rea-agents 6.5.0 → 6.7.0

package/dist/cli-runtime/StableFileHash-Ame_h3lY.js

@@ -0,0 +1,61 @@
+import { __esmMin } from "./rolldown-runtime-DXoylpqc.js";
+import { RegularFileCancelled, RegularFileChangedError, RegularFileCleanupFailure, RegularFileOperationCancelled, assertRegularFileActive, init_OwnedRegularFile, init_RegularFile, sameRegularFileState, withOwnedRegularFile } from "./OwnedRegularFile-D1f5nUCx.js";
+import { createHash } from "node:crypto";
+import { stat } from "node:fs/promises";
+
+//#region dist/filesystem/StableFileHash.js
+var StableFileHashFailure, stableFileHashCause, hashStableFile;
+function init_StableFileHash() {
+	return (init_StableFileHash = __esmMin((() => {
+		init_OwnedRegularFile();
+		init_RegularFile();
+		StableFileHashFailure = class extends Error {
+			path;
+			cause;
+			_tag = "StableFileHashFailure";
+			constructor(path, cause) {
+				super(`Could not hash ${path}: ${cause instanceof Error ? cause.message : String(cause)}`, { cause });
+				this.path = path;
+				this.cause = cause;
+				this.name = this._tag;
+			}
+		};
+		stableFileHashCause = (cause) => cause instanceof StableFileHashFailure ? cause.cause : cause;
+		hashStableFile = async (path, options) => {
+			try {
+				return await withOwnedRegularFile(path, options, async (handle) => {
+					const initial = await handle.stat();
+					if (!Number.isSafeInteger(initial.size) || initial.size < 0) throw new RangeError(`Regular file size cannot be represented safely: ${path}`);
+					const hash = createHash("sha256");
+					const chunk = Buffer.allocUnsafe(64 * 1024);
+					let position = 0;
+					while (position <= initial.size) {
+						assertRegularFileActive(options.signal);
+						const length = Math.min(chunk.length, initial.size - position + 1);
+						if (length <= 0) break;
+						const read = await handle.read(chunk, 0, length, position);
+						if (position + read.bytesRead > initial.size || read.bytesRead === 0 && position < initial.size) throw new RegularFileChangedError(path);
+						assertRegularFileActive(options.signal);
+						if (read.bytesRead === 0) break;
+						hash.update(chunk.subarray(0, read.bytesRead));
+						position += read.bytesRead;
+					}
+					assertRegularFileActive(options.signal);
+					const [opened, currentPath] = await Promise.all([handle.stat(), stat(path)]);
+					if (position !== initial.size || !sameRegularFileState(initial, opened) || !sameRegularFileState(initial, currentPath)) throw new RegularFileChangedError(path);
+					assertRegularFileActive(options.signal);
+					return {
+						sha256: hash.digest("hex"),
+						bytes: position
+					};
+				});
+			} catch (cause) {
+				if (cause instanceof RegularFileCleanupFailure || cause instanceof RegularFileCancelled || cause instanceof RegularFileOperationCancelled) throw cause;
+				throw new StableFileHashFailure(path, cause);
+			}
+		};
+	})))();
+}
+
+//#endregion
+export { StableFileHashFailure, hashStableFile, init_StableFileHash, stableFileHashCause };

package/dist/cli-runtime/{SupportedClients-DaX6Lt2d.js → SupportedClients-DMafjitv.js}

@@ -1,14 +1,15 @@
 import { __esmMin } from "./rolldown-runtime-DXoylpqc.js";
-import { PRODUCT_IDENTITY, analysisProviderSelectorSchema, compareUnicodeCodePoints, err, init_identity, init_localPath, init_mcpInputSchemaProfile, init_providerSelection, init_result, init_unicodeCodePointOrder, mcpInputSchemaProfileSchema, nulFreeStringSchema, ok } from "./reconstructionObligationLedgerSchemas-Bao0xMr-.js";
-import { ConfigurationError, init_configurationErrors } from "./errorSchemas-CTRmvMl3.js";
+import { PRODUCT_IDENTITY, analysisProviderSelectorSchema, compareUnicodeCodePoints, err, init_identity, init_localPath, init_mcpInputSchemaProfile, init_mcpOutputSchemaProfile, init_providerSelection, init_result, init_unicodeCodePointOrder, mcpInputSchemaProfileSchema, mcpOutputSchemaProfileSchema, nulFreeStringSchema, ok } from "./reconstructionObligationLedgerSchemas-Bi6sect1.js";
+import { ConfigurationError, init_configurationErrors } from "./errorSchemas-Ixz_q7qt.js";
 import { DEFAULT_GHIDRA_STARTUP_TIMEOUT_MS, DEFAULT_HOPPER_STARTUP_TIMEOUT_MS, DEFAULT_SWIFTC_COMPILE_TIMEOUT_MS, init_providerStartupTimeout, providerStartupTimeoutSchema } from "./providerStartupTimeout-B2tF2LtZ.js";
 import { init_safeJson, safeParseJson } from "./safeJson-DKKACtdy.js";
+import { init_CurrentEntrypointPath, normalizeEntrypointPath } from "./CurrentEntrypointPath-m7QCIVN0.js";
 import { z } from "zod";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep, win32 } from "node:path";
-import { lstat } from "node:fs/promises";
 import { lstatSync, readFileSync, readdirSync, realpathSync, statSync } from "node:fs";
-import { fileURLToPath } from "node:url";
 import { userInfo } from "node:os";
+import { lstat } from "node:fs/promises";
+import { fileURLToPath } from "node:url";
 import { valid } from "semver";
 
 //#region dist/config/ghidraLanguageOverride.js
@@ -32,26 +33,6 @@ function init_ghidraDisabledAnalyzers() {
 	})))();
 }
 
-//#endregion
-//#region dist/config/mcpOutputSchemaProfile.js
-var mcpOutputSchemaProfileSchema, profileConstraint, parseMcpOutputSchemaProfile;
-function init_mcpOutputSchemaProfile() {
-	return (init_mcpOutputSchemaProfile = __esmMin((() => {
-		init_configurationErrors();
-		init_result();
-		mcpOutputSchemaProfileSchema = z.enum(["full", "off"]);
-		profileConstraint = "REA_MCP_OUTPUT_SCHEMA_PROFILE must be \"full\" (default) or \"off\". The off profile omits output schemas from tools/list while REA validates every successful result against its canonical tool contract and returns complete structured content.";
-		parseMcpOutputSchemaProfile = (value) => {
-			if (value === undefined) return ok(undefined);
-			const parsed = mcpOutputSchemaProfileSchema.safeParse(value);
-			return parsed.success ? ok(parsed.data) : err(new ConfigurationError(profileConstraint, { settings: [{
-				setting: "REA_MCP_OUTPUT_SCHEMA_PROFILE",
-				constraint: profileConstraint
-			}] }));
-		};
-	})))();
-}
-
 //#endregion
 //#region dist/config/mcpResponseBudget.js
 var MINIMUM_RESPONSE_BYTES, mcpResponseBudgetSchema, budgetConstraint, parseMcpResponseBudget;
@@ -110,7 +91,7 @@ function init_parsers() {
 
 //#endregion
 //#region dist/config/environment.js
-var environmentSchema, parseEnvironmentValues, parseEnvironment;
+var environmentSchema, parseJebMcpTimeoutMs, parseEnvironmentValues, parseEnvironment;
 function init_environment() {
 	return (init_environment = __esmMin((() => {
 		init_configurationErrors();
@@ -129,6 +110,7 @@ function init_environment() {
 			REA_MCP_INPUT_SCHEMA_PROFILE: mcpInputSchemaProfileSchema.optional(),
 			REA_MCP_OUTPUT_SCHEMA_PROFILE: mcpOutputSchemaProfileSchema.optional(),
 			REA_IDA_MCP_CONFIG: z.string().min(1).refine(isAbsolute, "REA_IDA_MCP_CONFIG must be absolute").optional(),
+			REA_JEB_MCP_TIMEOUT_MS: providerStartupTimeoutSchema.optional(),
 			GHIDRA_INSTALL_DIR: z.string().min(1).refine(isAbsolute, "GHIDRA_INSTALL_DIR must be absolute").optional(),
 			JAVA_HOME: z.string().min(1).refine(isAbsolute, "JAVA_HOME must be absolute").optional(),
 			REA_GHIDRA_NATIVEAOT_JAR: z.string().min(1).refine(isAbsolute, "REA_GHIDRA_NATIVEAOT_JAR must be absolute").optional(),
@@ -155,7 +137,25 @@ function init_environment() {
 			]).default("info"),
 			REA_REFERENCE_SECRET_PATTERNS_JSON: z.string().default("[]")
 		});
-		parseEnvironmentValues = (environment) => {
+		parseJebMcpTimeoutMs = (value) => {
+			if (value === undefined) return ok(undefined);
+			const parsed = providerStartupTimeoutSchema.safeParse(value);
+			if (parsed.success) return ok(parsed.data);
+			return err(new ConfigurationError("Invalid REA environment configuration", {
+				cause: parsed.error,
+				settings: [{
+					setting: "REA_JEB_MCP_TIMEOUT_MS",
+					constraint: parsed.error.issues[0]?.message ?? "must be a valid timeout"
+				}]
+			}));
+		};
+		parseEnvironmentValues = (environment, unresolvedSettings = new Set()) => {
+			const keys = new Set([...Object.keys(environment), ...unresolvedSettings]);
+			const invalidEntries = [...keys].filter((key) => key.includes("\0") || Object.hasOwn(environment, key) && environment[key]?.includes("\0")).map((setting) => ({
+				setting,
+				constraint: "Environment variable names and values must not contain NUL bytes"
+			}));
+			if (invalidEntries.length > 0) return err(new ConfigurationError("Invalid REA environment configuration", { settings: invalidEntries }));
 			const parsed = environmentSchema.safeParse(environment);
 			if (!parsed.success) {
 				const settings = parsed.error.issues.map((issue) => ({
@@ -179,7 +179,7 @@ function init_environment() {
 			});
 		};
 		parseEnvironment = (environment, unresolvedSettings = new Set()) => {
-			const parsed = parseEnvironmentValues(environment);
+			const parsed = parseEnvironmentValues(environment, unresolvedSettings);
 			if (!parsed.ok) return parsed;
 			const env = parsed.value;
 			if (env.REA_GHIDRA_COMPILER_SPEC_ID !== undefined && env.REA_GHIDRA_LANGUAGE_ID === undefined && !unresolvedSettings.has("REA_GHIDRA_LANGUAGE_ID")) return err(new ConfigurationError("Invalid REA environment configuration", { settings: [{
@@ -191,29 +191,17 @@ function init_environment() {
 	})))();
 }
 
-//#endregion
-//#region dist/config/homeDirectory.js
-var firstNonempty, homeDirectoryFromEnvironment;
-function init_homeDirectory() {
-	return (init_homeDirectory = __esmMin((() => {
-		firstNonempty = (...values) => values.find((value) => value !== undefined && value.length > 0);
-		homeDirectoryFromEnvironment = (environment, platform) => {
-			const windowsDriveHome = environment.HOMEDRIVE !== undefined && environment.HOMEDRIVE.length > 0 && environment.HOMEPATH !== undefined && environment.HOMEPATH.length > 0 ? `${environment.HOMEDRIVE}${environment.HOMEPATH}` : undefined;
-			const selected = platform === "win32" ? firstNonempty(environment.USERPROFILE, windowsDriveHome, environment.HOME) : firstNonempty(environment.HOME, environment.USERPROFILE);
-			return selected ?? userInfo().homedir;
-		};
-	})))();
-}
-
 //#endregion
 //#region dist/application/ClientRegistrationIdentity.js
-var environmentValue, invokingPackageRunner, withoutPackageRunnerIdentity, packageRunnerRegistrationCommand, npxRegistrationCommand, unwrapCmdCommand, clientRegistrationPackageReference, isOwnedPackageReference, classifyClientRegistrationCommand, isOwnedClientRegistrationCommand;
+var environmentValue, invokingPackageRunner, withoutPackageRunnerIdentity, packageRunnerRegistrationCommand, npxRegistrationCommand, unwrapCmdCommand, clientRegistrationPackageReference, isOwnedPackageReference, entrypointIdentity, directEntrypointIdentity, classifyClientRegistrationCommand;
 function init_ClientRegistrationIdentity() {
 	return (init_ClientRegistrationIdentity = __esmMin((() => {
+		init_CurrentEntrypointPath();
 		init_identity();
 		environmentValue = (environment, name, platform) => {
 			if (platform !== "win32") return environment[name];
-			const key = Object.keys(environment).find((candidate) => candidate.toLowerCase() === name);
+			const target = name.toLowerCase();
+			const key = Object.keys(environment).findLast((candidate) => candidate.toLowerCase() === target);
 			return key === undefined ? undefined : environment[key];
 		};
 		invokingPackageRunner = (environment, platform = process.platform) => {
@@ -258,33 +246,42 @@ function init_ClientRegistrationIdentity() {
 			const versionPrefix = `${PRODUCT_IDENTITY.packageName}@`;
 			return packageReference.startsWith(versionPrefix) && valid(packageReference.slice(versionPrefix.length)) !== null;
 		};
+		entrypointIdentity = (candidate, current) => {
+			if (!isAbsolute(candidate) || !isAbsolute(current)) return "unknown";
+			if (candidate === current) return "owned";
+			try {
+				return realpathSync.native(candidate) === realpathSync.native(current) ? "owned" : "foreign";
+			} catch {
+				return "unknown";
+			}
+		};
+		directEntrypointIdentity = (candidate, current) => {
+			const nativeIdentity = entrypointIdentity(candidate, current);
+			const scriptPath = normalizeEntrypointPath(candidate);
+			if (scriptPath === candidate) return nativeIdentity;
+			return scriptPath !== undefined && entrypointIdentity(scriptPath, current) === nativeIdentity ? nativeIdentity : "unknown";
+		};
 		classifyClientRegistrationCommand = (command, currentCommandPath) => {
 			const packageReference = clientRegistrationPackageReference(command);
-			if (packageReference !== undefined) return isOwnedClientRegistrationCommand(command, currentCommandPath) ? "owned" : "foreign";
+			if (packageReference !== undefined) return isOwnedPackageReference(packageReference) ? "owned" : "foreign";
 			const currentPathAvailable = currentCommandPath !== undefined && currentCommandPath.length > 0;
-			const nodeScript = command.length === 3 && command[2] === "mcp";
-			if (nodeScript) {
-				if (!isAbsolute(command[0] ?? "") || !isAbsolute(command[1] ?? "") || !currentPathAvailable) return "unknown";
-				return isOwnedClientRegistrationCommand(command, currentCommandPath) ? "owned" : "foreign";
+			if (command.length === 3 && command[2] === "mcp") {
+				const interpreter = command[0] ?? "";
+				const entrypoint = command[1] ?? "";
+				if (!isAbsolute(interpreter) || !isAbsolute(entrypoint) || !currentPathAvailable) return "unknown";
+				const interpreterIdentity = entrypointIdentity(interpreter, process.execPath);
+				if (interpreterIdentity !== "owned") return interpreterIdentity;
+				const selectedEntrypoint = normalizeEntrypointPath(entrypoint);
+				return selectedEntrypoint === undefined ? "unknown" : entrypointIdentity(selectedEntrypoint, currentCommandPath);
 			}
 			if (command.length === 2 && command[1] === "mcp") {
 				const executable = command[0] ?? "";
 				if (executable === PRODUCT_IDENTITY.cliBinary) return "owned";
-				const relativePathLike = !isAbsolute(executable) && /[./\\]/u.test(executable);
-				if (relativePathLike || isAbsolute(executable) && !currentPathAvailable) return "unknown";
+				if (isAbsolute(executable)) return currentPathAvailable ? directEntrypointIdentity(executable, currentCommandPath) : "unknown";
+				if (/[./\\]/u.test(executable)) return "unknown";
 			}
-			if (isOwnedClientRegistrationCommand(command, currentCommandPath)) return "owned";
 			return "foreign";
 		};
-		isOwnedClientRegistrationCommand = (command, currentCommandPath) => {
-			if (currentCommandPath !== undefined && currentCommandPath.length > 0 && command.length === 3 && command[2] === "mcp" && isAbsolute(command[0] ?? "") && isAbsolute(command[1] ?? "") && resolve(command[0] ?? "") === resolve(process.execPath) && resolve(command[1] ?? "") === currentCommandPath) return true;
-			if (command.length === 2 && command[1] === "mcp") {
-				const executable = command[0] ?? "";
-				if (executable === PRODUCT_IDENTITY.cliBinary || isAbsolute(executable) && currentCommandPath !== undefined && currentCommandPath.length > 0 && resolve(executable) === currentCommandPath) return true;
-			}
-			const packageReference = clientRegistrationPackageReference(command);
-			return packageReference !== undefined && isOwnedPackageReference(packageReference);
-		};
 	})))();
 }
 
@@ -315,6 +312,20 @@ function init_HermesClientHome() {
 			const expanded = platform === "win32" ? variables.replace(/%([^%]+)%/gu, (match, variable) => env[variable] ?? match) : variables;
 			if (expanded === "~") return home;
 			if (expanded.startsWith("~/") || platform === "win32" && expanded.startsWith("~\\")) return join(home, expanded.slice(2));
+			if (expanded.startsWith("~")) {
+				if (platform !== "win32") {
+					const separator = expanded.indexOf("/");
+					const username = expanded.slice(1, separator < 0 ? undefined : separator);
+					let account;
+					try {
+						account = userInfo();
+					} catch {
+						throw new HermesClientPathError(override, "Cannot resolve the OS account for this named Hermes home. Set an absolute HERMES_HOME before configuring Hermes.");
+					}
+					if (account.username === username && isAbsolute(account.homedir)) return join(account.homedir, separator < 0 ? "" : expanded.slice(separator + 1));
+				}
+				throw new HermesClientPathError(override, "Cannot resolve this named Hermes home. Set an absolute HERMES_HOME before configuring Hermes.");
+			}
 			return resolve(expanded);
 		};
 		physicalPath = (path) => {
@@ -391,8 +402,8 @@ function init_MsixPackageStorage() {
 	return (init_MsixPackageStorage = __esmMin((() => {
 		init_result();
 		windowsAppDataRoots = (home, env) => ({
-			roaming: env.APPDATA?.trim() || join(home, "AppData", "Roaming"),
-			local: env.LOCALAPPDATA?.trim() || join(home, "AppData", "Local")
+			roaming: env.APPDATA || join(home, "AppData", "Roaming"),
+			local: env.LOCALAPPDATA || join(home, "AppData", "Local")
 		});
 		msixPackagesDirectory = (home, env) => join(windowsAppDataRoots(home, env).local, "Packages");
 		pathWithin = (path, root) => {
@@ -462,12 +473,18 @@ function init_MsixPackageStorage() {
 			return `This process was started by MSIX package ${view.packageFamilyName}, which redirects its writes under ${view.virtualizedRoots.join(" and ")} into the package's private storage. Changes to ${redirected.join(", ")} would not reach the files other apps read. Rerun ${operation} from a terminal that this app did not start.`;
 		};
 		packageReadTargetChanged = async (view, configPath) => {
-			if (configPath !== view.appDataConfigPath) return false;
+			if (configPath !== view.appDataConfigPath) return ok(false);
 			try {
 				await lstat(view.privateConfigPath);
-				return true;
+				return ok(true);
 			} catch (cause) {
-				return !(cause instanceof Error && "code" in cause && (cause.code === "ENOENT" || cause.code === "ENOTDIR"));
+				if (cause instanceof Error && "code" in cause && (cause.code === "ENOENT" || cause.code === "ENOTDIR")) return ok(false);
+				return err({
+					_tag: "MsixReadTargetInspectionFailure",
+					path: view.privateConfigPath,
+					detail: cause instanceof Error ? cause.message : String(cause),
+					cause
+				});
 			}
 		};
 	})))();
@@ -483,7 +500,7 @@ function init_ClaudeDesktopConfigLocation() {
 		CONFIG_FILE = "claude_desktop_config.json";
 		PROCESS_VIEW_PROBES = 8;
 		CLAUDE_DESKTOP_PACKAGE_FAMILY = "Claude_pzs8sxrjxfjjc";
-		CLAUDE_PACKAGE_FAMILY = /^Claude_[0-9a-hjkmnp-tv-z]{13}$/iu;
+		CLAUDE_PACKAGE_FAMILY = /^(?:AnthropicPBC\.)?Claude_[0-9a-hjkmnp-tv-z]{13}$/iu;
 		systemFileSystem = {
 			readdir: (path) => readdirSync(path),
 			lstat: (path) => lstatSync(path),
@@ -507,7 +524,7 @@ function init_ClaudeDesktopConfigLocation() {
 			const foreign = families.filter((name) => name.toLowerCase() !== CLAUDE_DESKTOP_PACKAGE_FAMILY.toLowerCase());
 			if (foreign.length > 0) return err({
 				path: join(packagesDirectory, foreign[0] ?? ""),
-				message: `MSIX package storage ${foreign.map((name) => join(packagesDirectory, name)).join(", ")} uses Claude Desktop's package name with an unrecognized publisher (Claude Desktop is ${CLAUDE_DESKTOP_PACKAGE_FAMILY}). REA cannot establish which ${CONFIG_FILE} that package reads and does not fall back to ${appDataConfigPath}. Remove the unrecognized package, or register REA in the configuration it reads.`
+				message: `MSIX package storage ${foreign.map((name) => join(packagesDirectory, name)).join(", ")} has an unrecognized Claude Desktop package identity or deployment (the supported identity is ${CLAUDE_DESKTOP_PACKAGE_FAMILY}). REA cannot establish which ${CONFIG_FILE} that package reads and does not fall back to ${appDataConfigPath}. Quit Claude Desktop fully and register REA in the configuration the installed app reads.`
 			});
 			const family = families[0];
 			if (family === undefined) return ok({
@@ -620,8 +637,8 @@ function init_SupportedClients() {
 				markerPath: directory
 			});
 		};
-		claudeCodeConfigDirectory = ({ home, env }) => env.CLAUDE_CONFIG_DIR ?? home;
-		claudeCodeMarkerDirectory = ({ home, env }) => env.CLAUDE_CONFIG_DIR ?? join(home, ".claude");
+		claudeCodeConfigDirectory = ({ home, env }) => env.CLAUDE_CONFIG_DIR || home;
+		claudeCodeMarkerDirectory = ({ home, env }) => env.CLAUDE_CONFIG_DIR || join(home, ".claude");
 		codexDirectory = ({ home, env }) => env.CODEX_HOME || join(home, ".codex");
 		kimiDirectory = ({ home, env }) => env.KIMI_CODE_HOME || join(home, ".kimi-code");
 		qoderDirectory = ({ home, env }) => env.QODER_CONFIG_DIR || join(home, ".qoder");
@@ -739,10 +756,10 @@ function init_SupportedClients() {
 			{
 				name: "claude_code",
 				displayName: "Claude Code",
-				skillPath: ({ home, env }) => join(env.CLAUDE_CONFIG_DIR ?? join(home, ".claude"), "skills"),
+				skillPath: (context) => join(claudeCodeMarkerDirectory(context), "skills"),
 				configPath: (context) => join(claudeCodeConfigDirectory(context), ".claude.json"),
 				markerPath: claudeCodeMarkerDirectory,
-				format: "json"
+				format: "claude_code"
 			},
 			{
 				name: "claude_desktop",
@@ -1046,4 +1063,4 @@ function init_SupportedClients() {
 }
 
 //#endregion
-export { SUPPORTED_CLIENT_DEFINITIONS, appDataRedirection, classifyClientRegistrationCommand, clientEvidencePaths, clientRegistrationPackageReference, clientSkillDirectories, homeDirectoryFromEnvironment, init_ClientRegistrationIdentity, init_MsixPackageStorage, init_SupportedClients, init_environment, init_homeDirectory, invokingPackageRunner, isOwnedClientRegistrationCommand, manualRegistrationRemediation, msixPackagesDirectory, npxRegistrationCommand, packagePrivateLauncherBlocker, packageReadTargetChanged, packageRunnerRegistrationCommand, parseEnvironment, parseEnvironmentValues, redirectedWriteBlocker, registrationPersistenceDetail, registrationWriteBlocker, supportedClients, withoutPackageRunnerIdentity };
+export { SUPPORTED_CLIENT_DEFINITIONS, appDataRedirection, classifyClientRegistrationCommand, clientEvidencePaths, clientRegistrationPackageReference, clientSkillDirectories, init_ClientRegistrationIdentity, init_MsixPackageStorage, init_SupportedClients, init_environment, invokingPackageRunner, manualRegistrationRemediation, msixPackagesDirectory, npxRegistrationCommand, packagePrivateLauncherBlocker, packageReadTargetChanged, packageRunnerRegistrationCommand, parseEnvironment, parseEnvironmentValues, parseJebMcpTimeoutMs, redirectedWriteBlocker, registrationPersistenceDetail, registrationWriteBlocker, supportedClients, withoutPackageRunnerIdentity };

package/dist/cli-runtime/{Update-CbTC_eg1.js → Update-DAsASWlE.js}

@@ -1,5 +1,5 @@
 import { __esmMin, __exportAll } from "./rolldown-runtime-DXoylpqc.js";
-import { PRODUCT_IDENTITY, init_identity } from "./reconstructionObligationLedgerSchemas-Bao0xMr-.js";
+import { PRODUCT_IDENTITY, init_identity } from "./reconstructionObligationLedgerSchemas-Bi6sect1.js";
 import { init_UpdateFailure, isUpdateFailure } from "./UpdateFailure-BcFNxEZZ.js";
 import { gt, valid } from "semver";
 

package/dist/cli-runtime/{AbortablePromise-BVBemxbD.js → WindowsBatchCommand-Cx9kaVNf.js}

@@ -1,5 +1,5 @@
 import { __esmMin } from "./rolldown-runtime-DXoylpqc.js";
-import { init_snapshotEnvironment, snapshotEnvironment } from "./snapshotEnvironment-D_tWyOub.js";
+import { init_snapshotEnvironment, snapshotEnvironment } from "./snapshotEnvironment-Yvx5qwsl.js";
 import { win32 } from "node:path";
 
 //#region dist/process/PendingOperations.js
@@ -94,30 +94,4 @@ function init_WindowsBatchCommand() {
 }
 
 //#endregion
-//#region dist/process/AbortablePromise.js
-var ABORTED, waitForAbortable;
-function init_AbortablePromise() {
-	return (init_AbortablePromise = __esmMin((() => {
-		ABORTED = Symbol("aborted");
-		waitForAbortable = async (pending, signal) => {
-			if (signal === undefined) return pending;
-			let onAbort;
-			const cancelled = new Promise((resolve) => {
-				if (signal.aborted) {
-					resolve(ABORTED);
-					return;
-				}
-				onAbort = () => resolve(ABORTED);
-				signal.addEventListener("abort", onAbort, { once: true });
-			});
-			try {
-				return await Promise.race([cancelled, pending]);
-			} finally {
-				if (onAbort !== undefined) signal.removeEventListener("abort", onAbort);
-			}
-		};
-	})))();
-}
-
-//#endregion
-export { ABORTED, PendingOperations, WindowsBatchCommandError, init_AbortablePromise, init_PendingOperations, init_WindowsBatchCommand, isWindowsBatchFile, quoteWindowsBatchToken, waitForAbortable, windowsBatchCommand };
+export { PendingOperations, WindowsBatchCommandError, init_PendingOperations, init_WindowsBatchCommand, isWindowsBatchFile, quoteWindowsBatchToken, windowsBatchCommand };

package/dist/cli-runtime/WindowsNativeLoader-BqyZO0ZD.js

@@ -0,0 +1,142 @@
+import { __esmMin } from "./rolldown-runtime-DXoylpqc.js";
+import { createRequire } from "node:module";
+import { z } from "zod";
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { PACKAGE_METADATA } from "../generatedPackageMetadata.js";
+
+//#region dist/windows/WindowsNativeLoader.js
+var windowsHandleSchema, windowsFileIdentitySchema, windowsNativeManifestSchema, inspectionSchema, bindingSchema, missingWindowsNativeFileReason, readPackagedWindowsNativeFile, loadWindowsNativeAuthority, assertWindowsX64Artifact, cached, systemWindowsNativeAuthority, requireWindowsNativeAuthority;
+function init_WindowsNativeLoader() {
+	return (init_WindowsNativeLoader = __esmMin((() => {
+		windowsHandleSchema = z.custom((value) => typeof value === "object" && value !== null && !Array.isArray(value));
+		windowsFileIdentitySchema = z.strictObject({
+			requestedPath: z.string(),
+			finalPath: z.string(),
+			filesystem: z.literal("NTFS"),
+			volumeSerial: z.string().regex(/^[a-f0-9]{16}$/u),
+			fileId: z.string().regex(/^[a-f0-9]{32}$/u),
+			size: z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER),
+			directory: z.boolean()
+		});
+		windowsNativeManifestSchema = z.strictObject({
+			packageVersion: z.string(),
+			platform: z.literal("win32"),
+			architecture: z.literal("x64"),
+			abiVersion: z.literal(1),
+			nodeApiVersion: z.literal(8),
+			artifact: z.literal("rea-windows-x64.node"),
+			artifactSha256: z.string().regex(/^[a-f0-9]{64}$/u)
+		});
+		inspectionSchema = z.strictObject({
+			abiVersion: z.literal(1),
+			nodeApiVersion: z.literal(8),
+			architecture: z.literal("x64"),
+			filesystem: windowsFileIdentitySchema,
+			privateDacl: z.literal(true),
+			privateBridgeDescriptorAccess: z.literal(true),
+			atomicJobAssignment: z.literal(true),
+			killOnOwnerClose: z.literal(true),
+			protocolStdin: z.boolean().optional(),
+			/** Absent from artifacts built before owned Job Object commit limits. */
+			jobMemoryLimit: z.literal(true).optional()
+		});
+		bindingSchema = z.strictObject({ call: z.custom((value) => typeof value === "function") });
+		missingWindowsNativeFileReason = (file) => `Missing packaged Windows native file native/windows/build/${file} (ENOENT). Restore both native/windows/build/manifest.json and native/windows/build/rea-windows-x64.node from the rea-agents@${PACKAGE_METADATA.version} tarball or build them with native/windows/README.md; no native artifact was loaded.`;
+		readPackagedWindowsNativeFile = (file, read) => {
+			try {
+				return read();
+			} catch (cause) {
+				if (typeof cause === "object" && cause !== null && "code" in cause && cause.code === "ENOENT") throw new Error(missingWindowsNativeFileReason(file), { cause });
+				throw cause;
+			}
+		};
+		loadWindowsNativeAuthority = (host) => {
+			if (host.platform !== "win32" || host.architecture !== "x64") return {
+				available: false,
+				failureStage: "host",
+				reason: "REA Windows native controls require a Windows x64 host."
+			};
+			const nodeApiVersion = Number(host.nodeApiVersion);
+			if (!Number.isSafeInteger(nodeApiVersion) || nodeApiVersion < 8) return {
+				available: false,
+				failureStage: "host",
+				reason: "REA Windows native controls require Node-API 8 or newer."
+			};
+			try {
+				const manifest = windowsNativeManifestSchema.parse(readPackagedWindowsNativeFile("manifest.json", () => host.readManifest()));
+				if (manifest.packageVersion !== host.packageVersion) throw new Error("Windows native artifact belongs to another REA version");
+				const artifact = readPackagedWindowsNativeFile("rea-windows-x64.node", () => host.readArtifact());
+				if (createHash("sha256").update(artifact).digest("hex") !== manifest.artifactSha256) throw new Error("Windows native artifact SHA-256 does not match package metadata");
+				assertWindowsX64Artifact(artifact);
+				const binding = bindingSchema.parse(host.loadArtifact());
+				let observed;
+				try {
+					observed = binding.call("inspect", []);
+				} catch (cause) {
+					return {
+						available: false,
+						failureStage: "self-test",
+						retryable: true,
+						reason: `REA Windows native self-test failed: ${cause instanceof Error ? cause.message : String(cause)}`
+					};
+				}
+				const parsed = inspectionSchema.safeParse(observed);
+				if (!parsed.success) return {
+					available: false,
+					failureStage: "inspection",
+					reason: `REA Windows native inspection is invalid: ${parsed.error.message}`
+				};
+				const inspection = parsed.data;
+				return {
+					available: true,
+					authority: {
+						call: binding.call,
+						inspection
+					}
+				};
+			} catch (cause) {
+				return {
+					available: false,
+					failureStage: "artifact",
+					reason: `REA Windows native controls are unavailable: ${cause instanceof Error ? cause.message : String(cause)}`
+				};
+			}
+		};
+		assertWindowsX64Artifact = (bytes) => {
+			if (bytes.length < 64 || bytes.toString("latin1", 0, 2) !== "MZ") throw new Error("Windows native artifact is not a PE image");
+			const offset = bytes.readUInt32LE(60);
+			if (offset > bytes.length - 26 || bytes.toString("latin1", offset, offset + 4) !== "PE\0\0" || bytes.readUInt16LE(offset + 4) !== 34404 || bytes.readUInt16LE(offset + 24) !== 523) throw new Error("Windows native artifact is not a Windows x64 PE32+ image");
+		};
+		;
+		systemWindowsNativeAuthority = () => {
+			if (cached?.available === false && cached.retryable === true) cached = undefined;
+			cached ??= loadWindowsNativeAuthority({
+				platform: process.platform,
+				architecture: process.arch,
+				nodeApiVersion: process.versions.napi,
+				packageVersion: PACKAGE_METADATA.version,
+				readManifest: () => {
+					const encoded = readFileSync(new URL("../../native/windows/build/manifest.json", new URL("../windows/WindowsNativeLoader.js", import.meta.url).href), "utf8");
+					const value = JSON.parse(encoded);
+					return value;
+				},
+				readArtifact: () => readFileSync(new URL("../../native/windows/build/rea-windows-x64.node", new URL("../windows/WindowsNativeLoader.js", import.meta.url).href)),
+				loadArtifact: () => {
+					const value = createRequire(new URL("../windows/WindowsNativeLoader.js", import.meta.url).href)(fileURLToPath(new URL("../../native/windows/build/rea-windows-x64.node", new URL("../windows/WindowsNativeLoader.js", import.meta.url).href)));
+					return value;
+				}
+			});
+			return cached;
+		};
+		requireWindowsNativeAuthority = () => {
+			const loaded = systemWindowsNativeAuthority();
+			if (!loaded.available) throw new Error(loaded.reason);
+			return loaded.authority;
+		};
+	})))();
+}
+
+//#endregion
+export { init_WindowsNativeLoader, requireWindowsNativeAuthority, systemWindowsNativeAuthority, windowsFileIdentitySchema, windowsHandleSchema };

package/dist/cli-runtime/{ZipArtifactReader-B8ZgNe4D.js → ZipArtifactReader-Jed69LEL.js}

@@ -1,6 +1,7 @@
 import { __esmMin } from "./rolldown-runtime-DXoylpqc.js";
-import { ArtifactReaderFailure, copyArtifactEntry, init_ArtifactReader, sameArtifactEntry } from "./ArtifactReader-BXkffc1D.js";
-import { NonRegularFileReadError, OwnedFileHandle, RegularFileAdmissionFailure, init_OwnedFileHandle, init_RegularFile, openRegularFile, sameRegularFileState } from "./RegularFile-B_6KPCNQ.js";
+import { NonRegularFileReadError, OwnedFileHandle, RegularFileAdmissionFailure, init_OwnedFileHandle, init_RegularFile, openRegularFile, sameRegularFileState } from "./OwnedRegularFile-D1f5nUCx.js";
+import { ArtifactReaderFailure, copyArtifactEntry, init_ArtifactReader, sameArtifactEntry } from "./ArtifactReader-DMwm42bk.js";
+import { assertArtifactReadActive, init_ArtifactFileOperation } from "./ArtifactFileOperation-Dg4BcoEM.js";
 import { once } from "node:events";
 import { PassThrough } from "node:stream";
 import { ERR_AMBIGUOUS_ARCHIVE, ERR_BAD_FORMAT, ERR_CENTRAL_DIRECTORY_NOT_FOUND, ERR_ENCRYPTED_CENTRAL_DIRECTORY, ERR_ENTRY_DATA_OUT_OF_BOUNDS, ERR_EOCDR_LOCATOR_ZIP64_NOT_FOUND, ERR_EOCDR_NOT_FOUND, ERR_EXTRAFIELD_ZIP64_NOT_FOUND, ERR_INVALID_COMPRESSED_DATA, ERR_INVALID_CRC32, ERR_INVALID_UNCOMPRESSED_SIZE, ERR_LOCAL_FILE_HEADER_NOT_FOUND, ERR_OVERLAPPING_ENTRY, ERR_SPLIT_ZIP_FILE, ERR_UNSUPPORTED_COMPRESSION, ERR_UNSUPPORTED_ENCRYPTION, ERR_UNSUPPORTED_UINT64, Reader, ZipReader } from "@zip.js/zip.js";
@@ -24,9 +25,10 @@ async function* typedZipFailures(source) {
 		throw typedZipFailure(cause);
 	}
 }
-var ZIP_UTF8_DECODER, NodeFileReader, ZipArtifactReader, projectZipEntry, decodeZipEntryText, CP437_HIGH_HALF, decodeCp437, zipEntryPath, decodeStrictZipUtf8, extractStream, ZIP_FAILURE_REASONS, typedZipFailure, isSymlink, abortIfNeeded, toError;
+var ZIP_UTF8_DECODER, NodeFileReader, ZipArtifactReader, projectZipEntry, decodeZipEntryText, CP437_HIGH_HALF, decodeCp437, zipEntryPath, decodeStrictZipUtf8, extractStream, ZIP_FAILURE_REASONS, typedZipFailure, isSymlink, toError;
 function init_ZipArtifactReader() {
 	return (init_ZipArtifactReader = __esmMin((() => {
+		init_ArtifactFileOperation();
 		init_ArtifactReader();
 		init_artifactDecompressionBudget();
 		init_OwnedFileHandle();
@@ -76,6 +78,7 @@ function init_ZipArtifactReader() {
 				const handle = this.#handle;
 				if (handle === undefined) throw new Error("ZIP reader is not initialized");
 				const readBytes = Math.min(length, this.size - index);
+				if (readBytes < 0) throw new ArtifactReaderFailure("format", `ZIP archive is malformed: read at ${index} extends beyond the ${this.size}-byte archive`);
 				if (this.maximumReadBytes !== undefined && readBytes > this.maximumReadBytes) throw new ArtifactReaderFailure("limit", `ZIP metadata read requires ${readBytes} bytes, exceeding the ${this.maximumReadBytes}-byte read budget`);
 				const bytes = Buffer.alloc(readBytes);
 				const read = await handle.read(bytes, 0, bytes.length, index);
@@ -110,8 +113,9 @@ function init_ZipArtifactReader() {
 				let index = 0;
 				let declaredFileBytes = 0;
 				for await (const entry of typedZipFailures(this.#reader.getEntriesGenerator({ decodeText: decodeZipEntryText }))) {
-					abortIfNeeded(signal);
+					assertArtifactReadActive(signal);
 					const metadata = projectZipEntry(entry, index++);
+					if (metadata === undefined) continue;
 					if (metadata.kind === "file" && !metadata.encrypted && metadata.declaredSize !== null && Number.isSafeInteger(metadata.declaredSize) && metadata.declaredSize >= 0) {
 						declaredFileBytes += metadata.declaredSize;
 						const budget = artifactDecompressionBudgetBytes(this.#source.size);
@@ -127,7 +131,7 @@ function init_ZipArtifactReader() {
 				}
 			}
 			open(entry, signal) {
-				abortIfNeeded(signal);
+				assertArtifactReadActive(signal);
 				const stored = this.#entries.get(entry.adapterKey);
 				if (stored === undefined || !sameArtifactEntry(entry, stored.metadata)) return Promise.reject(new ArtifactReaderFailure("integrity", "ZIP entry metadata does not match this reader's inventory"));
 				const source = stored.source;
@@ -144,18 +148,21 @@ function init_ZipArtifactReader() {
 			}
 		};
 		projectZipEntry = (entry, index) => {
-			const symlink = isSymlink(entry);
+			const kind = isSymlink(entry) ? "symlink" : entry.directory ? "directory" : "file";
+			const sourcePath = zipEntryPath(entry);
+			const path = sourcePath.replace(/^(?:\.\/)+/u, "");
+			if (kind === "directory" && (path === "" || path === ".")) return undefined;
 			return {
-				path: zipEntryPath(entry),
-				kind: entry.directory ? "directory" : symlink ? "symlink" : "file",
-				declaredSize: entry.directory ? null : entry.uncompressedSize,
-				compressedSize: entry.directory ? null : entry.compressedSize,
+				path,
+				kind,
+				declaredSize: kind === "directory" ? null : entry.uncompressedSize,
+				compressedSize: kind === "directory" ? null : entry.compressedSize,
 				executable: entry.executable,
 				encrypted: entry.encrypted,
 				byteOffset: null,
 				declaredSha256: null,
 				unpacked: false,
-				limitations: symlink ? ["Archive symlink target was not read."] : [],
+				limitations: [...kind === "symlink" ? ["Archive symlink target was not read."] : [], ...path === sourcePath ? [] : [`ZIP member name ${JSON.stringify(sourcePath)} has a leading current-directory prefix omitted from its logical path.`]],
 				adapterKey: `zip-entry:${index}`
 			};
 		};
@@ -192,7 +199,7 @@ function init_ZipArtifactReader() {
 			});
 			const writable = new WritableStream({
 				write: async (chunk) => {
-					abortIfNeeded(signal);
+					assertArtifactReadActive(signal);
 					if (!output.write(Buffer.from(chunk))) await once(output, "drain", { signal: controller.signal });
 				},
 				close: () => {
@@ -206,7 +213,7 @@ function init_ZipArtifactReader() {
 				signal: controller.signal,
 				checkSignature: true,
 				checkOverlappingEntry: true,
-				onprogress: () => abortIfNeeded(signal)
+				onprogress: () => assertArtifactReadActive(signal)
 			}).catch((cause) => output.destroy(toError(typedZipFailure(cause))));
 			return output;
 		};
@@ -237,9 +244,6 @@ function init_ZipArtifactReader() {
 			return new ArtifactReaderFailure(reason, reason === "format" ? `ZIP archive is malformed: ${cause.message}` : `ZIP archive uses an unsupported feature: ${cause.message}`, { cause });
 		};
 		isSymlink = (entry) => entry.unixMode !== undefined && (entry.unixMode & 61440) === 40960;
-		abortIfNeeded = (signal) => {
-			if (signal?.aborted === true) throw new ArtifactReaderFailure("cancelled", "ZIP operation cancelled");
-		};
 		toError = (cause) => cause instanceof Error ? cause : new Error("ZIP extraction failed");
 	})))();
 }