chainlesschain 0.163.7 → 0.164.0

package/src/commands/automation.js

@@ -12,6 +12,14 @@ import {
   buildAutomationCenterProjection,
   runAutomationCenterAction,
 } from "../lib/automation-center.js";
+import {
+  automationCenterIncidentActionErrorEnvelope,
+  runAutomationCenterIncidentAction,
+} from "../lib/automation-center-incidents.js";
+import {
+  automationCenterRuntimeActionErrorEnvelope,
+  runAutomationCenterRuntimeAction,
+} from "../lib/automation-center-runtime.js";
 import {
   createAutomationCenterRoutine,
   editAutomationCenterRoutine,
@@ -22,6 +30,7 @@ import { parseJsonOption } from "../lib/parse-json-option.js";
 import { AutomationSchedulerBridge } from "../lib/scheduler-kernel/automation-adapter.js";
 import { AutomationEventDispatcher } from "../lib/scheduler-kernel/automation-event-adapter.js";
 import { openSchedulerStore } from "../lib/scheduler-kernel/store.js";
+import { resolveAutomationCenterRuntimeControl } from "../lib/scheduler-kernel/runtime-control-capabilities.js";
 import {
   RoutineSchedulerBridge,
   routineBridgeRunId,
@@ -288,7 +297,8 @@ export function registerAutomationCommand(program) {
         if (
           actionCommand &&
           (actionCommand.name().endsWith("-v2") ||
-            actionCommand.name().startsWith("center-routine-"))
+            actionCommand.name().startsWith("center-routine-") ||
+            actionCommand.name() === "center-runtime-action")
         )
           return;
         const db = await _prepare(thisCommand);
@@ -446,9 +456,13 @@ function _wire(root) {
     .option("--json", "Output as JSON")
     .action(async (opts, cmd) => {
       const db = _dbFromCtx(cmd);
+      let schedulerStore;
       try {
+        schedulerStore = openSchedulerStore();
         const projection = buildAutomationCenterProjection(db, {
           limit: Number(opts.limit),
+          schedulerStore,
+          runtimeCapabilityForKind: resolveAutomationCenterRuntimeControl,
         });
         if (opts.json) console.log(JSON.stringify(projection, null, 2));
         else {
@@ -465,6 +479,94 @@ function _wire(root) {
         logger.error(e.message);
         process.exitCode = 1;
       } finally {
+        schedulerStore?.close();
+        await shutdown();
+      }
+    });
+
+  root
+    .command("center-runtime-action <occurrenceId> <pause|resume>")
+    .description("Pause or resume one exact fenced scheduler occurrence")
+    .requiredOption(
+      "--expected-fence <fence>",
+      "Exact scheduler fence shown by center-projection",
+    )
+    .requiredOption(
+      "--expected-control-revision <revision>",
+      "Exact runtime-control revision shown by center-projection",
+    )
+    .option("--json", "Output as JSON")
+    .action(async (occurrenceId, action, opts) => {
+      let schedulerStore;
+      try {
+        schedulerStore = openSchedulerStore();
+        const result = runAutomationCenterRuntimeAction(schedulerStore, {
+          capabilityForKind: resolveAutomationCenterRuntimeControl,
+          occurrenceId,
+          action,
+          expectedFence: Number(opts.expectedFence),
+          expectedControlRevision: Number(opts.expectedControlRevision),
+        });
+        if (opts.json) console.log(JSON.stringify(result, null, 2));
+        else logger.success(`${occurrenceId} ${action} completed`);
+      } catch (error) {
+        if (opts.json) {
+          console.log(
+            JSON.stringify(
+              automationCenterRuntimeActionErrorEnvelope(error, {
+                occurrenceId,
+                action,
+              }),
+              null,
+              2,
+            ),
+          );
+        } else logger.error(error.message);
+        process.exitCode = 1;
+      } finally {
+        schedulerStore?.close();
+        await shutdown();
+      }
+    });
+
+  root
+    .command("center-incident-action <incidentId> <retry|cancel>")
+    .description("Retry or cancel a revision-gated Automation Center incident")
+    .requiredOption(
+      "--expected-revision <revision>",
+      "Exact incident revision shown by center-projection",
+    )
+    .option("--json", "Output as JSON")
+    .action(async (incidentId, action, opts, cmd) => {
+      const db = _dbFromCtx(cmd);
+      let schedulerStore;
+      try {
+        // Cancellation is incident-local. Retry alone needs the scheduler's
+        // dead-letter evidence and owns this short-lived handle.
+        if (action === "retry") schedulerStore = openSchedulerStore();
+        const result = runAutomationCenterIncidentAction(db, schedulerStore, {
+          incidentId,
+          action,
+          expectedRevision: opts.expectedRevision,
+        });
+        if (opts.json) console.log(JSON.stringify(result, null, 2));
+        else logger.success(`${incidentId} ${action} completed`);
+      } catch (error) {
+        if (opts.json) {
+          console.log(
+            JSON.stringify(
+              automationCenterIncidentActionErrorEnvelope(error, {
+                incidentId,
+                action,
+              }),
+              null,
+              2,
+            ),
+          );
+        } else logger.error(error.message);
+        process.exitCode = 1;
+      } finally {
+        schedulerStore?.close();
         await shutdown();
       }
     });

package/src/commands/cowork.js

@@ -9,6 +9,14 @@ import fs from "fs";
 import path from "path";
 import { logger } from "../lib/logger.js";
 
+async function loadCoworkWorkflowRecord(cwd, id, definitionDigest) {
+  const { getWorkflowRecord, getWorkflowVersion } =
+    await import("../lib/cowork-workflow.js");
+  return definitionDigest
+    ? getWorkflowVersion(cwd, id, definitionDigest)
+    : getWorkflowRecord(cwd, id);
+}
+
 export function registerCoworkCommand(program) {
   const cowork = program
     .command("cowork")
@@ -799,6 +807,145 @@ export function registerCoworkCommand(program) {
       console.log(JSON.stringify(wf, null, 2));
     });
 
+  workflow
+    .command("versions <id>")
+    .description("List immutable saved definition versions")
+    .option("--json", "Machine-readable JSON output")
+    .action(async (id, options) => {
+      try {
+        const { listWorkflowVersions } =
+          await import("../lib/cowork-workflow.js");
+        const versions = listWorkflowVersions(process.cwd(), id);
+        if (options.json) {
+          console.log(JSON.stringify(versions, null, 2));
+          return;
+        }
+        if (versions.length === 0) {
+          logger.log(chalk.gray(`No versioned definitions found for '${id}'.`));
+          return;
+        }
+        logger.log(chalk.bold(`${versions.length} immutable version(s):`));
+        for (const version of versions) {
+          logger.log(`  ${version.definitionDigest}  ${version.name}`);
+        }
+      } catch (err) {
+        logger.error(err.message);
+        process.exitCode = 1;
+      }
+    });
+
+  workflow
+    .command("manifest <id>")
+    .description(
+      "Project a versioned, digest-bound workflow definition and DAG plan",
+    )
+    .option(
+      "--definition-digest <sha256>",
+      "Inspect an immutable saved definition version",
+    )
+    .option("--json", "Machine-readable JSON output")
+    .action(async (id, options) => {
+      try {
+        const [{ createDynamicWorkflowManifest }, record] = await Promise.all([
+          import("../lib/dynamic-workflow-facade.js"),
+          loadCoworkWorkflowRecord(process.cwd(), id, options.definitionDigest),
+        ]);
+        if (!record) {
+          logger.error(`Workflow not found: ${id}`);
+          process.exitCode = 1;
+          return;
+        }
+        const projected = createDynamicWorkflowManifest(record.definition);
+        const manifest = Object.freeze({
+          ...projected,
+          definitionAuthority: Object.freeze({
+            status: record.status,
+            recordSchema: record.recordSchema,
+            definitionSchema: record.definitionSchema,
+            definitionDigest: record.definitionDigest,
+          }),
+        });
+        if (options.json) {
+          console.log(JSON.stringify(manifest, null, 2));
+          return;
+        }
+        logger.log(chalk.bold(`${manifest.definition.name}`));
+        logger.log(`  schema:      ${manifest.schema}`);
+        logger.log(`  digest:      ${manifest.definitionDigest}`);
+        logger.log(`  authority:   ${record.status}`);
+        logger.log(`  adapter:     ${manifest.adapter}`);
+        logger.log(`  plan:        ${manifest.plan.mode}`);
+        logger.log(
+          `  task calls:  ${manifest.plan.worstCaseTaskCalls ?? "unknown"}`,
+        );
+        logger.log(
+          `  resumable:   ${manifest.runtimeClaims.durablePauseResume ? "yes" : "no"}`,
+        );
+      } catch (err) {
+        logger.error(err.message);
+        process.exitCode = 1;
+      }
+    });
+
+  workflow
+    .command("preflight <id>")
+    .description(
+      "Evaluate capability, permission, sandbox, scale, and cost gates",
+    )
+    .option(
+      "--definition-digest <sha256>",
+      "Preflight an immutable saved definition version",
+    )
+    .option("--max-parallel <n>", "Requested maximum parallel steps", "4")
+    .option("--json", "Machine-readable JSON output")
+    .action(async (id, options) => {
+      try {
+        const [
+          { buildDynamicWorkflowPreflight },
+          { captureAmbientExecutionLocation },
+          record,
+        ] = await Promise.all([
+          import("../lib/dynamic-workflow-facade.js"),
+          import("../lib/execution-location-runtime.js"),
+          loadCoworkWorkflowRecord(process.cwd(), id, options.definitionDigest),
+        ]);
+        if (!record) {
+          logger.error(`Workflow not found: ${id}`);
+          process.exitCode = 1;
+          return;
+        }
+        const preflight = buildDynamicWorkflowPreflight({
+          workflow: record.definition,
+          definitionAuthority: record,
+          executionLocation: captureAmbientExecutionLocation(),
+          maxParallel: options.maxParallel,
+        });
+        if (options.json) {
+          console.log(JSON.stringify(preflight, null, 2));
+        } else {
+          const color = preflight.allowed ? chalk.green : chalk.red;
+          logger.log(color(preflight.allowed ? "READY" : "BLOCKED"));
+          logger.log(`  definition:  ${preflight.definition.definitionDigest}`);
+          logger.log(
+            `  task calls: ${preflight.scale.worstCaseTaskCalls ?? "unknown"}`,
+          );
+          logger.log(
+            `  tokens/USD: ${preflight.cost.projectedTokens ?? "unknown"} / ${preflight.cost.projectedUsd ?? "unknown"}`,
+          );
+          for (const blocker of preflight.blockers) {
+            logger.log(chalk.red(`  blocker: ${blocker}`));
+          }
+          for (const warning of preflight.warnings) {
+            logger.log(chalk.yellow(`  warning: ${warning}`));
+          }
+        }
+        process.exitCode = preflight.allowed ? 0 : 2;
+      } catch (err) {
+        logger.error(err.message);
+        process.exitCode = 1;
+      }
+    });
+
   workflow
     .command("add <file>")
     .description("Add a workflow from a JSON definition file")
@@ -832,6 +979,10 @@ export function registerCoworkCommand(program) {
   workflow
     .command("run <id>")
     .description("Execute a saved workflow end-to-end")
+    .option(
+      "--definition-digest <sha256>",
+      "Replay an immutable saved definition version",
+    )
     .option("--continue-on-error", "Keep running after a step fails", false)
     .option("--max-parallel <n>", "Max parallel steps per batch", "4")
     .option(
@@ -840,28 +991,32 @@ export function registerCoworkCommand(program) {
       false,
     )
     .action(async (id, options) => {
-      const [
-        { getWorkflow, executeWorkflow, _deps: wfDeps },
-        { runCoworkTask },
-      ] = await Promise.all([
-        import("../lib/cowork-workflow.js"),
-        import("../lib/cowork-task-runner.js"),
-      ]);
-      const wf = getWorkflow(process.cwd(), id);
-      if (!wf) {
-        logger.error(`Workflow not found: ${id}`);
-        process.exit(1);
-      }
-      wfDeps.runTask = runCoworkTask;
-
-      logger.log(
-        chalk.bold(
-          `\nExecuting workflow '${wf.name}' (${wf.steps.length} steps)...`,
-        ),
-      );
+      const [{ executeWorkflow, _deps: wfDeps }, { runCoworkTask }] =
+        await Promise.all([
+          import("../lib/cowork-workflow.js"),
+          import("../lib/cowork-task-runner.js"),
+        ]);
       try {
+        const record = await loadCoworkWorkflowRecord(
+          process.cwd(),
+          id,
+          options.definitionDigest,
+        );
+        if (!record) {
+          logger.error(`Workflow not found: ${id}`);
+          process.exitCode = 1;
+          return;
+        }
+        const wf = record.definition;
+        wfDeps.runTask = runCoworkTask;
+        logger.log(
+          chalk.bold(
+            `\nExecuting workflow '${wf.name}' (${wf.steps.length} steps, ${record.definitionDigest})...`,
+          ),
+        );
         const result = await executeWorkflow({
           workflow: wf,
+          definitionDigest: record.definitionDigest,
           cwd: process.cwd(),
           maxParallel: parseInt(options.maxParallel, 10) || 4,
           continueOnError: !!options.continueOnError,

package/src/commands/permissions.js

@@ -3,15 +3,18 @@
  * permission ruleset (Claude-Code `permissions.{allow,ask,deny}` parity).
  *
  *   cc permissions list [--json]                merged ruleset + source file
+ *   cc permissions activity [--session <id>]    actual resources/effects/recovery
  *   cc permissions test <tool> <args...>        dry-run: which rule decides?
  *   cc permissions add <allow|ask|deny> <rule>  append a rule to a settings file
  *   cc permissions allow|ask|deny <rule>        convenience aliases for add
+ *   cc permissions scoped <decision> <rule>     add a workspace-bound TTL rule
+ *   cc permissions revoke <id> --revision <n>  CAS-revoke a scoped rule
  *       [--local | --user]                      (default target: project)
  *
- * The ruleset is loaded by settings-loader (user < project < local < env) and
- * evaluated by permission-rules (deny > ask > allow). This command only reads
- * and edits the files / runs the engine — it does not yet gate the agent tool
- * loop (that wiring is a separate, riskier step).
+ * The ruleset is loaded by the shared permission authority resolver and
+ * evaluated by permission-rules (deny > ask > allow). Scoped mutations are
+ * CLI-owned and live outside the repository; IDE clients call this surface
+ * instead of editing authority files directly.
  */
 
 import chalk from "chalk";
@@ -24,7 +27,37 @@ const KIND_COLOR = {
 };
 
 const RUNTIME_ADVISORY =
-  "settings rules are enforced by the Agent Core when loaded into the active runtime; managed host policy and ApprovalGate still apply.";
+  "permission rules are enforced by Agent Core; scoped rules are refreshed before every tool call, while managed host policy and ApprovalGate still apply.";
+
+const DURATION_UNITS = Object.freeze({
+  s: 1000,
+  m: 60 * 1000,
+  h: 60 * 60 * 1000,
+  d: 24 * 60 * 60 * 1000,
+});
+
+function parseDurationMs(value) {
+  const match = String(value || "")
+    .trim()
+    .toLowerCase()
+    .match(/^(\d+)(s|m|h|d)$/);
+  if (!match) {
+    throw new Error("duration must be an integer followed by s, m, h, or d");
+  }
+  const duration = Number(match[1]) * DURATION_UNITS[match[2]];
+  if (!Number.isSafeInteger(duration) || duration < 1000) {
+    throw new Error("duration must be at least 1s and within the safe range");
+  }
+  return duration;
+}
+
+function parseNonNegativeInteger(value, label) {
+  const number = Number(value);
+  if (!Number.isSafeInteger(number) || number < 0) {
+    throw new Error(`${label} must be a non-negative integer`);
+  }
+  return number;
+}
 
 function printRuntimeAdvisory() {
   logger.log(chalk.yellow(RUNTIME_ADVISORY));
@@ -49,7 +82,12 @@ function buildArgs(tool, positional, rulesMod) {
   return {};
 }
 
-async function persistPermissionRule(decision, rule, options, operation = "add") {
+async function persistPermissionRule(
+  decision,
+  rule,
+  options,
+  operation = "add",
+) {
   try {
     const kind = String(decision || "").toLowerCase();
     if (!["allow", "ask", "deny"].includes(kind)) {
@@ -110,11 +148,13 @@ export function registerPermissionsCommand(program) {
     .option("--settings <file>", "Also merge an explicit settings file")
     .action(async (options) => {
       try {
-        const { loadSettings } = await import("../lib/settings-loader.cjs");
-        const { rules, sources, files, managed, managedFile } = loadSettings({
-          cwd: process.cwd(),
-          settingsFile: options.settings,
-        });
+        const { loadPermissionAuthority } =
+          await import("../lib/permission-authority.js");
+        const { rules, sources, files, managed, managedFile, scoped } =
+          loadPermissionAuthority({
+            cwd: process.cwd(),
+            settingsFile: options.settings,
+          });
         if (options.json) {
           console.log(
             JSON.stringify(
@@ -124,8 +164,9 @@ export function registerPermissionsCommand(program) {
                 files,
                 managed,
                 managedFile,
+                scoped,
                 enforcement: {
-                  status: "advisory/not enforced",
+                  status: "enforced",
                   note: RUNTIME_ADVISORY,
                 },
               },
@@ -144,7 +185,7 @@ export function registerPermissionsCommand(program) {
                 "(or create .claude/settings.json with a permissions block)",
             ),
           );
-          return;
+          if (!scoped?.rules?.length) return;
         }
         for (const kind of ["deny", "ask", "allow"]) {
           if (rules[kind].length === 0) continue;
@@ -191,6 +232,17 @@ export function registerPermissionsCommand(program) {
             );
           }
         }
+        if (scoped?.rules?.length) {
+          logger.log(chalk.bold("\nworkspace-scoped rules"));
+          for (const record of scoped.rules) {
+            const status = record.effectiveStatus || record.status;
+            const color = status === "active" ? chalk.green : chalk.gray;
+            logger.log(
+              `  ${color(status.padEnd(28))} ${record.id} r${record.revision} ${record.decision} ${record.rule}`,
+            );
+          }
+          logger.log(chalk.dim(`  authority: ${scoped.file}`));
+        }
       } catch (err) {
         logger.error(chalk.red(`permissions list failed: ${err.message}`));
         process.exitCode = 1;
@@ -246,6 +298,82 @@ export function registerPermissionsCommand(program) {
       }
     });
 
+  // ── activity ──────────────────────────────────────────────────────────
+  cmd
+    .command("activity")
+    .description(
+      "Show actual resource, side-effect, permission, and recovery evidence",
+    )
+    .option("-s, --session <id>", "Persisted CLI session", "default")
+    .option("-n, --limit <n>", "Maximum side-effect records", "50")
+    .option("--json", "Output the versioned center projection as JSON")
+    .action(async (options) => {
+      try {
+        const sessionId = String(options.session || "default").trim();
+        const limit = Math.max(
+          1,
+          Math.min(100, parseNonNegativeInteger(options.limit, "limit")),
+        );
+        const { loadSideEffectLedger } =
+          await import("../lib/side-effect-ledger-store.js");
+        const { loadTurnBindingLog } =
+          await import("../lib/turn-binding-store.js");
+        const { loadMcpLedgerRecovery } =
+          await import("../lib/mcp-call-ledger-store.js");
+        const { sessionExists } =
+          await import("../harness/jsonl-session-store.js");
+        const { buildPermissionSideEffectCenter } =
+          await import("../lib/permission-side-effect-center.js");
+        const mcpRecords = sessionExists(sessionId)
+          ? loadMcpLedgerRecovery(sessionId).records
+          : [];
+        const projection = buildPermissionSideEffectCenter({
+          sessionId,
+          operations: loadSideEffectLedger(sessionId).list(),
+          mcpRecords,
+          turns: loadTurnBindingLog(sessionId).list(),
+          limit,
+        });
+        if (options.json) {
+          console.log(JSON.stringify(projection, null, 2));
+          return;
+        }
+        if (projection.entries.length === 0) {
+          logger.log(
+            chalk.gray(`No side-effect evidence for session ${sessionId}.`),
+          );
+          return;
+        }
+        logger.log(
+          chalk.bold(
+            `${projection.entries.length} actual side effect(s) · ${projection.summary.irreversible} irreversible · ${projection.summary.inspect} need inspection`,
+          ),
+        );
+        for (const entry of projection.entries) {
+          const coverage =
+            entry.recovery.coverage === "full"
+              ? chalk.green(entry.recovery.coverage)
+              : entry.recovery.coverage === "partial"
+                ? chalk.yellow(entry.recovery.coverage)
+                : chalk.red(entry.recovery.coverage);
+          logger.log(
+            `${chalk.cyan(entry.tool)} ${entry.kind} ${entry.state} · recovery ${coverage}/${entry.recovery.action}`,
+          );
+          for (const [kind, values] of Object.entries(entry.resources)) {
+            if (values.length) {
+              logger.log(chalk.gray(`  ${kind}: ${values.join(", ")}`));
+            }
+          }
+          for (const warning of entry.unresolvedResources) {
+            logger.log(chalk.yellow(`  unresolved: ${warning}`));
+          }
+        }
+      } catch (err) {
+        logger.error(chalk.red(`permissions activity failed: ${err.message}`));
+        process.exitCode = 1;
+      }
+    });
+
   // ── test (dry-run) ─────────────────────────────────────────────────────
   cmd
     .command("test <tool> [args...]")
@@ -256,13 +384,14 @@ export function registerPermissionsCommand(program) {
     .option("--settings <file>", "Also merge an explicit settings file")
     .action(async (tool, args, options) => {
       try {
-        const { loadSettings, ruleSource } =
-          await import("../lib/settings-loader.cjs");
+        const { ruleSource } = await import("../lib/settings-loader.cjs");
+        const { loadPermissionAuthority } =
+          await import("../lib/permission-authority.js");
         // .cjs default-export interop: module.exports surfaces as `.default`.
         const rulesMod = await import("../lib/permission-rules.cjs");
         const mod = rulesMod.default || rulesMod;
 
-        const { rules, sources } = loadSettings({
+        const { rules, sources } = loadPermissionAuthority({
           cwd: process.cwd(),
           settingsFile: options.settings,
         });
@@ -392,4 +521,99 @@ export function registerPermissionsCommand(program) {
         await persistPermissionRule(decision, rule, options, decision);
       });
   }
+
+  cmd
+    .command("scoped <decision> <rule>")
+    .description(
+      "Create a workspace-bound, expiring rule in the CLI security store",
+    )
+    .requiredOption(
+      "--expires-in <duration>",
+      "TTL such as 30s, 15m, 2h, or 1d",
+    )
+    .option("--reason <text>", "Human-readable reason for the grant")
+    .option(
+      "--expected-generation <n>",
+      "Create only if the store generation still matches",
+    )
+    .option("--json", "Output as JSON")
+    .action(async (decision, rule, options) => {
+      try {
+        const ttlMs = parseDurationMs(options.expiresIn);
+        const expectedGeneration =
+          options.expectedGeneration === undefined
+            ? null
+            : parseNonNegativeInteger(
+                options.expectedGeneration,
+                "expected generation",
+              );
+        const { ScopedPermissionStore } =
+          await import("../lib/scoped-permission-store.js");
+        const store = new ScopedPermissionStore({ cwd: process.cwd() });
+        const record = store.add({
+          decision,
+          rule,
+          expiresAt: Date.now() + ttlMs,
+          reason: options.reason || "",
+          expectedGeneration,
+        });
+        if (options.json) {
+          console.log(
+            JSON.stringify(
+              {
+                record,
+                authority: {
+                  file: store.filePath,
+                  workspace: store.workspace,
+                },
+              },
+              null,
+              2,
+            ),
+          );
+          return;
+        }
+        logger.log(
+          `${KIND_COLOR[record.decision].bold("✓ scoped " + record.decision)} ${record.rule}`,
+        );
+        logger.log(
+          chalk.gray(
+            `  ${record.id} r${record.revision}; expires ${new Date(record.expiresAt).toISOString()}`,
+          ),
+        );
+      } catch (err) {
+        logger.error(chalk.red(`permissions scoped failed: ${err.message}`));
+        process.exitCode = 1;
+      }
+    });
+
+  cmd
+    .command("revoke <id>")
+    .description("Revoke a workspace-scoped rule with revision CAS")
+    .requiredOption("--revision <n>", "Expected record revision")
+    .option("--json", "Output as JSON")
+    .action(async (id, options) => {
+      try {
+        const expectedRevision = parseNonNegativeInteger(
+          options.revision,
+          "revision",
+        );
+        const { ScopedPermissionStore } =
+          await import("../lib/scoped-permission-store.js");
+        const store = new ScopedPermissionStore({ cwd: process.cwd() });
+        const record = store.revoke({ id, expectedRevision });
+        if (options.json) {
+          console.log(JSON.stringify({ record }, null, 2));
+          return;
+        }
+        logger.log(
+          chalk.green(
+            `Revoked ${record.id} at revision ${record.revision} (${record.rule})`,
+          ),
+        );
+      } catch (err) {
+        logger.error(chalk.red(`permissions revoke failed: ${err.message}`));
+        process.exitCode = 1;
+      }
+    });
 }