@adeildo/pi-ask-permission 4.0.0

package/CONTRIBUTING.md

@@ -0,0 +1,43 @@
+# Contributing
+
+## Setup
+
+This package lives in the [pi-harness](https://github.com/felipeadeildo/pi-harness) monorepo. Setup, scripts, hooks and releases are shared and described in the [root CONTRIBUTING.md](../../CONTRIBUTING.md). Run every command from the repository root.
+
+To run only this package's tests:
+
+```bash
+bun test ./packages/ask-permission
+```
+
+## Layout
+
+```text
+src/
+  index.ts      # wiring only
+  pi/           # pi boundary: events, commands, provider, session
+  core/         # policy and judging, no pi and no TUI
+    config/     # schema, decode, store, patterns
+    judge/      # pipeline, compose, request, policy, backends
+  ui/           # TUI: dialog, selector, settings, judge entry
+  util/         # decoders and primitives
+```
+
+`core/` never imports `pi/` or `ui/`. The permission pipeline is in `pi/events.ts`, the judging pipeline in `core/judge`.
+
+All untrusted input (config, grants, model answers) goes through `util/decode.ts`, the only module that inspects `typeof`. Decoders return a value or a list of problems, and never throw.
+
+## Imports
+
+Use `#core`, `#ui`, `#pi`, `#util`, and `#identity`, declared in `package.json` `imports`. They resolve in tsc, Bun, and pi's jiti loader, so moving a file does not rewrite relative paths. tsconfig `paths` only works while pi runs from source, so it is not used.
+
+## Adding a config key
+
+1. Add the type and the default in `core/config/schema.ts`.
+2. Declare the leaf in `core/config/settings.ts`, with the decoder and the row it shows on the settings screen. A missing key takes the default, and an invalid one is ignored with a warning.
+3. Read it in `readConfig` and write it in `toEntries`, so saving the settings keeps it.
+4. Add a test in `test/config.test.ts`. A round trip through `writeConfig` and `readConfig` is what proves the mapping.
+
+## Open ideas
+
+The judge sees one call, the policy, and the project root. It does not see the session goal. Sending a short goal summary would make the verdict more accurate. The last user message alone was a poor source, often just "continue", and gating on it escalated most calls. A summary assembled from the session would fix the signal without the false positives.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Felipe Adeildo
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,274 @@
+<h1 align="center">@adeildo/pi-ask-permission</h1>
+
+<p align="center">
+  <a href="https://github.com/felipeadeildo/pi-harness/actions/workflows/ci.yml"><img src="https://github.com/felipeadeildo/pi-harness/actions/workflows/ci.yml/badge.svg" alt="CI"></a>
+  <a href="https://www.npmjs.com/package/@adeildo/pi-ask-permission"><img src="https://img.shields.io/npm/v/@adeildo/pi-ask-permission" alt="npm"></a>
+  <a href="https://www.npmjs.com/package/@adeildo/pi-ask-permission"><img src="https://img.shields.io/npm/dm/@adeildo/pi-ask-permission" alt="downloads"></a>
+  <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-blue.svg" alt="license"></a>
+  <a href="https://www.npmjs.com/package/@adeildo/pi-ask-permission"><img src="https://img.shields.io/badge/provenance-signed-success" alt="provenance"></a>
+  <a href="https://pi.dev/packages/@adeildo/pi-ask-permission"><img src="https://img.shields.io/badge/pi--package-6E56CF" alt="pi package"></a>
+  <a href="https://pi.dev"><img src="https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2Fraw.githubusercontent.com%2Ffelipeadeildo%2Fpi-harness%2Fmain%2Fpackage.json&query=%24.devDependencies%5B%22%40earendil-works%2Fpi-coding-agent%22%5D&label=pi%20SDK&color=6E56CF" alt="pi SDK"></a>
+</p>
+
+Pi runs every tool call without asking. This extension asks first.
+
+Answer `yes`, `always yes`, or `deny`, and add a note if you want. The note reaches the model with the result, so denying `npm install` with `use pnpm instead` corrects the agent without stopping it.
+
+<p align="center">
+  <img src="https://raw.githubusercontent.com/felipeadeildo/pi-harness/main/packages/ask-permission/assets/preview.png" alt="The permission dialog for npm install, with the judge card above it and a note typed on the deny row: use pnpm instead." width="860">
+</p>
+
+## Install
+
+```bash
+pi install npm:@adeildo/pi-ask-permission
+```
+
+Then start pi as usual. There is nothing to configure.
+
+`pi-ask-permission` on npm is this same extension under an older name, and it reads the same config, grants and sessions. To switch:
+
+```bash
+pi remove npm:pi-ask-permission
+pi install npm:@adeildo/pi-ask-permission
+```
+
+## First run
+
+Ask the agent to do something that writes, like `run the tests`. The dialog opens before the command runs:
+
+```
+╭─ permission · bash ──────────────────────────────────╮
+│ pnpm test                                            │
+│                                                      │
+│ ❯ 1  yes                                             │
+│   2  always yes                                      │
+│   3  deny                                            │
+│                                                      │
+│ ↑↓ or 1-3 pick   enter confirm   tab note   esc deny │
+╰──────────────────────────────────────────────────────╯
+```
+
+`enter` approves. `esc` denies. `tab` opens a note on the highlighted row.
+
+Reads inside the project never ask. `read`, `grep`, `find`, `ls`, and bash commands that only read, like `cat`, `git log`, or `rg`, run on their own. An `edit` or `write` shows the diff it would make.
+
+## Everyday use
+
+### Stop answering the same question
+
+Pick `always yes`, then choose how much to remember and for how long:
+
+```
+╭─ permission · bash ──────────────────────────────────╮
+│ pnpm test                                            │
+│                                                      │
+│ always yes for...                                    │
+│   pnpm                                               │
+│ ❯ pnpm test                                          │
+│                                                      │
+│ scope: this session   (tab to change)                │
+│                                                      │
+│ ↑↓ depth   tab scope   enter confirm   esc back      │
+╰──────────────────────────────────────────────────────╯
+```
+
+We recommend the narrowest level, which is preselected. `pnpm` would also approve `pnpm publish`.
+
+| Scope        | Lasts                                    | Stored in                                                  |
+| ------------ | ---------------------------------------- | ---------------------------------------------------------- |
+| this session | until the session ends, reloads included | the session file                                           |
+| this project | every session in this project            | `.pi/extensions/pi-ask-permission/always-yes.json`         |
+| everywhere   | every session                            | `~/.pi/agent/extensions/pi-ask-permission/always-yes.json` |
+
+Run `/perm forget` to drop this session's, or `/perm forget project` for the project's.
+
+### Let the agent work
+
+Press `Alt+M` to switch modes. The status bar shows the one you are in.
+
+| Mode           | Runs without asking                  |
+| -------------- | ------------------------------------ |
+| `manual`       | nothing beyond reads and always yes  |
+| `accept edits` | file edits and writes in the project |
+| `auto`         | everything in the project            |
+
+A call that leaves the project still asks, in every mode. The mode lasts for the session and never changes the settings file.
+
+### Correct the agent
+
+A note on `deny` tells the agent what to do instead. A note on `yes` adds context, like `and update the snapshot`. Both reach the model with the tool result.
+
+If you are typing in the editor when a call arrives, the dialog waits until you pause.
+
+## Let a model decide
+
+The judge answers first, and only the calls it is unsure about reach you. It is off by default. We recommend this setup:
+
+1. Run `/login typesafe` to use Jev, a fast model that answers with a confidence. Any model you set up in pi works too.
+2. Open `/perm`, turn on `Judge`, and turn on `Dry run`. The judge now shows its verdict as a card, and you still decide.
+3. Pick a policy. `Standard development` allows edits, tests, builds, and local git, and asks about installs, network, and anything destructive.
+4. After a few sessions of agreeing with it, turn off `Dry run`.
+
+The policy is plain text, so you can start from a preset and edit it:
+
+```text
+# May run without asking
+- Running tests, linters, type checks, and builds
+- git status, diff, log
+
+# Must always ask first
+- sudo, or anything that changes system-wide state
+- Anything that reaches the network
+
+# When in doubt
+Ask me.
+```
+
+If calls come back as `the judge could not decide`, run `/perm judge test`. It sends one request and reports the model, the latency, and the error.
+
+## Commands
+
+Type `/perm ` and the editor suggests the rest.
+
+| Command                | Does                                                        |
+| ---------------------- | ----------------------------------------------------------- |
+| `/perm`                | Open the settings                                           |
+| `/perm mode`           | Switch to the next mode (also `Alt+M`)                      |
+| `/perm mode auto`      | Switch to a mode (also `manual`, `accept-edits`)            |
+| `/perm status`         | Show the config, always yes, and file paths                 |
+| `/perm forget`         | Forget this session's always yes                            |
+| `/perm forget project` | Forget this project's always yes (also `everywhere`, `all`) |
+| `/perm judge on`       | Turn the judge on (also `off`)                              |
+| `/perm judge log`      | Show this session's judge decisions                         |
+| `/perm judge test`     | Send one real request and report what happened              |
+
+## Reference
+
+### Dialog keys
+
+| Key                    | Does                                                 |
+| ---------------------- | ---------------------------------------------------- |
+| `↑` `↓` or `1` `2` `3` | Move the highlight                                   |
+| `enter`                | Confirm the highlighted row                          |
+| `tab`                  | Open or close a note, or change the always yes scope |
+| `esc`                  | Close the note, or deny                              |
+| `ctrl+v`               | Paste a clipboard image as its file path             |
+
+A long paste collapses to `[paste #1 +48 lines]` and expands when you confirm.
+
+### Configuration
+
+The settings live in the file every pi-harness package shares, `~/.pi/agent/extensions/pi-harness/settings.json`, under a `permission.` prefix. Every key has a row of the same name in `/perm`, and only what you change is written, so a new default reaches you.
+
+```json
+{
+	"permission": {
+		"allow": ["read", "grep", "find", "ls"],
+		"mode": "manual",
+		"readOnlyBash": true,
+		"workspace": { "roots": ["."], "outside": "ask" },
+		"judge": { "enabled": false, "model": "jev-latest" }
+	}
+}
+```
+
+The ids below leave out the `permission.` prefix.
+
+| Key                 | Does                                                                                                                                   |
+| ------------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
+| `allow`             | Tools that never ask. `mcp_*` matches a family. It matches the tool name, so `bash` allows every command                               |
+| `mode`              | The mode a new session starts in                                                                                                       |
+| `readOnlyBash`      | Run bash commands that only read without asking                                                                                        |
+| `notes`             | `"result"` adds a note to the tool result. `"message"` sends it as its own message                                                     |
+| `noUI`              | `"allow"` or `"deny"` when nobody can answer, as in print mode or a subagent. Takes a per-tool map: `{ "*": "allow", "bash": "deny" }` |
+| `workspace.roots`   | Paths that count as the project. Relative, absolute, and `~` work                                                                      |
+| `workspace.outside` | A call outside the roots: `"ask"` you, `"deny"` it, or `"allow"` it like any other                                                     |
+| `typing.pause`      | Milliseconds of quiet before the dialog opens while you type                                                                           |
+| `typing.maxWait`    | The longest the dialog waits for you to stop typing. `null` waits forever                                                              |
+
+The `judge` block:
+
+| Key                 | Default        | Does                                                  |
+| ------------------- | -------------- | ----------------------------------------------------- |
+| `enabled`           | `false`        | Turn the judge on                                     |
+| `provider`          | `"jev"`        | `"jev"`, or `"pi"` for a model you set up in pi       |
+| `model`             | `"jev-latest"` | A Jev alias, or `provider/modelId` for a pi model     |
+| `tools`             | `["bash"]`     | Tools the judge decides. The rest ask you             |
+| `policy`            | Standard       | The rules the judge follows                           |
+| `canDeny`           | `true`         | A confident no blocks the call. Off, it asks you      |
+| `whenUnsure`        | `"ask"`        | `"ask"`, `"allow"`, or `"deny"`                       |
+| `whenItFails`       | `"ask"`        | The same, for a timeout, an error, or a missing key   |
+| `alwaysAsk`         | `[]`           | Patterns the judge never approves, like `"git push*"` |
+| `dryRun`            | `false`        | Show the verdict, and still ask you                   |
+| `noUI`              | `false`        | Also judge print, JSON, and subagent runs             |
+| `rememberApprovals` | `false`        | A judge approval becomes always yes for this session  |
+| `thresholds`        | `0.85` / `0.8` | Confidence needed to allow / deny                     |
+| `riskCeiling`       | `0.45`         | Highest risk the judge may approve                    |
+| `timeoutMs`         | `5000`         | How long to wait for an answer                        |
+
+A malformed value falls back and says what it dropped, so a typo never lets more through. A key from before 3.0 is read with the new name. `PI_CODING_AGENT_DIR` moves the file with the rest of the agent directory.
+
+Up to 3.0 the config was `~/.pi/agent/extensions/pi-ask-permission/config.json`. The first session after this version reads it, writes what you changed into the shared settings, and keeps the old file as `config.json.bak`.
+
+### How a call is decided
+
+The first step that answers wins.
+
+1. **Always yes** matches the tool and level: run it.
+2. **Workspace**: a call outside `workspace.roots` asks you, or is blocked with `outside: "deny"`. Nothing below can approve it.
+3. **Mode**: `auto` runs it, `accept edits` runs an edit.
+4. **Allow list**: the tool is in `allow`, run it.
+5. **Read-only bash**: the command only reads, run it.
+6. **Judge**: a confident yes runs it, a confident no blocks it.
+7. **No UI**: `noUI` decides.
+8. **Edit check**: an `edit` that cannot apply is blocked with pi's own error, so you never approve a failure.
+9. **You**, in the dialog.
+
+The judge answers three questions: a verdict, how reversible the call is, and whether it touches secrets. Code combines them into `risk = 0.6 × reversibility + 0.4 × sensitive` and approves only when the verdict is `allow`, confidence clears `thresholds.allow`, and risk is at most `riskCeiling`. The judge treats the tool call as data, so a command cannot talk its way past the policy or `alwaysAsk`.
+
+### Limits
+
+- Always yes matches text. `cd /repo && pnpm test` offers `cd`, `cd /repo`, and the whole line, not `pnpm test`.
+- A bash path the check cannot read counts as outside. `$HOME`, `$SECRET`, and `"$@"` ask for that reason.
+- The read-only check is a classifier, not a sandbox. It trusts the command name as written and does not resolve `PATH`. It refuses anything it cannot prove harmless, so a few safe commands still ask.
+- The judge is a model, and it can be wrong. It sees the tool call, so do not judge calls that carry secrets you would not send to its provider.
+- If you want deterministic rules and no human in the loop, use a sandbox instead.
+
+### For other extensions
+
+Every decision goes out on `pi.events`:
+
+```ts
+pi.events.on("pi-ask-permission:decided", (decided) => {
+	// { toolCallId, toolName, summary, action: "allow" | "block", by, reason?, note? }
+});
+```
+
+`by` names the step above that decided, `you` for the dialog, or `no UI`. Dialog answers are also saved in the session as `pi-ask-permission:answer` entries.
+
+A custom tool can say what it touches, so the workspace and `accept edits` treat it like `edit`. Emit from `session_start`, after every extension has loaded:
+
+```ts
+pi.on("session_start", () => {
+	pi.events.emit("pi-ask-permission:tool", {
+		name: "apply_patch",
+		edits: true,
+		paths: (input) => input.files,
+	});
+});
+```
+
+A tool that says nothing has no paths and is not an edit. Built-in tools cannot be redescribed.
+
+### Compatibility
+
+Tested against the pi SDK pinned in `devDependencies`, which the `pi SDK` badge shows. CI checks each new pi release. The peer range is `*` because pi, not npm, picks the SDK that loads the extension.
+
+## Contributing
+
+See [CONTRIBUTING.md](CONTRIBUTING.md). Commits follow [Conventional Commits](https://www.conventionalcommits.org), and [release-please](https://github.com/googleapis/release-please) publishes.
+
+## License
+
+[MIT](LICENSE) © Felipe Adeildo

package/package.json

@@ -0,0 +1,63 @@
+{
+	"name": "@adeildo/pi-ask-permission",
+	"version": "4.0.0",
+	"description": "A permission dialog for the Pi coding agent. Approve, always approve, or deny a tool call, and attach a note the model reads with the result.",
+	"keywords": [
+		"approval",
+		"permission",
+		"permissions",
+		"pi",
+		"pi-coding-agent",
+		"pi-extension",
+		"pi-package"
+	],
+	"homepage": "https://pi.dev/packages/@adeildo/pi-ask-permission",
+	"bugs": "https://github.com/felipeadeildo/pi-harness/issues",
+	"license": "MIT",
+	"author": {
+		"name": "Felipe Adeildo",
+		"email": "contato@felipeadeildo.com",
+		"url": "https://github.com/felipeadeildo"
+	},
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/felipeadeildo/pi-harness.git",
+		"directory": "packages/ask-permission"
+	},
+	"files": [
+		"src",
+		"assets/preview.png",
+		"README.md",
+		"CONTRIBUTING.md",
+		"LICENSE"
+	],
+	"type": "module",
+	"imports": {
+		"#core/*": "./src/core/*",
+		"#identity": "./src/identity.ts",
+		"#pi/*": "./src/pi/*",
+		"#ui/*": "./src/ui/*",
+		"#util/*": "./src/util/*"
+	},
+	"publishConfig": {
+		"access": "public"
+	},
+	"scripts": {
+		"prepublishOnly": "cd ../.. && bun run verify"
+	},
+	"dependencies": {
+		"@adeildo/pi-kit": "4.0.0",
+		"shell-quote": "^1.10.0"
+	},
+	"peerDependencies": {
+		"@earendil-works/pi-ai": "*",
+		"@earendil-works/pi-coding-agent": "*",
+		"@earendil-works/pi-tui": "*"
+	},
+	"pi": {
+		"extensions": [
+			"./src/index.ts"
+		],
+		"image": "https://raw.githubusercontent.com/felipeadeildo/pi-harness/main/packages/ask-permission/assets/preview.png"
+	}
+}

package/src/core/always-yes.ts

@@ -0,0 +1,183 @@
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+
+import { describe, isRecord } from "#util/primitives.ts";
+
+export type Scope = "session" | "project" | "global";
+type SavedScope = Exclude<Scope, "session">;
+
+export const SCOPES: Scope[] = ["session", "project", "global"];
+const SAVED_SCOPES: SavedScope[] = ["project", "global"];
+
+export const SCOPE_LABEL: Record<Scope, string> = {
+	session: "this session",
+	project: "this project",
+	global: "everywhere",
+};
+
+export const ALWAYS_YES_FILE = "always-yes.json";
+const LEGACY_FILE_NAME = "grants.json";
+
+export interface AlwaysYesFiles {
+	global: string;
+	/** Undefined when the project is not trusted. */
+	project?: string;
+}
+
+// A tool name cannot hold a NUL, so ("bash\0git", "") never matches ("bash", "git").
+const SEPARATOR = "\u0000";
+
+export class AlwaysYes {
+	private readonly levels: Record<Scope, Set<string>> = {
+		session: new Set(),
+		project: new Set(),
+		global: new Set(),
+	};
+	private files: AlwaysYesFiles | undefined;
+
+	open(files: AlwaysYesFiles): string[] {
+		this.files = files;
+		const warnings: string[] = [];
+		for (const scope of SAVED_SCOPES) {
+			const path = files[scope];
+			if (path === undefined) {
+				this.levels[scope] = new Set();
+				continue;
+			}
+			const read = readLevels(adoptLegacyFile(path));
+			this.levels[scope] = read.levels;
+			if (read.warning) warnings.push(read.warning);
+		}
+		return warnings;
+	}
+
+	has(toolName: string, levels: string[]): boolean {
+		return levels.some((level) => {
+			const key = keyOf(toolName, level);
+			return SCOPES.some((scope) => this.levels[scope].has(key));
+		});
+	}
+
+	size(scope: Scope): number {
+		return this.levels[scope].size;
+	}
+
+	total(): number {
+		return SCOPES.reduce((sum, scope) => sum + this.size(scope), 0);
+	}
+
+	/** Returns why it was not saved. It still holds until pi exits. */
+	add(scope: Scope, toolName: string, level: string): string | undefined {
+		const key = keyOf(toolName, level);
+		this.levels[scope].add(key);
+		if (scope === "session") return undefined;
+
+		const path = this.files?.[scope];
+		if (path === undefined) return "this project is not trusted, so it was not saved";
+
+		// Another pi may have saved since this one loaded, and a file that does not
+		// parse is someone's hand edit, not something to overwrite.
+		const read = readLevels(path);
+		if (read.warning) return read.warning;
+
+		read.levels.add(key);
+		this.levels[scope] = read.levels;
+		return writeLevels(path, read.levels);
+	}
+
+	forget(scope: Scope | "all"): { removed: number; errors: string[] } {
+		const scopes = scope === "all" ? SCOPES : [scope];
+		let removed = 0;
+		const errors: string[] = [];
+
+		for (const target of scopes) {
+			removed += this.levels[target].size;
+			this.levels[target].clear();
+			if (target === "session") continue;
+
+			const path = this.files?.[target];
+			if (path === undefined) continue;
+			try {
+				rmSync(path, { force: true });
+			} catch (error) {
+				errors.push(describe(error));
+			}
+		}
+
+		return { removed, errors };
+	}
+}
+
+export function savedFileExists(path: string): boolean {
+	return existsSync(path) || existsSync(legacyPath(path));
+}
+
+export function readLevels(path: string): { levels: Set<string>; warning?: string } {
+	if (!existsSync(path)) return { levels: new Set() };
+
+	let raw: unknown;
+	try {
+		raw = JSON.parse(readFileSync(path, "utf8"));
+	} catch (error) {
+		return { levels: new Set(), warning: `could not parse ${path}: ${describe(error)}` };
+	}
+	if (!isRecord(raw)) return { levels: new Set(), warning: `${path} must contain a JSON object` };
+
+	const levels = new Set<string>();
+	for (const [tool, list] of Object.entries(raw)) {
+		if (!Array.isArray(list)) continue;
+		for (const level of list) {
+			if (typeof level === "string" && level !== "") levels.add(keyOf(tool, level));
+		}
+	}
+	return { levels };
+}
+
+function writeLevels(path: string, levels: Set<string>): string | undefined {
+	try {
+		mkdirSync(dirname(path), { recursive: true });
+		writeFileSync(path, `${JSON.stringify(toFile(levels), null, 2)}\n`, "utf8");
+		return undefined;
+	} catch (error) {
+		return describe(error);
+	}
+}
+
+// Before 3.0 the file was grants.json. A failed rename reads it in place.
+function adoptLegacyFile(path: string): string {
+	const legacy = legacyPath(path);
+	if (existsSync(path) || !existsSync(legacy)) return path;
+
+	try {
+		renameSync(legacy, path);
+		return path;
+	} catch {
+		return legacy;
+	}
+}
+
+function legacyPath(path: string): string {
+	return join(dirname(path), LEGACY_FILE_NAME);
+}
+
+function keyOf(toolName: string, level: string): string {
+	return `${toolName}${SEPARATOR}${level}`;
+}
+
+function toFile(levels: Set<string>): Record<string, string[]> {
+	const byTool = new Map<string, string[]>();
+
+	for (const key of levels) {
+		const separator = key.indexOf(SEPARATOR);
+		const tool = key.slice(0, separator);
+		const list = byTool.get(tool) ?? [];
+		list.push(key.slice(separator + 1));
+		byTool.set(tool, list);
+	}
+
+	return Object.fromEntries(
+		[...byTool]
+			.toSorted(([left], [right]) => left.localeCompare(right))
+			.map(([tool, list]) => [tool, list.toSorted()]),
+	);
+}

package/src/core/answer.ts

@@ -0,0 +1,8 @@
+import type { Scope } from "#core/always-yes.ts";
+
+export interface DialogAnswer {
+	decision: "allow" | "deny";
+	note?: string;
+	remember?: string;
+	scope?: Scope;
+}