{
  "projectId": "theoriq",
  "title": "Theoriq｜会话存储与 Agent 事件流",
  "summary": "公开 Infinity 客户端把对话保存在本地会话库，并通过带认证的事件流接收 Agent 请求进度；本次没有进入 AlphaVault 策略执行层。",
  "scope": "实际公开网页发布的选定业务 JavaScript 包；REA 解析 2 个 JS 文件，静态分析。",
  "status": "partial",
  "analyzedAt": "2026-10-13T10:53:48.558971+00:00",
  "tool": {
    "name": "REA",
    "version": "6.4.0"
  },
  "findings": [
    {
      "title": "请求进度和 Agent 通知使用不同事件路径",
      "detail": "SSEStreamClient 为 /requests/{id}/events/stream 与 /agents/{id}/notifications 构造流请求，Authorization 来自 authClient.getBiscuit()。代码含取消连接及 404/取消异常处理。这里只观察到客户端的认证与流消费代码。",
      "evidenceType": "observed",
      "evidenceIds": [
        "ev_7022bdb7f8212968712cfabbd53e55e7c3c44a2e75c5deb4c298218410aa12ac"
      ],
      "sourceUrls": [
        "https://infinity.theoriq.ai/assets/SessionManagerProvider-BJlYwnMG.js",
        "https://infinity.theoriq.ai/assets/SSEStreamClient-BXuPPtRz.js"
      ]
    },
    {
      "title": "对话记录按用户索引保存到 IndexedDB",
      "detail": "SessionManager 使用经过哈希处理的用户标识和 session_id 保存会话、dialog items、SSE 记录与 pendingRequestId。可推断界面有本地会话恢复机制；这不能证明服务端数据保存、权限隔离或加密方式。",
      "evidenceType": "code_inference",
      "evidenceIds": [
        "ev_7022bdb7f8212968712cfabbd53e55e7c3c44a2e75c5deb4c298218410aa12ac"
      ],
      "sourceUrls": [
        "https://infinity.theoriq.ai/assets/SessionManagerProvider-BJlYwnMG.js",
        "https://infinity.theoriq.ai/assets/SSEStreamClient-BXuPPtRz.js"
      ]
    }
  ],
  "limitations": [
    "仅覆盖 Infinity 的两个发布模块；没有解析 AlphaVault 合约、资金调度或收益策略。",
    "用户标识哈希不等于会话内容加密；未做身份伪造或越权实验。",
    "静态代码不证明运行行为、完整风控、成交或收益；未审计服务端。",
    "没有登录、读取账户、连接钱包、签名、交易或执行目标代码。"
  ],
  "artifacts": [
    {
      "label": "SessionManagerProvider-BJlYwnMG.js",
      "url": "https://infinity.theoriq.ai/assets/SessionManagerProvider-BJlYwnMG.js",
      "sha256": "50b131a43769c3ba8874b4a44a709b416f8360038494224d914907eacfb3fdc5"
    },
    {
      "label": "SSEStreamClient-BXuPPtRz.js",
      "url": "https://infinity.theoriq.ai/assets/SSEStreamClient-BXuPPtRz.js",
      "sha256": "0db343d32962d6696401b905a32ffeacbdbcc0ee20642196d7e58f54cb25c504"
    }
  ],
  "evidenceIds": [
    "ev_7022bdb7f8212968712cfabbd53e55e7c3c44a2e75c5deb4c298218410aa12ac"
  ],
  "reportUrl": "/research/rea/theoriq.json",
  "coverage": {
    "parsedFiles": 2,
    "parseFailures": 0,
    "semanticCoverage": "unknown",
    "rootArtifactSha256": "49552bf74ed41b6d9e8a3871a0cd2c3841e80b158ac0ea24b5748837e35d1074",
    "inputFileCount": 2,
    "inputBytes": 17104,
    "analysisResult": "completed"
  }
}