rea-agents 3.0.0 → 3.2.0

package/dist/server/registerSessionRecordTools.js

@@ -1,9 +1,6 @@
 import { readEvidenceBundle, writeEvidenceBundle, } from "../application/EvidenceBundleFiles.js";
-import { exportEvidenceBundleInputSchema, importEvidenceBundleInputSchema, listUnknownsInputSchema, snapshotEvidenceBundleInputSchema, SESSION_TOOL_CONTRACTS, verifyUnknownResolutionInputSchema, } from "../contracts/toolContracts.js";
-import { AnalysisProtocolError, PermissionRequiredError, } from "../domain/errors.js";
-import { recordUnknownInputSchema, updateUnknownInputSchema, } from "../domain/residualUnknown.js";
-import { err, ok } from "../domain/result.js";
-import { safeParseToolInput } from "./toolInputValidation.js";
+import { SESSION_TOOL_CONTRACTS } from "../contracts/toolContracts.js";
+import { ok } from "../domain/result.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
 import { toCallToolResult } from "./toolResult.js";
 /** Register evidence bundle import and export tools. */
@@ -12,23 +9,10 @@ export const registerEvidenceTools = (registration) => {
     registerImportEvidenceTool(registration);
     registerSnapshotEvidenceTool(registration);
 };
-const registerExportEvidenceTool = ({ server, session, exportContract, filePolicy, permissionAuthority, }) => {
+const registerExportEvidenceTool = ({ server, session, exportContract, }) => {
     server.registerTool(exportContract.name, toolRegistrationOptions(exportContract), async (input) => {
-        const parsedInput = safeParseToolInput(exportEvidenceBundleInputSchema, input, exportContract.name);
-        if (!parsedInput.ok)
-            return toCallToolResult(parsedInput, exportContract);
-        const parsed = parsedInput.value;
         const bundle = session.exportEvidenceBundle();
-        const denied = await authorizeEvidencePath({
-            authority: permissionAuthority,
-            capability: "evidence_write",
-            path: parsed.path,
-            access: "write",
-            operationIdentity: `export_evidence:${parsed.path}`,
-        });
-        if (denied !== undefined)
-            return toCallToolResult(denied, exportContract);
-        const written = await writeEvidenceBundle(bundle, parsed.path, parsed.overwrite, filePolicy);
+        const written = await writeEvidenceBundle(bundle, input.path, input.overwrite);
         return written.ok
             ? toCallToolResult(ok({
                 path: written.value.path,
@@ -40,84 +24,33 @@ const registerExportEvidenceTool = ({ server, session, exportContract, filePolic
     });
 };
 const registerSnapshotEvidenceTool = ({ server, session, snapshotContract, }) => {
-    server.registerTool(snapshotContract.name, toolRegistrationOptions(snapshotContract), (input) => {
-        const parsed = safeParseToolInput(snapshotEvidenceBundleInputSchema, input, snapshotContract.name);
-        if (!parsed.ok)
-            return toCallToolResult(parsed, snapshotContract);
-        const snapshot = session.snapshotEvidenceBundle();
-        if (!snapshot.ok)
-            return toCallToolResult(snapshot, snapshotContract);
-        const value = {
-            bundle_digest: snapshot.value.bundleDigest,
-            bundle_version: snapshot.value.bundleVersion,
-            bytes: snapshot.value.bytes,
-            records: snapshot.value.records,
-            unknowns: snapshot.value.unknowns,
-            bundle_uri: snapshot.value.uri,
-        };
-        return toCallToolResult(ok(value), snapshotContract, {
-            resourceLinks: [
-                {
-                    uri: snapshot.value.uri,
-                    name: snapshot.value.bundleDigest,
-                    description: "Immutable session-retained Evidence v2 bundle",
-                },
-            ],
-        });
-    });
+    server.registerTool(snapshotContract.name, toolRegistrationOptions(snapshotContract), () => toCallToolResult(ok(session.exportEvidenceBundle()), snapshotContract));
 };
-const registerImportEvidenceTool = ({ server, session, importContract, filePolicy, permissionAuthority, }) => {
+const registerImportEvidenceTool = ({ server, session, importContract, }) => {
     server.registerTool(importContract.name, toolRegistrationOptions(importContract), async (input) => {
-        const parsedInput = safeParseToolInput(importEvidenceBundleInputSchema, input, importContract.name);
-        if (!parsedInput.ok)
-            return toCallToolResult(parsedInput, importContract);
-        const path = parsedInput.value.path;
-        const denied = await authorizeEvidencePath({
-            authority: permissionAuthority,
-            capability: "evidence_read",
-            path,
-            access: "read",
-            operationIdentity: `import_evidence:${path}`,
-        });
-        if (denied !== undefined)
-            return toCallToolResult(denied, importContract);
-        const loaded = await readEvidenceBundle(path, filePolicy);
+        const path = input.path;
+        const loaded = await readEvidenceBundle(path);
         if (!loaded.ok)
             return toCallToolResult(loaded, importContract);
+        const retainedUnknownRevisions = new Set(session
+            .exportEvidenceBundle()
+            .unknowns.map((unknown) => unknownRevisionKey(unknown)));
         const imported = session.importEvidenceBundle(loaded.value);
         return imported.ok
             ? toCallToolResult(ok({
                 imported: imported.value,
+                unknowns_added: loaded.value.unknowns.filter((unknown) => !retainedUnknownRevisions.has(unknownRevisionKey(unknown))).length,
                 total: session.exportEvidenceBundle().records.length,
             }), importContract)
             : toCallToolResult(imported, importContract);
     });
 };
-const authorizeEvidencePath = async (input) => {
-    if (input.authority === undefined)
-        return undefined;
-    const authorized = await input.authority.authorize({
-        capability: input.capability,
-        roots: [input.path],
-        executables: [],
-        environment_names: [],
-        network: "none",
-        mount: false,
-        operation_identity: input.operationIdentity,
-    }, input.access);
-    return authorized.ok ? undefined : permissionFailure(authorized);
-};
+const unknownRevisionKey = (unknown) => `${unknown.unknown_id}:${String(unknown.revision)}`;
 /** Register residual-unknown query and mutation tools. */
-export const registerUnknownTools = ({ server, session, contracts, }) => {
+const registerListUnknownsTool = ({ server, session, contracts, }) => {
     const listContract = contracts[14];
-    const recordContract = contracts[15];
-    const updateContract = contracts[16];
-    const verifyContract = contracts[17];
     server.registerTool(listContract.name, toolRegistrationOptions(listContract), (input) => {
-        const parsed = safeParseToolInput(listUnknownsInputSchema, input, listContract.name);
-        if (!parsed.ok)
-            return toCallToolResult(parsed, listContract);
-        const filters = parsed.value;
+        const filters = input;
         const all = session.listUnknowns({
             ...(filters.status === undefined ? {} : { status: filters.status }),
             ...(filters.severity === undefined
@@ -125,83 +58,33 @@ export const registerUnknownTools = ({ server, session, contracts, }) => {
                 : { severity: filters.severity }),
             ...(filters.domain === undefined ? {} : { domain: filters.domain }),
         });
-        const items = all
-            .slice(filters.offset, filters.offset + filters.limit)
-            .map((unknown) => ({
-            unknown,
-            uri: `rea://unknown/${unknown.unknown_id}`,
-        }));
-        const nextOffset = filters.offset + items.length < all.length
-            ? filters.offset + items.length
-            : null;
         return toCallToolResult(ok({
-            items,
-            offset: filters.offset,
-            limit: filters.limit,
+            items: all,
             total: all.length,
-            next_offset: nextOffset,
-            has_more: nextOffset !== null,
-        }), listContract, {
-            resourceLinks: items.map((unknown) => ({
-                uri: unknown.uri,
-                name: unknown.unknown.unknown_id,
-                description: `Current ${unknown.unknown.status} residual unknown revision`,
-            })),
-        });
+        }), listContract);
     });
+};
+const registerRecordUnknownTool = ({ server, session, contracts, }) => {
+    const recordContract = contracts[15];
     server.registerTool(recordContract.name, toolRegistrationOptions(recordContract), (input) => {
-        const parsed = safeParseToolInput(recordUnknownInputSchema, input, recordContract.name);
-        if (!parsed.ok)
-            return toCallToolResult(parsed, recordContract);
-        const result = session.recordUnknown(parsed.value);
-        return result.ok
-            ? toCallToolResult(result, recordContract, {
-                resourceLinks: [
-                    {
-                        uri: `rea://unknown/${result.value.unknown_id}`,
-                        name: result.value.unknown_id,
-                        description: "Current residual unknown head",
-                    },
-                ],
-            })
-            : toCallToolResult(result, recordContract);
+        const result = session.recordUnknown(input);
+        return toCallToolResult(result, recordContract);
     });
+};
+const registerUpdateUnknownTool = ({ server, session, contracts, }) => {
+    const updateContract = contracts[16];
     server.registerTool(updateContract.name, toolRegistrationOptions(updateContract), (input) => {
-        const parsed = safeParseToolInput(updateUnknownInputSchema, input, updateContract.name);
-        if (!parsed.ok)
-            return toCallToolResult(parsed, updateContract);
-        const result = session.updateUnknown(parsed.value);
-        if (result.ok)
-            void server.server
-                .sendResourceUpdated({
-                uri: `rea://unknown/${result.value.unknown_id}`,
-            })
-                .catch(() => undefined);
-        return result.ok
-            ? toCallToolResult(result, updateContract, {
-                resourceLinks: [
-                    {
-                        uri: `rea://unknown/${result.value.unknown_id}`,
-                        name: result.value.unknown_id,
-                        description: "Updated residual unknown head",
-                    },
-                ],
-            })
-            : toCallToolResult(result, updateContract);
-    });
-    server.registerTool(verifyContract.name, toolRegistrationOptions(verifyContract), (input) => {
-        const parsed = safeParseToolInput(verifyUnknownResolutionInputSchema, input, verifyContract.name);
-        return parsed.ok
-            ? toCallToolResult(session.verifyUnknownResolution(parsed.value.unknown_id), verifyContract)
-            : toCallToolResult(parsed, verifyContract);
+        const result = session.updateUnknown(input);
+        return toCallToolResult(result, updateContract);
     });
 };
-const permissionFailure = (failure) => {
-    if (failure.ok)
-        return err(new AnalysisProtocolError("Expected a denied permission"));
-    return err(failure.error instanceof PermissionRequiredError
-        ? failure.error
-        : new AnalysisProtocolError(failure.error.message, {
-            cause: failure.error,
-        }));
+const registerVerifyUnknownTool = ({ server, session, contracts, }) => {
+    const verifyContract = contracts[17];
+    server.registerTool(verifyContract.name, toolRegistrationOptions(verifyContract), (input) => toCallToolResult(session.verifyUnknownResolution(input.unknown_id), verifyContract));
+};
+export const registerUnknownTools = (registration) => {
+    registerListUnknownsTool(registration);
+    registerRecordUnknownTool(registration);
+    registerUpdateUnknownTool(registration);
+    registerVerifyUnknownTool(registration);
 };

package/dist/server/registerSessionStatusTool.js

@@ -1,53 +1,37 @@
-import { binarySessionInputSchema, SESSION_TOOL_CONTRACTS, } from "../contracts/toolContracts.js";
-import { toCallToolResult } from "./toolResult.js";
+import { buildCapabilityInventory } from "../application/CapabilityInventory.js";
+import { SESSION_TOOL_CONTRACTS } from "../contracts/toolContracts.js";
 import { jsonObjectSchema } from "../domain/jsonValue.js";
 import { createServerIdentity } from "../serverIdentity.js";
-import { buildCapabilityInventory } from "../application/CapabilityInventory.js";
+import { mcpClientMetadata } from "./mcpClientMetadata.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
-import { safeParseToolInput } from "./toolInputValidation.js";
+import { toCallToolResult } from "./toolResult.js";
 /** Register the read-only provider and target status operation. */
 export const registerSessionStatusTool = (options) => {
     const { server, session, contract, startedAt, availabilityPolicy } = options;
-    server.registerTool(contract.name, toolRegistrationOptions(contract), (input) => {
-        const parsedInput = safeParseToolInput(binarySessionInputSchema, input, contract.name);
-        if (!parsedInput.ok)
-            return toCallToolResult(parsedInput, contract);
-        const parsed = parsedInput.value;
-        const client = server.server.getClientVersion();
-        const clientCapabilities = server.server.getClientCapabilities();
-        const clientFeatures = {
-            elicitation_form: clientCapabilities?.elicitation?.form !== undefined,
-            elicitation_url: clientCapabilities?.elicitation?.url !== undefined,
-            roots: clientCapabilities?.roots !== undefined,
-            sampling: clientCapabilities?.sampling !== undefined,
-        };
+    server.registerTool(contract.name, toolRegistrationOptions(contract), (input, context) => {
+        const { client, clientFeatures, protocolVersion } = mcpClientMetadata(context);
         const status = session.status();
         const statusObject = jsonObjectSchema.parse(status);
         const toolAvailability = buildCapabilityInventory(status, availabilityPolicy(), clientFeatures);
         const serverIdentity = createServerIdentity({
             startedAt,
             expected: {
-                ...(parsed.expected_package_version === undefined
+                ...(input.expected_package_version === undefined
                     ? {}
-                    : { package_version: parsed.expected_package_version }),
-                ...(parsed.expected_catalog_digest === undefined
+                    : { package_version: input.expected_package_version }),
+                ...(input.expected_catalog_digest === undefined
                     ? {}
-                    : { catalog_digest: parsed.expected_catalog_digest }),
-                ...(parsed.expected_server_path === undefined
+                    : { catalog_digest: input.expected_catalog_digest }),
+                ...(input.expected_server_path === undefined
                     ? {}
-                    : { server_path: parsed.expected_server_path }),
+                    : { server_path: input.expected_server_path }),
             },
             ...(client === undefined ? {} : { client }),
-            ...(server.server.getNegotiatedProtocolVersion() === undefined
-                ? {}
-                : {
-                    protocolVersion: server.server.getNegotiatedProtocolVersion(),
-                }),
+            ...(protocolVersion === undefined ? {} : { protocolVersion }),
         });
         return toCallToolResult({
             ok: true,
             value: projectSessionStatus({
-                input: parsed,
                 status: statusObject,
                 toolAvailability,
                 serverIdentity,
@@ -56,71 +40,9 @@ export const registerSessionStatusTool = (options) => {
         }, contract);
     });
 };
-const projectSessionStatus = (options) => {
-    if (options.input.detail === "full")
-        return jsonObjectSchema.parse({
-            view: "full",
-            ...options.status,
-            tool_availability: options.toolAvailability,
-            client_features: options.clientFeatures,
-            server_identity: options.serverIdentity,
-        });
-    const open = options.status.open === true;
-    const activeProvider = activeProviderFrom(options.status);
-    if (options.input.detail === "capabilities") {
-        const filtered = options.input.capability_family === undefined
-            ? options.toolAvailability
-            : options.toolAvailability.filter(({ surface }) => surface === options.input.capability_family);
-        const items = filtered.slice(options.input.cursor, options.input.cursor + options.input.limit);
-        const nextCursor = options.input.cursor + items.length;
-        return jsonObjectSchema.parse({
-            view: "capabilities",
-            open,
-            provider: options.status.provider,
-            active_provider: activeProvider,
-            capability_family: options.input.capability_family ?? null,
-            capabilities: {
-                items,
-                cursor: options.input.cursor,
-                limit: options.input.limit,
-                total: filtered.length,
-                next_cursor: nextCursor < filtered.length ? nextCursor : null,
-                has_more: nextCursor < filtered.length,
-            },
-            client_features: options.clientFeatures,
-        });
-    }
-    return jsonObjectSchema.parse({
-        view: "summary",
-        open,
-        provider: options.status.provider,
-        active_provider: activeProvider,
-        target: open ? targetFrom(options.status) : null,
-        alignment: options.serverIdentity.alignment,
-        analysis_activity: options.status.analysis_activity,
-        recommended_actions: recommendedActions(open, options.serverIdentity.alignment.state),
-    });
-};
-const activeProviderFrom = (status) => {
-    const binding = jsonObjectSchema.safeParse(status.analysis_provider_binding);
-    return binding.success ? (binding.data.provider ?? null) : null;
-};
-const targetFrom = (status) => ({
-    path: status.path,
-    format: status.format,
-    kind: status.kind,
-    sha256: status.sha256,
-    architecture: status.architecture ?? null,
+const projectSessionStatus = (options) => jsonObjectSchema.parse({
+    ...options.status,
+    tool_availability: options.toolAvailability,
+    client_features: options.clientFeatures,
+    server_identity: options.serverIdentity,
 });
-const recommendedActions = (open, alignment) => [
-    ...(alignment === "mcp_server_restart_required"
-        ? ["Restart the registered MCP server or client before continuing."]
-        : []),
-    ...(!open
-        ? [
-            "For a supplied target, route by format: ASAR/JavaScript to analyze_javascript_application; archive/package to open_binary(path), then inspect_artifact or inventory_artifact on the active target; managed PE/CLI to inspect_managed_artifact; browser/Electron runtimes to their list-target tools; native binaries to open_binary.",
-        ]
-        : [
-            "Continue from the active target with binary_overview or a bounded target-specific query.",
-        ]),
-];

package/dist/server/registerSessionTools.js

@@ -1,39 +1,33 @@
 import { z } from "zod";
-import { addressContextInputSchema, navigationContextInputSchema, SESSION_TOOL_CONTRACTS, } from "../contracts/toolContracts.js";
-import { toCallToolResult } from "./toolResult.js";
-import { logToolExecution } from "./toolLogging.js";
-import { ok } from "../domain/result.js";
-import { processScenarioSchema } from "../domain/processCapture.js";
-import { captureProcessScenario } from "../application/ProcessHarness.js";
-import { processCapturePermissionRequest } from "../application/ProcessCapturePermission.js";
+import { isInputRequiredResult } from "@modelcontextprotocol/server";
+import { getNavigationContext, inspectAddressContext, } from "../application/AnalysisContextQueries.js";
 import { readAnalysisSnapshot } from "../application/AnalysisSnapshotFiles.js";
-import { UnknownRegistryError } from "../domain/errors.js";
-import { DENY_EVIDENCE_FILE_POLICY, DENY_PROCESS_POLICY, } from "./sessionToolPolicies.js";
+import { processCapturePermissionRequest } from "../application/ProcessCapturePermission.js";
 import { createProcessCaptureEvidence } from "../application/ProcessEvidence.js";
-import { registerProcessComparisonTool } from "./registerProcessComparisonTool.js";
+import { captureProcessScenario } from "../application/ProcessHarness.js";
+import { SESSION_TOOL_CONTRACTS } from "../contracts/toolContracts.js";
+import { UnknownRegistryError } from "../domain/errors.js";
+import { err, ok } from "../domain/result.js";
+import { projectPermissionFailure } from "../application/PermissionFailure.js";
+import { mcpProgressReporter } from "./mcpProgress.js";
+import { authorizeProcessCaptureWithElicitation, } from "./ProcessCaptureElicitation.js";
 import { registerArtifactComparisonTool } from "./registerArtifactComparisonTool.js";
-import { registerFunctionComparisonTool } from "./registerFunctionComparisonTool.js";
-import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
-import { safeParseToolInput } from "./toolInputValidation.js";
 import { registerBundleComparisonTool } from "./registerBundleComparisonTool.js";
+import { registerCloseLifecycleTool } from "./registerCloseLifecycleTool.js";
+import { registerFunctionComparisonTool } from "./registerFunctionComparisonTool.js";
 import { registerInvestigationTools } from "./registerInvestigationTools.js";
-import { openBinaryInputSchema } from "../contracts/sessionLifecycleInputs.js";
-import { registerSessionStatusTool } from "./registerSessionStatusTool.js";
-import { mcpProgressReporter } from "./mcpProgress.js";
-import { authorizeProcessCaptureWithElicitation, } from "./ProcessCaptureElicitation.js";
-import { isInputRequiredResult } from "@modelcontextprotocol/server";
-import { registerEvidenceTools, registerUnknownTools, } from "./registerSessionRecordTools.js";
+import { registerProcessComparisonTool } from "./registerProcessComparisonTool.js";
 import { registerReplayMachineTool } from "./registerReplayMachineTool.js";
+import { registerEvidenceTools, registerUnknownTools, } from "./registerSessionRecordTools.js";
+import { registerSessionStatusTool } from "./registerSessionStatusTool.js";
 import { sessionAvailabilityPolicy, } from "./sessionAvailabilityPolicy.js";
-import { permissionFailure } from "./permissionFailure.js";
-import { registerCloseLifecycleTool } from "./registerCloseLifecycleTool.js";
-import { getNavigationContext, inspectAddressContext, } from "../application/AnalysisContextQueries.js";
+import { DENY_PROCESS_POLICY } from "./sessionToolPolicies.js";
+import { logToolExecution } from "./toolLogging.js";
+import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
+import { toCallToolResult } from "./toolResult.js";
 const recordProcessResidualUnknowns = (session, scenario, evidence, residuals) => {
-    if (scenario.unknown_registry_approved !== true)
-        return ok(null);
     for (const residual of residuals) {
         const unknown = session.recordUnknown({
-            approved: true,
             question: `Was ${residual.scope} behavior fully observed during capture?`,
             severity: "medium",
             domain: `process-${residual.scope}`,
@@ -59,10 +53,7 @@ const recordProcessResidualUnknowns = (session, scenario, evidence, residuals) =
 };
 const registerProcessTools = ({ server, session, logger, processPolicy, captureContract, permissionAuthority, processCaptureElicitation, }) => {
     server.registerTool(captureContract.name, toolRegistrationOptions(captureContract), async (input, context) => {
-        const parsedInput = safeParseToolInput(processScenarioSchema, input, captureContract.name);
-        if (!parsedInput.ok)
-            return toCallToolResult(parsedInput, captureContract);
-        const scenario = parsedInput.value;
+        const scenario = input;
         if (permissionAuthority !== undefined) {
             const request = processCapturePermissionRequest(scenario);
             const authorized = processCaptureElicitation === undefined
@@ -71,7 +62,7 @@ const registerProcessTools = ({ server, session, logger, processPolicy, captureC
             if (isInputRequiredResult(authorized))
                 return authorized;
             if (!authorized.ok)
-                return toCallToolResult(permissionFailure(authorized), captureContract);
+                return toCallToolResult(err(projectPermissionFailure(authorized.error)), captureContract);
         }
         const progress = mcpProgressReporter(context);
         await progress.report({
@@ -80,7 +71,7 @@ const registerProcessTools = ({ server, session, logger, processPolicy, captureC
             total: 1,
             message: "started",
         });
-        const captured = await logToolExecution(logger, captureContract.name, () => captureProcessScenario(scenario, processPolicy, context.mcpReq.signal));
+        const captured = await logToolExecution(logger, captureContract.name, () => captureProcessScenario(scenario, processPolicy(), context.mcpReq.signal));
         await progress.report({
             phase: captureContract.name,
             completed: 1,
@@ -112,41 +103,22 @@ const registerLifecycleTools = (registration) => {
         availabilityPolicy,
     });
 };
-const registerOpenLifecycleTool = ({ server, session, logger, contracts: [openContract], snapshotFilePolicy, permissionAuthority, }) => {
+const registerOpenLifecycleTool = ({ server, session, logger, contracts: [openContract], }) => {
     server.registerTool(openContract.name, toolRegistrationOptions(openContract), async (input, context) => {
-        const parsedInput = safeParseToolInput(openBinaryInputSchema, input, openContract.name);
-        if (!parsedInput.ok)
-            return toCallToolResult(parsedInput, openContract);
-        const parsed = parsedInput.value;
         let snapshot;
-        if (parsed.snapshot_path !== undefined) {
-            if (permissionAuthority !== undefined) {
-                const authorized = await permissionAuthority.authorize({
-                    capability: "snapshot_read",
-                    roots: [parsed.snapshot_path],
-                    executables: [],
-                    environment_names: [],
-                    network: "none",
-                    mount: false,
-                    operation_identity: `open_binary:snapshot:${parsed.snapshot_path}`,
-                }, "read");
-                if (!authorized.ok)
-                    return toCallToolResult(permissionFailure(authorized), openContract);
-            }
-            const loaded = await readAnalysisSnapshot(parsed.snapshot_path, snapshotFilePolicy);
+        if (input.snapshot_path !== undefined) {
+            const loaded = await readAnalysisSnapshot(input.snapshot_path);
             if (!loaded.ok)
                 return toCallToolResult(loaded, openContract);
             snapshot = loaded.value;
         }
-        const opened = await logToolExecution(logger, openContract.name, () => session.open(parsed.path, {
+        const opened = await logToolExecution(logger, openContract.name, () => session.open(input.path, {
             signal: context.mcpReq.signal,
-            ...(parsed.provider_id === undefined
+            ...(input.provider_id === undefined
                 ? {}
-                : { providerId: parsed.provider_id }),
+                : { providerId: input.provider_id }),
             ...(snapshot === undefined ? {} : { snapshot }),
         }));
-        if (opened.ok)
-            server.sendToolListChanged();
         return opened.ok
             ? toCallToolResult({
                 ok: true,
@@ -176,22 +148,14 @@ const registerContextTools = (server, session) => {
     const navigationContract = SESSION_TOOL_CONTRACTS[20];
     const addressContract = SESSION_TOOL_CONTRACTS[21];
     server.registerTool(navigationContract.name, toolRegistrationOptions(navigationContract), async (input, context) => {
-        const parsed = safeParseToolInput(navigationContextInputSchema, input, navigationContract.name);
-        if (!parsed.ok)
-            return toCallToolResult(parsed, navigationContract);
-        return toCallToolResult(await getNavigationContext(session, parsed.value, context.mcpReq.signal), navigationContract);
+        return toCallToolResult(await getNavigationContext(session, input, context.mcpReq.signal), navigationContract);
     });
     server.registerTool(addressContract.name, toolRegistrationOptions(addressContract), async (input, context) => {
-        const parsed = safeParseToolInput(addressContextInputSchema, input, addressContract.name);
-        if (!parsed.ok)
-            return toCallToolResult(parsed, addressContract);
-        return toCallToolResult(await inspectAddressContext(session, parsed.value, context.mcpReq.signal), addressContract);
+        return toCallToolResult(await inspectAddressContext(session, input, context.mcpReq.signal), addressContract);
     });
 };
 export const registerSessionTools = (server, session, logger, options = {}) => {
-    const processPolicy = options.processPolicy ?? DENY_PROCESS_POLICY;
-    const evidenceFilePolicy = options.evidenceFilePolicy ?? DENY_EVIDENCE_FILE_POLICY;
-    const analysisSnapshotFilePolicy = options.analysisSnapshotFilePolicy ?? DENY_EVIDENCE_FILE_POLICY;
+    const processPolicy = options.processPolicy ?? (() => DENY_PROCESS_POLICY);
     const [openContract, closeContract, statusContract, exportContract, importContract, captureContract, compareContract, compareArtifactsContract, compareFunctionsContract, compareBundlesContract, changedBehaviorContract, callPathContract, staticRuntimeContract, reconstructionContract,] = SESSION_TOOL_CONTRACTS;
     const snapshotContract = SESSION_TOOL_CONTRACTS[19];
     registerLifecycleTools({
@@ -199,16 +163,10 @@ export const registerSessionTools = (server, session, logger, options = {}) => {
         session,
         logger,
         contracts: [openContract, closeContract, statusContract],
-        snapshotFilePolicy: analysisSnapshotFilePolicy,
         startedAt: options.startedAt ?? new Date().toISOString(),
         availabilityPolicy: sessionAvailabilityPolicy(options.availabilityPolicy, {
-            processPolicy,
-            evidenceFilePolicy,
-            investigationInputRoots: options.investigationInputRoots ?? [],
+            processPolicy: processPolicy(),
         }),
-        ...(options.permissionAuthority === undefined
-            ? {}
-            : { permissionAuthority: options.permissionAuthority }),
     });
     registerEvidenceTools({
         server,
@@ -216,10 +174,6 @@ export const registerSessionTools = (server, session, logger, options = {}) => {
         exportContract,
         importContract,
         snapshotContract,
-        filePolicy: evidenceFilePolicy,
-        ...(options.permissionAuthority === undefined
-            ? {}
-            : { permissionAuthority: options.permissionAuthority }),
     });
     registerProcessTools({
         server,
@@ -237,25 +191,14 @@ export const registerSessionTools = (server, session, logger, options = {}) => {
     registerProcessComparisonTool(server, session, compareContract);
     registerArtifactComparisonTool(server, session, compareArtifactsContract);
     registerFunctionComparisonTool(server, session, compareFunctionsContract);
-    registerBundleComparisonTool(server, session, compareBundlesContract, evidenceFilePolicy);
+    registerBundleComparisonTool(server, session, compareBundlesContract);
     const investigationContracts = [
         changedBehaviorContract,
         callPathContract,
         staticRuntimeContract,
         reconstructionContract,
     ];
-    registerInvestigationTools(server, session, investigationContracts, {
-        evidenceFiles: evidenceFilePolicy,
-        inputRoots: options.investigationInputRoots ?? [],
-        ...(options.artifactIntegrityContinueEnabled === undefined
-            ? {}
-            : {
-                integrityContinueEnabled: options.artifactIntegrityContinueEnabled,
-            }),
-        ...(options.permissionAuthority === undefined
-            ? {}
-            : { permissionAuthority: options.permissionAuthority }),
-    });
+    registerInvestigationTools(server, session, investigationContracts);
     registerRecordAndReplayTools(server, session, logger);
     registerContextTools(server, session);
 };

package/dist/server/sessionAvailabilityPolicy.js

@@ -1,12 +1,11 @@
 /** Select configured availability reporting or the target-free defaults. */
 export const sessionAvailabilityPolicy = (configured, defaults) => configured ??
     (() => ({
-        processCaptureEnabled: defaults.processPolicy.enabled,
-        evidenceFileRoots: defaults.evidenceFilePolicy.roots.length,
-        investigationInputRoots: defaults.investigationInputRoots.length,
+        processCaptureEnabled: defaults.processPolicy.status === "enabled",
         browserObservationEnabled: defaults.optionalFeatures?.browserObservationEnabled ?? false,
         browserScenarioEnabled: defaults.optionalFeatures?.browserScenarioEnabled ?? false,
         electronObservationEnabled: defaults.optionalFeatures?.electronObservationEnabled ?? false,
+        electronAutomationEnabled: defaults.optionalFeatures?.electronAutomationEnabled ?? false,
         v8InspectorObservationEnabled: defaults.optionalFeatures?.v8InspectorObservationEnabled ?? false,
         javascriptReplayEnabled: defaults.optionalFeatures?.javascriptReplayEnabled ?? false,
         managedRuntimeEnabled: defaults.optionalFeatures?.managedRuntimeEnabled ?? false,

package/dist/server/sessionEvidence.js

@@ -1,17 +1,11 @@
-import { EvidenceIntegrityError, EvidenceReferenceError, } from "../domain/errors.js";
-import { err, ok } from "../domain/result.js";
-/** Resolve bounded IDs to authoritative records with exact semantic identity. */
-export const resolveSessionEvidenceIds = (session, evidenceIds, expected) => {
-    const records = [];
-    for (const evidenceId of evidenceIds) {
-        const record = session.evidenceById(evidenceId);
-        if (record === undefined)
-            return err(new EvidenceReferenceError(evidenceId, "missing", expected.operation, null));
-        if (record.operation !== expected.operation)
-            return err(new EvidenceReferenceError(evidenceId, "wrong_operation", expected.operation, record.operation));
-        if (record.predicate_type !== expected.predicate)
-            return err(new EvidenceReferenceError(evidenceId, "wrong_predicate", expected.predicate, record.predicate_type));
-        records.push(record);
+import { EvidenceIntegrityError } from "../domain/errors.js";
+import { ok } from "../domain/result.js";
+/** Record source evidence in order, stopping at the first session rejection. */
+export const recordSessionEvidenceSources = (recordEvidence, sources) => {
+    for (const source of sources) {
+        const recorded = recordEvidence?.(source);
+        if (recorded !== undefined && !recorded.ok)
+            return recorded;
     }
-    return ok(records);
+    return ok(null);
 };