rea-agents 6.2.0 → 6.3.0

package/dist/artifacts/inventory/scanReader.js

@@ -7,7 +7,7 @@ import { STRICT_INTEGRITY_POLICY, } from "./types.js";
 import { hashReadable } from "../ArtifactHash.js";
 const UNAVAILABLE_UNPACKED_LIMITATION = "ASAR unpacked companion bytes were unavailable; no content hash or child artifact was produced.";
 const emptyScan = () => ({ nodes: new Map(), occurrences: [], pendingContradictions: [] });
-export const scanReader = async (reader, signal, integrity = STRICT_INTEGRITY_POLICY) => {
+export const scanReader = async (reader, ownedReaders, signal, integrity = STRICT_INTEGRITY_POLICY) => {
     const { nodes, occurrences, pendingContradictions } = emptyScan();
     if (reader === undefined)
         return { nodes, occurrences, pendingContradictions };
@@ -21,6 +21,7 @@ export const scanReader = async (reader, signal, integrity = STRICT_INTEGRITY_PO
         occurrenceByPath: new Map(),
         registry: new ArtifactPathRegistry(),
         expandedContainerIds: new Set(),
+        ownedReaders,
     };
     await visitArtifactEntries(context, reader, "");
     // Archive directories may appear after their children. Resolve containment
@@ -36,7 +37,6 @@ const visitArtifactEntries = async (context, currentReader, prefix) => {
             reader: currentReader,
             prefix,
             iterator: currentReader.entries(context.signal)[Symbol.asyncIterator](),
-            owned: false,
         },
     ];
     try {
@@ -47,8 +47,6 @@ const visitArtifactEntries = async (context, currentReader, prefix) => {
             const next = await frame.iterator.next();
             if (next.done) {
                 stack.pop();
-                if (frame.owned)
-                    await frame.reader.close();
                 continue;
             }
             const entry = next.value;
@@ -81,26 +79,24 @@ const visitArtifactEntries = async (context, currentReader, prefix) => {
             }
             context.occurrences.push(occurrence);
             context.occurrenceByPath.set(logicalPath, occurrence);
-            if (expandableAsar && digested?.mismatched !== true) {
+            if (expandableAsar && digested !== undefined && !digested.mismatched) {
                 const nested = new AsarArtifactReader(entry.adapterKey);
+                context.ownedReaders.push(nested);
+                await nested.prepareContainer(digested.node.sha256, context.signal);
                 // Only traversed containers can own members, not opaque ASAR-named files.
                 context.expandedContainerIds.add(occurrence.occurrence_id);
                 stack.push({
                     reader: nested,
                     prefix: logicalPath,
                     iterator: nested.entries(context.signal)[Symbol.asyncIterator](),
-                    owned: true,
                 });
             }
         }
     }
     finally {
-        await Promise.allSettled(stack
-            .filter(({ owned }) => owned)
-            .map(async ({ reader, iterator }) => {
+        // Readers remain owned by the inventory until its complete observation is built.
+        for (const { iterator } of stack)
             await iterator.return?.();
-            await reader.close();
-        }));
     }
 };
 const digestArtifactEntry = async (context, currentReader, entry, logicalPath) => {

package/dist/artifacts/javascript/JavaScriptArtifactFiles.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { isAbsolute } from "node:path";
-import { compareCodePoints } from "../../domain/canonicalOrdering.js";
+import { compareUnicodeCodePoints } from "../../domain/unicodeCodePointOrder.js";
 import { AsarArtifactReader } from "../AsarArtifactReader.js";
 import { ArtifactPathRegistry, normalizeArtifactPath, } from "../ArtifactPaths.js";
 import { ArtifactReaderFailure, } from "../ArtifactReader.js";
@@ -12,7 +12,7 @@ export const readJavaScriptArtifactFiles = async (reader, snapshot, signal) => {
         const root = snapshot.nodes.find(({ artifact_id }) => artifact_id === snapshot.manifest.root_artifact_id);
         if (root === undefined)
             throw new ArtifactReaderFailure("integrity", "Root artifact node is missing");
-        await verifyEntryBytes(reader.openContainer(signal), { path: ".", sha256: root.sha256, bytes: root.size }, signal);
+        await verifyEntryBytes(await reader.openContainer(signal), { path: ".", sha256: root.sha256, bytes: root.size }, signal);
     }
     const inventory = expectedInventory(snapshot);
     const expected = inventory.files;
@@ -27,11 +27,11 @@ export const readJavaScriptArtifactFiles = async (reader, snapshot, signal) => {
         invalidUtf8: 0,
     };
     await visitReader(reader, "", snapshot.manifest.root_sha256, context);
-    const files = context.files.sort((left, right) => compareCodePoints(left.path, right.path));
+    const files = context.files.sort((left, right) => compareUnicodeCodePoints(left.path, right.path));
     assertExpectedFilesWereVisited(expected, files);
     return {
         files,
-        containers: context.containers.sort((left, right) => compareCodePoints(left.path, right.path)),
+        containers: context.containers.sort((left, right) => compareUnicodeCodePoints(left.path, right.path)),
         text_bytes_read: context.textBytes,
         invalid_utf8_files: context.invalidUtf8,
     };
@@ -43,9 +43,10 @@ const visitReader = async (reader, prefix, containerSha256, context) => {
             prefix,
             containerSha256,
             iterator: reader.entries(context.signal)[Symbol.asyncIterator](),
-            owned: false,
         },
     ];
+    const ownedReaders = [];
+    let failure;
     try {
         while (stack.length > 0) {
             const frame = stack.at(-1);
@@ -54,8 +55,6 @@ const visitReader = async (reader, prefix, containerSha256, context) => {
             const next = await frame.iterator.next();
             if (next.done) {
                 stack.pop();
-                if (frame.owned)
-                    await frame.reader.close();
                 continue;
             }
             const entry = next.value;
@@ -64,17 +63,32 @@ const visitReader = async (reader, prefix, containerSha256, context) => {
             const nestedAsar = isFilesystemAsar(entry, path);
             context.registry.add(path, nestedAsar ? "directory" : entry.kind);
             if (nestedAsar) {
-                const inventory = expectedContainer(path, context);
+                const container = context.expectedContainers.get(path);
+                // Inventory deliberately does not expand unverified or unavailable
+                // nested archives. Keep the same boundary here when reconstruction
+                // reads the active entries again.
+                if (container === undefined)
+                    throw new ArtifactReaderFailure("integrity", `Nested ASAR was not present in inventory: ${path}`);
+                if (container.hash_status === "mismatched")
+                    continue;
+                if (container.hash_status === "unavailable")
+                    throw new ArtifactReaderFailure("unavailable", `Nested ASAR bytes were unavailable during inventory: ${path}`);
+                if (container.hash_status !== "verified")
+                    throw new ArtifactReaderFailure("integrity", `Nested ASAR was not integrity-verified: ${path}`);
+                const inventory = container.inventory;
+                if (inventory === null)
+                    throw new ArtifactReaderFailure("integrity", `Verified nested ASAR has no inventory node: ${path}`);
                 await verifyEntryBytes(await frame.reader.open(entry, context.signal), inventory, context.signal);
                 context.containers.push(inventory);
                 const nested = new AsarArtifactReader(entry.adapterKey);
+                ownedReaders.push(nested);
                 stack.push({
                     reader: nested,
                     prefix: path,
                     containerSha256: inventory.sha256,
                     iterator: nested.entries(context.signal)[Symbol.asyncIterator](),
-                    owned: true,
                 });
+                await nested.prepareContainer(inventory.sha256, context.signal);
                 continue;
             }
             const expected = context.expected.get(path);
@@ -97,20 +111,31 @@ const visitReader = async (reader, prefix, containerSha256, context) => {
             });
         }
     }
+    catch (cause) {
+        failure = { cause };
+    }
     finally {
-        await Promise.allSettled(stack
-            .filter(({ owned }) => owned)
-            .map(async ({ reader, iterator }) => {
-            await iterator.return?.();
-            await reader.close();
-        }));
+        for (const { iterator } of stack) {
+            try {
+                await iterator.return?.();
+            }
+            catch (cause) {
+                failure ??= { cause };
+            }
+        }
+        for (const owned of ownedReaders.reverse()) {
+            try {
+                await owned.close();
+            }
+            catch (cause) {
+                failure = {
+                    cause: ArtifactReaderFailure.withCleanup(failure?.cause ?? cause, ArtifactReaderFailure.cleanupObservation(cause, `nested ASAR reader for ${prefix}`)),
+                };
+            }
+        }
     }
-};
-const expectedContainer = (path, context) => {
-    const container = context.expectedContainers.get(path);
-    if (container === undefined)
-        throw new ArtifactReaderFailure("integrity", `Nested ASAR disappeared from inventory: ${path}`);
-    return container;
+    if (failure !== undefined)
+        throw failure.cause;
 };
 const readText = async (context, input) => {
     if (input.expected.kind === "native-addon") {
@@ -155,8 +180,18 @@ const expectedInventory = (snapshot) => {
     const files = new Map();
     const containers = new Map();
     for (const occurrence of snapshot.occurrences) {
-        if (occurrence.artifact_id === null || occurrence.logical_path === ".")
+        if (occurrence.logical_path === ".")
             continue;
+        const isNestedAsar = occurrence.entry_kind === "file" &&
+            occurrence.logical_path.toLowerCase().endsWith(".asar");
+        if (occurrence.artifact_id === null) {
+            if (isNestedAsar)
+                containers.set(occurrence.logical_path, {
+                    hash_status: occurrence.hash_status,
+                    inventory: null,
+                });
+            continue;
+        }
         const node = nodes.get(occurrence.artifact_id);
         if (node === undefined)
             throw new ArtifactReaderFailure("integrity", `Artifact inventory node is missing: ${occurrence.logical_path}`);
@@ -165,12 +200,15 @@ const expectedInventory = (snapshot) => {
         // node_modules/@zip.js remains a graph node and must never be opened.
         if (occurrence.entry_kind !== "file")
             continue;
-        if (occurrence.logical_path.toLowerCase().endsWith(".asar"))
+        if (isNestedAsar)
             containers.set(occurrence.logical_path, {
-                path: occurrence.logical_path,
-                sha256: node.sha256,
-                bytes: node.size,
-                inventory_artifact_id: node.artifact_id,
+                hash_status: occurrence.hash_status,
+                inventory: {
+                    path: occurrence.logical_path,
+                    sha256: node.sha256,
+                    bytes: node.size,
+                    inventory_artifact_id: node.artifact_id,
+                },
             });
         const kind = relevantKind(occurrence.logical_path);
         if (kind === undefined)

package/dist/browser/CdpBrowserProvider.js

@@ -21,12 +21,11 @@ import { discoverWebMcp } from "./CdpWebMcpDiscovery.js";
 import { captureCdpScreenshot } from "./CdpScreenshot.js";
 import { comparePngScreenshots } from "./PngVisualDiff.js";
 import { CDP_BROWSER_PROVIDER_IDENTITY } from "./providerIdentities.js";
-const IDENTITY = CDP_BROWSER_PROVIDER_IDENTITY;
 const CLEANUP_DOMAINS = ["Network", "Debugger", "Runtime", "Page"];
 /** Passive browser observation through a selected user-owned CDP endpoint. */
 export class CdpBrowserProvider {
     identity() {
-        return IDENTITY;
+        return CDP_BROWSER_PROVIDER_IDENTITY;
     }
     async listTargets(input, options = {}) {
         try {
@@ -262,4 +261,6 @@ const providerError = (cause, operation) => cause instanceof BrowserObservationE
     ? new BrowserObservationError(operation, cause.reason, { cause })
     : cause instanceof AnalysisError
         ? cause
-        : new ProviderAdapterError(IDENTITY.id, operation, { cause });
+        : new ProviderAdapterError(CDP_BROWSER_PROVIDER_IDENTITY.id, operation, {
+            cause,
+        });

package/dist/browser/CdpCaptureStorageFingerprints.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import canonicalize from "canonicalize";
-import { compareCodePoints } from "../domain/canonicalOrdering.js";
+import { compareUnicodeCodePoints } from "../domain/unicodeCodePointOrder.js";
 import { CdpConnection } from "./CdpConnection.js";
 import { optionalCdpCommand } from "./CdpOptionalCommand.js";
 import { recordValue, recordsValue, cdpStringValue, } from "./CdpCaptureValues.js";
@@ -16,7 +16,7 @@ export const captureStorageFingerprints = async ({ context, origin, cookieUrl, l
     await addCookies(run, cookieUrl);
     await addIndexedDb(run, origin, indexedDbNames);
     await addCaches(run, caches);
-    state.items.sort((left, right) => compareCodePoints(`${left.scope}:${left.identity_sha256}`, `${right.scope}:${right.identity_sha256}`));
+    state.items.sort((left, right) => compareUnicodeCodePoints(`${left.scope}:${left.identity_sha256}`, `${right.scope}:${right.identity_sha256}`));
     const complete = state.complete && state.items.every(({ complete }) => complete);
     return { items: state.items, complete };
 };
@@ -282,7 +282,7 @@ const stableValue = (value) => {
         return String(value);
     return Object.fromEntries(Object.entries(record)
         .filter(([key]) => key !== "objectId" && key !== "customPreview")
-        .sort(([left], [right]) => compareCodePoints(left, right))
+        .sort(([left], [right]) => compareUnicodeCodePoints(left, right))
         .map(([key, item]) => [key, stableValue(item)]));
 };
 const stableValueComplete = (value) => {

package/dist/browser/CdpElectronInspection.js

@@ -1,4 +1,4 @@
-import { canonicalDigest } from "../domain/comparisonSemantics.js";
+import { digestCanonicalValue } from "../domain/canonicalDigest.js";
 import { BrowserObservationError } from "../domain/browserObservationError.js";
 import { CdpCaptureCompleteness } from "./CdpCaptureCompleteness.js";
 import { delayWithCancellation, numberValue, recordValue, recordsValue, requiredRecord, cdpStringValue, } from "./CdpCaptureValues.js";
@@ -176,7 +176,7 @@ const captureResources = async (context, completeness) => {
                     ? null
                     : Math.max(0, numberValue(resource.contentSize) ?? 0),
             };
-            const resourceKey = `electron_resource_${canonicalDigest(item, "CDP capture")}`;
+            const resourceKey = `electron_resource_${digestCanonicalValue(item, "CDP capture")}`;
             if (seen.has(resourceKey))
                 continue;
             seen.add(resourceKey);

package/dist/browser/CdpElectronProvider.js

@@ -9,11 +9,10 @@ import { closeCdpTargetSession, openCdpTargetSession, } from "./CdpTargetSession
 import { inspectCdpElectronPage } from "./CdpElectronInspection.js";
 import { authorizedElectronFile } from "./ElectronFileScope.js";
 import { CDP_ELECTRON_PROVIDER_IDENTITY } from "./providerIdentities.js";
-const IDENTITY = CDP_ELECTRON_PROVIDER_IDENTITY;
 /** Passive Electron provider for local file pages exposed by loopback CDP. */
 export class CdpElectronProvider {
     identity() {
-        return IDENTITY;
+        return CDP_ELECTRON_PROVIDER_IDENTITY;
     }
     async listTargets(input, options = {}) {
         try {
@@ -106,4 +105,6 @@ const providerError = (cause, operation) => cause instanceof BrowserObservationE
     ? new BrowserObservationError(operation, cause.reason, { cause })
     : cause instanceof AnalysisError
         ? cause
-        : new ProviderAdapterError(IDENTITY.id, operation, { cause });
+        : new ProviderAdapterError(CDP_ELECTRON_PROVIDER_IDENTITY.id, operation, {
+            cause,
+        });

package/dist/browser/CdpElectronScripts.js

@@ -1,4 +1,4 @@
-import { canonicalDigest } from "../domain/comparisonSemantics.js";
+import { digestCanonicalValue } from "../domain/canonicalDigest.js";
 import { createWebTextArtifact } from "../domain/webContentArtifact.js";
 import { CdpCaptureCompleteness } from "./CdpCaptureCompleteness.js";
 import { requiredScriptSource } from "./CdpCaptureValues.js";
@@ -27,7 +27,7 @@ export const captureElectronScripts = async (input) => {
             is_module: script.isModule,
             language: script.language,
         };
-        const scriptKey = `electron_script_${canonicalDigest(identity, "CDP capture")}`;
+        const scriptKey = `electron_script_${digestCanonicalValue(identity, "CDP capture")}`;
         if (seen.has(scriptKey))
             continue;
         seen.add(scriptKey);

package/dist/browser/CdpWebMcpDiscovery.js

@@ -1,5 +1,7 @@
 import { createHash } from "node:crypto";
-import { inferJsonShape } from "../domain/jsonShape.js";
+import { jsonValueSchema } from "../domain/jsonValue.js";
+import { digestCanonicalValue } from "../domain/canonicalDigest.js";
+import { compositeKey } from "../domain/unicodeCodePointOrder.js";
 import { CdpCaptureCompleteness } from "./CdpCaptureCompleteness.js";
 import { BrowserObservationError } from "../domain/browserObservationError.js";
 import { allowedSanitizedUrl, delayWithCancellation, numberValue, recordValue, recordsValue, cdpStringValue, } from "./CdpCaptureValues.js";
@@ -265,6 +267,10 @@ const normalizeTool = (value, input, frames, completeness) => {
     }
     const description = cdpStringValue(value.description) ?? "";
     const annotations = recordValue(value.annotations);
+    const declaration = jsonValueSchema.safeParse(value.inputSchema);
+    if (!declaration.success)
+        completeness.exclude("webmcp_tools", "invalid_protocol_value");
+    const schema = declaration.success ? declaration.data : null;
     return {
         tool_key: toolKey(frame.url, frameId, name),
         name,
@@ -275,7 +281,10 @@ const normalizeTool = (value, input, frames, completeness) => {
         declaration_kind: numberValue(value.backendNodeId) === undefined
             ? "imperative"
             : "declarative",
-        input_schema_shape: schemaShape(value.inputSchema),
+        input_schema: schema,
+        input_schema_sha256: declaration.success
+            ? digestCanonicalValue(schema)
+            : null,
         annotations: {
             read_only: booleanOrNull(annotations?.readOnly),
             untrusted_content: booleanOrNull(annotations?.untrustedContent),
@@ -285,15 +294,6 @@ const normalizeTool = (value, input, frames, completeness) => {
         trust: "page-declared-untrusted",
     };
 };
-const schemaShape = (value) => {
-    if (recordValue(value) === undefined)
-        return null;
-    const encoded = JSON.stringify(value);
-    const shape = inferJsonShape(encoded);
-    if (shape === null)
-        throw new BrowserObservationError("inspect_web_page", "protocol_error");
-    return shape;
-};
 const registrationSource = (stack, allowedOrigins) => {
     const frame = recordsValue(stack?.callFrames)[0];
     const url = allowedSanitizedUrl(frame?.url, allowedOrigins);
@@ -327,8 +327,11 @@ const buildWebMcpResult = (options) => {
 };
 const toolKey = (frameUrl, frameId, name) => 
 // Registrations without a known admitted frame are excluded above, so the
-// frame ID here always distinguishes owners and keys cannot collapse.
-`webmcp_${createHash("sha256").update(`${frameUrl}\0${frameId}\0${name}`).digest("hex")}`;
+// frame ID here always distinguishes owners. Composite tuple keeps a NUL
+// inside one field from collapsing two registrations before hashing.
+`webmcp_${createHash("sha256")
+    .update(compositeKey([frameUrl, frameId, name]))
+    .digest("hex")}`;
 const booleanOrNull = (value) => typeof value === "boolean" ? value : null;
 const integerOrNull = (value) => {
     const number = numberValue(value);

package/dist/browser/PlaywrightBrowserScenarioProvider.js

@@ -135,11 +135,11 @@ const globalCompleteness = (scenario, session, steps) => {
         missing.push("events");
     return classifyBrowserScenarioCompleteness(missing, truncated);
 };
-const runScenario = async (factory, scenario, options) => {
+const runScenario = async (openSession, scenario, options) => {
     if (options.signal?.aborted === true)
         throw new BrowserObservationError(OPERATION, "cancelled");
     const startedAt = Date.now();
-    const session = await factory.open(scenario, options.signal === undefined ? {} : { signal: options.signal });
+    const session = await openSession(scenario, options.signal === undefined ? {} : { signal: options.signal });
     const steps = [];
     let operationOutcome = { ok: true };
     try {
@@ -225,16 +225,16 @@ const runScenario = async (factory, scenario, options) => {
 };
 /** Controlled Playwright/CDP scenario driver with exact process ownership. */
 export class PlaywrightBrowserScenarioProvider {
-    factory;
-    constructor(factory) {
-        this.factory = factory;
+    openSession;
+    constructor(openSession) {
+        this.openSession = openSession;
     }
     identity() {
         return PLAYWRIGHT_BROWSER_SCENARIO_PROVIDER_IDENTITY;
     }
     async captureScenario(scenario, options = {}) {
         try {
-            return ok(await runScenario(this.factory, scenario, options));
+            return ok(await runScenario(this.openSession, scenario, options));
         }
         catch (cause) {
             if (cause instanceof AnalysisError)