rea-agents 1.7.0 → 2.0.0

package/dist/cli.js

@@ -3,6 +3,11 @@ import { fileURLToPath } from "node:url";
 import { createInterface } from "node:readline/promises";
 import { runDoctor } from "./application/Doctor.js";
 import { runDirectAnalysis, runProviderAnalysis, runSessionStatus, } from "./application/DirectAnalysis.js";
+import { compareManagedMemberPaths } from "./application/ManagedMemberComparisonService.js";
+import { projectManagedApplicationGraphEvidence } from "./application/ManagedApplicationGraphService.js";
+import { verifyManagedNativeBoundariesEvidence } from "./application/ManagedNativeVerificationService.js";
+import { importManagedReconstructionEvidence } from "./application/ManagedReconstructionService.js";
+import { planManagedRuntimeCorrelationEvidence } from "./application/ManagedRuntimeCorrelationService.js";
 import { runSetup, systemSetupHost, } from "./application/Setup.js";
 import { runUninstall } from "./application/Uninstall.js";
 import { runUpgrade, systemUpgradeHost } from "./application/Upgrade.js";
@@ -21,7 +26,9 @@ import { registerPolicyCommands } from "./cliPolicyCommands.js";
 import { registerBrowserCommands } from "./cliBrowserCommands.js";
 import { registerAdvancedBrowserCommands } from "./cliBrowserAdvancedCommands.js";
 import { registerElectronCommands } from "./cliElectronCommands.js";
+import { registerApplicationCommands } from "./cliApplicationCommands.js";
 import { CLI_COMMANDS } from "./cliCommandNames.js";
+import { parseCliJsonInput } from "./cliJsonInput.js";
 import { analysisProviderSelectorSchema, } from "./contracts/providerSelection.js";
 import { createSystemDoctorHost } from "./doctorRuntime.js";
 /**
@@ -59,6 +66,7 @@ export const createCli = () => {
     registerCapabilityCommands(cli, logger);
     registerNativeCommands(cli, logger);
     registerArtifactCommands(cli, logger);
+    registerManagedCommands(cli, logger);
     registerInvestigationCommands(cli, logger);
     registerEvidenceCommands(cli, logger);
     registerReferenceSourceCommand(cli, logger);
@@ -67,6 +75,7 @@ export const createCli = () => {
     registerBrowserCommands(cli, logger);
     registerAdvancedBrowserCommands(cli, logger);
     registerElectronCommands(cli, logger);
+    registerApplicationCommands(cli, logger);
     return cli;
 };
 const registerCoreCommands = (cli, logger) => {
@@ -388,6 +397,385 @@ const registerArtifactCommands = (cli, logger) => {
         }, logger)),
     });
 };
+const registerManagedCommands = (cli, logger) => {
+    cli.command(CLI_COMMANDS.inspectManagedArtifact, {
+        description: "Inspect PE/CLI identity without loading target code",
+        args: z.object({
+            path: z.string().describe("Managed PE executable or assembly path"),
+        }),
+        options: z.object({
+            referenceOffset: z.number().int().min(0).default(0),
+            referenceLimit: z.number().int().min(1).max(500).default(100),
+            resourceOffset: z.number().int().min(0).default(0),
+            resourceLimit: z.number().int().min(1).max(500).default(100),
+            attributeOffset: z.number().int().min(0).default(0),
+            attributeLimit: z.number().int().min(1).max(500).default(100),
+            maxFileBytes: z
+                .number()
+                .int()
+                .min(4_096)
+                .max(1_073_741_824)
+                .default(268_435_456),
+            maxMetadataBytes: z
+                .number()
+                .int()
+                .min(256)
+                .max(268_435_456)
+                .default(67_108_864),
+            maxTableRows: z.number().int().min(1).max(1_000_000).default(100_000),
+            maxHeapItemBytes: z
+                .number()
+                .int()
+                .min(1)
+                .max(16_777_216)
+                .default(1_048_576),
+        }),
+        alias: {
+            referenceOffset: "reference-offset",
+            referenceLimit: "reference-limit",
+            resourceOffset: "resource-offset",
+            resourceLimit: "resource-limit",
+            attributeOffset: "attribute-offset",
+            attributeLimit: "attribute-limit",
+            maxFileBytes: "max-file-bytes",
+            maxMetadataBytes: "max-metadata-bytes",
+            maxTableRows: "max-table-rows",
+            maxHeapItemBytes: "max-heap-item-bytes",
+        },
+        run: ({ args, options }) => logCliCommand(logger, "inspect-managed-artifact", () => runProviderAnalysis(args.path, "inspect_managed_artifact", {
+            reference_offset: options.referenceOffset,
+            reference_limit: options.referenceLimit,
+            resource_offset: options.resourceOffset,
+            resource_limit: options.resourceLimit,
+            attribute_offset: options.attributeOffset,
+            attribute_limit: options.attributeLimit,
+            max_file_bytes: options.maxFileBytes,
+            max_metadata_bytes: options.maxMetadataBytes,
+            max_table_rows: options.maxTableRows,
+            max_heap_item_bytes: options.maxHeapItemBytes,
+        }, logger)),
+    });
+    cli.command(CLI_COMMANDS.inspectManagedMembers, {
+        description: "Inspect PE/CLI metadata members, signatures, and CIL anchors without loading target code",
+        args: z.object({
+            path: z.string().describe("Managed PE executable or assembly path"),
+        }),
+        options: z.object({
+            typeOffset: z.number().int().min(0).default(0),
+            typeLimit: z.number().int().min(1).max(500).default(100),
+            methodOffset: z.number().int().min(0).default(0),
+            methodLimit: z.number().int().min(1).max(500).default(100),
+            fieldOffset: z.number().int().min(0).default(0),
+            fieldLimit: z.number().int().min(1).max(500).default(100),
+            memberRefOffset: z.number().int().min(0).default(0),
+            memberRefLimit: z.number().int().min(1).max(500).default(100),
+            edgeOffset: z.number().int().min(0).default(0),
+            edgeLimit: z.number().int().min(1).max(1_000).default(250),
+            instructionAnchorLimit: z.number().int().min(0).max(500).default(100),
+            maxFileBytes: z
+                .number()
+                .int()
+                .min(4_096)
+                .max(1_073_741_824)
+                .default(268_435_456),
+            maxMetadataBytes: z
+                .number()
+                .int()
+                .min(256)
+                .max(268_435_456)
+                .default(67_108_864),
+            maxTableRows: z.number().int().min(1).max(1_000_000).default(100_000),
+            maxHeapItemBytes: z
+                .number()
+                .int()
+                .min(1)
+                .max(16_777_216)
+                .default(1_048_576),
+            maxMethodBodyBytes: z
+                .number()
+                .int()
+                .min(1)
+                .max(16_777_216)
+                .default(1_048_576),
+            maxMethodInstructions: z
+                .number()
+                .int()
+                .min(1)
+                .max(100_000)
+                .default(10_000),
+        }),
+        alias: {
+            typeOffset: "type-offset",
+            typeLimit: "type-limit",
+            methodOffset: "method-offset",
+            methodLimit: "method-limit",
+            fieldOffset: "field-offset",
+            fieldLimit: "field-limit",
+            memberRefOffset: "member-ref-offset",
+            memberRefLimit: "member-ref-limit",
+            edgeOffset: "edge-offset",
+            edgeLimit: "edge-limit",
+            instructionAnchorLimit: "instruction-anchor-limit",
+            maxFileBytes: "max-file-bytes",
+            maxMetadataBytes: "max-metadata-bytes",
+            maxTableRows: "max-table-rows",
+            maxHeapItemBytes: "max-heap-item-bytes",
+            maxMethodBodyBytes: "max-method-body-bytes",
+            maxMethodInstructions: "max-method-instructions",
+        },
+        run: ({ args, options }) => logCliCommand(logger, "inspect-managed-members", () => runProviderAnalysis(args.path, "inspect_managed_members", {
+            type_offset: options.typeOffset,
+            type_limit: options.typeLimit,
+            method_offset: options.methodOffset,
+            method_limit: options.methodLimit,
+            field_offset: options.fieldOffset,
+            field_limit: options.fieldLimit,
+            member_ref_offset: options.memberRefOffset,
+            member_ref_limit: options.memberRefLimit,
+            edge_offset: options.edgeOffset,
+            edge_limit: options.edgeLimit,
+            instruction_anchor_limit: options.instructionAnchorLimit,
+            max_file_bytes: options.maxFileBytes,
+            max_metadata_bytes: options.maxMetadataBytes,
+            max_table_rows: options.maxTableRows,
+            max_heap_item_bytes: options.maxHeapItemBytes,
+            max_method_body_bytes: options.maxMethodBodyBytes,
+            max_method_instructions: options.maxMethodInstructions,
+        }, logger)),
+    });
+    cli.command(CLI_COMMANDS.inspectManagedNativeBoundaries, {
+        description: "Inspect PE/CLI PInvoke and native implementation boundary declarations without loading target code",
+        args: z.object({
+            path: z.string().describe("Managed PE executable or assembly path"),
+        }),
+        options: z.object({
+            moduleRefOffset: z.number().int().min(0).default(0),
+            moduleRefLimit: z.number().int().min(1).max(500).default(100),
+            importOffset: z.number().int().min(0).default(0),
+            importLimit: z.number().int().min(1).max(500).default(100),
+            implementationOffset: z.number().int().min(0).default(0),
+            implementationLimit: z.number().int().min(1).max(500).default(100),
+            maxFileBytes: z
+                .number()
+                .int()
+                .min(4_096)
+                .max(1_073_741_824)
+                .default(268_435_456),
+            maxMetadataBytes: z
+                .number()
+                .int()
+                .min(256)
+                .max(268_435_456)
+                .default(67_108_864),
+            maxTableRows: z.number().int().min(1).max(1_000_000).default(100_000),
+            maxHeapItemBytes: z
+                .number()
+                .int()
+                .min(1)
+                .max(16_777_216)
+                .default(1_048_576),
+        }),
+        alias: {
+            moduleRefOffset: "module-ref-offset",
+            moduleRefLimit: "module-ref-limit",
+            importOffset: "import-offset",
+            importLimit: "import-limit",
+            implementationOffset: "implementation-offset",
+            implementationLimit: "implementation-limit",
+            maxFileBytes: "max-file-bytes",
+            maxMetadataBytes: "max-metadata-bytes",
+            maxTableRows: "max-table-rows",
+            maxHeapItemBytes: "max-heap-item-bytes",
+        },
+        run: ({ args, options }) => logCliCommand(logger, "inspect-managed-native-boundaries", () => runProviderAnalysis(args.path, "inspect_managed_native_boundaries", {
+            module_ref_offset: options.moduleRefOffset,
+            module_ref_limit: options.moduleRefLimit,
+            import_offset: options.importOffset,
+            import_limit: options.importLimit,
+            implementation_offset: options.implementationOffset,
+            implementation_limit: options.implementationLimit,
+            max_file_bytes: options.maxFileBytes,
+            max_metadata_bytes: options.maxMetadataBytes,
+            max_table_rows: options.maxTableRows,
+            max_heap_item_bytes: options.maxHeapItemBytes,
+        }, logger)),
+    });
+    cli.command(CLI_COMMANDS.compareManagedMembers, {
+        description: "Compare two managed PE/CLI member inventories without name-based matching",
+        args: z.object({
+            leftPath: z
+                .string()
+                .describe("Baseline managed PE executable or assembly"),
+            rightPath: z
+                .string()
+                .describe("Candidate managed PE executable or assembly"),
+        }),
+        options: z.object({
+            maxMethodMatches: z.number().int().min(1).max(50_000).default(10_000),
+            maxFieldMatches: z.number().int().min(0).max(50_000).default(5_000),
+            maxCandidates: z.number().int().min(1).max(500).default(50),
+            typeLimit: z.number().int().min(1).max(500).default(500),
+            methodLimit: z.number().int().min(1).max(500).default(500),
+            fieldLimit: z.number().int().min(1).max(500).default(500),
+            memberRefLimit: z.number().int().min(1).max(500).default(500),
+            edgeLimit: z.number().int().min(1).max(1_000).default(1_000),
+            instructionAnchorLimit: z.number().int().min(0).max(500).default(500),
+            maxFileBytes: z
+                .number()
+                .int()
+                .min(4_096)
+                .max(1_073_741_824)
+                .default(268_435_456),
+            maxMetadataBytes: z
+                .number()
+                .int()
+                .min(256)
+                .max(268_435_456)
+                .default(67_108_864),
+            maxTableRows: z.number().int().min(1).max(1_000_000).default(100_000),
+            maxHeapItemBytes: z
+                .number()
+                .int()
+                .min(1)
+                .max(16_777_216)
+                .default(1_048_576),
+            maxMethodBodyBytes: z
+                .number()
+                .int()
+                .min(1)
+                .max(16_777_216)
+                .default(1_048_576),
+            maxMethodInstructions: z
+                .number()
+                .int()
+                .min(1)
+                .max(100_000)
+                .default(100_000),
+        }),
+        alias: {
+            maxMethodMatches: "max-method-matches",
+            maxFieldMatches: "max-field-matches",
+            maxCandidates: "max-candidates",
+            typeLimit: "type-limit",
+            methodLimit: "method-limit",
+            fieldLimit: "field-limit",
+            memberRefLimit: "member-ref-limit",
+            edgeLimit: "edge-limit",
+            instructionAnchorLimit: "instruction-anchor-limit",
+            maxFileBytes: "max-file-bytes",
+            maxMetadataBytes: "max-metadata-bytes",
+            maxTableRows: "max-table-rows",
+            maxHeapItemBytes: "max-heap-item-bytes",
+            maxMethodBodyBytes: "max-method-body-bytes",
+            maxMethodInstructions: "max-method-instructions",
+        },
+        run: ({ args, options }) => logCliCommand(logger, "compare-managed-members", async () => {
+            const result = await compareManagedMemberPaths({
+                leftPath: args.leftPath,
+                rightPath: args.rightPath,
+                comparisonLimits: {
+                    max_method_matches: options.maxMethodMatches,
+                    max_field_matches: options.maxFieldMatches,
+                    max_candidates: options.maxCandidates,
+                },
+                memberLimits: {
+                    maxFileBytes: options.maxFileBytes,
+                    typeOffset: 0,
+                    typeLimit: options.typeLimit,
+                    methodOffset: 0,
+                    methodLimit: options.methodLimit,
+                    fieldOffset: 0,
+                    fieldLimit: options.fieldLimit,
+                    memberRefOffset: 0,
+                    memberRefLimit: options.memberRefLimit,
+                    edgeOffset: 0,
+                    edgeLimit: options.edgeLimit,
+                    instructionAnchorLimit: options.instructionAnchorLimit,
+                    maxMetadataBytes: options.maxMetadataBytes,
+                    maxTableRows: options.maxTableRows,
+                    maxHeapItemBytes: options.maxHeapItemBytes,
+                    maxMethodBodyBytes: options.maxMethodBodyBytes,
+                    maxMethodInstructions: options.maxMethodInstructions,
+                },
+            });
+            return result.ok
+                ? result.value
+                : {
+                    error: "Managed member comparison failed",
+                    ...projectAnalysisError(result.error),
+                };
+        }),
+    });
+    cli.command(CLI_COMMANDS.importManagedReconstruction, {
+        description: "Import decompiler-produced managed reconstruction against exact static member evidence",
+        args: z.object({
+            inputJson: z
+                .string()
+                .describe("Inline managed reconstruction JSON or JSON file path"),
+        }),
+        run: ({ args }) => logCliCommand(logger, "import-managed-reconstruction", async () => {
+            const input = await parseCliJsonInput(args.inputJson, "import-managed-reconstruction");
+            if (!input.ok)
+                return input.error;
+            const result = importManagedReconstructionEvidence(input.value);
+            return result.ok ? result.value : projectAnalysisError(result.error);
+        }),
+    });
+    cli.command(CLI_COMMANDS.verifyManagedNativeBoundaries, {
+        description: "Verify managed P/Invoke declarations against authenticated native Evidence",
+        args: z.object({
+            inputJson: z
+                .string()
+                .describe("Inline managed/native verification JSON or JSON file path"),
+        }),
+        run: ({ args }) => logCliCommand(logger, "verify-managed-native-boundaries", async () => {
+            const input = await parseCliJsonInput(args.inputJson, "verify-managed-native-boundaries");
+            if (!input.ok)
+                return input.error;
+            const result = verifyManagedNativeBoundariesEvidence(input.value);
+            return result.ok ? result.value : projectAnalysisError(result.error);
+        }),
+    });
+    cli.command(CLI_COMMANDS.planManagedRuntimeCorrelation, {
+        description: "Plan a separately authorized managed runtime-correlation experiment without executing target code",
+        args: z.object({
+            inputJson: z
+                .string()
+                .describe("Inline managed runtime-correlation JSON or JSON file path"),
+        }),
+        run: ({ args }) => logCliCommand(logger, "plan-managed-runtime-correlation", async () => {
+            const input = await parseCliJsonInput(args.inputJson, "plan-managed-runtime-correlation");
+            if (!input.ok)
+                return input.error;
+            const config = parseConfig(process.env);
+            if (!config.ok)
+                return projectAnalysisError(config.error);
+            const authority = await loadConfiguredPermissionAuthority(config.value);
+            if (!authority.ok)
+                return projectAnalysisError(authority.error);
+            const result = await planManagedRuntimeCorrelationEvidence({
+                policy: config.value.managedRuntimePolicy,
+                authority: authority.value,
+            }, input.value);
+            return result.ok ? result.value : projectAnalysisError(result.error);
+        }),
+    });
+    cli.command(CLI_COMMANDS.projectManagedApplicationGraph, {
+        description: "Project authenticated managed static Evidence into an application graph",
+        args: z.object({
+            inputJson: z
+                .string()
+                .describe("Inline managed application graph JSON or JSON file path"),
+        }),
+        run: ({ args }) => logCliCommand(logger, "project-managed-application-graph", async () => {
+            const input = await parseCliJsonInput(args.inputJson, "project-managed-application-graph");
+            if (!input.ok)
+                return input.error;
+            const result = projectManagedApplicationGraphEvidence(input.value);
+            return result.ok ? result.value : projectAnalysisError(result.error);
+        }),
+    });
+};
 const registerNativeCommands = (cli, logger) => {
     for (const [command, tool] of [
         [CLI_COMMANDS.inspectMacho, "inspect_macho"],

package/dist/cliApplicationCommands.js

@@ -0,0 +1,62 @@
+import { Cli, z } from "incur";
+import { compareApplicationVersionsEvidence, traceApplicationFeatureEvidence, } from "./application/JavaScriptApplicationWorkflowService.js";
+import { runControlledReplay } from "./application/JavaScriptReplayService.js";
+import { loadConfiguredPermissionAuthority } from "./application/PermissionConfiguration.js";
+import { CLI_COMMANDS } from "./cliCommandNames.js";
+import { parseCliJsonInput } from "./cliJsonInput.js";
+import { logCliCommand } from "./cliLogging.js";
+import { AnalysisInputError, projectAnalysisError } from "./domain/errors.js";
+import { parseConfig } from "./config.js";
+import { LinuxJavaScriptReplayRunner } from "./replay/LinuxJavaScriptReplayRunner.js";
+import { SystemJavaScriptReplayHost } from "./replay/SystemJavaScriptReplayHost.js";
+/** Register CLI equivalents of provider-neutral application graph workflows. */
+export const registerApplicationCommands = (cli, logger) => {
+    registerJsonCommand(cli, logger, CLI_COMMANDS.traceApplicationFeature, "Trace a typed seed through authenticated application Evidence JSON", traceApplicationFeatureEvidence);
+    registerJsonCommand(cli, logger, CLI_COMMANDS.compareApplicationVersions, "Compare two authenticated JavaScript Application Graph versions", compareApplicationVersionsEvidence);
+    cli.command(CLI_COMMANDS.runControlledReplay, {
+        description: "Plan or execute an approved extracted-module replay in the Linux sandbox",
+        args: z.object({
+            inputJson: z.string().describe("Inline replay JSON or JSON file path"),
+        }),
+        run: ({ args }) => logCliCommand(logger, CLI_COMMANDS.runControlledReplay, async () => {
+            const input = await parseCliJsonInput(args.inputJson, CLI_COMMANDS.runControlledReplay);
+            if (!input.ok)
+                return input.error;
+            const config = parseConfig(process.env);
+            if (!config.ok)
+                return projectAnalysisError(config.error);
+            const authority = await loadConfiguredPermissionAuthority(config.value);
+            if (!authority.ok)
+                return projectAnalysisError(authority.error);
+            const result = await runControlledReplay({
+                policy: config.value.javascriptReplayPolicy,
+                host: new SystemJavaScriptReplayHost(),
+                runner: new LinuxJavaScriptReplayRunner(),
+                authority: authority.value,
+            }, input.value);
+            return result.ok ? result.value : projectAnalysisError(result.error);
+        }),
+    });
+};
+const registerJsonCommand = (cli, logger, name, description, workflow) => {
+    cli.command(name, {
+        description,
+        args: z.object({
+            inputJson: z.string().describe("Inline workflow JSON or JSON file path"),
+        }),
+        run: ({ args }) => logCliCommand(logger, name, async () => {
+            const input = await parseCliJsonInput(args.inputJson, name);
+            if (!input.ok)
+                return input.error;
+            const result = workflow(input.value);
+            return result.ok
+                ? result.value
+                : {
+                    error: "Application workflow failed",
+                    ...projectAnalysisError(result.error instanceof AnalysisInputError
+                        ? result.error
+                        : new AnalysisInputError(name)),
+                };
+        }),
+    });
+};

package/dist/cliCommandNames.js

@@ -16,6 +16,14 @@ export const CLI_COMMANDS = Object.freeze({
     importReferenceSource: "import-reference-source",
     inventoryArtifact: "inventory-artifact",
     extractArtifact: "extract-artifact",
+    inspectManagedArtifact: "inspect-managed-artifact",
+    inspectManagedMembers: "inspect-managed-members",
+    inspectManagedNativeBoundaries: "inspect-managed-native-boundaries",
+    compareManagedMembers: "compare-managed-members",
+    verifyManagedNativeBoundaries: "verify-managed-native-boundaries",
+    importManagedReconstruction: "import-managed-reconstruction",
+    planManagedRuntimeCorrelation: "plan-managed-runtime-correlation",
+    projectManagedApplicationGraph: "project-managed-application-graph",
     inspectMacho: "inspect-macho",
     inspectSignature: "inspect-signature",
     listArchitectures: "list-architectures",
@@ -38,6 +46,11 @@ export const CLI_COMMANDS = Object.freeze({
     compareWebScreenshots: "compare-web-screenshots",
     listElectronTargets: "list-electron-targets",
     inspectElectronPage: "inspect-electron-page",
+    analyzeJavaScriptApplication: "analyze-javascript-application",
+    reconcileJavaScriptRuntime: "reconcile-javascript-runtime",
+    traceApplicationFeature: "trace-application-feature",
+    compareApplicationVersions: "compare-application-versions",
+    runControlledReplay: "run-controlled-replay",
 });
 /** Ordered primary CLI inventory; aliases are intentionally excluded. */
 export const CLI_COMMAND_NAMES = Object.freeze(Object.values(CLI_COMMANDS));

package/dist/cliElectronCommands.js

@@ -1,12 +1,16 @@
 import { Cli, z } from "incur";
 import { inspectElectronPage, listElectronTargets, } from "./application/ElectronObservationService.js";
+import { analyzeJavaScriptApplication } from "./application/JavaScriptApplicationService.js";
+import { reconcileJavaScriptRuntimeEvidence } from "./application/JavaScriptRuntimeReconciliationService.js";
 import { loadConfiguredPermissionAuthority } from "./application/PermissionConfiguration.js";
 import { CdpElectronProvider } from "./browser/CdpElectronProvider.js";
 import { logCliCommand } from "./cliLogging.js";
 import { parseConfig } from "./config.js";
 import { inspectElectronPageInputSchema, listElectronTargetsInputSchema, } from "./domain/electronObservation.js";
+import { analyzeJavaScriptApplicationInputSchema } from "./domain/javascriptApplicationAnalysis.js";
 import { AnalysisInputError, projectAnalysisError } from "./domain/errors.js";
 import { CLI_COMMANDS } from "./cliCommandNames.js";
+import { parseCliJsonInput } from "./cliJsonInput.js";
 const scopeOptions = {
     allowedFileRoots: z
         .array(z.string().min(1))
@@ -16,6 +20,28 @@ const scopeOptions = {
 };
 /** Register CLI equivalents of the Electron MCP tools. */
 export const registerElectronCommands = (cli, logger) => {
+    registerElectronObservationCommands(cli, logger);
+    registerJavaScriptApplicationCommand(cli, logger);
+    registerJavaScriptRuntimeReconciliationCommand(cli, logger);
+};
+const registerJavaScriptRuntimeReconciliationCommand = (cli, logger) => {
+    cli.command(CLI_COMMANDS.reconcileJavaScriptRuntime, {
+        description: "Reconcile static application and passive runtime Evidence JSON",
+        args: z.object({
+            inputJson: z
+                .string()
+                .describe("Inline JSON or a JSON file path matching reconcile_javascript_runtime"),
+        }),
+        run: ({ args }) => logCliCommand(logger, CLI_COMMANDS.reconcileJavaScriptRuntime, async () => {
+            const input = await parseCliJsonInput(args.inputJson, "reconcile_javascript_runtime");
+            if (!input.ok)
+                return input.error;
+            const result = reconcileJavaScriptRuntimeEvidence(input.value);
+            return result.ok ? result.value : cliError(result.error);
+        }),
+    });
+};
+const registerElectronObservationCommands = (cli, logger) => {
     cli.command(CLI_COMMANDS.listElectronTargets, {
         description: "List root-confined file pages from Electron CDP",
         args: z.object({ endpoint: z.string() }),
@@ -53,6 +79,7 @@ export const registerElectronCommands = (cli, logger) => {
             maxDomNodes: z.number().int().min(1).max(10_000).default(2_000),
             maxScripts: z.number().int().min(1).max(2_000).default(500),
             maxResources: z.number().int().min(1).max(10_000).default(2_000),
+            maxWorkers: z.number().int().min(1).max(5_000).default(500),
             maxScriptSourceBytes: z
                 .number()
                 .int()
@@ -83,6 +110,7 @@ export const registerElectronCommands = (cli, logger) => {
                     max_dom_nodes: options.maxDomNodes,
                     max_scripts: options.maxScripts,
                     max_resources: options.maxResources,
+                    max_workers: options.maxWorkers,
                     max_script_source_bytes: options.maxScriptSourceBytes,
                     max_total_script_source_bytes: options.maxTotalScriptSourceBytes,
                 },
@@ -94,6 +122,80 @@ export const registerElectronCommands = (cli, logger) => {
         }),
     });
 };
+const registerJavaScriptApplicationCommand = (cli, logger) => {
+    cli.command(CLI_COMMANDS.analyzeJavaScriptApplication, {
+        description: "Statically reconstruct an approved JavaScript/Electron application",
+        args: z.object({
+            path: z.string().describe("Absolute ASAR or extracted application path"),
+        }),
+        options: z.object({
+            approved: z.boolean().default(false),
+            format: z.enum(["auto", "asar", "directory"]).default("auto"),
+            sourceMapReadApproved: z.boolean().default(false),
+            maxEntries: z.number().int().min(1).default(8_000),
+            maxTotalArtifactBytes: z
+                .number()
+                .int()
+                .min(1)
+                .default(512 * 1_024 * 1_024),
+            maxArtifactEntryBytes: z
+                .number()
+                .int()
+                .min(1)
+                .default(128 * 1_024 * 1_024),
+            maxCompressionRatio: z.number().min(1).default(1_000),
+            maxDepth: z.number().int().min(1).default(64),
+            maxPathBytes: z.number().int().min(1).default(4_096),
+            maxTextFiles: z.number().int().min(1).default(5_000),
+            maxTotalTextBytes: z
+                .number()
+                .int()
+                .min(1)
+                .default(128 * 1_024 * 1_024),
+            maxTextFileBytes: z
+                .number()
+                .int()
+                .min(1)
+                .default(8 * 1_024 * 1_024),
+            maxAstNodes: z.number().int().min(1).default(2_000_000),
+            maxFindings: z.number().int().min(1).default(8_000),
+            maxModules: z.number().int().min(1).default(20_000),
+            maxSourceMapSources: z.number().int().min(1).default(5_000),
+            maxParseMilliseconds: z.number().int().min(1).default(30_000),
+        }),
+        run: ({ args, options }) => logCliCommand(logger, CLI_COMMANDS.analyzeJavaScriptApplication, async () => {
+            const context = await electronContext();
+            if (!context.ok)
+                return context.error;
+            const parsed = analyzeJavaScriptApplicationInputSchema.safeParse({
+                input_path: args.path,
+                approved: options.approved,
+                format: options.format,
+                source_map_read_approved: options.sourceMapReadApproved,
+                limits: {
+                    max_entries: options.maxEntries,
+                    max_total_artifact_bytes: options.maxTotalArtifactBytes,
+                    max_artifact_entry_bytes: options.maxArtifactEntryBytes,
+                    max_compression_ratio: options.maxCompressionRatio,
+                    max_depth: options.maxDepth,
+                    max_path_bytes: options.maxPathBytes,
+                    max_text_files: options.maxTextFiles,
+                    max_total_text_bytes: options.maxTotalTextBytes,
+                    max_text_file_bytes: options.maxTextFileBytes,
+                    max_ast_nodes: options.maxAstNodes,
+                    max_findings: options.maxFindings,
+                    max_modules: options.maxModules,
+                    max_source_map_sources: options.maxSourceMapSources,
+                    max_parse_milliseconds: options.maxParseMilliseconds,
+                },
+            });
+            if (!parsed.success)
+                return inputError("analyze_javascript_application");
+            const result = await analyzeJavaScriptApplication(context.authority, parsed.data);
+            return result.ok ? result.value : cliError(result.error);
+        }),
+    });
+};
 const electronContext = async () => {
     const config = parseConfig(process.env);
     if (!config.ok)
@@ -110,6 +212,6 @@ const electronContext = async () => {
 };
 const inputError = (operation) => cliError(new AnalysisInputError(operation));
 const cliError = (error) => ({
-    error: "Electron observation failed",
+    error: "Electron analysis failed",
     ...projectAnalysisError(error),
 });