rea-agents 3.1.0 → 3.2.1

package/dist/cliBrowserCommands.js

@@ -1,30 +1,13 @@
 import { Cli, z } from "incur";
+import { browserContext, browserCliError } from "./cliBrowserContext.js";
 import { analyzeWebBundle, inspectWebPage, listBrowserTargets, observeWebSession, } from "./application/BrowserObservationService.js";
-import { loadConfiguredPermissionAuthority } from "./application/PermissionConfiguration.js";
-import { CdpBrowserProvider } from "./browser/CdpBrowserProvider.js";
 import { logCliCommand } from "./cliLogging.js";
-import { parseConfig } from "./config.js";
 import { inspectWebPageInputSchema, listBrowserTargetsInputSchema, } from "./domain/browserObservation.js";
 import { analyzeWebBundleInputSchema } from "./domain/webBundleAnalysis.js";
 import { observeWebSessionInputSchema } from "./domain/browserSession.js";
-import { AnalysisCapabilityUnavailableError, AnalysisInputError, projectAnalysisError, } from "./domain/errors.js";
+import { AnalysisInputError } from "./domain/errors.js";
 import { CLI_COMMANDS } from "./cliCommandNames.js";
-import { browserPageInspectionOptions } from "./cliObservationOptions.js";
-const browserScopeOptions = {
-    allowedOrigins: z
-        .array(z.string().min(1))
-        .optional()
-        .describe("Exact origins to observe; defaults to REA_BROWSER_ALLOWED_ORIGINS_JSON"),
-    approved: z.boolean().default(false).describe("Approve passive observation"),
-};
-const boundedCount = (subject, maximum, fallback, minimum = 1) => z
-    .number()
-    .int()
-    .min(minimum)
-    .max(maximum)
-    .default(fallback)
-    .describe(`Maximum ${subject}`);
-const boundedBytes = (subject, maximum, fallback) => boundedCount(`${subject} in bytes`, maximum, fallback);
+import { browserPageInspectionOptions, browserScopeOptions, observationDuration, } from "./cliObservationOptions.js";
 /** Register CLI equivalents of the passive browser MCP tools. */
 export const registerBrowserCommands = (cli, logger) => {
     registerTargetList(cli, logger);
@@ -38,16 +21,7 @@ const registerTargetList = (cli, logger) => {
         args: z.object({
             endpoint: z.string().describe("Configured loopback CDP HTTP endpoint"),
         }),
-        options: z.object({
-            ...browserScopeOptions,
-            offset: z
-                .number()
-                .int()
-                .min(0)
-                .default(0)
-                .describe("Zero-based browser-target offset"),
-            limit: boundedCount("browser targets to return", 200, 100),
-        }),
+        options: z.object({ ...browserScopeOptions }),
         run: ({ args, options }) => logCliCommand(logger, "list-browser-targets", async () => {
             const context = await browserContext("list_browser_targets");
             if (!context.ok)
@@ -55,14 +29,11 @@ const registerTargetList = (cli, logger) => {
             const parsed = listBrowserTargetsInputSchema.safeParse({
                 cdp_endpoint: args.endpoint,
                 allowed_origins: options.allowedOrigins ?? context.allowedBrowserOrigins,
-                approved: options.approved,
-                offset: options.offset,
-                limit: options.limit,
             });
             if (!parsed.success)
-                return cliError(new AnalysisInputError("list_browser_targets"));
+                return browserCliError(new AnalysisInputError("list_browser_targets"));
             const result = await listBrowserTargets(context.provider, context.authority, parsed.data);
-            return result.ok ? result.value : cliError(result.error);
+            return result.ok ? result.value : browserCliError(result.error);
         }),
     });
 };
@@ -81,49 +52,20 @@ const registerPageInspection = (cli, logger) => {
             const parsed = inspectWebPageInputSchema.safeParse({
                 cdp_endpoint: args.endpoint,
                 allowed_origins: options.allowedOrigins ?? context.allowedBrowserOrigins,
-                approved: options.approved,
                 target_id: args.targetId,
                 observation_ms: options.observationMs,
                 include_accessibility_text: options.includeAccessibilityText,
                 include_console_text: options.includeConsoleText,
-                console_text_approved: options.consoleTextApproved,
                 include_json_body_shapes: options.includeJsonBodyShapes,
-                json_body_schema_approved: options.jsonBodySchemaApproved,
                 include_websocket_shapes: options.includeWebsocketShapes,
-                websocket_shape_approved: options.websocketShapeApproved,
                 include_script_sources: options.includeScriptSources,
-                source_capture_approved: options.sourceCaptureApproved,
                 include_storage_keys: options.includeStorageKeys,
                 include_storage_fingerprints: options.includeStorageFingerprints,
-                limits: {
-                    max_frames: options.maxFrames,
-                    max_dom_nodes: options.maxDomNodes,
-                    max_ax_nodes: options.maxAxNodes,
-                    max_ax_text_field_bytes: options.maxAxTextFieldBytes,
-                    max_total_ax_text_bytes: options.maxTotalAxTextBytes,
-                    max_scripts: options.maxScripts,
-                    max_resources: options.maxResources,
-                    max_workers: options.maxWorkers,
-                    max_storage_keys: options.maxStorageKeys,
-                    max_script_source_bytes: options.maxScriptSourceBytes,
-                    max_total_script_source_bytes: options.maxTotalScriptSourceBytes,
-                    max_network_events: options.maxNetworkEvents,
-                    max_console_events: options.maxConsoleEvents,
-                    max_console_text_field_bytes: options.maxConsoleTextFieldBytes,
-                    max_total_console_text_bytes: options.maxTotalConsoleTextBytes,
-                    max_json_body_bytes: options.maxJsonBodyBytes,
-                    max_total_json_body_bytes: options.maxTotalJsonBodyBytes,
-                    max_json_shape_nodes: options.maxJsonShapeNodes,
-                    max_json_shape_depth: options.maxJsonShapeDepth,
-                    max_websocket_events: options.maxWebsocketEvents,
-                    max_websocket_shape_bytes: options.maxWebsocketShapeBytes,
-                    max_total_websocket_shape_bytes: options.maxTotalWebsocketShapeBytes,
-                },
             });
             if (!parsed.success)
-                return cliError(new AnalysisInputError("inspect_web_page"));
+                return browserCliError(new AnalysisInputError("inspect_web_page"));
             const result = await inspectWebPage(context.provider, context.authority, parsed.data);
-            return result.ok ? result.value : cliError(result.error);
+            return result.ok ? result.value : browserCliError(result.error);
         }),
     });
 };
@@ -136,26 +78,11 @@ const registerBundleAnalysis = (cli, logger) => {
         }),
         options: z.object({
             ...browserScopeOptions,
-            sourceCaptureApproved: z
-                .boolean()
-                .default(false)
-                .describe("Approve capturing bounded script source text"),
-            observationMs: boundedCount("observation duration in milliseconds", 10_000, 500, 0),
+            observationMs: observationDuration(500),
             fetchSourceMaps: z
                 .boolean()
                 .default(false)
                 .describe("Fetch source maps referenced by captured scripts"),
-            sourceMapFetchApproved: z
-                .boolean()
-                .default(false)
-                .describe("Approve fetching referenced source maps from allowed origins"),
-            maxFindings: boundedCount("static-analysis findings", 10_000, 1_000),
-            maxAstNodes: boundedCount("JavaScript AST nodes", 2_000_000, 250_000),
-            maxSourceMaps: boundedCount("source maps", 1_000, 100),
-            maxSourceMapBytes: boundedBytes("one source map", 16 * 1_024 * 1_024, 4 * 1_024 * 1_024),
-            maxTotalSourceMapBytes: boundedBytes("total source maps", 64 * 1_024 * 1_024, 16 * 1_024 * 1_024),
-            maxSourceMapMappings: boundedCount("decoded source-map mappings", 100_000, 10_000),
-            maxOriginalSources: boundedCount("original source files", 20_000, 2_000),
         }),
         run: ({ args, options }) => logCliCommand(logger, "analyze-web-bundle", async () => {
             const context = await browserContext("analyze_web_bundle");
@@ -164,41 +91,28 @@ const registerBundleAnalysis = (cli, logger) => {
             const parsed = analyzeWebBundleInputSchema.safeParse({
                 cdp_endpoint: args.endpoint,
                 allowed_origins: options.allowedOrigins ?? context.allowedBrowserOrigins,
-                approved: options.approved,
                 target_id: args.targetId,
                 observation_ms: options.observationMs,
                 include_script_sources: true,
-                source_capture_approved: options.sourceCaptureApproved,
                 fetch_source_maps: options.fetchSourceMaps,
-                source_map_fetch_approved: options.sourceMapFetchApproved,
-                analysis_limits: {
-                    max_findings: options.maxFindings,
-                    max_ast_nodes: options.maxAstNodes,
-                    max_source_maps: options.maxSourceMaps,
-                    max_source_map_bytes: options.maxSourceMapBytes,
-                    max_total_source_map_bytes: options.maxTotalSourceMapBytes,
-                    max_source_map_mappings: options.maxSourceMapMappings,
-                    max_original_sources: options.maxOriginalSources,
-                },
             });
             if (!parsed.success)
-                return cliError(new AnalysisInputError("analyze_web_bundle"));
+                return browserCliError(new AnalysisInputError("analyze_web_bundle"));
             const result = await analyzeWebBundle(context.provider, context.authority, parsed.data);
-            return result.ok ? result.value : cliError(result.error);
+            return result.ok ? result.value : browserCliError(result.error);
         }),
     });
 };
 const registerObservationSession = (cli, logger) => {
     cli.command(CLI_COMMANDS.observeWebSession, {
-        description: "Observe user-driven page navigation during a bounded window",
+        description: "Observe user-driven page navigation during a chosen window",
         args: z.object({
             endpoint: z.string().describe("Configured loopback CDP HTTP endpoint"),
             targetId: z.string().describe("Target ID from list-browser-targets"),
         }),
         options: z.object({
             ...browserScopeOptions,
-            observationMs: boundedCount("observation duration in milliseconds", 60_000, 10_000),
-            maxTimelineEvents: boundedCount("timeline events", 20_000, 2_000),
+            observationMs: observationDuration(10_000, 1),
         }),
         run: ({ args, options }) => logCliCommand(logger, "observe-web-session", async () => {
             const context = await browserContext("observe_web_session");
@@ -208,38 +122,12 @@ const registerObservationSession = (cli, logger) => {
                 cdp_endpoint: args.endpoint,
                 allowed_origins: options.allowedOrigins ?? context.allowedBrowserOrigins,
                 target_id: args.targetId,
-                approved: options.approved,
                 observation_ms: options.observationMs,
-                max_timeline_events: options.maxTimelineEvents,
             });
             if (!parsed.success)
-                return cliError(new AnalysisInputError("observe_web_session"));
+                return browserCliError(new AnalysisInputError("observe_web_session"));
             const result = await observeWebSession(context.provider, context.authority, parsed.data);
-            return result.ok ? result.value : cliError(result.error);
+            return result.ok ? result.value : browserCliError(result.error);
         }),
     });
 };
-const browserContext = async (operation) => {
-    const config = parseConfig(process.env);
-    if (!config.ok)
-        return { ok: false, error: cliError(config.error) };
-    const policy = config.value.browserObservationPolicy;
-    if (policy.status === "disabled")
-        return {
-            ok: false,
-            error: cliError(new AnalysisCapabilityUnavailableError("rea-cdp-browser", operation, "browser observation is disabled; configure exact endpoints and origins before enabling it")),
-        };
-    const authority = await loadConfiguredPermissionAuthority(config.value);
-    if (!authority.ok)
-        return { ok: false, error: cliError(authority.error) };
-    return {
-        ok: true,
-        authority: authority.value,
-        provider: new CdpBrowserProvider(),
-        allowedBrowserOrigins: policy.allowedOrigins,
-    };
-};
-const cliError = (error) => ({
-    error: "Browser observation failed",
-    ...projectAnalysisError(error),
-});

package/dist/cliBrowserContext.js

@@ -0,0 +1,30 @@
+import { loadConfiguredPermissionAuthority } from "./application/PermissionConfiguration.js";
+import { CdpBrowserProvider } from "./browser/CdpBrowserProvider.js";
+import { parseConfig } from "./config.js";
+import { AnalysisCapabilityUnavailableError, projectAnalysisError, } from "./domain/errors.js";
+/** Load the configured passive browser authority and provider for one CLI operation. */
+export const browserContext = async (operation) => {
+    const config = parseConfig(process.env);
+    if (!config.ok)
+        return { ok: false, error: browserCliError(config.error) };
+    const policy = config.value.browserObservationPolicy;
+    if (policy.status === "disabled")
+        return {
+            ok: false,
+            error: browserCliError(new AnalysisCapabilityUnavailableError("rea-cdp-browser", operation, "browser observation is disabled; configure exact endpoints and origins before enabling it")),
+        };
+    const authority = await loadConfiguredPermissionAuthority(config.value);
+    if (!authority.ok)
+        return { ok: false, error: browserCliError(authority.error) };
+    return {
+        ok: true,
+        authority: authority.value,
+        provider: new CdpBrowserProvider(),
+        allowedBrowserOrigins: policy.allowedOrigins,
+    };
+};
+/** Project a browser operation failure consistently across CLI command groups. */
+export const browserCliError = (error) => ({
+    error: "Browser observation failed",
+    ...projectAnalysisError(error),
+});

package/dist/cliCommandNames.js

@@ -9,6 +9,8 @@ export const CLI_COMMANDS = Object.freeze({
     upgrade: "upgrade",
     xrefs: "xrefs",
     trace: "trace",
+    traceNativeUiAction: "trace-native-ui-action",
+    inspectNativeDispatchMetadata: "inspect-native-dispatch-metadata",
     capabilities: "capabilities",
     providers: "providers",
     function: "function",
@@ -16,9 +18,9 @@ export const CLI_COMMANDS = Object.freeze({
     instructions: "instructions",
     search: "search",
     importReferenceSource: "import-reference-source",
-    inventoryArtifact: "inventory-artifact",
     inspectArtifact: "inspect-artifact",
     extractArtifact: "extract-artifact",
+    decodeInterfaceBuilder: "decode-interface-builder",
     inspectManagedArtifact: "inspect-managed-artifact",
     inspectManagedMembers: "inspect-managed-members",
     inspectManagedNativeBoundaries: "inspect-managed-native-boundaries",
@@ -35,7 +37,6 @@ export const CLI_COMMANDS = Object.freeze({
     evidenceImport: "evidence-import",
     evidenceExport: "evidence-export",
     compare: "compare",
-    investigateVersions: "investigate-versions",
     captureProcess: "capture-process",
     compareProcessCaptures: "compare-process-captures",
     policy: "policy",
@@ -65,9 +66,7 @@ export const CLI_COMMANDS = Object.freeze({
     prepareNodeCharacterization: "prepare-node-characterization",
     executeNodeCharacterization: "execute-node-characterization",
     buildReconstructionObligationLedger: "build-reconstruction-obligation-ledger",
-    evaluateReconstructionReadiness: "evaluate-reconstruction-readiness",
-    commitReconstructionCoverage: "commit-reconstruction-coverage",
-    queryReconstructionCoverage: "query-reconstruction-coverage",
+    evaluateReconstructionCoverage: "evaluate-reconstruction-coverage",
 });
 /** Ordered primary CLI inventory; aliases are intentionally excluded. */
 export const CLI_COMMAND_NAMES = Object.freeze(Object.values(CLI_COMMANDS));

package/dist/cliElectronCommands.js

@@ -14,13 +14,6 @@ import { CLI_COMMANDS } from "./cliCommandNames.js";
 import { parseCliJsonInput } from "./cliJsonInput.js";
 import { electronPageInspectionOptions, javascriptApplicationOptions, } from "./cliObservationOptions.js";
 import { runCliJavaScriptApplicationAnalysis } from "./cli/javascriptApplicationAnalysis.js";
-const scopeOptions = {
-    allowedFileRoots: z
-        .array(z.string().min(1))
-        .optional()
-        .describe("Filesystem roots; defaults to REA_ELECTRON_FILE_ROOTS_JSON"),
-    approved: z.boolean().default(false).describe("Approve passive observation"),
-};
 /** Register CLI equivalents of the Electron MCP tools. */
 export const registerElectronCommands = (cli, logger) => {
     registerElectronObservationCommands(cli, logger);
@@ -74,38 +67,16 @@ const registerElectronObservationCommands = (cli, logger) => {
 };
 const registerElectronTargetList = (cli, logger) => {
     cli.command(CLI_COMMANDS.listElectronTargets, {
-        description: "List root-confined file pages from Electron CDP",
+        description: "List local file pages exposed by Electron CDP",
         args: z.object({
-            endpoint: z
-                .string()
-                .describe("Configured loopback Electron CDP endpoint"),
-        }),
-        options: z.object({
-            ...scopeOptions,
-            offset: z
-                .number()
-                .int()
-                .min(0)
-                .default(0)
-                .describe("Zero-based Electron-target offset"),
-            limit: z
-                .number()
-                .int()
-                .min(1)
-                .max(200)
-                .default(100)
-                .describe("Maximum Electron targets to return"),
+            endpoint: z.string().describe("Literal-loopback Electron CDP endpoint"),
         }),
-        run: ({ args, options }) => logCliCommand(logger, "list-electron-targets", async () => {
+        run: ({ args }) => logCliCommand(logger, "list-electron-targets", async () => {
             const context = await electronObservationContext("list_electron_targets");
             if (!context.ok)
                 return context.error;
             const parsed = listElectronTargetsInputSchema.safeParse({
                 cdp_endpoint: args.endpoint,
-                allowed_file_roots: options.allowedFileRoots ?? context.allowedFileRoots,
-                approved: options.approved,
-                offset: options.offset,
-                limit: options.limit,
             });
             if (!parsed.success)
                 return inputError("list_electron_targets");
@@ -116,11 +87,9 @@ const registerElectronTargetList = (cli, logger) => {
 };
 const registerElectronPageInspection = (cli, logger) => {
     cli.command(CLI_COMMANDS.inspectElectronPage, {
-        description: "Passively inspect one root-confined Electron file page",
+        description: "Passively inspect one Electron file page",
         args: z.object({
-            endpoint: z
-                .string()
-                .describe("Configured loopback Electron CDP endpoint"),
+            endpoint: z.string().describe("Literal-loopback Electron CDP endpoint"),
             targetId: z.string().describe("Target ID from list-electron-targets"),
         }),
         options: electronPageInspectionOptions,
@@ -130,21 +99,9 @@ const registerElectronPageInspection = (cli, logger) => {
                 return context.error;
             const parsed = inspectElectronPageInputSchema.safeParse({
                 cdp_endpoint: args.endpoint,
-                allowed_file_roots: options.allowedFileRoots ?? context.allowedFileRoots,
                 target_id: args.targetId,
-                approved: options.approved,
                 observation_ms: options.observationMs,
                 include_script_sources: options.includeScriptSources,
-                source_capture_approved: options.sourceCaptureApproved,
-                limits: {
-                    max_frames: options.maxFrames,
-                    max_dom_nodes: options.maxDomNodes,
-                    max_scripts: options.maxScripts,
-                    max_resources: options.maxResources,
-                    max_workers: options.maxWorkers,
-                    max_script_source_bytes: options.maxScriptSourceBytes,
-                    max_total_script_source_bytes: options.maxTotalScriptSourceBytes,
-                },
             });
             if (!parsed.success)
                 return inputError("inspect_electron_page");
@@ -155,32 +112,14 @@ const registerElectronPageInspection = (cli, logger) => {
 };
 const registerJavaScriptApplicationCommand = (cli, logger) => {
     cli.command(CLI_COMMANDS.analyzeJavaScriptApplication, {
-        description: "Statically reconstruct an approved JavaScript/Electron application",
+        description: "Statically reconstruct a local JavaScript/Electron application",
         args: z.object({
             path: z.string().describe("Absolute ASAR or extracted application path"),
         }),
         options: javascriptApplicationOptions,
         run: ({ args, options }) => logCliCommand(logger, CLI_COMMANDS.analyzeJavaScriptApplication, () => runCliJavaScriptApplicationAnalysis({
             input_path: args.path,
-            approved: options.approved,
             format: options.artifactFormat,
-            source_map_read_approved: options.sourceMapReadApproved,
-            limits: {
-                max_entries: options.maxEntries,
-                max_total_artifact_bytes: options.maxTotalArtifactBytes,
-                max_artifact_entry_bytes: options.maxArtifactEntryBytes,
-                max_compression_ratio: options.maxCompressionRatio,
-                max_depth: options.maxDepth,
-                max_path_bytes: options.maxPathBytes,
-                max_text_files: options.maxTextFiles,
-                max_total_text_bytes: options.maxTotalTextBytes,
-                max_text_file_bytes: options.maxTextFileBytes,
-                max_ast_nodes: options.maxAstNodes,
-                max_findings: options.maxFindings,
-                max_modules: options.maxModules,
-                max_source_map_sources: options.maxSourceMapSources,
-                max_parse_milliseconds: options.maxParseMilliseconds,
-            },
         })),
     });
 };
@@ -206,12 +145,9 @@ const electronObservationContext = async (operation) => {
     if (context.observationPolicy.status === "disabled")
         return {
             ok: false,
-            error: cliError(new AnalysisCapabilityUnavailableError("rea-cdp-electron", operation, "Electron observation is disabled; configure exact endpoints and file roots before enabling it")),
+            error: cliError(new AnalysisCapabilityUnavailableError("rea-cdp-electron", operation, "Electron observation is disabled; enable REA_ELECTRON_OBSERVE_ENABLED to authorize loopback endpoints")),
         };
-    return {
-        ...context,
-        allowedFileRoots: context.observationPolicy.fileRoots,
-    };
+    return context;
 };
 const inputError = (operation) => cliError(new AnalysisInputError(operation));
 const cliError = (error) => ({

package/dist/cliEvidenceCommands.js

@@ -1,32 +1,22 @@
 import { Cli, z } from "incur";
 import { compareEvidenceBundlesCommand, exportEvidenceBundleCommand, importEvidenceBundleCommand, } from "./application/EvidenceBundleCommands.js";
-import { parseConfig } from "./config.js";
 import { logCliCommand } from "./cliLogging.js";
 import { CLI_COMMANDS } from "./cliCommandNames.js";
-import { AnalysisProtocolError, PermissionRequiredError, projectAnalysisError, } from "./domain/errors.js";
-import { loadConfiguredPermissionAuthority } from "./application/PermissionConfiguration.js";
-/** Register filesystem-gated Evidence v2 commands. */
+import { projectAnalysisError } from "./domain/errors.js";
+/** Register caller-path Evidence commands. */
 export const registerEvidenceCommands = (cli, logger) => {
     cli.command(CLI_COMMANDS.evidenceImport, {
-        description: "Validate and import a bounded local Evidence v2 bundle",
+        description: "Validate and import a bounded local Evidence bundle",
         args: z.object({
             path: z.string().describe("Evidence bundle JSON path"),
         }),
         run: ({ args }) => logCliCommand(logger, "evidence-import", async () => {
-            const config = parseConfig(process.env);
-            if (!config.ok)
-                return cliError(config.error);
-            const denied = await authorizeEvidence(config.value, [
-                { capability: "evidence_read", path: args.path, access: "read" },
-            ]);
-            if (denied !== undefined)
-                return cliError(denied);
-            const imported = await importEvidenceBundleCommand(args.path, config.value.evidenceFilePolicy);
+            const imported = await importEvidenceBundleCommand(args.path);
             return imported.ok ? imported.value : cliError(imported.error);
         }),
     });
     cli.command(CLI_COMMANDS.evidenceExport, {
-        description: "Validate and atomically export canonical Evidence v2 JSON",
+        description: "Validate and atomically export canonical Evidence JSON",
         args: z.object({
             source: z.string().describe("Existing evidence bundle JSON path"),
             output: z.string().describe("Canonical output JSON path"),
@@ -35,85 +25,26 @@ export const registerEvidenceCommands = (cli, logger) => {
             overwrite: z.boolean().default(false).describe("Replace output file"),
         }),
         run: ({ args, options }) => logCliCommand(logger, "evidence-export", async () => {
-            const config = parseConfig(process.env);
-            if (!config.ok)
-                return cliError(config.error);
-            const denied = await authorizeEvidence(config.value, [
-                { capability: "evidence_read", path: args.source, access: "read" },
-                { capability: "evidence_write", path: args.output, access: "write" },
-            ]);
-            if (denied !== undefined)
-                return cliError(denied);
-            const exported = await exportEvidenceBundleCommand(args.source, args.output, options.overwrite, config.value.evidenceFilePolicy);
+            const exported = await exportEvidenceBundleCommand(args.source, args.output, options.overwrite);
             return exported.ok ? exported.value : cliError(exported.error);
         }),
     });
     cli.command(CLI_COMMANDS.compare, {
         aliases: ["compare-bundles"],
-        description: "Compare two canonical Evidence v2 bundles",
+        description: "Compare two canonical Evidence bundles",
         args: z.object({
             left: z.string().describe("Left Evidence bundle JSON path"),
             right: z.string().describe("Right Evidence bundle JSON path"),
         }),
-        options: z.object({
-            offset: z
-                .number()
-                .int()
-                .min(0)
-                .default(0)
-                .describe("Zero-based changed-record offset"),
-            limit: z
-                .number()
-                .int()
-                .min(1)
-                .max(500)
-                .default(100)
-                .describe("Maximum changed records to return"),
-        }),
-        run: ({ args, options }) => logCliCommand(logger, "compare", async () => {
-            const config = parseConfig(process.env);
-            if (!config.ok)
-                return cliError(config.error);
-            const denied = await authorizeEvidence(config.value, [
-                { capability: "evidence_read", path: args.left, access: "read" },
-                { capability: "evidence_read", path: args.right, access: "read" },
-            ]);
-            if (denied !== undefined)
-                return cliError(denied);
+        run: ({ args }) => logCliCommand(logger, "compare", async () => {
             const compared = await compareEvidenceBundlesCommand({
                 leftPath: args.left,
                 rightPath: args.right,
-                offset: options.offset,
-                limit: options.limit,
-                policy: config.value.evidenceFilePolicy,
             });
             return compared.ok ? compared.value : cliError(compared.error);
         }),
     });
 };
-const authorizeEvidence = async (config, requests) => {
-    const authority = await loadConfiguredPermissionAuthority(config);
-    if (!authority.ok)
-        return authority.error;
-    for (const request of requests) {
-        const result = await authority.value.authorize({
-            capability: request.capability,
-            roots: [request.path],
-            executables: [],
-            environment_names: [],
-            network: "none",
-            mount: false,
-            operation_identity: `cli:${request.capability}:${request.path}`,
-        }, request.access);
-        if (!result.ok)
-            return result.error instanceof PermissionRequiredError
-                ? result.error
-                : new AnalysisProtocolError(result.error.message, {
-                    cause: result.error,
-                });
-    }
-    return undefined;
-};
 const cliError = (error) => ({
     error: "Analysis failed",
     ...projectAnalysisError(error),