rea-agents 6.3.0 → 6.5.0

package/dist/application/Update.js

@@ -1,30 +1,30 @@
 import { gt, valid } from "semver";
 import { PRODUCT_IDENTITY } from "../identity.js";
-/** Whether the update command left the requested release unapplied. */
-export const isUpdateFailure = (result) => {
-    const status = result.status;
-    switch (status) {
-        case "current":
-        case "updated":
-            return false;
-        case "failed":
-            return true;
+export { isUpdateFailure } from "./UpdateFailure.js";
+/** Resolve the exact package-manager command for the identified installation and release. */
+export const updateInstallCommand = (installation, version) => {
+    const release = `${PRODUCT_IDENTITY.packageName}@${version}`;
+    const manager = installation.manager;
+    switch (manager) {
+        case "npm":
+            return [
+                "npm",
+                "install",
+                "--global",
+                "--ignore-scripts",
+                "--prefix",
+                installation.prefix,
+                release,
+            ];
+        case "bun":
+            // The host pins Bun's global directory and working directory for this command.
+            return ["bun", "add", "--global", "--ignore-scripts", release];
         default: {
-            const exhaustive = status;
-            throw new TypeError(`Unhandled update result status: ${String(exhaustive)}`);
+            const exhaustive = manager;
+            throw new TypeError(`Unhandled installation manager: ${String(exhaustive)}`);
         }
     }
 };
-/** Resolve the exact npm command for the identified prefix and release. */
-export const updateInstallCommand = (installation, version) => [
-    "npm",
-    "install",
-    "--global",
-    "--ignore-scripts",
-    "--prefix",
-    installation.prefix,
-    `${PRODUCT_IDENTITY.packageName}@${version}`,
-];
 const versionCheckRemediation = (release) => {
     if (release.ok) {
         return "REA received invalid version metadata. Check the installed version and npm registry, then rerun rea update.";
@@ -32,6 +32,8 @@ const versionCheckRemediation = (release) => {
     const failure = release.error;
     const kind = failure.kind;
     switch (kind) {
+        case "unsupported-package-manager":
+            return failure.detail;
         case "unavailable":
             return `REA could not resolve the latest release: ${failure.detail}. Retry rea update when registry access is available.`;
         case "invalid-metadata":
@@ -44,6 +46,33 @@ const versionCheckRemediation = (release) => {
 };
 /** Identify, resolve, install, and verify REA without applying setup changes. */
 export const runUpdate = async (currentVersion, host, output = "human") => {
+    let result;
+    let primaryFailure;
+    let failed = false;
+    try {
+        result = await runUpdateWorkflow(currentVersion, host, output);
+    }
+    catch (cause) {
+        failed = true;
+        primaryFailure = cause;
+    }
+    let cleanupFailure;
+    try {
+        cleanupFailure = await host.close?.();
+    }
+    catch (cause) {
+        cleanupFailure = `Update resource cleanup failed: ${cause instanceof Error ? cause.message : String(cause)}`;
+    }
+    if (failed) {
+        if (cleanupFailure !== undefined)
+            throw new AggregateError([primaryFailure, new Error(cleanupFailure)], "Update failed and its resource cleanup remains incomplete.", { cause: primaryFailure });
+        throw primaryFailure;
+    }
+    if (result === undefined)
+        throw new Error("Update result was not produced.");
+    return cleanupFailure === undefined ? result : { ...result, cleanupFailure };
+};
+const runUpdateWorkflow = async (currentVersion, host, output) => {
     const installation = await host.installation();
     const release = await host.latestVersion(installation);
     const latestVersion = release.ok ? release.value : null;
@@ -61,7 +90,7 @@ export const runUpdate = async (currentVersion, host, output = "human") => {
             status: "current",
             currentVersion,
             latestVersion: targetVersion,
-            installMethod: installation === undefined ? "unknown" : "npm",
+            installMethod: installation?.manager ?? "unknown",
         };
     if (installation === undefined)
         return {
@@ -78,7 +107,7 @@ export const runUpdate = async (currentVersion, host, output = "human") => {
             currentVersion,
             latestVersion: targetVersion,
             reason: "install",
-            remediation: `REA could not install ${targetVersion} in ${installation.prefix}: ${installed.error}. Repair this npm installation, then rerun rea update.`,
+            remediation: `REA could not install ${targetVersion} in ${installation.manager === "npm" ? installation.prefix : installation.globalDirectory}: ${installed.error}. Repair this ${installation.manager} installation, then rerun rea update.`,
         };
     const verified = await host.installedVersion(installation);
     if (!verified.ok || verified.value !== targetVersion)
@@ -88,7 +117,7 @@ export const runUpdate = async (currentVersion, host, output = "human") => {
             latestVersion: targetVersion,
             reason: "verification",
             ...(verified.ok ? { installedVersion: verified.value } : {}),
-            remediation: `npm completed, but REA could not verify ${targetVersion} in ${installation.packageRoot}: ${verified.ok ? `the executable reported ${verified.value}` : verified.error}. The installation may have changed; repair it before retrying.`,
+            remediation: `${installation.manager} completed, but REA could not verify ${targetVersion} in ${installation.packageRoot}: ${verified.ok ? `the executable reported ${verified.value}` : verified.error}. The installation may have changed; repair it before retrying.`,
         };
     const maintenance = await host.planMaintenance(installation);
     return {
@@ -96,7 +125,7 @@ export const runUpdate = async (currentVersion, host, output = "human") => {
         previousVersion: currentVersion,
         latestVersion: targetVersion,
         installedVersion: verified.value,
-        installMethod: "npm",
+        installMethod: installation.manager,
         command: updateInstallCommand(installation, targetVersion),
         maintenance,
         remediation: maintenance.status === "planned"

package/dist/application/UpdateFailure.js

@@ -0,0 +1,17 @@
+/** Whether the update command left the requested release unapplied. */
+export const isUpdateFailure = (result) => {
+    if (result.cleanupFailure !== undefined)
+        return true;
+    const status = result.status;
+    switch (status) {
+        case "current":
+        case "updated":
+            return false;
+        case "failed":
+            return true;
+        default: {
+            const exhaustive = status;
+            throw new TypeError(`Unhandled update result status: ${String(exhaustive)}`);
+        }
+    }
+};

package/dist/application/UpdateMaintenance.js

@@ -1,11 +1,7 @@
-import { readFile } from "node:fs/promises";
-import { join } from "node:path";
 import { z } from "zod";
-import { PRODUCT_IDENTITY } from "../identity.js";
 import { isOwnedClientRegistrationCommand } from "./ClientRegistrationIdentity.js";
-import { readClientRegistrationStatuses } from "./ClientRegistrationStatus.js";
-import { clientServerForcedEnabled, clientServerListedDisabled, effectiveClientServer, parseClientConfiguration, } from "./ClientConfigurationDocument.js";
-import { supportedClients } from "./SupportedClients.js";
+import { readClientRegistrationInspections } from "./ClientRegistrationStatus.js";
+import { existingSkillDestinations } from "./SetupSkill.js";
 const setupPlanSchema = z.object({
     status: z.literal("planned"),
     plannedActions: z.array(z.object({
@@ -20,51 +16,32 @@ const setupPlanSchema = z.object({
         commands: z.array(z.string()).optional(),
     })),
 });
-/** Discover owned registrations and an existing REA skill without writes. */
-export const existingMaintenanceScope = async (home, entryPoint, environment) => {
-    const registrations = await readClientRegistrationStatuses(home, entryPoint, {
+/** Discover owned registrations and REA skills without writes. */
+export const existingMaintenanceScope = async (home, entryPoint, environment, resources) => {
+    const registrations = await readClientRegistrationInspections(home, entryPoint, {
         environment,
+        ...(resources === undefined ? {} : { resources }),
     });
-    const supported = supportedClients(home, process.platform, environment);
     const clients = [];
-    for (const registration of registrations) {
-        if ((registration.state !== "aligned" && registration.state !== "stale") ||
+    for (const { status: registration, activation } of registrations) {
+        if (activation !== "enabled" ||
+            (registration.state !== "aligned" && registration.state !== "stale") ||
             !isOwnedClientRegistrationCommand(registration.command, entryPoint))
             continue;
-        const client = supported.find(({ name }) => name === registration.client);
-        if (client === undefined)
-            continue;
-        const parsed = parseClientConfiguration(await readFile(client.configPath, "utf8"), client.format);
-        const enabled = z
-            .object({
-            enabled: z.boolean().optional(),
-            disabled: z.boolean().optional(),
-        })
-            .parse(effectiveClientServer(parsed, PRODUCT_IDENTITY.mcpServerKey));
-        // Root disable lists override enabled entries and OMP's force-on allowlist.
-        if ((enabled.enabled !== false ||
-            clientServerForcedEnabled(parsed, PRODUCT_IDENTITY.mcpServerKey)) &&
-            enabled.disabled !== true &&
-            !clientServerListedDisabled(parsed, PRODUCT_IDENTITY.mcpServerKey))
-            clients.push(client.name);
-    }
-    let skill = false;
-    try {
-        const content = await readFile(join(home, ".agents", "skills", PRODUCT_IDENTITY.skillName, "SKILL.md"), "utf8");
-        skill =
-            content.startsWith(`---\nname: ${PRODUCT_IDENTITY.skillName}\n`) ||
-                content.startsWith(`---\r\nname: ${PRODUCT_IDENTITY.skillName}\r\n`);
-    }
-    catch (cause) {
-        if (!(cause instanceof Error && "code" in cause && cause.code === "ENOENT"))
-            throw cause;
+        clients.push(registration.client);
     }
-    return { clients, skill };
+    const skillDestinations = await existingSkillDestinations(home, environment, process.platform, resources);
+    return {
+        clients,
+        skill: skillDestinations.length > 0,
+        skillDestinations,
+    };
 };
 /** Ask the verified new executable to plan only existing REA integrations. */
-export const planIntegrationMaintenance = async (home, entryPoint, environment, execute) => {
+export const planIntegrationMaintenance = async (home, entryPoint, environment, execute, resources) => {
     try {
-        const scope = await existingMaintenanceScope(home, entryPoint, environment);
+        const scope = await existingMaintenanceScope(home, entryPoint, environment, resources);
+        const skillDestinations = scope.skillDestinations ?? [];
         if (scope.clients.length === 0 && !scope.skill)
             return { status: "current", plannedActions: [] };
         const command = [
@@ -72,6 +49,7 @@ export const planIntegrationMaintenance = async (home, entryPoint, environment,
             entryPoint,
             "setup",
             ...scope.clients.flatMap((client) => ["--client", client]),
+            ...skillDestinations.flatMap(({ client }) => ["--skill-client", client]),
             `--skill=${String(scope.skill)}`,
         ];
         const execution = await execute([...command, "--dry-run", "--json"]);
@@ -85,11 +63,11 @@ export const planIntegrationMaintenance = async (home, entryPoint, environment,
             };
         if (plan.data.plannedActions.length === 0)
             return { status: "current", plannedActions: [] };
-        const allowedIds = new Set([
-            ...scope.clients.map((client) => `configure_client:${client}`),
-            ...(scope.skill ? ["install_skill"] : []),
-        ]);
-        if (plan.data.plannedActions.some(({ id }) => !allowedIds.has(id)))
+        const allowedIds = new Set(scope.clients.map((client) => `configure_client:${client}`));
+        const skillTargets = new Set(skillDestinations.map(({ path }) => path));
+        if (plan.data.plannedActions.some((action) => action.kind === "install_skill"
+            ? !skillTargets.has(action.target)
+            : !allowedIds.has(action.id)))
             return {
                 status: "unavailable",
                 remediation: "The updated setup plan included an integration outside the existing REA maintenance scope.",

package/dist/application/UpdateRuntime.js

@@ -1,27 +1,30 @@
-import { realpath } from "node:fs/promises";
+import { realpath, stat } from "node:fs/promises";
 import { homeDirectoryFromEnvironment } from "../config/homeDirectory.js";
 import { basename, dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import spawn from "cross-spawn";
+import { lt, valid } from "semver";
 import { PRODUCT_IDENTITY } from "../identity.js";
+import { ArtifactResourceScope } from "../artifacts/ArtifactResourceScope.js";
 import { err, ok } from "../domain/result.js";
 import { safeParseJson } from "../domain/safeJson.js";
 import { updateInstallCommand, } from "./Update.js";
 import { planIntegrationMaintenance } from "./UpdateMaintenance.js";
+import { withoutPackageRunnerIdentity } from "./ClientRegistrationIdentity.js";
 /** Run an updater subprocess with complete diagnostics and isolated machine output. */
-export const runUpdateCommand = (command, selectedEnvironment, output = "structured") => new Promise((resolveResult) => {
+export const runUpdateCommand = (command, selectedEnvironment, output = "structured", workingDirectory = undefined) => new Promise((resolveResult) => {
     const [executable, ...args] = command;
     if (executable === undefined) {
         resolveResult(err("No executable supplied."));
         return;
     }
-    const environment = { ...selectedEnvironment };
-    // A fresh installed entry point must not inherit npx's invocation identity.
-    delete environment.npm_command;
+    // A fresh installed entry point must not inherit a package runner's invocation identity.
+    const environment = withoutPackageRunnerIdentity(selectedEnvironment);
     const child = spawn(executable, args, {
         stdio: ["ignore", "pipe", "pipe"],
         env: environment,
         windowsHide: true,
+        ...(workingDirectory === undefined ? {} : { cwd: workingDirectory }),
     });
     let stdout = "";
     let stderr = "";
@@ -70,7 +73,7 @@ export const detectNpmInstallation = async (packageRoot, host) => {
             const prefix = await host.globalPrefix();
             return prefix.length === 0
                 ? undefined
-                : { prefix, packageRoot: canonicalPackageRoot };
+                : { manager: "npm", prefix, packageRoot: canonicalPackageRoot };
         }
     }
     catch (cause) {
@@ -83,9 +86,64 @@ export const detectNpmInstallation = async (packageRoot, host) => {
         basename(nodeModules) !== "node_modules" ||
         basename(library) !== "lib")
         return undefined;
-    return { prefix: dirname(library), packageRoot: canonicalPackageRoot };
+    return {
+        manager: "npm",
+        prefix: dirname(library),
+        packageRoot: canonicalPackageRoot,
+    };
+};
+const nonemptyEnvironment = (value) => value === undefined || value.length === 0 ? undefined : value;
+/**
+ * Bun's global project directory for the selected environment, in Bun's precedence:
+ * BUN_INSTALL_GLOBAL_DIR, then $BUN_INSTALL/install/global, then
+ * $XDG_CACHE_HOME/.bun/install/global, then ~/.bun/install/global.
+ * Resolve against the caller's cwd before reusing the path as a subprocess cwd.
+ */
+export const bunGlobalDirectory = (environment, platform) => {
+    const explicit = nonemptyEnvironment(environment.BUN_INSTALL_GLOBAL_DIR);
+    if (explicit !== undefined)
+        return resolve(explicit);
+    const installRoot = nonemptyEnvironment(environment.BUN_INSTALL);
+    if (installRoot !== undefined)
+        return resolve(installRoot, "install", "global");
+    const cacheRoot = nonemptyEnvironment(environment.XDG_CACHE_HOME) ??
+        homeDirectoryFromEnvironment(environment, platform);
+    return resolve(cacheRoot, ".bun", "install", "global");
+};
+/**
+ * Identify the running package as Bun's global installation.
+ * Bun walks up to an ancestor project when its global directory has no
+ * package.json, so the global manifest must exist before `bun add --global`
+ * can be trusted to update this package root.
+ */
+export const detectBunInstallation = async (packageRoot, globalDirectory, host) => {
+    try {
+        const canonicalPackageRoot = await host.canonicalPath(packageRoot);
+        const globalPackageRoot = await host.canonicalPath(join(globalDirectory, "node_modules", PRODUCT_IDENTITY.packageName));
+        if (canonicalPackageRoot !== globalPackageRoot ||
+            !(await host.isFile(join(globalDirectory, "package.json"))))
+            return undefined;
+        return {
+            manager: "bun",
+            globalDirectory,
+            packageRoot: canonicalPackageRoot,
+        };
+    }
+    catch (cause) {
+        // best-effort cleanup: optional install-location probing; unknown means not Bun-managed.
+        void cause;
+        return undefined;
+    }
 };
 const INVALID_NPM_RELEASE_METADATA = "Invalid npm release metadata: expected a version string or a single-element version array.";
+/** bun info arguments for dist-tags.latest; Bun resolves its configured registry. */
+export const BUN_LATEST_VERSION_COMMAND = [
+    "bun",
+    "info",
+    PRODUCT_IDENTITY.packageName,
+    "dist-tags.latest",
+    "--json",
+];
 /** npm view arguments for dist-tags.latest, scoped to the owning prefix when known. */
 export const npmLatestVersionCommand = (installation) => [
     "npm",
@@ -120,7 +178,7 @@ const readNpmLatestVersion = (value) => {
     return typeof only === "string" ? nonemptyVersion(only) : undefined;
 };
 const nonemptyVersion = (value) => value.length === 0 ? undefined : value;
-/** Classify npm view output as a version or a lookup failure. */
+/** Classify `npm view` or `bun info` output as a version or a lookup failure. */
 export const npmReleaseLookup = (response) => {
     if (!response.ok)
         return err({ kind: "unavailable", detail: response.error });
@@ -129,22 +187,78 @@ export const npmReleaseLookup = (response) => {
         ? ok(parsed.value)
         : err({ kind: "invalid-metadata", detail: parsed.error });
 };
-/** Create npm, registry, verification, and read-only maintenance effects. */
-export const systemUpdateHost = (packageRoot = fileURLToPath(new URL("../..", import.meta.url)), home = undefined, environment = process.env) => ({
-    installation: () => detectNpmInstallation(packageRoot, {
-        canonicalPath: realpath,
-        globalRoot: () => requireCommandOutput(["npm", "root", "--global"], environment),
-        globalPrefix: () => requireCommandOutput(["npm", "prefix", "--global"], environment),
-    }),
-    latestVersion: async (installation) => npmReleaseLookup(await runUpdateCommand(npmLatestVersionCommand(installation), environment)),
-    installVersion: async (installation, version, output) => {
-        const result = await runUpdateCommand(updateInstallCommand(installation, version), environment, output);
-        return result.ok ? ok(undefined) : result;
-    },
-    installedVersion: (installation) => runUpdateCommand([
-        process.execPath,
-        join(installation.packageRoot, "scripts", "rea.mjs"),
-        "--version",
-    ], environment),
-    planMaintenance: (installation) => planIntegrationMaintenance(home ?? homeDirectoryFromEnvironment(environment, process.platform), join(installation.packageRoot, "scripts", "rea.mjs"), environment, (command) => runUpdateCommand(command, environment)),
-});
+const isFile = async (path) => {
+    try {
+        return (await stat(path)).isFile();
+    }
+    catch (cause) {
+        // best-effort cleanup: a missing or unreadable manifest is not an owned Bun global project.
+        void cause;
+        return false;
+    }
+};
+/**
+ * Environment and working directory for package-manager subprocesses.
+ * Bun commands run inside the identified global project with that directory
+ * pinned, so the caller's current project and Bun's ancestor search are never
+ * selected. npm keeps the caller's working directory; its prefix is explicit.
+ */
+const packageManagerContext = (installation, environment) => installation?.manager === "bun"
+    ? {
+        environment: {
+            ...environment,
+            BUN_INSTALL_GLOBAL_DIR: installation.globalDirectory,
+        },
+        workingDirectory: installation.globalDirectory,
+    }
+    : { environment, workingDirectory: undefined };
+/** Create package-manager, registry, verification, and read-only maintenance effects. */
+export const systemUpdateHost = (packageRoot = fileURLToPath(new URL("../..", import.meta.url)), home = undefined, environment = process.env) => {
+    const resources = new ArtifactResourceScope();
+    return {
+        installation: async () => (await detectBunInstallation(packageRoot, bunGlobalDirectory(environment, process.platform), { canonicalPath: realpath, isFile })) ??
+            detectNpmInstallation(packageRoot, {
+                canonicalPath: realpath,
+                globalRoot: () => requireCommandOutput(["npm", "root", "--global"], environment),
+                globalPrefix: () => requireCommandOutput(["npm", "prefix", "--global"], environment),
+            }),
+        latestVersion: async (installation) => {
+            const context = packageManagerContext(installation, environment);
+            if (installation?.manager === "bun") {
+                const version = await runUpdateCommand(["bun", "--version"], context.environment, "structured", context.workingDirectory);
+                if (!version.ok)
+                    return err({ kind: "unavailable", detail: version.error });
+                const bunVersion = valid(version.value);
+                // bun info was introduced in 1.2.17; older releases reserve the command.
+                if (bunVersion === null || lt(bunVersion, "1.2.17"))
+                    return err({
+                        kind: "unsupported-package-manager",
+                        detail: `REA updates for Bun global installations require Bun 1.2.17 or later; bun --version returned ${JSON.stringify(version.value)}. Upgrade Bun manually, then rerun rea update.`,
+                    });
+            }
+            return npmReleaseLookup(await runUpdateCommand(installation?.manager === "bun"
+                ? BUN_LATEST_VERSION_COMMAND
+                : npmLatestVersionCommand(installation), context.environment, "structured", context.workingDirectory));
+        },
+        installVersion: async (installation, version, output) => {
+            const context = packageManagerContext(installation, environment);
+            const result = await runUpdateCommand(updateInstallCommand(installation, version), context.environment, output, context.workingDirectory);
+            return result.ok ? ok(undefined) : result;
+        },
+        installedVersion: (installation) => runUpdateCommand([
+            process.execPath,
+            join(installation.packageRoot, "scripts", "rea.mjs"),
+            "--version",
+        ], environment),
+        planMaintenance: (installation) => planIntegrationMaintenance(home ?? homeDirectoryFromEnvironment(environment, process.platform), join(installation.packageRoot, "scripts", "rea.mjs"), environment, (command) => runUpdateCommand(command, environment), resources),
+        close: async () => {
+            try {
+                await resources.close();
+                return undefined;
+            }
+            catch (cause) {
+                return `Update resource cleanup failed: ${cause instanceof Error ? cause.message : String(cause)}`;
+            }
+        },
+    };
+};

package/dist/application/Utf8JsonInput.js

@@ -3,6 +3,11 @@ import { AnalysisResourceConstraintError } from "../domain/analysisErrorCore.js"
 import { safeParseJson } from "../domain/safeJson.js";
 /** Recovery that preserves complete, authenticated Evidence workflow inputs. */
 export const JSON_INPUT_RESOURCE_REMEDIATION = "Provide a smaller valid JSON value. For Evidence workflows, re-analyze a smaller selection of the original target and use its complete Evidence; splitting JSON text or trimming Evidence fields does not produce valid workflow input.";
+/**
+ * Strict JSON input keeps rejecting a leading byte-order mark, but names it:
+ * the parser's own message quotes the invisible U+FEFF as the bad token.
+ */
+export const JSON_BYTE_ORDER_MARK_MESSAGE = "JSON input begins with a UTF-8 byte-order mark (EF BB BF), which strict JSON input does not accept. Save the file as UTF-8 without a byte-order mark.";
 /** Decode JSON bytes without confusing a runtime string limit with malformed input. */
 export const parseUtf8Json = (bytes, operation, path, boundary = "json-input") => {
     const stringLimitFailure = (cause, decodedUnits) => new AnalysisResourceConstraintError(operation, "memory", "JSON input exceeds the runtime's maximum decoded string length", {
@@ -60,5 +65,7 @@ export const parseUtf8Json = (bytes, operation, path, boundary = "json-input") =
             cause,
         };
     }
+    if (text.startsWith("\uFEFF"))
+        return { ok: false, error: JSON_BYTE_ORDER_MARK_MESSAGE, cause: undefined };
     return safeParseJson(text);
 };

package/dist/application/WebModuleTraceService.js

@@ -1,3 +1,4 @@
+import { closeOwnedWebResources } from "./closeOwnedWebResources.js";
 import { isAbsolute } from "node:path";
 import { z } from "zod";
 import { AnalysisCancelledError, AnalysisCapabilityUnavailableError, AnalysisInputError, AnalysisOutputError, } from "../domain/analysisErrorCore.js";
@@ -43,6 +44,12 @@ export class WebModuleTraceService {
         this.artifacts = artifacts;
         this.resolver = resolver;
     }
+    close() {
+        return closeOwnedWebResources([
+            this.artifacts.close?.bind(this.artifacts),
+            this.resolver.close?.bind(this.resolver),
+        ], "Web module trace cleanup failed");
+    }
     async trace(rawInput, options) {
         if (isAborted(options?.signal))
             return err(new AnalysisCancelledError(OPERATION));

package/dist/application/WebNetworkCaptureService.js

@@ -3,11 +3,12 @@ import { excludeCaptureCoordinates } from "../domain/webNetworkCaptureCoordinate
 import { redactExplicitText } from "../domain/explicitSensitiveValues.js";
 import { isAbsolute } from "node:path";
 import { AnalysisCancelledError, AnalysisInputError, AnalysisOutputError, } from "../domain/analysisErrorCore.js";
+import { createAnalysisProfile } from "../domain/analysisProfile.js";
 import { createEvidence } from "../domain/evidence.js";
 import { analysisInputErrorFromIssues } from "../domain/inputIssueProjection.js";
 import { jsonObjectSchema } from "../domain/jsonValue.js";
 import { err, ok } from "../domain/result.js";
-import { inspectWebNetworkCaptureInputSchema, webNetworkCaptureSchema, } from "../domain/webNetworkCapture.js";
+import { inspectWebNetworkCaptureInputSchema, captureSensitiveValues, webNetworkCaptureSchema, } from "../domain/webNetworkCapture.js";
 const OPERATION = "inspect_web_network_capture";
 /** Shared CLI/MCP historical inspection preserves caller selection and producer record identity. */
 export class WebNetworkCaptureService {
@@ -15,16 +16,15 @@ export class WebNetworkCaptureService {
     constructor(port) {
         this.port = port;
     }
+    /** Release resources retained by the selected capture adapter. */
+    close() {
+        return this.port.close?.() ?? Promise.resolve();
+    }
     /** Return selected complete records inline, without inventing live browser attribution. */
     async inspect(rawInput, options) {
         if (options?.signal?.aborted)
             return err(new AnalysisCancelledError(OPERATION));
-        const declarations = inspectWebNetworkCaptureInputSchema.shape.sensitive_values.safeParse(typeof rawInput === "object" &&
-            rawInput !== null &&
-            "sensitive_values" in rawInput
-            ? rawInput.sensitive_values
-            : undefined);
-        const failure = (error) => err(redactExplicitFailure(error, declarations.success ? declarations.data : []));
+        const failure = (error) => err(redactExplicitFailure(error, captureSensitiveValues(rawInput)));
         const parsed = inspectWebNetworkCaptureInputSchema.safeParse(rawInput);
         if (!parsed.success)
             return failure(analysisInputErrorFromIssues(OPERATION, parsed.error.issues, rawInput, {
@@ -124,6 +124,15 @@ export class WebNetworkCaptureService {
                     ? [...limitations, subjectUnavailableReason]
                     : limitations,
             },
+            ...(safeValue.format !== "qlog"
+                ? {}
+                : {
+                    analysisProfile: createAnalysisProfile(value.decoder, {
+                        qlog_profile: safeValue.qlog.profile,
+                        clock: safeValue.qlog.clock,
+                        scope: safeValue.qlog.scope,
+                    }),
+                }),
             confidence: "observed",
             authority: "historical-reference",
             limitations,