rea-agents 3.2.1 → 4.0.1

package/dist/reference/ReferenceSourceReaderEntries.js

@@ -1,33 +1,32 @@
 import { readdir, readlink, realpath } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
 import { compareUnicodeCodePoints } from "../domain/unicodeCodePointOrder.js";
-import { entryFailure, safeSize } from "./ReferenceSourceReaderErrors.js";
+import { cancelled, entryFailure, filesystemFailureDetail, safeSize, } from "./ReferenceSourceReaderErrors.js";
 import { isPathWithinRoot } from "../domain/localPath.js";
 import { pathFromRoot } from "./ReferenceSourceReaderPaths.js";
 import { readStableFile } from "./ReferenceSourceReaderFile.js";
 import { isAborted, sameFile, validateDirectory, bigLstat, } from "./ReferenceSourceReaderValidate.js";
 import {} from "./ReferenceSourceReaderTypes.js";
 export const traverseDirectory = async (state, current) => {
-    const before = await validateDirectory(state.root, state.rootIdentity, current.path);
+    const before = await validateDirectory(state.root, state.rootIdentity, current.path, state.signal);
+    if (isAborted(state.signal))
+        return { ok: false, error: cancelled() };
     if (!before.ok) {
         state.entries.push(entryFailure(pathFromRoot(state.root, current.path), "directory", before.code, before.message));
         return { ok: true, value: undefined };
     }
     const names = await readDirectoryNames(current.path);
+    if (isAborted(state.signal))
+        return { ok: false, error: cancelled() };
     if (!names.ok) {
         state.entries.push(entryFailure(pathFromRoot(state.root, current.path), "directory", "io", names.message));
         return { ok: true, value: undefined };
     }
     if (isAborted(state.signal))
-        return {
-            ok: false,
-            error: {
-                tag: "reference-source-reader",
-                code: "cancelled",
-                message: "Reference source traversal cancelled",
-            },
-        };
-    const after = await validateDirectory(state.root, state.rootIdentity, current.path);
+        return { ok: false, error: cancelled() };
+    const after = await validateDirectory(state.root, state.rootIdentity, current.path, state.signal);
+    if (isAborted(state.signal))
+        return { ok: false, error: cancelled() };
     if (!after.ok || !sameFile(before.stats, after.stats)) {
         state.entries.push(entryFailure(pathFromRoot(state.root, current.path), "directory", "changed", "Directory changed while it was read"));
         return { ok: true, value: undefined };
@@ -49,28 +48,27 @@ const readDirectoryNames = async (path) => {
             value: (await readdir(path)).sort(compareUnicodeCodePoints),
         };
     }
-    catch {
-        return { ok: false, message: "Directory could not be read" };
+    catch (cause) {
+        const message = filesystemFailureDetail(cause, "Directory could not be read");
+        if (message === undefined)
+            throw cause;
+        return { ok: false, message };
     }
 };
 const readMetadata = async (path) => {
     try {
         return { ok: true, value: await bigLstat(path) };
     }
-    catch {
-        return { ok: false, message: "Entry metadata could not be read" };
+    catch (cause) {
+        const message = filesystemFailureDetail(cause, "Entry metadata could not be read");
+        if (message === undefined)
+            throw cause;
+        return { ok: false, message };
     }
 };
 const processEntry = async (state, current, name, directories) => {
     if (isAborted(state.signal))
-        return {
-            ok: false,
-            error: {
-                tag: "reference-source-reader",
-                code: "cancelled",
-                message: "Reference source traversal cancelled",
-            },
-        };
+        return { ok: false, error: cancelled() };
     const absolute = join(current.path, name);
     const path = pathFromRoot(state.root, absolute);
     const excluded = applyExclusion(state.shouldExclude, path);
@@ -86,6 +84,8 @@ const processEntry = async (state, current, name, directories) => {
     if (excluded.value)
         return { ok: true, value: undefined };
     const metadata = await readMetadata(absolute);
+    if (isAborted(state.signal))
+        return { ok: false, error: cancelled() };
     if (!metadata.ok) {
         state.entries.push(entryFailure(path, "unknown", "io", metadata.message));
         return { ok: true, value: undefined };
@@ -100,7 +100,7 @@ const processEntry = async (state, current, name, directories) => {
             },
         };
     if (metadata.value.isSymbolicLink())
-        state.entries.push(await describeSymlink(state.root, absolute, path));
+        state.entries.push(await describeSymlink(state.root, absolute, path, state.signal));
     else if (metadata.value.isDirectory()) {
         state.entries.push({ status: "read", kind: "directory", path });
         directories.push({ path: absolute });
@@ -124,7 +124,7 @@ const processFileEntry = async (state, absolute, path, metadata) => {
         state.bytesRead += result.bytes.byteLength;
     state.entries.push(result);
 };
-const describeSymlink = async (root, absolute, path) => {
+const describeSymlink = async (root, absolute, path, signal) => {
     try {
         const rawTarget = await readlink(absolute);
         const lexicalTarget = resolve(dirname(absolute), rawTarget);
@@ -133,7 +133,7 @@ const describeSymlink = async (root, absolute, path) => {
                 status: "read",
                 kind: "symlink",
                 path,
-                target: "<outside-root>",
+                target: lexicalTarget,
                 targetState: "external",
             };
         try {
@@ -150,22 +150,39 @@ const describeSymlink = async (root, absolute, path) => {
                     status: "read",
                     kind: "symlink",
                     path,
-                    target: "<outside-root>",
+                    target: canonicalTarget,
                     targetState: "external",
                 };
         }
-        catch {
+        catch (cause) {
+            if (isAborted(signal))
+                return entryFailure(path, "symlink", "cancelled", "Symlink inspection cancelled");
+            const code = cause instanceof Error ? Reflect.get(cause, "code") : undefined;
+            if (code !== "ENOENT") {
+                const message = filesystemFailureDetail(cause, "Symbolic link target could not be resolved");
+                if (message === undefined)
+                    throw cause;
+                return entryFailure(path, "symlink", "io", message);
+            }
+            const missingOutsideRoot = !isPathWithinRoot(root, lexicalTarget);
             return {
                 status: "read",
                 kind: "symlink",
                 path,
-                target: pathFromRoot(root, lexicalTarget),
+                target: missingOutsideRoot
+                    ? lexicalTarget
+                    : pathFromRoot(root, lexicalTarget),
                 targetState: "missing",
             };
         }
     }
-    catch {
-        return entryFailure(path, "symlink", "io", "Symbolic link target could not be read");
+    catch (cause) {
+        if (isAborted(signal))
+            return entryFailure(path, "symlink", "cancelled", "Symlink inspection cancelled");
+        const message = filesystemFailureDetail(cause, "Symbolic link target could not be read");
+        if (message === undefined)
+            throw cause;
+        return entryFailure(path, "symlink", "io", message);
     }
 };
 const applyExclusion = (shouldExclude, path) => {

package/dist/reference/ReferenceSourceReaderErrors.js

@@ -9,6 +9,30 @@ export const safeSize = (size) => {
     const value = Number(size);
     return Number.isSafeInteger(value) && value >= 0 ? value : undefined;
 };
+const FILESYSTEM_ERROR_CODES = new Set([
+    "EACCES",
+    "EBADF",
+    "EEXIST",
+    "EIO",
+    "EISDIR",
+    "ELOOP",
+    "EMFILE",
+    "ENFILE",
+    "ENOENT",
+    "ENOTDIR",
+    "ENOSPC",
+    "EPERM",
+    "EROFS",
+]);
+/** Preserve actionable operating-system detail while leaving invariants visible. */
+export const filesystemFailureDetail = (cause, operation) => {
+    if (!(cause instanceof Error))
+        return undefined;
+    const code = Reflect.get(cause, "code");
+    return typeof code === "string" && FILESYSTEM_ERROR_CODES.has(code)
+        ? `${operation}: ${cause.message}`
+        : undefined;
+};
 export const entryFailure = (...[path, kind, code, message, size]) => ({
     status: "failed",
     kind,

package/dist/reference/ReferenceSourceReaderFile.js

@@ -1,7 +1,7 @@
 import { constants } from "node:fs";
 import { open } from "node:fs/promises";
 import { dirname } from "node:path";
-import { entryFailure, safeSize } from "./ReferenceSourceReaderErrors.js";
+import { entryFailure, filesystemFailureDetail, safeSize, } from "./ReferenceSourceReaderErrors.js";
 import { isAborted, sameFile, validateDirectory, } from "./ReferenceSourceReaderValidate.js";
 import {} from "./ReferenceSourceReaderTypes.js";
 const READ_CHUNK_BYTES = 64 * 1024;
@@ -49,7 +49,7 @@ const readFileContents = async (request) => {
 const finalizeFileRead = async (request) => {
     const { root, rootIdentity, absolute, path, handle, before, parentBefore, chunks, total, } = request;
     const after = await handle.stat({ bigint: true });
-    const parentAfter = await validateDirectory(root, rootIdentity, dirname(absolute));
+    const parentAfter = await validateDirectory(root, rootIdentity, dirname(absolute), request.signal);
     if (!parentAfter.ok || !sameFile(parentBefore.stats, parentAfter.stats))
         return entryFailure(path, "file", "changed", "Parent directory changed while file was read", total);
     if (!sameFile(before, after) || BigInt(total) !== after.size)
@@ -66,7 +66,7 @@ export const readStableFile = async (request) => {
     const { root, rootIdentity, absolute, path, expected, signal } = request;
     let handle;
     try {
-        const parentBefore = await validateDirectory(root, rootIdentity, dirname(absolute));
+        const parentBefore = await validateDirectory(root, rootIdentity, dirname(absolute), signal);
         if (!parentBefore.ok)
             return entryFailure(path, "file", parentBefore.code, parentBefore.message, safeSize(expected.size));
         handle = await open(absolute, constants.O_RDONLY | constants.O_NOFOLLOW);
@@ -90,10 +90,16 @@ export const readStableFile = async (request) => {
             parentBefore,
             chunks: contents.chunks,
             total: contents.total,
+            ...(signal === undefined ? {} : { signal }),
         });
     }
-    catch {
-        return entryFailure(path, "file", isAborted(signal) ? "cancelled" : "io", "File could not be read safely", safeSize(expected.size));
+    catch (cause) {
+        if (isAborted(signal))
+            return entryFailure(path, "file", "cancelled", "File read cancelled", safeSize(expected.size));
+        const message = filesystemFailureDetail(cause, "File could not be read safely");
+        if (message === undefined)
+            throw cause;
+        return entryFailure(path, "file", "io", message, safeSize(expected.size));
     }
     finally {
         await handle?.close().catch(() => undefined);

package/dist/reference/ReferenceSourceReaderValidate.js

@@ -1,7 +1,7 @@
 import { constants } from "node:fs";
 import { lstat, realpath } from "node:fs/promises";
 import { err, ok } from "../domain/result.js";
-import { cancelled, failure } from "./ReferenceSourceReaderErrors.js";
+import { cancelled, failure, filesystemFailureDetail, } from "./ReferenceSourceReaderErrors.js";
 import { isPathWithinRoot } from "../domain/localPath.js";
 import {} from "./ReferenceSourceReaderTypes.js";
 export const bigLstat = (path) => lstat(path, { bigint: true });
@@ -12,7 +12,7 @@ export const sameFile = (left, right) => left.dev === right.dev &&
     left.ctimeNs === right.ctimeNs;
 export const isAborted = (signal) => signal?.aborted === true;
 export const noFollowOpenSupported = () => Number.isSafeInteger(constants.O_NOFOLLOW) && constants.O_NOFOLLOW !== 0;
-export const validateDirectory = async (root, rootIdentity, path) => {
+export const validateDirectory = async (root, rootIdentity, path, signal) => {
     try {
         const rootNow = await bigLstat(root);
         if (!sameFile(rootIdentity, rootNow))
@@ -39,11 +39,20 @@ export const validateDirectory = async (root, rootIdentity, path) => {
             };
         return { ok: true, stats };
     }
-    catch {
+    catch (cause) {
+        if (isAborted(signal))
+            return {
+                ok: false,
+                code: "cancelled",
+                message: "Reference source traversal cancelled",
+            };
+        const message = filesystemFailureDetail(cause, "Directory identity could not be verified");
+        if (message === undefined)
+            throw cause;
         return {
             ok: false,
             code: "io",
-            message: "Directory identity could not be verified",
+            message,
         };
     }
 };
@@ -53,16 +62,21 @@ export const prepareRoot = async (root, signal) => {
     try {
         const metadata = await bigLstat(root);
         if (metadata.isSymbolicLink() || !metadata.isDirectory())
-            return err(failure("invalid-root", "Reference source root must be a directory"));
+            return err(failure("invalid-root", `Reference source root is not a directory: ${root}`));
         const canonicalRoot = await realpath(root);
         if (isAborted(signal))
             return err(cancelled());
         const canonicalMetadata = await bigLstat(canonicalRoot);
         if (!sameFile(metadata, canonicalMetadata))
-            return err(failure("invalid-root", "Reference source root changed during resolution"));
+            return err(failure("invalid-root", `Reference source root changed during resolution: ${root}`));
         return ok({ canonicalRoot, rootIdentity: canonicalMetadata });
     }
-    catch {
-        return err(failure("invalid-root", "Reference source root could not be resolved"));
+    catch (cause) {
+        if (isAborted(signal))
+            return err(cancelled());
+        const message = filesystemFailureDetail(cause, "Reference source root could not be resolved");
+        if (message === undefined)
+            throw cause;
+        return err(failure("invalid-root", `${message}: ${root}`));
     }
 };

package/dist/server/createServer.js

@@ -1,12 +1,6 @@
-import { randomBytes } from "node:crypto";
-import { CLIENT_CAPABILITIES_META_KEY, createRequestStateCodec, McpServer, PROTOCOL_VERSION_META_KEY, } from "@modelcontextprotocol/server";
-import { MANAGED_RUNTIME_DISABLED } from "../application/ManagedRuntimeCorrelationService.js";
+import { McpServer } from "@modelcontextprotocol/server";
 import { PRODUCT_IDENTITY } from "../identity.js";
 import { silentLogger } from "../logger.js";
-import { LinuxJavaScriptReplayRunner } from "../replay/LinuxJavaScriptReplayRunner.js";
-import { SystemJavaScriptReplayHost } from "../replay/SystemJavaScriptReplayHost.js";
-import { mcpEnvelopeValue } from "./mcpClientMetadata.js";
-import { PROCESS_CAPTURE_ELICITATION_POLICY, } from "./ProcessCaptureElicitation.js";
 import { registerApplicationTools } from "./registerApplicationTools.js";
 import { registerArtifactTools } from "./registerArtifactTools.js";
 import { registerBrowserScenarioTool } from "./registerBrowserScenarioTool.js";
@@ -21,53 +15,29 @@ import { registerOfficialTools } from "./registerOfficialTools.js";
 import { registerGuidedPrompts } from "./registerPrompts.js";
 import { registerSessionTools } from "./registerSessionTools.js";
 import { sessionAvailabilityPolicy } from "./sessionAvailabilityPolicy.js";
-import { DENY_PROCESS_POLICY } from "./sessionToolPolicies.js";
 const TARGET_FREE_INSTRUCTIONS = "REA provides reverse-engineering tools for local artifacts, native binaries, managed code, browser pages, and runtimes. Use the tool that directly answers the question; discover targets or inspect inventory only when needed. Tool results include inline Evidence and report their coverage and limitations.";
 const ACTIVE_TARGET_INSTRUCTIONS = "REA analyzes the active reverse-engineering target. Use the analysis tool that answers the question directly. Search or list symbols when discovery is needed; analyze_function provides a function dossier, and focused procedure tools return individual facets.";
 const installSessionToolAvailability = (server, session, options) => {
     if (session === undefined)
         return undefined;
     const policy = sessionAvailabilityPolicy(options.availabilityPolicy, {
-        processPolicy: options.processPolicy?.() ?? DENY_PROCESS_POLICY,
         optionalFeatures: {
             browserObservationEnabled: options.browserObservation !== undefined,
             browserScenarioEnabled: options.browserScenarioCapture !== undefined,
             electronObservationEnabled: options.electronObservation !== undefined,
-            electronAutomationEnabled: options.electronActiveObservation !== undefined &&
-                options.permissionAuthority !== undefined,
+            electronAutomationEnabled: options.electronActiveObservation !== undefined,
             v8InspectorObservationEnabled: options.javascriptRuntimeObservation !== undefined,
-            javascriptReplayEnabled: options.javascriptReplayPolicy?.().status === "enabled",
-            managedRuntimeEnabled: options.managedRuntimePolicy?.().status === "enabled",
         },
     });
     return {
         policy,
     };
 };
-const createProcessCaptureElicitation = (stateCodec) => ({
-    stateCodec,
-    supported: (context) => {
-        const envelope = context.mcpReq.envelope;
-        const version = mcpEnvelopeValue(envelope, PROTOCOL_VERSION_META_KEY);
-        const capabilities = mcpEnvelopeValue(envelope, CLIENT_CAPABILITIES_META_KEY);
-        return (typeof version === "string" &&
-            PROCESS_CAPTURE_ELICITATION_POLICY.protocolVersions.some((supported) => supported === version) &&
-            isRecord(capabilities) &&
-            isRecord(capabilities.elicitation) &&
-            capabilities.elicitation.form !== undefined);
-    },
-    now: Date.now,
-    consumedNonces: new Map(),
-});
-const createMcpServer = (processCaptureStateCodec, session) => new McpServer({
+const createMcpServer = (session) => new McpServer({
     name: PRODUCT_IDENTITY.mcpServerKey,
     version: PRODUCT_IDENTITY.packageVersion,
 }, {
     capabilities: {},
-    inputRequired: {
-        roundTimeoutMs: PROCESS_CAPTURE_ELICITATION_POLICY.roundTimeoutMs,
-    },
-    requestState: { verify: processCaptureStateCodec.verify },
     instructions: session === undefined
         ? ACTIVE_TARGET_INSTRUCTIONS
         : TARGET_FREE_INSTRUCTIONS,
@@ -80,26 +50,16 @@ const createMcpServer = (processCaptureStateCodec, session) => new McpServer({
 export const createServer = (analysis, session, options = {}) => {
     const startedAt = new Date().toISOString();
     const logger = options.logger ?? silentLogger;
-    const permissionAuthority = options.permissionAuthority?.createConnectionAuthority();
-    const processCaptureStateCodec = createRequestStateCodec({
-        key: randomBytes(32),
-        ttlSeconds: PROCESS_CAPTURE_ELICITATION_POLICY.stateTtlSeconds,
-    });
-    const server = createMcpServer(processCaptureStateCodec, session);
+    const server = createMcpServer(session);
     const availability = installSessionToolAvailability(server, session, options);
-    server.server.onclose = () => {
-        permissionAuthority?.clearSessionGrants();
-    };
     const toolLogger = logger.child({ layer: "server" });
     const { activeTarget, recordEvidence, recordEvidenceWithUnknown } = createSessionRecorders(server, session);
-    const processCaptureElicitation = createProcessCaptureElicitation(processCaptureStateCodec);
     const toolContext = {
         server,
         analysis,
         session,
         options,
         logger: toolLogger,
-        permissionAuthority,
         activeTarget,
         recordEvidence,
         recordEvidenceWithUnknown,
@@ -113,14 +73,11 @@ export const createServer = (analysis, session, options = {}) => {
             ...(availability === undefined
                 ? {}
                 : { availabilityPolicy: availability.policy }),
-            ...(permissionAuthority === undefined ? {} : { permissionAuthority }),
             startedAt,
-            processCaptureElicitation,
         });
     }
     return server;
 };
-const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const createSessionRecorders = (server, session) => ({
     activeTarget: session === undefined ? undefined : () => session.activeTarget(),
     recordEvidence: session === undefined
@@ -136,7 +93,7 @@ const createSessionRecorders = (server, session) => ({
             return recorded;
         },
 });
-const registerBinaryAnalysisTools = ({ server, analysis, session, options, logger, permissionAuthority, activeTarget, recordEvidence, recordEvidenceWithUnknown, }) => {
+const registerBinaryAnalysisTools = ({ server, analysis, session, logger, activeTarget, recordEvidence, recordEvidenceWithUnknown, }) => {
     const recordUnknown = session === undefined
         ? undefined
         : (input) => session.recordUnknown(input);
@@ -155,7 +112,6 @@ const registerBinaryAnalysisTools = ({ server, analysis, session, options, logge
     registerNativeTools(server, analysis, evidenceOptions);
     registerArtifactTools(server, analysis, {
         ...evidenceOptions,
-        ...(permissionAuthority === undefined ? {} : { permissionAuthority }),
     });
     registerManagedTools(server, analysis, {
         ...evidenceOptions,
@@ -167,14 +123,10 @@ const registerBinaryAnalysisTools = ({ server, analysis, session, options, logge
             recordEvidence,
             recordEvidenceWithUnknown,
             session,
-            runtime: {
-                policy: options.managedRuntimePolicy ?? (() => MANAGED_RUNTIME_DISABLED),
-                authority: permissionAuthority,
-            },
         });
 };
-const registerObservationTools = ({ server, options, logger, permissionAuthority, recordEvidence, recordEvidenceWithUnknown, }) => {
-    const common = { logger, permissionAuthority, recordEvidence };
+const registerObservationTools = ({ server, options, logger, recordEvidence, recordEvidenceWithUnknown, }) => {
+    const common = { logger, recordEvidence };
     registerBrowserTools(server, {
         ...common,
         browser: options.browserObservation,
@@ -196,12 +148,5 @@ const registerObservationTools = ({ server, options, logger, permissionAuthority
         logger,
         recordEvidence,
         recordEvidenceWithUnknown,
-        permissionAuthority,
-        replay: {
-            policy: options.javascriptReplayPolicy ?? (() => ({ status: "disabled" })),
-            host: options.javascriptReplayHost ?? new SystemJavaScriptReplayHost(),
-            runner: options.javascriptReplayRunner ?? new LinuxJavaScriptReplayRunner(),
-            authority: permissionAuthority,
-        },
     });
 };

package/dist/server/registerApplicationTools/helpers.js

@@ -30,17 +30,10 @@ const unknownRegistration = (evidence, kind) => ({
             ? [
                 {
                     operation: "reconcile_javascript_runtime",
-                    rationale: "Add approved passive runtime Evidence without promoting it to static fact.",
+                    rationale: "Add passive runtime Evidence without promoting it to static fact.",
                 },
             ]
-            : kind === "source-to-bundle-comparison"
-                ? []
-                : [
-                    {
-                        operation: "run_controlled_replay",
-                        rationale: "Validate exact approved module behavior separately when runtime semantics are required.",
-                    },
-                ]),
+            : []),
     ],
     relationships: [],
 });

package/dist/server/registerApplicationTools.js

@@ -3,8 +3,6 @@ import { registerTraceJavaScriptSemanticsTool } from "./registerApplicationTools
 import { registerCompareApplicationVersionsTool } from "./registerApplicationTools/compareVersions.js";
 import { registerCompareSourceToBundleTool } from "./registerApplicationTools/compareSourceToBundle.js";
 import { registerCompareJavaScriptExportShapesTool } from "./registerApplicationTools/compareExportShapes.js";
-import { registerControlledReplayTool } from "./registerApplicationTools/controlledReplay.js";
-import { registerCharacterizationTools } from "./registerApplicationTools/characterization.js";
 import { registerCoverageTools } from "./registerApplicationTools/coverage.js";
 import { registerReconstructionObligationLedgerTool } from "./registerApplicationTools/obligationLedger.js";
 /** Register provider-neutral JavaScript application graph workflows. */
@@ -14,8 +12,6 @@ export const registerApplicationTools = (server, options) => {
     registerCompareApplicationVersionsTool(server, options);
     registerCompareSourceToBundleTool(server, options);
     registerCompareJavaScriptExportShapesTool(server, options);
-    registerControlledReplayTool(server, options);
-    registerCharacterizationTools(server, options);
     registerReconstructionObligationLedgerTool(server, options);
     registerCoverageTools(server, options);
 };

package/dist/server/registerArtifactComparisonTool.js

@@ -1,4 +1,4 @@
-import { SESSION_TOOL_CONTRACTS } from "../contracts/toolContracts.js";
+import { toolContract } from "../contracts/toolContracts.js";
 import { compareArtifacts } from "../domain/artifactComparison.js";
 import { createEvidence, parseEvidence } from "../domain/evidence.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";

package/dist/server/registerBrowserScenarioTool.js

@@ -4,12 +4,14 @@ import { browserScenarioSchema } from "../domain/browserScenario.js";
 import { logToolExecution } from "./toolLogging.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
 import { toCallToolResult } from "./toolResult.js";
-/** Register the controlled browser scenario tool even when policy disables it. */
+/** Register the browser scenario tool with execution-time provider diagnostics. */
 export const registerBrowserScenarioTool = (server, options) => {
     const [contract] = BROWSER_SCENARIO_TOOL_CONTRACTS;
     server.registerTool(contract.name, toolRegistrationOptions(contract), async (input, context) => {
         const scenario = browserScenarioSchema.parse(input);
-        const result = await logToolExecution(options.logger, contract.name, () => captureBrowserScenario(options.provider, options.permissionAuthority, scenario, { signal: context.mcpReq.signal }));
+        const result = await logToolExecution(options.logger, contract.name, () => captureBrowserScenario(options.provider, scenario, {
+            signal: context.mcpReq.signal,
+        }));
         if (!result.ok)
             return toCallToolResult(result, contract);
         const recorded = options.recordEvidence?.(result.value);

package/dist/server/registerBrowserTools.js

@@ -6,28 +6,28 @@ import { mcpProgressReporter } from "./mcpProgress.js";
 import { logToolExecution } from "./toolLogging.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
 import { toCallToolResult } from "./toolResult.js";
-/** Register browser tools even when policy/provider availability denies execution. */
+/** Register browser tools with execution-time provider diagnostics. */
 // oxlint-disable-next-line max-lines-per-function -- direct SDK calls retain each schema-handler type correlation.
 export const registerBrowserTools = (server, options) => {
     const [listContract, inspectContract, analyzeContract, sessionContract, webMcpContract, captureDiffContract, screenshotContract, screenshotDiffContract,] = BROWSER_TOOL_CONTRACTS;
-    server.registerTool(listContract.name, toolRegistrationOptions(listContract), (input, context) => runBrowserTool(options, listContract, { input, context }, (parsed, { signal }) => listBrowserTargets(options.browser, options.permissionAuthority, parsed, {
+    server.registerTool(listContract.name, toolRegistrationOptions(listContract), (input, context) => runBrowserTool(options, listContract, { input, context }, (parsed, { signal }) => listBrowserTargets(options.browser, parsed, {
         signal,
     })));
-    server.registerTool(inspectContract.name, toolRegistrationOptions(inspectContract), (input, context) => runBrowserTool(options, inspectContract, { input, context }, (parsed, { signal, progress }) => inspectWebPage(options.browser, options.permissionAuthority, inspectWebPageInputSchema.parse(parsed), { signal, progress })));
-    server.registerTool(analyzeContract.name, toolRegistrationOptions(analyzeContract), (input, context) => runBrowserTool(options, analyzeContract, { input, context }, (parsed, { signal, progress }) => analyzeWebBundle(options.browser, options.permissionAuthority, analyzeWebBundleInputSchema.parse(parsed), {
+    server.registerTool(inspectContract.name, toolRegistrationOptions(inspectContract), (input, context) => runBrowserTool(options, inspectContract, { input, context }, (parsed, { signal, progress }) => inspectWebPage(options.browser, inspectWebPageInputSchema.parse(parsed), { signal, progress })));
+    server.registerTool(analyzeContract.name, toolRegistrationOptions(analyzeContract), (input, context) => runBrowserTool(options, analyzeContract, { input, context }, (parsed, { signal, progress }) => analyzeWebBundle(options.browser, analyzeWebBundleInputSchema.parse(parsed), {
         signal,
         progress,
     })));
-    server.registerTool(sessionContract.name, toolRegistrationOptions(sessionContract), (input, context) => runBrowserTool(options, sessionContract, { input, context }, (parsed, { signal, progress }) => observeWebSession(options.browser, options.permissionAuthority, parsed, {
+    server.registerTool(sessionContract.name, toolRegistrationOptions(sessionContract), (input, context) => runBrowserTool(options, sessionContract, { input, context }, (parsed, { signal, progress }) => observeWebSession(options.browser, parsed, {
         signal,
         progress,
     })));
-    server.registerTool(webMcpContract.name, toolRegistrationOptions(webMcpContract), (input, context) => runBrowserTool(options, webMcpContract, { input, context }, (parsed, { signal, progress }) => discoverWebMcpTools(options.browser, options.permissionAuthority, parsed, {
+    server.registerTool(webMcpContract.name, toolRegistrationOptions(webMcpContract), (input, context) => runBrowserTool(options, webMcpContract, { input, context }, (parsed, { signal, progress }) => discoverWebMcpTools(options.browser, parsed, {
         signal,
         progress,
     })));
     server.registerTool(captureDiffContract.name, toolRegistrationOptions(captureDiffContract), (input, context) => runBrowserTool(options, captureDiffContract, { input, context }, (parsed) => compareWebCaptureEvidence(options.browser, parsed)));
-    server.registerTool(screenshotContract.name, toolRegistrationOptions(screenshotContract), (input, context) => runBrowserTool(options, screenshotContract, { input, context }, (parsed, { signal, progress }) => captureWebScreenshot(options.browser, options.permissionAuthority, parsed, {
+    server.registerTool(screenshotContract.name, toolRegistrationOptions(screenshotContract), (input, context) => runBrowserTool(options, screenshotContract, { input, context }, (parsed, { signal, progress }) => captureWebScreenshot(options.browser, parsed, {
         signal,
         progress,
     })));

package/dist/server/registerBundleComparisonTool.js

@@ -1,5 +1,5 @@
 import { readEvidenceBundle } from "../application/EvidenceBundleFiles.js";
-import { SESSION_TOOL_CONTRACTS } from "../contracts/toolContracts.js";
+import { toolContract } from "../contracts/toolContracts.js";
 import { compareBundles } from "../domain/bundleComparison.js";
 import { createEvidence } from "../domain/evidence.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";

package/dist/server/registerCloseLifecycleTool.js

@@ -6,7 +6,7 @@ import { logToolExecution } from "./toolLogging.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
 import { toCallToolResult } from "./toolResult.js";
 /** Register provider cleanup and optional pre-close snapshot persistence. */
-export const registerCloseLifecycleTool = ({ server, session, logger, contracts: [, closeContract], }) => {
+export const registerCloseLifecycleTool = ({ server, session, logger, closeContract, }) => {
     server.registerTool(closeContract.name, toolRegistrationOptions(closeContract), async (input, context) => {
         const progress = mcpProgressReporter(context);
         if (input.snapshot_path === undefined) {

package/dist/server/registerElectronTools.js

@@ -8,20 +8,26 @@ import { mcpProgressReporter } from "./mcpProgress.js";
 import { logToolExecution } from "./toolLogging.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
 import { toCallToolResult } from "./toolResult.js";
-/** Register Electron tools even when provider or permission policy is absent. */
+/** Register Electron tools even when a provider is absent. */
 // oxlint-disable-next-line max-lines-per-function -- direct SDK calls retain each schema-handler type correlation.
 export const registerElectronTools = (server, options) => {
     const [listContract, inspectContract, analyzeContract, reconcileContract, activeContract,] = ELECTRON_TOOL_CONTRACTS;
-    server.registerTool(listContract.name, toolRegistrationOptions(listContract), (input, context) => runElectronTool(options, listContract, { input, context }, (parsed, { signal }) => listElectronTargets(options.electron, options.permissionAuthority, parsed, {
+    server.registerTool(listContract.name, toolRegistrationOptions(listContract), (input, context) => runElectronTool(options, listContract, { input, context }, (parsed, { signal }) => listElectronTargets(options.electron, parsed, {
         signal,
     })));
     server.registerTool(inspectContract.name, toolRegistrationOptions(inspectContract), (input, context) => runElectronTool(options, inspectContract, { input, context }, async (parsed, { signal, progress }) => {
         const request = inspectElectronPageInputSchema.parse(parsed);
-        return inspectElectronPage(options.electron, options.permissionAuthority, request, { signal, progress });
+        return inspectElectronPage(options.electron, request, {
+            signal,
+            progress,
+        });
     }));
     server.registerTool(analyzeContract.name, toolRegistrationOptions(analyzeContract), (input, context) => runElectronTool(options, analyzeContract, { input, context }, (parsed, { signal, progress }) => analyzeJavaScriptApplicationValidated(parsed, { signal, progress })));
     server.registerTool(reconcileContract.name, toolRegistrationOptions(reconcileContract), (input, context) => runElectronTool(options, reconcileContract, { input, context }, (parsed) => Promise.resolve(reconcileJavaScriptRuntimeEvidenceValidated(parsed))));
-    server.registerTool(activeContract.name, toolRegistrationOptions(activeContract), (input, context) => runElectronTool(options, activeContract, { input, context }, (parsed, { signal, progress }) => captureElectronScenario(options.electronActive, options.permissionAuthority, parsed, { signal, progress })));
+    server.registerTool(activeContract.name, toolRegistrationOptions(activeContract), (input, context) => runElectronTool(options, activeContract, { input, context }, (parsed, { signal, progress }) => captureElectronScenario(options.electronActive, parsed, {
+        signal,
+        progress,
+    })));
 };
 const runElectronTool = async (options, contract, request, execute) => {
     const { input, context } = request;