rea-agents 1.3.0 → 1.5.0

package/dist/application/BinarySession.js

@@ -10,6 +10,7 @@ import { OFFICIAL_TOOL_CONTRACTS } from "../contracts/toolContracts.js";
 import { snapshotMatchesTarget } from "../domain/analysisSnapshot.js";
 import { AnalysisSnapshotCache, isSnapshotCacheable, } from "./AnalysisSnapshotCache.js";
 import { UNKNOWN_REGISTRY_PROVIDER, unknownEvidenceLinks, unknownMutationEvidence, } from "./UnknownEvidence.js";
+import { parseInvestigationWorkspace, } from "../domain/investigationWorkspace.js";
 const OFFICIAL_OPERATIONS = new Set(OFFICIAL_TOOL_CONTRACTS.map(({ name }) => name));
 /**
  * Owns the single active target shared by CLI and MCP adapters.
@@ -32,6 +33,9 @@ export class BinarySession {
         maxBytes: 64 * 1024 * 1024,
     });
     #snapshot = new AnalysisSnapshotCache();
+    #investigationWorkspaces = new Map();
+    #runtimeAvailability = new Map();
+    #availabilityListeners = new Set();
     #snapshotsEnabled;
     #snapshotInvalidated = false;
     constructor(provider, options = {}) {
@@ -57,7 +61,7 @@ export class BinarySession {
         if (operation !== undefined) {
             const exact = this.#capabilities?.get(operation)?.provider;
             if (exact !== undefined)
-                return exact;
+                return structuredClone(exact);
             if (enhancedToolNameSchema.safeParse(operation).success) {
                 const providers = new Map();
                 for (const descriptor of this.#capabilities?.values() ?? [])
@@ -67,11 +71,16 @@ export class BinarySession {
                 if (providers.size === 1) {
                     const provider = providers.values().next().value;
                     if (provider !== undefined)
-                        return provider;
+                        return structuredClone(provider);
                 }
             }
         }
-        return this.#providerIdentity;
+        return structuredClone(this.#providerIdentity);
+    }
+    /** Observe runtime provider-health changes that affect discovery metadata. */
+    onAvailabilityChanged(listener) {
+        this.#availabilityListeners.add(listener);
+        return () => this.#availabilityListeners.delete(listener);
     }
     /** Add one successful public observation to the session ledger. */
     recordEvidence(evidence) {
@@ -110,6 +119,27 @@ export class BinarySession {
             return err(new EvidenceIntegrityError("Analysis snapshots are unavailable with custom Hopper loader arguments"));
         return this.#snapshot.import(snapshot, this.#active?.target, (bundle) => this.#evidence.import(bundle));
     }
+    /** Retain one validated immutable workspace revision for session resources. */
+    retainInvestigationWorkspace(workspace) {
+        const parsed = parseInvestigationWorkspace(workspace);
+        const key = `${parsed.workspace_id}:${String(parsed.revision)}`;
+        if (this.#investigationWorkspaces.has(key))
+            return "duplicate";
+        this.#investigationWorkspaces.set(key, parsed);
+        return "added";
+    }
+    /** Read one session-retained immutable workspace revision. */
+    investigationWorkspace(workspaceId, revision) {
+        const workspace = this.#investigationWorkspaces.get(`${workspaceId}:${String(revision)}`);
+        return workspace === undefined ? undefined : structuredClone(workspace);
+    }
+    /** List retained workspace revisions in canonical identity order. */
+    investigationWorkspaces() {
+        return [...this.#investigationWorkspaces.values()]
+            .sort((left, right) => left.workspace_id.localeCompare(right.workspace_id) ||
+            left.revision - right.revision)
+            .map((workspace) => structuredClone(workspace));
+    }
     /** Create an approved residual unknown and immutable mutation evidence. */
     recordUnknown(input) {
         const evidence = unknownMutationEvidence(this.#active?.target, input);
@@ -189,6 +219,7 @@ export class BinarySession {
                 return err(new AnalysisCancelledError("open_binary"));
             }
             this.#active = { target: parsed.value, client };
+            this.#clearRuntimeAvailability();
             this.#snapshot.select(parsed.value);
             if (options.snapshot !== undefined) {
                 const imported = this.importAnalysisSnapshot(options.snapshot);
@@ -213,6 +244,7 @@ export class BinarySession {
             this.#evidence.clear();
             this.#snapshot.clear();
             this.#snapshotInvalidated = false;
+            this.#clearRuntimeAvailability();
             return ok(null);
         });
     }
@@ -237,6 +269,10 @@ export class BinarySession {
             ? []
             : [...this.#capabilities.values()]
                 .sort((left, right) => left.operation.localeCompare(right.operation))
+                .map((descriptor) => ({
+                ...descriptor,
+                ...this.#runtimeAvailability.get(descriptor.operation),
+            }))
                 .map((descriptor) => ({
                 operation: descriptor.operation,
                 available: descriptor.available,
@@ -277,7 +313,9 @@ export class BinarySession {
     }
     /** Return the immutable artifact identity captured before Hopper launched. */
     activeTarget() {
-        return this.#active?.target;
+        return this.#active === undefined
+            ? undefined
+            : structuredClone(this.#active.target);
     }
     /**
      * Invoke a Hopper tool against the active target.
@@ -304,6 +342,7 @@ export class BinarySession {
         this.#calls.add(call);
         try {
             const result = await call;
+            this.#observeRuntimeAvailability(name, result);
             if (result.ok && cacheable)
                 this.#snapshot.record(active.target, name, arguments_, result.value);
             else if (result.ok && capability?.effects.mutatesArtifact === true) {
@@ -316,6 +355,55 @@ export class BinarySession {
             this.#calls.delete(call);
         }
     }
+    #observeRuntimeAvailability(operation, result) {
+        if (result.ok) {
+            if (this.#setRuntimeAvailability(operation, true, null))
+                this.#emitAvailabilityChanged();
+            return;
+        }
+        if (result.error._tag === "AnalysisCapabilityUnavailableError") {
+            if (this.#setRuntimeAvailability(operation, false, result.error.message))
+                this.#emitAvailabilityChanged();
+            return;
+        }
+        if ([
+            "ProviderAdapterError",
+            "HopperProcessError",
+            "HopperStartError",
+            "HopperRemoteError",
+        ].includes(result.error._tag)) {
+            const providerId = this.#capabilities?.get(operation)?.provider.id;
+            let changed = false;
+            for (const descriptor of this.#capabilities?.values() ?? [])
+                if (providerId !== undefined && descriptor.provider.id === providerId)
+                    changed =
+                        this.#setRuntimeAvailability(descriptor.operation, false, "Provider became unavailable during this session.") || changed;
+            if (changed)
+                this.#emitAvailabilityChanged();
+        }
+    }
+    #setRuntimeAvailability(operation, available, reason) {
+        const current = this.#runtimeAvailability.get(operation);
+        if (current?.available === available && current.reason === reason)
+            return false;
+        if (available && current === undefined)
+            return false;
+        if (available)
+            this.#runtimeAvailability.delete(operation);
+        else
+            this.#runtimeAvailability.set(operation, { available, reason });
+        return true;
+    }
+    #clearRuntimeAvailability() {
+        if (this.#runtimeAvailability.size === 0)
+            return;
+        this.#runtimeAvailability.clear();
+        this.#emitAvailabilityChanged();
+    }
+    #emitAvailabilityChanged() {
+        for (const listener of this.#availabilityListeners)
+            listener();
+    }
     #serialize(operation) {
         const result = this.#transition.then(operation, operation);
         this.#transition = result.then(() => undefined, () => undefined);

package/dist/application/BoundedJsonFiles.js

@@ -2,7 +2,9 @@ import { lstat, readFile, realpath } from "node:fs/promises";
 import { basename, dirname, isAbsolute, relative, resolve } from "node:path";
 import writeFileAtomic from "write-file-atomic";
 import { EvidenceFileError } from "../domain/errors.js";
+import { isJsonWithinLimits } from "../domain/jsonLimits.js";
 import { err, ok } from "../domain/result.js";
+import { canonicalizeConfiguredRoots } from "./ConfiguredRoots.js";
 /** Read bounded JSON data from a regular file beneath an approved root. */
 export const readBoundedJson = async (path, policy) => {
     if (policy.roots.length === 0)
@@ -26,8 +28,9 @@ export const readBoundedJson = async (path, policy) => {
         catch (cause) {
             return err(new EvidenceFileError("read", "invalid-json", { cause }));
         }
-        const limits = validateJsonLimits(decoded, policy);
-        return limits.ok ? ok(decoded) : limits;
+        return isJsonWithinLimits(decoded, policy)
+            ? ok(decoded)
+            : err(new EvidenceFileError("read", "too-large"));
     }
     catch (cause) {
         return err(new EvidenceFileError("read", "io", { cause }));
@@ -69,8 +72,7 @@ export const writeBoundedText = async (encoded, path, overwrite, policy) => {
     }
 };
 const isApproved = async (candidate, roots) => {
-    for (const configuredRoot of roots) {
-        const root = await realpath(resolve(configuredRoot));
+    for (const root of await canonicalizeConfiguredRoots(roots.map((configuredRoot) => resolve(configuredRoot)))) {
         const relation = relative(root, candidate);
         if (relation === "" ||
             (!relation.startsWith("..") && !isAbsolute(relation)))
@@ -78,31 +80,6 @@ const isApproved = async (candidate, roots) => {
     }
     return false;
 };
-const validateJsonLimits = (root, policy) => {
-    const pending = [
-        { value: root, depth: 0 },
-    ];
-    let nodes = 0;
-    while (pending.length > 0) {
-        const current = pending.pop();
-        if (current === undefined)
-            break;
-        nodes += 1;
-        if (nodes > policy.maxNodes || current.depth > policy.maxDepth)
-            return err(new EvidenceFileError("read", "too-large"));
-        if (typeof current.value === "string" &&
-            current.value.length > policy.maxStringLength)
-            return err(new EvidenceFileError("read", "too-large"));
-        if (typeof current.value !== "object" || current.value === null)
-            continue;
-        for (const [key, value] of Object.entries(current.value)) {
-            if (key.length > policy.maxStringLength)
-                return err(new EvidenceFileError("read", "too-large"));
-            pending.push({ value, depth: current.depth + 1 });
-        }
-    }
-    return ok(null);
-};
 const isFileNotFound = (cause) => typeof cause === "object" &&
     cause !== null &&
     "code" in cause &&

package/dist/application/BrowserEvidence.js

@@ -0,0 +1,35 @@
+import { createEvidence, } from "../domain/evidence.js";
+import { jsonValueSchema } from "../domain/jsonValue.js";
+/** Create Evidence v2 for a policy-scoped external browser observation. */
+export const createBrowserEvidence = (operation, input, result, provider) => createEvidence(undefined, provider, {
+    predicateType: operation === "list_browser_targets"
+        ? "rea.browser-target-list/v1"
+        : "rea.web-page-inspection/v1",
+    operation,
+    parameters: browserParameters(input),
+    result: jsonValueSchema.parse(result),
+    confidence: "observed",
+    authority: "external-service",
+    environment: "target" in result
+        ? {
+            id: `${result.browser.product}@${result.browser.revision}`,
+            platform: process.platform,
+            architecture: process.arch,
+            isolation: "none",
+        }
+        : null,
+    limitations: result.limitations,
+});
+const browserParameters = (input) => ({
+    cdp_endpoint: input.cdp_endpoint,
+    allowed_origins: input.allowed_origins,
+    ...("target_id" in input
+        ? {
+            target_id: input.target_id,
+            observation_ms: input.observation_ms,
+            include_script_sources: input.include_script_sources,
+            include_storage_keys: input.include_storage_keys,
+            limits: input.limits,
+        }
+        : { offset: input.offset, limit: input.limit }),
+});

package/dist/application/BrowserObservationPort.js

@@ -0,0 +1 @@
+export {};

package/dist/application/BrowserObservationService.js

@@ -0,0 +1,52 @@
+import { AnalysisCapabilityUnavailableError, AnalysisProtocolError, PermissionRequiredError, } from "../domain/errors.js";
+import { err, ok } from "../domain/result.js";
+import { createBrowserEvidence } from "./BrowserEvidence.js";
+/** Authorize and execute one policy-scoped target discovery observation. */
+export const listBrowserTargets = async (browser, authority, input, options = {}) => {
+    const ready = await prepare(browser, authority, input, "list_browser_targets");
+    if (!ready.ok)
+        return ready;
+    const result = await ready.value.listTargets(input, options);
+    return result.ok
+        ? ok(createBrowserEvidence("list_browser_targets", input, result.value, ready.value.identity()))
+        : result;
+};
+/** Authorize and execute one policy-scoped passive page inspection. */
+export const inspectWebPage = async (browser, authority, input, options = {}) => {
+    const ready = await prepare(browser, authority, input, "inspect_web_page");
+    if (!ready.ok)
+        return ready;
+    const result = await ready.value.inspectPage(input, options);
+    return result.ok
+        ? ok(createBrowserEvidence("inspect_web_page", input, result.value, ready.value.identity()))
+        : result;
+};
+const prepare = async (browser, authority, input, operation) => {
+    if (authority === undefined)
+        return err(new AnalysisCapabilityUnavailableError("rea-cdp-browser", operation, "browser observation permission policy is not configured"));
+    const authorized = await authority.authorize({
+        capability: "browser_observe",
+        roots: [],
+        executables: [],
+        environment_names: [],
+        origins: [input.cdp_endpoint, ...input.allowed_origins],
+        network: browserNetworkScope(input.allowed_origins),
+        mount: false,
+        operation_identity: `${operation}:${input.target_id ?? input.cdp_endpoint}`,
+    }, "read");
+    if (!authorized.ok)
+        return err(authorized.error instanceof PermissionRequiredError
+            ? authorized.error
+            : new AnalysisProtocolError(authorized.error.message, {
+                cause: authorized.error,
+            }));
+    return browser === undefined
+        ? err(new AnalysisCapabilityUnavailableError("rea-cdp-browser", operation, "browser observation provider is not configured"))
+        : ok(browser);
+};
+const browserNetworkScope = (allowedOrigins) => allowedOrigins.every((origin) => {
+    const hostname = new URL(origin).hostname;
+    return hostname === "127.0.0.1" || hostname === "[::1]";
+})
+    ? "loopback"
+    : "external";

package/dist/application/CapabilityInventory.js

@@ -0,0 +1,134 @@
+import { z } from "zod";
+import { TOOL_CONTRACTS } from "../contracts/toolContracts.js";
+const statusSchema = z.object({
+    open: z.boolean(),
+    kind: z.enum(["executable", "database", "archive", "artifact"]).optional(),
+    format: z.string().optional(),
+    capabilities: z.array(z.object({
+        operation: z.string(),
+        available: z.boolean(),
+        reason: z.string().nullable(),
+    })),
+});
+const ENHANCED_REQUIREMENTS = {
+    swift_classes: ["list_procedures"],
+    get_objc_classes: ["list_names"],
+    get_objc_protocols: ["list_names"],
+    batch_decompile: ["procedure_pseudo_code"],
+    get_call_graph: ["procedure_callees", "procedure_callers"],
+    analyze_swift_types: ["list_procedures"],
+    find_xrefs_to_name: ["list_names", "xrefs"],
+    binary_overview: [
+        "list_segments",
+        "list_documents",
+        "list_procedures",
+        "list_strings",
+    ],
+    analyze_function: ["analyze_function"],
+    trace_feature: [
+        "list_strings",
+        "list_procedures",
+        "xrefs",
+        "resolve_containing_procedure",
+    ],
+};
+/** Build stable per-operation availability without hiding familiar tools. */
+export const buildCapabilityInventory = (sessionStatus, policy) => {
+    const status = statusSchema.parse(sessionStatus);
+    const descriptors = new Map(status.capabilities.map((descriptor) => [descriptor.operation, descriptor]));
+    return TOOL_CONTRACTS.map((contract) => {
+        const availability = availabilityFor(contract.name, contract.kind, status.open, status.kind, descriptors, policy);
+        return {
+            name: contract.name,
+            surface: contract.kind,
+            available: availability.reason === "available",
+            reason: availability.reason,
+            remediation: availability.remediation,
+            annotations: {
+                read_only: contract.annotations.readOnlyHint ?? false,
+                destructive: contract.annotations.destructiveHint ?? false,
+                idempotent: contract.annotations.idempotentHint ?? false,
+                open_world: contract.annotations.openWorldHint ?? true,
+            },
+        };
+    }).sort((left, right) => left.name.localeCompare(right.name));
+};
+const availabilityFor = (name, kind, targetOpen, targetKind, descriptors, policy) => {
+    if (name === "capture_process_scenario" && !policy.processCaptureEnabled)
+        return {
+            reason: "policy_disabled",
+            remediation: "Enable or grant process_capture within the administrator ceiling.",
+        };
+    if (name === "import_evidence_bundle" && policy.evidenceFileRoots === 0)
+        return {
+            reason: "policy_disabled",
+            remediation: "Configure or grant an evidence_read root.",
+        };
+    if (kind === "browser-provider")
+        return policy.browserObservationEnabled === true
+            ? { reason: "available", remediation: null }
+            : {
+                reason: "policy_disabled",
+                remediation: "Enable browser observation and configure exact CDP endpoint and page origins.",
+            };
+    if (kind === "session")
+        return { reason: "available", remediation: null };
+    if (!targetOpen)
+        return {
+            reason: "target_required",
+            remediation: "Call open_binary with a supported local target.",
+        };
+    if (targetKind !== undefined &&
+        targetKind !== "executable" &&
+        targetKind !== "database" &&
+        (kind === "official-proxy" || kind === "enhanced"))
+        return {
+            reason: "target_unsupported",
+            remediation: "Inventory or extract a native executable, then call open_binary on that executable.",
+        };
+    if (kind === "enhanced")
+        return composedAvailability(name, descriptors);
+    const descriptor = descriptors.get(name);
+    if (descriptor === undefined)
+        return {
+            reason: "provider_missing",
+            remediation: "Install or configure a provider that declares this operation.",
+        };
+    if (!descriptor.available &&
+        descriptor.reason?.toLowerCase().includes("require macos") === true)
+        return {
+            reason: "unsupported_host",
+            remediation: descriptor.reason,
+        };
+    return descriptor.available
+        ? { reason: "available", remediation: null }
+        : {
+            reason: "provider_unavailable",
+            remediation: descriptor.reason ?? "Choose another target or configured provider.",
+        };
+};
+const composedAvailability = (name, descriptors) => {
+    const requirements = ENHANCED_REQUIREMENTS[name];
+    if (requirements === undefined)
+        return {
+            reason: "provider_missing",
+            remediation: "No provider composition is declared for this operation.",
+        };
+    const missing = requirements.find((operation) => !descriptors.has(operation));
+    if (missing !== undefined)
+        return {
+            reason: "provider_missing",
+            remediation: `Configure a provider for required operation ${missing}.`,
+        };
+    const unavailable = requirements
+        .map((operation) => descriptors.get(operation))
+        .find((descriptor) => descriptor?.available === false);
+    if (unavailable !== undefined)
+        return {
+            reason: unavailable.reason?.toLowerCase().includes("require macos") === true
+                ? "unsupported_host"
+                : "provider_unavailable",
+            remediation: unavailable.reason ?? "Choose another target or configured provider.",
+        };
+    return { reason: "available", remediation: null };
+};

package/dist/application/ClientRegistrationStatus.js

@@ -0,0 +1,69 @@
+import { access, readFile } from "node:fs/promises";
+import { resolve } from "node:path";
+import { parse as parseToml } from "smol-toml";
+import { z } from "zod";
+import { PRODUCT_IDENTITY } from "../identity.js";
+import { supportedClients } from "./SupportedClients.js";
+const objectSchema = z.record(z.string(), z.unknown());
+const registrationSchema = z
+    .object({ command: z.string().min(1), args: z.array(z.string()).default([]) })
+    .passthrough();
+/** Inspect supported client registrations without reading their environment. */
+export const readClientRegistrationStatuses = async (home, currentCommandPath = resolve(process.argv[1] ?? "unknown")) => {
+    const statuses = [];
+    for (const client of supportedClients(home)) {
+        if (client.format === "unsupported" || !(await exists(client.markerPath)))
+            continue;
+        try {
+            const content = await readFile(client.configPath, "utf8");
+            const document = objectSchema.parse(client.format === "toml" ? parseToml(content) : JSON.parse(content));
+            const servers = objectSchema.parse(document[client.format === "toml" ? "mcp_servers" : "mcpServers"] ?? {});
+            const raw = servers[PRODUCT_IDENTITY.mcpServerKey];
+            if (raw === undefined) {
+                statuses.push(status(client.name, client.configPath, [], "missing"));
+                continue;
+            }
+            const registration = registrationSchema.parse(raw);
+            const command = [registration.command, ...registration.args];
+            statuses.push(status(client.name, client.configPath, command, registrationAligned(command, currentCommandPath)
+                ? "aligned"
+                : "stale"));
+        }
+        catch (cause) {
+            statuses.push(status(client.name, client.configPath, [], isMissing(cause) ? "missing" : "invalid"));
+        }
+    }
+    return statuses.sort((left, right) => left.client.localeCompare(right.client));
+};
+const registrationAligned = (command, currentCommandPath) => {
+    if (command.length === 4 &&
+        command[0] === "npx" &&
+        command[1] === "-y" &&
+        command[2] === PRODUCT_IDENTITY.packageName &&
+        command[3] === "mcp")
+        return true;
+    return (command.length === 2 &&
+        command[1] === "mcp" &&
+        resolve(command[0] ?? "") === currentCommandPath);
+};
+const status = (client, configPath, command, state) => ({
+    client,
+    config_path: configPath,
+    command,
+    state,
+    remediation: state === "aligned"
+        ? null
+        : "Run rea setup to refresh this registration, then restart the client.",
+});
+const exists = async (path) => {
+    if (path === undefined)
+        return false;
+    try {
+        await access(path);
+        return true;
+    }
+    catch {
+        return false;
+    }
+};
+const isMissing = (cause) => cause instanceof Error && "code" in cause && cause.code === "ENOENT";

package/dist/application/ConfiguredRoots.js

@@ -0,0 +1,19 @@
+import { realpath } from "node:fs/promises";
+/** Canonicalize configured policy roots while ignoring stale missing entries. */
+export const canonicalizeConfiguredRoots = async (roots) => {
+    const canonical = [];
+    for (const root of roots) {
+        try {
+            canonical.push(await realpath(root));
+        }
+        catch (cause) {
+            if (!isMissingPath(cause))
+                throw cause;
+        }
+    }
+    return canonical;
+};
+const isMissingPath = (cause) => typeof cause === "object" &&
+    cause !== null &&
+    "code" in cause &&
+    cause.code === "ENOENT";

package/dist/application/CrossVersionInventory.js

@@ -8,13 +8,19 @@ import { scanAuthorizedArtifactInventory } from "./AuthorizedArtifactInventory.j
 import { ARTIFACT_GRAPH_PROVIDER } from "./InvestigationProviders.js";
 export const AUTOMATIC_RUN_LIMITATION = "Automatic cross-version runs compare shipped artifact structure only; they do not execute either version.";
 /** Authorize and scan both inputs once under the same bounded traversal policy. */
-export const scanVersions = async (input, inputRoots, signal) => {
+export const scanVersions = async (input, inputRoots, signal, integrityContinueEnabled = false) => {
     try {
         if (signal?.aborted === true)
             return err(new AnalysisCancelledError("find_changed_behavior"));
         const limits = artifactLimits(input.options);
-        const left = await scanAuthorizedArtifactInventory(input.left_path, inputRoots, limits, signal);
-        const right = await scanAuthorizedArtifactInventory(input.right_path, inputRoots, limits, signal);
+        const integrity = {
+            mode: input.integrity_policy,
+            approved: input.integrity_continue_approved,
+            enabled: integrityContinueEnabled,
+            maxMismatches: input.max_integrity_mismatches,
+        };
+        const left = await scanAuthorizedArtifactInventory(input.left_path, inputRoots, limits, signal, integrity);
+        const right = await scanAuthorizedArtifactInventory(input.right_path, inputRoots, limits, signal, integrity);
         return ok({ left, right });
     }
     catch (cause) {
@@ -25,8 +31,8 @@ export const scanVersions = async (input, inputRoots, signal) => {
 };
 /** Project complete snapshots into bounded, comparable Evidence page sets. */
 export const createInventoryEvidencePages = (input, snapshots) => {
-    const left = inventoryPages(input.left_path, snapshots.left, input.options);
-    const right = inventoryPages(input.right_path, snapshots.right, input.options);
+    const left = inventoryPages(input.left_path, snapshots.left, input);
+    const right = inventoryPages(input.right_path, snapshots.right, input);
     if (left.length > 100 || right.length > 100)
         return err(new ArtifactOperationError("inventory_artifact", "limit"));
     return ok({ left, right });
@@ -46,11 +52,13 @@ export const runLimitations = (snapshots) => [
         AUTOMATIC_RUN_LIMITATION,
     ]),
 ].sort((left, right) => left.localeCompare(right));
-const inventoryPages = (path, snapshot, options) => {
+const inventoryPages = (path, snapshot, input) => {
+    const options = input.options;
     const count = Math.max(1, Math.ceil(snapshot.nodes.length / options.page_size), Math.ceil(snapshot.occurrences.length / options.page_size), Math.ceil(snapshot.edges.length / options.page_size));
-    return Array.from({ length: count }, (_, index) => inventoryPage(path, snapshot, options, index * options.page_size));
+    return Array.from({ length: count }, (_, index) => inventoryPage(path, snapshot, input, index * options.page_size));
 };
-const inventoryPage = (path, snapshot, options, offset) => {
+const inventoryPage = (path, snapshot, input, offset) => {
+    const options = input.options;
     const result = paginateArtifactInventory(snapshot, {
         nodeOffset: offset,
         nodeLimit: options.page_size,
@@ -78,6 +86,9 @@ const inventoryPage = (path, snapshot, options, offset) => {
             max_compression_ratio: options.max_compression_ratio,
             max_depth: options.max_depth,
             max_path_bytes: options.max_path_bytes,
+            integrity_policy: input.integrity_policy,
+            integrity_continue_approved: input.integrity_continue_approved,
+            max_integrity_mismatches: input.max_integrity_mismatches,
         },
         result: jsonValueSchema.parse(result),
         rawResult: null,