rea-agents 6.3.0 → 6.5.0

package/dist/ida/IdaProviderCapabilities.js

@@ -1,10 +1,10 @@
-/** This version identifies REA's adapter, not IDA or the upstream Python package. */
+/** This version identifies REA's adapter, not IDA or the upstream MCP server. */
 export const IDA_PROVIDER_IDENTITY = Object.freeze({
     id: "ida",
-    name: "IDA Pro MCP adapter",
+    name: "IDA MCP adapter",
     version: "1",
 });
-/** Read-only analyst outcomes supported by both upstream compatibility profiles. */
+/** Read-only analyst outcomes supported by the upstream compatibility profiles. */
 export const IDA_OPERATIONS = Object.freeze([
     "list_procedures",
     "search_procedures",
@@ -18,7 +18,15 @@ export const IDA_OPERATIONS = Object.freeze([
     "read_function_instructions",
     "xrefs",
     "analyze_function",
+    "resolve_containing_procedure",
+    "list_documents",
 ]);
+/** Operations only the modern headless profile implements. */
+const HEADLESS_ONLY_OPERATIONS = new Set([
+    "resolve_containing_procedure",
+]);
+/** Whether the configured profile admits an operation. */
+export const idaProfileAdmits = (operation, mode) => mode === "headless" || !HEADLESS_ONLY_OPERATIONS.has(operation);
 /** Shared limitations of observations from an externally mutable analysis database. */
 export const IDA_LIMITATIONS = Object.freeze([
     "Provider version identifies the REA IDA adapter. IDA engine and upstream distribution versions are unknown unless separately observed; MCP serverInfo is reported independently.",
@@ -28,25 +36,46 @@ export const IDA_LIMITATIONS = Object.freeze([
     "Headless workers are released through the upstream database lifecycle. Abrupt termination of REA, its proxy, or the supervisor cannot prove worker cleanup; inspect upstream inventory after an interrupted process.",
     "Complete function body ranges, typed references, unresolved indirect calls, referenced data, and basic blocks are unavailable in this adapter. Empty unsupported dossier facets are unknown, not observed absence.",
 ]);
+export const IDA_NATIVE_STRING_LIMITATION = "Native string observations use upstream C-string rendering; other string representations remain unknown.";
+/**
+ * Attached mode requires the legacy 1.4 profile, whose `disassemble_function`
+ * jumps to the function and whose `decompile_function` opens or reuses a
+ * pseudocode view whenever an IDA window is active.
+ */
+const ATTACHED_GUI_NAVIGATION_OPERATIONS = new Set([
+    "procedure_pseudo_code",
+    "procedure_assembly",
+    "read_function_instructions",
+    "analyze_function",
+]);
 /** Advertise live observations and configured lifecycle effects truthfully. */
-export const idaCapabilities = (mode, stdio) => IDA_OPERATIONS.map((operation) => ({
+export const idaCapabilities = (mode, stdio, native = false) => IDA_OPERATIONS.filter((operation) => idaProfileAdmits(operation, mode)).map((operation) => ({
     provider: IDA_PROVIDER_IDENTITY,
     operation,
-    ...(mode === "headless" && operation === "procedure_callers"
+    ...((mode === "headless" || native) && operation === "procedure_callers"
         ? {
             available: false,
-            reason: "The modern upstream profile reports code references without proving direct call edges.",
+            reason: native
+                ? "The native upstream profile reports code references without proving direct call edges."
+                : "The modern upstream profile reports code references without proving direct call edges.",
         }
         : { available: true, reason: null }),
     cachePolicy: "live",
     effects: {
         mutatesArtifact: false,
         launchesProcess: stdio || mode === "headless",
-        mayShowUi: false,
+        mayShowUi: mode === "attached" &&
+            (native
+                ? operation === "procedure_pseudo_code" ||
+                    operation === "analyze_function"
+                : ATTACHED_GUI_NAVIGATION_OPERATIONS.has(operation)),
         mayAccessNetwork: true,
         mayWriteFilesystem: stdio || mode === "headless",
         changesPermissions: false,
         requiresRoot: false,
     },
-    limitations: IDA_LIMITATIONS,
+    limitations: native &&
+        (operation === "list_strings" || operation === "search_strings")
+        ? [...IDA_LIMITATIONS, IDA_NATIVE_STRING_LIMITATION]
+        : IDA_LIMITATIONS,
 }));

package/dist/ida/IdaSessionClient.js

@@ -1,15 +1,21 @@
 import { z } from "zod";
+import { ABORTED, waitForAbortable } from "../process/AbortablePromise.js";
 import { createAnalysisExecution, } from "../application/AnalysisProvider.js";
 import { AnalysisCancelledError, AnalysisCapabilityUnavailableError, AnalysisProtocolError, AnalysisOutputError, AnalysisInputError, } from "../domain/analysisErrorCore.js";
 import { AnalysisError } from "../domain/analysisErrorBase.js";
 import { ProviderAdapterError } from "../domain/providerAdapterError.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";
 import { err, ok } from "../domain/result.js";
+import { idaProtocol } from "./IdaConfiguration.js";
+import { nativeTools } from "./IdaNativeProtocol.js";
+import { readSettledHealth } from "./IdaBusyHealth.js";
+import { isX86OnlyTarget } from "./IdaCallGraph.js";
 import { IdaOperationRunner } from "./IdaOperationRunner.js";
-import { IDA_LIMITATIONS, IDA_OPERATIONS, IDA_PROVIDER_IDENTITY, } from "./IdaProviderCapabilities.js";
-import { closeDatabaseSchema, databaseListSchema, legacyMetadataSchema, modernHealthSchema, openDatabaseSchema, } from "./IdaProtocolValues.js";
+import { IDA_LIMITATIONS, IDA_OPERATIONS, IDA_PROVIDER_IDENTITY, idaProfileAdmits, } from "./IdaProviderCapabilities.js";
+import { absentDatabaseCloseSchema, closeDatabaseSchema, databaseListSchema, legacyMetadataSchema, modernHealthSchema, openDatabaseSchema, rejectedOpenDatabaseSchema, } from "./IdaProtocolValues.js";
 import { idaFileDigest, IdaWorkspace, sameIdaHostPath, } from "./IdaWorkspace.js";
 import { parseIdaInput } from "./IdaInput.js";
+import { createEvidence } from "../domain/evidence.js";
 const legacyTools = [
     "get_metadata",
     "list_functions",
@@ -42,13 +48,34 @@ const wasCancelled = (options) => options?.signal?.aborted === true;
 class IdaCleanupError extends ProviderAdapterError {
     cleanupIncomplete = true;
     cleanupResources;
-    constructor(path, cause) {
+    constructor(path, cause, sessions) {
         super("ida", "close", {
             cause,
+            capturedOutput: cause instanceof AnalysisError ? cause.capturedOutput : undefined,
             diagnostics: {
+                ...(cause instanceof AnalysisError ? cause.diagnostics : undefined),
                 reason: "IDA cleanup could not be verified; the remaining connection or private workspace is retained for retry.",
-                failure_reason: cause instanceof Error ? cause.message : String(cause),
+                failure_reason: cause instanceof AnalysisError
+                    ? (cause.diagnostics?.reason ?? cause.message)
+                    : cause instanceof Error
+                        ? cause.message
+                        : String(cause),
                 workspace: path,
+                ...(sessions === undefined
+                    ? {}
+                    : {
+                        upstream_sessions: {
+                            state: "unverified",
+                            sessions: sessions.map(({ session_id, backend, owned, input_path, is_active }) => ({
+                                session_id,
+                                backend,
+                                owned,
+                                input_path,
+                                is_active,
+                            })),
+                            reason: "Release of upstream sessions matching the requested session ID or private input was not confirmed; input_path preserves the last observed binding and is null when no inventory has reported it. is_active preserves registry activity and is null when unknown; it does not establish process liveness. A worker outlives its supervisor and may keep running until it finishes and reaches its idle timeout; exiting REA does not stop it. A gui session belongs to an IDA instance REA does not control. An empty session_id means upstream reported none; owned is null when no inventory has reported ownership; an empty list means the requested worker's close was confirmed but no inventory has identified any remaining session.",
+                        },
+                    }),
             },
         });
         this.cleanupResources = [path];
@@ -67,9 +94,14 @@ export class IdaSessionClient {
     #closePromise;
     #workspace;
     #database;
-    #databaseCloseAcknowledged = false;
+    #databaseCloseCompleted = false;
     #openAttempted = false;
     #openCompleted = false;
+    #ready = false;
+    #blockingSessions;
+    #openRejected = false;
+    #callGraphAdvertised = false;
+    #surveyAdvertised = false;
     #initialIdentity;
     #metadata = null;
     #lifecycle = [];
@@ -84,15 +116,35 @@ export class IdaSessionClient {
         this.#tail = call.then(() => undefined, () => undefined);
         return call;
     }
-    async #execute(operation, parameters, options) {
+    async executeIfReady(operation, parameters, options) {
+        if (!this.#ready || this.#closed || this.#closing)
+            return Promise.resolve(undefined);
+        const call = this.#tail.then(() => {
+            if (!this.#ready || this.#closed || this.#closing)
+                return undefined;
+            if (wasCancelled(options))
+                return err(new AnalysisCancelledError(operation));
+            return this.#execute(operation, parameters, options, true);
+        });
+        this.#tail = call.then(() => undefined, () => undefined);
+        const result = await waitForAbortable(call, options?.signal);
+        return result === ABORTED
+            ? err(new AnalysisCancelledError(operation))
+            : result;
+    }
+    async #execute(operation, parameters, options, readyOnly = false) {
         if (this.#closed || this.#closing)
             return err(new AnalysisProtocolError("IDA session is closing or closed; reopen the target."));
         if (wasCancelled(options))
             return err(new AnalysisCancelledError(operation));
         if (operation !== "health" && !isIdaOperation(operation))
             return err(new AnalysisCapabilityUnavailableError("ida", operation, "This integration admits read-only analysis operations only."));
-        if (operation === "procedure_callers" && this.config.mode === "headless")
-            return err(new AnalysisCapabilityUnavailableError("ida", operation, "The modern upstream profile does not prove direct callers."));
+        if (operation !== "health" &&
+            !idaProfileAdmits(operation, this.config.mode))
+            return err(new AnalysisCapabilityUnavailableError("ida", operation, "This operation is available for the modern headless profile only."));
+        if (operation === "procedure_callers" &&
+            idaProtocol(this.config) !== "legacy")
+            return err(new AnalysisCapabilityUnavailableError("ida", operation, "This upstream profile does not prove direct callers."));
         if (operation !== "health") {
             const parsed = parseIdaInput(operation, parameters);
             if (!parsed.ok)
@@ -113,20 +165,34 @@ export class IdaSessionClient {
                     message: "IDA document must be the REA-bound target; omit document or use its admitted path.",
                 },
             ]));
+        const failureContext = {
+            runner: undefined,
+            metadataBefore: undefined,
+            metadataAfter: undefined,
+            postOperationIdentityCheck: "not_attempted",
+            parameters,
+        };
         try {
-            await this.#start();
-            const before = await this.#observe();
+            if (!readyOnly)
+                await this.#start();
+            const before = await this.#observe(options);
+            failureContext.metadataBefore = before;
             if (wasCancelled(options))
-                return err(new AnalysisCancelledError(operation));
+                throw new AnalysisCancelledError(operation);
             if (operation === "health")
                 return this.#health(before);
             if (!isIdaOperation(operation))
                 throw new AnalysisProtocolError("IDA operation changed after validation.");
-            const runner = new IdaOperationRunner(this.connection, this.config.mode === "attached" ? "legacy" : "modern", this.#database);
+            const runner = this.#runner(options);
+            failureContext.runner = runner;
             const result = await runner.run(operation, parameters);
-            const after = await this.#observe();
             if (wasCancelled(options))
-                return err(new AnalysisCancelledError(operation));
+                throw new AnalysisCancelledError(operation);
+            failureContext.postOperationIdentityCheck = "started";
+            const after = await this.#observe(options, (observed) => (failureContext.metadataAfter = observed));
+            failureContext.postOperationIdentityCheck = "verified";
+            if (wasCancelled(options))
+                throw new AnalysisCancelledError(operation);
             return ok(createAnalysisExecution(result, IDA_PROVIDER_IDENTITY, {
                 rawResult: {
                     upstream: this.connection.serverInfo(),
@@ -135,6 +201,12 @@ export class IdaSessionClient {
                     observations: jsonValueSchema.parse(runner.raw),
                 },
                 limitations: [...IDA_LIMITATIONS, ...runner.limitations],
+                ...(runner.relationshipCoverage === undefined
+                    ? {}
+                    : { relationshipCoverage: runner.relationshipCoverage }),
+                ...(runner.referencesTruncated !== undefined
+                    ? { referencesTruncated: runner.referencesTruncated }
+                    : {}),
                 locations: [
                     { kind: "artifact-path", path: this.target.path },
                     ...runner.locations,
@@ -145,9 +217,19 @@ export class IdaSessionClient {
             }));
         }
         catch (cause) {
-            return this.#failure(operation, cause, options);
+            return this.#failure(operation, cause, options, failureContext);
         }
     }
+    #runner(options) {
+        return new IdaOperationRunner(this.connection, idaProtocol(this.config), this.#database, {
+            signal: options?.signal,
+            selectorOrigin: options?.selectorOrigin,
+            x86Only: isX86OnlyTarget(this.target),
+            callGraphAvailable: this.#callGraphAdvertised,
+            surveyAvailable: this.#surveyAdvertised,
+            admittedDocument: this.target.path,
+        });
+    }
     #health(metadata) {
         return ok(createAnalysisExecution({
             ready: true,
@@ -163,20 +245,110 @@ export class IdaSessionClient {
                 : { analysisProfile: this.profile }),
         }));
     }
-    #failure(operation, cause, options) {
+    #failure(operation, cause, options, context) {
+        let failure;
         if (wasCancelled(options))
-            return err(new AnalysisCancelledError(operation));
-        if (cause instanceof AnalysisError)
-            return err(cause);
-        if (cause instanceof z.ZodError)
-            return err(new AnalysisOutputError(operation, `IDA MCP returned malformed or unsupported producer data: ${cause.issues.map((issue) => `${issue.path.join(".") || "$"}: ${issue.message}`).join("; ")}`, { cause }));
-        return err(new ProviderAdapterError("ida", operation, {
-            cause,
-            diagnostics: {
-                reason: cause instanceof Error ? cause.message : "Unknown upstream failure",
-                recovery: "Check the configured upstream MCP registration and selected target; see docs/ida-provider.md.",
-            },
-        }));
+            failure = new AnalysisCancelledError(operation, {
+                cause,
+                ...(cause instanceof AnalysisError
+                    ? {
+                        capturedOutput: cause.capturedOutput,
+                        diagnostics: cause.diagnostics,
+                        partialObservation: cause.partialObservation,
+                        cleanup: cause.cleanup ??
+                            (cause.cleanupIncomplete
+                                ? {
+                                    reason: cause.message,
+                                    resources: cause.cleanupResources,
+                                }
+                                : undefined),
+                    }
+                    : {}),
+            });
+        else if (cause instanceof ProviderAdapterError &&
+            cause.operation === "transport")
+            failure = new ProviderAdapterError("ida", operation, {
+                cause,
+                capturedOutput: cause.capturedOutput,
+                partialObservation: cause.partialObservation,
+                cleanup: cause.cleanup,
+                diagnostics: {
+                    ...cause.diagnostics,
+                    recovery: "Check the configured upstream MCP registration and selected target; see docs/ida-provider.md.",
+                },
+            });
+        else if (cause instanceof AnalysisError &&
+            (cause.partialObservation !== undefined ||
+                cause.cleanupIncomplete ||
+                cause.capturedOutput !== undefined))
+            failure = cause;
+        else if (cause instanceof AnalysisError)
+            failure = cause;
+        else if (cause instanceof z.ZodError)
+            failure = new AnalysisOutputError(operation, `IDA MCP returned malformed or unsupported producer data: ${cause.issues.map((issue) => `${issue.path.join(".") || "$"}: ${issue.message}`).join("; ")}`, { cause });
+        else
+            failure = new ProviderAdapterError("ida", operation, {
+                cause,
+                diagnostics: {
+                    reason: cause instanceof Error ? cause.message : "Unknown upstream failure",
+                    recovery: "Check the configured upstream MCP registration and selected target; see docs/ida-provider.md.",
+                },
+            });
+        // Only operation calls made after target identity/readiness validation can
+        // become partial Evidence. The failing call itself is absent from `raw`
+        // when its transport or MCP envelope could not be decoded.
+        const { runner, metadataBefore, metadataAfter } = context;
+        if (runner !== undefined &&
+            runner.raw.length > 0 &&
+            metadataBefore !== undefined) {
+            const observations = jsonValueSchema.parse(runner.raw);
+            const upstream = this.connection.serverInfo();
+            const binding = context.postOperationIdentityCheck !== "verified"
+                ? {
+                    status: "not_verified",
+                    reason: cause instanceof Error
+                        ? cause.message
+                        : "Post-operation target identity was not observed.",
+                }
+                : { status: "verified" };
+            failure.retainPartialObservation(createEvidence(this.target, IDA_PROVIDER_IDENTITY, {
+                predicateType: "analysis-observation",
+                operation,
+                parameters: context.parameters,
+                result: {
+                    status: "partial",
+                    failed_operation: operation,
+                    observations,
+                    metadata_before: metadataBefore,
+                    target_binding: binding,
+                    ...(metadataAfter === undefined
+                        ? {}
+                        : { metadata_after: metadataAfter }),
+                },
+                rawResult: {
+                    upstream,
+                    observations,
+                    metadata_before: metadataBefore,
+                    ...(metadataAfter === undefined
+                        ? {}
+                        : { metadata_after: metadataAfter }),
+                    post_operation_identity_check: context.postOperationIdentityCheck,
+                },
+                confidence: "observed",
+                authority: "external-service",
+                limitations: [
+                    ...IDA_LIMITATIONS,
+                    ...runner.limitations,
+                    "The requested IDA operation failed after these completed upstream replies; the partial Evidence does not establish a complete result.",
+                    "Replies are bound to the selected target only by the pre-operation identity check unless post_operation_identity_check is verified.",
+                ],
+                locations: [
+                    { kind: "artifact-path", path: this.target.path },
+                    ...runner.locations,
+                ],
+            }));
+        }
+        return err(failure);
     }
     #start() {
         this.#startup ??= this.#initialize();
@@ -184,10 +356,33 @@ export class IdaSessionClient {
     }
     async #initialize() {
         const tools = new Set(await this.connection.connect());
-        const expected = this.config.mode === "attached" ? legacyTools : modernTools;
+        this.#callGraphAdvertised = tools.has("callgraph");
+        this.#surveyAdvertised = tools.has("survey_binary");
+        const expected = this.config.protocol === "native"
+            ? nativeTools
+            : this.config.mode === "attached"
+                ? legacyTools
+                : modernTools;
         const missing = expected.filter((name) => !tools.has(name));
-        if (missing.length > 0)
-            throw new AnalysisProtocolError(`IDA MCP ${this.config.mode} compatibility profile is missing tools: ${missing.join(", ")}. Attached mode requires the legacy 1.4 profile; headless mode requires the database supervisor profile. See docs/ida-provider.md.`);
+        if (missing.length > 0) {
+            const summary = `IDA MCP ${this.config.protocol === "native" ? "native attached" : this.config.mode} compatibility profile is missing tools: ${missing.join(", ")}. Native attached mode requires the native IDA MCP tool catalog; legacy attached mode requires the legacy 1.4 profile; headless mode requires the database supervisor profile. See docs/ida-provider.md.`;
+            // The caller cannot act on a profile mismatch it never sees, so the
+            // missing names travel as adapter diagnostics rather than a bare message.
+            throw new ProviderAdapterError("ida", "initialize", {
+                userMessage: summary,
+                diagnostics: {
+                    reason: summary,
+                    mode: this.config.mode,
+                    expected_profile: this.config.protocol === "native"
+                        ? "native"
+                        : this.config.mode === "attached"
+                            ? "legacy-1.4"
+                            : "database-supervisor",
+                    missing_tools: [...missing],
+                    recovery: "Install an IDA MCP build that serves the selected profile; see docs/ida-provider.md.",
+                },
+            });
+        }
         if (this.config.mode === "headless") {
             this.#workspace = await IdaWorkspace.allocate(this.target, this.config.workspaceRoot);
             await this.#workspace.copyInput();
@@ -201,6 +396,9 @@ export class IdaSessionClient {
                 preferred_session_id: this.#workspace.sessionId,
             });
             this.#openCompleted = true;
+            // A completed but malformed/positive open may still own a live Worker.
+            // Only an explicit producer rejection keeps the old no-worker branch.
+            this.#openRejected = rejectedOpenDatabaseSchema.safeParse(raw).success;
             this.#lifecycle.push(raw);
             const opened = openDatabaseSchema.parse(raw);
             if (!sameIdaHostPath(opened.session.input_path, this.#workspace.inputPath))
@@ -209,6 +407,9 @@ export class IdaSessionClient {
                 throw new AnalysisProtocolError("IDA returned an adopted or unexpected session instead of the requested private worker.");
             const inventory = databaseListSchema.parse(await this.connection.call("idb_list", {}));
             this.#lifecycle.push(jsonValueSchema.parse(inventory));
+            const workspace = this.#workspace;
+            this.#recordBlockingSessions(inventory.sessions.filter((entry) => entry.session_id === workspace.sessionId ||
+                sameIdaHostPath(entry.input_path, workspace.inputPath)));
             const entry = inventory.sessions.find(({ session_id }) => session_id === opened.session.session_id);
             if (entry?.owned !== true ||
                 entry.backend !== "worker" ||
@@ -217,12 +418,22 @@ export class IdaSessionClient {
                 throw new AnalysisProtocolError("IDA did not return an active owned headless worker for the private input copy.");
             this.#database = opened.session.session_id;
         }
+        this.#ready = true;
+    }
+    async #nativeMetadata() {
+        if (this.connection.readResource === undefined)
+            throw new AnalysisProtocolError("Native IDA MCP requires resources/read for recorded input metadata.");
+        return this.connection.readResource("ida://idb/metadata");
     }
-    async #observe() {
+    async #observe(options, onObserved) {
         let identity;
         if (this.config.mode === "attached") {
-            const raw = await this.connection.call("get_metadata", {});
+            const raw = this.config.protocol === "native"
+                ? await this.#nativeMetadata()
+                : await this.connection.call("get_metadata", {});
             const metadata = legacyMetadataSchema.parse(raw);
+            this.#metadata = raw;
+            onObserved?.(raw);
             if (metadata.sha256.toLowerCase() !== this.target.sha256.toLowerCase())
                 throw new AnalysisProtocolError(`The attached IDA input SHA-256 does not match the selected target ${this.target.path}; open that target in IDA or use headless mode.`);
             identity = JSON.stringify([
@@ -230,17 +441,21 @@ export class IdaSessionClient {
                 metadata.sha256.toLowerCase(),
                 metadata.base,
             ]);
-            this.#metadata = raw;
         }
         else {
             if (this.#database === undefined || this.#workspace === undefined)
                 throw new AnalysisProtocolError("IDA headless session has no database binding.");
-            const raw = await this.connection.call("server_health", {
+            const raw = await readSettledHealth(this.connection, {
                 database: this.#database,
+                timeoutMs: this.config.timeoutMs,
+                signal: options?.signal,
             });
             const metadata = modernHealthSchema.parse(raw);
+            this.#metadata = raw;
+            onObserved?.(raw);
             if (!sameIdaHostPath(metadata.input_path, this.#workspace.inputPath) ||
-                (await idaFileDigest(this.#workspace.inputPath)) !== this.target.sha256)
+                (await idaFileDigest(this.#workspace.inputPath)) !==
+                    this.#workspace.inputSha256)
                 throw new AnalysisProtocolError("IDA headless input identity changed after target admission.");
             if (metadata.auto_analysis_ready !== true)
                 throw new AnalysisProtocolError("IDA auto-analysis is incomplete or readiness is unknown; retry after analysis completes.");
@@ -250,7 +465,6 @@ export class IdaSessionClient {
                 metadata.idb_path,
                 metadata.imagebase,
             ]);
-            this.#metadata = raw;
         }
         if (this.#initialIdentity !== undefined &&
             identity !== this.#initialIdentity)
@@ -269,6 +483,68 @@ export class IdaSessionClient {
         this.#closePromise = shared;
         return shared;
     }
+    /**
+     * Upstream sessions whose release cleanup has not confirmed: the entries
+     * the latest successful inventory found blocking release; else the
+     * requested private worker until its close is confirmed, and then none
+     * known.
+     */
+    #unreleasedSessions() {
+        if (this.#blockingSessions !== undefined)
+            return this.#blockingSessions;
+        if (!this.#openAttempted ||
+            this.#workspace === undefined ||
+            this.#openRejected)
+            return undefined;
+        return this.#databaseCloseCompleted
+            ? []
+            : [
+                {
+                    session_id: this.#workspace.sessionId,
+                    backend: "worker",
+                    owned: null,
+                    input_path: null,
+                    is_active: null,
+                },
+            ];
+    }
+    /** Drop a session whose release upstream confirmed, keeping other blockers. */
+    #forgetReleasedSession(sessionId) {
+        const remaining = this.#blockingSessions?.filter(({ session_id }) => session_id !== sessionId);
+        this.#blockingSessions =
+            remaining !== undefined && remaining.length > 0 ? remaining : undefined;
+    }
+    /** Replace blocker evidence from a successful inventory; true when blocked. */
+    #recordBlockingSessions(entries) {
+        this.#blockingSessions =
+            entries.length > 0
+                ? entries.map(({ session_id, backend, owned, input_path, is_active }) => ({
+                    session_id,
+                    backend,
+                    owned,
+                    input_path,
+                    is_active,
+                }))
+                : undefined;
+        return entries.length > 0;
+    }
+    async #closeDatabase(database) {
+        const response = await this.connection.call("idb_close", {
+            database,
+            save: false,
+        });
+        const closed = closeDatabaseSchema.safeParse(response);
+        if (!closed.success) {
+            if (!absentDatabaseCloseSchema(database).safeParse(response).success)
+                throw closed.error;
+            return;
+        }
+        if (closed.data.session_id !== database ||
+            closed.data.saved === true ||
+            closed.data.owned !== true ||
+            closed.data.backend !== "worker")
+            throw new AnalysisProtocolError("IDA database close did not confirm the requested owned, unsaved session release.");
+    }
     async #closeOnce() {
         this.#closing = true;
         await this.#tail;
@@ -283,26 +559,28 @@ export class IdaSessionClient {
                         entry.backend === "worker" &&
                         entry.session_id === workspace.sessionId &&
                         sameIdaHostPath(entry.input_path, workspace.inputPath))?.session_id;
+                    // Every same-input session and any entry under the requested ID,
+                    // whatever its input, stays reported until a later successful
+                    // inventory confirms release.
+                    const blocked = this.#recordBlockingSessions(inventory.sessions.filter((entry) => entry.session_id === workspace.sessionId ||
+                        sameIdaHostPath(entry.input_path, workspace.inputPath)));
+                    if (this.#database === undefined && blocked)
+                        throw new AnalysisProtocolError("A registered session still matches the requested ID or private input without a verified private worker binding; the workspace was retained.");
                     if (this.#database === undefined &&
-                        inventory.sessions.some((entry) => sameIdaHostPath(entry.input_path, workspace.inputPath)))
-                        throw new AnalysisProtocolError("An unowned worker still uses the private workspace; it was retained.");
+                        this.#openCompleted &&
+                        !this.#openRejected)
+                        throw new AnalysisProtocolError("IDA open returned without a verified private worker binding. An empty session inventory does not prove that its Worker exited; the private workspace was retained.");
                 }
                 if (this.#database !== undefined) {
-                    if (!this.#databaseCloseAcknowledged) {
-                        const closed = closeDatabaseSchema.parse(await this.connection.call("idb_close", {
-                            database: this.#database,
-                            save: false,
-                        }));
-                        if (closed.session_id !== this.#database ||
-                            closed.saved === true ||
-                            closed.owned !== true ||
-                            closed.backend !== "worker")
-                            throw new AnalysisProtocolError("IDA database close did not confirm the requested owned, unsaved session release.");
-                        this.#databaseCloseAcknowledged = true;
+                    if (!this.#databaseCloseCompleted) {
+                        await this.#closeDatabase(this.#database);
+                        this.#databaseCloseCompleted = true;
+                        this.#forgetReleasedSession(this.#database);
                     }
                     const inventory = databaseListSchema.parse(await this.connection.call("idb_list", {}));
-                    if (inventory.sessions.some((entry) => entry.session_id === this.#database ||
-                        sameIdaHostPath(entry.input_path, this.#workspace?.inputPath ?? "")))
+                    const remaining = inventory.sessions.filter((entry) => entry.session_id === this.#database ||
+                        sameIdaHostPath(entry.input_path, this.#workspace?.inputPath ?? ""));
+                    if (this.#recordBlockingSessions(remaining))
                         throw new AnalysisProtocolError("IDA worker remains registered after close.");
                     this.#database = undefined;
                 }
@@ -316,7 +594,8 @@ export class IdaSessionClient {
             return ok(null);
         }
         catch (cause) {
-            return err(new IdaCleanupError(this.#workspace?.directory ?? "IDA MCP connection", cause));
+            this.connection.detach();
+            return err(new IdaCleanupError(this.#workspace?.directory ?? "IDA MCP connection", cause, this.#unreleasedSessions()));
         }
     }
 }