rea-agents 6.3.0 → 6.4.0

package/dist/domain/artifactInventoryEvidence.js

@@ -97,8 +97,12 @@ const validateCompleteInventory = (inventory) => {
         throw new TypeError("Artifact root occurrence does not match its manifest representation");
     for (const occurrence of inventory.occurrences)
         validateOccurrence(occurrence, inventory, nodeIds, occurrenceIds);
+    const occurrencesById = new Map(inventory.occurrences.map((occurrence) => [
+        occurrence.occurrence_id,
+        occurrence,
+    ]));
     for (const edge of inventory.edges)
-        validateEdge(edge, nodeIds, occurrenceIds);
+        validateEdge(edge, nodeIds, occurrencesById);
     for (const contradiction of inventory.integrityContradictions) {
         if (!nodeIds.has(contradiction.parent_artifact_id) ||
             !occurrenceIds.has(contradiction.occurrence_id))
@@ -138,19 +142,14 @@ const validateOccurrence = (occurrence, inventory, nodeIds, occurrenceIds) => {
     if (occurrence.occurrence_id !== expectedId)
         throw new TypeError("Artifact occurrence ID does not match its identity");
 };
-const validateEdge = (edge, nodeIds, occurrenceIds) => {
+const validateEdge = (edge, nodeIds, occurrences) => {
+    const occurrence = occurrences.get(edge.occurrence_id);
     if (!nodeIds.has(edge.parent_artifact_id) ||
-        !nodeIds.has(edge.child_artifact_id) ||
-        !occurrenceIds.has(edge.occurrence_id))
+        occurrence?.artifact_id === null ||
+        occurrence === undefined ||
+        !nodeIds.has(occurrence.artifact_id))
         throw new TypeError("Artifact edge references a missing graph member");
-    const semantic = {
-        parent_artifact_id: edge.parent_artifact_id,
-        child_artifact_id: edge.child_artifact_id,
-        relation: edge.relation,
-        occurrence_id: edge.occurrence_id,
-        logical_path: edge.logical_path,
-    };
-    if (edge.edge_id !== artifactEdgeId(semantic))
+    if (edge.edge_id !== artifactEdgeId(edge, occurrence))
         throw new TypeError("Artifact edge ID does not match its identity");
 };
 const mergeExact = (output, key, value, label) => {

package/dist/domain/artifactPathSyntax.js

@@ -6,7 +6,7 @@
  * Policy divergence (deliberate, not yet unified):
  * - Local artifact paths resolve against an inventoried container root and
  *   report rejected | external | not-found. Confinement is lexical
- *   (posix.normalize must stay inside the root).
+ *   (normalizeJoinedLogicalPath must stay inside the root).
  * - Live DOM destinations resolve against the document base URL and report
  *   approved | outside_policy | unsupported against allowedOrigins
  *   (see CdpCaptureDocuments.domDestination).

package/dist/domain/binaryTarget.js

@@ -103,6 +103,20 @@ const parseElf = (bytes, fileSize) => {
     const architecture = elfArchitecture(machine);
     if (architecture === undefined)
         return err("unsupported ELF architecture");
+    if (architecture === "mips")
+        return ok({
+            format: "elf",
+            architecture,
+            availableArchitectures: [architecture],
+            mips: {
+                elfClass: bytes[4] === 1 ? 32 : 64,
+                byteOrder: little ? "little" : "big",
+                type: little ? bytes.readUInt16LE(16) : bytes.readUInt16BE(16),
+                flags: little
+                    ? bytes.readUInt32LE(bytes[4] === 1 ? 36 : 48)
+                    : bytes.readUInt32BE(bytes[4] === 1 ? 36 : 48),
+            },
+        });
     return ok({
         format: "elf",
         architecture,
@@ -197,6 +211,8 @@ const elfArchitecture = (machine) => {
             return "x86";
         case 62:
             return "x86_64";
+        case 8: // EM_MIPS: ISA, ABI and byte order remain separate ELF facts.
+            return "mips";
         case 40:
             return "arm";
         case 183:

package/dist/domain/binaryTargetTypes.js

@@ -1 +1,8 @@
-export {};
+/** Provider-neutral CPU families detected from supported executable headers. */
+export const BINARY_ARCHITECTURES = [
+    "x86",
+    "x86_64",
+    "arm",
+    "arm64",
+    "mips",
+];

package/dist/domain/browserObservationSchemas.js

@@ -159,11 +159,10 @@ const browserConsoleEventSchema = z.object({
         retained_bytes: z.number().int().min(0),
     }),
 });
-const browserWebSocketEventSchema = z.object({
-    request_id: z.string(),
+const browserWebSocketFrameSchema = z.object({
     direction: z.enum(["sent", "received"]),
     opcode: z.number().int().min(0),
-    payload_bytes: z.number().int().min(0),
+    payload_bytes: z.number().int().min(0).nullable(),
     payload_shape: z
         .object({
         format: z.enum(["json", "text", "binary"]),
@@ -171,6 +170,11 @@ const browserWebSocketEventSchema = z.object({
     })
         .nullable(),
 });
+const browserWebSocketConnectionSchema = z.object({
+    request_id: z.string(),
+    url: z.string(),
+    events: z.array(browserWebSocketFrameSchema),
+});
 const browserWorkerSchema = z.object({
     target_id: z.string(),
     type: z.string(),
@@ -275,7 +279,7 @@ export const webPageInspectionSchema = z.object({
     resources: z.array(browserResourceSchema),
     network: z.object({
         requests: z.array(browserNetworkRequestSchema),
-        websocket_events: z.array(browserWebSocketEventSchema),
+        websocket_connections: z.array(browserWebSocketConnectionSchema),
         coverage_started_at: z.iso.datetime(),
         prior_activity_available: z.literal(false),
     }),

package/dist/domain/canonicalJsonDigestSteps.js

@@ -4,6 +4,9 @@ export function* canonicalJsonDigestSteps(value) {
     const hash = createHash("sha256");
     const ancestors = new Set();
     const stack = [{ kind: "value", value }];
+    const encodedKeys = new Map();
+    // Keep reusable key encodings within one existing digest-buffer quantum.
+    let remainingKeyCodeUnits = 8192;
     let buffered = "";
     let flushed = false;
     const emit = (part) => {
@@ -46,21 +49,22 @@ export function* canonicalJsonDigestSteps(value) {
                 stack.push(frame);
                 continue;
             }
+            let item;
             if (frame.kind === "array") {
                 if (frame.index === frame.length) {
                     emit("]");
                     ancestors.delete(frame.value);
                     continue;
                 }
-                const item = frame.value[frame.index];
-                if (item === undefined)
+                const element = frame.value[frame.index];
+                if (element === undefined)
                     throw new TypeError("Canonical JSON digest requires dense JSON arrays");
                 if (frame.index++ > 0)
                     emit(",");
-                stack.push(frame, { kind: "value", value: item });
-                continue;
+                stack.push(frame);
+                item = element;
             }
-            if (frame.kind === "object") {
+            else if (frame.kind === "object") {
                 if (frame.index === frame.keys.length) {
                     emit("}");
                     ancestors.delete(frame.value);
@@ -69,22 +73,39 @@ export function* canonicalJsonDigestSteps(value) {
                 const key = frame.keys[frame.index++];
                 if (key === undefined)
                     throw new TypeError("Canonical JSON object changed during hashing");
-                const item = frame.value[key];
-                if (item === undefined)
+                const property = frame.value[key];
+                if (property === undefined) {
+                    stack.push(frame);
                     continue;
+                }
                 if (frame.written++ > 0)
                     emit(",");
                 if (key.length > 8192) {
                     emit('"');
-                    stack.push(frame, { kind: "value", value: item }, { kind: "separator" }, { kind: "string", value: key, index: 0 });
+                    stack.push(frame, { kind: "value", value: property }, { kind: "separator" }, { kind: "string", value: key, index: 0 });
                     continue;
                 }
-                emit(JSON.stringify(key));
+                let encodedKey = encodedKeys.get(key);
+                if (encodedKey === undefined) {
+                    encodedKey = JSON.stringify(key);
+                    if (encodedKey.length <= remainingKeyCodeUnits) {
+                        encodedKeys.set(key, encodedKey);
+                        remainingKeyCodeUnits -= encodedKey.length;
+                    }
+                }
+                emit(encodedKey);
                 emit(":");
-                stack.push(frame, { kind: "value", value: item });
-                continue;
+                stack.push(frame);
+                item = property;
+            }
+            else {
+                item = frame.value;
+            }
+            // Resume containers directly; scalar members need no temporary value frame.
+            if (flushed) {
+                flushed = false;
+                yield;
             }
-            const item = frame.value;
             if (typeof item === "string" && item.length > 8192) {
                 emit('"');
                 stack.push({ kind: "string", value: item, index: 0 });
@@ -128,6 +149,7 @@ export function* canonicalJsonDigestSteps(value) {
     finally {
         stack.length = 0;
         ancestors.clear();
+        encodedKeys.clear();
         buffered = "";
     }
 }

package/dist/domain/compactStringIdentity.js

@@ -0,0 +1,9 @@
+import { digestCanonicalValue } from "./canonicalDigest.js";
+/** Retain short exact string keys or commit their value in a reserved digest namespace. */
+export const compactStringIdentityKey = (value) => {
+    const prefix = "value-sha256:";
+    const digestKey = `${prefix}${digestCanonicalValue(value, "String identity")}`;
+    return value.length <= digestKey.length && !value.startsWith(prefix)
+        ? value
+        : digestKey;
+};

package/dist/domain/evidence.js

@@ -2,6 +2,7 @@ import { z } from "zod";
 import { digestCanonicalValue } from "./canonicalDigest.js";
 import { canonicalJsonDigestSteps } from "./canonicalJsonDigestSteps.js";
 import { analysisProfileSchema, } from "./analysisProfile.js";
+import { BINARY_ARCHITECTURES, } from "./binaryTargetTypes.js";
 import { jsonObjectSchema, jsonValueSchema, jsonValueValidationIssue, jsonValueValidationSteps, } from "./jsonValue.js";
 import { freezeJsonSnapshot, isImmutableJsonSnapshot, } from "./immutableJson.js";
 import { digestSchema } from "./../domain/digests.js";
@@ -41,7 +42,7 @@ const subjectSchema = z.object({
         "javascript-bundle",
         "entitlements",
     ]),
-    architecture: z.enum(["x86", "x86_64", "arm", "arm64"]).nullable(),
+    architecture: z.enum(BINARY_ARCHITECTURES).nullable(),
     local_path: z.string(),
 });
 /** Source location attached to an evidence observation. */

package/dist/domain/evidenceRecordSummary.js

@@ -0,0 +1,144 @@
+import { z } from "zod";
+import { digestSchema, prefixedDigestSchema } from "./digests.js";
+import { evidenceSchema } from "./evidence.js";
+/** Exact retained-record selectors; selection never resolves a provider address. */
+export const evidenceRecordFiltersSchema = z.strictObject({
+    evidence_id: prefixedDigestSchema("ev").optional(),
+    operation: z.string().min(1).optional(),
+    target_sha256: digestSchema.optional(),
+    analysis_profile_digest: digestSchema.optional(),
+    procedure_address: z.string().min(1).optional(),
+});
+const countSchema = z.number().int().nonnegative();
+const nativeMetadataSchema = z.object({
+    procedure: z.object({ address: z.string(), name: z.string().nullish() }),
+    native_value_flow: z.unknown().optional(),
+});
+const valueFlowMetadataSchema = z.union([
+    z.object({
+        available: z.literal(true),
+        truncated: z.boolean(),
+        omitted_operations_lower_bound: countSchema.optional(),
+        known_omitted_inputs: countSchema.optional(),
+        known_omitted_edges: countSchema.optional(),
+    }),
+    z.object({ available: z.literal(false), reason: z.string() }),
+]);
+const nativeSummarySchema = z.discriminatedUnion("available", [
+    z.strictObject({
+        available: z.literal(true),
+        procedure_address: z.string(),
+        procedure_name: z.string().nullable(),
+        value_flow: z.discriminatedUnion("status", [
+            z.strictObject({
+                status: z.literal("observed"),
+                truncated: z.boolean(),
+                omitted_operations_lower_bound: countSchema.nullable(),
+                known_omitted_inputs: countSchema.nullable(),
+                known_omitted_edges: countSchema.nullable(),
+            }),
+            z.strictObject({ status: z.literal("unavailable"), reason: z.string() }),
+            z.strictObject({ status: z.literal("not-recorded") }),
+            z.strictObject({ status: z.literal("unknown"), reason: z.string() }),
+        ]),
+    }),
+    z.strictObject({
+        available: z.literal(false),
+        reason: z.enum(["different-operation", "not-recorded-or-incompatible"]),
+    }),
+]);
+/** Metadata for complete retained records, independent of analysis completeness. */
+export const evidenceBundleSummarySchema = z.strictObject({
+    kind: z.literal("evidence-bundle-summary"),
+    filters: z.record(z.string(), z.string()),
+    total_retained_records: countSchema,
+    matching_records: countSchema,
+    unknown_revisions: countSchema,
+    records: z.array(z.strictObject({
+        evidence_id: evidenceSchema.shape.evidence_id,
+        subject: evidenceSchema.shape.subject,
+        provider: evidenceSchema.shape.provider,
+        operation: evidenceSchema.shape.operation,
+        confidence: evidenceSchema.shape.confidence,
+        authority: evidenceSchema.shape.authority,
+        analysis_profile_digest: digestSchema.nullable(),
+        retention: z.literal("complete-record"),
+        limitation_count: countSchema,
+        native_dossier: nativeSummarySchema,
+    })),
+});
+const nativeSummary = (evidence) => {
+    if (evidence.operation !== "analyze_function")
+        return { available: false, reason: "different-operation" };
+    // Read only producer metadata. Parsing the full dossier would allocate every
+    // large collection merely to discover its already authenticated parent ID.
+    const parsed = nativeMetadataSchema.safeParse(evidence.normalized_result);
+    if (!parsed.success)
+        return { available: false, reason: "not-recorded-or-incompatible" };
+    const flow = valueFlowMetadataSchema.safeParse(parsed.data.native_value_flow);
+    return {
+        available: true,
+        procedure_address: parsed.data.procedure.address,
+        procedure_name: parsed.data.procedure.name ?? null,
+        value_flow: parsed.data.native_value_flow == null
+            ? { status: "not-recorded" }
+            : !flow.success
+                ? {
+                    status: "unknown",
+                    reason: "Value-flow metadata has an incompatible representation.",
+                }
+                : flow.data.available
+                    ? {
+                        status: "observed",
+                        truncated: flow.data.truncated,
+                        omitted_operations_lower_bound: flow.data.omitted_operations_lower_bound ?? null,
+                        known_omitted_inputs: flow.data.known_omitted_inputs ?? null,
+                        known_omitted_edges: flow.data.known_omitted_edges ?? null,
+                    }
+                    : { status: "unavailable", reason: flow.data.reason },
+    };
+};
+/** Discover retained Evidence without reading or copying its complete payloads. */
+export const summarizeEvidenceBundle = (bundle, filters = {}) => {
+    const selectedFilters = {};
+    for (const [field, value] of Object.entries(filters))
+        if (value !== undefined)
+            selectedFilters[field] = value;
+    const records = [];
+    for (const evidence of bundle.records) {
+        if ((filters.evidence_id !== undefined &&
+            filters.evidence_id !== evidence.evidence_id) ||
+            (filters.operation !== undefined &&
+                filters.operation !== evidence.operation) ||
+            (filters.target_sha256 !== undefined &&
+                filters.target_sha256 !== evidence.subject?.digest.sha256) ||
+            (filters.analysis_profile_digest !== undefined &&
+                filters.analysis_profile_digest !== evidence.analysis_profile?.digest))
+            continue;
+        const native = nativeSummary(evidence);
+        if (filters.procedure_address !== undefined &&
+            (!native.available ||
+                filters.procedure_address !== native.procedure_address))
+            continue;
+        records.push({
+            evidence_id: evidence.evidence_id,
+            subject: evidence.subject,
+            provider: evidence.provider,
+            operation: evidence.operation,
+            confidence: evidence.confidence,
+            authority: evidence.authority,
+            analysis_profile_digest: evidence.analysis_profile?.digest ?? null,
+            retention: "complete-record",
+            limitation_count: evidence.limitations.length,
+            native_dossier: native,
+        });
+    }
+    return {
+        kind: "evidence-bundle-summary",
+        filters: selectedFilters,
+        total_retained_records: bundle.records.length,
+        matching_records: records.length,
+        unknown_revisions: bundle.unknowns.length,
+        records,
+    };
+};

package/dist/domain/inputIssueProjection.js

@@ -6,8 +6,23 @@ export const projectInputIssues = (issues, input) => issues.flatMap((issue) => p
 const projectIssue = (issue, input) => {
     const path = issue.path.flatMap((part) => typeof part === "string" || typeof part === "number" ? [part] : []);
     // Branch issue paths are relative to the union; branches often agree.
-    if (issue.code === "invalid_union")
+    if (issue.code === "invalid_union") {
+        // Unmatched discriminators and ambiguous unions have no branch issues.
+        // Keep their outer failure instead of flattening it into an empty list.
+        if (issue.errors.length === 0) {
+            const expected = "options" in issue ? issue.options?.filter(isSafeExpected) : undefined;
+            return [
+                {
+                    path,
+                    reason: valueAtPath(input, path) === undefined
+                        ? "missing_argument"
+                        : "invalid_value",
+                    ...(expected === undefined ? {} : { expected }),
+                },
+            ];
+        }
         return uniqueIssues(issue.errors.flatMap((branch) => branch.flatMap((branchIssue) => projectIssue({ ...branchIssue, path: [...issue.path, ...branchIssue.path] }, input))));
+    }
     if (issue.code === "invalid_key")
         return issue.issues.flatMap((keyIssue) => projectIssue({ ...keyIssue, path: [...issue.path, ...keyIssue.path] }, input));
     if (issue.code === "unrecognized_keys")

package/dist/domain/javascript/electronStaticAnalysisBrowser.js

@@ -1,21 +1,21 @@
 import * as t from "@babel/types";
-import { boundedExpression, collectContextBridgeMembers, electronStaticValue, objectProperty, } from "./electronStaticAnalysisValues.js";
+import { boundedExpression, collectContextBridgeMembers, electronCalleePath, electronStaticValue, objectProperty, } from "./electronStaticAnalysisValues.js";
 import { compareUnicodeCodePoints } from "../unicodeCodePointOrder.js";
 import { addLocatedFinding } from "./javascriptStaticAnalysisFindings.js";
-import { argumentNode, calleeName, range, staticPath, staticPathResolutionContext, } from "./javascriptStaticAnalysisHelpers.js";
+import { argumentNode, range, staticPath, staticPathResolutionContext, } from "./javascriptStaticAnalysisHelpers.js";
 import { semanticStaticPropertyName } from "./javascriptAstValues.js";
 /** Inspect BrowserWindow, contextBridge, and utility-process syntax. */
 export const inspectElectronBrowserNode = (node, context) => {
     if (t.isNewExpression(node))
         inspectBrowserWindow(node, context);
-    if (!t.isCallExpression(node))
+    if (!t.isCallExpression(node) && !t.isOptionalCallExpression(node))
         return;
     inspectContextBridge(node, context);
     inspectUtilityProcess(node, context);
 };
 const inspectBrowserWindow = (node, context) => {
-    const name = calleeName(node.callee);
-    if (name !== "BrowserWindow" && !name.endsWith(".BrowserWindow"))
+    const path = electronCalleePath(node.callee, context);
+    if (path?.length !== 1 || path[0] !== "BrowserWindow")
         return;
     const options = argumentNode(node.arguments[0]);
     const collected = collectWindowOptions(context.source, options);
@@ -34,7 +34,7 @@ const inspectBrowserWindow = (node, context) => {
     };
     addLocatedFinding(context, {
         collection: context.accumulator.browserWindows,
-        key: `electron-window\0${name}`,
+        key: "electron-window\0BrowserWindow",
         node,
         value: finding,
     });
@@ -107,11 +107,10 @@ const collectWebPreferences = (source, object) => {
     };
 };
 const inspectContextBridge = (node, context) => {
-    const name = calleeName(node.callee);
-    const main = name === "contextBridge.exposeInMainWorld" ||
-        name.endsWith(".contextBridge.exposeInMainWorld");
-    const isolated = name === "contextBridge.exposeInIsolatedWorld" ||
-        name.endsWith(".contextBridge.exposeInIsolatedWorld");
+    const path = electronCalleePath(node.callee, context);
+    const exposureMethod = path?.length === 2 && path[0] === "contextBridge" ? path[1] : undefined;
+    const main = exposureMethod === "exposeInMainWorld";
+    const isolated = exposureMethod === "exposeInIsolatedWorld";
     if (!main && !isolated)
         return;
     const keyNode = argumentNode(node.arguments[isolated ? 1 : 0]);
@@ -148,8 +147,8 @@ const inspectContextBridge = (node, context) => {
     });
 };
 const inspectUtilityProcess = (node, context) => {
-    const name = calleeName(node.callee);
-    if (name !== "utilityProcess.fork" && !name.endsWith(".utilityProcess.fork"))
+    const path = electronCalleePath(node.callee, context);
+    if (path?.length !== 2 || path[0] !== "utilityProcess" || path[1] !== "fork")
         return;
     const moduleNode = argumentNode(node.arguments[0]);
     const modulePath = moduleNode === undefined ? undefined : staticPath(moduleNode);

package/dist/domain/javascript/electronStaticAnalysisIpc.js

@@ -1,12 +1,12 @@
 import * as t from "@babel/types";
-import { boundedExpression, electronStaticValue, handlerKind, } from "./electronStaticAnalysisValues.js";
+import { boundedExpression, electronCalleePath, electronStaticValue, handlerKind, } from "./electronStaticAnalysisValues.js";
 import { addLocatedFinding } from "./javascriptStaticAnalysisFindings.js";
 import { argumentNode, calleeName, range, } from "./javascriptStaticAnalysisHelpers.js";
 import { semanticStaticPropertyName } from "./javascriptAstValues.js";
 import { compositeKey } from "../unicodeCodePointOrder.js";
 /** Inspect Electron IPC operations and validation candidates. */
 export const inspectElectronIpcNode = (node, context) => {
-    if (t.isCallExpression(node)) {
+    if (t.isCallExpression(node) || t.isOptionalCallExpression(node)) {
         inspectIpcCall(node, context);
         inspectValidationCall(node, context);
     }
@@ -14,8 +14,7 @@ export const inspectElectronIpcNode = (node, context) => {
         inspectValidationComparison(node, context);
 };
 const inspectIpcCall = (node, context) => {
-    const name = calleeName(node.callee);
-    const descriptor = ipcDescriptor(name);
+    const descriptor = ipcDescriptor(electronCalleePath(node.callee, context));
     if (descriptor === undefined)
         return;
     const channelNode = argumentNode(node.arguments[0]);
@@ -129,9 +128,12 @@ const addValidation = (context, node, input) => {
         value: finding,
     });
 };
-const ipcDescriptor = (name) => {
-    const renderer = suffixOperation(name, "ipcRenderer");
-    if (renderer !== undefined) {
+const ipcDescriptor = (path) => {
+    if (path?.length !== 2)
+        return undefined;
+    const [object, operation] = path;
+    if (object === "ipcRenderer" && operation !== undefined) {
+        const renderer = operation;
         switch (renderer) {
             case "send":
                 return { side: "renderer", operation: "send", mode: "send" };
@@ -157,7 +159,7 @@ const ipcDescriptor = (name) => {
                 return { side: "renderer", operation: "once", mode: "listen" };
         }
     }
-    const main = suffixOperation(name, "ipcMain");
+    const main = object === "ipcMain" ? operation : undefined;
     switch (main) {
         case "on":
             return { side: "main", operation: "on", mode: "listen" };
@@ -171,19 +173,8 @@ const ipcDescriptor = (name) => {
             return undefined;
     }
 };
-const suffixOperation = (name, object) => {
-    const marker = `${object}.`;
-    const index = name.lastIndexOf(marker);
-    if (index < 0)
-        return undefined;
-    const prefix = name.slice(0, index);
-    if (prefix !== "" && !prefix.endsWith("."))
-        return undefined;
-    const operation = name.slice(index + marker.length);
-    return operation.includes(".") ? undefined : operation;
-};
 const senderSubject = (node) => {
-    const name = t.isCallExpression(node)
+    const name = t.isCallExpression(node) || t.isOptionalCallExpression(node)
         ? calleeName(node.callee)
         : calleeName(node);
     if (/(?:^|\.)sender\.getURL$/u.test(name))