rea-agents 1.7.0 → 2.1.0

package/dist/server/registerEnhancedTools.js

@@ -1,14 +1,15 @@
-import { EnhancedTools } from "../application/EnhancedTools.js";
-import { enhancedToolNameSchema } from "../contracts/enhancedInputs.js";
+import { EnhancedTools, } from "../application/EnhancedTools.js";
+import { enhancedInputSchemas, enhancedToolNameSchema, } from "../contracts/enhancedInputs.js";
 import { ENHANCED_TOOL_CONTRACTS, } from "../contracts/toolContracts.js";
 import { toCallToolResult } from "./toolResult.js";
 import { logToolExecution } from "./toolLogging.js";
 import { createEvidence } from "../domain/evidence.js";
-import { jsonObjectSchema } from "../domain/jsonValue.js";
-import { enhancedInputSchemas } from "../contracts/enhancedInputs.js";
-import { UnknownRegistryError } from "../domain/errors.js";
+import { AnalysisInputError, UnknownRegistryError } from "../domain/errors.js";
+import { ok } from "../domain/result.js";
 import { mcpProgressReporter } from "./mcpProgress.js";
 import { REA_WORKFLOW_PROVIDER, workflowAnalysisProfile, } from "../application/InvestigationProviders.js";
+import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
+import { safeParseToolInput } from "./toolInputValidation.js";
 /** Register composed workflows against the same port as direct bridge tools. */
 export const registerEnhancedTools = (server, analysis, options) => {
     const services = new EnhancedTools(analysis);
@@ -24,12 +25,7 @@ export const registerEnhancedTools = (server, analysis, options) => {
 };
 const registerEnhancedTool = (server, services, contract, registration) => {
     const name = enhancedToolNameSchema.parse(contract.name);
-    server.registerTool(name, {
-        description: contract.description,
-        inputSchema: contract.inputSchema,
-        outputSchema: contract.outputSchema,
-        annotations: contract.annotations,
-    }, async (input, context) => {
+    server.registerTool(name, toolRegistrationOptions(contract), async (input, context) => {
         const progress = mcpProgressReporter(context);
         await progress.report({
             phase: name,
@@ -37,9 +33,12 @@ const registerEnhancedTool = (server, services, contract, registration) => {
             total: 1,
             message: "started",
         });
-        const parsedInput = jsonObjectSchema.parse(enhancedInputSchemas[name].parse(input));
-        const parameters = { ...parsedInput };
-        const result = await logToolExecution(registration.logger, name, () => services.execute(name, input, context.mcpReq.signal));
+        const validatedCall = parseEnhancedCall(name, input);
+        if (!validatedCall.ok)
+            return toCallToolResult(validatedCall, contract);
+        const parsedInput = validatedCall.value.input;
+        const parameters = jsonParameters(parsedInput);
+        const result = await logToolExecution(registration.logger, name, () => services.executeValidated(validatedCall.value, context.mcpReq.signal));
         await progress.report({
             phase: name,
             completed: 1,
@@ -68,7 +67,7 @@ const registerEnhancedTool = (server, services, contract, registration) => {
                 return toCallToolResult(recorded, contract);
             const unknowns = recordWorkflowUnknowns({
                 name,
-                input: parsedInput,
+                input: parameters,
                 result: result.value,
                 evidenceId: evidence.evidence_id,
                 recordUnknown: registration.recordUnknown,
@@ -82,6 +81,44 @@ const registerEnhancedTool = (server, services, contract, registration) => {
         return toCallToolResult(result, contract);
     });
 };
+const jsonParameters = (input) => Object.fromEntries(Object.entries(input).filter((entry) => entry[1] !== undefined));
+const ENHANCED_INPUT_PARSERS = {
+    swift_classes: (input) => safeParseToolInput(enhancedInputSchemas.swift_classes, input, "swift_classes"),
+    get_objc_classes: (input) => safeParseToolInput(enhancedInputSchemas.get_objc_classes, input, "get_objc_classes"),
+    get_objc_protocols: (input) => safeParseToolInput(enhancedInputSchemas.get_objc_protocols, input, "get_objc_protocols"),
+    batch_decompile: (input) => safeParseToolInput(enhancedInputSchemas.batch_decompile, input, "batch_decompile"),
+    get_call_graph: (input) => safeParseToolInput(enhancedInputSchemas.get_call_graph, input, "get_call_graph"),
+    analyze_swift_types: (input) => safeParseToolInput(enhancedInputSchemas.analyze_swift_types, input, "analyze_swift_types"),
+    find_xrefs_to_name: (input) => safeParseToolInput(enhancedInputSchemas.find_xrefs_to_name, input, "find_xrefs_to_name"),
+    binary_overview: (input) => safeParseToolInput(enhancedInputSchemas.binary_overview, input, "binary_overview"),
+    analyze_function: (input) => safeParseToolInput(enhancedInputSchemas.analyze_function, input, "analyze_function"),
+    trace_feature: (input) => safeParseToolInput(enhancedInputSchemas.trace_feature, input, "trace_feature"),
+};
+const parseEnhancedCall = (name, input) => {
+    switch (name) {
+        case "swift_classes":
+            return mapEnhancedCall(ENHANCED_INPUT_PARSERS.swift_classes(input), (value) => ({ name, input: value }));
+        case "get_objc_classes":
+            return mapEnhancedCall(ENHANCED_INPUT_PARSERS.get_objc_classes(input), (value) => ({ name, input: value }));
+        case "get_objc_protocols":
+            return mapEnhancedCall(ENHANCED_INPUT_PARSERS.get_objc_protocols(input), (value) => ({ name, input: value }));
+        case "batch_decompile":
+            return mapEnhancedCall(ENHANCED_INPUT_PARSERS.batch_decompile(input), (value) => ({ name, input: value }));
+        case "get_call_graph":
+            return mapEnhancedCall(ENHANCED_INPUT_PARSERS.get_call_graph(input), (value) => ({ name, input: value }));
+        case "analyze_swift_types":
+            return mapEnhancedCall(ENHANCED_INPUT_PARSERS.analyze_swift_types(input), (value) => ({ name, input: value }));
+        case "find_xrefs_to_name":
+            return mapEnhancedCall(ENHANCED_INPUT_PARSERS.find_xrefs_to_name(input), (value) => ({ name, input: value }));
+        case "binary_overview":
+            return mapEnhancedCall(ENHANCED_INPUT_PARSERS.binary_overview(input), (value) => ({ name, input: value }));
+        case "analyze_function":
+            return mapEnhancedCall(ENHANCED_INPUT_PARSERS.analyze_function(input), (value) => ({ name, input: value }));
+        case "trace_feature":
+            return mapEnhancedCall(ENHANCED_INPUT_PARSERS.trace_feature(input), (value) => ({ name, input: value }));
+    }
+};
+const mapEnhancedCall = (parsed, project) => parsed.ok ? ok(project(parsed.value)) : parsed;
 const recordWorkflowUnknowns = ({ name, input, result, evidenceId, recordUnknown, }) => {
     if (name !== "trace_feature" ||
         input.unknown_registry_approved !== true ||

package/dist/server/registerEvidenceResources.js

@@ -4,6 +4,45 @@ import canonicalize from "canonicalize";
 const evidenceUri = (evidenceId) => `rea://evidence/${evidenceId}`;
 /** Expose immutable session-owned Evidence v2 records as MCP resources. */
 export const registerEvidenceResources = (server, session) => {
+    registerReconstructionCoverageResource(server, session);
+    registerInvestigationWorkspaceResource(server, session);
+    registerSessionEvidenceResource(server, session);
+    registerActiveResidualUnknownsResource(server, session);
+    registerAnalysisSnapshotResource(server, session);
+    registerArtifactPageResource(server, session);
+    registerFunctionDossierResource(server, session);
+    registerEvidenceSectionResource(server, session);
+    registerResidualUnknownResource(server, session);
+};
+const registerReconstructionCoverageResource = (server, session) => {
+    server.registerResource("reconstruction-coverage-revision", new ResourceTemplate("rea://reconstruction-coverage/{workspaceId}/revision/{revision}", {
+        list: () => ({
+            resources: session
+                .reconstructionCoverageWorkspaces()
+                .map((workspace) => ({
+                uri: coverageWorkspaceUri(workspace.workspace_id, workspace.revision),
+                name: `${workspace.workspace_id} revision ${String(workspace.revision)}`,
+                title: `${workspace.name} coverage revision ${String(workspace.revision)}`,
+                description: "Immutable evidence-backed reconstruction coverage workspace revision.",
+                mimeType: "application/json",
+            })),
+        }),
+    }), {
+        title: "Reconstruction coverage revision",
+        description: "Canonical CAS-linked surfaces, owners, claims, verifiers, evidence, and completion boundaries.",
+        mimeType: "application/json",
+    }, (uri, variables) => {
+        const workspaceId = stringVariable(variables.workspaceId, uri.href);
+        const revisionText = stringVariable(variables.revision, uri.href);
+        if (!/^\d+$/u.test(revisionText))
+            throw new ResourceNotFoundError(uri.href);
+        const workspace = session.reconstructionCoverageWorkspace(workspaceId, Number(revisionText));
+        if (workspace === undefined)
+            throw new ResourceNotFoundError(uri.href);
+        return jsonResource(uri.href, workspace);
+    });
+};
+const registerInvestigationWorkspaceResource = (server, session) => {
     server.registerResource("investigation-workspace-revision", new ResourceTemplate("rea://workspace/{workspaceId}/revision/{revision}", {
         list: () => ({
             resources: session.investigationWorkspaces().map((workspace) => ({
@@ -40,6 +79,8 @@ export const registerEvidenceResources = (server, session) => {
             throw new ResourceNotFoundError(uri.href);
         return jsonResource(uri.href, workspace);
     });
+};
+const registerSessionEvidenceResource = (server, session) => {
     server.registerResource("session-evidence", new ResourceTemplate("rea://evidence/{evidenceId}", {
         list: () => ({
             resources: session.exportEvidenceBundle().records.map((evidence) => ({
@@ -77,11 +118,15 @@ export const registerEvidenceResources = (server, session) => {
             ],
         };
     });
+};
+const registerActiveResidualUnknownsResource = (server, session) => {
     server.registerResource("active-residual-unknowns", "rea://unknowns/active", {
         title: "Active residual unknowns",
         description: "Current unresolved session-owned residual unknown heads.",
         mimeType: "application/json",
     }, (uri) => jsonResource(uri.href, session.listUnknowns().filter(({ status }) => status !== "resolved")));
+};
+const registerAnalysisSnapshotResource = (server, session) => {
     server.registerResource("analysis-snapshot", new ResourceTemplate("rea://snapshot/{snapshotDigest}", {
         list: () => {
             const snapshot = session.exportAnalysisSnapshot();
@@ -111,6 +156,8 @@ export const registerEvidenceResources = (server, session) => {
             throw new ResourceNotFoundError(uri.href);
         return jsonResource(uri.href, snapshot.value);
     });
+};
+const registerArtifactPageResource = (server, session) => {
     server.registerResource("artifact-page", new ResourceTemplate("rea://artifact/{manifestId}/{collection}", {
         list: undefined,
         complete: {
@@ -143,6 +190,8 @@ export const registerEvidenceResources = (server, session) => {
             limitations: evidence.limitations,
         });
     });
+};
+const registerFunctionDossierResource = (server, session) => {
     server.registerResource("function-dossier", new ResourceTemplate("rea://function/{targetSha256}/{address}", {
         list: undefined,
     }), {
@@ -161,6 +210,8 @@ export const registerEvidenceResources = (server, session) => {
             throw new ResourceNotFoundError(uri.href);
         return jsonResource(uri.href, evidence);
     });
+};
+const registerEvidenceSectionResource = (server, session) => {
     server.registerResource("evidence-section", new ResourceTemplate("rea://evidence/{evidenceId}/section/{section}", {
         list: undefined,
         complete: {
@@ -191,6 +242,8 @@ export const registerEvidenceResources = (server, session) => {
             value,
         });
     });
+};
+const registerResidualUnknownResource = (server, session) => {
     server.registerResource("residual-unknown", new ResourceTemplate("rea://unknown/{unknownId}", {
         list: () => ({
             resources: session.listUnknowns().map((unknown) => ({
@@ -224,6 +277,7 @@ export const registerEvidenceResources = (server, session) => {
         return jsonResource(uri.href, { current: unknown, history });
     });
 };
+const coverageWorkspaceUri = (workspaceId, revision) => `rea://reconstruction-coverage/${workspaceId}/revision/${String(revision)}`;
 const workspaceUri = (workspaceId, revision) => `rea://workspace/${workspaceId}/revision/${String(revision)}`;
 const EVIDENCE_SECTIONS = [
     "result",

package/dist/server/registerEvidenceTools.js

@@ -4,6 +4,7 @@ import { logToolExecution } from "./toolLogging.js";
 import { toCallToolResult } from "./toolResult.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
 import { mcpProgressReporter } from "./mcpProgress.js";
+import { safeParseToolInput } from "./toolInputValidation.js";
 import { AnalysisProtocolError, PermissionRequiredError, } from "../domain/errors.js";
 import { err } from "../domain/result.js";
 /** Register provider-backed contracts that return atomic Evidence v2 observations. */
@@ -17,7 +18,10 @@ export const registerEvidenceTools = (server, analysis, contracts, options) => {
                 total: 1,
                 message: "started",
             });
-            const parameters = jsonObjectSchema.parse(contract.inputSchema.parse(input));
+            const parsedInput = safeParseToolInput(contract.inputSchema, input, contract.name);
+            if (!parsedInput.ok)
+                return toCallToolResult(parsedInput, contract);
+            const parameters = jsonObjectSchema.parse(parsedInput.value);
             if (options.permissionAuthority !== undefined) {
                 const request = permissionRequest(contract.name, parameters);
                 if (request !== undefined) {

package/dist/server/registerFunctionComparisonTool.js

@@ -4,21 +4,29 @@ import { jsonValueSchema } from "../domain/jsonValue.js";
 import { FUNCTION_COMPARISON_PROVIDER } from "./sessionToolPolicies.js";
 import { toCallToolResult } from "./toolResult.js";
 import { recordDerivedEvidence } from "./recordDerivedEvidence.js";
-import { resolveSessionEvidence } from "./sessionEvidence.js";
+import { resolveSessionEvidenceIds } from "./sessionEvidence.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
 import { runDerivedOperation } from "./runDerivedOperation.js";
+import { safeParseToolInput } from "./toolInputValidation.js";
 /** Register explicit Evidence-backed function comparison. */
 export const registerFunctionComparisonTool = (server, session, contract) => {
     server.registerTool(contract.name, toolRegistrationOptions(contract), async (input, context) => {
-        const parsed = functionComparisonInputSchema.parse(input);
-        const left = resolveSessionEvidence(session, parsed.left);
+        const parsedInput = safeParseToolInput(functionComparisonInputSchema, input, contract.name);
+        if (!parsedInput.ok)
+            return toCallToolResult(parsedInput, contract);
+        const parsed = parsedInput.value;
+        const expected = {
+            operation: "analyze_function",
+            predicate: "rea.analysis/v2",
+        };
+        const left = resolveSessionEvidenceIds(session, parsed.left_evidence_ids, expected);
         if (!left.ok)
             return toCallToolResult(left, contract);
-        const right = resolveSessionEvidence(session, parsed.right);
+        const right = resolveSessionEvidenceIds(session, parsed.right_evidence_ids, expected);
         if (!right.ok)
             return toCallToolResult(right, contract);
-        const leftIds = evidenceIds(left.value);
-        const rightIds = evidenceIds(right.value);
+        const leftIds = left.value.map(({ evidence_id: id }) => id);
+        const rightIds = right.value.map(({ evidence_id: id }) => id);
         const computed = await runDerivedOperation(context, contract.name, () => compareFunctions(left.value, right.value, parsed.offset, parsed.limit));
         if (!computed.ok)
             return toCallToolResult(computed, contract);
@@ -69,4 +77,3 @@ const functionUnknownInput = ({ approved, status, leftIds, rightIds, }) => {
         relationships: [],
     };
 };
-const evidenceIds = (input) => (Array.isArray(input) ? input : [input]).map(({ evidence_id: id }) => id);

package/dist/server/registerInvestigationTools/helpers.js

@@ -0,0 +1,74 @@
+import { EvidenceIntegrityError, } from "../../domain/errors.js";
+import { err, ok } from "../../domain/result.js";
+import { recordDerivedEvidence } from "../recordDerivedEvidence.js";
+import { evaluateReconstructionClosure } from "../../domain/reconstructionCoverage.js";
+import { AnalysisInputError } from "../../domain/errors.js";
+/** Build the execution context passed to cross-version investigation. */
+export const investigationContext = ({ session, signal, inputRoots, integrityContinueEnabled, progress, }) => ({
+    session,
+    signal,
+    inputRoots,
+    integrityContinueEnabled,
+    ...(progress === undefined ? {} : { progress }),
+});
+export const isIncomplete = (status) => status === "unknown" || status === "truncated";
+export const comparisonClosure = (comparisons) => uniqueIds(comparisons.flatMap((evidence) => [
+    evidence.evidence_id,
+    ...evidence.evidence_links,
+]));
+export const functionEvidenceIds = (groups) => uniqueIds(groups.flatMap((group) => (Array.isArray(group) ? group : [group]).map(({ evidence_id: id }) => id)));
+const uniqueIds = (ids) => [...new Set(ids)].sort((left, right) => left.localeCompare(right));
+export const evidenceClosure = (session, seedIds) => {
+    const records = new Map(session
+        .exportEvidenceBundle()
+        .records.map((evidence) => [evidence.evidence_id, evidence]));
+    const visited = new Set();
+    const pending = [...seedIds];
+    while (pending.length > 0) {
+        const evidenceId = pending.pop();
+        if (evidenceId === undefined || visited.has(evidenceId))
+            continue;
+        const evidence = records.get(evidenceId);
+        if (evidence === undefined)
+            return err(new EvidenceIntegrityError("Investigation input has a dangling Evidence link"));
+        visited.add(evidenceId);
+        pending.push(...evidence.evidence_links);
+    }
+    return ok(uniqueIds([...visited]));
+};
+/** Verify a retained coverage boundary before reconstruction evidence is derived. */
+export const verifyCoverageReadiness = (session, coverage) => {
+    if (coverage === undefined)
+        return ok(null);
+    const workspace = session.reconstructionCoverageWorkspace(coverage.workspace_id, coverage.revision);
+    if (workspace === undefined ||
+        workspace.revision_sha256 !== coverage.revision_sha256)
+        return err(new EvidenceIntegrityError("The requested reconstruction coverage revision is not retained by this session"));
+    try {
+        const result = evaluateReconstructionClosure(workspace, coverage.boundary_id, Date.now());
+        return result.status === "ready"
+            ? ok(null)
+            : err(new EvidenceIntegrityError(`Reconstruction coverage boundary is ${result.status}; readiness requires ready`));
+    }
+    catch (cause) {
+        return err(new AnalysisInputError("verify_reconstruction", { cause }));
+    }
+};
+export const recordWorkflowEvidence = (...[session, evidence, approved, unresolved, input]) => {
+    if (approved !== true || !unresolved) {
+        return recordDerivedEvidence(session, evidence, undefined);
+    }
+    return recordDerivedEvidence(session, evidence, {
+        approved: true,
+        question: input.question,
+        severity: "high",
+        domain: input.domain,
+        supporting_evidence_ids: [evidence.evidence_id],
+        contradicting_evidence_ids: [],
+        required_authority: input.requiredAuthority,
+        required_confidence: input.requiredConfidence,
+        required_environment: null,
+        recommended_probes: [...input.probes],
+        relationships: [],
+    });
+};

package/dist/server/registerInvestigationTools/types.js

@@ -0,0 +1 @@
+export {};

package/dist/server/registerInvestigationTools.js

@@ -1,18 +1,19 @@
-import { runCrossVersionInvestigation } from "../application/CrossVersionInvestigation.js";
+import { runCrossVersionInvestigationValidated } from "../application/CrossVersionInvestigation.js";
+import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
+import { safeParseToolInput } from "./toolInputValidation.js";
 import { buildCallPath, callPathInputSchema } from "../domain/callPath.js";
 import { correlateStaticAndRuntime, staticRuntimeCorrelationInputSchema, } from "../domain/staticRuntimeCorrelation.js";
 import { reconstructionVerificationInputSchema, verifyReconstruction, } from "../domain/reconstructionVerification.js";
 import { changedBehaviorResultSchema, changedBehaviorInputSchema, findChangedBehavior, } from "../domain/changedBehavior.js";
 import { createEvidence } from "../domain/evidence.js";
-import { EvidenceIntegrityError, } from "../domain/errors.js";
+import {} from "../domain/errors.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";
-import { err, ok } from "../domain/result.js";
 import { CALL_PATH_PROVIDER, CHANGED_BEHAVIOR_PROVIDER, RECONSTRUCTION_PROVIDER, STATIC_RUNTIME_PROVIDER, } from "./sessionToolPolicies.js";
 import { toCallToolResult } from "./toolResult.js";
-import { recordDerivedEvidence } from "./recordDerivedEvidence.js";
 import { mcpProgressReporter } from "./mcpProgress.js";
-import { runDerivedOperation } from "./runDerivedOperation.js";
+import { runDerivedOperation, } from "./runDerivedOperation.js";
 import { authorizeFileReadWithDeferredWrite, authorizeRootPermission, } from "../application/DeferredFileAuthorization.js";
+import { comparisonClosure, evidenceClosure, functionEvidenceIds, investigationContext, isIncomplete, recordWorkflowEvidence, verifyCoverageReadiness, } from "./registerInvestigationTools/helpers.js";
 /** Register Evidence-composed differential investigation workflows. */
 export const registerInvestigationTools = (server, session, contracts, policies) => {
     registerChangedBehavior(server, session, contracts[0], policies);
@@ -20,81 +21,23 @@ export const registerInvestigationTools = (server, session, contracts, policies)
     registerStaticRuntime(server, session, contracts[2]);
     registerReconstruction(server, session, contracts[3]);
 };
-const investigationExecution = (session, signal, inputRoots, integrityContinueEnabled, progress) => ({
-    session,
-    signal,
-    inputRoots,
-    integrityContinueEnabled,
-    ...(progress === undefined ? {} : { progress }),
-});
-const isIncomplete = (status) => status === "unknown" || status === "truncated";
 const registerChangedBehavior = (server, session, contract, policies) => {
     server.registerTool(contract.name, contractOptions(contract), async (input, context) => {
-        const parsed = changedBehaviorInputSchema.parse(input);
+        const parsedInput = safeParseToolInput(changedBehaviorInputSchema, input, contract.name);
+        if (!parsedInput.ok)
+            return toCallToolResult(parsedInput, contract);
+        const parsed = parsedInput.value;
         const investigationRun = parsed.investigation_run;
-        if (investigationRun !== undefined) {
-            const progress = mcpProgressReporter(context);
-            let workspaceAuthorization;
-            let authorizeInputRead;
-            if (policies.permissionAuthority !== undefined) {
-                const authority = policies.permissionAuthority;
-                const authorizedWorkspace = await authorizeFileReadWithDeferredWrite(authority, {
-                    path: investigationRun.workspace_path,
-                    readCapability: "investigation_workspace_read",
-                    writeCapability: "investigation_workspace_write",
-                    operation: contract.name,
-                });
-                if (!authorizedWorkspace.ok)
-                    return toCallToolResult(authorizedWorkspace, contract);
-                workspaceAuthorization = authorizedWorkspace.value;
-                authorizeInputRead = () => authorizeRootPermission(authority, {
-                    capability: "investigation_input",
-                    roots: [investigationRun.left_path, investigationRun.right_path],
-                    access: "read",
-                    operation: contract.name,
-                });
-            }
-            const investigated = await runCrossVersionInvestigation(investigationRun, policies.evidenceFiles, {
-                ...investigationExecution(session, context.mcpReq.signal, policies.inputRoots, policies.integrityContinueEnabled?.() ?? false, progress),
-                ...(workspaceAuthorization === undefined
-                    ? {}
-                    : {
-                        authorizeWorkspaceWrite: workspaceAuthorization.authorizeWrite,
-                    }),
-                ...(authorizeInputRead === undefined ? {} : { authorizeInputRead }),
+        if (investigationRun !== undefined)
+            return runAutomaticInvestigation({
+                server,
+                session,
+                contract,
+                policies,
+                investigationRun,
+                unknownRegistryApproved: parsed.unknown_registry_approved,
+                context,
             });
-            if (!investigated.ok)
-                return toCallToolResult(investigated, contract);
-            const workspace = investigated.value.workspace;
-            if (session.retainInvestigationWorkspace(workspace) === "added")
-                server.sendResourceListChanged();
-            const result = changedBehaviorResultSchema.parse(investigated.value.evidence.normalized_result);
-            const toolResult = toCallToolResult(recordWorkflowEvidence(session, investigated.value.evidence, parsed.unknown_registry_approved, isIncomplete(result.behavior_status), {
-                question: `Automatic changed behavior run ${result.investigation_run?.run_id ?? "unknown"} remains ${result.behavior_status}`,
-                domain: "changed-behavior",
-                requiredAuthority: "controlled-replay",
-                requiredConfidence: "observed",
-                probes: [
-                    {
-                        operation: "capture_process_scenario",
-                        rationale: "Capture both versions under the same bounded scenario and environment.",
-                    },
-                ],
-            }), contract);
-            return {
-                ...toolResult,
-                content: [
-                    ...toolResult.content,
-                    {
-                        type: "resource_link",
-                        uri: `rea://workspace/${workspace.workspace_id}/revision/${String(workspace.revision)}`,
-                        name: `${workspace.workspace_id} revision ${String(workspace.revision)}`,
-                        description: "Immutable CAS-linked investigation workspace revision",
-                        mimeType: "application/json",
-                    },
-                ],
-            };
-        }
         const closure = evidenceClosure(session, comparisonClosure(parsed.comparisons));
         if (!closure.ok)
             return toCallToolResult(closure, contract);
@@ -132,9 +75,80 @@ const registerChangedBehavior = (server, session, contract, policies) => {
         return toCallToolResult(recorded, contract);
     });
 };
+const runAutomaticInvestigation = async (input) => {
+    const { policies, investigationRun, contract, session } = input;
+    const progress = mcpProgressReporter(input.context);
+    let workspaceAuthorization;
+    let authorizeInputRead;
+    if (policies.permissionAuthority !== undefined) {
+        const authority = policies.permissionAuthority;
+        const authorizedWorkspace = await authorizeFileReadWithDeferredWrite(authority, {
+            path: investigationRun.workspace_path,
+            readCapability: "investigation_workspace_read",
+            writeCapability: "investigation_workspace_write",
+            operation: contract.name,
+        });
+        if (!authorizedWorkspace.ok)
+            return toCallToolResult(authorizedWorkspace, contract);
+        workspaceAuthorization = authorizedWorkspace.value;
+        authorizeInputRead = () => authorizeRootPermission(authority, {
+            capability: "investigation_input",
+            roots: [investigationRun.left_path, investigationRun.right_path],
+            access: "read",
+            operation: contract.name,
+        });
+    }
+    const investigated = await runCrossVersionInvestigationValidated(investigationRun, policies.evidenceFiles, {
+        ...investigationContext({
+            session,
+            signal: input.context.mcpReq.signal,
+            inputRoots: policies.inputRoots,
+            integrityContinueEnabled: policies.integrityContinueEnabled?.() ?? false,
+            progress,
+        }),
+        ...(workspaceAuthorization === undefined
+            ? {}
+            : { authorizeWorkspaceWrite: workspaceAuthorization.authorizeWrite }),
+        ...(authorizeInputRead === undefined ? {} : { authorizeInputRead }),
+    });
+    if (!investigated.ok)
+        return toCallToolResult(investigated, contract);
+    const workspace = investigated.value.workspace;
+    if (session.retainInvestigationWorkspace(workspace) === "added")
+        input.server.sendResourceListChanged();
+    const result = changedBehaviorResultSchema.parse(investigated.value.evidence.normalized_result);
+    const toolResult = toCallToolResult(recordWorkflowEvidence(session, investigated.value.evidence, input.unknownRegistryApproved, isIncomplete(result.behavior_status), {
+        question: `Automatic changed behavior run ${result.investigation_run?.run_id ?? "unknown"} remains ${result.behavior_status}`,
+        domain: "changed-behavior",
+        requiredAuthority: "controlled-replay",
+        requiredConfidence: "observed",
+        probes: [
+            {
+                operation: "capture_process_scenario",
+                rationale: "Capture both versions under the same bounded scenario and environment.",
+            },
+        ],
+    }), contract);
+    return {
+        ...toolResult,
+        content: [
+            ...toolResult.content,
+            {
+                type: "resource_link",
+                uri: `rea://workspace/${workspace.workspace_id}/revision/${String(workspace.revision)}`,
+                name: `${workspace.workspace_id} revision ${String(workspace.revision)}`,
+                description: "Immutable CAS-linked investigation workspace revision",
+                mimeType: "application/json",
+            },
+        ],
+    };
+};
 const registerCallPath = (server, session, contract) => {
     server.registerTool(contract.name, contractOptions(contract), async (input, context) => {
-        const parsed = callPathInputSchema.parse(input);
+        const parsedInput = safeParseToolInput(callPathInputSchema, input, contract.name);
+        if (!parsedInput.ok)
+            return toCallToolResult(parsedInput, contract);
+        const parsed = parsedInput.value;
         const closure = evidenceClosure(session, functionEvidenceIds(parsed.functions));
         if (!closure.ok)
             return toCallToolResult(closure, contract);
@@ -177,7 +191,10 @@ const registerCallPath = (server, session, contract) => {
 };
 const registerStaticRuntime = (server, session, contract) => {
     server.registerTool(contract.name, contractOptions(contract), async (input, context) => {
-        const parsed = staticRuntimeCorrelationInputSchema.parse(input);
+        const parsedInput = safeParseToolInput(staticRuntimeCorrelationInputSchema, input, contract.name);
+        if (!parsedInput.ok)
+            return toCallToolResult(parsedInput, contract);
+        const parsed = parsedInput.value;
         const closure = evidenceClosure(session, comparisonClosure([
             ...parsed.static_comparisons,
             ...parsed.runtime_comparisons,
@@ -219,13 +236,14 @@ const registerStaticRuntime = (server, session, contract) => {
 };
 const registerReconstruction = (server, session, contract) => {
     server.registerTool(contract.name, contractOptions(contract), async (input, context) => {
-        const parsed = reconstructionVerificationInputSchema.parse(input);
+        const parsedInput = safeParseToolInput(reconstructionVerificationInputSchema, input, contract.name);
+        if (!parsedInput.ok)
+            return toCallToolResult(parsedInput, contract);
+        const parsed = parsedInput.value;
+        const coverage = verifyCoverageReadiness(session, parsed.coverage);
+        if (!coverage.ok)
+            return toCallToolResult(coverage, contract);
         const owned = session.exportEvidenceBundle();
-        const ownedUnknowns = new Set(owned.unknowns.map(({ revision_digest: digest }) => digest));
-        const ownedEvidenceIds = new Set(owned.records.map(({ evidence_id: id }) => id));
-        if (parsed.evidence_bundle.records.some(({ evidence_id: id }) => !ownedEvidenceIds.has(id)) ||
-            parsed.evidence_bundle.unknowns.some(({ revision_digest: digest }) => !ownedUnknowns.has(digest)))
-            return toCallToolResult(err(new EvidenceIntegrityError("Reconstruction input unknown history is not present in this session")), contract);
         const computed = await runDerivedOperation(context, contract.name, () => verifyReconstruction(parsed.specification, owned, parsed.offset, parsed.limit));
         if (!computed.ok)
             return toCallToolResult(computed, contract);
@@ -261,51 +279,4 @@ const registerReconstruction = (server, session, contract) => {
         }), contract);
     });
 };
-const contractOptions = (contract) => ({
-    description: contract.description,
-    inputSchema: contract.inputSchema,
-    outputSchema: contract.outputSchema,
-    annotations: contract.annotations,
-});
-const comparisonClosure = (comparisons) => uniqueIds(comparisons.flatMap((evidence) => [
-    evidence.evidence_id,
-    ...evidence.evidence_links,
-]));
-const functionEvidenceIds = (groups) => uniqueIds(groups.flatMap((group) => (Array.isArray(group) ? group : [group]).map(({ evidence_id: id }) => id)));
-const uniqueIds = (ids) => [...new Set(ids)].sort((left, right) => left.localeCompare(right));
-const evidenceClosure = (session, seedIds) => {
-    const records = new Map(session
-        .exportEvidenceBundle()
-        .records.map((evidence) => [evidence.evidence_id, evidence]));
-    const visited = new Set();
-    const pending = [...seedIds];
-    while (pending.length > 0) {
-        const evidenceId = pending.pop();
-        if (evidenceId === undefined || visited.has(evidenceId))
-            continue;
-        const evidence = records.get(evidenceId);
-        if (evidence === undefined)
-            return err(new EvidenceIntegrityError("Investigation input has a dangling Evidence link"));
-        visited.add(evidenceId);
-        pending.push(...evidence.evidence_links);
-    }
-    return ok(uniqueIds([...visited]));
-};
-const recordWorkflowEvidence = (...[session, evidence, approved, unresolved, input]) => {
-    if (approved !== true || !unresolved) {
-        return recordDerivedEvidence(session, evidence, undefined);
-    }
-    return recordDerivedEvidence(session, evidence, {
-        approved: true,
-        question: input.question,
-        severity: "high",
-        domain: input.domain,
-        supporting_evidence_ids: [evidence.evidence_id],
-        contradicting_evidence_ids: [],
-        required_authority: input.requiredAuthority,
-        required_confidence: input.requiredConfidence,
-        required_environment: null,
-        recommended_probes: [...input.probes],
-        relationships: [],
-    });
-};
+const contractOptions = toolRegistrationOptions;

package/dist/server/registerManagedTools.js

@@ -0,0 +1,6 @@
+import { MANAGED_TOOL_CONTRACTS } from "../contracts/managedToolContracts.js";
+import { registerEvidenceTools } from "./registerEvidenceTools.js";
+/** Register execution-free managed PE/CLI inspection. */
+export const registerManagedTools = (server, analysis, options) => {
+    registerEvidenceTools(server, analysis, MANAGED_TOOL_CONTRACTS, options);
+};