rea-agents 2.5.0 → 3.0.0

package/dist/server/LazyToolCatalog.js

@@ -0,0 +1,134 @@
+import { fromJsonSchema, isCallToolResult, isInputRequiredResult, } from "@modelcontextprotocol/server";
+import { GENERATED_MCP_TOOL_CATALOG } from "../generatedMcpToolCatalog.js";
+/**
+ * Advertise the generated MCP catalog immediately and hydrate its callbacks
+ * through the existing registrars on first execution.
+ */
+export class LazyToolCatalog {
+    #server;
+    #hydrateRegistrations;
+    #includeSessionTools;
+    #tools = new Map();
+    #hydrations = new Map();
+    #hydrationQueue = Promise.resolve();
+    #closed = false;
+    constructor(server, hydrateRegistrations, includeSessionTools = true) {
+        this.#server = server;
+        this.#hydrateRegistrations = hydrateRegistrations;
+        this.#includeSessionTools = includeSessionTools;
+    }
+    /** Register every generated tool with a lazy callback. */
+    register() {
+        for (const contract of GENERATED_MCP_TOOL_CATALOG) {
+            if (contract.requiresSession && !this.#includeSessionTools)
+                continue;
+            const inputSchema = advertisedSchema(contract.inputSchema);
+            const outputSchema = advertisedSchema(contract.outputSchema);
+            let registered;
+            const callback = async (input, context) => {
+                await this.#hydrate(contract.kind);
+                const handler = registered?.handler;
+                if (handler === undefined || handler === callback)
+                    throw new Error(`MCP tool ${contract.name} was not hydrated`);
+                const result = await Reflect.apply(handler, undefined, [
+                    input,
+                    context,
+                ]);
+                if (isCallToolResult(result) || isInputRequiredResult(result))
+                    return result;
+                throw new TypeError(`MCP tool ${contract.name} returned an invalid result`);
+            };
+            registered = this.#server.registerTool(contract.name, {
+                title: contract.title,
+                description: contract.description,
+                inputSchema,
+                outputSchema,
+                annotations: contract.annotations,
+            }, callback);
+            this.#tools.set(contract.name, registered);
+        }
+    }
+    /** Wait for in-flight hydration and reject future first-use loading. */
+    async close() {
+        this.#closed = true;
+        await Promise.allSettled(this.#hydrations.values());
+    }
+    async #hydrate(kind) {
+        if (this.#closed)
+            throw new Error("MCP tool catalog is closed");
+        const existing = this.#hydrations.get(kind);
+        if (existing !== undefined) {
+            await existing;
+            return;
+        }
+        const hydration = this.#hydrationQueue
+            .catch(() => undefined)
+            .then(() => this.#runHydration(kind));
+        this.#hydrationQueue = hydration;
+        this.#hydrations.set(kind, hydration);
+        try {
+            await hydration;
+        }
+        catch (cause) {
+            if (this.#hydrations.get(kind) === hydration)
+                this.#hydrations.delete(kind);
+            throw cause;
+        }
+    }
+    async #runHydration(kind) {
+        if (this.#closed)
+            throw new Error("MCP tool catalog is closed");
+        const expected = GENERATED_MCP_TOOL_CATALOG.filter((contract) => contract.kind === kind &&
+            (this.#includeSessionTools || !contract.requiresSession)).map((contract) => contract.name);
+        const expectedNames = new Set(expected);
+        const hydrated = new Set();
+        const originalRegisterTool = this.#server.registerTool;
+        const hydrationRegisterTool = (...args) => {
+            const [name, config, callback] = args;
+            if (typeof name !== "string" ||
+                !isRecord(config) ||
+                typeof callback !== "function")
+                throw new TypeError("Invalid lazy MCP tool registration");
+            const registered = this.#tools.get(name);
+            if (registered === undefined || !expectedNames.has(name))
+                throw new TypeError(`MCP tool ${name} is not in the ${kind} catalog family`);
+            if (hydrated.has(name))
+                throw new TypeError(`MCP tool ${name} was hydrated more than once`);
+            hydrated.add(name);
+            Reflect.apply(registered.update, registered, [
+                {
+                    title: config.title,
+                    description: config.description,
+                    paramsSchema: config.inputSchema,
+                    outputSchema: config.outputSchema,
+                    annotations: config.annotations,
+                    callback,
+                },
+            ]);
+            return registered;
+        };
+        if (!Reflect.set(this.#server, "registerTool", hydrationRegisterTool))
+            throw new TypeError("Unable to install lazy MCP tool hydration");
+        try {
+            await this.#hydrateRegistrations(kind);
+        }
+        finally {
+            Reflect.set(this.#server, "registerTool", originalRegisterTool);
+        }
+        const missing = expected.filter((name) => !hydrated.has(name));
+        if (missing.length > 0)
+            throw new TypeError(`Generated MCP tools were not hydrated: ${missing.join(", ")}`);
+    }
+}
+const advertisedSchema = (jsonSchema) => fromJsonSchema(jsonSchema, DEFERRED_VALIDATION_PROVIDER);
+class DeferredValidationProvider {
+    getValidator() {
+        return (input) => ({
+            valid: true,
+            data: input,
+            errorMessage: undefined,
+        });
+    }
+}
+const DEFERRED_VALIDATION_PROVIDER = new DeferredValidationProvider();
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);

package/dist/server/createServer.js

@@ -1,30 +1,16 @@
 import { randomBytes } from "node:crypto";
 import { CLIENT_CAPABILITIES_META_KEY, createRequestStateCodec, McpServer, PROTOCOL_VERSION_META_KEY, } from "@modelcontextprotocol/server";
 import { PRODUCT_IDENTITY } from "../identity.js";
-import { registerEnhancedTools } from "./registerEnhancedTools.js";
-import { registerOfficialTools } from "./registerOfficialTools.js";
-import { registerSessionTools } from "./registerSessionTools.js";
-import { registerNativeTools } from "./registerNativeTools.js";
-import { registerArtifactTools } from "./registerArtifactTools.js";
-import { registerManagedTools } from "./registerManagedTools.js";
-import { registerManagedWorkflowTools } from "./registerManagedWorkflowTools.js";
 import { silentLogger } from "../logger.js";
 import { registerGuidedPrompts } from "./registerPrompts.js";
 import { registerEvidenceResources } from "./registerEvidenceResources.js";
-import { createServerIdentity } from "../serverIdentity.js";
-import { registerBrowserTools } from "./registerBrowserTools.js";
-import { registerBrowserScenarioTool } from "./registerBrowserScenarioTool.js";
-import { registerElectronTools } from "./registerElectronTools.js";
-import { registerJavaScriptRuntimeObservationTools } from "./registerJavaScriptRuntimeObservationTools.js";
-import { registerApplicationTools } from "./registerApplicationTools.js";
 import { sessionAvailabilityPolicy } from "./sessionAvailabilityPolicy.js";
 import { DENY_EVIDENCE_FILE_POLICY, DENY_PROCESS_POLICY, } from "./sessionToolPolicies.js";
 import { installDynamicToolAvailability } from "./DynamicToolAvailability.js";
-const TARGET_FREE_INSTRUCTIONS = "REA analyzes shipped artifacts. Route: ASAR/JavaScript -> analyze_javascript_application (configured root); archive/package -> inspect_artifact; managed PE/CLI -> inspect_managed_artifact; passive browser/Electron -> list_browser_targets/list_electron_targets; approved browser interaction -> capture_browser_scenario; Node/Electron Inspector -> list_javascript_runtime_targets; native binary/database -> open_binary, then binary_overview. Check binary_session policy. Start with summaries and cite Evidence IDs. Never repeat identical analysis or read full Evidence without need.";
+const TARGET_FREE_INSTRUCTIONS = "ASAR/JavaScript -> analyze_javascript_application; archive/package -> open_binary(path), then inspect_artifact/inventory_artifact (active target); managed PE/CLI -> inspect_managed_artifact; passive browser/Electron -> list_browser_targets/list_electron_targets; approved browser interaction -> capture_browser_scenario; Node/Electron Inspector -> list_javascript_runtime_targets; native binary/database -> open_binary, then binary_overview. Start with binary_session; call only tools in tools/list. Hidden routes: binary_session detail=capabilities. Use summaries, cite Evidence IDs. Never repeat identical analysis or read full Evidence.";
 const ACTIVE_TARGET_INSTRUCTIONS = "REA analyzes the active reverse-engineering target. Start native analysis with binary_overview, then narrow with analyze_function, literal search, callers, callees, and xrefs. Prefer summary views, never repeat an identical call, and read full Evidence only when the task requires it.";
-import { LinuxJavaScriptReplayRunner } from "../replay/LinuxJavaScriptReplayRunner.js";
-import { SystemJavaScriptReplayHost } from "../replay/SystemJavaScriptReplayHost.js";
 import { PROCESS_CAPTURE_ELICITATION_POLICY, } from "./ProcessCaptureElicitation.js";
+import { LazyToolCatalog } from "./LazyToolCatalog.js";
 const installSessionToolAvailability = (server, session, options) => {
     if (session === undefined)
         return undefined;
@@ -65,7 +51,7 @@ export const createServer = (analysis, session, options = {}) => {
     }, {
         capabilities: {
             tools: { listChanged: true },
-            resources: { listChanged: true },
+            resources: { listChanged: true, subscribe: true },
         },
         inputRequired: {
             maxRounds: 3,
@@ -86,47 +72,71 @@ export const createServer = (analysis, session, options = {}) => {
     registerServerIdentityResource(server, startedAt);
     const toolLogger = logger.child({ layer: "server" });
     const { activeTarget, recordEvidence, recordEvidenceWithUnknown } = createSessionRecorders(server, session);
-    const toolContext = {
-        server,
-        analysis,
-        session,
-        options,
-        logger: toolLogger,
-        permissionAuthority,
-        activeTarget,
-        recordEvidence,
-        recordEvidenceWithUnknown,
+    const processCaptureElicitation = {
+        stateCodec: processCaptureStateCodec,
+        supported: (context) => {
+            const envelope = context.mcpReq.envelope;
+            const version = envelope?.[PROTOCOL_VERSION_META_KEY];
+            const capabilities = envelope?.[CLIENT_CAPABILITIES_META_KEY];
+            return (typeof version === "string" &&
+                PROCESS_CAPTURE_ELICITATION_POLICY.protocolVersions.some((supported) => supported === version) &&
+                isRecord(capabilities) &&
+                isRecord(capabilities.elicitation) &&
+                capabilities.elicitation.form !== undefined);
+        },
+        now: Date.now,
+        consumedNonces: new Map(),
+    };
+    let optionalProviders;
+    const loadOptionalProviders = () => {
+        optionalProviders ??= options
+            .loadOptionalProviders?.()
+            .catch((cause) => {
+            optionalProviders = undefined;
+            throw cause;
+        });
+        return optionalProviders;
     };
-    registerBinaryAnalysisTools(toolContext);
-    registerObservationTools(toolContext);
+    const lazyTools = new LazyToolCatalog(server, async (kind) => {
+        const needsObservationProviders = kind === "browser-provider" ||
+            kind === "electron-provider" ||
+            kind === "runtime-provider";
+        const [{ hydrateServerToolFamily }, loadedOptionalProviders] = await Promise.all([
+            import("./hydrateServerTools.js"),
+            needsObservationProviders ? loadOptionalProviders() : undefined,
+        ]);
+        const hydratedOptions = loadedOptionalProviders === undefined
+            ? options
+            : { ...options, ...loadedOptionalProviders };
+        await hydrateServerToolFamily({
+            kind,
+            server,
+            analysis,
+            session,
+            options: hydratedOptions,
+            context: {
+                logger: toolLogger,
+                permissionAuthority,
+                activeTarget,
+                recordEvidence,
+                recordEvidenceWithUnknown,
+                availabilityPolicy: dynamicTools?.policy,
+                startedAt,
+                processCaptureElicitation,
+            },
+        });
+    }, session !== undefined);
+    lazyTools.register();
     registerGuidedPrompts(server, analysis, session);
     if (session !== undefined) {
         registerEvidenceResources(server, session);
-        registerSessionTools(server, session, toolLogger, {
-            ...options,
-            ...(dynamicTools === undefined
-                ? {}
-                : { availabilityPolicy: dynamicTools.policy }),
-            ...(permissionAuthority === undefined ? {} : { permissionAuthority }),
-            startedAt,
-            processCaptureElicitation: {
-                stateCodec: processCaptureStateCodec,
-                supported: (context) => {
-                    const envelope = context.mcpReq.envelope;
-                    const version = envelope?.[PROTOCOL_VERSION_META_KEY];
-                    const capabilities = envelope?.[CLIENT_CAPABILITIES_META_KEY];
-                    return (typeof version === "string" &&
-                        PROCESS_CAPTURE_ELICITATION_POLICY.protocolVersions.some((supported) => supported === version) &&
-                        isRecord(capabilities) &&
-                        isRecord(capabilities.elicitation) &&
-                        capabilities.elicitation.form !== undefined);
-                },
-                now: Date.now,
-                consumedNonces: new Map(),
-            },
-        });
     }
     dynamicTools?.controller.synchronize();
+    const close = server.close.bind(server);
+    server.close = async () => {
+        await lazyTools.close();
+        await close();
+    };
     return server;
 };
 const createSessionRecorders = (server, session) => ({
@@ -135,16 +145,12 @@ const createSessionRecorders = (server, session) => ({
         ? undefined
         : (evidence) => {
             const recorded = session.recordEvidence(evidence);
-            if (recorded.ok && recorded.value === "added")
-                server.sendResourceListChanged();
             return recorded;
         },
     recordEvidenceWithUnknown: session === undefined
         ? undefined
         : (evidence, input) => {
             const recorded = session.recordEvidenceWithUnknown(evidence, input);
-            if (recorded.ok)
-                server.sendResourceListChanged();
             return recorded;
         },
 });
@@ -153,7 +159,8 @@ const registerServerIdentityResource = (server, startedAt) => {
         title: "REA server identity",
         description: "Live package, SDK, protocol, and catalog identity.",
         mimeType: "application/json",
-    }, (uri) => {
+    }, async (uri) => {
+        const { createServerIdentity } = await import("../serverIdentity.js");
         const client = server.server.getClientVersion();
         const protocolVersion = server.server.getNegotiatedProtocolVersion();
         return {
@@ -171,118 +178,4 @@ const registerServerIdentityResource = (server, startedAt) => {
         };
     });
 };
-const registerBinaryAnalysisTools = ({ server, analysis, session, options, logger, permissionAuthority, activeTarget, recordEvidence, recordEvidenceWithUnknown, }) => {
-    const recordUnknown = session === undefined
-        ? undefined
-        : (input) => session.recordUnknown(input);
-    registerOfficialTools(server, analysis, {
-        logger,
-        activeTarget,
-        recordEvidence,
-        recordUnknown,
-    });
-    registerEnhancedTools(server, analysis, {
-        logger,
-        activeTarget,
-        analysisProfile: session === undefined ? undefined : () => session.analysisProfile(),
-        recordEvidence,
-        recordUnknown,
-    });
-    registerNativeTools(server, analysis, {
-        logger,
-        activeTarget,
-        recordEvidence,
-    });
-    registerArtifactTools(server, analysis, {
-        logger,
-        activeTarget,
-        recordEvidence,
-        ...(permissionAuthority === undefined ? {} : { permissionAuthority }),
-    });
-    registerManagedTools(server, analysis, {
-        logger,
-        activeTarget,
-        recordEvidence,
-        session,
-    });
-    if (session !== undefined)
-        registerManagedWorkflowTools(server, {
-            logger,
-            recordEvidence,
-            recordEvidenceWithUnknown,
-            session,
-            runtime: {
-                policy: options.managedRuntimePolicy ?? {
-                    enabled: false,
-                    roots: [],
-                    executablePath: "/usr/bin/dotnet",
-                },
-                authority: permissionAuthority,
-            },
-        });
-};
-const registerObservationTools = ({ server, session, options, logger, permissionAuthority, recordEvidence, recordEvidenceWithUnknown, }) => {
-    registerBrowserTools(server, {
-        logger,
-        browser: options.browserObservation,
-        permissionAuthority,
-        recordEvidence,
-    });
-    registerBrowserScenarioTool(server, {
-        logger,
-        provider: options.browserScenarioCapture,
-        permissionAuthority,
-        recordEvidence,
-    });
-    registerElectronTools(server, {
-        logger,
-        electron: options.electronObservation,
-        permissionAuthority,
-        recordEvidence,
-    });
-    registerJavaScriptRuntimeObservationTools(server, {
-        logger,
-        runtime: options.javascriptRuntimeObservation,
-        permissionAuthority,
-        recordEvidence,
-    });
-    registerApplicationTools(server, {
-        logger,
-        recordEvidence,
-        recordEvidenceWithUnknown,
-        evidenceLookup: session === undefined
-            ? undefined
-            : (evidenceId) => session.evidenceById(evidenceId),
-        evidenceFilePolicy: options.evidenceFilePolicy ?? {
-            roots: [],
-            maxBytes: 1,
-            maxDepth: 1,
-            maxStringLength: 1,
-            maxNodes: 1,
-        },
-        permissionAuthority,
-        retainCoverageWorkspace: session === undefined
-            ? undefined
-            : (workspace) => {
-                const retained = session.retainReconstructionCoverageWorkspace(workspace);
-                if (retained === "added")
-                    server.sendResourceListChanged();
-                return retained;
-            },
-        replay: {
-            policy: options.javascriptReplayPolicy ?? {
-                enabled: false,
-                roots: [],
-                nodePath: process.execPath,
-                bubblewrapPath: "/usr/bin/bwrap",
-                systemdRunPath: "/usr/bin/systemd-run",
-                systemctlPath: "/usr/bin/systemctl",
-                shellPath: "/usr/bin/bash",
-            },
-            host: options.javascriptReplayHost ?? new SystemJavaScriptReplayHost(),
-            runner: options.javascriptReplayRunner ?? new LinuxJavaScriptReplayRunner(),
-            authority: permissionAuthority,
-        },
-    });
-};
 const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);

package/dist/server/hydrateServerTools.js

@@ -0,0 +1,191 @@
+/**
+ * Install production callbacks on generated lazy tool registrations.
+ */
+export const hydrateServerToolFamily = async ({ kind, server, analysis, session, options, context, }) => {
+    const toolContext = {
+        server,
+        analysis,
+        session,
+        options,
+        logger: context.logger,
+        permissionAuthority: context.permissionAuthority,
+        activeTarget: context.activeTarget,
+        recordEvidence: context.recordEvidence,
+        recordEvidenceWithUnknown: context.recordEvidenceWithUnknown,
+    };
+    switch (kind) {
+        case "official-proxy": {
+            const { registerOfficialTools } = await import("./registerOfficialTools.js");
+            registerOfficialTools(server, analysis, analysisOptions(toolContext));
+            return;
+        }
+        case "enhanced": {
+            const { registerEnhancedTools } = await import("./registerEnhancedTools.js");
+            registerEnhancedTools(server, analysis, enhancedOptions(toolContext));
+            return;
+        }
+        case "native-provider": {
+            const { registerNativeTools } = await import("./registerNativeTools.js");
+            registerNativeTools(server, analysis, evidenceOptions(toolContext));
+            return;
+        }
+        case "artifact-provider": {
+            const { registerArtifactTools } = await import("./registerArtifactTools.js");
+            registerArtifactTools(server, analysis, {
+                ...evidenceOptions(toolContext),
+                ...(context.permissionAuthority === undefined
+                    ? {}
+                    : { permissionAuthority: context.permissionAuthority }),
+            });
+            return;
+        }
+        case "managed-provider": {
+            const { registerManagedTools } = await import("./registerManagedTools.js");
+            registerManagedTools(server, analysis, {
+                ...evidenceOptions(toolContext),
+                session,
+            });
+            return;
+        }
+        case "application":
+            await registerApplicationFamily(toolContext);
+            return;
+        case "browser-provider":
+        case "electron-provider":
+        case "runtime-provider": {
+            await hydrateObservationFamily(kind, toolContext);
+            return;
+        }
+        case "session": {
+            if (session === undefined)
+                throw new TypeError("Session tools require a binary session");
+            const { registerSessionTools } = await import("./registerSessionTools.js");
+            registerSessionTools(server, session, context.logger, {
+                ...options,
+                ...(context.availabilityPolicy === undefined
+                    ? {}
+                    : { availabilityPolicy: context.availabilityPolicy }),
+                ...(context.permissionAuthority === undefined
+                    ? {}
+                    : { permissionAuthority: context.permissionAuthority }),
+                startedAt: context.startedAt,
+                processCaptureElicitation: context.processCaptureElicitation,
+            });
+        }
+    }
+};
+const hydrateObservationFamily = async (kind, context) => {
+    const common = {
+        logger: context.logger,
+        permissionAuthority: context.permissionAuthority,
+        recordEvidence: context.recordEvidence,
+    };
+    if (kind === "browser-provider") {
+        const [{ registerBrowserTools }, { registerBrowserScenarioTool }] = await Promise.all([
+            import("./registerBrowserTools.js"),
+            import("./registerBrowserScenarioTool.js"),
+        ]);
+        registerBrowserTools(context.server, {
+            ...common,
+            browser: context.options.browserObservation,
+        });
+        registerBrowserScenarioTool(context.server, {
+            ...common,
+            provider: context.options.browserScenarioCapture,
+        });
+        return;
+    }
+    if (kind === "electron-provider") {
+        const { registerElectronTools } = await import("./registerElectronTools.js");
+        registerElectronTools(context.server, {
+            ...common,
+            electron: context.options.electronObservation,
+        });
+        return;
+    }
+    const { registerJavaScriptRuntimeObservationTools } = await import("./registerJavaScriptRuntimeObservationTools.js");
+    registerJavaScriptRuntimeObservationTools(context.server, {
+        ...common,
+        runtime: context.options.javascriptRuntimeObservation,
+    });
+};
+const analysisOptions = ({ logger, activeTarget, recordEvidence, session, }) => {
+    const recordUnknown = session === undefined
+        ? undefined
+        : (input) => session.recordUnknown(input);
+    return {
+        logger,
+        activeTarget,
+        recordEvidence,
+        recordUnknown,
+    };
+};
+const enhancedOptions = (context) => ({
+    ...analysisOptions(context),
+    analysisProfile: context.session === undefined
+        ? undefined
+        : () => context.session?.analysisProfile(),
+});
+const evidenceOptions = ({ logger, activeTarget, recordEvidence, }) => ({
+    logger,
+    activeTarget,
+    recordEvidence,
+});
+const registerApplicationFamily = async ({ server, session, options, logger, permissionAuthority, recordEvidence, recordEvidenceWithUnknown, }) => {
+    const [{ registerApplicationTools }, { registerManagedWorkflowTools }, { LinuxJavaScriptReplayRunner }, { SystemJavaScriptReplayHost },] = await Promise.all([
+        import("./registerApplicationTools.js"),
+        import("./registerManagedWorkflowTools.js"),
+        import("../replay/LinuxJavaScriptReplayRunner.js"),
+        import("../replay/SystemJavaScriptReplayHost.js"),
+    ]);
+    if (session !== undefined)
+        registerManagedWorkflowTools(server, {
+            logger,
+            recordEvidence,
+            recordEvidenceWithUnknown,
+            session,
+            runtime: {
+                policy: options.managedRuntimePolicy ?? {
+                    enabled: false,
+                    roots: [],
+                    executablePath: "/usr/bin/dotnet",
+                },
+                authority: permissionAuthority,
+            },
+        });
+    registerApplicationTools(server, {
+        logger,
+        recordEvidence,
+        recordEvidenceWithUnknown,
+        evidenceLookup: session === undefined
+            ? undefined
+            : (evidenceId) => session.evidenceById(evidenceId),
+        evidenceFilePolicy: options.evidenceFilePolicy ?? {
+            roots: [],
+            maxBytes: 1,
+            maxDepth: 1,
+            maxStringLength: 1,
+            maxNodes: 1,
+        },
+        permissionAuthority,
+        retainCoverageWorkspace: session === undefined
+            ? undefined
+            : (workspace) => {
+                return session.retainReconstructionCoverageWorkspace(workspace);
+            },
+        replay: {
+            policy: options.javascriptReplayPolicy ?? {
+                enabled: false,
+                roots: [],
+                nodePath: process.execPath,
+                bubblewrapPath: "/usr/bin/bwrap",
+                systemdRunPath: "/usr/bin/systemd-run",
+                systemctlPath: "/usr/bin/systemctl",
+                shellPath: "/usr/bin/bash",
+            },
+            host: options.javascriptReplayHost ?? new SystemJavaScriptReplayHost(),
+            runner: options.javascriptReplayRunner ?? new LinuxJavaScriptReplayRunner(),
+            authority: permissionAuthority,
+        },
+    });
+};

package/dist/server/registerEnhancedTools.js

@@ -97,6 +97,7 @@ const ENHANCED_INPUT_PARSERS = {
     find_xrefs_to_name: (input) => safeParseToolInput(enhancedInputSchemas.find_xrefs_to_name, input, "find_xrefs_to_name"),
     binary_overview: (input) => safeParseToolInput(enhancedInputSchemas.binary_overview, input, "binary_overview"),
     analyze_function: (input) => safeParseToolInput(enhancedInputSchemas.analyze_function, input, "analyze_function"),
+    inspect_native_api: (input) => safeParseToolInput(enhancedInputSchemas.inspect_native_api, input, "inspect_native_api"),
     trace_feature: (input) => safeParseToolInput(enhancedInputSchemas.trace_feature, input, "trace_feature"),
     find_code_for_string: (input) => safeParseToolInput(enhancedInputSchemas.find_code_for_string, input, "find_code_for_string"),
     trace_call_path: (input) => safeParseToolInput(enhancedInputSchemas.trace_call_path, input, "trace_call_path"),
@@ -121,6 +122,8 @@ const parseEnhancedCall = (name, input) => {
             return mapEnhancedCall(ENHANCED_INPUT_PARSERS.binary_overview(input), (value) => ({ name, input: value }));
         case "analyze_function":
             return mapEnhancedCall(ENHANCED_INPUT_PARSERS.analyze_function(input), (value) => ({ name, input: value }));
+        case "inspect_native_api":
+            return mapEnhancedCall(ENHANCED_INPUT_PARSERS.inspect_native_api(input), (value) => ({ name, input: value }));
         case "trace_feature":
             return mapEnhancedCall(ENHANCED_INPUT_PARSERS.trace_feature(input), (value) => ({ name, input: value }));
         case "find_code_for_string":
@@ -131,7 +134,12 @@ const parseEnhancedCall = (name, input) => {
 };
 const mapEnhancedCall = (parsed, project) => parsed.ok ? ok(project(parsed.value)) : parsed;
 const recordWorkflowUnknowns = ({ name, input, result, evidenceId, recordUnknown, }) => {
-    if (!["trace_feature", "find_code_for_string", "trace_call_path"].includes(name) ||
+    if (![
+        "trace_feature",
+        "find_code_for_string",
+        "trace_call_path",
+        "inspect_native_api",
+    ].includes(name) ||
         input.unknown_registry_approved !== true ||
         recordUnknown === undefined ||
         typeof result !== "object" ||
@@ -146,7 +154,7 @@ const recordWorkflowUnknowns = ({ name, input, result, evidenceId, recordUnknown
             approved: true,
             question,
             severity: "medium",
-            domain: "control-flow",
+            domain: name === "inspect_native_api" ? "native-api" : "control-flow",
             supporting_evidence_ids: [evidenceId],
             contradicting_evidence_ids: [],
             required_authority: "shipped-artifact",
@@ -155,7 +163,9 @@ const recordWorkflowUnknowns = ({ name, input, result, evidenceId, recordUnknown
             recommended_probes: [
                 {
                     operation: name,
-                    rationale: "Continue with a larger bounded budget.",
+                    rationale: name === "inspect_native_api"
+                        ? "Confirm the unsupported boundary with a capable provider or ABI probe."
+                        : "Continue with a larger bounded budget.",
                 },
             ],
             relationships: [],