rea-agents 3.2.1 → 4.0.0

package/dist/browser/PngVisualDiff.js

@@ -65,6 +65,7 @@ const decodePng = (artifact) => {
     let header;
     const compressed = [];
     let sawEnd = false;
+    let transparentColor;
     while (offset < bytes.length) {
         if (offset + 12 > bytes.length)
             throw new TypeError("Truncated PNG chunk");
@@ -77,6 +78,15 @@ const decodePng = (artifact) => {
         const data = bytes.subarray(dataStart, dataEnd);
         if (type === "IHDR")
             header = parseHeader(data);
+        else if (type === "tRNS") {
+            if (header?.channels !== 3 || data.length !== 6)
+                throw new TypeError("Unsupported PNG transparency");
+            transparentColor = [
+                data.readUInt16BE(0),
+                data.readUInt16BE(2),
+                data.readUInt16BE(4),
+            ];
+        }
         else if (type === "IDAT")
             compressed.push(data);
         else if (type === "IEND") {
@@ -97,7 +107,7 @@ const decodePng = (artifact) => {
     return {
         width: header.width,
         height: header.height,
-        rgba: unfilter(raw, header.width, header.height, header.channels),
+        rgba: expandRgba(unfilter(raw, header.width, header.height, header.channels), header.channels, transparentColor),
     };
 };
 const parseHeader = (data) => {
@@ -145,14 +155,22 @@ const unfilter = (raw, width, height, channels) => {
             });
         }
     }
+    return decoded;
+};
+const expandRgba = (decoded, channels, transparentColor) => {
     if (channels === 4)
         return decoded;
-    const rgba = Buffer.alloc(width * height * 4);
+    const rgba = Buffer.alloc((decoded.length / channels) * 4);
     for (let source = 0, target = 0; source < decoded.length; source += 3, target += 4) {
         rgba[target] = decoded[source] ?? 0;
         rgba[target + 1] = decoded[source + 1] ?? 0;
         rgba[target + 2] = decoded[source + 2] ?? 0;
-        rgba[target + 3] = 255;
+        // PNG tRNS keys are 16-bit values; values above 255 cannot match 8-bit samples.
+        rgba[target + 3] =
+            transparentColor !== undefined &&
+                transparentColor.every((value, channel) => decoded[source + channel] === value)
+                ? 0
+                : 255;
     }
     return rgba;
 };
@@ -188,5 +206,6 @@ const dimensions = ({ width, height }) => ({ width, height });
 const limitations = () => [
     "Pixel comparison does not perform OCR, semantic layout analysis, or perceptual color correction.",
     "Only non-interlaced 8-bit RGB and RGBA PNG screenshots are accepted.",
+    "PNG tRNS transparency is accepted only as a six-byte RGB color key; tRNS on RGBA or with another length is rejected.",
 ];
 const PNG_SIGNATURE = Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]);

package/dist/browser/V8InspectorCaptureProjection.js

@@ -8,7 +8,8 @@ export const createInspectorExclusionCounts = () => ({
 export const describeInspectorTargetLimitations = () => [
     "REA attaches to an already-running exact target and never launches, resumes, evaluates, pauses, or mutates it.",
     "Only Runtime.enable and Debugger.enable are sent; source text, object values, EventEmitter activity, and Electron IPC are not inspected.",
-    "Target IDs and locations are authorized, but the Inspector protocol does not authenticate an operating-system process ID or Electron role.",
+    "The selected endpoint and target ID authorize observation; discovery file locations can remain unresolved and do not prove filesystem identity.",
+    "Node discovery reports a best-effort pathname rather than an encoded file URL; lossy Windows paths and ambiguous underscores are preserved without guessing a file path.",
     "Every target exposed by the selected Inspector endpoint is eligible for observation; target IDs and locations are not authenticated as operating-system process identity.",
     "No runtime graph depth is traversed because passive Inspector events do not establish require/import caller edges.",
 ];
@@ -83,6 +84,11 @@ export const finalizeInspectorCapture = async ({ input, runtime, target, state,
             "script unload events",
         ],
         unknowns: [
+            ...(target.location.kind === "unresolved"
+                ? [
+                    "The discovery-reported file location cannot be verified; loaded script locations are resolved independently from Debugger.scriptParsed.",
+                ]
+                : []),
             "Scripts collected before attachment may have been garbage-collected and therefore omitted.",
             "A bounded observation window cannot establish that an unobserved script or behavior never occurs.",
             "The declared Node/Electron process role is not authenticated by the Inspector protocol.",

package/dist/browser/V8InspectorProvider.js

@@ -23,7 +23,10 @@ export class V8InspectorProvider {
             const allowed = [];
             const excluded = createInspectorExclusionCounts();
             for (const target of discovery.targets) {
-                const decision = await authorizeRuntimeTargetLocation(target.url);
+                const decision = await authorizeRuntimeTargetLocation(target.url, {
+                    type: target.type,
+                    product: discovery.runtime.product,
+                });
                 if (!decision.allowed) {
                     excluded[decision.reason] += 1;
                     continue;
@@ -48,9 +51,14 @@ export class V8InspectorProvider {
     }
     async observe(input, options = {}) {
         let connection;
+        let primaryFailure;
+        let failed = false;
+        let cleanupFailure;
+        let cleanupFailed = false;
+        let outcome;
         try {
             const discovery = await discoverV8Inspector(input.inspector_endpoint, "observe_javascript_runtime", options.signal);
-            const target = await authorizedTarget(discovery.targets, input);
+            const target = await authorizedTarget(discovery.targets, input, discovery.runtime.product);
             if (input.runtime_kind !== undefined)
                 assertRuntimeKind(target, input.runtime_kind);
             connection = await CdpConnection.connect(target.webSocketUrl, "observe_javascript_runtime", options.signal);
@@ -70,27 +78,72 @@ export class V8InspectorProvider {
                 target,
                 state,
             });
-            return ok(javascriptRuntimeObservationSchema.parse(result));
+            outcome = ok(javascriptRuntimeObservationSchema.parse(result));
         }
         catch (cause) {
-            return err(providerError(cause, "observe_javascript_runtime"));
+            failed = true;
+            primaryFailure = cause;
+            outcome = err(providerError(cause, "observe_javascript_runtime"));
         }
         finally {
-            await connection?.close();
+            if (connection !== undefined)
+                try {
+                    await closeInspectorConnection(connection, options.signal);
+                }
+                catch (cause) {
+                    cleanupFailed = true;
+                    cleanupFailure = cause;
+                }
+        }
+        if (cleanupFailed) {
+            return err(inspectorCleanupError(primaryFailure, cleanupFailure, failed));
         }
+        return (outcome ??
+            err(new BrowserObservationError("observe_javascript_runtime", "protocol_error")));
     }
 }
+export const closeInspectorConnection = async (connection, signal) => {
+    const closing = connection.close();
+    void closing.catch(() => undefined);
+    // CdpConnection.close has its own one second transport bound. Do not make a
+    // cancelled caller wait for that fallback.
+    if (signal === undefined)
+        return await closing;
+    let onAbort;
+    const cancelled = new Promise((resolve) => {
+        onAbort = () => resolve();
+        signal.addEventListener("abort", onAbort, { once: true });
+        if (signal.aborted)
+            onAbort();
+    });
+    try {
+        await Promise.race([closing, cancelled]);
+    }
+    finally {
+        if (onAbort !== undefined)
+            signal.removeEventListener("abort", onAbort);
+    }
+};
+export const inspectorCleanupError = (primaryFailure, cleanupFailure, hasPrimaryFailure) => {
+    const cause = hasPrimaryFailure
+        ? new AggregateError([primaryFailure, cleanupFailure], "Inspector observation and cleanup both failed")
+        : cleanupFailure;
+    return new BrowserObservationError("observe_javascript_runtime", "cleanup_failed", { cause });
+};
 const projectTarget = (target) => ({
     target_id: target.id,
     protocol_type: target.type,
     attached: target.attached,
     location: target.location,
 });
-const authorizedTarget = async (targets, input) => {
+const authorizedTarget = async (targets, input, product) => {
     const target = targets.find(({ id }) => id === input.target_id);
     if (target === undefined)
         throw new BrowserObservationError("observe_javascript_runtime", "target_not_found");
-    const decision = await authorizeRuntimeTargetLocation(target.url);
+    const decision = await authorizeRuntimeTargetLocation(target.url, {
+        type: target.type,
+        product,
+    });
     if (target.attached ||
         !decision.allowed ||
         decision.location.kind === "builtin")

package/dist/browser/WebSourceMapFetcher.js

@@ -1,5 +1,9 @@
+import * as t from "@babel/types";
 import { AnyMap, eachMapping } from "@jridgewell/trace-mapping";
 import { sanitizeBrowserUrl } from "../domain/browserObservation.js";
+import { analyzeParsedJavaScriptSemantics } from "../domain/javascriptSemanticAnalysis.js";
+import { parseJavaScriptSource } from "../domain/javascriptSourceParser.js";
+import { hasValidSourceMapContents } from "../domain/sourceMapContents.js";
 import { webSourceMapsSchema } from "../domain/webBundleAnalysis.js";
 import { createWebTextArtifact } from "../domain/webContentArtifact.js";
 /** Fetch and validate approved source maps without browser credentials. */
@@ -10,13 +14,14 @@ export const fetchWebSourceMaps = async (requests, input, signal, host = { fetch
             throw signal.reason;
         items.push(await fetchOne(request, input, signal, host));
     }
-    const included = items.filter(({ status }) => status === "included").length;
+    const retained = items.filter(({ status }) => status === "included" || status === "partial").length;
     return webSourceMapsSchema.parse({
         status: items.length === 0
             ? "unavailable"
-            : included === items.length
+            : retained === items.length &&
+                !items.some(({ status }) => status === "partial")
                 ? "included"
-                : included > 0
+                : retained > 0
                     ? "partial"
                     : "unavailable",
         requested: requests.length,
@@ -28,12 +33,15 @@ const fetchOne = async (request, input, signal, host) => {
     if (!approvedUrl(request.fetchUrl, input.allowed_origins))
         return emptySourceMapItem(request, "policy_filtered", "Declared source-map URL is outside the approved exact origins.");
     try {
-        const response = await fetchFollowingApprovedRedirects(request.fetchUrl, input.allowed_origins, signal, host);
-        if (response === undefined)
+        const fetched = await fetchFollowingApprovedRedirects(request.fetchUrl, input.allowed_origins, signal, host);
+        if (fetched === undefined)
             return emptySourceMapItem(request, "policy_filtered", "A source-map redirect left the approved exact origins.");
-        if (!response.ok)
+        const { response, fetchedUrl } = fetched;
+        if (!response.ok) {
+            await response.body?.cancel();
             return emptySourceMapItem(request, "fetch_failed", `Source-map server returned HTTP ${String(response.status)}.`);
-        return normalizeSourceMap(request, await response.text());
+        }
+        return normalizeSourceMap(request, await response.text(), fetchedUrl);
     }
     catch (cause) {
         if (signal?.aborted === true)
@@ -61,18 +69,19 @@ const fetchFollowingApprovedRedirects = async (initialUrl, allowedOrigins, signa
             ...(signal === undefined ? {} : { signal }),
         });
         if (response.status < 300 || response.status >= 400)
-            return response;
+            return { response, fetchedUrl: current };
         const location = response.headers.get("location");
         if (location === null)
-            return response;
+            return { response, fetchedUrl: current };
+        await response.body?.cancel();
         current = new URL(location, current).href;
     }
 };
-const normalizeSourceMap = (request, text) => {
+const normalizeSourceMap = (request, text, fetchedUrl) => {
     if (!validSourceMapEnvelope(text))
         return emptySourceMapItem(request, "invalid", "Source-map JSON is not a version 3 map.");
     try {
-        const map = new AnyMap(text, request.fetchUrl);
+        const map = new AnyMap(text, fetchedUrl);
         const resolvedBySource = new Map();
         const originalSources = map.sources.map((source, index) => {
             const content = map.sourcesContent?.[index];
@@ -106,10 +115,16 @@ const normalizeSourceMap = (request, text) => {
             ...sourceMapContext(request),
             artifact: createWebTextArtifact(text, "application/source-map+json"),
             original_sources: originalSources,
-            original_module_edges: modules,
+            original_module_edges: modules.edges,
             mappings,
         };
-        return { ...parsed, status: "included", limitation: null };
+        return modules.incomplete.length === 0
+            ? { ...parsed, status: "included", limitation: null }
+            : {
+                ...parsed,
+                status: "partial",
+                limitation: `Module edges are incomplete: ${modules.incomplete.length} of ${originalSources.filter(({ artifact }) => artifact !== null).length} original sources could not be parsed in full (${modules.incomplete.join(", ")}).`,
+            };
     }
     catch {
         return emptySourceMapItem(request, "invalid", "Source-map mappings could not be decoded safely.");
@@ -118,28 +133,49 @@ const normalizeSourceMap = (request, text) => {
 const originalModuleEdges = (sources) => {
     const edges = [];
     const seen = new Set();
+    const incomplete = [];
     for (const source of sources) {
         if (source.artifact === null)
             continue;
-        for (const detector of originalImportDetectors) {
-            for (const match of source.artifact.text.matchAll(detector.pattern)) {
-                const specifier = match[1];
-                if (specifier === undefined)
-                    continue;
-                const key = `${source.source}\0${detector.kind}\0${specifier}`;
-                if (seen.has(key))
-                    continue;
-                seen.add(key);
-                edges.push({
-                    from_source: source.source,
-                    kind: detector.kind,
-                    specifier,
-                    resolved_source: resolveOriginalSource(specifier, source.source),
-                });
-            }
+        const parsed = parseJavaScriptSource(source.artifact.text);
+        if (parsed === null) {
+            incomplete.push(source.source);
+            continue;
         }
+        // A recovered program still yields the imports it did parse, but nodes
+        // after an unrecoverable point are missing, so the edges are a subset.
+        if (parsed.errors.length > 0)
+            incomplete.push(source.source);
+        let unboundRequires;
+        t.traverseFast(parsed, (node) => {
+            const dependency = originalDependency(node);
+            if (dependency === null)
+                return;
+            const { kind, specifier } = dependency;
+            if (kind === "require" && t.isCallExpression(node)) {
+                unboundRequires ??= new Set(analyzeParsedJavaScriptSemantics(parsed)
+                    .references.filter(({ name, role, resolution }) => name === "require" &&
+                    role === "read" &&
+                    resolution === "unbound")
+                    .map(({ location }) => `${String(location.start.line)}:${String(location.start.column)}`));
+                const location = node.callee.loc?.start;
+                if (location === undefined ||
+                    !unboundRequires.has(`${String(location.line)}:${String(location.column)}`))
+                    return;
+            }
+            const key = `${source.source}\0${kind}\0${specifier}`;
+            if (seen.has(key))
+                return;
+            seen.add(key);
+            edges.push({
+                from_source: source.source,
+                kind,
+                specifier,
+                resolved_source: resolveOriginalSource(specifier, source.source),
+            });
+        });
     }
-    return edges;
+    return { edges, incomplete };
 };
 const validSourceMapEnvelope = (text) => {
     let parsed;
@@ -152,7 +188,7 @@ const validSourceMapEnvelope = (text) => {
     if (!isRecord(parsed) || parsed.version !== 3)
         return false;
     if (typeof parsed.mappings === "string")
-        return Array.isArray(parsed.sources) && Array.isArray(parsed.names);
+        return validSourceMapLeaf(parsed);
     if (!Array.isArray(parsed.sections))
         return false;
     const pending = [...parsed.sections];
@@ -166,13 +202,15 @@ const validSourceMapEnvelope = (text) => {
         if (Array.isArray(map.sections))
             for (const child of map.sections)
                 pending.push(child);
-        else if (typeof map.mappings !== "string" ||
-            !Array.isArray(map.sources) ||
-            !Array.isArray(map.names))
+        else if (!validSourceMapLeaf(map))
             return false;
     }
     return true;
 };
+const validSourceMapLeaf = (map) => typeof map.mappings === "string" &&
+    Array.isArray(map.sources) &&
+    Array.isArray(map.names) &&
+    hasValidSourceMapContents(map.sources.length, map.sourcesContent);
 const approvedUrl = (value, allowedOrigins) => {
     try {
         const parsed = new URL(value);
@@ -200,13 +238,10 @@ const emptySourceMapItem = (request, status, limitation) => ({
 });
 const sanitizeSource = (value) => {
     try {
-        const parsed = new URL(value);
-        return parsed.protocol === "http:" || parsed.protocol === "https:"
-            ? sanitizeBrowserUrl(parsed.href).url
-            : `${parsed.protocol}//${parsed.host}${parsed.pathname}`;
+        return sanitizeBrowserUrl(new URL(value).href).url;
     }
     catch {
-        return value.split("#", 1)[0]?.split("?", 1)[0] ?? "";
+        return value;
     }
 };
 const resolveOriginalSource = (specifier, base) => {
@@ -221,17 +256,28 @@ const sourceMediaType = (source) => source?.endsWith(".ts") || source?.endsWith(
     ? "text/typescript"
     : "text/javascript";
 const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-const originalImportDetectors = [
-    {
-        kind: "static_import",
-        pattern: /\b(?:import|export)\s+(?:[^'"\n]*?\s+from\s+)?["']([^"'\n]+)["']/gu,
-    },
-    {
-        kind: "dynamic_import",
-        pattern: /\bimport\s*\(\s*["']([^"'\n]+)["']\s*\)/gu,
-    },
-    {
-        kind: "require",
-        pattern: /\brequire\s*\(\s*["']([^"'\n]+)["']\s*\)/gu,
-    },
-];
+const originalDependency = (node) => {
+    if (t.isImportDeclaration(node) ||
+        t.isExportAllDeclaration(node) ||
+        t.isExportNamedDeclaration(node))
+        return node.source === null || node.source === undefined
+            ? null
+            : { kind: "static_import", specifier: node.source.value };
+    if (t.isImportExpression(node) && t.isStringLiteral(node.source))
+        return { kind: "dynamic_import", specifier: node.source.value };
+    if (t.isCallExpression(node) &&
+        t.isIdentifier(node.callee, { name: "require" }) &&
+        t.isStringLiteral(node.arguments[0]))
+        return { kind: "require", specifier: node.arguments[0].value };
+    // `import x = require("m")` is only legal at module top level and always
+    // refers to the host loader, so it needs no unbound-`require` check. The
+    // `moduleReference` is an entity name for a local alias instead, which
+    // declares no dependency.
+    if (t.isTSImportEqualsDeclaration(node) &&
+        t.isTSExternalModuleReference(node.moduleReference))
+        return {
+            kind: "require",
+            specifier: node.moduleReference.expression.value,
+        };
+    return null;
+};

package/dist/cli/artifactCommands.js

@@ -7,6 +7,62 @@ export const registerArtifactCommands = (cli, logger) => {
     registerInspectionCommand(cli, logger);
     registerExtractionCommand(cli, logger);
     registerInterfaceBuilderCommand(cli, logger);
+    registerAssetCatalogCommand(cli, logger);
+    cli.command(CLI_COMMANDS.inspectKeyedArchive, {
+        description: "Inspect a Foundation keyed archive as an object-reference graph",
+        args: z.object({
+            path: z.string().describe("Foundation plist archive or Apple app bundle"),
+            archive: z
+                .string()
+                .default(".")
+                .describe("Relative archive path when the target is a bundle"),
+        }),
+        options: z.object({
+            root: z.string().optional().describe("Named $top archive root"),
+            offset: z
+                .number()
+                .int()
+                .min(0)
+                .default(0)
+                .describe("First original object-table index"),
+            limit: z
+                .number()
+                .int()
+                .min(1)
+                .max(20000)
+                .default(20000)
+                .describe("Maximum object-table entries to return"),
+        }),
+        run: ({ args, options }) => logCliCommand(logger, CLI_COMMANDS.inspectKeyedArchive, () => runProviderAnalysis(args.path, "inspect_keyed_archive", {
+            path: args.archive,
+            offset: options.offset,
+            limit: options.limit,
+            ...(options.root === undefined ? {} : { root: options.root }),
+        }, logger)),
+    });
+};
+const registerAssetCatalogCommand = (cli, logger) => {
+    cli.command(CLI_COMMANDS.inspectAssetCatalog, {
+        description: "Inspect compiled Apple asset catalog metadata",
+        args: z.object({ path: z.string().describe("Apple .app bundle path") }),
+        options: z.object({
+            offset: z
+                .number()
+                .int()
+                .min(0)
+                .default(0)
+                .describe("First metadata record"),
+            limit: z
+                .number()
+                .int()
+                .min(1)
+                .max(10_000)
+                .default(1_000)
+                .describe("Maximum records to return"),
+        }),
+        alias: {},
+        run: ({ args, options }) => logCliCommand(logger, CLI_COMMANDS.inspectAssetCatalog, () => runProviderAnalysis(args.path, "inspect_asset_catalog", { offset: options.offset, limit: options.limit }, logger)),
+    });
 };
 const registerInterfaceBuilderCommand = (cli, logger) => {
     cli.command(CLI_COMMANDS.decodeInterfaceBuilder, {
@@ -72,24 +128,12 @@ const registerInspectionCommand = (cli, logger) => {
                 .enum(["fail", "record-and-continue"])
                 .default("fail")
                 .describe("Behavior when declared artifact integrity does not match"),
-            integrityContinueApproved: z
-                .boolean()
-                .default(false)
-                .describe("Approve continuing after recorded integrity mismatches"),
-            nativeMountApproved: z
-                .boolean()
-                .default(false)
-                .describe("Approve read-only native mounting when required"),
         }),
         alias: {
             integrityPolicy: "integrity-policy",
-            integrityContinueApproved: "integrity-continue-approved",
-            nativeMountApproved: "native-mount-approved",
         },
         run: ({ args, options }) => logCliCommand(logger, "inspect-artifact", () => runProviderAnalysis(args.path, "inspect_artifact", {
             integrity_policy: options.integrityPolicy,
-            integrity_continue_approved: options.integrityContinueApproved,
-            native_mount_approved: options.nativeMountApproved,
         }, logger)),
     });
 };

package/dist/cli/coreAnalysisCommands.js

@@ -8,6 +8,116 @@ import { directAnalysisOptions, providerSelectionOption } from "./options.js";
 import { runCliJavaScriptApplicationAnalysis } from "./javascriptApplicationAnalysis.js";
 export const registerCoreAnalysisCommands = (cli, logger) => {
     registerCoreCommands(cli, logger);
+    cli.command(CLI_COMMANDS.traceNativeValues, {
+        description: "Trace bounded native def-use and call dependencies",
+        args: z.object({
+            path: z.string().describe("Local native executable or app path"),
+            procedure: z
+                .string()
+                .describe("Explicit native procedure symbol or address"),
+        }),
+        options: z.object({
+            maxDepth: z
+                .number()
+                .int()
+                .min(0)
+                .max(16)
+                .default(3)
+                .describe("Maximum call traversal depth"),
+            maxFunctions: z
+                .number()
+                .int()
+                .min(1)
+                .max(64)
+                .default(16)
+                .describe("Maximum function decompilations"),
+            maxCallSites: z
+                .number()
+                .int()
+                .min(1)
+                .max(4096)
+                .default(256)
+                .describe("Maximum static call-site resolutions"),
+            maxNodes: z
+                .number()
+                .int()
+                .min(1)
+                .max(20000)
+                .default(5000)
+                .describe("Maximum retained graph nodes"),
+            maxEdges: z
+                .number()
+                .int()
+                .min(1)
+                .max(40000)
+                .default(10000)
+                .describe("Maximum retained graph edges"),
+            offset: z
+                .number()
+                .int()
+                .min(0)
+                .default(0)
+                .describe("First graph node index"),
+            limit: z
+                .number()
+                .int()
+                .min(1)
+                .max(5000)
+                .default(1000)
+                .describe("Maximum nodes on this page"),
+            provider: providerSelectionOption,
+        }),
+        alias: {
+            maxDepth: "max-depth",
+            maxFunctions: "max-functions",
+            maxCallSites: "max-call-sites",
+            maxNodes: "max-nodes",
+            maxEdges: "max-edges",
+        },
+        run: ({ args, options }) => logCliCommand(logger, CLI_COMMANDS.traceNativeValues, () => runDirectAnalysis(args.path, "trace_native_values", {
+            procedure: args.procedure,
+            max_depth: options.maxDepth,
+            max_functions: options.maxFunctions,
+            max_call_sites: options.maxCallSites,
+            max_nodes: options.maxNodes,
+            max_edges: options.maxEdges,
+            offset: options.offset,
+            limit: options.limit,
+        }, directAnalysisOptions(logger, undefined, options.provider))),
+    });
+    cli.command(CLI_COMMANDS.inspectNativeDataType, {
+        description: "Inspect one recovered database type or typed data object",
+        args: z.object({
+            path: z.string().describe("Local native executable or app path"),
+        }),
+        options: z.object({
+            type: z.string().optional().describe("Exact database type category path"),
+            address: z.string().describe("Exact native address").optional(),
+            provider: providerSelectionOption,
+        }),
+        run: ({ args, options }) => logCliCommand(logger, CLI_COMMANDS.inspectNativeDataType, () => runDirectAnalysis(args.path, "inspect_native_data_type", {
+            ...(options.type === undefined ? {} : { type: options.type }),
+            ...(options.address === undefined
+                ? {}
+                : { address: options.address }),
+        }, directAnalysisOptions(logger, undefined, options.provider))),
+    });
+    for (const [command, operation] of [
+        [CLI_COMMANDS.inspectNativeInstruction, "inspect_native_instruction"],
+        [CLI_COMMANDS.resolveNativeCallTargets, "resolve_native_call_targets"],
+    ]) {
+        cli.command(command, {
+            description: operation === "inspect_native_instruction"
+                ? "Inspect one native instruction with decoded operand facts"
+                : "Resolve one static native call site",
+            args: z.object({
+                path: z.string().describe("Local native executable or app path"),
+                address: z.string().describe("Exact native address"),
+            }),
+            options: z.object({ provider: providerSelectionOption }),
+            run: ({ args, options }) => logCliCommand(logger, command, () => runDirectAnalysis(args.path, operation, { address: args.address }, directAnalysisOptions(logger, undefined, options.provider))),
+        });
+    }
     registerFunctionCommand(cli, logger);
     registerNativeApiCommand(cli, logger);
     registerInstructionsCommand(cli, logger);