rea-agents 6.2.0 → 6.4.0

package/dist/application/UpdateMaintenance.js

@@ -1,11 +1,11 @@
-import { readFile } from "node:fs/promises";
-import { join } from "node:path";
 import { z } from "zod";
 import { PRODUCT_IDENTITY } from "../identity.js";
 import { isOwnedClientRegistrationCommand } from "./ClientRegistrationIdentity.js";
 import { readClientRegistrationStatuses } from "./ClientRegistrationStatus.js";
-import { effectiveClientServer, parseClientConfiguration, } from "./ClientConfigurationDocument.js";
+import { clientServerForcedEnabled, clientServerListedDisabled, effectiveClientServer, parseClientConfiguration, } from "./ClientConfigurationDocument.js";
 import { supportedClients } from "./SupportedClients.js";
+import { existingSkillDestinations } from "./SetupSkill.js";
+import { readRegularFileText } from "./RegularFileRead.js";
 const setupPlanSchema = z.object({
     status: z.literal("planned"),
     plannedActions: z.array(z.object({
@@ -20,7 +20,7 @@ const setupPlanSchema = z.object({
         commands: z.array(z.string()).optional(),
     })),
 });
-/** Discover owned registrations and an existing REA skill without writes. */
+/** Discover owned registrations and REA skills without writes. */
 export const existingMaintenanceScope = async (home, entryPoint, environment) => {
     const registrations = await readClientRegistrationStatuses(home, entryPoint, {
         environment,
@@ -34,33 +34,32 @@ export const existingMaintenanceScope = async (home, entryPoint, environment) =>
         const client = supported.find(({ name }) => name === registration.client);
         if (client === undefined)
             continue;
-        const parsed = parseClientConfiguration(await readFile(client.configPath, "utf8"), client.format);
+        const parsed = parseClientConfiguration(await readRegularFileText(client.configPath), client.format);
         const enabled = z
             .object({
             enabled: z.boolean().optional(),
             disabled: z.boolean().optional(),
         })
             .parse(effectiveClientServer(parsed, PRODUCT_IDENTITY.mcpServerKey));
-        if (enabled.enabled !== false && enabled.disabled !== true)
+        // Root disable lists override enabled entries and OMP's force-on allowlist.
+        if ((enabled.enabled !== false ||
+            clientServerForcedEnabled(parsed, PRODUCT_IDENTITY.mcpServerKey)) &&
+            enabled.disabled !== true &&
+            !clientServerListedDisabled(parsed, PRODUCT_IDENTITY.mcpServerKey))
             clients.push(client.name);
     }
-    let skill = false;
-    try {
-        const content = await readFile(join(home, ".agents", "skills", PRODUCT_IDENTITY.skillName, "SKILL.md"), "utf8");
-        skill =
-            content.startsWith(`---\nname: ${PRODUCT_IDENTITY.skillName}\n`) ||
-                content.startsWith(`---\r\nname: ${PRODUCT_IDENTITY.skillName}\r\n`);
-    }
-    catch (cause) {
-        if (!(cause instanceof Error && "code" in cause && cause.code === "ENOENT"))
-            throw cause;
-    }
-    return { clients, skill };
+    const skillDestinations = await existingSkillDestinations(home, environment);
+    return {
+        clients,
+        skill: skillDestinations.length > 0,
+        skillDestinations,
+    };
 };
 /** Ask the verified new executable to plan only existing REA integrations. */
 export const planIntegrationMaintenance = async (home, entryPoint, environment, execute) => {
     try {
         const scope = await existingMaintenanceScope(home, entryPoint, environment);
+        const skillDestinations = scope.skillDestinations ?? [];
         if (scope.clients.length === 0 && !scope.skill)
             return { status: "current", plannedActions: [] };
         const command = [
@@ -68,6 +67,7 @@ export const planIntegrationMaintenance = async (home, entryPoint, environment,
             entryPoint,
             "setup",
             ...scope.clients.flatMap((client) => ["--client", client]),
+            ...skillDestinations.flatMap(({ client }) => ["--skill-client", client]),
             `--skill=${String(scope.skill)}`,
         ];
         const execution = await execute([...command, "--dry-run", "--json"]);
@@ -81,11 +81,11 @@ export const planIntegrationMaintenance = async (home, entryPoint, environment,
             };
         if (plan.data.plannedActions.length === 0)
             return { status: "current", plannedActions: [] };
-        const allowedIds = new Set([
-            ...scope.clients.map((client) => `configure_client:${client}`),
-            ...(scope.skill ? ["install_skill"] : []),
-        ]);
-        if (plan.data.plannedActions.some(({ id }) => !allowedIds.has(id)))
+        const allowedIds = new Set(scope.clients.map((client) => `configure_client:${client}`));
+        const skillTargets = new Set(skillDestinations.map(({ path }) => path));
+        if (plan.data.plannedActions.some((action) => action.kind === "install_skill"
+            ? !skillTargets.has(action.target)
+            : !allowedIds.has(action.id)))
             return {
                 status: "unavailable",
                 remediation: "The updated setup plan included an integration outside the existing REA maintenance scope.",

package/dist/application/Utf8JsonInput.js

@@ -0,0 +1,71 @@
+import { constants } from "node:buffer";
+import { AnalysisResourceConstraintError } from "../domain/analysisErrorCore.js";
+import { safeParseJson } from "../domain/safeJson.js";
+/** Recovery that preserves complete, authenticated Evidence workflow inputs. */
+export const JSON_INPUT_RESOURCE_REMEDIATION = "Provide a smaller valid JSON value. For Evidence workflows, re-analyze a smaller selection of the original target and use its complete Evidence; splitting JSON text or trimming Evidence fields does not produce valid workflow input.";
+/**
+ * Strict JSON input keeps rejecting a leading byte-order mark, but names it:
+ * the parser's own message quotes the invisible U+FEFF as the bad token.
+ */
+export const JSON_BYTE_ORDER_MARK_MESSAGE = "JSON input begins with a UTF-8 byte-order mark (EF BB BF), which strict JSON input does not accept. Save the file as UTF-8 without a byte-order mark.";
+/** Decode JSON bytes without confusing a runtime string limit with malformed input. */
+export const parseUtf8Json = (bytes, operation, path, boundary = "json-input") => {
+    const stringLimitFailure = (cause, decodedUnits) => new AnalysisResourceConstraintError(operation, "memory", "JSON input exceeds the runtime's maximum decoded string length", {
+        boundary,
+        input_path: path,
+        input_bytes: bytes.byteLength,
+        max_string_code_units: constants.MAX_STRING_LENGTH,
+        ...(decodedUnits === undefined
+            ? {}
+            : { decoded_string_code_units_at_least: decodedUnits }),
+    }, {
+        ...(cause === undefined ? {} : { cause }),
+        remediationAction: JSON_INPUT_RESOURCE_REMEDIATION,
+    });
+    let text;
+    try {
+        const decoder = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true });
+        if (bytes.byteLength <= constants.MAX_STRING_LENGTH) {
+            text = decoder.decode(bytes);
+        }
+        else {
+            // Node 22's UTF-8 fast path bounds encoded bytes before decoding. Decode
+            // large inputs in chunks so valid multibyte text is bounded by its actual
+            // UTF-16 length. Streaming also preserves characters spanning chunks.
+            const parts = [];
+            let decodedUnits = 0;
+            const append = (part) => {
+                decodedUnits += part.length;
+                if (decodedUnits > constants.MAX_STRING_LENGTH)
+                    throw stringLimitFailure(undefined, decodedUnits);
+                parts.push(part);
+            };
+            const chunkBytes = 1024 * 1024;
+            for (let offset = 0; offset < bytes.byteLength; offset += chunkBytes)
+                append(decoder.decode(bytes.subarray(offset, offset + chunkBytes), {
+                    stream: true,
+                }));
+            append(decoder.decode());
+            text = parts.join("");
+        }
+    }
+    catch (cause) {
+        if (cause instanceof AnalysisResourceConstraintError)
+            throw cause;
+        const code = typeof cause === "object" && cause !== null && "code" in cause
+            ? cause.code
+            : undefined;
+        if (code === "ERR_STRING_TOO_LONG")
+            throw stringLimitFailure(cause);
+        if (code !== "ERR_ENCODING_INVALID_ENCODED_DATA")
+            throw cause;
+        return {
+            ok: false,
+            error: "JSON input is not valid UTF-8",
+            cause,
+        };
+    }
+    if (text.startsWith("\uFEFF"))
+        return { ok: false, error: JSON_BYTE_ORDER_MARK_MESSAGE, cause: undefined };
+    return safeParseJson(text);
+};

package/dist/application/WebScriptExportService.js

@@ -1,5 +1,4 @@
 import { createHash } from "node:crypto";
-import { readFile } from "node:fs/promises";
 import { isAbsolute } from "node:path";
 import { z } from "zod";
 import { ArtifactReaderFailure } from "../artifacts/ArtifactReader.js";
@@ -7,24 +6,28 @@ import { publishWebScripts } from "../browser/assets/PublishWebScripts.js";
 import { selectScriptCapture } from "../browser/assets/ScriptCaptureAdapters.js";
 import { AnalysisAccessDeniedError, AnalysisCancelledError, AnalysisInputError, AnalysisOutputError, } from "../domain/analysisErrorCore.js";
 import { createEvidence } from "../domain/evidence.js";
+import { analysisErrorWithCleanupFailure } from "../domain/analysisErrorCleanup.js";
 import { analysisInputErrorFromIssues } from "../domain/inputIssueProjection.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";
 import { ProviderAdapterError } from "../domain/providerAdapterError.js";
+import { ProviderCleanupError } from "../domain/providerCleanupError.js";
 import { err, ok } from "../domain/result.js";
 import { safeParseJson } from "../domain/safeJson.js";
 import { exportWebScriptsInputSchema, } from "../domain/webScriptExport.js";
 import { WebScriptExportError } from "../domain/webScriptExportError.js";
 import { WEB_SCRIPT_EXPORT_PROVIDER as PROVIDER } from "./InvestigationProviders.js";
+import { readRegularFile, RegularFileCleanupFailure, retryRegularFileCleanup, } from "./RegularFileRead.js";
+import { NonRegularFileReadError, RegularFileChangedError, } from "../filesystem/RegularFile.js";
 const OPERATION = "export_web_scripts";
 /** Export one local capture through the shared CLI/MCP application workflow. */
-export const exportWebScripts = async (rawInput, options = {}) => {
+export const exportWebScripts = async (rawInput, resources, options = {}) => {
     const input = exportWebScriptsInputSchema.safeParse(rawInput);
     return input.success
-        ? exportWebScriptsValidated(input.data, options)
+        ? exportWebScriptsValidated(input.data, resources, options)
         : err(analysisInputErrorFromIssues(OPERATION, input.error.issues, rawInput));
 };
 /** Publish input already parsed by a named adapter contract. */
-export const exportWebScriptsValidated = async (input, options = {}) => {
+export const exportWebScriptsValidated = async (input, resources, options = {}) => {
     if (!isAbsolute(input.capture_path) || !isAbsolute(input.output_directory))
         return err(new AnalysisInputError(OPERATION, undefined, [
             {
@@ -35,16 +38,16 @@ export const exportWebScriptsValidated = async (input, options = {}) => {
         ]));
     try {
         options.signal?.throwIfAborted();
-        const read = await readCapture(input.capture_path, options.signal);
-        if (!read.ok)
-            return read;
-        const bytes = read.value;
-        const loaded = parseCapture(bytes);
-        if (!loaded.ok)
-            return loaded;
+        const prepared = await prepareCapture(input.capture_path, resources, options.signal);
+        if (!prepared.ok)
+            return prepared;
+        const { bytes, loaded } = prepared.value;
         options.signal?.throwIfAborted();
         const sha256 = createHash("sha256").update(bytes).digest("hex");
-        const result = await publishWebScripts(input, loaded.value, sha256, options.signal);
+        const result = await publishWebScripts(input, loaded, sha256, {
+            resources,
+            ...(options.signal === undefined ? {} : { signal: options.signal }),
+        });
         return ok(createEvidence({ path: input.capture_path, sha256, format: "file" }, PROVIDER, {
             predicateType: "rea.web-script-export",
             operation: OPERATION,
@@ -58,65 +61,132 @@ export const exportWebScriptsValidated = async (input, options = {}) => {
             authority: "historical-reference",
             limitations: result.limitations,
             locations: [{ kind: "artifact-path", path: result.manifest.path }],
-            evidenceLinks: loaded.value.sourceEvidenceId === null
-                ? []
-                : [loaded.value.sourceEvidenceId],
+            evidenceLinks: loaded.sourceEvidenceId === null ? [] : [loaded.sourceEvidenceId],
         }));
     }
     catch (cause) {
-        if (cause instanceof WebScriptExportError)
-            return err(cause);
-        if (options.signal?.aborted === true)
-            return err(new AnalysisCancelledError(OPERATION));
-        if (cause instanceof ArtifactReaderFailure)
-            return err(new WebScriptExportError(cause.reason, input.output_directory, cause.message));
-        if (cause instanceof z.ZodError)
-            return err(new AnalysisOutputError(OPERATION, cause.message, { cause }));
-        if (cause instanceof Error &&
-            "code" in cause &&
-            typeof cause.code === "string")
-            return err(new WebScriptExportError("io", `${input.capture_path} → ${input.output_directory}`, cause.message));
-        return err(new ProviderAdapterError(PROVIDER.id, OPERATION, {
-            cause,
-            diagnostics: {
-                capture_path: input.capture_path,
-                output_directory: input.output_directory,
-                error_name: cause instanceof Error ? cause.name : "UnknownError",
-                error_message: cause instanceof Error
-                    ? cause.message
-                    : typeof cause === "string"
-                        ? cause
-                        : "Unknown script export failure",
-            },
-        }));
+        return err(mapExportFailure(cause, input, options.signal));
+    }
+};
+const prepareCapture = async (path, resources, signal) => {
+    const read = await resources.run(() => readCapture(path, resources, signal));
+    if (!read.ok)
+        return read;
+    const cleanup = read.value.cleanup;
+    const loaded = parseCapture(read.value.bytes, cleanup === undefined || cleanup.incomplete
+        ? undefined
+        : { cause: cleanup.cause });
+    if (!loaded.ok)
+        return err(cleanup?.incomplete === true
+            ? incompleteCaptureCleanup(loaded.error, path, cleanup)
+            : loaded.error);
+    if (cleanup !== undefined) {
+        const primary = new WebScriptExportError("io", path, `Capture handle close failed: ${cleanup.reason}`, { cause: cleanup.cause });
+        return err(cleanup.incomplete
+            ? incompleteCaptureCleanup(primary, path, cleanup)
+            : primary);
     }
+    return ok({ bytes: read.value.bytes, loaded: loaded.value });
+};
+const mapExportFailure = (cause, input, signal) => {
+    if (cause instanceof WebScriptExportError)
+        return cause;
+    if (cause instanceof ArtifactReaderFailure && cause.cleanup !== undefined)
+        return analysisErrorWithCleanupFailure(new WebScriptExportError(cause.reason, input.output_directory, cause.message, { cause }), new ProviderCleanupError(PROVIDER.id, cause.cleanup.resources, { reason: cause.cleanup.reason }, { cause, operation: OPERATION }), OPERATION);
+    if (signal?.aborted === true)
+        return new AnalysisCancelledError(OPERATION, { cause });
+    if (cause instanceof ArtifactReaderFailure)
+        return new WebScriptExportError(cause.reason, input.output_directory, cause.message, { cause });
+    if (cause instanceof z.ZodError)
+        return new AnalysisOutputError(OPERATION, cause.message, { cause });
+    if (cause instanceof Error &&
+        "code" in cause &&
+        typeof cause.code === "string")
+        return new WebScriptExportError("io", `${input.capture_path} → ${input.output_directory}`, cause.message, { cause });
+    return new ProviderAdapterError(PROVIDER.id, OPERATION, {
+        cause,
+        diagnostics: {
+            capture_path: input.capture_path,
+            output_directory: input.output_directory,
+            error_name: cause instanceof Error ? cause.name : "UnknownError",
+            error_message: cause instanceof Error
+                ? cause.message
+                : typeof cause === "string"
+                    ? cause
+                    : "Unknown script export failure",
+        },
+    });
 };
 /**
  * Read the caller-selected capture. A missing, non-file or unreadable
  * selection is a caller or host-permission failure, not an export failure.
  */
-const readCapture = async (path, signal) => {
+const readCapture = async (path, resources, signal) => {
     try {
-        return ok(await readFile(path, { signal }));
+        return ok({ bytes: await readRegularFile(path, { signal }) });
     }
     catch (cause) {
-        const code = cause instanceof Error && "code" in cause ? String(cause.code) : "";
-        if (code === "EACCES" || code === "EPERM")
-            return err(new AnalysisAccessDeniedError(OPERATION, path, code, { cause }));
-        if (code === "ENOENT" || code === "ENOTDIR" || code === "EISDIR")
-            return err(new AnalysisInputError(OPERATION, { cause }, [
-                {
-                    path: ["capture_path"],
-                    reason: "invalid_value",
-                    message: code === "EISDIR"
+        if (cause instanceof RegularFileCleanupFailure) {
+            const retry = await retryRegularFileCleanup(cause, resources);
+            const cleanup = {
+                reason: retry.cleanup?.reason ?? errorMessage(cause.cleanupCause),
+                incomplete: retry.cleanup !== undefined,
+                cause: cause.cleanupCause,
+            };
+            if (cause.outcome.kind === "completed")
+                return ok({ bytes: cause.outcome.value, cleanup });
+            const primary = captureReadFailure(path, cause.outcome.cause, signal, retry.cleanup === undefined ? { cause: cause.cleanupCause } : undefined);
+            return err(retry.cleanup === undefined
+                ? primary
+                : incompleteCaptureCleanup(primary, path, cleanup));
+        }
+        return err(captureReadFailure(path, cause, signal));
+    }
+};
+const captureReadFailure = (path, cause, signal, closeFailure) => {
+    const causeWithClose = closeFailure === undefined
+        ? cause
+        : new AggregateError([cause, closeFailure.cause], "Capture read and file-handle close both failed", { cause });
+    if (signal?.aborted === true)
+        return new AnalysisCancelledError(OPERATION, { cause: causeWithClose });
+    const code = cause instanceof Error && "code" in cause ? String(cause.code) : "";
+    if (code === "EACCES" || code === "EPERM")
+        return new AnalysisAccessDeniedError(OPERATION, path, code, {
+            cause: causeWithClose,
+        });
+    if (cause instanceof NonRegularFileReadError ||
+        cause instanceof RegularFileChangedError ||
+        code === "ENOENT" ||
+        code === "ENOTDIR" ||
+        code === "EISDIR" ||
+        code === "ENXIO")
+        return new AnalysisInputError(OPERATION, { cause: causeWithClose }, [
+            {
+                path: ["capture_path"],
+                reason: "invalid_value",
+                message: cause instanceof NonRegularFileReadError && code !== "EISDIR"
+                    ? cause.message
+                    : code === "EISDIR"
                         ? `Selected capture is a directory, not a file: ${path}`
                         : `Selected capture could not be read (${code}): ${path}`,
-                },
-            ]));
-        throw cause;
-    }
+            },
+        ]);
+    if (code !== "")
+        return new WebScriptExportError("io", path, errorMessage(cause), {
+            cause: causeWithClose,
+        });
+    return new ProviderAdapterError(PROVIDER.id, OPERATION, {
+        cause: causeWithClose,
+        diagnostics: {
+            capture_path: path,
+            error_name: cause instanceof Error ? cause.name : "UnknownError",
+            error_message: cause instanceof Error ? cause.message : String(cause),
+        },
+    });
 };
-const parseCapture = (bytes) => {
+const incompleteCaptureCleanup = (primary, path, cleanup) => analysisErrorWithCleanupFailure(primary, new ProviderCleanupError(PROVIDER.id, [path], { reason: cleanup.reason }, { cause: cleanup.cause, operation: OPERATION }), OPERATION);
+const errorMessage = (cause) => cause instanceof Error ? cause.message : String(cause);
+const parseCapture = (bytes, closeFailure) => {
     try {
         const text = new TextDecoder("utf-8", {
             fatal: true,
@@ -128,7 +198,10 @@ const parseCapture = (bytes) => {
         return ok(selectScriptCapture(json.value));
     }
     catch (cause) {
-        return err(new AnalysisInputError(OPERATION, { cause }, [
+        const causeWithClose = closeFailure === undefined
+            ? cause
+            : new AggregateError([cause, closeFailure.cause], "Capture parse and file-handle close both failed", { cause });
+        return err(new AnalysisInputError(OPERATION, { cause: causeWithClose }, [
             {
                 path: ["capture_path"],
                 reason: "invalid_format",

package/dist/application/WebSourceLocationService.js

@@ -35,6 +35,9 @@ export class WebSourceLocationService {
         this.artifacts = artifacts;
         this.decoder = decoder;
     }
+    close() {
+        return this.decoder.close?.() ?? Promise.resolve();
+    }
     /** Shared CLI/MCP workflow preserves raw declarations and every equal-position match. */
     async trace(rawInput, options) {
         if (options?.signal?.aborted)

package/dist/application/adb/AdbDeviceAnalysisPort.js

@@ -0,0 +1 @@
+export {};

package/dist/application/adb/AdbDeviceAnalysisService.js

@@ -0,0 +1,13 @@
+import { adbRequestSchema, } from "../../domain/adb/adbDeviceAnalysis.js";
+import { executeProviderOperation } from "../ProviderOperationExecution.js";
+/** Shared CLI/MCP admission, execution, and Evidence composition for ADB. */
+export class AdbDeviceAnalysisService {
+    provider;
+    constructor(provider) {
+        this.provider = provider;
+    }
+    /** Run one caller-selected ADB request and retain device provenance inline. */
+    async execute(operation, input, options) {
+        return executeProviderOperation(operation, input, options, adbRequestSchema, this.provider, "observed");
+    }
+}

package/dist/application/analysisView/AnalysisViewService.js

@@ -1,6 +1,7 @@
 import { z } from "zod";
 import { ANALYSIS_VIEW_PROVIDER } from "../InvestigationProviders.js";
 import { resolveEvidenceInput } from "../EvidenceInputResolver.js";
+import { AnalysisCapabilityUnavailableError } from "../../domain/analysisErrorCore.js";
 import { analysisInputErrorFromIssues } from "../../domain/inputIssueProjection.js";
 import { EvidenceIntegrityError } from "../../domain/evidenceErrors.js";
 import { createEvidence, parseEvidence, } from "../../domain/evidence.js";
@@ -25,6 +26,12 @@ export const inspectAnalysisViewValidated = (input, lookup) => {
         operation: parent.operation,
         normalizedResult: parent.normalized_result,
         limitations: parent.limitations,
+        artifact: parent.subject === null
+            ? null
+            : {
+                path: parent.subject.local_path,
+                sha256: parent.subject.digest.sha256,
+            },
     }, input.view);
     if (!projected.ok)
         return projected;
@@ -33,6 +40,25 @@ export const inspectAnalysisViewValidated = (input, lookup) => {
         return err(new EvidenceIntegrityError(`Parent subject SHA-256 ${parent.subject.digest.sha256} differs from analysis artifact SHA-256 ${projected.value.artifact.sha256}.`));
     return ok(createAnalysisViewEvidence(input, parent, projected.value));
 };
+/**
+ * Retain complete analysis Evidence in the session, then project its summary
+ * view from the retained record. Callers page or select the rest through
+ * inspect_analysis_view with the view's parent Evidence ID.
+ */
+export const summarizeRetainedAnalysis = (evidence, retention) => {
+    if (retention.recordEvidence === undefined ||
+        retention.evidenceById === undefined)
+        return err(new AnalysisCapabilityUnavailableError(ANALYSIS_VIEW_PROVIDER.id, evidence.operation, "summary detail requires a server session that retains Evidence for later views", {
+            userMessage: "This server does not retain Evidence. Select detail complete to receive the complete analysis inline.",
+        }));
+    const recorded = retention.recordEvidence(evidence);
+    if (!recorded.ok)
+        return recorded;
+    return inspectAnalysisViewValidated({
+        source: { kind: "retained-evidence", evidence_id: evidence.evidence_id },
+        view: { kind: "summary" },
+    }, retention.evidenceById);
+};
 const resolveAnalysisViewSource = (source, lookup) => {
     if (source.kind === "retained-evidence")
         return resolveEvidenceInput(source, lookup);
@@ -41,7 +67,10 @@ const resolveAnalysisViewSource = (source, lookup) => {
     }
     catch (cause) {
         if (cause instanceof z.ZodError)
-            return err(analysisInputErrorFromIssues(INSPECT_ANALYSIS_VIEW_OPERATION, cause.issues, source.evidence, { cause }));
+            return err(analysisInputErrorFromIssues(INSPECT_ANALYSIS_VIEW_OPERATION, cause.issues.map((issue) => ({
+                ...issue,
+                path: ["source", "evidence", ...issue.path],
+            })), { source }, { cause }));
         if (cause instanceof TypeError)
             return err(new EvidenceIntegrityError(cause.message, cause.message.length > 0 ? { userMessage: cause.message } : undefined));
         throw cause;
@@ -70,7 +99,16 @@ const createAnalysisViewEvidence = (input, parent, result) => {
         confidence: "derived",
         authority: parent.authority,
         limitations: result.limitations,
-        locations: [{ kind: "artifact-path", path: result.artifact.path }],
+        locations: [
+            ...(result.artifact.path.length > 0
+                ? [{ kind: "artifact-path", path: result.artifact.path }]
+                : []),
+            ...(result.kind === "native" &&
+                result.procedure_address !== null &&
+                result.procedure_address.length > 0
+                ? [{ kind: "address", address: result.procedure_address }]
+                : []),
+        ],
         evidenceLinks: [parent.evidence_id],
     });
 };

package/dist/application/android/AndroidAnalysisService.js

@@ -17,7 +17,7 @@ export class AndroidAnalysisService {
         const request = androidRequestSchema.safeParse({ operation, input });
         if (!request.success)
             return err(new AnalysisInputError(operation, { cause: request.error }));
-        const target = await parseBinaryTarget(request.data.input.path);
+        const target = await parseBinaryTarget(request.data.input.path, options?.signal === undefined ? {} : { signal: options.signal });
         if (!target.ok)
             return target;
         const executed = await this.provider.execute(target.value, request.data, options);

package/dist/application/apktool/ApktoolResourceAnalysisPort.js

@@ -0,0 +1 @@
+export {};

package/dist/application/apktool/ApktoolResourceAnalysisService.js

@@ -0,0 +1,13 @@
+import { apktoolRequestSchema, } from "../../domain/apktool/apktoolResourceAnalysis.js";
+import { executeProviderOperation } from "../ProviderOperationExecution.js";
+/** Shared CLI/MCP admission, execution, and Evidence composition for Apktool. */
+export class ApktoolResourceAnalysisService {
+    provider;
+    constructor(provider) {
+        this.provider = provider;
+    }
+    /** Run one caller-selected Apktool request and retain target identity inline. */
+    async execute(operation, input, options) {
+        return executeProviderOperation(operation, input, options, apktoolRequestSchema, this.provider, "observed");
+    }
+}

package/dist/application/binary/AnalysisClientCleanup.js

@@ -1,6 +1,4 @@
 import { ProviderCleanupError } from "../../domain/providerCleanupError.js";
-import { ProviderAdapterError } from "../../domain/providerAdapterError.js";
-import { projectAnalysisError } from "../../domain/analysisErrorProjection.js";
 import { err } from "../../domain/result.js";
 import { AnalysisError } from "../../domain/analysisErrorBase.js";
 /** Close one provider client and normalize unexpected adapter rejection. */
@@ -15,25 +13,3 @@ export const closeAnalysisClient = async (client, providerId, options = {}) => {
         return err(new ProviderCleanupError(providerId, ["provider-client"], { reason: "provider client close rejected unexpectedly" }, { cause }));
     }
 };
-/** Preserve the original lifecycle failure alongside incomplete cleanup. */
-export const analysisErrorWithCleanupFailure = (primary, cleanup, operation = "close_binary") => {
-    const projected = projectAnalysisError(cleanup);
-    return new ProviderAdapterError(cleanup instanceof ProviderAdapterError ? cleanup.providerId : "rea", operation, {
-        cause: primary,
-        userMessage: projectAnalysisError(primary).message,
-        ...(primary.capturedOutput === undefined
-            ? {}
-            : { capturedOutput: primary.capturedOutput }),
-        ...(primary.partialObservation === undefined
-            ? {}
-            : { partialObservation: primary.partialObservation }),
-        cleanup: {
-            reason: projected.message,
-            resources: cleanup.cleanupResources,
-        },
-        diagnostics: {
-            primary_error: projectAnalysisError(primary),
-            cleanup_error: projected,
-        },
-    });
-};

package/dist/application/binary/AnalysisSnapshotCache.js

@@ -4,6 +4,7 @@ import {} from "../../domain/analysisErrorBase.js";
 import { err, ok } from "../../domain/result.js";
 import { analysisQueryId, createAnalysisSnapshotEntry, createAnalysisSnapshotWorkflowEntry, snapshotBinding, snapshotMatchesProfile, snapshotMatchesTarget, snapshotTarget, parseAnalysisSnapshot, } from "../../domain/analysisSnapshot.js";
 import { OFFICIAL_TOOL_CONTRACTS } from "../../contracts/officialToolContracts.js";
+import { compareUnicodeCodePoints } from "../../domain/unicodeCodePointOrder.js";
 const STATEFUL_OPERATIONS = new Set([
     "health",
     "current_address",
@@ -87,8 +88,8 @@ export class AnalysisSnapshotCache {
         try {
             const snapshotTargetIdentity = snapshotTarget(target);
             const binding = snapshotBinding(profile);
-            const entries = [...this.#entries.values()].sort((left, right) => left.query_id.localeCompare(right.query_id));
-            const workflows = [...this.#workflowEntries.values()].sort((left, right) => left.query_id.localeCompare(right.query_id));
+            const entries = [...this.#entries.values()].sort((left, right) => compareUnicodeCodePoints(left.query_id, right.query_id));
+            const workflows = [...this.#workflowEntries.values()].sort((left, right) => compareUnicodeCodePoints(left.query_id, right.query_id));
             // Parsing owns the returned JSON and metadata; pre-cloning the same
             // payloads here only adds another full materialization.
             return ok(parseAnalysisSnapshot({
@@ -126,13 +127,13 @@ export class AnalysisSnapshotCache {
     /** Return canonical entries for persistence. */
     entries() {
         return [...this.#entries.values()]
-            .sort((left, right) => left.query_id.localeCompare(right.query_id))
+            .sort((left, right) => compareUnicodeCodePoints(left.query_id, right.query_id))
             .map((entry) => structuredClone(entry));
     }
     /** Return canonical composed-workflow entries for persistence. */
     workflowEntries() {
         return [...this.#workflowEntries.values()]
-            .sort((left, right) => left.query_id.localeCompare(right.query_id))
+            .sort((left, right) => compareUnicodeCodePoints(left.query_id, right.query_id))
             .map((entry) => structuredClone(entry));
     }
     /** Record one exact derived workflow result unless the shared cache is full. */