rea-agents 3.0.0 → 3.2.0

package/dist/application/SetupClientConfiguration.js

@@ -1,9 +1,8 @@
+import { clientConfigurationValuesEqual, parseClientConfiguration, serializeClientConfiguration, } from "./ClientConfigurationDocument.js";
 import { constants as fsConstants } from "node:fs";
 import { copyFile, mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { dirname } from "node:path";
-import { z } from "zod";
 import writeFileAtomic from "write-file-atomic";
-import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
 import { PRODUCT_IDENTITY } from "../identity.js";
 import { MCP_STARTUP_POLICY } from "../mcpStartupPolicy.js";
 import { resolveClientConfigTransactionPath } from "./ClientConfigPath.js";
@@ -14,43 +13,43 @@ const defaultCommand = () => [
     "mcp",
 ];
 /** Back up, atomically update, and semantically read back one JSON MCP configuration. */
-export const configureJsonClient = async (client, environment = {}, command = defaultCommand()) => {
+export const configureJsonClient = (client, environment = {}, command = defaultCommand()) => configureClientDocument(client, environment, command, "json");
+/** Back up, atomically update, and semantically read back one TOML MCP configuration. */
+export const configureTomlClient = (client, environment = {}, command = defaultCommand()) => configureClientDocument(client, environment, command, "toml");
+const configureClientDocument = async (client, environment, command, format) => {
     const transactionPath = await resolveClientConfigTransactionPath(client.configPath);
     if (transactionPath === undefined)
         return { status: "failed", reason: "path" };
-    let document = {};
     let original;
     try {
         original = await readFile(transactionPath, "utf8");
-        document = parseObject(original);
     }
     catch (cause) {
         if (!isMissing(cause))
             return { status: "failed", reason: "readback" };
     }
-    let servers;
+    let parsed;
     try {
-        servers = parseOptionalObject(document.mcpServers);
+        parsed = parseClientConfiguration(original ?? (format === "toml" ? "" : "{}"), format);
     }
     catch {
         return { status: "failed", reason: "readback" };
     }
-    const desired = clientConfigurationDesired(client, normalizeProviderEnvironment(environment), command);
-    if (sameConfiguration(servers[PRODUCT_IDENTITY.mcpServerKey], desired))
+    const { document, servers, serversKey } = parsed;
+    const desired = clientConfigurationDesired(client, environment, command);
+    if (clientConfigurationValuesEqual(servers[PRODUCT_IDENTITY.mcpServerKey], desired))
         return { status: "unchanged" };
-    let backupPath;
-    if (original !== undefined) {
-        backupPath = `${client.configPath}.rea.backup`;
-        if (!(await preserveConfigBackup(transactionPath, backupPath)))
-            return { status: "failed", reason: "backup" };
-    }
-    document.mcpServers = {
+    const backupPath = original === undefined ? undefined : `${client.configPath}.rea.backup`;
+    if (backupPath !== undefined &&
+        !(await preserveConfigBackup(transactionPath, backupPath)))
+        return { status: "failed", reason: "backup" };
+    document[serversKey] = {
         ...servers,
         [PRODUCT_IDENTITY.mcpServerKey]: desired,
     };
     try {
         await mkdir(dirname(client.configPath), { recursive: true });
-        await writeFileAtomic(transactionPath, `${JSON.stringify(document, null, 2)}\n`, {
+        await writeFileAtomic(transactionPath, serializeClientConfiguration(document, format), {
             encoding: "utf8",
             mode: 0o600,
         });
@@ -59,8 +58,8 @@ export const configureJsonClient = async (client, environment = {}, command = de
         return { status: "failed", reason: "write" };
     }
     try {
-        const readback = parseObject(await readFile(transactionPath, "utf8"));
-        if (!sameConfiguration(parseOptionalObject(readback.mcpServers)[PRODUCT_IDENTITY.mcpServerKey], desired)) {
+        const readback = parseClientConfiguration(await readFile(transactionPath, "utf8"), format);
+        if (!clientConfigurationValuesEqual(readback.servers[PRODUCT_IDENTITY.mcpServerKey], desired)) {
             await restoreConfig(transactionPath, original);
             return { status: "failed", reason: "readback" };
         }
@@ -74,68 +73,13 @@ export const configureJsonClient = async (client, environment = {}, command = de
         ...(backupPath === undefined ? {} : { backupPath }),
     };
 };
-/** Back up, atomically update, and semantically read back Codex TOML configuration. */
-export const configureTomlClient = async (client, environment = {}, command = defaultCommand()) => {
-    const transactionPath = await resolveClientConfigTransactionPath(client.configPath);
-    if (transactionPath === undefined)
-        return { status: "failed", reason: "path" };
-    let document = {};
-    let original;
-    try {
-        original = await readFile(transactionPath, "utf8");
-        document = objectSchema.parse(parseToml(original));
-    }
-    catch (cause) {
-        if (!isMissing(cause))
-            return { status: "failed", reason: "readback" };
-    }
-    let servers;
-    try {
-        servers = parseOptionalObject(document.mcp_servers);
-    }
-    catch {
-        return { status: "failed", reason: "readback" };
-    }
-    const desired = clientConfigurationDesired(client, normalizeProviderEnvironment(environment), command);
-    if (sameConfiguration(servers[PRODUCT_IDENTITY.mcpServerKey], desired))
-        return { status: "unchanged" };
-    const backupPath = original === undefined ? undefined : `${client.configPath}.rea.backup`;
-    if (backupPath !== undefined &&
-        !(await preserveConfigBackup(transactionPath, backupPath)))
-        return { status: "failed", reason: "backup" };
-    document.mcp_servers = {
-        ...servers,
-        [PRODUCT_IDENTITY.mcpServerKey]: desired,
-    };
-    try {
-        await mkdir(dirname(client.configPath), { recursive: true });
-        await writeFileAtomic(transactionPath, stringifyToml(document), {
-            encoding: "utf8",
-            mode: 0o600,
-        });
-        const readback = objectSchema.parse(parseToml(await readFile(transactionPath, "utf8")));
-        if (!sameConfiguration(parseOptionalObject(readback.mcp_servers)[PRODUCT_IDENTITY.mcpServerKey], desired))
-            throw new Error("TOML readback mismatch");
-    }
-    catch {
-        await restoreConfig(transactionPath, original);
-        return { status: "failed", reason: "readback" };
-    }
-    return {
-        status: "configured",
-        ...(backupPath === undefined ? {} : { backupPath }),
-    };
-};
 /** Determine whether an existing client configuration matches the desired registration. */
 export const clientConfigurationAligned = async (client, providerEnvironment, command) => {
     const desired = clientConfigurationDesired(client, providerEnvironment, command);
     try {
         const original = await readFile(client.configPath, "utf8");
-        const document = client.format === "toml"
-            ? objectSchema.parse(parseToml(original))
-            : parseObject(original);
-        const servers = parseOptionalObject(client.format === "toml" ? document.mcp_servers : document.mcpServers);
-        return sameConfiguration(servers[PRODUCT_IDENTITY.mcpServerKey], desired);
+        const { servers } = parseClientConfiguration(original, client.format);
+        return clientConfigurationValuesEqual(servers[PRODUCT_IDENTITY.mcpServerKey], desired);
     }
     catch {
         return false;
@@ -165,11 +109,8 @@ export const inspectClientConfiguration = async (client, providerEnvironment, co
     }
     const desired = clientConfigurationDesired(client, providerEnvironment, command);
     try {
-        const document = client.format === "toml"
-            ? objectSchema.parse(parseToml(original))
-            : parseObject(original);
-        const servers = parseOptionalObject(client.format === "toml" ? document.mcp_servers : document.mcpServers);
-        if (sameConfiguration(servers[PRODUCT_IDENTITY.mcpServerKey], desired))
+        const { servers } = parseClientConfiguration(original, client.format);
+        if (clientConfigurationValuesEqual(servers[PRODUCT_IDENTITY.mcpServerKey], desired))
             return { status: "already_current" };
     }
     catch {
@@ -183,11 +124,7 @@ export const inspectClientConfiguration = async (client, providerEnvironment, co
         backupPath: `${client.configPath}.rea.backup`,
     };
 };
-const objectSchema = z.record(z.string(), z.unknown());
-const parseOptionalObject = (value) => value === undefined ? {} : objectSchema.parse(value);
-const parseObject = (text) => objectSchema.parse(JSON.parse(text));
 const isMissing = (cause) => cause instanceof Error && "code" in cause && cause.code === "ENOENT";
-const sameConfiguration = (left, right) => JSON.stringify(left) === JSON.stringify(right);
 const preserveConfigBackup = async (source, destination) => {
     try {
         await copyFile(source, destination, fsConstants.COPYFILE_EXCL);
@@ -221,6 +158,3 @@ const clientConfigurationDesired = (client, providerEnvironment, command) => {
         ...(Object.keys(environment).length === 0 ? {} : { env: environment }),
     };
 };
-const normalizeProviderEnvironment = (environment) => typeof environment === "string"
-    ? { HOPPER_LAUNCHER_PATH: environment }
-    : environment;

package/dist/application/SetupRegistrationEnvironment.js

@@ -1,10 +1,3 @@
-/** Select explicit non-secret permission settings safe for managed MCP registrations. */
-export const registrationPermissionEnvironment = (environment) => {
-    const investigationRoots = environment.REA_INVESTIGATION_INPUT_ROOTS_JSON;
-    return investigationRoots === undefined
-        ? {}
-        : { REA_INVESTIGATION_INPUT_ROOTS_JSON: investigationRoots };
-};
 /** Select exact non-secret settings published by available providers. */
 export const providerRegistrationEnvironment = (inspections) => Object.fromEntries(inspections
     .filter(({ available }) => available)

package/dist/application/StoreFileLock.js

@@ -0,0 +1,119 @@
+import { randomUUID } from "node:crypto";
+import { lstat, mkdtemp, open, readdir, rename, rm, rmdir, unlink, } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { readBoundedFileBytes } from "../process/BoundedFileBytes.js";
+class StoreFileLockOccupied extends Error {
+    code = "EEXIST";
+    constructor(cause) {
+        super("Store transaction lock is occupied", { cause });
+    }
+}
+/** Atomically publish a populated directory so another owner cannot replace a live lock. */
+export const createStoreFileLock = async (path) => {
+    if (await exists(path))
+        throw new StoreFileLockOccupied();
+    const staged = await mkdtemp(join(dirname(path), ".rea-store-lock-"));
+    const owner = `owner-${randomUUID()}`;
+    try {
+        const handle = await open(join(staged, owner), "wx", 0o600);
+        try {
+            await handle.writeFile(`${String(process.pid)}\n`, "utf8");
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+        try {
+            // Rename cannot replace a nonempty directory: the owner entry is present before publication.
+            await rename(staged, path);
+        }
+        catch (cause) {
+            if (await exists(path))
+                throw new StoreFileLockOccupied(cause);
+            throw cause;
+        }
+        return {
+            release: async () => {
+                await removeOwner(path, owner).catch(() => undefined);
+            },
+        };
+    }
+    finally {
+        await rm(staged, { recursive: true, force: true });
+    }
+};
+/** Recover a dead owner's directory lock or a legacy PID file; leave live and unknown owners intact. */
+export const removeStaleStoreFileLock = async (path) => {
+    try {
+        const stats = await lstat(path);
+        if (stats.isFile()) {
+            if (!(await ownerIsDead(path)))
+                return false;
+            await unlink(path);
+            return true;
+        }
+        if (!stats.isDirectory())
+            return false;
+        const entries = await readdir(path);
+        if (entries.length === 0) {
+            await rmdir(path);
+            return true;
+        }
+        const owner = entries[0];
+        if (entries.length !== 1 ||
+            owner === undefined ||
+            !/^owner-[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/u.test(owner) ||
+            !(await ownerIsDead(join(path, owner))))
+            return false;
+        await removeOwner(path, owner);
+        return true;
+    }
+    catch {
+        return false;
+    }
+};
+const removeOwner = async (path, owner) => {
+    // A successor has a different entry, so stale cleanup cannot make its directory empty.
+    await unlink(join(path, owner));
+    await rmdir(path);
+};
+const ownerIsDead = async (path) => {
+    const stats = await lstat(path);
+    if (!stats.isFile() || stats.size > 32)
+        return false;
+    const handle = await open(path, "r");
+    let bytes;
+    try {
+        bytes = await readBoundedFileBytes(handle, 32);
+    }
+    finally {
+        await handle.close();
+    }
+    const encoded = bytes?.toString("utf8").trim();
+    return (encoded !== undefined &&
+        /^[1-9][0-9]{0,9}$/u.test(encoded) &&
+        !processIsAlive(Number(encoded)));
+};
+const exists = async (path) => {
+    try {
+        await lstat(path);
+        return true;
+    }
+    catch (cause) {
+        if (errorCode(cause) === "ENOENT")
+            return false;
+        throw cause;
+    }
+};
+const processIsAlive = (pid) => {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (cause) {
+        return errorCode(cause) !== "ESRCH";
+    }
+};
+const errorCode = (cause) => typeof cause === "object" && cause !== null && "code" in cause
+    ? cause.code
+    : undefined;

package/dist/application/TerminalRenderer.js

@@ -4,8 +4,8 @@ const require = createRequire(import.meta.url);
 const HeadlessPackage = require("@xterm/headless");
 // SAFETY: the addon package is pinned with the compatible headless xterm release.
 const SerializePackage = require("@xterm/addon-serialize");
-/** Owns one headless terminal and serializes writes into deterministic frames. */
 /**
+ * Owns one headless terminal and serializes writes into deterministic frames.
  * Reconstructs bounded terminal states while raw PTY chunks remain authoritative.
  *
  * Rendered frames answer what an operator saw after control-sequence handling;
@@ -71,8 +71,7 @@ export class TerminalRenderer {
         const serializedState = this.options.normalize(this.#serializeAddon.serialize());
         const bytes = Buffer.byteLength(serializedState) +
             lines.reduce((total, line) => total + Buffer.byteLength(line), 0);
-        if (this.#frames.length >= this.options.maxFrames ||
-            this.#capturedBytes + bytes > this.options.maxBytes) {
+        if (this.#capturedBytes + bytes > this.options.maxBytes) {
             this.#truncated = true;
             return;
         }

package/dist/application/Uninstall.js

@@ -1,7 +1,7 @@
+import { parseClientConfiguration, serializeClientConfiguration, } from "./ClientConfigurationDocument.js";
 import { copyFile, lstat, readFile, realpath, rm } from "node:fs/promises";
 import { homedir } from "node:os";
 import { basename, isAbsolute, join } from "node:path";
-import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
 import writeFileAtomic from "write-file-atomic";
 import { z } from "zod";
 import { PRODUCT_IDENTITY } from "../identity.js";
@@ -65,9 +65,11 @@ const removeClient = async (client, fileSystem) => {
     let key;
     let servers;
     try {
-        document = objectSchema.parse(client.format === "toml" ? parseToml(original) : JSON.parse(original));
-        key = client.format === "toml" ? "mcp_servers" : "mcpServers";
-        servers = optionalObject(document[key]);
+        ({
+            document,
+            servers,
+            serversKey: key,
+        } = parseClientConfiguration(original, client.format));
     }
     catch {
         return item(client.name, "failed", `Configuration is not valid ${client.format === "toml" ? "TOML" : "JSON"} and was not changed. Repair it, then rerun uninstall.`);
@@ -88,14 +90,9 @@ const removeClient = async (client, fileSystem) => {
         return item(client.name, "failed", "Configuration could not be backed up, so no change was made. Check file permissions, then rerun uninstall.");
     }
     try {
-        const encoded = client.format === "toml"
-            ? stringifyToml(document)
-            : `${JSON.stringify(document, null, 2)}\n`;
-        await fileSystem.writeText(transactionPath, encoded);
-        const readback = objectSchema.parse(client.format === "toml"
-            ? parseToml(await fileSystem.readText(transactionPath))
-            : JSON.parse(await fileSystem.readText(transactionPath)));
-        if (PRODUCT_IDENTITY.mcpServerKey in optionalObject(readback[key]))
+        await fileSystem.writeText(transactionPath, serializeClientConfiguration(document, client.format));
+        const readback = parseClientConfiguration(await fileSystem.readText(transactionPath), client.format);
+        if (PRODUCT_IDENTITY.mcpServerKey in readback.servers)
             throw new Error("registration readback mismatch");
         return item(client.name, "removed", `Removed registration from ${client.configPath}.`);
     }
@@ -154,8 +151,6 @@ const removeManagedPath = async (path, name, fileSystem) => {
 };
 const removeManagedSkills = async (home, fileSystem) => removeManagedPath(join(home, ".agents/skills", PRODUCT_IDENTITY.skillName), "skill", fileSystem);
 const item = (name, status, detail) => ({ name, status, detail });
-const objectSchema = z.record(z.string(), z.unknown());
-const optionalObject = (value) => value === undefined ? {} : objectSchema.parse(value);
 const registrationSchema = z
     .object({ command: z.string(), args: z.array(z.string()) })
     .passthrough();

package/dist/application/UnknownEvidence.js

@@ -7,7 +7,7 @@ export const UNKNOWN_REGISTRY_PROVIDER = {
 };
 /** Create immutable evidence for one approved residual-unknown mutation. */
 export const unknownMutationEvidence = (target, input) => createEvidence(target, UNKNOWN_REGISTRY_PROVIDER, {
-    predicateType: "rea.residual-unknown-mutation/v1",
+    predicateType: "rea.residual-unknown-mutation",
     operation: "record_unknown",
     parameters: { domain: input.domain, severity: input.severity },
     result: {

package/dist/application/WindowsCapabilities.js

@@ -2,6 +2,7 @@ import { constants } from "node:fs";
 import { mkdtemp, rm, symlink, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { windowsNativeCapabilities, } from "../process/WindowsAuthority.js";
 import { probeProcessCaptureCapability, } from "./ProcessCaptureCapability.js";
 /** Probe named prerequisites without converting missing controls into support. */
 export const probeWindowsCapabilities = async (dependencies = systemDependencies()) => {
@@ -17,11 +18,11 @@ export const probeWindowsCapabilities = async (dependencies = systemDependencies
             no_follow_open: dependencies.probeNoFollowOpen(),
             private_acl: dependencies.probePrivateAcl(),
             unix_domain_socket: dependencies.probeUnixDomainSocket(),
-            pty: {
-                available: pty.available,
-                reason: pty.available ? null : pty.reason,
-            },
+            pty: pty.available
+                ? { available: true, reason: null }
+                : { available: false, reason: pty.reason },
         },
+        security: windowsNativeCapabilities(dependencies.platform),
     };
 };
 const systemDependencies = () => ({

package/dist/artifacts/ArtifactPaths.js

@@ -1,9 +1,8 @@
-import { Buffer } from "node:buffer";
 import { posix } from "node:path";
-import { ArtifactReaderFailure, } from "./ArtifactReader.js";
+import { ArtifactReaderFailure } from "./ArtifactReader.js";
 const DRIVE_OR_UNC = /^(?:[A-Za-z]:|\\|\/\/)/u;
 /** Normalize an untrusted logical archive path without touching filesystem. */
-export const normalizeArtifactPath = (input, limits) => {
+export const normalizeArtifactPath = (input) => {
     if (input.includes("\0") ||
         input.includes("\\") ||
         input.startsWith("/") ||
@@ -13,8 +12,6 @@ export const normalizeArtifactPath = (input, limits) => {
     const parts = normalized.split("/");
     if (normalized.length === 0 ||
         parts.some((part) => part === "" || part === "." || part === "..") ||
-        parts.length > limits.maxDepth ||
-        Buffer.byteLength(normalized, "utf8") > limits.maxPathBytes ||
         posix.normalize(normalized) !== normalized)
         throw new ArtifactReaderFailure("path", "Artifact path is not normalized");
     return normalized;

package/dist/artifacts/ArtifactProvider.js

@@ -1,13 +1,16 @@
 import { createAnalysisExecution, } from "../application/AnalysisProvider.js";
 import { inventoryArtifact } from "../application/ArtifactInventory.js";
 import { extractArtifact } from "../application/ArtifactExtraction.js";
-import { ARTIFACT_TOOL_CONTRACTS, artifactInspectionInputSchema, artifactInventoryInputSchema, artifactExtractionInputSchema, } from "../contracts/artifactToolContracts.js";
+import { analyzeInterfaceBuilderBundle } from "../application/InterfaceBuilderAnalysis.js";
+import { ARTIFACT_ANALYSIS_OPERATIONS, artifactInventoryInputSchema, artifactExtractionExecutionSchema, } from "../contracts/artifactToolContracts.js";
 import { AnalysisCapabilityUnavailableError, ArtifactOperationError, } from "../domain/errors.js";
+import { interfaceBuilderLimitsSchema } from "../domain/interfaceBuilderGraph.js";
 import { err, ok } from "../domain/result.js";
-import { ArtifactReaderFailure, } from "./ArtifactReader.js";
+import { ArtifactReaderFailure } from "./ArtifactReader.js";
 import { ARTIFACT_GRAPH_PROVIDER } from "../application/InvestigationProviders.js";
 import { createEvidence } from "../domain/evidence.js";
 import { createArtifactInspection } from "../domain/artifactInspection.js";
+import { resolveArtifactIntegrityPolicy, resolveNativeMountPolicy, } from "../application/ArtifactInventory/policy.js";
 const IDENTITY = Object.freeze(ARTIFACT_GRAPH_PROVIDER);
 /** Read-only inventory and exclusively owned extraction provider. */
 export class ArtifactProvider {
@@ -17,31 +20,20 @@ export class ArtifactProvider {
         this.nativeMountEnabled = nativeMountEnabled;
         this.integrityContinueEnabled = integrityContinueEnabled;
     }
-    #capabilities = Object.freeze(ARTIFACT_TOOL_CONTRACTS.map((contract) => Object.freeze({
+    #capabilities = Object.freeze(ARTIFACT_ANALYSIS_OPERATIONS.map((operation) => Object.freeze({
         provider: IDENTITY,
-        operation: contract.name,
-        inputContractVersion: 1,
-        outputContractVersion: 1,
+        operation,
         available: true,
         reason: null,
-        pagination: contract.name === "inspect_artifact"
-            ? "none"
-            : "offset",
-        exhaustive: false,
         effects: Object.freeze({
             mutatesArtifact: false,
-            launchesProcess: true,
+            launchesProcess: operation !== "decode_interface_builder",
             mayShowUi: false,
             mayAccessNetwork: false,
-            mayWriteFilesystem: contract.name === "extract_artifact",
+            mayWriteFilesystem: operation === "extract_artifact",
             changesPermissions: false,
             requiresRoot: false,
         }),
-        limits: Object.freeze({
-            maxResults: 500,
-            maxPayloadBytes: 4 * 1024 * 1024,
-            timeoutMs: 120_000,
-        }),
         limitations: Object.freeze([
             "DMG child inventory is macOS-only and requires per-call approval plus operator policy; PKG remains root-hash-only.",
             "ASAR files discovered in filesystem-backed inventories are expanded without bulk extraction; other nested containers remain recorded only.",
@@ -76,22 +68,38 @@ class ArtifactClient {
                 const inspected = await this.inspectArtifact(parameters, options);
                 return inspected;
             }
+            if (operation === "decode_interface_builder") {
+                if (this.target.kind !== "executable" ||
+                    this.target.sourcePath === undefined ||
+                    !this.target.sourcePath.toLowerCase().endsWith(".app"))
+                    throw new ArtifactReaderFailure("unavailable", "decode_interface_builder requires an active .app bundle target");
+                const limits = interfaceBuilderLimitsSchema.parse(parameters);
+                const result = await analyzeInterfaceBuilderBundle({
+                    bundlePath: this.target.sourcePath,
+                    targetSha256: this.target.sha256,
+                    limits,
+                    ...(options?.signal === undefined ? {} : { signal: options.signal }),
+                });
+                return ok(createAnalysisExecution(result, IDENTITY, {
+                    limitations: result.limitations,
+                    locations: result.documents.map(({ relative_path: path }) => ({
+                        kind: "artifact-path",
+                        path,
+                    })),
+                }));
+            }
             if (operation === "extract_artifact") {
-                const parsed = artifactExtractionInputSchema.parse(parameters);
+                const parsed = artifactExtractionExecutionSchema.parse(parameters);
                 const result = await extractArtifact({
                     inputPath: this.target.sourcePath ?? this.target.path,
                     inputFormat: this.target.format,
                     outputRoot: parsed.output_root,
-                    occurrenceIds: parsed.occurrence_ids,
-                    offset: parsed.offset,
-                    limit: parsed.limit,
-                    limits: limitsFrom(parsed),
                 }, options?.signal);
                 return ok(createAnalysisExecution(result, IDENTITY, {
                     rawResult: null,
                     limitations: result.limitations,
                     subject: subjectFor(this.target.sourcePath ?? this.target.path, result.manifest),
-                    locations: result.artifacts.items.map(({ relative_path: path }) => ({
+                    locations: result.artifacts.map(({ relative_path: path }) => ({
                         kind: "artifact-path",
                         path,
                     })),
@@ -103,7 +111,7 @@ class ArtifactClient {
                 rawResult: null,
                 limitations: result.limitations,
                 subject: subjectFor(this.target.sourcePath ?? this.target.path, result.manifest),
-                locations: result.occurrences.items.map(({ logical_path: path }) => ({
+                locations: result.occurrences.map(({ logical_path: path }) => ({
                     kind: "artifact-path",
                     path,
                 })),
@@ -117,24 +125,11 @@ class ArtifactClient {
         return Promise.resolve();
     }
     async inspectArtifact(parameters, options) {
-        const parsed = artifactInspectionInputSchema.parse(parameters);
+        const parsed = artifactInventoryInputSchema.parse(parameters);
         const inventoryParameters = artifactInventoryInputSchema.parse({
-            node_offset: 0,
-            node_limit: parsed.max_observations,
-            occurrence_offset: 0,
-            occurrence_limit: parsed.max_observations,
-            edge_offset: 0,
-            edge_limit: parsed.max_relationships,
             native_mount_approved: parsed.native_mount_approved,
             integrity_policy: parsed.integrity_policy,
             integrity_continue_approved: parsed.integrity_continue_approved,
-            max_integrity_mismatches: parsed.max_integrity_mismatches,
-            max_entries: parsed.max_entries,
-            max_total_bytes: parsed.max_total_bytes,
-            max_entry_bytes: parsed.max_entry_bytes,
-            max_compression_ratio: parsed.max_compression_ratio,
-            max_depth: parsed.max_depth,
-            max_path_bytes: parsed.max_path_bytes,
         });
         await options?.progress?.report({
             phase: "inspect_artifact.inventory",
@@ -144,7 +139,7 @@ class ArtifactClient {
         });
         const inventory = await this.inventory(inventoryParameters, options);
         const subject = subjectFor(this.target.sourcePath ?? this.target.path, inventory.manifest);
-        const locations = inventory.occurrences.items.map(({ logical_path: path }) => ({
+        const locations = inventory.occurrences.map(({ logical_path: path }) => ({
             kind: "artifact-path",
             path,
         }));
@@ -156,7 +151,7 @@ class ArtifactClient {
             limitations: inventory.limitations,
             locations,
         });
-        const result = createArtifactInspection(inventoryEvidence, parsed);
+        const result = createArtifactInspection(inventoryEvidence);
         await options?.progress?.report({
             phase: "inspect_artifact.inventory",
             completed: 1,
@@ -171,37 +166,18 @@ class ArtifactClient {
         }));
     }
     inventory(parsed, options) {
-        return inventoryArtifact(this.target.sourcePath ?? this.target.path, limitsFrom(parsed), {
-            nodeOffset: parsed.node_offset,
-            nodeLimit: parsed.node_limit,
-            occurrenceOffset: parsed.occurrence_offset,
-            occurrenceLimit: parsed.occurrence_limit,
-            edgeOffset: parsed.edge_offset,
-            edgeLimit: parsed.edge_limit,
-        }, {
+        return inventoryArtifact(this.target.sourcePath ?? this.target.path, {
             ...(options?.signal === undefined ? {} : { signal: options.signal }),
-            nativeMount: {
-                nativeMountApproved: parsed.native_mount_approved === true,
-                nativeMountEnabled: this.nativeMountEnabled,
-            },
-            integrity: {
-                mode: parsed.integrity_policy,
-                approved: parsed.integrity_continue_approved === true,
-                enabled: this.integrityContinueEnabled,
-                maxMismatches: parsed.max_integrity_mismatches,
-            },
+            nativeMount: resolveNativeMountPolicy(parsed.native_mount_approved === true, this.nativeMountEnabled),
+            integrity: resolveArtifactIntegrityPolicy(parsed.integrity_policy === "fail"
+                ? { mode: "fail" }
+                : {
+                    mode: parsed.integrity_policy,
+                }, this.integrityContinueEnabled),
         });
     }
 }
-const limitsFrom = (input) => ({
-    maxEntries: input.max_entries,
-    maxTotalBytes: input.max_total_bytes,
-    maxEntryBytes: input.max_entry_bytes,
-    maxCompressionRatio: input.max_compression_ratio,
-    maxDepth: input.max_depth,
-    maxPathBytes: input.max_path_bytes,
-});
-const isArtifactOperation = (operation) => ARTIFACT_TOOL_CONTRACTS.some(({ name }) => name === operation);
+const isArtifactOperation = (operation) => ARTIFACT_ANALYSIS_OPERATIONS.includes(operation);
 const translateFailure = (operation, cause) => {
     if (cause instanceof ArtifactReaderFailure)
         return new ArtifactOperationError(operation, cause.reason, cause.details);