rea-agents 6.2.0 → 6.4.0

package/dist/artifacts/javascript/JavaScriptArtifactFiles.js

@@ -1,22 +1,23 @@
 import { createHash } from "node:crypto";
 import { isAbsolute } from "node:path";
-import { compareCodePoints } from "../../domain/canonicalOrdering.js";
+import { compareUnicodeCodePoints } from "../../domain/unicodeCodePointOrder.js";
 import { AsarArtifactReader } from "../AsarArtifactReader.js";
 import { ArtifactPathRegistry, normalizeArtifactPath, } from "../ArtifactPaths.js";
 import { ArtifactReaderFailure, } from "../ArtifactReader.js";
 import { streamChunkToBuffer } from "../StreamBytes.js";
 import { hashReadable } from "../ArtifactHash.js";
 /** Read all relevant textual entries through an already-inventoried reader. */
-export const readJavaScriptArtifactFiles = async (reader, snapshot, signal) => {
+export const readJavaScriptArtifactFiles = async (reader, snapshot, resources, signal) => {
     if (reader instanceof AsarArtifactReader) {
         const root = snapshot.nodes.find(({ artifact_id }) => artifact_id === snapshot.manifest.root_artifact_id);
         if (root === undefined)
             throw new ArtifactReaderFailure("integrity", "Root artifact node is missing");
-        await verifyEntryBytes(reader.openContainer(signal), { path: ".", sha256: root.sha256, bytes: root.size }, signal);
+        await verifyEntryBytes(await reader.openContainer(signal), { path: ".", sha256: root.sha256, bytes: root.size }, signal);
     }
     const inventory = expectedInventory(snapshot);
     const expected = inventory.files;
     const context = {
+        resources,
         expected,
         expectedContainers: inventory.containers,
         registry: new ArtifactPathRegistry(),
@@ -27,11 +28,11 @@ export const readJavaScriptArtifactFiles = async (reader, snapshot, signal) => {
         invalidUtf8: 0,
     };
     await visitReader(reader, "", snapshot.manifest.root_sha256, context);
-    const files = context.files.sort((left, right) => compareCodePoints(left.path, right.path));
+    const files = context.files.sort((left, right) => compareUnicodeCodePoints(left.path, right.path));
     assertExpectedFilesWereVisited(expected, files);
     return {
         files,
-        containers: context.containers.sort((left, right) => compareCodePoints(left.path, right.path)),
+        containers: context.containers.sort((left, right) => compareUnicodeCodePoints(left.path, right.path)),
         text_bytes_read: context.textBytes,
         invalid_utf8_files: context.invalidUtf8,
     };
@@ -43,9 +44,10 @@ const visitReader = async (reader, prefix, containerSha256, context) => {
             prefix,
             containerSha256,
             iterator: reader.entries(context.signal)[Symbol.asyncIterator](),
-            owned: false,
         },
     ];
+    const ownedReaders = [];
+    let failure;
     try {
         while (stack.length > 0) {
             const frame = stack.at(-1);
@@ -54,8 +56,6 @@ const visitReader = async (reader, prefix, containerSha256, context) => {
             const next = await frame.iterator.next();
             if (next.done) {
                 stack.pop();
-                if (frame.owned)
-                    await frame.reader.close();
                 continue;
             }
             const entry = next.value;
@@ -64,17 +64,32 @@ const visitReader = async (reader, prefix, containerSha256, context) => {
             const nestedAsar = isFilesystemAsar(entry, path);
             context.registry.add(path, nestedAsar ? "directory" : entry.kind);
             if (nestedAsar) {
-                const inventory = expectedContainer(path, context);
+                const container = context.expectedContainers.get(path);
+                // Inventory deliberately does not expand unverified or unavailable
+                // nested archives. Keep the same boundary here when reconstruction
+                // reads the active entries again.
+                if (container === undefined)
+                    throw new ArtifactReaderFailure("integrity", `Nested ASAR was not present in inventory: ${path}`);
+                if (container.hash_status === "mismatched")
+                    continue;
+                if (container.hash_status === "unavailable")
+                    throw new ArtifactReaderFailure("unavailable", `Nested ASAR bytes were unavailable during inventory: ${path}`);
+                if (container.hash_status !== "verified")
+                    throw new ArtifactReaderFailure("integrity", `Nested ASAR was not integrity-verified: ${path}`);
+                const inventory = container.inventory;
+                if (inventory === null)
+                    throw new ArtifactReaderFailure("integrity", `Verified nested ASAR has no inventory node: ${path}`);
                 await verifyEntryBytes(await frame.reader.open(entry, context.signal), inventory, context.signal);
                 context.containers.push(inventory);
                 const nested = new AsarArtifactReader(entry.adapterKey);
+                ownedReaders.push({ reader: nested, path });
                 stack.push({
                     reader: nested,
                     prefix: path,
                     containerSha256: inventory.sha256,
                     iterator: nested.entries(context.signal)[Symbol.asyncIterator](),
-                    owned: true,
                 });
+                await nested.prepareContainer(inventory.sha256, context.signal);
                 continue;
             }
             const expected = context.expected.get(path);
@@ -97,20 +112,36 @@ const visitReader = async (reader, prefix, containerSha256, context) => {
             });
         }
     }
+    catch (cause) {
+        failure = { cause };
+    }
     finally {
-        await Promise.allSettled(stack
-            .filter(({ owned }) => owned)
-            .map(async ({ reader, iterator }) => {
-            await iterator.return?.();
-            await reader.close();
-        }));
+        for (const { iterator, prefix, reader } of stack.reverse()) {
+            try {
+                await iterator.return?.();
+            }
+            catch (cause) {
+                failure = {
+                    cause: ArtifactReaderFailure.withCleanup(failure === undefined ? cause : failure.cause, ArtifactReaderFailure.cleanupObservation(cause, `JavaScript artifact traversal for ${prefix || reader.format}`)),
+                };
+            }
+        }
+        for (const owned of ownedReaders.reverse()) {
+            const resource = `nested ASAR reader for ${owned.path}`;
+            const cleanup = await context.resources.release({
+                kind: "reader",
+                reader: owned.reader,
+                resource,
+            });
+            if (cleanup.kind === "failed") {
+                failure = {
+                    cause: ArtifactReaderFailure.withCleanup(failure === undefined ? cleanup.cause : failure.cause, ArtifactReaderFailure.cleanupObservation(cleanup.cause, resource)),
+                };
+            }
+        }
     }
-};
-const expectedContainer = (path, context) => {
-    const container = context.expectedContainers.get(path);
-    if (container === undefined)
-        throw new ArtifactReaderFailure("integrity", `Nested ASAR disappeared from inventory: ${path}`);
-    return container;
+    if (failure !== undefined)
+        throw failure.cause;
 };
 const readText = async (context, input) => {
     if (input.expected.kind === "native-addon") {
@@ -155,8 +186,18 @@ const expectedInventory = (snapshot) => {
     const files = new Map();
     const containers = new Map();
     for (const occurrence of snapshot.occurrences) {
-        if (occurrence.artifact_id === null || occurrence.logical_path === ".")
+        if (occurrence.logical_path === ".")
             continue;
+        const isNestedAsar = occurrence.entry_kind === "file" &&
+            occurrence.logical_path.toLowerCase().endsWith(".asar");
+        if (occurrence.artifact_id === null) {
+            if (isNestedAsar)
+                containers.set(occurrence.logical_path, {
+                    hash_status: occurrence.hash_status,
+                    inventory: null,
+                });
+            continue;
+        }
         const node = nodes.get(occurrence.artifact_id);
         if (node === undefined)
             throw new ArtifactReaderFailure("integrity", `Artifact inventory node is missing: ${occurrence.logical_path}`);
@@ -165,12 +206,15 @@ const expectedInventory = (snapshot) => {
         // node_modules/@zip.js remains a graph node and must never be opened.
         if (occurrence.entry_kind !== "file")
             continue;
-        if (occurrence.logical_path.toLowerCase().endsWith(".asar"))
+        if (isNestedAsar)
             containers.set(occurrence.logical_path, {
-                path: occurrence.logical_path,
-                sha256: node.sha256,
-                bytes: node.size,
-                inventory_artifact_id: node.artifact_id,
+                hash_status: occurrence.hash_status,
+                inventory: {
+                    path: occurrence.logical_path,
+                    sha256: node.sha256,
+                    bytes: node.size,
+                    inventory_artifact_id: node.artifact_id,
+                },
             });
         const kind = relevantKind(occurrence.logical_path);
         if (kind === undefined)

package/dist/artifacts/javascript/JavaScriptSourceAnalysis.js

@@ -0,0 +1,3 @@
+import { JavaScriptAnalysisWorker } from "../../javascript/analysis/JavaScriptAnalysisWorker.js";
+/** Construct the inert artifact analyzer; resources are acquired on the first source. */
+export const createJavaScriptSourceAnalysis = (limits, sourceCount) => new JavaScriptAnalysisWorker(limits, undefined, sourceCount);

package/dist/browser/BrowserScenarioPartialObservation.js

@@ -5,13 +5,19 @@ import { BrowserObservationError } from "../domain/browserObservationError.js";
 import { ProviderAdapterError } from "../domain/providerAdapterError.js";
 import { PLAYWRIGHT_BROWSER_SCENARIO_PROVIDER_IDENTITY } from "./providerIdentities.js";
 const OPERATION = "capture_browser_scenario";
-const browserScenarioLimitations = (session) => [
+const browserScenarioLimitations = (session, scenario) => [
     "Event sequence records provider receipt order; simultaneous browser causality is not inferred.",
     "Network content is retained only when selected; response bytes are browser-decoded, not compressed wire bytes.",
     "Request bytes are limited to what Playwright exposes; not_exposed does not establish body absence or multipart file coverage.",
     "Network content reads settle within 5 seconds each and never wait for unfinished responses or refetch them.",
     "Playwright scenario events do not expose request initiator stacks; receipt order does not prove causality.",
     "Storage values are hashed only after declared-secret redaction.",
+    ...(scenario.storage.local_storage.length === 0 &&
+        scenario.storage.session_storage.length === 0
+        ? []
+        : [
+            "Non-cookie storage seeds use CDP pre-script instrumentation; only pauses in the scenario's private seed script are resumed by this observer.",
+        ]),
     ...(session.eventLimitations?.() ?? []),
     ...(session.mode === "connect"
         ? [
@@ -40,7 +46,7 @@ export const browserScenarioCaptureData = (input) => ({
     steps: [...input.steps],
     events: input.session.events(),
     limitations: [
-        ...browserScenarioLimitations(input.session),
+        ...browserScenarioLimitations(input.session, input.scenario),
         ...(input.limitations ?? []),
     ],
 });

package/dist/browser/BrowserScenarioSecrets.js

@@ -6,6 +6,36 @@ const encodedSecretValues = (secret) => new Set([
     encodeURIComponent(secret),
     new URLSearchParams([["value", secret]]).toString().slice("value=".length),
 ]);
+const secretSpellings = (secret, spellings) => {
+    if (secret === "")
+        return [];
+    if (spellings === "raw")
+        return [secret];
+    const values = [...encodedSecretValues(secret)];
+    if (spellings === "bytes")
+        values.push(JSON.stringify(secret).slice(1, -1));
+    return [...new Set(values)].filter((value) => value !== "");
+};
+const declaredLiterals = (values, spellings) => [
+    ...new Set([...values.values()].flatMap((secret) => secretSpellings(secret, spellings))),
+];
+/** Pick a marker that does not itself contain a declared secret spelling. */
+const redactionMarker = (id, literals) => [`${REDACTION_PREFIX}${id}]`, "[REDACTED]", "…", ""].find((candidate) => literals.every((literal) => !candidate.includes(literal))) ?? "";
+const replaceSecretLiterals = (value, values, spellings, literals) => {
+    const replacements = [...values]
+        .flatMap(([id, secret]) => secretSpellings(secret, spellings).map((text) => ({ id, text })))
+        .sort((left, right) => right.text.length - left.text.length ||
+        (left.id < right.id ? -1 : left.id > right.id ? 1 : 0));
+    let output = value;
+    for (const replacement of replacements)
+        output = output.replaceAll(replacement.text, redactionMarker(replacement.id, literals));
+    return output;
+};
+const secretNeedles = (values, literals) => [...values].flatMap(([id, secret]) => secretSpellings(secret, "bytes").map((text) => ({
+    id,
+    needle: Buffer.from(text),
+    marker: Buffer.from(redactionMarker(id, literals)),
+})));
 /** Resolved secret values kept only for one in-memory scenario session. */
 export class BrowserScenarioSecrets {
     values;
@@ -38,35 +68,18 @@ export class BrowserScenarioSecrets {
         return url.href;
     }
     redact(value) {
-        let output = value;
-        const replacements = [...this.values].sort(([leftId, left], [rightId, right]) => right.length - left.length ||
-            (leftId < rightId ? -1 : leftId > rightId ? 1 : 0));
-        for (const [id, secret] of replacements)
-            if (secret !== "")
-                output = output.replaceAll(secret, `${REDACTION_PREFIX}${id}]`);
-        return output;
+        const literals = declaredLiterals(this.values, "raw");
+        const output = replaceSecretLiterals(value, this.values, "raw", literals);
+        return literals.some((literal) => output.includes(literal)) ? "" : output;
     }
     /** Replace declared UTF-8, URI/form, and JSON-escaped secrets without decoding binary data. */
     redactBytes(value) {
-        const candidates = [...this.values]
-            .flatMap(([id, secret]) => {
-            if (secret === "")
-                return [];
-            return [
-                ...new Set([
-                    ...encodedSecretValues(secret),
-                    JSON.stringify(secret).slice(1, -1),
-                ]),
-            ].map((text) => {
-                const needle = Buffer.from(text);
-                return {
-                    id,
-                    needle,
-                    marker: Buffer.from(`${REDACTION_PREFIX}${id}]`),
-                    index: value.indexOf(needle),
-                };
-            });
-        })
+        const literals = declaredLiterals(this.values, "bytes");
+        const candidates = secretNeedles(this.values, literals)
+            .map((candidate) => ({
+            ...candidate,
+            index: value.indexOf(candidate.needle),
+        }))
             .sort((left, right) => right.needle.length - left.needle.length ||
             (left.id < right.id ? -1 : left.id > right.id ? 1 : 0));
         const parts = [];
@@ -88,20 +101,22 @@ export class BrowserScenarioSecrets {
         if (parts.length === 0)
             return value;
         parts.push(value.subarray(offset));
-        return Buffer.concat(parts);
+        const redacted = Buffer.concat(parts);
+        return literals.some((literal) => redacted.includes(Buffer.from(literal)))
+            ? Buffer.alloc(0)
+            : redacted;
     }
     /** Remove only declared secret values from one URL and report that action. */
     sanitizeUrl(value) {
-        let output = value;
-        const replacements = [...this.values].sort(([leftId, left], [rightId, right]) => right.length - left.length ||
-            (leftId < rightId ? -1 : leftId > rightId ? 1 : 0));
-        for (const [id, secret] of replacements) {
-            if (secret === "")
-                continue;
-            const marker = `${REDACTION_PREFIX}${id}]`;
-            for (const candidate of encodedSecretValues(secret))
-                output = output.replaceAll(candidate, marker);
-        }
+        const literals = declaredLiterals(this.values, "url");
+        const output = replaceSecretLiterals(value, this.values, "url", literals);
+        if (literals.some((literal) => output.includes(literal)))
+            return {
+                url: "",
+                origin: null,
+                query_parameter_names: [],
+                redacted: true,
+            };
         const sanitized = sanitizeBrowserUrl(output);
         return {
             ...sanitized,

package/dist/browser/CdpBrowserProvider.js

@@ -7,6 +7,7 @@ import { webMcpDiscoverySchema, } from "../domain/webMcpDiscovery.js";
 import { browserCaptureComparisonSchema, compareBrowserCaptures, } from "../domain/browserCaptureComparison.js";
 import { webScreenshotDiffSchema, webScreenshotSchema, } from "../domain/webScreenshot.js";
 import { AnalysisError } from "../domain/analysisErrorBase.js";
+import { AnalysisInputError } from "../domain/analysisErrorCore.js";
 import { BrowserObservationError } from "../domain/browserObservationError.js";
 import { ProviderAdapterError } from "../domain/providerAdapterError.js";
 import {} from "../domain/browserObservationErrors.js";
@@ -21,12 +22,11 @@ import { discoverWebMcp } from "./CdpWebMcpDiscovery.js";
 import { captureCdpScreenshot } from "./CdpScreenshot.js";
 import { comparePngScreenshots } from "./PngVisualDiff.js";
 import { CDP_BROWSER_PROVIDER_IDENTITY } from "./providerIdentities.js";
-const IDENTITY = CDP_BROWSER_PROVIDER_IDENTITY;
 const CLEANUP_DOMAINS = ["Network", "Debugger", "Runtime", "Page"];
 /** Passive browser observation through a selected user-owned CDP endpoint. */
 export class CdpBrowserProvider {
     identity() {
-        return IDENTITY;
+        return CDP_BROWSER_PROVIDER_IDENTITY;
     }
     async listTargets(input, options = {}) {
         try {
@@ -174,6 +174,10 @@ export class CdpBrowserProvider {
             return ok(webScreenshotDiffSchema.parse(comparePngScreenshots(input)));
         }
         catch (cause) {
+            if (cause instanceof TypeError)
+                return err(new AnalysisInputError("compare_web_screenshots", { cause }, [
+                    { path: [], reason: "invalid_format", message: cause.message },
+                ]));
             return err(providerError(cause, "compare_web_screenshots"));
         }
     }
@@ -262,4 +266,6 @@ const providerError = (cause, operation) => cause instanceof BrowserObservationE
     ? new BrowserObservationError(operation, cause.reason, { cause })
     : cause instanceof AnalysisError
         ? cause
-        : new ProviderAdapterError(IDENTITY.id, operation, { cause });
+        : new ProviderAdapterError(CDP_BROWSER_PROVIDER_IDENTITY.id, operation, {
+            cause,
+        });

package/dist/browser/CdpCaptureDocuments.js

@@ -1,5 +1,6 @@
 import { allowedSanitizedUrl, numberValue, recordValue, recordsValue, requiredRecord, cdpStringValue, } from "./CdpCaptureValues.js";
 import { exclusionReasonForUrl } from "./CdpCaptureEventHelpers.js";
+import { createDocumentSvgAncestry, domSvgLink } from "./CdpCaptureDomSvg.js";
 /** Normalize every allowed frame, optionally selecting a leading frame. */
 export const captureFrames = (result, allowedOrigins, maximum, completeness) => {
     const root = recordValue(recordValue(result)?.frameTree);
@@ -114,21 +115,27 @@ export const captureDom = (result, allowedOrigins, input, completeness) => {
             ? documentNodes.attributes
             : [];
         const baseIndex = nodes.length;
+        const ancestry = createDocumentSvgAncestry({
+            nodeTypes,
+            nodeNames,
+            parents,
+            strings,
+            attributes,
+        });
         total += nodeTypes.length;
         for (let index = 0; index < nodeTypes.length; index += 1) {
             const attributeIndexes = numberArray(attributes[index]);
             const parent = Math.trunc(parents[index] ?? -1);
             const nodeIndex = nodes.length;
             const nodeName = indexedString(strings, nodeNames[index]);
+            const attributeNames = uniqueAttributeNames(attributeIndexes, strings);
             nodes.push({
                 index: nodeIndex,
                 parent_index: parent < 0 ? -1 : baseIndex + parent,
                 node_type: Math.max(0, Math.trunc(nodeTypes[index] ?? 0)),
                 node_name: nodeName,
                 node_value_length: indexedString(strings, nodeValues[index]).length,
-                attribute_names: attributeIndexes
-                    .filter((_value, attributeIndex) => attributeIndex % 2 === 0)
-                    .map((value) => indexedString(strings, value)),
+                attribute_names: attributeNames,
             });
             const metadata = domMetadata({
                 strings,
@@ -139,6 +146,7 @@ export const captureDom = (result, allowedOrigins, input, completeness) => {
                 nodeIndex,
                 nodeName,
                 allowedOrigins,
+                ...domSvgLink(ancestry, index),
             });
             for (const url of metadata.urls) {
                 urls.push(url);
@@ -261,23 +269,49 @@ const indexedString = (strings, index) => {
     const integer = numberValue(index);
     return integer === undefined ? "" : (strings[Math.trunc(integer)] ?? "");
 };
+const uniqueAttributeNames = (attributeIndexes, strings) => {
+    const names = [];
+    const seen = new Set();
+    for (let index = 0; index < attributeIndexes.length; index += 2) {
+        const name = indexedString(strings, attributeIndexes[index]);
+        if (seen.has(name))
+            continue;
+        seen.add(name);
+        names.push(name);
+    }
+    return names;
+};
 const numberArray = (value) => Array.isArray(value)
     ? value.flatMap((item) => {
         const number = numberValue(item);
         return number === undefined ? [] : [number];
     })
     : [];
+// Chrome reads an SVG XLink href only when href itself is absent, and an
+// empty href still wins. HTML keeps the literal attribute name `xlink:href`.
+// XML uses any prefix bound to the XLink namespace. Both are stored as href.
+const hrefAttributeValue = (pairs, attribute, options) => {
+    const declared = pairs.get(attribute);
+    if (declared !== undefined)
+        return declared;
+    if (attribute !== "href" || !options.svgElement)
+        return undefined;
+    return options.xmlDocument ? options.xlinkHref : pairs.get("xlink:href");
+};
 const domMetadata = (options) => {
     const { strings, attributes, baseUrl, documentUrl, nodeIndex, nodeName, allowedOrigins, } = options;
     const pairs = new Map();
     for (let index = 0; index + 1 < attributes.length; index += 2) {
-        const name = indexedString(strings, attributes[index]).toLowerCase();
+        // Chrome already folds HTML names; SVG/XML names remain case-sensitive.
+        const name = indexedString(strings, attributes[index]);
         const value = indexedString(strings, attributes[index + 1]);
-        pairs.set(name, value);
+        // HTML keeps the first declaration. A later repeat must not move dom_urls.
+        if (!pairs.has(name))
+            pairs.set(name, value);
     }
     const urls = [];
     for (const attribute of domUrlAttributes) {
-        const value = pairs.get(attribute);
+        const value = hrefAttributeValue(pairs, attribute, options);
         if (value === undefined)
             continue;
         const tagName = nodeName.toLowerCase();