rea-agents 1.7.0 → 2.1.0

package/dist/server/registerApplicationTools/compareVersions.js

@@ -0,0 +1,34 @@
+import { compareApplicationVersionsEvidenceValidated } from "../../application/JavaScriptApplicationWorkflowService.js";
+import { APPLICATION_TOOL_CONTRACTS } from "../../contracts/applicationToolContracts.js";
+import { compareApplicationVersionsInputSchema } from "../../domain/javascriptApplicationVersionComparisonSchemas.js";
+import { applicationVersionComparisonResultSchema } from "../../domain/javascriptApplicationVersionComparisonSchemas.js";
+import { logToolExecution } from "../toolLogging.js";
+import { toCallToolResult } from "../toolResult.js";
+import { toolRegistrationOptions } from "../toolRegistrationOptions.js";
+import { safeParseToolInput } from "../toolInputValidation.js";
+import { recordResult, recordSources } from "./helpers.js";
+const compareContract = APPLICATION_TOOL_CONTRACTS[1];
+/** Register the provider-neutral JavaScript version comparison tool. */
+export const registerCompareApplicationVersionsTool = (server, options) => {
+    server.registerTool(compareContract.name, toolRegistrationOptions(compareContract), async (input) => {
+        const parsedInput = safeParseToolInput(compareApplicationVersionsInputSchema, input, compareContract.name);
+        if (!parsedInput.ok)
+            return toCallToolResult(parsedInput, compareContract);
+        const parsed = parsedInput.value;
+        const result = await logToolExecution(options.logger, compareContract.name, () => Promise.resolve(compareApplicationVersionsEvidenceValidated(parsed)));
+        if (!result.ok)
+            return toCallToolResult(result, compareContract);
+        const sources = [
+            parsed.left,
+            parsed.right,
+            ...parsed.left_native_observations,
+            ...parsed.right_native_observations,
+        ];
+        const recorded = recordSources(options.recordEvidence, sources);
+        if (!recorded.ok)
+            return toCallToolResult(recorded, compareContract);
+        const comparison = applicationVersionComparisonResultSchema.parse(result.value.normalized_result);
+        const unknown = comparison.summary.unknown > 0;
+        return recordResult(options, compareContract, result.value, parsed.unknown_registry_approved === true && unknown);
+    });
+};

package/dist/server/registerApplicationTools/controlledReplay.js

@@ -0,0 +1,38 @@
+import { runControlledReplayValidated } from "../../application/JavaScriptReplayService.js";
+import { APPLICATION_TOOL_CONTRACTS } from "../../contracts/applicationToolContracts.js";
+import { controlledReplayInputSchema, controlledReplayOutputSchema, } from "../../domain/javascriptReplay.js";
+import { parseEvidence } from "../../domain/evidence.js";
+import { logToolExecution } from "../toolLogging.js";
+import { toCallToolResult } from "../toolResult.js";
+import { toolRegistrationOptions } from "../toolRegistrationOptions.js";
+import { safeParseToolInput } from "../toolInputValidation.js";
+import { mcpProgressReporter } from "../mcpProgress.js";
+import { recordSources } from "./helpers.js";
+const replayContract = APPLICATION_TOOL_CONTRACTS[2];
+/** Register the controlled JavaScript replay tool. */
+export const registerControlledReplayTool = (server, options) => {
+    server.registerTool(replayContract.name, toolRegistrationOptions(replayContract), async (input, context) => {
+        const parsedInput = safeParseToolInput(controlledReplayInputSchema, input, replayContract.name);
+        if (!parsedInput.ok)
+            return toCallToolResult(parsedInput, replayContract);
+        const parsed = parsedInput.value;
+        const result = await logToolExecution(options.logger, replayContract.name, () => runControlledReplayValidated(options.replay, parsed, {
+            signal: context.mcpReq.signal,
+            progress: mcpProgressReporter(context),
+        }));
+        if (!result.ok)
+            return toCallToolResult(result, replayContract);
+        const output = controlledReplayOutputSchema.parse(result.value);
+        if (output.evidence !== null) {
+            const sourcesRecorded = recordSources(options.recordEvidence, output.source_evidence.map((item) => parseEvidence(item)));
+            if (!sourcesRecorded.ok)
+                return toCallToolResult(sourcesRecorded, replayContract);
+            const recorded = options.recordEvidence?.(parseEvidence(output.evidence));
+            if (recorded !== undefined && !recorded.ok)
+                return toCallToolResult(recorded, replayContract);
+        }
+        return toCallToolResult(result, replayContract, {
+            evidenceResourcesAvailable: output.evidence !== null && options.recordEvidence !== undefined,
+        });
+    });
+};

package/dist/server/registerApplicationTools/coverage.js

@@ -0,0 +1,84 @@
+import { commitReconstructionCoverage, queryReconstructionCoverage, } from "../../application/ReconstructionCoverageService.js";
+import { readReconstructionCoverageWorkspace } from "../../application/ReconstructionCoverageWorkspaceStore.js";
+import { authorizeFileReadWithDeferredWrite, authorizeRootPermission, } from "../../application/DeferredFileAuthorization.js";
+import { APPLICATION_TOOL_CONTRACTS } from "../../contracts/applicationToolContracts.js";
+import { reconstructionCoverageCommitInputSchema, reconstructionCoverageQueryInputSchema, } from "../../application/ReconstructionCoverageService.js";
+import { reconstructionClosureResultSchema } from "../../domain/reconstructionCoverage.js";
+import { AnalysisCapabilityUnavailableError, EvidenceIntegrityError, } from "../../domain/errors.js";
+import { err } from "../../domain/result.js";
+import { logToolExecution } from "../toolLogging.js";
+import { toCallToolResult } from "../toolResult.js";
+import { toolRegistrationOptions } from "../toolRegistrationOptions.js";
+import { safeParseToolInput } from "../toolInputValidation.js";
+import { coverageWorkspaceUri } from "./helpers.js";
+const commitContract = APPLICATION_TOOL_CONTRACTS[5];
+const queryContract = APPLICATION_TOOL_CONTRACTS[6];
+/** Register reconstruction coverage commit and query tools. */
+export const registerCoverageTools = (server, options) => {
+    registerCommitTool(server, options);
+    registerQueryTool(server, options);
+};
+const registerCommitTool = (server, options) => {
+    server.registerTool(commitContract.name, toolRegistrationOptions(commitContract), async (input, context) => {
+        const parsed = safeParseToolInput(reconstructionCoverageCommitInputSchema, input, commitContract.name);
+        if (!parsed.ok)
+            return toCallToolResult(parsed, commitContract);
+        if (options.permissionAuthority === undefined)
+            return toCallToolResult(err(new AnalysisCapabilityUnavailableError("rea-reconstruction-coverage", commitContract.name, "workspace permission policy is not configured")), commitContract);
+        const authorization = await authorizeFileReadWithDeferredWrite(options.permissionAuthority, {
+            path: parsed.value.workspace_path,
+            readCapability: "investigation_workspace_read",
+            writeCapability: "investigation_workspace_write",
+            operation: commitContract.name,
+        });
+        if (!authorization.ok)
+            return toCallToolResult(authorization, commitContract);
+        const write = await authorization.value.authorizeWrite();
+        if (!write.ok)
+            return toCallToolResult(write, commitContract);
+        const result = await logToolExecution(options.logger, commitContract.name, () => commitReconstructionCoverage(parsed.value, options.evidenceFilePolicy, { signal: context.mcpReq.signal }));
+        if (!result.ok)
+            return toCallToolResult(result, commitContract);
+        options.retainCoverageWorkspace?.(parsed.value.workspace);
+        return toCallToolResult(result, commitContract, {
+            resourceLinks: options.retainCoverageWorkspace === undefined
+                ? []
+                : [
+                    {
+                        uri: coverageWorkspaceUri(parsed.value.workspace),
+                        name: parsed.value.workspace.workspace_id,
+                        description: "Session-retained reconstruction coverage workspace revision",
+                    },
+                ],
+        });
+    });
+};
+const registerQueryTool = (server, options) => {
+    server.registerTool(queryContract.name, toolRegistrationOptions(queryContract), async (input, context) => {
+        const parsed = safeParseToolInput(reconstructionCoverageQueryInputSchema, input, queryContract.name);
+        if (!parsed.ok)
+            return toCallToolResult(parsed, queryContract);
+        if (options.permissionAuthority === undefined)
+            return toCallToolResult(err(new AnalysisCapabilityUnavailableError("rea-reconstruction-coverage", queryContract.name, "workspace permission policy is not configured")), queryContract);
+        const authorized = await authorizeRootPermission(options.permissionAuthority, {
+            capability: "investigation_workspace_read",
+            roots: [parsed.value.workspace_path],
+            access: "read",
+            operation: queryContract.name,
+        });
+        if (!authorized.ok)
+            return toCallToolResult(authorized, queryContract);
+        const result = await logToolExecution(options.logger, queryContract.name, () => queryReconstructionCoverage(parsed.value, options.evidenceFilePolicy, Date.now(), { signal: context.mcpReq.signal }));
+        if (result.ok && options.retainCoverageWorkspace !== undefined) {
+            const closure = reconstructionClosureResultSchema.parse(result.value);
+            const loaded = await readReconstructionCoverageWorkspace(parsed.value.workspace_path, options.evidenceFilePolicy);
+            if (!loaded.ok)
+                return toCallToolResult(loaded, queryContract);
+            if (loaded.value === null ||
+                loaded.value.revision_sha256 !== closure.workspace_revision_sha256)
+                return toCallToolResult(err(new EvidenceIntegrityError("workspace changed while its closure was being retained")), queryContract);
+            options.retainCoverageWorkspace(loaded.value);
+        }
+        return toCallToolResult(result, queryContract);
+    });
+};

package/dist/server/registerApplicationTools/helpers.js

@@ -0,0 +1,42 @@
+import { APPLICATION_TOOL_CONTRACTS } from "../../contracts/applicationToolContracts.js";
+import { toCallToolResult } from "../toolResult.js";
+export const coverageWorkspaceUri = (workspace) => `rea://reconstruction-coverage/${workspace.workspace_id}/revision/${String(workspace.revision)}`;
+export const recordSources = (recordEvidence, sources) => {
+    for (const source of sources) {
+        const recorded = recordEvidence?.(source);
+        if (recorded !== undefined && !recorded.ok)
+            return recorded;
+    }
+    return { ok: true, value: null };
+};
+export const recordResult = (options, contract, evidence, recordUnknown = false) => {
+    const recorded = recordUnknown
+        ? options.recordEvidenceWithUnknown?.(evidence, {
+            approved: true,
+            question: "Which application entities remain unmatched or ambiguous across these versions?",
+            severity: "medium",
+            domain: "application-version-comparison",
+            supporting_evidence_ids: [evidence.evidence_id],
+            contradicting_evidence_ids: [],
+            required_authority: "shipped-artifact",
+            required_confidence: "observed",
+            required_environment: null,
+            recommended_probes: [
+                {
+                    operation: "analyze_javascript_application",
+                    rationale: "Repeat static reconstruction with complete artifacts and source maps when available.",
+                },
+                {
+                    operation: "reconcile_javascript_runtime",
+                    rationale: "Add approved passive runtime Evidence without promoting it to static fact.",
+                },
+            ],
+            relationships: [],
+        })
+        : options.recordEvidence?.(evidence);
+    if (recorded !== undefined && !recorded.ok)
+        return toCallToolResult(recorded, contract);
+    return toCallToolResult({ ok: true, value: evidence }, contract, {
+        evidenceResourcesAvailable: recorded !== undefined,
+    });
+};

package/dist/server/registerApplicationTools/traceFeature.js

@@ -0,0 +1,26 @@
+import { traceApplicationFeatureEvidenceValidated } from "../../application/JavaScriptApplicationWorkflowService.js";
+import { APPLICATION_TOOL_CONTRACTS } from "../../contracts/applicationToolContracts.js";
+import { traceApplicationFeatureInputSchema } from "../../domain/javascriptFeatureTraceSchemas.js";
+import { logToolExecution } from "../toolLogging.js";
+import { toCallToolResult } from "../toolResult.js";
+import { toolRegistrationOptions } from "../toolRegistrationOptions.js";
+import { safeParseToolInput } from "../toolInputValidation.js";
+import { recordResult, recordSources } from "./helpers.js";
+const traceContract = APPLICATION_TOOL_CONTRACTS[0];
+/** Register the provider-neutral JavaScript feature trace tool. */
+export const registerTraceFeatureTool = (server, options) => {
+    server.registerTool(traceContract.name, toolRegistrationOptions(traceContract), async (input) => {
+        const parsedInput = safeParseToolInput(traceApplicationFeatureInputSchema, input, traceContract.name);
+        if (!parsedInput.ok)
+            return toCallToolResult(parsedInput, traceContract);
+        const parsed = parsedInput.value;
+        const result = await logToolExecution(options.logger, traceContract.name, () => Promise.resolve(traceApplicationFeatureEvidenceValidated(parsed)));
+        if (!result.ok)
+            return toCallToolResult(result, traceContract);
+        const sources = [parsed.application, ...parsed.native_observations];
+        const recorded = recordSources(options.recordEvidence, sources);
+        if (!recorded.ok)
+            return toCallToolResult(recorded, traceContract);
+        return recordResult(options, traceContract, result.value);
+    });
+};

package/dist/server/registerApplicationTools/types.js

@@ -0,0 +1 @@
+export {};

package/dist/server/registerApplicationTools.js

@@ -0,0 +1,13 @@
+import { registerTraceFeatureTool } from "./registerApplicationTools/traceFeature.js";
+import { registerCompareApplicationVersionsTool } from "./registerApplicationTools/compareVersions.js";
+import { registerControlledReplayTool } from "./registerApplicationTools/controlledReplay.js";
+import { registerCharacterizationTools } from "./registerApplicationTools/characterization.js";
+import { registerCoverageTools } from "./registerApplicationTools/coverage.js";
+/** Register provider-neutral JavaScript application graph workflows. */
+export const registerApplicationTools = (server, options) => {
+    registerTraceFeatureTool(server, options);
+    registerCompareApplicationVersionsTool(server, options);
+    registerControlledReplayTool(server, options);
+    registerCharacterizationTools(server, options);
+    registerCoverageTools(server, options);
+};

package/dist/server/registerArtifactComparisonTool.js

@@ -2,27 +2,35 @@ import { artifactComparisonInputSchema, compareArtifacts, } from "../domain/arti
 import { createEvidence } from "../domain/evidence.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";
 import { recordDerivedEvidence } from "./recordDerivedEvidence.js";
-import { resolveSessionEvidence } from "./sessionEvidence.js";
+import { resolveSessionEvidenceIds } from "./sessionEvidence.js";
 import { ARTIFACT_COMPARISON_PROVIDER } from "./sessionToolPolicies.js";
 import { toCallToolResult } from "./toolResult.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
 import { runDerivedOperation } from "./runDerivedOperation.js";
+import { safeParseToolInput } from "./toolInputValidation.js";
 /** Register Evidence-backed deterministic artifact comparison. */
 export const registerArtifactComparisonTool = (server, session, contract) => {
     server.registerTool(contract.name, toolRegistrationOptions(contract), async (input, context) => {
-        const parsed = artifactComparisonInputSchema.parse(input);
-        const left = resolveSessionEvidence(session, parsed.left);
+        const parsedInput = safeParseToolInput(artifactComparisonInputSchema, input, contract.name);
+        if (!parsedInput.ok)
+            return toCallToolResult(parsedInput, contract);
+        const parsed = parsedInput.value;
+        const expected = {
+            operation: "inventory_artifact",
+            predicate: "rea.analysis/v2",
+        };
+        const left = resolveSessionEvidenceIds(session, parsed.left_evidence_ids, expected);
         if (!left.ok)
             return toCallToolResult(left, contract);
-        const right = resolveSessionEvidence(session, parsed.right);
+        const right = resolveSessionEvidenceIds(session, parsed.right_evidence_ids, expected);
         if (!right.ok)
             return toCallToolResult(right, contract);
         const computed = await runDerivedOperation(context, contract.name, () => compareArtifacts(left.value, right.value, parsed.offset, parsed.limit));
         if (!computed.ok)
             return toCallToolResult(computed, contract);
         const comparison = computed.value;
-        const leftEvidenceIds = evidenceIds(parsed.left);
-        const rightEvidenceIds = evidenceIds(parsed.right);
+        const leftEvidenceIds = parsed.left_evidence_ids;
+        const rightEvidenceIds = parsed.right_evidence_ids;
         const evidence = createEvidence(undefined, ARTIFACT_COMPARISON_PROVIDER, {
             predicateType: "rea.artifact-comparison/v1",
             operation: contract.name,
@@ -49,8 +57,8 @@ const artifactUnknownInput = (input, status) => {
         question: `Artifact comparison is ${status}`,
         severity: status === "unknown" || status === "truncated" ? "high" : "medium",
         domain: "artifact-comparison",
-        supporting_evidence_ids: evidenceIds(input.left),
-        contradicting_evidence_ids: evidenceIds(input.right),
+        supporting_evidence_ids: [...input.left_evidence_ids],
+        contradicting_evidence_ids: [...input.right_evidence_ids],
         required_authority: "shipped-artifact",
         required_confidence: "observed",
         required_environment: null,
@@ -63,4 +71,3 @@ const artifactUnknownInput = (input, status) => {
         relationships: [],
     };
 };
-const evidenceIds = (input) => (Array.isArray(input) ? input : [input]).map(({ evidence_id: id }) => id);

package/dist/server/registerBrowserTools.js

@@ -9,80 +9,81 @@ import { captureWebScreenshotInputSchema, compareWebScreenshotsInputSchema, } fr
 import { logToolExecution } from "./toolLogging.js";
 import { toCallToolResult } from "./toolResult.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
+import { safeParseToolInput } from "./toolInputValidation.js";
 import { mcpProgressReporter } from "./mcpProgress.js";
 /** Register browser tools even when policy/provider availability denies execution. */
 export const registerBrowserTools = (server, options) => {
     const [listContract, inspectContract, analyzeContract, sessionContract, webMcpContract, captureDiffContract, screenshotContract, screenshotDiffContract,] = BROWSER_TOOL_CONTRACTS;
-    server.registerTool(listContract.name, toolRegistrationOptions(listContract), async (input, context) => {
-        const parsed = listBrowserTargetsInputSchema.parse(input);
-        const result = await logToolExecution(options.logger, listContract.name, () => listBrowserTargets(options.browser, options.permissionAuthority, parsed, { signal: context.mcpReq.signal }));
-        if (!result.ok)
-            return toCallToolResult(result, listContract);
-        return evidenceResult(options, listContract, result.value);
+    registerBrowserTool(server, options, {
+        contract: listContract,
+        schema: listBrowserTargetsInputSchema,
+        execute: (parsed, { signal }) => listBrowserTargets(options.browser, options.permissionAuthority, parsed, {
+            signal,
+        }),
     });
-    server.registerTool(inspectContract.name, toolRegistrationOptions(inspectContract), async (input, context) => {
-        const parsed = inspectWebPageInputSchema.parse(input);
-        const result = await logToolExecution(options.logger, inspectContract.name, () => inspectWebPage(options.browser, options.permissionAuthority, parsed, {
-            signal: context.mcpReq.signal,
-            progress: mcpProgressReporter(context),
-        }));
-        if (!result.ok)
-            return toCallToolResult(result, inspectContract);
-        return evidenceResult(options, inspectContract, result.value);
+    registerBrowserTool(server, options, {
+        contract: inspectContract,
+        schema: inspectWebPageInputSchema,
+        execute: (parsed, { signal, progress }) => inspectWebPage(options.browser, options.permissionAuthority, parsed, {
+            signal,
+            progress,
+        }),
     });
-    server.registerTool(analyzeContract.name, toolRegistrationOptions(analyzeContract), async (input, context) => {
-        const parsed = analyzeWebBundleInputSchema.parse(input);
-        const result = await logToolExecution(options.logger, analyzeContract.name, () => analyzeWebBundle(options.browser, options.permissionAuthority, parsed, {
-            signal: context.mcpReq.signal,
-            progress: mcpProgressReporter(context),
-        }));
-        if (!result.ok)
-            return toCallToolResult(result, analyzeContract);
-        return evidenceResult(options, analyzeContract, result.value);
+    registerBrowserTool(server, options, {
+        contract: analyzeContract,
+        schema: analyzeWebBundleInputSchema,
+        execute: (parsed, { signal, progress }) => analyzeWebBundle(options.browser, options.permissionAuthority, parsed, {
+            signal,
+            progress,
+        }),
     });
-    server.registerTool(sessionContract.name, toolRegistrationOptions(sessionContract), async (input, context) => {
-        const parsed = observeWebSessionInputSchema.parse(input);
-        const result = await logToolExecution(options.logger, sessionContract.name, () => observeWebSession(options.browser, options.permissionAuthority, parsed, {
-            signal: context.mcpReq.signal,
-            progress: mcpProgressReporter(context),
-        }));
-        if (!result.ok)
-            return toCallToolResult(result, sessionContract);
-        return evidenceResult(options, sessionContract, result.value);
+    registerBrowserTool(server, options, {
+        contract: sessionContract,
+        schema: observeWebSessionInputSchema,
+        execute: (parsed, { signal, progress }) => observeWebSession(options.browser, options.permissionAuthority, parsed, {
+            signal,
+            progress,
+        }),
     });
-    server.registerTool(webMcpContract.name, toolRegistrationOptions(webMcpContract), async (input, context) => {
-        const parsed = discoverWebMcpToolsInputSchema.parse(input);
-        const result = await logToolExecution(options.logger, webMcpContract.name, () => discoverWebMcpTools(options.browser, options.permissionAuthority, parsed, {
-            signal: context.mcpReq.signal,
-            progress: mcpProgressReporter(context),
-        }));
-        if (!result.ok)
-            return toCallToolResult(result, webMcpContract);
-        return evidenceResult(options, webMcpContract, result.value);
+    registerBrowserTool(server, options, {
+        contract: webMcpContract,
+        schema: discoverWebMcpToolsInputSchema,
+        execute: (parsed, { signal, progress }) => discoverWebMcpTools(options.browser, options.permissionAuthority, parsed, {
+            signal,
+            progress,
+        }),
     });
-    server.registerTool(captureDiffContract.name, toolRegistrationOptions(captureDiffContract), async (input) => {
-        const parsed = compareWebCapturesInputSchema.parse(input);
-        const result = await logToolExecution(options.logger, captureDiffContract.name, () => compareWebCaptureEvidence(options.browser, parsed));
-        if (!result.ok)
-            return toCallToolResult(result, captureDiffContract);
-        return evidenceResult(options, captureDiffContract, result.value);
+    registerBrowserTool(server, options, {
+        contract: captureDiffContract,
+        schema: compareWebCapturesInputSchema,
+        execute: (parsed, _context) => compareWebCaptureEvidence(options.browser, parsed),
     });
-    server.registerTool(screenshotContract.name, toolRegistrationOptions(screenshotContract), async (input, context) => {
-        const parsed = captureWebScreenshotInputSchema.parse(input);
-        const result = await logToolExecution(options.logger, screenshotContract.name, () => captureWebScreenshot(options.browser, options.permissionAuthority, parsed, {
+    registerBrowserTool(server, options, {
+        contract: screenshotContract,
+        schema: captureWebScreenshotInputSchema,
+        execute: (parsed, { signal, progress }) => captureWebScreenshot(options.browser, options.permissionAuthority, parsed, {
+            signal,
+            progress,
+        }),
+    });
+    registerBrowserTool(server, options, {
+        contract: screenshotDiffContract,
+        schema: compareWebScreenshotsInputSchema,
+        execute: (parsed, _context) => compareWebScreenshotEvidence(options.browser, parsed),
+    });
+};
+const registerBrowserTool = (server, options, spec) => {
+    server.registerTool(spec.contract.name, toolRegistrationOptions(spec.contract), async (input, context) => {
+        const parsedInput = safeParseToolInput(spec.schema, input, spec.contract.name);
+        if (!parsedInput.ok)
+            return toCallToolResult(parsedInput, spec.contract);
+        const result = await logToolExecution(options.logger, spec.contract.name, () => spec.execute(parsedInput.value, {
             signal: context.mcpReq.signal,
             progress: mcpProgressReporter(context),
         }));
         if (!result.ok)
-            return toCallToolResult(result, screenshotContract);
-        return evidenceResult(options, screenshotContract, result.value);
-    });
-    server.registerTool(screenshotDiffContract.name, toolRegistrationOptions(screenshotDiffContract), async (input) => {
-        const parsed = compareWebScreenshotsInputSchema.parse(input);
-        const result = await logToolExecution(options.logger, screenshotDiffContract.name, () => compareWebScreenshotEvidence(options.browser, parsed));
-        if (!result.ok)
-            return toCallToolResult(result, screenshotDiffContract);
-        return evidenceResult(options, screenshotDiffContract, result.value);
+            return toCallToolResult(result, spec.contract);
+        return evidenceResult(options, spec.contract, result.value);
     });
 };
 const evidenceResult = (options, contract, evidence) => {

package/dist/server/registerBundleComparisonTool.js

@@ -1,31 +1,29 @@
+import { readEvidenceBundle } from "../application/EvidenceBundleFiles.js";
 import { bundleComparisonInputSchema, compareBundles, } from "../domain/bundleComparison.js";
 import { createEvidence } from "../domain/evidence.js";
-import { EvidenceIntegrityError } from "../domain/errors.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";
-import { err, ok } from "../domain/result.js";
+import { ok } from "../domain/result.js";
 import { BUNDLE_COMPARISON_PROVIDER } from "./sessionToolPolicies.js";
 import { toCallToolResult } from "./toolResult.js";
-import { isSessionEvidence } from "./sessionEvidence.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
 import { runDerivedOperation } from "./runDerivedOperation.js";
+import { safeParseToolInput } from "./toolInputValidation.js";
 /** Register canonical Evidence bundle comparison. */
-export const registerBundleComparisonTool = (server, session, contract) => {
+export const registerBundleComparisonTool = (server, session, contract, evidenceFilePolicy) => {
     server.registerTool(contract.name, toolRegistrationOptions(contract), async (input, context) => {
-        const parsed = bundleComparisonInputSchema.parse(input);
-        const sourceIds = [
-            ...new Set([
-                ...parsed.left.records.map(({ evidence_id: id }) => id),
-                ...parsed.right.records.map(({ evidence_id: id }) => id),
-            ]),
-        ].sort();
-        if ([...parsed.left.records, ...parsed.right.records].some((evidence) => !isSessionEvidence(session, evidence)))
-            return toCallToolResult(err(new EvidenceIntegrityError("Bundle comparison input Evidence is not present in this session")), contract);
-        const ownedUnknownDigests = new Set(session
-            .exportEvidenceBundle()
-            .unknowns.map(({ revision_digest: digest }) => digest));
-        if ([...parsed.left.unknowns, ...parsed.right.unknowns].some(({ revision_digest: digest }) => !ownedUnknownDigests.has(digest)))
-            return toCallToolResult(err(new EvidenceIntegrityError("Bundle comparison input unknown history is not present in this session")), contract);
-        const computed = await runDerivedOperation(context, contract.name, () => compareBundles(parsed.left, parsed.right, parsed.record_pairs, parsed.offset, parsed.limit));
+        const parsedInput = safeParseToolInput(bundleComparisonInputSchema, input, contract.name);
+        if (!parsedInput.ok)
+            return toCallToolResult(parsedInput, contract);
+        const parsed = parsedInput.value;
+        const [left, right] = await Promise.all([
+            readEvidenceBundle(parsed.left_bundle_path, evidenceFilePolicy),
+            readEvidenceBundle(parsed.right_bundle_path, evidenceFilePolicy),
+        ]);
+        if (!left.ok)
+            return toCallToolResult(left, contract);
+        if (!right.ok)
+            return toCallToolResult(right, contract);
+        const computed = await runDerivedOperation(context, contract.name, () => compareBundles(left.value, right.value, parsed.record_pairs, parsed.offset, parsed.limit));
         if (!computed.ok)
             return toCallToolResult(computed, contract);
         const comparison = computed.value;
@@ -43,7 +41,6 @@ export const registerBundleComparisonTool = (server, session, contract) => {
             confidence: "derived",
             authority: "analyst-inference",
             limitations: comparison.limitations,
-            evidenceLinks: sourceIds,
         });
         const recorded = session.recordEvidence(evidence);
         return toCallToolResult(recorded.ok ? ok(evidence) : recorded, contract);

package/dist/server/registerElectronTools.js

@@ -1,29 +1,56 @@
+import { analyzeJavaScriptApplicationValidated } from "../application/JavaScriptApplicationService.js";
+import { reconcileJavaScriptRuntimeEvidenceValidated } from "../application/JavaScriptRuntimeReconciliationService.js";
 import { inspectElectronPage, listElectronTargets, } from "../application/ElectronObservationService.js";
 import { ELECTRON_TOOL_CONTRACTS } from "../contracts/electronToolContracts.js";
 import { inspectElectronPageInputSchema, listElectronTargetsInputSchema, } from "../domain/electronObservation.js";
+import { analyzeJavaScriptApplicationInputSchema } from "../domain/javascriptApplicationAnalysis.js";
+import { reconcileJavaScriptRuntimeInputSchema } from "../domain/javascriptRuntimeReconciliationSchemas.js";
 import { logToolExecution } from "./toolLogging.js";
 import { toCallToolResult } from "./toolResult.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
+import { safeParseToolInput } from "./toolInputValidation.js";
 import { mcpProgressReporter } from "./mcpProgress.js";
 /** Register Electron tools even when provider or permission policy is absent. */
 export const registerElectronTools = (server, options) => {
-    const [listContract, inspectContract] = ELECTRON_TOOL_CONTRACTS;
-    server.registerTool(listContract.name, toolRegistrationOptions(listContract), async (input, context) => {
-        const parsed = listElectronTargetsInputSchema.parse(input);
-        const result = await logToolExecution(options.logger, listContract.name, () => listElectronTargets(options.electron, options.permissionAuthority, parsed, { signal: context.mcpReq.signal }));
-        if (!result.ok)
-            return toCallToolResult(result, listContract);
-        return evidenceResult(options, listContract, result.value);
+    const [listContract, inspectContract, analyzeContract, reconcileContract] = ELECTRON_TOOL_CONTRACTS;
+    registerElectronTool(server, options, {
+        contract: listContract,
+        schema: listElectronTargetsInputSchema,
+        execute: (parsed, { signal }) => listElectronTargets(options.electron, options.permissionAuthority, parsed, {
+            signal,
+        }),
+    });
+    registerElectronTool(server, options, {
+        contract: inspectContract,
+        schema: inspectElectronPageInputSchema,
+        execute: (parsed, { signal, progress }) => inspectElectronPage(options.electron, options.permissionAuthority, parsed, {
+            signal,
+            progress,
+        }),
+    });
+    registerElectronTool(server, options, {
+        contract: analyzeContract,
+        schema: analyzeJavaScriptApplicationInputSchema,
+        execute: (parsed, { signal, progress }) => analyzeJavaScriptApplicationValidated(options.permissionAuthority, parsed, { signal, progress }),
     });
-    server.registerTool(inspectContract.name, toolRegistrationOptions(inspectContract), async (input, context) => {
-        const parsed = inspectElectronPageInputSchema.parse(input);
-        const result = await logToolExecution(options.logger, inspectContract.name, () => inspectElectronPage(options.electron, options.permissionAuthority, parsed, {
+    registerElectronTool(server, options, {
+        contract: reconcileContract,
+        schema: reconcileJavaScriptRuntimeInputSchema,
+        execute: (parsed, _context) => Promise.resolve(reconcileJavaScriptRuntimeEvidenceValidated(parsed)),
+    });
+};
+const registerElectronTool = (server, options, spec) => {
+    server.registerTool(spec.contract.name, toolRegistrationOptions(spec.contract), async (input, context) => {
+        const parsedInput = safeParseToolInput(spec.schema, input, spec.contract.name);
+        if (!parsedInput.ok)
+            return toCallToolResult(parsedInput, spec.contract);
+        const result = await logToolExecution(options.logger, spec.contract.name, () => spec.execute(parsedInput.value, {
             signal: context.mcpReq.signal,
             progress: mcpProgressReporter(context),
         }));
         if (!result.ok)
-            return toCallToolResult(result, inspectContract);
-        return evidenceResult(options, inspectContract, result.value);
+            return toCallToolResult(result, spec.contract);
+        return evidenceResult(options, spec.contract, result.value);
     });
 };
 const evidenceResult = (options, contract, evidence) => {