row),
-            row_offset: cursor.start,
-            name: readMetadataString(bytes, layout, cursor.readIndex(layout.stringIndexSize), heapExtent),
-        });
+        readManagedValue(() => {
+            const cursor = metadataRowCursor(bytes, layout, 26, row);
+            refs.push({
+                token: metadataToken(26, row),
+                row_offset: cursor.start,
+                name: readMetadataString(bytes, layout, cursor.readIndex(layout.stringIndexSize), heapExtent),
+            });
+        }, issues);
     }
     return refs;
 };
-export const parseFields = (bytes, layout, heapExtent) => {
+export const parseFields = (bytes, layout, heapExtent, issues) => {
     const fields = new Map();
     const table = layout.table(4);
     for (let row = 1; row <= (table?.rowCount ?? 0); row += 1) {
-        const cursor = metadataRowCursor(bytes, layout, 4, row);
-        const flags = cursor.readUInt16();
-        const name = readMetadataString(bytes, layout, cursor.readIndex(layout.stringIndexSize), heapExtent);
-        cursor.readIndex(layout.blobIndexSize);
-        const token = metadataToken(4, row);
-        fields.set(token, {
-            token,
-            rowOffset: cursor.start,
-            kind: "field",
-            name,
-            flags,
-            implFlags: null,
-            rva: null,
-        });
+        readManagedValue(() => {
+            const cursor = metadataRowCursor(bytes, layout, 4, row);
+            const flags = cursor.readUInt16();
+            const name = readMetadataString(bytes, layout, cursor.readIndex(layout.stringIndexSize), heapExtent);
+            cursor.readIndex(layout.blobIndexSize);
+            const token = metadataToken(4, row);
+            fields.set(token, {
+                token,
+                rowOffset: cursor.start,
+                kind: "field",
+                name,
+                flags,
+                implFlags: null,
+                rva: null,
+            });
+        }, issues);
     }
     return fields;
 };
-export const parseMethods = (bytes, layout, heapExtent) => {
+export const parseMethods = (bytes, layout, heapExtent, issues) => {
     const methods = new Map();
     const table = layout.table(6);
     for (let row = 1; row <= (table?.rowCount ?? 0); row += 1) {
-        const cursor = metadataRowCursor(bytes, layout, 6, row);
-        const rva = cursor.readUInt32();
-        const implFlags = cursor.readUInt16();
-        const flags = cursor.readUInt16();
-        const name = readMetadataString(bytes, layout, cursor.readIndex(layout.stringIndexSize), heapExtent);
-        cursor.readIndex(layout.blobIndexSize);
-        cursor.readIndex(layout.tableIndexSize(8));
-        const token = metadataToken(6, row);
-        methods.set(token, {
-            token,
-            rowOffset: cursor.start,
-            kind: "method",
-            name,
-            flags,
-            implFlags,
-            rva,
-        });
+        readManagedValue(() => {
+            const cursor = metadataRowCursor(bytes, layout, 6, row);
+            const rva = cursor.readUInt32();
+            const implFlags = cursor.readUInt16();
+            const flags = cursor.readUInt16();
+            const name = readMetadataString(bytes, layout, cursor.readIndex(layout.stringIndexSize), heapExtent);
+            cursor.readIndex(layout.blobIndexSize);
+            cursor.readIndex(layout.tableIndexSize(8));
+            const token = metadataToken(6, row);
+            methods.set(token, {
+                token,
+                rowOffset: cursor.start,
+                kind: "method",
+                name,
+                flags,
+                implFlags,
+                rva,
+            });
+        }, issues);
     }
     return methods;
 };
@@ -66,46 +73,60 @@ export const parseImplMaps = ({ bytes, layout, heapExtent, modules, members, iss
     const imports = [];
     const table = layout.table(28);
     for (let row = 1; row <= (table?.rowCount ?? 0); row += 1) {
-        const cursor = metadataRowCursor(bytes, layout, 28, row);
-        const mappingFlags = cursor.readUInt16();
-        const memberForwardedOffset = cursor.offset;
-        const memberForwardedRaw = cursor.readIndex(layout.codedIndexSize("MemberForwarded"));
-        const memberForwardedReason = metadataCodedTokenInvalidReason(memberForwardedRaw, 1, [4, 6], layout.rowCounts);
-        if (memberForwardedReason !== null || memberForwardedRaw === 0)
-            issues.push({
-                code: "invalid-row",
-                scope: `metadata.ImplMap:${metadataToken(28, row)}`,
-                offset: memberForwardedOffset,
-                detail: memberForwardedReason === null
-                    ? "ImplMap MemberForwarded coded index 0x0 is null, but the column must reference a Field or MethodDef row"
-                    : `ImplMap MemberForwarded coded index 0x${memberForwardedRaw.toString(16)} is invalid: ${memberForwardedReason}`,
+        readManagedValue(() => {
+            const cursor = metadataRowCursor(bytes, layout, 28, row);
+            const mappingFlags = cursor.readUInt16();
+            const memberForwardedOffset = cursor.offset;
+            const memberForwardedRaw = cursor.readIndex(layout.codedIndexSize("MemberForwarded"));
+            const memberForwardedReason = metadataCodedTokenInvalidReason(memberForwardedRaw, 1, [4, 6], layout.rowCounts);
+            if (memberForwardedReason !== null || memberForwardedRaw === 0)
+                issues.push({
+                    code: "invalid-row",
+                    scope: `metadata.ImplMap:${metadataToken(28, row)}`,
+                    offset: memberForwardedOffset,
+                    detail: memberForwardedReason === null
+                        ? "ImplMap MemberForwarded coded index 0x0 is null, but the column must reference a Field or MethodDef row"
+                        : `ImplMap MemberForwarded coded index 0x${memberForwardedRaw.toString(16)} is invalid: ${memberForwardedReason}`,
+                });
+            const memberToken = metadataCodedToken(memberForwardedRaw, 1, [4, 6], layout.rowCounts);
+            const importName = readMetadataString(bytes, layout, cursor.readIndex(layout.stringIndexSize), heapExtent);
+            const importScopeOffset = cursor.offset;
+            const importScopeRow = cursor.readIndex(layout.tableIndexSize(26));
+            const moduleCount = layout.table(26)?.rowCount ?? 0;
+            const validImportScope = importScopeRow > 0 && importScopeRow <= moduleCount;
+            if (!validImportScope)
+                issues.push({
+                    code: "invalid-row",
+                    scope: `metadata.ImplMap:${metadataToken(28, row)}`,
+                    offset: importScopeOffset,
+                    detail: `ImplMap ImportScope row ${String(importScopeRow)} must reference a ModuleRef row between 1 and ${String(moduleCount)}`,
+                });
+            const importScopeToken = validImportScope
+                ? metadataToken(26, importScopeRow)
+                : null;
+            const member = memberToken === null ? undefined : members.get(memberToken);
+            imports.push({
+                token: metadataToken(28, row),
+                row_offset: cursor.start,
+                mapping_flags: mappingFlags,
+                mapping_flags_hex: flagsHex(mappingFlags),
+                member_token: memberToken,
+                member_kind: member?.kind ?? "unknown",
+                member_name: member?.name ?? null,
+                import_name: importName,
+                import_scope_token: importScopeToken,
+                import_scope_name: importScopeToken === null
+                    ? null
+                    : (moduleNames.get(importScopeToken)?.name ?? null),
+                no_mangle: (mappingFlags & 0x0001) !== 0,
+                char_set: charSet(mappingFlags),
+                call_convention: callConvention(mappingFlags),
+                supports_last_error: (mappingFlags & 0x0040) !== 0,
+                best_fit: bestFit(mappingFlags),
+                throw_on_unmappable_char: throwOnUnmappable(mappingFlags),
+                verification: "managed-declaration-only",
             });
-        const memberToken = metadataCodedToken(memberForwardedRaw, 1, [4, 6], layout.rowCounts);
-        const importName = readMetadataString(bytes, layout, cursor.readIndex(layout.stringIndexSize), heapExtent);
-        const importScopeRow = cursor.readIndex(layout.tableIndexSize(26));
-        const importScopeToken = importScopeRow === 0 ? null : metadataToken(26, importScopeRow);
-        const member = memberToken === null ? undefined : members.get(memberToken);
-        imports.push({
-            token: metadataToken(28, row),
-            row_offset: cursor.start,
-            mapping_flags: mappingFlags,
-            mapping_flags_hex: flagsHex(mappingFlags),
-            member_token: memberToken,
-            member_kind: member?.kind ?? "unknown",
-            member_name: member?.name ?? null,
-            import_name: importName,
-            import_scope_token: importScopeToken,
-            import_scope_name: importScopeToken === null
-                ? null
-                : (moduleNames.get(importScopeToken)?.name ?? null),
-            no_mangle: (mappingFlags & 0x0001) !== 0,
-            char_set: charSet(mappingFlags),
-            call_convention: callConvention(mappingFlags),
-            supports_last_error: (mappingFlags & 0x0040) !== 0,
-            best_fit: bestFit(mappingFlags),
-            throw_on_unmappable_char: throwOnUnmappable(mappingFlags),
-            verification: "managed-declaration-only",
-        });
+        }, issues);
     }
     return imports;
 };
@@ -168,6 +189,8 @@ const throwOnUnmappable = (flags) => {
 export const nativeImplementations = (methods, pinvokeTokens) => {
     const implementations = [];
     for (const method of methods) {
+        if (method.kind !== "method")
+            continue;
         const implFlags = method.implFlags ?? 0;
         const codeType = codeTypeFor(implFlags);
         const managedKind = managedKindFor(implFlags);
@@ -229,19 +252,9 @@ const boundaryKind = (pinvokeDeclared, codeType, managedKind) => {
         return "unmanaged-method";
     return "mixed-or-unknown";
 };
-/** CLI header facets of a PE without an admitted CLI header. */
-export const NO_CLI_NATIVE = {
-    il_only: false,
-    requires_32bit: false,
-    strong_name_signed: false,
-    native_entry_point: false,
-    ready_to_run_signature: false,
-    managed_native_header_rva: 0,
-    managed_native_header_size: 0,
-};
 export const cliNative = (pe) => {
     if (pe.cli === null)
-        return NO_CLI_NATIVE;
+        return null;
     return {
         il_only: (pe.cli.flags & 0x0000_0001) !== 0,
         requires_32bit: (pe.cli.flags & 0x0000_0002) !== 0,
@@ -255,10 +268,12 @@ export const cliNative = (pe) => {
 /** Summarize declaration counts with the native facets of the CLI header. */
 export const nativeBoundarySummary = (native, counts) => ({
     ...counts,
-    ready_to_run: native.ready_to_run_signature,
-    mixed_mode_or_native_header: native.managed_native_header_rva !== 0 ||
-        native.managed_native_header_size !== 0 ||
-        native.native_entry_point,
+    ready_to_run: native?.ready_to_run_signature ?? null,
+    mixed_mode_or_native_header: native === null
+        ? null
+        : native.managed_native_header_rva !== 0 ||
+            native.managed_native_header_size !== 0 ||
+            native.native_entry_point,
 });
 export const buildNativeBoundaryInspection = ({ target, bytes, layout, inventory, moduleRefs, imports, implementations, native, issues, }) => managedNativeBoundaryInspectionSchema.parse({
     artifact: {

package/dist/dotnet/ManagedNativeBoundaryInspector.js

@@ -1,16 +1,15 @@
 import { managedNativeBoundaryInspectionSchema, } from "../domain/managed/managedArtifact.js";
-import { readManagedMetadataInventory, } from "./ManagedMetadataInventory.js";
+import { readManagedMetadataInventory, readManagedResourceDirectory, } from "./ManagedMetadataInventory.js";
 import { readManagedMetadataLayout, } from "./ManagedMetadataLayout.js";
 import { readManagedPeLayout, } from "./ManagedPeReader.js";
 import { ManagedReaderFailure } from "./ManagedReaderFailure.js";
-import { buildNativeBoundaryInspection, cliNative, NO_CLI_NATIVE, nativeBoundarySummary, nativeImplementations, parseFields, parseImplMaps, parseMethods, parseModuleRefs, } from "./ManagedNativeBoundaryHelpers.js";
+import { buildNativeBoundaryInspection, cliNative, nativeBoundarySummary, nativeImplementations, parseFields, parseImplMaps, parseMethods, parseModuleRefs, } from "./ManagedNativeBoundaryHelpers.js";
 /**
  * Report a PE whose CLI metadata is absent or cannot be admitted. `native`
  * holds the CLI header facts when the header itself was admitted; otherwise
  * the header is absent (`not-managed`) or unreadable (`malformed`).
  */
 const emptyInspection = (target, bytes, classification, { native = null, issues = [], } = {}) => {
-    const header = native ?? NO_CLI_NATIVE;
     return managedNativeBoundaryInspectionSchema.parse({
         artifact: {
             path: target.path,
@@ -29,11 +28,11 @@ const emptyInspection = (target, bytes, classification, { native = null, issues
             requires_artifact_sha256: target.sha256,
             requires_mvid: null,
         },
-        cli_native: header,
+        cli_native: native,
         module_refs: [],
         pinvoke_imports: [],
         native_implementations: [],
-        summary: nativeBoundarySummary(header, {
+        summary: nativeBoundarySummary(native, {
             module_ref_count: 0,
             pinvoke_import_count: 0,
             native_implementation_count: 0,
@@ -41,23 +40,14 @@ const emptyInspection = (target, bytes, classification, { native = null, issues
         coverage: { state: "unavailable", issues },
         limitations: [
             "No CLI metadata was admitted; native boundary declarations are unavailable.",
-            ...(native === null && classification === "malformed"
-                ? [
-                    "The CLI header was not admitted, so cli_native and the summary's ready_to_run and mixed_mode_or_native_header values are defaults, not observations.",
-                ]
-                : []),
             "Static inspection does not load or execute target code, so native export resolution is not performed.",
         ],
     });
 };
-const readBoundaryInventory = (bytes, pe, cli) => {
+const readBoundaryInventory = (bytes, pe, cli, issues) => {
     const metadataOffset = pe.rvaToOffset(cli.metadata.rva, cli.metadata.size, "cli.metadata");
     const layout = readManagedMetadataLayout(bytes, metadataOffset, cli.metadata.size);
-    const resourceDirectory = {
-        offset: pe.rvaToOffset(cli.resources.rva, cli.resources.size, "cli.resources"),
-        size: cli.resources.size,
-    };
-    const inventory = readManagedMetadataInventory(bytes, layout, resourceDirectory);
+    const inventory = readManagedMetadataInventory(bytes, layout, readManagedResourceDirectory(pe, issues));
     return { layout, inventory };
 };
 /** Inspect managed/native boundary declarations from PE metadata without execution. */
@@ -75,10 +65,11 @@ export const inspectManagedNativeBoundariesBytes = (bytes, target) => {
     }
     if (pe.cli === null)
         return emptyInspection(target, bytes, pe.cliDirectoryPresent ? "malformed" : "not-managed", { issues: pe.cliIssue === null ? [] : [pe.cliIssue] });
+    const issues = [];
     let layout;
     let inventory;
     try {
-        ({ layout, inventory } = readBoundaryInventory(bytes, pe, pe.cli));
+        ({ layout, inventory } = readBoundaryInventory(bytes, pe, pe.cli, issues));
     }
     catch (cause) {
         if (!(cause instanceof ManagedReaderFailure))
@@ -89,11 +80,11 @@ export const inspectManagedNativeBoundariesBytes = (bytes, target) => {
         });
     }
     const heapExtent = Math.max(layout.strings.size, layout.blob.size);
-    const issues = [...inventory.issues];
-    const moduleRefs = parseModuleRefs(bytes, layout, heapExtent);
+    issues.push(...inventory.issues);
+    const moduleRefs = parseModuleRefs(bytes, layout, heapExtent, issues);
     const members = new Map([
-        ...parseFields(bytes, layout, heapExtent),
-        ...parseMethods(bytes, layout, heapExtent),
+        ...parseFields(bytes, layout, heapExtent, issues),
+        ...parseMethods(bytes, layout, heapExtent, issues),
     ]);
     const imports = parseImplMaps({
         bytes,

package/dist/dotnet/ManagedReaderFailure.js

@@ -8,3 +8,19 @@ export class ManagedReaderFailure extends Error {
 }
 /** Construct a typed managed parse failure at an exact byte location. */
 export const managedFailure = (code, scope, detail, offset = null) => new ManagedReaderFailure({ code, scope, offset, detail });
+/** Retain one malformed item's location while allowing independent items to be read. */
+export const readManagedValue = (operation, issues) => {
+    try {
+        return operation();
+    }
+    catch (cause) {
+        if (!(cause instanceof ManagedReaderFailure))
+            throw cause;
+        issues.push(cause.issue);
+        return undefined;
+    }
+};
+/** Preserve issue order while collapsing the same malformed producer fact across facets. */
+export const uniqueManagedParseIssues = (issues) => [
+    ...new Map(issues.map((issue) => [JSON.stringify(issue), issue])).values(),
+];

package/dist/dotnet/ManagedStaticProvider.js

@@ -3,7 +3,7 @@ import { createReadStream } from "node:fs";
 import { readFile } from "node:fs/promises";
 import { createAnalysisExecution, } from "../application/AnalysisProvider.js";
 import { MANAGED_STATIC_PROVIDER_IDENTITY as IDENTITY, managedStaticCapabilities, } from "./ManagedStaticProviderMetadata.js";
-import { MANAGED_TOOL_CONTRACTS, managedArtifactInputSchema, managedMemberInputSchema, managedNativeBoundaryInputSchema, } from "../contracts/managed/managedToolContracts.js";
+import { MANAGED_TOOL_CONTRACTS, managedTargetInputSchema, } from "../contracts/managed/managedToolContracts.js";
 import { AnalysisCancelledError, AnalysisCapabilityUnavailableError, } from "../domain/analysisErrorCore.js";
 import { EvidenceIntegrityError } from "../domain/evidenceErrors.js";
 import { ProviderAdapterError } from "../domain/providerAdapterError.js";
@@ -66,7 +66,7 @@ class ManagedStaticClient {
     }
     close() {
         this.#snapshotBytes = undefined;
-        return Promise.resolve();
+        return Promise.resolve(ok(null));
     }
 }
 const readManagedSnapshot = async (path, signal) => {
@@ -93,15 +93,13 @@ const hashManagedSource = async (path, signal) => {
 };
 const isManagedOperation = (operation) => MANAGED_TOOL_CONTRACTS.some(({ name }) => name === operation);
 const inspectManagedOperation = (operation, parameters, bytes, target) => {
+    managedTargetInputSchema.parse(parameters);
     if (operation === "inspect_managed_artifact") {
-        managedArtifactInputSchema.parse(parameters);
         return inspectManagedArtifactBytes(bytes, target);
     }
     if (operation === "inspect_managed_native_boundaries") {
-        managedNativeBoundaryInputSchema.parse(parameters);
         return inspectManagedNativeBoundariesBytes(bytes, target);
     }
-    managedMemberInputSchema.parse(parameters);
     return inspectManagedMembersBytes(bytes, target);
 };
 const managedLocations = (result) => {

package/dist/evaluation/AgentEvaluationFixtures.js

@@ -0,0 +1,250 @@
+import { createHash } from "node:crypto";
+import { cp, mkdir, readFile, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { createPackage } from "@electron/asar";
+import { javascriptApplicationAnalysisResultSchema } from "../domain/javascript/javascriptApplicationAnalysis.js";
+import { javaScriptExportShapeComparisonResultSchema } from "../domain/javascript/javascriptExportShapeComparisonSchemas.js";
+const desktopFixtureFiles = {
+    "package.json": `${JSON.stringify({ name: "desktop-fixture", version: "1.0.0", main: "main.js" }, null, 2)}\n`,
+    "main.js": 'const { BrowserWindow, ipcMain } = require("electron");\nnew BrowserWindow({ webPreferences: { preload: require("node:path").join(__dirname, "preload.js"), contextIsolation: true, sandbox: true } });\nipcMain.handle("profile:read", (_event, id) => ({ id }));\n',
+    "preload.js": 'const { contextBridge, ipcRenderer } = require("electron");\ncontextBridge.exposeInMainWorld("profileApi", { read: (id) => ipcRenderer.invoke("profile:read", id) });\n',
+    "renderer/app.js": 'globalThis.profileApi.read("fixture");\n',
+};
+/** Materialize the exact packaged and source-owned parser targets used by the runner. */
+export const createAgentEvaluationFixtures = async (root, repositoryRoot) => {
+    const desktop = join(root, "desktop-app");
+    const javascript = join(root, "desktop-app.asar");
+    const javascriptShapeLeft = join(root, "parser-v1");
+    const javascriptShapeRight = join(root, "parser-v2");
+    await Promise.all([
+        mkdir(join(desktop, "renderer"), { recursive: true }),
+        mkdir(javascriptShapeLeft, { recursive: true }),
+        mkdir(javascriptShapeRight, { recursive: true }),
+    ]);
+    await Promise.all([
+        ...Object.entries(desktopFixtureFiles).map(([path, source]) => writeFile(join(desktop, path), source)),
+        cp(join(repositoryRoot, "tests/fixtures/replay/parser.mjs"), join(javascriptShapeLeft, "parser.mjs")),
+        cp(join(repositoryRoot, "tests/fixtures/replay/parser-v2.mjs"), join(javascriptShapeRight, "parser.mjs")),
+    ]);
+    await createPackage(desktop, javascript);
+    return {
+        javascript,
+        javascriptSha256: createHash("sha256")
+            .update(await readFile(javascript))
+            .digest("hex"),
+        javascriptShapeLeft,
+        javascriptShapeRight,
+    };
+};
+const singleObservation = (value, kind, include = () => true) => {
+    const result = javascriptApplicationAnalysisResultSchema.safeParse(value);
+    if (!result.success)
+        return undefined;
+    const candidates = result.data.graph.nodes
+        .filter((node) => node.kind === kind)
+        .flatMap((node) => node.observations)
+        .filter(include);
+    return candidates.length === 1 ? candidates[0] : undefined;
+};
+const observationSource = (observation) => {
+    const location = observation.evidence.location;
+    return location.available && location.value.kind === "source-range"
+        ? location.value.source
+        : undefined;
+};
+const rendererApi = (value) => {
+    const observation = singleObservation(value, "context-bridge-api");
+    if (observation === undefined)
+        return undefined;
+    const { api_key: key, members, world } = observation.properties;
+    const source = observationSource(observation);
+    if (key === undefined ||
+        members === undefined ||
+        world === undefined ||
+        source === undefined)
+        return undefined;
+    return { key, members, world, source };
+};
+const ipcOperation = (side) => (value) => {
+    const observation = singleObservation(value, "ipc-channel", (candidate) => candidate.properties.side === side);
+    if (observation === undefined)
+        return undefined;
+    const { channel, operation } = observation.properties;
+    const source = observationSource(observation);
+    if (channel === undefined ||
+        operation === undefined ||
+        source === undefined)
+        return undefined;
+    return { channel, operation, source };
+};
+const preload = (value) => {
+    const observation = singleObservation(value, "electron-preload", (candidate) => candidate.properties.mechanism === "BrowserWindow:webPreferences.preload");
+    const path = observation?.properties.resolved_path;
+    const resolutionStatus = observation?.properties.resolution_status;
+    if (path === undefined || resolutionStatus === undefined)
+        return undefined;
+    return { path, resolution_status: resolutionStatus };
+};
+const headingChange = (value) => {
+    const result = javaScriptExportShapeComparisonResultSchema.safeParse(value);
+    if (!result.success)
+        return undefined;
+    const changes = result.data.changes.filter((change) => change.path === "/depth");
+    const change = changes.length === 1 ? changes[0] : undefined;
+    if (change === undefined)
+        return undefined;
+    return {
+        status: change.status,
+        path: change.path,
+        discriminant: change.discriminant,
+        left: change.left,
+        right: change.right,
+    };
+};
+const comparisonCoverage = (value) => {
+    const result = javaScriptExportShapeComparisonResultSchema.safeParse(value);
+    if (!result.success)
+        return undefined;
+    return {
+        status: result.data.coverage.status,
+        paired_variants: result.data.coverage.paired_variants,
+        ...result.data.summary,
+    };
+};
+const runtimeSemantics = (value) => {
+    const result = javaScriptExportShapeComparisonResultSchema.safeParse(value);
+    return result.success &&
+        result.data.limitations.includes("Return shapes are inferred from inert syntax and do not prove runtime behavior.")
+        ? "not_established"
+        : undefined;
+};
+const asarClaims = (targets) => {
+    const source = {
+        operation: "analyze_javascript_application",
+        authority: "shipped-artifact",
+        confidence: "derived",
+        subject: { path: targets.javascript, sha256: targets.javascriptSha256 },
+    };
+    return [
+        {
+            id: "renderer_api",
+            expectedValue: {
+                key: "profileApi",
+                members: ["read"],
+                world: "main",
+                source: "preload.js",
+            },
+            source: { ...source, select: rendererApi },
+        },
+        {
+            id: "renderer_ipc",
+            expectedValue: {
+                channel: "profile:read",
+                operation: "invoke",
+                source: "preload.js",
+            },
+            source: { ...source, select: ipcOperation("renderer") },
+        },
+        {
+            id: "main_ipc",
+            expectedValue: {
+                channel: "profile:read",
+                operation: "handle",
+                source: "main.js",
+            },
+            source: { ...source, select: ipcOperation("main") },
+        },
+        {
+            id: "preload",
+            expectedValue: { path: "preload.js", resolution_status: "resolved" },
+            source: { ...source, select: preload },
+        },
+    ];
+};
+const parserClaims = (targets) => {
+    const source = {
+        operation: "compare_javascript_export_shapes",
+        authority: "analyst-inference",
+        confidence: "inferred",
+        parameters: {
+            left_module_path: "parser.mjs",
+            left_export_name: "default",
+            right_module_path: "parser.mjs",
+            right_export_name: "default",
+        },
+        linkedSubjects: [
+            {
+                operation: "analyze_javascript_application",
+                path: targets.javascriptShapeLeft,
+            },
+            {
+                operation: "analyze_javascript_application",
+                path: targets.javascriptShapeRight,
+            },
+        ],
+    };
+    return [
+        {
+            id: "heading_change",
+            expectedValue: {
+                status: "added",
+                path: "/depth",
+                discriminant: { path: "/type", value: "heading" },
+                left: { availability: "absent" },
+                right: { availability: "literal", value: 1 },
+            },
+            source: { ...source, select: headingChange },
+        },
+        {
+            id: "comparison_coverage",
+            expectedValue: {
+                status: "complete-within-inputs",
+                paired_variants: 3,
+                added: 1,
+                removed: 0,
+                changed: 0,
+                unknown: 0,
+            },
+            source: { ...source, select: comparisonCoverage },
+        },
+        {
+            id: "runtime_semantics",
+            expectedValue: "not_established",
+            source: { ...source, select: runtimeSemantics },
+        },
+    ];
+};
+/** Return the closed known-answer rubric, or undefined for routing-only scenarios. */
+export const agentFixtureClaims = (scenarioId, targets) => {
+    if (scenarioId === "asar")
+        return asarClaims(targets);
+    if (scenarioId === "javascript-export-shape")
+        return parserClaims(targets);
+    return undefined;
+};
+const answerValueDescriptions = {
+    asar: [
+        'renderer_api: {"key": string, "members": string[], "world": string, "source": string}, describing the exposed bridge API, its members, world, and source file.',
+        'renderer_ipc: {"channel": string, "operation": string, "source": string}, describing the renderer-side IPC operation and its source file.',
+        'main_ipc: {"channel": string, "operation": string, "source": string}, describing the main-side IPC operation and its source file.',
+        'preload: {"path": string, "resolution_status": string}, describing the BrowserWindow-declared preload resolved within the shipped artifact.',
+    ],
+    "javascript-export-shape": [
+        'heading_change: {"status": string, "path": string, "discriminant": object or null, "left": object, "right": object}, copying the exact heading-change fields from the comparison result.',
+        'comparison_coverage: {"status": string, "paired_variants": number, "added": number, "removed": number, "changed": number, "unknown": number}, copying comparison coverage and summary counts.',
+        'runtime_semantics: "established" or "not_established", stating whether the cited comparison establishes runtime behavior.',
+    ],
+};
+/** Describe the strict answer contract without revealing any golden fixture values. */
+export const agentFixtureAnswerInstructions = (scenarioId) => {
+    const descriptions = answerValueDescriptions[scenarioId];
+    if (descriptions === undefined)
+        return "";
+    return [
+        "For this benchmark, return only one JSON object, without Markdown fences or surrounding prose.",
+        'The exact shape is {"claims": [{"id": string, "value": JSON value, "evidence_id": string, "confidence": string, "authority": string}]}.',
+        "Include exactly one claim per ID below, without additional fields or claims. Infer values only from REA tool results; do not read target files directly.",
+        "Each evidence_id must identify the successful REA result that supports its claim. Copy confidence and authority from that result's Evidence envelope.",
+        ...descriptions,
+    ].join("\n");
+};