rea-agents 6.5.0 → 6.7.0

package/dist/application/WebRuntimeService.js

@@ -1,11 +1,12 @@
 import { z } from "zod";
 import { AnalysisCancelledError, AnalysisOutputError, } from "../domain/analysisErrorCore.js";
 import { createEvidence } from "../domain/evidence.js";
-import { jsonObjectSchema, jsonValueSchema } from "../domain/jsonValue.js";
+import { jsonObjectSchema } from "../domain/jsonValue.js";
 import { analysisInputErrorFromIssues } from "../domain/inputIssueProjection.js";
 import { err, ok } from "../domain/result.js";
 import { observeWebExecutionInputSchema, webExecutionSchema, } from "../domain/webExecution.js";
 import { inspectWebEventListenersInputSchema, webEventListenersSchema, } from "../domain/webEventListeners.js";
+import { completeProviderEvidence } from "./ProviderOperationExecution.js";
 /** Shared public workflows keep instrumentation and listener inspection independently selectable. */
 export class WebRuntimeService {
     provider;
@@ -19,8 +20,25 @@ export class WebRuntimeService {
         if (!parsed.ok)
             return parsed;
         const result = await this.provider.observeExecution(parsed.value, options);
-        if (!result.ok)
+        if (!result.ok) {
+            const partial = result.error.partialObservation;
+            if (partial !== undefined &&
+                !("evidence_id" in partial) &&
+                "instrumentation" in partial &&
+                "window" in partial) {
+                const verifiedPartial = webExecutionSchema.safeParse(partial);
+                if (verifiedPartial.success) {
+                    const evidence = this.evidence(operation, parsed.value, verifiedPartial.data);
+                    if (evidence.ok)
+                        result.error.partialObservation = evidence.value;
+                    else if (result.error instanceof AnalysisCancelledError)
+                        return evidence;
+                }
+                else if (result.error instanceof AnalysisCancelledError)
+                    return err(new AnalysisOutputError(operation, "Provider retained a malformed completed execution observation.", { cause: verifiedPartial.error }));
+            }
             return result;
+        }
         const verified = webExecutionSchema.safeParse(result.value);
         if (!verified.success)
             return err(new AnalysisOutputError(operation, verified.error.message));
@@ -36,8 +54,25 @@ export class WebRuntimeService {
         if (!parsed.ok)
             return parsed;
         const result = await this.provider.inspectEventListeners(parsed.value, options);
-        if (!result.ok)
+        if (!result.ok) {
+            const partial = result.error.partialObservation;
+            if (partial !== undefined &&
+                !("evidence_id" in partial) &&
+                "selected_node" in partial &&
+                "listeners" in partial) {
+                const verifiedPartial = webEventListenersSchema.safeParse(partial);
+                if (verifiedPartial.success) {
+                    const evidence = this.evidence(operation, parsed.value, verifiedPartial.data);
+                    if (evidence.ok)
+                        result.error.partialObservation = evidence.value;
+                    else if (result.error instanceof AnalysisCancelledError)
+                        return evidence;
+                }
+                else if (result.error instanceof AnalysisCancelledError)
+                    return err(new AnalysisOutputError(operation, "Provider retained malformed completed event-listener data.", { cause: verifiedPartial.error }));
+            }
             return result;
+        }
         const verified = webEventListenersSchema.safeParse(result.value);
         if (!verified.success)
             return err(new AnalysisOutputError(operation, verified.error.message));
@@ -47,20 +82,18 @@ export class WebRuntimeService {
         return this.evidence(operation, parsed.value, verified.data, options);
     }
     evidence(operation, input, result, options) {
-        if (options?.signal?.aborted)
-            return err(new AnalysisCancelledError(operation));
         if (input.allowed_origins.length > 0 &&
             !input.allowed_origins.includes(result.target.origin))
             return err(new AnalysisOutputError(operation, "Provider returned a document outside the selected origin scope."));
-        return ok(createEvidence(undefined, this.provider.identity(), {
+        return completeProviderEvidence(createEvidence(undefined, this.provider.identity(), {
             predicateType: `rea.${operation.replaceAll("_", "-")}`,
             operation,
             parameters: jsonObjectSchema.parse(input),
-            result: jsonValueSchema.parse(result),
+            result,
             confidence: "observed",
             authority: "external-service",
             limitations: result.limitations,
-        }));
+        }), options?.signal);
     }
 }
 const parseInput = (schema, rawInput, operation, options) => {

package/dist/application/WebScriptExportService.js

@@ -126,16 +126,18 @@ const readCapture = async (path, resources, signal) => {
         return ok({ bytes: await readRegularFile(path, { signal }) });
     }
     catch (cause) {
+        if (signal?.aborted === true && cause === signal.reason)
+            return err(captureReadFailure(path, cause, signal));
         if (cause instanceof RegularFileCleanupFailure) {
-            const retry = await retryRegularFileCleanup(cause, resources);
+            const retry = await retryRegularFileCleanup(cause, resources, signal);
             const cleanup = {
                 reason: retry.cleanup?.reason ?? errorMessage(cause.cleanupCause),
                 incomplete: retry.cleanup !== undefined,
                 cause: cause.cleanupCause,
             };
-            if (cause.outcome.kind === "completed")
-                return ok({ bytes: cause.outcome.value, cleanup });
-            const primary = captureReadFailure(path, cause.outcome.cause, signal, retry.cleanup === undefined ? { cause: cause.cleanupCause } : undefined);
+            if (retry.outcome.kind === "completed")
+                return ok({ bytes: retry.outcome.value, cleanup });
+            const primary = captureReadFailure(path, retry.outcome.cause, signal, retry.cleanup === undefined ? { cause: cause.cleanupCause } : undefined);
             return err(retry.cleanup === undefined
                 ? primary
                 : incompleteCaptureCleanup(primary, path, cleanup));

package/dist/application/WebSourceLocationService.js

@@ -11,6 +11,7 @@ import { selectedWebScriptArtifactsSchema, webArtifactFileSchema, } from "../dom
 import { WEB_SOURCE_MAP_LIMITS, webSourceLocationInputSchema, webSourceLocationResultSchema, webSourceMapReportSchema, } from "../domain/webSourceLocation.js";
 import { webSourceOffset } from "../domain/webSourcePosition.js";
 import { capturedWebManifestIdentity, validateSelectedWebScript, } from "./ValidateSelectedWebScript.js";
+import { completeProviderEvidence } from "./ProviderOperationExecution.js";
 const OPERATION = "trace_web_source_location";
 const artifactsSchema = selectedWebScriptArtifactsSchema.extend({
     sourceMap: z.strictObject({
@@ -91,8 +92,6 @@ export class WebSourceLocationService {
         const report = verifyReport(input, map.file.sha256, traced.value);
         if (!report.ok)
             return report;
-        if (options?.signal?.aborted)
-            return err(new AnalysisCancelledError(OPERATION));
         const limitations = [
             ...LIMITATIONS,
             codecBudgetLimitation(report.value.runtime),
@@ -113,7 +112,7 @@ export class WebSourceLocationService {
         });
         if (!normalized.success)
             return invalidOutput(normalized.error.message);
-        return ok(createEvidence({
+        return completeProviderEvidence(createEvidence({
             path: data.sourceFile.path,
             sha256: data.sourceFile.sha256,
             format: "file",
@@ -137,7 +136,7 @@ export class WebSourceLocationService {
             evidenceLinks: data.manifest.source_evidence_id === null
                 ? []
                 : [data.manifest.source_evidence_id],
-        }));
+        }), options?.signal);
     }
 }
 const invalidOutput = (message) => err(new AnalysisOutputError(OPERATION, message));

package/dist/application/WorkflowEvidence.js

@@ -3,15 +3,22 @@ import { ok } from "../domain/result.js";
 import { analysisProfileSchema, committedProviderSchema, } from "../domain/analysisProfile.js";
 import { createEvidence, } from "../domain/evidence.js";
 import { UnknownRegistryError } from "../domain/unknownRegistryError.js";
-import { compareUnicodeCodePoints } from "../domain/unicodeCodePointOrder.js";
+import { renderSourceLimitations, sourceLimitationKey, } from "./SourceLimitations.js";
 /** Retain the limits of exactly the observations used by one composed call. */
 export const executeComposedWorkflow = async (analysis, execute) => {
-    const limitations = new Set();
+    const limitations = new Map();
     const result = await execute({
         execute: async (operation, parameters, options) => {
             const execution = await analysis.execute(operation, parameters, options);
             if (execution.ok)
-                execution.value.limitations.forEach((limitation) => limitations.add(limitation));
+                for (const limitation of execution.value.limitations) {
+                    const fact = {
+                        provider: execution.value.provider,
+                        operation,
+                        limitation,
+                    };
+                    limitations.set(sourceLimitationKey(fact), fact);
+                }
             return execution;
         },
     });
@@ -19,7 +26,7 @@ export const executeComposedWorkflow = async (analysis, execute) => {
         return result;
     return ok({
         result: result.value,
-        limitations: [...limitations].sort(compareUnicodeCodePoints),
+        limitations: renderSourceLimitations([...limitations.values()]),
     });
 };
 /** Build the shared Evidence record for a successful composed binary workflow. */

package/dist/application/analysisView/AnalysisViewService.js

@@ -2,7 +2,7 @@ import { INSPECT_ANALYSIS_VIEW_OPERATION } from "../../domain/analysisView/analy
 import { z } from "zod";
 import { ANALYSIS_VIEW_PROVIDER } from "../InvestigationProviders.js";
 import { resolveEvidenceInput } from "../EvidenceInputResolver.js";
-import { AnalysisCapabilityUnavailableError, AnalysisInputError, } from "../../domain/analysisErrorCore.js";
+import { AnalysisCapabilityUnavailableError } from "../../domain/analysisErrorCore.js";
 import { analysisInputErrorFromIssues } from "../../domain/inputIssueProjection.js";
 import { EvidenceIntegrityError } from "../../domain/evidenceErrors.js";
 import { createEvidence, parseEvidence, } from "../../domain/evidence.js";
@@ -11,6 +11,7 @@ import { jsonValueSchema } from "../../domain/jsonValue.js";
 import { isImmutableJsonSnapshot } from "../../domain/immutableJson.js";
 import { err, ok } from "../../domain/result.js";
 import { WebNetworkApiSurfaceAccumulator } from "../../domain/analysisView/WebNetworkApiSurfaceAccumulator.js";
+import { admitAnalysisViewData } from "../../domain/analysisView/analysisViewDataAdmission.js";
 /** Authenticate a selected-view request and project already completed Evidence. */
 export const inspectAnalysisView = (rawInput, lookup) => {
     const parsed = inspectAnalysisViewInputSchema.safeParse(rawInput);
@@ -23,8 +24,10 @@ export const inspectAnalysisViewValidated = (input, lookup) => {
     const accumulator = input.view.kind === "api-surface"
         ? new WebNetworkApiSurfaceAccumulator(undefined, input.view.include_query_parameter_names === true)
         : undefined;
-    if (input.source.kind === "inline" && accumulator !== undefined) {
-        const admitted = accumulator.admitInlineEvidence(input.source.evidence);
+    if (input.source.kind === "inline") {
+        const admitted = accumulator === undefined
+            ? admitAnalysisViewData(input.source.evidence, true)
+            : accumulator.admitInlineEvidence(input.source.evidence);
         if (!admitted.ok)
             return admitted;
     }
@@ -87,15 +90,6 @@ export const summarizeRetainedAnalysis = (evidence, retention) => {
 const resolveAnalysisViewSource = (source, lookup) => {
     if (source.kind === "retained-evidence")
         return resolveEvidenceInput(source, lookup);
-    const invalidDataPath = inlineEvidenceInvalidDataPath(source.evidence);
-    if (invalidDataPath !== undefined)
-        return err(new AnalysisInputError(INSPECT_ANALYSIS_VIEW_OPERATION, undefined, [
-            {
-                path: ["source", "evidence", ...invalidDataPath],
-                reason: "invalid_type",
-                message: "Inline Evidence must contain plain JSON data properties without accessors or cycles.",
-            },
-        ]));
     try {
         return ok(parseEvidence(source.evidence));
     }
@@ -110,46 +104,6 @@ const resolveAnalysisViewSource = (source, lookup) => {
         throw cause;
     }
 };
-/** Reject non-JSON object behavior before Zod reads caller-owned Evidence. */
-const inlineEvidenceInvalidDataPath = (root) => {
-    const active = new Set();
-    const pending = [{ value: root, path: [] }];
-    while (pending.length > 0) {
-        const current = pending.pop();
-        if (current === undefined)
-            continue;
-        if (current.exit !== undefined) {
-            active.delete(current.exit);
-            continue;
-        }
-        const { value, path } = current;
-        if (typeof value !== "object" || value === null)
-            continue;
-        const isArray = Array.isArray(value);
-        const prototype = Object.getPrototypeOf(value);
-        if ((isArray && prototype !== Array.prototype) ||
-            (!isArray && prototype !== Object.prototype && prototype !== null) ||
-            active.has(value))
-            return path;
-        active.add(value);
-        pending.push({ value, path, exit: value });
-        const keys = Object.getOwnPropertyNames(value);
-        for (let index = keys.length - 1; index >= 0; index -= 1) {
-            const key = keys[index];
-            if (key === undefined)
-                continue;
-            const descriptor = Object.getOwnPropertyDescriptor(value, key);
-            const childPath = [
-                ...path,
-                isArray && /^(0|[1-9]\d*)$/u.test(key) ? Number(key) : key,
-            ];
-            if (descriptor === undefined || !Object.hasOwn(descriptor, "value"))
-                return childPath;
-            pending.push({ value: descriptor.value, path: childPath });
-        }
-    }
-    return undefined;
-};
 const createAnalysisViewEvidence = (input, parent, result) => {
     const target = parent.subject === null
         ? undefined
@@ -177,6 +131,9 @@ const createAnalysisViewEvidence = (input, parent, result) => {
             : "derived",
         authority: parent.authority,
         limitations: result.limitations,
+        ...(result.kind === "native" && parent.relationship_coverage !== null
+            ? { relationshipCoverage: parent.relationship_coverage }
+            : {}),
         locations: [
             ...(result.artifact.path.length > 0
                 ? [{ kind: "artifact-path", path: result.artifact.path }]

package/dist/application/android/AndroidAnalysisService.js

@@ -3,7 +3,8 @@ import { androidRequestSchema, } from "../../domain/android/androidAnalysis.js";
 import { AnalysisCancelledError, AnalysisInputError, } from "../../domain/analysisErrorCore.js";
 import { createEvidence } from "../../domain/evidence.js";
 import { jsonObjectSchema } from "../../domain/jsonValue.js";
-import { err, ok } from "../../domain/result.js";
+import { err } from "../../domain/result.js";
+import { completeProviderEvidence } from "../ProviderOperationExecution.js";
 /** Shared CLI/MCP admission, execution and Evidence composition for Android. */
 export class AndroidAnalysisService {
     provider;
@@ -13,7 +14,7 @@ export class AndroidAnalysisService {
     /** Inspect a caller-selected APK and retain producing-provider provenance inline. */
     async execute(operation, input, options) {
         if (options?.signal?.aborted === true)
-            return err(new AnalysisCancelledError(operation));
+            return err(new AnalysisCancelledError(operation, { cause: options.signal.reason }));
         const request = androidRequestSchema.safeParse({ operation, input });
         if (!request.success)
             return err(new AnalysisInputError(operation, { cause: request.error }));
@@ -24,7 +25,7 @@ export class AndroidAnalysisService {
         if (!executed.ok)
             return executed;
         const execution = executed.value;
-        return ok(createEvidence(execution.subject ?? target.value, execution.provider, {
+        return completeProviderEvidence(createEvidence(execution.subject ?? target.value, execution.provider, {
             operation,
             parameters: jsonObjectSchema.parse(request.data.input),
             result: execution.result,
@@ -32,6 +33,6 @@ export class AndroidAnalysisService {
             limitations: execution.limitations,
             locations: execution.locations,
             confidence: operation === "inspect_android_method" ? "derived" : "observed",
-        }));
+        }), options?.signal);
     }
 }

package/dist/application/android/AndroidSearchEvidenceSummary.js

@@ -1,11 +1,10 @@
 import { createEvidence } from "../../domain/evidence.js";
 import { ok } from "../../domain/result.js";
 /**
- * Complete class-inventory pages dominate raw-call provenance for focused
- * searches: one traversal embeds every examined class name regardless of the
- * match count. The summary keeps the pagination audit inline (totals, page
- * offsets and sizes, elided item counts) and links the retained record that
- * still carries the complete inventory.
+ * Class-search pages duplicate matching names already present in normalized
+ * results; an empty query also returns the complete top-level inventory.
+ * Keep the selection and pagination audit inline and link the retained
+ * record carrying every complete producer reply.
  */
 const elideInventoryText = (text) => {
     let page;
@@ -56,9 +55,8 @@ const summarizeInventoryCall = (call) => {
 /**
  * Retain the complete search Evidence — full raw provider calls included —
  * in the session record, then deliver a bounded summary Evidence inline.
- * Callers without a retaining session keep the complete inline delivery, so
- * complete CLI JSON output is unchanged. Coverage metadata stays truthful in
- * both copies: the examined inventory is never rewritten to matched-only.
+ * Callers without a retaining session receive complete source Evidence inline.
+ * Both copies preserve examined inventory ranges separately from matching rows.
  */
 export const summarizeRetainedAndroidSearch = (evidence, recordEvidence) => {
     if (recordEvidence === undefined)

package/dist/application/artifacts/ArtifactComparisonEvidence.js

@@ -0,0 +1,32 @@
+import { AnalysisInputError } from "../../domain/analysisErrorCore.js";
+import { inspectAnalysisViewValidated } from "../analysisView/AnalysisViewService.js";
+import { artifactInventorySummaryViewResultSchema } from "../../domain/analysisView/analysisView.js";
+import { EvidenceIntegrityError, EvidenceReferenceError, } from "../../domain/evidenceErrors.js";
+import { err, ok } from "../../domain/result.js";
+/** Resolve only an artifact summary's exact retained owner before comparison. */
+export const resolveArtifactComparisonEvidence = (evidence, evidenceById) => {
+    if (evidence.operation !== "inspect_analysis_view")
+        return ok(evidence);
+    const summary = artifactInventorySummaryViewResultSchema.safeParse(evidence.normalized_result);
+    if (!summary.success)
+        return err(new AnalysisInputError("compare_artifacts", undefined, [
+            {
+                path: ["evidence"],
+                reason: "invalid_value",
+                message: "Artifact comparison accepts only an artifact inventory summary from inspect_analysis_view.",
+            },
+        ]));
+    const parentId = summary.data.parent_evidence_id;
+    const parent = evidenceById?.(parentId);
+    if (parent === undefined)
+        return err(new EvidenceReferenceError(parentId, "missing", "retained complete artifact inventory Evidence", null));
+    const reprojected = inspectAnalysisViewValidated({
+        source: { kind: "retained-evidence", evidence_id: parentId },
+        view: { kind: "summary" },
+    }, (evidenceId) => (evidenceId === parentId ? parent : undefined));
+    if (!reprojected.ok)
+        return reprojected;
+    if (reprojected.value.evidence_id !== evidence.evidence_id)
+        return err(new EvidenceIntegrityError("Artifact summary does not match its retained parent inventory."));
+    return ok(parent);
+};

package/dist/application/binary/AnalysisProviderEvaluation.js

@@ -1,25 +1,26 @@
 import { analysisProfileSchema, } from "../../domain/analysisProfile.js";
 import { AnalysisCancelledError, AnalysisUnsupportedTargetError, } from "../../domain/analysisErrorCore.js";
+import { AnalysisError } from "../../domain/analysisErrorBase.js";
 import { jsonObjectSchema } from "../../domain/jsonValue.js";
 import { err, ok } from "../../domain/result.js";
-import { ABORTED, waitForAbortable } from "../../process/AbortablePromise.js";
+import { ProviderAdapterError } from "../../domain/providerAdapterError.js";
 /** Resolve and validate one provider profile without starting its client. */
-export const evaluateAnalysisProviderCandidate = async (candidate, status, target, signal) => {
+export const evaluateAnalysisProviderCandidate = async (candidate, status, target, options = {}) => {
+    const { signal } = options;
     if (signalIsAborted(signal))
-        return err(new AnalysisCancelledError("open_binary"));
+        return err(new AnalysisCancelledError("open_binary", { cause: signal?.reason }));
     let resolved;
     try {
-        const resolution = await waitForAbortable(candidate.resolveAnalysisProfile(target, signal === undefined ? undefined : { signal }), signal);
-        if (resolution === ABORTED)
-            return err(new AnalysisCancelledError("open_binary"));
-        resolved = resolution;
+        resolved = await candidate.resolveAnalysisProfile(target, options);
     }
     catch (cause) {
-        void cause;
-        return ok(rejectedProfile(candidate, status, "Provider profile resolution threw"));
+        resolved = err(cause instanceof AnalysisError
+            ? cause
+            : new ProviderAdapterError(status.provider.id, "resolve_analysis_profile", {
+                cause,
+                diagnostics: { reason: "Provider profile resolution threw" },
+            }));
     }
-    if (signalIsAborted(signal))
-        return err(new AnalysisCancelledError("open_binary"));
     if (!resolved.ok && resolved.error instanceof AnalysisCancelledError)
         return err(resolved.error);
     if (!resolved.ok) {
@@ -42,6 +43,8 @@ export const evaluateAnalysisProviderCandidate = async (candidate, status, targe
             });
         return ok({ ...rejection, profileError: error });
     }
+    if (signalIsAborted(signal))
+        return err(new AnalysisCancelledError("open_binary", { cause: signal?.reason }));
     try {
         if (resolved.value.profile === null)
             return ok(rejectedProfile(candidate, status, "Provider version or analysis profile could not be resolved"));