rea-agents 1.6.0 → 2.0.0

package/dist/cli.js

@@ -3,7 +3,12 @@ import { fileURLToPath } from "node:url";
 import { createInterface } from "node:readline/promises";
 import { runDoctor } from "./application/Doctor.js";
 import { runDirectAnalysis, runProviderAnalysis, runSessionStatus, } from "./application/DirectAnalysis.js";
-import { runSetup } from "./application/Setup.js";
+import { compareManagedMemberPaths } from "./application/ManagedMemberComparisonService.js";
+import { projectManagedApplicationGraphEvidence } from "./application/ManagedApplicationGraphService.js";
+import { verifyManagedNativeBoundariesEvidence } from "./application/ManagedNativeVerificationService.js";
+import { importManagedReconstructionEvidence } from "./application/ManagedReconstructionService.js";
+import { planManagedRuntimeCorrelationEvidence } from "./application/ManagedRuntimeCorrelationService.js";
+import { runSetup, systemSetupHost, } from "./application/Setup.js";
 import { runUninstall } from "./application/Uninstall.js";
 import { runUpgrade, systemUpgradeHost } from "./application/Upgrade.js";
 import { PRODUCT_IDENTITY } from "./identity.js";
@@ -21,6 +26,11 @@ import { registerPolicyCommands } from "./cliPolicyCommands.js";
 import { registerBrowserCommands } from "./cliBrowserCommands.js";
 import { registerAdvancedBrowserCommands } from "./cliBrowserAdvancedCommands.js";
 import { registerElectronCommands } from "./cliElectronCommands.js";
+import { registerApplicationCommands } from "./cliApplicationCommands.js";
+import { CLI_COMMANDS } from "./cliCommandNames.js";
+import { parseCliJsonInput } from "./cliJsonInput.js";
+import { analysisProviderSelectorSchema, } from "./contracts/providerSelection.js";
+import { createSystemDoctorHost } from "./doctorRuntime.js";
 /**
  * Build the one-shot Incur CLI without starting Hopper at import time.
  * Analysis commands acquire and close their own sessions; bare `mcp` and
@@ -56,6 +66,7 @@ export const createCli = () => {
     registerCapabilityCommands(cli, logger);
     registerNativeCommands(cli, logger);
     registerArtifactCommands(cli, logger);
+    registerManagedCommands(cli, logger);
     registerInvestigationCommands(cli, logger);
     registerEvidenceCommands(cli, logger);
     registerReferenceSourceCommand(cli, logger);
@@ -64,6 +75,7 @@ export const createCli = () => {
     registerBrowserCommands(cli, logger);
     registerAdvancedBrowserCommands(cli, logger);
     registerElectronCommands(cli, logger);
+    registerApplicationCommands(cli, logger);
     return cli;
 };
 const registerCoreCommands = (cli, logger) => {
@@ -75,35 +87,39 @@ const registerCoreCommands = (cli, logger) => {
             .min(1)
             .optional()
             .describe("Load and update a local analysis snapshot"),
+        provider: providerSelectionOption,
     });
-    cli.command("analyze", {
+    cli.command(CLI_COMMANDS.analyze, {
         description: "Get an overview of an app",
         args: z.object({
-            path: z.string().describe("App, program, or Hopper database path"),
+            path: z.string().describe("App, program, or analysis database path"),
         }),
         options: overviewOptions,
-        run: ({ args, options }) => logCliCommand(logger, "analyze", () => runDirectAnalysis(args.path, "binary_overview", { detail: options.detail, limit: options.limit }, { logger, snapshotPath: options.snapshot })),
+        run: ({ args, options }) => logCliCommand(logger, "analyze", () => runDirectAnalysis(args.path, "binary_overview", { detail: options.detail, limit: options.limit }, directAnalysisOptions(logger, options.snapshot, options.provider))),
     });
-    cli.command("inspect", {
+    cli.command(CLI_COMMANDS.inspect, {
         description: "Inspect an app overview with evidence",
         args: z.object({
-            path: z.string().describe("App, program, or Hopper database path"),
+            path: z.string().describe("App, program, or analysis database path"),
         }),
         options: overviewOptions,
-        run: ({ args, options }) => logCliCommand(logger, "inspect", () => runDirectAnalysis(args.path, "binary_overview", { detail: options.detail, limit: options.limit }, { logger, snapshotPath: options.snapshot })),
+        run: ({ args, options }) => logCliCommand(logger, "inspect", () => runDirectAnalysis(args.path, "binary_overview", { detail: options.detail, limit: options.limit }, directAnalysisOptions(logger, options.snapshot, options.provider))),
     });
-    cli.command("decompile", {
+    cli.command(CLI_COMMANDS.decompile, {
         description: "Read one part of an app as code",
         args: z.object({
             path: z.string().describe("App or program path"),
             address: z.string().describe("Procedure address"),
         }),
-        options: z.object({ snapshot: z.string().min(1).optional() }),
-        run: ({ args, options }) => logCliCommand(logger, "decompile", () => runDirectAnalysis(args.path, "procedure_pseudo_code", { procedure: args.address }, { logger, snapshotPath: options.snapshot })),
+        options: z.object({
+            snapshot: z.string().min(1).optional(),
+            provider: providerSelectionOption,
+        }),
+        run: ({ args, options }) => logCliCommand(logger, "decompile", () => runDirectAnalysis(args.path, "procedure_pseudo_code", { procedure: args.address }, directAnalysisOptions(logger, options.snapshot, options.provider))),
     });
 };
 const registerSetupCommands = (cli, logger) => {
-    cli.command("setup", {
+    cli.command(CLI_COMMANDS.setup, {
         description: "Install requirements and configure agents",
         options: z.object({
             yes: z
@@ -120,18 +136,18 @@ const registerSetupCommands = (cli, logger) => {
             approved: options.yes,
             installHopper: options.installHopper,
             structured: formatExplicit,
-        }, undefined, options.yes || formatExplicit || process.stdin.isTTY !== true
+        }, systemSetupHost(createSystemDoctorHost()), options.yes || formatExplicit || process.stdin.isTTY !== true
             ? undefined
             : confirmSetup)),
     });
-    cli.command("doctor", {
+    cli.command(CLI_COMMANDS.doctor, {
         description: "Check whether REA is ready",
         options: z.object({
             target: z.string().optional().describe("Optional app path to check"),
         }),
-        run: ({ options }) => logCliCommand(logger, "doctor", () => runDoctor(options.target)),
+        run: ({ options }) => logCliCommand(logger, "doctor", () => runDoctor(options.target, createSystemDoctorHost())),
     });
-    cli.command("uninstall", {
+    cli.command(CLI_COMMANDS.uninstall, {
         description: "Remove REA-owned agent configuration and skill files",
         options: z.object({
             purgeData: z
@@ -142,7 +158,7 @@ const registerSetupCommands = (cli, logger) => {
         alias: { purgeData: "purge-data" },
         run: ({ options }) => logCliCommand(logger, "uninstall", () => runUninstall(options.purgeData)),
     });
-    cli.command("upgrade", {
+    cli.command(CLI_COMMANDS.upgrade, {
         description: "Upgrade a global npm installation to the latest REA release",
         run: ({ formatExplicit }) => logCliCommand(logger, "upgrade", () => runUpgrade(PRODUCT_IDENTITY.packageVersion, systemUpgradeHost(), formatExplicit ? "structured" : "human")),
     });
@@ -166,18 +182,21 @@ const confirmSetup = async (actions) => {
     }
 };
 const registerXrefsCommand = (cli, logger) => {
-    cli.command("xrefs", {
+    cli.command(CLI_COMMANDS.xrefs, {
         description: "List bounded references to an analyzed address",
         args: z.object({
             path: z.string().describe("App or program path"),
             address: z.string().describe("Hexadecimal address"),
         }),
-        options: z.object({ snapshot: z.string().min(1).optional() }),
-        run: ({ args, options }) => logCliCommand(logger, "xrefs", () => runDirectAnalysis(args.path, "xrefs", { address: args.address }, { logger, snapshotPath: options.snapshot })),
+        options: z.object({
+            snapshot: z.string().min(1).optional(),
+            provider: providerSelectionOption,
+        }),
+        run: ({ args, options }) => logCliCommand(logger, "xrefs", () => runDirectAnalysis(args.path, "xrefs", { address: args.address }, directAnalysisOptions(logger, options.snapshot, options.provider))),
     });
 };
 const registerTraceCommand = (cli, logger) => {
-    cli.command("trace", {
+    cli.command(CLI_COMMANDS.trace, {
         description: "Trace a bounded literal feature through analyzed references",
         args: z.object({
             path: z.string().describe("App or program path"),
@@ -188,6 +207,7 @@ const registerTraceCommand = (cli, logger) => {
             limit: z.number().int().min(1).max(100).default(20),
             maxOperations: z.number().int().min(1).max(100).default(20),
             snapshot: z.string().min(1).optional(),
+            provider: providerSelectionOption,
         }),
         alias: {
             caseSensitive: "case-sensitive",
@@ -198,11 +218,14 @@ const registerTraceCommand = (cli, logger) => {
             case_sensitive: options.caseSensitive,
             limit: options.limit,
             max_operations: options.maxOperations,
-        }, { logger, snapshotPath: options.snapshot })),
+        }, directAnalysisOptions(logger, options.snapshot, options.provider))),
     });
 };
 const registerCapabilityCommands = (cli, logger) => {
-    for (const command of ["capabilities", "providers"]) {
+    for (const command of [
+        CLI_COMMANDS.capabilities,
+        CLI_COMMANDS.providers,
+    ]) {
         cli.command(command, {
             description: command === "capabilities"
                 ? "List provider capabilities and side effects"
@@ -212,7 +235,7 @@ const registerCapabilityCommands = (cli, logger) => {
     }
 };
 const registerFunctionCommand = (cli, logger) => {
-    cli.command("function", {
+    cli.command(CLI_COMMANDS.function, {
         description: "Analyze one bounded function with evidence",
         args: z.object({
             path: z.string().describe("App or program path"),
@@ -224,6 +247,7 @@ const registerFunctionCommand = (cli, logger) => {
             maxPseudocodeChars: z.number().int().min(1).max(100_000).default(20_000),
             maxInstructions: z.number().int().min(1).max(5_000).default(500),
             snapshot: z.string().min(1).optional(),
+            provider: providerSelectionOption,
         }),
         alias: {
             includeAssembly: "include-assembly",
@@ -236,11 +260,11 @@ const registerFunctionCommand = (cli, logger) => {
             limit: options.limit,
             max_pseudocode_chars: options.maxPseudocodeChars,
             max_instructions: options.maxInstructions,
-        }, { logger, snapshotPath: options.snapshot })),
+        }, directAnalysisOptions(logger, options.snapshot, options.provider))),
     });
 };
 const registerSearchCommand = (cli, logger) => {
-    cli.command("search", {
+    cli.command(CLI_COMMANDS.search, {
         description: "Search bounded analyzed strings or procedure names",
         args: z.object({
             path: z.string().describe("App or program path"),
@@ -253,6 +277,7 @@ const registerSearchCommand = (cli, logger) => {
             offset: z.number().int().min(0).default(0),
             limit: z.number().int().min(1).max(100).default(100),
             snapshot: z.string().min(1).optional(),
+            provider: providerSelectionOption,
         }),
         alias: { caseSensitive: "case-sensitive" },
         run: ({ args, options }) => logCliCommand(logger, "search", () => runDirectAnalysis(args.path, options.kind === "strings" ? "search_strings" : "search_procedures", {
@@ -261,11 +286,11 @@ const registerSearchCommand = (cli, logger) => {
             case_sensitive: options.caseSensitive,
             offset: options.offset,
             limit: options.limit,
-        }, { logger, snapshotPath: options.snapshot })),
+        }, directAnalysisOptions(logger, options.snapshot, options.provider))),
     });
 };
 const registerReferenceSourceCommand = (cli, logger) => {
-    cli.command("import-reference-source", {
+    cli.command(CLI_COMMANDS.importReferenceSource, {
         description: "Import a bounded source tree as historical reference only",
         args: z.object({
             root: z
@@ -322,7 +347,7 @@ const registerReferenceSourceCommand = (cli, logger) => {
     });
 };
 const registerArtifactCommands = (cli, logger) => {
-    cli.command("inventory-artifact", {
+    cli.command(CLI_COMMANDS.inventoryArtifact, {
         description: "Build a bounded deterministic artifact graph",
         args: z.object({
             path: z.string().describe("Application or package path"),
@@ -354,7 +379,7 @@ const registerArtifactCommands = (cli, logger) => {
             native_mount_approved: options.nativeMountApproved,
         }, logger)),
     });
-    cli.command("extract-artifact", {
+    cli.command(CLI_COMMANDS.extractArtifact, {
         description: "Extract explicitly selected artifact occurrences safely",
         args: z.object({
             path: z.string().describe("Application or package path"),
@@ -372,11 +397,390 @@ const registerArtifactCommands = (cli, logger) => {
         }, logger)),
     });
 };
+const registerManagedCommands = (cli, logger) => {
+    cli.command(CLI_COMMANDS.inspectManagedArtifact, {
+        description: "Inspect PE/CLI identity without loading target code",
+        args: z.object({
+            path: z.string().describe("Managed PE executable or assembly path"),
+        }),
+        options: z.object({
+            referenceOffset: z.number().int().min(0).default(0),
+            referenceLimit: z.number().int().min(1).max(500).default(100),
+            resourceOffset: z.number().int().min(0).default(0),
+            resourceLimit: z.number().int().min(1).max(500).default(100),
+            attributeOffset: z.number().int().min(0).default(0),
+            attributeLimit: z.number().int().min(1).max(500).default(100),
+            maxFileBytes: z
+                .number()
+                .int()
+                .min(4_096)
+                .max(1_073_741_824)
+                .default(268_435_456),
+            maxMetadataBytes: z
+                .number()
+                .int()
+                .min(256)
+                .max(268_435_456)
+                .default(67_108_864),
+            maxTableRows: z.number().int().min(1).max(1_000_000).default(100_000),
+            maxHeapItemBytes: z
+                .number()
+                .int()
+                .min(1)
+                .max(16_777_216)
+                .default(1_048_576),
+        }),
+        alias: {
+            referenceOffset: "reference-offset",
+            referenceLimit: "reference-limit",
+            resourceOffset: "resource-offset",
+            resourceLimit: "resource-limit",
+            attributeOffset: "attribute-offset",
+            attributeLimit: "attribute-limit",
+            maxFileBytes: "max-file-bytes",
+            maxMetadataBytes: "max-metadata-bytes",
+            maxTableRows: "max-table-rows",
+            maxHeapItemBytes: "max-heap-item-bytes",
+        },
+        run: ({ args, options }) => logCliCommand(logger, "inspect-managed-artifact", () => runProviderAnalysis(args.path, "inspect_managed_artifact", {
+            reference_offset: options.referenceOffset,
+            reference_limit: options.referenceLimit,
+            resource_offset: options.resourceOffset,
+            resource_limit: options.resourceLimit,
+            attribute_offset: options.attributeOffset,
+            attribute_limit: options.attributeLimit,
+            max_file_bytes: options.maxFileBytes,
+            max_metadata_bytes: options.maxMetadataBytes,
+            max_table_rows: options.maxTableRows,
+            max_heap_item_bytes: options.maxHeapItemBytes,
+        }, logger)),
+    });
+    cli.command(CLI_COMMANDS.inspectManagedMembers, {
+        description: "Inspect PE/CLI metadata members, signatures, and CIL anchors without loading target code",
+        args: z.object({
+            path: z.string().describe("Managed PE executable or assembly path"),
+        }),
+        options: z.object({
+            typeOffset: z.number().int().min(0).default(0),
+            typeLimit: z.number().int().min(1).max(500).default(100),
+            methodOffset: z.number().int().min(0).default(0),
+            methodLimit: z.number().int().min(1).max(500).default(100),
+            fieldOffset: z.number().int().min(0).default(0),
+            fieldLimit: z.number().int().min(1).max(500).default(100),
+            memberRefOffset: z.number().int().min(0).default(0),
+            memberRefLimit: z.number().int().min(1).max(500).default(100),
+            edgeOffset: z.number().int().min(0).default(0),
+            edgeLimit: z.number().int().min(1).max(1_000).default(250),
+            instructionAnchorLimit: z.number().int().min(0).max(500).default(100),
+            maxFileBytes: z
+                .number()
+                .int()
+                .min(4_096)
+                .max(1_073_741_824)
+                .default(268_435_456),
+            maxMetadataBytes: z
+                .number()
+                .int()
+                .min(256)
+                .max(268_435_456)
+                .default(67_108_864),
+            maxTableRows: z.number().int().min(1).max(1_000_000).default(100_000),
+            maxHeapItemBytes: z
+                .number()
+                .int()
+                .min(1)
+                .max(16_777_216)
+                .default(1_048_576),
+            maxMethodBodyBytes: z
+                .number()
+                .int()
+                .min(1)
+                .max(16_777_216)
+                .default(1_048_576),
+            maxMethodInstructions: z
+                .number()
+                .int()
+                .min(1)
+                .max(100_000)
+                .default(10_000),
+        }),
+        alias: {
+            typeOffset: "type-offset",
+            typeLimit: "type-limit",
+            methodOffset: "method-offset",
+            methodLimit: "method-limit",
+            fieldOffset: "field-offset",
+            fieldLimit: "field-limit",
+            memberRefOffset: "member-ref-offset",
+            memberRefLimit: "member-ref-limit",
+            edgeOffset: "edge-offset",
+            edgeLimit: "edge-limit",
+            instructionAnchorLimit: "instruction-anchor-limit",
+            maxFileBytes: "max-file-bytes",
+            maxMetadataBytes: "max-metadata-bytes",
+            maxTableRows: "max-table-rows",
+            maxHeapItemBytes: "max-heap-item-bytes",
+            maxMethodBodyBytes: "max-method-body-bytes",
+            maxMethodInstructions: "max-method-instructions",
+        },
+        run: ({ args, options }) => logCliCommand(logger, "inspect-managed-members", () => runProviderAnalysis(args.path, "inspect_managed_members", {
+            type_offset: options.typeOffset,
+            type_limit: options.typeLimit,
+            method_offset: options.methodOffset,
+            method_limit: options.methodLimit,
+            field_offset: options.fieldOffset,
+            field_limit: options.fieldLimit,
+            member_ref_offset: options.memberRefOffset,
+            member_ref_limit: options.memberRefLimit,
+            edge_offset: options.edgeOffset,
+            edge_limit: options.edgeLimit,
+            instruction_anchor_limit: options.instructionAnchorLimit,
+            max_file_bytes: options.maxFileBytes,
+            max_metadata_bytes: options.maxMetadataBytes,
+            max_table_rows: options.maxTableRows,
+            max_heap_item_bytes: options.maxHeapItemBytes,
+            max_method_body_bytes: options.maxMethodBodyBytes,
+            max_method_instructions: options.maxMethodInstructions,
+        }, logger)),
+    });
+    cli.command(CLI_COMMANDS.inspectManagedNativeBoundaries, {
+        description: "Inspect PE/CLI PInvoke and native implementation boundary declarations without loading target code",
+        args: z.object({
+            path: z.string().describe("Managed PE executable or assembly path"),
+        }),
+        options: z.object({
+            moduleRefOffset: z.number().int().min(0).default(0),
+            moduleRefLimit: z.number().int().min(1).max(500).default(100),
+            importOffset: z.number().int().min(0).default(0),
+            importLimit: z.number().int().min(1).max(500).default(100),
+            implementationOffset: z.number().int().min(0).default(0),
+            implementationLimit: z.number().int().min(1).max(500).default(100),
+            maxFileBytes: z
+                .number()
+                .int()
+                .min(4_096)
+                .max(1_073_741_824)
+                .default(268_435_456),
+            maxMetadataBytes: z
+                .number()
+                .int()
+                .min(256)
+                .max(268_435_456)
+                .default(67_108_864),
+            maxTableRows: z.number().int().min(1).max(1_000_000).default(100_000),
+            maxHeapItemBytes: z
+                .number()
+                .int()
+                .min(1)
+                .max(16_777_216)
+                .default(1_048_576),
+        }),
+        alias: {
+            moduleRefOffset: "module-ref-offset",
+            moduleRefLimit: "module-ref-limit",
+            importOffset: "import-offset",
+            importLimit: "import-limit",
+            implementationOffset: "implementation-offset",
+            implementationLimit: "implementation-limit",
+            maxFileBytes: "max-file-bytes",
+            maxMetadataBytes: "max-metadata-bytes",
+            maxTableRows: "max-table-rows",
+            maxHeapItemBytes: "max-heap-item-bytes",
+        },
+        run: ({ args, options }) => logCliCommand(logger, "inspect-managed-native-boundaries", () => runProviderAnalysis(args.path, "inspect_managed_native_boundaries", {
+            module_ref_offset: options.moduleRefOffset,
+            module_ref_limit: options.moduleRefLimit,
+            import_offset: options.importOffset,
+            import_limit: options.importLimit,
+            implementation_offset: options.implementationOffset,
+            implementation_limit: options.implementationLimit,
+            max_file_bytes: options.maxFileBytes,
+            max_metadata_bytes: options.maxMetadataBytes,
+            max_table_rows: options.maxTableRows,
+            max_heap_item_bytes: options.maxHeapItemBytes,
+        }, logger)),
+    });
+    cli.command(CLI_COMMANDS.compareManagedMembers, {
+        description: "Compare two managed PE/CLI member inventories without name-based matching",
+        args: z.object({
+            leftPath: z
+                .string()
+                .describe("Baseline managed PE executable or assembly"),
+            rightPath: z
+                .string()
+                .describe("Candidate managed PE executable or assembly"),
+        }),
+        options: z.object({
+            maxMethodMatches: z.number().int().min(1).max(50_000).default(10_000),
+            maxFieldMatches: z.number().int().min(0).max(50_000).default(5_000),
+            maxCandidates: z.number().int().min(1).max(500).default(50),
+            typeLimit: z.number().int().min(1).max(500).default(500),
+            methodLimit: z.number().int().min(1).max(500).default(500),
+            fieldLimit: z.number().int().min(1).max(500).default(500),
+            memberRefLimit: z.number().int().min(1).max(500).default(500),
+            edgeLimit: z.number().int().min(1).max(1_000).default(1_000),
+            instructionAnchorLimit: z.number().int().min(0).max(500).default(500),
+            maxFileBytes: z
+                .number()
+                .int()
+                .min(4_096)
+                .max(1_073_741_824)
+                .default(268_435_456),
+            maxMetadataBytes: z
+                .number()
+                .int()
+                .min(256)
+                .max(268_435_456)
+                .default(67_108_864),
+            maxTableRows: z.number().int().min(1).max(1_000_000).default(100_000),
+            maxHeapItemBytes: z
+                .number()
+                .int()
+                .min(1)
+                .max(16_777_216)
+                .default(1_048_576),
+            maxMethodBodyBytes: z
+                .number()
+                .int()
+                .min(1)
+                .max(16_777_216)
+                .default(1_048_576),
+            maxMethodInstructions: z
+                .number()
+                .int()
+                .min(1)
+                .max(100_000)
+                .default(100_000),
+        }),
+        alias: {
+            maxMethodMatches: "max-method-matches",
+            maxFieldMatches: "max-field-matches",
+            maxCandidates: "max-candidates",
+            typeLimit: "type-limit",
+            methodLimit: "method-limit",
+            fieldLimit: "field-limit",
+            memberRefLimit: "member-ref-limit",
+            edgeLimit: "edge-limit",
+            instructionAnchorLimit: "instruction-anchor-limit",
+            maxFileBytes: "max-file-bytes",
+            maxMetadataBytes: "max-metadata-bytes",
+            maxTableRows: "max-table-rows",
+            maxHeapItemBytes: "max-heap-item-bytes",
+            maxMethodBodyBytes: "max-method-body-bytes",
+            maxMethodInstructions: "max-method-instructions",
+        },
+        run: ({ args, options }) => logCliCommand(logger, "compare-managed-members", async () => {
+            const result = await compareManagedMemberPaths({
+                leftPath: args.leftPath,
+                rightPath: args.rightPath,
+                comparisonLimits: {
+                    max_method_matches: options.maxMethodMatches,
+                    max_field_matches: options.maxFieldMatches,
+                    max_candidates: options.maxCandidates,
+                },
+                memberLimits: {
+                    maxFileBytes: options.maxFileBytes,
+                    typeOffset: 0,
+                    typeLimit: options.typeLimit,
+                    methodOffset: 0,
+                    methodLimit: options.methodLimit,
+                    fieldOffset: 0,
+                    fieldLimit: options.fieldLimit,
+                    memberRefOffset: 0,
+                    memberRefLimit: options.memberRefLimit,
+                    edgeOffset: 0,
+                    edgeLimit: options.edgeLimit,
+                    instructionAnchorLimit: options.instructionAnchorLimit,
+                    maxMetadataBytes: options.maxMetadataBytes,
+                    maxTableRows: options.maxTableRows,
+                    maxHeapItemBytes: options.maxHeapItemBytes,
+                    maxMethodBodyBytes: options.maxMethodBodyBytes,
+                    maxMethodInstructions: options.maxMethodInstructions,
+                },
+            });
+            return result.ok
+                ? result.value
+                : {
+                    error: "Managed member comparison failed",
+                    ...projectAnalysisError(result.error),
+                };
+        }),
+    });
+    cli.command(CLI_COMMANDS.importManagedReconstruction, {
+        description: "Import decompiler-produced managed reconstruction against exact static member evidence",
+        args: z.object({
+            inputJson: z
+                .string()
+                .describe("Inline managed reconstruction JSON or JSON file path"),
+        }),
+        run: ({ args }) => logCliCommand(logger, "import-managed-reconstruction", async () => {
+            const input = await parseCliJsonInput(args.inputJson, "import-managed-reconstruction");
+            if (!input.ok)
+                return input.error;
+            const result = importManagedReconstructionEvidence(input.value);
+            return result.ok ? result.value : projectAnalysisError(result.error);
+        }),
+    });
+    cli.command(CLI_COMMANDS.verifyManagedNativeBoundaries, {
+        description: "Verify managed P/Invoke declarations against authenticated native Evidence",
+        args: z.object({
+            inputJson: z
+                .string()
+                .describe("Inline managed/native verification JSON or JSON file path"),
+        }),
+        run: ({ args }) => logCliCommand(logger, "verify-managed-native-boundaries", async () => {
+            const input = await parseCliJsonInput(args.inputJson, "verify-managed-native-boundaries");
+            if (!input.ok)
+                return input.error;
+            const result = verifyManagedNativeBoundariesEvidence(input.value);
+            return result.ok ? result.value : projectAnalysisError(result.error);
+        }),
+    });
+    cli.command(CLI_COMMANDS.planManagedRuntimeCorrelation, {
+        description: "Plan a separately authorized managed runtime-correlation experiment without executing target code",
+        args: z.object({
+            inputJson: z
+                .string()
+                .describe("Inline managed runtime-correlation JSON or JSON file path"),
+        }),
+        run: ({ args }) => logCliCommand(logger, "plan-managed-runtime-correlation", async () => {
+            const input = await parseCliJsonInput(args.inputJson, "plan-managed-runtime-correlation");
+            if (!input.ok)
+                return input.error;
+            const config = parseConfig(process.env);
+            if (!config.ok)
+                return projectAnalysisError(config.error);
+            const authority = await loadConfiguredPermissionAuthority(config.value);
+            if (!authority.ok)
+                return projectAnalysisError(authority.error);
+            const result = await planManagedRuntimeCorrelationEvidence({
+                policy: config.value.managedRuntimePolicy,
+                authority: authority.value,
+            }, input.value);
+            return result.ok ? result.value : projectAnalysisError(result.error);
+        }),
+    });
+    cli.command(CLI_COMMANDS.projectManagedApplicationGraph, {
+        description: "Project authenticated managed static Evidence into an application graph",
+        args: z.object({
+            inputJson: z
+                .string()
+                .describe("Inline managed application graph JSON or JSON file path"),
+        }),
+        run: ({ args }) => logCliCommand(logger, "project-managed-application-graph", async () => {
+            const input = await parseCliJsonInput(args.inputJson, "project-managed-application-graph");
+            if (!input.ok)
+                return input.error;
+            const result = projectManagedApplicationGraphEvidence(input.value);
+            return result.ok ? result.value : projectAnalysisError(result.error);
+        }),
+    });
+};
 const registerNativeCommands = (cli, logger) => {
     for (const [command, tool] of [
-        ["inspect-macho", "inspect_macho"],
-        ["inspect-signature", "inspect_signature"],
-        ["list-architectures", "list_architectures"],
+        [CLI_COMMANDS.inspectMacho, "inspect_macho"],
+        [CLI_COMMANDS.inspectSignature, "inspect_signature"],
+        [CLI_COMMANDS.listArchitectures, "list_architectures"],
     ]) {
         cli.command(command, {
             description: `Run ${tool} without launching Hopper`,
@@ -384,7 +788,7 @@ const registerNativeCommands = (cli, logger) => {
             run: ({ args }) => logCliCommand(logger, command, () => runProviderAnalysis(args.path, tool, {}, logger)),
         });
     }
-    cli.command("inspect-plist", {
+    cli.command(CLI_COMMANDS.inspectPlist, {
         description: "Parse app plist metadata without launching Hopper",
         args: z.object({ path: z.string().describe("App or Mach-O path") }),
         options: z.object({
@@ -393,7 +797,7 @@ const registerNativeCommands = (cli, logger) => {
         alias: { relativePath: "relative-path" },
         run: ({ args, options }) => logCliCommand(logger, "inspect-plist", () => runProviderAnalysis(args.path, "inspect_plist", { relative_path: options.relativePath }, logger)),
     });
-    cli.command("demangle-swift", {
+    cli.command(CLI_COMMANDS.demangleSwift, {
         description: "Demangle a bounded Swift symbol batch without Hopper",
         args: z.object({
             path: z.string().describe("Artifact path used for evidence identity"),
@@ -402,3 +806,11 @@ const registerNativeCommands = (cli, logger) => {
         run: ({ args }) => logCliCommand(logger, "demangle-swift", () => runProviderAnalysis(args.path, "demangle_swift", { symbols: args.symbols }, logger)),
     });
 };
+const providerSelectionOption = analysisProviderSelectorSchema
+    .optional()
+    .describe("Bind deep analysis to a provider ID or use deterministic auto selection");
+const directAnalysisOptions = (logger, snapshotPath, providerId) => ({
+    logger,
+    snapshotPath,
+    ...(providerId === undefined ? {} : { providerId }),
+});