rea-agents 5.0.0 → 6.0.0

package/dist/cli/nativeCallCommands.js

@@ -0,0 +1,35 @@
+import { z } from "incur";
+import { runProviderAnalysis } from "../composition/directAnalysis.js";
+import { CLI_COMMANDS } from "../cliCommandNames.js";
+import { parseCliJsonInput } from "../cliJsonInput.js";
+import { logCliCommand } from "../cliLogging.js";
+import { AnalysisInputError } from "../domain/analysisErrorCore.js";
+import { projectAnalysisError } from "../domain/analysisErrorProjection.js";
+import { projectInputIssues } from "../domain/inputIssueProjection.js";
+import { jsonValueSchema } from "../domain/jsonValue.js";
+import { nativeCallObservationInputSchema } from "../domain/native/nativeCallObservation.js";
+const OPERATION = "observe_native_calls";
+/** `observe-native-calls <path> <input-json>`: the MCP input object as JSON. */
+export const registerNativeCallCommands = (cli, logger) => {
+    cli.command(CLI_COMMANDS.observeNativeCalls, {
+        description: "Launch a Mach-O under LLDB and record entries into selected functions or Objective-C methods",
+        args: z.object({
+            path: z.string().describe("Mach-O or app path"),
+            inputJson: z
+                .string()
+                .describe("Inline JSON or a JSON file path: breakpoints, arguments, environment, duration_ms, max_events, argument_registers, backtrace_frames"),
+        }),
+        run: ({ args }) => logCliCommand(logger, CLI_COMMANDS.observeNativeCalls, async () => {
+            const input = await parseCliJsonInput(args.inputJson, OPERATION);
+            if (!input.ok)
+                return input.error;
+            const parsed = nativeCallObservationInputSchema.safeParse(input.value);
+            if (!parsed.success)
+                return {
+                    error: "Analysis failed",
+                    ...projectAnalysisError(new AnalysisInputError(OPERATION, undefined, projectInputIssues(parsed.error.issues, input.value))),
+                };
+            return runProviderAnalysis(args.path, OPERATION, z.record(z.string(), jsonValueSchema).parse(parsed.data), logger);
+        }),
+    });
+};

package/dist/cli/processCommands.js

@@ -1,5 +1,5 @@
 import { Cli, z } from "incur";
-import { captureProcessScenarioFile, compareProcessEvidenceFiles, isProcessCliFailure, } from "../application/ProcessCli.js";
+import { captureProcessScenarioFile, compareProcessEvidenceFiles, isProcessCliFailure, } from "../application/process/ProcessCli.js";
 import { logCliCommand } from "../cliLogging.js";
 import { CLI_COMMANDS } from "../cliCommandNames.js";
 /** Register direct process capture and comparison commands. */

package/dist/cli/streamedJsonOutput.js

@@ -0,0 +1,56 @@
+import {} from "node:stream";
+import { Filter } from "incur";
+import { parseCliOutputArguments } from "../cliOutput.js";
+import { writeJsonOutput } from "./jsonOutput.js";
+/** Preserve Incur's JSON controls while streaming the complete result. */
+export const createStreamedCliJsonOutput = (arguments_, destination) => {
+    const options = parseCliOutputArguments(arguments_);
+    if (options.parseError ||
+        options.tokenCount ||
+        options.tokenWindow ||
+        (options.format !== "json" && options.format !== "jsonl"))
+        return undefined;
+    const format = options.format;
+    let handled = false;
+    let failed = false;
+    return {
+        get handled() {
+            return handled;
+        },
+        get failed() {
+            return failed;
+        },
+        async write(value, metadata) {
+            if (metadata.format !== format)
+                return false;
+            const filtered = options.filterOutput
+                ? Filter.apply(value, Filter.parse(options.filterOutput))
+                : value;
+            const meta = {
+                command: metadata.command,
+                duration: metadata.duration,
+            };
+            const document = options.fullOutput
+                ? filtered === undefined
+                    ? { ok: true, meta }
+                    : { ok: true, data: filtered, meta }
+                : filtered === undefined ||
+                    filtered === null ||
+                    typeof filtered === "function" ||
+                    typeof filtered === "symbol"
+                    ? {}
+                    : filtered;
+            // Once writing starts, a failed destination must not receive a second
+            // document from Incur's error formatter.
+            handled = true;
+            try {
+                await writeJsonOutput(document, destination, format);
+            }
+            catch (cause) {
+                failed = true;
+                throw cause;
+            }
+            return true;
+        },
+    };
+};

package/dist/cli/utilityCommands.js

@@ -13,9 +13,11 @@ import { logCliCommand } from "../cliLogging.js";
 import { CLI_COMMANDS } from "../cliCommandNames.js";
 import { swiftSymbolsSchema } from "../contracts/native/nativeToolContracts.js";
 import { isReferenceSourceImportCliFailure } from "./referenceSourceImportStatus.js";
+import { registerNativeCallCommands } from "./nativeCallCommands.js";
 export const registerUtilityCommands = (cli, logger, environment = process.env) => {
     registerCapabilityCommands(cli, logger);
     registerNativeCommands(cli, logger);
+    registerNativeCallCommands(cli, logger);
     for (const [command, operation] of [
         [CLI_COMMANDS.observeNativeUi, "observe_native_ui"],
         [CLI_COMMANDS.captureNativeUiScenario, "capture_native_ui_scenario"],

package/dist/cli/webNetworkCaptureCommands.js

@@ -0,0 +1,40 @@
+import { z } from "incur";
+import { createWebNetworkCaptureService } from "../composition/webNetworkCaptures.js";
+import { CLI_COMMANDS } from "../cliCommandNames.js";
+import { logCliCommand } from "../cliLogging.js";
+import { projectAnalysisError } from "../domain/analysisErrorProjection.js";
+import { withCommandCancellation } from "./commandCancellation.js";
+/** Expose offline historical capture inspection with the same selection contract as MCP. */
+export const registerWebNetworkCaptureCommands = (cli, logger, environment) => {
+    const service = createWebNetworkCaptureService(environment);
+    cli.command(CLI_COMMANDS.inspectWebNetworkCapture, {
+        description: "Inspect retained HAR or native mitmproxy records without fetching recorded URLs",
+        args: z.object({
+            capturePath: z.string().describe("Absolute local capture path"),
+            format: z.enum(["har", "mitmproxy"]).describe("Producer capture format"),
+        }),
+        options: z.object({
+            record: z
+                .array(z.coerce.number().int().nonnegative())
+                .optional()
+                .describe("Zero-based producer ordinals; repeat to select several"),
+            sensitiveValue: z
+                .array(z.string().min(1))
+                .default([])
+                .describe("Literal string values explicitly marked sensitive; repeat as needed"),
+        }),
+        run: ({ args, options }) => withCommandCancellation((signal) => logCliCommand(logger, CLI_COMMANDS.inspectWebNetworkCapture, async () => {
+            const result = await service.inspect({
+                capture_path: args.capturePath,
+                format: args.format,
+                sensitive_values: options.sensitiveValue,
+                ...(options.record === undefined
+                    ? {}
+                    : { record_ordinals: options.record }),
+            }, { signal });
+            return result.ok
+                ? result.value
+                : projectAnalysisError(result.error);
+        })),
+    });
+};

package/dist/cli.js

@@ -1,3 +1,5 @@
+import { registerEvmCommands } from "./cli/evmCommands.js";
+import { registerBinaryDiagnosticsCommands } from "./cli/binaryDiagnosticsCommands.js";
 import { Cli } from "incur";
 import { createLogger, parseLogLevel } from "./logger.js";
 import { PRODUCT_IDENTITY } from "./identity.js";
@@ -15,6 +17,7 @@ import { registerWebScriptCommands } from "./cli/webScriptCommands.js";
 import { registerWebModuleCommands } from "./cli/webModuleCommands.js";
 import { registerWebSourceLocationCommands } from "./cli/webSourceLocationCommands.js";
 import { registerWebRuntimeCommands } from "./cli/webRuntimeCommands.js";
+import { registerWebNetworkCaptureCommands } from "./cli/webNetworkCaptureCommands.js";
 import { registerJavaScriptRecoveryCommands } from "./cli/javascriptRecoveryCommands.js";
 import { registerAdvancedBrowserCommands } from "./cli/browserAdvancedCommands.js";
 import { registerBrowserScenarioCommands } from "./cliBrowserScenarioCommands.js";
@@ -26,7 +29,7 @@ import { registerApplicationCommands } from "./cli/applicationCommands.js";
  * Analysis commands acquire and close their own sessions; bare `mcp` and
  * `--mcp` are intercepted by the executable dispatcher before this module loads.
  */
-export const createCli = (environment = process.env) => {
+export const createCli = (environment = process.env, resultOutput) => {
     const logger = createLogger("cli", environment.REA_LOG_LEVEL === undefined
         ? "silent"
         : parseLogLevel(environment.REA_LOG_LEVEL));
@@ -40,12 +43,14 @@ export const createCli = (environment = process.env) => {
         sync: false,
     });
     registerSetupCommands(cli, logger);
-    registerCoreAnalysisCommands(cli, logger);
+    registerCoreAnalysisCommands(cli, logger, resultOutput);
     registerUtilityCommands(cli, logger, environment);
+    registerEvmCommands(cli, logger, environment);
     registerArtifactCommands(cli, logger);
     registerManagedCommands(cli, logger);
     registerAndroidCommands(cli, logger, environment);
     registerFirmwareCommands(cli, logger, environment);
+    registerBinaryDiagnosticsCommands(cli, logger, environment);
     registerEvidenceCommands(cli, logger);
     registerProcessCommands(cli, logger, environment);
     registerBrowserCommands(cli, logger);
@@ -53,10 +58,11 @@ export const createCli = (environment = process.env) => {
     registerWebModuleCommands(cli, logger, environment);
     registerWebSourceLocationCommands(cli, logger, environment);
     registerWebRuntimeCommands(cli, logger);
+    registerWebNetworkCaptureCommands(cli, logger, environment);
     registerJavaScriptRecoveryCommands(cli, logger, environment);
     registerAdvancedBrowserCommands(cli, logger);
     registerBrowserScenarioCommands(cli, logger);
-    registerElectronCommands(cli, logger);
+    registerElectronCommands(cli, logger, resultOutput);
     registerJavaScriptRuntimeObservationCommands(cli, logger);
     registerApplicationCommands(cli, logger);
     return cli;

package/dist/cliBrowserScenarioCommands.js

@@ -3,7 +3,7 @@ import { z } from "zod";
 import { captureBrowserScenario } from "./application/BrowserScenarioCaptureService.js";
 import { createBrowserScenarioProvider } from "./composition/browserScenario.js";
 import { CLI_COMMANDS } from "./cliCommandNames.js";
-import { parseCliJsonInput } from "./cliJsonInput.js";
+import { parseCliJsonInput, resolveCliJsonPaths } from "./cliJsonInput.js";
 import { logCliCommand } from "./cliLogging.js";
 import { AnalysisInputError } from "./domain/analysisErrorCore.js";
 import { projectAnalysisError } from "./domain/analysisErrorProjection.js";
@@ -23,7 +23,7 @@ export const registerBrowserScenarioCommands = (cli, logger) => {
             const input = await parseCliJsonInput(args.inputJson, OPERATION);
             if (!input.ok)
                 return input.error;
-            const scenario = browserScenarioSchema.safeParse(input.value);
+            const scenario = browserScenarioSchema.safeParse(resolveCliJsonPaths(input.value, [["browser", "executable_path"]]));
             if (!scenario.success)
                 return cliError(new AnalysisInputError(OPERATION, { cause: scenario.error }, projectInputIssues(scenario.error.issues, input.value)));
             const result = await captureBrowserScenario(createBrowserScenarioProvider(), scenario.data);

package/dist/cliCommandNames.js

@@ -1,5 +1,7 @@
 /** Canonical names used by every one-shot CLI command registration. */
 export const CLI_COMMANDS = Object.freeze({
+    inspectEvmInterface: "inspect-evm-interface",
+    inspectWebNetworkCapture: "inspect-web-network-capture",
     observeWebExecution: "observe-web-execution",
     inspectWebEventListeners: "inspect-web-event-listeners",
     traceWebSourceLocation: "trace-web-source-location",
@@ -27,6 +29,7 @@ export const CLI_COMMANDS = Object.freeze({
     extractArtifact: "extract-artifact",
     decodeInterfaceBuilder: "decode-interface-builder",
     inspectKeyedArchive: "inspect-keyed-archive",
+    traceDylibResolution: "trace-dylib-resolution",
     inspectNativeDataType: "inspect-native-data-type",
     inspectNativeLoadImage: "inspect-native-load-image",
     readBytes: "read-bytes",
@@ -36,6 +39,8 @@ export const CLI_COMMANDS = Object.freeze({
     resolveNativeCallTargets: "resolve-native-call-targets",
     inspectAssetCatalog: "inspect-asset-catalog",
     inspectManagedArtifact: "inspect-managed-artifact",
+    inspectRecordedCrash: "inspect-recorded-crash",
+    inspectBinaryLayout: "inspect-binary-layout",
     inspectFirmwareRegions: "inspect-firmware-regions",
     extractFirmware: "extract-firmware",
     inspectAndroidPackage: "inspect-android-package",
@@ -50,6 +55,7 @@ export const CLI_COMMANDS = Object.freeze({
     importManagedReconstruction: "import-managed-reconstruction",
     projectManagedApplicationGraph: "project-managed-application-graph",
     observeNativeUi: "observe-native-ui",
+    observeNativeCalls: "observe-native-calls",
     captureNativeUiScenario: "capture-native-ui-scenario",
     inspectMacho: "inspect-macho",
     inspectSignature: "inspect-signature",

package/dist/cliJsonInput.js

@@ -1,4 +1,5 @@
 import { readFile } from "node:fs/promises";
+import { resolve } from "node:path";
 import { AnalysisInputError } from "./domain/analysisErrorCore.js";
 import { projectAnalysisError } from "./domain/analysisErrorProjection.js";
 import { safeParseJson } from "./domain/safeJson.js";
@@ -23,10 +24,38 @@ export const parseCliJsonInput = async (value, operation) => {
         return jsonFileError(value, operation, "read-failed", cause);
     }
 };
+/**
+ * Resolve named string fields of CLI-supplied JSON against the operator
+ * working directory. Each entry is a key path from the document root; only
+ * fields holding strings are resolved, everything else passes through
+ * untouched. Shared MCP contracts reject relative paths, so CLI workflows
+ * resolve operator-relative values before validation.
+ */
+export const resolveCliJsonPaths = (value, paths) => {
+    let resolved = value;
+    for (const keys of paths)
+        resolved = resolveJsonPath(resolved, keys);
+    return resolved;
+};
+const resolveJsonPath = (value, keys) => {
+    const [head, ...tail] = keys;
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return value;
+    const entries = Object.entries(value).map(([key, entry]) => {
+        if (key !== head)
+            return [key, entry];
+        if (tail.length === 0)
+            return [key, typeof entry === "string" ? resolve(entry) : entry];
+        return [key, resolveJsonPath(entry, tail)];
+    });
+    return Object.fromEntries(entries);
+};
 const cannotBeAnExistingFile = (cause) => typeof cause === "object" &&
     cause !== null &&
     "code" in cause &&
-    (cause.code === "ENOENT" || cause.code === "ENAMETOOLONG");
+    (cause.code === "ENOENT" ||
+        cause.code === "ENAMETOOLONG" ||
+        cause.code === "ENOTDIR");
 const hasExplicitJsonFileExtension = (value) => value.toLowerCase().endsWith(".json");
 const parseJson = (value) => {
     let text;

package/dist/cliOutput.js

@@ -10,10 +10,21 @@ const validationError = (value) => {
         return value.error.code === "VALIDATION_ERROR" ? value.error : undefined;
     return undefined;
 };
-const parseCliOutputArguments = (arguments_) => {
+/** Read effective Incur output controls at the executable boundary. */
+export const parseCliOutputArguments = (arguments_) => {
     let format = "toon";
-    let filterOutput = false;
+    let filterOutput;
+    let fullOutput = false;
+    let tokenCount = false;
     let tokenWindow = false;
+    const parsed = (parseError) => ({
+        filterOutput,
+        format,
+        fullOutput,
+        parseError,
+        tokenCount,
+        tokenWindow: parseError ? false : tokenWindow,
+    });
     for (let index = 0; index < arguments_.length; index += 1) {
         const argument = arguments_[index];
         // Incur scans builtins across `--` and accepts only spaced value forms.
@@ -28,7 +39,7 @@ const parseCliOutputArguments = (arguments_) => {
                 // Incur stops parsing at an invalid format before applying any later
                 // output controls. Let it report that malformed flag itself.
                 if (!INCUR_OUTPUT_FORMATS.has(value))
-                    return { filterOutput, format, parseError: true, tokenWindow: false };
+                    return parsed(true);
                 format = value;
                 index += 1;
             }
@@ -36,7 +47,7 @@ const parseCliOutputArguments = (arguments_) => {
         }
         if (argument === "--filter-output") {
             if (arguments_[index + 1]) {
-                filterOutput = true;
+                filterOutput = arguments_[index + 1];
                 index += 1;
             }
             continue;
@@ -46,14 +57,18 @@ const parseCliOutputArguments = (arguments_) => {
             if (value) {
                 const numericValue = Number(value);
                 if (!Number.isFinite(numericValue) || value.trim() === "")
-                    return { filterOutput, format, parseError: true, tokenWindow: false };
+                    return parsed(true);
                 tokenWindow = true;
                 index += 1;
             }
             continue;
         }
+        if (argument === "--full-output")
+            fullOutput = true;
+        if (argument === "--token-count")
+            tokenCount = true;
     }
-    return { filterOutput, format, parseError: false, tokenWindow };
+    return parsed(false);
 };
 /** Reject text-window controls that would corrupt a structured document. */
 export const validateCliOutputArguments = (arguments_) => {

package/dist/composition/binaryDiagnostics.js

@@ -0,0 +1,8 @@
+import { RecordedCrashService } from "../application/binaryDiagnostics/RecordedCrashService.js";
+import { PwntoolsRecordedCrashProvider } from "../native/pwntools/PwntoolsRecordedCrashProvider.js";
+import { BinaryLayoutService } from "../application/binaryDiagnostics/BinaryLayoutService.js";
+import { PwntoolsLayoutProvider } from "../native/pwntools/PwntoolsLayoutProvider.js";
+/** Compose the offline adapter without import-time I/O or dependency acquisition. */
+export const createBinaryLayoutService = (environment = process.env) => new BinaryLayoutService(new PwntoolsLayoutProvider(environment));
+/** Compose recorded-core inspection without acquiring a debugger or toolchain. */
+export const createRecordedCrashService = (environment = process.env) => new RecordedCrashService(new PwntoolsRecordedCrashProvider(environment));

package/dist/composition/evm.js

@@ -0,0 +1,4 @@
+import { EvmInterfaceService } from "../application/evm/EvmInterfaceService.js";
+import { EvmoleInterfaceProvider } from "../evm/EvmoleInterfaceProvider.js";
+/** Compose offline interface analysis without import-time I/O or dependency acquisition. */
+export const createEvmInterfaceService = (environment = process.env) => new EvmInterfaceService(new EvmoleInterfaceProvider(environment));

package/dist/composition/webNetworkCaptures.js

@@ -0,0 +1,6 @@
+import { WebNetworkCaptureService } from "../application/WebNetworkCaptureService.js";
+import { HistoricalCaptureDecoder } from "../browser/history/HistoricalCaptureDecoder.js";
+import { HarCaptureAdapter } from "../browser/history/HarCaptureAdapter.js";
+import { MitmproxyCaptureAdapter } from "../browser/history/MitmproxyCaptureAdapter.js";
+/** Compose offline format adapters without import-time reads, installation or process startup. */
+export const createWebNetworkCaptureService = (environment = process.env) => new WebNetworkCaptureService(new HistoricalCaptureDecoder([new HarCaptureAdapter(), new MitmproxyCaptureAdapter(environment)], environment));

package/dist/contracts/artifactToolContracts.js

@@ -4,6 +4,7 @@ import { jsonValueSchema } from "../domain/jsonValue.js";
 import { toolContractMetadata } from "./toolEffects.js";
 import { requireOutputSchema } from "./toolOutputSchemaPrimitives.js";
 import { appleAssetCatalogInputSchema } from "../domain/apple/appleAssetCatalog.js";
+import { dylibResolutionInputSchema } from "../domain/apple/dylibResolution.js";
 import { keyedArchiveInputSchema } from "../domain/apple/keyedArchive.js";
 /** Exact caller boundary for deterministic artifact inventory. */
 export const artifactInventoryInputSchema = z.strictObject({
@@ -22,6 +23,10 @@ const examples = {
     decode_interface_builder: {},
     inspect_asset_catalog: { offset: 0, limit: 1000 },
     inspect_keyed_archive: { path: "Contents/Resources/Model.plist" },
+    trace_dylib_resolution: {
+        roots: ["Contents/MacOS/App"],
+        architecture: "arm64",
+    },
 };
 const artifact = (name, description, inputSchema) => {
     const outputSchema = requireOutputSchema(artifactOutputSchemas, name);
@@ -51,6 +56,7 @@ export const ARTIFACT_TOOL_CONTRACTS = [
     })),
     artifact("inspect_keyed_archive", "Inspect one Foundation NSKeyedArchiver plist in the active app bundle as original object-table nodes, class descriptors, named roots, and UID edges. Preserves shared and cyclic references without instantiating classes. The path is relative to the bundle; root selection and object pagination preserve original identities.", keyedArchiveInputSchema),
     artifact("inspect_asset_catalog", "Inspect compiled Assets.car metadata in an active Apple app bundle. Returns stable paginated catalog and rendition records with raw assetutil metadata and catalog digests; rendition bytes are not extracted.", appleAssetCatalogInputSchema),
+    artifact("trace_dylib_resolution", "Trace how dyld would resolve each Mach-O dylib load for the active Mach-O, or for every executable in the active .app bundle (the main app, XPC services, extensions, login items, helpers). Expands @executable_path, @loader_path, and @rpath through each process's LC_RPATH stack in dependents-first load order, and reports every candidate path with its outcome, the resolved image and digest, weak, re-export, and upward flags, and derived findings such as unresolved required loads or absent earlier @rpath candidates. Pure header parsing: nothing is executed, and absolute or system paths outside the analyzed root stay undetermined. Select roots or one architecture to narrow large bundles.", dylibResolutionInputSchema),
 ];
 /** Provider operations; inventory remains an internal primitive of inspection. */
 export const ARTIFACT_ANALYSIS_OPERATIONS = [

package/dist/contracts/browserCaptureToolInputSchema.js

@@ -0,0 +1,43 @@
+import { browserCaptureComparisonInputSchema } from "../domain/browserCaptureComparison.js";
+import { browserScenarioCaptureSchema } from "../domain/browserScenarioCapture.js";
+import { captureSnapshotSchema } from "../domain/webCaptureDiffSchemas.js";
+// Captures are complete producer results to pass back unchanged, rather than
+// analyst-authored options. Describe that boundary without embedding the entire
+// inspection result schema in every comparison input. The cloned parser still
+// validates every nested field using the canonical domain schemas.
+const passiveCaptureInputSchema = captureSnapshotSchema.clone(captureSnapshotSchema.def);
+passiveCaptureInputSchema._zod.toJSONSchema = () => ({
+    type: "object",
+    properties: {
+        inspection: {
+            type: "object",
+            description: "Complete result object returned by inspect_web_page. Pass the entire result unchanged, including capture identity, observations, completeness, and limitations. Every nested field is validated by REA.",
+        },
+        webmcp: {
+            anyOf: [{ type: "object" }, { type: "null" }],
+            default: null,
+            description: "Complete result object returned by discover_webmcp_tools for this capture, or null when it was not recorded. Pass the entire result unchanged. Every nested field is validated by REA.",
+        },
+    },
+    required: ["inspection"],
+});
+const scenarioCaptureInputSchema = browserScenarioCaptureSchema.clone(browserScenarioCaptureSchema.def);
+scenarioCaptureInputSchema._zod.toJSONSchema = () => ({
+    type: "object",
+    description: "Complete result object returned by capture_browser_scenario. Pass the entire result unchanged, including browser and scenario identity, steps, events, artifact contents and digests, completeness, and limitations. Every nested field is validated by REA.",
+});
+/** Advertise capture round trips while retaining full runtime validation. */
+export const browserCaptureToolInputSchema = browserCaptureComparisonInputSchema.safeExtend({
+    before: passiveCaptureInputSchema
+        .optional()
+        .describe("Earlier passive web-page capture with complete producer results."),
+    after: passiveCaptureInputSchema
+        .optional()
+        .describe("Later passive web-page capture with complete producer results."),
+    before_scenario: scenarioCaptureInputSchema
+        .optional()
+        .describe("Earlier complete result object returned by capture_browser_scenario."),
+    after_scenario: scenarioCaptureInputSchema
+        .optional()
+        .describe("Later complete result object returned by capture_browser_scenario."),
+});

package/dist/contracts/browserToolContracts.js

@@ -2,10 +2,11 @@ import { browserTargetListSchema, inspectWebPageInputSchema, listBrowserTargetsI
 import { analyzeWebBundleInputSchema, webBundleAnalysisSchema, } from "../domain/webBundleAnalysis.js";
 import { observeWebSessionInputSchema, webObservationSessionSchema, } from "../domain/browserSession.js";
 import { discoverWebMcpToolsInputSchema, webMcpDiscoverySchema, } from "../domain/webMcpDiscovery.js";
-import { browserCaptureComparisonInputSchema, browserCaptureComparisonSchema, } from "../domain/browserCaptureComparison.js";
+import { browserCaptureComparisonSchema } from "../domain/browserCaptureComparison.js";
 import { captureWebScreenshotInputSchema, compareWebScreenshotsInputSchema, webScreenshotDiffSchema, webScreenshotSchema, } from "../domain/webScreenshot.js";
 import { toolContractMetadata } from "./toolEffects.js";
 import { evidenceResultOf } from "./toolOutputSchemas.js";
+import { browserCaptureToolInputSchema } from "./browserCaptureToolInputSchema.js";
 const evidenceResult = evidenceResultOf;
 const listOutputSchema = evidenceResult(browserTargetListSchema);
 const inspectionOutputSchema = evidenceResult(webPageInspectionSchema);
@@ -181,9 +182,9 @@ export const BROWSER_TOOL_CONTRACTS = [
     {
         name: "compare_web_captures",
         ...toolContractMetadata("compare_web_captures"),
-        description: "Compare passive web captures by providing before and after, or compare recorded scenarios by providing before_scenario and after_scenario with an optional normalization policy. Use exactly one input group. Scenario comparison aligns exact step IDs, records deterministic literal normalization, and returns every artifact-level difference plus alignment failures inline. Missing or truncated evidence never proves equality.",
+        description: "Compare passive web captures by providing before and after, each with the complete inspect_web_page result in inspection and an optional complete discover_webmcp_tools result in webmcp; or compare recorded scenarios by passing complete capture_browser_scenario results in before_scenario and after_scenario with an optional normalization policy. Use exactly one input group. Scenario comparison aligns exact step IDs, records deterministic literal normalization, and returns every artifact-level difference plus alignment failures inline. Missing or truncated evidence never proves equality.",
         kind: "browser-provider",
-        inputSchema: browserCaptureComparisonInputSchema,
+        inputSchema: browserCaptureToolInputSchema,
         outputSchema: captureDiffOutputSchema,
         examples: [
             {

package/dist/contracts/errorSchemas.js

@@ -1,11 +1,14 @@
 import { z } from "zod";
+import { jsonValueSchema } from "../domain/jsonValue.js";
 const categorySchema = z.enum([
     "invalid_input",
     "unsupported_provider",
+    "unsupported_target",
     "integrity_mismatch",
     "truncated",
     "cancelled",
     "timeout",
+    "resource_constraint",
     "unavailable",
     "execution_failure",
 ]);
@@ -20,17 +23,21 @@ const common = {
     retryable: z.boolean(),
     remediation: remediationSchema,
 };
-const genericDetails = z.record(z.string(), z.json()).optional();
+const genericDetails = z.record(z.string(), jsonValueSchema).optional();
 const generic = (code) => z
     .object({ code: z.literal(code), ...common, details: genericDetails })
     .strict();
 /** Stable discriminated schema shared by every CLI and MCP error surface. */
 export const analysisErrorProjectionSchema = z.discriminatedUnion("code", [
     generic("invalid_request"),
+    generic("access_denied"),
+    generic("artifact_changed"),
     generic("unreadable_output"),
     generic("capability_unavailable"),
+    generic("unsupported_target"),
     generic("provider_unavailable"),
     generic("provider_timeout"),
+    generic("resource_constraint"),
     generic("cancelled"),
     z
         .object({

package/dist/contracts/evm/evmToolContracts.js

@@ -0,0 +1,20 @@
+import { inspectEvmInterfaceInputSchema, evmInterfaceSchema, } from "../../domain/evm/evmInterface.js";
+import { toolContractMetadata } from "../toolEffects.js";
+import { evidenceResultOf } from "../toolOutputSchemas.js";
+/** Target-free EVM capabilities are independent of archive/Apple artifact providers. */
+export const EVM_TOOL_CONTRACTS = [
+    {
+        name: "inspect_evm_interface",
+        ...toolContractMetadata("inspect_evm_interface"),
+        kind: "artifact-provider",
+        description: "Inspect an explicit local flat EVM bytecode carrier and infer dispatch selectors, argument strings and mutability without executing the target or accessing a chain/RPC endpoint. Choose raw or hex encoding explicitly. Returns original carrier and decoded-byte SHA-256, full bytecode and interface candidates inline as inferred Evidence; bytecode kind, hardfork, deployed authenticity and discovery completeness remain unknown. Initial real-verified Linux x64 profile uses unchanged bundled EVMole 0.9.3/WASM in a bounded owned worker; EOF-style EF00 containers are unsupported. No signature lookup, wallet action or transaction broadcast.",
+        inputSchema: inspectEvmInterfaceInputSchema,
+        outputSchema: evidenceResultOf(evmInterfaceSchema),
+        examples: [
+            {
+                title: "Inspect a local runtime bytecode hex carrier",
+                input: { path: "/artifacts/runtime.hex", encoding: "hex" },
+            },
+        ],
+    },
+];

package/dist/contracts/investigationExamples.js

@@ -1,9 +1,9 @@
 import { compareFunctions } from "../domain/functionComparison.js";
 import { createEvidence } from "../domain/evidence.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";
-import { compareProcessCaptures, parseProcessCapture, } from "../domain/processCapture.js";
+import { compareProcessCaptures, parseProcessCapture, } from "../domain/process/processCapture.js";
 import { FUNCTION_COMPARISON_EXAMPLE } from "./functionComparisonExample.js";
-import { EMPTY_PROCESS_CAPTURE_EXAMPLE } from "./processCaptureExample.js";
+import { EMPTY_PROCESS_CAPTURE_EXAMPLE } from "./process/processCaptureExample.js";
 const comparison = compareFunctions(FUNCTION_COMPARISON_EXAMPLE.left, FUNCTION_COMPARISON_EXAMPLE.right);
 export const FUNCTION_COMPARISON_EVIDENCE = createEvidence(undefined, {
     id: "rea-function-comparison",

package/dist/contracts/managed/managedToolContracts.js

@@ -2,13 +2,17 @@ import { z } from "zod";
 import { managedOutputSchemas } from "../toolOutputSchemas.js";
 import { toolContractMetadata } from "../toolEffects.js";
 import { requireOutputSchema } from "../toolOutputSchemaPrimitives.js";
+import { isAbsoluteLocalPath } from "../../domain/localPath.js";
 /** Exact caller boundary for execution-free PE/CLI triage and identity. */
-const managedTargetInputSchema = z.object({
+const managedTargetInputSchema = z.strictObject({
     path: z
         .string()
         .min(1)
-        .optional()
-        .describe("Explicit managed PE/CLI path; omit to reuse the previously selected managed target"),
+        .refine(isAbsoluteLocalPath, {
+        message: "path must be an absolute local filesystem path (for example /tmp/Example.dll or C:\\Example.dll)",
+    })
+        .describe("Explicit absolute managed PE/CLI path; omit to reuse the previously selected managed target")
+        .optional(),
 });
 export const managedArtifactInputSchema = managedTargetInputSchema;
 /** Exact caller boundary for execution-free metadata/signature/IL inspection. */

package/dist/contracts/native/binaryDiagnosticsToolContracts.js

@@ -0,0 +1,42 @@
+import { inspectRecordedCrashInputSchema, recordedCrashSchema, } from "../../domain/native/recordedCrash.js";
+import { inspectBinaryLayoutInputSchema, binaryLayoutSchema, } from "../../domain/native/binaryLayout.js";
+import { toolContractMetadata } from "../toolEffects.js";
+import { evidenceResultOf } from "../toolOutputSchemas.js";
+/** Offline binary diagnostics are independent of macOS process/UI providers. */
+export const BINARY_DIAGNOSTICS_TOOL_CONTRACTS = [
+    {
+        name: "inspect_binary_layout",
+        ...toolContractMetadata("inspect_binary_layout"),
+        kind: "native-provider",
+        description: "Inspect an explicit local binary without launching it as a host process. Returns file-backed section/segment ranges, linked addresses, original symbol/REL/RELA table identities, complete encoded RELR tables and upstream-derived offsets with unknown per-word locations/addends, raw name bytes, dependency/interpreter names and static mitigation inferences inline with artifact SHA-256 Evidence. Initial profile: ELF64 x86-64 little-endian EXEC/DYN/REL on Linux x64 via caller-supplied Python with unchanged pwntools 4.15.0, pyelftools 0.33 and Unicorn 2.1.2. Runtime addresses/library paths, overall relocation inventory completeness and complete derived GOT/PLT coverage remain unknown. Zero executable entry values mean absence; relocatable entries are not applicable. Upstream can emulate PLT instructions with Unicorn for derived static maps. Uses bounded complete output and owned temporary files/processes; malformed, unsupported or oversized objects return no partial success.",
+        inputSchema: inspectBinaryLayoutInputSchema,
+        outputSchema: evidenceResultOf(binaryLayoutSchema),
+        examples: [
+            {
+                title: "Inspect ELF linked and file layout",
+                input: { path: "/artifacts/application.elf" },
+            },
+        ],
+    },
+    {
+        name: "inspect_recorded_crash",
+        ...toolContractMetadata("inspect_recorded_crash"),
+        kind: "native-provider",
+        description: "Inspect a supplied Linux ELF64 amd64 little-endian core without launching its target or attaching to any live PID. Returns all recorded segments, raw note owners/descriptors and source ranges, every Linux CORE PRSTATUS thread/register and SIGINFO fields inline with SHA-256 Evidence. Historical PID is recorded metadata; current process/file identity, note coverage and signal-thread associations stay unknown. Optionally add derived core-only GDB/pwndbg mapping candidates through explicit BYO configuration; zero map flags mean unknown permissions. Uses the same stable snapshot for both stages, bounded complete output and owned cleanup. Initial Linux x64 profile: unchanged pwntools 4.15.0/pyelftools 0.33/Unicorn 2.1.2; optional unchanged pwndbg 2026.09.15. No implicit executable/library pairing, GDB command language, host configuration changes or dependency installation.",
+        inputSchema: inspectRecordedCrashInputSchema,
+        outputSchema: evidenceResultOf(recordedCrashSchema),
+        examples: [
+            {
+                title: "Inspect recorded registers and signal evidence",
+                input: { path: "/artifacts/crash.core" },
+            },
+            {
+                title: "Add core-only debugger mapping candidates",
+                input: {
+                    path: "/artifacts/crash.core",
+                    include_debugger_context: true,
+                },
+            },
+        ],
+    },
+];