rea-agents 1.2.0 → 1.4.0

package/dist/application/Uninstall.js

@@ -5,7 +5,14 @@ import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
 import writeFileAtomic from "write-file-atomic";
 import { z } from "zod";
 import { PRODUCT_IDENTITY } from "../identity.js";
-import { supportedClients } from "./Setup.js";
+import { supportedClients } from "./SupportedClients.js";
+const systemFileSystem = {
+    readText: (path) => readFile(path, "utf8"),
+    copy: (source, destination) => copyFile(source, destination),
+    writeText: (path, contents) => writeFileAtomic(path, contents, { encoding: "utf8" }),
+    stat: (path) => lstat(path),
+    remove: (path) => rm(path, { recursive: true }),
+};
 /** Remove only REA-owned registrations and managed files, optionally including local state. */
 export const runUninstall = async (purgeData, host = systemUninstallHost()) => {
     const items = [];
@@ -27,26 +34,26 @@ export const runUninstall = async (purgeData, host = systemUninstallHost()) => {
     };
 };
 /** Create uninstall effects contained to detected client configs and REA-owned paths. */
-export const systemUninstallHost = (home = homedir()) => ({
+export const systemUninstallHost = (home = homedir(), fileSystem = systemFileSystem) => ({
     clients: () => Promise.resolve(supportedClients(home)),
-    removeClient,
-    removeSkill: () => removeManagedPath(join(home, ".agents/skills", PRODUCT_IDENTITY.skillName), "skill"),
+    removeClient: (client) => removeClient(client, fileSystem),
+    removeSkill: () => removeManagedPath(join(home, ".agents/skills", PRODUCT_IDENTITY.skillName), "skill", fileSystem),
     purgeData: async () => [
-        await removeManagedPath(join(home, ".rea/cache"), "cache"),
-        await removeManagedPath(join(home, ".rea/state"), "state"),
+        await removeManagedPath(join(home, ".rea/cache"), "cache", fileSystem),
+        await removeManagedPath(join(home, ".rea/state"), "state", fileSystem),
     ],
 });
-const removeClient = async (client) => {
+const removeClient = async (client, fileSystem) => {
     if (client.format === "unsupported")
         return item(client.name, "skipped", "This client has no documented local MCP configuration boundary.");
     let original;
     try {
-        original = await readFile(client.configPath, "utf8");
+        original = await fileSystem.readText(client.configPath);
     }
     catch (cause) {
         return isMissing(cause)
             ? item(client.name, "skipped", "Configuration does not exist.")
-            : item(client.name, "failed", "Configuration could not be read.");
+            : item(client.name, "failed", "Configuration could not be read. Check file permissions, then rerun uninstall.");
     }
     let document;
     let key;
@@ -57,7 +64,7 @@ const removeClient = async (client) => {
         servers = optionalObject(document[key]);
     }
     catch {
-        return item(client.name, "failed", "Malformed configuration was preserved without mutation.");
+        return item(client.name, "failed", `Configuration is not valid ${client.format === "toml" ? "TOML" : "JSON"} and was not changed. Repair it, then rerun uninstall.`);
     }
     const registration = servers[PRODUCT_IDENTITY.mcpServerKey];
     if (registration === undefined)
@@ -69,28 +76,31 @@ const removeClient = async (client) => {
     document[key] = remaining;
     const backupPath = `${client.configPath}.rea.backup`;
     try {
-        await copyFile(client.configPath, backupPath);
+        await fileSystem.copy(client.configPath, backupPath);
     }
     catch {
-        return item(client.name, "failed", "Configuration backup failed; no mutation was attempted.");
+        return item(client.name, "failed", "Configuration could not be backed up, so no change was made. Check file permissions, then rerun uninstall.");
     }
     try {
         const encoded = client.format === "toml"
             ? stringifyToml(document)
             : `${JSON.stringify(document, null, 2)}\n`;
-        await writeFileAtomic(client.configPath, encoded, { encoding: "utf8" });
+        await fileSystem.writeText(client.configPath, encoded);
         const readback = objectSchema.parse(client.format === "toml"
-            ? parseToml(await readFile(client.configPath, "utf8"))
-            : JSON.parse(await readFile(client.configPath, "utf8")));
+            ? parseToml(await fileSystem.readText(client.configPath))
+            : JSON.parse(await fileSystem.readText(client.configPath)));
         if (PRODUCT_IDENTITY.mcpServerKey in optionalObject(readback[key]))
             throw new Error("registration readback mismatch");
         return item(client.name, "removed", `Removed registration from ${client.configPath}.`);
     }
     catch {
-        await writeFileAtomic(client.configPath, original, {
-            encoding: "utf8",
-        }).catch(() => undefined);
-        return item(client.name, "failed", `Configuration update failed; the original was restored and ${backupPath} was retained.`);
+        try {
+            await fileSystem.writeText(client.configPath, original);
+        }
+        catch {
+            return item(client.name, "failed", "Configuration could not be updated or restored. Restore its `.rea.backup` manually, then rerun uninstall.");
+        }
+        return item(client.name, "failed", "Configuration could not be updated. The original was restored and its `.rea.backup` was retained. Repair the configuration or restore the backup, then rerun uninstall.");
     }
 };
 /** Ownership rule for persistent MCP registrations created by REA setup. */
@@ -107,18 +117,18 @@ const isOwnedRegistration = (value) => {
             JSON.stringify(args) ===
                 JSON.stringify(["-y", PRODUCT_IDENTITY.packageName, "mcp"])));
 };
-const removeManagedPath = async (path, name) => {
+const removeManagedPath = async (path, name, fileSystem) => {
     try {
-        const stats = await lstat(path);
+        const stats = await fileSystem.stat(path);
         if (stats.isSymbolicLink())
-            return item(name, "retained", `Refused to follow symlink ${path}.`);
-        await rm(path, { recursive: true });
+            return item(name, "retained", "REA did not remove this item because its managed path is a symbolic link. Verify the link target before removing it manually.");
+        await fileSystem.remove(path);
         return item(name, "removed", `Removed ${path}.`);
     }
     catch (cause) {
         return isMissing(cause)
             ? item(name, "skipped", `${path} does not exist.`)
-            : item(name, "failed", `${path} could not be removed.`);
+            : item(name, "failed", "This item could not be removed. Check file permissions, then rerun uninstall.");
     }
 };
 const item = (name, status, detail) => ({ name, status, detail });

package/dist/application/UnknownEvidence.js

@@ -0,0 +1,33 @@
+import { createEvidence } from "../domain/evidence.js";
+/** Provider identity for analyst-authored residual-unknown mutations. */
+export const UNKNOWN_REGISTRY_PROVIDER = {
+    id: "rea-unknown-registry",
+    name: "REA residual unknown registry",
+    version: "1",
+};
+/** Create immutable evidence for one approved residual-unknown mutation. */
+export const unknownMutationEvidence = (target, input) => createEvidence(target, UNKNOWN_REGISTRY_PROVIDER, {
+    predicateType: "rea.residual-unknown-mutation/v1",
+    operation: "record_unknown",
+    parameters: { domain: input.domain, severity: input.severity },
+    result: {
+        action: "record",
+        question: input.question,
+        required_authority: input.required_authority,
+        required_confidence: input.required_confidence,
+    },
+    confidence: "derived",
+    authority: "analyst-inference",
+    evidenceLinks: unknownEvidenceLinks(input),
+    limitations: [
+        "Registry mutation evidence records analyst intent, not proof of the answer.",
+    ],
+});
+/** Deduplicate evidence links carried by an unknown mutation. */
+export const unknownEvidenceLinks = (input) => [
+    ...input.supporting_evidence_ids,
+    ...input.contradicting_evidence_ids,
+    ...("resolution" in input && input.resolution !== null
+        ? input.resolution.evidence_ids
+        : []),
+].filter((id, index, values) => values.indexOf(id) === index);

package/dist/application/Upgrade.js

@@ -33,7 +33,7 @@ export const runUpgrade = async (currentVersion, host = systemUpgradeHost(), out
             currentVersion,
             latestVersion: latestVersion ?? null,
             reason: "install",
-            remediation: `${UPGRADE_COMMAND} failed.`,
+            remediation: `REA could not update through npm. Check npm registry access and global install permissions, then run: ${UPGRADE_COMMAND}`,
         };
     return {
         status: "upgraded",
@@ -42,6 +42,8 @@ export const runUpgrade = async (currentVersion, host = systemUpgradeHost(), out
         versionCheck: latestVersion === undefined ? "unavailable" : "available",
         installMethod: "npm",
         command: UPGRADE_COMMAND,
+        clientRestartRequired: true,
+        remediation: "Rerun rea setup to refresh registrations and the skill, then restart clients that may retain an older MCP server.",
     };
 };
 /** Create the npm registry and subprocess effects for a production upgrade. */

package/dist/application/runtime.js

@@ -11,8 +11,8 @@ import { silentLogger } from "../logger.js";
  */
 export const createBinarySession = (config, logger = silentLogger) => {
     return new BinarySession(new CompositeProvider([
-        new ArtifactProvider(config.artifactNativeMountEnabled),
+        new ArtifactProvider(config.artifactNativeMountEnabled, config.artifactIntegrityContinueEnabled),
         new NativeMacOSProvider(),
         new HopperProvider(config, logger),
-    ]));
+    ]), { snapshotsEnabled: config.hopperLoaderArgs.length === 0 });
 };

package/dist/artifacts/ArtifactProvider.js

@@ -5,16 +5,15 @@ import { ARTIFACT_TOOL_CONTRACTS, artifactInventoryInputSchema, artifactExtracti
 import { AnalysisCapabilityUnavailableError, ArtifactOperationError, } from "../domain/errors.js";
 import { err, ok } from "../domain/result.js";
 import { ArtifactReaderFailure, } from "./ArtifactReader.js";
-const IDENTITY = Object.freeze({
-    id: "rea-artifact-graph",
-    name: "REA safe artifact graph provider",
-    version: "1",
-});
+import { ARTIFACT_GRAPH_PROVIDER } from "../application/InvestigationProviders.js";
+const IDENTITY = Object.freeze(ARTIFACT_GRAPH_PROVIDER);
 /** Read-only inventory and exclusively owned extraction provider. */
 export class ArtifactProvider {
     nativeMountEnabled;
-    constructor(nativeMountEnabled = false) {
+    integrityContinueEnabled;
+    constructor(nativeMountEnabled = false, integrityContinueEnabled = false) {
         this.nativeMountEnabled = nativeMountEnabled;
+        this.integrityContinueEnabled = integrityContinueEnabled;
     }
     #capabilities = Object.freeze(ARTIFACT_TOOL_CONTRACTS.map((contract) => Object.freeze({
         provider: IDENTITY,
@@ -51,15 +50,17 @@ export class ArtifactProvider {
         return this.#capabilities;
     }
     createClient(target) {
-        return new ArtifactClient(target, this.nativeMountEnabled);
+        return new ArtifactClient(target, this.nativeMountEnabled, this.integrityContinueEnabled);
     }
 }
 class ArtifactClient {
     target;
     nativeMountEnabled;
-    constructor(target, nativeMountEnabled) {
+    integrityContinueEnabled;
+    constructor(target, nativeMountEnabled, integrityContinueEnabled) {
         this.target = target;
         this.nativeMountEnabled = nativeMountEnabled;
+        this.integrityContinueEnabled = integrityContinueEnabled;
     }
     async execute(operation, parameters, options) {
         if (operation === "health")
@@ -102,6 +103,12 @@ class ArtifactClient {
                     nativeMountApproved: parsed.native_mount_approved === true,
                     nativeMountEnabled: this.nativeMountEnabled,
                 },
+                integrity: {
+                    mode: parsed.integrity_policy,
+                    approved: parsed.integrity_continue_approved === true,
+                    enabled: this.integrityContinueEnabled,
+                    maxMismatches: parsed.max_integrity_mismatches,
+                },
             });
             return ok(createAnalysisExecution(result, IDENTITY, {
                 rawResult: null,

package/dist/catalogIdentity.js

@@ -0,0 +1,121 @@
+import { createHash } from "node:crypto";
+import canonicalize from "canonicalize";
+import { z } from "zod";
+import { PROMPT_CONTRACTS } from "./contracts/promptContracts.js";
+import { TOOL_CONTRACTS } from "./contracts/toolContracts.js";
+/** Explicit CLI command inventory, kept separate from MCP tool counts. */
+export const CLI_COMMAND_NAMES = [
+    "analyze",
+    "inspect",
+    "decompile",
+    "setup",
+    "doctor",
+    "uninstall",
+    "upgrade",
+    "xrefs",
+    "trace",
+    "capabilities",
+    "providers",
+    "function",
+    "search",
+    "import-reference-source",
+    "inventory-artifact",
+    "extract-artifact",
+    "inspect-macho",
+    "inspect-signature",
+    "list-architectures",
+    "inspect-plist",
+    "demangle-swift",
+    "evidence-import",
+    "evidence-export",
+    "compare",
+    "investigate-versions",
+    "capture-process",
+    "compare-process-captures",
+    "policy",
+];
+const toolCatalog = TOOL_CONTRACTS.map((contract) => ({
+    name: contract.name,
+    surface: contract.kind,
+    description: contract.description,
+    annotations: contract.annotations,
+    input_schema: z.toJSONSchema(contract.inputSchema, {
+        unrepresentable: "any",
+    }),
+    output_schema: z.toJSONSchema(contract.outputSchema, {
+        unrepresentable: "any",
+    }),
+})).sort((left, right) => left.name.localeCompare(right.name));
+const promptCatalog = PROMPT_CONTRACTS.map((contract) => ({
+    name: contract.name,
+    title: contract.title,
+    description: contract.description,
+    arguments: contract.arguments,
+    steps: contract.steps,
+})).sort((left, right) => left.name.localeCompare(right.name));
+const resourceCatalog = [
+    { name: "server-identity", uri: "rea://server/identity" },
+    { name: "active-residual-unknowns", uri: "rea://unknowns/active" },
+];
+const resourceTemplateCatalog = [
+    { name: "session-evidence", uri_template: "rea://evidence/{evidenceId}" },
+    {
+        name: "evidence-section",
+        uri_template: "rea://evidence/{evidenceId}/section/{section}",
+    },
+    { name: "residual-unknown", uri_template: "rea://unknown/{unknownId}" },
+    {
+        name: "analysis-snapshot",
+        uri_template: "rea://snapshot/{snapshotDigest}",
+    },
+    {
+        name: "artifact-page",
+        uri_template: "rea://artifact/{manifestId}/{collection}",
+    },
+    {
+        name: "function-dossier",
+        uri_template: "rea://function/{targetSha256}/{address}",
+    },
+    {
+        name: "investigation-workspace-revision",
+        uri_template: "rea://workspace/{workspaceId}/revision/{revision}",
+    },
+];
+const digest = (value) => {
+    const encoded = canonicalize(value);
+    if (encoded === undefined)
+        throw new TypeError("Catalog is not canonical JSON");
+    return createHash("sha256").update(encoded).digest("hex");
+};
+/** Stable, schema-sensitive identity for every public REA surface. */
+export const CATALOG_IDENTITY = {
+    counts: {
+        cli_commands: CLI_COMMAND_NAMES.length,
+        mcp_tools: toolCatalog.length,
+        mcp_prompts: promptCatalog.length,
+        mcp_resources: resourceCatalog.length,
+        mcp_resource_templates: resourceTemplateCatalog.length,
+    },
+    digests: {
+        tools_sha256: digest(toolCatalog),
+        prompts_sha256: digest(promptCatalog),
+        resources_sha256: digest({ resourceCatalog, resourceTemplateCatalog }),
+        combined_sha256: digest({
+            cli: CLI_COMMAND_NAMES,
+            tools: toolCatalog,
+            prompts: promptCatalog,
+            resources: resourceCatalog,
+            resource_templates: resourceTemplateCatalog,
+        }),
+    },
+    tools: toolCatalog.map(({ name, surface, annotations }) => ({
+        name,
+        surface,
+        annotations: {
+            read_only: annotations.readOnlyHint ?? false,
+            destructive: annotations.destructiveHint ?? false,
+            idempotent: annotations.idempotentHint ?? false,
+            open_world: annotations.openWorldHint ?? true,
+        },
+    })),
+};

package/dist/cli.js

@@ -13,6 +13,11 @@ import { parseConfig } from "./config.js";
 import { importReferenceSource } from "./application/ReferenceSourceImport.js";
 import { registerEvidenceCommands } from "./cliEvidenceCommands.js";
 import { registerProcessCommands } from "./cliProcessCommands.js";
+import { registerInvestigationCommands } from "./cliInvestigationCommands.js";
+import { AnalysisProtocolError, PermissionRequiredError, projectAnalysisError, } from "./domain/errors.js";
+import { projectReferenceSourceImportError } from "./application/ReferenceSourceImportTypes.js";
+import { loadConfiguredPermissionAuthority } from "./application/PermissionConfiguration.js";
+import { registerPolicyCommands } from "./cliPolicyCommands.js";
 /**
  * Build the one-shot Incur CLI without starting Hopper at import time.
  * Analysis commands acquire and close their own sessions; bare `mcp` and
@@ -23,8 +28,8 @@ export const createCli = () => {
         ? "silent"
         : parseLogLevel(process.env.REA_LOG_LEVEL));
     const cli = Cli.create(PRODUCT_IDENTITY.cliBinary, {
-        version: process.env.REA_PACKAGE_VERSION ?? "0.0.0-development",
-        description: "Reverse engineer anything from your terminal or coding agent.",
+        version: PRODUCT_IDENTITY.packageVersion,
+        description: "Reverse engineer anything from your terminal or agent.",
         mcp: {
             command: PRODUCT_IDENTITY.mcpCommand,
             instructions: "Ask what software, artifact, protocol, or behavior the user wants to understand, then choose the available investigation capabilities that can produce evidence.",
@@ -48,15 +53,22 @@ export const createCli = () => {
     registerCapabilityCommands(cli, logger);
     registerNativeCommands(cli, logger);
     registerArtifactCommands(cli, logger);
+    registerInvestigationCommands(cli, logger);
     registerEvidenceCommands(cli, logger);
     registerReferenceSourceCommand(cli, logger);
     registerProcessCommands(cli, logger);
+    registerPolicyCommands(cli, logger);
     return cli;
 };
 const registerCoreCommands = (cli, logger) => {
     const overviewOptions = z.object({
         detail: z.enum(["concise", "detailed"]).default("concise"),
         limit: z.number().int().min(1).max(50).default(10),
+        snapshot: z
+            .string()
+            .min(1)
+            .optional()
+            .describe("Load and update a local analysis snapshot"),
     });
     cli.command("analyze", {
         description: "Get an overview of an app",
@@ -64,7 +76,7 @@ const registerCoreCommands = (cli, logger) => {
             path: z.string().describe("App, program, or Hopper database path"),
         }),
         options: overviewOptions,
-        run: ({ args, options }) => logCliCommand(logger, "analyze", () => runDirectAnalysis(args.path, "binary_overview", { detail: options.detail, limit: options.limit }, logger)),
+        run: ({ args, options }) => logCliCommand(logger, "analyze", () => runDirectAnalysis(args.path, "binary_overview", { detail: options.detail, limit: options.limit }, { logger, snapshotPath: options.snapshot })),
     });
     cli.command("inspect", {
         description: "Inspect an app overview with evidence",
@@ -72,7 +84,7 @@ const registerCoreCommands = (cli, logger) => {
             path: z.string().describe("App, program, or Hopper database path"),
         }),
         options: overviewOptions,
-        run: ({ args, options }) => logCliCommand(logger, "inspect", () => runDirectAnalysis(args.path, "binary_overview", { detail: options.detail, limit: options.limit }, logger)),
+        run: ({ args, options }) => logCliCommand(logger, "inspect", () => runDirectAnalysis(args.path, "binary_overview", { detail: options.detail, limit: options.limit }, { logger, snapshotPath: options.snapshot })),
     });
     cli.command("decompile", {
         description: "Read one part of an app as code",
@@ -80,12 +92,13 @@ const registerCoreCommands = (cli, logger) => {
             path: z.string().describe("App or program path"),
             address: z.string().describe("Procedure address"),
         }),
-        run: ({ args }) => logCliCommand(logger, "decompile", () => runDirectAnalysis(args.path, "procedure_pseudo_code", { procedure: args.address }, logger)),
+        options: z.object({ snapshot: z.string().min(1).optional() }),
+        run: ({ args, options }) => logCliCommand(logger, "decompile", () => runDirectAnalysis(args.path, "procedure_pseudo_code", { procedure: args.address }, { logger, snapshotPath: options.snapshot })),
     });
 };
 const registerSetupCommands = (cli, logger) => {
     cli.command("setup", {
-        description: "Install requirements and configure coding agents",
+        description: "Install requirements and configure agents",
         options: z.object({
             yes: z
                 .boolean()
@@ -125,7 +138,7 @@ const registerSetupCommands = (cli, logger) => {
     });
     cli.command("upgrade", {
         description: "Upgrade a global npm installation to the latest REA release",
-        run: ({ formatExplicit }) => logCliCommand(logger, "upgrade", () => runUpgrade(process.env.REA_PACKAGE_VERSION ?? "0.0.0-development", systemUpgradeHost(), formatExplicit ? "structured" : "human")),
+        run: ({ formatExplicit }) => logCliCommand(logger, "upgrade", () => runUpgrade(PRODUCT_IDENTITY.packageVersion, systemUpgradeHost(), formatExplicit ? "structured" : "human")),
     });
 };
 const confirmSetup = async (actions) => {
@@ -153,7 +166,8 @@ const registerXrefsCommand = (cli, logger) => {
             path: z.string().describe("App or program path"),
             address: z.string().describe("Hexadecimal address"),
         }),
-        run: ({ args }) => logCliCommand(logger, "xrefs", () => runDirectAnalysis(args.path, "xrefs", { address: args.address }, logger)),
+        options: z.object({ snapshot: z.string().min(1).optional() }),
+        run: ({ args, options }) => logCliCommand(logger, "xrefs", () => runDirectAnalysis(args.path, "xrefs", { address: args.address }, { logger, snapshotPath: options.snapshot })),
     });
 };
 const registerTraceCommand = (cli, logger) => {
@@ -167,6 +181,7 @@ const registerTraceCommand = (cli, logger) => {
             caseSensitive: z.boolean().default(false),
             limit: z.number().int().min(1).max(100).default(20),
             maxOperations: z.number().int().min(1).max(100).default(20),
+            snapshot: z.string().min(1).optional(),
         }),
         alias: {
             caseSensitive: "case-sensitive",
@@ -177,7 +192,7 @@ const registerTraceCommand = (cli, logger) => {
             case_sensitive: options.caseSensitive,
             limit: options.limit,
             max_operations: options.maxOperations,
-        }, logger)),
+        }, { logger, snapshotPath: options.snapshot })),
     });
 };
 const registerCapabilityCommands = (cli, logger) => {
@@ -202,6 +217,7 @@ const registerFunctionCommand = (cli, logger) => {
             limit: z.number().int().min(1).max(500).default(100),
             maxPseudocodeChars: z.number().int().min(1).max(100_000).default(20_000),
             maxInstructions: z.number().int().min(1).max(5_000).default(500),
+            snapshot: z.string().min(1).optional(),
         }),
         alias: {
             includeAssembly: "include-assembly",
@@ -214,7 +230,7 @@ const registerFunctionCommand = (cli, logger) => {
             limit: options.limit,
             max_pseudocode_chars: options.maxPseudocodeChars,
             max_instructions: options.maxInstructions,
-        }, logger)),
+        }, { logger, snapshotPath: options.snapshot })),
     });
 };
 const registerSearchCommand = (cli, logger) => {
@@ -230,6 +246,7 @@ const registerSearchCommand = (cli, logger) => {
             caseSensitive: z.boolean().default(false),
             offset: z.number().int().min(0).default(0),
             limit: z.number().int().min(1).max(100).default(100),
+            snapshot: z.string().min(1).optional(),
         }),
         alias: { caseSensitive: "case-sensitive" },
         run: ({ args, options }) => logCliCommand(logger, "search", () => runDirectAnalysis(args.path, options.kind === "strings" ? "search_strings" : "search_procedures", {
@@ -238,7 +255,7 @@ const registerSearchCommand = (cli, logger) => {
             case_sensitive: options.caseSensitive,
             offset: options.offset,
             limit: options.limit,
-        }, logger)),
+        }, { logger, snapshotPath: options.snapshot })),
     });
 };
 const registerReferenceSourceCommand = (cli, logger) => {
@@ -252,7 +269,36 @@ const registerReferenceSourceCommand = (cli, logger) => {
         run: ({ args }) => logCliCommand(logger, "import-reference-source", async () => {
             const config = parseConfig(process.env);
             if (!config.ok)
-                return { error: config.error._tag, message: config.error.message };
+                return {
+                    error: "Import failed",
+                    ...projectAnalysisError(config.error),
+                };
+            const authority = await loadConfiguredPermissionAuthority(config.value);
+            if (!authority.ok)
+                return {
+                    error: "Import failed",
+                    ...projectAnalysisError(authority.error),
+                };
+            const authorized = await authority.value.authorize({
+                capability: "reference_read",
+                roots: [args.root],
+                executables: [],
+                environment_names: [],
+                network: "none",
+                mount: false,
+                operation_identity: `import_reference_source:${args.root}`,
+            }, "read");
+            if (!authorized.ok) {
+                const error = authorized.error instanceof PermissionRequiredError
+                    ? authorized.error
+                    : new AnalysisProtocolError(authorized.error.message, {
+                        cause: authorized.error,
+                    });
+                return {
+                    error: "Import failed",
+                    ...projectAnalysisError(error),
+                };
+            }
             const imported = await importReferenceSource({
                 root: args.root,
                 caller: "rea-cli",
@@ -262,7 +308,10 @@ const registerReferenceSourceCommand = (cli, logger) => {
             });
             return imported.ok
                 ? imported.value
-                : { error: imported.error.code, message: imported.error.message };
+                : {
+                    error: "Import failed",
+                    ...projectReferenceSourceImportError(imported.error),
+                };
         }),
     });
 };
@@ -275,7 +324,17 @@ const registerArtifactCommands = (cli, logger) => {
         options: z.object({
             offset: z.number().int().min(0).default(0),
             limit: z.number().int().min(1).max(500).default(100),
+            integrityPolicy: z.enum(["fail", "record-and-continue"]).default("fail"),
+            integrityContinueApproved: z.boolean().default(false),
+            maxIntegrityMismatches: z.number().int().min(1).max(100).default(10),
+            nativeMountApproved: z.boolean().default(false),
         }),
+        alias: {
+            integrityPolicy: "integrity-policy",
+            integrityContinueApproved: "integrity-continue-approved",
+            maxIntegrityMismatches: "max-integrity-mismatches",
+            nativeMountApproved: "native-mount-approved",
+        },
         run: ({ args, options }) => logCliCommand(logger, "inventory-artifact", () => runProviderAnalysis(args.path, "inventory_artifact", {
             node_offset: options.offset,
             node_limit: options.limit,
@@ -283,6 +342,10 @@ const registerArtifactCommands = (cli, logger) => {
             occurrence_limit: options.limit,
             edge_offset: options.offset,
             edge_limit: options.limit,
+            integrity_policy: options.integrityPolicy,
+            integrity_continue_approved: options.integrityContinueApproved,
+            max_integrity_mismatches: options.maxIntegrityMismatches,
+            native_mount_approved: options.nativeMountApproved,
         }, logger)),
     });
     cli.command("extract-artifact", {