rea-agents 2.1.0 → 2.2.0

package/dist/domain/runtimeIdentification.js

@@ -0,0 +1,210 @@
+import { createHash } from "node:crypto";
+import canonicalize from "canonicalize";
+import { z } from "zod";
+import { parseArtifactInventoryEvidence } from "./artifactInventoryEvidence.js";
+import { evidenceSchema } from "./evidence.js";
+const digestSchema = z.string().regex(/^[a-f0-9]{64}$/u);
+const evidenceIdSchema = z.string().regex(/^ev_[a-f0-9]{64}$/u);
+const runtimeFamilySchema = z.enum([
+    "android",
+    "apple",
+    "javascript",
+    "jvm",
+    "native",
+    "webassembly",
+]);
+const observationSchema = z.strictObject({
+    path: z.string().min(1).max(4_096),
+    artifact_id: z.string().regex(/^art_[a-f0-9]{64}$/u),
+    sha256: digestSchema,
+    format: z.string().min(1).max(100),
+});
+/** Authenticated artifact inventory pages to classify by runtime family. */
+const runtimeIdentificationInputSchema = z.strictObject({
+    inventory_evidence: z.array(evidenceSchema).min(1).max(100),
+    limits: z
+        .strictObject({
+        max_observations: z.number().int().min(1).max(10_000).default(1_000),
+    })
+        .default({ max_observations: 1_000 }),
+});
+/** Provider-neutral runtime identification with explicit tooling availability. */
+export const runtimeIdentificationResultSchema = z.strictObject({
+    schema_version: z.literal(1),
+    identification_id: z.string().regex(/^rid_[a-f0-9]{64}$/u),
+    root_sha256: digestSchema,
+    root_format: z.string().min(1).max(100),
+    source_evidence_ids: z.array(evidenceIdSchema).min(1).max(100),
+    runtimes: z.array(z.strictObject({
+        family: runtimeFamilySchema,
+        inspection: z.enum([
+            "available",
+            "provider-missing",
+            "provider-selection-required",
+        ]),
+        provider_id: z.string().min(1).max(200).nullable(),
+        reason: z.string().min(1).max(1_000).nullable(),
+        observations: z.array(observationSchema),
+        omitted_observations: z.number().int().min(0),
+    })),
+    coverage: z.strictObject({
+        status: z.enum(["complete-within-inventory", "partial", "truncated"]),
+        inventory_complete: z.boolean(),
+        omitted_observations: z.number().int().min(0),
+    }),
+    limitations: z.array(z.string().min(1).max(4_096)).max(100),
+});
+const PROVIDERS = {
+    android: {
+        inspection: "available",
+        id: "rea-android-application",
+        reason: null,
+    },
+    apple: { inspection: "available", id: "rea-apple-application", reason: null },
+    javascript: {
+        inspection: "available",
+        id: "rea-javascript-application",
+        reason: null,
+    },
+    jvm: {
+        inspection: "provider-missing",
+        id: null,
+        reason: "Install or configure a JVM bytecode-analysis provider.",
+    },
+    native: {
+        inspection: "provider-selection-required",
+        id: null,
+        reason: "Select an available native deep-analysis provider for this target and host.",
+    },
+    webassembly: {
+        inspection: "provider-missing",
+        id: null,
+        reason: "Install or configure a WebAssembly semantic-analysis provider.",
+    },
+};
+/** Identify runtime families without executing or semantically decoding target bytes. */
+export const identifyRuntimes = (input) => {
+    const parsed = runtimeIdentificationInputSchema.parse(input);
+    const { evidence, inventory } = parseArtifactInventoryEvidence(parsed.inventory_evidence);
+    const nodes = new Map(inventory.nodes.map((node) => [node.artifact_id, node]));
+    const grouped = new Map();
+    const add = (family, observation) => {
+        const observations = grouped.get(family) ?? [];
+        observations.push(observation);
+        grouped.set(family, observations);
+    };
+    for (const occurrence of inventory.occurrences) {
+        if (occurrence.artifact_id === null)
+            continue;
+        const node = nodes.get(occurrence.artifact_id);
+        if (node === undefined)
+            throw new TypeError("Runtime observation has no artifact node");
+        const observation = {
+            path: occurrence.logical_path,
+            artifact_id: node.artifact_id,
+            sha256: node.sha256,
+            format: node.format,
+        };
+        for (const family of familiesFor(node.format, occurrence.logical_path))
+            add(family, observation);
+    }
+    const rootObservation = inventory.nodes.find(({ sha256 }) => sha256 === inventory.manifest.root_sha256);
+    if (rootObservation !== undefined)
+        for (const family of familiesFor(inventory.manifest.root_format, "."))
+            add(family, {
+                path: ".",
+                artifact_id: rootObservation.artifact_id,
+                sha256: rootObservation.sha256,
+                format: rootObservation.format,
+            });
+    let remaining = parsed.limits.max_observations;
+    let omitted = 0;
+    const runtimes = [...grouped.entries()]
+        .sort(([left], [right]) => compare(left, right))
+        .map(([family, values]) => {
+        const unique = deduplicate(values);
+        const observations = unique.slice(0, remaining);
+        remaining -= observations.length;
+        const omittedObservations = unique.length - observations.length;
+        omitted += omittedObservations;
+        const provider = providerFor(family, inventory.manifest.root_format);
+        return {
+            family,
+            inspection: provider.inspection,
+            provider_id: provider.id,
+            reason: provider.reason,
+            observations,
+            omitted_observations: omittedObservations,
+        };
+    });
+    const limitations = [
+        ...(!inventory.complete
+            ? [
+                "Source inventory pages are incomplete; absent runtimes remain unknown.",
+            ]
+            : []),
+        ...(omitted > 0
+            ? [`${String(omitted)} runtime observations were omitted by the limit.`]
+            : []),
+        "Runtime families are identified from exact artifact formats and paths; semantic claims require the named provider.",
+    ];
+    const withoutId = {
+        schema_version: 1,
+        root_sha256: inventory.manifest.root_sha256,
+        root_format: inventory.manifest.root_format,
+        source_evidence_ids: evidence
+            .map(({ evidence_id: id }) => id)
+            .sort(compare),
+        runtimes,
+        coverage: {
+            status: omitted > 0
+                ? "truncated"
+                : inventory.complete
+                    ? "complete-within-inventory"
+                    : "partial",
+            inventory_complete: inventory.complete,
+            omitted_observations: omitted,
+        },
+        limitations,
+    };
+    return runtimeIdentificationResultSchema.parse({
+        ...withoutId,
+        identification_id: `rid_${digest(withoutId)}`,
+    });
+};
+const providerFor = (family, rootFormat) => family === "android" && rootFormat !== "apk"
+    ? {
+        inspection: "provider-selection-required",
+        id: null,
+        reason: "Extract or select an APK root before using the Android application provider.",
+    }
+    : PROVIDERS[family];
+const familiesFor = (format, path) => {
+    const families = new Set();
+    if (format === "apk" ||
+        format === "dex" ||
+        /(?:^|\/)[^/]+\.dex$/iu.test(path) ||
+        /(?:^|\/)AndroidManifest\.xml$/u.test(path))
+        families.add("android");
+    if (format === "ipa")
+        families.add("apple");
+    if (format === "javascript-bundle")
+        families.add("javascript");
+    if (format === "jvm-class" || /(?:^|\/)[^/]+\.class$/iu.test(path))
+        families.add("jvm");
+    if (["elf", "mach-o", "mach-o-universal", "pe"].includes(format))
+        families.add("native");
+    if (format === "webassembly" || /(?:^|\/)[^/]+\.wasm$/iu.test(path))
+        families.add("webassembly");
+    return [...families];
+};
+const deduplicate = (values) => [
+    ...new Map(values.map((value) => [`${value.path}\0${value.artifact_id}`, value])).values(),
+].sort((left, right) => compare(left.path, right.path));
+const compare = (left, right) => left < right ? -1 : left > right ? 1 : 0;
+const digest = (value) => {
+    const encoded = canonicalize(value);
+    if (encoded === undefined)
+        throw new TypeError("Runtime identification is not canonical JSON");
+    return createHash("sha256").update(encoded).digest("hex");
+};

package/dist/evaluation/CodexAgentEval.js

@@ -0,0 +1,132 @@
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const record = (value) => isRecord(value) ? value : undefined;
+const textValue = (value) => typeof value === "string" && value.length > 0 ? value : undefined;
+const numberValue = (value) => typeof value === "number" && Number.isFinite(value) ? value : 0;
+const canonicalValue = (value) => {
+    if (Array.isArray(value))
+        return value.map(canonicalValue);
+    const object = record(value);
+    if (object === undefined)
+        return value;
+    return Object.fromEntries(Object.entries(object)
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([key, child]) => [key, canonicalValue(child)]));
+};
+const evidenceIdsFrom = (value) => {
+    const encoded = JSON.stringify(value);
+    if (encoded === undefined)
+        return [];
+    return [...new Set(encoded.match(/ev_[a-f0-9]{64}/gu) ?? [])];
+};
+const toolResultFailed = (item) => {
+    if (item.status === "failed" ||
+        (item.error !== undefined && item.error !== null))
+        return true;
+    const result = record(item.result ?? item.output);
+    const structured = record(result?.structured_content ?? result?.structuredContent);
+    return result?.isError === true || structured?.error !== undefined;
+};
+const callFromItem = (value) => {
+    const item = record(value);
+    if (item?.type !== "mcp_tool_call")
+        return undefined;
+    const tool = textValue(item.tool) ?? textValue(item.name);
+    if (tool === undefined)
+        return undefined;
+    return {
+        id: textValue(item.id) ?? null,
+        server: textValue(item.server) ?? textValue(item.server_name) ?? null,
+        tool,
+        arguments: item.arguments ?? item.input ?? {},
+        evidenceIds: evidenceIdsFrom(item.result ?? item.output),
+        error: toolResultFailed(item),
+    };
+};
+const agentTextFromItem = (value) => {
+    const item = record(value);
+    if (item?.type !== "agent_message")
+        return undefined;
+    const direct = textValue(item.text) ?? textValue(item.message);
+    if (direct !== undefined)
+        return direct;
+    if (!Array.isArray(item.content))
+        return undefined;
+    const parts = item.content.flatMap((part) => {
+        const object = record(part);
+        const text = object === undefined ? undefined : textValue(object.text);
+        return text === undefined ? [] : [text];
+    });
+    return parts.length === 0 ? undefined : parts.join("\n");
+};
+const consumeEvent = (state, value) => {
+    const event = record(value);
+    if (event === undefined)
+        return;
+    const completedItem = event.type === "item.completed" ? event.item : undefined;
+    const call = callFromItem(completedItem) ??
+        (event.type === "mcp_tool_call" ? callFromItem(event) : undefined);
+    if (call !== undefined) {
+        const identity = call.id ??
+            `${call.server ?? ""}:${call.tool}:${JSON.stringify(canonicalValue(call.arguments))}`;
+        if (!state.seenCallIds.has(identity)) {
+            state.seenCallIds.add(identity);
+            state.calls.push(call);
+        }
+    }
+    const message = agentTextFromItem(completedItem);
+    if (message !== undefined)
+        state.finalMessages.push(message);
+    if (event.type !== "turn.completed")
+        return;
+    const usage = record(event.usage);
+    state.inputTokens = Math.max(state.inputTokens, numberValue(usage?.input_tokens));
+    state.cachedInputTokens = Math.max(state.cachedInputTokens, numberValue(usage?.cached_input_tokens));
+    state.outputTokens = Math.max(state.outputTokens, numberValue(usage?.output_tokens));
+};
+/** Score agent routing, repetition, model usage, and epistemic completion. */
+export const evaluateCodexEvents = (events, expectedFirstTool, options = {}) => {
+    const state = {
+        calls: [],
+        seenCallIds: new Set(),
+        finalMessages: [],
+        inputTokens: 0,
+        cachedInputTokens: 0,
+        outputTokens: 0,
+    };
+    for (const event of events)
+        consumeEvent(state, event);
+    const reaCalls = state.calls.filter(({ server }) => server === null || server.toLowerCase() === "rea");
+    const signatures = new Map();
+    for (const call of reaCalls) {
+        const signature = `${call.tool}:${JSON.stringify(canonicalValue(call.arguments))}`;
+        signatures.set(signature, (signatures.get(signature) ?? 0) + 1);
+    }
+    const repeatedCallCount = [...signatures.values()].reduce((total, count) => total + Math.max(0, count - 1), 0);
+    const finalMessage = state.finalMessages.at(-1) ?? "";
+    const evidenceIds = [
+        ...new Set(reaCalls.flatMap(({ evidenceIds: ids }) => ids)),
+    ];
+    const finalCitesEvidence = evidenceIds.some((evidenceId) => finalMessage.includes(evidenceId));
+    const normalizedFinalMessage = finalMessage.toLocaleLowerCase("en-US");
+    const contentCriteriaMet = (options.requiredAnswerTermGroups ?? []).every((terms) => terms.some((term) => normalizedFinalMessage.includes(term.toLocaleLowerCase("en-US"))));
+    const authorityHonesty = /\b(evidence|observed|inferred|unknown|unavailable|limitation|authority|not configured|could not|requires approval)\b/iu.test(finalMessage);
+    return {
+        naturalUse: reaCalls.length > 0,
+        correctFirstTool: reaCalls[0]?.tool === expectedFirstTool,
+        firstTool: reaCalls[0]?.tool ?? null,
+        reaCalls,
+        repeatedCallCount,
+        inputTokens: state.inputTokens,
+        cachedInputTokens: state.cachedInputTokens,
+        outputTokens: state.outputTokens,
+        finalMessage,
+        evidenceIds,
+        finalCitesEvidence,
+        contentCriteriaMet,
+        completionQuality: finalMessage.trim().length >= 80 &&
+            authorityHonesty &&
+            contentCriteriaMet &&
+            (options.requireEvidence !== true || finalCitesEvidence),
+        authorityHonesty,
+    };
+};

package/dist/generatedPackageMetadata.js

@@ -1,9 +1,9 @@
 /** Generated from package.json and package-lock.json; do not edit. */
 export const PACKAGE_METADATA = {
     name: "rea-agents",
-    version: "2.1.0",
+    version: "2.2.0", // x-release-please-version
     serverSdkVersion: "2.0.0-beta.4",
     clientSdkVersion: "2.0.0-beta.4",
     coreSdkVersion: "2.0.0-beta.4",
-    skillVersion: "22",
+    skillVersion: "23",
 };

package/dist/identity.js

@@ -7,9 +7,10 @@ export const PRODUCT_IDENTITY = {
     displayName: "REA",
     packageName: PACKAGE_METADATA.name,
     packageSpecifier: `${PACKAGE_METADATA.name}@latest`,
+    registrationPackageSpecifier: `${PACKAGE_METADATA.name}@${PACKAGE_METADATA.version}`,
     packageVersion: PACKAGE_METADATA.version,
     cliBinary: "rea",
-    mcpCommand: `npx -y ${PACKAGE_METADATA.name}@latest mcp`,
+    mcpCommand: `npx -y ${PACKAGE_METADATA.name}@${PACKAGE_METADATA.version} mcp`,
     mcpServerKey: "rea",
     skillName: "reverse-engineer-anything",
     skillVersion: PACKAGE_METADATA.skillVersion,

package/dist/server/createServer.js

@@ -15,6 +15,8 @@ import { createServerIdentity } from "../serverIdentity.js";
 import { registerBrowserTools } from "./registerBrowserTools.js";
 import { registerElectronTools } from "./registerElectronTools.js";
 import { registerApplicationTools } from "./registerApplicationTools.js";
+const TARGET_FREE_INSTRUCTIONS = "REA analyzes shipped artifacts and approved runtime evidence; use repository tools for source. Route: ASAR/JavaScript -> analyze_javascript_application; archive/package -> inventory_artifact; managed PE/CLI -> inspect_managed_artifact; browser/Electron runtime -> list_browser_targets/list_electron_targets; native binary/database -> open_binary, then binary_overview. Start with summaries and cite Evidence IDs. Never repeat identical analysis or read full Evidence unless a missing detail requires it.";
+const ACTIVE_TARGET_INSTRUCTIONS = "REA analyzes the active reverse-engineering target. Start native analysis with binary_overview, then narrow with analyze_function, literal search, callers, callees, and xrefs. Prefer summary views, never repeat an identical call, and read full Evidence only when the task requires it.";
 import { LinuxJavaScriptReplayRunner } from "../replay/LinuxJavaScriptReplayRunner.js";
 import { SystemJavaScriptReplayHost } from "../replay/SystemJavaScriptReplayHost.js";
 import { PROCESS_CAPTURE_ELICITATION_POLICY, } from "./ProcessCaptureElicitation.js";
@@ -45,8 +47,8 @@ export const createServer = (analysis, session, options = {}) => {
         },
         requestState: { verify: processCaptureStateCodec.verify },
         instructions: session === undefined
-            ? "Reverse-engineering tools for an active analysis target. Start with binary_overview."
-            : "Reverse-engineering tools for configured analysis providers. Open a target with open_binary, then start with binary_overview.",
+            ? ACTIVE_TARGET_INSTRUCTIONS
+            : TARGET_FREE_INSTRUCTIONS,
     });
     server.server.onclose = () => {
         permissionAuthority?.clearSessionGrants();
@@ -168,6 +170,7 @@ const registerBinaryAnalysisTools = ({ server, analysis, session, options, logge
         logger,
         activeTarget,
         recordEvidence,
+        session,
     });
     if (session !== undefined)
         registerManagedWorkflowTools(server, {

package/dist/server/javascriptApplicationResult.js

@@ -0,0 +1,85 @@
+import { javascriptApplicationAnalysisResultSchema } from "../domain/javascriptApplicationAnalysis.js";
+import { compareCodePoints } from "../domain/javascriptApplicationGraph.js";
+import { javascriptApplicationAnalysisSummarySchema } from "../contracts/electronToolContracts.js";
+const DEFAULT_GRAPH_PAGE_LIMIT = 100;
+const ROOT_SAMPLE_LIMIT = 10;
+const TOP_FINDING_LIMIT = 20;
+const FINDING_PRIORITY = {
+    "browser-window": 0,
+    "electron-preload": 1,
+    "context-bridge-api": 2,
+    "ipc-channel": 3,
+    "ipc-handler": 4,
+    "electron-utility": 5,
+    endpoint: 6,
+    storage: 7,
+    worker: 8,
+    "service-worker": 9,
+    "native-addon": 10,
+    "native-export": 11,
+    "source-map": 12,
+};
+/** Project complete JavaScript application Evidence into a bounded agent result. */
+export const summarizeJavaScriptApplicationEvidence = (evidence) => {
+    const result = javascriptApplicationAnalysisResultSchema.parse(evidence.normalized_result);
+    const nodeKinds = new Map();
+    for (const node of result.graph.nodes)
+        nodeKinds.set(node.kind, (nodeKinds.get(node.kind) ?? 0) + 1);
+    const rootItems = result.graph.root_node_ids.slice(0, ROOT_SAMPLE_LIMIT);
+    const pageRoot = `rea://evidence/${evidence.evidence_id}/application-graph`;
+    const topFindings = [...result.graph.nodes]
+        .sort((left, right) => (FINDING_PRIORITY[left.kind] ?? Number.MAX_SAFE_INTEGER) -
+        (FINDING_PRIORITY[right.kind] ?? Number.MAX_SAFE_INTEGER) ||
+        compareCodePoints(left.node_id, right.node_id))
+        .slice(0, TOP_FINDING_LIMIT)
+        .map((node) => {
+        const observation = node.observations[0];
+        if (observation === undefined)
+            throw new TypeError("Application graph node has no observation");
+        return {
+            node_id: node.node_id,
+            kind: node.kind,
+            label: observation.label,
+            authority: observation.evidence.authority,
+            state: observation.evidence.state,
+            confidence: observation.evidence.confidence,
+            location: observation.evidence.location,
+        };
+    });
+    const { graph: _graph, ...summary } = result;
+    const unknowns = new Set([
+        ...result.limitations,
+        ...result.graph.limitations,
+    ]);
+    if (result.statistics.parse_failures > 0)
+        unknowns.add(`${String(result.statistics.parse_failures)} JavaScript file(s) could not be parsed.`);
+    if (result.statistics.truncated_scopes > 0)
+        unknowns.add(`${String(result.statistics.truncated_scopes)} analysis scope(s) were truncated.`);
+    if (result.graph.coverage.status !== "complete")
+        unknowns.add(`Application graph coverage is ${result.graph.coverage.status}; omitted facts remain unknown.`);
+    return javascriptApplicationAnalysisSummarySchema.parse({
+        ...summary,
+        unknowns: [...unknowns],
+        graph: {
+            graph_id: result.graph.graph_id,
+            node_count: result.graph.nodes.length,
+            edge_count: result.graph.edges.length,
+            roots: {
+                items: rootItems,
+                total: result.graph.root_node_ids.length,
+                truncated: rootItems.length < result.graph.root_node_ids.length,
+            },
+            node_kinds: [...nodeKinds]
+                .sort(([left], [right]) => compareCodePoints(left, right))
+                .map(([kind, count]) => ({ kind, count })),
+            top_findings: topFindings,
+            coverage: result.graph.coverage,
+            limitations: result.graph.limitations,
+            pages: {
+                nodes: `${pageRoot}/nodes/offset/0/limit/${String(DEFAULT_GRAPH_PAGE_LIMIT)}`,
+                edges: `${pageRoot}/edges/offset/0/limit/${String(DEFAULT_GRAPH_PAGE_LIMIT)}`,
+                page_limit: DEFAULT_GRAPH_PAGE_LIMIT,
+            },
+        },
+    });
+};

package/dist/server/registerElectronTools.js

@@ -1,15 +1,15 @@
 import { analyzeJavaScriptApplicationValidated } from "../application/JavaScriptApplicationService.js";
 import { reconcileJavaScriptRuntimeEvidenceValidated } from "../application/JavaScriptRuntimeReconciliationService.js";
 import { inspectElectronPage, listElectronTargets, } from "../application/ElectronObservationService.js";
-import { ELECTRON_TOOL_CONTRACTS } from "../contracts/electronToolContracts.js";
+import { analyzeJavaScriptApplicationToolInputSchema, ELECTRON_TOOL_CONTRACTS, } from "../contracts/electronToolContracts.js";
 import { inspectElectronPageInputSchema, listElectronTargetsInputSchema, } from "../domain/electronObservation.js";
-import { analyzeJavaScriptApplicationInputSchema } from "../domain/javascriptApplicationAnalysis.js";
 import { reconcileJavaScriptRuntimeInputSchema } from "../domain/javascriptRuntimeReconciliationSchemas.js";
 import { logToolExecution } from "./toolLogging.js";
 import { toCallToolResult } from "./toolResult.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
 import { safeParseToolInput } from "./toolInputValidation.js";
 import { mcpProgressReporter } from "./mcpProgress.js";
+import { summarizeJavaScriptApplicationEvidence } from "./javascriptApplicationResult.js";
 /** Register Electron tools even when provider or permission policy is absent. */
 export const registerElectronTools = (server, options) => {
     const [listContract, inspectContract, analyzeContract, reconcileContract] = ELECTRON_TOOL_CONTRACTS;
@@ -30,8 +30,14 @@ export const registerElectronTools = (server, options) => {
     });
     registerElectronTool(server, options, {
         contract: analyzeContract,
-        schema: analyzeJavaScriptApplicationInputSchema,
+        schema: analyzeJavaScriptApplicationToolInputSchema,
         execute: (parsed, { signal, progress }) => analyzeJavaScriptApplicationValidated(options.permissionAuthority, parsed, { signal, progress }),
+        projectEvidence: (evidence, parsed) => {
+            const summary = summarizeJavaScriptApplicationEvidence(evidence);
+            return parsed.detail === "full"
+                ? { structured: evidence.normalized_result, text: summary }
+                : { structured: summary };
+        },
     });
     registerElectronTool(server, options, {
         contract: reconcileContract,
@@ -50,14 +56,22 @@ const registerElectronTool = (server, options, spec) => {
         }));
         if (!result.ok)
             return toCallToolResult(result, spec.contract);
-        return evidenceResult(options, spec.contract, result.value);
+        return evidenceResult(options, spec.contract, result.value, spec.projectEvidence?.(result.value, parsedInput.value));
     });
 };
-const evidenceResult = (options, contract, evidence) => {
+const evidenceResult = (options, contract, evidence, projection) => {
     const recorded = options.recordEvidence?.(evidence);
     return recorded !== undefined && !recorded.ok
         ? toCallToolResult(recorded, contract)
         : toCallToolResult({ ok: true, value: evidence }, contract, {
             evidenceResourcesAvailable: recorded !== undefined,
+            ...(projection === undefined
+                ? {}
+                : {
+                    evidenceResultProjection: projection.structured,
+                    ...(projection.text === undefined
+                        ? {}
+                        : { evidenceTextProjection: projection.text }),
+                }),
         });
 };

package/dist/server/registerEvidenceResources.js

@@ -1,6 +1,7 @@
 import { ResourceNotFoundError, ResourceTemplate, } from "@modelcontextprotocol/server";
 import { createHash } from "node:crypto";
 import canonicalize from "canonicalize";
+import { registerJavaScriptApplicationGraphResource } from "./registerJavaScriptApplicationGraphResource.js";
 const evidenceUri = (evidenceId) => `rea://evidence/${evidenceId}`;
 /** Expose immutable session-owned Evidence v2 records as MCP resources. */
 export const registerEvidenceResources = (server, session) => {
@@ -12,6 +13,7 @@ export const registerEvidenceResources = (server, session) => {
     registerArtifactPageResource(server, session);
     registerFunctionDossierResource(server, session);
     registerEvidenceSectionResource(server, session);
+    registerJavaScriptApplicationGraphResource(server, session);
     registerResidualUnknownResource(server, session);
 };
 const registerReconstructionCoverageResource = (server, session) => {

package/dist/server/registerJavaScriptApplicationGraphResource.js

@@ -0,0 +1,69 @@
+import { ResourceNotFoundError, ResourceTemplate, } from "@modelcontextprotocol/server";
+import { javascriptApplicationAnalysisResultSchema } from "../domain/javascriptApplicationAnalysis.js";
+/** Register deterministic pages over one authenticated JavaScript graph. */
+export const registerJavaScriptApplicationGraphResource = (server, session) => {
+    server.registerResource("javascript-application-graph-page", new ResourceTemplate("rea://evidence/{evidenceId}/application-graph/{collection}/offset/{offset}/limit/{limit}", {
+        list: undefined,
+        complete: {
+            evidenceId: (prefix) => session
+                .exportEvidenceBundle()
+                .records.map(({ evidence_id }) => evidence_id)
+                .filter((evidenceId) => evidenceId.startsWith(prefix)),
+            collection: (prefix) => ["nodes", "edges"].filter((name) => name.startsWith(prefix)),
+        },
+    }), {
+        title: "JavaScript application graph page",
+        description: "One deterministic bounded node or edge page from authenticated JavaScript application Evidence.",
+        mimeType: "application/json",
+    }, (uri, variables) => {
+        const evidenceId = stringVariable(variables.evidenceId, uri.href);
+        const collection = stringVariable(variables.collection, uri.href);
+        if (collection !== "nodes" && collection !== "edges")
+            throw new ResourceNotFoundError(uri.href);
+        const offset = pageInteger(variables.offset, uri.href, 0, 100_000);
+        const limit = pageInteger(variables.limit, uri.href, 1, 500);
+        const evidence = session.evidenceById(evidenceId);
+        if (evidence === undefined ||
+            evidence.operation !== "analyze_javascript_application")
+            throw new ResourceNotFoundError(uri.href);
+        const analysis = javascriptApplicationAnalysisResultSchema.safeParse(evidence.normalized_result);
+        if (!analysis.success)
+            throw new ResourceNotFoundError(uri.href);
+        const values = analysis.data.graph[collection];
+        const items = values.slice(offset, offset + limit);
+        const nextOffset = offset + items.length;
+        return {
+            contents: [
+                {
+                    uri: uri.href,
+                    mimeType: "application/json",
+                    text: JSON.stringify({
+                        evidence_id: evidence.evidence_id,
+                        graph_id: analysis.data.graph.graph_id,
+                        collection,
+                        items,
+                        offset,
+                        limit,
+                        total: values.length,
+                        next_offset: nextOffset < values.length ? nextOffset : null,
+                        has_more: nextOffset < values.length,
+                    }, null, 2),
+                },
+            ],
+        };
+    });
+};
+const stringVariable = (value, uri) => {
+    if (typeof value !== "string")
+        throw new ResourceNotFoundError(uri);
+    return value;
+};
+const pageInteger = (value, uri, minimum, maximum) => {
+    const text = stringVariable(value, uri);
+    if (!/^\d+$/u.test(text))
+        throw new ResourceNotFoundError(uri);
+    const parsed = Number(text);
+    if (!Number.isSafeInteger(parsed) || parsed < minimum || parsed > maximum)
+        throw new ResourceNotFoundError(uri);
+    return parsed;
+};

package/dist/server/registerManagedTools.js

@@ -1,6 +1,23 @@
 import { MANAGED_TOOL_CONTRACTS } from "../contracts/managedToolContracts.js";
+import { err } from "../domain/result.js";
 import { registerEvidenceTools } from "./registerEvidenceTools.js";
 /** Register execution-free managed PE/CLI inspection. */
 export const registerManagedTools = (server, analysis, options) => {
-    registerEvidenceTools(server, analysis, MANAGED_TOOL_CONTRACTS, options);
+    const targetAwareAnalysis = {
+        execute: async (operation, parameters, executionOptions) => {
+            const path = operation === "inspect_managed_artifact" &&
+                typeof parameters.path === "string"
+                ? parameters.path
+                : undefined;
+            if (path !== undefined && options.session !== undefined) {
+                const opened = await options.session.open(path, executionOptions?.signal === undefined
+                    ? undefined
+                    : { signal: executionOptions.signal });
+                if (!opened.ok)
+                    return err(opened.error);
+            }
+            return analysis.execute(operation, parameters, executionOptions);
+        },
+    };
+    registerEvidenceTools(server, targetAwareAnalysis, MANAGED_TOOL_CONTRACTS, options);
 };