rea-agents 4.0.1 → 4.1.0

package/dist/android/JadxRelease.js

@@ -0,0 +1,19 @@
+/** Audited upstream release; source remains unmodified in the Git submodule. */
+export const JADX_RELEASE = Object.freeze({
+    version: "0.7.1",
+    revision: "5844800a486d2248fa949b74c9896285f5b54de2",
+    sha256: "6e5eacf500b64292bfb73c49797c1958f6ee44646e43e868039ae7feb573ff75",
+    url: "https://github.com/1013503897/jadx-headless-mcp/releases/download/v0.7.1/jadx-headless-mcp-0.7.1-all.jar",
+});
+/** Producing engine identity used by Evidence and the generated product catalog. */
+export const JADX_PROVIDER_IDENTITY = Object.freeze({
+    id: "jadx",
+    name: "JADX headless",
+    version: JADX_RELEASE.version,
+});
+/** Audited engine coverage, kept outside portable Android semantics. */
+export const JADX_LIMITATIONS = [
+    "Static decompiler observations do not establish runtime behavior; the APK is never executed.",
+    "Method signatures use provider display types; exact DEX descriptors and instruction offsets are unavailable. Overload indices are local to this engine and artifact.",
+    "Manifest summary fields are extracted by the upstream engine; decoded XML is retained for verification. APK signatures, split APKs, native libraries and Android runtime capture are not verified by this provider.",
+];

package/dist/android/JadxSession.js

@@ -0,0 +1,97 @@
+import { Client } from "@modelcontextprotocol/client";
+import { createAnalysisExecution, } from "../application/AnalysisProvider.js";
+import { AnalysisCapabilityUnavailableError, AnalysisOutputError, } from "../domain/analysisErrorCore.js";
+import { jsonValueSchema } from "../domain/jsonValue.js";
+import { ProviderAdapterError } from "../domain/providerAdapterError.js";
+import { analyzeJadxRequest } from "./JadxAnalysis.js";
+import { JadxMcpTransport } from "./JadxMcpTransport.js";
+import { jadxLoadSchema, parseJadxEnvelope, parseJadxJson, } from "./JadxProtocol.js";
+import { JADX_RELEASE, JADX_PROVIDER_IDENTITY, JADX_LIMITATIONS, } from "./JadxRelease.js";
+/** One owned engine connection; its wire protocol stays inside the Android adapter. */
+export class JadxSession {
+    transport;
+    #client = new Client({ name: "rea-android-adapter", version: "1" });
+    #raw = [];
+    constructor(options, launcher) {
+        this.transport = new JadxMcpTransport(options, launcher);
+    }
+    /** Analyze one admitted immutable APK, checking producer identity and selectors. */
+    async execute(context) {
+        const { request, target, snapshot, jarHash, signal } = context;
+        const abort = () => {
+            void this.transport.close().catch(() => undefined);
+        };
+        signal.addEventListener("abort", abort, { once: true });
+        try {
+            signal.throwIfAborted();
+            await this.#client.connect(this.transport, { timeout: 30_000 });
+            const server = this.#client.getServerVersion();
+            if (server?.name !== "jadx-headless-mcp" ||
+                server.version !== JADX_RELEASE.version)
+                throw new AnalysisCapabilityUnavailableError("jadx", request.operation, `Expected jadx-headless-mcp ${JADX_RELEASE.version}; server reported ${server?.name ?? "unknown"} ${server?.version ?? "unknown"}.`);
+            const tools = this.#tools(request, target, signal);
+            const loaded = jadxLoadSchema.parse(await tools.json("load_apk", {
+                path: snapshot,
+                threads: 1,
+                resources: "full",
+            }));
+            if (loaded.apk_path !== snapshot)
+                throw new AnalysisOutputError(request.operation, "JADX loaded a different APK path than the admitted snapshot");
+            const engine = {
+                name: "jadx-headless-mcp",
+                version: "0.7.1",
+                artifact_sha256: jarHash,
+                source_revision: jarHash === JADX_RELEASE.sha256 ? JADX_RELEASE.revision : null,
+                worker_count: 1,
+                heap_limit_mib: 512,
+            };
+            const result = await analyzeJadxRequest(tools, request, loaded, engine);
+            return createAnalysisExecution(result, JADX_PROVIDER_IDENTITY, {
+                rawResult: { server, jar_sha256: jarHash, calls: this.#raw },
+                subject: target,
+                limitations: JADX_LIMITATIONS,
+                locations: request.operation === "inspect_android_package"
+                    ? [{ kind: "artifact-path", path: "AndroidManifest.xml" }]
+                    : [],
+            });
+        }
+        finally {
+            signal.removeEventListener("abort", abort);
+        }
+    }
+    /** Join owned cleanup even if SDK connection teardown itself fails. */
+    async close() {
+        try {
+            await this.#client.close();
+        }
+        finally {
+            await this.transport.close();
+        }
+    }
+    #tools(request, target, signal) {
+        const call = async (name, input) => {
+            signal.throwIfAborted();
+            const response = await this.#client.callTool({ name, arguments: input }, { timeout: 120_000, signal });
+            const envelope = parseJadxEnvelope(response, request.operation);
+            this.#raw.push({
+                operation: name,
+                input,
+                response: jsonValueSchema.parse(response),
+            });
+            if (envelope.failed)
+                throw new ProviderAdapterError("jadx", request.operation, {
+                    diagnostics: {
+                        upstream_operation: name,
+                        reason: envelope.text,
+                        target_path: target.path,
+                        target_sha256: target.sha256,
+                    },
+                });
+            return envelope.text;
+        };
+        return {
+            text: call,
+            json: async (name, input) => parseJadxJson(await call(name, input), request.operation),
+        };
+    }
+}

package/dist/application/AnalysisContextQueries.js

@@ -1,4 +1,5 @@
-import { AnalysisCapabilityUnavailableError, AnalysisOutputError, } from "../domain/errors.js";
+import { AnalysisCapabilityUnavailableError, AnalysisOutputError, } from "../domain/analysisErrorCore.js";
+import {} from "../domain/analysisErrorBase.js";
 import { parseDocuments } from "../domain/hopperValues.js";
 import { err, ok } from "../domain/result.js";
 const parameters = (document, address) => ({

package/dist/application/AnalysisProviderEvaluation.js

@@ -1,5 +1,5 @@
 import { analysisProfileSchema, } from "../domain/analysisProfile.js";
-import { AnalysisCancelledError } from "../domain/errors.js";
+import { AnalysisCancelledError } from "../domain/analysisErrorCore.js";
 import { jsonObjectSchema } from "../domain/jsonValue.js";
 import { err, ok } from "../domain/result.js";
 import { ABORTED, waitForAbortable } from "./AbortablePromise.js";
@@ -14,7 +14,8 @@ export const evaluateAnalysisProviderCandidate = async (candidate, status, targe
             return err(new AnalysisCancelledError("open_binary"));
         resolved = resolution;
     }
-    catch {
+    catch (cause) {
+        void cause;
         return ok(rejectedProfile(candidate, status, "Provider profile resolution threw"));
     }
     if (signalIsAborted(signal))
@@ -38,7 +39,8 @@ export const evaluateAnalysisProviderCandidate = async (candidate, status, targe
             return ok(rejectedProfile(candidate, status, "Resolved analysis profile has mismatched provider identity"));
         return ok({ candidate, status, profile, compatibility });
     }
-    catch {
+    catch (cause) {
+        void cause;
         return ok(rejectedProfile(candidate, status, "Provider returned an invalid analysis profile"));
     }
 };

package/dist/application/AnalysisProviderRegistry.js

@@ -1,5 +1,6 @@
 import { analysisProviderIdSchema, analysisProviderSelectorSchema, } from "../contracts/providerSelection.js";
-import { AnalysisCancelledError, ProviderSelectionError, } from "../domain/errors.js";
+import { AnalysisCancelledError } from "../domain/analysisErrorCore.js";
+import { ProviderSelectionError, } from "../domain/providerSelectionError.js";
 import { jsonObjectSchema } from "../domain/jsonValue.js";
 import { err, ok } from "../domain/result.js";
 import { evaluateAnalysisProviderCandidate, } from "./AnalysisProviderEvaluation.js";

package/dist/application/AnalysisSnapshotCache.js

@@ -1,4 +1,6 @@
-import { EvidenceIntegrityError, NoBinaryOpenError, } from "../domain/errors.js";
+import { EvidenceIntegrityError } from "../domain/evidenceErrors.js";
+import { NoBinaryOpenError } from "../domain/configurationErrors.js";
+import {} from "../domain/analysisErrorBase.js";
 import { err, ok } from "../domain/result.js";
 import { analysisQueryId, createAnalysisSnapshotEntry, snapshotBinding, snapshotMatchesProfile, snapshotMatchesTarget, snapshotTarget, parseAnalysisSnapshot, } from "../domain/analysisSnapshot.js";
 import { GENERATED_MCP_TOOL_CATALOG } from "../generatedMcpToolCatalog.js";
@@ -31,6 +33,7 @@ export const isSnapshotCacheable = (operation, descriptor, parameters) => !STATE
     (!CURSOR_DEFAULT_OPERATIONS.has(operation) ||
         typeof parameters.address === "string") &&
     descriptor?.effects.mutatesArtifact === false &&
+    descriptor.cachePolicy !== "live" &&
     descriptor.effects.mayWriteFilesystem === false &&
     descriptor.effects.changesPermissions === false;
 /** Bounded in-memory cache for one immutable binary identity. */

package/dist/application/AnalysisSnapshotFiles.js

@@ -1,5 +1,5 @@
 import { parseAnalysisSnapshot, serializeAnalysisSnapshot, } from "../domain/analysisSnapshot.js";
-import { EvidenceFileError, EvidenceIntegrityError } from "../domain/errors.js";
+import { EvidenceFileError, EvidenceIntegrityError, } from "../domain/evidenceErrors.js";
 import { err, ok } from "../domain/result.js";
 import { readJsonFile, writeTextFile } from "./JsonFiles.js";
 /** Read and validate an analysis snapshot from the caller's path. */

package/dist/application/AndroidAnalysisPort.js

@@ -0,0 +1 @@
+export {};

package/dist/application/AndroidAnalysisService.js

@@ -0,0 +1,37 @@
+import { parseBinaryTarget } from "./BinaryTargetResolver.js";
+import { androidRequestSchema, } from "../domain/androidAnalysis.js";
+import { AnalysisCancelledError, AnalysisInputError, } from "../domain/analysisErrorCore.js";
+import { createEvidence } from "../domain/evidence.js";
+import { jsonObjectSchema } from "../domain/jsonValue.js";
+import { err, ok } from "../domain/result.js";
+/** Shared CLI/MCP admission, execution and Evidence composition for Android. */
+export class AndroidAnalysisService {
+    provider;
+    constructor(provider) {
+        this.provider = provider;
+    }
+    /** Inspect a caller-selected APK and retain producing-provider provenance inline. */
+    async execute(operation, input, options) {
+        if (options?.signal?.aborted === true)
+            return err(new AnalysisCancelledError(operation));
+        const request = androidRequestSchema.safeParse({ operation, input });
+        if (!request.success)
+            return err(new AnalysisInputError(operation, { cause: request.error }));
+        const target = await parseBinaryTarget(request.data.input.path);
+        if (!target.ok)
+            return target;
+        const executed = await this.provider.execute(target.value, request.data, options);
+        if (!executed.ok)
+            return executed;
+        const execution = executed.value;
+        return ok(createEvidence(execution.subject ?? target.value, execution.provider, {
+            operation,
+            parameters: jsonObjectSchema.parse(request.data.input),
+            result: execution.result,
+            rawResult: execution.rawResult,
+            limitations: execution.limitations,
+            locations: execution.locations,
+            confidence: operation === "inspect_android_method" ? "derived" : "observed",
+        }));
+    }
+}

package/dist/application/ArtifactExtraction.js

@@ -1,4 +1,5 @@
 import { lstat, realpath } from "node:fs/promises";
+import { canonicalDigest } from "../domain/comparisonSemantics.js";
 import { AsarArtifactReader } from "../artifacts/AsarArtifactReader.js";
 import { ArtifactPathRegistry, normalizeArtifactPath, } from "../artifacts/ArtifactPaths.js";
 import { ArtifactReaderFailure, } from "../artifacts/ArtifactReader.js";
@@ -8,7 +9,6 @@ import { ZipArtifactReader } from "../artifacts/ZipArtifactReader.js";
 import { MachOSliceArtifactReader } from "../artifacts/MachOSliceArtifactReader.js";
 import { artifactExtractionResultSchema, } from "../domain/artifactGraph.js";
 import { scanArtifactInventory } from "./ArtifactInventory.js";
-import { digestCanonical } from "./ArtifactGraphConstruction.js";
 /** Extract every regular inventory occurrence into an exclusively owned absent root. */
 export const extractArtifact = async (input, signal) => {
     const sourcePath = await realpath(input.inputPath);
@@ -86,7 +86,10 @@ const materializeSelection = async ({ input, sourcePath, inventory, selected, si
     }
     catch (cause) {
         if (!readerClosed)
-            await reader.close().catch(() => undefined);
+            await reader.close().catch((cause) => {
+                // best-effort cleanup: reader close must not mask the extraction failure.
+                void cause;
+            });
         await output.rollback();
         throw cause;
     }
@@ -97,14 +100,14 @@ const createExtractionResult = (input, inventory, selected, extracted) => {
         selected_occurrence_ids: selected
             .map(({ occurrence }) => occurrence.occurrence_id)
             .sort((left, right) => left.localeCompare(right)),
-        files_sha256: digestCanonical(extracted),
+        files_sha256: canonicalDigest(extracted, "Artifact"),
         output_root_alias: "$OUTPUT_ROOT",
     };
     return artifactExtractionResultSchema.parse({
         manifest: inventory.manifest,
         extraction_manifest: {
             ...extractionSemantic,
-            extraction_id: `aex_${digestCanonical(extractionSemantic)}`,
+            extraction_id: `aex_${canonicalDigest(extractionSemantic, "Artifact")}`,
         },
         output_root: input.outputRoot,
         artifacts: extracted,

package/dist/application/ArtifactGraphConstruction.js

@@ -1,5 +1,4 @@
-import { createHash } from "node:crypto";
-import canonicalize from "canonicalize";
+import { canonicalDigest } from "../domain/comparisonSemantics.js";
 import { zipPackageFormatForPath } from "../domain/zipPackageFormat.js";
 import { mzWindowsHeaderOffset, parseDosMzHeader } from "../domain/dosMz.js";
 /** Index the first occurrence for each canonical logical path. */
@@ -11,7 +10,7 @@ export const indexOccurrencesByPath = (occurrences) => {
     return byPath;
 };
 export const createOccurrence = (entry, path, parent) => ({
-    occurrence_id: `occ_${digestCanonical({ path, kind: entry.kind })}`,
+    occurrence_id: `occ_${canonicalDigest({ path, kind: entry.kind }, "Artifact")}`,
     artifact_id: null,
     parent_occurrence_id: parent,
     logical_path: path,
@@ -59,7 +58,7 @@ export const materializeDirectoryNodes = (occurrences, nodes) => {
         }))
             .sort((left, right) => compareDirectoryChildNames(left.name, right.name));
         const node = createArtifactNode({
-            sha256: digestCanonical({ kind: "directory", children }),
+            sha256: canonicalDigest({ kind: "directory", children }, "Artifact"),
             size: 0,
             kind: directory.logical_path.toLowerCase().endsWith(".framework")
                 ? "framework"
@@ -76,13 +75,13 @@ export const materializeDirectoryNodes = (occurrences, nodes) => {
 };
 export const createRootNode = (input) => createArtifactNode({
     sha256: input.digest?.sha256 ??
-        digestCanonical({
+        canonicalDigest({
             kind: "directory-root",
             children: input.occurrences.map(({ logical_path, artifact_id }) => ({
                 logical_path,
                 artifact_id,
             })),
-        }),
+        }, "Artifact"),
     size: input.digest?.bytes ?? 0,
     kind: input.directory ||
         ["zip", "ipa", "apk", "msix", "appx", "asar", "dmg", "pkg"].includes(input.format)
@@ -95,7 +94,7 @@ export const createRootNode = (input) => createArtifactNode({
     contentState: "materialized",
 });
 export const createArtifactNode = (input) => ({
-    artifact_id: `art_${digestCanonical({ sha256: input.sha256 })}`,
+    artifact_id: `art_${canonicalDigest({ sha256: input.sha256 }, "Artifact")}`,
     kind: input.kind,
     format: input.format,
     sha256: input.sha256,
@@ -107,7 +106,7 @@ export const createArtifactNode = (input) => ({
     limitations: [...(input.limitations ?? [])],
 });
 export const rootOccurrenceFor = (node, declaredSize) => ({
-    occurrence_id: `occ_${digestCanonical({ root: node.artifact_id })}`,
+    occurrence_id: `occ_${canonicalDigest({ root: node.artifact_id }, "Artifact")}`,
     artifact_id: node.artifact_id,
     parent_occurrence_id: null,
     logical_path: ".",
@@ -123,11 +122,11 @@ export const rootOccurrenceFor = (node, declaredSize) => ({
 export const rekeyOccurrences = (rootArtifactId, occurrences) => {
     const replacements = new Map();
     for (const occurrence of occurrences)
-        replacements.set(occurrence.occurrence_id, `occ_${digestCanonical({
+        replacements.set(occurrence.occurrence_id, `occ_${canonicalDigest({
             root_artifact_id: rootArtifactId,
             logical_path: occurrence.logical_path,
             entry_kind: occurrence.entry_kind,
-        })}`);
+        }, "Artifact")}`);
     for (const occurrence of occurrences) {
         occurrence.occurrence_id =
             replacements.get(occurrence.occurrence_id) ?? occurrence.occurrence_id;
@@ -161,7 +160,7 @@ export const createArtifactEdges = (rootArtifactId, occurrences, producer) => {
             logical_path: occurrence.logical_path,
         };
         edges.push({
-            edge_id: `edge_${digestCanonical(semantic)}`,
+            edge_id: `edge_${canonicalDigest(semantic, "Artifact")}`,
             ...semantic,
             producer: occurrence.entry_kind === "slice" ? (producer ?? null) : null,
             ordinal: edges.length,
@@ -255,12 +254,6 @@ export const classifyArtifactContent = (path, prefix, fileSize = prefix.length)
     }
     return byPath;
 };
-export const digestCanonical = (value) => {
-    const encoded = canonicalize(value);
-    if (encoded === undefined)
-        throw new TypeError("Artifact value is not canonical JSON");
-    return createHash("sha256").update(encoded).digest("hex");
-};
 const relationFor = (path) => {
     const lower = path.toLowerCase();
     if (lower.endsWith(".map"))

package/dist/application/ArtifactInventory/scanCanonical.js

@@ -2,7 +2,8 @@ import { createReadStream } from "node:fs";
 import { lstat } from "node:fs/promises";
 import { ArtifactReaderFailure, } from "../../artifacts/ArtifactReader.js";
 import { artifactInventoryResultSchema, } from "../../domain/artifactGraph.js";
-import { createArtifactEdges, createRootNode, digestCanonical, indexOccurrencesByPath, materializeDirectoryNodes, rekeyOccurrences, rootOccurrenceFor, } from "../ArtifactGraphConstruction.js";
+import { createArtifactEdges, createRootNode, indexOccurrencesByPath, materializeDirectoryNodes, rekeyOccurrences, rootOccurrenceFor, } from "../ArtifactGraphConstruction.js";
+import { canonicalDigest } from "../../domain/comparisonSemantics.js";
 import { classifyRoot } from "./classify.js";
 import { hashReadable } from "./hash.js";
 import { createReader, inventoryLimitations } from "./reader.js";
@@ -62,12 +63,12 @@ const buildInventorySnapshot = async (input) => {
     const orderedOccurrences = sortOccurrences(input.occurrences);
     const orderedEdges = sortEdges(edges);
     await verifyRootDigest(path, rootDigest, signal);
-    const graphSha256 = digestCanonical({
+    const graphSha256 = canonicalDigest({
         nodes: orderedNodes,
         occurrences: orderedOccurrences,
         edges: orderedEdges,
         integrity_contradictions: integrityContradictions,
-    });
+    }, "Artifact");
     const manifest = buildManifest({
         rootNode,
         graphSha256,
@@ -94,12 +95,12 @@ const buildIntegrityContradictions = (pending, occurrenceByPath, occurrenceById,
         : occurrenceById.get(occurrence.parent_occurrence_id);
     const parentArtifactId = parent?.artifact_id ?? rootNode.artifact_id;
     return {
-        contradiction_id: `ic_${digestCanonical({
+        contradiction_id: `ic_${canonicalDigest({
             root_artifact_id: rootNode.artifact_id,
             logical_path: contradiction.logicalPath,
             declared_sha256: contradiction.declaredSha256,
             observed_sha256: contradiction.observedSha256,
-        })}`,
+        }, "Artifact")}`,
         occurrence_id: occurrence.occurrence_id,
         parent_artifact_id: parentArtifactId,
         logical_path: contradiction.logicalPath,
@@ -126,10 +127,10 @@ const sortNodes = (nodes) => nodes.sort((left, right) => left.artifact_id.locale
 const sortOccurrences = (occurrences) => occurrences.sort((left, right) => left.logical_path.localeCompare(right.logical_path, "en"));
 const sortEdges = (edges) => edges.sort((left, right) => left.edge_id.localeCompare(right.edge_id));
 const buildManifest = ({ rootNode, graphSha256, orderedNodes, orderedOccurrences, orderedEdges, }) => artifactInventoryResultSchema.shape.manifest.parse({
-    manifest_id: `agm_${digestCanonical({
+    manifest_id: `agm_${canonicalDigest({
         root_artifact_id: rootNode.artifact_id,
         graph_sha256: graphSha256,
-    })}`,
+    }, "Artifact")}`,
     root_artifact_id: rootNode.artifact_id,
     root_sha256: rootNode.sha256,
     root_format: rootNode.format,

package/dist/application/BinarySession.js

@@ -1,6 +1,7 @@
 import { randomUUID } from "node:crypto";
 import { analysisProfilesEqual, } from "../domain/analysisProfile.js";
-import { AnalysisCancelledError, } from "../domain/errors.js";
+import { AnalysisCancelledError } from "../domain/analysisErrorCore.js";
+import {} from "../domain/analysisErrorBase.js";
 import { err, ok } from "../domain/result.js";
 import { createEvidence } from "../domain/evidence.js";
 import { GENERATED_MCP_TOOL_CATALOG } from "../generatedMcpToolCatalog.js";
@@ -58,6 +59,14 @@ export class BinarySession extends BinarySessionRecords {
             ? profile.provider
             : selected);
     }
+    /** External live state cannot be replayed by a direct or composed CLI workflow. */
+    allowsSnapshotReplay(operation) {
+        const capabilities = this.#active?.route.capabilities;
+        const descriptor = capabilities?.get(operation);
+        if (descriptor !== undefined)
+            return descriptor.cachePolicy !== "live";
+        return ![...(capabilities?.values() ?? [])].some(({ cachePolicy }) => cachePolicy === "live");
+    }
     /** Return the selected immutable profile, optionally scoped to an operation. */
     analysisProfile(operation) {
         const profile = this.#active?.profile;
@@ -318,12 +327,16 @@ export class BinarySession extends BinarySessionRecords {
         for (const listener of this.#availabilityListeners) {
             try {
                 const notification = listener();
-                if (notification !== undefined)
+                if (notification !== undefined) {
+                    // best-effort cleanup: async observer notifications must not reject
+                    // unhandled; state transitions and other listeners continue.
                     void notification.catch(() => undefined);
+                }
             }
-            catch {
+            catch (cause) {
                 // External observers are best-effort notifications. Contain only the
                 // callback failure so state transitions and other listeners continue.
+                void cause;
             }
         }
     }

package/dist/application/BinarySessionExecution.js

@@ -1,4 +1,7 @@
-import { AnalysisCapabilityUnavailableError, NoBinaryOpenError, ProviderAdapterError, } from "../domain/errors.js";
+import { AnalysisCapabilityUnavailableError } from "../domain/analysisErrorCore.js";
+import { NoBinaryOpenError } from "../domain/configurationErrors.js";
+import { ProviderAdapterError } from "../domain/providerAdapterError.js";
+import {} from "../domain/analysisErrorBase.js";
 import { err, ok } from "../domain/result.js";
 import { isSnapshotCacheable } from "./AnalysisSnapshotCache.js";
 /** Resolve capability, profile, and snapshot state before invoking a provider. */

package/dist/application/BinarySessionOpen.js

@@ -1,13 +1,14 @@
 import { snapshotMatchesBinding, snapshotMatchesTarget, snapshotTarget, } from "../domain/analysisSnapshot.js";
 import { parseBinaryTarget } from "./BinaryTargetResolver.js";
 import {} from "../domain/binaryTarget.js";
-import { EvidenceIntegrityError, } from "../domain/errors.js";
+import { EvidenceIntegrityError } from "../domain/evidenceErrors.js";
+import {} from "../domain/analysisErrorBase.js";
 import { err } from "../domain/result.js";
 import { SessionProviderRouter } from "./SessionProviderRouter.js";
 /** Parse a target, resolve its provider route, and validate snapshot binding. */
 export const resolveSessionOpen = async (input) => {
     const { router, current, path, options, stagedSnapshotMatches } = input;
-    const parsed = await parseBinaryTarget(path, process.cwd(), process.arch, options.targetKind);
+    const parsed = await parseBinaryTarget(path, process.cwd(), process.arch, options.targetKind, options.formatHint);
     if (!parsed.ok)
         return parsed;
     const target = parsed.value;

package/dist/application/BinarySessionRecords.js

@@ -1,6 +1,8 @@
 import { createEvidence } from "../domain/evidence.js";
 import { evidenceBundleForTarget } from "../domain/evidenceBundle.js";
-import { EvidenceIntegrityError, } from "../domain/errors.js";
+import { EvidenceIntegrityError } from "../domain/evidenceErrors.js";
+import {} from "../domain/analysisErrorBase.js";
+import {} from "../domain/unknownRegistryError.js";
 import { err, ok } from "../domain/result.js";
 import { AnalysisSnapshotCache } from "./AnalysisSnapshotCache.js";
 import { EvidenceLedger } from "./EvidenceLedger.js";
@@ -105,11 +107,15 @@ export class BinarySessionRecords {
             try {
                 const notification = listener();
                 if (notification !== undefined)
-                    void notification.catch(() => undefined);
+                    void notification.catch((cause) => {
+                        // best-effort cleanup: async observer notifications must not reject unhandled.
+                        void cause;
+                    });
             }
-            catch {
+            catch (cause) {
                 // External resource observers are best-effort; one callback must not
                 // make a committed evidence mutation appear to fail.
+                void cause;
             }
         }
     }

package/dist/application/BinaryTargetResolver.js

@@ -5,8 +5,9 @@ import { execFile } from "node:child_process";
 import { extname, isAbsolute, join, resolve } from "node:path";
 import { promisify } from "node:util";
 import { isPathWithinRoot } from "../domain/localPath.js";
-import { BinaryTargetError } from "../domain/errors.js";
+import { BinaryTargetError } from "../domain/configurationErrors.js";
 import { err, ok } from "../domain/result.js";
+import { validateDosComLength, } from "../domain/dosCom.js";
 import { mzWindowsHeaderOffset } from "../domain/dosMz.js";
 import { hasZipSignature, zipPackageFormatForPath, } from "../domain/zipPackageFormat.js";
 import { parseExecutableHeader, parsePeRecord, } from "../domain/binaryTarget.js";
@@ -16,7 +17,7 @@ const execFileAsync = promisify(execFile);
  * FAT Mach-O inputs select only a host-compatible architecture so setup remains
  * non-interactive; unsupported or ambiguous inputs are returned as typed errors.
  */
-export const parseBinaryTarget = async (input, cwd = process.cwd(), hostArchitecture = process.arch, targetKind) => {
+export const parseBinaryTarget = async (input, cwd = process.cwd(), hostArchitecture = process.arch, targetKind, formatHint) => {
     const candidate = isAbsolute(input) ? input : resolve(cwd, input);
     try {
         await access(candidate, constants.R_OK);
@@ -29,11 +30,27 @@ export const parseBinaryTarget = async (input, cwd = process.cwd(), hostArchitec
         try {
             if (!(await handle.stat()).isFile())
                 return err(new BinaryTargetError(path, "target is not a regular file"));
+            if (formatHint === "dos-com") {
+                if (targetKind !== undefined && targetKind !== "executable")
+                    return err(new BinaryTargetError(path, "DOS COM format requires an executable target kind"));
+                const length = validateDosComLength((await handle.stat()).size);
+                if (!length.ok)
+                    return err(new BinaryTargetError(path, length.error));
+                return ok({
+                    path,
+                    sourcePath: canonical,
+                    sha256: await sha256Handle(handle),
+                    kind: "executable",
+                    format: "dos-com",
+                    architecture: "x86",
+                    availableArchitectures: ["x86"],
+                });
+            }
             if (targetKind === "database" ||
                 (targetKind === undefined && path.toLowerCase().endsWith(".hop")))
                 return ok({
                     path,
-                    sourcePath: canonical,
+                    sourcePath: process.platform === "win32" ? candidate : canonical,
                     sha256: await sha256Handle(handle),
                     kind: "database",
                     format: "analysis-database",
@@ -42,7 +59,7 @@ export const parseBinaryTarget = async (input, cwd = process.cwd(), hostArchitec
             if (artifactFormat !== undefined) {
                 const identity = {
                     path,
-                    sourcePath: canonical,
+                    sourcePath: process.platform === "win32" ? candidate : canonical,
                     sha256: await sha256Handle(handle),
                 };
                 return isArchiveFormat(artifactFormat)
@@ -54,7 +71,7 @@ export const parseBinaryTarget = async (input, cwd = process.cwd(), hostArchitec
                 return err(new BinaryTargetError(path, detected.error));
             return ok({
                 path,
-                sourcePath: canonical,
+                sourcePath: process.platform === "win32" ? candidate : canonical,
                 sha256: await sha256Handle(handle),
                 kind: "executable",
                 ...detected.value,
@@ -144,7 +161,9 @@ const resolveAppBundle = async (path) => {
     if (!metadata.isDirectory())
         return ok(path);
     if (extname(path).toLowerCase() !== ".app")
-        return err(new BinaryTargetError(path, "target is not an app or file"));
+        return err(new BinaryTargetError(path, "this opening route requires a file or macOS app bundle", {
+            constraint: "directory_requires_file",
+        }));
     const plistPath = join(path, "Contents", "Info.plist");
     let name;
     try {

package/dist/application/BrowserObservationService.js

@@ -1,4 +1,5 @@
-import { AnalysisCapabilityUnavailableError, } from "../domain/errors.js";
+import { AnalysisCapabilityUnavailableError } from "../domain/analysisErrorCore.js";
+import {} from "../domain/analysisErrorBase.js";
 import { err, ok } from "../domain/result.js";
 import { createBrowserEvidence } from "./BrowserEvidence.js";
 /** List browser targets within the endpoint and origin scope in the request. */

package/dist/application/BrowserScenarioCaptureService.js

@@ -1,5 +1,6 @@
 import { createBrowserScenarioEvidence } from "./BrowserScenarioEvidence.js";
-import { AnalysisCapabilityUnavailableError, } from "../domain/errors.js";
+import { AnalysisCapabilityUnavailableError } from "../domain/analysisErrorCore.js";
+import {} from "../domain/analysisErrorBase.js";
 import { err } from "../domain/result.js";
 const OPERATION = "capture_browser_scenario";
 const PROVIDER_ID = "rea-playwright-browser-scenario";

package/dist/application/BrowserScenarioEvidence.js

@@ -1,9 +1,9 @@
+import { canonicalDigest } from "../domain/comparisonSemantics.js";
 import { sanitizeBrowserUrl } from "../domain/browserObservation.js";
 import { createEvidence, } from "../domain/evidence.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";
-import { digestCanonicalJson } from "../domain/browserScenarioNormalization.js";
 const browserScenarioParameters = (scenario) => ({
-    scenario_sha256: digestCanonicalJson(scenario),
+    scenario_sha256: canonicalDigest(scenario, "Browser scenario"),
     browser_mode: scenario.browser.mode,
     ...(scenario.browser.mode === "launch"
         ? { browser_headless: scenario.browser.headless }

package/dist/application/CallPathTracing.js

@@ -1,4 +1,5 @@
-import { projectAnalysisError } from "../domain/errors.js";
+import { projectAnalysisError } from "../domain/analysisErrorProjection.js";
+import {} from "../domain/analysisErrorBase.js";
 import { parseRelatedAddresses } from "../domain/hopperValues.js";
 import { ok } from "../domain/result.js";
 /** Trace direct caller/callee relationships until the graph is exhausted or the goal is reached. */