rea-agents 3.2.0 → 4.0.0

package/dist/cli/managedCommands.js

@@ -2,10 +2,7 @@ import { z } from "incur";
 import { compareManagedMemberPaths } from "../application/ManagedMemberComparisonService.js";
 import { verifyManagedNativeBoundariesEvidence } from "../application/ManagedNativeVerificationService.js";
 import { importManagedReconstructionEvidence } from "../application/ManagedReconstructionService.js";
-import { planManagedRuntimeCorrelationEvidence } from "../application/ManagedRuntimeCorrelationService.js";
 import { runProviderAnalysis } from "../application/DirectAnalysis.js";
-import { parseConfig } from "../config.js";
-import { loadConfiguredPermissionAuthority } from "../application/PermissionConfiguration.js";
 import { parseCliJsonInput } from "../cliJsonInput.js";
 import { projectAnalysisError } from "../domain/errors.js";
 import { CLI_COMMANDS } from "../cliCommandNames.js";
@@ -18,7 +15,6 @@ export const registerManagedCommands = (cli, logger) => {
     registerCompareManagedMembers(cli, logger);
     registerImportManagedReconstruction(cli, logger);
     registerVerifyManagedNativeBoundaries(cli, logger);
-    registerPlanManagedRuntimeCorrelation(cli, logger);
     registerProjectManagedApplicationGraph(cli, logger);
 };
 const registerInspectManagedArtifact = (cli, logger) => {
@@ -54,7 +50,7 @@ const compareManagedMemberArgs = z.object({
 });
 const registerCompareManagedMembers = (cli, logger) => {
     cli.command(CLI_COMMANDS.compareManagedMembers, {
-        description: "Compare two managed PE/CLI member inventories without name-based matching",
+        description: "Compare managed PE/CLI member inventories by exact declared type, name, and signature; names alone never form a match",
         args: compareManagedMemberArgs,
         run: ({ args }) => logCliCommand(logger, "compare-managed-members", async () => {
             const result = await compareManagedMemberPaths({
@@ -104,29 +100,3 @@ const registerVerifyManagedNativeBoundaries = (cli, logger) => {
         }),
     });
 };
-const registerPlanManagedRuntimeCorrelation = (cli, logger) => {
-    cli.command(CLI_COMMANDS.planManagedRuntimeCorrelation, {
-        description: "Plan a separately authorized managed runtime-correlation experiment without executing target code",
-        args: z.object({
-            inputJson: z
-                .string()
-                .describe("Inline managed runtime-correlation JSON or JSON file path"),
-        }),
-        run: ({ args }) => logCliCommand(logger, "plan-managed-runtime-correlation", async () => {
-            const input = await parseCliJsonInput(args.inputJson, "plan-managed-runtime-correlation");
-            if (!input.ok)
-                return input.error;
-            const config = parseConfig(process.env);
-            if (!config.ok)
-                return projectAnalysisError(config.error);
-            const authority = await loadConfiguredPermissionAuthority(config.value);
-            if (!authority.ok)
-                return projectAnalysisError(authority.error);
-            const result = await planManagedRuntimeCorrelationEvidence({
-                policy: () => config.value.managedRuntimePolicy,
-                authority: authority.value,
-            }, input.value);
-            return result.ok ? result.value : projectAnalysisError(result.error);
-        }),
-    });
-};

package/dist/cli/setupCommands.js

@@ -1,8 +1,9 @@
 import { z } from "incur";
 import { DOCTOR_PROVIDER_IDS, runDoctor, } from "../application/Doctor.js";
-import { runSetup, systemSetupHost, } from "../application/Setup.js";
-import { runUninstall } from "../application/Uninstall.js";
-import { runUpgrade, systemUpgradeHost } from "../application/Upgrade.js";
+import { runSetup, isSetupFailure, systemSetupHost, } from "../application/Setup.js";
+import { isUninstallFailure, runUninstall } from "../application/Uninstall.js";
+import { isUpdateFailure, runUpdate } from "../application/Update.js";
+import { systemUpdateHost } from "../application/UpdateRuntime.js";
 import { confirmInteractiveSetup, renderInteractiveSetupResult, renderSetupProgress, } from "../cliSetup.js";
 import { PRODUCT_IDENTITY } from "../identity.js";
 import { logCliCommand } from "../cliLogging.js";
@@ -13,7 +14,7 @@ const supportedClientIds = SUPPORTED_CLIENT_DEFINITIONS.map(({ name }) => name);
 const supportedClientSchema = z
     .string()
     .refine((candidate) => supportedClientIds.some((name) => name === candidate), "Unsupported agent integration");
-/** Register setup, doctor, uninstall, and upgrade CLI commands. */
+/** Register setup, doctor, uninstall, and update CLI commands. */
 export const registerSetupCommands = (cli, logger) => {
     registerSetupCommand(cli, logger);
     registerDoctorCommand(cli, logger);
@@ -21,7 +22,7 @@ export const registerSetupCommands = (cli, logger) => {
 };
 const registerSetupCommand = (cli, logger) => {
     cli.command(CLI_COMMANDS.setup, {
-        description: "Install requirements and configure agents",
+        description: "Configure agent integrations and optional analysis providers",
         outputPolicy: "agent-only",
         options: z.object({
             yes: z
@@ -54,7 +55,7 @@ const registerSetupCommand = (cli, logger) => {
                 .describe("Use sequential accessible setup prompts"),
         }),
         alias: { yes: "y" },
-        run: ({ options, formatExplicit }) => logCliCommand(logger, "setup", () => runSetupCommand({ options, formatExplicit })),
+        run: ({ options, formatExplicit }) => logCliCommand(logger, CLI_COMMANDS.setup, () => runSetupCommand({ options, formatExplicit }), isSetupFailure),
     });
 };
 const registerDoctorCommand = (cli, logger) => {
@@ -88,21 +89,19 @@ const registerMaintenanceCommands = (cli, logger) => {
                 .describe("Also remove REA caches and state"),
         }),
         alias: { purgeData: "purge-data" },
-        run: ({ options }) => logCliCommand(logger, "uninstall", () => runUninstall(options.purgeData)),
+        run: ({ options }) => logCliCommand(logger, "uninstall", () => runUninstall(options.purgeData), isUninstallFailure),
     });
-    cli.command(CLI_COMMANDS.upgrade, {
-        description: "Upgrade a global npm installation to the latest REA release",
-        run: ({ formatExplicit }) => logCliCommand(logger, "upgrade", () => runUpgrade(PRODUCT_IDENTITY.packageVersion, systemUpgradeHost(), formatExplicit ? "structured" : "human")),
+    cli.command(CLI_COMMANDS.update, {
+        description: "Update this REA installation and verify the installed release",
+        run: ({ formatExplicit }) => logCliCommand(logger, CLI_COMMANDS.update, () => runUpdate(PRODUCT_IDENTITY.packageVersion, systemUpdateHost(), formatExplicit ? "structured" : "human"), isUpdateFailure),
     });
 };
 const runSetupCommand = async (input) => {
     const { options } = input;
     const interactive = setupIsInteractive(options, input.formatExplicit);
     const hasExplicitScope = setupHasExplicitScope(options);
-    if (options.yes && !hasExplicitScope)
-        process.stderr.write("!  Implicit `rea setup --yes` scope is deprecated; use `--all-detected` to retain it.\n");
     const result = await runSetup(setupRunOptions(input, interactive, hasExplicitScope), systemSetupHost(createSystemDoctorHost()), interactive
-        ? (actions) => confirmInteractiveSetup(actions, options.accessible)
+        ? (actions, context) => confirmInteractiveSetup(actions, options.accessible, context)
         : undefined);
     if (interactive)
         renderInteractiveSetupResult(result);
@@ -116,7 +115,9 @@ const setupRunOptions = (input, interactive, hasExplicitScope) => {
         approved: options.yes && !options.dryRun,
         installHopper: options.installHopper,
         structured: input.formatExplicit || options.dryRun,
-        proposeHopper: !hasExplicitScope || options.installHopper,
+        dryRun: options.dryRun,
+        allDetectedClients: options.allDetected,
+        proposeHopper: interactive || options.installHopper,
         ...(hasSelectedClients ? { clientIds: options.client } : {}),
         ...(hasExplicitScope
             ? { installSkill: options.skill ?? agentIntegrationSelected }
@@ -137,6 +138,7 @@ const setupIsInteractive = (options, formatExplicit) => !options.yes &&
     !options.dryRun &&
     !formatExplicit &&
     process.stdin.isTTY === true &&
+    process.stdout.isTTY === true &&
     process.stderr.isTTY === true;
 const setupHasExplicitScope = (options) => options.allDetected ||
     options.client.length > 0 ||

package/dist/cli/utilityCommands.js

@@ -1,4 +1,5 @@
 import { z } from "incur";
+import { jsonValueSchema } from "../domain/jsonValue.js";
 import { runCapabilityStatus, runProviderAnalysis, runProviderStatus, } from "../application/DirectAnalysis.js";
 import { importReferenceSource } from "../application/ReferenceSourceImport.js";
 import { projectReferenceSourceImportError } from "../application/ReferenceSourceImportTypes.js";
@@ -7,10 +8,66 @@ import { projectAnalysisError } from "../domain/errors.js";
 import { PRODUCT_IDENTITY } from "../identity.js";
 import { logCliCommand } from "../cliLogging.js";
 import { CLI_COMMANDS } from "../cliCommandNames.js";
-export const registerUtilityCommands = (cli, logger) => {
+export const registerUtilityCommands = (cli, logger, environment = process.env) => {
     registerCapabilityCommands(cli, logger);
     registerNativeCommands(cli, logger);
-    registerReferenceSourceCommand(cli, logger);
+    for (const [command, operation] of [
+        [CLI_COMMANDS.observeNativeUi, "observe_native_ui"],
+        [CLI_COMMANDS.captureNativeUiScenario, "capture_native_ui_scenario"],
+    ]) {
+        cli.command(command, {
+            description: "Observe or run a scenario in one exact native application window",
+            args: z.object({
+                path: z.string().describe("Local native executable or app path"),
+            }),
+            options: z.object({
+                pid: z.number().int().positive().describe("Existing application PID"),
+                windowId: z
+                    .number()
+                    .int()
+                    .positive()
+                    .describe("Exact selected application window ID"),
+                steps: z
+                    .string()
+                    .optional()
+                    .describe("JSON array of declarative AX actions or waits"),
+                screenshot: z
+                    .boolean()
+                    .default(true)
+                    .describe("Capture only the selected window"),
+                accessibility: z
+                    .boolean()
+                    .default(true)
+                    .describe("Read the selected window accessibility tree"),
+                maxNodes: z
+                    .number()
+                    .int()
+                    .positive()
+                    .safe()
+                    .default(500)
+                    .describe("Maximum accessibility nodes per capture"),
+            }),
+            alias: {
+                windowId: "window-id",
+                maxNodes: "max-nodes",
+            },
+            run: ({ args, options }) => logCliCommand(logger, command, () => runProviderAnalysis(args.path, operation, {
+                pid: options.pid,
+                window_id: options.windowId,
+                screenshot: options.screenshot,
+                accessibility: options.accessibility,
+                max_nodes: options.maxNodes,
+                ...(operation === "capture_native_ui_scenario"
+                    ? {
+                        steps: options.steps === undefined
+                            ? []
+                            : jsonValueSchema.parse(JSON.parse(options.steps)),
+                    }
+                    : {}),
+            }, logger)),
+        });
+    }
+    registerReferenceSourceCommand(cli, logger, environment);
 };
 const registerCapabilityCommands = (cli, logger) => {
     for (const command of [
@@ -63,7 +120,7 @@ const registerNativeCommands = (cli, logger) => {
         run: ({ args }) => logCliCommand(logger, "demangle-swift", () => runProviderAnalysis(args.path, "demangle_swift", { symbols: args.symbols }, logger)),
     });
 };
-const registerReferenceSourceCommand = (cli, logger) => {
+const registerReferenceSourceCommand = (cli, logger, environment = process.env) => {
     cli.command(CLI_COMMANDS.importReferenceSource, {
         description: "Import a source tree as historical reference only",
         args: z.object({
@@ -72,7 +129,7 @@ const registerReferenceSourceCommand = (cli, logger) => {
                 .describe("Local source directory to import as historical reference"),
         }),
         run: ({ args }) => logCliCommand(logger, "import-reference-source", async () => {
-            const config = parseConfig(process.env);
+            const config = parseConfig(environment);
             if (!config.ok)
                 return {
                     error: "Import failed",

package/dist/cli.js

@@ -9,7 +9,6 @@ import { registerArtifactCommands } from "./cli/artifactCommands.js";
 import { registerManagedCommands } from "./cli/managedCommands.js";
 import { registerEvidenceCommands } from "./cliEvidenceCommands.js";
 import { registerProcessCommands } from "./cliProcessCommands.js";
-import { registerPolicyCommands } from "./cliPolicyCommands.js";
 import { registerBrowserCommands } from "./cliBrowserCommands.js";
 import { registerAdvancedBrowserCommands } from "./cliBrowserAdvancedCommands.js";
 import { registerBrowserScenarioCommands } from "./cliBrowserScenarioCommands.js";
@@ -21,10 +20,10 @@ import { registerApplicationCommands } from "./cliApplicationCommands.js";
  * Analysis commands acquire and close their own sessions; bare `mcp` and
  * `--mcp` are intercepted by the executable dispatcher before this module loads.
  */
-export const createCli = () => {
-    const logger = createLogger("cli", process.env.REA_LOG_LEVEL === undefined
+export const createCli = (environment = process.env) => {
+    const logger = createLogger("cli", environment.REA_LOG_LEVEL === undefined
         ? "silent"
-        : parseLogLevel(process.env.REA_LOG_LEVEL));
+        : parseLogLevel(environment.REA_LOG_LEVEL));
     const cli = Cli.create(PRODUCT_IDENTITY.cliBinary, {
         version: PRODUCT_IDENTITY.packageVersion,
         description: "Reverse engineer anything from your terminal or agent.",
@@ -44,12 +43,11 @@ export const createCli = () => {
     });
     registerSetupCommands(cli, logger);
     registerCoreAnalysisCommands(cli, logger);
-    registerUtilityCommands(cli, logger);
+    registerUtilityCommands(cli, logger, environment);
     registerArtifactCommands(cli, logger);
     registerManagedCommands(cli, logger);
     registerEvidenceCommands(cli, logger);
-    registerProcessCommands(cli, logger);
-    registerPolicyCommands(cli, logger);
+    registerProcessCommands(cli, logger, environment);
     registerBrowserCommands(cli, logger);
     registerAdvancedBrowserCommands(cli, logger);
     registerBrowserScenarioCommands(cli, logger);

package/dist/cliApplicationCommands.js

@@ -1,19 +1,13 @@
 import { Cli, z } from "incur";
 import { compareApplicationVersionsEvidenceValidated, compareJavaScriptExportShapesEvidenceValidated, compareSourceToBundleEvidenceValidated, traceApplicationFeatureEvidenceValidated, } from "./application/JavaScriptApplicationWorkflowService.js";
 import { traceJavaScriptSemanticsEvidenceValidated } from "./application/JavaScriptSemanticTraceService.js";
-import { runControlledReplay } from "./application/JavaScriptReplayService.js";
-import { executeNodeCharacterization, prepareNodeCharacterization, } from "./application/NodeRuntimeCharacterizationService.js";
 import { evaluateReconstructionCoverage, reconstructionCoverageEvaluationInputSchema, } from "./application/ReconstructionCoverageService.js";
 import { buildReconstructionObligationLedgerEvidenceValidated } from "./application/ReconstructionObligationLedgerService.js";
-import { loadConfiguredPermissionAuthority } from "./application/PermissionConfiguration.js";
 import { CLI_COMMANDS } from "./cliCommandNames.js";
 import { parseCliJsonInput } from "./cliJsonInput.js";
 import { logCliCommand } from "./cliLogging.js";
 import { AnalysisInputError, projectAnalysisError, } from "./domain/errors.js";
 import { jsonValueSchema } from "./domain/jsonValue.js";
-import { parseConfig } from "./config.js";
-import { LinuxJavaScriptReplayRunner } from "./replay/LinuxJavaScriptReplayRunner.js";
-import { SystemJavaScriptReplayHost } from "./replay/SystemJavaScriptReplayHost.js";
 import { traceApplicationFeatureInputSchema } from "./domain/javascriptFeatureTraceSchemas.js";
 import { traceJavaScriptSemanticsInputSchema } from "./domain/javascriptSemanticTraceSchemas.js";
 import { compareApplicationVersionsInputSchema } from "./domain/javascriptApplicationVersionComparisonSchemas.js";
@@ -63,44 +57,6 @@ export const registerApplicationCommands = (cli, logger) => {
         inputSchema: compareJavaScriptExportShapesInputSchema,
         workflow: compareJavaScriptExportShapesEvidenceValidated,
     });
-    cli.command(CLI_COMMANDS.runControlledReplay, {
-        description: "Plan or execute an approved extracted-module replay in the Linux sandbox",
-        args: z.object({
-            inputJson: z.string().describe("Inline replay JSON or JSON file path"),
-        }),
-        run: ({ args }) => logCliCommand(logger, CLI_COMMANDS.runControlledReplay, async () => {
-            const input = await parseCliJsonInput(args.inputJson, CLI_COMMANDS.runControlledReplay);
-            if (!input.ok)
-                return input.error;
-            const config = parseConfig(process.env);
-            if (!config.ok)
-                return projectAnalysisError(config.error);
-            const authority = await loadConfiguredPermissionAuthority(config.value);
-            if (!authority.ok)
-                return projectAnalysisError(authority.error);
-            const result = await runControlledReplay({
-                policy: () => config.value.javascriptReplayPolicy,
-                host: new SystemJavaScriptReplayHost(),
-                runner: new LinuxJavaScriptReplayRunner(),
-                authority: authority.value,
-            }, input.value);
-            return result.ok ? result.value : projectAnalysisError(result.error);
-        }),
-    });
-    registerAuthorizedJsonCommand({
-        cli,
-        logger,
-        name: CLI_COMMANDS.prepareNodeCharacterization,
-        description: "Prepare one exact Node/JavaScript characterization without execution",
-        workflow: (config, authority, input) => prepareNodeCharacterization(replayDependencies(config, authority), input),
-    });
-    registerAuthorizedJsonCommand({
-        cli,
-        logger,
-        name: CLI_COMMANDS.executeNodeCharacterization,
-        description: "Execute one separately approved exact Node/JavaScript characterization",
-        workflow: (config, authority, input) => executeNodeCharacterization(replayDependencies(config, authority), input),
-    });
     registerObligationLedgerCommand(cli, logger);
     registerCoverageCommand(cli, logger);
 };
@@ -117,24 +73,6 @@ const registerObligationLedgerCommand = (cli, logger) => registerJsonCommand({
             : result;
     },
 });
-const registerAuthorizedJsonCommand = ({ cli, logger, name, description, workflow, }) => {
-    cli.command(name, {
-        description,
-        args: z.object({
-            inputJson: z.string().describe("Inline workflow JSON or JSON file path"),
-        }),
-        run: ({ args }) => logCliCommand(logger, name, async () => {
-            const input = await parseCliJsonInput(args.inputJson, name);
-            if (!input.ok)
-                return input.error;
-            const configured = await configuredAuthority();
-            if (!configured.ok)
-                return configured.error;
-            const result = await workflow(configured.config, configured.authority, input.value);
-            return result.ok ? result.value : projectAnalysisError(result.error);
-        }),
-    });
-};
 const registerCoverageCommand = (cli, logger) => registerJsonCommand({
     cli,
     logger,
@@ -148,18 +86,6 @@ const registerCoverageCommand = (cli, logger) => registerJsonCommand({
             : result;
     },
 });
-const configuredAuthority = async () => {
-    const configured = await loadConfiguredAuthority();
-    return configured.ok
-        ? configured
-        : { ok: false, error: projectAnalysisError(configured.error) };
-};
-const replayDependencies = (config, authority) => ({
-    policy: () => config.javascriptReplayPolicy,
-    host: new SystemJavaScriptReplayHost(),
-    runner: new LinuxJavaScriptReplayRunner(),
-    authority,
-});
 const registerJsonCommand = ({ cli, logger, name, description, inputSchema, workflow, }) => {
     cli.command(name, {
         description,
@@ -186,12 +112,3 @@ const registerJsonCommand = ({ cli, logger, name, description, inputSchema, work
         }),
     });
 };
-const loadConfiguredAuthority = async () => {
-    const config = parseConfig(process.env);
-    if (!config.ok)
-        return config;
-    const authority = await loadConfiguredPermissionAuthority(config.value);
-    return authority.ok
-        ? { ok: true, config: config.value, authority: authority.value }
-        : authority;
-};

package/dist/cliBrowserAdvancedCommands.js

@@ -33,18 +33,16 @@ const registerWebMcp = (cli, logger) => {
                 .describe("Observation duration in milliseconds"),
         }),
         run: ({ args, options }) => logCliCommand(logger, "discover-webmcp-tools", async () => {
-            const context = await browserContext("discover_webmcp_tools");
-            if (!context.ok)
-                return context.error;
+            const context = browserContext();
             const parsed = discoverWebMcpToolsInputSchema.safeParse({
                 cdp_endpoint: args.endpoint,
-                allowed_origins: options.allowedOrigins ?? context.allowedBrowserOrigins,
+                allowed_origins: options.allowedOrigins,
                 target_id: args.targetId,
                 observation_ms: options.observationMs,
             });
             if (!parsed.success)
                 return inputError("discover_webmcp_tools");
-            const result = await discoverWebMcpTools(context.provider, context.authority, parsed.data);
+            const result = await discoverWebMcpTools(context.provider, parsed.data);
             return result.ok ? result.value : browserCliError(result.error);
         }),
     });
@@ -85,7 +83,7 @@ const registerCaptureDiff = (cli, logger) => {
 };
 const registerScreenshot = (cli, logger) => {
     cli.command(CLI_COMMANDS.captureWebScreenshot, {
-        description: "Capture an explicitly approved visible page viewport",
+        description: "Capture one visible page viewport within the supplied origin scope",
         args: z.object({
             endpoint: z.string().describe("Configured loopback CDP HTTP endpoint"),
             targetId: z.string().describe("Target ID from list-browser-targets"),
@@ -94,17 +92,15 @@ const registerScreenshot = (cli, logger) => {
             ...browserScopeOptions,
         }),
         run: ({ args, options }) => logCliCommand(logger, "capture-web-screenshot", async () => {
-            const context = await browserContext("capture_web_screenshot");
-            if (!context.ok)
-                return context.error;
+            const context = browserContext();
             const parsed = captureWebScreenshotInputSchema.safeParse({
                 cdp_endpoint: args.endpoint,
-                allowed_origins: options.allowedOrigins ?? context.allowedBrowserOrigins,
+                allowed_origins: options.allowedOrigins,
                 target_id: args.targetId,
             });
             if (!parsed.success)
                 return inputError("capture_web_screenshot");
-            const result = await captureWebScreenshot(context.provider, context.authority, parsed.data);
+            const result = await captureWebScreenshot(context.provider, parsed.data);
             return result.ok ? result.value : browserCliError(result.error);
         }),
     });

package/dist/cliBrowserCommands.js

@@ -17,41 +17,37 @@ export const registerBrowserCommands = (cli, logger) => {
 };
 const registerTargetList = (cli, logger) => {
     cli.command(CLI_COMMANDS.listBrowserTargets, {
-        description: "List approved pages from a user-owned loopback CDP browser",
+        description: "List page targets from a selected loopback CDP browser, optionally filtered by origin",
         args: z.object({
             endpoint: z.string().describe("Configured loopback CDP HTTP endpoint"),
         }),
         options: z.object({ ...browserScopeOptions }),
         run: ({ args, options }) => logCliCommand(logger, "list-browser-targets", async () => {
-            const context = await browserContext("list_browser_targets");
-            if (!context.ok)
-                return context.error;
+            const context = browserContext();
             const parsed = listBrowserTargetsInputSchema.safeParse({
                 cdp_endpoint: args.endpoint,
-                allowed_origins: options.allowedOrigins ?? context.allowedBrowserOrigins,
+                allowed_origins: options.allowedOrigins,
             });
             if (!parsed.success)
                 return browserCliError(new AnalysisInputError("list_browser_targets"));
-            const result = await listBrowserTargets(context.provider, context.authority, parsed.data);
+            const result = await listBrowserTargets(context.provider, parsed.data);
             return result.ok ? result.value : browserCliError(result.error);
         }),
     });
 };
 const registerPageInspection = (cli, logger) => {
     cli.command(CLI_COMMANDS.inspectWebPage, {
-        description: "Passively inspect one approved page through CDP",
+        description: "Passively inspect one page through CDP, defaulting to its current origin",
         args: z.object({
             endpoint: z.string().describe("Configured loopback CDP HTTP endpoint"),
             targetId: z.string().describe("Target ID from list-browser-targets"),
         }),
         options: browserPageInspectionOptions,
         run: ({ args, options }) => logCliCommand(logger, "inspect-web-page", async () => {
-            const context = await browserContext("inspect_web_page");
-            if (!context.ok)
-                return context.error;
+            const context = browserContext();
             const parsed = inspectWebPageInputSchema.safeParse({
                 cdp_endpoint: args.endpoint,
-                allowed_origins: options.allowedOrigins ?? context.allowedBrowserOrigins,
+                allowed_origins: options.allowedOrigins,
                 target_id: args.targetId,
                 observation_ms: options.observationMs,
                 include_accessibility_text: options.includeAccessibilityText,
@@ -64,14 +60,14 @@ const registerPageInspection = (cli, logger) => {
             });
             if (!parsed.success)
                 return browserCliError(new AnalysisInputError("inspect_web_page"));
-            const result = await inspectWebPage(context.provider, context.authority, parsed.data);
+            const result = await inspectWebPage(context.provider, parsed.data);
             return result.ok ? result.value : browserCliError(result.error);
         }),
     });
 };
 const registerBundleAnalysis = (cli, logger) => {
     cli.command(CLI_COMMANDS.analyzeWebBundle, {
-        description: "Capture and statically analyze an approved page bundle",
+        description: "Capture and statically analyze a page bundle, defaulting to the selected target origin",
         args: z.object({
             endpoint: z.string().describe("Configured loopback CDP HTTP endpoint"),
             targetId: z.string().describe("Target ID from list-browser-targets"),
@@ -85,12 +81,10 @@ const registerBundleAnalysis = (cli, logger) => {
                 .describe("Fetch source maps referenced by captured scripts"),
         }),
         run: ({ args, options }) => logCliCommand(logger, "analyze-web-bundle", async () => {
-            const context = await browserContext("analyze_web_bundle");
-            if (!context.ok)
-                return context.error;
+            const context = browserContext();
             const parsed = analyzeWebBundleInputSchema.safeParse({
                 cdp_endpoint: args.endpoint,
-                allowed_origins: options.allowedOrigins ?? context.allowedBrowserOrigins,
+                allowed_origins: options.allowedOrigins,
                 target_id: args.targetId,
                 observation_ms: options.observationMs,
                 include_script_sources: true,
@@ -98,7 +92,7 @@ const registerBundleAnalysis = (cli, logger) => {
             });
             if (!parsed.success)
                 return browserCliError(new AnalysisInputError("analyze_web_bundle"));
-            const result = await analyzeWebBundle(context.provider, context.authority, parsed.data);
+            const result = await analyzeWebBundle(context.provider, parsed.data);
             return result.ok ? result.value : browserCliError(result.error);
         }),
     });
@@ -115,18 +109,16 @@ const registerObservationSession = (cli, logger) => {
             observationMs: observationDuration(10_000, 1),
         }),
         run: ({ args, options }) => logCliCommand(logger, "observe-web-session", async () => {
-            const context = await browserContext("observe_web_session");
-            if (!context.ok)
-                return context.error;
+            const context = browserContext();
             const parsed = observeWebSessionInputSchema.safeParse({
                 cdp_endpoint: args.endpoint,
-                allowed_origins: options.allowedOrigins ?? context.allowedBrowserOrigins,
+                allowed_origins: options.allowedOrigins,
                 target_id: args.targetId,
                 observation_ms: options.observationMs,
             });
             if (!parsed.success)
                 return browserCliError(new AnalysisInputError("observe_web_session"));
-            const result = await observeWebSession(context.provider, context.authority, parsed.data);
+            const result = await observeWebSession(context.provider, parsed.data);
             return result.ok ? result.value : browserCliError(result.error);
         }),
     });

package/dist/cliBrowserContext.js

@@ -1,28 +1,7 @@
-import { loadConfiguredPermissionAuthority } from "./application/PermissionConfiguration.js";
 import { CdpBrowserProvider } from "./browser/CdpBrowserProvider.js";
-import { parseConfig } from "./config.js";
-import { AnalysisCapabilityUnavailableError, projectAnalysisError, } from "./domain/errors.js";
-/** Load the configured passive browser authority and provider for one CLI operation. */
-export const browserContext = async (operation) => {
-    const config = parseConfig(process.env);
-    if (!config.ok)
-        return { ok: false, error: browserCliError(config.error) };
-    const policy = config.value.browserObservationPolicy;
-    if (policy.status === "disabled")
-        return {
-            ok: false,
-            error: browserCliError(new AnalysisCapabilityUnavailableError("rea-cdp-browser", operation, "browser observation is disabled; configure exact endpoints and origins before enabling it")),
-        };
-    const authority = await loadConfiguredPermissionAuthority(config.value);
-    if (!authority.ok)
-        return { ok: false, error: browserCliError(authority.error) };
-    return {
-        ok: true,
-        authority: authority.value,
-        provider: new CdpBrowserProvider(),
-        allowedBrowserOrigins: policy.allowedOrigins,
-    };
-};
+import { projectAnalysisError } from "./domain/errors.js";
+/** Build the passive browser provider; scope is supplied on each request. */
+export const browserContext = () => ({ provider: new CdpBrowserProvider() });
 /** Project a browser operation failure consistently across CLI command groups. */
 export const browserCliError = (error) => ({
     error: "Browser observation failed",

package/dist/cliBrowserScenarioCommands.js

@@ -1,19 +1,17 @@
 import { Cli } from "incur";
 import { z } from "zod";
 import { captureBrowserScenario } from "./application/BrowserScenarioCaptureService.js";
-import { loadConfiguredPermissionAuthority } from "./application/PermissionConfiguration.js";
 import { PlaywrightBrowserScenarioProvider } from "./browser/PlaywrightBrowserScenarioProvider.js";
 import { CLI_COMMANDS } from "./cliCommandNames.js";
 import { parseCliJsonInput } from "./cliJsonInput.js";
 import { logCliCommand } from "./cliLogging.js";
-import { parseConfig } from "./config.js";
 import { AnalysisInputError, projectAnalysisError } from "./domain/errors.js";
 import { browserScenarioSchema } from "./domain/browserScenario.js";
 const OPERATION = "capture_browser_scenario";
 /** Register the one-shot controlled browser scenario command. */
 export const registerBrowserScenarioCommands = (cli, logger) => {
     cli.command(CLI_COMMANDS.captureBrowserScenario, {
-        description: "Run one approved, bounded Playwright browser scenario and return Evidence",
+        description: "Run one bounded Playwright browser scenario and return Evidence",
         args: z.object({
             inputJson: z
                 .string()
@@ -26,13 +24,7 @@ export const registerBrowserScenarioCommands = (cli, logger) => {
             const scenario = browserScenarioSchema.safeParse(input.value);
             if (!scenario.success)
                 return cliError(new AnalysisInputError(OPERATION));
-            const config = parseConfig(process.env);
-            if (!config.ok)
-                return cliError(config.error);
-            const authority = await loadConfiguredPermissionAuthority(config.value);
-            if (!authority.ok)
-                return cliError(authority.error);
-            const result = await captureBrowserScenario(new PlaywrightBrowserScenarioProvider(), authority.value, scenario.data);
+            const result = await captureBrowserScenario(new PlaywrightBrowserScenarioProvider(), scenario.data);
             return result.ok ? result.value : cliError(result.error);
         }),
     });