rea-agents 6.3.0 → 6.4.0

package/dist/server/registerBrowserTools.js

@@ -7,10 +7,11 @@ import { inspectWebPageInputSchema } from "../domain/browserObservation.js";
 import { mcpProgressReporter } from "./mcpProgress.js";
 import { logToolExecution } from "./toolLogging.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
+import { runAdmittedToolOperation } from "./admittedToolOperation.js";
 /** Register browser tools with execution-time provider diagnostics. */
 // oxlint-disable-next-line max-lines-per-function -- direct SDK calls retain each schema-handler type correlation.
 export const registerBrowserTools = (server, options) => {
-    const registration = { ...options, delivery: server.delivery };
+    const registration = { ...options, delivery: server.delivery, server };
     const listContract = toolContract("list_browser_targets");
     const inspectContract = toolContract("inspect_web_page");
     const analyzeContract = toolContract("analyze_web_bundle");
@@ -46,12 +47,14 @@ const runBrowserTool = async (options, contract, request, execute) => {
     const { input, context } = request;
     if (options.loadFailure !== undefined)
         return options.delivery.toCallToolResult(err(optionalProviderUnavailable(options.loadFailure, contract.name)), contract);
-    const result = await logToolExecution(options.logger, contract.name, () => execute(input, {
-        signal: context.mcpReq.signal,
-        progress: mcpProgressReporter(context),
-    }));
-    if (!result.ok)
-        return options.delivery.toCallToolResult(result, contract);
-    const recorded = options.recordEvidence?.(result.value);
-    return options.delivery.toEvidenceToolResult(result.value, contract, recorded);
+    return runAdmittedToolOperation(options.server, options.withAdmittedAnalysis, contract.name, context.mcpReq.signal, async () => {
+        const result = await logToolExecution(options.logger, contract.name, () => execute(input, {
+            signal: context.mcpReq.signal,
+            progress: mcpProgressReporter(context),
+        }));
+        if (!result.ok)
+            return options.delivery.toCallToolResult(result, contract);
+        const recorded = options.recordEvidence?.(result.value);
+        return options.delivery.toEvidenceToolResult(result.value, contract, recorded);
+    });
 };

package/dist/server/registerBundleComparisonTool.js

@@ -4,11 +4,15 @@ import { compareBundles } from "../domain/bundleComparison.js";
 import { createEvidence } from "../domain/evidence.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";
 import { runDerivedOperation } from "./runDerivedOperation.js";
+import { recordSessionEvidenceSources } from "./sessionEvidence.js";
 import { BUNDLE_COMPARISON_PROVIDER } from "../application/InvestigationProviders.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
+import { withAdmittedAnalysis } from "./analysisAdmission.js";
+import { runAdmittedToolOperation } from "./admittedToolOperation.js";
 /** Register canonical Evidence bundle comparison. */
 export const registerBundleComparisonTool = (server, session, contract) => {
-    server.registerTool(contract.name, toolRegistrationOptions(contract), async (input, context) => {
+    const admission = withAdmittedAnalysis({ kind: "session", session });
+    server.registerTool(contract.name, toolRegistrationOptions(contract), async (input, context) => runAdmittedToolOperation(server, admission, contract.name, context.mcpReq.signal, async () => {
         const [left, right] = await Promise.all([
             readEvidenceBundle(input.left_bundle_path),
             readEvidenceBundle(input.right_bundle_path),
@@ -21,6 +25,15 @@ export const registerBundleComparisonTool = (server, session, contract) => {
         if (!computed.ok)
             return server.delivery.toCallToolResult(computed, contract);
         const comparison = computed.value;
+        const sourceRecords = [
+            ...new Map([...left.value.records, ...right.value.records].map((record) => [
+                record.evidence_id,
+                record,
+            ])).values(),
+        ];
+        const recordedSources = recordSessionEvidenceSources((evidence) => session.recordEvidence(evidence), sourceRecords);
+        if (!recordedSources.ok)
+            return server.delivery.toCallToolResult(recordedSources, contract);
         const evidence = createEvidence(undefined, BUNDLE_COMPARISON_PROVIDER, {
             predicateType: "rea.bundle-comparison",
             operation: contract.name,
@@ -33,8 +46,9 @@ export const registerBundleComparisonTool = (server, session, contract) => {
             confidence: "derived",
             authority: "analyst-inference",
             limitations: comparison.limitations,
+            evidenceLinks: sourceRecords.map(({ evidence_id }) => evidence_id),
         });
         const recorded = session.recordEvidence(evidence);
         return server.delivery.toEvidenceToolResult(evidence, contract, recorded);
-    });
+    }));
 };

package/dist/server/registerCloseLifecycleTool.js

@@ -4,20 +4,49 @@ import { mcpProgressReporter } from "./mcpProgress.js";
 import { logToolExecution } from "./toolLogging.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
 /** Register provider cleanup and optional pre-close snapshot persistence. */
-export const registerCloseLifecycleTool = ({ server, session, logger, closeContract, }) => {
+export const registerCloseLifecycleTool = ({ server, session, logger, closeContract, closeProcessResources, }) => {
+    const closeWithResources = async (closeSession) => {
+        const [sessionClose, resourceClose] = await Promise.allSettled([
+            closeSession(),
+            closeProcessResources(),
+        ]);
+        if (sessionClose.status === "rejected") {
+            if (resourceClose.status === "rejected")
+                logger.warn({
+                    error: resourceClose.reason instanceof Error
+                        ? resourceClose.reason.message
+                        : String(resourceClose.reason),
+                }, "Process capture cleanup threw while closing the session");
+            else if (!resourceClose.value.ok)
+                logger.warn({ error: resourceClose.value.error.message }, "Process capture cleanup failed while closing the session");
+            throw sessionClose.reason;
+        }
+        if (resourceClose.status === "rejected")
+            throw resourceClose.reason;
+        const closed = sessionClose.value;
+        const resources = resourceClose.value;
+        if (!closed.ok) {
+            if (!resources.ok)
+                logger.warn({ error: resources.error.message }, "Process capture cleanup failed while closing the session");
+            return closed;
+        }
+        return resources.ok ? closed : resources;
+    };
     server.registerTool(closeContract.name, toolRegistrationOptions(closeContract), async (input, context) => {
         const progress = mcpProgressReporter(context);
         const snapshotPath = input.snapshot_path;
         if (snapshotPath === undefined) {
             // Enqueue the lifecycle transition before awaiting progress transport so
             // a later open request cannot overtake this close.
-            const closing = logToolExecution(logger, closeContract.name, () => session.close({ progress }));
+            const closing = logToolExecution(logger, closeContract.name, () => closeWithResources(() => session.close({ progress })));
             await reportLifecycleStart(progress, closeContract.name);
             const closed = await closing;
             await reportLifecycleEnd(progress, closeContract.name, closed.ok);
             return server.delivery.toCallToolResult(closed, closeContract);
         }
-        const closing = logToolExecution(logger, closeContract.name, () => session.closeWithSnapshot(snapshotPath, input.overwrite, { progress }));
+        const closing = logToolExecution(logger, closeContract.name, () => closeWithResources(() => session.closeWithSnapshot(snapshotPath, input.overwrite, {
+            progress,
+        })));
         await reportLifecycleStart(progress, closeContract.name, "saving snapshot; closing provider");
         const closed = await closing;
         await reportLifecycleEnd(progress, closeContract.name, closed.ok);

package/dist/server/registerElectronTools.js

@@ -1,3 +1,4 @@
+import { summarizeRetainedAnalysis } from "../application/analysisView/AnalysisViewService.js";
 import { optionalProviderUnavailable, } from "../application/OptionalObservationProviders.js";
 import { err } from "../domain/result.js";
 import { captureElectronScenario } from "../application/javascript/ElectronActiveObservationService.js";
@@ -9,10 +10,11 @@ import { inspectElectronPageInputSchema } from "../domain/javascript/electronObs
 import { mcpProgressReporter } from "./mcpProgress.js";
 import { logToolExecution } from "./toolLogging.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
+import { runAdmittedToolOperation } from "./admittedToolOperation.js";
 /** Register Electron tools even when a provider is absent. */
 // oxlint-disable-next-line max-lines-per-function -- direct SDK calls retain each schema-handler type correlation.
 export const registerElectronTools = (server, options) => {
-    const registration = { ...options, delivery: server.delivery };
+    const registration = { ...options, delivery: server.delivery, server };
     const listContract = toolContract("list_electron_targets");
     const inspectContract = toolContract("inspect_electron_page");
     const analyzeContract = toolContract("analyze_javascript_application");
@@ -28,7 +30,12 @@ export const registerElectronTools = (server, options) => {
             progress,
         });
     }));
-    server.registerTool(analyzeContract.name, toolRegistrationOptions(analyzeContract), (input, context) => runElectronTool(registration, analyzeContract, { input, context }, (parsed, { signal, progress }) => analyzeJavaScriptApplicationValidated(parsed, { signal, progress })));
+    server.registerTool(analyzeContract.name, toolRegistrationOptions(analyzeContract), (input, context) => runElectronTool(registration, analyzeContract, { input, context }, async ({ detail, ...request }, { signal, progress }) => {
+        const analyzed = await analyzeJavaScriptApplicationValidated(request, options.artifactResources, { signal, progress });
+        return detail === "summary" && analyzed.ok
+            ? summarizeRetainedAnalysis(analyzed.value, options)
+            : analyzed;
+    }));
     server.registerTool(reconcileContract.name, toolRegistrationOptions(reconcileContract), (input, context) => runElectronTool(registration, reconcileContract, { input, context }, (parsed) => Promise.resolve(reconcileJavaScriptRuntimeEvidenceValidated(parsed))));
     server.registerTool(activeContract.name, toolRegistrationOptions(activeContract), (input, context) => runElectronTool(registration, activeContract, { input, context }, (parsed, { signal, progress }) => captureElectronScenario(options.electronActive, parsed, {
         signal,
@@ -45,12 +52,23 @@ const runElectronTool = async (options, contract, request, execute) => {
             : undefined;
     if (failure !== undefined)
         return options.delivery.toCallToolResult(err(optionalProviderUnavailable(failure, contract.name)), contract);
-    const result = await logToolExecution(options.logger, contract.name, () => execute(input, {
-        signal: context.mcpReq.signal,
-        progress: mcpProgressReporter(context),
-    }));
-    if (!result.ok)
-        return options.delivery.toCallToolResult(result, contract);
-    const recorded = options.recordEvidence?.(result.value);
-    return options.delivery.toEvidenceToolResult(result.value, contract, recorded);
+    return runAdmittedToolOperation(options.server, options.withAdmittedAnalysis, contract.name, context.mcpReq.signal, async () => {
+        const result = await logToolExecution(options.logger, contract.name, () => execute(input, {
+            signal: context.mcpReq.signal,
+            progress: mcpProgressReporter(context),
+        }));
+        if (!result.ok) {
+            const partial = result.error.partialObservation;
+            if (partial !== undefined &&
+                "evidence_id" in partial &&
+                typeof partial.evidence_id === "string") {
+                const recorded = options.recordEvidence?.(partial);
+                if (recorded !== undefined)
+                    return options.delivery.toRecordedPartialErrorToolResult(result.error, partial.evidence_id, recorded);
+            }
+            return options.delivery.toCallToolResult(result, contract);
+        }
+        const recorded = options.recordEvidence?.(result.value);
+        return options.delivery.toEvidenceToolResult(result.value, contract, recorded);
+    });
 };

package/dist/server/registerEvmTools.js

@@ -1,14 +1,9 @@
 import { toolContract } from "../contracts/toolContracts.js";
-import { logToolExecution } from "./toolLogging.js";
+import { createEvidenceToolHandler } from "./contractToolHandler.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
 /** Bind the named EVM contract to shared validation and session Evidence recording. */
-export const registerEvmTools = (server, service, logger, recordEvidence) => {
+export const registerEvmTools = (server, service, logger, recordEvidence, withAdmittedAnalysis) => {
     const contract = toolContract("inspect_evm_interface");
-    server.registerTool(contract.name, toolRegistrationOptions(contract), async (input, context) => {
-        const result = await logToolExecution(logger, contract.name, () => service.inspect(input, { signal: context.mcpReq.signal }));
-        if (!result.ok)
-            return server.delivery.toCallToolResult(result, contract);
-        const recorded = recordEvidence?.(result.value);
-        return server.delivery.toEvidenceToolResult(result.value, contract, recorded);
-    });
+    const handler = createEvidenceToolHandler(server, (input, options) => service.inspect(input, options), logger, recordEvidence, withAdmittedAnalysis);
+    server.registerTool(contract.name, toolRegistrationOptions(contract), handler(contract));
 };

package/dist/server/registerFirmwareTools.js

@@ -1,17 +1,9 @@
 import { toolContract } from "../contracts/toolContracts.js";
-import { logToolExecution } from "./toolLogging.js";
+import { createContractToolHandler } from "./contractToolHandler.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
 /** Bind firmware handlers to their exact named schemas. */
-export const registerFirmwareTools = (server, service, logger, recordEvidence) => {
-    const handler = (contract) => async (input, context) => {
-        const result = await logToolExecution(logger, contract.name, () => service.execute(contract.name, input, {
-            signal: context.mcpReq.signal,
-        }));
-        if (!result.ok)
-            return server.delivery.toCallToolResult(result, contract);
-        const recorded = recordEvidence?.(result.value);
-        return server.delivery.toEvidenceToolResult(result.value, contract, recorded);
-    };
+export const registerFirmwareTools = (server, service, logger, recordEvidence, withAdmittedAnalysis) => {
+    const handler = createContractToolHandler(server, service, logger, recordEvidence, withAdmittedAnalysis);
     const inspect = toolContract("inspect_firmware_regions");
     server.registerTool(inspect.name, toolRegistrationOptions(inspect), handler(inspect));
     const extract = toolContract("extract_firmware");

package/dist/server/registerFunctionComparisonTool.js

@@ -8,10 +8,13 @@ import { recordSessionEvidenceSources } from "./sessionEvidence.js";
 import { runDerivedOperation } from "./runDerivedOperation.js";
 import { FUNCTION_COMPARISON_PROVIDER } from "../application/InvestigationProviders.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
+import { withAdmittedAnalysis } from "./analysisAdmission.js";
+import { runAdmittedToolOperation } from "./admittedToolOperation.js";
 import { compareFunctions } from "../domain/functionComparison.js";
 /** Register explicit Evidence-backed function comparison. */
 export const registerFunctionComparisonTool = (server, session, contract) => {
-    server.registerTool(contract.name, toolRegistrationOptions(contract), async (input, context) => {
+    const admission = withAdmittedAnalysis({ kind: "session", session });
+    server.registerTool(contract.name, toolRegistrationOptions(contract), async (input, context) => runAdmittedToolOperation(server, admission, contract.name, context.mcpReq.signal, async () => {
         let leftEvidence;
         let rightEvidence;
         try {
@@ -55,7 +58,7 @@ export const registerFunctionComparisonTool = (server, session, contract) => {
             comparisonEvidenceId: evidence.evidence_id,
         }));
         return server.delivery.toEvidenceToolResult(evidence, contract, recorded);
-    });
+    }));
 };
 const functionUnknownInput = ({ status, leftIds, rightIds, comparisonEvidenceId, }) => {
     if (status === "unchanged")

package/dist/server/registerJavaScriptRecoveryTool.js

@@ -1,14 +1,9 @@
 import { toolContract } from "../contracts/toolContracts.js";
-import { logToolExecution } from "./toolLogging.js";
+import { createEvidenceToolHandler } from "./contractToolHandler.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
 /** Bind optional recovery to its exact named contract without acquiring an engine. */
-export const registerJavaScriptRecoveryTool = (server, service, logger, recordEvidence) => {
+export const registerJavaScriptRecoveryTool = (server, service, logger, recordEvidence, withAdmittedAnalysis) => {
     const contract = toolContract("recover_javascript_sources");
-    server.registerTool(contract.name, toolRegistrationOptions(contract), async (input, context) => {
-        const result = await logToolExecution(logger, contract.name, () => service.recover(input, { signal: context.mcpReq.signal }));
-        if (!result.ok)
-            return server.delivery.toCallToolResult(result, contract);
-        const recorded = recordEvidence?.(result.value);
-        return server.delivery.toEvidenceToolResult(result.value, contract, recorded);
-    });
+    const handler = createEvidenceToolHandler(server, (input, options) => service.recover(input, options), logger, recordEvidence, withAdmittedAnalysis);
+    server.registerTool(contract.name, toolRegistrationOptions(contract), handler(contract));
 };

package/dist/server/registerJavaScriptRuntimeObservationTools.js

@@ -5,9 +5,10 @@ import { toolContract } from "../contracts/toolContracts.js";
 import { observeJavaScriptRuntimeInputSchema } from "../domain/javascript/javascriptRuntimeObservation.js";
 import { logToolExecution } from "./toolLogging.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
+import { runAdmittedToolOperation } from "./admittedToolOperation.js";
 /** Register passive Inspector tools even when policy keeps them unavailable. */
 export const registerJavaScriptRuntimeObservationTools = (server, options) => {
-    const registration = { ...options, delivery: server.delivery };
+    const registration = { ...options, delivery: server.delivery, server };
     const listContract = toolContract("list_javascript_runtime_targets");
     const observeContract = toolContract("observe_javascript_runtime");
     server.registerTool(listContract.name, toolRegistrationOptions(listContract), (input, context) => runRuntimeTool(registration, listContract, { input, context }, (parsed, signal) => listJavaScriptRuntimeTargets(options.runtime, parsed, { signal })));
@@ -20,9 +21,11 @@ const runRuntimeTool = async (options, contract, request, execute) => {
     const { input, context } = request;
     if (options.loadFailure !== undefined)
         return options.delivery.toCallToolResult(err(optionalProviderUnavailable(options.loadFailure, contract.name)), contract);
-    const result = await logToolExecution(options.logger, contract.name, () => execute(input, context.mcpReq.signal));
-    if (!result.ok)
-        return options.delivery.toCallToolResult(result, contract);
-    const recorded = options.recordEvidence?.(result.value);
-    return options.delivery.toEvidenceToolResult(result.value, contract, recorded);
+    return runAdmittedToolOperation(options.server, options.withAdmittedAnalysis, contract.name, context.mcpReq.signal, async () => {
+        const result = await logToolExecution(options.logger, contract.name, () => execute(input, context.mcpReq.signal));
+        if (!result.ok)
+            return options.delivery.toCallToolResult(result, contract);
+        const recorded = options.recordEvidence?.(result.value);
+        return options.delivery.toEvidenceToolResult(result.value, contract, recorded);
+    });
 };

package/dist/server/registerJebTools.js

@@ -0,0 +1,16 @@
+import { JebAnalysisService } from "../application/jeb/JebAnalysisService.js";
+import { toolContract } from "../contracts/toolContracts.js";
+import { createContractToolHandler } from "./contractToolHandler.js";
+import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
+/** Bind JEB handlers to their exact named contracts through shared workflows. */
+export const registerJebTools = (server, service, logger, recordEvidence, withAdmittedAnalysis) => {
+    const handler = createContractToolHandler(server, service, logger, recordEvidence, withAdmittedAnalysis);
+    const clientContract = toolContract("inspect_jeb_client");
+    server.registerTool(clientContract.name, toolRegistrationOptions(clientContract), handler(clientContract));
+    const openContract = toolContract("open_jeb_project");
+    server.registerTool(openContract.name, toolRegistrationOptions(openContract), handler(openContract));
+    const unitsContract = toolContract("list_jeb_units");
+    server.registerTool(unitsContract.name, toolRegistrationOptions(unitsContract), handler(unitsContract));
+    const decompileContract = toolContract("decompile_jeb_item");
+    server.registerTool(decompileContract.name, toolRegistrationOptions(decompileContract), handler(decompileContract));
+};

package/dist/server/registerManagedWorkflowTools/compareManagedMembers.js

@@ -1,3 +1,4 @@
+import { runAdmittedToolOperation } from "../admittedToolOperation.js";
 import { recordSessionEvidenceSources } from "../sessionEvidence.js";
 import { compareManagedMembersEvidenceValidated } from "../../application/managed/ManagedMemberComparisonService.js";
 import { managedMemberComparisonResultSchema } from "../../domain/managed/managedMemberComparison.js";
@@ -8,7 +9,7 @@ import { resolveManagedEvidence } from "./evidence.js";
 const compareContract = managedWorkflowContract("compare_managed_members");
 /** Register the managed member comparison workflow tool. */
 export const registerCompareManagedMembers = (server, options) => {
-    server.registerTool(compareContract.name, toolRegistrationOptions(compareContract), async (input) => {
+    server.registerTool(compareContract.name, toolRegistrationOptions(compareContract), async (input, context) => runAdmittedToolOperation(server, options.withAdmittedAnalysis, compareContract.name, context.mcpReq.signal, async () => {
         const leftResolved = resolveManagedEvidence(input.left);
         const rightResolved = resolveManagedEvidence(input.right);
         if (!leftResolved.ok)
@@ -23,10 +24,7 @@ export const registerCompareManagedMembers = (server, options) => {
         const result = await logToolExecution(options.logger, compareContract.name, () => Promise.resolve(compareManagedMembersEvidenceValidated(parsed)));
         if (!result.ok)
             return server.delivery.toCallToolResult(result, compareContract);
-        const recorded = recordSessionEvidenceSources(options.recordEvidence, [
-            parsed.left,
-            parsed.right,
-        ]);
+        const recorded = recordSessionEvidenceSources(options.recordEvidence, [parsed.left, parsed.right]);
         if (!recorded.ok)
             return server.delivery.toCallToolResult(recorded, compareContract);
         const comparison = managedMemberComparisonResultSchema.parse(result.value.normalized_result);
@@ -51,5 +49,5 @@ export const registerCompareManagedMembers = (server, options) => {
             })
             : options.recordEvidence?.(result.value);
         return server.delivery.toEvidenceToolResult(result.value, compareContract, output);
-    });
+    }));
 };

package/dist/server/registerManagedWorkflowTools/importManagedReconstruction.js

@@ -1,3 +1,4 @@
+import { runAdmittedToolOperation } from "../admittedToolOperation.js";
 import { importManagedReconstructionEvidenceValidated } from "../../application/managed/ManagedReconstructionService.js";
 import { logToolExecution } from "../toolLogging.js";
 import { toolRegistrationOptions } from "../toolRegistrationOptions.js";
@@ -6,7 +7,7 @@ import { resolveManagedEvidence } from "./evidence.js";
 const reconstructionContract = managedWorkflowContract("import_managed_reconstruction");
 /** Register the managed reconstruction import workflow tool. */
 export const registerImportManagedReconstruction = (server, options) => {
-    server.registerTool(reconstructionContract.name, toolRegistrationOptions(reconstructionContract), async (input) => {
+    server.registerTool(reconstructionContract.name, toolRegistrationOptions(reconstructionContract), async (input, context) => runAdmittedToolOperation(server, options.withAdmittedAnalysis, reconstructionContract.name, context.mcpReq.signal, async () => {
         const resolved = resolveManagedEvidence(input.static_members);
         if (!resolved.ok)
             return server.delivery.toCallToolResult(resolved, reconstructionContract);
@@ -22,5 +23,5 @@ export const registerImportManagedReconstruction = (server, options) => {
             return server.delivery.toCallToolResult(recordedSource, reconstructionContract);
         const recorded = options.recordEvidence?.(result.value);
         return server.delivery.toEvidenceToolResult(result.value, reconstructionContract, recorded);
-    });
+    }));
 };

package/dist/server/registerManagedWorkflowTools/projectManagedApplicationGraph.js

@@ -1,3 +1,4 @@
+import { runAdmittedToolOperation } from "../admittedToolOperation.js";
 import { recordSessionEvidenceSources } from "../sessionEvidence.js";
 import { projectManagedApplicationGraphEvidence } from "../../application/managed/ManagedApplicationGraphService.js";
 import { logToolExecution } from "../toolLogging.js";
@@ -7,7 +8,7 @@ import { resolveManagedArtifactEvidence, resolveManagedBoundaryEvidence, resolve
 const graphContract = managedWorkflowContract("project_managed_application_graph");
 /** Register the managed application graph projection workflow tool. */
 export const registerProjectManagedApplicationGraph = (server, options) => {
-    server.registerTool(graphContract.name, toolRegistrationOptions(graphContract), async (input) => {
+    server.registerTool(graphContract.name, toolRegistrationOptions(graphContract), async (input, context) => runAdmittedToolOperation(server, options.withAdmittedAnalysis, graphContract.name, context.mcpReq.signal, async () => {
         const managedArtifact = input.managed_artifact === undefined
             ? undefined
             : resolveManagedArtifactEvidence(input.managed_artifact);
@@ -36,5 +37,5 @@ export const registerProjectManagedApplicationGraph = (server, options) => {
             return server.delivery.toCallToolResult(recordedSources, graphContract);
         const recorded = options.recordEvidence?.(result.value);
         return server.delivery.toEvidenceToolResult(result.value, graphContract, recorded);
-    });
+    }));
 };

package/dist/server/registerManagedWorkflowTools/verifyManagedNativeBoundaries.js

@@ -1,3 +1,4 @@
+import { runAdmittedToolOperation } from "../admittedToolOperation.js";
 import { recordSessionEvidenceSources } from "../sessionEvidence.js";
 import { verifyManagedNativeBoundariesEvidence } from "../../application/managed/ManagedNativeVerificationService.js";
 import { managedNativeVerificationResultSchema } from "../../domain/managed/managedNativeVerificationSchemas.js";
@@ -8,7 +9,7 @@ import { resolveManagedBoundaryEvidence, resolveNativeEvidence, } from "./eviden
 const nativeVerificationContract = managedWorkflowContract("verify_managed_native_boundaries");
 /** Register the managed/native boundary verification workflow tool. */
 export const registerVerifyManagedNativeBoundaries = (server, options) => {
-    server.registerTool(nativeVerificationContract.name, toolRegistrationOptions(nativeVerificationContract), async (input) => {
+    server.registerTool(nativeVerificationContract.name, toolRegistrationOptions(nativeVerificationContract), async (input, context) => runAdmittedToolOperation(server, options.withAdmittedAnalysis, nativeVerificationContract.name, context.mcpReq.signal, async () => {
         const managedBoundaries = resolveManagedBoundaryEvidence(input.managed_boundaries);
         if (!managedBoundaries.ok)
             return server.delivery.toCallToolResult(managedBoundaries, nativeVerificationContract);
@@ -57,5 +58,5 @@ export const registerVerifyManagedNativeBoundaries = (server, options) => {
             })
             : options.recordEvidence?.(result.value);
         return server.delivery.toEvidenceToolResult(result.value, nativeVerificationContract, output);
-    });
+    }));
 };

package/dist/server/registerPeResourcesTool.js

@@ -0,0 +1,9 @@
+import { toolContract } from "../contracts/toolContracts.js";
+import { createEvidenceToolHandler } from "./contractToolHandler.js";
+import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
+/** Register the explicit-file PE resource workflow and retain its complete Evidence. */
+export const registerPeResourcesTool = (server, service, logger, recordEvidence, withAdmittedAnalysis) => {
+    const contract = toolContract("inspect_pe_resources");
+    const handler = createEvidenceToolHandler(server, (input, options) => service.inspect(input, options), logger, recordEvidence, withAdmittedAnalysis);
+    server.registerTool(contract.name, toolRegistrationOptions(contract), handler(contract));
+};

package/dist/server/registerProcessComparisonTool.js

@@ -13,6 +13,8 @@ import { recordSessionEvidenceSources } from "./sessionEvidence.js";
 import { runDerivedOperation } from "./runDerivedOperation.js";
 import { PROCESS_PROVIDER } from "../domain/process/processEvidenceProvider.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
+import { withAdmittedAnalysis } from "./analysisAdmission.js";
+import { runAdmittedToolOperation } from "./admittedToolOperation.js";
 const PROCESS_CAPTURE_EVIDENCE = {
     operation: "capture_process_scenario",
     predicate: "rea.process-capture",
@@ -57,7 +59,8 @@ const parseCaptureSide = (operation, side, value) => {
 };
 /** Register deterministic process-capture comparison and contradiction tracking. */
 export const registerProcessComparisonTool = (server, session, contract, now = Date.now) => {
-    server.registerTool(contract.name, toolRegistrationOptions(contract), async (input, context) => {
+    const admission = withAdmittedAnalysis({ kind: "session", session });
+    server.registerTool(contract.name, toolRegistrationOptions(contract), async (input, context) => runAdmittedToolOperation(server, admission, contract.name, context.mcpReq.signal, async () => {
         const left = parseCaptureSide(contract.name, "left", input.left);
         if (!left.ok)
             return server.delivery.toCallToolResult(left, contract);
@@ -105,7 +108,7 @@ export const registerProcessComparisonTool = (server, session, contract, now = D
             right_evidence_id: rightRecord.evidence_id,
             comparison_evidence_id: evidence.evidence_id,
         }, comparison)));
-    });
+    }));
 };
 const comparisonUnknownInput = (parsed, comparison) => {
     if (comparison.status === "unchanged")

package/dist/server/registerRecordedCrashTools.js

@@ -1,14 +1,9 @@
 import { toolContract } from "../contracts/toolContracts.js";
-import { logToolExecution } from "./toolLogging.js";
+import { createEvidenceToolHandler } from "./contractToolHandler.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
 /** Bind recorded crash inspection to its named contract and session Evidence owner. */
-export const registerRecordedCrashTools = (server, service, logger, recordEvidence) => {
+export const registerRecordedCrashTools = (server, service, logger, recordEvidence, withAdmittedAnalysis) => {
     const contract = toolContract("inspect_recorded_crash");
-    server.registerTool(contract.name, toolRegistrationOptions(contract), async (input, context) => {
-        const result = await logToolExecution(logger, contract.name, () => service.inspect(input, { signal: context.mcpReq.signal }));
-        if (!result.ok)
-            return server.delivery.toCallToolResult(result, contract);
-        const recorded = recordEvidence?.(result.value);
-        return server.delivery.toEvidenceToolResult(result.value, contract, recorded);
-    });
+    const handler = createEvidenceToolHandler(server, (input, options) => service.inspect(input, options), logger, recordEvidence, withAdmittedAnalysis);
+    server.registerTool(contract.name, toolRegistrationOptions(contract), handler(contract));
 };

package/dist/server/registerSessionRecordTools.js

@@ -1,6 +1,7 @@
 import { readEvidenceBundle, writeEvidenceBundle, } from "../application/EvidenceBundleFiles.js";
 import { toolContract } from "../contracts/toolContracts.js";
 import { ok } from "../domain/result.js";
+import { inspectEvidenceBundle } from "../application/investigation/InspectEvidenceBundle.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
 /** Register evidence bundle import and export tools. */
 export const registerEvidenceTools = (registration) => {
@@ -23,7 +24,7 @@ const registerExportEvidenceTool = ({ server, session, exportContract, }) => {
     });
 };
 const registerSnapshotEvidenceTool = ({ server, session, snapshotContract, }) => {
-    server.registerTool(snapshotContract.name, toolRegistrationOptions(snapshotContract), () => server.delivery.toCallToolResult(ok(bundleForSerialization(session)), snapshotContract));
+    server.registerTool(snapshotContract.name, toolRegistrationOptions(snapshotContract), (input) => server.delivery.toCallToolResult(inspectEvidenceBundle(bundleForSerialization(session), input), snapshotContract));
 };
 const registerImportEvidenceTool = ({ server, session, importContract, }) => {
     server.registerTool(importContract.name, toolRegistrationOptions(importContract), async (input) => {