From 8fc2043eb8bcedbf34dce064f977e455438635d6 Mon Sep 17 00:00:00 2001
From: morluto <76467478+morluto@users.noreply.github.com>
Date: Tue, 13 Oct 2026 05:25:15 +0800
Subject: [PATCH] fix(mcp): preserve target provenance on retained partial
 errors

---
 src/server/contractToolHandler.ts           | 1 +
 tests/boundary/mcp/packetCaptureMcp.test.ts | 3 +++
 2 files changed, 4 insertions(+)

diff --git a/src/server/contractToolHandler.ts b/src/server/contractToolHandler.ts
index 0ad6fcd16..e813f060f 100644
--- a/src/server/contractToolHandler.ts
+++ b/src/server/contractToolHandler.ts
@@ -70,6 +70,7 @@ export const createEvidenceToolHandler =
                 result.error,
                 partial.evidence_id,
                 recorded,
+                contract.returnsTargetContent,
               );
           }
           return server.delivery.toCallToolResult(result, contract);
diff --git a/tests/boundary/mcp/packetCaptureMcp.test.ts b/tests/boundary/mcp/packetCaptureMcp.test.ts
index 3d7322baf..e11b60d3e 100644
--- a/tests/boundary/mcp/packetCaptureMcp.test.ts
+++ b/tests/boundary/mcp/packetCaptureMcp.test.ts
@@ -90,6 +90,9 @@ it.each(["cancelled", "cleanup"])(
       arguments: input,
     });
     expect(response.isError).toBe(true);
+    expect(response._meta).toEqual({
+      provenance: { untrusted_content: true, source: "analysis_target" },
+    });
     expect(parseMcpToolError(response)).toMatchObject({
       error: {
         details: {