rea-agents 1.7.0 → 2.1.0

package/dist/cliElectronCommands.js

@@ -1,28 +1,74 @@
 import { Cli, z } from "incur";
 import { inspectElectronPage, listElectronTargets, } from "./application/ElectronObservationService.js";
+import { analyzeJavaScriptApplication } from "./application/JavaScriptApplicationService.js";
+import { reconcileJavaScriptRuntimeEvidence } from "./application/JavaScriptRuntimeReconciliationService.js";
 import { loadConfiguredPermissionAuthority } from "./application/PermissionConfiguration.js";
 import { CdpElectronProvider } from "./browser/CdpElectronProvider.js";
 import { logCliCommand } from "./cliLogging.js";
 import { parseConfig } from "./config.js";
 import { inspectElectronPageInputSchema, listElectronTargetsInputSchema, } from "./domain/electronObservation.js";
+import { analyzeJavaScriptApplicationInputSchema } from "./domain/javascriptApplicationAnalysis.js";
 import { AnalysisInputError, projectAnalysisError } from "./domain/errors.js";
 import { CLI_COMMANDS } from "./cliCommandNames.js";
+import { parseCliJsonInput } from "./cliJsonInput.js";
+import { electronPageInspectionOptions, javascriptApplicationOptions, } from "./cliObservationOptions.js";
 const scopeOptions = {
     allowedFileRoots: z
         .array(z.string().min(1))
         .optional()
         .describe("Filesystem roots; defaults to REA_ELECTRON_FILE_ROOTS_JSON"),
-    approved: z.boolean().default(false),
+    approved: z.boolean().default(false).describe("Approve passive observation"),
 };
 /** Register CLI equivalents of the Electron MCP tools. */
 export const registerElectronCommands = (cli, logger) => {
+    registerElectronObservationCommands(cli, logger);
+    registerJavaScriptApplicationCommand(cli, logger);
+    registerJavaScriptRuntimeReconciliationCommand(cli, logger);
+};
+const registerJavaScriptRuntimeReconciliationCommand = (cli, logger) => {
+    cli.command(CLI_COMMANDS.reconcileJavaScriptRuntime, {
+        description: "Reconcile static application and passive runtime Evidence JSON",
+        args: z.object({
+            inputJson: z
+                .string()
+                .describe("Inline JSON or a JSON file path matching reconcile_javascript_runtime"),
+        }),
+        run: ({ args }) => logCliCommand(logger, CLI_COMMANDS.reconcileJavaScriptRuntime, async () => {
+            const input = await parseCliJsonInput(args.inputJson, "reconcile_javascript_runtime");
+            if (!input.ok)
+                return input.error;
+            const result = reconcileJavaScriptRuntimeEvidence(input.value);
+            return result.ok ? result.value : cliError(result.error);
+        }),
+    });
+};
+const registerElectronObservationCommands = (cli, logger) => {
+    registerElectronTargetList(cli, logger);
+    registerElectronPageInspection(cli, logger);
+};
+const registerElectronTargetList = (cli, logger) => {
     cli.command(CLI_COMMANDS.listElectronTargets, {
         description: "List root-confined file pages from Electron CDP",
-        args: z.object({ endpoint: z.string() }),
+        args: z.object({
+            endpoint: z
+                .string()
+                .describe("Configured loopback Electron CDP endpoint"),
+        }),
         options: z.object({
             ...scopeOptions,
-            offset: z.number().int().min(0).default(0),
-            limit: z.number().int().min(1).max(200).default(100),
+            offset: z
+                .number()
+                .int()
+                .min(0)
+                .default(0)
+                .describe("Zero-based Electron-target offset"),
+            limit: z
+                .number()
+                .int()
+                .min(1)
+                .max(200)
+                .default(100)
+                .describe("Maximum Electron targets to return"),
         }),
         run: ({ args, options }) => logCliCommand(logger, "list-electron-targets", async () => {
             const context = await electronContext();
@@ -41,31 +87,17 @@ export const registerElectronCommands = (cli, logger) => {
             return result.ok ? result.value : cliError(result.error);
         }),
     });
+};
+const registerElectronPageInspection = (cli, logger) => {
     cli.command(CLI_COMMANDS.inspectElectronPage, {
         description: "Passively inspect one root-confined Electron file page",
-        args: z.object({ endpoint: z.string(), targetId: z.string() }),
-        options: z.object({
-            ...scopeOptions,
-            observationMs: z.number().int().min(0).max(10_000).default(100),
-            includeScriptSources: z.boolean().default(false),
-            sourceCaptureApproved: z.boolean().default(false),
-            maxFrames: z.number().int().min(1).max(1_000).default(200),
-            maxDomNodes: z.number().int().min(1).max(10_000).default(2_000),
-            maxScripts: z.number().int().min(1).max(2_000).default(500),
-            maxResources: z.number().int().min(1).max(10_000).default(2_000),
-            maxScriptSourceBytes: z
-                .number()
-                .int()
-                .min(1)
-                .max(4 * 1_024 * 1_024)
-                .default(1_024 * 1_024),
-            maxTotalScriptSourceBytes: z
-                .number()
-                .int()
-                .min(1)
-                .max(16 * 1_024 * 1_024)
-                .default(4 * 1_024 * 1_024),
+        args: z.object({
+            endpoint: z
+                .string()
+                .describe("Configured loopback Electron CDP endpoint"),
+            targetId: z.string().describe("Target ID from list-electron-targets"),
         }),
+        options: electronPageInspectionOptions,
         run: ({ args, options }) => logCliCommand(logger, "inspect-electron-page", async () => {
             const context = await electronContext();
             if (!context.ok)
@@ -83,6 +115,7 @@ export const registerElectronCommands = (cli, logger) => {
                     max_dom_nodes: options.maxDomNodes,
                     max_scripts: options.maxScripts,
                     max_resources: options.maxResources,
+                    max_workers: options.maxWorkers,
                     max_script_source_bytes: options.maxScriptSourceBytes,
                     max_total_script_source_bytes: options.maxTotalScriptSourceBytes,
                 },
@@ -94,6 +127,46 @@ export const registerElectronCommands = (cli, logger) => {
         }),
     });
 };
+const registerJavaScriptApplicationCommand = (cli, logger) => {
+    cli.command(CLI_COMMANDS.analyzeJavaScriptApplication, {
+        description: "Statically reconstruct an approved JavaScript/Electron application",
+        args: z.object({
+            path: z.string().describe("Absolute ASAR or extracted application path"),
+        }),
+        options: javascriptApplicationOptions,
+        run: ({ args, options }) => logCliCommand(logger, CLI_COMMANDS.analyzeJavaScriptApplication, async () => {
+            const context = await electronContext();
+            if (!context.ok)
+                return context.error;
+            const parsed = analyzeJavaScriptApplicationInputSchema.safeParse({
+                input_path: args.path,
+                approved: options.approved,
+                format: options.format,
+                source_map_read_approved: options.sourceMapReadApproved,
+                limits: {
+                    max_entries: options.maxEntries,
+                    max_total_artifact_bytes: options.maxTotalArtifactBytes,
+                    max_artifact_entry_bytes: options.maxArtifactEntryBytes,
+                    max_compression_ratio: options.maxCompressionRatio,
+                    max_depth: options.maxDepth,
+                    max_path_bytes: options.maxPathBytes,
+                    max_text_files: options.maxTextFiles,
+                    max_total_text_bytes: options.maxTotalTextBytes,
+                    max_text_file_bytes: options.maxTextFileBytes,
+                    max_ast_nodes: options.maxAstNodes,
+                    max_findings: options.maxFindings,
+                    max_modules: options.maxModules,
+                    max_source_map_sources: options.maxSourceMapSources,
+                    max_parse_milliseconds: options.maxParseMilliseconds,
+                },
+            });
+            if (!parsed.success)
+                return inputError("analyze_javascript_application");
+            const result = await analyzeJavaScriptApplication(context.authority, parsed.data);
+            return result.ok ? result.value : cliError(result.error);
+        }),
+    });
+};
 const electronContext = async () => {
     const config = parseConfig(process.env);
     if (!config.ok)
@@ -110,6 +183,6 @@ const electronContext = async () => {
 };
 const inputError = (operation) => cliError(new AnalysisInputError(operation));
 const cliError = (error) => ({
-    error: "Electron observation failed",
+    error: "Electron analysis failed",
     ...projectAnalysisError(error),
 });

package/dist/cliEvidenceCommands.js

@@ -56,8 +56,19 @@ export const registerEvidenceCommands = (cli, logger) => {
             right: z.string().describe("Right Evidence bundle JSON path"),
         }),
         options: z.object({
-            offset: z.number().int().min(0).default(0),
-            limit: z.number().int().min(1).max(500).default(100),
+            offset: z
+                .number()
+                .int()
+                .min(0)
+                .default(0)
+                .describe("Zero-based changed-record offset"),
+            limit: z
+                .number()
+                .int()
+                .min(1)
+                .max(500)
+                .default(100)
+                .describe("Maximum changed records to return"),
         }),
         run: ({ args, options }) => logCliCommand(logger, "compare", async () => {
             const config = parseConfig(process.env);

package/dist/cliInvestigationCommands.js

@@ -11,31 +11,74 @@ const investigationOptionsSchema = z.object({
         .boolean()
         .default(false)
         .describe("Approve persistent workspace writes"),
-    workspaceName: z.string().trim().min(1).max(200).default("default"),
-    expectedRevision: z.number().int().min(1).optional(),
+    workspaceName: z
+        .string()
+        .trim()
+        .min(1)
+        .max(200)
+        .default("default")
+        .describe("Logical name recorded in the investigation workspace"),
+    expectedRevision: z
+        .number()
+        .int()
+        .min(1)
+        .optional()
+        .describe("Required current workspace revision for an atomic update"),
     replayRunId: z
         .string()
         .regex(/^run_[a-f0-9]{64}$/u)
         .optional()
         .describe("Replay one verified complete workspace run without rescanning"),
-    maxEntries: z.number().int().min(1).max(50_000).default(10_000),
+    maxEntries: z
+        .number()
+        .int()
+        .min(1)
+        .max(50_000)
+        .default(10_000)
+        .describe("Maximum artifact entries to inspect per version"),
     maxTotalBytes: z
         .number()
         .int()
         .min(1)
         .max(Number.MAX_SAFE_INTEGER)
-        .default(1_073_741_824),
+        .default(1_073_741_824)
+        .describe("Maximum total uncompressed artifact content to inspect"),
     maxEntryBytes: z
         .number()
         .int()
         .min(1)
         .max(Number.MAX_SAFE_INTEGER)
-        .default(268_435_456),
-    pageSize: z.number().int().min(1).max(500).default(500),
-    changeLimit: z.number().int().min(1).max(500).default(500),
-    integrityPolicy: z.enum(["fail", "record-and-continue"]).default("fail"),
-    integrityContinueApproved: z.boolean().default(false),
-    maxIntegrityMismatches: z.number().int().min(1).max(100).default(10),
+        .default(268_435_456)
+        .describe("Maximum uncompressed content to inspect for one entry"),
+    pageSize: z
+        .number()
+        .int()
+        .min(1)
+        .max(500)
+        .default(500)
+        .describe("Maximum graph items loaded per investigation page"),
+    changeLimit: z
+        .number()
+        .int()
+        .min(1)
+        .max(500)
+        .default(500)
+        .describe("Maximum version changes to record"),
+    integrityPolicy: z
+        .enum(["fail", "record-and-continue"])
+        .default("fail")
+        .describe("Behavior when declared artifact integrity does not match"),
+    integrityContinueApproved: z
+        .boolean()
+        .default(false)
+        .describe("Approve continuing after recorded integrity mismatches"),
+    maxIntegrityMismatches: z
+        .number()
+        .int()
+        .min(1)
+        .max(100)
+        .default(10)
+        .describe("Maximum integrity mismatches to record before stopping"),
 });
 /** Register the persistent cross-version CLI workflow. */
 export const registerInvestigationCommands = (cli, logger) => {

package/dist/cliJsonInput.js

@@ -0,0 +1,54 @@
+import { readFile, stat } from "node:fs/promises";
+import { AnalysisInputError, projectAnalysisError } from "./domain/errors.js";
+const MAX_JSON_INPUT_BYTES = 64 * 1_024 * 1_024;
+/** Parse bounded inline JSON or one bounded local JSON file for a CLI workflow. */
+export const parseCliJsonInput = async (value, operation) => {
+    const inline = parseJson(value);
+    if (inline !== undefined)
+        return { ok: true, value: inline };
+    if (["{", "["].includes(value.trimStart()[0] ?? ""))
+        return { ok: false, error: inputError(operation) };
+    try {
+        const metadata = await stat(value);
+        if (!metadata.isFile())
+            return jsonFileError(value, operation, "not-file");
+        if (metadata.size > MAX_JSON_INPUT_BYTES)
+            return jsonFileError(value, operation, "too-large");
+        const bytes = await readFile(value);
+        if (bytes.byteLength > MAX_JSON_INPUT_BYTES)
+            return jsonFileError(value, operation, "too-large");
+        const parsed = parseJson(bytes.toString("utf8"));
+        return parsed === undefined
+            ? jsonFileError(value, operation, "invalid-json")
+            : { ok: true, value: parsed };
+    }
+    catch {
+        return jsonFileError(value, operation, "read-failed");
+    }
+};
+const parseJson = (value) => {
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        return undefined;
+    }
+};
+const inputError = (operation) => ({
+    error: "Application workflow failed",
+    ...projectAnalysisError(new AnalysisInputError(operation, undefined, [
+        { path: [], reason: "invalid_format", expected: "JSON" },
+    ])),
+});
+const jsonFileError = (path, operation, reason) => ({
+    ok: false,
+    error: {
+        error: "Application workflow failed",
+        ...projectAnalysisError(new AnalysisInputError(operation, undefined, reason === "invalid-json"
+            ? [{ path: [], reason: "invalid_format", expected: "JSON" }]
+            : [])),
+        input_path: path,
+        input_reason: reason,
+        maximum_input_bytes: MAX_JSON_INPUT_BYTES,
+    },
+});

package/dist/cliObservationOptions.js

@@ -0,0 +1,137 @@
+import { z } from "incur";
+const boundedCount = (subject, maximum, fallback, minimum = 1) => z
+    .number()
+    .int()
+    .min(minimum)
+    .max(maximum)
+    .default(fallback)
+    .describe(`Maximum ${subject}`);
+const boundedBytes = (subject, maximum, fallback) => boundedCount(`${subject} in bytes`, maximum, fallback);
+const positiveCount = (subject, fallback) => z.number().int().min(1).default(fallback).describe(`Maximum ${subject}`);
+const browserScopeOptions = {
+    allowedOrigins: z
+        .array(z.string().min(1))
+        .optional()
+        .describe("Exact origins to observe; defaults to REA_BROWSER_ALLOWED_ORIGINS_JSON"),
+    approved: z.boolean().default(false).describe("Approve passive observation"),
+};
+export const browserPageInspectionOptions = z.object({
+    ...browserScopeOptions,
+    observationMs: boundedCount("observation duration in milliseconds", 10_000, 500, 0),
+    includeAccessibilityText: z
+        .boolean()
+        .default(false)
+        .describe("Include bounded accessibility text"),
+    includeConsoleText: z
+        .boolean()
+        .default(false)
+        .describe("Include bounded console message text"),
+    consoleTextApproved: z
+        .boolean()
+        .default(false)
+        .describe("Approve capturing console message text"),
+    includeJsonBodyShapes: z
+        .boolean()
+        .default(false)
+        .describe("Include structural shapes of JSON response bodies"),
+    jsonBodySchemaApproved: z
+        .boolean()
+        .default(false)
+        .describe("Approve inspecting JSON response bodies for structural shapes"),
+    includeWebsocketShapes: z
+        .boolean()
+        .default(false)
+        .describe("Include structural shapes of WebSocket payloads"),
+    websocketShapeApproved: z
+        .boolean()
+        .default(false)
+        .describe("Approve inspecting WebSocket payloads for structural shapes"),
+    includeScriptSources: z
+        .boolean()
+        .default(false)
+        .describe("Include bounded JavaScript source text"),
+    includeStorageKeys: z
+        .boolean()
+        .default(false)
+        .describe("Include storage key names without values"),
+    maxFrames: boundedCount("page frames", 1_000, 200),
+    maxDomNodes: boundedCount("DOM nodes", 10_000, 2_000),
+    maxAxNodes: boundedCount("accessibility nodes", 10_000, 2_000),
+    maxAxTextFieldBytes: boundedBytes("one accessibility text field", 16 * 1_024, 1_024),
+    maxTotalAxTextBytes: boundedBytes("total accessibility text", 1_024 * 1_024, 64 * 1_024),
+    maxScripts: boundedCount("scripts", 1_000, 200),
+    maxResources: boundedCount("resources", 10_000, 2_000),
+    maxWorkers: boundedCount("workers", 5_000, 500),
+    maxStorageKeys: boundedCount("storage keys", 10_000, 1_000),
+    maxScriptSourceBytes: boundedBytes("one script source", 4 * 1_024 * 1_024, 1_024 * 1_024),
+    maxTotalScriptSourceBytes: boundedBytes("total script source", 16 * 1_024 * 1_024, 4 * 1_024 * 1_024),
+    maxNetworkEvents: boundedCount("network events", 10_000, 1_000),
+    maxConsoleEvents: boundedCount("console events", 2_000, 200),
+    maxConsoleTextFieldBytes: boundedBytes("one console text field", 16 * 1_024, 1_024),
+    maxTotalConsoleTextBytes: boundedBytes("total console text", 1_024 * 1_024, 64 * 1_024),
+    maxJsonBodyBytes: boundedBytes("one JSON response body", 4 * 1_024 * 1_024, 1_024 * 1_024),
+    maxTotalJsonBodyBytes: boundedBytes("total JSON response bodies", 16 * 1_024 * 1_024, 4 * 1_024 * 1_024),
+    maxJsonShapeNodes: boundedCount("JSON shape nodes", 100_000, 5_000),
+    maxJsonShapeDepth: boundedCount("JSON shape depth", 100, 20),
+    maxWebsocketEvents: boundedCount("WebSocket events", 5_000, 500),
+    maxWebsocketShapeBytes: boundedBytes("one WebSocket shape", 1_024 * 1_024, 64 * 1_024),
+    maxTotalWebsocketShapeBytes: boundedBytes("total WebSocket shapes", 16 * 1_024 * 1_024, 1_024 * 1_024),
+});
+const electronScopeOptions = {
+    allowedFileRoots: z
+        .array(z.string().min(1))
+        .optional()
+        .describe("Filesystem roots; defaults to REA_ELECTRON_FILE_ROOTS_JSON"),
+    approved: z.boolean().default(false).describe("Approve passive observation"),
+};
+export const electronPageInspectionOptions = z.object({
+    ...electronScopeOptions,
+    observationMs: boundedCount("observation duration in milliseconds", 10_000, 100, 0),
+    includeScriptSources: z
+        .boolean()
+        .default(false)
+        .describe("Include bounded JavaScript source text"),
+    sourceCaptureApproved: z
+        .boolean()
+        .default(false)
+        .describe("Approve capturing bounded script source text"),
+    maxFrames: boundedCount("page frames", 1_000, 200),
+    maxDomNodes: boundedCount("DOM nodes", 10_000, 2_000),
+    maxScripts: boundedCount("scripts", 2_000, 500),
+    maxResources: boundedCount("resources", 10_000, 2_000),
+    maxWorkers: boundedCount("workers", 5_000, 500),
+    maxScriptSourceBytes: boundedBytes("one captured script source", 4 * 1_024 * 1_024, 1_024 * 1_024),
+    maxTotalScriptSourceBytes: boundedBytes("total captured script source", 16 * 1_024 * 1_024, 4 * 1_024 * 1_024),
+});
+export const javascriptApplicationOptions = z.object({
+    approved: z
+        .boolean()
+        .default(false)
+        .describe("Approve reading the application artifact"),
+    format: z
+        .enum(["auto", "asar", "directory"])
+        .default("auto")
+        .describe("Application artifact format"),
+    sourceMapReadApproved: z
+        .boolean()
+        .default(false)
+        .describe("Approve reading local source maps referenced by the application"),
+    maxEntries: positiveCount("artifact entries to inspect", 8_000),
+    maxTotalArtifactBytes: positiveCount("total uncompressed artifact content to inspect", 512 * 1_024 * 1_024),
+    maxArtifactEntryBytes: positiveCount("uncompressed content for one artifact entry", 128 * 1_024 * 1_024),
+    maxCompressionRatio: z
+        .number()
+        .min(1)
+        .default(1_000)
+        .describe("Maximum accepted compressed-to-uncompressed expansion ratio"),
+    maxDepth: positiveCount("artifact directory depth", 64),
+    maxPathBytes: positiveCount("encoded artifact path length", 4_096),
+    maxTextFiles: positiveCount("text files to parse", 5_000),
+    maxTotalTextBytes: positiveCount("total text content to parse", 128 * 1_024 * 1_024),
+    maxTextFileBytes: positiveCount("size of one parsed text file", 8 * 1_024 * 1_024),
+    maxAstNodes: positiveCount("JavaScript AST nodes to parse", 2_000_000),
+    maxFindings: positiveCount("static-analysis findings to return", 8_000),
+    maxModules: positiveCount("application modules to project", 20_000),
+    maxSourceMapSources: positiveCount("original sources from source maps", 5_000),
+    maxParseMilliseconds: positiveCount("JavaScript parsing time in milliseconds", 30_000),
+});

package/dist/cliPolicyCommands.js

@@ -36,17 +36,40 @@ export const registerPolicyCommands = (cli, logger) => {
     cli.command(CLI_COMMANDS.policy, {
         description: "Inspect, explain, or revoke unified local permission grants",
         args: z.object({
-            action: z.enum(["status", "list", "explain", "revoke"]),
-            value: z.string().optional(),
+            action: z
+                .enum(["status", "list", "explain", "revoke"])
+                .describe("Permission-policy operation to perform"),
+            value: z
+                .string()
+                .optional()
+                .describe("Capability to explain or grant ID to revoke"),
         }),
         options: z.object({
-            root: z.string().optional(),
-            executable: z.string().optional(),
-            environmentNames: z.array(z.string()).default([]),
-            origins: z.array(z.string()).default([]),
-            network: z.enum(["none", "loopback", "external"]).default("none"),
-            mount: z.boolean().default(false),
-            write: z.boolean().default(false),
+            root: z.string().optional().describe("Filesystem root to authorize"),
+            executable: z
+                .string()
+                .optional()
+                .describe("Executable path to authorize"),
+            environmentNames: z
+                .array(z.string())
+                .default([])
+                .describe("Environment variable names the operation may read"),
+            origins: z
+                .array(z.string())
+                .default([])
+                .describe("Exact browser origins the operation may access"),
+            network: z
+                .enum(["none", "loopback", "external"])
+                .default("none")
+                .describe("Maximum network scope to authorize"),
+            mount: z
+                .boolean()
+                .default(false)
+                .describe("Authorize mounting an artifact filesystem"),
+            write: z
+                .boolean()
+                .default(false)
+                .describe("Explain the write form of the requested capability"),
             yes: z
                 .boolean()
                 .default(false)
@@ -58,56 +81,67 @@ export const registerPolicyCommands = (cli, logger) => {
             if (!config.ok)
                 return failure(config.error);
             if (args.action === "status")
-                return {
-                    reload: "SIGHUP",
-                    restart_required: false,
-                    administrator_ceilings: config.value.permissionCeilings,
-                    project_store: config.value.permissionProjectStore ?? null,
-                };
+                return policyStatus(config.value);
             if (args.action === "list")
-                return readProjectGrants(config.value).then((result) => result.ok ? { grants: result.grants } : result.error);
-            if (args.action === "revoke") {
-                if (args.value === undefined)
-                    return { error: "Grant ID is required for policy revoke" };
-                const { permissionProjectRoot, permissionProjectStore } = config.value;
-                if (permissionProjectRoot === undefined ||
-                    permissionProjectStore === undefined)
-                    return { error: "Project policy is not configured" };
-                const approval = await approvePolicyRevocation({
+                return policyList(config.value);
+            if (args.action === "revoke")
+                return policyRevoke({
+                    config: config.value,
+                    grantId: args.value,
                     approved: options.yes,
                     interactive: !agent && !formatExplicit && process.stdin.isTTY === true,
-                    grantId: args.value,
                     confirm: confirmPolicyRevocation,
                 });
-                if (!approval.approved)
-                    return approval.reason === "required"
-                        ? {
-                            error: "Policy revoke requires confirmation. Rerun interactively or with --yes.",
-                            grant_id: args.value,
-                        }
-                        : {
-                            error: "Policy revocation was cancelled",
-                            grant_id: args.value,
-                        };
-                const revoked = await revokeProjectPermissionGrant(permissionProjectStore, permissionProjectRoot, args.value);
-                return revoked.ok && revoked.value
-                    ? {
-                        revoked: args.value,
-                        reload: "Send SIGHUP to the REA MCP process",
-                    }
-                    : revoked.ok
-                        ? { error: "Grant was not found", grant_id: args.value }
-                        : { error: revoked.error.message };
-            }
             const capability = capabilitySchema.safeParse(args.value);
             if (!capability.success)
                 return {
                     error: "A registered capability is required for policy explain",
                 };
-            return explain(config.value, capability.data, options);
+            return policyExplain(config.value, capability.data, options);
         }),
     });
 };
+const policyStatus = (config) => ({
+    reload: "SIGHUP",
+    restart_required: false,
+    administrator_ceilings: config.permissionCeilings,
+    project_store: config.permissionProjectStore ?? null,
+});
+const policyList = (config) => readProjectGrants(config).then((result) => result.ok ? { grants: result.grants } : result.error);
+const policyRevoke = async (context) => {
+    if (context.grantId === undefined)
+        return { error: "Grant ID is required for policy revoke" };
+    const { permissionProjectRoot, permissionProjectStore } = context.config;
+    if (permissionProjectRoot === undefined ||
+        permissionProjectStore === undefined)
+        return { error: "Project policy is not configured" };
+    const approval = await approvePolicyRevocation({
+        approved: context.approved,
+        interactive: context.interactive,
+        grantId: context.grantId,
+        confirm: context.confirm,
+    });
+    if (!approval.approved)
+        return approval.reason === "required"
+            ? {
+                error: "Policy revoke requires confirmation. Rerun interactively or with --yes.",
+                grant_id: context.grantId,
+            }
+            : {
+                error: "Policy revocation was cancelled",
+                grant_id: context.grantId,
+            };
+    const revoked = await revokeProjectPermissionGrant(permissionProjectStore, permissionProjectRoot, context.grantId);
+    return revoked.ok && revoked.value
+        ? {
+            revoked: context.grantId,
+            reload: "Send SIGHUP to the REA MCP process",
+        }
+        : revoked.ok
+            ? { error: "Grant was not found", grant_id: context.grantId }
+            : { error: revoked.error.message };
+};
+const policyExplain = async (config, capability, options) => explain(config, capability, options);
 const confirmPolicyRevocation = async (grantId) => {
     const prompt = createInterface({
         input: process.stdin,