@remnux/mcp-server 0.1.73 → 0.1.75

package/README.md

@@ -284,6 +284,20 @@ claude mcp add remnux --transport http http://REMNUX_IP:3000/mcp \
 
 **Auto-summarization:** When total tool output exceeds ~32KB, `analyze_file` automatically switches to summary mode to prevent LLM context overflow — key findings per tool, full IOC extraction, and paths to saved full outputs for drill-down via `download_file`.
 
+**IOC list:** Hash-shaped values in tool output (MD5, SHA-1, SHA-256, SHA-512, ssdeep) are not counted in `analyze_file`'s `iocs` list. A hash in tool output is almost always one a tool computed, such as a section hash or an imphash. Those hashes stay in each tool's output, and `extract_iocs` still reports hashes in the text it is given.
+
+**Tool status (summary mode):** each tool entry in the summary has a `status`.
+
+| Status | Meaning |
+|---|---|
+| `findings` | The tool's parser resolved at least one finding |
+| `clean` | The tool's parser read the output and resolved nothing. A benign verdict needs other evidence |
+| `not_assessed` | No parser reads this tool's output, so the server did not interpret it. Its `key_lines` are raw excerpts |
+| `error` | The tool exited non-zero or reported its own failure (`tool_reported_error`), or its parser could not read the output (`parse_failed`) |
+| `timeout` | The tool exited non-zero and its output mentions a timeout |
+
+*Compatibility note:* `not_assessed` is new. Tools without a parser used to report `clean`. A client that switches exhaustively over the status values needs a branch for it.
+
 **Preprocessing:** Before analysis, `analyze_file` checks for conditions that prevent effective analysis (encrypted Office docs, bloated PEs, PyInstaller bundles) and applies automatic fixes. Results appear in the `preprocessing` field.
 
 ### Example: run_tool

package/dist/analysis/summarizer.d.ts

@@ -14,6 +14,12 @@ interface ToolRun {
     full_output_length?: number;
     findings?: Finding[];
     metadata?: Record<string, unknown>;
+    /** Output file the server saved for this tool. */
+    saved_output_file?: string;
+    /** The tool's parser could not read its output. */
+    parse_failed?: boolean;
+    /** The tool exited 0 but reported a failure of its own. */
+    tool_reported_error?: boolean;
 }
 interface IOC {
     type: string;
@@ -44,9 +50,21 @@ interface PreprocessResult {
     outputPath?: string;
     error?: string;
 }
+/**
+ * `clean` means the tool's parser read its output and resolved nothing.
+ * `not_assessed` means no parser reads this tool's output, so nothing interpreted it.
+ */
+export type ToolStatus = "findings" | "clean" | "not_assessed" | "error" | "timeout";
 export interface ToolSummary {
     name: string;
-    status: "findings" | "clean" | "error" | "timeout";
+    status: ToolStatus;
+    /** Present when the tool's parser could not read its output; status is then "error". */
+    parse_failed?: true;
+    /**
+     * Present when the tool exited 0 but reported a failure of its own. Status is
+     * "error", or "findings" when the tool also recovered something.
+     */
+    tool_reported_error?: true;
     key_lines: string[];
     finding_count?: number;
     output_size: number;
@@ -120,6 +138,12 @@ export declare function shouldSummarize(toolsRun: ToolRun[]): boolean;
  * - Repetitive lines
  */
 export declare function extractKeyLines(output: string, limit?: number): string[];
+/**
+ * The lines that represent a tool in summary mode. A parsed tool's findings come
+ * first, because the generic scorer can miss them (a YARA match line scores zero),
+ * followed by the scorer's picks from the raw output.
+ */
+export declare function deriveKeyLines(tool: ToolRun): string[];
 /**
  * Generate a summarized analysis response.
  */

package/dist/analysis/summarizer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"summarizer.d.ts","sourceRoot":"","sources":["../../src/analysis/summarizer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAEnD,UAAU,OAAO;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,UAAU,GAAG;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,UAAU,UAAU;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,UAAU,UAAU;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,UAAU,WAAW;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,eAAe,GAAG,gBAAgB,GAAG,oBAAoB,CAAC;CACtE;AAED,UAAU,gBAAgB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,CAAC;IACnD,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,IAAI,EAAE,SAAS,CAAC;IAChB,eAAe,CAAC,EAAE,cAAc,EAAE,CAAC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,gBAAgB,EAAE,CAAC;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,YAAY,EAAE,UAAU,EAAE,CAAC;IAC3B,aAAa,EAAE,WAAW,EAAE,CAAC;IAC7B,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,WAAW,EAAE,UAAU,CAAC;IACxB,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,kBAAkB,CAAC;CAC1C;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,uFAAuF;IACvF,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,kGAAkG;IAClG,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,kBAAkB,GAAG,SAAS,CA4B/F;AAQD;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAG5D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,GAAE,MAA+B,GAAG,MAAM,EAAE,CAgEhG;AAgBD;;GAEG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,OAAO,EAAE,EACnB,WAAW,EAAE,UAAU,EAAE,EACzB,YAAY,EAAE,WAAW,EAAE,EAC3B,iBAAiB,EAAE,gBAAgB,EAAE,EACrC,IAAI,EAAE,GAAG,EAAE,EACX,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,MAAM,EAAE,EACnB,gBAAgB,EAAE,MAAM,EACxB,YAAY,CAAC,EAAE,MAAM,EACrB,UAAU,CAAC,EAAE,cAAc,EAAE,GAC5B,eAAe,CAwDjB"}
+{"version":3,"file":"summarizer.d.ts","sourceRoot":"","sources":["../../src/analysis/summarizer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAInD,UAAU,OAAO;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,kDAAkD;IAClD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mDAAmD;IACnD,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,2DAA2D;IAC3D,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,UAAU,GAAG;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,UAAU,UAAU;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,UAAU,UAAU;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,UAAU,WAAW;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,eAAe,GAAG,gBAAgB,GAAG,oBAAoB,CAAC;CACtE;AAED,UAAU,gBAAgB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,OAAO,GAAG,cAAc,GAAG,OAAO,GAAG,SAAS,CAAC;AAErF,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,CAAC;IACnB,wFAAwF;IACxF,YAAY,CAAC,EAAE,IAAI,CAAC;IACpB;;;OAGG;IACH,mBAAmB,CAAC,EAAE,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,IAAI,EAAE,SAAS,CAAC;IAChB,eAAe,CAAC,EAAE,cAAc,EAAE,CAAC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,gBAAgB,EAAE,CAAC;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,YAAY,EAAE,UAAU,EAAE,CAAC;IAC3B,aAAa,EAAE,WAAW,EAAE,CAAC;IAC7B,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,WAAW,EAAE,UAAU,CAAC;IACxB,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,kBAAkB,CAAC;CAC1C;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,uFAAuF;IACvF,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,kGAAkG;IAClG,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,kBAAkB,GAAG,SAAS,CA4B/F;AAQD;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAG5D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,GAAE,MAA+B,GAAG,MAAM,EAAE,CAgEhG;AAWD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,EAAE,CAatD;AAmBD;;GAEG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,OAAO,EAAE,EACnB,WAAW,EAAE,UAAU,EAAE,EACzB,YAAY,EAAE,WAAW,EAAE,EAC3B,iBAAiB,EAAE,gBAAgB,EAAE,EACrC,IAAI,EAAE,GAAG,EAAE,EACX,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,MAAM,EAAE,EACnB,gBAAgB,EAAE,MAAM,EACxB,YAAY,CAAC,EAAE,MAAM,EACrB,UAAU,CAAC,EAAE,cAAc,EAAE,GAC5B,eAAe,CAmDjB"}

package/dist/analysis/summarizer.js

@@ -4,6 +4,8 @@
  * When total output exceeds the budget, generates a summary with key findings
  * per tool while preserving IOCs and providing paths to full outputs.
  */
+import { hasParser } from "../parsers/index.js";
+import { exitCodeIsFailure } from "../tools/registry.js";
 /**
  * Separate capability findings (e.g. capa) by the kind of evidence they matched
  * on, using each finding's evidence_types tag. This is a pure reorganization of
@@ -130,11 +132,37 @@ export function extractKeyLines(output, limit = MAX_KEY_LINES_PER_TOOL) {
     scored.sort((a, b) => b.score - a.score);
     return scored.slice(0, limit).map((s) => s.line);
 }
+/** Findings shown as key lines for a parsed tool. Overflow is counted, never silent. */
+const MAX_FINDING_KEY_LINES = 20;
+/** Per-line cap, since a finding description can quote sample text. */
+const MAX_KEY_LINE_CHARS = 300;
+const capLine = (line) => line.length > MAX_KEY_LINE_CHARS ? `${line.slice(0, MAX_KEY_LINE_CHARS)}…` : line;
+/**
+ * The lines that represent a tool in summary mode. A parsed tool's findings come
+ * first, because the generic scorer can miss them (a YARA match line scores zero),
+ * followed by the scorer's picks from the raw output.
+ */
+export function deriveKeyLines(tool) {
+    const findings = tool.findings ?? [];
+    if (findings.length === 0)
+        return extractKeyLines(tool.output);
+    const lines = findings.slice(0, MAX_FINDING_KEY_LINES).map((f) => capLine(f.description));
+    if (findings.length > MAX_FINDING_KEY_LINES) {
+        lines.push(`… and ${findings.length - MAX_FINDING_KEY_LINES} more finding(s)`);
+    }
+    const seen = new Set(lines.map((l) => l.toLowerCase()));
+    for (const line of extractKeyLines(tool.output)) {
+        const capped = capLine(line);
+        if (!seen.has(capped.toLowerCase()))
+            lines.push(capped);
+    }
+    return lines;
+}
 /**
  * Determine the status of a tool run.
  */
 function getToolStatus(tool) {
-    if (tool.exit_code !== 0) {
+    if (exitCodeIsFailure(tool.name, tool.exit_code)) {
         if (tool.output?.toLowerCase().includes("timeout"))
             return "timeout";
         // Some tools exit non-zero but still produce findings
@@ -144,6 +172,11 @@ function getToolStatus(tool) {
     }
     if (tool.findings && tool.findings.length > 0)
         return "findings";
+    if (tool.parse_failed || tool.tool_reported_error)
+        return "error";
+    // "clean" would claim a reading of output that nothing interpreted.
+    if (!hasParser(tool.name))
+        return "not_assessed";
     return "clean";
 }
 /**
@@ -154,22 +187,17 @@ export function generateSummary(file, detectedType, category, depth, triageSumma
     const savedFiles = [];
     for (const tool of toolsRun) {
         const status = getToolStatus(tool);
-        const keyLines = extractKeyLines(tool.output);
-        // Track which files were saved for full output retrieval. The marker is
-        // written by analyze_file's truncation path as
-        // "Saved in full as %OUTPUT%/<file> (...)" (legacy form: "Full output: output/<file>").
-        // Only trust the marker when the server actually truncated this tool's
-        // output: sample-derived text could otherwise forge a saved_to entry.
-        const savedMatch = tool.truncated
-            ? (tool.output?.match(/Saved in full as %OUTPUT%\/([^\s\](]+)/) ??
-                tool.output?.match(/Full output: output\/([^\s\]]+)/))
-            : null;
-        const savedTo = savedMatch ? savedMatch[1] : undefined;
+        const keyLines = deriveKeyLines(tool);
+        // Set by analyze_file whenever it saved this tool's output, never read from
+        // tool text, so sample content cannot forge it.
+        const savedTo = tool.saved_output_file;
         if (savedTo)
             savedFiles.push(savedTo);
         toolSummaries.push({
             name: tool.name,
             status,
+            ...(tool.parse_failed && { parse_failed: true }),
+            ...(tool.tool_reported_error && { tool_reported_error: true }),
             key_lines: keyLines,
             ...(tool.findings && tool.findings.length > 0 && { finding_count: tool.findings.length }),
             output_size: tool.output?.length || 0,

package/dist/analysis/summarizer.js.map

@@ -1 +1 @@
-{"version":3,"file":"summarizer.js","sourceRoot":"","sources":["../../src/analysis/summarizer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAqGH;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CAAC,QAAmB;IAC7D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,SAAS;QAC7B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC9B,MAAM,EAAE,GAAG,CAAC,CAAC,cAAc,CAAC;YAC5B,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACrC,IAAI,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;;gBACpD,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,IAAI,YAAY,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACrE,MAAM,GAAG,GAAG,EAAE,CAAC;IACf,MAAM,MAAM,GAAG,CAAC,CAAc,EAAY,EAAE;QAC1C,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACnB,OAAO,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,GAAG,CAAC,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC3F,CAAC,CAAC;IACF,OAAO;QACL,IAAI,EACF,yGAAyG;YACzG,yGAAyG;YACzG,sDAAsD;YACtD,0GAA0G;YAC1G,sGAAsG;QACxG,gBAAgB,EAAE,MAAM,CAAC,QAAQ,CAAC;QAClC,aAAa,EAAE,MAAM,CAAC,YAAY,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,+DAA+D;AAC/D,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAEtC,4CAA4C;AAC5C,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAEjC;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,QAAmB;IACjD,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5E,OAAO,KAAK,GAAG,uBAAuB,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,QAAgB,sBAAsB;IACpF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAE9C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,MAAM,GAA2C,EAAE,CAAC;IAC1D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,wDAAwD;IACxD,qEAAqE;IACrE,MAAM,iBAAiB,GAAG;QACxB,uDAAuD;QACvD,mCAAmC;QACnC,wCAAwC;QACxC,6DAA6D;QAC7D,+BAA+B;QAC/B,sBAAsB;QACtB,sCAAsC;KACvC,CAAC;IAEF,iDAAiD;IACjD,MAAM,aAAa,GAAG;QACpB,cAAc;QACd,qCAAqC;QACrC,oBAAoB;QACpB,aAAa;QACb,UAAU;KACX,CAAC;IAEF,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG;YAAE,SAAS;QAE5D,kBAAkB;QAClB,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC3D,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,SAAS;QACnC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAErB,kBAAkB;QAClB,IAAI,KAAK,GAAG,CAAC,CAAC;QAEd,iCAAiC;QACjC,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;YACxC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,KAAK,IAAI,EAAE,CAAC;QACtC,CAAC;QAED,iCAAiC;QACjC,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;YACpC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,KAAK,IAAI,EAAE,CAAC;QACtC,CAAC;QAED,gEAAgE;QAChE,IAAI,qCAAqC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,KAAK,IAAI,CAAC,CAAC;QAEjE,8CAA8C;QAC9C,IAAI,0CAA0C,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,KAAK,IAAI,CAAC,CAAC;QAEtE,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,uCAAuC;IACvC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACnD,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,IAAa;IAClC,IAAI,IAAI,CAAC,SAAS,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QACrE,sDAAsD;QACtD,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,UAAU,CAAC;QACjE,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,UAAU,CAAC;IACjE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,YAAoB,EACpB,QAAgB,EAChB,KAAa,EACb,aAAqB,EACrB,QAAmB,EACnB,WAAyB,EACzB,YAA2B,EAC3B,iBAAqC,EACrC,IAAW,EACX,UAAsB,EACtB,SAAmB,EACnB,gBAAwB,EACxB,YAAqB,EACrB,UAA6B;IAE7B,MAAM,aAAa,GAAkB,EAAE,CAAC;IACxC,MAAM,UAAU,GAAa,EAAE,CAAC;IAEhC,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAE9C,wEAAwE;QACxE,+CAA+C;QAC/C,wFAAwF;QACxF,uEAAuE;QACvE,sEAAsE;QACtE,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS;YAC/B,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,wCAAwC,CAAC;gBAC7D,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,iCAAiC,CAAC,CAAC;YACxD,CAAC,CAAC,IAAI,CAAC;QACT,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACvD,IAAI,OAAO;YAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAEtC,aAAa,CAAC,IAAI,CAAC;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM;YACN,SAAS,EAAE,QAAQ;YACnB,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YACzF,WAAW,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC;YACrC,GAAG,CAAC,OAAO,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;SACtC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,iBAAiB,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,MAAM,CAAC;IAEtF,OAAO;QACL,IAAI,EAAE,SAAS;QACf,GAAG,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;QAC3E,IAAI;QACJ,aAAa,EAAE,YAAY;QAC3B,gBAAgB,EAAE,QAAQ;QAC1B,KAAK;QACL,cAAc,EAAE,aAAa;QAC7B,GAAG,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,aAAa,EAAE,iBAAiB,EAAE,CAAC;QACzE,WAAW,EAAE,QAAQ,CAAC,MAAM;QAC5B,mBAAmB,EAAE,iBAAiB;QACtC,KAAK,EAAE,aAAa;QACpB,YAAY,EAAE,WAAW;QACzB,aAAa,EAAE,YAAY;QAC3B,IAAI;QACJ,WAAW,EAAE,UAAU;QACvB,oBAAoB,EAAE,SAAS;QAC/B,gBAAgB,EACd,UAAU,CAAC,MAAM,GAAG,CAAC;YACnB,CAAC,CAAC,oDAAoD,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,4FAA4F;YACvK,CAAC,CAAC,wDAAwD;QAC9D,iBAAiB,EAAE,gBAAgB;QACnC,GAAG,CAAC,YAAY,IAAI,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;KACrD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"summarizer.js","sourceRoot":"","sources":["../../src/analysis/summarizer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAsHzD;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CAAC,QAAmB;IAC7D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,SAAS;QAC7B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC9B,MAAM,EAAE,GAAG,CAAC,CAAC,cAAc,CAAC;YAC5B,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACrC,IAAI,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;;gBACpD,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,IAAI,YAAY,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACrE,MAAM,GAAG,GAAG,EAAE,CAAC;IACf,MAAM,MAAM,GAAG,CAAC,CAAc,EAAY,EAAE;QAC1C,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACnB,OAAO,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,GAAG,CAAC,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC3F,CAAC,CAAC;IACF,OAAO;QACL,IAAI,EACF,yGAAyG;YACzG,yGAAyG;YACzG,sDAAsD;YACtD,0GAA0G;YAC1G,sGAAsG;QACxG,gBAAgB,EAAE,MAAM,CAAC,QAAQ,CAAC;QAClC,aAAa,EAAE,MAAM,CAAC,YAAY,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,+DAA+D;AAC/D,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAEtC,4CAA4C;AAC5C,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAEjC;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,QAAmB;IACjD,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5E,OAAO,KAAK,GAAG,uBAAuB,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,QAAgB,sBAAsB;IACpF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAE9C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,MAAM,GAA2C,EAAE,CAAC;IAC1D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,wDAAwD;IACxD,qEAAqE;IACrE,MAAM,iBAAiB,GAAG;QACxB,uDAAuD;QACvD,mCAAmC;QACnC,wCAAwC;QACxC,6DAA6D;QAC7D,+BAA+B;QAC/B,sBAAsB;QACtB,sCAAsC;KACvC,CAAC;IAEF,iDAAiD;IACjD,MAAM,aAAa,GAAG;QACpB,cAAc;QACd,qCAAqC;QACrC,oBAAoB;QACpB,aAAa;QACb,UAAU;KACX,CAAC;IAEF,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG;YAAE,SAAS;QAE5D,kBAAkB;QAClB,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC3D,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,SAAS;QACnC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAErB,kBAAkB;QAClB,IAAI,KAAK,GAAG,CAAC,CAAC;QAEd,iCAAiC;QACjC,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;YACxC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,KAAK,IAAI,EAAE,CAAC;QACtC,CAAC;QAED,iCAAiC;QACjC,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;YACpC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,KAAK,IAAI,EAAE,CAAC;QACtC,CAAC;QAED,gEAAgE;QAChE,IAAI,qCAAqC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,KAAK,IAAI,CAAC,CAAC;QAEjE,8CAA8C;QAC9C,IAAI,0CAA0C,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,KAAK,IAAI,CAAC,CAAC;QAEtE,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,uCAAuC;IACvC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACnD,CAAC;AAED,wFAAwF;AACxF,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAEjC,uEAAuE;AACvE,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAE/B,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,EAAE,CAC/B,IAAI,CAAC,MAAM,GAAG,kBAAkB,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAEpF;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,IAAa;IAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IACrC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;IAC1F,IAAI,QAAQ,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;QAC5C,KAAK,CAAC,IAAI,CAAC,SAAS,QAAQ,CAAC,MAAM,GAAG,qBAAqB,kBAAkB,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACxD,KAAK,MAAM,IAAI,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,IAAa;IAClC,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACjD,IAAI,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QACrE,sDAAsD;QACtD,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,UAAU,CAAC;QACjE,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,UAAU,CAAC;IACjE,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,mBAAmB;QAAE,OAAO,OAAO,CAAC;IAClE,oEAAoE;IACpE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,cAAc,CAAC;IACjD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,YAAoB,EACpB,QAAgB,EAChB,KAAa,EACb,aAAqB,EACrB,QAAmB,EACnB,WAAyB,EACzB,YAA2B,EAC3B,iBAAqC,EACrC,IAAW,EACX,UAAsB,EACtB,SAAmB,EACnB,gBAAwB,EACxB,YAAqB,EACrB,UAA6B;IAE7B,MAAM,aAAa,GAAkB,EAAE,CAAC;IACxC,MAAM,UAAU,GAAa,EAAE,CAAC;IAEhC,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QAEtC,4EAA4E;QAC5E,gDAAgD;QAChD,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC;QACvC,IAAI,OAAO;YAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAEtC,aAAa,CAAC,IAAI,CAAC;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM;YACN,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,IAAa,EAAE,CAAC;YACzD,GAAG,CAAC,IAAI,CAAC,mBAAmB,IAAI,EAAE,mBAAmB,EAAE,IAAa,EAAE,CAAC;YACvE,SAAS,EAAE,QAAQ;YACnB,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YACzF,WAAW,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC;YACrC,GAAG,CAAC,OAAO,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;SACtC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,iBAAiB,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,MAAM,CAAC;IAEtF,OAAO;QACL,IAAI,EAAE,SAAS;QACf,GAAG,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;QAC3E,IAAI;QACJ,aAAa,EAAE,YAAY;QAC3B,gBAAgB,EAAE,QAAQ;QAC1B,KAAK;QACL,cAAc,EAAE,aAAa;QAC7B,GAAG,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,aAAa,EAAE,iBAAiB,EAAE,CAAC;QACzE,WAAW,EAAE,QAAQ,CAAC,MAAM;QAC5B,mBAAmB,EAAE,iBAAiB;QACtC,KAAK,EAAE,aAAa;QACpB,YAAY,EAAE,WAAW;QACzB,aAAa,EAAE,YAAY;QAC3B,IAAI;QACJ,WAAW,EAAE,UAAU;QACvB,oBAAoB,EAAE,SAAS;QAC/B,gBAAgB,EACd,UAAU,CAAC,MAAM,GAAG,CAAC;YACnB,CAAC,CAAC,oDAAoD,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,4FAA4F;YACvK,CAAC,CAAC,wDAAwD;QAC9D,iBAAiB,EAAE,gBAAgB;QACnC,GAAG,CAAC,YAAY,IAAI,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;KACrD,CAAC;AACJ,CAAC"}

package/dist/handlers/analyze-file.d.ts

@@ -11,6 +11,12 @@ interface ToolRun {
     full_output_length?: number;
     findings?: Finding[];
     metadata?: Record<string, unknown>;
+    /** Output file the server saved for this tool. */
+    saved_output_file?: string;
+    /** The tool's parser could not read its output. */
+    parse_failed?: boolean;
+    /** The tool exited 0 but reported a failure of its own. */
+    tool_reported_error?: boolean;
 }
 interface ToolSkipped {
     name: string;
@@ -20,8 +26,17 @@ interface ToolSkipped {
     /** Categorizes why the tool was skipped for clearer UX */
     skip_type: "not_installed" | "not_applicable" | "requires_user_args";
 }
+/**
+ * Name for a tool-output file the server writes into the output directory.
+ * Sanitizing the sample name is lossy (every non-Latin letter becomes "_"), so a
+ * short hash of the original name keeps two samples from overwriting each other's
+ * output. The whole name stays within one 255-byte path component.
+ */
+export declare function spillFilename(toolName: string, sampleName: string): string;
 /** Generate suggested next steps based on file category and analysis results */
 export declare function generateNextSteps(category: string, depth: DepthTier, toolsRun: ToolRun[], toolsSkipped: ToolSkipped[], iocCount: number): string[];
+/** Generate a brief triage summary from analysis results */
+export declare function generateTriageSummary(category: string, toolsRun: ToolRun[], iocCount: number): string;
 /**
  * Parsing hints for querying saved (oversized) tool output with jq/grep.
  * Every hint is a runnable run_tool command: `%OUTPUT%/<file>` is the sentinel

package/dist/handlers/analyze-file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyze-file.d.ts","sourceRoot":"","sources":["../../src/handlers/analyze-file.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAG3D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAI1D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAgBnD,UAAU,OAAO;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,UAAU,WAAW;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,SAAS,EAAE,eAAe,GAAG,gBAAgB,GAAG,oBAAoB,CAAC;CACtE;AAED,gFAAgF;AAChF,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,OAAO,EAAE,EACnB,YAAY,EAAE,WAAW,EAAE,EAC3B,QAAQ,EAAE,MAAM,GACf,MAAM,EAAE,CAyFV;AA+ID;;;;;GAKG;AACH,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CA0BlD,CAAC;AAEF,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,eAAe;;;;;;GAqctB"}
+{"version":3,"file":"analyze-file.d.ts","sourceRoot":"","sources":["../../src/handlers/analyze-file.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAG3D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAI1D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAgBnD,UAAU,OAAO;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,kDAAkD;IAClD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mDAAmD;IACnD,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,2DAA2D;IAC3D,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,UAAU,WAAW;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,SAAS,EAAE,eAAe,GAAG,gBAAgB,GAAG,oBAAoB,CAAC;CACtE;AAeD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAK1E;AAED,gFAAgF;AAChF,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,OAAO,EAAE,EACnB,YAAY,EAAE,WAAW,EAAE,EAC3B,QAAQ,EAAE,MAAM,GACf,MAAM,EAAE,CAwFV;AAED,4DAA4D;AAC5D,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,OAAO,EAAE,EACnB,QAAQ,EAAE,MAAM,GACf,MAAM,CAsFR;AAmCD;;;;;GAKG;AACH,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CA0BlD,CAAC;AAEF,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,eAAe;;;;;;GA6ctB"}

package/dist/handlers/analyze-file.js

@@ -1,7 +1,8 @@
+import { createHash } from "node:crypto";
 import { saveOversizedOutput } from "./output-spill.js";
 import { validateFilePath } from "../security/blocklist.js";
 import { matchFileType, CATEGORY_TAG_MAP } from "../file-type-mappings.js";
-import { toolRegistry } from "../tools/registry.js";
+import { toolRegistry, exitCodeIsFailure } from "../tools/registry.js";
 import { buildCommandFromDefinition, resolveOutputPath, buildInvocationTemplate } from "../tools/invoker.js";
 import { parseToolOutput } from "../parsers/index.js";
 import { formatResponse, formatError } from "../response.js";
@@ -15,9 +16,34 @@ import { checkFileExists } from "../utils/check-file-exists.js";
 import { getPreprocessors } from "../tools/preprocessors.js";
 import { shouldSummarize, generateSummary, summarizeCapabilityEvidence } from "../analysis/index.js";
 import { evaluateAdvisories, } from "../tools/advisories.js";
+const YARA_TOOLS = new Set(["yara-forge", "yara-rules"]);
+/** diec detections (its "type: name" findings) that earn a container or packer label. */
+const CONTAINER_LABELS = [
+    [/^sfx:.*Microsoft Cabinet/i, "Microsoft Cabinet SFX"],
+    [/Nullsoft|NSIS/i, "NSIS installer"],
+    [/Inno Setup/i, "Inno Setup"],
+    [/PyInstaller/i, "PyInstaller"],
+    [/AutoIt/i, "AutoIt compiled"],
+    [/Themida|VMProtect|Enigma/i, "protected"],
+    [/\bUPX\b/i, "UPX packed"],
+];
+/**
+ * Name for a tool-output file the server writes into the output directory.
+ * Sanitizing the sample name is lossy (every non-Latin letter becomes "_"), so a
+ * short hash of the original name keeps two samples from overwriting each other's
+ * output. The whole name stays within one 255-byte path component.
+ */
+export function spillFilename(toolName, sampleName) {
+    const suffix = createHash("sha256").update(sampleName).digest("hex").slice(0, 8);
+    const room = 255 - toolName.length - suffix.length - "--.txt".length;
+    const safe = sampleName.replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, Math.max(1, room));
+    return `${toolName}-${safe}-${suffix}.txt`;
+}
 /** Generate suggested next steps based on file category and analysis results */
 export function generateNextSteps(category, depth, toolsRun, toolsSkipped, iocCount) {
     const steps = [];
+    // A generic step that repeats a command this run already executed adds nothing.
+    const ran = (name) => toolsRun.some(t => t.name === name);
     // Depth-based suggestions
     if (depth === "quick") {
         steps.push("Run with depth='standard' for more thorough analysis (capa, YARA rules, etc.)");
@@ -29,11 +55,13 @@ export function generateNextSteps(category, depth, toolsRun, toolsSkipped, iocCo
     switch (category) {
         case "PE":
         case "DOTNET":
-            if (!toolsRun.some(t => t.name === "capa" && t.findings && t.findings.length > 0)) {
+            if (!ran("upx-decompress") && !toolsRun.some(t => t.name === "capa" && t.findings && t.findings.length > 0)) {
                 steps.push("File may be packed — try unpacking with 'upx -d' or specialized unpackers before re-analysis");
             }
-            steps.push("For dynamic analysis: use run_tool with 'speakeasy -t <file>' to emulate execution");
-            steps.push("Extract strings: run_tool command='pestr <file>' (extracts both ASCII and Unicode with section info)");
+            if (!ran("speakeasy"))
+                steps.push("For dynamic analysis: use run_tool with 'speakeasy -t <file>' to emulate execution");
+            if (!ran("pestr"))
+                steps.push("Extract strings: run_tool command='pestr <file>' (extracts both ASCII and Unicode with section info)");
             steps.push("If this is a self-extracting archive (SFX/dropper): run_tool command='7z l <file>' to list embedded contents, then 'run_tool command=7z x <file> -o%OUTPUT%/sfx -y' to unpack them");
             break;
         case "PDF":
@@ -43,15 +71,21 @@ export function generateNextSteps(category, depth, toolsRun, toolsSkipped, iocCo
         case "OLE2":
         case "OOXML":
             steps.push("Extract specific macro streams: run_tool command='oledump.py -s <stream_num> -v <file>'");
-            steps.push("Decode VBA p-code for stomped macros: run_tool command='pcodedmp <file>'");
+            if (!ran("pcodedmp"))
+                steps.push("Decode VBA p-code for stomped macros: run_tool command='pcodedmp <file>'");
             break;
         case "Shellcode":
-            steps.push("Emulate 32-bit shellcode: run_tool command='speakeasy -t <file> -r -a x86'");
-            steps.push("Emulate 64-bit shellcode: run_tool command='speakeasy -t <file> -r -a amd64'");
+            if (!ran("speakeasy-sc-x86"))
+                steps.push("Emulate 32-bit shellcode: run_tool command='speakeasy -t <file> -r -a x86'");
+            if (!ran("speakeasy-sc-x64"))
+                steps.push("Emulate 64-bit shellcode: run_tool command='speakeasy -t <file> -r -a amd64'");
             break;
         case "DataWithPEExtension":
-            steps.push("Emulate as shellcode: run_tool command='speakeasy -t <file> -r -a x86' (try amd64 if no output)");
-            steps.push("Check for Cobalt Strike beacon: run_tool command='1768.py <file>'");
+            // The step covers both architectures, so it is stale only when both ran.
+            if (!(ran("speakeasy-sc-x86") && ran("speakeasy-sc-x64")))
+                steps.push("Emulate as shellcode: run_tool command='speakeasy -t <file> -r -a x86' (try amd64 if no output)");
+            if (!ran("1768"))
+                steps.push("Check for Cobalt Strike beacon: run_tool command='1768.py <file>'");
             steps.push("Extract encoded content: run_tool command='base64dump.py -n 20 <file>'");
             break;
         case "PCAP":
@@ -77,37 +111,37 @@ export function generateNextSteps(category, depth, toolsRun, toolsSkipped, iocCo
     // NOTE: Cross-tool conditions like "autoit-ripper failed + diec detected AutoIt"
     // are now handled by the advisory framework (see advisories.ts).
     // This keeps generateNextSteps focused on category/depth suggestions.
-    // IOC-based suggestions
+    // Pointers to this run's own results come after the cap on generic suggestions,
+    // so a full generic list cannot evict them.
+    const runSpecific = [];
     if (iocCount > 0) {
-        steps.push("Extracted IOCs are in the 'iocs' field — consider threat intel lookup for network indicators");
+        runSpecific.push("Extracted IOCs are in the 'iocs' field — consider threat intel lookup for network indicators");
     }
-    // Tool-not-installed suggestions
     const notInstalled = toolsSkipped.filter(t => t.skip_type === "not_installed");
     if (notInstalled.length > 0) {
-        steps.push(`${notInstalled.length} tool(s) not installed — run check_tools to see installation status`);
+        runSpecific.push(`${notInstalled.length} tool(s) not installed — run check_tools to see installation status`);
     }
-    // Report-drafting pointer — only when the analysis produced something worth reporting,
-    // so empty triage runs stay quiet. Cap the base steps to 5 FIRST, then append the
-    // pointer, so it can never be truncated away in the very case it's meant to fire
-    // (a busy PE run can otherwise accumulate 6 base steps and evict the pointer).
+    // Report-drafting pointer, only when the analysis produced something worth reporting.
     const hasSubstantiveResults = iocCount > 0 || toolsRun.some(t => t.findings && t.findings.length > 0);
     if (hasSubstantiveResults) {
-        const reportPointer = "Draft a report: get_report_template and get_report_guidance provide a bundled report template and writing " +
-            "guidelines (offline); treat (Optional) section markers as conditional, not literal headings.";
-        return [...steps.slice(0, 5), reportPointer];
+        runSpecific.push("Draft a report: get_report_template and get_report_guidance provide a bundled report template and writing " +
+            "guidelines (offline); treat (Optional) section markers as conditional, not literal headings.");
     }
-    return steps.slice(0, 5); // Limit to 5 most relevant suggestions
+    return [...steps.slice(0, 5), ...runSpecific];
 }
 /** Generate a brief triage summary from analysis results */
-function generateTriageSummary(category, toolsRun, iocCount) {
+export function generateTriageSummary(category, toolsRun, iocCount) {
     const findings = [];
     // Count findings by severity
+    let criticalCount = 0;
     let highCount = 0;
     let mediumCount = 0;
     for (const tool of toolsRun) {
         if (tool.findings) {
             for (const f of tool.findings) {
-                if (f.severity === "high")
+                if (f.severity === "critical")
+                    criticalCount++;
+                else if (f.severity === "high")
                     highCount++;
                 else if (f.severity === "medium")
                     mediumCount++;
@@ -119,19 +153,13 @@ function generateTriageSummary(category, toolsRun, iocCount) {
     const hasMacros = toolsRun.some(t => t.name === "olevba" && t.output && !t.output.includes("No VBA macros found"));
     const hasPackerDetection = toolsRun.some(t => t.name === "diec" && t.output && /packer|protector|crypter/i.test(t.output));
     const hasAnomaly = toolsRun.some(t => (t.name === "portex" || t.name === "pescan") && t.findings && t.findings.length > 0);
-    const hasYaraMatches = toolsRun.some(t => t.name === "yara-rules" && t.output && t.output.trim().length > 0 && !t.output.includes("No matches"));
-    const hasFamilyDetection = toolsRun.some(t => {
-        if (t.name !== "yara-forge" || !t.output)
-            return false;
-        // Check for actual YARA matches: lines that aren't warnings/errors
-        const lines = t.output.trim().split("\n");
-        return lines.some(line => {
-            const trimmed = line.trim();
-            return trimmed.length > 0 &&
-                !trimmed.startsWith("warning:") &&
-                !trimmed.startsWith("error:");
-        });
-    });
+    // Read the rules each YARA parser resolved. Testing the output text instead read
+    // the server's own "(no output)" placeholder as a match on every unmatched scan.
+    const yaraMatched = (name) => toolsRun.some(t => t.name === name && (t.findings?.length ?? 0) > 0);
+    const hasYaraMatches = yaraMatched("yara-rules");
+    const hasFamilyDetection = yaraMatched("yara-forge");
+    // Only a configuration that passed 1768's own sanity check earns the token.
+    const hasCobaltStrikeConfig = toolsRun.some(t => t.name === "1768" && (t.findings ?? []).some(f => f.category === "cobalt-strike-config" && f.severity === "high"));
     // Detect shellcode loader/stub pattern: no imports + W+X section + low entropy
     const hasNoImports = toolsRun.some(t => t.name === "yara-rules" && t.output?.includes("ImportTableIsBad"));
     const hasWriteExecute = toolsRun.some(t => (t.name === "portex" || t.name === "pescan") &&
@@ -140,28 +168,15 @@ function generateTriageSummary(category, toolsRun, iocCount) {
     const isShellcodeLoaderPattern = hasNoImports && hasWriteExecute && hasLowEntropy;
     // Build summary
     findings.push(`File type: ${category}`);
-    // Surface key container/packer detections from ALL tool outputs
-    const allOutput = toolsRun.map(t => t.output || "").join(" ");
-    if (/IExpress|WEXTRACT|Cabinet Self-Extractor/i.test(allOutput)) {
-        findings.push("IExpress SFX");
-    }
-    if (/NSIS|Nullsoft/i.test(allOutput)) {
-        findings.push("NSIS installer");
-    }
-    if (/Inno\s*Setup/i.test(allOutput)) {
-        findings.push("Inno Setup");
-    }
-    if (/PyInstaller/i.test(allOutput)) {
-        findings.push("PyInstaller");
-    }
-    if (/AutoIt|AU3!/i.test(allOutput)) {
-        findings.push("AutoIt compiled");
-    }
-    if (/Themida|VMProtect|Enigma/i.test(allOutput)) {
-        findings.push("protected");
-    }
-    if (/\bUPX\b/i.test(allOutput)) {
-        findings.push("UPX packed");
+    // Container and packer labels come from diec, the tool whose job is identifying
+    // them. Matching every tool's text instead picked up unpackers' own failure
+    // messages ("not packed by UPX") and echoes of the sample's name.
+    const diecDetections = toolsRun
+        .filter(t => t.name === "diec")
+        .flatMap(t => (t.findings ?? []).map(f => f.description));
+    for (const [pattern, label] of CONTAINER_LABELS) {
+        if (diecDetections.some(d => pattern.test(d)))
+            findings.push(label);
     }
     if (isShellcodeLoaderPattern)
         findings.push("⚠️ Shellcode loader pattern (no imports + W+X section + low entropy)");
@@ -173,18 +188,22 @@ function generateTriageSummary(category, toolsRun, iocCount) {
         findings.push("Notable capabilities identified");
     if (hasMacros)
         findings.push("VBA macros present");
+    if (hasCobaltStrikeConfig)
+        findings.push("Cobalt Strike configuration recovered (1768)");
     if (hasFamilyDetection)
         findings.push("YARA family signature matched");
     if (hasYaraMatches)
         findings.push("YARA rules matched");
-    if (highCount > 0)
+    if (criticalCount > 0)
+        findings.push(`${criticalCount} critical-severity finding(s)`);
+    else if (highCount > 0)
         findings.push(`${highCount} high-severity finding(s)`);
     else if (mediumCount > 0)
         findings.push(`${mediumCount} medium-severity finding(s)`);
     if (iocCount > 0)
         findings.push(`${iocCount} IOC(s) extracted`);
-    const toolsSucceeded = toolsRun.length;
-    findings.push(`${toolsSucceeded} tool(s) completed`);
+    // Every tool that returned, including those that failed, so "ran" rather than "completed".
+    findings.push(`${toolsRun.length} tool(s) ran`);
     return findings.join(" | ");
 }
 const DEFAULT_OUTPUT_BUDGET = 40 * 1024; // 40KB default
@@ -286,20 +305,6 @@ export async function handleAnalyzeFile(deps, args) {
             const msg = `Error running file command: ${error instanceof Error ? error.message : "Unknown error"}`;
             return formatError("analyze_file", new REMnuxError(msg, "EMPTY_OUTPUT", "tool_failure", "Check that the file exists and is readable"), startTime);
         }
-        // Compute the file's own hashes so we can filter them from IOC results
-        const ownHashes = new Set();
-        try {
-            const hashResult = await connector.execute(["sh", "-c", `md5sum '${filePath.replace(/'/g, "'\\''")}' && sha1sum '${filePath.replace(/'/g, "'\\''")}' && sha256sum '${filePath.replace(/'/g, "'\\''")}'`], { timeout: 30000 });
-            if (hashResult.exitCode === 0) {
-                for (const line of hashResult.stdout.split("\n")) {
-                    const hash = line.trim().split(/\s+/)[0];
-                    if (hash && /^[a-fA-F0-9]{32,128}$/.test(hash)) {
-                        ownHashes.add(hash.toLowerCase());
-                    }
-                }
-            }
-        }
-        catch { /* best effort — if hashing fails, we just skip filtering */ }
         // Step 2: Match to category and get tools from registry by tag + depth
         const category = matchFileType(fileOutput, normalizedFile);
         const tag = CATEGORY_TAG_MAP[category.name] ?? "fallback";
@@ -419,8 +424,9 @@ export async function handleAnalyzeFile(deps, args) {
                     continue;
                 }
                 // Detect missing tools — only match shell "command not found" or exit code 127,
-                // not tool output that happens to contain "not found" (e.g., pescan "section not found")
-                const isNotInstalled = result.exitCode === 127 ||
+                // not tool output that happens to contain "not found" (e.g., pescan "section not found").
+                // A tool whose exit code carries a result can exit 127 by chance, so ask its definition.
+                const isNotInstalled = (result.exitCode === 127 && exitCodeIsFailure(tool.name, 127)) ||
                     /command not found/i.test(stderr) ||
                     (result.exitCode !== 0 && /^.*: No such file or directory$/m.test(stderr) && stderr.includes(tool.command));
                 if (isNotInstalled) {
@@ -448,8 +454,7 @@ export async function handleAnalyzeFile(deps, args) {
                 let savedOutputFile;
                 if (outputTruncated) {
                     // Save full output to output dir for later retrieval (if under size limit)
-                    const safeFile = args.file.replace(/[^a-zA-Z0-9._-]/g, "_");
-                    const outFilename = `${tool.name}-${safeFile}.txt`;
+                    const outFilename = spillFilename(tool.name, args.file);
                     // Non-fatal: on any failure the truncation hint simply carries no file reference
                     const spill = await saveOversizedOutput(connector, config.outputDir, outFilename, output);
                     if (spill.saved)
@@ -472,7 +477,17 @@ export async function handleAnalyzeFile(deps, args) {
                     output = output.slice(0, budget) + truncationMsg;
                 }
                 totalOutputSize += output.length;
-                const parsed = parseToolOutput(tool.name, output);
+                // Parse the tool's complete output, never the display copy: the cut loses every
+                // finding past the budget, and cut JSON (capa -j) does not parse at all.
+                const parsed = parseToolOutput(tool.name, result.stdout || stderr, { targetPath: analysisPath, stderr });
+                // A YARA match list is the run's attribution evidence and too small to reach
+                // the truncation spill, so save it explicitly: summary mode shows only key lines.
+                if (!savedOutputFile && YARA_TOOLS.has(tool.name) && parsed.findings.length > 0) {
+                    const outFilename = spillFilename(tool.name, args.file);
+                    const spill = await saveOversizedOutput(connector, config.outputDir, outFilename, fullOutput);
+                    if (spill.saved)
+                        savedOutputFile = outFilename;
+                }
                 // Check for tool-specific exit code hints
                 const extraMetadata = {};
                 const hint = tool.exitCodeHints?.[result.exitCode];
@@ -510,6 +525,10 @@ export async function handleAnalyzeFile(deps, args) {
                     output,
                     exit_code: result.exitCode,
                     ...(outputTruncated && { truncated: true, full_output_length: fullLen }),
+                    ...(savedOutputFile && { saved_output_file: savedOutputFile }),
+                    // Only at exit 0: a tool that exited non-zero refused the file, which is not a parser failure.
+                    ...(parsed.metadata?.parse_error === true && result.exitCode === 0 && { parse_failed: true }),
+                    ...(parsed.metadata?.tool_reported_error === true && { tool_reported_error: true }),
                     ...(parsed.parsed && {
                         findings: parsed.findings,
                         metadata: { ...parsed.metadata, ...extraMetadata },
@@ -529,9 +548,13 @@ export async function handleAnalyzeFile(deps, args) {
         }
         const combinedOutput = iocScanOutputs.join("\n\n")
             .replace(/^\s*"command":\s*".*"$/gm, "");
-        // The file's own hashes are excluded during extraction rather than after it, so an excluded
-        // hash cannot take a slot under the per-type cap and hide a real indicator behind it.
-        const iocResult = extractIOCs(combinedOutput, ownHashes.size > 0 ? { exclude: ownHashes } : undefined);
+        // A hash-shaped value in tool output is almost always one a tool computed (a section hash, the
+        // imphash, the file's ssdeep, a decoder's per-chunk MD5), not an indicator found in the sample.
+        // Those hashes stay visible in each tool's output, and extract_iocs still reports hashes in text.
+        // This also covers the file's own hashes.
+        const iocResult = extractIOCs(combinedOutput, {
+            excludeTypes: new Set(["md5", "sha1", "sha256", "sha512", "ssdeep"]),
+        });
         // Generate triage summary and next steps
         const triageSummary = generateTriageSummary(category.name, toolsRun, iocResult.iocs.length);
         const suggestedNextSteps = generateNextSteps(category.name, depth, toolsRun, toolsSkipped, iocResult.iocs.length);
@@ -549,6 +572,7 @@ export async function handleAnalyzeFile(deps, args) {
                 name: t.name,
                 exit_code: t.exit_code,
                 output: fullOutputs[i] ?? t.output,
+                ...(t.findings && { findings: t.findings }),
             })),
             toolsFailed: toolsFailed.map((t) => ({
                 name: t.name,
@@ -574,6 +598,12 @@ export async function handleAnalyzeFile(deps, args) {
             "explainable as normal development practices? " +
             "(3) What concrete evidence distinguishes this from a benign program? " +
             "State your confidence level (low/medium/high) and what evidence supports or contradicts a malicious verdict. " +
+            "TOOL STATUS (summary mode): 'clean' means the tool's parser read its output and found nothing " +
+            "notable. A benign verdict needs other evidence. 'not_assessed' means no parser reads that tool's output, " +
+            "so the server did not interpret it. Its key_lines are raw excerpts. 'error' without either flag " +
+            "below means the tool exited non-zero. 'error' with parse_failed " +
+            "means the parser could not read the output. 'error' with tool_reported_error means the tool " +
+            "exited 0 but reported a failure of its own. " +
             "ATTRIBUTION AND CLASSIFICATION: " +
             "YARA family signatures (yara-forge) indicate resemblance to known families, not confirmed identity — " +
             "signatures can match shared code, libraries, or techniques reused across unrelated families. " +