rea-agents 1.2.0 → 1.4.0

package/dist/hopper/BridgeLauncher.js

@@ -30,10 +30,13 @@ export class HopperApplicationLauncher {
     }
     async launch(session, options = {}) {
         const bootstrapPath = `${session.directory}/bootstrap.py`;
+        const ownsProcessLifetime = usesLinuxDemo(this.options);
         const source = [
             `REA_SOCKET = ${JSON.stringify(session.socketPath)}`,
             `REA_TOKEN = ${JSON.stringify(session.token)}`,
             `REA_RUN_ID = ${JSON.stringify(session.runId)}`,
+            `REA_TARGET_PATH = ${JSON.stringify(this.options.targetPath)}`,
+            `REA_OWNS_PROCESS_LIFETIME = ${ownsProcessLifetime ? "True" : "False"}`,
             `exec(compile(open(${JSON.stringify(this.options.bridgeScriptPath)}, 'rb').read(), ${JSON.stringify(this.options.bridgeScriptPath)}, 'exec'))`,
             "",
         ].join("\n");
@@ -59,25 +62,12 @@ export class HopperApplicationLauncher {
             const prepared = await prepareHopperApplication(this.options.launcherPath, options.signal);
             if (!prepared)
                 return err(new HopperCancelledError());
-            const child = spawn(this.options.launcherPath, args, {
-                stdio: ["ignore", "ignore", "pipe"],
-                detached: process.platform !== "win32",
-                env: { ...process.env, REA_PROCESS_RUN_ID: session.runId },
-            });
-            const started = await new Promise((resolve) => {
-                const onSpawn = () => {
-                    child.off("error", onError);
-                    resolve(ok(undefined));
-                };
-                const onError = (cause) => {
-                    child.off("spawn", onSpawn);
-                    resolve(err(new HopperStartError({ cause })));
-                };
-                child.once("spawn", onSpawn);
-                child.once("error", onError);
-            });
+            const linuxDemo = linuxDemoLaunch(this.options, session, args);
+            const ownershipCommand = linuxDemo?.ownershipCommand ?? this.options.launcherPath;
+            const started = await spawnLauncher(linuxDemo?.command ?? this.options.launcherPath, linuxDemo?.args ?? args, session.runId);
             if (!started.ok)
                 return started;
+            const child = started.value;
             const pid = child.pid;
             if (pid === undefined)
                 return err(new HopperStartError({ cause: new Error("missing launcher PID") }));
@@ -87,20 +77,21 @@ export class HopperApplicationLauncher {
                 pid,
                 process_group_id: pid,
                 parent_pid: process.pid,
-                launcher: this.options.launcherPath,
+                launcher: linuxDemo?.command ?? this.options.launcherPath,
                 created_at: new Date().toISOString(),
             };
             try {
                 await writeFileAtomic(join(session.directory, "ownership.json"), `${JSON.stringify(ownership)}\n`, { encoding: "utf8", mode: 0o600 });
             }
             catch (cause) {
-                await cleanupOwnedProcessGroup(ownedProcessGroup(session, pid, this.options.launcherPath));
+                await cleanupOwnedProcessGroup(ownedProcessGroup(session, pid, ownershipCommand));
                 return err(new HopperStartError({ cause }));
             }
             return ok({
                 process: child,
                 ownsProcessLifetime: true,
-                cleanup: () => cleanupOwnedProcessGroup(ownedProcessGroup(session, pid, this.options.launcherPath)),
+                shutdownByCleanup: ownsProcessLifetime,
+                cleanup: () => cleanupOwnedProcessGroup(ownedProcessGroup(session, pid, ownershipCommand)),
             });
         }
         catch (cause) {
@@ -108,6 +99,46 @@ export class HopperApplicationLauncher {
         }
     }
 }
+const linuxDemoLaunch = (options, session, hopperArgs) => {
+    if (!usesLinuxDemo(options) || options.demoHelperPath === undefined)
+        return undefined;
+    return {
+        command: "/usr/bin/python3",
+        ownershipCommand: "/usr/bin/python3",
+        args: [
+            options.demoHelperPath,
+            "--hopper",
+            options.launcherPath,
+            "--socket",
+            session.socketPath,
+            "--",
+            options.launcherPath,
+            ...hopperArgs,
+        ],
+    };
+};
+const usesLinuxDemo = (options) => process.platform === "linux" &&
+    basename(options.launcherPath) === "Hopper" &&
+    options.demoHelperPath !== undefined;
+const spawnLauncher = async (command, args, runId) => {
+    const child = spawn(command, args, {
+        stdio: ["ignore", "ignore", "pipe"],
+        detached: process.platform !== "win32",
+        env: { ...process.env, REA_PROCESS_RUN_ID: runId },
+    });
+    return new Promise((resolve) => {
+        const onSpawn = () => {
+            child.off("error", onError);
+            resolve(ok(child));
+        };
+        const onError = (cause) => {
+            child.off("spawn", onSpawn);
+            resolve(err(new HopperStartError({ cause })));
+        };
+        child.once("spawn", onSpawn);
+        child.once("error", onError);
+    });
+};
 const ownedProcessGroup = (session, pid, launcherPath) => ({
     runId: session.runId,
     leaderPid: pid,

package/dist/hopper/HopperClient.js

@@ -3,11 +3,12 @@ import { access, mkdtemp, rm } from "node:fs/promises";
 import { createConnection } from "node:net";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { HopperCancelledError, HopperProcessError, HopperProtocolError, HopperStartError, HopperTimeoutError, } from "../domain/errors.js";
+import { HopperCancelledError, HopperProcessError, HopperProtocolError, HopperStartError, hopperStartupFailure, HopperTimeoutError, } from "../domain/errors.js";
 import { err, ok } from "../domain/result.js";
 import { silentLogger } from "../logger.js";
 import { parseResponseLine, responseResult } from "./protocol.js";
 const MAX_LINE_BYTES = 10 * 1024 * 1024;
+const SHUTDOWN_TIMEOUT_MS = 30_000;
 const SESSION_ROOT = process.platform === "darwin" ? "/tmp" : tmpdir();
 /**
  * Owns one authenticated NDJSON-over-Unix-socket bridge session.
@@ -28,6 +29,7 @@ export class HopperClient {
     #nextId = 1;
     #buffer = "";
     #closing = false;
+    #launcherExitCode;
     #startPromise;
     #closePromise;
     constructor(options) {
@@ -57,6 +59,7 @@ export class HopperClient {
         }
         const socketPath = join(this.#directory, "bridge.sock");
         this.#token = randomBytes(32).toString("hex");
+        this.#launcherExitCode = undefined;
         const runId = randomUUID();
         const launched = await this.#options.launcher.launch({
             directory: this.#directory,
@@ -104,14 +107,30 @@ export class HopperClient {
         this.#closing = true;
         try {
             const socket = this.#socket;
+            let cleanupAttempted = false;
             if (socket !== undefined && !socket.destroyed) {
-                await this.#request("shutdown", {}, { timeoutMs: 500 }).catch(() => err(new HopperProcessError(null)));
+                const shutdown = await this.#request("shutdown", {}, { timeoutMs: SHUTDOWN_TIMEOUT_MS }).catch(() => err(new HopperProcessError(null)));
+                if (shutdown.ok &&
+                    isCleanupRequired(shutdown.value) &&
+                    this.#launch?.shutdownByCleanup === true &&
+                    this.#launch.cleanup !== undefined) {
+                    cleanupAttempted = true;
+                    const cleanup = await this.#launch.cleanup();
+                    if (!cleanup.cleaned) {
+                        await this.#fallbackDocumentShutdown();
+                        const retried = await this.#launch.cleanup();
+                        if (!retried.cleaned)
+                            this.#logger.warn({ reason: retried.reason }, "Owned launcher cleanup failed closed");
+                    }
+                }
+                else if (!shutdown.ok || !isShutdownAcknowledgement(shutdown.value))
+                    this.#logger.warn({ status: shutdown.ok ? "invalid-acknowledgement" : "failed" }, "Hopper document shutdown was not confirmed");
             }
             this.#failAll(new HopperProcessError(null));
             socket?.destroy();
             this.#socket = undefined;
             if (this.#launch?.ownsProcessLifetime === true) {
-                if (this.#launch.cleanup !== undefined) {
+                if (this.#launch.cleanup !== undefined && !cleanupAttempted) {
                     const cleanup = await this.#launch.cleanup();
                     if (!cleanup.cleaned)
                         this.#logger.warn({ reason: cleanup.reason }, "Owned launcher cleanup failed closed");
@@ -132,6 +151,11 @@ export class HopperClient {
             this.#closePromise = undefined;
         }
     }
+    async #fallbackDocumentShutdown() {
+        const fallback = await this.#request("shutdown_document", {}, { timeoutMs: SHUTDOWN_TIMEOUT_MS }).catch(() => err(new HopperProcessError(null)));
+        if (!fallback.ok || !isShutdownAcknowledgement(fallback.value))
+            this.#logger.warn({ status: fallback.ok ? "invalid-acknowledgement" : "failed" }, "Hopper document shutdown fallback was not confirmed");
+    }
     async #connect(socketPath, signal) {
         const deadline = Date.now() + this.#options.startupTimeoutMs;
         while (Date.now() < deadline) {
@@ -139,6 +163,9 @@ export class HopperClient {
                 return err(new HopperCancelledError());
             if (this.#closing)
                 return err(new HopperProcessError(null));
+            if (this.#launcherExitCode !== undefined &&
+                hopperStartupFailure(this.#launcherExitCode) !== undefined)
+                return err(new HopperProcessError(this.#launcherExitCode));
             try {
                 await access(socketPath);
             }
@@ -222,6 +249,7 @@ export class HopperClient {
             });
         });
         launch.process.on("exit", (code) => {
+            this.#launcherExitCode = code;
             this.#options.onDiagnostic?.({ type: "launcher-exit", code });
             if (launch.ownsProcessLifetime && !this.#closing) {
                 this.#failAll(new HopperProcessError(code));
@@ -310,6 +338,20 @@ const connectOnce = async (socketPath) => new Promise((resolve) => {
         resolve(err(new HopperStartError({ cause })));
     });
 });
+const isShutdownAcknowledgement = (value) => {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return false;
+    if (value.shutdown !== true)
+        return false;
+    if (value.analysis_stopped === true && value.document_closed === true)
+        return true;
+    return false;
+};
+const isCleanupRequired = (value) => typeof value === "object" &&
+    value !== null &&
+    !Array.isArray(value) &&
+    value.shutdown === true &&
+    value.cleanup_required === true;
 const parseServerInfo = (value, expectedRunId) => {
     if (typeof value === "object" &&
         value !== null &&

package/dist/hopper/HopperProvider.js

@@ -78,6 +78,7 @@ export class HopperProvider {
                     ? this.config.hopperLoaderArgs
                     : target.loaderArgs,
                 bridgeScriptPath: fileURLToPath(new URL("../../bridge/hopper_bridge.py", import.meta.url)),
+                demoHelperPath: fileURLToPath(new URL("../../scripts/hopper-demo-x11.py", import.meta.url)),
             }),
             logger: this.logger.child({ layer: "bridge" }),
         });

package/dist/identity.js

@@ -5,12 +5,19 @@
  */
 export const PRODUCT_IDENTITY = {
     displayName: "REA",
-    packageName: "rea-agents",
-    packageVersion: "1.1.0",
+    packageName: PACKAGE_METADATA.name,
+    packageVersion: PACKAGE_METADATA.version,
     cliBinary: "rea",
     mcpCommand: "npx -y rea-agents mcp",
     mcpServerKey: "rea",
     skillName: "rea-analysis",
-    skillVersion: "10",
+    skillVersion: PACKAGE_METADATA.skillVersion,
     configFileName: "rea.json",
 };
+/** Exact SDK package identities, distinct from negotiated protocol version. */
+export const SDK_IDENTITY = {
+    server: PACKAGE_METADATA.serverSdkVersion,
+    client_test: PACKAGE_METADATA.clientSdkVersion,
+    core: PACKAGE_METADATA.coreSdkVersion,
+};
+import { PACKAGE_METADATA } from "./generatedPackageMetadata.js";

package/dist/logger.js

@@ -5,7 +5,7 @@ const logLevelSchema = z
     .default("info");
 /** Parse the optional REA_LOG_LEVEL environment variable. */
 export const parseLogLevel = (value) => logLevelSchema.parse(value);
-/** Create a JSON logger whose destination cannot corrupt MCP stdout frames. */
+/** Create a JSON logger on stderr so protocol and CLI result stdout stay valid. */
 export const createLogger = (mode, level) => pino({
     level,
     base: { application: "rea", mode },
@@ -22,6 +22,6 @@ export const createLogger = (mode, level) => pino({
         ],
         censor: "[Redacted]",
     },
-}, pino.destination({ dest: mode === "mcp" ? 2 : 1, sync: false }));
+}, pino.destination({ dest: 2, sync: false }));
 /** Logger used by embedders that have not opted into process output. */
 export const silentLogger = pino({ level: "silent" });

package/dist/main.js

@@ -6,19 +6,49 @@ import { parseConfig } from "./config.js";
 import { createBinarySession } from "./application/runtime.js";
 import { createServer } from "./server/createServer.js";
 import { createLogger } from "./logger.js";
+import { projectAnalysisError } from "./domain/errors.js";
+import { readProjectPermissionStore } from "./application/ProjectPermissionStore.js";
+import { loadConfiguredPermissionAuthority } from "./application/PermissionConfiguration.js";
+const MCP_CONNECTION_LOST = "REA lost its MCP client connection. Restart REA from your MCP client.";
+const MCP_CONNECTION_START_FAILED = "REA could not start its MCP connection. Restart REA from your MCP client; run `rea doctor` if it fails again.";
+const MCP_SHUTDOWN_FAILED = "REA could not close cleanly. End the REA process before starting it again.";
+const SERVER_START_FAILED = "REA could not start. Run `rea doctor`, then restart REA from your MCP client.";
+const runtimeDependencies = () => ({
+    env: process.env,
+    serve: serveStdio,
+    writeStderr: (text) => process.stderr.write(text),
+    setExitCode: (code) => {
+        process.exitCode = code;
+    },
+    registerShutdown: (handler) => {
+        process.once("SIGINT", handler);
+        process.once("SIGTERM", handler);
+        process.stdin.once("end", handler);
+        process.stdin.once("close", handler);
+    },
+    registerReload: (handler) => {
+        process.on("SIGHUP", handler);
+        return () => process.off("SIGHUP", handler);
+    },
+});
 /**
  * Start the long-lived MCP adapter and install idempotent shutdown handlers.
  * The adapter owns its BinarySession for the process lifetime; EOF and process
  * signals close bridge resources without assuming ownership of the Hopper app.
  */
-export const run = async () => {
-    const config = parseConfig(process.env);
+export const run = async (dependencies = runtimeDependencies()) => {
+    const config = parseConfig(dependencies.env);
     if (!config.ok) {
-        process.stderr.write(`${config.error._tag}: ${config.error.message}\n`);
+        dependencies.writeStderr(`${projectAnalysisError(config.error).message}\n`);
         return 1;
     }
     const logger = createLogger("mcp", config.value.logLevel);
     const serverLogger = logger.child({ layer: "server" });
+    const permissionAuthority = await loadConfiguredPermissionAuthority(config.value);
+    if (!permissionAuthority.ok) {
+        dependencies.writeStderr(`${projectAnalysisError(permissionAuthority.error).message}\n`);
+        return 1;
+    }
     const session = createBinarySession(config.value, logger);
     if (config.value.hopperTargetPath !== undefined) {
         const opened = await session.open(config.value.hopperTargetPath, {
@@ -27,59 +57,140 @@ export const run = async () => {
         if (!opened.ok) {
             await session.close();
             serverLogger.error({ errorTag: opened.error._tag }, "Initial target failed to open");
-            process.stderr.write(`${opened.error._tag}: ${opened.error.message}\n`);
+            dependencies.writeStderr(`${projectAnalysisError(opened.error).message}\n`);
             return 1;
         }
     }
+    let currentConfig = config.value;
+    const runtimeProcessPolicy = {
+        ...config.value.processExecutionPolicy,
+        executableRoots: [...config.value.processExecutionPolicy.executableRoots],
+        workingRoots: [...config.value.processExecutionPolicy.workingRoots],
+        allowedEnvironment: [
+            ...config.value.processExecutionPolicy.allowedEnvironment,
+        ],
+    };
+    const runtimeEvidencePolicy = {
+        ...config.value.evidenceFilePolicy,
+        roots: [...config.value.evidenceFilePolicy.roots],
+    };
+    const runtimeSnapshotPolicy = {
+        ...config.value.analysisSnapshotFilePolicy,
+        roots: [...config.value.analysisSnapshotFilePolicy.roots],
+    };
+    const runtimeInvestigationRoots = [...config.value.investigationInputRoots];
+    const liveServers = new Set();
     let handle;
     try {
-        handle = serveStdio(() => createServer(session, session, {
-            logger,
-            processPolicy: config.value.processExecutionPolicy,
-            evidenceFilePolicy: config.value.evidenceFilePolicy,
-        }), {
+        handle = dependencies.serve(() => {
+            const server = createServer(session, session, {
+                logger,
+                processPolicy: runtimeProcessPolicy,
+                evidenceFilePolicy: runtimeEvidencePolicy,
+                investigationInputRoots: runtimeInvestigationRoots,
+                analysisSnapshotFilePolicy: runtimeSnapshotPolicy,
+                permissionAuthority: permissionAuthority.value,
+                artifactIntegrityContinueEnabled: () => currentConfig.artifactIntegrityContinueEnabled,
+                availabilityPolicy: () => ({
+                    processCaptureEnabled: currentConfig.processExecutionPolicy.enabled,
+                    evidenceFileRoots: currentConfig.evidenceFilePolicy.roots.length,
+                }),
+            });
+            liveServers.add(server);
+            return server;
+        }, {
             onerror: () => {
-                serverLogger.error("MCP stdio transport error");
-                process.stderr.write("MCP stdio transport error\n");
+                serverLogger.error(MCP_CONNECTION_LOST);
+                dependencies.writeStderr(`${MCP_CONNECTION_LOST}\n`);
             },
         });
     }
     catch {
         await session.close();
-        serverLogger.error("Failed to start MCP stdio transport");
-        process.stderr.write("Failed to start MCP stdio transport\n");
+        serverLogger.error(MCP_CONNECTION_START_FAILED);
+        dependencies.writeStderr(`${MCP_CONNECTION_START_FAILED}\n`);
         return 1;
     }
+    const unregisterReload = dependencies.registerReload?.(() => {
+        void (async () => {
+            const refreshed = parseConfig(dependencies.env);
+            if (!refreshed.ok) {
+                serverLogger.error("Reloaded permission policy is invalid");
+                return;
+            }
+            const reloaded = await permissionAuthority.value.reload(refreshed.value.permissionCeilings);
+            if (!reloaded.ok) {
+                serverLogger.error("Reloaded permission ceiling could not be applied");
+                return;
+            }
+            const administrators = await permissionAuthority.value.replaceAdministratorGrants(refreshed.value.administratorPermissionGrants);
+            if (!administrators.ok) {
+                serverLogger.error("Reloaded administrator grants could not be applied");
+                return;
+            }
+            if (refreshed.value.permissionProjectRoot !== undefined &&
+                refreshed.value.permissionProjectStore !== undefined) {
+                const project = await readProjectPermissionStore(refreshed.value.permissionProjectStore, refreshed.value.permissionProjectRoot);
+                if (!project.ok) {
+                    serverLogger.error("Reloaded project grants could not be read");
+                    return;
+                }
+                const projects = await permissionAuthority.value.replaceProjectGrants(project.value?.grants ?? []);
+                if (!projects.ok) {
+                    serverLogger.error("Reloaded project grants could not be applied");
+                    return;
+                }
+            }
+            else {
+                const projects = await permissionAuthority.value.replaceProjectGrants([]);
+                if (!projects.ok) {
+                    serverLogger.error("Reloaded project grants could not be cleared");
+                    return;
+                }
+            }
+            currentConfig = refreshed.value;
+            Object.assign(runtimeProcessPolicy, refreshed.value.processExecutionPolicy);
+            Object.assign(runtimeEvidencePolicy, refreshed.value.evidenceFilePolicy);
+            Object.assign(runtimeSnapshotPolicy, refreshed.value.analysisSnapshotFilePolicy);
+            runtimeInvestigationRoots.splice(0, runtimeInvestigationRoots.length, ...refreshed.value.investigationInputRoots);
+            for (const server of liveServers)
+                server.sendToolListChanged();
+        })();
+    }) ?? (() => undefined);
     let shutdownPromise;
     const shutdown = () => {
         shutdownPromise ??= (async () => {
+            unregisterReload();
             await handle.close();
             await session.close();
+            permissionAuthority.value.clearSessionGrants();
         })();
         return shutdownPromise;
     };
     const requestShutdown = () => {
         shutdown().catch(() => {
-            process.exitCode = 1;
-            serverLogger.error("Failed to shut down cleanly");
-            process.stderr.write("Failed to shut down cleanly\n");
+            dependencies.setExitCode(1);
+            serverLogger.error(MCP_SHUTDOWN_FAILED);
+            dependencies.writeStderr(`${MCP_SHUTDOWN_FAILED}\n`);
         });
     };
-    process.once("SIGINT", requestShutdown);
-    process.once("SIGTERM", requestShutdown);
-    process.stdin.once("end", requestShutdown);
-    process.stdin.once("close", requestShutdown);
+    dependencies.registerShutdown(requestShutdown);
     return 0;
 };
+/** Run the executable boundary without exposing an unexpected startup cause. */
+export const runEntrypoint = async (start = () => run(), writeStderr = (text) => process.stderr.write(text), setExitCode = (code) => {
+    process.exitCode = code;
+}) => {
+    try {
+        setExitCode(await start());
+    }
+    catch {
+        writeStderr(`${SERVER_START_FAILED}\n`);
+        setExitCode(1);
+    }
+};
 const entryPath = process.argv[1];
 if (entryPath !== undefined &&
     pathToFileURL(realpathSync(entryPath)).href === import.meta.url) {
-    run()
-        .then((exitCode) => {
-        process.exitCode = exitCode;
-    })
-        .catch(() => {
-        process.stderr.write("Unexpected server startup failure\n");
-        process.exitCode = 1;
-    });
+    void runEntrypoint();
 }

package/dist/server/createServer.js

@@ -6,24 +6,64 @@ import { registerSessionTools } from "./registerSessionTools.js";
 import { registerNativeTools } from "./registerNativeTools.js";
 import { registerArtifactTools } from "./registerArtifactTools.js";
 import { silentLogger } from "../logger.js";
+import { registerGuidedPrompts } from "./registerPrompts.js";
+import { registerEvidenceResources } from "./registerEvidenceResources.js";
+import { createServerIdentity } from "../serverIdentity.js";
 /**
  * Construct one MCP server without acquiring subprocess resources.
  * Supplying a session adds target lifecycle tools; omitting it retains the
  * fixed-target seam used by focused tests and embedders.
  */
 export const createServer = (analysis, session, options = {}) => {
+    const startedAt = new Date().toISOString();
     const logger = options.logger ?? silentLogger;
-    const server = new McpServer({ name: PRODUCT_IDENTITY.mcpServerKey, version: "0.1.0" }, {
-        capabilities: { tools: {} },
+    const server = new McpServer({
+        name: PRODUCT_IDENTITY.mcpServerKey,
+        version: PRODUCT_IDENTITY.packageVersion,
+    }, {
+        capabilities: {
+            tools: { listChanged: true },
+            resources: { listChanged: true },
+        },
         instructions: session === undefined
             ? "Reverse-engineering tools for an active analysis target. Start with binary_overview."
             : "Reverse-engineering tools for configured analysis providers. Open a target with open_binary, then start with binary_overview.",
     });
+    session?.onAvailabilityChanged?.(() => server.sendToolListChanged());
+    server.registerResource("server-identity", "rea://server/identity", {
+        title: "REA server identity",
+        description: "Live package, SDK, protocol, and catalog identity.",
+        mimeType: "application/json",
+    }, (uri) => {
+        const client = server.server.getClientVersion();
+        return {
+            contents: [
+                {
+                    uri: uri.href,
+                    mimeType: "application/json",
+                    text: JSON.stringify(createServerIdentity({
+                        startedAt,
+                        ...(client === undefined ? {} : { client }),
+                        ...(server.server.getNegotiatedProtocolVersion() === undefined
+                            ? {}
+                            : {
+                                protocolVersion: server.server.getNegotiatedProtocolVersion(),
+                            }),
+                    }), null, 2),
+                },
+            ],
+        };
+    });
     const toolLogger = logger.child({ layer: "server" });
     const activeTarget = session === undefined ? undefined : () => session.activeTarget();
     const recordEvidence = session === undefined
         ? undefined
-        : (evidence) => session.recordEvidence(evidence);
+        : (evidence) => {
+            const recorded = session.recordEvidence(evidence);
+            if (recorded.ok && recorded.value === "added")
+                server.sendResourceListChanged();
+            return recorded;
+        };
     registerOfficialTools(server, analysis, {
         logger: toolLogger,
         activeTarget,
@@ -49,8 +89,17 @@ export const createServer = (analysis, session, options = {}) => {
         logger: toolLogger,
         activeTarget,
         recordEvidence,
+        ...(options.permissionAuthority === undefined
+            ? {}
+            : { permissionAuthority: options.permissionAuthority }),
     });
-    if (session !== undefined)
-        registerSessionTools(server, session, toolLogger, options);
+    registerGuidedPrompts(server, analysis, session);
+    if (session !== undefined) {
+        registerEvidenceResources(server, session);
+        registerSessionTools(server, session, toolLogger, {
+            ...options,
+            startedAt,
+        });
+    }
     return server;
 };

package/dist/server/mcpProgress.js

@@ -0,0 +1,23 @@
+import { createProgressReporter, silentProgressReporter, } from "../application/ProgressReporter.js";
+/** Adapt the request's negotiated MCP progress token to application progress. */
+export const mcpProgressReporter = (context) => {
+    const token = context.mcpReq._meta?.progressToken;
+    if (token === undefined)
+        return silentProgressReporter;
+    return createProgressReporter(async (update) => {
+        try {
+            await context.mcpReq.notify({
+                method: "notifications/progress",
+                params: {
+                    progressToken: token,
+                    progress: update.completed,
+                    ...(update.total === null ? {} : { total: update.total }),
+                    message: `${update.phase}: ${update.message}`,
+                },
+            });
+        }
+        catch {
+            // Progress is observational; transport failure cannot change tool truth.
+        }
+    }, { minimumIntervalMs: 100 });
+};