rea-agents 6.2.0 → 6.4.0

package/dist/server/registerEvmTools.js

@@ -1,14 +1,9 @@
 import { toolContract } from "../contracts/toolContracts.js";
-import { logToolExecution } from "./toolLogging.js";
+import { createEvidenceToolHandler } from "./contractToolHandler.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
 /** Bind the named EVM contract to shared validation and session Evidence recording. */
-export const registerEvmTools = (server, service, logger, recordEvidence) => {
+export const registerEvmTools = (server, service, logger, recordEvidence, withAdmittedAnalysis) => {
     const contract = toolContract("inspect_evm_interface");
-    server.registerTool(contract.name, toolRegistrationOptions(contract), async (input, context) => {
-        const result = await logToolExecution(logger, contract.name, () => service.inspect(input, { signal: context.mcpReq.signal }));
-        if (!result.ok)
-            return server.delivery.toCallToolResult(result, contract);
-        const recorded = recordEvidence?.(result.value);
-        return server.delivery.toEvidenceToolResult(result.value, contract, recorded);
-    });
+    const handler = createEvidenceToolHandler(server, (input, options) => service.inspect(input, options), logger, recordEvidence, withAdmittedAnalysis);
+    server.registerTool(contract.name, toolRegistrationOptions(contract), handler(contract));
 };

package/dist/server/registerFirmwareTools.js

@@ -1,17 +1,9 @@
 import { toolContract } from "../contracts/toolContracts.js";
-import { logToolExecution } from "./toolLogging.js";
+import { createContractToolHandler } from "./contractToolHandler.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
 /** Bind firmware handlers to their exact named schemas. */
-export const registerFirmwareTools = (server, service, logger, recordEvidence) => {
-    const handler = (contract) => async (input, context) => {
-        const result = await logToolExecution(logger, contract.name, () => service.execute(contract.name, input, {
-            signal: context.mcpReq.signal,
-        }));
-        if (!result.ok)
-            return server.delivery.toCallToolResult(result, contract);
-        const recorded = recordEvidence?.(result.value);
-        return server.delivery.toEvidenceToolResult(result.value, contract, recorded);
-    };
+export const registerFirmwareTools = (server, service, logger, recordEvidence, withAdmittedAnalysis) => {
+    const handler = createContractToolHandler(server, service, logger, recordEvidence, withAdmittedAnalysis);
     const inspect = toolContract("inspect_firmware_regions");
     server.registerTool(inspect.name, toolRegistrationOptions(inspect), handler(inspect));
     const extract = toolContract("extract_firmware");

package/dist/server/registerFunctionComparisonTool.js

@@ -8,10 +8,13 @@ import { recordSessionEvidenceSources } from "./sessionEvidence.js";
 import { runDerivedOperation } from "./runDerivedOperation.js";
 import { FUNCTION_COMPARISON_PROVIDER } from "../application/InvestigationProviders.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
+import { withAdmittedAnalysis } from "./analysisAdmission.js";
+import { runAdmittedToolOperation } from "./admittedToolOperation.js";
 import { compareFunctions } from "../domain/functionComparison.js";
 /** Register explicit Evidence-backed function comparison. */
 export const registerFunctionComparisonTool = (server, session, contract) => {
-    server.registerTool(contract.name, toolRegistrationOptions(contract), async (input, context) => {
+    const admission = withAdmittedAnalysis({ kind: "session", session });
+    server.registerTool(contract.name, toolRegistrationOptions(contract), async (input, context) => runAdmittedToolOperation(server, admission, contract.name, context.mcpReq.signal, async () => {
         let leftEvidence;
         let rightEvidence;
         try {
@@ -55,7 +58,7 @@ export const registerFunctionComparisonTool = (server, session, contract) => {
             comparisonEvidenceId: evidence.evidence_id,
         }));
         return server.delivery.toEvidenceToolResult(evidence, contract, recorded);
-    });
+    }));
 };
 const functionUnknownInput = ({ status, leftIds, rightIds, comparisonEvidenceId, }) => {
     if (status === "unchanged")

package/dist/server/registerJavaScriptRecoveryTool.js

@@ -1,14 +1,9 @@
 import { toolContract } from "../contracts/toolContracts.js";
-import { logToolExecution } from "./toolLogging.js";
+import { createEvidenceToolHandler } from "./contractToolHandler.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
 /** Bind optional recovery to its exact named contract without acquiring an engine. */
-export const registerJavaScriptRecoveryTool = (server, service, logger, recordEvidence) => {
+export const registerJavaScriptRecoveryTool = (server, service, logger, recordEvidence, withAdmittedAnalysis) => {
     const contract = toolContract("recover_javascript_sources");
-    server.registerTool(contract.name, toolRegistrationOptions(contract), async (input, context) => {
-        const result = await logToolExecution(logger, contract.name, () => service.recover(input, { signal: context.mcpReq.signal }));
-        if (!result.ok)
-            return server.delivery.toCallToolResult(result, contract);
-        const recorded = recordEvidence?.(result.value);
-        return server.delivery.toEvidenceToolResult(result.value, contract, recorded);
-    });
+    const handler = createEvidenceToolHandler(server, (input, options) => service.recover(input, options), logger, recordEvidence, withAdmittedAnalysis);
+    server.registerTool(contract.name, toolRegistrationOptions(contract), handler(contract));
 };

package/dist/server/registerJavaScriptRuntimeObservationTools.js

@@ -5,9 +5,10 @@ import { toolContract } from "../contracts/toolContracts.js";
 import { observeJavaScriptRuntimeInputSchema } from "../domain/javascript/javascriptRuntimeObservation.js";
 import { logToolExecution } from "./toolLogging.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
+import { runAdmittedToolOperation } from "./admittedToolOperation.js";
 /** Register passive Inspector tools even when policy keeps them unavailable. */
 export const registerJavaScriptRuntimeObservationTools = (server, options) => {
-    const registration = { ...options, delivery: server.delivery };
+    const registration = { ...options, delivery: server.delivery, server };
     const listContract = toolContract("list_javascript_runtime_targets");
     const observeContract = toolContract("observe_javascript_runtime");
     server.registerTool(listContract.name, toolRegistrationOptions(listContract), (input, context) => runRuntimeTool(registration, listContract, { input, context }, (parsed, signal) => listJavaScriptRuntimeTargets(options.runtime, parsed, { signal })));
@@ -20,9 +21,11 @@ const runRuntimeTool = async (options, contract, request, execute) => {
     const { input, context } = request;
     if (options.loadFailure !== undefined)
         return options.delivery.toCallToolResult(err(optionalProviderUnavailable(options.loadFailure, contract.name)), contract);
-    const result = await logToolExecution(options.logger, contract.name, () => execute(input, context.mcpReq.signal));
-    if (!result.ok)
-        return options.delivery.toCallToolResult(result, contract);
-    const recorded = options.recordEvidence?.(result.value);
-    return options.delivery.toEvidenceToolResult(result.value, contract, recorded);
+    return runAdmittedToolOperation(options.server, options.withAdmittedAnalysis, contract.name, context.mcpReq.signal, async () => {
+        const result = await logToolExecution(options.logger, contract.name, () => execute(input, context.mcpReq.signal));
+        if (!result.ok)
+            return options.delivery.toCallToolResult(result, contract);
+        const recorded = options.recordEvidence?.(result.value);
+        return options.delivery.toEvidenceToolResult(result.value, contract, recorded);
+    });
 };

package/dist/server/registerJebTools.js

@@ -0,0 +1,16 @@
+import { JebAnalysisService } from "../application/jeb/JebAnalysisService.js";
+import { toolContract } from "../contracts/toolContracts.js";
+import { createContractToolHandler } from "./contractToolHandler.js";
+import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
+/** Bind JEB handlers to their exact named contracts through shared workflows. */
+export const registerJebTools = (server, service, logger, recordEvidence, withAdmittedAnalysis) => {
+    const handler = createContractToolHandler(server, service, logger, recordEvidence, withAdmittedAnalysis);
+    const clientContract = toolContract("inspect_jeb_client");
+    server.registerTool(clientContract.name, toolRegistrationOptions(clientContract), handler(clientContract));
+    const openContract = toolContract("open_jeb_project");
+    server.registerTool(openContract.name, toolRegistrationOptions(openContract), handler(openContract));
+    const unitsContract = toolContract("list_jeb_units");
+    server.registerTool(unitsContract.name, toolRegistrationOptions(unitsContract), handler(unitsContract));
+    const decompileContract = toolContract("decompile_jeb_item");
+    server.registerTool(decompileContract.name, toolRegistrationOptions(decompileContract), handler(decompileContract));
+};

package/dist/server/registerManagedTools.js

@@ -5,9 +5,9 @@ import { registerEvidenceTools } from "./registerEvidenceTools.js";
 import { runManagedProviderExecution } from "../composition/directAnalysis.js";
 import { isManagedToolName } from "../contracts/managed/managedToolContracts.js";
 /** Register execution-free managed PE/CLI inspection. */
-export const registerManagedTools = (server, analysis, options) => {
+export const registerManagedTools = (server, options) => {
     let selectedManagedPath;
-    const managedAnalysis = {
+    const analysisForAdmission = (analysis) => ({
         execute: async (operation, parameters, executionOptions) => {
             if (!isManagedToolName(operation))
                 return analysis.execute(operation, parameters, executionOptions);
@@ -32,6 +32,9 @@ export const registerManagedTools = (server, analysis, options) => {
                 selectedManagedPath = requestedPath;
             return execution;
         },
-    };
-    registerEvidenceTools(server, managedAnalysis, MANAGED_TOOL_CONTRACTS, options);
+    });
+    registerEvidenceTools(server, MANAGED_TOOL_CONTRACTS, {
+        ...options,
+        analysisForAdmission,
+    });
 };

package/dist/server/registerManagedWorkflowTools/compareManagedMembers.js

@@ -1,3 +1,4 @@
+import { runAdmittedToolOperation } from "../admittedToolOperation.js";
 import { recordSessionEvidenceSources } from "../sessionEvidence.js";
 import { compareManagedMembersEvidenceValidated } from "../../application/managed/ManagedMemberComparisonService.js";
 import { managedMemberComparisonResultSchema } from "../../domain/managed/managedMemberComparison.js";
@@ -8,7 +9,7 @@ import { resolveManagedEvidence } from "./evidence.js";
 const compareContract = managedWorkflowContract("compare_managed_members");
 /** Register the managed member comparison workflow tool. */
 export const registerCompareManagedMembers = (server, options) => {
-    server.registerTool(compareContract.name, toolRegistrationOptions(compareContract), async (input) => {
+    server.registerTool(compareContract.name, toolRegistrationOptions(compareContract), async (input, context) => runAdmittedToolOperation(server, options.withAdmittedAnalysis, compareContract.name, context.mcpReq.signal, async () => {
         const leftResolved = resolveManagedEvidence(input.left);
         const rightResolved = resolveManagedEvidence(input.right);
         if (!leftResolved.ok)
@@ -23,10 +24,7 @@ export const registerCompareManagedMembers = (server, options) => {
         const result = await logToolExecution(options.logger, compareContract.name, () => Promise.resolve(compareManagedMembersEvidenceValidated(parsed)));
         if (!result.ok)
             return server.delivery.toCallToolResult(result, compareContract);
-        const recorded = recordSessionEvidenceSources(options.recordEvidence, [
-            parsed.left,
-            parsed.right,
-        ]);
+        const recorded = recordSessionEvidenceSources(options.recordEvidence, [parsed.left, parsed.right]);
         if (!recorded.ok)
             return server.delivery.toCallToolResult(recorded, compareContract);
         const comparison = managedMemberComparisonResultSchema.parse(result.value.normalized_result);
@@ -51,5 +49,5 @@ export const registerCompareManagedMembers = (server, options) => {
             })
             : options.recordEvidence?.(result.value);
         return server.delivery.toEvidenceToolResult(result.value, compareContract, output);
-    });
+    }));
 };

package/dist/server/registerManagedWorkflowTools/importManagedReconstruction.js

@@ -1,3 +1,4 @@
+import { runAdmittedToolOperation } from "../admittedToolOperation.js";
 import { importManagedReconstructionEvidenceValidated } from "../../application/managed/ManagedReconstructionService.js";
 import { logToolExecution } from "../toolLogging.js";
 import { toolRegistrationOptions } from "../toolRegistrationOptions.js";
@@ -6,7 +7,7 @@ import { resolveManagedEvidence } from "./evidence.js";
 const reconstructionContract = managedWorkflowContract("import_managed_reconstruction");
 /** Register the managed reconstruction import workflow tool. */
 export const registerImportManagedReconstruction = (server, options) => {
-    server.registerTool(reconstructionContract.name, toolRegistrationOptions(reconstructionContract), async (input) => {
+    server.registerTool(reconstructionContract.name, toolRegistrationOptions(reconstructionContract), async (input, context) => runAdmittedToolOperation(server, options.withAdmittedAnalysis, reconstructionContract.name, context.mcpReq.signal, async () => {
         const resolved = resolveManagedEvidence(input.static_members);
         if (!resolved.ok)
             return server.delivery.toCallToolResult(resolved, reconstructionContract);
@@ -22,5 +23,5 @@ export const registerImportManagedReconstruction = (server, options) => {
             return server.delivery.toCallToolResult(recordedSource, reconstructionContract);
         const recorded = options.recordEvidence?.(result.value);
         return server.delivery.toEvidenceToolResult(result.value, reconstructionContract, recorded);
-    });
+    }));
 };

package/dist/server/registerManagedWorkflowTools/projectManagedApplicationGraph.js

@@ -1,3 +1,4 @@
+import { runAdmittedToolOperation } from "../admittedToolOperation.js";
 import { recordSessionEvidenceSources } from "../sessionEvidence.js";
 import { projectManagedApplicationGraphEvidence } from "../../application/managed/ManagedApplicationGraphService.js";
 import { logToolExecution } from "../toolLogging.js";
@@ -7,7 +8,7 @@ import { resolveManagedArtifactEvidence, resolveManagedBoundaryEvidence, resolve
 const graphContract = managedWorkflowContract("project_managed_application_graph");
 /** Register the managed application graph projection workflow tool. */
 export const registerProjectManagedApplicationGraph = (server, options) => {
-    server.registerTool(graphContract.name, toolRegistrationOptions(graphContract), async (input) => {
+    server.registerTool(graphContract.name, toolRegistrationOptions(graphContract), async (input, context) => runAdmittedToolOperation(server, options.withAdmittedAnalysis, graphContract.name, context.mcpReq.signal, async () => {
         const managedArtifact = input.managed_artifact === undefined
             ? undefined
             : resolveManagedArtifactEvidence(input.managed_artifact);
@@ -36,5 +37,5 @@ export const registerProjectManagedApplicationGraph = (server, options) => {
             return server.delivery.toCallToolResult(recordedSources, graphContract);
         const recorded = options.recordEvidence?.(result.value);
         return server.delivery.toEvidenceToolResult(result.value, graphContract, recorded);
-    });
+    }));
 };

package/dist/server/registerManagedWorkflowTools/verifyManagedNativeBoundaries.js

@@ -1,3 +1,4 @@
+import { runAdmittedToolOperation } from "../admittedToolOperation.js";
 import { recordSessionEvidenceSources } from "../sessionEvidence.js";
 import { verifyManagedNativeBoundariesEvidence } from "../../application/managed/ManagedNativeVerificationService.js";
 import { managedNativeVerificationResultSchema } from "../../domain/managed/managedNativeVerificationSchemas.js";
@@ -8,7 +9,7 @@ import { resolveManagedBoundaryEvidence, resolveNativeEvidence, } from "./eviden
 const nativeVerificationContract = managedWorkflowContract("verify_managed_native_boundaries");
 /** Register the managed/native boundary verification workflow tool. */
 export const registerVerifyManagedNativeBoundaries = (server, options) => {
-    server.registerTool(nativeVerificationContract.name, toolRegistrationOptions(nativeVerificationContract), async (input) => {
+    server.registerTool(nativeVerificationContract.name, toolRegistrationOptions(nativeVerificationContract), async (input, context) => runAdmittedToolOperation(server, options.withAdmittedAnalysis, nativeVerificationContract.name, context.mcpReq.signal, async () => {
         const managedBoundaries = resolveManagedBoundaryEvidence(input.managed_boundaries);
         if (!managedBoundaries.ok)
             return server.delivery.toCallToolResult(managedBoundaries, nativeVerificationContract);
@@ -57,5 +58,5 @@ export const registerVerifyManagedNativeBoundaries = (server, options) => {
             })
             : options.recordEvidence?.(result.value);
         return server.delivery.toEvidenceToolResult(result.value, nativeVerificationContract, output);
-    });
+    }));
 };

package/dist/server/registerOfficialTools.js

@@ -5,40 +5,46 @@ import { mcpProgressReporter } from "./mcpProgress.js";
 import { logToolExecution } from "./toolLogging.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
 /** Register direct bridge proxies, preserving MCP cancellation and typed errors. */
-export const registerOfficialTools = (server, analysis, options) => {
+export const registerOfficialTools = (server, options) => {
     for (const contract of OFFICIAL_TOOL_CONTRACTS) {
-        registerOfficialTool(server, analysis, contract, {
+        registerOfficialTool(server, contract, {
             logger: options.logger,
             activeTarget: options.activeTarget,
             recordEvidence: options.recordEvidence,
+            withAdmittedAnalysis: options.withAdmittedAnalysis,
         });
     }
 };
-const registerOfficialTool = (server, analysis, contract, registration) => {
+const registerOfficialTool = (server, contract, registration) => {
     server.registerTool(contract.name, toolRegistrationOptions(contract), async (input, context) => {
-        const arguments_ = jsonObjectSchema.parse(contract.inputSchema.parse(input));
-        const progress = mcpProgressReporter(context);
-        const result = await runOfficialOperation(analysis, contract, arguments_, {
-            logger: registration.logger,
-            signal: context.mcpReq.signal,
-            progress,
+        const admitted = await registration.withAdmittedAnalysis(contract.name, context.mcpReq.signal, async (admittedAnalysis) => {
+            const arguments_ = jsonObjectSchema.parse(contract.inputSchema.parse(input));
+            const progress = mcpProgressReporter(context);
+            const result = await runOfficialOperation(admittedAnalysis, contract, arguments_, {
+                logger: registration.logger,
+                signal: context.mcpReq.signal,
+                progress,
+            });
+            if (!result.ok) {
+                return server.delivery.toCallToolResult(result, contract);
+            }
+            const evidence = createEvidence(result.value.subject ?? registration.activeTarget?.(), result.value.provider, {
+                operation: contract.name,
+                parameters: arguments_,
+                result: result.value.result,
+                ...(result.value.analysisProfile === undefined
+                    ? {}
+                    : { analysisProfile: result.value.analysisProfile }),
+                rawResult: result.value.rawResult,
+                limitations: result.value.limitations,
+                locations: result.value.locations,
+            });
+            const recorded = registration.recordEvidence?.(evidence);
+            return server.delivery.toEvidenceToolResult(evidence, contract, recorded);
         });
-        if (!result.ok) {
-            return server.delivery.toCallToolResult(result, contract);
-        }
-        const evidence = createEvidence(result.value.subject ?? registration.activeTarget?.(), result.value.provider, {
-            operation: contract.name,
-            parameters: arguments_,
-            result: result.value.result,
-            ...(result.value.analysisProfile === undefined
-                ? {}
-                : { analysisProfile: result.value.analysisProfile }),
-            rawResult: result.value.rawResult,
-            limitations: result.value.limitations,
-            locations: result.value.locations,
-        });
-        const recorded = registration.recordEvidence?.(evidence);
-        return server.delivery.toEvidenceToolResult(evidence, contract, recorded);
+        return admitted.ok
+            ? admitted.value
+            : server.delivery.toCallToolResult(admitted, contract);
     });
 };
 const runOfficialOperation = async (analysis, contract, arguments_, execution) => {

package/dist/server/registerPeResourcesTool.js

@@ -0,0 +1,9 @@
+import { toolContract } from "../contracts/toolContracts.js";
+import { createEvidenceToolHandler } from "./contractToolHandler.js";
+import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
+/** Register the explicit-file PE resource workflow and retain its complete Evidence. */
+export const registerPeResourcesTool = (server, service, logger, recordEvidence, withAdmittedAnalysis) => {
+    const contract = toolContract("inspect_pe_resources");
+    const handler = createEvidenceToolHandler(server, (input, options) => service.inspect(input, options), logger, recordEvidence, withAdmittedAnalysis);
+    server.registerTool(contract.name, toolRegistrationOptions(contract), handler(contract));
+};

package/dist/server/registerProcessComparisonTool.js

@@ -13,6 +13,8 @@ import { recordSessionEvidenceSources } from "./sessionEvidence.js";
 import { runDerivedOperation } from "./runDerivedOperation.js";
 import { PROCESS_PROVIDER } from "../domain/process/processEvidenceProvider.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
+import { withAdmittedAnalysis } from "./analysisAdmission.js";
+import { runAdmittedToolOperation } from "./admittedToolOperation.js";
 const PROCESS_CAPTURE_EVIDENCE = {
     operation: "capture_process_scenario",
     predicate: "rea.process-capture",
@@ -57,7 +59,8 @@ const parseCaptureSide = (operation, side, value) => {
 };
 /** Register deterministic process-capture comparison and contradiction tracking. */
 export const registerProcessComparisonTool = (server, session, contract, now = Date.now) => {
-    server.registerTool(contract.name, toolRegistrationOptions(contract), async (input, context) => {
+    const admission = withAdmittedAnalysis({ kind: "session", session });
+    server.registerTool(contract.name, toolRegistrationOptions(contract), async (input, context) => runAdmittedToolOperation(server, admission, contract.name, context.mcpReq.signal, async () => {
         const left = parseCaptureSide(contract.name, "left", input.left);
         if (!left.ok)
             return server.delivery.toCallToolResult(left, contract);
@@ -105,7 +108,7 @@ export const registerProcessComparisonTool = (server, session, contract, now = D
             right_evidence_id: rightRecord.evidence_id,
             comparison_evidence_id: evidence.evidence_id,
         }, comparison)));
-    });
+    }));
 };
 const comparisonUnknownInput = (parsed, comparison) => {
     if (comparison.status === "unchanged")

package/dist/server/registerRecordedCrashTools.js

@@ -1,14 +1,9 @@
 import { toolContract } from "../contracts/toolContracts.js";
-import { logToolExecution } from "./toolLogging.js";
+import { createEvidenceToolHandler } from "./contractToolHandler.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
 /** Bind recorded crash inspection to its named contract and session Evidence owner. */
-export const registerRecordedCrashTools = (server, service, logger, recordEvidence) => {
+export const registerRecordedCrashTools = (server, service, logger, recordEvidence, withAdmittedAnalysis) => {
     const contract = toolContract("inspect_recorded_crash");
-    server.registerTool(contract.name, toolRegistrationOptions(contract), async (input, context) => {
-        const result = await logToolExecution(logger, contract.name, () => service.inspect(input, { signal: context.mcpReq.signal }));
-        if (!result.ok)
-            return server.delivery.toCallToolResult(result, contract);
-        const recorded = recordEvidence?.(result.value);
-        return server.delivery.toEvidenceToolResult(result.value, contract, recorded);
-    });
+    const handler = createEvidenceToolHandler(server, (input, options) => service.inspect(input, options), logger, recordEvidence, withAdmittedAnalysis);
+    server.registerTool(contract.name, toolRegistrationOptions(contract), handler(contract));
 };

package/dist/server/registerSessionRecordTools.js

@@ -1,6 +1,7 @@
 import { readEvidenceBundle, writeEvidenceBundle, } from "../application/EvidenceBundleFiles.js";
 import { toolContract } from "../contracts/toolContracts.js";
 import { ok } from "../domain/result.js";
+import { inspectEvidenceBundle } from "../application/investigation/InspectEvidenceBundle.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
 /** Register evidence bundle import and export tools. */
 export const registerEvidenceTools = (registration) => {
@@ -23,7 +24,7 @@ const registerExportEvidenceTool = ({ server, session, exportContract, }) => {
     });
 };
 const registerSnapshotEvidenceTool = ({ server, session, snapshotContract, }) => {
-    server.registerTool(snapshotContract.name, toolRegistrationOptions(snapshotContract), () => server.delivery.toCallToolResult(ok(bundleForSerialization(session)), snapshotContract));
+    server.registerTool(snapshotContract.name, toolRegistrationOptions(snapshotContract), (input) => server.delivery.toCallToolResult(inspectEvidenceBundle(bundleForSerialization(session), input), snapshotContract));
 };
 const registerImportEvidenceTool = ({ server, session, importContract, }) => {
     server.registerTool(importContract.name, toolRegistrationOptions(importContract), async (input) => {

package/dist/server/registerSessionTools.js

@@ -2,10 +2,12 @@ import { getNavigationContext, inspectAddressContext, } from "../application/Ana
 import { readAnalysisSnapshot } from "../application/binary/AnalysisSnapshotFiles.js";
 import { createProcessCaptureEvidence } from "../application/process/ProcessEvidence.js";
 import { captureProcessScenario } from "../process/capture/ProcessHarness.js";
+import { ProcessCaptureResourceScope } from "../process/capture/ProcessCaptureLifecycle.js";
+import { ProcessCaptureError } from "../process/capture/ProcessCaptureError.js";
 import { toolContract } from "../contracts/toolContracts.js";
 import { UnknownRegistryError } from "../domain/unknownRegistryError.js";
 import {} from "../domain/analysisErrorBase.js";
-import { ok } from "../domain/result.js";
+import { err, ok } from "../domain/result.js";
 import { mcpProgressReporter } from "./mcpProgress.js";
 import { registerArtifactComparisonTool } from "./registerArtifactComparisonTool.js";
 import { registerBundleComparisonTool } from "./registerBundleComparisonTool.js";
@@ -15,9 +17,11 @@ import { registerInvestigationTools } from "./registerInvestigationTools.js";
 import { registerProcessComparisonTool } from "./registerProcessComparisonTool.js";
 import { registerEvidenceTools, registerUnknownTools, } from "./registerSessionRecordTools.js";
 import { registerSessionStatusTool } from "./registerSessionStatusTool.js";
-import { sessionAvailabilityPolicy, } from "./sessionAvailabilityPolicy.js";
+import { sessionAvailabilityPolicy } from "./sessionAvailabilityPolicy.js";
 import { logToolExecution } from "./toolLogging.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
+import { withAdmittedAnalysis } from "./analysisAdmission.js";
+import { runAdmittedToolOperation } from "./admittedToolOperation.js";
 const recordProcessResidualUnknowns = (session, evidence, residuals) => {
     for (const residual of residuals) {
         const unknown = session.recordUnknown({
@@ -44,23 +48,11 @@ const recordProcessResidualUnknowns = (session, evidence, residuals) => {
     }
     return ok(null);
 };
-const registerProcessTools = ({ server, session, logger, captureContract, }) => {
-    server.registerTool(captureContract.name, toolRegistrationOptions(captureContract), async (input, context) => {
+const registerProcessTools = ({ server, session, logger, captureContract, resourceScope, }) => {
+    const admission = withAdmittedAnalysis({ kind: "session", session });
+    server.registerTool(captureContract.name, toolRegistrationOptions(captureContract), async (input, context) => runAdmittedToolOperation(server, admission, captureContract.name, context.mcpReq.signal, async () => {
         const progress = mcpProgressReporter(context);
-        await progress.report({
-            phase: captureContract.name,
-            completed: 0,
-            total: 1,
-            message: "started",
-        });
-        const captured = await logToolExecution(logger, captureContract.name, () => captureProcessScenario(input, context.mcpReq.signal));
-        await progress.report({
-            phase: captureContract.name,
-            completed: 1,
-            total: 1,
-            message: captured.ok ? "completed" : "failed",
-            terminal: true,
-        });
+        const captured = await logToolExecution(logger, captureContract.name, () => captureProcessScenario(input, context.mcpReq.signal, process.platform, process.env, undefined, undefined, progress, resourceScope));
         if (!captured.ok)
             return server.delivery.toCallToolResult(captured, captureContract);
         const evidence = createProcessCaptureEvidence(input, captured.value);
@@ -71,7 +63,7 @@ const registerProcessTools = ({ server, session, logger, captureContract, }) =>
         if (!unknowns.ok)
             return server.delivery.toCallToolResult(unknowns, captureContract);
         return server.delivery.toEvidenceToolResult(evidence, captureContract, recorded);
-    });
+    }));
 };
 const registerLifecycleTools = (registration) => {
     const { server, session, statusContract, startedAt, availabilityPolicy, androidAnalysisAvailability, } = registration;
@@ -121,10 +113,16 @@ const registerContextTools = (server, session) => {
     const navigationContract = toolContract("get_navigation_context");
     const addressContract = toolContract("inspect_address_context");
     server.registerTool(navigationContract.name, toolRegistrationOptions(navigationContract), async (input, context) => {
-        return server.delivery.toCallToolResult(await getNavigationContext(session, input, context.mcpReq.signal), navigationContract);
+        const admitted = await session.withAdmittedAnalysis(navigationContract.name, context.mcpReq.signal, async (analysis) => server.delivery.toCallToolResult(await getNavigationContext(analysis, input, context.mcpReq.signal), navigationContract));
+        return admitted.ok
+            ? admitted.value
+            : server.delivery.toCallToolResult(admitted, navigationContract);
     });
     server.registerTool(addressContract.name, toolRegistrationOptions(addressContract), async (input, context) => {
-        return server.delivery.toCallToolResult(await inspectAddressContext(session, input, context.mcpReq.signal), addressContract);
+        const admitted = await session.withAdmittedAnalysis(addressContract.name, context.mcpReq.signal, async (analysis) => server.delivery.toCallToolResult(await inspectAddressContext(analysis, input, context.mcpReq.signal), addressContract));
+        return admitted.ok
+            ? admitted.value
+            : server.delivery.toCallToolResult(admitted, addressContract);
     });
 };
 export const registerSessionTools = (server, session, logger, options = {}) => {
@@ -139,6 +137,7 @@ export const registerSessionTools = (server, session, logger, options = {}) => {
     const compareFunctionsContract = toolContract("compare_functions");
     const compareBundlesContract = toolContract("compare_bundles");
     const snapshotContract = toolContract("get_evidence_bundle");
+    const processResources = new ProcessCaptureResourceScope();
     registerLifecycleTools({
         server,
         session,
@@ -149,6 +148,22 @@ export const registerSessionTools = (server, session, logger, options = {}) => {
         startedAt: options.startedAt ?? new Date().toISOString(),
         availabilityPolicy: sessionAvailabilityPolicy(options.availabilityPolicy, {}),
         androidAnalysisAvailability: options.androidAnalysisAvailability ?? missingAndroidAvailability,
+        closeProcessResources: async () => {
+            try {
+                await processResources.retryCleanup();
+                return ok(null);
+            }
+            catch (cause) {
+                return err(new ProcessCaptureError("process capture cleanup remains incomplete", {
+                    cause,
+                    reason: "cleanup_incomplete",
+                    cleanupResources: ["process_capture_resources"],
+                    executionFailure: cause instanceof Error
+                        ? cause.message || cause.name
+                        : String(cause),
+                }));
+            }
+        },
     });
     registerEvidenceTools({
         server,
@@ -162,7 +177,29 @@ export const registerSessionTools = (server, session, logger, options = {}) => {
         session,
         logger,
         captureContract,
+        resourceScope: processResources,
     });
+    const closeServer = server.close.bind(server);
+    server.close = async () => {
+        const results = await Promise.allSettled([
+            closeServer(),
+            processResources.close(),
+        ]);
+        const failures = results.flatMap((result) => result.status === "rejected" ? [result.reason] : []);
+        if (failures.length > 0)
+            throw new AggregateError(failures, "REA session cleanup failed");
+    };
+    const previousOnclose = server.server.onclose;
+    server.server.onclose = () => {
+        try {
+            previousOnclose?.();
+        }
+        finally {
+            void processResources.close().catch((cause) => {
+                logger.error({ error: cause instanceof Error ? cause.message : String(cause) }, "Process capture cleanup failed during server shutdown");
+            });
+        }
+    };
     registerProcessComparisonTool(server, session, compareContract);
     registerArtifactComparisonTool(server, session, compareArtifactsContract);
     registerFunctionComparisonTool(server, session, compareFunctionsContract);

package/dist/server/registerWebModuleTool.js

@@ -1,14 +1,9 @@
 import { toolContract } from "../contracts/toolContracts.js";
-import { logToolExecution } from "./toolLogging.js";
+import { createEvidenceToolHandler } from "./contractToolHandler.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
 /** Bind the module relationship workflow to its exact canonical contract. */
-export const registerWebModuleTool = (server, service, logger, recordEvidence) => {
+export const registerWebModuleTool = (server, service, logger, recordEvidence, withAdmittedAnalysis) => {
     const contract = toolContract("trace_web_module_imports");
-    server.registerTool(contract.name, toolRegistrationOptions(contract), async (input, context) => {
-        const result = await logToolExecution(logger, contract.name, () => service.trace(input, { signal: context.mcpReq.signal }));
-        if (!result.ok)
-            return server.delivery.toCallToolResult(result, contract);
-        const recorded = recordEvidence?.(result.value);
-        return server.delivery.toEvidenceToolResult(result.value, contract, recorded);
-    });
+    const handler = createEvidenceToolHandler(server, (input, options) => service.trace(input, options), logger, recordEvidence, withAdmittedAnalysis);
+    server.registerTool(contract.name, toolRegistrationOptions(contract), handler(contract));
 };

package/dist/server/registerWebNetworkCaptureTool.js

@@ -1,8 +1,8 @@
 import { toolContract } from "../contracts/toolContracts.js";
-import { logToolExecution } from "./toolLogging.js";
+import { createEvidenceToolHandler } from "./contractToolHandler.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
 /** Bind historical inspection to its named contract and caller-owned Evidence writer. */
-export const registerWebNetworkCaptureTool = (server, service, logger, recordEvidence) => {
+export const registerWebNetworkCaptureTool = (server, service, logger, recordEvidence, withAdmittedAnalysis) => {
     const contract = toolContract("inspect_web_network_capture");
     const registration = toolRegistrationOptions(contract);
     // Keep the exact advertised contract; the shared service validates raw input
@@ -15,11 +15,6 @@ export const registerWebNetworkCaptureTool = (server, service, logger, recordEvi
             validate: (value) => ({ value }),
         },
     };
-    server.registerTool(contract.name, { ...registration, inputSchema }, async (input, context) => {
-        const result = await logToolExecution(logger, contract.name, () => service.inspect(input, { signal: context.mcpReq.signal }));
-        if (!result.ok)
-            return server.delivery.toCallToolResult(result, contract);
-        const recorded = recordEvidence?.(result.value);
-        return server.delivery.toEvidenceToolResult(result.value, contract, recorded);
-    });
+    const handler = createEvidenceToolHandler(server, (input, options) => service.inspect(input, options), logger, recordEvidence, withAdmittedAnalysis);
+    server.registerTool(contract.name, { ...registration, inputSchema }, handler(contract));
 };