@agentwhy/cli 0.0.0-dev → 0.2.0

package/dist/report/start/settings/files-tab.js

@@ -1,3 +1,5 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
 import { escapeHtml as e } from '../../render/html-report-components.js';
 import { inLanguages, labelAttributes } from '../../render/report-copy.js';
 import { pill, trashButton } from '../../render/ui/button.js';
@@ -91,13 +93,17 @@ function ruleRow(row, at, view) {
     const action = row.remove !== undefined && canWrite ? remove(removeWindowId(at))
         : row.untell !== undefined ? remove(untellWindowId(at))
             : '<span class="set-none" aria-hidden="true">—</span>';
-    const icon = !row.watched ? '' : row.kept !== undefined ? OPEN_LOCK_SVG : MODE_SVG[row.mode];
-    const iconClass = !row.watched ? '' : ' set-icon-' + (row.kept !== undefined ? 'gap' : row.mode);
+    const covered = row.covered;
+    const gapped = row.kept !== undefined || covered !== undefined;
+    const icon = !row.watched ? '' : gapped ? OPEN_LOCK_SVG : MODE_SVG[row.mode];
+    const iconClass = !row.watched ? '' : ' set-icon-' + (gapped ? 'gap' : row.mode);
     return '<li class="set-rule' + (row.watched ? '' : ' set-rule-off') + (watchable ? ' set-rule-watchable' : '') + '"' + (watchable ? ' data-set-row' : '') + '>' +
         '<span class="set-icon' + iconClass + '" aria-hidden="true">' + icon + '</span>' +
         '<span class="set-rule-text"><span class="set-rule-name">' + label + '</span>' +
         '<span class="chip set-rule-chip" title="' + e(pattern) + '">' + e(patternShort(pattern)) + '</span>' +
-        (row.kept === undefined ? '' : '<span class="set-rule-gap">' + inLanguages((t) => t('set.rule.gap.' + row.kept)) + '</span>') + '</span>' +
+        (row.kept === undefined ? '' : '<span class="set-rule-gap">' + inLanguages((t) => t('set.rule.gap.' + row.kept)) + '</span>') +
+        // SW19: tracked here, and still refused by Claude Code's own rule for a wider pattern - said on the row, like a half block.
+        (covered === undefined ? '' : '<span class="set-rule-gap">' + inLanguages((t) => t('set.rule.covered', { pattern: e(patternShort(covered)) })) + '</span>') + '</span>' +
         '<span class="set-rule-mode">' + mode + '</span>' +
         '<span class="set-rule-src">' + tag(inLanguages((t) => t('set.src.short.' + row.source)), SOURCE_TONE[row.source]) + '</span>' +
         '<span class="set-rule-act">' + action + '</span>' +
@@ -149,21 +155,21 @@ function finishCard(view) {
     });
 }
 /**
- * `codex-blocks-too` CK8: in a project that uses Codex, whether the files blocked here are kept from Codex too. Where
- * agentwhy's hook is written, a grey line says it holds once approved in Codex, which nothing here can see (CKB9). Where
- * it is not and Claude Code's block runs, a coral line with the one write that adds it; where Claude Code's does not
- * run either, Finish blocking above writes both, and this says nothing.
+ * `codex-approves-its-own-hook` AO3, AO10: in a project that uses Codex, whether the files blocked here are kept from
+ * Codex too. Verified (`on`), a grey line states the fact: from the first message, in the terminal and in VS Code,
+ * nothing to confirm in Codex. Written but not verified (`stale`), a coral line says Codex may still ask, with the one
+ * write that makes it automatic. Not written (`off`) and Claude Code's block running, a coral line with the same
+ * write; where Claude Code's block does not run either, Finish blocking above writes both, and this says nothing.
  */
 function codexCard(view) {
-    if (!view.known || view.codex === undefined)
+    if (!view.known || view.codex === undefined || !view.stop.on)
         return '';
     if (view.codex === 'on')
         return callout({ tone: 'grey', body: inLanguages((t) => t('set.codex.on')) });
-    if (!view.stop.on)
-        return '';
+    const stale = view.codex === 'stale';
     return callout({
         tone: 'coral',
-        body: inLanguages((t) => t('set.codex.off')),
-        ...(view.canWrite ? { action: pill({ label: inLanguages((t) => t('set.codex.go')), tone: 'primary', size: 'task', href: '#' + CODEX_WINDOW, attributes: opener(CODEX_WINDOW) }) } : {}),
+        body: inLanguages((t) => t(stale ? 'set.codex.stale' : 'set.codex.off')),
+        ...(view.canWrite ? { action: pill({ label: inLanguages((t) => t(stale ? 'set.codex.fix' : 'set.codex.go')), tone: 'primary', size: 'task', href: '#' + CODEX_WINDOW, attributes: opener(CODEX_WINDOW) }) } : {}),
     });
 }

package/dist/report/start/settings/general-tab.js

@@ -1,10 +1,15 @@
-import { inLanguages } from '../../render/report-copy.js';
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
+import { escapeHtml as e } from '../../render/html-report-components.js';
+import { inLanguages, labelAttributes } from '../../render/report-copy.js';
 import { avatar } from '../../render/ui/avatar.js';
 import { BRAND_MARK } from '../../render/ui/brand-mark.js';
 import { pill, TRASH_SVG } from '../../render/ui/button.js';
 import { callout } from '../../render/ui/callout.js';
 import { opener } from '../../render/ui/popup.js';
+import { toggleSwitch } from '../../render/ui/switch.js';
 import { tag } from '../../render/ui/tag.js';
+import { stateLine } from './alerts-tab.js';
 import { scopeWindowId, UNINSTALL_WINDOW } from './settings-windows.js';
 /**
  * General (`for-people-who-build-with-ai.md` F56, asked for 2026-09-24; redrawn 2026-09-25): who what agentwhy saved in
@@ -25,9 +30,36 @@ export function generalTab(view, welcome) {
         // which-project V5: which AI agentwhy sees, in the words the project step and the list of projects say it.
         '<p class="set-quiet set-general-note"><span class="set-info" aria-hidden="true">i</span><span>' + inLanguages((t) => t('proj.which')) + '</span></p>' +
         '</section>' +
+        systemCard(view) +
         setupCard(welcome) +
         uninstallCard(view);
 }
+/**
+ * Whether agentwhy also shows what it says in the corner of the screen (`2026-10-02-said-where-the-person-is.md` SW13).
+ * Asked for by the maintainer on 2026-10-02, who found the notifications tiresome and had only a command to turn them
+ * off. Written at once, as Alerts' optional rows are (R26a), keeping every other channel in force; on a page opened as a
+ * file, the script offers the command to copy instead.
+ */
+function systemCard(view) {
+    const on = view.system.on;
+    const others = view.system.channels.filter((channel) => channel !== 'os');
+    const next = on ? (others.length === 0 ? ['chat'] : others) : [...others, 'os'];
+    return '<section class="set-box set-system"><div class="set-head"><h2 class="set-h2">' + inLanguages((t) => t('set.system.title')) + '</h2>' +
+        '<p class="set-lead">' + inLanguages((t) => t('set.system.lead')) + '</p></div>' +
+        // Not `set-msg-opt`: that row hangs from Alerts' first on a line, and this one hangs from nothing.
+        '<article class="set-msg' + (on ? ' set-msg-on' : '') + '"><div class="set-card-body">' +
+        '<div class="set-card-name"><h3 class="set-msg-name">' + inLanguages((t) => t('set.system.name')) + '</h3></div>' +
+        '<p class="set-msg-why">' + inLanguages((t) => t('set.system.when')) + '</p>' +
+        // As Alerts' optional rows: where the hooks are unknown, so is whether anything is said at all - the switch alone.
+        (view.known ? stateLine({ key: on ? 'set.state.on' : 'set.state.off', on }) : '') +
+        '<p class="set-say" data-set-say hidden></p></div>' +
+        toggleSwitch({
+            on,
+            disabled: !view.noticesWritable,
+            attributes: labelAttributes((t) => t('set.system.name')) + ' data-set-notice="' + e(JSON.stringify({ notify: next })) + '"',
+        }) +
+        '</article></section>';
+}
 /**
  * W25a: the onboarding again, where this run serves it - drawn as Uninstall is (a mark, one sentence, the button), and
  * above it: going through the setup again comes before taking it all out. Nothing is written until its Finish (W10).

package/dist/report/start/settings/settings-renderer.js

@@ -115,6 +115,8 @@ const SETTINGS_STYLE = String.raw `
 .set-cannot{margin:-8px 0 22px}
 .set-quiet{font-size:14px;line-height:1.5;color:var(--text-3)}
 .set-soft{color:var(--text-2)}
+.set-tick{display:flex;gap:10px;align-items:flex-start;font-size:14px;color:var(--text-2);cursor:pointer}
+.set-tick input{margin-top:3px;accent-color:var(--coral)}
 .set-head{margin-bottom:16px}
 .co+.set-head{margin-top:30px}
 .set-h2{margin:0;font-size:19px;font-weight:650;line-height:1.3}

package/dist/report/start/settings/settings-script.js

@@ -1,3 +1,5 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
 /**
  * What only Settings does (`.ai/plans/2026-09-23-settings-redesign.md`, step 3). The kit opens and closes the windows
  * and switches the tabs; this posts what a confirm button carries, and reads the page again once the server has
@@ -43,7 +45,7 @@ export const SETTINGS_SCRIPT = String.raw `
     if (body.change === 'protect') return 'agentwhy init --protect ' + quote(body.pattern) + ' --refuse' + shared(body.where);
     if (body.change === 'adopt') return 'agentwhy init' + body.patterns.map((pattern) => ' --protect ' + quote(pattern)).join('') + ' --refuse' + shared(body.where);
     if (body.change === 'unprotect') return 'agentwhy init --remove --unprotect ' + quote(body.pattern) + shared(body.where);
-    if (body.scope === 'project') return 'agentwhy notify' + (body.on ? ' --on ' + body.on : '') + (body.clean ? ' --clean ' + body.clean : '');
+    if (body.scope === 'project') return 'agentwhy notify' + (body.on ? ' --on ' + body.on : '') + (body.clean ? ' --clean ' + body.clean : '') + (body.notify ? ' --notify ' + body.notify.join(',') : '');
     return '';
   };
 
@@ -101,6 +103,11 @@ export const SETTINGS_SCRIPT = String.raw `
         const picked = document.querySelector('input[name="' + confirm.dataset.setWho + '"]:checked');
         body.where = picked ? picked.value : 'local';
       }
+      // AO17: the window's unticked choice - out of the person's own Codex files too, only when ticked.
+      if (confirm.dataset.setTick) {
+        const tick = document.querySelector('input[name="' + confirm.dataset.setTick + '"]');
+        if (tick && tick.checked) body.codex = true;
+      }
       change(body, confirm, confirm.getAttribute('data-set-command-' + (body.where || 'local')));
       return;
     }

package/dist/report/start/settings/settings-view.js

@@ -1,7 +1,10 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
 import { DEFAULT_POLICY } from '../../../core/policy/default-policy.js';
+import { matchesGlob } from '../../../core/policy/glob.js';
 import { SETTINGS_FILES } from '../../../adapter/claude-code/contract/settings.js';
 import { DEFAULT_THRESHOLD } from '../../watch/agent-alert.js';
-import { DEFAULT_CLEAN } from '../../watch/notice-choices.js';
+import { DEFAULT_CHANNELS, DEFAULT_CLEAN } from '../../watch/notice-choices.js';
 import { RULE_NAMES } from '../../rule-names.js';
 /**
  * What the Settings page shows, decided from what the files hold (`for-people-who-build-with-ai.md` §3 C; the plan's
@@ -32,7 +35,9 @@ export function settingsView(settings) {
     const read = known ? readPatterns(settings, reads) : undefined;
     const told = toldIn(settings);
     const canTell = canWrite && settings.told !== undefined && settings.told.local !== 'unreadable' && settings.told.shared !== 'unreadable';
-    const rows = read === undefined ? policyRows(settings) : fileRows(settings, reads, read, told, canTell).map((row) => keptOf(row, settings, hooks));
+    const rows = read === undefined
+        ? policyRows(settings)
+        : fileRows(settings, reads, read, told, canTell).map((row) => coveredOf(keptOf(row, settings, hooks), settings, told));
     const unread = read === undefined ? [] : unreadRules(settings, read);
     const addTo = reads === 'local' || reads === 'shared' ? reads : alerts.who ?? stop.who ?? 'local';
     // A built-in pattern on a told list is read and told, never blocked again by an add (F57).
@@ -45,6 +50,7 @@ export function settingsView(settings) {
         stopped: { on: on === 'refused', locked: known && !alerts.on },
         fine: { on: clean !== 'off', locked: known && !alerts.on },
         noticesWritable: notices !== undefined && !notices.unusable,
+        system: { on: (notices?.notify ?? DEFAULT_CHANNELS).includes('os'), channels: notices?.notify ?? DEFAULT_CHANNELS },
         stop,
         scope,
         moves: { local: movesInto(settings, hooks, 'local'), shared: movesInto(settings, hooks, 'shared') },
@@ -189,6 +195,27 @@ function keptOf(row, settings, hooks) {
     const whole = ruled.length === row.patterns.length && (searched === undefined || row.patterns.every((pattern) => searched.has(pattern)));
     return whole ? row : { ...row, kept: 'open' };
 }
+/**
+ * SW19, found by the maintainer on 2026-10-02: `demo.env` was switched to Track, and Claude Code still refused every
+ * read - its own deny rule for every `.env` file covers that name, and deny rules know no exceptions. The row carries
+ * the shortest written Block rule that still matches the row's file, by the name a command or a path would use. Only
+ * a row tracked by a file's name is asked - a folder or a hand-written pattern names no one file to try - and only
+ * rules a settings file actually holds count, because only those are rules Claude Code applies itself.
+ */
+function coveredOf(row, settings, told) {
+    if (row.mode !== 'tell' || !row.watched)
+        return row;
+    const names = row.patterns.flatMap((pattern) => {
+        const name = /^\*\*\/([^*?/]+)$/.exec(pattern)?.[1];
+        return name === undefined ? [] : [name];
+    });
+    if (names.length === 0)
+        return row;
+    const written = FILES.flatMap((file) => settings.held?.[file] ?? []).filter((pattern) => !told.has(pattern));
+    const covering = written.filter((pattern) => names.some((name) => matchesGlob(name, pattern) || matchesGlob(`a/${name}`, pattern)));
+    const covered = covering.sort((one, two) => one.length - two.length || (one < two ? -1 : 1))[0];
+    return covered === undefined ? row : { ...row, covered };
+}
 function denied(settings, pattern) {
     return FILES.some((file) => settings.held?.[file]?.includes(pattern) ?? false);
 }

package/dist/report/start/settings/settings-windows.js

@@ -1,3 +1,5 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
 import { escapeHtml as e } from '../../render/html-report-components.js';
 import { inLanguages } from '../../render/report-copy.js';
 import { addFilePopup } from '../../render/ui/add-file-popup.js';
@@ -115,18 +117,25 @@ function uninstallWindow(view) {
         return '';
     const command = files.map((file) => 'agentwhy init --remove --watch --refuse' +
         (view.uninstall[file] ?? []).map((rule) => ' --unprotect ' + quoted(rule)).join('') + shared(file)).join(' && ');
+    // AO17: one project's uninstall leaves agentwhy's check in the person's own Codex settings for the other projects
+    // (AOD4) - said here, with the unticked choice that takes it out of Codex too.
+    const codex = view.codex === undefined ? '' :
+        '<label class="set-tick"><input type="checkbox" name="set-uninstall-codex">' +
+            '<span>' + inLanguages((t) => t('set.confirm.uninstall.codex')) + '</span></label>';
     return confirmDialog({
         id: UNINSTALL_WINDOW,
         glyph: '',
         title: inLanguages((t) => t('set.confirm.uninstall')),
         subject: '',
         sentence: inLanguages((t) => t('set.confirm.uninstall.text') + (files.includes('shared') ? ' ' + t('set.confirm.everyone') : '')),
-        option: '',
+        option: codex,
         note: say(),
         cancel: inLanguages((t) => t('app.cancel')),
         confirm: inLanguages((t) => t('set.confirm.uninstall.go')),
         tone: 'primary',
-        confirmAttributes: write({ change: 'uninstall', rules: view.uninstall }) + commandAttribute('local', command),
+        confirmAttributes: write({ change: 'uninstall', rules: view.uninstall }) +
+            (view.codex === undefined ? '' : ' data-set-tick="set-uninstall-codex"') +
+            commandAttribute('local', command),
     });
 }
 /** The hooks a file runs once the moved ones are in it: `init` with hook flags takes out any it is not given (R4b). */
@@ -167,11 +176,13 @@ function finishWindow(view) {
     });
 }
 /**
- * CK5, CK7: Codex's hook, written to match the block Claude Code runs - the page's confirmation is the consent, as for
- * every block - and the honesty line under it. Opened as a file, it hands over `agentwhy init --codex`.
+ * `codex-approves-its-own-hook` AO8, AO10: agentwhy's Codex check, written to the person's own files and approved by
+ * agentwhy itself - the page's confirmation is the consent, as for every block - and the honesty line under it. Opened
+ * from `off` and from `stale` alike: the same write installs and heals. Opened as a file, it hands over
+ * `agentwhy init --codex`.
  */
 function codexWindow(view) {
-    if (view.codex !== 'off' || !view.stop.on)
+    if ((view.codex !== 'off' && view.codex !== 'stale') || !view.stop.on)
         return '';
     return confirmDialog({
         id: CODEX_WINDOW,

package/dist/report/start/settings-files.js

@@ -1,3 +1,5 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
 import { fileRulesIn } from '../../adapter/claude-code/settings/deny-entries.js';
 import { missingHookEntries } from '../../adapter/claude-code/settings/hook-entries.js';
 /**

package/dist/report/start/to-fix/done-list.js

@@ -1,3 +1,5 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
 import { escapeHtml as e } from '../../render/html-report-components.js';
 import { inLanguages } from '../../render/report-copy.js';
 import { textButton } from '../../render/ui/button.js';

package/dist/report/start/to-fix/file-window.js

@@ -1,3 +1,5 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
 import { escapeHtml as e } from '../../render/html-report-components.js';
 import { inLanguages, labelAttributes } from '../../render/report-copy.js';
 import { closeButton, pill } from '../../render/ui/button.js';

package/dist/report/start/to-fix/to-fix-list.js

@@ -1,3 +1,5 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
 import { escapeHtml as e } from '../../render/html-report-components.js';
 import { inLanguages, labelAttributes } from '../../render/report-copy.js';
 import { pill } from '../../render/ui/button.js';

package/dist/report/start/to-fix/to-fix-renderer.js

@@ -1,3 +1,5 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
 import { matchesGlob } from '../../../core/policy/glob.js';
 import { idInKey } from '../../../core/session-catalogue.js';
 import { escapeHtml as e } from '../../render/html-report-components.js';

package/dist/report/start/to-fix/to-fix-script.js

@@ -1,3 +1,5 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
 /**
  * What only To fix does (`.ai/plans/2026-09-23-to-fix-redesign.md`, step 3). The kit opens and closes the windows and
  * switches the tabs, and the Fix it wizard writes a mark; this posts an undo, and reads the page again once the server

package/dist/report/watch/agent-alert.js

@@ -1,3 +1,4 @@
+import { sumRefusedByOthers } from '../refusals.js';
 export const ALERT_THRESHOLDS = ['value', 'reached', 'refused'];
 /**
  * What is said when nobody has said otherwise: only a value written from a protected file. The other two are worth
@@ -32,6 +33,7 @@ export function alertOf(report, agentIndex) {
     const wroteItself = node.wroteValue === true || node.wroteOnward === true || usedItself;
     const reached = reachedFromReturn > 0 || node.filesReached > 0 || reachedBelow;
     const refusedAttempts = subtree.reduce((sum, agent) => sum + agent.refusedAttempts, 0);
+    const byOthers = sumRefusedByOthers(subtree.map((agent) => agent.refusedByOthers));
     const filesReached = own.length > 0 ? reachedFromReturn : reachedBelow ? undefined : node.filesReached;
     const level = wroteOrReturnedValue || wroteItself ? 'value' : reached ? 'reached' : refusedAttempts > 0 ? 'refused' : 'nothing';
     return {
@@ -40,6 +42,7 @@ export function alertOf(report, agentIndex) {
         ...(node.type === undefined ? {} : { type: node.type }),
         ...(filesReached === undefined ? {} : { filesReached }),
         refusedAttempts,
+        ...(byOthers === undefined ? {} : { refusedByOthers: byOthers }),
     };
 }
 /** Whether a level is strong enough to be said, under the threshold asked for. */

package/dist/report/watch/codex-turn-format.js

@@ -0,0 +1,69 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
+import { join } from 'node:path';
+import { SETTINGS_FILES } from '../../adapter/claude-code/contract/settings.js';
+import { refuseProjectAbove, refuseRulesOf } from '../../adapter/claude-code/settings/refuse-project.js';
+import { codexReaderOf } from '../../adapter/codex/hooks/reader.js';
+import { codexConversationOf } from '../../adapter/codex/hooks/codex-conversation.js';
+import { codexStopFolder, parseCodexStopInput } from '../../adapter/codex/hooks/stop-input.js';
+import { sessionKey } from '../../core/session-catalogue.js';
+import { FileAccessError } from '../../ports/file-access-error.js';
+import { CODEX_REQUESTS } from './render/codex-request-words.js';
+/**
+ * Codex's end of a turn, for `watch` (`2026-10-02-codex-says-it-too.md` CX1-CX7): its `Stop` read by Codex's names,
+ * who reads it from its rollout, the commands agentwhy stopped in the turn, Codex's requests, a Codex session's key, and
+ * the project's rules - the ones Codex's `refuse` reads.
+ */
+export function codexTurnFormat(files, refusals, threadIndexPath, home) {
+    return {
+        readStop: parseCodexStopInput,
+        readerOf: (turn) => codexReaderOf(files, turn.transcriptPath),
+        stoppedIn: (text) => refusals.find(text),
+        requests: CODEX_REQUESTS,
+        sessionKey: (id) => sessionKey({ id, provider: 'codex' }),
+        settingsFor: (text) => rulesOfProject(files, codexStopFolder(text), home),
+        // CX8: one conversation across the session ids the Codex apps give it (CXB5).
+        conversationOf: (turn) => codexConversationOf(files, threadIndexPath, turn.sessionId),
+        // CX9 with AO5: watched where a project above the turn's folder runs `refuse` - as `refuse --codex` finds it.
+        watchedHere: async (text) => {
+            const folder = codexStopFolder(text);
+            return folder !== undefined && (await refuseProjectAbove(files, folder, home)) !== undefined;
+        },
+    };
+}
+/**
+ * CX5 with AO5, AO6: the project is found as `refuse --codex` finds it - the nearest folder short of home whose Claude
+ * Code settings run `refuse` - and its rules are the settings file that project's `refuse` command names. Found by
+ * review: guessing the local file first read no rules where a project keeps them in the shared one, and so said a chat
+ * was clean over a file `refuse` protects. Where it names none, the local file, then the shared one, as before. A
+ * policy file is not a settings path, so it reads as none.
+ */
+async function rulesOfProject(files, folder, home) {
+    if (folder === undefined)
+        return undefined;
+    const found = await refuseProjectAbove(files, folder, home);
+    if (found === undefined)
+        return undefined;
+    const rules = refuseRulesOf(found);
+    if (rules.policyPath !== undefined)
+        return undefined;
+    if (rules.settingsPath !== undefined)
+        return rules.settingsPath;
+    for (const name of [SETTINGS_FILES.local, SETTINGS_FILES.shared]) {
+        const settings = join(found.project, SETTINGS_FILES.directory, name);
+        if (await readable(files, settings))
+            return settings;
+    }
+    return undefined;
+}
+async function readable(files, path) {
+    try {
+        await files.readText(path);
+        return true;
+    }
+    catch (error) {
+        if (error instanceof FileAccessError)
+            return false;
+        throw error;
+    }
+}

package/dist/report/watch/notice-choices.js

@@ -1,3 +1,5 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
 /**
  * The choices a notice can be given, in a module of their own so that both the code that says a notice and the code
  * that remembers what a person chose can name them without depending on each other.

package/dist/report/watch/notice-settings.js

@@ -1,3 +1,5 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
 import { dirname } from 'node:path';
 import { longestMatch, NO_PREFERENCES, preferencesFor, readPreferences, withProjectChoices, writtenPreferences, } from './preferences.js';
 /**

package/dist/report/watch/preferences.js

@@ -1,3 +1,5 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
 import { isJsonObject, parseJsonObject } from '../../shared/json.js';
 import { ALERT_THRESHOLDS } from './agent-alert.js';
 import { CLEAN_MODES, NOTICE_CHANNELS, NOTICE_LANGS, SAID_AS, } from './notice-choices.js';

package/dist/report/watch/render/codex-request-words.js

@@ -0,0 +1,106 @@
+/*
+ * The stopped limit says "now": told to never read the file another way, the agent refused to try again later in the
+ * same conversation after the person had switched the file to Track (seen by the maintainer, 2026-10-02). The hook is
+ * the gate, not the agent's memory of this sentence.
+ */
+/**
+ * What Codex's agent is handed (`2026-10-02-codex-says-it-too.md` CX2, CX3, amended 2026-10-02). Codex shows it whole, in
+ * a bubble above the reply (CXB1, CKB14), and the maintainer found the first wording - written to the agent, with the
+ * report's command in it - too long and not understandable for the person who reads it first. So each is written to the
+ * person: what happened and what to do, in one or two sentences of the glossary's words, in the language chosen for
+ * agentwhy; then, in brackets and marked as the AI's ("For the AI:", chosen by the maintainer so a person does not read it
+ * as said to them), the one thing the agent is asked - one short sentence back - with the limit that keeps
+ * the file safe: never show a key, never read a stopped file another way. No command, no report offered: the report is
+ * one step away in Conversations, and a command in that bubble is a line a person cannot read.
+ */
+export const CODEX_REQUESTS = {
+    stopped: (paths, lang) => STOPPED[lang](listed(paths, lang), paths.length === 1),
+    keys: (files, _command, lang) => KEYS[lang](listed(files.map(String), lang), files.length <= 1),
+    template: (files, _command, lang) => TEMPLATE[lang](listed(files.map(String), lang), files.length <= 1),
+    data: (files, _command, lang) => DATA[lang](listed(files.map(String), lang), files.length <= 1),
+    told: (files, _command, lang, foldsTurn) => TOLD[lang](listed(files.map(String), lang), files.length <= 1, foldsTurn === true),
+    quiet: (lang, foldsTurn) => QUIET[lang](foldsTurn === true),
+};
+const STOPPED = {
+    en: (files, one) => `**agentwhy** stopped your AI from reading the private ${one ? 'file' : 'files'} ${files}. ` +
+        `(For the AI: reply in one short sentence, and don't try to read ${one ? 'it' : 'them'} another way now.)`,
+    pl: (files, one) => `**agentwhy** nie pozwolił AI odczytać ${one ? 'prywatnego pliku' : 'prywatnych plików'} ${files}. ` +
+        `(Dla AI: odpowiedz jednym krótkim zdaniem i nie próbuj teraz odczytać ${one ? 'go' : 'ich'} inaczej.)`,
+    de: (files, one) => `**agentwhy** hat deine KI daran gehindert, ${one ? 'die private Datei' : 'die privaten Dateien'} ${files} zu lesen. ` +
+        `(Für die KI: antworte in einem kurzen Satz und versuch jetzt nicht, sie anders zu lesen.)`,
+};
+const KEYS = {
+    en: (files, one) => `**agentwhy**: a key from the private ${one ? 'file' : 'files'} ${files} is now in this chat. Make a new key ` +
+        `today where it was created; deleting the chat won't undo it. (For the AI: reply in one short sentence; don't show the key.)`,
+    pl: (files, one) => `**agentwhy**: klucz z ${one ? 'prywatnego pliku' : 'prywatnych plików'} ${files} jest teraz w tej rozmowie. ` +
+        `Zrób dziś nowy klucz tam, gdzie go utworzono; usunięcie rozmowy tego nie cofnie. (Dla AI: odpowiedz jednym krótkim ` +
+        `zdaniem; nie pokazuj klucza.)`,
+    de: (files, one) => `**agentwhy**: Ein Schlüssel aus ${one ? 'der privaten Datei' : 'den privaten Dateien'} ${files} ist jetzt ` +
+        `in diesem Chat. Erstelle heute dort einen neuen, wo er erstellt wurde; den Chat zu löschen hilft nicht. (Für die KI: ` +
+        `antworte in einem kurzen Satz; zeig den Schlüssel nicht.)`,
+};
+/** A template's value may be a placeholder: only a real key is to be made new (S6, `template`). */
+const TEMPLATE = {
+    en: (files, one) => `**agentwhy**: a value from the template ${one ? 'file' : 'files'} ${files} is now in this chat. If it's a ` +
+        `real key, make a new one where it was created. (For the AI: reply in one short sentence; don't show the value.)`,
+    pl: (files, one) => `**agentwhy**: wartość z ${one ? 'pliku-szablonu' : 'plików-szablonów'} ${files} jest teraz w tej rozmowie. ` +
+        `Jeśli to prawdziwy klucz, zrób nowy tam, gdzie go utworzono. (Dla AI: odpowiedz jednym krótkim zdaniem; ` +
+        `nie pokazuj tej wartości.)`,
+    de: (files, one) => `**agentwhy**: Ein Wert aus ${one ? 'der Vorlagendatei' : 'den Vorlagendateien'} ${files} ist jetzt in ` +
+        `diesem Chat. Ist es ein echter Schlüssel, erstelle dort einen neuen, wo er erstellt wurde. (Für die KI: antworte in ` +
+        `einem kurzen Satz; zeig den Wert nicht.)`,
+};
+/** Data cannot be made new, so nothing is asked to be changed (S6, `data`): what cannot be taken back, and where to look. */
+const DATA = {
+    en: (files, one) => `**agentwhy**: private data from the private ${one ? 'file' : 'files'} ${files} is now in this chat. It ` +
+        `can't be taken back; agentwhy's report shows how to limit the damage. (For the AI: reply in one short sentence; don't repeat the data.)`,
+    pl: (files, one) => `**agentwhy**: prywatne dane z ${one ? 'prywatnego pliku' : 'prywatnych plików'} ${files} są teraz w tej ` +
+        `rozmowie. Nie da się tego cofnąć; raport agentwhy pokazuje, jak ograniczyć szkody. (Dla AI: odpowiedz jednym krótkim ` +
+        `zdaniem; nie powtarzaj tych danych.)`,
+    de: (files, one) => `**agentwhy**: Private Daten aus ${one ? 'der privaten Datei' : 'den privaten Dateien'} ${files} sind jetzt ` +
+        `in diesem Chat. Das lässt sich nicht zurücknehmen; der Bericht von agentwhy zeigt, wie du den Schaden begrenzt. (Für ` +
+        `die KI: antworte in einem kurzen Satz; wiederhole die Daten nicht.)`,
+};
+/**
+ * Where the app folds the turn away (`foldsTurn`, the desktop app, CXB5's display note), told and quiet ask the
+ * answer back - decided by the maintainer, 2026-10-02, after a control run: with a block, the whole Apache-licence
+ * answer sat behind "Worked for ...", and the visible reply was one line about private files. The full answer, not a
+brief one: the maintainer tried "repeat your answer" the same day and found the visible repeat more condensed than
+the original the fold hides. A told file is one the
+ * person lets their AI read, so the repeat carries nothing that may not be here; keys, data and a stopped command
+ * keep their limits - what their fold hides is what must not be repeated. VS Code's Codex folds nothing, so there
+ * the one short sentence stays and nothing is said twice.
+ */
+const TOLD = {
+    en: (files, one, folds) => `**agentwhy**: your AI read the private ${one ? 'file' : 'files'} ${files}, which you let it read. ` +
+        `Nothing to do. (For the AI: ${folds ? 'repeat your full answer for the user, then that nothing needs doing' : 'reply in one short sentence'}.)`,
+    pl: (files, one, folds) => `**agentwhy**: AI przeczytało ${one ? 'prywatny plik' : 'prywatne pliki'} ${files}, na ${one ? 'który' : 'które'} ` +
+        `pozwoliłeś. Nic nie trzeba robić. (Dla AI: ${folds ? 'powtórz całą swoją odpowiedź dla użytkownika i dodaj, że nic nie trzeba robić' : 'odpowiedz jednym krótkim zdaniem'}.)`,
+    de: (files, one, folds) => `**agentwhy**: Deine KI hat ${one ? 'die private Datei' : 'die privaten Dateien'} ${files} gelesen, die du ` +
+        `ihr erlaubt hast. Nichts zu tun. (Für die KI: ${folds ? 'wiederhole deine ganze Antwort für den Nutzer und ergänze, dass nichts zu tun ist' : 'antworte in einem kurzen Satz'}.)`,
+};
+const QUIET = {
+    en: (folds) => '**agentwhy** is keeping watch over your private files: none has been opened so far. ' +
+        `(For the AI: ${folds ? 'repeat your full answer for the user, then this in one sentence' : 'reply in one short sentence'}.)`,
+    pl: (folds) => '**agentwhy** pilnuje twoich prywatnych plików: jak dotąd żaden nie został otwarty. ' +
+        `(Dla AI: ${folds ? 'powtórz całą swoją odpowiedź dla użytkownika i dodaj to jednym zdaniem' : 'odpowiedz jednym krótkim zdaniem'}.)`,
+    de: (folds) => '**agentwhy** passt auf deine privaten Dateien auf: Bisher wurde keine geöffnet. ' +
+        `(Für die KI: ${folds ? 'wiederhole deine ganze Antwort für den Nutzer und ergänze dies in einem Satz' : 'antworte in einem kurzen Satz'}.)`,
+};
+/** At most three files by name, then how many more: a request a person reads is not a list. */
+function listed(paths, lang) {
+    const named = [...new Set(paths)].slice(0, 3);
+    const rest = new Set(paths).size - named.length;
+    const and = AND[lang];
+    if (rest > 0)
+        named.push(MORE[lang](rest));
+    if (named.length <= 1)
+        return named[0] ?? '';
+    return `${named.slice(0, -1).join(', ')} ${and} ${named.at(-1)}`;
+}
+const AND = { en: 'and', pl: 'i', de: 'und' };
+const MORE = {
+    en: (count) => `${count} more`,
+    pl: (count) => `${count} innych`,
+    de: (count) => `${count} weitere`,
+};