rea-agents 6.2.0 → 6.3.0

package/dist/server/registerEnhancedTools.js

@@ -7,7 +7,7 @@ import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
 import { executeFunctionAnalysisEvidence } from "../application/FunctionAnalysisEvidence.js";
 /** Register composed workflows against the same port as direct bridge tools. */
 // oxlint-disable-next-line max-lines-per-function -- direct SDK calls retain each schema-handler type correlation.
-export const registerEnhancedTools = (server, analysis, options) => {
+export const registerEnhancedTools = (server, options) => {
     const registration = { ...options, delivery: server.delivery };
     const nativeDispatchMetadata = toolContract("inspect_native_dispatch_metadata");
     const objcClasses = toolContract("get_objc_classes");
@@ -23,125 +23,130 @@ export const registerEnhancedTools = (server, analysis, options) => {
     const traceCallPath = toolContract("trace_call_path");
     const traceNativeUiAction = toolContract("trace_native_ui_action");
     const traceNativeValues = toolContract("trace_native_values");
-    server.registerTool(traceNativeValues.name, toolRegistrationOptions(traceNativeValues), (input, context) => executeEnhancedTool(analysis, registration, traceNativeValues, {
+    server.registerTool(traceNativeValues.name, toolRegistrationOptions(traceNativeValues), (input, context) => executeEnhancedTool(registration, traceNativeValues, {
         validatedCall: { name: "trace_native_values", input },
         context,
     }));
-    server.registerTool(nativeDispatchMetadata.name, toolRegistrationOptions(nativeDispatchMetadata), (input, context) => executeEnhancedTool(analysis, registration, nativeDispatchMetadata, {
+    server.registerTool(nativeDispatchMetadata.name, toolRegistrationOptions(nativeDispatchMetadata), (input, context) => executeEnhancedTool(registration, nativeDispatchMetadata, {
         validatedCall: { name: "inspect_native_dispatch_metadata", input },
         context,
     }));
-    server.registerTool(objcClasses.name, toolRegistrationOptions(objcClasses), (input, context) => executeEnhancedTool(analysis, registration, objcClasses, {
+    server.registerTool(objcClasses.name, toolRegistrationOptions(objcClasses), (input, context) => executeEnhancedTool(registration, objcClasses, {
         validatedCall: { name: "get_objc_classes", input },
         context,
     }));
-    server.registerTool(objcProtocols.name, toolRegistrationOptions(objcProtocols), (input, context) => executeEnhancedTool(analysis, registration, objcProtocols, {
+    server.registerTool(objcProtocols.name, toolRegistrationOptions(objcProtocols), (input, context) => executeEnhancedTool(registration, objcProtocols, {
         validatedCall: { name: "get_objc_protocols", input },
         context,
     }));
-    server.registerTool(batchDecompile.name, toolRegistrationOptions(batchDecompile), (input, context) => executeEnhancedTool(analysis, registration, batchDecompile, {
+    server.registerTool(batchDecompile.name, toolRegistrationOptions(batchDecompile), (input, context) => executeEnhancedTool(registration, batchDecompile, {
         validatedCall: { name: "batch_decompile", input },
         context,
     }));
-    server.registerTool(callGraph.name, toolRegistrationOptions(callGraph), (input, context) => executeEnhancedTool(analysis, registration, callGraph, {
+    server.registerTool(callGraph.name, toolRegistrationOptions(callGraph), (input, context) => executeEnhancedTool(registration, callGraph, {
         validatedCall: { name: "get_call_graph", input },
         context,
     }));
-    server.registerTool(swiftTypes.name, toolRegistrationOptions(swiftTypes), (input, context) => executeEnhancedTool(analysis, registration, swiftTypes, {
+    server.registerTool(swiftTypes.name, toolRegistrationOptions(swiftTypes), (input, context) => executeEnhancedTool(registration, swiftTypes, {
         validatedCall: { name: "analyze_swift_types", input },
         context,
     }));
-    server.registerTool(xrefsToName.name, toolRegistrationOptions(xrefsToName), (input, context) => executeEnhancedTool(analysis, registration, xrefsToName, {
+    server.registerTool(xrefsToName.name, toolRegistrationOptions(xrefsToName), (input, context) => executeEnhancedTool(registration, xrefsToName, {
         validatedCall: { name: "find_xrefs_to_name", input },
         context,
     }));
-    server.registerTool(binaryOverview.name, toolRegistrationOptions(binaryOverview), (input, context) => executeEnhancedTool(analysis, registration, binaryOverview, {
+    server.registerTool(binaryOverview.name, toolRegistrationOptions(binaryOverview), (input, context) => executeEnhancedTool(registration, binaryOverview, {
         validatedCall: { name: "binary_overview", input },
         context,
     }));
-    server.registerTool(analyzeFunction.name, toolRegistrationOptions(analyzeFunction), (input, context) => executeEnhancedTool(analysis, registration, analyzeFunction, {
+    server.registerTool(analyzeFunction.name, toolRegistrationOptions(analyzeFunction), (input, context) => executeEnhancedTool(registration, analyzeFunction, {
         validatedCall: { name: "analyze_function", input },
         context,
     }));
-    server.registerTool(inspectNativeApi.name, toolRegistrationOptions(inspectNativeApi), (input, context) => executeEnhancedTool(analysis, registration, inspectNativeApi, {
+    server.registerTool(inspectNativeApi.name, toolRegistrationOptions(inspectNativeApi), (input, context) => executeEnhancedTool(registration, inspectNativeApi, {
         validatedCall: { name: "inspect_native_api", input },
         context,
     }));
-    server.registerTool(traceFeature.name, toolRegistrationOptions(traceFeature), (input, context) => executeEnhancedTool(analysis, registration, traceFeature, {
+    server.registerTool(traceFeature.name, toolRegistrationOptions(traceFeature), (input, context) => executeEnhancedTool(registration, traceFeature, {
         validatedCall: { name: "trace_feature", input },
         context,
     }));
-    server.registerTool(traceCallPath.name, toolRegistrationOptions(traceCallPath), (input, context) => executeEnhancedTool(analysis, registration, traceCallPath, {
+    server.registerTool(traceCallPath.name, toolRegistrationOptions(traceCallPath), (input, context) => executeEnhancedTool(registration, traceCallPath, {
         validatedCall: { name: "trace_call_path", input },
         context,
     }));
-    server.registerTool(traceNativeUiAction.name, toolRegistrationOptions(traceNativeUiAction), (input, context) => executeEnhancedTool(analysis, registration, traceNativeUiAction, {
+    server.registerTool(traceNativeUiAction.name, toolRegistrationOptions(traceNativeUiAction), (input, context) => executeEnhancedTool(registration, traceNativeUiAction, {
         validatedCall: { name: "trace_native_ui_action", input },
         context,
     }));
 };
-const executeEnhancedTool = async (analysis, registration, contract, request) => {
-    const { validatedCall, context } = request;
-    const name = validatedCall.name;
-    const progress = mcpProgressReporter(context);
-    await progress.report({
-        phase: name,
-        completed: 0,
-        total: 1,
-        message: "started",
-    });
-    const parsedInput = validatedCall.input;
-    const parameters = jsonParameters(parsedInput);
-    if (name === "analyze_function")
-        return executeFunctionTool(analysis, registration, contract, {
-            context,
-            parameters,
+const executeEnhancedTool = async (registration, contract, request) => {
+    const admitted = await registration.withAdmittedAnalysis(request.validatedCall.name, request.context.mcpReq.signal, async (admittedAnalysis) => {
+        const { validatedCall, context } = request;
+        const name = validatedCall.name;
+        const progress = mcpProgressReporter(context);
+        await progress.report({
+            phase: name,
+            completed: 0,
+            total: 1,
+            message: "started",
         });
-    const services = new EnhancedTools({
-        execute: (operation, operationParameters, executionOptions) => analysis.execute(operation, operationParameters, {
-            ...executionOptions,
-            progress,
-        }),
-    });
-    const result = await logToolExecution(registration.logger, name, () => services.executeValidated(validatedCall, context.mcpReq.signal));
-    await progress.report({
-        phase: name,
-        completed: 1,
-        total: 1,
-        message: result.ok ? "completed" : "failed",
-        terminal: true,
-    });
-    if (result.ok) {
-        const evidence = createWorkflowEvidence({
-            target: registration.activeTarget?.(),
-            operation: name,
-            parameters,
-            result: result.value,
-            upstreamProfile: registration.analysisProfile?.(),
+        const parsedInput = validatedCall.input;
+        const parameters = jsonParameters(parsedInput);
+        if (name === "analyze_function")
+            return executeFunctionTool(admittedAnalysis, registration, contract, {
+                context,
+                parameters,
+            });
+        const services = new EnhancedTools({
+            execute: (operation, operationParameters, executionOptions) => admittedAnalysis.execute(operation, operationParameters, {
+                ...executionOptions,
+                progress,
+            }),
+        });
+        const result = await logToolExecution(registration.logger, name, () => services.executeValidated(validatedCall, context.mcpReq.signal));
+        await progress.report({
+            phase: name,
+            completed: 1,
+            total: 1,
+            message: result.ok ? "completed" : "failed",
+            terminal: true,
         });
-        const recorded = registration.recordEvidence?.(evidence);
-        if (recorded !== undefined && !recorded.ok)
-            return registration.delivery.toCallToolResult(recorded, contract);
-        if (name !== "trace_native_ui_action" &&
-            registration.allowsSnapshotReplay?.(name) === true) {
-            const workflowRecord = workflowSnapshotRecord(evidence, name);
-            if (workflowRecord !== undefined) {
-                const snapshot = registration.recordWorkflowSnapshot?.(workflowRecord);
-                if (snapshot !== undefined && !snapshot.ok)
-                    return registration.delivery.toCallToolResult(snapshot, contract);
+        if (result.ok) {
+            const evidence = createWorkflowEvidence({
+                target: registration.activeTarget?.(),
+                operation: name,
+                parameters,
+                result: result.value,
+                upstreamProfile: registration.analysisProfile?.(),
+            });
+            const recorded = registration.recordEvidence?.(evidence);
+            if (recorded !== undefined && !recorded.ok)
+                return registration.delivery.toCallToolResult(recorded, contract);
+            if (name !== "trace_native_ui_action" &&
+                registration.allowsSnapshotReplay?.(name) === true) {
+                const workflowRecord = workflowSnapshotRecord(evidence, name);
+                if (workflowRecord !== undefined) {
+                    const snapshot = registration.recordWorkflowSnapshot?.(workflowRecord);
+                    if (snapshot !== undefined && !snapshot.ok)
+                        return registration.delivery.toCallToolResult(snapshot, contract);
+                }
             }
+            const unknowns = recordWorkflowUnknowns({
+                name,
+                result: result.value,
+                evidenceId: evidence.evidence_id,
+                recordUnknown: registration.recordUnknown,
+            });
+            if (!unknowns.ok)
+                return registration.delivery.toCallToolResult(unknowns, contract);
+            return registration.delivery.toEvidenceToolResult(evidence, contract, recorded);
         }
-        const unknowns = recordWorkflowUnknowns({
-            name,
-            result: result.value,
-            evidenceId: evidence.evidence_id,
-            recordUnknown: registration.recordUnknown,
-        });
-        if (!unknowns.ok)
-            return registration.delivery.toCallToolResult(unknowns, contract);
-        return registration.delivery.toEvidenceToolResult(evidence, contract, recorded);
-    }
-    return registration.delivery.toCallToolResult(result, contract);
+        return registration.delivery.toCallToolResult(result, contract);
+    });
+    return admitted.ok
+        ? admitted.value
+        : registration.delivery.toCallToolResult(admitted, contract);
 };
 const executeFunctionTool = async (analysis, registration, contract, request) => {
     const { context, parameters } = request;

package/dist/server/registerEvidenceTools.js

@@ -5,56 +5,64 @@ import { logToolExecution } from "./toolLogging.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
 import { createArtifactExtractionDestination } from "../application/artifacts/ArtifactExtractionDestination.js";
 /** Register provider-backed contracts that return atomic Evidence observations. */
-export const registerEvidenceTools = (server, analysis, contracts, options) => {
+export const registerEvidenceTools = (server, contracts, options) => {
     for (const contract of contracts) {
         server.registerTool(contract.name, toolRegistrationOptions(contract), async (input, context) => {
-            const progress = mcpProgressReporter(context);
-            await progress.report({
-                phase: contract.name,
-                completed: 0,
-                total: 1,
-                message: "started",
-            });
-            const parameters = jsonObjectSchema.parse(input);
-            const executionParameters = contract.name === "extract_artifact"
-                ? {
-                    ...parameters,
-                    output_root: createArtifactExtractionDestination(),
+            const admitted = await options.withAdmittedAnalysis(contract.name, context.mcpReq.signal, async (admittedAnalysis) => {
+                const analysis = options.analysisForAdmission?.(admittedAnalysis) ??
+                    admittedAnalysis;
+                const progress = mcpProgressReporter(context);
+                await progress.report({
+                    phase: contract.name,
+                    completed: 0,
+                    total: 1,
+                    message: "started",
+                });
+                const parameters = jsonObjectSchema.parse(input);
+                const executionParameters = contract.name === "extract_artifact"
+                    ? {
+                        ...parameters,
+                        output_root: createArtifactExtractionDestination(),
+                    }
+                    : parameters;
+                const execution = await logToolExecution(options.logger, contract.name, () => analysis.execute(contract.name, executionParameters, {
+                    signal: context.mcpReq.signal,
+                    progress,
+                }));
+                await progress.report({
+                    phase: contract.name,
+                    completed: 1,
+                    total: 1,
+                    message: execution.ok ? "completed" : "failed",
+                    terminal: true,
+                });
+                if (!execution.ok)
+                    return server.delivery.toCallToolResult(execution, contract);
+                const sourceEvidence = options.sourceEvidence?.(contract.name, execution.value.result) ??
+                    [];
+                const evidence = createEvidence(execution.value.subject ?? options.activeTarget?.(), execution.value.provider, {
+                    operation: contract.name,
+                    parameters,
+                    result: execution.value.result,
+                    ...(execution.value.analysisProfile === undefined
+                        ? {}
+                        : { analysisProfile: execution.value.analysisProfile }),
+                    rawResult: execution.value.rawResult,
+                    limitations: execution.value.limitations,
+                    locations: execution.value.locations,
+                    evidenceLinks: sourceEvidence.map(({ evidence_id: id }) => id),
+                });
+                for (const source of sourceEvidence) {
+                    const sourceRecorded = options.recordEvidence?.(source);
+                    if (sourceRecorded !== undefined && !sourceRecorded.ok)
+                        return server.delivery.toCallToolResult(sourceRecorded, contract);
                 }
-                : parameters;
-            const execution = await logToolExecution(options.logger, contract.name, () => analysis.execute(contract.name, executionParameters, {
-                signal: context.mcpReq.signal,
-                progress,
-            }));
-            await progress.report({
-                phase: contract.name,
-                completed: 1,
-                total: 1,
-                message: execution.ok ? "completed" : "failed",
-                terminal: true,
-            });
-            if (!execution.ok)
-                return server.delivery.toCallToolResult(execution, contract);
-            const sourceEvidence = options.sourceEvidence?.(contract.name, execution.value.result) ?? [];
-            const evidence = createEvidence(execution.value.subject ?? options.activeTarget?.(), execution.value.provider, {
-                operation: contract.name,
-                parameters,
-                result: execution.value.result,
-                ...(execution.value.analysisProfile === undefined
-                    ? {}
-                    : { analysisProfile: execution.value.analysisProfile }),
-                rawResult: execution.value.rawResult,
-                limitations: execution.value.limitations,
-                locations: execution.value.locations,
-                evidenceLinks: sourceEvidence.map(({ evidence_id: id }) => id),
+                const recorded = options.recordEvidence?.(evidence);
+                return server.delivery.toEvidenceToolResult(evidence, contract, recorded);
             });
-            for (const source of sourceEvidence) {
-                const sourceRecorded = options.recordEvidence?.(source);
-                if (sourceRecorded !== undefined && !sourceRecorded.ok)
-                    return server.delivery.toCallToolResult(sourceRecorded, contract);
-            }
-            const recorded = options.recordEvidence?.(evidence);
-            return server.delivery.toEvidenceToolResult(evidence, contract, recorded);
+            return admitted.ok
+                ? admitted.value
+                : server.delivery.toCallToolResult(admitted, contract);
         });
     }
 };

package/dist/server/registerManagedTools.js

@@ -5,9 +5,9 @@ import { registerEvidenceTools } from "./registerEvidenceTools.js";
 import { runManagedProviderExecution } from "../composition/directAnalysis.js";
 import { isManagedToolName } from "../contracts/managed/managedToolContracts.js";
 /** Register execution-free managed PE/CLI inspection. */
-export const registerManagedTools = (server, analysis, options) => {
+export const registerManagedTools = (server, options) => {
     let selectedManagedPath;
-    const managedAnalysis = {
+    const analysisForAdmission = (analysis) => ({
         execute: async (operation, parameters, executionOptions) => {
             if (!isManagedToolName(operation))
                 return analysis.execute(operation, parameters, executionOptions);
@@ -32,6 +32,9 @@ export const registerManagedTools = (server, analysis, options) => {
                 selectedManagedPath = requestedPath;
             return execution;
         },
-    };
-    registerEvidenceTools(server, managedAnalysis, MANAGED_TOOL_CONTRACTS, options);
+    });
+    registerEvidenceTools(server, MANAGED_TOOL_CONTRACTS, {
+        ...options,
+        analysisForAdmission,
+    });
 };

package/dist/server/registerOfficialTools.js

@@ -5,40 +5,46 @@ import { mcpProgressReporter } from "./mcpProgress.js";
 import { logToolExecution } from "./toolLogging.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
 /** Register direct bridge proxies, preserving MCP cancellation and typed errors. */
-export const registerOfficialTools = (server, analysis, options) => {
+export const registerOfficialTools = (server, options) => {
     for (const contract of OFFICIAL_TOOL_CONTRACTS) {
-        registerOfficialTool(server, analysis, contract, {
+        registerOfficialTool(server, contract, {
             logger: options.logger,
             activeTarget: options.activeTarget,
             recordEvidence: options.recordEvidence,
+            withAdmittedAnalysis: options.withAdmittedAnalysis,
         });
     }
 };
-const registerOfficialTool = (server, analysis, contract, registration) => {
+const registerOfficialTool = (server, contract, registration) => {
     server.registerTool(contract.name, toolRegistrationOptions(contract), async (input, context) => {
-        const arguments_ = jsonObjectSchema.parse(contract.inputSchema.parse(input));
-        const progress = mcpProgressReporter(context);
-        const result = await runOfficialOperation(analysis, contract, arguments_, {
-            logger: registration.logger,
-            signal: context.mcpReq.signal,
-            progress,
+        const admitted = await registration.withAdmittedAnalysis(contract.name, context.mcpReq.signal, async (admittedAnalysis) => {
+            const arguments_ = jsonObjectSchema.parse(contract.inputSchema.parse(input));
+            const progress = mcpProgressReporter(context);
+            const result = await runOfficialOperation(admittedAnalysis, contract, arguments_, {
+                logger: registration.logger,
+                signal: context.mcpReq.signal,
+                progress,
+            });
+            if (!result.ok) {
+                return server.delivery.toCallToolResult(result, contract);
+            }
+            const evidence = createEvidence(result.value.subject ?? registration.activeTarget?.(), result.value.provider, {
+                operation: contract.name,
+                parameters: arguments_,
+                result: result.value.result,
+                ...(result.value.analysisProfile === undefined
+                    ? {}
+                    : { analysisProfile: result.value.analysisProfile }),
+                rawResult: result.value.rawResult,
+                limitations: result.value.limitations,
+                locations: result.value.locations,
+            });
+            const recorded = registration.recordEvidence?.(evidence);
+            return server.delivery.toEvidenceToolResult(evidence, contract, recorded);
         });
-        if (!result.ok) {
-            return server.delivery.toCallToolResult(result, contract);
-        }
-        const evidence = createEvidence(result.value.subject ?? registration.activeTarget?.(), result.value.provider, {
-            operation: contract.name,
-            parameters: arguments_,
-            result: result.value.result,
-            ...(result.value.analysisProfile === undefined
-                ? {}
-                : { analysisProfile: result.value.analysisProfile }),
-            rawResult: result.value.rawResult,
-            limitations: result.value.limitations,
-            locations: result.value.locations,
-        });
-        const recorded = registration.recordEvidence?.(evidence);
-        return server.delivery.toEvidenceToolResult(evidence, contract, recorded);
+        return admitted.ok
+            ? admitted.value
+            : server.delivery.toCallToolResult(admitted, contract);
     });
 };
 const runOfficialOperation = async (analysis, contract, arguments_, execution) => {

package/dist/server/registerSessionTools.js

@@ -15,7 +15,7 @@ import { registerInvestigationTools } from "./registerInvestigationTools.js";
 import { registerProcessComparisonTool } from "./registerProcessComparisonTool.js";
 import { registerEvidenceTools, registerUnknownTools, } from "./registerSessionRecordTools.js";
 import { registerSessionStatusTool } from "./registerSessionStatusTool.js";
-import { sessionAvailabilityPolicy, } from "./sessionAvailabilityPolicy.js";
+import { sessionAvailabilityPolicy } from "./sessionAvailabilityPolicy.js";
 import { logToolExecution } from "./toolLogging.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
 const recordProcessResidualUnknowns = (session, evidence, residuals) => {
@@ -121,10 +121,16 @@ const registerContextTools = (server, session) => {
     const navigationContract = toolContract("get_navigation_context");
     const addressContract = toolContract("inspect_address_context");
     server.registerTool(navigationContract.name, toolRegistrationOptions(navigationContract), async (input, context) => {
-        return server.delivery.toCallToolResult(await getNavigationContext(session, input, context.mcpReq.signal), navigationContract);
+        const admitted = await session.withAdmittedAnalysis(navigationContract.name, context.mcpReq.signal, async (analysis) => server.delivery.toCallToolResult(await getNavigationContext(analysis, input, context.mcpReq.signal), navigationContract));
+        return admitted.ok
+            ? admitted.value
+            : server.delivery.toCallToolResult(admitted, navigationContract);
     });
     server.registerTool(addressContract.name, toolRegistrationOptions(addressContract), async (input, context) => {
-        return server.delivery.toCallToolResult(await inspectAddressContext(session, input, context.mcpReq.signal), addressContract);
+        const admitted = await session.withAdmittedAnalysis(addressContract.name, context.mcpReq.signal, async (analysis) => server.delivery.toCallToolResult(await inspectAddressContext(analysis, input, context.mcpReq.signal), addressContract));
+        return admitted.ok
+            ? admitted.value
+            : server.delivery.toCallToolResult(admitted, addressContract);
     });
 };
 export const registerSessionTools = (server, session, logger, options = {}) => {

package/native/windows/build/manifest.json

@@ -1,5 +1,5 @@
 {
-  "packageVersion": "6.2.0",
+  "packageVersion": "6.3.0",
   "platform": "win32",
   "architecture": "x64",
   "abiVersion": 1,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "rea-agents",
   "mcpName": "io.github.morluto/rea",
-  "version": "6.2.0",
+  "version": "6.3.0",
   "description": "Reverse engineer anything from your terminal or agent with one CLI and MCP server.",
   "license": "MIT",
   "repository": {
@@ -88,7 +88,7 @@
     "prebuild": "npm run deps:check",
     "build": "node scripts/run-exclusive.mjs artifacts turbo run artifacts:skills --force",
     "precheck": "npm run deps:check",
-    "check": "node scripts/run-exclusive.mjs artifacts turbo run typecheck lint format:check knip metadata:check",
+    "check": "node scripts/run-exclusive.mjs artifacts turbo run typecheck lint format:check knip metadata:check && npm run verify:architecture-guards",
     "precheck:fast": "npm run deps:check",
     "check:fast": "turbo run typecheck lint --output-logs=errors-only",
     "precheck:changed": "npm run deps:check",
@@ -98,7 +98,7 @@
     "precheck:pr": "npm run deps:check",
     "check:pr": "node scripts/run-exclusive.mjs artifacts turbo run typecheck lint format:check knip metadata:check test:run && npm run docs:check && npm run jscpd && npm run scan:todos",
     "precheck:ci": "npm run deps:check",
-    "check:ci": "node scripts/run-exclusive.mjs artifacts turbo run typecheck lint format:check knip metadata:check jscpd scan:todos",
+    "check:ci": "node scripts/run-exclusive.mjs artifacts turbo run typecheck lint format:check knip metadata:check jscpd scan:todos && npm run verify:architecture-guards",
     "build:cached": "node scripts/check-dependency-install.mjs && node scripts/run-exclusive.mjs artifacts turbo run artifacts:skills",
     "format": "oxfmt .",
     "format:check": "oxfmt --check .",
@@ -144,6 +144,8 @@
     "verify:native-ui": "npm run build:cached && node scripts/verify-native-ui.mjs",
     "verify:keyed-archive": "npm run build:cached && node scripts/verify/apple/keyed-archive.mjs",
     "verify:macos-bundle": "npm run build:cached && node scripts/verify/apple/macos-bundle.mjs",
+    "verify:legacy-simulator": "npm run build:cached && node scripts/verify/apple/legacy-simulator.mjs",
+    "verify:architecture-guards": "node scripts/verify/architecture-guards.mjs",
     "verify:ghidra": "npm run build:cached && node scripts/verify-real-ghidra.mjs",
     "verify:ghidra:swift": "npm run build:cached && node scripts/verify-real-ghidra-swift.mjs",
     "verify:ida": "npm run build:cached && node scripts/verify-real-ida.mjs",
@@ -263,6 +265,7 @@
     "plist": "5.0.0",
     "semver": "7.8.5",
     "smol-toml": "1.9.0",
+    "stream-json": "3.7.0",
     "write-file-atomic": "7.0.0",
     "ws": "8.21.0",
     "zod": "4.4.3",

package/skills/reverse-engineer-anything/SKILL.md

@@ -29,10 +29,10 @@ advertise retained references.
 When tools are absent or registration is stale:
 
 1. Diagnose without changing files. For Codex, run
-   `npx -y rea-agents@latest doctor --client codex --json`. Substitute the current
+   `npx -y rea-agents@6.3.0 doctor --client codex --json`. Substitute the current
    supported client: `claude_code`, `claude_desktop`, `codex`, `cursor`,
    `gemini_cli`, `windsurf`, `devin`, `opencode`, `antigravity`, `copilot_cli`,
-   `commandcode`, `vscode`, `grok_build`, or `grok_bot`. `grok_bot` has no local
+   `commandcode`, `vscode`, `grok_build`, `omp`, or `grok_bot`. `grok_bot` has no local
    file registration: doctor reports the Grok Bot chat step, and setup does not
    write `mcp.json`. If the client is unknown, use `doctor --json` and
    inspect its registration results before choosing a setup scope.
@@ -43,12 +43,12 @@ When tools are absent or registration is stale:
    that provider: static JavaScript inspection needs neither Hopper nor Ghidra,
    and Android inspection has separate bring-your-own JADX/Java prerequisites.
 3. For a configuration repair, prepare the read-only plan:
-   `npx -y rea-agents@latest setup --client codex --dry-run --json`.
+   `npx -y rea-agents@6.3.0 setup --client codex --dry-run --json`.
    Use the current client's ID, show its exact proposed paths, backups, and
    changes, and obtain approval before setup writes configuration or installs
    Hopper. Setup normally installs the matching bundled skill too; include that
    replacement in the reviewed plan. After approval, apply the same scope with
-   `npx -y rea-agents@latest setup --client codex --yes`. Add `--install-hopper`
+   `npx -y rea-agents@6.3.0 setup --client codex --yes`. Add `--install-hopper`
    only if that separate installation was needed and explicitly approved.
 4. Restart/reconnect the affected agent. Verify that REA tools actually appear
    in the session, then resume the original investigation. If they remain
@@ -63,7 +63,7 @@ with a version-pinned `rea-agents` package or continue through the CLI.
 A concrete CLI fallback for an operator-supplied JavaScript tree or ASAR is:
 
 ```bash
-npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json
+npx -y rea-agents@6.3.0 analyze-javascript-application /absolute/path/to/app --json
 ```
 
 No MCP registration or native engine is required. Read the returned Evidence,

package/skills/reverse-engineer-anything/references/native-and-artifacts.md

@@ -60,6 +60,15 @@ use inclusive ends and can contain gaps. Do not treat the enclosing span as code
 For packed targets, retain the original and separately derived artifact identities;
 decompiling an unpacking stub does not recover the unpacked program.
 
+When reading Objective-C dispatch metadata, distinguish class implementation
+methods from protocol requirements: class methods report null requirement
+flags, while decoded protocol declarations retain required and optional facts.
+Property attributes remain raw name/value tokens; use the property's
+`atomicity` field for the decoded `N` marker or the default atomic behavior.
+Null class/meta flags, ivar counts, atomicity, or read-only values mean the
+selected provider did not establish that fact. Symbol names alone do not prove
+that a class is a root class or has no ivars.
+
 ## Managed PE/CLI
 
 Start with `inspect_managed_artifact`. REA's canonical managed inspection is

package/dist/artifacts/inventory/policy.js

@@ -1,2 +0,0 @@
-/** Preserve the explicit integrity admission choice without changing verification. */
-export const resolveArtifactIntegrityPolicy = (intent) => intent;

package/dist/domain/managed/managedApplicationGraphNodeCoverage.js

@@ -1,6 +0,0 @@
-/** Derive module coverage from the best available managed evidence source. */
-export const moduleCoverageState = (parsed) => parsed.artifact !== null && parsed.artifact.result.module !== null
-    ? parsed.artifact.result.coverage.state
-    : parsed.members !== null && parsed.members.result.module !== null
-        ? parsed.members.result.coverage.state
-        : (parsed.boundaries?.result.coverage.state ?? "complete");

package/dist/server/registerNativeTools.js

@@ -1,6 +0,0 @@
-import { NATIVE_TOOL_CONTRACTS } from "../contracts/native/nativeToolContracts.js";
-import { registerEvidenceTools } from "./registerEvidenceTools.js";
-/** Register provider-neutral static inspection operations. */
-export const registerNativeTools = (server, analysis, options) => {
-    registerEvidenceTools(server, analysis, NATIVE_TOOL_CONTRACTS, options);
-};