feat(mcp)!: harden contracts and evidence references

BREAKING CHANGE: comparison tools now require session-owned Evidence IDs or approved bundle paths, and structured Evidence results use compact references.
This commit is contained in:
morluto
2026-07-16 18:49:35 +08:00
parent ad398a17f5
commit ee1cd40405
47 changed files with 1387 additions and 672 deletions
@@ -6,6 +6,7 @@ import {
type AnalysisError,
} from "../domain/errors.js";
import type { Evidence } from "../domain/evidence.js";
import { projectInputIssues } from "../domain/inputIssueProjection.js";
import { compareJavaScriptApplicationVersions } from "../domain/javascriptApplicationVersionComparison.js";
import { compareApplicationVersionsInputSchema } from "../domain/javascriptApplicationVersionComparisonSchemas.js";
import { traceApplicationFeature } from "../domain/javascriptFeatureTrace.js";
@@ -26,7 +27,14 @@ export const traceApplicationFeatureEvidence = (
): Result<Evidence, AnalysisError> => {
const operation = "trace_application_feature";
const parsed = traceApplicationFeatureInputSchema.safeParse(rawInput);
if (!parsed.success) return err(new AnalysisInputError(operation));
if (!parsed.success)
return err(
new AnalysisInputError(
operation,
undefined,
projectInputIssues(parsed.error.issues, rawInput),
),
);
try {
const source = parseApplicationGraphEvidence(parsed.data.application);
const nativeEvidence = parseNativeApplicationEvidence(
@@ -63,7 +71,14 @@ export const compareApplicationVersionsEvidence = (
): Result<Evidence, AnalysisError> => {
const operation = "compare_application_versions";
const parsed = compareApplicationVersionsInputSchema.safeParse(rawInput);
if (!parsed.success) return err(new AnalysisInputError(operation));
if (!parsed.success)
return err(
new AnalysisInputError(
operation,
undefined,
projectInputIssues(parsed.error.issues, rawInput),
),
);
try {
const left = parseApplicationGraphEvidence(parsed.data.left);
const right = parseApplicationGraphEvidence(parsed.data.right);