rea-agents 6.2.0 → 6.4.0

package/dist/contracts/inputSchemaPresentation.js

@@ -1,4 +1,5 @@
-const schemaMaps = new Set([
+import { isDeepStrictEqual } from "node:util";
+export const schemaMaps = new Set([
     "$defs",
     "definitions",
     "properties",
@@ -6,8 +7,8 @@ const schemaMaps = new Set([
     "dependentSchemas",
     "dependencies",
 ]);
-const schemaArrays = new Set(["allOf", "anyOf", "oneOf", "prefixItems"]);
-const schemaChildren = new Set([
+export const schemaArrays = new Set(["allOf", "anyOf", "oneOf", "prefixItems"]);
+export const schemaChildren = new Set([
     "items",
     "additionalItems",
     "contains",
@@ -55,15 +56,15 @@ const describeSchema = (schema, root, describeProperty) => {
                 key,
                 Object.fromEntries(Object.entries(value).map(([name, child]) => {
                     const described = describeSchema(child, root, describeProperty);
+                    if (key !== "properties" || !isObject(described))
+                        return [name, described];
+                    const description = referencedDescription(root, described) ??
+                        describeProperty(name);
                     return [
                         name,
-                        key === "properties" && isObject(described)
-                            ? {
-                                ...described,
-                                description: referencedDescription(root, described) ??
-                                    describeProperty(name),
-                            }
-                            : described,
+                        description === undefined
+                            ? described
+                            : { ...described, description },
                     ];
                 })),
             ];
@@ -83,8 +84,98 @@ const describeSchema = (schema, root, describeProperty) => {
         return [key, value];
     }));
 };
-/** Describe canonical input fields without changing structural constraints. */
+const objectBranch = (root, branch) => {
+    // Reference siblings evaluate separately from the target in 2020-12, so a
+    // merged object could accept inputs the branch rejects.
+    const resolved = isObject(branch) && typeof branch.$ref === "string"
+        ? Object.keys(branch).length === 1
+            ? resolveReference(root, branch.$ref)
+            : undefined
+        : branch;
+    return isObject(resolved) &&
+        resolved.type === "object" &&
+        isObject(resolved.properties)
+        ? resolved
+        : undefined;
+};
+const requiredProperties = (branch) => Array.isArray(branch.required)
+    ? branch.required.filter((name) => typeof name === "string")
+    : [];
+const sharedRequiredProperties = (branches) => {
+    const [first = [], ...others] = branches.map(requiredProperties);
+    return first.filter((name) => others.every((names) => names.includes(name)));
+};
+const inputGroup = (branch) => {
+    const required = requiredProperties(branch);
+    const optional = Object.keys(branch.properties ?? {})
+        .filter((name) => !required.includes(name))
+        .map((name) => `[${name}]`);
+    return [...required, ...optional].join(" + ");
+};
+// Anthropic tool input schemas reject anyOf, oneOf, and allOf at the root, and
+// clients then drop the tool or advertise it without parameters. Present a
+// root union of strict object groups as one object whose properties are the
+// union of the groups. The canonical Zod schema still enforces the exact group.
+const flattenRootObjectUnion = (root) => {
+    const { anyOf, oneOf, ...rest } = root;
+    const alternatives = Array.isArray(anyOf) ? anyOf : oneOf;
+    if (!Array.isArray(alternatives) ||
+        alternatives.length === 0 ||
+        root.properties !== undefined)
+        return root;
+    const branches = alternatives.map((branch) => objectBranch(root, branch));
+    if (!branches.every((branch) => branch !== undefined))
+        return root;
+    const variants = new Map();
+    for (const branch of branches)
+        for (const [name, schema] of Object.entries(branch.properties ?? {})) {
+            const known = variants.get(name) ?? [];
+            if (!known.some((seen) => isDeepStrictEqual(seen, schema)))
+                known.push(schema);
+            variants.set(name, known);
+        }
+    const required = sharedRequiredProperties(branches);
+    // A field unique to a group still needs that group's required partners.
+    // Counting properties alone would let optional fields pad an incomplete pair.
+    const dependencies = Object.fromEntries([...variants.keys()].flatMap((name) => {
+        const owners = branches.filter((branch) => Object.hasOwn(branch.properties ?? {}, name));
+        const partners = sharedRequiredProperties(owners).filter((partner) => partner !== name && !required.includes(partner));
+        return partners.length > 0 ? [[name, partners]] : [];
+    }));
+    const fewestRequired = Math.min(...branches.map((branch) => requiredProperties(branch).length));
+    // Groups that differ only in property values add no caller guidance.
+    const groups = [...new Set(branches.map(inputGroup))];
+    const description = [
+        typeof rest.description === "string" ? rest.description : undefined,
+        groups.length > 1
+            ? `Provide a complete input group: ${groups.join("; ")}.`
+            : undefined,
+    ].filter((text) => text !== undefined);
+    return {
+        ...rest,
+        type: "object",
+        ...(description.length > 0 ? { description: description.join(" ") } : {}),
+        properties: Object.fromEntries([...variants].map(([name, schemas]) => [
+            name,
+            schemas.length === 1 ? schemas[0] : { anyOf: schemas },
+        ])),
+        ...(required.length > 0 ? { required } : {}),
+        ...(fewestRequired > 0 ? { minProperties: fewestRequired } : {}),
+        ...(Object.keys(dependencies).length > 0
+            ? {
+                [root.$schema === "http://json-schema.org/draft-07/schema#"
+                    ? "dependencies"
+                    : "dependentRequired"]: dependencies,
+            }
+            : {}),
+        ...(branches.every((branch) => branch.additionalProperties === false)
+            ? { additionalProperties: false }
+            : {}),
+    };
+};
+/** Describe canonical input fields and present the root as one object. */
 export const presentInputJsonSchema = (root, describeProperty) => {
-    const described = describeSchema(root, root, describeProperty);
-    return isObject(described) ? described : root;
+    const flattened = flattenRootObjectUnion(root);
+    const described = describeSchema(flattened, flattened, describeProperty);
+    return isObject(described) ? described : flattened;
 };

package/dist/contracts/javascript/electronToolContracts.js

@@ -2,12 +2,17 @@ import { toolContractMetadata } from "../toolEffects.js";
 import { evidenceResultOf } from "../toolOutputSchemaPrimitives.js";
 import { electronPageInspectionSchema, electronTargetListSchema, inspectElectronPageInputSchema, listElectronTargetsInputSchema, } from "../../domain/javascript/electronObservation.js";
 import { electronActiveObservationInputSchema, electronActiveObservationResultSchema, } from "../../domain/javascript/electronActiveObservation.js";
+import { analysisDetailOutputSchemaOf, analysisDetailSchema, } from "../analysisDetail.js";
 import { analyzeJavaScriptApplicationInputSchema, javascriptApplicationAnalysisResultSchema, } from "../../domain/javascript/javascriptApplicationAnalysis.js";
 import { javascriptRuntimeReconciliationResultSchema, reconcileJavaScriptRuntimeInputSchema, } from "../../domain/javascript/javascriptRuntimeReconciliationSchemas.js";
 import { JAVASCRIPT_RUNTIME_RECONCILIATION_EXAMPLE } from "./javascriptRuntimeReconciliationExample.js";
 const listOutputSchema = evidenceResultOf(electronTargetListSchema);
 const inspectionOutputSchema = evidenceResultOf(electronPageInspectionSchema);
-const applicationOutputSchema = evidenceResultOf(javascriptApplicationAnalysisResultSchema);
+/** Caller-selected delivery of a completed JavaScript application analysis. */
+export const analyzeJavaScriptApplicationRequestSchema = analyzeJavaScriptApplicationInputSchema.extend({
+    detail: analysisDetailSchema,
+});
+const applicationOutputSchema = analysisDetailOutputSchemaOf(javascriptApplicationAnalysisResultSchema);
 const reconciliationOutputSchema = evidenceResultOf(javascriptRuntimeReconciliationResultSchema);
 const endpoint = "http://127.0.0.1:9223";
 const activeExample = {
@@ -54,9 +59,9 @@ export const ELECTRON_TOOL_CONTRACTS = [
     {
         name: "analyze_javascript_application",
         ...toolContractMetadata("analyze_javascript_application"),
-        description: "Reconstruct one local ASAR or extracted JavaScript application as an inline application graph without executing it. Returns all recovered graph nodes, edges, semantic relations, limitations, and coverage.",
+        description: "Reconstruct one local ASAR or extracted JavaScript application as an inline application graph without executing it. Returns recovered graph nodes, edges, semantic relations, integrity contradictions, limitations, and coverage. Select detail summary to retain the complete analysis Evidence in this session and receive only its summary view, then inspect selected modules or pages with inspect_analysis_view. Integrity mismatches fail by default; record-and-continue retains observed bytes as untrusted and marks graph coverage partial.",
         kind: "electron-provider",
-        inputSchema: analyzeJavaScriptApplicationInputSchema,
+        inputSchema: analyzeJavaScriptApplicationRequestSchema,
         outputSchema: applicationOutputSchema,
         examples: [
             {
@@ -64,6 +69,14 @@ export const ELECTRON_TOOL_CONTRACTS = [
                 input: {
                     input_path: "/Applications/Example.app/Contents/Resources/app.asar",
                     format: "auto",
+                    integrity_policy: "fail",
+                },
+            },
+            {
+                title: "Retain the complete analysis and return its summary view",
+                input: {
+                    input_path: "/Applications/Example.app/Contents/Resources/app.asar",
+                    detail: "summary",
                 },
             },
         ],

package/dist/contracts/javascript/javascriptApplicationWorkflowExamples.js

@@ -1,8 +1,9 @@
 import { createEvidence } from "../../domain/evidence.js";
-import { reconcileJavaScriptRuntime } from "../../domain/javascript/javascriptRuntimeReconciliation.js";
+import { parseRuntimeReconciliationInput, reconcileJavaScriptRuntime, } from "../../domain/javascript/javascriptRuntimeReconciliation.js";
 import { JAVASCRIPT_APPLICATION_EVIDENCE_EXAMPLE, JAVASCRIPT_RUNTIME_RECONCILIATION_EXAMPLE, } from "./javascriptRuntimeReconciliationExample.js";
 import { createHistoricalSourceGraph } from "../../domain/referenceSourceGraph.js";
-const reconciliation = reconcileJavaScriptRuntime(JAVASCRIPT_RUNTIME_RECONCILIATION_EXAMPLE);
+import { reconcileJavaScriptRuntimeInputSchema } from "../../domain/javascript/javascriptRuntimeReconciliationSchemas.js";
+const reconciliation = reconcileJavaScriptRuntime(parseRuntimeReconciliationInput(reconcileJavaScriptRuntimeInputSchema.parse(JAVASCRIPT_RUNTIME_RECONCILIATION_EXAMPLE)));
 const reconciliationEvidence = createEvidence(undefined, {
     id: "rea-javascript-runtime-reconciliation",
     name: "REA JavaScript runtime reconciliation",

package/dist/contracts/javascript/javascriptExportShapeComparisonExample.js

@@ -4,7 +4,7 @@ import { analyzeJavaScriptSemantics } from "../../domain/javascript/javascriptSe
 import { projectJavaScriptExportReturnShapes } from "../../domain/javascript/javascriptExportReturnShapeProjection.js";
 import { completeApplicationCoverage, partialApplicationCoverage, } from "../../domain/javascript/javascriptApplicationEvidenceSchemas.js";
 import { createJavaScriptApplicationGraph, createJavaScriptApplicationNode, } from "../../domain/javascript/javascriptApplicationGraph.js";
-import { createJavaScriptSemanticGraph, createJavaScriptSemanticGraphNode, } from "../../domain/javascript/javascriptSemanticGraph.js";
+import { createJavaScriptSemanticGraph, createJavaScriptSemanticGraphNode, JavaScriptSemanticEvidenceContextRegistry, } from "../../domain/javascript/javascriptSemanticGraph.js";
 import { JAVASCRIPT_SEMANTIC_RELATION_FAMILIES } from "../../domain/javascript/javascriptSemanticGraphSchemas.js";
 import { javascriptApplicationAnalysisResultSchema } from "../../domain/javascript/javascriptApplicationAnalysis.js";
 // Inventory identities/counters captured from real analysis of these two sources.
@@ -15,12 +15,14 @@ const captures = {
         root_artifact_sha256: "5005ebc2f35719a2fc014f19a81c669f3a1ab471b7245ef6985a111b6845a747",
         inventory_manifest_id: "agm_f30ded9a83d43a3980417bbe63dfad569e83386f243c4d6a01af0166372cb9e6",
         inventory_graph_sha256: "4b8aceaf67e43fd8317ec1f5fd1df5235f8fa402335accf011683e008c6bc62c",
+        integrity_contradictions: [],
     },
     total: {
         input_path: "/examples/javascript-export-presence/right",
         root_artifact_sha256: "269ae72a601ad5ac02f1c2dda6ff9accffa2d2e4f4a9e406facee0d5a78a5377",
         inventory_manifest_id: "agm_d3ceaa1af38fb3474070ca25c0d4644282e5fb7d5824cee3e3a81391481e9fc1",
         inventory_graph_sha256: "3e9bc926951480c35385efe5650d9d781631bd74c37a523d543b5fbe06b01ce6",
+        integrity_contradictions: [],
     },
 };
 const summary = {
@@ -56,7 +58,6 @@ const statistics = {
     findings: 1,
     modules: 0,
     parse_failures: 0,
-    truncated_scopes: 0,
 };
 const modulePath = "parser.mjs";
 const limitations = [
@@ -163,6 +164,7 @@ const exampleEvidence = (property) => {
         coverage: partialApplicationCoverage([], null),
         limitations,
     });
+    const evidenceContexts = new JavaScriptSemanticEvidenceContextRegistry();
     const module = createJavaScriptSemanticGraphNode({
         kind: "module",
         identity: {
@@ -181,12 +183,13 @@ const exampleEvidence = (property) => {
             state: "observed",
             confidence: "exact",
         },
-    });
+    }, evidenceContexts);
     const semanticGraph = createJavaScriptSemanticGraph({
         schema: "JavaScriptSemanticRelationGraph",
         root_artifact_sha256: metadata.root_artifact_sha256,
         application_graph_id: graph.graph_id,
         root_node_ids: [module.node_id],
+        evidence_contexts: evidenceContexts.contexts,
         nodes: [module],
         relations: [],
         fingerprints: [],

package/dist/contracts/javascript/javascriptRecoveryToolContracts.js

@@ -7,7 +7,7 @@ export const JAVASCRIPT_RECOVERY_TOOL_CONTRACTS = [
         name: "recover_javascript_sources",
         ...toolContractMetadata("recover_javascript_sources"),
         kind: "application",
-        description: "Recover readable modules from one local UTF-8 JavaScript script/bundle into an absent directory, using caller-supplied Wakaru 1.13.0 on Linux x64. Returns original/derived digests, extraction byte ranges, emitted source maps, warnings and analysis_input inline. Structural splitting may fall back to one module; original names and runtime equivalence remain unknown. No application code execution. Requires util-linux prlimit; one worker, 1 GiB address-space ceiling, 120-second deadline, 64 MiB input, 128 MiB output, 10000 entries and 8 MiB per diagnostic/report stream.",
+        description: "Recover readable modules from one local UTF-8 JavaScript script/bundle into an absent directory, using caller-supplied Wakaru ^1.13.0 (verified with 1.14.0) on Linux x64. Returns original/derived digests, extraction byte ranges, emitted source maps, warnings and analysis_input inline. Structural splitting may fall back to one module; original names and runtime equivalence remain unknown. No application code execution. Requires util-linux prlimit; one worker, 1 GiB address-space ceiling, 120-second deadline, 64 MiB input, 128 MiB output, 10000 entries and 8 MiB per diagnostic/report stream.",
         inputSchema: javascriptRecoveryInputSchema,
         outputSchema: evidenceResultOf(javascriptRecoveryResultSchema),
         examples: [

package/dist/contracts/javascript/javascriptRuntimeReconciliationExample.js

@@ -1,7 +1,7 @@
 import { createEvidence } from "../../domain/evidence.js";
 import { createJavaScriptApplicationGraph, createJavaScriptApplicationNode, } from "../../domain/javascript/javascriptApplicationGraph.js";
 import { createWebTextArtifact } from "../../domain/webContentArtifact.js";
-import { createJavaScriptSemanticGraph, createJavaScriptSemanticGraphNode, } from "../../domain/javascript/javascriptSemanticGraph.js";
+import { createJavaScriptSemanticGraph, createJavaScriptSemanticGraphNode, JavaScriptSemanticEvidenceContextRegistry, } from "../../domain/javascript/javascriptSemanticGraph.js";
 import { JAVASCRIPT_SEMANTIC_RELATION_FAMILIES } from "../../domain/javascript/javascriptSemanticGraphSchemas.js";
 const applicationSha256 = "1".repeat(64);
 const script = createWebTextArtifact("export const example = true;\n", "text/javascript");
@@ -59,6 +59,7 @@ const graph = createJavaScriptApplicationGraph({
     coverage: completeCoverage,
     limitations: [],
 });
+const evidenceContexts = new JavaScriptSemanticEvidenceContextRegistry();
 const semanticNode = createJavaScriptSemanticGraphNode({
     kind: "module",
     identity: {
@@ -72,12 +73,13 @@ const semanticNode = createJavaScriptSemanticGraphNode({
     label: "renderer.js",
     properties: {},
     evidence: graphEvidence,
-});
+}, evidenceContexts);
 const semanticGraph = createJavaScriptSemanticGraph({
     schema: "JavaScriptSemanticRelationGraph",
     root_artifact_sha256: applicationSha256,
     application_graph_id: graph.graph_id,
     root_node_ids: [semanticNode.node_id],
+    evidence_contexts: evidenceContexts.contexts,
     nodes: [semanticNode],
     relations: [],
     fingerprints: [],
@@ -98,7 +100,8 @@ const semanticGraph = createJavaScriptSemanticGraph({
     },
     limitations: ["Semantic relations are unavailable in this minimal example."],
 });
-const staticEvidence = createEvidence({ path: inputPath, sha256: applicationSha256, format: "directory" }, {
+/** Minimal valid static application Evidence for graph workflow examples. */
+export const JAVASCRIPT_APPLICATION_EVIDENCE_EXAMPLE = createEvidence({ path: inputPath, sha256: applicationSha256, format: "directory" }, {
     id: "rea-javascript-application",
     name: "REA JavaScript application analyzer",
     version: "1",
@@ -112,6 +115,7 @@ const staticEvidence = createEvidence({ path: inputPath, sha256: applicationSha2
         root_artifact_sha256: applicationSha256,
         inventory_manifest_id: `agm_${"2".repeat(64)}`,
         inventory_graph_sha256: "3".repeat(64),
+        integrity_contradictions: [],
         graph,
         semantic_graph: semanticGraph,
         summary: {
@@ -147,15 +151,12 @@ const staticEvidence = createEvidence({ path: inputPath, sha256: applicationSha2
             findings: 0,
             modules: 0,
             parse_failures: 0,
-            truncated_scopes: 0,
         },
         limitations: [],
     },
     confidence: "derived",
     authority: "shipped-artifact",
 });
-/** Minimal valid static application Evidence for graph workflow examples. */
-export const JAVASCRIPT_APPLICATION_EVIDENCE_EXAMPLE = staticEvidence;
 const runtimeEvidence = createEvidence(undefined, {
     id: "rea-cdp-electron",
     name: "REA Electron file-page CDP observation provider",
@@ -215,7 +216,7 @@ const runtimeEvidence = createEvidence(undefined, {
 });
 /** Compact valid Evidence pair used by the public reconciliation contract. */
 export const JAVASCRIPT_RUNTIME_RECONCILIATION_EXAMPLE = {
-    static_layers: [{ analysis: staticEvidence }],
+    static_layers: [{ analysis: JAVASCRIPT_APPLICATION_EVIDENCE_EXAMPLE }],
     runtime_observations: [runtimeEvidence],
 };
 function browserCompleteness() {

package/dist/contracts/jeb/jebToolContracts.js

@@ -0,0 +1,64 @@
+import { jebInputSchemas, jebResultSchemas, } from "../../domain/jeb/jebAnalysis.js";
+import { evidenceResultOf } from "../toolOutputSchemaPrimitives.js";
+import { toolContractMetadata } from "../toolEffects.js";
+/** JEB-backed inspection served by a caller-supplied running engine client. */
+export const JEB_TOOL_CONTRACTS = [
+    {
+        name: "inspect_jeb_client",
+        ...toolContractMetadata("inspect_jeb_client"),
+        description: "Inspect the running JEB client serving MCP: engine version, GUI or headless mode, and startup time. Does not open a target. Requires a caller-started JEB client reachable at REA_JEB_MCP_URL (default http://127.0.0.1:8425/mcp); REA never installs or launches JEB.",
+        kind: "jeb-provider",
+        inputSchema: jebInputSchemas.inspect_jeb_client,
+        outputSchema: evidenceResultOf(jebResultSchemas.inspect_jeb_client),
+        examples: [{ title: "Check the engine", input: {} }],
+    },
+    {
+        name: "open_jeb_project",
+        ...toolContractMetadata("open_jeb_project"),
+        description: "Open or create a JEB project from an artifact file or existing .jdb2 database on the engine host. Returns the project's input-file digests and top-level units. The engine analyzes the target itself; REA does not read the file or execute it. Fails when a project is already open.",
+        kind: "jeb-provider",
+        inputSchema: jebInputSchemas.open_jeb_project,
+        outputSchema: evidenceResultOf(jebResultSchemas.open_jeb_project),
+        examples: [
+            {
+                title: "Open a target for analysis",
+                input: { path: "/tmp/Example.apk" },
+            },
+        ],
+    },
+    {
+        name: "list_jeb_units",
+        ...toolContractMetadata("list_jeb_units"),
+        description: "List project units by stable unit path and type, with optional wildcard filter, parent restriction, and pagination. The engine caps pages at 100 units; a full page reports partial coverage because more units may exist. Read-only.",
+        kind: "jeb-provider",
+        inputSchema: jebInputSchemas.list_jeb_units,
+        outputSchema: evidenceResultOf(jebResultSchemas.list_jeb_units),
+        examples: [
+            {
+                title: "List units",
+                input: {},
+            },
+            {
+                title: "Find DEX units",
+                input: { filter: "*.dex" },
+            },
+        ],
+    },
+    {
+        name: "decompile_jeb_item",
+        ...toolContractMetadata("decompile_jeb_item"),
+        description: "Decompile one type or method to engine pseudo-code using its decompiler (Dalvik, Java, or native). item_address comes from the engine's code item listing; unit_path defaults to the engine's first code unit and stays unknown when omitted. Read-only with respect to the target file.",
+        kind: "jeb-provider",
+        inputSchema: jebInputSchemas.decompile_jeb_item,
+        outputSchema: evidenceResultOf(jebResultSchemas.decompile_jeb_item),
+        examples: [
+            {
+                title: "Decompile a method",
+                input: {
+                    item_address: "Lcom/example/Main;->onCreate()V",
+                    item_kind: "method",
+                },
+            },
+        ],
+    },
+];

package/dist/contracts/managed/managedToolContracts.js

@@ -1,12 +1,13 @@
 import { z } from "zod";
+import { isAbsolute } from "node:path";
 import { managedOutputSchemas } from "../toolOutputSchemaGroups.js";
 import { toolContractMetadata } from "../toolEffects.js";
 import { requireOutputSchema } from "../toolOutputSchemaPrimitives.js";
-import { isAbsoluteLocalPath, localPathStringSchema, } from "../../domain/localPath.js";
+import { localPathStringSchema } from "../../domain/localPath.js";
 /** Exact caller boundary for execution-free PE/CLI triage and identity. */
 export const managedTargetInputSchema = z.strictObject({
     path: localPathStringSchema
-        .refine(isAbsoluteLocalPath, {
+        .refine(isAbsolute, {
         message: "path must be an absolute local filesystem path (for example /tmp/Example.dll or C:\\Example.dll)",
     })
         .describe("Explicit absolute managed PE/CLI path; omit to reuse the previously selected managed target")

package/dist/contracts/mobileApplicationGraphExamples.js

@@ -1,10 +1,10 @@
-import { canonicalDigest } from "../domain/comparisonSemantics.js";
+import { digestCanonicalValue } from "../domain/canonicalDigest.js";
 import { createEvidence } from "../domain/evidence.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";
 const inventory = (format, digit) => {
     const sha = digit.repeat(64);
-    const artifactId = `art_${canonicalDigest({ sha256: sha }, "Artifact inventory")}`;
-    const occurrenceId = `occ_${canonicalDigest({ root: artifactId }, "Artifact inventory")}`;
+    const artifactId = `art_${digestCanonicalValue({ sha256: sha }, "Artifact inventory")}`;
+    const occurrenceId = `occ_${digestCanonicalValue({ root: artifactId }, "Artifact inventory")}`;
     const nodes = [
         {
             artifact_id: artifactId,
@@ -35,7 +35,7 @@ const inventory = (format, digit) => {
             limitations: [],
         },
     ];
-    const graphSha256 = canonicalDigest({
+    const graphSha256 = digestCanonicalValue({
         nodes,
         occurrences,
         edges: [],
@@ -43,7 +43,7 @@ const inventory = (format, digit) => {
     }, "Artifact inventory");
     return jsonValueSchema.parse({
         manifest: {
-            manifest_id: `agm_${canonicalDigest({
+            manifest_id: `agm_${digestCanonicalValue({
                 root_artifact_id: artifactId,
                 graph_sha256: graphSha256,
             }, "Artifact inventory")}`,

package/dist/contracts/native/binaryDiagnosticsToolContracts.js

@@ -1,21 +1,43 @@
 import { inspectRecordedCrashInputSchema, recordedCrashSchema, } from "../../domain/native/recordedCrash.js";
 import { inspectBinaryLayoutInputSchema, binaryLayoutSchema, } from "../../domain/native/binaryLayout.js";
+import { analysisDetailOutputSchemaOf, analysisDetailSchema, } from "../analysisDetail.js";
 import { toolContractMetadata } from "../toolEffects.js";
 import { evidenceResultOf } from "../toolOutputSchemaPrimitives.js";
+import { inspectPeResourcesInputSchema, peResourcesSchema, } from "../../domain/native/peResources.js";
+/** Caller-selected delivery of completed binary layout Evidence. */
+export const inspectBinaryLayoutRequestSchema = inspectBinaryLayoutInputSchema.extend({ detail: analysisDetailSchema });
 /** Offline binary diagnostics are independent of macOS process/UI providers. */
 export const BINARY_DIAGNOSTICS_TOOL_CONTRACTS = [
+    {
+        name: "inspect_pe_resources",
+        ...toolContractMetadata("inspect_pe_resources"),
+        kind: "native-provider",
+        description: "Inspect one explicit local PE32/PE32+ image's complete bounded type/name/language resource tree without executing it or opening a disassembler. Returns numeric IDs versus original UTF-16 names, directory/data-entry file locations, payload RVA/file ranges, complete SHA-256 hashes and static RT_GROUP_ICON image-resource candidates. Language fallback, image decoding and actual shell/window loading remain unobserved. Reads a stable regular file; malformed or ambiguous mappings, non-identical overlapping ranges and exhausted budgets return no partial success. Portable on supported Node hosts; no Windows SDK or engine installation required.",
+        inputSchema: inspectPeResourcesInputSchema,
+        outputSchema: evidenceResultOf(peResourcesSchema),
+        examples: [
+            {
+                title: "Inspect PE resource identities and icon relationships",
+                input: { path: "/artifacts/application.exe" },
+            },
+        ],
+    },
     {
         name: "inspect_binary_layout",
         ...toolContractMetadata("inspect_binary_layout"),
         kind: "native-provider",
-        description: "Inspect an explicit local binary without launching it as a host process. Returns file-backed section/segment ranges, linked addresses, original symbol/REL/RELA table identities, complete encoded RELR tables and upstream-derived offsets with unknown per-word locations/addends, raw name bytes, dependency/interpreter names and static mitigation inferences inline with artifact SHA-256 Evidence. Initial profile: ELF64 x86-64 little-endian EXEC/DYN/REL on Linux x64 via caller-supplied Python with unchanged pwntools 4.15.0, pyelftools 0.33 and Unicorn 2.1.2. Runtime addresses/library paths, overall relocation inventory completeness and complete derived GOT/PLT coverage remain unknown. Zero executable entry values mean absence; relocatable entries are not applicable. Upstream can emulate PLT instructions with Unicorn for derived static maps. Uses bounded complete output and owned temporary files/processes; malformed, unsupported or oversized objects return no partial success.",
-        inputSchema: inspectBinaryLayoutInputSchema,
-        outputSchema: evidenceResultOf(binaryLayoutSchema),
+        description: "Inspect an explicit local binary without launching it as a host process. Returns file-backed section/segment ranges, linked addresses, original symbol/REL/RELA table identities, complete encoded RELR tables and upstream-derived offsets with unknown per-word locations/addends, raw name bytes, dependency/interpreter names and static mitigation inferences inline with artifact SHA-256 Evidence. Initial profile: ELF64 x86-64 little-endian EXEC/DYN/REL on Linux x64 via caller-supplied Python with unchanged pwntools 4.15.0, pyelftools 0.33 and Unicorn 2.1.2. Runtime addresses/library paths, overall relocation inventory completeness and complete derived GOT/PLT coverage remain unknown. Zero executable entry values mean absence; relocatable entries are not applicable. Upstream can emulate PLT instructions with Unicorn for derived static maps. Uses bounded complete output and owned temporary files/processes; malformed, unsupported or oversized objects return no partial success. Select detail summary to retain the complete layout Evidence in this session and receive only its summary view, then inspect sections, symbols, mitigations or linkage with inspect_analysis_view.",
+        inputSchema: inspectBinaryLayoutRequestSchema,
+        outputSchema: analysisDetailOutputSchemaOf(binaryLayoutSchema),
         examples: [
             {
                 title: "Inspect ELF linked and file layout",
                 input: { path: "/artifacts/application.elf" },
             },
+            {
+                title: "Retain the complete layout and return its summary view",
+                input: { path: "/artifacts/application.elf", detail: "summary" },
+            },
         ],
     },
     {

package/dist/contracts/native/nativeToolContracts.js

@@ -58,7 +58,7 @@ export const swiftSymbolsSchema = z
     .string()
     .min(1)
     .regex(/^[^\n]*$/u, "Each Swift symbol must be one line.")
-    .regex(/^[^\u0000]*$/u, "Swift symbols cannot contain NUL."))
+    .regex(/^[^\x00]*$/u, "Swift symbols cannot contain NUL."))
     .min(1);
 /** Provider-neutral semantic operations backed initially by macOS utilities. */
 export const NATIVE_TOOL_CONTRACTS = [

package/dist/contracts/officialToolContracts.js

@@ -44,21 +44,21 @@ export const OFFICIAL_TOOL_CONTRACTS = [
     official("next_address", "Return the next analyzed object address after an explicit address or current cursor. This is a navigation primitive, not instruction-flow or CFG analysis.", z.object({ document, address: optionalAddress })),
     official("prev_address", "Return the previous analyzed object start before an explicit address or current cursor. This is a navigation primitive and may fail at document boundaries; data objects and instructions remain distinct from control flow.", z.object({ document, address: optionalAddress })),
     official("procedure_address", "Resolve an unambiguous procedure symbol name or provider-normalized address to its canonical entry address. External address spaces remain explicit.", z.object({ procedure, document })),
-    official("procedure_assembly", "Return assembly for one analyzed procedure identified by symbol or hexadecimal address. Use when pseudocode loses calling-convention or instruction-level detail; output is currently returned as one unpaginated string.", z.object({ procedure, document })),
+    official("procedure_assembly", "Return assembly for one analyzed procedure identified by symbol or hexadecimal address. Use when pseudocode loses calling-convention or instruction-level detail; output is currently returned as one unpaginated string. Ghidra terminal-call assumptions that may cut the analyzed body are reported in Evidence limitations.", z.object({ procedure, document })),
     official("procedure_callees", "Return the provider's resolved direct callees for one procedure identified by symbol or address. Unresolved indirect calls may be absent; use analyze_function and typed references to preserve available edge uncertainty.", z.object({ procedure, document })),
     official("procedure_callers", "Return the provider's resolved direct callers for one procedure identified by symbol or address. Results reflect completed static analysis and may omit unresolved indirect references.", z.object({ procedure, document })),
-    official("procedure_info", "Return provider metadata for one procedure identified by symbol or address: entrypoint, signature, locals, size, block count, and complete inclusive body ranges when observed. Hopper locals preserve observed names and signed stack displacements; source types remain unknown. Body byte count and enclosing span remain distinct; unavailable extent is explicit.", z.object({ procedure, document })),
-    official("read_function_instructions", "Return every raw instruction for one analyzed procedure. Instruction text is provider-specific.", functionInstructionInputSchema),
+    official("procedure_info", "Return provider metadata for one procedure identified by symbol or address: entrypoint, signature, locals, size, block count, and complete inclusive body ranges when observed. Extents reflect the provider's analyzed body; Ghidra terminal-call assumptions that may cut it are reported in Evidence limitations. Hopper locals preserve observed names and signed stack displacements; source types remain unknown. Body byte count and enclosing span remain distinct; unavailable extent is explicit.", z.object({ procedure, document })),
+    official("read_function_instructions", "Return every raw instruction for one analyzed procedure. Instruction text and body extent are provider-specific. Ghidra terminal-call assumptions that may cut the analyzed body are reported in limitations.", functionInstructionInputSchema),
     ...HOPPER_MEMORY_TOOL_DEFINITIONS.map(({ name, description, inputSchema }) => official(name, description, inputSchema)),
     official("procedure_references", "Return every raw incoming or outgoing reference edge for one procedure. Endpoint procedures are resolved only from provider containment. Ghidra preserves detailed reference flags. Hopper preserves native CallReference classifications and exact endpoints while leaving unavailable detailed flags explicit.", z.object({
         procedure,
         direction: z.enum(["incoming", "outgoing"]).default("outgoing"),
         document,
     })),
-    official("procedure_pseudo_code", "Decompile one analyzed procedure by symbol name or provider-normalized address. Returns provider-specific pseudocode, never original source or cross-provider text equivalence, and may return null; request procedure_assembly when instruction precision matters.", z.object({ procedure, document })),
+    official("procedure_pseudo_code", "Decompile one analyzed procedure by symbol name or provider-normalized address. Returns provider-specific pseudocode, never original source or cross-provider text equivalence, and may return null; request procedure_assembly when instruction precision matters. Ghidra no-return assumptions may cut the analyzed body; Evidence limitations report observed terminal calls and available callee identities.", z.object({ procedure, document })),
     official("resolve_containing_procedure", "Resolve an arbitrary address, including an interior instruction or exact external entry, to its provider-analyzed containing procedure. A negative result distinguishes outside segments from not in a procedure and is never guessed from nearby symbols.", z.object({ address, document })),
     official("search_procedures", "Search every analyzed procedure name using literal matching by default or regex when requested. Results are deterministic and complete. Hopper regex mode uses ECMAScript Unicode syntax in a cancellable worker; a matching deadline leaves its API usable.", z.object(analysisSearchInput)),
-    official("search_strings", "Search every analyzed string object using literal matching by default or regex when requested. Results are deterministic and complete over the native inventory. Hopper retains typed byte decoding, native display, and explicit decoding unknowns. Adjacent long-literal fragments match independently. Hopper regex mode uses ECMAScript Unicode syntax in a cancellable worker; a matching deadline leaves its API usable.", z.object(analysisSearchInput)),
+    official("search_strings", "Search every provider-defined string object using literal matching by default or regex when requested. Results are deterministic and complete over those defined objects, not every text sequence in artifact bytes. Ghidra may omit packed or undefined literals, including Rust strings; an empty result does not prove text is absent. If an address is known, read_bytes and xrefs inspect its bytes and references. Hopper retains typed byte decoding, native display, and explicit decoding unknowns. Adjacent long-literal fragments match independently. Hopper regex mode uses ECMAScript Unicode syntax in a cancellable worker; a matching deadline leaves its API usable.", z.object(analysisSearchInput)),
     official("set_address_name", "Assign an analyst name to one mapped hexadecimal address and report whether the native edit succeeded and exact readback matched. Hopper rejects symbol names exceeding 1024 UTF-16 code units before mutation, and rejects names owned by another address; use set_addresses_names to explicitly move or swap labels among selected addresses. This mutates analysis metadata.", z.object({ address, name: z.string(), document })),
     official("set_addresses_names", "Assign analyst names to multiple mapped addresses in one call and return per-address edit/readback success booleans. Hopper validates mapped destinations, native string representations, its 1024 UTF-16 code-unit symbol-name limit, and unique destinations/names before applying edits. Existing labels may move or swap only among explicitly selected addresses; unselected label owners remain unchanged. This mutates analysis metadata; verify failures individually.", z.object({ names: z.record(z.string(), z.string()), document })),
     official("set_bookmark", "Create or replace a bookmark at a mapped hexadecimal address and report success. This mutates navigation metadata; bookmarks are analyst-authored navigation aids, not binary evidence.", z.object({ address, name: z.string().optional(), document })),

package/dist/contracts/sessionLifecycleInputs.js

@@ -1,16 +1,17 @@
+import { isAbsolute } from "node:path";
 import { executableFormatHintSchema } from "../domain/dosCom.js";
-import { isAbsoluteLocalPath, localPathStringSchema, } from "../domain/localPath.js";
+import { localPathStringSchema } from "../domain/localPath.js";
 import { z } from "zod";
 import { analysisProviderSelectorSchema } from "./providerSelection.js";
 /** Caller-supplied analysis snapshot path; must name its destination absolutely. */
 const snapshotPathSchema = localPathStringSchema
-    .refine(isAbsoluteLocalPath, {
+    .refine(isAbsolute, {
     message: "snapshot_path must be an absolute local filesystem path (for example /tmp/rea/analysis.json or C:\\rea\\analysis.json)",
 })
     .describe("Absolute local filesystem path for the analysis snapshot; relative paths are rejected.");
 /** Caller-supplied analysis target path; must name the target absolutely. */
 const binaryTargetPathSchema = localPathStringSchema
-    .refine(isAbsoluteLocalPath, {
+    .refine(isAbsolute, {
     message: "path must be an absolute local filesystem path (for example /tmp/fixture.bin or C:\\analysis\\fixture.bin)",
 })
     .describe("Absolute local filesystem path for the analysis target; relative paths are rejected.");

package/dist/contracts/sessionStatusContract.js

@@ -1,5 +1,6 @@
 import { z } from "zod";
-import { isAbsoluteLocalPath, localPathStringSchema, } from "../domain/localPath.js";
+import { isAbsolute } from "node:path";
+import { localPathStringSchema } from "../domain/localPath.js";
 /** Optional expectations used to compare the live session with its caller. */
 export const binarySessionInputSchema = z.strictObject({
     expected_package_version: z.string().min(1).optional(),
@@ -8,7 +9,7 @@ export const binarySessionInputSchema = z.strictObject({
         .regex(/^[a-f0-9]{64}$/u)
         .optional(),
     expected_server_path: localPathStringSchema
-        .refine(isAbsoluteLocalPath, {
+        .refine(isAbsolute, {
         message: "expected_server_path must be an absolute local filesystem path (for example /opt/rea/dist/main.js)",
     })
         .describe("Absolute local filesystem path expected for the running server; relative paths are rejected.")