rea-agents 5.0.0 → 6.1.0

package/dist/contracts/sessionLifecycleInputs.js

@@ -1,17 +1,30 @@
 import { executableFormatHintSchema } from "../domain/dosCom.js";
+import { isAbsoluteLocalPath, localPathStringSchema, } from "../domain/localPath.js";
 import { z } from "zod";
 import { analysisProviderSelectorSchema } from "./providerSelection.js";
+/** Caller-supplied analysis snapshot path; must name its destination absolutely. */
+const snapshotPathSchema = localPathStringSchema
+    .refine(isAbsoluteLocalPath, {
+    message: "snapshot_path must be an absolute local filesystem path (for example /tmp/rea/analysis.json or C:\\rea\\analysis.json)",
+})
+    .describe("Absolute local filesystem path for the analysis snapshot; relative paths are rejected.");
+/** Caller-supplied analysis target path; must name the target absolutely. */
+const binaryTargetPathSchema = localPathStringSchema
+    .refine(isAbsoluteLocalPath, {
+    message: "path must be an absolute local filesystem path (for example /tmp/fixture.bin or C:\\analysis\\fixture.bin)",
+})
+    .describe("Absolute local filesystem path for the analysis target; relative paths are rejected.");
 /** Input contract for opening a target with an optional staged snapshot. */
-export const openBinaryInputSchema = z.object({
-    path: z.string().min(1),
+export const openBinaryInputSchema = z.strictObject({
+    path: binaryTargetPathSchema,
     format: executableFormatHintSchema
         .optional()
         .describe("Explicit headerless DOS COM interpretation; omission preserves header-based detection"),
     provider_id: analysisProviderSelectorSchema.optional(),
-    snapshot_path: z.string().min(1).optional(),
+    snapshot_path: snapshotPathSchema.optional(),
 });
 /** Input contract for closing a target after an optional atomic snapshot. */
-export const closeBinaryInputSchema = z.object({
-    snapshot_path: z.string().min(1).optional(),
+export const closeBinaryInputSchema = z.strictObject({
+    snapshot_path: snapshotPathSchema.optional(),
     overwrite: z.boolean().default(false),
 });

package/dist/contracts/sessionStatusContract.js

@@ -1,10 +1,16 @@
 import { z } from "zod";
+import { isAbsoluteLocalPath, localPathStringSchema, } from "../domain/localPath.js";
 /** Optional expectations used to compare the live session with its caller. */
-export const binarySessionInputSchema = z.object({
+export const binarySessionInputSchema = z.strictObject({
     expected_package_version: z.string().min(1).optional(),
     expected_catalog_digest: z
         .string()
         .regex(/^[a-f0-9]{64}$/u)
         .optional(),
-    expected_server_path: z.string().min(1).optional(),
+    expected_server_path: localPathStringSchema
+        .refine(isAbsoluteLocalPath, {
+        message: "expected_server_path must be an absolute local filesystem path (for example /opt/rea/dist/main.js)",
+    })
+        .describe("Absolute local filesystem path expected for the running server; relative paths are rejected.")
+        .optional(),
 });

package/dist/contracts/sessionToolContracts.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { isAbsoluteLocalPath, localPathStringSchema, } from "../domain/localPath.js";
 import { sessionOutputSchemas, requireOutputSchema, } from "./toolOutputSchemas.js";
 import { addressContextInputSchema, artifactComparisonInputSchema, binarySessionInputSchema, bundleComparisonInputSchema, callPathInputSchema, changedBehaviorInputSchema, closeBinaryInputSchema, functionComparisonInputSchema, importEvidenceBundleInputSchema, listUnknownsInputSchema, navigationContextInputSchema, openBinaryInputSchema, processComparisonInputSchema, processScenarioSchema, reconstructionVerificationInputSchema, recordUnknownInputSchema, getEvidenceBundleInputSchema, staticRuntimeCorrelationInputSchema, updateUnknownInputSchema, verifyUnknownResolutionInputSchema, } from "./sessionToolSchemas.js";
 import { examplesFor } from "./toolContractHelpers.js";
@@ -14,13 +15,17 @@ const session = (name, description, inputSchema) => ({
 });
 /** Session-owned Evidence bundle export options. */
 export const exportEvidenceBundleInputSchema = z.strictObject({
-    path: z.string().min(1),
+    path: localPathStringSchema
+        .refine(isAbsoluteLocalPath, {
+        message: "path must be an absolute local filesystem path (for example /tmp/rea/evidence.json or C:\\rea\\evidence.json)",
+    })
+        .describe("Absolute local filesystem path for the exported evidence bundle; relative paths are rejected."),
     overwrite: z.boolean().default(false),
 });
 /** Target lifecycle tools available only on the long-lived MCP adapter. */
 export const SESSION_TOOL_CONTRACTS = [
-    session("open_binary", "Open a local executable, application bundle, archive, JavaScript, source map, plist, or analysis database after validation. format=dos-com explicitly interprets 1..65280 headerless bytes as a DOS COM analysis image; omission preserves header-based detection. provider_id selects one deep provider or deterministic auto selection; the binding remains stable until close or an explicit switch, with no failure fallback. An optional analysis snapshot is imported atomically and must match the binary identity, concrete provider, and canonical analysis profile exactly.", openBinaryInputSchema),
-    session("close_binary", "Optionally write a provider-neutral analysis snapshot atomically to the caller-supplied path, then close the active target and every provider resource started for it. Existing files require explicit overwrite; a failed save leaves the session open so cached analysis is not lost.", closeBinaryInputSchema),
+    session("open_binary", "Open a local executable, application bundle, archive, JavaScript, source map, plist, or analysis database after validation. format=dos-com explicitly interprets 1..65280 headerless bytes as a DOS COM analysis image; omission preserves header-based detection. provider_id selects one deep provider or deterministic auto selection; the binding remains stable until close or an explicit switch, with no failure fallback. Reopening the same target and profile retains its active database and metadata edits. An optional analysis snapshot is imported atomically and must match the binary identity, concrete provider, and canonical analysis profile exactly; importing into a session with metadata mutations requires closing and reopening it first.", openBinaryInputSchema),
+    session("close_binary", "Drain earlier provider requests, optionally write a provider-neutral analysis snapshot atomically to the caller-supplied path, then close the active target and every provider resource started for it. Later provider requests wait until this lifecycle operation finishes. Existing files require explicit overwrite; a failed save leaves the session open so cached analysis is not lost. Metadata edits prevent immutable snapshot saves until the session is recreated; export_evidence_bundle preserves mutable observations before closing without a snapshot.", closeBinaryInputSchema),
     session("binary_session", "Report the complete current target, provider, capability availability, client-feature, analysis, and server-identity status without starting analysis.", binarySessionInputSchema),
     session("export_evidence_bundle", "Atomically write the session's deterministic Evidence bundle to the requested local path. Existing files require overwrite: true; records and manifests use canonical byte-stable ordering.", exportEvidenceBundleInputSchema),
     session("import_evidence_bundle", "Read the JSON bundle at the supplied local path, validate every Evidence ID and canonical manifest, then atomically merge it. Imported content is data only and is never executed.", importEvidenceBundleInputSchema),

package/dist/contracts/sessionToolSchemas.js

@@ -1,12 +1,12 @@
 import { z } from "zod";
+import { isAbsoluteLocalPath, localPathStringSchema, } from "../domain/localPath.js";
 import { artifactComparisonInputSchema } from "../domain/artifactComparison.js";
 import { bundleComparisonInputSchema } from "../domain/bundleComparison.js";
 import { callPathInputSchema } from "../domain/callPath.js";
 import { changedBehaviorInputSchema } from "../domain/changedBehavior.js";
 import { functionComparisonInputSchema } from "../domain/functionComparison.js";
-import { jsonValueSchema } from "../domain/jsonValue.js";
-import { processScenarioSchema } from "../domain/processCapture.js";
-import { processTraceSpecificationSchema } from "../domain/processTraceComparison.js";
+import { processScenarioSchema } from "../domain/process/processCapture.js";
+import { processTraceSpecificationSchema } from "../domain/process/processTraceComparison.js";
 import { recordUnknownInputSchema } from "../domain/residualUnknown.js";
 import { reconstructionVerificationInputSchema } from "../domain/reconstructionVerification.js";
 import { staticRuntimeCorrelationInputSchema } from "../domain/staticRuntimeCorrelation.js";
@@ -28,7 +28,11 @@ export const addressContextInputSchema = z.strictObject({
 });
 /** Session-owned Evidence bundle import options. */
 export const importEvidenceBundleInputSchema = z.strictObject({
-    path: z.string().min(1),
+    path: localPathStringSchema
+        .refine(isAbsoluteLocalPath, {
+        message: "path must be an absolute local filesystem path (for example /tmp/evidence.json or C:\\rea\\evidence.json)",
+    })
+        .describe("Absolute local filesystem path for the evidence bundle to import; relative paths are rejected."),
 });
 /** Evidence references for deterministic process comparison. */
 export const processComparisonInputSchema = z.strictObject({

package/dist/contracts/toolContractExamples.js

@@ -28,7 +28,6 @@ export const TOOL_EXAMPLE_OVERRIDES = {
     set_addresses_names: { names: { "0x1000": "entry" } },
     set_bookmark: { address: "0x1000" },
     set_comment: { address: "0x1000", comment: "validated entry point" },
-    set_current_document: { document: "fixture" },
     set_inline_comment: { address: "0x1000", comment: "calls parser" },
     unset_bookmark: { address: "0x1000" },
     get_call_graph: { address: "0x1000" },
@@ -47,7 +46,7 @@ export const TOOL_EXAMPLE_OVERRIDES = {
     open_binary: { path: "/tmp/fixture" },
     export_evidence_bundle: { path: "/tmp/evidence.json" },
     inspect_address_context: { address: "0x1000" },
-    import_evidence_bundle: { path: "evidence.json" },
+    import_evidence_bundle: { path: "/tmp/evidence.json" },
     capture_process_scenario: {
         executable: "/usr/bin/true",
         working_directory: "/tmp",

package/dist/contracts/toolContractHelpers.js

@@ -1,7 +1,10 @@
 import { z } from "zod";
 import { jsonValueSchema } from "../domain/jsonValue.js";
 import { TOOL_EXAMPLE_OVERRIDES } from "./toolContractExamples.js";
-export const document = z.string().optional().describe("The document name");
+export const document = z
+    .string()
+    .optional()
+    .describe("The active target's provider document name; use open_binary to switch targets");
 export const address = z
     .string()
     .describe("A provider-normalized address; default memory uses 0x-prefixed hexadecimal");

package/dist/contracts/toolContracts.js

@@ -1,3 +1,5 @@
+import { EVM_TOOL_CONTRACTS } from "./evm/evmToolContracts.js";
+import { BINARY_DIAGNOSTICS_TOOL_CONTRACTS } from "./native/binaryDiagnosticsToolContracts.js";
 import { NATIVE_TOOL_CONTRACTS } from "./native/nativeToolContracts.js";
 import { ARTIFACT_TOOL_CONTRACTS } from "./artifactToolContracts.js";
 import { MANAGED_TOOL_CONTRACTS } from "./managed/managedToolContracts.js";
@@ -10,6 +12,7 @@ import { JAVASCRIPT_RUNTIME_OBSERVATION_TOOL_CONTRACTS } from "./javascript/java
 import { APPLICATION_TOOL_CONTRACTS } from "./applicationToolContracts.js";
 import { WEB_SCRIPT_TOOL_CONTRACTS } from "./webScriptToolContracts.js";
 import { WEB_RUNTIME_TOOL_CONTRACTS } from "./webRuntimeToolContracts.js";
+import { WEB_NETWORK_CAPTURE_TOOL_CONTRACTS } from "./webNetworkCaptureToolContracts.js";
 import { JAVASCRIPT_RECOVERY_TOOL_CONTRACTS } from "./javascript/javascriptRecoveryToolContracts.js";
 import { OFFICIAL_TOOL_CONTRACTS } from "./officialToolContracts.js";
 import { ENHANCED_TOOL_CONTRACTS } from "./enhancedToolContracts.js";
@@ -19,7 +22,9 @@ export const TOOL_CONTRACTS = [
     ...OFFICIAL_TOOL_CONTRACTS,
     ...ENHANCED_TOOL_CONTRACTS,
     ...NATIVE_TOOL_CONTRACTS,
+    ...BINARY_DIAGNOSTICS_TOOL_CONTRACTS,
     ...ARTIFACT_TOOL_CONTRACTS,
+    ...EVM_TOOL_CONTRACTS,
     ...MANAGED_TOOL_CONTRACTS,
     ...ANDROID_TOOL_CONTRACTS,
     ...FIRMWARE_TOOL_CONTRACTS,
@@ -30,6 +35,7 @@ export const TOOL_CONTRACTS = [
     ...APPLICATION_TOOL_CONTRACTS,
     ...WEB_SCRIPT_TOOL_CONTRACTS,
     ...WEB_RUNTIME_TOOL_CONTRACTS,
+    ...WEB_NETWORK_CAPTURE_TOOL_CONTRACTS,
     ...JAVASCRIPT_RECOVERY_TOOL_CONTRACTS,
     ...SESSION_TOOL_CONTRACTS,
 ];

package/dist/contracts/toolEffects.js

@@ -18,6 +18,16 @@ const browserEvidence = effects({
 const sessionEvidence = effects({ mutatesSession: true });
 /** Explicit effect audit for every public tool. */
 export const TOOL_EFFECTS = {
+    inspect_evm_interface: effects({
+        mutatesSession: true,
+        writesFilesystem: true,
+        launchesProcess: true,
+    }),
+    inspect_web_network_capture: effects({
+        mutatesSession: true,
+        writesFilesystem: true,
+        launchesProcess: true,
+    }),
     observe_web_execution: effects({
         mutatesTarget: true,
         mutatesSession: true,
@@ -37,6 +47,16 @@ export const TOOL_EFFECTS = {
         launchesProcess: true,
         accessesNetwork: true,
     }),
+    inspect_recorded_crash: effects({
+        mutatesSession: true,
+        writesFilesystem: true,
+        launchesProcess: true,
+    }),
+    inspect_binary_layout: effects({
+        mutatesSession: true,
+        writesFilesystem: true,
+        launchesProcess: true,
+    }),
     inspect_firmware_regions: effects({
         mutatesSession: true,
         launchesProcess: true,
@@ -118,7 +138,6 @@ export const TOOL_EFFECTS = {
     set_addresses_names: effects({ mutatesTarget: true, mutatesSession: true }),
     set_bookmark: effects({ mutatesTarget: true, mutatesSession: true }),
     set_comment: effects({ mutatesTarget: true, mutatesSession: true }),
-    set_current_document: effects({ mutatesSession: true, changesUiState: true }),
     set_inline_comment: effects({ mutatesTarget: true, mutatesSession: true }),
     unset_bookmark: effects({
         mutatesTarget: true,
@@ -152,6 +171,15 @@ export const TOOL_EFFECTS = {
         mayDiscardData: true,
         idempotent: false,
     }),
+    // The owned process can change files, show UI and use the network.
+    observe_native_calls: effects({
+        mutatesSession: true,
+        writesFilesystem: true,
+        launchesProcess: true,
+        accessesNetwork: true,
+        changesUiState: true,
+        idempotent: false,
+    }),
     inspect_macho: nativeEvidence,
     inspect_signature: nativeEvidence,
     inspect_plist: nativeEvidence,
@@ -171,6 +199,7 @@ export const TOOL_EFFECTS = {
     decode_interface_builder: evidence,
     inspect_asset_catalog: nativeEvidence,
     inspect_keyed_archive: evidence,
+    trace_dylib_resolution: evidence,
     inspect_managed_artifact: evidence,
     inspect_managed_members: evidence,
     inspect_managed_native_boundaries: evidence,

package/dist/contracts/toolOutputSchemaGroups.js

@@ -4,17 +4,19 @@ import { nativeLoadImageSchema } from "../domain/native/nativeLoadImage.js";
 import { nativeUiResultSchema } from "../domain/native/nativeUiObservation.js";
 import { nativeValueTraceSchema } from "../domain/native/nativeValueTrace.js";
 import { nativeDataTypeSchema } from "../domain/native/nativeDataType.js";
+import { nativeCallObservationResultSchema } from "../domain/native/nativeCallObservation.js";
 import { nativeInstructionSchema, nativeCallTargetsSchema, } from "../domain/native/nativeInstruction.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";
 import { residualUnknownSchema } from "../domain/residualUnknown.js";
 import { evidenceBundleSchema } from "../domain/evidenceBundle.js";
-import { processCaptureComparisonSchema, processCaptureSchema, } from "../domain/processCapture.js";
-import { functionInstructionWindowSchema, referenceKindSchema, } from "../domain/hopperValues.js";
+import { processCaptureComparisonSchema, processCaptureSchema, } from "../domain/process/processCapture.js";
+import { analysisBookmarkSchema, functionInstructionWindowSchema, referenceEdgeSchema, unresolvedCallSchema, analysisStringSchema, } from "../domain/hopperValues.js";
 import { nativeApiInspectionResultSchema } from "../domain/native/nativeApiBoundary.js";
 import { demangleSwiftSchema, inspectMachoSchema, inspectPlistSchema, inspectSignatureSchema, listArchitecturesSchema, } from "../domain/native/nativeInspection.js";
 import { artifactExtractionResultSchema } from "../domain/artifactGraph.js";
 import { artifactInspectionResultSchema } from "../domain/artifactInspection.js";
 import { interfaceBuilderAnalysisSchema } from "../domain/apple/interfaceBuilderGraph.js";
+import { dylibResolutionResultSchema } from "../domain/apple/dylibResolution.js";
 import { keyedArchiveResultSchema } from "../domain/apple/keyedArchive.js";
 import { appleAssetCatalogResultSchema } from "../domain/apple/appleAssetCatalog.js";
 import { managedArtifactInspectionSchema, managedMemberInspectionSchema, managedNativeBoundaryInspectionSchema, } from "../domain/managed/managedArtifact.js";
@@ -42,24 +44,16 @@ const contextFacetSchema = z.discriminatedUnion("state", [
     }),
 ]);
 const bookmarkFacetSchema = z.discriminatedUnion("state", [
-    z.object({ state: z.literal("available"), value: z.array(addressedEntry) }),
+    z.object({
+        state: z.literal("available"),
+        value: z.array(analysisBookmarkSchema),
+    }),
     z.object({
         state: z.literal("unavailable"),
         reason: z.string(),
         remediation: z.string(),
     }),
 ]);
-const addressedString = z.object({
-    address: z.string(),
-    value: z.string(),
-    string: z
-        .object({
-        encoding: z.string().min(1),
-        termination: z.enum(["missing", "present_or_not_required"]),
-        byte_length: z.number().int().min(0),
-    })
-        .optional(),
-});
 /** Exact structured-content schemas shared by direct analysis providers. */
 export const officialOutputSchemas = {
     annotate_native_function: resultOf(nativeFunctionAnnotationsSchema),
@@ -74,12 +68,12 @@ export const officialOutputSchemas = {
     current_document: resultOf(z.string()),
     goto_address: resultOf(z.string()),
     inline_comment: resultOf(nullableText),
-    list_bookmarks: resultOf(z.array(addressedEntry)),
+    list_bookmarks: resultOf(z.array(analysisBookmarkSchema)),
     list_documents: resultOf(z.array(z.string())),
     list_names: resultOf(z.array(addressedValue)),
     list_procedures: resultOf(z.array(addressedValue)),
     list_segments: segmentOutput,
-    list_strings: resultOf(z.array(addressedString)),
+    list_strings: resultOf(z.array(analysisStringSchema)),
     next_address: resultOf(z.string()),
     prev_address: resultOf(z.string()),
     procedure_address: resultOf(z.string()),
@@ -98,31 +92,40 @@ export const officialOutputSchemas = {
     address_to_file_offset: resultOf(z.object({
         address: z.string(),
         file_offset: z.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
+        provider_file_offset: z
+            .number()
+            .int()
+            .min(0)
+            .max(Number.MAX_SAFE_INTEGER)
+            .exactOptional()
+            .describe("Original coordinate returned by the provider's mapping API."),
+        image_base_file_offset: z
+            .number()
+            .int()
+            .min(0)
+            .max(Number.MAX_SAFE_INTEGER)
+            .exactOptional()
+            .describe("File offset of the loaded image within its source container; zero for a thin executable."),
+        source_path: z
+            .string()
+            .exactOptional()
+            .describe("Observed original executable path used to verify the file mapping."),
     })),
     procedure_references: resultOf(z.object({
         procedure: procedureIdentity,
         direction: z.enum(["incoming", "outgoing"]),
         reference_kinds_available: z.boolean().optional(),
-        unresolved_calls: z
-            .array(z.object({ address: z.string(), reason: z.string() }))
-            .default([]),
-        references: z.array(z.object({
-            source_address: z.string(),
-            target_address: z.string(),
-            source_procedure: procedureIdentity.nullable(),
-            target_procedure: procedureIdentity.nullable(),
-            kind: referenceKindSchema,
-        })),
+        unresolved_calls: z.array(unresolvedCallSchema).default([]),
+        references: z.array(referenceEdgeSchema),
     })),
     procedure_pseudo_code: resultOf(nullableText),
     resolve_containing_procedure: resultOf(containingProcedureResolution),
     search_procedures: resultOf(z.array(z.object({ address: z.string(), value: z.string() }))),
-    search_strings: resultOf(z.array(z.object({ address: z.string(), value: z.string() }))),
+    search_strings: resultOf(z.array(analysisStringSchema)),
     set_address_name: resultOf(z.boolean()),
     set_addresses_names: resultOf(z.record(z.string(), z.boolean())),
     set_bookmark: resultOf(z.boolean()),
     set_comment: resultOf(z.boolean()),
-    set_current_document: resultOf(z.string()),
     set_inline_comment: resultOf(z.boolean()),
     unset_bookmark: resultOf(z.boolean()),
     xrefs: resultOf(addressList),
@@ -235,6 +238,7 @@ export const enhancedOutputSchemas = {
 export const nativeOutputSchemas = {
     observe_native_ui: resultOf(nativeUiResultSchema),
     capture_native_ui_scenario: resultOf(nativeUiResultSchema),
+    observe_native_calls: resultOf(nativeCallObservationResultSchema),
     inspect_macho: resultOf(inspectMachoSchema),
     inspect_signature: resultOf(inspectSignatureSchema),
     inspect_plist: resultOf(inspectPlistSchema),
@@ -248,6 +252,7 @@ export const artifactOutputSchemas = {
     decode_interface_builder: resultOf(interfaceBuilderAnalysisSchema),
     inspect_keyed_archive: resultOf(keyedArchiveResultSchema),
     inspect_asset_catalog: resultOf(appleAssetCatalogResultSchema),
+    trace_dylib_resolution: resultOf(dylibResolutionResultSchema),
 };
 /** Exact Evidence schema for execution-free managed static analysis. */
 export const managedOutputSchemas = {

package/dist/contracts/toolOutputSchemaPrimitives.js

@@ -4,16 +4,19 @@ import { analysisProfileSchema } from "../domain/analysisProfile.js";
 import { evidenceEnvelopeSchema } from "../domain/evidence.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";
 import { PROVIDER_REJECTION_CODES, } from "./providerSelection.js";
+import { PROVIDER_FAILURE_STAGES, PROVIDER_OPERATION_STATES, PROVIDER_RETRY_ACTIONS, } from "../domain/providerOperationHealth.js";
 import { analysisErrorProjectionSchema } from "./errorSchemas.js";
 import { prefixedDigestSchema } from "./../domain/digests.js";
 /** Inline result with its complete Evidence record. */
 export const inlineEvidenceRecordSchema = evidenceEnvelopeSchema;
+/** Wrap a result and its Evidence while preserving the result schema type. */
 export const evidenceResultOf = (schema) => z.strictObject({
     result: schema,
     evidence_id: prefixedDigestSchema("ev"),
     evidence: inlineEvidenceRecordSchema,
 });
 const resultOf = evidenceResultOf;
+/** Wrap a lifecycle result while preserving its exact schema type. */
 export const lifecycleResultOf = (schema) => z.object({ result: schema });
 /** Resolve a required named output schema or reject contract drift. */
 export const requireOutputSchema = (schemas, name) => {
@@ -133,6 +136,20 @@ export const analysisActivity = z.object({
         queued_requests: z.number().int().min(0),
     })),
 });
+const providerOperationRequest = z.object({
+    request_id: z.number().int().min(1),
+    operation: z.string().min(1),
+    stage: z.enum(PROVIDER_FAILURE_STAGES),
+});
+export const providerOperationHealth = z
+    .object({
+    state: z.enum(PROVIDER_OPERATION_STATES),
+    stage: z.enum(PROVIDER_FAILURE_STAGES).nullable(),
+    retry_action: z.enum(PROVIDER_RETRY_ACTIONS).nullable(),
+    exit_code: z.number().int().nullable(),
+    requests: z.array(providerOperationRequest),
+})
+    .nullable();
 const providerRejectionCode = z.enum(PROVIDER_REJECTION_CODES);
 const providerDiagnostics = z.record(z.string(), jsonValueSchema);
 const providerAvailability = z.discriminatedUnion("status", [
@@ -259,6 +276,7 @@ export const sessionProvider = z
     capabilities: z.array(providerCapability),
     analysis_run: analysisRun,
     analysis_activity: analysisActivity,
+    provider_operation_health: providerOperationHealth,
     analysis_provider_binding: z
         .object({
         provider: providerIdentity,
@@ -305,7 +323,7 @@ export const sessionProvider = z
         negotiated_protocol_version: z.string().nullable(),
         client: z.object({ name: z.string(), version: z.string() }).nullable(),
         skill: z.object({ name: z.string(), expected_version: z.string() }),
-        catalog: z.record(z.string(), z.json()),
+        catalog: z.record(z.string(), jsonValueSchema),
         protocol_features: z.object({
             progress: z.boolean(),
             cancellation: z.boolean(),

package/dist/contracts/toolSchemaMetadata.js

@@ -38,28 +38,87 @@ const PROPERTY_DESCRIPTIONS = {
     unknown_id: "Exact residual-unknown identifier.",
 };
 /** Attach caller guidance to a canonical schema for the SDK wire projection. */
-export const toolInputSchemaWithMetadata = (contract) => {
-    const schema = contract.inputSchema.meta(z.globalRegistry.get(contract.inputSchema) ?? {});
-    const standard = schema["~standard"];
-    const inputJsonSchema = standard.jsonSchema?.input;
-    if (inputJsonSchema === undefined)
-        throw new TypeError("Tool input schema does not expose Standard JSON Schema");
+export const toolInputSchemaWithMetadata = (contract) => withAdvertisedJsonSchema(contract.inputSchema, "input", (project) => (options) => flattenRootUnion({
+    ...describeProperties(project(options)),
+    examples: contract.examples.map(({ input }) => input),
+}));
+/** Advertise a canonical output schema without reconverting it per listing. */
+export const toolOutputSchemaWithMetadata = (contract) => withAdvertisedJsonSchema(contract.outputSchema, "output");
+const withAdvertisedJsonSchema = (canonical, io, advertise = (project) => project) => {
     // Zod's input projection drops root metadata when a descendant transforms.
     // Preserve the parser and let the SDK own conversion of everything else.
+    const schema = canonical.meta(z.globalRegistry.get(canonical) ?? {});
+    const standard = schema["~standard"];
+    const project = standard.jsonSchema?.[io];
+    if (project === undefined)
+        throw new TypeError(`Tool ${io} schema does not expose Standard JSON Schema`);
     Object.defineProperty(schema, "~standard", {
         value: {
             ...standard,
             jsonSchema: {
                 ...standard.jsonSchema,
-                input: (options) => ({
-                    ...describeProperties(inputJsonSchema(options)),
-                    examples: contract.examples.map(({ input }) => input),
-                }),
+                [io]: memoizeByTarget(advertise(project)),
             },
         },
     });
     return schema;
 };
+// The SDK reconverts every registered schema on each `tools/list`, although a
+// registered contract cannot change. Like the SDK's own memoized output
+// projection, the advertised value is shared and treated as read-only.
+const memoizeByTarget = (project) => {
+    const byTarget = new Map();
+    return (options) => {
+        if (options.libraryOptions !== undefined)
+            return project(options);
+        const cached = byTarget.get(options.target);
+        if (cached !== undefined)
+            return cached;
+        const projected = project(options);
+        byTarget.set(options.target, projected);
+        return projected;
+    };
+};
+/** Keep MCP tool roots object-shaped for clients that reject root unions. */
+const flattenRootUnion = (value) => {
+    if (!Array.isArray(value.anyOf))
+        return value;
+    const branches = value.anyOf.filter(isObject);
+    if (branches.length === 0 || branches.length !== value.anyOf.length)
+        return value;
+    const properties = {};
+    for (const branch of branches) {
+        if (!isObject(branch.properties))
+            return value;
+        for (const [name, schema] of Object.entries(branch.properties)) {
+            const previous = properties[name];
+            if (previous === undefined)
+                properties[name] = schema;
+            else if (JSON.stringify(previous) !== JSON.stringify(schema))
+                properties[name] = {
+                    anyOf: [previous, schema],
+                    description: fallbackPropertyDescription(name),
+                };
+        }
+    }
+    // The canonical Zod parser still enforces branch validation at invocation.
+    const { anyOf: _anyOf, required: _required, ...root } = value;
+    const requiredByBranch = branches.map((branch) => Array.isArray(branch.required)
+        ? branch.required.filter((item) => typeof item === "string")
+        : []);
+    const required = requiredByBranch.reduce((common, current) => common.filter((name) => current.includes(name)));
+    const minProperties = Math.max(typeof root.minProperties === "number" ? root.minProperties : 0, Math.min(...requiredByBranch.map((names) => names.length)));
+    return {
+        ...root,
+        type: "object",
+        properties,
+        ...(minProperties > 0 ? { minProperties } : {}),
+        ...(required.length > 0 ? { required } : {}),
+        ...(branches.every((branch) => branch.additionalProperties === false)
+            ? { additionalProperties: false }
+            : {}),
+    };
+};
 const describeProperties = (value) => Object.fromEntries(Object.entries(value).map(([key, child]) => {
     if (key !== "properties" || !isObject(child))
         return [key, describeValue(child)];

package/dist/contracts/webNetworkCaptureToolContracts.js

@@ -0,0 +1,24 @@
+import { inspectWebNetworkCaptureInputSchema, webNetworkCaptureSchema, } from "../domain/webNetworkCapture.js";
+import { toolContractMetadata } from "./toolEffects.js";
+import { evidenceResultOf } from "./toolOutputSchemas.js";
+/** Historical inspection is distinct from live browser capture and runtime authority. */
+export const WEB_NETWORK_CAPTURE_TOOL_CONTRACTS = [
+    {
+        name: "inspect_web_network_capture",
+        ...toolContractMetadata("inspect_web_network_capture"),
+        description: "Inspect retained local HAR 1.2 or native mitmproxy capture records without contacting recorded URLs. Returns original ordinals, pointers/byte ranges, preserved producer fields, precise numeric representations and exact exposed binary bytes inline. Excludes known transport credentials and explicitly marked values. Decodes every record before optional ordinal selection; malformed or oversized captures return no partial success. Duplicate HAR members are invalid; prototype-named members such as __proto__ are preserved as ordinary own JSON members without prototype mutation. Uses pinned upstream parsers, owned temporary files and bounded offline processes. Native mitmproxy requires caller-supplied mitmdump 12.2.3 on Linux. Browser transaction IDs, runtime attribution and original bytes of HAR Unicode text remain unknown.",
+        kind: "browser-provider",
+        inputSchema: inspectWebNetworkCaptureInputSchema,
+        outputSchema: evidenceResultOf(webNetworkCaptureSchema),
+        examples: [
+            {
+                title: "Inspect historical HAR entries",
+                input: {
+                    capture_path: "/captures/session.har",
+                    format: "har",
+                    record_ordinals: [0, 2],
+                },
+            },
+        ],
+    },
+];

package/dist/domain/analysisErrorBase.js

@@ -2,10 +2,14 @@
 const ANALYSIS_ERROR_TAGS = [
     "AnalysisProtocolError",
     "AnalysisInputError",
+    "AnalysisAccessDeniedError",
+    "AnalysisArtifactChangedError",
     "AnalysisOutputError",
     "AnalysisCapabilityUnavailableError",
+    "AnalysisUnsupportedTargetError",
     "AnalysisCancelledError",
     "AnalysisTimeoutError",
+    "AnalysisResourceConstraintError",
     "ProviderSelectionError",
     "ProviderAdapterError",
     "BrowserObservationError",
@@ -26,8 +30,24 @@ const ANALYSIS_ERROR_TAGS = [
 ];
 /** Base class for expected analysis, provider, and session failures. */
 export class AnalysisError extends Error {
+    capturedOutput;
+    cleanup;
+    cleanupIncomplete;
+    cleanupResources;
+    constructor(message, options) {
+        super(message, options);
+        this.capturedOutput =
+            options?.capturedOutput === undefined
+                ? undefined
+                : { ...options.capturedOutput };
+        this.cleanup = options?.cleanup;
+        this.cleanupIncomplete = options?.cleanup !== undefined;
+        this.cleanupResources = options?.cleanup?.resources ?? [];
+        this.partialObservation = options?.partialObservation;
+    }
     userMessage = undefined;
     userCategory = undefined;
-    cleanupIncomplete = false;
-    cleanupResources = [];
+    executionFailure = undefined;
+    partialObservation;
+    cleanupReport = undefined;
 }