fix(tools)!: simplify direct invocation and harden boundary contracts (#555)

Remove REA permission grants, scope ceilings, approval confirmations, and inert settings. Preserve selected local evidence, accept caller-chosen commands and paths, and report actual runtime failures.

Harden provider results, schema serialization, snapshot evidence binding, archive paths, source maps, native screenshots, managed EH parsing, and cancellation cleanup. Regenerate tool metadata and document direct invocation.

BREAKING CHANGE: Removed permission configuration and policy commands, approval fields, filesystem scope inputs, and fixed confirmation options. Process capture inherits the host environment and accepts command names; callers must refresh tool schemas and migrate removed fields.

src/cliJavaScriptRuntimeCommands.ts

@@ -4,21 +4,15 @@ import {
   listJavaScriptRuntimeTargets,
   observeJavaScriptRuntime,
 } from "./application/JavaScriptRuntimeObservationService.js";
-import { loadConfiguredPermissionAuthority } from "./application/PermissionConfiguration.js";
 import { V8InspectorProvider } from "./browser/V8InspectorProvider.js";
 import { CLI_COMMANDS } from "./cliCommandNames.js";
 import { logCliCommand } from "./cliLogging.js";
-import { parseConfig } from "./config.js";
 import {
   javascriptRuntimeKindSchema,
   listJavaScriptRuntimeTargetsInputSchema,
   observeJavaScriptRuntimeInputSchema,
 } from "./domain/javascriptRuntimeObservation.js";
-import {
-  AnalysisCapabilityUnavailableError,
-  AnalysisInputError,
-  projectAnalysisError,
-} from "./domain/errors.js";
+import { AnalysisInputError, projectAnalysisError } from "./domain/errors.js";
 import type { JsonValue } from "./domain/jsonValue.js";
 import type { Logger } from "./logger.js";
 
@@ -40,7 +34,6 @@ const observeOptionsSchema = z.object({
 export const registerJavaScriptRuntimeObservationCommands = (
   cli: ReturnType<typeof Cli.create>,
   logger: Logger,
-  environment: Readonly<Record<string, string | undefined>> = process.env,
 ): void => {
   cli.command(CLI_COMMANDS.listJavaScriptRuntimeTargets, {
     description: "List Node/Electron V8 Inspector targets",
@@ -52,10 +45,7 @@ export const registerJavaScriptRuntimeObservationCommands = (
         logger,
         CLI_COMMANDS.listJavaScriptRuntimeTargets,
         async () => {
-          const context = await runtimeContext(
-            "list_javascript_runtime_targets",
-          );
-          if (!context.ok) return context.error;
+          const context = runtimeContext();
           const parsed = listJavaScriptRuntimeTargetsInputSchema.safeParse({
             inspector_endpoint: args.endpoint,
           });
@@ -63,7 +53,6 @@ export const registerJavaScriptRuntimeObservationCommands = (
             return inputError("list_javascript_runtime_targets");
           const result = await listJavaScriptRuntimeTargets(
             context.provider,
-            context.authority,
             parsed.data,
           );
           return result.ok ? result.value : cliError(result.error);
@@ -82,11 +71,7 @@ export const registerJavaScriptRuntimeObservationCommands = (
     options: observeOptionsSchema,
     run: ({ args, options }) =>
       logCliCommand(logger, CLI_COMMANDS.observeJavaScriptRuntime, async () => {
-        const context = await runtimeContext(
-          "observe_javascript_runtime",
-          environment,
-        );
-        if (!context.ok) return context.error;
+        const context = runtimeContext();
         const parsed = observeJavaScriptRuntimeInputSchema.safeParse({
           inspector_endpoint: args.endpoint,
           target_id: args.targetId,
@@ -96,7 +81,6 @@ export const registerJavaScriptRuntimeObservationCommands = (
         if (!parsed.success) return inputError("observe_javascript_runtime");
         const result = await observeJavaScriptRuntime(
           context.provider,
-          context.authority,
           parsed.data,
         );
         return result.ok ? result.value : cliError(result.error);
@@ -104,33 +88,7 @@ export const registerJavaScriptRuntimeObservationCommands = (
   });
 };
 
-const runtimeContext = async (
-  operation: string,
-  environment: Readonly<Record<string, string | undefined>> = process.env,
-) => {
-  const config = parseConfig(environment);
-  if (!config.ok) return { ok: false as const, error: cliError(config.error) };
-  const policy = config.value.v8InspectorObservationPolicy;
-  if (policy.status === "disabled")
-    return {
-      ok: false as const,
-      error: cliError(
-        new AnalysisCapabilityUnavailableError(
-          "rea-v8-inspector",
-          operation,
-          "V8 Inspector observation is disabled; enable REA_V8_INSPECTOR_OBSERVE_ENABLED to authorize loopback endpoints",
-        ),
-      ),
-    };
-  const authority = await loadConfiguredPermissionAuthority(config.value);
-  if (!authority.ok)
-    return { ok: false as const, error: cliError(authority.error) };
-  return {
-    ok: true as const,
-    authority: authority.value,
-    provider: new V8InspectorProvider(),
-  };
-};
+const runtimeContext = () => ({ provider: new V8InspectorProvider() });
 
 const inputError = (operation: string): JsonValue =>
   cliError(new AnalysisInputError(operation));