8ecbb74b00
* fix(wasm): refuse unretained summary delivery before provider work inspect_wasm_artifact with detail summary ran the WASM provider before checking whether the server retains Evidence. On a fixed server without session retention a successful provider run was followed by capability_unavailable, and a failing provider run replaced that diagnostic with the provider error, hiding the guidance to select detail complete. Check retention right after input validation, as the EVM, pcap and network-capture handlers do, so the refusal precedes any provider work and keeps its typed diagnostic. Complete delivery is unchanged. The fixed-server boundary test now injects a vi.fn provider and asserts it stays idle for refused summaries while complete delivery still runs it. Fixes #5100 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(wasm): validate caller paths before the summary retention preflight Review follow-up for #5274. The retention preflight ran ahead of the semantic input checks, so a relative path, glue path or candidate path with detail summary on a fixed server returned capability_unavailable instead of its field-specific invalid_request. WasmArtifactService now exposes that parse-and-absolute-path step as validate(); inspect() uses the same method, so the checks stay at the owning boundary, and the MCP handler validates before deciding on retention. The composition descriptor and server typing expose validate. The fixed-server boundary test sends relative path and glue_paths with detail summary and asserts invalid_request with both issue paths and no provider call; it failed on 418a66d7d with capability_unavailable. docs/mcp-contracts.md now claims the before-analysis refusal only for inspect_artifact, inspect_wasm_artifact, inspect_macho and decode_interface_builder, which enforce it; inspect_binary_layout and analyze_javascript_application still analyze first and are left to a separate change. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * refactor(wasm): inspect validated artifact input without reparsing it Follow-up for #5274, matching the review outcome on #5288. The MCP handler validated the request and then called inspect(), which ran the same validator again, so every call parsed and cloned its input twice. WasmArtifactService now separates the raw entry point from execution: inspect() validates raw input once and delegates to the new inspectValidated(), which runs the inspection for input that validate() already admitted. The handler validates, runs the retention preflight, then calls inspectValidated(); the composition descriptor and server typing expose it. The CLI keeps the raw inspect() entry point; behavior and diagnostics are unchanged. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(wasm): keep cancellation ahead of raw artifact input validation Follow-up for #5274, matching the review outcome on #5288. Separating validate() from inspectValidated() moved the raw inspect() entry point's validation ahead of its abort check, so a direct call with an already-aborted signal and malformed input returned AnalysisInputError instead of the AnalysisCancelledError the pre-change service gave. The raw entry point now checks the signal before va