rea-agents 6.4.0 → 6.5.0

package/dist/server/registerInvestigationTools.js

@@ -7,7 +7,7 @@ import { correlateStaticAndRuntime } from "../domain/staticRuntimeCorrelation.js
 import { comparisonClosure, evidenceClosure, functionEvidenceIds, isIncomplete, recordWorkflowEvidence, } from "./registerInvestigationTools/helpers.js";
 import { runDerivedOperation } from "./runDerivedOperation.js";
 import { CALL_PATH_PROVIDER, CHANGED_BEHAVIOR_PROVIDER, RECONSTRUCTION_PROVIDER, STATIC_RUNTIME_PROVIDER, } from "../application/InvestigationProviders.js";
-import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
+import { applicationValidatedInputSchema, toolRegistrationOptions, } from "./toolRegistrationOptions.js";
 import { verifyReconstruction } from "../domain/reconstructionVerification.js";
 /** Register Evidence-composed differential investigation workflows. */
 export const registerInvestigationTools = (server, session) => {
@@ -17,20 +17,24 @@ export const registerInvestigationTools = (server, session) => {
     registerReconstruction(server, session, toolContract("verify_reconstruction"));
 };
 const registerChangedBehavior = (server, session, contract) => {
-    server.registerTool(contract.name, toolRegistrationOptions(contract), async (input, context) => {
-        const closure = evidenceClosure(session, comparisonClosure(input.comparisons));
+    const registration = toolRegistrationOptions(contract);
+    server.registerTool(contract.name, {
+        ...registration,
+        inputSchema: applicationValidatedInputSchema(registration.inputSchema),
+    }, async (input, context) => {
+        const computed = await runDerivedOperation(context, contract.name, () => findChangedBehavior(input));
+        if (!computed.ok)
+            return server.delivery.toCallToolResult(computed, contract);
+        const { result, comparisonEvidenceIds } = computed.value;
+        const closure = evidenceClosure(session, result.evidence_links);
         if (!closure.ok)
             return server.delivery.toCallToolResult(closure, contract);
         const links = closure.value;
-        const computed = await runDerivedOperation(context, contract.name, () => findChangedBehavior(input.comparisons));
-        if (!computed.ok)
-            return server.delivery.toCallToolResult(computed, contract);
-        const result = computed.value;
         const evidence = createEvidence(undefined, CHANGED_BEHAVIOR_PROVIDER, {
             predicateType: "rea.changed-behavior",
             operation: contract.name,
             parameters: {
-                comparison_evidence_ids: input.comparisons.map(({ evidence_id: id }) => id),
+                comparison_evidence_ids: [...comparisonEvidenceIds],
             },
             result: jsonValueSchema.parse(result),
             confidence: "derived",

package/dist/server/registerJavaScriptRuntimeObservationTools.js

@@ -2,7 +2,6 @@ import { optionalProviderUnavailable, } from "../application/OptionalObservation
 import { err } from "../domain/result.js";
 import { listJavaScriptRuntimeTargets, observeJavaScriptRuntime, } from "../application/javascript/JavaScriptRuntimeObservationService.js";
 import { toolContract } from "../contracts/toolContracts.js";
-import { observeJavaScriptRuntimeInputSchema } from "../domain/javascript/javascriptRuntimeObservation.js";
 import { logToolExecution } from "./toolLogging.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
 import { runAdmittedToolOperation } from "./admittedToolOperation.js";
@@ -12,10 +11,7 @@ export const registerJavaScriptRuntimeObservationTools = (server, options) => {
     const listContract = toolContract("list_javascript_runtime_targets");
     const observeContract = toolContract("observe_javascript_runtime");
     server.registerTool(listContract.name, toolRegistrationOptions(listContract), (input, context) => runRuntimeTool(registration, listContract, { input, context }, (parsed, signal) => listJavaScriptRuntimeTargets(options.runtime, parsed, { signal })));
-    server.registerTool(observeContract.name, toolRegistrationOptions(observeContract), (input, context) => runRuntimeTool(registration, observeContract, { input, context }, async (parsed, signal) => {
-        const request = observeJavaScriptRuntimeInputSchema.parse(parsed);
-        return observeJavaScriptRuntime(options.runtime, request, { signal });
-    }));
+    server.registerTool(observeContract.name, toolRegistrationOptions(observeContract), (input, context) => runRuntimeTool(registration, observeContract, { input, context }, (parsed, signal) => observeJavaScriptRuntime(options.runtime, parsed, { signal })));
 };
 const runRuntimeTool = async (options, contract, request, execute) => {
     const { input, context } = request;

package/dist/server/registerManagedTools.js

@@ -2,11 +2,18 @@ import { MANAGED_TOOL_CONTRACTS } from "../contracts/managed/managedToolContract
 import { AnalysisInputError } from "../domain/analysisErrorCore.js";
 import { err } from "../domain/result.js";
 import { registerEvidenceTools } from "./registerEvidenceTools.js";
+import { retainedSummaryDelivery, withoutDeliveryDetail, } from "./retainedSummaryDelivery.js";
 import { runManagedProviderExecution } from "../composition/directAnalysis.js";
 import { isManagedToolName } from "../contracts/managed/managedToolContracts.js";
+/** Operations whose MCP delivery may be a retained summary view. */
+const SUMMARY_DELIVERY = new Set([
+    "inspect_managed_artifact",
+    "inspect_managed_members",
+]);
 /** Register execution-free managed PE/CLI inspection. */
 export const registerManagedTools = (server, options) => {
     let selectedManagedPath;
+    const withoutDelivery = withoutDeliveryDetail(SUMMARY_DELIVERY);
     const analysisForAdmission = (analysis) => ({
         execute: async (operation, parameters, executionOptions) => {
             if (!isManagedToolName(operation))
@@ -27,7 +34,7 @@ export const registerManagedTools = (server, options) => {
                         message: "Provide a managed PE/CLI path or first select one with inspect_managed_artifact.",
                     },
                 ]));
-            const execution = await runManagedProviderExecution(path, operation, executionOptions?.signal);
+            const execution = await runManagedProviderExecution(path, operation, executionOptions?.signal, parameters);
             if (execution.ok && typeof requestedPath === "string")
                 selectedManagedPath = requestedPath;
             return execution;
@@ -35,6 +42,9 @@ export const registerManagedTools = (server, options) => {
     });
     registerEvidenceTools(server, MANAGED_TOOL_CONTRACTS, {
         ...options,
+        ...retainedSummaryDelivery(SUMMARY_DELIVERY, options),
+        parametersForExecution: withoutDelivery,
+        parametersForEvidence: withoutDelivery,
         analysisForAdmission,
     });
 };

package/dist/server/registerNativeTools.js

@@ -0,0 +1,14 @@
+import { NATIVE_TOOL_CONTRACTS } from "../contracts/native/nativeToolContracts.js";
+import { registerEvidenceTools } from "./registerEvidenceTools.js";
+import { retainedSummaryDelivery, withoutDeliveryDetail, } from "./retainedSummaryDelivery.js";
+const SUMMARY_DELIVERY = new Set(["inspect_macho"]);
+/** Register macOS native contracts; Mach-O inspection can deliver a retained summary. */
+export const registerNativeTools = (server, options) => {
+    const withoutDelivery = withoutDeliveryDetail(SUMMARY_DELIVERY);
+    registerEvidenceTools(server, NATIVE_TOOL_CONTRACTS, {
+        ...options,
+        ...retainedSummaryDelivery(SUMMARY_DELIVERY, options),
+        parametersForExecution: withoutDelivery,
+        parametersForEvidence: withoutDelivery,
+    });
+};

package/dist/server/registerOfficialTools.js

@@ -37,6 +37,11 @@ const registerOfficialTool = (server, contract, registration) => {
                     : { analysisProfile: result.value.analysisProfile }),
                 rawResult: result.value.rawResult,
                 limitations: result.value.limitations,
+                ...(result.value.relationshipCoverage === undefined
+                    ? {}
+                    : {
+                        relationshipCoverage: result.value.relationshipCoverage,
+                    }),
                 locations: result.value.locations,
             });
             const recorded = registration.recordEvidence?.(evidence);

package/dist/server/registerPcapTools.js

@@ -0,0 +1,35 @@
+import { PcapAnalysisService } from "../application/pcap/PcapAnalysisService.js";
+import { toolContract } from "../contracts/toolContracts.js";
+import { createContractToolHandler, createEvidenceToolHandler, } from "./contractToolHandler.js";
+import { toolRegistrationOptions, applicationValidatedInputSchema, } from "./toolRegistrationOptions.js";
+import { requireAnalysisViewRetention, summarizeRetainedAnalysis, } from "../application/analysisView/AnalysisViewService.js";
+import { analysisInputErrorFromIssues } from "../domain/inputIssueProjection.js";
+import { err } from "../domain/result.js";
+/** Bind pcap handlers to their exact named contracts through admission. */
+export const registerPcapTools = (server, service, logger, recordEvidence, withAdmittedAnalysis, evidenceById) => {
+    const handler = createContractToolHandler(server, service, logger, recordEvidence, withAdmittedAnalysis);
+    const clientContract = toolContract("inspect_pcap_client");
+    server.registerTool(clientContract.name, toolRegistrationOptions(clientContract), handler(clientContract));
+    const contract = toolContract("inspect_pcap_capture");
+    const registration = toolRegistrationOptions(contract);
+    const capture = createEvidenceToolHandler(server, async (rawInput, options) => {
+        const parsed = contract.inputSchema.safeParse(rawInput);
+        if (!parsed.success)
+            return err(analysisInputErrorFromIssues(contract.name, parsed.error.issues, rawInput, { cause: parsed.error }));
+        const { detail, ...input } = parsed.data;
+        const retention = { recordEvidence, evidenceById };
+        if (detail === "summary") {
+            const ready = requireAnalysisViewRetention(contract.name, retention);
+            if (!ready.ok)
+                return ready;
+        }
+        const result = await service.execute(contract.name, input, options);
+        return detail === "summary" && result.ok
+            ? summarizeRetainedAnalysis(result.value, retention)
+            : result;
+    }, logger, recordEvidence, withAdmittedAnalysis);
+    server.registerTool(contract.name, {
+        ...registration,
+        inputSchema: applicationValidatedInputSchema(registration.inputSchema),
+    }, capture(contract));
+};

package/dist/server/registerProcessComparisonTool.js

@@ -1,6 +1,5 @@
 import { toolContract } from "../contracts/toolContracts.js";
 import { AnalysisInputError } from "../domain/analysisErrorCore.js";
-import {} from "../domain/analysisErrorBase.js";
 import { describeValidationFailure } from "../domain/evidenceBundle.js";
 import { EvidenceIntegrityError } from "../domain/evidenceErrors.js";
 import { createEvidence, parseEvidence, } from "../domain/evidence.js";
@@ -11,7 +10,7 @@ import { err, ok } from "../domain/result.js";
 import { recordDerivedEvidence } from "./recordDerivedEvidence.js";
 import { recordSessionEvidenceSources } from "./sessionEvidence.js";
 import { runDerivedOperation } from "./runDerivedOperation.js";
-import { PROCESS_PROVIDER } from "../domain/process/processEvidenceProvider.js";
+import { PROCESS_PROVIDER, isProcessEvidenceProvider, } from "../domain/process/processEvidenceProvider.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
 import { withAdmittedAnalysis } from "./analysisAdmission.js";
 import { runAdmittedToolOperation } from "./admittedToolOperation.js";
@@ -44,6 +43,14 @@ const parseCaptureSide = (operation, side, value) => {
                 message: `Expected process capture Evidence (operation ${PROCESS_CAPTURE_EVIDENCE.operation}, predicate ${PROCESS_CAPTURE_EVIDENCE.predicate}); the ${side} Evidence has operation ${record.operation} and predicate ${record.predicate_type}.`,
             },
         ]));
+    if (!isProcessEvidenceProvider(record.provider))
+        return err(new AnalysisInputError(operation, undefined, [
+            {
+                path: [side, "provider"],
+                reason: "invalid_value",
+                message: `The ${side} Evidence provider ${record.provider.id} v${record.provider.version} (${record.provider.name}) is not the current or supported legacy ${PROCESS_PROVIDER.id} v${PROCESS_PROVIDER.version} process capture provider.`,
+            },
+        ]));
     try {
         return ok({
             record,

package/dist/server/registerReverseEngineeringTools.js

@@ -0,0 +1,86 @@
+import { projectAnalysisError } from "../domain/analysisErrorProjection.js";
+import { toolContract } from "../contracts/toolContracts.js";
+import { logToolExecution } from "./toolLogging.js";
+import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
+import { rizinInputSchema } from "../domain/reverseEngineering.js";
+import { AnalysisOutputError } from "../domain/analysisErrorCore.js";
+/** Register objdump and Rizin operations against their exact named contracts. */
+export const registerReverseEngineeringTools = (server, service, logger, delivery, recordEvidence, withAdmittedAnalysis, invalidateSnapshotForExternalMutation, withAdmittedExternalMutation) => {
+    const objdump = toolContract("inspect_with_objdump");
+    const rizin = toolContract("execute_rizin_command");
+    server.registerTool(objdump.name, toolRegistrationOptions(objdump), (input, context) => runAdmitted(objdump, context, withAdmittedAnalysis, delivery, async () => {
+        const result = await logToolExecution(logger, objdump.name, () => service.inspectWithObjdump(input, {
+            signal: context.mcpReq.signal,
+        }));
+        if (!result.ok)
+            return deliverFailure(result.error, objdump, delivery, recordEvidence);
+        return delivery.toEvidenceToolResult(result.value, objdump, recordEvidence?.(result.value));
+    }));
+    server.registerTool(rizin.name, toolRegistrationOptions(rizin), async (input, context) => {
+        const parsed = rizinInputSchema.safeParse(input);
+        if (parsed.success && withAdmittedExternalMutation !== undefined) {
+            const cleanup = await service.retryCleanup(rizin.name);
+            if (!cleanup.ok)
+                return deliverFailure(cleanup.error, rizin, delivery, recordEvidence);
+            const admitted = await withAdmittedExternalMutation(parsed.data.path, context.mcpReq.signal, async () => {
+                invalidateSnapshotForExternalMutation?.();
+                return logToolExecution(logger, rizin.name, () => service.executeRizinCommand(parsed.data, {
+                    signal: context.mcpReq.signal,
+                }));
+            }, (value, cause) => {
+                if (!value.ok)
+                    return value.error.retainSecondaryFailure(cause, {
+                        retirement_error: projectAnalysisError(cause),
+                    });
+                const observation = value.value;
+                return new AnalysisOutputError(rizin.name, "Rizin may have changed the bound artifact, but the active analysis session could not be retired.", {
+                    cause,
+                    ...(cause.cleanup === undefined
+                        ? {}
+                        : { cleanup: cause.cleanup }),
+                    ...(cause.capturedOutput === undefined
+                        ? {}
+                        : { capturedOutput: cause.capturedOutput }),
+                    ...(observation === undefined
+                        ? {}
+                        : { partialObservation: observation }),
+                });
+            });
+            if (!admitted.ok)
+                return deliverFailure(admitted.error, rizin, delivery, recordEvidence);
+            const result = admitted.value;
+            if (!result.ok)
+                return deliverFailure(result.error, rizin, delivery, recordEvidence);
+            return delivery.toEvidenceToolResult(result.value, rizin, recordEvidence?.(result.value));
+        }
+        return runAdmitted(rizin, context, withAdmittedAnalysis, delivery, async () => {
+            if (invalidateSnapshotForExternalMutation !== undefined &&
+                rizinInputSchema.safeParse(input).success)
+                invalidateSnapshotForExternalMutation();
+            const result = await logToolExecution(logger, rizin.name, () => service.executeRizinCommand(input, {
+                signal: context.mcpReq.signal,
+            }));
+            if (!result.ok)
+                return deliverFailure(result.error, rizin, delivery, recordEvidence);
+            return delivery.toEvidenceToolResult(result.value, rizin, recordEvidence?.(result.value));
+        });
+    });
+};
+const runAdmitted = async (contract, context, admission, delivery, operation) => {
+    if (admission === undefined)
+        return operation();
+    const admitted = await admission(contract.name, context.mcpReq.signal, async () => operation());
+    return admitted.ok
+        ? admitted.value
+        : delivery.toErrorToolResult(admitted.error, contract.returnsTargetContent);
+};
+const deliverFailure = (error, contract, delivery, recordEvidence) => {
+    const partial = error.partialObservation;
+    if (isEvidence(partial) && recordEvidence !== undefined)
+        return delivery.toRecordedPartialErrorToolResult(error, partial.evidence_id, recordEvidence(partial), contract.returnsTargetContent);
+    return delivery.toErrorToolResult(error, contract.returnsTargetContent);
+};
+const isEvidence = (value) => typeof value === "object" &&
+    value !== null &&
+    "evidence_id" in value &&
+    typeof value.evidence_id === "string";

package/dist/server/registerRizinDebugTools.js

@@ -0,0 +1,53 @@
+import { toolContract } from "../contracts/toolContracts.js";
+import { AnalysisInputError } from "../domain/analysisErrorCore.js";
+import { evidenceSchema } from "../domain/evidence.js";
+import { runOwnedCleanupWithExternalMutationAdmission, runWithExternalMutationAdmission, } from "./externalMutationAdmission.js";
+import { logToolExecution } from "./toolLogging.js";
+import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
+/** Register persistent Rizin debugger operations on the existing REA MCP server. */
+export const registerRizinDebugTools = (server, manager, logger, delivery, recordEvidence, session) => {
+    const start = toolContract("start_rizin_debug_session");
+    const command = toolContract("rizin_debug_command");
+    const status = toolContract("rizin_debug_session_status");
+    const close = toolContract("close_rizin_debug_session");
+    server.registerTool(start.name, toolRegistrationOptions(start), async (input, context) => {
+        const result = await runWithExternalMutationAdmission(session, start.name, context.mcpReq.signal, () => logToolExecution(logger, start.name, () => manager.start({
+            path: input.path,
+            inferior_tty: input.inferior_tty,
+            ...(input.backend === undefined
+                ? {}
+                : { backend: input.backend }),
+        }, context.mcpReq.signal)), undefined, () => manager.retryCleanupFailures(), (value) => ({ session_id: value.session_id }));
+        return result.ok
+            ? delivery.toCallToolResult({ ok: true, value: result.value }, start)
+            : delivery.toCallToolResult(result, start);
+    });
+    server.registerTool(command.name, toolRegistrationOptions(command), async (input, context) => {
+        const result = await runWithExternalMutationAdmission(session, command.name, context.mcpReq.signal, () => logToolExecution(logger, command.name, () => manager.execute(input.session_id, input.command, context.mcpReq.signal)), (value) => value.evidence, () => manager.retryCleanupFailures());
+        if (!result.ok) {
+            const partial = evidenceSchema.safeParse(result.error.partialObservation);
+            if (partial.success) {
+                const recorded = recordEvidence?.(partial.data);
+                if (recorded !== undefined)
+                    return delivery.toRecordedPartialErrorToolResult(result.error, partial.data.evidence_id, recorded, command.returnsTargetContent);
+            }
+            return delivery.toCallToolResult(result, command);
+        }
+        return delivery.toEvidenceToolResult(result.value.evidence, command, recordEvidence?.(result.value.evidence));
+    });
+    server.registerTool(status.name, toolRegistrationOptions(status), async (input) => {
+        const result = manager.status(input.session_id);
+        if (result === undefined)
+            return delivery.toCallToolResult({ ok: false, error: new AnalysisInputError(status.name) }, status);
+        return delivery.toCallToolResult({
+            ok: true,
+            value: { ...result, recent_output: [...result.recent_output] },
+        }, status);
+    });
+    server.registerTool(close.name, toolRegistrationOptions(close), async (input, context) => {
+        const result = await runOwnedCleanupWithExternalMutationAdmission(session, close.name, context.mcpReq.signal, input.session_id, () => logToolExecution(logger, close.name, () => manager.close(input.session_id)));
+        return result.ok
+            ? delivery.toCallToolResult({ ok: true, value: result.value }, close)
+            : delivery.toCallToolResult(result, close);
+    });
+};

package/dist/server/registerRustTools.js

@@ -0,0 +1,9 @@
+import { toolContract } from "../contracts/toolContracts.js";
+import { createEvidenceToolHandler } from "./contractToolHandler.js";
+import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
+/** Bind the exact Rust contract to its shared workflow and owning session Evidence ledger. */
+export const registerRustTools = (server, service, logger, recordEvidence, withAdmittedAnalysis) => {
+    const contract = toolContract("inspect_rust_binary");
+    const handler = createEvidenceToolHandler(server, (input, options) => service.inspect(input, options), logger, recordEvidence, withAdmittedAnalysis);
+    server.registerTool(contract.name, toolRegistrationOptions(contract), handler(contract));
+};

package/dist/server/registerSessionRecordTools.js

@@ -1,18 +1,21 @@
-import { readEvidenceBundle, writeEvidenceBundle, } from "../application/EvidenceBundleFiles.js";
+import { readImmutableEvidenceBundle, writeEvidenceBundle, } from "../application/EvidenceBundleFiles.js";
 import { toolContract } from "../contracts/toolContracts.js";
-import { ok } from "../domain/result.js";
+import { err, ok } from "../domain/result.js";
+import { AnalysisCancelledError } from "../domain/analysisErrorCore.js";
 import { inspectEvidenceBundle } from "../application/investigation/InspectEvidenceBundle.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
+import { withAdmittedAnalysis } from "./analysisAdmission.js";
+import { runAdmittedToolOperation } from "./admittedToolOperation.js";
 /** Register evidence bundle import and export tools. */
 export const registerEvidenceTools = (registration) => {
     registerExportEvidenceTool(registration);
     registerImportEvidenceTool(registration);
     registerSnapshotEvidenceTool(registration);
 };
-const registerExportEvidenceTool = ({ server, session, exportContract, }) => {
+const registerExportEvidenceTool = ({ server, session, resources, exportContract, }) => {
     server.registerTool(exportContract.name, toolRegistrationOptions(exportContract), async (input, context) => {
         const bundle = bundleForSerialization(session);
-        const written = await writeEvidenceBundle(bundle, input.path, input.overwrite, context.mcpReq.signal);
+        const written = await writeEvidenceBundle(bundle, input.path, input.overwrite, resources, context.mcpReq.signal);
         return written.ok
             ? server.delivery.toCallToolResult(ok({
                 path: written.value.path,
@@ -26,13 +29,17 @@ const registerExportEvidenceTool = ({ server, session, exportContract, }) => {
 const registerSnapshotEvidenceTool = ({ server, session, snapshotContract, }) => {
     server.registerTool(snapshotContract.name, toolRegistrationOptions(snapshotContract), (input) => server.delivery.toCallToolResult(inspectEvidenceBundle(bundleForSerialization(session), input), snapshotContract));
 };
-const registerImportEvidenceTool = ({ server, session, importContract, }) => {
-    server.registerTool(importContract.name, toolRegistrationOptions(importContract), async (input) => {
+const registerImportEvidenceTool = ({ server, session, resources, importContract, }) => {
+    const admission = withAdmittedAnalysis({ kind: "session", session });
+    server.registerTool(importContract.name, toolRegistrationOptions(importContract), async (input, context) => runAdmittedToolOperation(server, admission, importContract.name, context.mcpReq.signal, async () => {
         const path = input.path;
-        const loaded = await readEvidenceBundle(path);
+        const signal = context.mcpReq.signal;
+        const loaded = await readImmutableEvidenceBundle(path, signal, resources);
         if (!loaded.ok)
             return server.delivery.toCallToolResult(loaded, importContract);
         const retainedUnknownRevisions = new Set(bundleForSerialization(session).unknowns.map((unknown) => unknownRevisionKey(unknown)));
+        if (signal.aborted)
+            return server.delivery.toCallToolResult(err(new AnalysisCancelledError("import_evidence_bundle")), importContract);
         const imported = session.importEvidenceBundle(loaded.value);
         return imported.ok
             ? server.delivery.toCallToolResult(ok({
@@ -41,7 +48,7 @@ const registerImportEvidenceTool = ({ server, session, importContract, }) => {
                 total: bundleForSerialization(session).records.length,
             }), importContract)
             : server.delivery.toCallToolResult(imported, importContract);
-    });
+    }));
 };
 const bundleForSerialization = (session) => session.evidenceBundleForSerialization?.() ?? session.exportEvidenceBundle();
 const unknownRevisionKey = (unknown) => `${unknown.unknown_id}:${String(unknown.revision)}`;
@@ -49,15 +56,14 @@ const unknownRevisionKey = (unknown) => `${unknown.unknown_id}:${String(unknown.
 const registerListUnknownsTool = ({ server, session, }) => {
     const listContract = toolContract("list_unknowns");
     server.registerTool(listContract.name, toolRegistrationOptions(listContract), (input) => {
-        const all = session.listUnknowns({
+        const page = session.listUnknownsPage({
             ...(input.status === undefined ? {} : { status: input.status }),
             ...(input.severity === undefined ? {} : { severity: input.severity }),
             ...(input.domain === undefined ? {} : { domain: input.domain }),
+            offset: input.offset,
+            ...(input.limit === undefined ? {} : { limit: input.limit }),
         });
-        return server.delivery.toCallToolResult(ok({
-            items: all,
-            total: all.length,
-        }), listContract);
+        return server.delivery.toCallToolResult(ok(page), listContract);
     });
 };
 const registerRecordUnknownTool = ({ server, session, }) => {

package/dist/server/registerSessionStatusTool.js

@@ -1,19 +1,29 @@
 import { AnalysisCancelledError } from "../domain/analysisErrorCore.js";
-import { buildCapabilityInventory } from "../application/CapabilityInventory.js";
+import { buildCapabilityInventory, compactToolAvailability, } from "../application/CapabilityInventory.js";
 import { toolContract } from "../contracts/toolContracts.js";
 import { jsonObjectSchema } from "../domain/jsonValue.js";
 import { createServerIdentity } from "../serverIdentity.js";
 import { mcpClientMetadata } from "./mcpClientMetadata.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
 import { err } from "../domain/result.js";
+import { CURRENT_ENTRYPOINT_PATH } from "../process/CurrentEntrypointPath.js";
 /** Register the read-only provider and target status operation. */
 export const registerSessionStatusTool = (options) => {
-    const { server, session, contract, startedAt, availabilityPolicy, androidAnalysisAvailability, } = options;
+    const { server, session, contract, startedAt, availabilityPolicy, androidAnalysisAvailability, adbAnalysisAvailability, apktoolAnalysisAvailability, } = options;
     server.registerTool(contract.name, toolRegistrationOptions(contract), async (input, context) => {
         const { client, clientFeatures, protocolVersion } = mcpClientMetadata(context, server.server);
         let androidAvailability;
+        let adbAvailability;
+        let apktoolAvailability;
         try {
-            androidAvailability = await androidAnalysisAvailability(context.mcpReq.signal);
+            const [android, adb, apktool] = await Promise.all([
+                androidAnalysisAvailability(context.mcpReq.signal),
+                adbAnalysisAvailability?.(context.mcpReq.signal) ?? undefined,
+                apktoolAnalysisAvailability?.(context.mcpReq.signal) ?? undefined,
+            ]);
+            androidAvailability = android;
+            adbAvailability = adb;
+            apktoolAvailability = apktool;
         }
         catch (cause) {
             if (!context.mcpReq.signal.aborted)
@@ -25,9 +35,17 @@ export const registerSessionStatusTool = (options) => {
         const toolAvailability = buildCapabilityInventory(status, {
             ...availabilityPolicy(),
             androidAnalysisAvailability: androidAvailability,
+            ...(adbAvailability === undefined
+                ? {}
+                : { adbAnalysisAvailability: adbAvailability }),
+            ...(apktoolAvailability === undefined
+                ? {}
+                : { apktoolAnalysisAvailability: apktoolAvailability }),
         }, clientFeatures);
         const serverIdentity = createServerIdentity({
             startedAt,
+            commandPath: CURRENT_ENTRYPOINT_PATH,
+            catalog: server.catalogIdentity,
             expected: {
                 ...(input.expected_package_version === undefined
                     ? {}
@@ -55,7 +73,7 @@ export const registerSessionStatusTool = (options) => {
 };
 const projectSessionStatus = (options) => jsonObjectSchema.parse({
     ...options.status,
-    tool_availability: options.toolAvailability,
+    tool_availability: compactToolAvailability(options.toolAvailability),
     client_features: options.clientFeatures,
     server_identity: options.serverIdentity,
 });

package/dist/server/registerSessionTools.js

@@ -5,8 +5,8 @@ import { captureProcessScenario } from "../process/capture/ProcessHarness.js";
 import { ProcessCaptureResourceScope } from "../process/capture/ProcessCaptureLifecycle.js";
 import { ProcessCaptureError } from "../process/capture/ProcessCaptureError.js";
 import { toolContract } from "../contracts/toolContracts.js";
+import { binaryTargetSummary } from "../application/binary/BinaryTargetSummary.js";
 import { UnknownRegistryError } from "../domain/unknownRegistryError.js";
-import {} from "../domain/analysisErrorBase.js";
 import { err, ok } from "../domain/result.js";
 import { mcpProgressReporter } from "./mcpProgress.js";
 import { registerArtifactComparisonTool } from "./registerArtifactComparisonTool.js";
@@ -65,9 +65,9 @@ const registerProcessTools = ({ server, session, logger, captureContract, resour
         return server.delivery.toEvidenceToolResult(evidence, captureContract, recorded);
     }));
 };
-const registerLifecycleTools = (registration) => {
-    const { server, session, statusContract, startedAt, availabilityPolicy, androidAnalysisAvailability, } = registration;
-    registerOpenLifecycleTool(registration);
+const registerLifecycleTools = (registration, artifactResources) => {
+    const { server, session, statusContract, startedAt, availabilityPolicy, androidAnalysisAvailability, adbAnalysisAvailability, apktoolAnalysisAvailability, } = registration;
+    registerOpenLifecycleTool(registration, artifactResources);
     registerCloseLifecycleTool(registration);
     registerSessionStatusTool({
         server,
@@ -76,13 +76,19 @@ const registerLifecycleTools = (registration) => {
         startedAt,
         availabilityPolicy,
         androidAnalysisAvailability,
+        ...(adbAnalysisAvailability === undefined
+            ? {}
+            : { adbAnalysisAvailability }),
+        ...(apktoolAnalysisAvailability === undefined
+            ? {}
+            : { apktoolAnalysisAvailability }),
     });
 };
-const registerOpenLifecycleTool = ({ server, session, logger, openContract, }) => {
+const registerOpenLifecycleTool = ({ server, session, logger, openContract }, artifactResources) => {
     server.registerTool(openContract.name, toolRegistrationOptions(openContract), async (input, context) => {
         let snapshot;
         if (input.snapshot_path !== undefined) {
-            const loaded = await readAnalysisSnapshot(input.snapshot_path);
+            const loaded = await readAnalysisSnapshot(input.snapshot_path, context.mcpReq.signal, artifactResources);
             if (!loaded.ok)
                 return server.delivery.toCallToolResult(loaded, openContract);
             snapshot = loaded.value;
@@ -90,6 +96,12 @@ const registerOpenLifecycleTool = ({ server, session, logger, openContract, }) =
         const opened = await logToolExecution(logger, openContract.name, () => session.open(input.path, {
             signal: context.mcpReq.signal,
             ...(input.format === undefined ? {} : { formatHint: input.format }),
+            ...(input.architecture === undefined
+                ? {}
+                : { architecture: input.architecture }),
+            ...(input.entry_point === undefined
+                ? {}
+                : { entryPoint: input.entry_point }),
             ...(input.provider_id === undefined
                 ? {}
                 : { providerId: input.provider_id }),
@@ -98,13 +110,7 @@ const registerOpenLifecycleTool = ({ server, session, logger, openContract, }) =
         return opened.ok
             ? server.delivery.toCallToolResult({
                 ok: true,
-                value: {
-                    path: opened.value.path,
-                    format: opened.value.format,
-                    kind: opened.value.kind,
-                    sha256: opened.value.sha256,
-                    architecture: opened.value.architecture ?? null,
-                },
+                value: binaryTargetSummary(opened.value),
             }, openContract)
             : server.delivery.toCallToolResult(opened, openContract);
     });
@@ -125,7 +131,7 @@ const registerContextTools = (server, session) => {
             : server.delivery.toCallToolResult(admitted, addressContract);
     });
 };
-export const registerSessionTools = (server, session, logger, options = {}) => {
+export const registerSessionTools = (server, session, logger, options) => {
     const openContract = toolContract("open_binary");
     const closeContract = toolContract("close_binary");
     const statusContract = toolContract("binary_session");
@@ -148,6 +154,12 @@ export const registerSessionTools = (server, session, logger, options = {}) => {
         startedAt: options.startedAt ?? new Date().toISOString(),
         availabilityPolicy: sessionAvailabilityPolicy(options.availabilityPolicy, {}),
         androidAnalysisAvailability: options.androidAnalysisAvailability ?? missingAndroidAvailability,
+        ...(options.adbAnalysisAvailability === undefined
+            ? {}
+            : { adbAnalysisAvailability: options.adbAnalysisAvailability }),
+        ...(options.apktoolAnalysisAvailability === undefined
+            ? {}
+            : { apktoolAnalysisAvailability: options.apktoolAnalysisAvailability }),
         closeProcessResources: async () => {
             try {
                 await processResources.retryCleanup();
@@ -164,10 +176,11 @@ export const registerSessionTools = (server, session, logger, options = {}) => {
                 }));
             }
         },
-    });
+    }, options.artifactResources);
     registerEvidenceTools({
         server,
         session,
+        resources: options.artifactResources,
         exportContract,
         importContract,
         snapshotContract,
@@ -203,7 +216,7 @@ export const registerSessionTools = (server, session, logger, options = {}) => {
     registerProcessComparisonTool(server, session, compareContract);
     registerArtifactComparisonTool(server, session, compareArtifactsContract);
     registerFunctionComparisonTool(server, session, compareFunctionsContract);
-    registerBundleComparisonTool(server, session, compareBundlesContract);
+    registerBundleComparisonTool(server, session, compareBundlesContract, options.artifactResources);
     registerInvestigationTools(server, session);
     registerUnknownTools({ server, session });
     registerContextTools(server, session);

package/dist/server/registerSignalTools.js

@@ -0,0 +1,12 @@
+import { toolContract } from "../contracts/toolContracts.js";
+import { createEvidenceToolHandler } from "./contractToolHandler.js";
+import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
+/** Bind the named signal contract through shared admission and retained Evidence delivery. */
+export const registerSignalTools = (server, service, logger, recordEvidence, withAdmittedAnalysis) => {
+    const contract = toolContract("decode_signal_recording");
+    const handler = createEvidenceToolHandler(server, (input, options) => service.decode(input, options), logger, recordEvidence, withAdmittedAnalysis);
+    server.registerTool(contract.name, toolRegistrationOptions(contract), handler(contract));
+    const discovery = toolContract("inspect_signal_decoders");
+    const discover = createEvidenceToolHandler(server, (input, options) => service.inspectDecoders(input, options), logger, recordEvidence, withAdmittedAnalysis);
+    server.registerTool(discovery.name, toolRegistrationOptions(discovery), discover(discovery));
+};

package/dist/server/registerSqliteTools.js

@@ -0,0 +1,9 @@
+import { toolContract } from "../contracts/toolContracts.js";
+import { createEvidenceToolHandler } from "./contractToolHandler.js";
+import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
+/** Bind snapshot inspection to its named contract and additive session Evidence. */
+export const registerSqliteTools = (server, service, logger, recordEvidence, withAdmittedAnalysis) => {
+    const contract = toolContract("inspect_sqlite_database");
+    const handler = createEvidenceToolHandler(server, (input, options) => service.inspect(input, options), logger, recordEvidence, withAdmittedAnalysis);
+    server.registerTool(contract.name, toolRegistrationOptions(contract), handler(contract));
+};