rea-agents 3.1.0 → 3.2.1

package/dist/replay/SystemJavaScriptReplayHost.js

@@ -1,13 +1,38 @@
+import { temporaryFilterHandle } from "./ReplaySeccompFile.js";
 import { constants } from "node:fs";
-import { mkdtemp, open, readFile, realpath, rm, stat, writeFile, } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { open, readFile, realpath, stat } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
 import { spawn } from "node:child_process";
 import { digestBytes } from "../application/JavaScriptReplayPlanning.js";
-import { buildLinuxX64ReplaySeccomp, linuxX64ReplaySeccompDigest, } from "./LinuxSeccompPolicy.js";
+import { linuxX64ReplaySeccompDigest } from "./LinuxSeccompPolicy.js";
 import { resolveLinuxRuntimeClosure } from "./LinuxRuntimeClosure.js";
-const VERSION_OUTPUT_LIMIT = 16 * 1024;
+import { readBoundedFileBytes } from "../process/BoundedFileBytes.js";
+const bubblewrapProbeArguments = (command) => [
+    "--unshare-all",
+    "--unshare-user",
+    "--disable-userns",
+    "--new-session",
+    "--die-with-parent",
+    "--cap-drop",
+    "ALL",
+    "--ro-bind",
+    "/usr",
+    "/usr",
+    "--ro-bind",
+    "/lib",
+    "/lib",
+    "--ro-bind-try",
+    "/lib64",
+    "/lib64",
+    "--proc",
+    "/proc",
+    "--dev",
+    "/dev",
+    "--seccomp",
+    "3",
+    "--",
+    ...command,
+];
 /** Production planning host for descriptor-backed reads and fail-closed probes. */
 export class SystemJavaScriptReplayHost {
     async readSource(path, maximumBytes) {
@@ -17,7 +42,9 @@ export class SystemJavaScriptReplayHost {
             const metadata = await handle.stat();
             if (!metadata.isFile() || metadata.size > maximumBytes)
                 throw new RangeError(`Replay source exceeds its declared limit: ${canonicalPath}`);
-            const bytes = await handle.readFile();
+            const bytes = await readBoundedFileBytes(handle, maximumBytes);
+            if (bytes === undefined)
+                throw new RangeError(`Replay source exceeds its declared limit: ${canonicalPath}`);
             return { canonicalPath, bytes };
         }
         finally {
@@ -31,7 +58,7 @@ export class SystemJavaScriptReplayHost {
             throw new TypeError(`Replay executable is not a file: ${canonicalPath}`);
         const [bytes, version] = await Promise.all([
             readFile(canonicalPath),
-            capture(canonicalPath, versionArguments, VERSION_OUTPUT_LIMIT),
+            capture(canonicalPath, versionArguments),
         ]);
         return {
             path: canonicalPath,
@@ -57,65 +84,14 @@ export class SystemJavaScriptReplayHost {
         if ((await readFile("/sys/fs/cgroup/cgroup.controllers", "utf8")).trim()
             .length === 0)
             throw new TypeError("Controlled replay requires delegated cgroup v2");
-        const directory = await mkdtemp(join(tmpdir(), "rea-replay-probe-"));
-        const filterPath = join(directory, "seccomp.bpf");
-        await writeFile(filterPath, buildLinuxX64ReplaySeccomp(), { mode: 0o600 });
-        const filter = await open(filterPath, "r");
+        const filter = await temporaryFilterHandle();
         try {
-            await run(policy.bubblewrapPath, [
-                "--unshare-all",
-                "--unshare-user",
-                "--disable-userns",
-                "--new-session",
-                "--die-with-parent",
-                "--cap-drop",
-                "ALL",
-                "--ro-bind",
-                "/usr",
-                "/usr",
-                "--ro-bind",
-                "/lib",
-                "/lib",
-                "--ro-bind-try",
-                "/lib64",
-                "/lib64",
-                "--proc",
-                "/proc",
-                "--dev",
-                "/dev",
-                "--seccomp",
-                "3",
-                "--",
-                "/usr/bin/true",
-            ], ["ignore", "pipe", "pipe", filter.fd]);
-            await runExpectFailure(policy.bubblewrapPath, [
-                "--unshare-all",
-                "--unshare-user",
-                "--disable-userns",
-                "--new-session",
-                "--die-with-parent",
-                "--cap-drop",
-                "ALL",
-                "--ro-bind",
-                "/usr",
-                "/usr",
-                "--ro-bind",
-                "/lib",
-                "/lib",
-                "--ro-bind-try",
-                "/lib64",
-                "/lib64",
-                "--proc",
-                "/proc",
-                "--dev",
-                "/dev",
-                "--seccomp",
-                "3",
-                "--",
+            await run(policy.bubblewrapPath, bubblewrapProbeArguments(["/usr/bin/true"]), ["ignore", "pipe", "pipe", filter.handle.fd]);
+            await runExpectFailure(policy.bubblewrapPath, bubblewrapProbeArguments([
                 "/usr/bin/unshare",
                 "--mount",
                 "/usr/bin/true",
-            ], ["ignore", "pipe", "pipe", filter.fd]);
+            ]), ["ignore", "pipe", "pipe", filter.handle.fd]);
             await run(policy.systemdRunPath, [
                 "--user",
                 "--pipe",
@@ -131,45 +107,40 @@ export class SystemJavaScriptReplayHost {
         }
         finally {
             await filter.close();
-            await rm(directory, { recursive: true, force: true });
         }
     }
 }
-const capture = async (executable, arguments_, maximumBytes) => {
+const capture = async (executable, arguments_) => {
     if (arguments_.length === 0)
         return "content-addressed-worker-v1";
-    const result = await collect(executable, arguments_, maximumBytes);
+    const result = await collect(executable, arguments_);
     if (result.code !== 0)
         throw new TypeError(`Replay executable probe failed: ${executable}`);
     return result.stdout.length > 0 ? result.stdout : result.stderr;
 };
 const run = async (executable, arguments_, stdio) => {
-    const result = await collect(executable, arguments_, VERSION_OUTPUT_LIMIT, stdio);
+    const result = await collect(executable, arguments_, stdio);
     if (result.code !== 0)
         throw new TypeError(`Replay feature probe failed (${String(result.code)}): ${executable}: ${result.stderr.trim()}`);
 };
 const runExpectFailure = async (executable, arguments_, stdio) => {
-    const result = await collect(executable, arguments_, VERSION_OUTPUT_LIMIT, stdio);
+    const result = await collect(executable, arguments_, stdio);
     if (result.code === 0)
         throw new TypeError(`Replay denial probe unexpectedly succeeded: ${executable}`);
 };
-const collect = async (executable, arguments_, maximumBytes, stdio = ["ignore", "pipe", "pipe"]) => new Promise((resolve, reject) => {
+const collect = async (executable, arguments_, stdio = ["ignore", "pipe", "pipe"]) => new Promise((resolve, reject) => {
     const child = spawn(executable, [...arguments_], { stdio });
     const timeout = setTimeout(() => child.kill("SIGKILL"), 5_000);
     timeout.unref();
     let stdout = "";
     let stderr = "";
-    const retain = (current, chunk) => {
-        const remaining = Math.max(0, maximumBytes - Buffer.byteLength(current));
-        return current + chunk.subarray(0, remaining).toString("utf8");
-    };
     if (child.stdout !== null)
         child.stdout.on("data", (chunk) => {
-            stdout = retain(stdout, chunk);
+            stdout += chunk.toString("utf8");
         });
     if (child.stderr !== null)
         child.stderr.on("data", (chunk) => {
-            stderr = retain(stderr, chunk);
+            stderr += chunk.toString("utf8");
         });
     child.once("error", (error) => {
         clearTimeout(timeout);

package/dist/server/ProcessCaptureElicitation.js

@@ -4,7 +4,6 @@ import { z } from "zod";
 import { PermissionRequiredError } from "../domain/errors.js";
 import { isPermissionRequestWithinCeiling, } from "../domain/permissionPolicy.js";
 const RESPONSE_KEY = "process_capture_grant";
-const STATE_VERSION = 1;
 /** Shared continuation, replay, and round limits for process capture consent. */
 export const PROCESS_CAPTURE_ELICITATION_POLICY = {
     protocolVersions: ["2026-07-28"],
@@ -22,7 +21,6 @@ const grantResponseJsonSchema = { ...z.toJSONSchema(grantResponseSchema) };
 Reflect.deleteProperty(grantResponseJsonSchema, "$schema");
 Reflect.deleteProperty(grantResponseJsonSchema, "additionalProperties");
 const stateSchema = z.strictObject({
-    version: z.literal(STATE_VERSION),
     nonce: z.string().uuid(),
     request: z.strictObject({
         capability: z.literal("process_capture"),
@@ -37,14 +35,13 @@ const stateSchema = z.strictObject({
 });
 /** Authorize capture or return a signed MCP input-required continuation. */
 export const authorizeProcessCaptureWithElicitation = async (authority, request, context, elicitation) => {
-    const supported = elicitation.supported(context);
     const initial = await authority.authorize(request, "read", {
-        elicitationSupported: supported,
+        remediation: elicitation.supported(context) ? "elicit" : "configure",
     });
     if (initial.ok || !(initial.error instanceof PermissionRequiredError))
         return initial;
     const denied = initial.error;
-    if (!supported ||
+    if (denied.remediation !== "elicit" ||
         denied.requested.capability !== "process_capture" ||
         denied.ceiling === null ||
         !isPermissionRequestWithinCeiling(denied.requested, denied.ceiling))
@@ -70,7 +67,6 @@ export const authorizeProcessCaptureWithElicitation = async (authority, request,
             return initial;
     }
     const state = await elicitation.stateCodec.mint({
-        version: STATE_VERSION,
         nonce: randomUUID(),
         request: {
             capability: "process_capture",
@@ -106,12 +102,12 @@ const grantAndAuthorize = async (authority, request, lifetime) => {
     const granted = authority.grant(grant);
     if (!granted.ok)
         return authority.authorize(request, "read", {
-            elicitationSupported: true,
+            remediation: "elicit",
         });
     let authorized;
     try {
         authorized = await authority.authorize(request, "read", {
-            elicitationSupported: true,
+            remediation: "elicit",
         });
     }
     catch (cause) {

package/dist/server/createServer.js

@@ -5,7 +5,7 @@ import { PRODUCT_IDENTITY } from "../identity.js";
 import { silentLogger } from "../logger.js";
 import { LinuxJavaScriptReplayRunner } from "../replay/LinuxJavaScriptReplayRunner.js";
 import { SystemJavaScriptReplayHost } from "../replay/SystemJavaScriptReplayHost.js";
-import { mcpClientMetadata, mcpEnvelopeValue } from "./mcpClientMetadata.js";
+import { mcpEnvelopeValue } from "./mcpClientMetadata.js";
 import { PROCESS_CAPTURE_ELICITATION_POLICY, } from "./ProcessCaptureElicitation.js";
 import { registerApplicationTools } from "./registerApplicationTools.js";
 import { registerArtifactTools } from "./registerArtifactTools.js";
@@ -13,7 +13,6 @@ import { registerBrowserScenarioTool } from "./registerBrowserScenarioTool.js";
 import { registerBrowserTools } from "./registerBrowserTools.js";
 import { registerElectronTools } from "./registerElectronTools.js";
 import { registerEnhancedTools } from "./registerEnhancedTools.js";
-import { registerEvidenceResources } from "./registerEvidenceResources.js";
 import { registerJavaScriptRuntimeObservationTools } from "./registerJavaScriptRuntimeObservationTools.js";
 import { registerManagedTools } from "./registerManagedTools.js";
 import { registerManagedWorkflowTools } from "./registerManagedWorkflowTools.js";
@@ -22,16 +21,14 @@ import { registerOfficialTools } from "./registerOfficialTools.js";
 import { registerGuidedPrompts } from "./registerPrompts.js";
 import { registerSessionTools } from "./registerSessionTools.js";
 import { sessionAvailabilityPolicy } from "./sessionAvailabilityPolicy.js";
-import { DENY_EVIDENCE_FILE_POLICY, DENY_PROCESS_POLICY, } from "./sessionToolPolicies.js";
-const TARGET_FREE_INSTRUCTIONS = "ASAR/JavaScript -> analyze_javascript_application; archive/package -> open_binary(path), then inspect_artifact/inventory_artifact (active target); managed PE/CLI -> inspect_managed_artifact; browser/Electron -> list_browser_targets/list_electron_targets; approved -> capture_browser_scenario/capture_electron_scenario; Node/Electron Inspector -> list_javascript_runtime_targets; native binary/database -> open_binary, then binary_overview. Start with binary_session; use tools/list; capabilities via binary_session. Use summaries, cite Evidence IDs; Never repeat identical analysis or read full Evidence.";
-const ACTIVE_TARGET_INSTRUCTIONS = "REA analyzes the active reverse-engineering target. Start native analysis with binary_overview, then narrow with analyze_function, literal search, callers, callees, and xrefs. Prefer summary views, never repeat an identical call, and read full Evidence only when the task requires it.";
+import { DENY_PROCESS_POLICY } from "./sessionToolPolicies.js";
+const TARGET_FREE_INSTRUCTIONS = "REA provides reverse-engineering tools for local artifacts, native binaries, managed code, browser pages, and runtimes. Use the tool that directly answers the question; discover targets or inspect inventory only when needed. Tool results include inline Evidence and report their coverage and limitations.";
+const ACTIVE_TARGET_INSTRUCTIONS = "REA analyzes the active reverse-engineering target. Use the analysis tool that answers the question directly. Search or list symbols when discovery is needed; analyze_function provides a function dossier, and focused procedure tools return individual facets.";
 const installSessionToolAvailability = (server, session, options) => {
     if (session === undefined)
         return undefined;
     const policy = sessionAvailabilityPolicy(options.availabilityPolicy, {
         processPolicy: options.processPolicy?.() ?? DENY_PROCESS_POLICY,
-        evidenceFilePolicy: options.evidenceFilePolicy ?? DENY_EVIDENCE_FILE_POLICY,
-        investigationInputRoots: options.investigationInputRoots ?? [],
         optionalFeatures: {
             browserObservationEnabled: options.browserObservation !== undefined,
             browserScenarioEnabled: options.browserScenarioCapture !== undefined,
@@ -66,11 +63,8 @@ const createMcpServer = (processCaptureStateCodec, session) => new McpServer({
     name: PRODUCT_IDENTITY.mcpServerKey,
     version: PRODUCT_IDENTITY.packageVersion,
 }, {
-    capabilities: {
-        resources: { subscribe: true },
-    },
+    capabilities: {},
     inputRequired: {
-        maxRounds: 3,
         roundTimeoutMs: PROCESS_CAPTURE_ELICITATION_POLICY.roundTimeoutMs,
     },
     requestState: { verify: processCaptureStateCodec.verify },
@@ -96,7 +90,6 @@ export const createServer = (analysis, session, options = {}) => {
     server.server.onclose = () => {
         permissionAuthority?.clearSessionGrants();
     };
-    registerServerIdentityResource(server, startedAt);
     const toolLogger = logger.child({ layer: "server" });
     const { activeTarget, recordEvidence, recordEvidenceWithUnknown } = createSessionRecorders(server, session);
     const processCaptureElicitation = createProcessCaptureElicitation(processCaptureStateCodec);
@@ -115,7 +108,6 @@ export const createServer = (analysis, session, options = {}) => {
     registerObservationTools(toolContext);
     registerGuidedPrompts(server, analysis, session);
     if (session !== undefined) {
-        registerEvidenceResources(server, session);
         registerSessionTools(server, session, toolLogger, {
             ...options,
             ...(availability === undefined
@@ -181,7 +173,7 @@ const registerBinaryAnalysisTools = ({ server, analysis, session, options, logge
             },
         });
 };
-const registerObservationTools = ({ server, session, options, logger, permissionAuthority, recordEvidence, recordEvidenceWithUnknown, }) => {
+const registerObservationTools = ({ server, options, logger, permissionAuthority, recordEvidence, recordEvidenceWithUnknown, }) => {
     const common = { logger, permissionAuthority, recordEvidence };
     registerBrowserTools(server, {
         ...common,
@@ -204,14 +196,7 @@ const registerObservationTools = ({ server, session, options, logger, permission
         logger,
         recordEvidence,
         recordEvidenceWithUnknown,
-        evidenceLookup: session === undefined
-            ? undefined
-            : (evidenceId) => session.evidenceById(evidenceId),
-        evidenceFilePolicy: options.evidenceFilePolicy ?? DENY_EVIDENCE_FILE_POLICY,
         permissionAuthority,
-        retainCoverageWorkspace: session === undefined
-            ? undefined
-            : (workspace) => session.retainReconstructionCoverageWorkspace(workspace),
         replay: {
             policy: options.javascriptReplayPolicy ?? (() => ({ status: "disabled" })),
             host: options.javascriptReplayHost ?? new SystemJavaScriptReplayHost(),
@@ -220,26 +205,3 @@ const registerObservationTools = ({ server, session, options, logger, permission
         },
     });
 };
-const registerServerIdentityResource = (server, startedAt) => {
-    server.registerResource("server-identity", "rea://server/identity", {
-        title: "REA server identity",
-        description: "Live package, SDK, protocol, and catalog identity.",
-        mimeType: "application/json",
-    }, async (uri, context) => {
-        const { createServerIdentity } = await import("../serverIdentity.js");
-        const { client, protocolVersion } = mcpClientMetadata(context);
-        return {
-            contents: [
-                {
-                    uri: uri.href,
-                    mimeType: "application/json",
-                    text: JSON.stringify(createServerIdentity({
-                        startedAt,
-                        ...(client === undefined ? {} : { client }),
-                        ...(protocolVersion === undefined ? {} : { protocolVersion }),
-                    }), null, 2),
-                },
-            ],
-        };
-    });
-};

package/dist/server/promptCompletion.js

@@ -1,10 +1,7 @@
 import { z } from "zod";
 import { artifactInventoryResultSchema } from "../domain/artifactGraph.js";
-import { parseAddressedPage } from "../domain/hopperValues.js";
-import { processCaptureSchema, validateProcessCapture, } from "../domain/processCapture.js";
-const COMPLETION_SCAN_LIMIT = 10_000;
-const PROCEDURE_PAGE_SIZE = 500;
-const MAX_COMPLETION_VALUE_LENGTH = 4_096;
+import { artifactInspectionResultSchema } from "../domain/artifactInspection.js";
+import { processCaptureSchema } from "../domain/processCapture.js";
 const documentListSchema = z.array(z.string().min(1));
 const providerStatusSchema = z.object({
     providers: z.array(z.object({ id: z.string().min(1) })),
@@ -12,16 +9,12 @@ const providerStatusSchema = z.object({
         .array(z.object({ provider: z.object({ id: z.string().min(1) }) }))
         .optional(),
 });
-/** Build bounded live completion over the active provider and session ledger. */
+/** Build live completion over the active provider and session ledger. */
 export const createPromptCompletionSource = (analysis, session) => ({
     async complete(kind, value, context) {
-        if (value.length > MAX_COMPLETION_VALUE_LENGTH)
-            return [];
         const candidates = await completionCandidates(kind, analysis, session, context);
         const prefix = normalize(value);
-        return uniqueSorted(candidates)
-            .filter((candidate) => normalize(candidate).startsWith(prefix))
-            .slice(0, COMPLETION_SCAN_LIMIT);
+        return uniqueSorted(candidates).filter((candidate) => normalize(candidate).startsWith(prefix));
     },
 });
 const completionCandidates = async (kind, analysis, session, context) => {
@@ -46,39 +39,20 @@ const documentCandidates = async (analysis) => {
     if (!result.ok)
         return [];
     const parsed = documentListSchema.safeParse(result.value.result);
-    return parsed.success ? parsed.data.slice(0, COMPLETION_SCAN_LIMIT) : [];
+    return parsed.success ? parsed.data : [];
 };
 const procedureCandidates = async (analysis, document) => {
-    if (document !== undefined && document.length > MAX_COMPLETION_VALUE_LENGTH)
-        return [];
     const byAddress = new Map();
-    let offset = 0;
-    let exhaustive = false;
-    while (byAddress.size < COMPLETION_SCAN_LIMIT / 2) {
-        const result = await analysis.execute("list_procedures", {
-            offset,
-            limit: PROCEDURE_PAGE_SIZE,
-            ...(document === undefined || document.length === 0 ? {} : { document }),
-        });
-        if (!result.ok)
-            break;
-        const parsed = parseAddressedPage(result.value.result);
-        if (!parsed.ok)
-            break;
-        for (const item of parsed.value.items) {
-            if (byAddress.size >= COMPLETION_SCAN_LIMIT / 2)
-                break;
-            if (!byAddress.has(item.address))
-                byAddress.set(item.address, item.name);
-        }
-        const nextOffset = parsed.value.nextOffset;
-        if (!parsed.value.hasMore) {
-            exhaustive = true;
-            break;
-        }
-        if (nextOffset === null || nextOffset <= offset)
-            break;
-        offset = nextOffset;
+    const input = document === undefined || document.length === 0 ? {} : { document };
+    const result = await analysis.execute("list_procedures", input);
+    if (result.ok) {
+        const parsed = z
+            .array(z.object({ address: z.string(), value: z.string() }))
+            .safeParse(result.value.result);
+        if (parsed.success)
+            for (const item of parsed.data)
+                if (!byAddress.has(item.address))
+                    byAddress.set(item.address, item.value);
     }
     const addressesByName = new Map();
     for (const [address, name] of byAddress) {
@@ -87,10 +61,9 @@ const procedureCandidates = async (analysis, document) => {
         addressesByName.set(name, addresses);
     }
     const candidates = [...byAddress.keys()];
-    if (exhaustive)
-        for (const [name, addresses] of addressesByName)
-            if (addresses.size === 1 && name.length > 0)
-                candidates.push(name);
+    for (const [name, addresses] of addressesByName)
+        if (addresses.size === 1 && name.length > 0)
+            candidates.push(name);
     return candidates;
 };
 const providerCandidates = (session) => {
@@ -102,18 +75,14 @@ const providerCandidates = (session) => {
     const candidates = (parsed.data.analysis_provider_candidates?.length ?? 0) > 0
         ? (parsed.data.analysis_provider_candidates?.map(({ provider }) => provider.id) ?? [])
         : parsed.data.providers.map(({ id }) => id);
-    return ["auto", ...candidates].slice(0, COMPLETION_SCAN_LIMIT);
+    return ["auto", ...candidates];
 };
 const evidenceCandidates = (kind, session) => {
     if (session === undefined)
         return [];
     const candidates = [];
-    for (const evidence of session.exportEvidenceBundle().records) {
-        const remaining = COMPLETION_SCAN_LIMIT - candidates.length;
-        candidates.push(...evidenceValues(kind, evidence).slice(0, remaining));
-        if (candidates.length >= COMPLETION_SCAN_LIMIT)
-            break;
-    }
+    for (const evidence of session.exportEvidenceBundle().records)
+        candidates.push(...evidenceValues(kind, evidence));
     return candidates;
 };
 const evidenceValues = (kind, evidence) => {
@@ -121,30 +90,37 @@ const evidenceValues = (kind, evidence) => {
         return [evidence.evidence_id];
     if (kind === "capture")
         return isProcessCaptureEvidence(evidence) ? [evidence.evidence_id] : [];
-    if (evidence.operation !== "inventory_artifact")
+    const inventoryResult = evidence.operation === "inventory_artifact"
+        ? evidence.normalized_result
+        : evidence.operation === "inspect_artifact"
+            ? (() => {
+                const inspection = artifactInspectionResultSchema.safeParse(evidence.normalized_result);
+                return inspection.success
+                    ? inspection.data.substeps[0]?.evidence.normalized_result
+                    : undefined;
+            })()
+            : undefined;
+    if (inventoryResult === undefined)
         return [];
-    const inventory = artifactInventoryResultSchema.safeParse(evidence.normalized_result);
+    const inventory = artifactInventoryResultSchema.safeParse(inventoryResult);
     if (!inventory.success)
         return [];
     if (kind === "manifest")
         return [inventory.data.manifest.manifest_id];
-    return inventory.data.occurrences.items.map(({ occurrence_id: id }) => id);
+    return inventory.data.occurrences.map(({ occurrence_id: id }) => id);
 };
 const isProcessCaptureEvidence = (evidence) => {
     if (evidence.operation !== "capture_process_scenario")
         return false;
     const capture = processCaptureSchema.safeParse(evidence.normalized_result);
-    return capture.success && validateProcessCapture(capture.data).length === 0;
+    return capture.success;
 };
 const unknownCandidates = (session) => session === undefined
     ? []
     : session
         .listUnknowns()
         .filter(({ status }) => status !== "resolved")
-        .map(({ unknown_id: id }) => id)
-        .slice(0, COMPLETION_SCAN_LIMIT);
-const uniqueSorted = (values) => [
-    ...new Set(values.filter((value) => value.length > 0 && value.length <= MAX_COMPLETION_VALUE_LENGTH)),
-].sort(compareText);
+        .map(({ unknown_id: id }) => id);
+const uniqueSorted = (values) => [...new Set(values.filter((value) => value.length > 0))].sort(compareText);
 const compareText = (left, right) => left < right ? -1 : left > right ? 1 : 0;
 const normalize = (value) => value.normalize("NFKC").toLowerCase();

package/dist/server/recordDerivedEvidence.js

@@ -1,5 +1,5 @@
 import { ok } from "../domain/result.js";
-/** Atomically record derived Evidence with an optional approved unknown. */
+/** Atomically record derived Evidence with an optional supported unknown. */
 export const recordDerivedEvidence = (session, evidence, unknown) => {
     if (unknown !== undefined) {
         const recorded = session.recordEvidenceWithUnknown(evidence, unknown);

package/dist/server/registerApplicationTools/characterization.js

@@ -1,3 +1,4 @@
+import { recordSessionEvidenceSources } from "../sessionEvidence.js";
 import { executeNodeCharacterization, prepareNodeCharacterization, } from "../../application/NodeRuntimeCharacterizationService.js";
 import { applicationToolContract } from "../../contracts/applicationToolContracts.js";
 import { parseEvidence } from "../../domain/evidence.js";
@@ -6,7 +7,6 @@ import { mcpProgressReporter } from "../mcpProgress.js";
 import { logToolExecution } from "../toolLogging.js";
 import { toolRegistrationOptions } from "../toolRegistrationOptions.js";
 import { toCallToolResult } from "../toolResult.js";
-import { recordSources } from "./helpers.js";
 const prepareContract = applicationToolContract("prepare_node_characterization");
 const executeContract = applicationToolContract("execute_node_characterization");
 /** Register node runtime characterization prepare and execute tools. */
@@ -22,9 +22,7 @@ export const registerCharacterizationTools = (server, options) => {
         const recorded = options.recordEvidence?.(parseEvidence(output.transformation_evidence));
         if (recorded !== undefined && !recorded.ok)
             return toCallToolResult(recorded, prepareContract);
-        return toCallToolResult(result, prepareContract, {
-            evidenceResourcesAvailable: options.recordEvidence !== undefined,
-        });
+        return toCallToolResult(result, prepareContract);
     });
     server.registerTool(executeContract.name, toolRegistrationOptions(executeContract), async (input, context) => {
         const result = await logToolExecution(options.logger, executeContract.name, () => executeNodeCharacterization(options.replay, input, {
@@ -40,11 +38,9 @@ export const registerCharacterizationTools = (server, options) => {
             output.replay.evidence,
             output.evidence,
         ].map((item) => parseEvidence(item));
-        const recorded = recordSources(options.recordEvidence, sources);
+        const recorded = recordSessionEvidenceSources(options.recordEvidence, sources);
         if (!recorded.ok)
             return toCallToolResult(recorded, executeContract);
-        return toCallToolResult(result, executeContract, {
-            evidenceResourcesAvailable: options.recordEvidence !== undefined,
-        });
+        return toCallToolResult(result, executeContract);
     });
 };

package/dist/server/registerApplicationTools/compareExportShapes.js

@@ -1,23 +1,20 @@
-import { resolveCompareJavaScriptExportShapesRequestValidated } from "../../application/ApplicationWorkflowEvidenceResolver.js";
+import { recordSessionEvidenceSources } from "../sessionEvidence.js";
 import { compareJavaScriptExportShapesEvidenceValidated } from "../../application/JavaScriptApplicationWorkflowService.js";
 import { applicationToolContract } from "../../contracts/applicationToolContracts.js";
 import { javaScriptExportShapeComparisonResultSchema } from "../../domain/javascriptExportShapeComparisonSchemas.js";
 import { logToolExecution } from "../toolLogging.js";
 import { toolRegistrationOptions } from "../toolRegistrationOptions.js";
 import { toCallToolResult } from "../toolResult.js";
-import { recordResult, recordSources } from "./helpers.js";
+import { recordResult } from "./helpers.js";
 const contract = applicationToolContract("compare_javascript_export_shapes");
 /** Register the execution-free exact JavaScript export-shape comparison. */
 export const registerCompareJavaScriptExportShapesTool = (server, options) => {
     server.registerTool(contract.name, toolRegistrationOptions(contract), async (input) => {
-        const resolved = resolveCompareJavaScriptExportShapesRequestValidated(input, options.evidenceLookup);
-        if (!resolved.ok)
-            return toCallToolResult(resolved, contract);
-        const parsed = resolved.value;
+        const parsed = input;
         const result = await logToolExecution(options.logger, contract.name, () => Promise.resolve(compareJavaScriptExportShapesEvidenceValidated(parsed)));
         if (!result.ok)
             return toCallToolResult(result, contract);
-        const recorded = recordSources(options.recordEvidence, [
+        const recorded = recordSessionEvidenceSources(options.recordEvidence, [
             parsed.left,
             parsed.right,
         ]);
@@ -25,8 +22,6 @@ export const registerCompareJavaScriptExportShapesTool = (server, options) => {
             return toCallToolResult(recorded, contract);
         const comparison = javaScriptExportShapeComparisonResultSchema.parse(result.value.normalized_result);
         const unknown = comparison.summary.unknown > 0;
-        return recordResult(options, contract, result.value, parsed.unknown_registry_approved === true && unknown
-            ? "javascript-export-shape"
-            : undefined);
+        return recordResult(options, contract, result.value, unknown ? "javascript-export-shape" : undefined);
     });
 };

package/dist/server/registerApplicationTools/compareSourceToBundle.js

@@ -1,29 +1,25 @@
-import { resolveCompareSourceToBundleRequestValidated } from "../../application/ApplicationWorkflowEvidenceResolver.js";
+import { recordSessionEvidenceSources } from "../sessionEvidence.js";
 import { compareSourceToBundleEvidenceValidated } from "../../application/JavaScriptApplicationWorkflowService.js";
 import { applicationToolContract } from "../../contracts/applicationToolContracts.js";
 import { sourceToBundleComparisonResultSchema } from "../../domain/sourceToBundleComparisonSchemas.js";
 import { logToolExecution } from "../toolLogging.js";
 import { toolRegistrationOptions } from "../toolRegistrationOptions.js";
 import { toCallToolResult } from "../toolResult.js";
-import { recordResult, recordSources } from "./helpers.js";
+import { recordResult } from "./helpers.js";
 const contract = applicationToolContract("compare_source_to_bundle");
 /** Register conservative historical-source to bundle comparison. */
 export const registerCompareSourceToBundleTool = (server, options) => {
     server.registerTool(contract.name, toolRegistrationOptions(contract), async (input) => {
-        const resolved = resolveCompareSourceToBundleRequestValidated(input, options.evidenceLookup);
-        if (!resolved.ok)
-            return toCallToolResult(resolved, contract);
-        const result = await logToolExecution(options.logger, contract.name, () => Promise.resolve(compareSourceToBundleEvidenceValidated(resolved.value)));
+        const result = await logToolExecution(options.logger, contract.name, () => Promise.resolve(compareSourceToBundleEvidenceValidated(input)));
         if (!result.ok)
             return toCallToolResult(result, contract);
-        const recorded = recordSources(options.recordEvidence, [
-            resolved.value.application,
+        const recorded = recordSessionEvidenceSources(options.recordEvidence, [
+            input.application,
         ]);
         if (!recorded.ok)
             return toCallToolResult(recorded, contract);
         const comparison = sourceToBundleComparisonResultSchema.parse(result.value.normalized_result);
-        return recordResult(options, contract, result.value, resolved.value.unknown_registry_approved === true &&
-            comparison.summary.unknown > 0
+        return recordResult(options, contract, result.value, comparison.summary.unknown > 0
             ? "source-to-bundle-comparison"
             : undefined);
     });