rea-agents 6.3.0 → 6.5.0

package/dist/server/registerElectronTools.js

@@ -1,3 +1,4 @@
+import { summarizeRetainedAnalysis } from "../application/analysisView/AnalysisViewService.js";
 import { optionalProviderUnavailable, } from "../application/OptionalObservationProviders.js";
 import { err } from "../domain/result.js";
 import { captureElectronScenario } from "../application/javascript/ElectronActiveObservationService.js";
@@ -5,14 +6,16 @@ import { inspectElectronPage, listElectronTargets, } from "../application/javasc
 import { analyzeJavaScriptApplicationValidated } from "../application/javascript/JavaScriptApplicationService.js";
 import { reconcileJavaScriptRuntimeEvidenceValidated } from "../application/javascript/JavaScriptRuntimeReconciliationService.js";
 import { toolContract } from "../contracts/toolContracts.js";
-import { inspectElectronPageInputSchema } from "../domain/javascript/electronObservation.js";
 import { mcpProgressReporter } from "./mcpProgress.js";
 import { logToolExecution } from "./toolLogging.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
+import { runAdmittedToolOperation } from "./admittedToolOperation.js";
+import { createEvidenceToolHandler } from "./contractToolHandler.js";
 /** Register Electron tools even when a provider is absent. */
 // oxlint-disable-next-line max-lines-per-function -- direct SDK calls retain each schema-handler type correlation.
 export const registerElectronTools = (server, options) => {
-    const registration = { ...options, delivery: server.delivery };
+    const registration = { ...options, delivery: server.delivery, server };
+    registerElectronFuseTool(server, options);
     const listContract = toolContract("list_electron_targets");
     const inspectContract = toolContract("inspect_electron_page");
     const analyzeContract = toolContract("analyze_javascript_application");
@@ -21,20 +24,27 @@ export const registerElectronTools = (server, options) => {
     server.registerTool(listContract.name, toolRegistrationOptions(listContract), (input, context) => runElectronTool(registration, listContract, { input, context }, (parsed, { signal }) => listElectronTargets(options.electron, parsed, {
         signal,
     })));
-    server.registerTool(inspectContract.name, toolRegistrationOptions(inspectContract), (input, context) => runElectronTool(registration, inspectContract, { input, context }, async (parsed, { signal, progress }) => {
-        const request = inspectElectronPageInputSchema.parse(parsed);
-        return inspectElectronPage(options.electron, request, {
-            signal,
-            progress,
-        });
+    server.registerTool(inspectContract.name, toolRegistrationOptions(inspectContract), (input, context) => runElectronTool(registration, inspectContract, { input, context }, (parsed, { signal, progress }) => inspectElectronPage(options.electron, parsed, {
+        signal,
+        progress,
+    })));
+    server.registerTool(analyzeContract.name, toolRegistrationOptions(analyzeContract), (input, context) => runElectronTool(registration, analyzeContract, { input, context }, async ({ detail, ...request }, { signal, progress }) => {
+        const analyzed = await analyzeJavaScriptApplicationValidated(request, options.artifactResources, { signal, progress });
+        return detail === "summary" && analyzed.ok
+            ? summarizeRetainedAnalysis(analyzed.value, options)
+            : analyzed;
     }));
-    server.registerTool(analyzeContract.name, toolRegistrationOptions(analyzeContract), (input, context) => runElectronTool(registration, analyzeContract, { input, context }, (parsed, { signal, progress }) => analyzeJavaScriptApplicationValidated(parsed, { signal, progress })));
     server.registerTool(reconcileContract.name, toolRegistrationOptions(reconcileContract), (input, context) => runElectronTool(registration, reconcileContract, { input, context }, (parsed) => Promise.resolve(reconcileJavaScriptRuntimeEvidenceValidated(parsed))));
     server.registerTool(activeContract.name, toolRegistrationOptions(activeContract), (input, context) => runElectronTool(registration, activeContract, { input, context }, (parsed, { signal, progress }) => captureElectronScenario(options.electronActive, parsed, {
         signal,
         progress,
     })));
 };
+const registerElectronFuseTool = (server, options) => {
+    const contract = toolContract("inspect_electron_fuses");
+    const handler = createEvidenceToolHandler(server, (input, execution) => options.electronFuses.inspect(input, execution), options.logger, options.recordEvidence, options.withAdmittedAnalysis);
+    server.registerTool(contract.name, toolRegistrationOptions(contract), handler(contract));
+};
 const runElectronTool = async (options, contract, request, execute) => {
     const { input, context } = request;
     const failure = contract.name === "capture_electron_scenario"
@@ -45,12 +55,23 @@ const runElectronTool = async (options, contract, request, execute) => {
             : undefined;
     if (failure !== undefined)
         return options.delivery.toCallToolResult(err(optionalProviderUnavailable(failure, contract.name)), contract);
-    const result = await logToolExecution(options.logger, contract.name, () => execute(input, {
-        signal: context.mcpReq.signal,
-        progress: mcpProgressReporter(context),
-    }));
-    if (!result.ok)
-        return options.delivery.toCallToolResult(result, contract);
-    const recorded = options.recordEvidence?.(result.value);
-    return options.delivery.toEvidenceToolResult(result.value, contract, recorded);
+    return runAdmittedToolOperation(options.server, options.withAdmittedAnalysis, contract.name, context.mcpReq.signal, async () => {
+        const result = await logToolExecution(options.logger, contract.name, () => execute(input, {
+            signal: context.mcpReq.signal,
+            progress: mcpProgressReporter(context),
+        }));
+        if (!result.ok) {
+            const partial = result.error.partialObservation;
+            if (partial !== undefined &&
+                "evidence_id" in partial &&
+                typeof partial.evidence_id === "string") {
+                const recorded = options.recordEvidence?.(partial);
+                if (recorded !== undefined)
+                    return options.delivery.toRecordedPartialErrorToolResult(result.error, partial.evidence_id, recorded, contract.returnsTargetContent);
+            }
+            return options.delivery.toCallToolResult(result, contract);
+        }
+        const recorded = options.recordEvidence?.(result.value);
+        return options.delivery.toEvidenceToolResult(result.value, contract, recorded);
+    });
 };

package/dist/server/registerEnhancedTools.js

@@ -1,5 +1,5 @@
 import { EnhancedTools } from "../application/EnhancedTools.js";
-import { createWorkflowEvidence, workflowSnapshotRecord, recordWorkflowUnknowns, } from "../application/WorkflowEvidence.js";
+import { executeComposedWorkflow, createWorkflowEvidence, workflowSnapshotRecord, recordWorkflowUnknowns, } from "../application/WorkflowEvidence.js";
 import { toolContract } from "../contracts/toolContracts.js";
 import { mcpProgressReporter } from "./mcpProgress.js";
 import { logToolExecution } from "./toolLogging.js";
@@ -98,13 +98,13 @@ const executeEnhancedTool = async (registration, contract, request) => {
                 context,
                 parameters,
             });
-        const services = new EnhancedTools({
+        const analysis = {
             execute: (operation, operationParameters, executionOptions) => admittedAnalysis.execute(operation, operationParameters, {
                 ...executionOptions,
                 progress,
             }),
-        });
-        const result = await logToolExecution(registration.logger, name, () => services.executeValidated(validatedCall, context.mcpReq.signal));
+        };
+        const result = await logToolExecution(registration.logger, name, () => executeComposedWorkflow(analysis, (observed) => new EnhancedTools(observed).executeValidated(validatedCall, context.mcpReq.signal)));
         await progress.report({
             phase: name,
             completed: 1,
@@ -117,8 +117,9 @@ const executeEnhancedTool = async (registration, contract, request) => {
                 target: registration.activeTarget?.(),
                 operation: name,
                 parameters,
-                result: result.value,
+                result: result.value.result,
                 upstreamProfile: registration.analysisProfile?.(),
+                upstreamLimitations: result.value.limitations,
             });
             const recorded = registration.recordEvidence?.(evidence);
             if (recorded !== undefined && !recorded.ok)
@@ -134,7 +135,7 @@ const executeEnhancedTool = async (registration, contract, request) => {
             }
             const unknowns = recordWorkflowUnknowns({
                 name,
-                result: result.value,
+                result: result.value.result,
                 evidenceId: evidence.evidence_id,
                 recordUnknown: registration.recordUnknown,
             });

package/dist/server/registerEvidenceTools.js

@@ -1,13 +1,16 @@
 import { createEvidence } from "../domain/evidence.js";
 import { jsonObjectSchema } from "../domain/jsonValue.js";
+import { ok } from "../domain/result.js";
 import { mcpProgressReporter } from "./mcpProgress.js";
 import { logToolExecution } from "./toolLogging.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
-import { createArtifactExtractionDestination } from "../application/artifacts/ArtifactExtractionDestination.js";
 /** Register provider-backed contracts that return atomic Evidence observations. */
 export const registerEvidenceTools = (server, contracts, options) => {
     for (const contract of contracts) {
         server.registerTool(contract.name, toolRegistrationOptions(contract), async (input, context) => {
+            const ready = options.preflight?.(contract.name, jsonObjectSchema.parse(input));
+            if (ready !== undefined && !ready.ok)
+                return server.delivery.toCallToolResult(ready, contract);
             const admitted = await options.withAdmittedAnalysis(contract.name, context.mcpReq.signal, async (admittedAnalysis) => {
                 const analysis = options.analysisForAdmission?.(admittedAnalysis) ??
                     admittedAnalysis;
@@ -19,12 +22,8 @@ export const registerEvidenceTools = (server, contracts, options) => {
                     message: "started",
                 });
                 const parameters = jsonObjectSchema.parse(input);
-                const executionParameters = contract.name === "extract_artifact"
-                    ? {
-                        ...parameters,
-                        output_root: createArtifactExtractionDestination(),
-                    }
-                    : parameters;
+                const executionParameters = options.parametersForExecution?.(contract.name, parameters) ??
+                    parameters;
                 const execution = await logToolExecution(options.logger, contract.name, () => analysis.execute(contract.name, executionParameters, {
                     signal: context.mcpReq.signal,
                     progress,
@@ -42,7 +41,8 @@ export const registerEvidenceTools = (server, contracts, options) => {
                     [];
                 const evidence = createEvidence(execution.value.subject ?? options.activeTarget?.(), execution.value.provider, {
                     operation: contract.name,
-                    parameters,
+                    parameters: options.parametersForEvidence?.(contract.name, parameters) ??
+                        parameters,
                     result: execution.value.result,
                     ...(execution.value.analysisProfile === undefined
                         ? {}
@@ -57,8 +57,12 @@ export const registerEvidenceTools = (server, contracts, options) => {
                     if (sourceRecorded !== undefined && !sourceRecorded.ok)
                         return server.delivery.toCallToolResult(sourceRecorded, contract);
                 }
-                const recorded = options.recordEvidence?.(evidence);
-                return server.delivery.toEvidenceToolResult(evidence, contract, recorded);
+                const projected = options.projectEvidence?.(contract.name, parameters, evidence) ??
+                    ok(evidence);
+                if (!projected.ok)
+                    return server.delivery.toCallToolResult(projected, contract);
+                const recorded = options.recordEvidence?.(projected.value);
+                return server.delivery.toEvidenceToolResult(projected.value, contract, recorded);
             });
             return admitted.ok
                 ? admitted.value

package/dist/server/registerEvmTools.js

@@ -1,14 +1,27 @@
-import { toolContract } from "../contracts/toolContracts.js";
-import { logToolExecution } from "./toolLogging.js";
+import { requireAnalysisViewRetention, summarizeRetainedAnalysis, } from "../application/analysisView/AnalysisViewService.js";
+import { analysisInputErrorFromIssues } from "../domain/inputIssueProjection.js";
+import { err } from "../domain/result.js";
+import { evmInterfaceModule } from "../composition/evm.js";
+import { createEvidenceToolHandler } from "./contractToolHandler.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
 /** Bind the named EVM contract to shared validation and session Evidence recording. */
-export const registerEvmTools = (server, service, logger, recordEvidence) => {
-    const contract = toolContract("inspect_evm_interface");
-    server.registerTool(contract.name, toolRegistrationOptions(contract), async (input, context) => {
-        const result = await logToolExecution(logger, contract.name, () => service.inspect(input, { signal: context.mcpReq.signal }));
-        if (!result.ok)
-            return server.delivery.toCallToolResult(result, contract);
-        const recorded = recordEvidence?.(result.value);
-        return server.delivery.toEvidenceToolResult(result.value, contract, recorded);
-    });
+export const registerEvmTools = (server, service, logger, recordEvidence, withAdmittedAnalysis, evidenceById) => {
+    const contract = evmInterfaceModule.contract;
+    const handler = createEvidenceToolHandler(server, async (rawInput, options) => {
+        const parsed = contract.inputSchema.safeParse(rawInput);
+        if (!parsed.success)
+            return err(analysisInputErrorFromIssues(contract.name, parsed.error.issues, rawInput, { cause: parsed.error }));
+        const { detail, ...input } = parsed.data;
+        const retention = { recordEvidence, evidenceById };
+        if (detail === "summary") {
+            const ready = requireAnalysisViewRetention(contract.name, retention);
+            if (!ready.ok)
+                return ready;
+        }
+        const inspected = await service.inspect(input, options);
+        return detail === "summary" && inspected.ok
+            ? summarizeRetainedAnalysis(inspected.value, retention)
+            : inspected;
+    }, logger, recordEvidence, withAdmittedAnalysis);
+    server.registerTool(contract.name, toolRegistrationOptions(contract), handler(contract));
 };

package/dist/server/registerFirmwareTools.js

@@ -1,17 +1,9 @@
 import { toolContract } from "../contracts/toolContracts.js";
-import { logToolExecution } from "./toolLogging.js";
+import { createContractToolHandler } from "./contractToolHandler.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
 /** Bind firmware handlers to their exact named schemas. */
-export const registerFirmwareTools = (server, service, logger, recordEvidence) => {
-    const handler = (contract) => async (input, context) => {
-        const result = await logToolExecution(logger, contract.name, () => service.execute(contract.name, input, {
-            signal: context.mcpReq.signal,
-        }));
-        if (!result.ok)
-            return server.delivery.toCallToolResult(result, contract);
-        const recorded = recordEvidence?.(result.value);
-        return server.delivery.toEvidenceToolResult(result.value, contract, recorded);
-    };
+export const registerFirmwareTools = (server, service, logger, recordEvidence, withAdmittedAnalysis) => {
+    const handler = createContractToolHandler(server, service, logger, recordEvidence, withAdmittedAnalysis);
     const inspect = toolContract("inspect_firmware_regions");
     server.registerTool(inspect.name, toolRegistrationOptions(inspect), handler(inspect));
     const extract = toolContract("extract_firmware");

package/dist/server/registerFlutterTools.js

@@ -0,0 +1,17 @@
+import { FlutterBuildAnalysisService } from "../application/flutter/FlutterBuildAnalysisService.js";
+import { inspectDartAot } from "../application/flutter/DartAotInspection.js";
+import { toolContract } from "../contracts/toolContracts.js";
+import { createContractToolHandler, } from "./contractToolHandler.js";
+import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
+/** Bind Flutter handlers to their exact named contracts through admission. */
+export const registerFlutterTools = (server, service, logger, recordEvidence, withAdmittedAnalysis, evidenceById) => {
+    const handler = createContractToolHandler(server, service, logger, recordEvidence, withAdmittedAnalysis);
+    const identify = toolContract("identify_flutter_build");
+    server.registerTool(identify.name, toolRegistrationOptions(identify), handler(identify));
+    const aotService = {
+        execute: (_operation, input, options) => inspectDartAot(service, input, { recordEvidence, evidenceById }, options),
+    };
+    const aotHandler = createContractToolHandler(server, aotService, logger, recordEvidence, withAdmittedAnalysis);
+    const aot = toolContract("inspect_dart_aot");
+    server.registerTool(aot.name, toolRegistrationOptions(aot), aotHandler(aot));
+};

package/dist/server/registerFridaTools.js

@@ -0,0 +1,205 @@
+import { FridaInstrumentationService } from "../application/frida/FridaInstrumentationService.js";
+import { toolContract } from "../contracts/toolContracts.js";
+import { evidenceSchema } from "../domain/evidence.js";
+import { AnalysisInputError } from "../domain/analysisErrorCore.js";
+import { jsonValueSchema } from "../domain/jsonValue.js";
+import { logToolExecution } from "./toolLogging.js";
+import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
+import { unknownFridaSession } from "../application/frida/fridaInputErrors.js";
+/** Register Frida device discovery and persistent instrumentation operations. */
+export const registerFridaTools = (server, provider, logger, delivery, recordEvidence) => {
+    const service = new FridaInstrumentationService(provider);
+    const listDevices = toolContract("list_frida_devices");
+    const listProcesses = toolContract("list_frida_processes");
+    const start = toolContract("start_frida_session");
+    const load = toolContract("load_frida_script");
+    const resume = toolContract("resume_frida_session");
+    const unload = toolContract("unload_frida_script");
+    const status = toolContract("frida_session_status");
+    const close = toolContract("close_frida_session");
+    const instrument = toolContract("instrument_with_frida");
+    server.registerTool(listDevices.name, toolRegistrationOptions(listDevices), async (input) => {
+        const result = await logToolExecution(logger, listDevices.name, () => service.listDevices(remoteConnection(input.remote)));
+        return result.ok
+            ? delivery.toCallToolResult({
+                ok: true,
+                value: jsonValueSchema.parse({
+                    devices: result.value.devices.map((device) => ({
+                        device_id: device.deviceId,
+                        name: device.name,
+                        type: device.type,
+                    })),
+                    cleanup_error: result.value.cleanupError,
+                }),
+            }, listDevices)
+            : delivery.toCallToolResult(result, listDevices);
+    });
+    server.registerTool(listProcesses.name, toolRegistrationOptions(listProcesses), async (input) => {
+        const remote = remoteConnection(input.remote);
+        const result = await logToolExecution(logger, listProcesses.name, () => service.listProcesses({
+            ...(input.device_id === undefined
+                ? {}
+                : { deviceId: input.device_id }),
+            ...(remote === undefined ? {} : { remote }),
+        }));
+        return result.ok
+            ? delivery.toCallToolResult({
+                ok: true,
+                value: jsonValueSchema.parse({
+                    device_id: result.value.deviceId,
+                    processes: result.value.processes,
+                    cleanup_error: result.value.cleanupError,
+                }),
+            }, listProcesses)
+            : delivery.toCallToolResult(result, listProcesses);
+    });
+    server.registerTool(start.name, toolRegistrationOptions(start), async (input, context) => {
+        const remote = remoteConnection(input.remote);
+        const selected = {
+            ...(input.device_id === undefined ? {} : { deviceId: input.device_id }),
+            ...(remote === undefined ? {} : { remote }),
+        };
+        const result = await logToolExecution(logger, start.name, () => input.mode === "attach" && input.pid !== undefined
+            ? service.startSession({
+                ...selected,
+                mode: input.mode,
+                pid: input.pid,
+            }, context.mcpReq.signal)
+            : input.mode === "spawn" && input.program !== undefined
+                ? service.startSession({
+                    ...selected,
+                    mode: input.mode,
+                    program: input.program,
+                    ...(input.argv === undefined ? {} : { argv: input.argv }),
+                }, context.mcpReq.signal)
+                : Promise.resolve({
+                    ok: false,
+                    error: new AnalysisInputError(start.name),
+                }));
+        if (!result.ok) {
+            recordPartialEvidence(result.error, recordEvidence);
+            return delivery.toCallToolResult(result, start);
+        }
+        return delivery.toCallToolResult({
+            ok: true,
+            value: jsonValueSchema.parse(sessionOutput(result.value)),
+        }, start);
+    });
+    server.registerTool(load.name, toolRegistrationOptions(load), async (input, context) => {
+        const result = await logToolExecution(logger, load.name, () => input.source_kind === "inline" && input.source !== undefined
+            ? service.loadScript(input.session_id, {
+                sourceKind: "inline",
+                source: input.source,
+            }, context.mcpReq.signal)
+            : input.source_kind === "file" && input.path !== undefined
+                ? service.loadScript(input.session_id, {
+                    sourceKind: "file",
+                    path: input.path,
+                }, context.mcpReq.signal)
+                : Promise.resolve({
+                    ok: false,
+                    error: new AnalysisInputError(load.name),
+                }));
+        if (!result.ok) {
+            recordPartialEvidence(result.error, recordEvidence);
+            return delivery.toCallToolResult(result, load);
+        }
+        return delivery.toEvidenceToolResult(result.value, load, recordEvidence?.(result.value));
+    });
+    server.registerTool(resume.name, toolRegistrationOptions(resume), async (input, context) => {
+        const result = await logToolExecution(logger, resume.name, () => service.resumeSession(input.session_id, context.mcpReq.signal));
+        return result.ok
+            ? delivery.toCallToolResult({ ok: true, value: { state: "running" } }, resume)
+            : delivery.toCallToolResult(result, resume);
+    });
+    server.registerTool(unload.name, toolRegistrationOptions(unload), async (input, context) => {
+        const result = await logToolExecution(logger, unload.name, () => service.unloadScript(input.session_id, input.script_id, context.mcpReq.signal));
+        return result.ok
+            ? delivery.toCallToolResult({ ok: true, value: { unloaded: true } }, unload)
+            : delivery.toCallToolResult(result, unload);
+    });
+    server.registerTool(status.name, toolRegistrationOptions(status), async (input) => {
+        const evidence = service.statusEvidence(input.session_id);
+        if (evidence === undefined)
+            return delivery.toCallToolResult({
+                ok: false,
+                error: unknownFridaSession(status.name, input.session_id),
+            }, status);
+        return delivery.toEvidenceToolResult(evidence, status, recordEvidence?.(evidence));
+    });
+    server.registerTool(close.name, toolRegistrationOptions(close), async (input) => {
+        const result = await logToolExecution(logger, close.name, () => service.closeSession(input.session_id));
+        return result.ok
+            ? delivery.toCallToolResult({ ok: true, value: { target_state: "unknown" } }, close)
+            : delivery.toCallToolResult(result, close);
+    });
+    server.registerTool(instrument.name, toolRegistrationOptions(instrument), async (input, context) => {
+        const remote = remoteConnection(input.remote);
+        const selected = {
+            ...(input.device_id === undefined ? {} : { deviceId: input.device_id }),
+            ...(remote === undefined ? {} : { remote }),
+        };
+        const source = input.source_kind === "inline" && input.source !== undefined
+            ? { sourceKind: "inline", source: input.source }
+            : input.source_kind === "file" && input.path !== undefined
+                ? { sourceKind: "file", path: input.path }
+                : undefined;
+        if (source === undefined)
+            return delivery.toCallToolResult({ ok: false, error: new AnalysisInputError(instrument.name) }, instrument);
+        const operation = input.mode === "attach" && input.pid !== undefined
+            ? service.instrument({
+                ...selected,
+                mode: "attach",
+                pid: input.pid,
+                source,
+                durationMs: input.duration_ms,
+            }, context.mcpReq.signal)
+            : input.mode === "spawn" && input.program !== undefined
+                ? service.instrument({
+                    ...selected,
+                    mode: "spawn",
+                    program: input.program,
+                    ...(input.argv === undefined ? {} : { argv: input.argv }),
+                    source,
+                    durationMs: input.duration_ms,
+                }, context.mcpReq.signal)
+                : Promise.resolve({
+                    ok: false,
+                    error: new AnalysisInputError(instrument.name),
+                });
+        const result = await logToolExecution(logger, instrument.name, () => operation);
+        if (!result.ok) {
+            recordPartialEvidence(result.error, recordEvidence);
+            return delivery.toCallToolResult(result, instrument);
+        }
+        return delivery.toEvidenceToolResult(result.value.evidence, instrument, recordEvidence?.(result.value.evidence));
+    });
+};
+const recordPartialEvidence = (error, recordEvidence) => {
+    if (error.partialObservation === undefined)
+        return;
+    const parsed = evidenceSchema.safeParse(error.partialObservation);
+    if (parsed.success)
+        recordEvidence?.(parsed.data);
+};
+const remoteConnection = (input) => input === undefined
+    ? undefined
+    : {
+        address: input.address,
+        ...(typeof input.token === "string" ? { token: input.token } : {}),
+        ...(typeof input.certificate === "string"
+            ? { certificate: input.certificate }
+            : {}),
+        ...(typeof input.origin === "string" ? { origin: input.origin } : {}),
+        ...(typeof input.keepalive_interval === "number"
+            ? { keepaliveInterval: input.keepalive_interval }
+            : {}),
+    };
+const sessionOutput = (session) => ({
+    session_id: session.sessionId,
+    device_id: session.deviceId,
+    target: session.target,
+    pid: session.pid,
+    mode: session.mode,
+    state: session.state,
+});

package/dist/server/registerFunctionComparisonTool.js

@@ -8,10 +8,14 @@ import { recordSessionEvidenceSources } from "./sessionEvidence.js";
 import { runDerivedOperation } from "./runDerivedOperation.js";
 import { FUNCTION_COMPARISON_PROVIDER } from "../application/InvestigationProviders.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
+import { withAdmittedAnalysis } from "./analysisAdmission.js";
+import { runAdmittedToolOperation } from "./admittedToolOperation.js";
 import { compareFunctions } from "../domain/functionComparison.js";
+import { uniqueSorted } from "../domain/canonicalOrdering.js";
 /** Register explicit Evidence-backed function comparison. */
 export const registerFunctionComparisonTool = (server, session, contract) => {
-    server.registerTool(contract.name, toolRegistrationOptions(contract), async (input, context) => {
+    const admission = withAdmittedAnalysis({ kind: "session", session });
+    server.registerTool(contract.name, toolRegistrationOptions(contract), async (input, context) => runAdmittedToolOperation(server, admission, contract.name, context.mcpReq.signal, async () => {
         let leftEvidence;
         let rightEvidence;
         try {
@@ -48,26 +52,45 @@ export const registerFunctionComparisonTool = (server, session, contract) => {
             limitations: comparison.limitations,
             evidenceLinks: [...leftIds, ...rightIds],
         });
-        const recorded = recordDerivedEvidence(session, evidence, functionUnknownInput({
-            status: comparison.status,
-            leftIds,
-            rightIds,
-            comparisonEvidenceId: evidence.evidence_id,
-        }));
+        const recorded = recordDerivedEvidence(session, evidence, comparisonUnknownInput(comparison, leftIds, rightIds, evidence.evidence_id));
         return server.delivery.toEvidenceToolResult(evidence, contract, recorded);
-    });
+    }));
 };
-const functionUnknownInput = ({ status, leftIds, rightIds, comparisonEvidenceId, }) => {
+const comparisonUnknownInput = (comparison, leftIds, rightIds, comparisonEvidenceId) => functionUnknownInput({
+    status: comparison.status,
+    dimensions: comparison.dimensions
+        .filter(({ status }) => comparison.status === "unknown"
+        ? status === "unknown"
+        : status === "changed")
+        .map(({ dimension }) => dimension),
+    leftIds,
+    rightIds,
+    comparisonEvidenceId,
+});
+const functionUnknownInput = ({ status, dimensions, leftIds, rightIds, comparisonEvidenceId, }) => {
     if (status === "unchanged")
         return undefined;
-    const supportingIds = [...new Set([...leftIds, ...rightIds])];
+    const supportingIds = [
+        ...new Set([...leftIds, ...rightIds, comparisonEvidenceId]),
+    ];
     const contradictingIds = rightIds.filter((id) => !leftIds.includes(id));
     const contradictory = status === "changed";
     return {
         question: `Function comparison is ${status} (comparison ${comparisonEvidenceId})`,
         severity: status === "changed" ? "medium" : "high",
         domain: "function-comparison",
-        supporting_evidence_ids: contradictory ? [...leftIds] : supportingIds,
+        comparison_conclusion_scope: {
+            comparison_evidence_id: comparisonEvidenceId,
+            dimensions: uniqueSorted([
+                ...(status === "unknown" || dimensions.length === 0
+                    ? ["overall"]
+                    : []),
+                ...dimensions,
+            ]),
+        },
+        supporting_evidence_ids: contradictory
+            ? [...leftIds, comparisonEvidenceId]
+            : supportingIds,
         contradicting_evidence_ids: contradictory ? contradictingIds : [],
         required_authority: "shipped-artifact",
         required_confidence: "observed",

package/dist/server/registerGdbTools.js

@@ -0,0 +1,64 @@
+import { toolContract } from "../contracts/toolContracts.js";
+import { evidenceSchema } from "../domain/evidence.js";
+import { err } from "../domain/result.js";
+import { AnalysisInputError } from "../domain/analysisErrorCore.js";
+import { runOwnedCleanupWithExternalMutationAdmission, runWithExternalMutationAdmission, } from "./externalMutationAdmission.js";
+import { logToolExecution } from "./toolLogging.js";
+import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
+/** Register persistent GDB session operations on the existing REA MCP server. */
+export const registerGdbTools = (server, manager, logger, delivery, recordEvidence, session) => {
+    const start = toolContract("start_gdb_session");
+    const consoleContract = toolContract("gdb_console");
+    const status = toolContract("gdb_session_status");
+    const close = toolContract("close_gdb_session");
+    server.registerTool(start.name, toolRegistrationOptions(start), async (input, context) => {
+        const result = await logToolExecution(logger, start.name, () => manager.start(context.mcpReq.signal, input.inferior_tty === undefined
+            ? {}
+            : { inferiorTty: input.inferior_tty }));
+        if (result.ok)
+            return delivery.toCallToolResult({ ok: true, value: result.value }, start);
+        const partial = result.error.partialObservation;
+        const parsed = evidenceSchema.safeParse(partial);
+        if (parsed.success) {
+            const recorded = recordEvidence?.(parsed.data);
+            if (recorded !== undefined)
+                return delivery.toRecordedPartialErrorToolResult(result.error, parsed.data.evidence_id, recorded, start.returnsTargetContent);
+        }
+        return delivery.toCallToolResult(result, start);
+    });
+    server.registerTool(consoleContract.name, toolRegistrationOptions(consoleContract), async (input, context) => {
+        const execute = () => logToolExecution(logger, consoleContract.name, () => manager.execute(input.session_id, input.command, context.mcpReq.signal));
+        const result = await runWithExternalMutationAdmission(session, consoleContract.name, context.mcpReq.signal, execute, (value) => value.evidence, () => manager.retryCleanupFailures());
+        if (!result.ok) {
+            const partial = result.error.partialObservation;
+            const parsed = evidenceSchema.safeParse(partial);
+            if (parsed.success) {
+                const recorded = recordEvidence?.(parsed.data);
+                if (recorded !== undefined)
+                    return delivery.toRecordedPartialErrorToolResult(result.error, parsed.data.evidence_id, recorded, consoleContract.returnsTargetContent);
+            }
+            return delivery.toCallToolResult(result, consoleContract);
+        }
+        const recorded = recordEvidence?.(result.value.evidence);
+        return delivery.toEvidenceToolResult(result.value.evidence, consoleContract, recorded);
+    });
+    server.registerTool(status.name, toolRegistrationOptions(status), async (input) => {
+        const result = manager.status(input.session_id);
+        if (result === undefined)
+            return delivery.toCallToolResult(err(invalidSession("gdb_session_status")), status);
+        return delivery.toCallToolResult({
+            ok: true,
+            value: {
+                ...result,
+                recent_mi_records: [...result.recent_mi_records],
+            },
+        }, status);
+    });
+    server.registerTool(close.name, toolRegistrationOptions(close), async (input, context) => {
+        const result = await runOwnedCleanupWithExternalMutationAdmission(session, close.name, context.mcpReq.signal, input.session_id, () => logToolExecution(logger, close.name, () => manager.close(input.session_id)));
+        return result.ok
+            ? delivery.toCallToolResult({ ok: true, value: result.value }, close)
+            : delivery.toCallToolResult(result, close);
+    });
+};
+const invalidSession = (operation) => new AnalysisInputError(operation);

package/dist/server/registerGoTools.js

@@ -0,0 +1,9 @@
+import { toolContract } from "../contracts/toolContracts.js";
+import { createEvidenceToolHandler } from "./contractToolHandler.js";
+import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
+/** Bind the exact Go contract to its shared workflow and owning session Evidence ledger. */
+export const registerGoTools = (server, service, logger, recordEvidence, withAdmittedAnalysis) => {
+    const contract = toolContract("inspect_go_binary");
+    const handler = createEvidenceToolHandler(server, (input, options) => service.inspect(input, options), logger, recordEvidence, withAdmittedAnalysis);
+    server.registerTool(contract.name, toolRegistrationOptions(contract), handler(contract));
+};

package/dist/server/registerInvestigationTools/helpers.js

@@ -1,14 +1,14 @@
 import { EvidenceIntegrityError } from "../../domain/evidenceErrors.js";
-import {} from "../../domain/analysisErrorBase.js";
 import { err, ok } from "../../domain/result.js";
 import { recordDerivedEvidence } from "../recordDerivedEvidence.js";
+import { compareUnicodeCodePoints } from "../../domain/unicodeCodePointOrder.js";
 export const isIncomplete = (status) => status === "unknown" || status === "truncated";
 export const comparisonClosure = (comparisons) => uniqueIds(comparisons.flatMap((evidence) => [
     evidence.evidence_id,
     ...evidence.evidence_links,
 ]));
 export const functionEvidenceIds = (records) => uniqueIds(records.map(({ evidence_id }) => evidence_id));
-const uniqueIds = (ids) => [...new Set(ids)].sort((left, right) => left.localeCompare(right));
+const uniqueIds = (ids) => [...new Set(ids)].sort((left, right) => compareUnicodeCodePoints(left, right));
 export const evidenceClosure = (session, seedIds) => {
     const records = new Map(session
         .exportEvidenceBundle()