rea-agents 6.1.0 → 6.2.0

package/dist/application/SetupPlan.js

@@ -1,4 +1,3 @@
-import { homedir } from "node:os";
 import { join } from "node:path";
 import { PRODUCT_IDENTITY } from "../identity.js";
 import { isOwnedClientRegistrationCommand } from "./ClientRegistrationIdentity.js";
@@ -6,7 +5,7 @@ import { linuxHopperInstallDisclosure, } from "./LinuxHopper.js";
 import { macHopperInstallDisclosure } from "./MacHopper.js";
 /** Discover supported clients and current registrations without mutation. */
 export const discoverSetupState = async (input) => {
-    const initialDoctor = input.initialDoctor ?? (await input.host.doctor(input.doctorScope));
+    const { initialDoctor } = input;
     const linuxHopperRepairNeeded = initialDoctor.checks.some(({ name, ok, detail }) => !ok &&
         (name === "hopper-demo-runtime" ||
             (name === "hopper-version" && detail === "/opt/hopper/bin/Hopper")));
@@ -22,7 +21,7 @@ export const discoverSetupState = async (input) => {
             (Object.keys(input.providerEnvironment).length === 0 ||
                 linuxHopperRepairNeeded));
     const [clients, detectedClients, skillNeedsInstall] = await Promise.all([
-        input.host.supportedClients?.() ?? input.host.detectedClients(),
+        input.host.supportedClients(),
         input.host.detectedClients(),
         input.host.skillNeedsInstall(),
     ]);
@@ -85,7 +84,7 @@ export const planSetupActions = async (input) => {
     });
     const inspections = await Promise.all(selectedClients.map(async (client) => ({
         client,
-        inspection: (await input.host.inspectClientConfiguration?.(client, input.providerEnvironment, input.command)) ?? { status: "update" },
+        inspection: await input.host.inspectClientConfiguration(client, input.providerEnvironment, input.command),
     })));
     const invalid = inspections.find(({ inspection }) => inspection.status === "invalid");
     if (invalid?.inspection.status === "invalid") {
@@ -117,6 +116,7 @@ export const planSetupActions = async (input) => {
     return {
         plannedActions: setupPlan({
             platform: input.host.platform,
+            homeDirectory: input.host.homeDirectory,
             installHopper: input.discovery.installHopper,
             installSkill: input.installSkill,
             clients: clientPlans,
@@ -139,7 +139,7 @@ const setupPlan = (input) => [
                 kind: "install_hopper",
                 label: "Hopper deep-analysis provider",
                 target: input.platform === "darwin"
-                    ? join(homedir(), "Applications/Hopper Disassembler.app")
+                    ? join(input.homeDirectory, "Applications/Hopper Disassembler.app")
                     : "system package manager",
                 detail: input.platform === "linux"
                     ? "Download, verify, and install Hopper plus its Xvfb demo-session dependencies. For the supported demo build, REA uses a private display and selects Hopper's offered demo mode for each analysis session."
@@ -175,7 +175,7 @@ const setupPlan = (input) => [
                 id: "install_skill",
                 kind: "install_skill",
                 label: "REA reverse-engineering skill",
-                target: join(homedir(), ".agents/skills", PRODUCT_IDENTITY.skillName),
+                target: join(input.homeDirectory, ".agents/skills", PRODUCT_IDENTITY.skillName),
                 detail: "Install or update the bundled REA reverse-engineering skill and on-demand references.",
                 external: false,
                 operation: "install",

package/dist/application/Uninstall.js

@@ -1,6 +1,7 @@
 import { parseClientConfiguration, serializeClientConfiguration, clientServerPath, legacyClientServerPath, withClientServers, } from "./ClientConfigurationDocument.js";
 import { copyFile, lstat, readFile, realpath, rm } from "node:fs/promises";
-import { homedir } from "node:os";
+import { constants as fsConstants } from "node:fs";
+import { homeDirectoryFromEnvironment } from "../config/homeDirectory.js";
 import { join } from "node:path";
 import writeFileAtomic from "write-file-atomic";
 import { z } from "zod";
@@ -10,7 +11,7 @@ import { resolveClientConfigTransactionPath } from "./ClientConfigPath.js";
 import { manualRegistrationRemediation, supportedClients, } from "./SupportedClients.js";
 const systemFileSystem = {
     readText: (path) => readFile(path, "utf8"),
-    copy: (source, destination) => copyFile(source, destination),
+    copy: (source, destination) => copyFile(source, destination, fsConstants.COPYFILE_EXCL),
     writeText: (path, contents) => writeFileAtomic(path, contents, { encoding: "utf8" }),
     stat: (path) => lstat(path),
     realpath: (path) => realpath(path),
@@ -30,14 +31,26 @@ export const isUninstallFailure = (result) => {
         }
     }
 };
-/** Remove only REA-owned registrations and managed files, optionally including local state. */
+/**
+ * Remove only REA-owned registrations and managed files, optionally including
+ * local state. A client configuration that cannot be read safely stops the
+ * operation before anything is removed; one that fails during removal stops
+ * the remaining removals.
+ */
 export const runUninstall = async (purgeData, host = systemUninstallHost()) => {
-    const items = [];
-    for (const client of await host.clients())
-        items.push(await host.removeClient(client));
-    items.push(await host.removeSkill());
-    if (purgeData)
-        items.push(...(await host.purgeData()));
+    const clients = await host.clients();
+    const blocked = [];
+    for (const client of clients) {
+        const blocking = await host.inspectClient(client);
+        if (blocking !== undefined)
+            blocked.push(blocking);
+    }
+    const items = blocked.length > 0
+        ? [
+            ...blocked,
+            item("uninstall", "skipped", "No REA registration, skill, or data was removed. Repair each failed configuration, then rerun uninstall."),
+        ]
+        : await removeAll(clients, purgeData, host);
     items.push({
         name: "analysis_engine",
         status: "retained",
@@ -50,41 +63,80 @@ export const runUninstall = async (purgeData, host = systemUninstallHost()) => {
         items,
     };
 };
+/**
+ * Each client is reread when it is edited, so a concurrent change is never
+ * overwritten. A client that fails then still stops the remaining removals.
+ */
+const removeAll = async (clients, purgeData, host) => {
+    const items = [];
+    for (const client of clients) {
+        const removed = await host.removeClient(client);
+        items.push(removed);
+        if (removed.status === "failed")
+            return [
+                ...items,
+                item("uninstall", "skipped", "Uninstall stopped at this failure; the items above report what changed. Repair the failed configuration, then rerun uninstall."),
+            ];
+    }
+    items.push(await host.removeSkill());
+    if (purgeData)
+        items.push(...(await host.purgeData()));
+    return items;
+};
 /** Create uninstall effects contained to detected client configs and REA-owned paths. */
-export const systemUninstallHost = (home = homedir(), fileSystem = systemFileSystem) => ({
-    clients: () => Promise.resolve(supportedClients(home)),
-    removeClient: (client) => removeClient(client, fileSystem),
-    removeSkill: () => removeManagedSkills(home, fileSystem),
-    purgeData: async () => [
-        await removeManagedPath(join(home, ".rea/cache"), "cache", fileSystem),
-        await removeManagedPath(join(home, ".rea/state"), "state", fileSystem),
-    ],
-});
-const removeClient = async (client, fileSystem) => {
+export const systemUninstallHost = (selectedHome = undefined, fileSystem = systemFileSystem, environment = process.env, platform = process.platform) => {
+    const home = selectedHome ?? homeDirectoryFromEnvironment(environment, platform);
+    return {
+        clients: () => Promise.resolve(supportedClients(home, platform, environment)),
+        inspectClient: async (client) => {
+            const read = await readClientConfiguration(client, fileSystem);
+            return read.kind === "item" && read.item.status === "failed"
+                ? read.item
+                : undefined;
+        },
+        removeClient: (client) => removeClient(client, fileSystem),
+        removeSkill: () => removeManagedSkills(home, fileSystem),
+        purgeData: async () => [
+            await removeManagedPath(join(home, ".rea/cache"), "cache", fileSystem),
+            await removeManagedPath(join(home, ".rea/state"), "state", fileSystem),
+        ],
+    };
+};
+const readClientConfiguration = async (client, fileSystem) => {
     if (client.format === "unsupported")
-        return item(client.name, "skipped", manualRegistrationRemediation(client.name) ??
-            "This client has no documented local MCP configuration boundary.");
+        return itemRead(item(client.name, "skipped", manualRegistrationRemediation(client.name) ??
+            "This client has no documented local MCP configuration boundary."));
     const resolved = await resolveUninstallConfigPath(client, fileSystem);
     if (typeof resolved !== "string")
-        return resolved;
+        return itemRead(resolved);
     const transactionPath = resolved;
     let original;
     try {
         original = await fileSystem.readText(transactionPath);
     }
     catch (cause) {
-        return isMissing(cause)
+        return itemRead(isMissing(cause)
             ? item(client.name, "skipped", "Configuration does not exist.")
-            : item(client.name, "failed", "Configuration could not be read. Check file permissions, then rerun uninstall.");
+            : item(client.name, "failed", "Configuration could not be read. Check file permissions, then rerun uninstall."));
     }
-    let parsed;
     try {
-        parsed = parseClientConfiguration(original, client.format);
+        const parsed = parseClientConfiguration(original, client.format);
+        return { kind: "configuration", transactionPath, original, parsed };
     }
     catch (cause) {
         void cause;
-        return item(client.name, "failed", `Configuration is not valid ${client.format === "toml" || client.format === "grok" ? "TOML" : client.format === "opencode" ? "JSONC" : "JSON"} and was not changed. Repair it, then rerun uninstall.`);
+        return itemRead(item(client.name, "failed", `Configuration is not valid ${client.format === "toml" || client.format === "grok" ? "TOML" : client.format === "opencode" ? "JSONC" : "JSON"} and was not changed. Repair it, then rerun uninstall.`));
     }
+};
+const itemRead = (result) => ({
+    kind: "item",
+    item: result,
+});
+const removeClient = async (client, fileSystem) => {
+    const read = await readClientConfiguration(client, fileSystem);
+    if (read.kind === "item")
+        return read.item;
+    const { transactionPath, original, parsed } = read;
     const name = PRODUCT_IDENTITY.mcpServerKey;
     // Beside a native OpenCode V2 table, OpenCode also loads a V1 `mcp.rea`.
     const legacyPath = legacyClientServerPath(parsed, name);
@@ -109,8 +161,8 @@ const removeClient = async (client, fileSystem) => {
         await fileSystem.copy(transactionPath, backupPath);
     }
     catch (cause) {
-        void cause;
-        return item(client.name, "failed", "Configuration could not be backed up, so no change was made. Check file permissions, then rerun uninstall.");
+        if (!(cause instanceof Error && "code" in cause && cause.code === "EEXIST"))
+            return item(client.name, "failed", "Configuration could not be backed up, so no change was made. Check file permissions, then rerun uninstall.");
     }
     try {
         await fileSystem.writeText(transactionPath, serializeClientConfiguration(document, client.format, original, editedPaths));

package/dist/application/UpdateMaintenance.js

@@ -21,9 +21,11 @@ const setupPlanSchema = z.object({
     })),
 });
 /** Discover owned registrations and an existing REA skill without writes. */
-export const existingMaintenanceScope = async (home, entryPoint) => {
-    const registrations = await readClientRegistrationStatuses(home, entryPoint);
-    const supported = supportedClients(home);
+export const existingMaintenanceScope = async (home, entryPoint, environment) => {
+    const registrations = await readClientRegistrationStatuses(home, entryPoint, {
+        environment,
+    });
+    const supported = supportedClients(home, process.platform, environment);
     const clients = [];
     for (const registration of registrations) {
         if ((registration.state !== "aligned" && registration.state !== "stale") ||
@@ -56,9 +58,9 @@ export const existingMaintenanceScope = async (home, entryPoint) => {
     return { clients, skill };
 };
 /** Ask the verified new executable to plan only existing REA integrations. */
-export const planIntegrationMaintenance = async (home, entryPoint, execute) => {
+export const planIntegrationMaintenance = async (home, entryPoint, environment, execute) => {
     try {
-        const scope = await existingMaintenanceScope(home, entryPoint);
+        const scope = await existingMaintenanceScope(home, entryPoint, environment);
         if (scope.clients.length === 0 && !scope.skill)
             return { status: "current", plannedActions: [] };
         const command = [

package/dist/application/UpdateRuntime.js

@@ -1,5 +1,5 @@
 import { realpath } from "node:fs/promises";
-import { homedir } from "node:os";
+import { homeDirectoryFromEnvironment } from "../config/homeDirectory.js";
 import { basename, dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import spawn from "cross-spawn";
@@ -9,13 +9,13 @@ import { safeParseJson } from "../domain/safeJson.js";
 import { updateInstallCommand, } from "./Update.js";
 import { planIntegrationMaintenance } from "./UpdateMaintenance.js";
 /** Run an updater subprocess with complete diagnostics and isolated machine output. */
-export const runUpdateCommand = (command, output = "structured") => new Promise((resolveResult) => {
+export const runUpdateCommand = (command, selectedEnvironment, output = "structured") => new Promise((resolveResult) => {
     const [executable, ...args] = command;
     if (executable === undefined) {
         resolveResult(err("No executable supplied."));
         return;
     }
-    const environment = { ...process.env };
+    const environment = { ...selectedEnvironment };
     // A fresh installed entry point must not inherit npx's invocation identity.
     delete environment.npm_command;
     const child = spawn(executable, args, {
@@ -46,8 +46,8 @@ export const runUpdateCommand = (command, output = "structured") => new Promise(
                 ? `Process exited with code ${String(code)}.`
                 : `Process terminated by ${signal}.`))));
 });
-const requireCommandOutput = async (command) => {
-    const result = await runUpdateCommand(command);
+const requireCommandOutput = async (command, environment) => {
+    const result = await runUpdateCommand(command, environment);
     if (!result.ok)
         throw new Error(result.error);
     return result.value;
@@ -130,21 +130,21 @@ export const npmReleaseLookup = (response) => {
         : err({ kind: "invalid-metadata", detail: parsed.error });
 };
 /** Create npm, registry, verification, and read-only maintenance effects. */
-export const systemUpdateHost = (packageRoot = fileURLToPath(new URL("../..", import.meta.url)), home = homedir()) => ({
+export const systemUpdateHost = (packageRoot = fileURLToPath(new URL("../..", import.meta.url)), home = undefined, environment = process.env) => ({
     installation: () => detectNpmInstallation(packageRoot, {
         canonicalPath: realpath,
-        globalRoot: () => requireCommandOutput(["npm", "root", "--global"]),
-        globalPrefix: () => requireCommandOutput(["npm", "prefix", "--global"]),
+        globalRoot: () => requireCommandOutput(["npm", "root", "--global"], environment),
+        globalPrefix: () => requireCommandOutput(["npm", "prefix", "--global"], environment),
     }),
-    latestVersion: async (installation) => npmReleaseLookup(await runUpdateCommand(npmLatestVersionCommand(installation))),
+    latestVersion: async (installation) => npmReleaseLookup(await runUpdateCommand(npmLatestVersionCommand(installation), environment)),
     installVersion: async (installation, version, output) => {
-        const result = await runUpdateCommand(updateInstallCommand(installation, version), output);
+        const result = await runUpdateCommand(updateInstallCommand(installation, version), environment, output);
         return result.ok ? ok(undefined) : result;
     },
     installedVersion: (installation) => runUpdateCommand([
         process.execPath,
         join(installation.packageRoot, "scripts", "rea.mjs"),
         "--version",
-    ]),
-    planMaintenance: (installation) => planIntegrationMaintenance(home, join(installation.packageRoot, "scripts", "rea.mjs"), runUpdateCommand),
+    ], environment),
+    planMaintenance: (installation) => planIntegrationMaintenance(home ?? homeDirectoryFromEnvironment(environment, process.platform), join(installation.packageRoot, "scripts", "rea.mjs"), environment, (command) => runUpdateCommand(command, environment)),
 });

package/dist/application/WebScriptExportService.js

@@ -5,7 +5,7 @@ import { z } from "zod";
 import { ArtifactReaderFailure } from "../artifacts/ArtifactReader.js";
 import { publishWebScripts } from "../browser/assets/PublishWebScripts.js";
 import { selectScriptCapture } from "../browser/assets/ScriptCaptureAdapters.js";
-import { AnalysisCancelledError, AnalysisInputError, AnalysisOutputError, } from "../domain/analysisErrorCore.js";
+import { AnalysisAccessDeniedError, AnalysisCancelledError, AnalysisInputError, AnalysisOutputError, } from "../domain/analysisErrorCore.js";
 import { createEvidence } from "../domain/evidence.js";
 import { analysisInputErrorFromIssues } from "../domain/inputIssueProjection.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";
@@ -35,9 +35,10 @@ export const exportWebScriptsValidated = async (input, options = {}) => {
         ]));
     try {
         options.signal?.throwIfAborted();
-        const bytes = await readFile(input.capture_path, {
-            signal: options.signal,
-        });
+        const read = await readCapture(input.capture_path, options.signal);
+        if (!read.ok)
+            return read;
+        const bytes = read.value;
         const loaded = parseCapture(bytes);
         if (!loaded.ok)
             return loaded;
@@ -90,6 +91,31 @@ export const exportWebScriptsValidated = async (input, options = {}) => {
         }));
     }
 };
+/**
+ * Read the caller-selected capture. A missing, non-file or unreadable
+ * selection is a caller or host-permission failure, not an export failure.
+ */
+const readCapture = async (path, signal) => {
+    try {
+        return ok(await readFile(path, { signal }));
+    }
+    catch (cause) {
+        const code = cause instanceof Error && "code" in cause ? String(cause.code) : "";
+        if (code === "EACCES" || code === "EPERM")
+            return err(new AnalysisAccessDeniedError(OPERATION, path, code, { cause }));
+        if (code === "ENOENT" || code === "ENOTDIR" || code === "EISDIR")
+            return err(new AnalysisInputError(OPERATION, { cause }, [
+                {
+                    path: ["capture_path"],
+                    reason: "invalid_value",
+                    message: code === "EISDIR"
+                        ? `Selected capture is a directory, not a file: ${path}`
+                        : `Selected capture could not be read (${code}): ${path}`,
+                },
+            ]));
+        throw cause;
+    }
+};
 const parseCapture = (bytes) => {
     try {
         const text = new TextDecoder("utf-8", {

package/dist/application/WorkflowEvidence.js

@@ -1,6 +1,6 @@
 import { REA_WORKFLOW_PROVIDER, workflowAnalysisProfile, } from "./InvestigationProviders.js";
 import { analysisProfileSchema, committedProviderSchema, } from "../domain/analysisProfile.js";
-import { createEvidence } from "../domain/evidence.js";
+import { createEvidence, } from "../domain/evidence.js";
 import { UnknownRegistryError } from "../domain/unknownRegistryError.js";
 /** Build the shared Evidence record for a successful composed binary workflow. */
 export const createWorkflowEvidence = (input) => createEvidence(input.target, REA_WORKFLOW_PROVIDER, {
@@ -14,10 +14,33 @@ export const createWorkflowEvidence = (input) => createEvidence(input.target, RE
         }),
     confidence: "derived",
     limitations: ["Derived by an REA composed workflow."],
+    ...(input.operation === "batch_decompile"
+        ? { locations: batchProcedureLocations(input.result) }
+        : {}),
 });
+const batchProcedureLocations = (result) => {
+    if (result === null ||
+        typeof result !== "object" ||
+        Array.isArray(result) ||
+        !Array.isArray(result.items))
+        return [];
+    const addresses = new Set();
+    for (const item of result.items) {
+        if (item === null || typeof item !== "object" || Array.isArray(item))
+            continue;
+        const procedure = item.procedure;
+        if (procedure !== null &&
+            typeof procedure === "object" &&
+            !Array.isArray(procedure) &&
+            procedure.status === "resolved" &&
+            typeof procedure.address === "string")
+            addresses.add(procedure.address);
+    }
+    return [...addresses].map((address) => ({ kind: "address", address }));
+};
 /** Convert workflow Evidence into its exact replay binding, when it has a profile. */
 export const workflowSnapshotRecord = (evidence, operation) => {
-    if (!("analysis_profile" in evidence))
+    if (evidence.analysis_profile === null)
         return undefined;
     return {
         operation,

package/dist/application/XrefsAddressResolution.js

@@ -0,0 +1,45 @@
+import { addressedValue } from "../contracts/toolOutputSchemaPrimitives.js";
+import { AnalysisCapabilityUnavailableError, AnalysisInputError, AnalysisOutputError, } from "../domain/analysisErrorCore.js";
+import { err, ok } from "../domain/result.js";
+import { resolveProcedureAddress } from "./ProcedureAddressResolution.js";
+/** Resolve a CLI symbol selector without changing existing address spellings. */
+export const resolveXrefsAddress = async (analysis, selector, signal) => {
+    if (selector.length === 0 ||
+        /^[0-9a-f]+$/iu.test(selector) ||
+        /^0x/iu.test(selector) ||
+        /:0x/iu.test(selector))
+        return ok(selector);
+    const inventory = await analysis.execute("list_names", {}, { signal });
+    if (!inventory.ok) {
+        if (inventory.error instanceof AnalysisCapabilityUnavailableError &&
+            inventory.error.operation === "list_names" &&
+            !inventory.error.cleanupIncomplete)
+            return resolveProcedureAddress(async (operation, parameters, signal) => {
+                const result = await analysis.execute(operation, parameters, signal === undefined ? {} : { signal });
+                return result.ok ? ok(result.value.result) : result;
+            }, selector, signal);
+        return inventory;
+    }
+    if (!Array.isArray(inventory.value.result))
+        return err(new AnalysisOutputError("list_names", "Expected a symbol inventory array"));
+    const addresses = new Set();
+    for (const [index, item] of inventory.value.result.entries()) {
+        const parsed = addressedValue.safeParse(item);
+        if (!parsed.success || parsed.data.address.length === 0)
+            return err(new AnalysisOutputError("list_names", `Invalid symbol inventory entry at index ${index}`));
+        if (parsed.data.value === selector)
+            addresses.add(parsed.data.address);
+    }
+    const [address] = addresses;
+    if (addresses.size === 1 && address !== undefined)
+        return ok(address);
+    return err(new AnalysisInputError("xrefs", undefined, [
+        {
+            path: ["address"],
+            reason: "invalid_value",
+            message: addresses.size === 0
+                ? `Unknown analyzed symbol name ${JSON.stringify(selector)}. Use an exact analyzed name or a hexadecimal address.`
+                : `Analyzed symbol name ${JSON.stringify(selector)} is ambiguous at ${[...addresses].join(", ")}. Select an exact address.`,
+        },
+    ]));
+};

package/dist/application/analysisView/AnalysisViewService.js

@@ -0,0 +1,76 @@
+import { z } from "zod";
+import { ANALYSIS_VIEW_PROVIDER } from "../InvestigationProviders.js";
+import { resolveEvidenceInput } from "../EvidenceInputResolver.js";
+import { analysisInputErrorFromIssues } from "../../domain/inputIssueProjection.js";
+import { EvidenceIntegrityError } from "../../domain/evidenceErrors.js";
+import { createEvidence, parseEvidence, } from "../../domain/evidence.js";
+import { INSPECT_ANALYSIS_VIEW_OPERATION, inspectAnalysisViewInputSchema, projectAnalysisView, } from "../../domain/analysisView/analysisView.js";
+import { jsonValueSchema } from "../../domain/jsonValue.js";
+import { err, ok } from "../../domain/result.js";
+/** Authenticate a selected-view request and project already completed Evidence. */
+export const inspectAnalysisView = (rawInput, lookup) => {
+    const parsed = inspectAnalysisViewInputSchema.safeParse(rawInput);
+    if (!parsed.success)
+        return err(analysisInputErrorFromIssues(INSPECT_ANALYSIS_VIEW_OPERATION, parsed.error.issues, rawInput, { cause: parsed.error }));
+    return inspectAnalysisViewValidated(parsed.data, lookup);
+};
+/** Project a view from input already parsed by a trusted adapter. */
+export const inspectAnalysisViewValidated = (input, lookup) => {
+    const resolved = resolveAnalysisViewSource(input.source, lookup);
+    if (!resolved.ok)
+        return resolved;
+    const parent = resolved.value;
+    const projected = projectAnalysisView({
+        evidenceId: parent.evidence_id,
+        operation: parent.operation,
+        normalizedResult: parent.normalized_result,
+        limitations: parent.limitations,
+    }, input.view);
+    if (!projected.ok)
+        return projected;
+    if (parent.subject !== null &&
+        parent.subject.digest.sha256 !== projected.value.artifact.sha256)
+        return err(new EvidenceIntegrityError(`Parent subject SHA-256 ${parent.subject.digest.sha256} differs from analysis artifact SHA-256 ${projected.value.artifact.sha256}.`));
+    return ok(createAnalysisViewEvidence(input, parent, projected.value));
+};
+const resolveAnalysisViewSource = (source, lookup) => {
+    if (source.kind === "retained-evidence")
+        return resolveEvidenceInput(source, lookup);
+    try {
+        return ok(parseEvidence(source.evidence));
+    }
+    catch (cause) {
+        if (cause instanceof z.ZodError)
+            return err(analysisInputErrorFromIssues(INSPECT_ANALYSIS_VIEW_OPERATION, cause.issues, source.evidence, { cause }));
+        if (cause instanceof TypeError)
+            return err(new EvidenceIntegrityError(cause.message, cause.message.length > 0 ? { userMessage: cause.message } : undefined));
+        throw cause;
+    }
+};
+const createAnalysisViewEvidence = (input, parent, result) => {
+    const target = parent.subject === null
+        ? undefined
+        : {
+            path: parent.subject.local_path,
+            sha256: parent.subject.digest.sha256,
+            format: parent.subject.format,
+            ...(parent.subject.architecture === null
+                ? {}
+                : { architecture: parent.subject.architecture }),
+        };
+    return createEvidence(target, ANALYSIS_VIEW_PROVIDER, {
+        predicateType: "rea.analysis-view",
+        operation: INSPECT_ANALYSIS_VIEW_OPERATION,
+        parameters: {
+            parent_evidence_id: parent.evidence_id,
+            view: jsonValueSchema.parse(input.view),
+        },
+        result: jsonValueSchema.parse(result),
+        rawResult: null,
+        confidence: "derived",
+        authority: parent.authority,
+        limitations: result.limitations,
+        locations: [{ kind: "artifact-path", path: result.artifact.path }],
+        evidenceLinks: [parent.evidence_id],
+    });
+};

package/dist/application/binary/AnalysisClientCleanup.js

@@ -1,14 +1,39 @@
 import { ProviderCleanupError } from "../../domain/providerCleanupError.js";
-import { err, ok } from "../../domain/result.js";
+import { ProviderAdapterError } from "../../domain/providerAdapterError.js";
+import { projectAnalysisError } from "../../domain/analysisErrorProjection.js";
+import { err } from "../../domain/result.js";
+import { AnalysisError } from "../../domain/analysisErrorBase.js";
 /** Close one provider client and normalize unexpected adapter rejection. */
 export const closeAnalysisClient = async (client, providerId, options = {}) => {
     try {
-        if (client.closeWithOutcome !== undefined)
-            return await client.closeWithOutcome(options);
-        await client.close();
-        return ok(null);
+        return await client.close(options);
     }
     catch (cause) {
+        // A typed cleanup failure already names its leftover resources.
+        if (cause instanceof AnalysisError && cause.cleanupIncomplete)
+            return err(cause);
         return err(new ProviderCleanupError(providerId, ["provider-client"], { reason: "provider client close rejected unexpectedly" }, { cause }));
     }
 };
+/** Preserve the original lifecycle failure alongside incomplete cleanup. */
+export const analysisErrorWithCleanupFailure = (primary, cleanup, operation = "close_binary") => {
+    const projected = projectAnalysisError(cleanup);
+    return new ProviderAdapterError(cleanup instanceof ProviderAdapterError ? cleanup.providerId : "rea", operation, {
+        cause: primary,
+        userMessage: projectAnalysisError(primary).message,
+        ...(primary.capturedOutput === undefined
+            ? {}
+            : { capturedOutput: primary.capturedOutput }),
+        ...(primary.partialObservation === undefined
+            ? {}
+            : { partialObservation: primary.partialObservation }),
+        cleanup: {
+            reason: projected.message,
+            resources: cleanup.cleanupResources,
+        },
+        diagnostics: {
+            primary_error: projectAnalysisError(primary),
+            cleanup_error: projected,
+        },
+    });
+};

package/dist/application/binary/AnalysisProviderEvaluation.js

@@ -46,14 +46,13 @@ export const evaluateAnalysisProviderCandidate = async (candidate, status, targe
         if (resolved.value.profile === null)
             return ok(rejectedProfile(candidate, status, "Provider version or analysis profile could not be resolved"));
         const profile = analysisProfileSchema.parse(resolved.value.profile);
-        const compatibility = jsonObjectSchema.parse(resolved.value.compatibility);
         const identity = candidate.identity();
         if (profile.provider.id !== identity.id ||
             profile.provider.name !== identity.name ||
             (identity.version !== null &&
                 profile.provider.version !== identity.version))
             return ok(rejectedProfile(candidate, status, "Resolved analysis profile has mismatched provider identity"));
-        return ok({ candidate, status, profile, compatibility });
+        return ok({ candidate, status, profile });
     }
     catch (cause) {
         void cause;

package/dist/application/binary/AnalysisProviderRegistry.js

@@ -117,13 +117,11 @@ export class AnalysisProviderRegistry {
         if (evaluated.profileError !== undefined)
             return err(evaluated.profileError);
         const statuses = replaceCandidate(baseline, evaluated.status);
-        if (evaluated.profile === undefined ||
-            evaluated.compatibility === undefined)
+        if (evaluated.profile === undefined)
             return err(selectionError("provider_unavailable", providerId, statuses));
         return ok(selectedResult(providerId, source, {
             ...evaluated,
             profile: evaluated.profile,
-            compatibility: evaluated.compatibility,
         }, statuses));
     }
     async #selectAutomatically(context) {
@@ -149,8 +147,7 @@ export class AnalysisProviderRegistry {
             return result.value;
         });
         const statuses = evaluations.map(({ status }) => status);
-        const usable = evaluations.filter((evaluation) => evaluation.profile !== undefined &&
-            evaluation.compatibility !== undefined);
+        const usable = evaluations.filter((evaluation) => evaluation.profile !== undefined);
         if (usable.length === 0)
             return ok({
                 requestedProviderId: "auto",
@@ -195,7 +192,6 @@ const selectedResult = (requestedProviderId, source, evaluated, statuses) => {
             identity: structuredClone(evaluated.profile.provider),
             selectionSource: source,
             profile: structuredClone(evaluated.profile),
-            compatibility: structuredClone(evaluated.compatibility),
         },
         candidates: replaceCandidate(statuses, selectedStatus),
     };