rea-agents 6.2.0 → 6.4.0

package/dist/domain/referenceSourceImportParsing.js

@@ -1,5 +1,8 @@
 import { parse } from "@babel/parser";
-import { isCallExpression, isExportAllDeclaration, isExportNamedDeclaration, isIdentifier, isImport, isImportDeclaration, isImportExpression, isMemberExpression, isNode, isStringLiteral, isTSExternalModuleReference, isTSImportEqualsDeclaration, isTSModuleDeclaration, } from "@babel/types";
+import { traverseJavaScriptAst } from "./javascript/javascriptSemanticTraversal.js";
+import { parserPluginsForPath } from "./javascript/javascriptSourceParser.js";
+import { unshadowedReferenceSourceRequireCalls } from "./referenceSourceRequireBindings.js";
+import { isCallExpression, isExportAllDeclaration, isExportNamedDeclaration, isIdentifier, isImport, isImportDeclaration, isImportExpression, isMemberExpression, isStringLiteral, isTSExternalModuleReference, isTSImportEqualsDeclaration, isTSModuleDeclaration, } from "@babel/types";
 const codeSourceLanguages = new Set(["JavaScript", "TypeScript", "JSX", "TSX"]);
 const safeModuleName = (node) => {
     if (isStringLiteral(node))
@@ -112,40 +115,18 @@ const isRequireCallee = (callee) => {
     }
     return false;
 };
-const isImportCallee = (callee) => isImport(callee);
-const collectModuleExpressions = (node, targets) => {
-    if (node === null || node === undefined)
-        return;
-    if (typeof node !== "object")
-        return;
-    if (Array.isArray(node)) {
-        for (const item of node)
-            collectModuleExpressions(item, targets);
-        return;
-    }
-    if (!isNode(node))
-        return;
-    if (isCallExpression(node) || isImportExpression(node)) {
-        targets.push(node);
-    }
-    for (const value of Object.values(node)) {
-        if (value !== null &&
-            value !== undefined &&
-            typeof value === "object" &&
-            !isSourceLocation(value)) {
-            collectModuleExpressions(value, targets);
-        }
-    }
-};
-const isSourceLocation = (value) => typeof value === "object" &&
-    value !== null &&
-    "start" in value &&
-    "end" in value &&
-    !("type" in value);
-const extractRequireAndDynamicImports = (body, from_path, relationships) => {
+const extractRequireAndDynamicImports = (body, from_path, relationships, unshadowedRequireCalls) => {
+    // Single traversal owner: iterative, VISITOR_KEYS-gated, no recursion over
+    // loc/comment objects. Survives deeply nested generated member chains that
+    // overflowed the previous hand-rolled Object.values walker.
     const expressions = [];
     for (const statement of body)
-        collectModuleExpressions(statement, expressions);
+        traverseJavaScriptAst(statement, {
+            enter: (node) => {
+                if (isCallExpression(node) || isImportExpression(node))
+                    expressions.push(node);
+            },
+        });
     for (const call of expressions) {
         if (isImportExpression(call)) {
             const specifier = safeModuleName(call.source);
@@ -159,7 +140,9 @@ const extractRequireAndDynamicImports = (body, from_path, relationships) => {
             continue;
         }
         const first = call.arguments[0];
-        if (isRequireCallee(call.callee) && isModuleExpression(first)) {
+        if (isRequireCallee(call.callee) &&
+            unshadowedRequireCalls.has(call) &&
+            isModuleExpression(first)) {
             const result = moduleSpecifierFromExpression(first);
             if (result !== undefined) {
                 appendRelationship(relationships, {
@@ -171,7 +154,7 @@ const extractRequireAndDynamicImports = (body, from_path, relationships) => {
             }
             continue;
         }
-        if (isImportCallee(call.callee) && isModuleExpression(first)) {
+        if (isImport(call.callee) && isModuleExpression(first)) {
             const result = moduleSpecifierFromExpression(first);
             if (result !== undefined) {
                 appendRelationship(relationships, {
@@ -185,17 +168,11 @@ const extractRequireAndDynamicImports = (body, from_path, relationships) => {
     }
 };
 const parseWithBabel = (path, source, language) => {
-    const plugins = ["jsx"];
-    if (language === "TypeScript" || language === "TSX") {
-        plugins.push([
-            "typescript",
-            {
-                dts: path.endsWith(".d.ts") ||
-                    path.endsWith(".d.mts") ||
-                    path.endsWith(".d.cts"),
-            },
-        ]);
-    }
+    // Single parser-mode owner: path-driven plugins (dts/JSX/mts) shared with
+    // the semantic pipeline. `language` only gates non-JS/TS callers upstream;
+    // TypeScript syntax must parse identically here and in semantic analysis.
+    void language;
+    const plugins = parserPluginsForPath(path);
     try {
         const ast = parse(source, {
             sourceType: "unambiguous",
@@ -218,7 +195,22 @@ const parseWithBabel = (path, source, language) => {
 export const parseReferenceSourceImports = (path, bytes, language) => {
     if (language !== null && !codeSourceLanguages.has(language))
         return { relationships: [], parse_failures: [] };
-    const source = new TextDecoder("utf-8", { fatal: false }).decode(bytes);
+    let source;
+    try {
+        source = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    }
+    catch {
+        return {
+            relationships: [],
+            parse_failures: [
+                {
+                    path,
+                    parser: "utf-8",
+                    reason: "Source bytes are not valid UTF-8; import targets were not parsed.",
+                },
+            ],
+        };
+    }
     const { ast, reasons } = parseWithBabel(path, source, language);
     const parseFailures = reasons.map((reason) => ({
         path,
@@ -233,7 +225,7 @@ export const parseReferenceSourceImports = (path, bytes, language) => {
     }
     const relationships = [];
     extractImportDeclarations(ast.program.body, path, relationships);
-    extractRequireAndDynamicImports(ast.program.body, path, relationships);
+    extractRequireAndDynamicImports(ast.program.body, path, relationships, unshadowedReferenceSourceRequireCalls(ast, path));
     return {
         relationships: relationships.map((relationship) => ({
             ...relationship,

package/dist/domain/referenceSourcePathIdentity.js

@@ -0,0 +1,22 @@
+/**
+ * Reference inventories retain filesystem spelling. Prefer that exact identity;
+ * canonical Unicode equivalence is a fallback only when it identifies one entry.
+ */
+export const createReferenceSourcePathLookup = (paths) => {
+    const exact = new Set(paths);
+    const canonical = new Map();
+    for (const path of exact) {
+        const key = path.normalize("NFC");
+        canonical.set(key, canonical.has(key) ? null : path);
+    }
+    const equivalent = (path) => canonical.get(path.normalize("NFC")) ?? undefined;
+    return {
+        resolve: (path) => (exact.has(path) ? path : equivalent(path)),
+        resolveCandidates: (candidates) => candidates.find((path) => exact.has(path)) ??
+            candidates.map(equivalent).find((path) => path !== undefined),
+    };
+};
+/** Symlink evidence can originate on a different OS from the graph reader. */
+export const isPortableAbsoluteReferenceTarget = (target) => target.startsWith("/") ||
+    /^[A-Za-z]:[\\/]/u.test(target) ||
+    /^\\\\[^\\/]+[\\/][^\\/]+/u.test(target);

package/dist/domain/referenceSourceRequireBindings.js

@@ -0,0 +1,137 @@
+import * as t from "@babel/types";
+import { analyzeParsedJavaScriptReferences } from "./javascript/javascriptSemanticAnalysis.js";
+import { semanticBindingId, semanticScopeId, } from "./javascript/javascriptSemanticState.js";
+import { traverseJavaScriptAst } from "./javascript/javascriptSemanticTraversal.js";
+/**
+ * Keep calls that resolve either to Node's CommonJS wrapper loader or to a
+ * direct ESM `createRequire(import.meta.url)` binding. The shared lexical
+ * analyzer supplies binding ownership; this boundary accounts for the two
+ * Node loader bindings without evaluating arbitrary values.
+ */
+export const unshadowedReferenceSourceRequireCalls = (file, path) => {
+    const references = new Map(analyzeParsedJavaScriptReferences(file).map((reference) => [
+        `${reference.location.start.line}:${reference.location.start.column}`,
+        reference,
+    ]));
+    const programRequireBinding = semanticBindingId(semanticScopeId("program", file.program), "require");
+    const allowsUnboundRequire = !isExplicitModuleSource(path);
+    const hasTopLevelVarRequire = allowsUnboundRequire && hasUninitializedTopLevelVarRequire(file.program);
+    const createRequireBinding = directCreateRequireBinding(file.program, references);
+    const requireLoaderWasWritten = [...references.values()].some((reference) => reference.name === "require" &&
+        reference.role === "write" &&
+        (reference.resolution === "unbound" ||
+            reference.bindingId === programRequireBinding));
+    const calls = new Set();
+    traverseJavaScriptAst(file.program, {
+        enter: (node, _parent, readAncestors) => {
+            if (!t.isCallExpression(node))
+                return;
+            const identifier = requireCalleeIdentifier(node.callee);
+            const start = identifier?.loc?.start;
+            if (start === undefined)
+                return;
+            if (readAncestors().some((ancestor) => t.isWithStatement(ancestor) && contains(ancestor.body, node)))
+                return;
+            const reference = references.get(`${start.line}:${start.column}`);
+            if ((allowsUnboundRequire &&
+                !requireLoaderWasWritten &&
+                reference?.resolution === "unbound") ||
+                (((hasTopLevelVarRequire && !requireLoaderWasWritten) ||
+                    createRequireBinding) &&
+                    reference?.resolution === "resolved" &&
+                    reference.bindingId === programRequireBinding))
+                calls.add(node);
+        },
+    });
+    return calls;
+};
+const contains = (container, node) => typeof container.start === "number" &&
+    typeof container.end === "number" &&
+    typeof node.start === "number" &&
+    typeof node.end === "number" &&
+    container.start <= node.start &&
+    node.end <= container.end;
+const isExplicitModuleSource = (path) => {
+    const lower = path.toLowerCase();
+    if (lower.endsWith(".mjs") || lower.endsWith(".mts"))
+        return true;
+    if (lower.endsWith(".cjs") || lower.endsWith(".cts"))
+        return false;
+    // Syntax alone cannot establish Node's runtime mode: `.js` depends on its
+    // package scope, and `.ts` may be compiled with a CommonJS module target.
+    // Keep unmarked paths runtime-unknown and preserve candidate require edges.
+    return false;
+};
+const hasUninitializedTopLevelVarRequire = (program) => {
+    let found = false;
+    let initialized = false;
+    traverseJavaScriptAst(program, {
+        enter: (node, _parent, readAncestors) => {
+            if (!t.isVariableDeclaration(node, { kind: "var" }))
+                return;
+            if (readAncestors().some((ancestor) => t.isFunction(ancestor) || t.isStaticBlock(ancestor)))
+                return;
+            for (const declaration of node.declarations) {
+                if (!Object.hasOwn(t.getBindingIdentifiers(declaration.id), "require"))
+                    continue;
+                found = true;
+                initialized ||= declaration.init !== null;
+            }
+        },
+    });
+    return found && !initialized;
+};
+const directCreateRequireBinding = (program, references) => {
+    const programScope = semanticScopeId("program", program);
+    const importedNames = new Set();
+    for (const declaration of program.body) {
+        if (!t.isImportDeclaration(declaration) ||
+            (declaration.source.value !== "node:module" &&
+                declaration.source.value !== "module"))
+            continue;
+        for (const specifier of declaration.specifiers) {
+            if (t.isImportSpecifier(specifier) &&
+                t.isIdentifier(specifier.imported, { name: "createRequire" }))
+                importedNames.add(specifier.local.name);
+        }
+    }
+    return program.body.some((statement) => t.isVariableDeclaration(statement, { kind: "const" }) &&
+        statement.declarations.some((declaration) => {
+            if (!t.isIdentifier(declaration.id, { name: "require" }) ||
+                !t.isCallExpression(declaration.init) ||
+                !t.isIdentifier(declaration.init.callee) ||
+                !importedNames.has(declaration.init.callee.name) ||
+                !isImportMetaUrl(declaration.init.arguments[0]))
+                return false;
+            const start = declaration.init.callee.loc?.start;
+            if (start === undefined)
+                return false;
+            const reference = references.get(`${start.line}:${start.column}`);
+            return (reference?.resolution === "resolved" &&
+                reference.bindingId ===
+                    semanticBindingId(programScope, declaration.init.callee.name));
+        }));
+};
+const isImportMetaUrl = (node) => t.isMemberExpression(node) &&
+    !node.computed &&
+    t.isIdentifier(node.property, { name: "url" }) &&
+    t.isMetaProperty(node.object) &&
+    t.isIdentifier(node.object.meta, { name: "import" }) &&
+    t.isIdentifier(node.object.property, { name: "meta" });
+const requireCalleeIdentifier = (callee) => {
+    if (t.isIdentifier(callee, { name: "require" }))
+        return callee;
+    if (!t.isMemberExpression(callee) ||
+        !t.isIdentifier(callee.object, { name: "require" }) ||
+        ((!t.isIdentifier(callee.property) || callee.computed) &&
+            !t.isStringLiteral(callee.property)))
+        return undefined;
+    const propertyName = t.isIdentifier(callee.property)
+        ? callee.property.name
+        : t.isStringLiteral(callee.property)
+            ? callee.property.value
+            : undefined;
+    return propertyName === "resolve" || propertyName === "main"
+        ? callee.object
+        : undefined;
+};

package/dist/domain/residualUnknown.js

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import canonicalize from "canonicalize";
 import { z } from "zod";
+import { compareUnicodeCodePoints, compositeKey, } from "./unicodeCodePointOrder.js";
 import { prefixedDigestSchema } from "./../domain/digests.js";
 const evidenceIdSchema = prefixedDigestSchema("ev");
 const unknownIdSchema = prefixedDigestSchema("unk");
@@ -232,5 +233,5 @@ const canonicalJson = (value) => {
         throw new TypeError("Unknown identity failed");
     return serialized;
 };
-const sortedUnique = (values) => [...new Set(values)].sort((left, right) => left.localeCompare(right));
-const sortedRelationships = (values) => [...values].sort((left, right) => `${left.type}:${left.unknown_id}`.localeCompare(`${right.type}:${right.unknown_id}`));
+const sortedUnique = (values) => [...new Set(values)].sort(compareUnicodeCodePoints);
+const sortedRelationships = (values) => [...values].sort((left, right) => compareUnicodeCodePoints(compositeKey([left.type, left.unknown_id]), compositeKey([right.type, right.unknown_id])));

package/dist/domain/staticRuntimeCorrelation.js

@@ -3,6 +3,7 @@ import canonicalize from "canonicalize";
 import { z } from "zod";
 import { artifactComparisonResultSchema } from "./artifactComparison.js";
 import { uniqueSorted } from "./canonicalOrdering.js";
+import { compareUnicodeCodePoints } from "./unicodeCodePointOrder.js";
 import { comparisonSourceEvidenceIds } from "./comparisonSourceEvidence.js";
 import { evidenceSchema, parseEvidence } from "./evidence.js";
 import { functionComparisonResultSchema } from "./functionComparisonSchemas.js";
@@ -146,7 +147,7 @@ export const correlateStaticAndRuntime = (input) => {
     const runtimeById = byId(runtimeEvidence);
     const correlations = parsed.mappings
         .map((mapping) => correlate(mapping, staticById, runtimeById))
-        .sort((left, right) => left.correlation_id.localeCompare(right.correlation_id, "en"));
+        .sort((left, right) => compareUnicodeCodePoints(left.correlation_id, right.correlation_id));
     if (new Set(correlations.map(({ correlation_id: id }) => id)).size !==
         correlations.length)
         throw new TypeError("Static/runtime correlation rejects duplicate mappings");

package/dist/domain/swiftSymbolClassification.js

@@ -37,7 +37,12 @@ export const classifySwiftSymbol = (name) => {
         const kind = mangling.charAt(end);
         const nominal = NOMINAL_CATEGORIES.get(kind);
         if (nominal === undefined) {
-            if (kind === "E" && category !== null)
+            // Current swiftc emits protocol descriptors as `…<Nominal>Mp` without
+            // the nominal `P` marker (e.g. `_$s4main7ScoringMp`). Decode that exact
+            // suffix; unknown substitution encodings stay unclassified, never guessed.
+            if (mangling.slice(end) === "Mp")
+                category = "protocols";
+            else if (kind === "E" && category !== null)
                 category = "extensions";
             break;
         }

package/dist/domain/symbolAnalysis.js

@@ -1,8 +1,20 @@
 import { classifySwiftSymbol, } from "./swiftSymbolClassification.js";
+/** Objective-C class definition markers emitted by modern Apple clang. */
+const OBJC_CLASS_MARKER = "OBJC_CLASS_$_";
+/** Local class records emitted by Apple's fragile Objective-C ABI. */
+const LEGACY_OBJC_CLASS_PREFIX = "l_OBJC_CLASS_";
+/**
+ * Objective-C protocol declaration marker. `PROTOCOL_REFERENCE` slots
+ * share the substring but are uses, not definitions.
+ */
+const OBJC_PROTOCOL_MARKER = "OBJC_PROTOCOL_$_";
 /** Select and deduplicate Objective-C class labels. */
 export const discoverObjcClasses = (names, pattern) => {
     const classes = uniqueByName(names
-        .filter(({ name }) => ["OBJC_CLASS", "OBJC_$_CLASS"].some((marker) => name.includes(marker)))
+        .filter(({ name }) => name.includes(OBJC_CLASS_MARKER) ||
+        (name.startsWith(LEGACY_OBJC_CLASS_PREFIX) &&
+            name.length > LEGACY_OBJC_CLASS_PREFIX.length &&
+            !/^l_OBJC_CLASS_NAME_(?:\.\d+)?$/u.test(name)))
         .filter(({ name }) => pattern.length === 0 || name.includes(pattern)));
     return {
         count: classes.length,
@@ -11,7 +23,10 @@ export const discoverObjcClasses = (names, pattern) => {
 };
 /** Select and deduplicate Objective-C and Swift protocol labels. */
 export const discoverObjcProtocols = (names) => {
-    const protocols = uniqueByName(names.filter(({ name }) => name.includes("OBJC_PROTOCOL") || name.includes("_TtP")));
+    const protocols = uniqueByName(names.filter(({ name }) => name.includes(OBJC_PROTOCOL_MARKER) ||
+        name.includes("_TtP") ||
+        (name.endsWith("Mp") &&
+            classifySwiftSymbol(name)?.category === "protocols")));
     return {
         count: protocols.length,
         protocols: protocols.map(toJsonEntry),

package/dist/domain/unicodeCodePointOrder.js

@@ -15,3 +15,9 @@ export const compareUnicodeCodePoints = (left, right) => {
         return 0;
     return leftIndex === left.length ? -1 : 1;
 };
+/**
+ * Collision-free composite key for deduplication/sorting. `\0`-joins
+ * collide when any component contains NUL (valid in JS property names);
+ * a JSON tuple escapes every component. Single owner for composite keys.
+ */
+export const compositeKey = (parts) => JSON.stringify(parts);

package/dist/domain/webBundleAnalyzerInspection.js

@@ -1,11 +1,13 @@
 import { parse } from "@babel/parser";
 import * as t from "@babel/types";
 import { sanitizeEndpointCandidate } from "./browserObservation.js";
-import { traverseJavaScriptAst } from "./javascript/javascriptSemanticTraversal.js";
-import { classifyParsedJavaScriptOpenReceivers } from "./javascript/javascriptSemanticAnalysis.js";
+import { compositeKey } from "./unicodeCodePointOrder.js";
+import { completeSemanticSteps, traverseJavaScriptAst, } from "./javascript/javascriptSemanticTraversal.js";
+import { classifyParsedJavaScriptOpenReceivers, classifyParsedJavaScriptRpcClientRootsSteps, } from "./javascript/javascriptSemanticAnalysis.js";
 import { semanticStaticPropertyName } from "./javascript/javascriptAstValues.js";
 import { calleeName, endpointArgument, stringValue, } from "./javascript/javascriptStaticAnalysisHelpers.js";
 import { location, locationFields, objectString, objectValue, resolveSpecifier, isUrlLikeModuleSpecifier, } from "./webBundleAnalyzerAst.js";
+import { createJavaScriptRpcScan } from "./javascript/javascriptRpcEndpoints.js";
 export const analyzeScript = (script, accumulator) => {
     let file;
     try {
@@ -24,10 +26,21 @@ export const analyzeScript = (script, accumulator) => {
     accumulator.parsedScripts += 1;
     detectVendorFingerprints(script, accumulator);
     const openReceiverFacts = classifyParsedJavaScriptOpenReceivers(file);
+    const rpc = createJavaScriptRpcScan(script.source.artifact.text, completeSemanticSteps(classifyParsedJavaScriptRpcClientRootsSteps(file)));
     traverseJavaScriptAst(file, {
         enter: (node) => {
             accumulator.visitedNodes += 1;
             inspectNode(script, node, accumulator, openReceiverFacts);
+            const endpoint = rpc.inspect(node);
+            if (endpoint !== undefined)
+                addFinding({
+                    collection: accumulator.endpoints,
+                    script,
+                    rawValue: endpoint.value,
+                    mechanism: endpoint.mechanism,
+                    node,
+                    accumulator,
+                });
         },
     });
 };
@@ -169,7 +182,14 @@ const addWebMcpDeclaration = (script, node, accumulator) => {
             ].filter(Boolean)
             : [])
         : [];
-    const key = `webmcp\0${script.script_key}\0${name ?? ""}\0${schemaPropertyNames.join("\0")}`;
+    // Property names are a variable-length source-derived list: NUL-joins
+    // would collapse ["a\0b"] with ["a", "b"] and drop a declaration.
+    const key = compositeKey([
+        "webmcp",
+        script.script_key,
+        name ?? "",
+        schemaPropertyNames,
+    ]);
     addUnique(accumulator, key, () => accumulator.webMcp.push({
         name: name ?? null,
         description: description ?? null,