rea-agents 6.4.0 → 6.5.0

package/dist/application/UpdateMaintenance.js

@@ -1,11 +1,7 @@
 import { z } from "zod";
-import { PRODUCT_IDENTITY } from "../identity.js";
 import { isOwnedClientRegistrationCommand } from "./ClientRegistrationIdentity.js";
-import { readClientRegistrationStatuses } from "./ClientRegistrationStatus.js";
-import { clientServerForcedEnabled, clientServerListedDisabled, effectiveClientServer, parseClientConfiguration, } from "./ClientConfigurationDocument.js";
-import { supportedClients } from "./SupportedClients.js";
+import { readClientRegistrationInspections } from "./ClientRegistrationStatus.js";
 import { existingSkillDestinations } from "./SetupSkill.js";
-import { readRegularFileText } from "./RegularFileRead.js";
 const setupPlanSchema = z.object({
     status: z.literal("planned"),
     plannedActions: z.array(z.object({
@@ -21,34 +17,20 @@ const setupPlanSchema = z.object({
     })),
 });
 /** Discover owned registrations and REA skills without writes. */
-export const existingMaintenanceScope = async (home, entryPoint, environment) => {
-    const registrations = await readClientRegistrationStatuses(home, entryPoint, {
+export const existingMaintenanceScope = async (home, entryPoint, environment, resources) => {
+    const registrations = await readClientRegistrationInspections(home, entryPoint, {
         environment,
+        ...(resources === undefined ? {} : { resources }),
     });
-    const supported = supportedClients(home, process.platform, environment);
     const clients = [];
-    for (const registration of registrations) {
-        if ((registration.state !== "aligned" && registration.state !== "stale") ||
+    for (const { status: registration, activation } of registrations) {
+        if (activation !== "enabled" ||
+            (registration.state !== "aligned" && registration.state !== "stale") ||
             !isOwnedClientRegistrationCommand(registration.command, entryPoint))
             continue;
-        const client = supported.find(({ name }) => name === registration.client);
-        if (client === undefined)
-            continue;
-        const parsed = parseClientConfiguration(await readRegularFileText(client.configPath), client.format);
-        const enabled = z
-            .object({
-            enabled: z.boolean().optional(),
-            disabled: z.boolean().optional(),
-        })
-            .parse(effectiveClientServer(parsed, PRODUCT_IDENTITY.mcpServerKey));
-        // Root disable lists override enabled entries and OMP's force-on allowlist.
-        if ((enabled.enabled !== false ||
-            clientServerForcedEnabled(parsed, PRODUCT_IDENTITY.mcpServerKey)) &&
-            enabled.disabled !== true &&
-            !clientServerListedDisabled(parsed, PRODUCT_IDENTITY.mcpServerKey))
-            clients.push(client.name);
+        clients.push(registration.client);
     }
-    const skillDestinations = await existingSkillDestinations(home, environment);
+    const skillDestinations = await existingSkillDestinations(home, environment, process.platform, resources);
     return {
         clients,
         skill: skillDestinations.length > 0,
@@ -56,9 +38,9 @@ export const existingMaintenanceScope = async (home, entryPoint, environment) =>
     };
 };
 /** Ask the verified new executable to plan only existing REA integrations. */
-export const planIntegrationMaintenance = async (home, entryPoint, environment, execute) => {
+export const planIntegrationMaintenance = async (home, entryPoint, environment, execute, resources) => {
     try {
-        const scope = await existingMaintenanceScope(home, entryPoint, environment);
+        const scope = await existingMaintenanceScope(home, entryPoint, environment, resources);
         const skillDestinations = scope.skillDestinations ?? [];
         if (scope.clients.length === 0 && !scope.skill)
             return { status: "current", plannedActions: [] };

package/dist/application/UpdateRuntime.js

@@ -1,27 +1,30 @@
-import { realpath } from "node:fs/promises";
+import { realpath, stat } from "node:fs/promises";
 import { homeDirectoryFromEnvironment } from "../config/homeDirectory.js";
 import { basename, dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import spawn from "cross-spawn";
+import { lt, valid } from "semver";
 import { PRODUCT_IDENTITY } from "../identity.js";
+import { ArtifactResourceScope } from "../artifacts/ArtifactResourceScope.js";
 import { err, ok } from "../domain/result.js";
 import { safeParseJson } from "../domain/safeJson.js";
 import { updateInstallCommand, } from "./Update.js";
 import { planIntegrationMaintenance } from "./UpdateMaintenance.js";
+import { withoutPackageRunnerIdentity } from "./ClientRegistrationIdentity.js";
 /** Run an updater subprocess with complete diagnostics and isolated machine output. */
-export const runUpdateCommand = (command, selectedEnvironment, output = "structured") => new Promise((resolveResult) => {
+export const runUpdateCommand = (command, selectedEnvironment, output = "structured", workingDirectory = undefined) => new Promise((resolveResult) => {
     const [executable, ...args] = command;
     if (executable === undefined) {
         resolveResult(err("No executable supplied."));
         return;
     }
-    const environment = { ...selectedEnvironment };
-    // A fresh installed entry point must not inherit npx's invocation identity.
-    delete environment.npm_command;
+    // A fresh installed entry point must not inherit a package runner's invocation identity.
+    const environment = withoutPackageRunnerIdentity(selectedEnvironment);
     const child = spawn(executable, args, {
         stdio: ["ignore", "pipe", "pipe"],
         env: environment,
         windowsHide: true,
+        ...(workingDirectory === undefined ? {} : { cwd: workingDirectory }),
     });
     let stdout = "";
     let stderr = "";
@@ -70,7 +73,7 @@ export const detectNpmInstallation = async (packageRoot, host) => {
             const prefix = await host.globalPrefix();
             return prefix.length === 0
                 ? undefined
-                : { prefix, packageRoot: canonicalPackageRoot };
+                : { manager: "npm", prefix, packageRoot: canonicalPackageRoot };
         }
     }
     catch (cause) {
@@ -83,9 +86,64 @@ export const detectNpmInstallation = async (packageRoot, host) => {
         basename(nodeModules) !== "node_modules" ||
         basename(library) !== "lib")
         return undefined;
-    return { prefix: dirname(library), packageRoot: canonicalPackageRoot };
+    return {
+        manager: "npm",
+        prefix: dirname(library),
+        packageRoot: canonicalPackageRoot,
+    };
+};
+const nonemptyEnvironment = (value) => value === undefined || value.length === 0 ? undefined : value;
+/**
+ * Bun's global project directory for the selected environment, in Bun's precedence:
+ * BUN_INSTALL_GLOBAL_DIR, then $BUN_INSTALL/install/global, then
+ * $XDG_CACHE_HOME/.bun/install/global, then ~/.bun/install/global.
+ * Resolve against the caller's cwd before reusing the path as a subprocess cwd.
+ */
+export const bunGlobalDirectory = (environment, platform) => {
+    const explicit = nonemptyEnvironment(environment.BUN_INSTALL_GLOBAL_DIR);
+    if (explicit !== undefined)
+        return resolve(explicit);
+    const installRoot = nonemptyEnvironment(environment.BUN_INSTALL);
+    if (installRoot !== undefined)
+        return resolve(installRoot, "install", "global");
+    const cacheRoot = nonemptyEnvironment(environment.XDG_CACHE_HOME) ??
+        homeDirectoryFromEnvironment(environment, platform);
+    return resolve(cacheRoot, ".bun", "install", "global");
+};
+/**
+ * Identify the running package as Bun's global installation.
+ * Bun walks up to an ancestor project when its global directory has no
+ * package.json, so the global manifest must exist before `bun add --global`
+ * can be trusted to update this package root.
+ */
+export const detectBunInstallation = async (packageRoot, globalDirectory, host) => {
+    try {
+        const canonicalPackageRoot = await host.canonicalPath(packageRoot);
+        const globalPackageRoot = await host.canonicalPath(join(globalDirectory, "node_modules", PRODUCT_IDENTITY.packageName));
+        if (canonicalPackageRoot !== globalPackageRoot ||
+            !(await host.isFile(join(globalDirectory, "package.json"))))
+            return undefined;
+        return {
+            manager: "bun",
+            globalDirectory,
+            packageRoot: canonicalPackageRoot,
+        };
+    }
+    catch (cause) {
+        // best-effort cleanup: optional install-location probing; unknown means not Bun-managed.
+        void cause;
+        return undefined;
+    }
 };
 const INVALID_NPM_RELEASE_METADATA = "Invalid npm release metadata: expected a version string or a single-element version array.";
+/** bun info arguments for dist-tags.latest; Bun resolves its configured registry. */
+export const BUN_LATEST_VERSION_COMMAND = [
+    "bun",
+    "info",
+    PRODUCT_IDENTITY.packageName,
+    "dist-tags.latest",
+    "--json",
+];
 /** npm view arguments for dist-tags.latest, scoped to the owning prefix when known. */
 export const npmLatestVersionCommand = (installation) => [
     "npm",
@@ -120,7 +178,7 @@ const readNpmLatestVersion = (value) => {
     return typeof only === "string" ? nonemptyVersion(only) : undefined;
 };
 const nonemptyVersion = (value) => value.length === 0 ? undefined : value;
-/** Classify npm view output as a version or a lookup failure. */
+/** Classify `npm view` or `bun info` output as a version or a lookup failure. */
 export const npmReleaseLookup = (response) => {
     if (!response.ok)
         return err({ kind: "unavailable", detail: response.error });
@@ -129,22 +187,78 @@ export const npmReleaseLookup = (response) => {
         ? ok(parsed.value)
         : err({ kind: "invalid-metadata", detail: parsed.error });
 };
-/** Create npm, registry, verification, and read-only maintenance effects. */
-export const systemUpdateHost = (packageRoot = fileURLToPath(new URL("../..", import.meta.url)), home = undefined, environment = process.env) => ({
-    installation: () => detectNpmInstallation(packageRoot, {
-        canonicalPath: realpath,
-        globalRoot: () => requireCommandOutput(["npm", "root", "--global"], environment),
-        globalPrefix: () => requireCommandOutput(["npm", "prefix", "--global"], environment),
-    }),
-    latestVersion: async (installation) => npmReleaseLookup(await runUpdateCommand(npmLatestVersionCommand(installation), environment)),
-    installVersion: async (installation, version, output) => {
-        const result = await runUpdateCommand(updateInstallCommand(installation, version), environment, output);
-        return result.ok ? ok(undefined) : result;
-    },
-    installedVersion: (installation) => runUpdateCommand([
-        process.execPath,
-        join(installation.packageRoot, "scripts", "rea.mjs"),
-        "--version",
-    ], environment),
-    planMaintenance: (installation) => planIntegrationMaintenance(home ?? homeDirectoryFromEnvironment(environment, process.platform), join(installation.packageRoot, "scripts", "rea.mjs"), environment, (command) => runUpdateCommand(command, environment)),
-});
+const isFile = async (path) => {
+    try {
+        return (await stat(path)).isFile();
+    }
+    catch (cause) {
+        // best-effort cleanup: a missing or unreadable manifest is not an owned Bun global project.
+        void cause;
+        return false;
+    }
+};
+/**
+ * Environment and working directory for package-manager subprocesses.
+ * Bun commands run inside the identified global project with that directory
+ * pinned, so the caller's current project and Bun's ancestor search are never
+ * selected. npm keeps the caller's working directory; its prefix is explicit.
+ */
+const packageManagerContext = (installation, environment) => installation?.manager === "bun"
+    ? {
+        environment: {
+            ...environment,
+            BUN_INSTALL_GLOBAL_DIR: installation.globalDirectory,
+        },
+        workingDirectory: installation.globalDirectory,
+    }
+    : { environment, workingDirectory: undefined };
+/** Create package-manager, registry, verification, and read-only maintenance effects. */
+export const systemUpdateHost = (packageRoot = fileURLToPath(new URL("../..", import.meta.url)), home = undefined, environment = process.env) => {
+    const resources = new ArtifactResourceScope();
+    return {
+        installation: async () => (await detectBunInstallation(packageRoot, bunGlobalDirectory(environment, process.platform), { canonicalPath: realpath, isFile })) ??
+            detectNpmInstallation(packageRoot, {
+                canonicalPath: realpath,
+                globalRoot: () => requireCommandOutput(["npm", "root", "--global"], environment),
+                globalPrefix: () => requireCommandOutput(["npm", "prefix", "--global"], environment),
+            }),
+        latestVersion: async (installation) => {
+            const context = packageManagerContext(installation, environment);
+            if (installation?.manager === "bun") {
+                const version = await runUpdateCommand(["bun", "--version"], context.environment, "structured", context.workingDirectory);
+                if (!version.ok)
+                    return err({ kind: "unavailable", detail: version.error });
+                const bunVersion = valid(version.value);
+                // bun info was introduced in 1.2.17; older releases reserve the command.
+                if (bunVersion === null || lt(bunVersion, "1.2.17"))
+                    return err({
+                        kind: "unsupported-package-manager",
+                        detail: `REA updates for Bun global installations require Bun 1.2.17 or later; bun --version returned ${JSON.stringify(version.value)}. Upgrade Bun manually, then rerun rea update.`,
+                    });
+            }
+            return npmReleaseLookup(await runUpdateCommand(installation?.manager === "bun"
+                ? BUN_LATEST_VERSION_COMMAND
+                : npmLatestVersionCommand(installation), context.environment, "structured", context.workingDirectory));
+        },
+        installVersion: async (installation, version, output) => {
+            const context = packageManagerContext(installation, environment);
+            const result = await runUpdateCommand(updateInstallCommand(installation, version), context.environment, output, context.workingDirectory);
+            return result.ok ? ok(undefined) : result;
+        },
+        installedVersion: (installation) => runUpdateCommand([
+            process.execPath,
+            join(installation.packageRoot, "scripts", "rea.mjs"),
+            "--version",
+        ], environment),
+        planMaintenance: (installation) => planIntegrationMaintenance(home ?? homeDirectoryFromEnvironment(environment, process.platform), join(installation.packageRoot, "scripts", "rea.mjs"), environment, (command) => runUpdateCommand(command, environment), resources),
+        close: async () => {
+            try {
+                await resources.close();
+                return undefined;
+            }
+            catch (cause) {
+                return `Update resource cleanup failed: ${cause instanceof Error ? cause.message : String(cause)}`;
+            }
+        },
+    };
+};

package/dist/application/WebModuleTraceService.js

@@ -1,3 +1,4 @@
+import { closeOwnedWebResources } from "./closeOwnedWebResources.js";
 import { isAbsolute } from "node:path";
 import { z } from "zod";
 import { AnalysisCancelledError, AnalysisCapabilityUnavailableError, AnalysisInputError, AnalysisOutputError, } from "../domain/analysisErrorCore.js";
@@ -43,6 +44,12 @@ export class WebModuleTraceService {
         this.artifacts = artifacts;
         this.resolver = resolver;
     }
+    close() {
+        return closeOwnedWebResources([
+            this.artifacts.close?.bind(this.artifacts),
+            this.resolver.close?.bind(this.resolver),
+        ], "Web module trace cleanup failed");
+    }
     async trace(rawInput, options) {
         if (isAborted(options?.signal))
             return err(new AnalysisCancelledError(OPERATION));

package/dist/application/WebNetworkCaptureService.js

@@ -3,11 +3,12 @@ import { excludeCaptureCoordinates } from "../domain/webNetworkCaptureCoordinate
 import { redactExplicitText } from "../domain/explicitSensitiveValues.js";
 import { isAbsolute } from "node:path";
 import { AnalysisCancelledError, AnalysisInputError, AnalysisOutputError, } from "../domain/analysisErrorCore.js";
+import { createAnalysisProfile } from "../domain/analysisProfile.js";
 import { createEvidence } from "../domain/evidence.js";
 import { analysisInputErrorFromIssues } from "../domain/inputIssueProjection.js";
 import { jsonObjectSchema } from "../domain/jsonValue.js";
 import { err, ok } from "../domain/result.js";
-import { inspectWebNetworkCaptureInputSchema, webNetworkCaptureSchema, } from "../domain/webNetworkCapture.js";
+import { inspectWebNetworkCaptureInputSchema, captureSensitiveValues, webNetworkCaptureSchema, } from "../domain/webNetworkCapture.js";
 const OPERATION = "inspect_web_network_capture";
 /** Shared CLI/MCP historical inspection preserves caller selection and producer record identity. */
 export class WebNetworkCaptureService {
@@ -15,16 +16,15 @@ export class WebNetworkCaptureService {
     constructor(port) {
         this.port = port;
     }
+    /** Release resources retained by the selected capture adapter. */
+    close() {
+        return this.port.close?.() ?? Promise.resolve();
+    }
     /** Return selected complete records inline, without inventing live browser attribution. */
     async inspect(rawInput, options) {
         if (options?.signal?.aborted)
             return err(new AnalysisCancelledError(OPERATION));
-        const declarations = inspectWebNetworkCaptureInputSchema.shape.sensitive_values.safeParse(typeof rawInput === "object" &&
-            rawInput !== null &&
-            "sensitive_values" in rawInput
-            ? rawInput.sensitive_values
-            : undefined);
-        const failure = (error) => err(redactExplicitFailure(error, declarations.success ? declarations.data : []));
+        const failure = (error) => err(redactExplicitFailure(error, captureSensitiveValues(rawInput)));
         const parsed = inspectWebNetworkCaptureInputSchema.safeParse(rawInput);
         if (!parsed.success)
             return failure(analysisInputErrorFromIssues(OPERATION, parsed.error.issues, rawInput, {
@@ -124,6 +124,15 @@ export class WebNetworkCaptureService {
                     ? [...limitations, subjectUnavailableReason]
                     : limitations,
             },
+            ...(safeValue.format !== "qlog"
+                ? {}
+                : {
+                    analysisProfile: createAnalysisProfile(value.decoder, {
+                        qlog_profile: safeValue.qlog.profile,
+                        clock: safeValue.qlog.clock,
+                        scope: safeValue.qlog.scope,
+                    }),
+                }),
             confidence: "observed",
             authority: "historical-reference",
             limitations,

package/dist/application/WebSourceLocationService.js

@@ -1,3 +1,4 @@
+import { closeOwnedWebResources } from "./closeOwnedWebResources.js";
 import { createHash } from "node:crypto";
 import { isAbsolute } from "node:path";
 import { z } from "zod";
@@ -25,8 +26,16 @@ const LIMITATIONS = [
     "Embedded source hashes identify the UTF-8 encoding of decoded sourcesContent text, not an independently retained original file. Missing or out-of-range original content positions remain explicit.",
     "Lookup returns all segments at the greatest generated position not greater than the selected point, including earlier lines and generated-only segments. A mapped point does not establish an executed range or UI causality.",
     "Regular maps and inline indexed sections are supported. External section URLs are unsupported; unknown extensions are retained in raw map text and are not interpreted.",
-    "Complete evidence has a 4 MiB map, 32 MiB reply, 262144 decoded rows/segments and 64-level section budget. The owned codec has a 20-second deadline, 192 MiB old-generation heap and one V8 worker; cleanup may extend the deadline. V8 heap limits do not establish aggregate RSS limits.",
 ];
+const CODEC_BUDGET = "Complete evidence has a 4 MiB map, 32 MiB reply, 262144 decoded rows/segments and 64-level section budget. The owned codec has a 20-second deadline";
+/** Bun accepts but ignores the codec's V8 heap flags; Windows enforces a commit limit instead. */
+const codecBudgetLimitation = (runtime) => {
+    if (runtime.id === "node-v8")
+        return `${CODEC_BUDGET}, ${String(WEB_SOURCE_MAP_LIMITS.codecHeapMiB)} MiB old-generation heap and one V8 worker; cleanup may extend the deadline. V8 heap limits do not establish aggregate RSS limits.`;
+    return runtime.process_memory_limit_bytes === null
+        ? `${CODEC_BUDGET}; cleanup may extend the deadline. The codec ran on Bun, which does not enforce REA's V8 heap flags, so no codec heap limit is established.`
+        : `${CODEC_BUDGET}; cleanup may extend the deadline. The codec ran on Bun, which does not enforce REA's V8 heap flags; a Windows Job Object limited its committed memory to ${String(runtime.process_memory_limit_bytes)} bytes, which is not a heap or RSS limit.`;
+};
 /** Join verified captured bytes with an explicitly selected source-map point. */
 export class WebSourceLocationService {
     artifacts;
@@ -36,7 +45,10 @@ export class WebSourceLocationService {
         this.decoder = decoder;
     }
     close() {
-        return this.decoder.close?.() ?? Promise.resolve();
+        return closeOwnedWebResources([
+            this.artifacts.close?.bind(this.artifacts),
+            this.decoder.close?.bind(this.decoder),
+        ], "Web source-location cleanup failed");
     }
     /** Shared CLI/MCP workflow preserves raw declarations and every equal-position match. */
     async trace(rawInput, options) {
@@ -81,6 +93,10 @@ export class WebSourceLocationService {
             return report;
         if (options?.signal?.aborted)
             return err(new AnalysisCancelledError(OPERATION));
+        const limitations = [
+            ...LIMITATIONS,
+            codecBudgetLimitation(report.value.runtime),
+        ];
         const normalized = webSourceLocationResultSchema.safeParse({
             ...report.value,
             manifest: capturedWebManifestIdentity(data),
@@ -93,7 +109,7 @@ export class WebSourceLocationService {
             generated_offset: generatedOffset,
             source_authenticity: "unknown",
             execution: "unknown",
-            limitations: LIMITATIONS,
+            limitations,
         });
         if (!normalized.success)
             return invalidOutput(normalized.error.message);
@@ -112,7 +128,7 @@ export class WebSourceLocationService {
             rawResult: { source_map_text: map.text },
             confidence: "derived",
             authority: "historical-reference",
-            limitations: LIMITATIONS,
+            limitations,
             locations: [
                 data.sourceFile.path,
                 data.manifestFile.path,

package/dist/application/WindowsCapabilities.js

@@ -26,21 +26,24 @@ export const probeWindowsCapabilities = async (dependencies = systemDependencies
             windowsNativeCapabilities(dependencies.platform),
     };
 };
-const systemDependencies = () => ({
-    platform: process.platform,
-    architecture: process.arch,
-    probeSymlinkCreation,
-    probeNoFollowOpen: () => systemNoFollowOpenCapability(process.platform, constants.O_NOFOLLOW),
-    probePrivateAcl: () => windowsNativeCapabilities(process.platform).private_runtime_dacl,
-    nativeCapabilities: () => windowsNativeCapabilities(process.platform),
-    probeUnixDomainSocket: () => process.platform === "win32"
-        ? {
-            available: false,
-            reason: "Node path-based IPC uses named pipes on Windows",
-        }
-        : { available: true, reason: null },
-    probePty: probeProcessCaptureCapability,
-});
+const systemDependencies = () => {
+    const security = windowsNativeCapabilities(process.platform);
+    return {
+        platform: process.platform,
+        architecture: process.arch,
+        probeSymlinkCreation,
+        probeNoFollowOpen: () => systemNoFollowOpenCapability(process.platform, constants.O_NOFOLLOW),
+        probePrivateAcl: () => security.private_runtime_dacl,
+        nativeCapabilities: () => security,
+        probeUnixDomainSocket: () => process.platform === "win32"
+            ? {
+                available: false,
+                reason: "Node path-based IPC uses named pipes on Windows",
+            }
+            : { available: true, reason: null },
+        probePty: probeProcessCaptureCapability,
+    };
+};
 /** Report pathname no-follow support without treating it as Windows authority. */
 export const systemNoFollowOpenCapability = (platform, noFollow) => {
     if (platform === "win32")

package/dist/application/WorkflowEvidence.js

@@ -1,7 +1,27 @@
 import { REA_WORKFLOW_PROVIDER, workflowAnalysisProfile, } from "./InvestigationProviders.js";
+import { ok } from "../domain/result.js";
 import { analysisProfileSchema, committedProviderSchema, } from "../domain/analysisProfile.js";
 import { createEvidence, } from "../domain/evidence.js";
 import { UnknownRegistryError } from "../domain/unknownRegistryError.js";
+import { compareUnicodeCodePoints } from "../domain/unicodeCodePointOrder.js";
+/** Retain the limits of exactly the observations used by one composed call. */
+export const executeComposedWorkflow = async (analysis, execute) => {
+    const limitations = new Set();
+    const result = await execute({
+        execute: async (operation, parameters, options) => {
+            const execution = await analysis.execute(operation, parameters, options);
+            if (execution.ok)
+                execution.value.limitations.forEach((limitation) => limitations.add(limitation));
+            return execution;
+        },
+    });
+    if (!result.ok)
+        return result;
+    return ok({
+        result: result.value,
+        limitations: [...limitations].sort(compareUnicodeCodePoints),
+    });
+};
 /** Build the shared Evidence record for a successful composed binary workflow. */
 export const createWorkflowEvidence = (input) => createEvidence(input.target, REA_WORKFLOW_PROVIDER, {
     operation: input.operation,
@@ -13,7 +33,10 @@ export const createWorkflowEvidence = (input) => createEvidence(input.target, RE
             analysisProfile: workflowAnalysisProfile(input.upstreamProfile, input.operation),
         }),
     confidence: "derived",
-    limitations: ["Derived by an REA composed workflow."],
+    limitations: [
+        "Derived by an REA composed workflow.",
+        ...input.upstreamLimitations,
+    ],
     ...(input.operation === "batch_decompile"
         ? { locations: batchProcedureLocations(input.result) }
         : {}),