rea-agents 6.2.0 → 6.4.0

package/dist/mcpDoctor.js

@@ -5,6 +5,7 @@ import { resolve } from "node:path";
 import { CATALOG_IDENTITY } from "./catalogIdentity.js";
 import { PROMPT_CONTRACTS } from "./contracts/promptContracts.js";
 import { TOOL_CONTRACTS } from "./contracts/toolContracts.js";
+import { err, ok } from "./domain/result.js";
 import { PRODUCT_IDENTITY } from "./identity.js";
 import { MCP_STARTUP_POLICY } from "./mcpStartupPolicy.js";
 const OUTPUT_FORMATS = ["toon", "json", "yaml", "md", "jsonl"];
@@ -85,16 +86,22 @@ export const runProductionMcpDoctor = async (options) => {
 };
 const inspectProductionMcpSession = async (client, deadline, signal) => {
     const request = requestOptions(deadline, signal);
-    const [tools, prompts, requestFlow] = await Promise.all([
+    const [tools, prompts] = await Promise.all([
         client.listTools(undefined, request),
         client.listPrompts(undefined, request),
-        client.callTool({ name: "binary_session", arguments: {} }, request),
     ]);
+    const sessionTool = tools.tools.find(({ name }) => name === "binary_session");
+    const requestFlow = await client
+        .callTool({ name: "binary_session", arguments: {} }, {
+        ...requestOptions(deadline, signal),
+        ...(sessionTool === undefined ? {} : { toolDefinition: sessionTool }),
+    })
+        .then(ok, (cause) => err({ kind: "request-flow", detail: errorMessage(cause) }));
     const inventory = {
         tools: compareInventory(TOOL_CONTRACTS.map(({ name }) => name), tools.tools.map(({ name }) => name)),
         prompts: compareInventory(PROMPT_CONTRACTS.map(({ name }) => name), prompts.prompts.map(({ name }) => name)),
     };
-    const observedIdentity = parseIdentityToolResult(requestFlow.structuredContent);
+    const observedIdentity = parseIdentityToolResult(requestFlow.ok ? requestFlow.value.structuredContent : undefined);
     const serverVersion = client.getServerVersion();
     const protocolVersion = client.getNegotiatedProtocolVersion();
     const checks = [
@@ -115,8 +122,10 @@ const inspectProductionMcpSession = async (client, deadline, signal) => {
         },
         {
             name: "request-flow",
-            ok: requestFlow.isError !== true,
-            detail: "binary_session target-free request",
+            ok: requestFlow.ok && requestFlow.value.isError !== true,
+            detail: requestFlow.ok
+                ? "binary_session target-free request"
+                : requestFlow.error.detail,
         },
     ];
     return {
@@ -136,7 +145,7 @@ const inspectProductionMcpSession = async (client, deadline, signal) => {
         },
         request_flow: {
             tool: "binary_session",
-            ok: requestFlow.isError !== true,
+            ok: requestFlow.ok && requestFlow.value.isError !== true,
         },
         checks,
     };

package/dist/native/AppleDispatchCoverage.js

@@ -1,9 +1,15 @@
 const describeFixups = (fixups) => {
-    if (fixups.kind === "chained")
-        return `chained fixups: ${fixups.formats.join(", ") || "no fixup segments"}`;
-    return fixups.kind === "dyld-info"
-        ? "LC_DYLD_INFO bind opcodes"
-        : "no fixup load commands";
+    const unread = fixups.unreadRebaseBytes > 0
+        ? `LC_DYLD_INFO rebase opcodes were not decoded (${fixups.unreadRebaseBytes} bytes)`
+        : undefined;
+    const kind = fixups.kind === "chained"
+        ? `chained fixups: ${fixups.formats.join(", ") || "no fixup segments"}`
+        : fixups.kind === "dyld-info"
+            ? "LC_DYLD_INFO bind opcodes"
+            : unread === undefined
+                ? "no fixup load commands"
+                : undefined;
+    return [unread, kind].filter((line) => line !== undefined).join("; ");
 };
 /** Append the per-facet coverage of one Apple dispatch metadata decode. */
 export const pushDispatchCoverage = (input) => {
@@ -42,15 +48,22 @@ export const pushDispatchCoverage = (input) => {
         examined: categoriesExamined,
         decoded: result.objc_categories.filter(({ decode }) => decode.status === "decoded").length,
     });
+    const fixupReason = [
+        describeFixups(fixups),
+        ...fixups.issues.map(({ code, location, message }) => `${code}${location === undefined ? "" : ` at ${location}`}: ${message}`),
+    ]
+        .filter((line) => line.length > 0)
+        .join("; ");
     result.coverage.push({
         facet: "pointer_fixups",
-        status: fixups.issues.length > 0 ? "partial" : "complete",
-        reason: [
-            describeFixups(fixups),
-            ...fixups.issues.map(({ code, location, message }) => `${code}${location === undefined ? "" : ` at ${location}`}: ${message}`),
-        ].join("; "),
-        examined: 0,
-        decoded: 0,
+        status: fixups.issues.length > 0 || fixups.unreadRebaseBytes > 0
+            ? "partial"
+            : fixups.examined === 0
+                ? "unsupported"
+                : "complete",
+        reason: fixupReason.length > 0 ? fixupReason : null,
+        examined: fixups.examined,
+        decoded: fixups.issues.length > 0 ? 0 : fixups.examined,
     });
     result.coverage.push({
         facet: "swift_generic_resilient_witnesses_overrides_async_coroutines",

package/dist/native/AppleDispatchMetadata.js

@@ -1,8 +1,8 @@
 import { createHash } from "node:crypto";
-import { open } from "node:fs/promises";
-import { constants } from "node:fs";
 import { objcSwiftMetadataSchema, nativeDispatchMetadataResultSchema, } from "../domain/native/objcSwiftMetadata.js";
-import { AnalysisCancelledError } from "../domain/analysisErrorCore.js";
+import { AnalysisCancelledError, AnalysisResourceConstraintError, } from "../domain/analysisErrorCore.js";
+import { openRegularFile } from "../filesystem/RegularFile.js";
+import { readBoundedFileBytes } from "../process/BoundedFileBytes.js";
 import { EvidenceIntegrityError } from "../domain/evidenceErrors.js";
 import { pushDispatchCoverage } from "./AppleDispatchCoverage.js";
 import { parsePointerFixups } from "./AppleMachoFixups.js";
@@ -140,14 +140,21 @@ export const decodeAppleDispatchMetadata = (bytes, maxRecords, provenance, archi
 export const inspectAppleDispatchMetadata = async (target, maxRecords, signal) => {
     if (target.kind !== "executable" || target.format !== "mach-o")
         throw new TypeError("Apple dispatch metadata requires a Mach-O target");
-    const handle = await open(target.path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    const maximumBytes = 64 * 1024 * 1024;
+    const capacityError = () => new AnalysisResourceConstraintError("inspect_native_dispatch_metadata", "memory", "Apple static metadata input exceeds its 64 MiB snapshot budget", { input_bytes: maximumBytes });
+    const handle = await openRegularFile(target.path, {
+        symlinks: "reject",
+        signal,
+    });
     try {
         const before = await handle.stat();
-        if (!before.isFile() || before.size > 64 * 1024 * 1024)
-            throw new RangeError("Apple metadata target must be a regular file no larger than 64 MiB");
+        if (before.size > maximumBytes)
+            throw capacityError();
         if (signal?.aborted)
             throw new AnalysisCancelledError("inspect_native_dispatch_metadata");
-        const bytes = await handle.readFile({ signal });
+        const bytes = await readBoundedFileBytes(handle, maximumBytes, signal);
+        if (bytes === undefined)
+            throw capacityError();
         const digest = createHash("sha256").update(bytes).digest("hex");
         if (digest !== target.sha256)
             throw new EvidenceIntegrityError("Apple metadata target digest changed after session binding");

package/dist/native/AppleMachoFixups.js

@@ -134,6 +134,8 @@ const chainedFixups = (image, range) => {
         formats,
         failures: issues.map(({ message }) => message),
         issues,
+        examined: Math.max(ranges.length, 1),
+        unreadRebaseBytes: 0,
         decode(address, raw) {
             const segment = ranges.find(({ from, to }) => address >= from && address < to);
             // Pointers outside fixup segments, such as in __TEXT, are stored plainly.
@@ -211,6 +213,7 @@ const setBindRegister = (image, stream, state, byte) => {
             const segment = image.segments[immediate];
             if (segment === undefined)
                 throw new RangeError("Bind segment index is out of range");
+            state.segmentIndex = immediate;
             state.address = segment.address + uleb(bytes, cursor, end);
             return true;
         }
@@ -232,21 +235,50 @@ const readBindStream = (image, range, binds) => {
     const cursor = { at: range.offset };
     const state = {
         ordinal: 0,
+        segmentIndex: -1,
         symbol: "",
         weak: false,
         addend: 0n,
         address: 0n,
     };
-    const bind = (skip) => {
-        binds.set(state.address, {
+    const preflightRun = (count, skip) => {
+        if (count === 0n)
+            return;
+        const segment = image.segments[state.segmentIndex];
+        if (segment === undefined)
+            throw new RangeError("Bind location has no selected segment");
+        const stride = 8n + skip;
+        const end = state.address + (count - 1n) * stride + 8n;
+        if (state.address < segment.address || end > segment.address + segment.size)
+            throw new RangeError("Bind expansion leaves its file-backed segment");
+    };
+    const bind = (count, skip) => {
+        if (count === 0n)
+            return;
+        preflightRun(count, skip);
+        const stride = 8n + skip;
+        const binding = {
             symbol: state.symbol,
             library: range.stream === "weak"
                 ? null
                 : libraryName(state.ordinal, image.dylibs),
             weak: state.weak,
             addend: state.addend,
-        });
-        state.address += 8n + skip;
+        };
+        const previous = binds.at(-1);
+        if (previous !== undefined &&
+            previous.stride === stride &&
+            previous.start + previous.count * stride === state.address &&
+            previous.binding.symbol === binding.symbol &&
+            previous.binding.library === binding.library &&
+            previous.binding.weak === binding.weak &&
+            previous.binding.addend === binding.addend) {
+            previous.count += count;
+        }
+        else {
+            binds.push({ start: state.address, count, stride, binding });
+        }
+        state.address += count * stride;
     };
     while (cursor.at < end) {
         const byte = bytes[cursor.at++] ?? 0;
@@ -259,19 +291,20 @@ const readBindStream = (image, range, binds) => {
                     return;
                 break;
             case 0x90:
-                bind(0n);
+                bind(1n, 0n);
                 break;
             case 0xa0:
-                bind(uleb(bytes, cursor, end));
+                bind(1n, uleb(bytes, cursor, end));
                 break;
             case 0xb0:
-                bind(BigInt(byte & 0x0f) * 8n);
+                bind(1n, BigInt(byte & 0x0f) * 8n);
                 break;
             case 0xc0: {
+                if (range.stream === "lazy")
+                    throw new RangeError("Lazy bind streams do not support repeated bind opcodes");
                 const count = uleb(bytes, cursor, end);
                 const skip = uleb(bytes, cursor, end);
-                for (let index = 0n; index < count; index++)
-                    bind(skip);
+                bind(count, skip);
                 break;
             }
             default:
@@ -282,17 +315,24 @@ const readBindStream = (image, range, binds) => {
 /** Build pointer decoding for one slice from its fixup load commands. */
 export const parsePointerFixups = (bytes, commands, segments, baseAddress) => {
     const image = { bytes, segments, dylibs: commands.dylibs, baseAddress };
-    if (commands.chained !== null)
-        return chainedFixups(image, commands.chained);
+    const unreadRebaseBytes = commands.rebases.reduce((total, rebase) => total + rebase.size, 0);
+    if (commands.chained !== null) {
+        const chained = chainedFixups(image, commands.chained);
+        return unreadRebaseBytes === 0
+            ? chained
+            : { ...chained, unreadRebaseBytes };
+    }
     if (commands.binds.length === 0)
         return {
             kind: "none",
             formats: [],
             failures: [],
             issues: [],
+            examined: 0,
+            unreadRebaseBytes,
             decode: (_address, raw) => ({ kind: "rebase", target: raw }),
         };
-    const binds = new Map();
+    const binds = [];
     const failures = [];
     for (const stream of commands.binds)
         try {
@@ -306,11 +346,27 @@ export const parsePointerFixups = (bytes, commands, segments, baseAddress) => {
         formats: [],
         failures,
         issues: failures.map((message) => issue("pointer_fixups", "bind_stream_decode_failed", message)),
+        examined: commands.binds.length,
+        unreadRebaseBytes,
         decode(address, raw) {
-            const bound = binds.get(address);
-            return bound === undefined
+            let match;
+            for (const run of binds) {
+                const { start, count, stride } = run;
+                const distance = address - start;
+                if (distance >= 0n &&
+                    distance % stride === 0n &&
+                    distance / stride < count) {
+                    if (match !== undefined)
+                        return {
+                            kind: "unsupported",
+                            reason: `Ambiguous bind records target pointer location 0x${address.toString(16)}`,
+                        };
+                    match = run;
+                }
+            }
+            return match === undefined
                 ? { kind: "rebase", target: raw }
-                : { kind: "bind", ...bound };
+                : { kind: "bind", ...match.binding };
         },
     };
 };

package/dist/native/AppleMachoSelection.js

@@ -35,7 +35,9 @@ export const selectMachoSlice = (bytes, architecture) => {
     const headerEnd = 8 + count * stride;
     if (count > 128 || headerEnd > bytes.length)
         throw malformed("Malformed FAT architecture table");
-    const cpu = architecture === "arm64" ? 0x0100000c : 0x01000007;
+    const cpu = MACHO_CPU_TYPE[architecture];
+    if (cpu === undefined)
+        throw invalid("Requested FAT architecture is absent");
     const declarations = readFatSliceDeclarations(bytes.subarray(8, headerEnd), {
         count,
         wide: fat64,
@@ -63,8 +65,22 @@ export const selectMachoSlice = (bytes, architecture) => {
     }
     if (selected === undefined)
         throw invalid("Requested FAT architecture is absent");
+    if (selected.slice + 4 > bytes.length)
+        throw malformed("Truncated Mach-O header");
+    const sliceMagic = bytes.readUInt32LE(selected.slice);
+    if (sliceMagic === MH_MAGIC || sliceMagic === MH_CIGAM)
+        throw invalid(`Unsupported 32-bit Mach-O metadata for requested CPU type ${architecture}`);
     return selected;
 };
+/** CPU types admitted by `machArchitecture` in the domain binary target parser. */
+const MACHO_CPU_TYPE = {
+    x86: 7,
+    x86_64: 0x01000007,
+    arm: 12,
+    arm64: 0x0100000c,
+};
+const MH_MAGIC = 0xfeedface;
+const MH_CIGAM = 0xcefaedfe;
 /** Parse segments/sections for a little-endian 64-bit Mach-O architecture slice. */
 export const parseMachoLayout = (bytes, architecture) => {
     if (bytes.length < 4)
@@ -95,6 +111,7 @@ export const parseMachoLayout = (bytes, architecture) => {
         sections: [],
         dylibs: [],
         binds: [],
+        rebases: [],
         chained: null,
         baseAddress: undefined,
     };
@@ -115,7 +132,7 @@ export const parseMachoLayout = (bytes, architecture) => {
             collectFixupCommand(bytes, command, state);
         cursor += command.size;
     }
-    const { segments, sections, chained, binds, dylibs } = state;
+    const { segments, sections, chained, binds, rebases, dylibs } = state;
     const offset = (address, size = 1) => {
         const matches = segments.filter((segment) => address >= segment.address &&
             address + BigInt(size) <= segment.address + segment.size);
@@ -130,7 +147,7 @@ export const parseMachoLayout = (bytes, architecture) => {
         segments,
         sections,
         offset,
-        fixups: { chained, binds, dylibs },
+        fixups: { chained, binds, rebases, dylibs },
         baseAddress: state.baseAddress ?? 0n,
     };
 };
@@ -190,6 +207,9 @@ const collectFixupCommand = (bytes, { cursor, kind, size }, state) => {
     else if (kind === LC_DYLD_INFO || kind === LC_DYLD_INFO_ONLY) {
         if (size < 48)
             throw new RangeError("Truncated dyld-info command");
+        const rebase = range(cursor + 8);
+        if (rebase.size > 0)
+            state.rebases.push(rebase);
         for (const [at, stream] of [
             [cursor + 16, "bind"],
             [cursor + 24, "weak"],

package/dist/native/AppleObjcDispatchFacets.js

@@ -146,7 +146,7 @@ export const decodeObjcDispatchFacets = (input) => {
         if (superclass.name === null && superclass.address === null && !root)
             failures.push(`Superclass of ${name} requires external binding resolution`);
         const ivarList = read.pointer(ro + 48n);
-        let ivarCount = 0;
+        let ivarCount = meta ? null : 0;
         if (ivarList !== 0n && !meta) {
             const stride = read.u32(ivarList), count = read.u32(ivarList + 4n);
             if (stride !== 32)
@@ -198,8 +198,8 @@ export const decodeObjcDispatchFacets = (input) => {
                         BigInt(Number.MAX_SAFE_INTEGER)
                     ? Number(BigInt(item.implementation_address))
                     : null,
-                is_required: false,
-                is_optional: false,
+                is_required: null,
+                is_optional: null,
             })),
             properties: readObjcPropertiesOf(read, read.pointer(ro + 64n), {
                 owner: name,

package/dist/native/AppleObjcProperties.js

@@ -5,19 +5,29 @@ import { issue } from "./AppleDispatchDecodeFacts.js";
  */
 export const parsePropertyAttributes = (name, attributes) => {
     const tokens = attributes.length === 0 ? [] : splitAttributes(attributes);
-    const value = (code) => tokens.find((token) => token.startsWith(code))?.slice(1) ?? null;
+    const typeAttributes = tokens.filter((token) => token[0] === "T");
+    const typeAttribute = typeAttributes.length === 1 ? typeAttributes[0] : undefined;
+    const typeEncoding = typeAttribute !== undefined && typeAttribute.length > 1
+        ? typeAttribute.slice(1)
+        : null;
+    const value = (code) => tokens.find((token) => token[0] === code)?.slice(1) ?? null;
     return {
         name,
-        type_encoding: value("T"),
+        type_encoding: typeEncoding,
         attributes: tokens.map((token) => ({
             name: token.slice(0, 1),
             value: token.slice(1),
-            is_weak: token === "W",
-            is_atomic: false,
-            is_copy: token === "C",
-            is_strong: token === "&",
         })),
-        is_readonly: tokens.includes("R"),
+        atomicity: tokens.includes("N")
+            ? "nonatomic"
+            : typeEncoding === null
+                ? null
+                : "atomic",
+        is_readonly: tokens.includes("R")
+            ? true
+            : typeEncoding === null
+                ? null
+                : false,
         getter: value("G"),
         setter: value("S"),
     };