rea-agents 6.2.0 → 6.4.0

package/dist/ida/IdaOperationRunner.js

@@ -1,6 +1,6 @@
 import { z } from "zod";
 import { analysisSearchInput } from "../contracts/analysisSearchContract.js";
-import { AnalysisInputError, AnalysisProtocolError, } from "../domain/analysisErrorCore.js";
+import { AnalysisInputError, AnalysisCancelledError, AnalysisProtocolError, } from "../domain/analysisErrorCore.js";
 import { functionDossierSchema, functionInstructionWindowSchema, } from "../domain/hopperValues.js";
 import { IDA_LIMITATIONS } from "./IdaProviderCapabilities.js";
 import { disassemblySchema, idaAddressSchema, idaFunctionSchema, legacyCalleesSchema, legacyPageSchema, legacyStringSchema, legacyXrefsSchema, modernCalleesSchema, modernDecompileSchema, modernDisassemblySchema, modernLookupSchema, modernPageSchema, modernStringsSchema, modernXrefsSchema, nextOffset, } from "./IdaProtocolValues.js";
@@ -20,18 +20,24 @@ export class IdaOperationRunner {
     connection;
     protocol;
     database;
+    signal;
     raw = [];
     locations = [];
     limitations = [];
-    constructor(connection, protocol, database) {
+    constructor(connection, protocol, database, signal) {
         this.connection = connection;
         this.protocol = protocol;
         this.database = database;
+        this.signal = signal;
     }
     async call(tool, args) {
+        if (this.signal?.aborted)
+            throw new AnalysisCancelledError(tool);
         const scoped = this.database === undefined ? args : { ...args, database: this.database };
         const result = await this.connection.call(tool, scoped);
         this.raw.push({ tool, arguments: scoped, result });
+        if (this.signal?.aborted)
+            throw new AnalysisCancelledError(tool);
         return result;
     }
     async functions() {
@@ -288,6 +294,8 @@ export class IdaOperationRunner {
             referenced_strings: [],
             referenced_names: [],
             basic_blocks: [],
+            native_api: null,
+            native_value_flow: null,
             limitations: [
                 ...IDA_LIMITATIONS,
                 ...this.limitations,

package/dist/ida/IdaProvider.js

@@ -70,6 +70,13 @@ export class IdaProvider {
             target_kind: target.kind,
             target_format: target.format,
         };
+        if (target.kind === "executable" && target.architecture === "mips")
+            return {
+                status: "unsupported",
+                code: "architecture_unsupported",
+                reason: "REA's IDA adapter has no verified MIPS lane. Select a supported Ghidra profile instead.",
+                diagnostics,
+            };
         return target.kind === "executable"
             ? { status: "supported", code: null, reason: null, diagnostics }
             : {

package/dist/ida/IdaSessionClient.js

@@ -101,8 +101,10 @@ export class IdaSessionClient {
         }
         const document = parameters.document;
         if (document !== undefined &&
-            document !== this.target.path &&
-            document !== this.target.sourcePath)
+            (typeof document !== "string" ||
+                (!sameIdaHostPath(document, this.target.path) &&
+                    (this.target.sourcePath === undefined ||
+                        !sameIdaHostPath(document, this.target.sourcePath)))))
             return err(new AnalysisInputError(operation, undefined, [
                 {
                     path: ["document"],
@@ -120,8 +122,10 @@ export class IdaSessionClient {
                 return this.#health(before);
             if (!isIdaOperation(operation))
                 throw new AnalysisProtocolError("IDA operation changed after validation.");
-            const runner = new IdaOperationRunner(this.connection, this.config.mode === "attached" ? "legacy" : "modern", this.#database);
+            const runner = new IdaOperationRunner(this.connection, this.config.mode === "attached" ? "legacy" : "modern", this.#database, options?.signal);
             const result = await runner.run(operation, parameters);
+            if (wasCancelled(options))
+                return err(new AnalysisCancelledError(operation));
             const after = await this.#observe();
             if (wasCancelled(options))
                 return err(new AnalysisCancelledError(operation));

package/dist/ida/IdaWorkspace.js

@@ -1,6 +1,6 @@
 import { createHash, randomUUID } from "node:crypto";
 import { createReadStream, constants } from "node:fs";
-import { copyFile } from "node:fs/promises";
+import { copyFile, realpath } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { basename, join, normalize } from "node:path";
 import { AnalysisProtocolError } from "../domain/analysisErrorCore.js";
@@ -33,8 +33,10 @@ export class IdaWorkspace {
     }
     /** Allocate a protected workspace so its owner can retain it before input preparation. */
     static async allocate(target, root = tmpdir()) {
+        // Upstream reports canonical paths (macOS /var -> /private/var), so the
+        // private input path must already be canonical for identity checks.
         const runtime = await PrivateRuntimeRoot.create({
-            parent: normalize(root),
+            parent: await realpath(normalize(root)),
             prefix: "rea-ida-",
         });
         const inputPath = join(runtime.path, basename(target.path));

package/dist/inspector/JavaScriptRuntimeScope.js

@@ -21,11 +21,6 @@ export const inspectorExclusionKey = (reason) => {
 /** Resolve a protocol location exposed by the explicitly selected Inspector endpoint. */
 export const authorizeRuntimeLocation = async (value, signal) => {
     throwIfRuntimeObservationCancelled(signal);
-    if (value.startsWith("node:") && value.length > 0)
-        return {
-            allowed: true,
-            location: { kind: "builtin", specifier: value },
-        };
     if (value.startsWith("file:")) {
         const filePath = await authorizedElectronFile(value);
         throwIfRuntimeObservationCancelled(signal);
@@ -33,6 +28,15 @@ export const authorizeRuntimeLocation = async (value, signal) => {
             ? { allowed: false, reason: "not_approved" }
             : { allowed: true, location: { kind: "file", file_path: filePath } };
     }
+    return projectReportedRuntimeUrl(value);
+};
+/** Project non-file Inspector URLs without filesystem access. */
+export const projectReportedRuntimeUrl = (value) => {
+    if (value.startsWith("node:") && value.length > 0)
+        return {
+            allowed: true,
+            location: { kind: "builtin", specifier: value },
+        };
     let url;
     try {
         url = new URL(value);

package/dist/inspector/V8InspectorCaptureProjection.js

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { authorizeRuntimeLocation, inspectorExclusionKey, throwIfRuntimeObservationCancelled, } from "./JavaScriptRuntimeScope.js";
+import { authorizeRuntimeLocation, inspectorExclusionKey, projectReportedRuntimeUrl, throwIfRuntimeObservationCancelled, } from "./JavaScriptRuntimeScope.js";
 /** Empty durable-location exclusion counters. */
 export const createInspectorExclusionCounts = () => ({
     unsupported_location: 0,
@@ -15,26 +15,29 @@ export const describeInspectorTargetLimitations = () => [
 ];
 const LOCATION_AUTHORIZATION_WORKERS = 8;
 /** Canonically authorize, deduplicate, and sort one bounded raw capture. */
-export const finalizeInspectorCapture = async ({ input, runtime, target, state, authorizeLocation = authorizeRuntimeLocation, signal, }) => {
-    throwIfRuntimeObservationCancelled(signal);
+export const finalizeInspectorCapture = async ({ input, runtime, target, state, authorizeLocation = authorizeRuntimeLocation, locationMode = "verify", signal, }) => {
+    if (locationMode === "verify")
+        throwIfRuntimeObservationCancelled(signal);
     const exclusions = createInspectorExclusionCounts();
     const scripts = new Map();
     const draftsByUrl = new Map();
-    for (const draft of state.scripts) {
-        const drafts = draftsByUrl.get(draft.rawUrl) ?? [];
-        drafts.push(draft);
-        draftsByUrl.set(draft.rawUrl, drafts);
-    }
+    if (locationMode === "verify")
+        for (const draft of state.scripts) {
+            const drafts = draftsByUrl.get(draft.rawUrl) ?? [];
+            drafts.push(draft);
+            draftsByUrl.set(draft.rawUrl, drafts);
+        }
     const groups = [...draftsByUrl];
     const authorizedGroups = new Array(groups.length);
     let nextGroup = 0;
     let stopScheduling = false;
+    let unresolvedScripts = 0;
     const worker = async () => {
         try {
             for (;;) {
-                throwIfRuntimeObservationCancelled(signal);
                 if (stopScheduling)
                     return;
+                throwIfRuntimeObservationCancelled(signal);
                 const index = nextGroup;
                 nextGroup += 1;
                 const group = groups[index];
@@ -53,12 +56,18 @@ export const finalizeInspectorCapture = async ({ input, runtime, target, state,
             throw cause;
         }
     };
-    const workerResults = await Promise.allSettled(Array.from({ length: Math.min(LOCATION_AUTHORIZATION_WORKERS, groups.length) }, worker));
+    const workerResults = locationMode === "verify"
+        ? await Promise.allSettled(Array.from({ length: Math.min(LOCATION_AUTHORIZATION_WORKERS, groups.length) }, worker))
+        : [];
     const failedWorker = workerResults.find((result) => result.status === "rejected");
-    throwIfRuntimeObservationCancelled(signal);
+    if (locationMode === "verify")
+        throwIfRuntimeObservationCancelled(signal);
     if (failedWorker?.status === "rejected")
         throw failedWorker.reason;
-    for (const { drafts, decision } of authorizedGroups) {
+    for (const group of authorizedGroups) {
+        if (group === undefined)
+            continue;
+        const { drafts, decision } = group;
         for (const draft of drafts) {
             if (!decision.allowed) {
                 exclusions[inspectorExclusionKey(decision.reason)] += 1;
@@ -68,6 +77,14 @@ export const finalizeInspectorCapture = async ({ input, runtime, target, state,
             scripts.set(script.script_key, script);
         }
     }
+    if (locationMode === "reported")
+        for (const draft of state.scripts) {
+            const location = partialScriptLocation(draft.rawUrl);
+            if (location.kind === "unresolved")
+                unresolvedScripts += 1;
+            const script = scriptFromDraft(draft, location);
+            scripts.set(script.script_key, script);
+        }
     const items = [...scripts.values()].sort((left, right) => left.script_key < right.script_key
         ? -1
         : left.script_key > right.script_key
@@ -85,7 +102,8 @@ export const finalizeInspectorCapture = async ({ input, runtime, target, state,
         : left.context_key > right.context_key
             ? 1
             : 0);
-    throwIfRuntimeObservationCancelled(signal);
+    if (locationMode === "verify")
+        throwIfRuntimeObservationCancelled(signal);
     return {
         runtime,
         target: {
@@ -132,6 +150,11 @@ export const finalizeInspectorCapture = async ({ input, runtime, target, state,
                     "The discovery-reported file location cannot be verified; loaded script locations are resolved independently from Debugger.scriptParsed.",
                 ]
                 : []),
+            ...(unresolvedScripts === 0
+                ? []
+                : [
+                    `${String(unresolvedScripts)} observed script location${unresolvedScripts === 1 ? " remains" : "s remain"} unverified; raw URLs and script metadata are retained.`,
+                ]),
             "Scripts collected before attachment may have been garbage-collected and therefore omitted.",
             "A bounded observation window cannot establish that an unobserved script or behavior never occurs.",
             "The declared Node/Electron process role is not authenticated by the Inspector protocol.",
@@ -157,3 +180,13 @@ const scriptFromDraft = (draft, location) => {
         status: "observed-loaded",
     };
 };
+const partialScriptLocation = (reportedUrl) => {
+    const projection = projectReportedRuntimeUrl(reportedUrl);
+    if (projection.allowed)
+        return projection.location;
+    return {
+        kind: "unresolved",
+        reported_url: reportedUrl,
+        reason: "location-authorization-not-attempted",
+    };
+};

package/dist/inspector/V8InspectorProvider.js

@@ -54,19 +54,30 @@ export class V8InspectorProvider {
     }
     async observe(input, options = {}) {
         let connection;
+        let discovery;
+        let target;
+        let state;
         let primaryFailure;
         let failed = false;
         let cleanupFailure;
         let cleanupFailed = false;
+        let connectionClosePromise;
         let outcome;
+        const closeConnection = () => {
+            if (connection === undefined)
+                return Promise.resolve();
+            connectionClosePromise ??= closeInspectorConnection(connection, options.signal);
+            return connectionClosePromise;
+        };
         try {
-            const discovery = await discoverV8Inspector(input.inspector_endpoint, "observe_javascript_runtime", options.signal);
-            const target = await authorizedTarget(discovery.targets, input, discovery.runtime.product);
+            discovery = await discoverV8Inspector(input.inspector_endpoint, "observe_javascript_runtime", options.signal);
+            target = await authorizedTarget(discovery.targets, input, discovery.runtime.product);
             if (input.runtime_kind !== undefined)
                 assertRuntimeKind(target, input.runtime_kind);
             connection = await CdpConnection.connect(target.webSocketUrl, "observe_javascript_runtime", options.signal, { maxPayloadBytes: INSPECTOR_MAX_PAYLOAD_BYTES });
-            const state = emptyCaptureState();
-            const removeListener = connection.onEvent((event) => ingestEvent(event, state));
+            const captureState = emptyCaptureState();
+            state = captureState;
+            const removeListener = connection.onEvent((event) => ingestEvent(event, captureState));
             try {
                 await connection.send("Runtime.enable", {}, undefined, options.signal);
                 await connection.send("Debugger.enable", {}, undefined, options.signal);
@@ -79,7 +90,7 @@ export class V8InspectorProvider {
                 input,
                 runtime: discovery.runtime,
                 target,
-                state,
+                state: captureState,
                 ...(options.signal === undefined ? {} : { signal: options.signal }),
             });
             outcome = ok(javascriptRuntimeObservationSchema.parse(result));
@@ -87,12 +98,53 @@ export class V8InspectorProvider {
         catch (cause) {
             failed = true;
             primaryFailure = cause;
-            outcome = err(providerError(cause, "observe_javascript_runtime"));
+            let error = providerError(cause, "observe_javascript_runtime");
+            if (state !== undefined &&
+                discovery !== undefined &&
+                target !== undefined &&
+                (cause instanceof BrowserObservationError ||
+                    options.signal?.aborted === true)) {
+                const reason = options.signal?.aborted === true
+                    ? "cancelled"
+                    : cause instanceof BrowserObservationError
+                        ? cause.reason
+                        : "protocol_error";
+                try {
+                    await closeConnection();
+                }
+                catch (cause) {
+                    cleanupFailed = true;
+                    cleanupFailure = cause;
+                }
+                try {
+                    const partialObservation = await finalizeInspectorCapture({
+                        input,
+                        runtime: discovery.runtime,
+                        target,
+                        state,
+                        locationMode: "reported",
+                    });
+                    error = new BrowserObservationError("observe_javascript_runtime", reason, {
+                        cause: error,
+                        ...(error.userMessage === undefined
+                            ? {}
+                            : { detail: error.userMessage }),
+                        partialObservation,
+                    });
+                }
+                catch (projectionFailure) {
+                    error = new BrowserObservationError("observe_javascript_runtime", reason, {
+                        cause: new AggregateError([error, projectionFailure], "Inspector failure and partial-observation projection both failed"),
+                        detail: `${error.message} Partial observations could not be projected.`,
+                    });
+                }
+            }
+            outcome = err(error);
         }
         finally {
             if (connection !== undefined)
                 try {
-                    await closeInspectorConnection(connection, options.signal);
+                    await closeConnection();
                 }
                 catch (cause) {
                     cleanupFailed = true;
@@ -212,7 +264,7 @@ const ingestScript = (event, state) => {
     state.scriptsObserved += 1;
     const value = recordValue(event.params);
     const rawUrl = cdpStringValue(value?.url);
-    if (rawUrl === undefined || rawUrl === "") {
+    if (rawUrl === undefined) {
         state.invalidScripts += 1;
         retainEvent(state, 0);
         return;