fix(resources)!: inspect app resources without an executable

Add a read-only app resource session shared by CLI and MCP. Preserve resource-root provenance without inventing executable identity, reject binary-only snapshots and operations, and retain failed cleanup owners across switches and retries.

Keep filesystem admission failures typed and preserve cancellation ordering from observed cleanup facts. Document resource routing in the packaged investigation skill.

BREAKING CHANGE: resource-only observations may have a null Evidence subject and null executable target digests. Clients must use resource_root and reported per-resource provenance instead.

Refs #5589
This commit is contained in:
morluto
2026-10-21 04:21:16 +08:00
parent 6389e50337
commit 6a6adf703f
58 changed files with 3582 additions and 189 deletions
@@ -82,7 +82,7 @@ export class JavaScriptRecoveryService {
const result = javascriptRecoveryResultSchema.safeParse(
execution.value.result,
);
if (!result.success || execution.value.subject === null)
if (!result.success || execution.value.subject == null)
return err(
new AnalysisOutputError(
OPERATION,