rea-agents 6.3.0 → 6.4.0

package/dist/application/AppBundleExecutable.js

@@ -1,14 +1,15 @@
-import { execFile } from "node:child_process";
-import { lstat, readdir, readFile, realpath, stat } from "node:fs/promises";
+import { lstat, opendir, readFile, realpath, stat } from "node:fs/promises";
 import { join } from "node:path";
-import { promisify } from "node:util";
+import { parseBinary } from "plist";
 import { z } from "zod";
+import { preflightPropertyListDecode } from "../artifacts/apple/InterfaceBuilderDecodeBudget.js";
 import { BinaryTargetError } from "../domain/configurationErrors.js";
 import { isPathWithinRoot } from "../domain/localPath.js";
-import { parseXmlPropertyList } from "../domain/propertyListKeys.js";
+import { omitPrototypeKeys, parseXmlPropertyList, } from "../domain/propertyListKeys.js";
 import { decodeXmlPlistText } from "../domain/propertyListXmlText.js";
 import { err, ok } from "../domain/result.js";
-const execFileAsync = promisify(execFile);
+/** Decoded representation bound for one binary Info.plist. */
+const BINARY_PLIST_DECODE_BYTES = 16 * 1024 * 1024;
 const BUNDLE_LAYOUTS = [
     // macOS bundles keep both under Contents.
     {
@@ -105,11 +106,15 @@ const wrappedBundle = async (bundle) => {
             return undefined;
         throw cause;
     }
-    const apps = (await readdir(wrapper, { withFileTypes: true })).filter((entry) => entry.isDirectory() && entry.name.toLowerCase().endsWith(".app"));
-    const [app] = apps;
-    return apps.length === 1 && app !== undefined
-        ? join(wrapper, app.name)
-        : undefined;
+    let app;
+    for await (const entry of await opendir(wrapper)) {
+        if (!entry.isDirectory() || !entry.name.toLowerCase().endsWith(".app"))
+            continue;
+        if (app !== undefined)
+            return undefined;
+        app = join(wrapper, entry.name);
+    }
+    return app;
 };
 const resolveLayoutExecutable = async (bundle, layout, fileSystem) => {
     const plistPath = join(bundle, ...layout.plist);
@@ -128,7 +133,8 @@ const resolveLayoutExecutable = async (bundle, layout, fileSystem) => {
     try {
         name =
             plist.subarray(0, 6).toString("ascii") === "bplist"
-                ? await (fileSystem.decodeBinaryPlist ?? readBinaryPlistExecutable)(plistPath)
+                ? await (fileSystem.decodeBinaryPlist?.(plistPath) ??
+                    parseBinaryPlistExecutable(plist))
                 : parseXmlPlistExecutable(decodeXmlPlistText(plist));
     }
     catch (cause) {
@@ -163,23 +169,22 @@ const resolveLayoutExecutable = async (bundle, layout, fileSystem) => {
 const parseXmlPlistExecutable = (plist) => {
     // An unrelated `__proto__` entry must not make the bundle unreadable.
     const { value } = parseXmlPropertyList(plist);
+    return executableName(value);
+};
+const executableName = (value) => {
     const executable = executableEntrySchema.safeParse(value);
     if (!executable.success)
         throw new Error("CFBundleExecutable is missing");
     return executable.data.CFBundleExecutable;
 };
 const executableEntrySchema = z.looseObject({ CFBundleExecutable: z.string() });
-const readBinaryPlistExecutable = async (plistPath) => 
-// `-n` strips only the newline plutil appends; it requires macOS 12+.
-(await execFileAsync("/usr/bin/plutil", [
-    "-extract",
-    "CFBundleExecutable",
-    "raw",
-    "-n",
-    "-o",
-    "-",
-    plistPath,
-])).stdout;
+/** Decode a binary plist in-process, so no host plist tool is required. */
+const parseBinaryPlistExecutable = (plist) => {
+    preflightPropertyListDecode(plist, BINARY_PLIST_DECODE_BYTES);
+    // `plist` assigns a `__proto__` key as the prototype; copying drops it, as
+    // the XML path does.
+    return executableName(omitPrototypeKeys(parseBinary(plist)).value);
+};
 const isSafeExecutableName = (name) => name.length > 0 &&
     name !== "." &&
     name !== ".." &&

package/dist/application/BinaryTargetResolver.js

@@ -6,6 +6,7 @@ import { BinaryTargetError } from "../domain/configurationErrors.js";
 import { openRegularFile, sameRegularFileState, } from "../filesystem/RegularFile.js";
 import { AnalysisCancelledError } from "../domain/analysisErrorCore.js";
 import { err, ok } from "../domain/result.js";
+import { readMipsElfAbiFlags } from "./MipsElfAbiFlags.js";
 import { resolveAppBundleExecutable, } from "./AppBundleExecutable.js";
 import { validateDosComLength, } from "../domain/dosCom.js";
 import { mzWindowsHeaderOffset } from "../domain/dosMz.js";
@@ -178,12 +179,14 @@ const sha256Handle = async (handle, path, initial, signal) => {
     let position = 0;
     while (true) {
         throwIfTargetResolutionCancelled(signal);
-        const observed = await handle.read(chunk, 0, chunk.length, position);
+        const observed = await handle.read(chunk, 0, Math.min(chunk.length, initial.size - position + 1), position);
         throwIfTargetResolutionCancelled(signal);
         if (observed.bytesRead === 0)
             break;
         hash.update(chunk.subarray(0, observed.bytesRead));
         position += observed.bytesRead;
+        if (position > initial.size)
+            throw new BinaryTargetError(path, "target grew while being read");
     }
     throwIfTargetResolutionCancelled(signal);
     const [opened, currentPath] = await Promise.all([handle.stat(), lstat(path)]);
@@ -250,7 +253,24 @@ const readExecutableMetadata = async (handle, hostArchitecture, signal) => {
             }
         }
     }
-    return parseExecutableHeader(bytes, hostArchitecture, fileSize);
+    const parsed = parseExecutableHeader(bytes, hostArchitecture, fileSize);
+    if (!parsed.ok ||
+        parsed.value.architecture !== "mips" ||
+        parsed.value.mips.elfClass !== 32)
+        return parsed;
+    const abiFlags = await readMipsElfAbiFlags(handle, parsed.value.mips, () => throwIfTargetResolutionCancelled(signal));
+    if (!abiFlags.ok)
+        return abiFlags;
+    return ok({
+        ...parsed.value,
+        mips: {
+            ...parsed.value.mips,
+            abiFlags: abiFlags.value.abiFlags,
+            ...(abiFlags.value.limitations.length === 0
+                ? {}
+                : { limitations: abiFlags.value.limitations }),
+        },
+    });
 };
 const readPeMetadata = async (handle, offset, signal) => {
     throwIfTargetResolutionCancelled(signal);

package/dist/application/CapabilityInventory.js

@@ -203,7 +203,7 @@ const workflowAvailabilityFor = ({ name, kind, policy, }) => {
             ? { reason: "available", remediation: null }
             : {
                 reason: "provider_missing",
-                remediation: "On Linux x64, provide an absolute REA_WAKARU_COMMAND for Wakaru 1.13.0 and util-linux prlimit. No binary target is required.",
+                remediation: "On Linux x64, provide an absolute REA_WAKARU_COMMAND for Wakaru ^1.13.0 (verified with 1.14.0) and util-linux prlimit; see docs/javascript-recovery.md#install-wakaru. No binary target is required.",
             };
     if (name === "inspect_binary_layout")
         return policy.binaryLayoutEnabled === true
@@ -212,6 +212,8 @@ const workflowAvailabilityFor = ({ name, kind, policy, }) => {
                 reason: "provider_missing",
                 remediation: "On Linux x64, set absolute REA_PWNTOOLS_PYTHON to caller-supplied Python with pwntools 4.15.0. No active binary target is required.",
             };
+    if (name === "inspect_pe_resources")
+        return { reason: "available", remediation: null };
     if (name === "inspect_evm_interface")
         return policy.evmInterfaceEnabled === true
             ? { reason: "available", remediation: null }
@@ -247,6 +249,14 @@ const workflowAvailabilityFor = ({ name, kind, policy, }) => {
                 remediation: policy.androidAnalysisAvailability?.reason ??
                     "Set REA_JADX_MCP_JAR to a caller-supplied jadx-headless-mcp 0.7.1 JAR and provide a full JDK on Linux, macOS, or Windows x64 with its matching bundled native controls.",
             };
+    if (kind === "jeb-provider")
+        return policy.jebAnalysisAvailability?.status === "available"
+            ? { reason: "available", remediation: null }
+            : {
+                reason: "provider_missing",
+                remediation: policy.jebAnalysisAvailability?.reason ??
+                    "Start a JEB client serving MCP (GUI client, or headless via its programmatic launcher) and point REA_JEB_MCP_URL at it (default http://127.0.0.1:8425/mcp). REA does not install or launch JEB.",
+            };
     const browser = browserProviderAvailability(name, kind, policy);
     if (browser !== null)
         return browser;

package/dist/application/ClientConfigurationDocument.js

@@ -1,4 +1,5 @@
 import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
+import { parse as parseYaml, parseDocument as parseYamlDocument, stringify as stringifyYaml, } from "yaml";
 import { isDeepStrictEqual } from "node:util";
 import { applyEdits, findNodeAtLocation, modify, parse as parseJsonc, parseTree, printParseErrorCode, } from "jsonc-parser";
 import { z } from "zod";
@@ -20,6 +21,7 @@ export const clientConfigurationServersKey = (format) => {
     switch (format) {
         case "toml":
         case "grok":
+        case "hermes":
             return "mcp_servers";
         case "opencode":
             return "mcp";
@@ -37,6 +39,14 @@ const isEmptyClientConfigurationText = (text) => text.replace(/^\uFEFF/, "").tri
 const parseDocument = (text, format) => {
     if (format === "toml" || format === "grok")
         return objectSchema.parse(parseToml(text));
+    // Pi loads `mcp.json` with a strict `JSON.parse` and no BOM tolerance, so
+    // comments, trailing commas, a BOM, or an empty existing file must be
+    // rejected instead of registering into a document Pi cannot load.
+    if (format === "pi")
+        return objectSchema.parse(JSON.parse(text));
+    // Hermes stores MCP servers in `mcp_servers` inside a YAML document.
+    if (format === "hermes")
+        return objectSchema.parse(parseYaml(text));
     // An empty file, which some clients create before any server is added,
     // holds no settings to preserve.
     if (isEmptyClientConfigurationText(text))
@@ -1031,6 +1041,8 @@ export const serializeClientConfiguration = (document, format, originalText, edi
         return serializeCodexConfiguration(document, originalText);
     if (format === "grok")
         return serializeGrokConfiguration(document, originalText);
+    if (format === "hermes")
+        return serializeHermesConfiguration(document, originalText);
     // An empty original holds no comments or settings to preserve. Writing a
     // fresh document also keeps a lone BOM from shifting past the closing brace.
     if (originalText !== undefined &&
@@ -1055,6 +1067,28 @@ export const clientServerPath = (parsed, name) => [...parsed.serversPath, name];
 export const legacyClientServerPath = (parsed, name) => Object.hasOwn(parsed.legacyServers, name)
     ? [parsed.serversPath[0] ?? "mcp", name]
     : undefined;
+/**
+ * Keep an existing Hermes `config.yaml` intact aside from the REA server entry.
+ * Hermes config files carry user comments and unrelated settings, so the rea
+ * entry is upserted into the parsed YAML document (which retains formatting and
+ * comments) rather than re-serializing the whole object.
+ */
+const serializeHermesConfiguration = (document, originalText) => {
+    if (originalText === undefined ||
+        isEmptyClientConfigurationText(originalText))
+        return stringifyYaml(document);
+    const serversKey = clientConfigurationServersKey("hermes");
+    const servers = document[serversKey];
+    const entry = typeof servers === "object" && servers !== null
+        ? servers[PRODUCT_IDENTITY.mcpServerKey]
+        : undefined;
+    const yamlDocument = parseYamlDocument(originalText);
+    if (entry === undefined)
+        yamlDocument.deleteIn([serversKey, PRODUCT_IDENTITY.mcpServerKey]);
+    else
+        yamlDocument.setIn([serversKey, PRODUCT_IDENTITY.mcpServerKey], entry);
+    return yamlDocument.toString();
+};
 /** Build the stdio entry shape expected by one client's configuration dialect. */
 export const clientRegistrationEntry = (format, command, environment) => {
     const [executable = "rea", ...args] = command;
@@ -1079,6 +1113,7 @@ export const clientRegistrationEntry = (format, command, environment) => {
             };
         case "vscode":
         case "omp":
+        case "pi":
             return {
                 type: "stdio",
                 command: executable,
@@ -1101,6 +1136,15 @@ export const clientRegistrationEntry = (format, command, environment) => {
                 args,
                 ...(Object.keys(environment).length === 0 ? {} : { env: environment }),
             };
+        case "hermes":
+            // Hermes reads stdio servers from `mcp_servers.<name>` and connects them
+            // unless `enabled` is false, so the entry states it explicitly.
+            return {
+                command: executable,
+                args,
+                ...(Object.keys(environment).length === 0 ? {} : { env: environment }),
+                enabled: true,
+            };
         default:
             return {
                 command: executable,
@@ -1109,3 +1153,29 @@ export const clientRegistrationEntry = (format, command, environment) => {
             };
     }
 };
+/** Parse one Gemini policy at its source boundary before consolidating scopes. */
+export const parseGeminiMcpPolicy = (parsed) => z
+    .object({
+    allowed: z.array(z.string()).optional(),
+    excluded: z.array(z.string()).optional(),
+})
+    .passthrough()
+    .parse(parsed.document.mcp ?? {});
+/** Gemini consolidates excludes by union and allowlists by normalized intersection. */
+export const geminiServerPolicyBlock = (policies, serverKey) => {
+    if (policies.some(({ excluded }) => excluded?.includes(serverKey)))
+        return `Gemini mcp.excluded blocks ${serverKey}. Review the selected settings policies before rerunning setup.`;
+    const allowlists = policies.flatMap(({ allowed }) => allowed === undefined ? [] : [allowed]);
+    const allowed = allowlists.reduce((previous, current) => {
+        if (previous === undefined)
+            return current;
+        const normalized = new Set(current.map((name) => name.toLowerCase().trim()));
+        return previous.filter((name) => normalized.has(name.toLowerCase().trim()));
+    }, undefined);
+    // Gemini's manager applies the consolidated allowlist only when nonempty.
+    if (allowed !== undefined &&
+        allowed.length > 0 &&
+        !allowed.includes(serverKey))
+        return `Gemini mcp.allowed does not include ${serverKey}. Review the selected settings policies before rerunning setup.`;
+    return undefined;
+};

package/dist/application/ClientConfigurationFiles.js

@@ -0,0 +1,91 @@
+import { err, ok } from "../domain/result.js";
+import { RegularFileCleanupFailure, readRegularFileText, } from "./RegularFileRead.js";
+import { effectiveClientServer, parseClientConfiguration, } from "./ClientConfigurationDocument.js";
+import { clientRegistrationEnvironment } from "./ClientRegistrationEnvironment.js";
+/** Preserve named read failures and distinguish a missing source from an empty file. */
+export const readConfigurationText = async (path) => {
+    try {
+        return ok(await readRegularFileText(path));
+    }
+    catch (cause) {
+        if (cause instanceof Error && "code" in cause && cause.code === "ENOENT")
+            return ok(undefined);
+        return err({
+            kind: "unreadable",
+            path,
+            detail: `Configuration ${path} could not be read: ${cause instanceof Error ? cause.message : String(cause)}`,
+            ...(cause instanceof RegularFileCleanupFailure
+                ? { cleanupFailure: cause }
+                : {}),
+        });
+    }
+};
+/** Read and parse one configuration at its source boundary. */
+export const readConfigurationFile = async (path, format) => {
+    const source = await readConfigurationText(path);
+    if (!source.ok)
+        return source;
+    const content = source.value;
+    if (content === undefined)
+        return ok(undefined);
+    try {
+        return ok(parseClientConfiguration(content, format));
+    }
+    catch (cause) {
+        return err({
+            kind: "malformed",
+            path,
+            detail: `Configuration ${path} is malformed: ${cause instanceof Error ? cause.message : String(cause)}`,
+        });
+    }
+};
+/** Read every applicable user file; malformed lower-priority files also stop setup. */
+export const readClientConfigurationFiles = async (client) => {
+    const documents = [];
+    for (const path of client.configPaths ?? [client.configPath]) {
+        const document = await readConfigurationFile(path, client.format);
+        if (!document.ok)
+            return document;
+        if (document.value !== undefined) {
+            const environment = clientRegistrationEnvironment(document.value);
+            if (!environment.ok)
+                return err({
+                    kind: "malformed",
+                    path,
+                    detail: `Configuration ${path} has an invalid REA server environment: ${environment.error.settings.map(({ setting, constraint }) => `${setting}: ${constraint}`).join("; ")}. Repair it before rerunning setup.`,
+                });
+            documents.push(document.value);
+        }
+    }
+    return ok(documents);
+};
+/** OpenCode merges server objects in file order, replacing arrays and scalar values. */
+const mergeConfigurationValue = (previous, next) => {
+    if (!isObject(previous) || !isObject(next))
+        return next;
+    return Object.fromEntries([...new Set([...Object.keys(previous), ...Object.keys(next)])].map((key) => [
+        key,
+        Object.hasOwn(next, key)
+            ? mergeConfigurationValue(previous[key], next[key])
+            : previous[key],
+    ]));
+};
+const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/** Project a client's effective user registration without modifying its source files. */
+export const effectiveClientConfiguration = (documents) => {
+    const last = documents.at(-1);
+    if (last === undefined)
+        return undefined;
+    if (documents.length === 1)
+        return last;
+    const servers = {};
+    for (const document of documents) {
+        const names = new Set([
+            ...Object.keys(document.legacyServers),
+            ...Object.keys(document.servers),
+        ]);
+        for (const name of names)
+            servers[name] = mergeConfigurationValue(servers[name], effectiveClientServer(document, name));
+    }
+    return { ...last, servers, legacyServers: {} };
+};

package/dist/application/ClientRegistrationEnvironment.js

@@ -0,0 +1,35 @@
+import { z } from "zod";
+import { parseEnvironment } from "../config/environment.js";
+import { ConfigurationError } from "../domain/configurationErrors.js";
+import { err, ok } from "../domain/result.js";
+import { effectiveClientServer, } from "./ClientConfigurationDocument.js";
+import { PRODUCT_IDENTITY } from "../identity.js";
+/** Read explicit REA overrides without dropping peers when one value is invalid. */
+export const clientRegistrationEnvironment = (parsed, overrides = {}) => {
+    const key = parsed?.dialect === "opencode" || parsed?.dialect === "opencode_v2"
+        ? "environment"
+        : "env";
+    const registration = parsed === undefined
+        ? undefined
+        : effectiveClientServer(parsed, PRODUCT_IDENTITY.mcpServerKey);
+    const raw = typeof registration === "object" && registration !== null
+        ? Reflect.get(registration, key)
+        : undefined;
+    const existing = z
+        .record(z.string(), z.string())
+        .safeParse(raw === undefined ? {} : raw);
+    if (!existing.success)
+        return err(new ConfigurationError("Invalid REA server environment", {
+            settings: existing.error.issues.map((issue) => ({
+                setting: [key, ...issue.path].join("."),
+                constraint: "Server environment must be an object containing only string values",
+            })),
+        }));
+    // Validate known settings with the runtime's parser, but retain the original
+    // string overrides, including unknown client-specific keys and no defaults.
+    const environment = { ...existing.data, ...overrides };
+    const validated = parseEnvironment(environment);
+    if (!validated.ok)
+        return validated;
+    return ok(Object.fromEntries(Object.entries(environment).sort(([left], [right]) => left.localeCompare(right))));
+};

package/dist/application/ClientRegistrationStatus.js

@@ -1,11 +1,13 @@
-import { clientServerForcedEnabled, clientServerListedDisabled, effectiveClientServer, parseClientConfiguration, } from "./ClientConfigurationDocument.js";
-import { access, readFile } from "node:fs/promises";
+import { readClientPolicyBlock } from "./GeminiClientSettings.js";
+import { effectiveClientConfiguration, readClientConfigurationFiles, } from "./ClientConfigurationFiles.js";
+import { clientServerForcedEnabled, clientServerListedDisabled, effectiveClientServer, } from "./ClientConfigurationDocument.js";
+import { access } from "node:fs/promises";
 import { resolve } from "node:path";
 import { z } from "zod";
 import { PRODUCT_IDENTITY } from "../identity.js";
 import { MCP_STARTUP_POLICY } from "../mcpStartupPolicy.js";
 import { isOwnedClientRegistrationCommand, npxRegistrationCommand, } from "./ClientRegistrationIdentity.js";
-import { manualRegistrationRemediation, supportedClients, } from "./SupportedClients.js";
+import { clientEvidencePaths, manualRegistrationRemediation, supportedClients, } from "./SupportedClients.js";
 const registrationSchema = z
     .object({
     command: z.string().min(1),
@@ -21,24 +23,18 @@ const registrationSchema = z
 /** Inspect supported client registrations without reading their environment. */
 export const readClientRegistrationStatuses = async (home, currentCommandPath = resolve(process.argv[1] ?? "unknown"), options = {}) => {
     const statuses = [];
-    for (const client of supportedClients(home, options.platform, options.environment === undefined
-        ? undefined
-        : {
-            APPDATA: options.environment.APPDATA,
-            CLAUDE_CONFIG_DIR: options.environment.CLAUDE_CONFIG_DIR,
-            CODEX_HOME: options.environment.CODEX_HOME,
-            COPILOT_HOME: options.environment.COPILOT_HOME,
-            GROK_HOME: options.environment.GROK_HOME,
-            OMP_PROFILE: options.environment.OMP_PROFILE,
-            OPENCODE_CONFIG: options.environment.OPENCODE_CONFIG,
-            PI_CODING_AGENT_DIR: options.environment.PI_CODING_AGENT_DIR,
-            PI_CONFIG_DIR: options.environment.PI_CONFIG_DIR,
-            PI_PROFILE: options.environment.PI_PROFILE,
-            SAND_DATA_ROOT: options.environment.SAND_DATA_ROOT,
-            XDG_CONFIG_HOME: options.environment.XDG_CONFIG_HOME,
-        })) {
-        if (!(await exists(client.markerPath)) &&
-            !(await exists(client.configPath)))
+    for (const client of supportedClients(home, options.platform, options.environment)) {
+        if (client.configPathError !== undefined) {
+            statuses.push({
+                client: client.name,
+                config_path: client.configPath,
+                command: [],
+                state: "invalid",
+                remediation: client.configPathError,
+            });
+            continue;
+        }
+        if (!(await clientEvidencePresent(client)))
             continue;
         const manualRemediation = manualRegistrationRemediation(client.name);
         if (client.format === "unsupported") {
@@ -53,8 +49,34 @@ export const readClientRegistrationStatuses = async (home, currentCommandPath =
             continue;
         }
         try {
-            const content = await readFile(client.configPath, "utf8");
-            const parsed = parseClientConfiguration(content, client.format);
+            const files = await readClientConfigurationFiles(client);
+            if (!files.ok) {
+                statuses.push({
+                    client: client.name,
+                    config_path: client.configPath,
+                    command: [],
+                    state: "invalid",
+                    remediation: files.error.detail,
+                });
+                continue;
+            }
+            const parsed = effectiveClientConfiguration(files.value);
+            if (parsed === undefined) {
+                statuses.push(unavailableStatus(client.name, client.configPath, "missing"));
+                continue;
+            }
+            const policy = await readClientPolicyBlock(client, parsed);
+            if (!policy.ok) {
+                statuses.push({
+                    client: client.name,
+                    config_path: client.configPath,
+                    command: [],
+                    state: "invalid",
+                    remediation: policy.error.detail,
+                });
+                continue;
+            }
+            const policyBlock = policy.value;
             const raw = effectiveClientServer(parsed, PRODUCT_IDENTITY.mcpServerKey);
             if (raw === undefined) {
                 statuses.push(unavailableStatus(client.name, client.configPath, "missing"));
@@ -66,9 +88,10 @@ export const readClientRegistrationStatuses = async (home, currentCommandPath =
                 ...registration.args,
             ];
             statuses.push(configuredStatus(client.name, client.configPath, command, registrationAligned(registration, client, currentCommandPath, options.platform ?? process.platform, clientServerForcedEnabled(parsed, PRODUCT_IDENTITY.mcpServerKey)) &&
-                !clientServerListedDisabled(parsed, PRODUCT_IDENTITY.mcpServerKey)
+                !clientServerListedDisabled(parsed, PRODUCT_IDENTITY.mcpServerKey) &&
+                policyBlock === undefined
                 ? "aligned"
-                : "stale"));
+                : "stale", policyBlock));
         }
         catch (cause) {
             statuses.push(unavailableStatus(client.name, client.configPath, isMissing(cause) ? "missing" : "invalid"));
@@ -78,7 +101,7 @@ export const readClientRegistrationStatuses = async (home, currentCommandPath =
 };
 const registrationAligned = (registration, client, currentCommandPath, platform, forcedEnabled = false) => {
     const command = [registration.command, ...registration.args];
-    if (registration.disabled === true ||
+    if ((client.format !== "grok" && registration.disabled === true) ||
         (registration.enabled === false && !forcedEnabled))
         return false;
     if (!isOwnedClientRegistrationCommand(command, currentCommandPath))
@@ -89,8 +112,8 @@ const registrationAligned = (registration, client, currentCommandPath, platform,
         return false;
     if (client.format === "vscode" && registration.type !== "stdio")
         return false;
-    // OMP infers stdio for a command entry without an explicit type.
-    if (client.format === "omp" &&
+    // OMP and Pi infer stdio for a command entry without an explicit type.
+    if ((client.format === "omp" || client.format === "pi") &&
         registration.type !== undefined &&
         registration.type !== "stdio")
         return false;
@@ -136,16 +159,22 @@ const parseRegistration = (value, client) => {
         throw new TypeError("Expected an stdio registration");
     if (client.format === "commandcode" && registration.transport !== "stdio")
         throw new TypeError("Expected an stdio registration");
-    if (client.format === "omp" &&
+    if ((client.format === "omp" || client.format === "pi") &&
         registration.type !== undefined &&
         registration.type !== "stdio")
         throw new TypeError("Expected an stdio registration");
     return registration;
 };
 const remediation = "Run rea setup to refresh this registration, then restart the client.";
-const configuredStatus = (client, configPath, command, state) => state === "aligned"
+const configuredStatus = (client, configPath, command, state, policyRemediation) => state === "aligned"
     ? { client, config_path: configPath, command, state, remediation: null }
-    : { client, config_path: configPath, command, state, remediation };
+    : {
+        client,
+        config_path: configPath,
+        command,
+        state,
+        remediation: policyRemediation ?? remediation,
+    };
 const unavailableStatus = (client, configPath, state) => ({
     client,
     config_path: configPath,
@@ -153,6 +182,12 @@ const unavailableStatus = (client, configPath, state) => ({
     state,
     remediation,
 });
+const clientEvidencePresent = async (client) => {
+    for (const path of clientEvidencePaths(client))
+        if (await exists(path))
+            return true;
+    return false;
+};
 const exists = async (path) => {
     if (path === undefined)
         return false;

package/dist/application/DirectAnalysis.js

@@ -43,7 +43,7 @@ export const runProviderAnalysis = async (dependencies, ...[path, tool, argument
     }));
 /** Execute managed metadata inspection in an isolated managed-only session. */
 export const runManagedProviderExecution = async (dependencies, path, tool, signal) => withProcessCancellation(signal, async (operationSignal) => {
-    const session = dependencies.createManagedBinarySession();
+    const session = await dependencies.createManagedBinarySession();
     return withSessionCleanup(session, async () => {
         const opened = await session.open(path, { signal: operationSignal });
         if (!opened.ok)
@@ -70,7 +70,7 @@ const runAnalysis = async (dependencies, path, tool, arguments_, options) => {
     const config = dependencies.readConfiguration();
     if (!config.ok)
         return cliError(config.error);
-    const session = dependencies.createBinarySession(config.value, logger);
+    const session = await dependencies.createBinarySession(config.value, logger);
     return withSessionCleanup(session, async () => {
         const prepared = await prepareSnapshot({
             path,

package/dist/application/DirectAnalysisCleanup.js

@@ -3,7 +3,7 @@ import { projectAnalysisError } from "../domain/analysisErrorProjection.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";
 import { ProviderAdapterError } from "../domain/providerAdapterError.js";
 import { err } from "../domain/result.js";
-import { analysisErrorWithCleanupFailure } from "./binary/AnalysisClientCleanup.js";
+import { analysisErrorWithCleanupFailure } from "../domain/analysisErrorCleanup.js";
 /** Await one-shot cleanup and retain either the outcome or both failures. */
 export const withSessionCleanup = async (session, operation, onCleanupFailure) => {
     let value;

package/dist/application/DirectAnalysisStatus.js

@@ -7,7 +7,7 @@ export const runSessionStatus = async (dependencies, logger = silentLogger) => {
     const config = dependencies.readConfiguration();
     if (!config.ok)
         return { error: projectAnalysisError(config.error) };
-    const session = dependencies.createBinarySession(config.value, logger);
+    const session = await dependencies.createBinarySession(config.value, logger);
     try {
         return {
             ...jsonObjectSchema.parse(session.status()),

package/dist/application/Doctor.js

@@ -1,5 +1,5 @@
 import { constants } from "node:fs";
-import { access, readdir } from "node:fs/promises";
+import { access, readdir, stat } from "node:fs/promises";
 import { homeDirectoryFromEnvironment } from "../config/homeDirectory.js";
 import { join } from "node:path";
 import { analysisErrorRemediationAction } from "../domain/analysisErrorPresentation.js";
@@ -8,7 +8,7 @@ import { parseBinaryTarget } from "./BinaryTargetResolver.js";
 import { execFileOutput } from "../process/ExecFileOutput.js";
 import { installedCaskAppdir, probeHomebrew } from "./homebrew.js";
 import { linuxHopperBinarySupported, linuxSharedLibrariesAvailable, readLinuxDistribution, } from "./LinuxHopper.js";
-import { claudeCodeSkillsDirectory, readInstalledSkillIdentity, } from "./SetupSkill.js";
+import { readInstalledSkillIdentity, } from "./SetupSkill.js";
 import { CATALOG_IDENTITY } from "../catalogIdentity.js";
 import { PRODUCT_IDENTITY, SDK_IDENTITY } from "../identity.js";
 import { readClientRegistrationStatuses, } from "./ClientRegistrationStatus.js";
@@ -228,7 +228,7 @@ export const systemDoctorHost = (options = {}) => {
                 return [];
             }
         },
-        installedSkillIdentity: (clientIds) => readInstalledSkillIdentity(homeDirectory, clientIds, claudeCodeSkillsDirectory(homeDirectory, environment)),
+        installedSkillIdentity: (clientIds) => readInstalledSkillIdentity(homeDirectory, clientIds, environment, platform),
         clientRegistrations: () => readClientRegistrationStatuses(homeDirectory, undefined, {
             platform,
             environment,
@@ -248,6 +248,8 @@ const readMacosVersion = async (run, options) => {
 const executableAvailable = async (path, platform, run, options) => {
     try {
         await access(path, constants.X_OK);
+        if (!(await stat(path)).isFile())
+            return false;
         if (platform !== "linux")
             return true;
         const linked = await run("ldd", [path], options);