rea-agents 2.4.0 → 3.0.0

package/dist/server/registerApplicationTools/readiness.js

@@ -0,0 +1,55 @@
+import { evaluateReconstructionReadinessValidated, resolveReconstructionReadinessRequest, } from "../../application/ReconstructionReadinessService.js";
+import { applicationToolContract } from "../../contracts/applicationToolContracts.js";
+import { reconstructionReadinessInputSchema } from "../../domain/reconstructionReadinessSchemas.js";
+import { reconstructionReadinessReportSchema } from "../../domain/reconstructionReadinessSchemas.js";
+import { logToolExecution } from "../toolLogging.js";
+import { safeParseToolInput } from "../toolInputValidation.js";
+import { toolRegistrationOptions } from "../toolRegistrationOptions.js";
+import { toCallToolResult } from "../toolResult.js";
+import { recordSources } from "./helpers.js";
+const contract = applicationToolContract("evaluate_reconstruction_readiness");
+/** Register deterministic public-contract reconstruction conformance. */
+export const registerReconstructionReadinessTool = (server, options) => {
+    server.registerTool(contract.name, toolRegistrationOptions(contract), async (input) => {
+        const parsed = safeParseToolInput(reconstructionReadinessInputSchema, input, contract.name);
+        if (!parsed.ok)
+            return toCallToolResult(parsed, contract);
+        const resolved = resolveReconstructionReadinessRequest(parsed.value);
+        if (!resolved.ok)
+            return toCallToolResult(resolved, contract);
+        const result = await logToolExecution(options.logger, contract.name, () => Promise.resolve(evaluateReconstructionReadinessValidated(resolved.value)));
+        if (!result.ok)
+            return toCallToolResult(result, contract);
+        const recorded = recordSources(options.recordEvidence, resolved.value.evidence_bundle.records);
+        if (!recorded.ok)
+            return toCallToolResult(recorded, contract);
+        const recordedResult = options.recordEvidence?.(result.value);
+        if (recordedResult !== undefined && !recordedResult.ok)
+            return toCallToolResult(recordedResult, contract);
+        const report = reconstructionReadinessReportSchema.parse(result.value.normalized_result);
+        const reportUri = `rea://evidence/${result.value.evidence_id}/reconstruction-readiness-report`;
+        const projection = {
+            schema: report.schema,
+            schema_version: report.schema_version,
+            report_id: report.report_id,
+            source_digest: report.source_digest,
+            report_digest: report.report_digest,
+            status: report.status,
+            summary: report.summary,
+            metrics: report.metrics,
+            report_resource_uri: reportUri,
+        };
+        return toCallToolResult({ ok: true, value: result.value }, contract, {
+            evidenceResourcesAvailable: recordedResult !== undefined,
+            evidenceResultProjection: projection,
+            evidenceTextProjection: projection,
+            resourceLinks: [
+                {
+                    uri: reportUri,
+                    name: report.report_id,
+                    description: "Full deterministic reconstruction readiness report",
+                },
+            ],
+        });
+    });
+};

package/dist/server/registerApplicationTools.js

@@ -1,17 +1,23 @@
 import { registerTraceFeatureTool } from "./registerApplicationTools/traceFeature.js";
 import { registerTraceJavaScriptSemanticsTool } from "./registerApplicationTools/traceSemantics.js";
 import { registerCompareApplicationVersionsTool } from "./registerApplicationTools/compareVersions.js";
+import { registerCompareSourceToBundleTool } from "./registerApplicationTools/compareSourceToBundle.js";
 import { registerCompareJavaScriptExportShapesTool } from "./registerApplicationTools/compareExportShapes.js";
 import { registerControlledReplayTool } from "./registerApplicationTools/controlledReplay.js";
 import { registerCharacterizationTools } from "./registerApplicationTools/characterization.js";
 import { registerCoverageTools } from "./registerApplicationTools/coverage.js";
+import { registerReconstructionObligationLedgerTool } from "./registerApplicationTools/obligationLedger.js";
+import { registerReconstructionReadinessTool } from "./registerApplicationTools/readiness.js";
 /** Register provider-neutral JavaScript application graph workflows. */
 export const registerApplicationTools = (server, options) => {
     registerTraceFeatureTool(server, options);
     registerTraceJavaScriptSemanticsTool(server, options);
     registerCompareApplicationVersionsTool(server, options);
+    registerCompareSourceToBundleTool(server, options);
     registerCompareJavaScriptExportShapesTool(server, options);
     registerControlledReplayTool(server, options);
     registerCharacterizationTools(server, options);
+    registerReconstructionObligationLedgerTool(server, options);
+    registerReconstructionReadinessTool(server, options);
     registerCoverageTools(server, options);
 };

package/dist/server/registerArtifactTools.js

@@ -1,6 +1,14 @@
 import { ARTIFACT_TOOL_CONTRACTS } from "../contracts/artifactToolContracts.js";
 import { registerEvidenceTools } from "./registerEvidenceTools.js";
+import { artifactInspectionResultSchema } from "../domain/artifactInspection.js";
 /** Register deterministic artifact inventory and safe extraction operations. */
 export const registerArtifactTools = (server, analysis, options) => {
-    registerEvidenceTools(server, analysis, ARTIFACT_TOOL_CONTRACTS, options);
+    registerEvidenceTools(server, analysis, ARTIFACT_TOOL_CONTRACTS, {
+        ...options,
+        sourceEvidence: (operation, result) => operation === "inspect_artifact"
+            ? artifactInspectionResultSchema
+                .parse(result)
+                .substeps.map(({ evidence }) => evidence)
+            : [],
+    });
 };

package/dist/server/registerBrowserScenarioTool.js

@@ -0,0 +1,25 @@
+import { captureBrowserScenario } from "../application/BrowserScenarioCaptureService.js";
+import { BROWSER_SCENARIO_TOOL_CONTRACTS } from "../contracts/browserScenarioToolContracts.js";
+import { browserScenarioSchema } from "../domain/browserScenario.js";
+import { logToolExecution } from "./toolLogging.js";
+import { safeParseToolInput } from "./toolInputValidation.js";
+import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
+import { toCallToolResult } from "./toolResult.js";
+/** Register the controlled browser scenario tool even when policy disables it. */
+export const registerBrowserScenarioTool = (server, options) => {
+    const [contract] = BROWSER_SCENARIO_TOOL_CONTRACTS;
+    server.registerTool(contract.name, toolRegistrationOptions(contract), async (input, context) => {
+        const parsed = safeParseToolInput(browserScenarioSchema, input, contract.name);
+        if (!parsed.ok)
+            return toCallToolResult(parsed, contract);
+        const result = await logToolExecution(options.logger, contract.name, () => captureBrowserScenario(options.provider, options.permissionAuthority, parsed.value, { signal: context.mcpReq.signal }));
+        if (!result.ok)
+            return toCallToolResult(result, contract);
+        const recorded = options.recordEvidence?.(result.value);
+        return recorded !== undefined && !recorded.ok
+            ? toCallToolResult(recorded, contract)
+            : toCallToolResult({ ok: true, value: result.value }, contract, {
+                evidenceResourcesAvailable: recorded !== undefined,
+            });
+    });
+};

package/dist/server/registerBrowserTools.js

@@ -4,7 +4,7 @@ import { inspectWebPageInputSchema, listBrowserTargetsInputSchema, } from "../do
 import { analyzeWebBundleInputSchema } from "../domain/webBundleAnalysis.js";
 import { observeWebSessionInputSchema } from "../domain/browserSession.js";
 import { discoverWebMcpToolsInputSchema } from "../domain/webMcpDiscovery.js";
-import { compareWebCapturesInputSchema } from "../domain/webCaptureDiff.js";
+import { browserCaptureComparisonInputSchema } from "../domain/browserCaptureComparison.js";
 import { captureWebScreenshotInputSchema, compareWebScreenshotsInputSchema, } from "../domain/webScreenshot.js";
 import { logToolExecution } from "./toolLogging.js";
 import { toCallToolResult } from "./toolResult.js";
@@ -55,7 +55,7 @@ export const registerBrowserTools = (server, options) => {
     });
     registerBrowserTool(server, options, {
         contract: captureDiffContract,
-        schema: compareWebCapturesInputSchema,
+        schema: browserCaptureComparisonInputSchema,
         execute: (parsed, _context) => compareWebCaptureEvidence(options.browser, parsed),
     });
     registerBrowserTool(server, options, {

package/dist/server/registerCloseLifecycleTool.js

@@ -0,0 +1,57 @@
+import { writeAnalysisSnapshot } from "../application/AnalysisSnapshotFiles.js";
+import { closeBinaryInputSchema } from "../contracts/sessionLifecycleInputs.js";
+import { ok } from "../domain/result.js";
+import { reportLifecycleEnd, reportLifecycleStart, } from "./lifecycleProgress.js";
+import { logToolExecution } from "./toolLogging.js";
+import { toCallToolResult } from "./toolResult.js";
+import { mcpProgressReporter } from "./mcpProgress.js";
+import { permissionFailure } from "./permissionFailure.js";
+import { safeParseToolInput } from "./toolInputValidation.js";
+import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
+/** Register provider cleanup and optional pre-close snapshot persistence. */
+export const registerCloseLifecycleTool = ({ server, session, logger, contracts: [, closeContract], snapshotFilePolicy, permissionAuthority, }) => {
+    server.registerTool(closeContract.name, toolRegistrationOptions(closeContract), async (input, context) => {
+        const parsedInput = safeParseToolInput(closeBinaryInputSchema, input, closeContract.name);
+        if (!parsedInput.ok)
+            return toCallToolResult(parsedInput, closeContract);
+        const parsed = parsedInput.value;
+        const progress = mcpProgressReporter(context);
+        if (parsed.snapshot_path === undefined) {
+            await reportLifecycleStart(progress, closeContract.name);
+            const closed = await logToolExecution(logger, closeContract.name, () => session.close({ progress }));
+            await reportLifecycleEnd(progress, closeContract.name, closed.ok);
+            server.sendToolListChanged();
+            return toCallToolResult(closed, closeContract);
+        }
+        if (permissionAuthority !== undefined) {
+            const authorized = await permissionAuthority.authorize({
+                capability: "snapshot_write",
+                roots: [parsed.snapshot_path],
+                executables: [],
+                environment_names: [],
+                network: "none",
+                mount: false,
+                operation_identity: `close_binary:snapshot:${parsed.snapshot_path}`,
+            }, "write");
+            if (!authorized.ok)
+                return toCallToolResult(permissionFailure(authorized), closeContract);
+        }
+        const snapshot = session.exportAnalysisSnapshot();
+        if (!snapshot.ok)
+            return toCallToolResult(snapshot, closeContract);
+        const written = await writeAnalysisSnapshot(snapshot.value, parsed.snapshot_path, parsed.overwrite, snapshotFilePolicy);
+        if (!written.ok)
+            return toCallToolResult(written, closeContract);
+        await reportLifecycleStart(progress, closeContract.name, "snapshot written; closing provider");
+        const closed = await logToolExecution(logger, closeContract.name, () => session.close({ progress }));
+        await reportLifecycleEnd(progress, closeContract.name, closed.ok);
+        server.sendToolListChanged();
+        return closed.ok
+            ? toCallToolResult(ok({
+                path: written.value.path,
+                bytes: written.value.bytes,
+                entries: snapshot.value.entries.length,
+            }), closeContract)
+            : toCallToolResult(closed, closeContract);
+    });
+};

package/dist/server/registerEnhancedTools.js

@@ -12,9 +12,8 @@ import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
 import { safeParseToolInput } from "./toolInputValidation.js";
 /** Register composed workflows against the same port as direct bridge tools. */
 export const registerEnhancedTools = (server, analysis, options) => {
-    const services = new EnhancedTools(analysis);
     for (const contract of ENHANCED_TOOL_CONTRACTS) {
-        registerEnhancedTool(server, services, contract, {
+        registerEnhancedTool(server, analysis, contract, {
             logger: options.logger,
             activeTarget: options.activeTarget,
             analysisProfile: options.analysisProfile,
@@ -23,7 +22,7 @@ export const registerEnhancedTools = (server, analysis, options) => {
         });
     }
 };
-const registerEnhancedTool = (server, services, contract, registration) => {
+const registerEnhancedTool = (server, analysis, contract, registration) => {
     const name = enhancedToolNameSchema.parse(contract.name);
     server.registerTool(name, toolRegistrationOptions(contract), async (input, context) => {
         const progress = mcpProgressReporter(context);
@@ -38,6 +37,12 @@ const registerEnhancedTool = (server, services, contract, registration) => {
             return toCallToolResult(validatedCall, contract);
         const parsedInput = validatedCall.value.input;
         const parameters = jsonParameters(parsedInput);
+        const services = new EnhancedTools({
+            execute: (operation, operationParameters, executionOptions) => analysis.execute(operation, operationParameters, {
+                ...executionOptions,
+                progress,
+            }),
+        });
         const result = await logToolExecution(registration.logger, name, () => services.executeValidated(validatedCall.value, context.mcpReq.signal));
         await progress.report({
             phase: name,
@@ -92,7 +97,10 @@ const ENHANCED_INPUT_PARSERS = {
     find_xrefs_to_name: (input) => safeParseToolInput(enhancedInputSchemas.find_xrefs_to_name, input, "find_xrefs_to_name"),
     binary_overview: (input) => safeParseToolInput(enhancedInputSchemas.binary_overview, input, "binary_overview"),
     analyze_function: (input) => safeParseToolInput(enhancedInputSchemas.analyze_function, input, "analyze_function"),
+    inspect_native_api: (input) => safeParseToolInput(enhancedInputSchemas.inspect_native_api, input, "inspect_native_api"),
     trace_feature: (input) => safeParseToolInput(enhancedInputSchemas.trace_feature, input, "trace_feature"),
+    find_code_for_string: (input) => safeParseToolInput(enhancedInputSchemas.find_code_for_string, input, "find_code_for_string"),
+    trace_call_path: (input) => safeParseToolInput(enhancedInputSchemas.trace_call_path, input, "trace_call_path"),
 };
 const parseEnhancedCall = (name, input) => {
     switch (name) {
@@ -114,13 +122,24 @@ const parseEnhancedCall = (name, input) => {
             return mapEnhancedCall(ENHANCED_INPUT_PARSERS.binary_overview(input), (value) => ({ name, input: value }));
         case "analyze_function":
             return mapEnhancedCall(ENHANCED_INPUT_PARSERS.analyze_function(input), (value) => ({ name, input: value }));
+        case "inspect_native_api":
+            return mapEnhancedCall(ENHANCED_INPUT_PARSERS.inspect_native_api(input), (value) => ({ name, input: value }));
         case "trace_feature":
             return mapEnhancedCall(ENHANCED_INPUT_PARSERS.trace_feature(input), (value) => ({ name, input: value }));
+        case "find_code_for_string":
+            return mapEnhancedCall(ENHANCED_INPUT_PARSERS.find_code_for_string(input), (value) => ({ name, input: value }));
+        case "trace_call_path":
+            return mapEnhancedCall(ENHANCED_INPUT_PARSERS.trace_call_path(input), (value) => ({ name, input: value }));
     }
 };
 const mapEnhancedCall = (parsed, project) => parsed.ok ? ok(project(parsed.value)) : parsed;
 const recordWorkflowUnknowns = ({ name, input, result, evidenceId, recordUnknown, }) => {
-    if (name !== "trace_feature" ||
+    if (![
+        "trace_feature",
+        "find_code_for_string",
+        "trace_call_path",
+        "inspect_native_api",
+    ].includes(name) ||
         input.unknown_registry_approved !== true ||
         recordUnknown === undefined ||
         typeof result !== "object" ||
@@ -135,7 +154,7 @@ const recordWorkflowUnknowns = ({ name, input, result, evidenceId, recordUnknown
             approved: true,
             question,
             severity: "medium",
-            domain: "control-flow",
+            domain: name === "inspect_native_api" ? "native-api" : "control-flow",
             supporting_evidence_ids: [evidenceId],
             contradicting_evidence_ids: [],
             required_authority: "shipped-artifact",
@@ -143,8 +162,10 @@ const recordWorkflowUnknowns = ({ name, input, result, evidenceId, recordUnknown
             required_environment: null,
             recommended_probes: [
                 {
-                    operation: "trace_feature",
-                    rationale: "Continue with a larger bounded budget.",
+                    operation: name,
+                    rationale: name === "inspect_native_api"
+                        ? "Confirm the unsupported boundary with a capable provider or ABI probe."
+                        : "Continue with a larger bounded budget.",
                 },
             ],
             relationships: [],

package/dist/server/registerEvidenceResources.js

@@ -2,33 +2,31 @@ import { ResourceNotFoundError, ResourceTemplate, } from "@modelcontextprotocol/
 import { createHash } from "node:crypto";
 import canonicalize from "canonicalize";
 import { registerJavaScriptApplicationGraphResource } from "./registerJavaScriptApplicationGraphResource.js";
-const evidenceUri = (evidenceId) => `rea://evidence/${evidenceId}`;
+import { registerReconstructionObligationLedgerResource } from "./registerReconstructionObligationLedgerResource.js";
+import { registerReconstructionReadinessResource } from "./registerReconstructionReadinessResource.js";
 /** Expose immutable session-owned Evidence v2 records as MCP resources. */
 export const registerEvidenceResources = (server, session) => {
     registerReconstructionCoverageResource(server, session);
     registerInvestigationWorkspaceResource(server, session);
     registerSessionEvidenceResource(server, session);
-    registerActiveResidualUnknownsResource(server, session);
+    registerEvidenceBundleResource(server, session);
     registerAnalysisSnapshotResource(server, session);
     registerArtifactPageResource(server, session);
     registerFunctionDossierResource(server, session);
     registerEvidenceSectionResource(server, session);
+    registerReconstructionObligationLedgerResource(server, session);
+    registerReconstructionReadinessResource(server, session);
     registerJavaScriptApplicationGraphResource(server, session);
     registerResidualUnknownResource(server, session);
+    session.onAnalysisSnapshotChanged?.(() => {
+        void server.server
+            .sendResourceUpdated({ uri: "rea://snapshot/current" })
+            .catch(() => undefined);
+    });
 };
 const registerReconstructionCoverageResource = (server, session) => {
     server.registerResource("reconstruction-coverage-revision", new ResourceTemplate("rea://reconstruction-coverage/{workspaceId}/revision/{revision}", {
-        list: () => ({
-            resources: session
-                .reconstructionCoverageWorkspaces()
-                .map((workspace) => ({
-                uri: coverageWorkspaceUri(workspace.workspace_id, workspace.revision),
-                name: `${workspace.workspace_id} revision ${String(workspace.revision)}`,
-                title: `${workspace.name} coverage revision ${String(workspace.revision)}`,
-                description: "Immutable evidence-backed reconstruction coverage workspace revision.",
-                mimeType: "application/json",
-            })),
-        }),
+        list: undefined,
     }), {
         title: "Reconstruction coverage revision",
         description: "Canonical CAS-linked surfaces, owners, claims, verifiers, evidence, and completion boundaries.",
@@ -46,27 +44,7 @@ const registerReconstructionCoverageResource = (server, session) => {
 };
 const registerInvestigationWorkspaceResource = (server, session) => {
     server.registerResource("investigation-workspace-revision", new ResourceTemplate("rea://workspace/{workspaceId}/revision/{revision}", {
-        list: () => ({
-            resources: session.investigationWorkspaces().map((workspace) => ({
-                uri: workspaceUri(workspace.workspace_id, workspace.revision),
-                name: `${workspace.workspace_id} revision ${String(workspace.revision)}`,
-                title: `${workspace.name} revision ${String(workspace.revision)}`,
-                description: "Immutable CAS-linked investigation workspace revision.",
-                mimeType: "application/json",
-            })),
-        }),
-        complete: {
-            workspaceId: (prefix) => [
-                ...new Set(session
-                    .investigationWorkspaces()
-                    .map(({ workspace_id }) => workspace_id)),
-            ].filter((workspaceId) => workspaceId.startsWith(prefix)),
-            revision: (prefix, context) => session
-                .investigationWorkspaces()
-                .filter(({ workspace_id }) => context?.arguments?.workspaceId === workspace_id)
-                .map(({ revision }) => String(revision))
-                .filter((revision) => revision.startsWith(prefix)),
-        },
+        list: undefined,
     }), {
         title: "Investigation workspace revision",
         description: "Immutable session-retained workspace with CAS linkage.",
@@ -84,21 +62,7 @@ const registerInvestigationWorkspaceResource = (server, session) => {
 };
 const registerSessionEvidenceResource = (server, session) => {
     server.registerResource("session-evidence", new ResourceTemplate("rea://evidence/{evidenceId}", {
-        list: () => ({
-            resources: session.exportEvidenceBundle().records.map((evidence) => ({
-                uri: evidenceUri(evidence.evidence_id),
-                name: evidence.evidence_id,
-                title: `${evidence.operation} evidence`,
-                description: `Session-owned Evidence v2 record for ${evidence.operation}.`,
-                mimeType: "application/json",
-            })),
-        }),
-        complete: {
-            evidenceId: (prefix) => session
-                .exportEvidenceBundle()
-                .records.map(({ evidence_id }) => evidence_id)
-                .filter((evidenceId) => evidenceId.startsWith(prefix)),
-        },
+        list: undefined,
     }), {
         title: "Session evidence",
         description: "Immutable Evidence v2 records owned by this REA session.",
@@ -121,42 +85,52 @@ const registerSessionEvidenceResource = (server, session) => {
         };
     });
 };
-const registerActiveResidualUnknownsResource = (server, session) => {
-    server.registerResource("active-residual-unknowns", "rea://unknowns/active", {
-        title: "Active residual unknowns",
-        description: "Current unresolved session-owned residual unknown heads.",
+const registerEvidenceBundleResource = (server, session) => {
+    server.registerResource("evidence-bundle", new ResourceTemplate("rea://evidence-bundle/{bundleDigest}", {
+        list: undefined,
+    }), {
+        title: "Evidence bundle",
+        description: "Immutable session-retained canonical Evidence v2 bundle.",
         mimeType: "application/json",
-    }, (uri) => jsonResource(uri.href, session.listUnknowns().filter(({ status }) => status !== "resolved")));
+    }, (uri, variables) => {
+        const digest = stringVariable(variables.bundleDigest, uri.href);
+        if (!/^[a-f0-9]{64}$/u.test(digest))
+            throw new ResourceNotFoundError(uri.href);
+        const text = session.retainedEvidenceBundle(digest);
+        if (text === undefined)
+            throw new ResourceNotFoundError(uri.href);
+        return {
+            contents: [
+                {
+                    uri: uri.href,
+                    mimeType: "application/json",
+                    text,
+                },
+            ],
+        };
+    });
 };
 const registerAnalysisSnapshotResource = (server, session) => {
-    server.registerResource("analysis-snapshot", new ResourceTemplate("rea://snapshot/{snapshotDigest}", {
-        list: () => {
-            const snapshot = session.exportAnalysisSnapshot();
-            if (!snapshot.ok)
-                return { resources: [] };
-            const digest = contentDigest(snapshot.value);
-            return {
-                resources: [
-                    {
-                        uri: `rea://snapshot/${digest}`,
-                        name: digest,
-                        title: "Current analysis snapshot",
-                        description: "Immutable projection of the current target cache.",
-                        mimeType: "application/json",
-                    },
-                ],
-            };
-        },
-    }), {
+    server.registerResource("analysis-snapshot", "rea://snapshot/current", {
         title: "Analysis snapshot",
-        description: "Current provider-neutral analysis snapshot by content digest.",
+        description: "Mutable provider-neutral analysis snapshot for the current native target.",
         mimeType: "application/json",
-    }, (uri, variables) => {
-        const requested = stringVariable(variables.snapshotDigest, uri.href);
+    }, (uri) => {
         const snapshot = session.exportAnalysisSnapshot();
-        if (!snapshot.ok || contentDigest(snapshot.value) !== requested)
-            throw new ResourceNotFoundError(uri.href);
-        return jsonResource(uri.href, snapshot.value);
+        if (!snapshot.ok)
+            return jsonResource(uri.href, {
+                state: "unavailable",
+                reason: snapshot.error.message,
+                remediation: "Open a native target with a concrete analysis profile. After metadata mutation, call open_binary again for the current target to begin a fresh cache.",
+            });
+        return jsonResource(uri.href, {
+            state: "available",
+            target: snapshot.value.target,
+            profile: snapshot.value.binding,
+            content_digest: contentDigest(snapshot.value),
+            entry_count: snapshot.value.entries.length,
+            snapshot: snapshot.value,
+        });
     });
 };
 const registerArtifactPageResource = (server, session) => {
@@ -217,7 +191,6 @@ const registerEvidenceSectionResource = (server, session) => {
     server.registerResource("evidence-section", new ResourceTemplate("rea://evidence/{evidenceId}/section/{section}", {
         list: undefined,
         complete: {
-            evidenceId: (prefix) => evidenceIds(session, prefix),
             section: (prefix) => EVIDENCE_SECTIONS.filter((section) => section.startsWith(prefix)),
         },
     }), {
@@ -247,21 +220,7 @@ const registerEvidenceSectionResource = (server, session) => {
 };
 const registerResidualUnknownResource = (server, session) => {
     server.registerResource("residual-unknown", new ResourceTemplate("rea://unknown/{unknownId}", {
-        list: () => ({
-            resources: session.listUnknowns().map((unknown) => ({
-                uri: `rea://unknown/${unknown.unknown_id}`,
-                name: unknown.unknown_id,
-                title: unknown.question,
-                description: `Current ${unknown.status} residual unknown revision.`,
-                mimeType: "application/json",
-            })),
-        }),
-        complete: {
-            unknownId: (prefix) => session
-                .listUnknowns()
-                .map(({ unknown_id }) => unknown_id)
-                .filter((unknownId) => unknownId.startsWith(prefix)),
-        },
+        list: undefined,
     }), {
         title: "Residual unknown",
         description: "Current session-owned residual unknown head.",
@@ -279,8 +238,6 @@ const registerResidualUnknownResource = (server, session) => {
         return jsonResource(uri.href, { current: unknown, history });
     });
 };
-const coverageWorkspaceUri = (workspaceId, revision) => `rea://reconstruction-coverage/${workspaceId}/revision/${String(revision)}`;
-const workspaceUri = (workspaceId, revision) => `rea://workspace/${workspaceId}/revision/${String(revision)}`;
 const EVIDENCE_SECTIONS = [
     "result",
     "terminal",
@@ -291,10 +248,6 @@ const EVIDENCE_SECTIONS = [
     "occurrences",
     "edges",
 ];
-const evidenceIds = (session, prefix) => session
-    .exportEvidenceBundle()
-    .records.map(({ evidence_id }) => evidence_id)
-    .filter((evidenceId) => evidenceId.startsWith(prefix));
 const stringVariable = (value, uri) => {
     if (typeof value !== "string")
         throw new ResourceNotFoundError(uri);

package/dist/server/registerEvidenceTools.js

@@ -47,6 +47,7 @@ export const registerEvidenceTools = (server, analysis, contracts, options) => {
             });
             if (!execution.ok)
                 return toCallToolResult(execution, contract);
+            const sourceEvidence = options.sourceEvidence?.(contract.name, execution.value.result) ?? [];
             const evidence = createEvidence(execution.value.subject ?? options.activeTarget?.(), execution.value.provider, {
                 operation: contract.name,
                 parameters,
@@ -54,7 +55,13 @@ export const registerEvidenceTools = (server, analysis, contracts, options) => {
                 rawResult: execution.value.rawResult,
                 limitations: execution.value.limitations,
                 locations: execution.value.locations,
+                evidenceLinks: sourceEvidence.map(({ evidence_id: id }) => id),
             });
+            for (const source of sourceEvidence) {
+                const sourceRecorded = options.recordEvidence?.(source);
+                if (sourceRecorded !== undefined && !sourceRecorded.ok)
+                    return toCallToolResult(sourceRecorded, contract);
+            }
             const recorded = options.recordEvidence?.(evidence);
             return recorded !== undefined && !recorded.ok
                 ? toCallToolResult(recorded, contract)
@@ -76,7 +83,7 @@ const permissionRequest = (operation, parameters) => {
             mount: false,
             operation_identity: `extract_artifact:${parameters.output_root}`,
         };
-    if (operation === "inventory_artifact" &&
+    if (["inventory_artifact", "inspect_artifact"].includes(operation) &&
         parameters.native_mount_approved === true)
         return {
             capability: "native_mount",
@@ -85,7 +92,7 @@ const permissionRequest = (operation, parameters) => {
             environment_names: [],
             network: "none",
             mount: true,
-            operation_identity: "inventory_artifact:native_mount",
+            operation_identity: `${operation}:native_mount`,
         };
     return undefined;
 };

package/dist/server/registerInvestigationTools.js

@@ -114,8 +114,7 @@ const runAutomaticInvestigation = async (input) => {
     if (!investigated.ok)
         return toCallToolResult(investigated, contract);
     const workspace = investigated.value.workspace;
-    if (session.retainInvestigationWorkspace(workspace) === "added")
-        input.server.sendResourceListChanged();
+    session.retainInvestigationWorkspace(workspace);
     const result = changedBehaviorResultSchema.parse(investigated.value.evidence.normalized_result);
     const toolResult = toCallToolResult(recordWorkflowEvidence(session, investigated.value.evidence, input.unknownRegistryApproved, isIncomplete(result.behavior_status), {
         question: `Automatic changed behavior run ${result.investigation_run?.run_id ?? "unknown"} remains ${result.behavior_status}`,

package/dist/server/registerJavaScriptApplicationGraphResource.js

@@ -5,10 +5,6 @@ export const registerJavaScriptApplicationGraphResource = (server, session) => {
     server.registerResource("javascript-application-graph-page", new ResourceTemplate("rea://evidence/{evidenceId}/application-graph/{collection}/offset/{offset}/limit/{limit}", {
         list: undefined,
         complete: {
-            evidenceId: (prefix) => session
-                .exportEvidenceBundle()
-                .records.map(({ evidence_id }) => evidence_id)
-                .filter((evidenceId) => evidenceId.startsWith(prefix)),
             collection: (prefix) => ["nodes", "edges"].filter((name) => name.startsWith(prefix)),
         },
     }), {

package/dist/server/registerJavaScriptRuntimeObservationTools.js

@@ -0,0 +1,37 @@
+import { listJavaScriptRuntimeTargets, observeJavaScriptRuntime, } from "../application/JavaScriptRuntimeObservationService.js";
+import { JAVASCRIPT_RUNTIME_OBSERVATION_TOOL_CONTRACTS } from "../contracts/javascriptRuntimeObservationToolContracts.js";
+import { listJavaScriptRuntimeTargetsInputSchema, observeJavaScriptRuntimeInputSchema, } from "../domain/javascriptRuntimeObservation.js";
+import { logToolExecution } from "./toolLogging.js";
+import { safeParseToolInput } from "./toolInputValidation.js";
+import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
+import { toCallToolResult } from "./toolResult.js";
+/** Register passive Inspector tools even when policy keeps them unavailable. */
+export const registerJavaScriptRuntimeObservationTools = (server, options) => {
+    const [listContract, observeContract] = JAVASCRIPT_RUNTIME_OBSERVATION_TOOL_CONTRACTS;
+    registerRuntimeTool(server, options, {
+        contract: listContract,
+        schema: listJavaScriptRuntimeTargetsInputSchema,
+        execute: (parsed, signal) => listJavaScriptRuntimeTargets(options.runtime, options.permissionAuthority, parsed, { signal }),
+    });
+    registerRuntimeTool(server, options, {
+        contract: observeContract,
+        schema: observeJavaScriptRuntimeInputSchema,
+        execute: (parsed, signal) => observeJavaScriptRuntime(options.runtime, options.permissionAuthority, parsed, { signal }),
+    });
+};
+const registerRuntimeTool = (server, options, spec) => {
+    server.registerTool(spec.contract.name, toolRegistrationOptions(spec.contract), async (input, context) => {
+        const parsed = safeParseToolInput(spec.schema, input, spec.contract.name);
+        if (!parsed.ok)
+            return toCallToolResult(parsed, spec.contract);
+        const result = await logToolExecution(options.logger, spec.contract.name, () => spec.execute(parsed.value, context.mcpReq.signal));
+        if (!result.ok)
+            return toCallToolResult(result, spec.contract);
+        const recorded = options.recordEvidence?.(result.value);
+        return recorded !== undefined && !recorded.ok
+            ? toCallToolResult(recorded, spec.contract)
+            : toCallToolResult({ ok: true, value: result.value }, spec.contract, {
+                evidenceResourcesAvailable: recorded !== undefined,
+            });
+    });
+};