rea-agents 6.2.0 → 6.4.0

package/dist/application/ClientRegistrationStatus.js

@@ -1,11 +1,13 @@
-import { effectiveClientServer, grokServerListedDisabled, parseClientConfiguration, } from "./ClientConfigurationDocument.js";
-import { access, readFile } from "node:fs/promises";
+import { readClientPolicyBlock } from "./GeminiClientSettings.js";
+import { effectiveClientConfiguration, readClientConfigurationFiles, } from "./ClientConfigurationFiles.js";
+import { clientServerForcedEnabled, clientServerListedDisabled, effectiveClientServer, } from "./ClientConfigurationDocument.js";
+import { access } from "node:fs/promises";
 import { resolve } from "node:path";
 import { z } from "zod";
 import { PRODUCT_IDENTITY } from "../identity.js";
 import { MCP_STARTUP_POLICY } from "../mcpStartupPolicy.js";
 import { isOwnedClientRegistrationCommand, npxRegistrationCommand, } from "./ClientRegistrationIdentity.js";
-import { manualRegistrationRemediation, supportedClients, } from "./SupportedClients.js";
+import { clientEvidencePaths, manualRegistrationRemediation, supportedClients, } from "./SupportedClients.js";
 const registrationSchema = z
     .object({
     command: z.string().min(1),
@@ -21,20 +23,18 @@ const registrationSchema = z
 /** Inspect supported client registrations without reading their environment. */
 export const readClientRegistrationStatuses = async (home, currentCommandPath = resolve(process.argv[1] ?? "unknown"), options = {}) => {
     const statuses = [];
-    for (const client of supportedClients(home, options.platform, options.environment === undefined
-        ? undefined
-        : {
-            APPDATA: options.environment.APPDATA,
-            CLAUDE_CONFIG_DIR: options.environment.CLAUDE_CONFIG_DIR,
-            CODEX_HOME: options.environment.CODEX_HOME,
-            COPILOT_HOME: options.environment.COPILOT_HOME,
-            GROK_HOME: options.environment.GROK_HOME,
-            OPENCODE_CONFIG: options.environment.OPENCODE_CONFIG,
-            SAND_DATA_ROOT: options.environment.SAND_DATA_ROOT,
-            XDG_CONFIG_HOME: options.environment.XDG_CONFIG_HOME,
-        })) {
-        if (!(await exists(client.markerPath)) &&
-            !(await exists(client.configPath)))
+    for (const client of supportedClients(home, options.platform, options.environment)) {
+        if (client.configPathError !== undefined) {
+            statuses.push({
+                client: client.name,
+                config_path: client.configPath,
+                command: [],
+                state: "invalid",
+                remediation: client.configPathError,
+            });
+            continue;
+        }
+        if (!(await clientEvidencePresent(client)))
             continue;
         const manualRemediation = manualRegistrationRemediation(client.name);
         if (client.format === "unsupported") {
@@ -49,8 +49,34 @@ export const readClientRegistrationStatuses = async (home, currentCommandPath =
             continue;
         }
         try {
-            const content = await readFile(client.configPath, "utf8");
-            const parsed = parseClientConfiguration(content, client.format);
+            const files = await readClientConfigurationFiles(client);
+            if (!files.ok) {
+                statuses.push({
+                    client: client.name,
+                    config_path: client.configPath,
+                    command: [],
+                    state: "invalid",
+                    remediation: files.error.detail,
+                });
+                continue;
+            }
+            const parsed = effectiveClientConfiguration(files.value);
+            if (parsed === undefined) {
+                statuses.push(unavailableStatus(client.name, client.configPath, "missing"));
+                continue;
+            }
+            const policy = await readClientPolicyBlock(client, parsed);
+            if (!policy.ok) {
+                statuses.push({
+                    client: client.name,
+                    config_path: client.configPath,
+                    command: [],
+                    state: "invalid",
+                    remediation: policy.error.detail,
+                });
+                continue;
+            }
+            const policyBlock = policy.value;
             const raw = effectiveClientServer(parsed, PRODUCT_IDENTITY.mcpServerKey);
             if (raw === undefined) {
                 statuses.push(unavailableStatus(client.name, client.configPath, "missing"));
@@ -61,11 +87,11 @@ export const readClientRegistrationStatuses = async (home, currentCommandPath =
                 registration.command,
                 ...registration.args,
             ];
-            statuses.push(configuredStatus(client.name, client.configPath, command, registrationAligned(registration, client, currentCommandPath, options.platform ?? process.platform) &&
-                !(client.format === "grok" &&
-                    grokServerListedDisabled(parsed.document, PRODUCT_IDENTITY.mcpServerKey))
+            statuses.push(configuredStatus(client.name, client.configPath, command, registrationAligned(registration, client, currentCommandPath, options.platform ?? process.platform, clientServerForcedEnabled(parsed, PRODUCT_IDENTITY.mcpServerKey)) &&
+                !clientServerListedDisabled(parsed, PRODUCT_IDENTITY.mcpServerKey) &&
+                policyBlock === undefined
                 ? "aligned"
-                : "stale"));
+                : "stale", policyBlock));
         }
         catch (cause) {
             statuses.push(unavailableStatus(client.name, client.configPath, isMissing(cause) ? "missing" : "invalid"));
@@ -73,9 +99,10 @@ export const readClientRegistrationStatuses = async (home, currentCommandPath =
     }
     return statuses.sort((left, right) => left.client.localeCompare(right.client));
 };
-const registrationAligned = (registration, client, currentCommandPath, platform) => {
+const registrationAligned = (registration, client, currentCommandPath, platform, forcedEnabled = false) => {
     const command = [registration.command, ...registration.args];
-    if (registration.disabled === true || registration.enabled === false)
+    if ((client.format !== "grok" && registration.disabled === true) ||
+        (registration.enabled === false && !forcedEnabled))
         return false;
     if (!isOwnedClientRegistrationCommand(command, currentCommandPath))
         return false;
@@ -85,6 +112,11 @@ const registrationAligned = (registration, client, currentCommandPath, platform)
         return false;
     if (client.format === "vscode" && registration.type !== "stdio")
         return false;
+    // OMP and Pi infer stdio for a command entry without an explicit type.
+    if ((client.format === "omp" || client.format === "pi") &&
+        registration.type !== undefined &&
+        registration.type !== "stdio")
+        return false;
     if (client.format === "copilot_cli" &&
         (registration.type !== "stdio" ||
             JSON.stringify(registration.tools) !== JSON.stringify(["*"])))
@@ -127,12 +159,22 @@ const parseRegistration = (value, client) => {
         throw new TypeError("Expected an stdio registration");
     if (client.format === "commandcode" && registration.transport !== "stdio")
         throw new TypeError("Expected an stdio registration");
+    if ((client.format === "omp" || client.format === "pi") &&
+        registration.type !== undefined &&
+        registration.type !== "stdio")
+        throw new TypeError("Expected an stdio registration");
     return registration;
 };
 const remediation = "Run rea setup to refresh this registration, then restart the client.";
-const configuredStatus = (client, configPath, command, state) => state === "aligned"
+const configuredStatus = (client, configPath, command, state, policyRemediation) => state === "aligned"
     ? { client, config_path: configPath, command, state, remediation: null }
-    : { client, config_path: configPath, command, state, remediation };
+    : {
+        client,
+        config_path: configPath,
+        command,
+        state,
+        remediation: policyRemediation ?? remediation,
+    };
 const unavailableStatus = (client, configPath, state) => ({
     client,
     config_path: configPath,
@@ -140,6 +182,12 @@ const unavailableStatus = (client, configPath, state) => ({
     state,
     remediation,
 });
+const clientEvidencePresent = async (client) => {
+    for (const path of clientEvidencePaths(client))
+        if (await exists(path))
+            return true;
+    return false;
+};
 const exists = async (path) => {
     if (path === undefined)
         return false;

package/dist/application/DirectAnalysis.js

@@ -43,7 +43,7 @@ export const runProviderAnalysis = async (dependencies, ...[path, tool, argument
     }));
 /** Execute managed metadata inspection in an isolated managed-only session. */
 export const runManagedProviderExecution = async (dependencies, path, tool, signal) => withProcessCancellation(signal, async (operationSignal) => {
-    const session = dependencies.createManagedBinarySession();
+    const session = await dependencies.createManagedBinarySession();
     return withSessionCleanup(session, async () => {
         const opened = await session.open(path, { signal: operationSignal });
         if (!opened.ok)
@@ -70,11 +70,12 @@ const runAnalysis = async (dependencies, path, tool, arguments_, options) => {
     const config = dependencies.readConfiguration();
     if (!config.ok)
         return cliError(config.error);
-    const session = dependencies.createBinarySession(config.value, logger);
+    const session = await dependencies.createBinarySession(config.value, logger);
     return withSessionCleanup(session, async () => {
         const prepared = await prepareSnapshot({
             path,
             snapshotPath,
+            signal,
             ...(options.formatHint === undefined
                 ? {}
                 : { formatHint: options.formatHint }),
@@ -144,7 +145,7 @@ const runAnalysis = async (dependencies, path, tool, arguments_, options) => {
         if (evidence !== undefined) {
             const recorded = session.recordEvidence(evidence);
             if (!recorded.ok)
-                return cliError(recorded.error);
+                return cliError(recorded.error.retainPartialObservation(evidence));
             if (isWorkflowEvidenceTool(tool)) {
                 const unknowns = recordWorkflowUnknowns({
                     name: tool,
@@ -153,7 +154,7 @@ const runAnalysis = async (dependencies, path, tool, arguments_, options) => {
                     recordUnknown: (unknown) => session.recordUnknown(unknown),
                 });
                 if (!unknowns.ok)
-                    return cliError(unknowns.error);
+                    return cliError(unknowns.error.retainPartialObservation(evidence));
             }
         }
         if (isWorkflowEvidenceTool(tool) &&
@@ -165,7 +166,7 @@ const runAnalysis = async (dependencies, path, tool, arguments_, options) => {
             if (workflowRecord !== undefined) {
                 const recorded = session.recordWorkflowSnapshot(workflowRecord);
                 if (!recorded.ok)
-                    return cliError(recorded.error);
+                    return cliError(recorded.error.retainPartialObservation(evidence));
             }
         }
         if (tool !== "trace_native_ui_action" &&
@@ -173,10 +174,10 @@ const runAnalysis = async (dependencies, path, tool, arguments_, options) => {
             evidence !== undefined) {
             const snapshot = session.exportAnalysisSnapshot();
             if (!snapshot.ok)
-                return cliError(snapshot.error);
+                return cliError(snapshot.error.retainPartialObservation(evidence));
             const written = await writeAnalysisSnapshot(snapshot.value, snapshotPath, true);
             if (!written.ok)
-                return cliError(written.error);
+                return cliError(written.error.retainPartialObservation(evidence));
         }
         return output;
     }, directAnalysisCleanupFailure);
@@ -266,7 +267,12 @@ const prepareSnapshot = async (options) => {
     const loaded = await readAnalysisSnapshot(snapshotPath);
     if (!loaded.ok)
         return loaded;
-    const target = await parseBinaryTarget(path, process.cwd(), process.arch, undefined, options.formatHint);
+    const target = await parseBinaryTarget(path, {
+        signal: options.signal,
+        ...(options.formatHint === undefined
+            ? {}
+            : { formatHint: options.formatHint }),
+    });
     if (!target.ok)
         return target;
     if (!snapshotMatchesTarget(loaded.value.target, target.value))

package/dist/application/DirectAnalysisCleanup.js

@@ -3,7 +3,7 @@ import { projectAnalysisError } from "../domain/analysisErrorProjection.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";
 import { ProviderAdapterError } from "../domain/providerAdapterError.js";
 import { err } from "../domain/result.js";
-import { analysisErrorWithCleanupFailure } from "./binary/AnalysisClientCleanup.js";
+import { analysisErrorWithCleanupFailure } from "../domain/analysisErrorCleanup.js";
 /** Await one-shot cleanup and retain either the outcome or both failures. */
 export const withSessionCleanup = async (session, operation, onCleanupFailure) => {
     let value;
@@ -39,7 +39,6 @@ export const directAnalysisCleanupFailure = (output, error) => {
                         "execution_failure" in primary.data.details
                         ? (primary.data.details.execution_failure ?? primary.data.code)
                         : primary.data.code,
-                    primary_error: projection,
                     cleanup_error: cleanup,
                 },
             };

package/dist/application/DirectAnalysisStatus.js

@@ -2,11 +2,12 @@ import { projectAnalysisError } from "../domain/analysisErrorProjection.js";
 import { jsonObjectSchema } from "../domain/jsonValue.js";
 import { createServerIdentity } from "../serverIdentity.js";
 import { silentLogger } from "../logger.js";
-const runSessionStatus = async (dependencies, logger = silentLogger) => {
+/** Read target-free provider status and operation availability. */
+export const runSessionStatus = async (dependencies, logger = silentLogger) => {
     const config = dependencies.readConfiguration();
     if (!config.ok)
         return { error: projectAnalysisError(config.error) };
-    const session = dependencies.createBinarySession(config.value, logger);
+    const session = await dependencies.createBinarySession(config.value, logger);
     try {
         return {
             ...jsonObjectSchema.parse(session.status()),
@@ -19,7 +20,3 @@ const runSessionStatus = async (dependencies, logger = silentLogger) => {
         await session.close();
     }
 };
-/** List binary-session provider candidates and auxiliary operation availability. */
-export const runProviderStatus = (dependencies, logger = silentLogger) => runSessionStatus(dependencies, logger);
-/** List binary-session operation descriptors; this is not the full MCP catalog. */
-export const runCapabilityStatus = (dependencies, logger = silentLogger) => runSessionStatus(dependencies, logger);

package/dist/application/Doctor.js

@@ -1,13 +1,14 @@
 import { constants } from "node:fs";
-import { access, readFile, readdir } from "node:fs/promises";
+import { access, readdir, stat } from "node:fs/promises";
 import { homeDirectoryFromEnvironment } from "../config/homeDirectory.js";
 import { join } from "node:path";
 import { analysisErrorRemediationAction } from "../domain/analysisErrorPresentation.js";
+import { BinaryTargetError } from "../domain/configurationErrors.js";
 import { parseBinaryTarget } from "./BinaryTargetResolver.js";
 import { execFileOutput } from "../process/ExecFileOutput.js";
 import { installedCaskAppdir, probeHomebrew } from "./homebrew.js";
 import { linuxHopperBinarySupported, linuxSharedLibrariesAvailable, readLinuxDistribution, } from "./LinuxHopper.js";
-import { canonicalSkillNeedsInstall } from "./SetupSkill.js";
+import { readInstalledSkillIdentity, } from "./SetupSkill.js";
 import { CATALOG_IDENTITY } from "../catalogIdentity.js";
 import { PRODUCT_IDENTITY, SDK_IDENTITY } from "../identity.js";
 import { readClientRegistrationStatuses, } from "./ClientRegistrationStatus.js";
@@ -21,8 +22,9 @@ export const DOCTOR_PROVIDER_IDS = ["hopper", "ghidra", "ida"];
  * or an agent consuming the structured result.
  */
 export const runDoctor = async (target, host = systemDoctorHost(), requestedScope) => {
+    const scope = normalizeDoctorScope(requestedScope, target);
     const { checks: diagnosticChecks, hopperPath, providerInspections, } = await collectDoctorDiagnostics(target, host);
-    const identity = await collectDoctorIdentity(host);
+    const identity = await collectDoctorIdentity(host, scope);
     const checks = [...diagnosticChecks, ...identity.checks];
     const providers = {
         hopperAvailable: hopperPath !== undefined &&
@@ -33,7 +35,6 @@ export const runDoctor = async (target, host = systemDoctorHost(), requestedScop
         providerInspections,
     };
     const environmentHealthy = doctorHealthy(checks, providers);
-    const scope = normalizeDoctorScope(requestedScope, target);
     const scoped = scopeDoctorChecks({
         checks,
         registrations: identity.value.registrations,
@@ -53,11 +54,14 @@ export const runDoctor = async (target, host = systemDoctorHost(), requestedScop
         identity: identity.value,
     };
 };
-const collectDoctorIdentity = async (host) => {
+const collectDoctorIdentity = async (host, scope) => {
     const installationPaths = (await host.installationPaths?.()) ?? [];
-    const installedSkillIdentity = await host.installedSkillIdentity?.();
-    const skillAligned = skillIdentityAligned(installedSkillIdentity);
     const registrations = (await host.clientRegistrations?.()) ?? [];
+    const skillClientIds = scope.mode === "audit-wide"
+        ? registrations.map(({ client }) => client)
+        : scope.clients;
+    const installedSkillIdentity = await host.installedSkillIdentity?.(skillClientIds);
+    const skillAligned = skillIdentityAligned(installedSkillIdentity);
     return {
         checks: [
             ...(skillAligned ? [] : [skillIdentityCheck(installedSkillIdentity)]),
@@ -81,7 +85,6 @@ const collectDoctorIdentity = async (host) => {
             skill: {
                 installed_version: installedSkillIdentity?.version ?? null,
                 installed_tool_count: installedSkillIdentity?.toolCount ?? null,
-                installed_catalog_digest: installedSkillIdentity?.catalogDigest ?? null,
                 state: installedSkillIdentity === undefined
                     ? "missing"
                     : skillAligned
@@ -137,10 +140,16 @@ export const systemDoctorHost = (options = {}) => {
         macosVersion: () => readMacosVersion(hostExecFileOutput, commandEnvironment),
         linuxDistribution: readLinuxDistribution,
         async validTarget(path) {
-            return (await parseBinaryTarget(path, process.cwd(), architecture)).ok;
+            return (await parseBinaryTarget(path, {
+                cwd: process.cwd(),
+                hostArchitecture: architecture,
+            })).ok;
         },
         async inspectTarget(path) {
-            const result = await parseBinaryTarget(path, process.cwd(), architecture);
+            const result = await parseBinaryTarget(path, {
+                cwd: process.cwd(),
+                hostArchitecture: architecture,
+            });
             if (result.ok)
                 return {
                     name: "target",
@@ -149,18 +158,19 @@ export const systemDoctorHost = (options = {}) => {
                     detail: path,
                 };
             const error = result.error;
+            const targetError = error instanceof BinaryTargetError ? error : undefined;
             return {
                 name: "target",
                 ok: false,
-                classification: error.constraint === "directory_requires_file"
+                classification: targetError?.constraint === "directory_requires_file"
                     ? "unsupported_target"
                     : "config_drift",
                 detail: path,
                 details: {
-                    reason: error.reason,
-                    ...(error.constraint === undefined
+                    reason: targetError?.reason ?? error.message,
+                    ...(targetError?.constraint === undefined
                         ? {}
-                        : { constraint: error.constraint }),
+                        : { constraint: targetError.constraint }),
                 },
                 remediation: analysisErrorRemediationAction(error),
             };
@@ -218,7 +228,7 @@ export const systemDoctorHost = (options = {}) => {
                 return [];
             }
         },
-        installedSkillIdentity: () => installedSkillIdentity(homeDirectory),
+        installedSkillIdentity: (clientIds) => readInstalledSkillIdentity(homeDirectory, clientIds, environment, platform),
         clientRegistrations: () => readClientRegistrationStatuses(homeDirectory, undefined, {
             platform,
             environment,
@@ -238,6 +248,8 @@ const readMacosVersion = async (run, options) => {
 const executableAvailable = async (path, platform, run, options) => {
     try {
         await access(path, constants.X_OK);
+        if (!(await stat(path)).isFile())
+            return false;
         if (platform !== "linux")
             return true;
         const linked = await run("ldd", [path], options);
@@ -272,25 +284,6 @@ const manualHopperPaths = async (home) => {
     }
     return paths;
 };
-const readInstalledSkill = (home) => readFile(join(home, ".agents/skills", PRODUCT_IDENTITY.skillName, "SKILL.md"), "utf8");
-const installedSkillIdentity = async (home) => {
-    try {
-        const content = await readInstalledSkill(home);
-        const countText = /^\s{2}tool_count:\s*(\d+)\s*$/mu.exec(content)?.[1];
-        return {
-            canonical: !(await canonicalSkillNeedsInstall(home)),
-            version: /^\s{2}version:\s*"([^"]+)"\s*$/mu.exec(content)?.[1] ?? null,
-            toolCount: countText === undefined ? null : Number.parseInt(countText, 10),
-            catalogDigest: /^\s{2}catalog_digest:\s*"([a-f0-9]{64})"\s*$/mu.exec(content)?.[1] ??
-                null,
-        };
-    }
-    catch (cause) {
-        // best-effort cleanup: optional skill probing; failure means unknown.
-        void cause;
-        return undefined;
-    }
-};
 const uniqueLines = (value) => [
     ...new Set(value
         .split(/\r?\n/u)

package/dist/application/DoctorDiagnostics.js

@@ -65,7 +65,7 @@ const hostCheck = async (host) => {
             ? `${host.platform} ${host.architecture}`
             : `${linuxDistribution.id} ${linuxDistribution.versionId ?? "unknown"}`);
     return check("host", supported, detail, {
-        remediation: "REA supports macOS 12+, Ubuntu 24.04+, Fedora 41+, 64-bit Arch Linux, CachyOS, and the experimental Windows x64 Ghidra P0 boundary.",
+        remediation: "REA supports macOS 12+, Ubuntu 24.04+, Fedora 41+, Nobara 44+, 64-bit Arch Linux, CachyOS, Omarchy, and the experimental Windows x64 Ghidra P0 boundary.",
         classification: "unsupported_host",
     });
 };

package/dist/application/EvidenceBundleCommands.js

@@ -3,22 +3,17 @@ import {} from "../domain/analysisErrorBase.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";
 import { err, ok } from "../domain/result.js";
 import { compareBundles } from "../domain/bundleComparison.js";
-import { EvidenceLedger } from "./investigation/EvidenceLedger.js";
 import { readEvidenceBundle, writeEvidenceBundle, } from "./EvidenceBundleFiles.js";
-/** Validate and merge one bundle using the session Evidence ledger. */
+/** Validate a standalone bundle and report its complete record/revision counts. */
 export const importEvidenceBundleCommand = async (path) => {
     const loaded = await readEvidenceBundle(path);
     if (!loaded.ok)
         return loaded;
-    const ledger = createLedger();
-    const imported = ledger.import(loaded.value);
-    return imported.ok
-        ? ok({
-            imported: imported.value.recordsAdded,
-            unknowns_added: imported.value.unknownsAdded,
-            total: ledger.export().records.length,
-        })
-        : imported;
+    return ok({
+        imported: loaded.value.records.length,
+        unknowns_added: loaded.value.unknowns.length,
+        total: loaded.value.records.length,
+    });
 };
 /** Validate a source bundle and atomically export canonical bytes. */
 export const exportEvidenceBundleCommand = async (sourcePath, outputPath, overwrite) => {
@@ -46,7 +41,6 @@ export const compareEvidenceBundlesCommand = async (input) => {
         }));
     }
 };
-const createLedger = () => new EvidenceLedger();
 const projectWrite = (bundle, written) => written.ok
     ? ok({
         path: written.value.path,

package/dist/application/EvidenceBundleFiles.js

@@ -1,7 +1,7 @@
 import { describeEvidenceBundleFailure, describeValidationFailure, parseEvidenceBundle, } from "../domain/evidenceBundle.js";
 import { EvidenceFileError, EvidenceIntegrityError, } from "../domain/evidenceErrors.js";
 import { err, ok } from "../domain/result.js";
-import { AnalysisCancelledError } from "../domain/analysisErrorCore.js";
+import { AnalysisCancelledError, } from "../domain/analysisErrorCore.js";
 import { parseProcessCapture } from "../domain/process/processCaptureParsing.js";
 import { bufferedJsonParts, canonicalJsonParts, } from "../domain/jsonSerialization.js";
 import { readJsonFile, writeTextParts } from "./JsonFiles.js";

package/dist/application/GeminiClientSettings.js

@@ -0,0 +1,139 @@
+import { realpath } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+import { stripComments } from "jsonc-parser";
+import { z } from "zod";
+import { err, ok } from "../domain/result.js";
+import { PRODUCT_IDENTITY } from "../identity.js";
+import { npxRegistrationCommand } from "./ClientRegistrationIdentity.js";
+import { clientConfigurationValuesEqual, clientRegistrationEntry, geminiServerPolicyBlock, parseGeminiMcpPolicy, } from "./ClientConfigurationDocument.js";
+import { readConfigurationFile, readConfigurationText, } from "./ClientConfigurationFiles.js";
+const folderTrustSchema = z
+    .object({
+    security: z
+        .object({
+        folderTrust: z
+            .object({ enabled: z.boolean().optional() })
+            .passthrough()
+            .optional(),
+    })
+        .passthrough()
+        .optional(),
+})
+    .passthrough();
+const trustRulesSchema = z.record(z.string(), z.enum(["TRUST_FOLDER", "TRUST_PARENT", "DO_NOT_TRUST"]));
+const sourceFailure = (path, cause) => ({
+    kind: "malformed",
+    path,
+    detail: `Gemini settings in ${path} are malformed: ${cause instanceof Error ? cause.message : String(cause)}`,
+});
+// Gemini resolves symlinks when possible and compares macOS/Windows paths without case.
+const normalizedPath = async (path, platform) => {
+    const physical = await realpath(path).catch(() => path);
+    const absolute = resolve(physical).replaceAll("\\", "/");
+    return platform === "win32" || platform === "darwin"
+        ? absolute.toLowerCase()
+        : absolute;
+};
+const workspaceTrusted = async (settings, sources) => {
+    let enabled = true;
+    for (const { path, document } of sources) {
+        const parsed = folderTrustSchema.safeParse(document.document);
+        if (!parsed.success)
+            return err(sourceFailure(path, parsed.error));
+        enabled = parsed.data.security?.folderTrust?.enabled ?? enabled;
+    }
+    if (settings.trustOverride !== undefined)
+        return ok(settings.trustOverride);
+    if (!enabled)
+        return ok(true);
+    const text = await readConfigurationText(settings.trustedFoldersPath);
+    if (!text.ok)
+        return text;
+    if (text.value === undefined)
+        return ok(false);
+    let rules;
+    try {
+        // Gemini strips comments, but rejects trailing commas, BOMs and invalid trust levels.
+        rules = trustRulesSchema.parse(JSON.parse(stripComments(text.value)));
+    }
+    catch (cause) {
+        return err(sourceFailure(settings.trustedFoldersPath, cause));
+    }
+    const workspace = await normalizedPath(settings.workspaceDirectory, settings.platform);
+    let longest = -1;
+    let trusted = false;
+    for (const [path, level] of Object.entries(rules)) {
+        const effective = await normalizedPath(level === "TRUST_PARENT" ? dirname(path) : path, settings.platform);
+        if ((workspace === effective ||
+            workspace.startsWith(effective.endsWith("/") ? effective : `${effective}/`)) &&
+            path.length > longest) {
+            longest = path.length;
+            trusted = level !== "DO_NOT_TRUST";
+        }
+    }
+    return ok(trusted);
+};
+/** Check effective Gemini scopes while preserving their authority and source identity. */
+export const readClientPolicyBlock = async (client, userDocument, desiredRegistration) => {
+    if (client.name !== "gemini_cli" || client.geminiSettings === undefined)
+        return ok(undefined);
+    const settings = client.geminiSettings;
+    const sources = [];
+    const higher = [];
+    for (const path of [
+        settings.defaultsPath,
+        client.configPath,
+        settings.systemPath,
+    ]) {
+        const parsed = path === client.configPath && userDocument !== undefined
+            ? ok(userDocument)
+            : await readConfigurationFile(path, "json");
+        if (!parsed.ok)
+            return parsed;
+        if (parsed.value !== undefined)
+            sources.push({ path, document: parsed.value });
+    }
+    const workspace = await normalizedPath(settings.workspaceDirectory, settings.platform);
+    const home = await normalizedPath(dirname(dirname(client.configPath)), settings.platform);
+    if (workspace !== home) {
+        const path = resolve(settings.workspaceDirectory, ".gemini", "settings.json");
+        const document = await readConfigurationFile(path, "json");
+        if (!document.ok)
+            return document;
+        if (document.value !== undefined) {
+            const trusted = await workspaceTrusted(settings, sources);
+            if (!trusted.ok)
+                return trusted;
+            if (trusted.value) {
+                const source = { path, document: document.value };
+                const systemIndex = sources.findIndex((item) => item.path === settings.systemPath);
+                sources.splice(systemIndex < 0 ? sources.length : systemIndex, 0, source);
+                higher.push(source);
+            }
+        }
+    }
+    const system = sources.find(({ path }) => path === settings.systemPath);
+    if (system !== undefined)
+        higher.push(system);
+    const policies = [];
+    for (const { path, document } of sources) {
+        try {
+            policies.push(parseGeminiMcpPolicy(document));
+        }
+        catch (cause) {
+            return err(sourceFailure(path, cause));
+        }
+    }
+    const policy = geminiServerPolicyBlock(policies, PRODUCT_IDENTITY.mcpServerKey);
+    if (policy !== undefined)
+        return ok(`${policy} Settings sources: ${sources.map(({ path }) => path).join(", ")}.`);
+    // mcpServers uses shallow merge: the entire same-name definition is replaced.
+    const override = higher.findLast(({ document }) => Object.hasOwn(document.servers, PRODUCT_IDENTITY.mcpServerKey));
+    const desired = desiredRegistration ??
+        userDocument?.servers[PRODUCT_IDENTITY.mcpServerKey] ??
+        clientRegistrationEntry("json", npxRegistrationCommand(), {});
+    if (override !== undefined &&
+        !clientConfigurationValuesEqual(override.document.servers[PRODUCT_IDENTITY.mcpServerKey], desired))
+        return ok(`Gemini mcpServers.${PRODUCT_IDENTITY.mcpServerKey} in ${override.path} overrides the user registration. Review that settings file before rerunning setup; REA does not modify system or workspace settings.`);
+    return ok(undefined);
+};