rea-agents - v2.1.0
    Preparing search index...

    Function createProcessCaptureEvidence

    • Create one canonical observed Process Capture v4 Evidence record.

      Parameters

      • scenario: {
            approved: true;
            arguments: string[];
            checkpoints: {
                name: string;
                trigger:
                    | { at_ms: number; type: "time" }
                    | { occurrence: number; type: "terminal_literal"; value: string }
                    | { type: "root_exit" }
                    | { type: "settled" };
            }[];
            command_shims: {
                name: string;
                routes: {
                    arguments: string[];
                    max_calls: number;
                    outputs: { at_ms: number; data: string; stream: "stdout"
                    | "stderr" }[];
                    termination:
                        | { code: number; type: "exit" }
                        | { signal: "SIGINT" | "SIGTERM" | "SIGKILL"; type: "signal" };
                }[];
            }[];
            environment: Record<string, string>;
            events: (
                | { at_ms: number; data: string; sensitive: boolean; type: "input" }
                | { at_ms: number; columns: number; rows: number; type: "resize" }
                | {
                    at_ms: number;
                    signal: "SIGINT" | "SIGTERM" | "SIGKILL";
                    type: "signal";
                }
            )[];
            executable: string;
            filesystem_roots: string[];
            idle_timeout_ms: number;
            inherit_environment: string[];
            limits: {
                connections: number;
                file_bytes: number;
                files: number;
                filesystem_depth: number;
                frames: number;
                output_bytes: number;
                processes: number;
                protocol_body_bytes: number;
                protocol_events: number;
            };
            network_access: "host";
            normalization: {
                paths: boolean;
                patterns: { pattern: string; replacement: string }[];
                pids: boolean;
                ports: boolean;
                time_bucket_ms: number;
            };
            replay: {
                http: {
                    body: string;
                    delay_ms: number;
                    disconnect: boolean;
                    max_calls: number;
                    method: string;
                    path: string;
                    request_body?: string;
                    request_headers: Record<string, string>;
                    response_headers: Record<string, string>;
                    status: number;
                }[];
                websocket_connections: {
                    disconnect_after: boolean;
                    messages: { data: string; delay_ms: number }[];
                }[];
                websocket_messages: string[];
            };
            secret_aliases: string[];
            settle_ms: number;
            terminal: { columns: number; rows: number; scrollback: number };
            timeout_ms: number;
            unknown_registry_approved?: true;
            working_directory: string;
        }
      • capture: ProcessCapture

      Returns
          | {
              analysis_profile: {
                  digest: string;
                  parameters: Record<string, JSONType>;
                  provider: { id: string; name: string; version: string };
                  provider_profile_schema_version: number;
                  schema_version: 1;
              };
              authority: | "shipped-artifact"
              | "controlled-replay"
              | "historical-reference"
              | "external-service"
              | "analyst-inference";
              confidence: "observed"
              | "derived"
              | "inferred";
              environment:
                  | {
                      architecture: string;
                      id: string;
                      isolation: "process"
                      | "none"
                      | "container"
                      | "virtual-machine";
                      platform: string;
                  }
                  | null;
              evidence_id: string;
              evidence_links: string[];
              limitations: string[];
              locations: (
                  | { address: string; kind: "address" }
                  | { end: string; kind: "address-range"; start: string }
                  | { kind: "artifact-path"; path: string }
                  | { kind: "file-offset"; offset: number }
                  | { end: number; kind: "file-offset-range"; start: number }
              )[];
              normalized_result: JSONType;
              operation: string;
              parameters: Record<string, JSONType>;
              predicate_type: string;
              provider: { id: string; name: string; version: string | null };
              raw_result: JSONType;
              schema_version: 2;
              subject:
                  | {
                      architecture: "x86"
                      | "x86_64"
                      | "arm"
                      | "arm64"
                      | null;
                      digest: { sha256: string };
                      format:
                          | "unknown"
                          | "file"
                          | "directory"
                          | "javascript"
                          | "source-map"
                          | "plist"
                          | "entitlements"
                          | "dmg"
                          | "zip"
                          | "pkg"
                          | "asar"
                          | "javascript-bundle"
                          | "mach-o-universal"
                          | "mach-o"
                          | "elf"
                          | "pe"
                          | "hopper"
                          | "analysis-database"
                          | "ipa"
                          | "apk";
                      local_path: string;
                      name: string;
                  }
                  | null;
          }
          | {
              authority: | "shipped-artifact"
              | "controlled-replay"
              | "historical-reference"
              | "external-service"
              | "analyst-inference";
              confidence: "observed"
              | "derived"
              | "inferred";
              environment:
                  | {
                      architecture: string;
                      id: string;
                      isolation: "process"
                      | "none"
                      | "container"
                      | "virtual-machine";
                      platform: string;
                  }
                  | null;
              evidence_id: string;
              evidence_links: string[];
              limitations: string[];
              locations: (
                  | { address: string; kind: "address" }
                  | { end: string; kind: "address-range"; start: string }
                  | { kind: "artifact-path"; path: string }
                  | { kind: "file-offset"; offset: number }
                  | { end: number; kind: "file-offset-range"; start: number }
              )[];
              normalized_result: JSONType;
              operation: string;
              parameters: Record<string, JSONType>;
              predicate_type: string;
              provider: { id: string; name: string; version: string | null };
              raw_result: JSONType;
              schema_version: 2;
              subject:
                  | {
                      architecture: "x86"
                      | "x86_64"
                      | "arm"
                      | "arm64"
                      | null;
                      digest: { sha256: string };
                      format:
                          | "unknown"
                          | "file"
                          | "directory"
                          | "javascript"
                          | "source-map"
                          | "plist"
                          | "entitlements"
                          | "dmg"
                          | "zip"
                          | "pkg"
                          | "asar"
                          | "javascript-bundle"
                          | "mach-o-universal"
                          | "mach-o"
                          | "elf"
                          | "pe"
                          | "hopper"
                          | "analysis-database"
                          | "ipa"
                          | "apk";
                      local_path: string;
                      name: string;
                  }
                  | null;
          }

    Settings
    Member Visibility