@agentwhy/cli 0.0.0-dev

package/dist/report/start/settings/settings-script.js

@@ -0,0 +1,161 @@
+/**
+ * What only Settings does (`.ai/plans/2026-09-23-settings-redesign.md`, step 3). The kit opens and closes the windows
+ * and switches the tabs; this posts what a confirm button carries, and reads the page again once the server has
+ * written it (R60), so a control shows what the file holds and never what was clicked. A refusal is said in the words
+ * the server gave (R59). Opened as a file, nothing can be written, and the same button shows the command that would
+ * do it (R61).
+ *
+ * Picking or typing a file's name is the kit's (`add-file-popup.ts`), which reads a picked file's name and nothing
+ * else (F36).
+ */
+export const SETTINGS_SCRIPT = String.raw `
+(() => {
+  const root = document.querySelector('[data-settings]');
+  if (!root) return;
+  const served = location.protocol === 'http:' || location.protocol === 'https:';
+  const words = JSON.parse(root.dataset.setWords || '{}');
+  const word = (key) => (words[document.documentElement.dataset.lang] || words.en || {})[key] || '';
+  const TABS = ['files', 'alerts', 'general'];
+
+  // The tab a person was on survives the page being read again after a write.
+  const pills = [...root.querySelectorAll(':scope .tabs-state [data-tab]')];
+  const opened = TABS.indexOf(location.hash.slice(1));
+  if (opened > 0 && pills[opened]) pills[opened].click();
+  pills.forEach((pill, at) => pill.addEventListener('click', () => history.replaceState(null, '', '#' + TABS[at])));
+
+  const say = (where, text, command, busy) => {
+    const line = where && where.querySelector('[data-set-say]');
+    if (!line) return;
+    line.textContent = text;
+    line.classList.toggle('set-say-busy', busy === true);
+    if (command) {
+      const code = document.createElement('code');
+      code.textContent = command;
+      line.append(code);
+    }
+    line.hidden = false;
+  };
+
+  const quote = (text) => /^[\w@%+=:,./*-]+$/.test(text) ? text : "'" + text.replace(/'/g, "'\\''") + "'";
+  const shared = (where) => where === 'shared' ? ' --shared' : '';
+  const commandFor = (body) => {
+    // A private file is kept from searches too (F38), so protecting names refuse, as the page's own write does.
+    if (body.change === 'protect') return 'agentwhy init --protect ' + quote(body.pattern) + ' --refuse' + shared(body.where);
+    if (body.change === 'adopt') return 'agentwhy init' + body.patterns.map((pattern) => ' --protect ' + quote(pattern)).join('') + ' --refuse' + shared(body.where);
+    if (body.change === 'unprotect') return 'agentwhy init --remove --unprotect ' + quote(body.pattern) + shared(body.where);
+    if (body.scope === 'project') return 'agentwhy notify' + (body.on ? ' --on ' + body.on : '') + (body.clean ? ' --clean ' + body.clean : '');
+    return '';
+  };
+
+  const post = (url, body, where, controls) => {
+    controls.forEach((control) => { control.disabled = true; control.setAttribute('aria-busy', 'true'); });
+    say(where, word('saving'), '', true);
+    fetch(url, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body) })
+      .then((response) => response.json().then((answer) => ({ ok: response.ok && answer.ok, message: answer.message || '' })))
+      .catch(() => ({ ok: false, message: word('unreachable') }))
+      .then((answer) => {
+        if (answer.ok) {
+          const tab = TABS[pills.findIndex((pill) => pill.classList.contains('tabs-on'))] || TABS[0];
+          location.replace(location.pathname + '?at=' + Date.now() + '#' + tab);
+          return;
+        }
+        controls.forEach((control) => { control.disabled = false; control.removeAttribute('aria-busy'); });
+        say(where, word('refused') + ' ' + answer.message);
+      });
+  };
+
+  /** A change that writes into the project: posted where the page is served, said as a command where it is a file. */
+  const change = (body, button, command) => {
+    const dialog = button.closest('dialog');
+    if (!served) { say(dialog, word('asFile'), command || commandFor(body)); return; }
+    post('api/settings', body, dialog, [button]);
+  };
+
+  // A row that needs row 1 answers a click - on its switch or anywhere on it - with a bubble beside its switch, and
+  // row 1 lights up for a moment.
+  const tips = [...root.querySelectorAll('[data-set-tip]')];
+  const hideTips = (except) => tips.forEach((tip) => { if (tip !== except) tip.hidden = true; });
+  document.addEventListener('keydown', (event) => { if (event.key === 'Escape') hideTips(); });
+  document.addEventListener('click', (event) => { if (!event.target.closest('[data-set-tip], .set-msg-locked')) hideTips(); });
+
+  root.addEventListener('click', (event) => {
+    if (event.target.closest('[data-set-tip] [data-popup-open]')) hideTips();
+    const locked = !event.target.closest('[data-set-tip]') && event.target.closest('.set-msg-locked');
+    const needs = locked && locked.querySelector('[data-set-needs-first]');
+    if (needs) {
+      const tip = document.getElementById(needs.getAttribute('aria-describedby'));
+      hideTips(tip);
+      if (tip) tip.hidden = false;
+      const first = root.querySelector('[data-set-first]');
+      if (first) {
+        first.classList.add('set-msg-point');
+        setTimeout(() => first.classList.remove('set-msg-point'), 1600);
+      }
+      return;
+    }
+
+    const confirm = event.target.closest('[data-set-write]');
+    if (confirm) {
+      const body = JSON.parse(confirm.dataset.setWrite);
+      if (confirm.dataset.setWho) {
+        const picked = document.querySelector('input[name="' + confirm.dataset.setWho + '"]:checked');
+        body.where = picked ? picked.value : 'local';
+      }
+      change(body, confirm, confirm.getAttribute('data-set-command-' + (body.where || 'local')));
+      return;
+    }
+
+    // A row not watched yet opens its confirmation from anywhere on it, as its own button does.
+    const unwatched = event.target.closest('[data-set-row]');
+    if (unwatched && !event.target.closest('[data-popup-open]')) {
+      const button = unwatched.querySelector('[data-popup-open]');
+      if (button) button.click();
+      return;
+    }
+
+    const add = event.target.closest('[data-set-add]');
+    if (add) {
+      const settings = JSON.parse(add.dataset.setAdd);
+      const pattern = add.dataset.pattern;
+      if (!pattern) return;
+      const body = settings.builtIn.length > 0
+        ? { change: 'adopt', patterns: [...settings.builtIn, pattern], where: settings.where }
+        : { change: 'protect', pattern, where: settings.where };
+      // Where alerts run from the same file, the command names them too: \`init\` with a hook flag takes out any other.
+      change(body, add, commandFor(body).replace(/( --shared)?$/, (settings.watch ? ' --watch' : '') + '$1'));
+      return;
+    }
+
+    // Rows 2 and 3 are notice choices for this project, written at once (R26a).
+    const notice = event.target.closest('[data-set-notice]');
+    if (notice) {
+      const body = Object.assign({ scope: 'project' }, JSON.parse(notice.dataset.setNotice));
+      const card = notice.closest('.set-msg');
+      if (!served) { say(card, word('asFile'), commandFor(body)); return; }
+      post('api/notify', body, card, [notice]);
+      return;
+    }
+
+  });
+
+  /**
+   * The kit's "Add a private file" hands over a name already turned into its pattern, or refused in words (F36, R46);
+   * Settings shows the pattern exactly as it will be written, and what it means, and asks (F35).
+   */
+  const picker = root.querySelector('#set-add');
+  if (picker) picker.addEventListener('add-file', (event) => {
+    const confirm = root.querySelector('#set-add-confirm');
+    if (!confirm) return;
+    const { name, kind, pattern } = event.detail;
+    confirm.querySelectorAll('[data-set-name]').forEach((slot) => { slot.textContent = kind === 'folder' ? name + '/' : name; });
+    confirm.querySelectorAll('[data-set-pattern]').forEach((slot) => { slot.textContent = pattern; });
+    confirm.querySelectorAll('[data-set-kind]').forEach((slot) => { slot.hidden = slot.dataset.setKind !== kind; });
+    const button = confirm.querySelector('[data-set-add]');
+    if (button) button.dataset.pattern = pattern;
+    const line = confirm.querySelector('[data-set-say]');
+    if (line) line.hidden = true;
+    if (picker.open) picker.close();
+    confirm.showModal();
+  });
+})();
+`;

package/dist/report/start/settings/settings-view.js

@@ -0,0 +1,240 @@
+import { DEFAULT_POLICY } from '../../../core/policy/default-policy.js';
+import { SETTINGS_FILES } from '../../../adapter/claude-code/contract/settings.js';
+import { DEFAULT_THRESHOLD } from '../../watch/agent-alert.js';
+import { DEFAULT_CLEAN } from '../../watch/notice-choices.js';
+import { RULE_NAMES } from '../../rule-names.js';
+/**
+ * What the Settings page shows, decided from what the files hold (`for-people-who-build-with-ai.md` §3 C; the plan's
+ * S4). No HTML: every state, name and source of the page is chosen here, and the page only writes it.
+ *
+ * "Watched" means what the `watch` hook reads, never the list this run of `start` read: a settings file's rules replace
+ * the built-in list for a hook that names it, so a pattern is called watched only where that hook's rules hold it.
+ */
+const BUILT_IN = DEFAULT_POLICY.protected.map((entry) => entry.pattern);
+const NO_HOOKS = {
+    watch: false,
+    refuse: false,
+    reads: { watch: 'default', refuse: 'default' },
+    path: SETTINGS_FILES.directory + '/' + SETTINGS_FILES.local,
+    sharedPath: SETTINGS_FILES.directory + '/' + SETTINGS_FILES.shared,
+};
+export function settingsView(settings) {
+    const hooks = settings.hooks ?? NO_HOOKS;
+    const canWrite = settings.hooks !== undefined && settings.mine !== undefined;
+    const alerts = hookOf(hooks.watch);
+    const stop = hookOf(hooks.refuse);
+    const reads = hooks.reads.watch;
+    const notices = settings.notices;
+    const on = notices?.on ?? DEFAULT_THRESHOLD;
+    const clean = notices?.clean ?? DEFAULT_CLEAN;
+    const known = settings.hooks !== undefined;
+    // Unknown, the hooks' rules are unknown too: the list is what this run read, and no row claims to be watched or not.
+    const read = known ? readPatterns(settings, reads) : undefined;
+    const told = toldIn(settings);
+    const canTell = canWrite && settings.told !== undefined && settings.told.local !== 'unreadable' && settings.told.shared !== 'unreadable';
+    const rows = read === undefined ? policyRows(settings) : fileRows(settings, reads, read, told, canTell).map((row) => keptOf(row, settings, hooks));
+    const unread = read === undefined ? [] : unreadRules(settings, read);
+    const addTo = reads === 'local' || reads === 'shared' ? reads : alerts.who ?? stop.who ?? 'local';
+    // A built-in pattern on a told list is read and told, never blocked again by an add (F57).
+    const withBuiltIn = read === undefined ? [] : BUILT_IN.filter((pattern) => (reads === 'default' || !read.has(pattern)) && !told.has(pattern));
+    const scope = known ? scopeOf(settings, hooks) : undefined;
+    return {
+        known,
+        canWrite,
+        alerts,
+        stopped: { on: on === 'refused', locked: known && !alerts.on },
+        fine: { on: clean !== 'off', locked: known && !alerts.on },
+        noticesWritable: notices !== undefined && !notices.unusable,
+        stop,
+        scope,
+        moves: { local: movesInto(settings, hooks, 'local'), shared: movesInto(settings, hooks, 'shared') },
+        uninstall: known ? uninstallFrom(settings, hooks) : {},
+        writeTo: scope === 'local' || scope === 'shared' ? scope : addTo,
+        canTell,
+        reads,
+        rows,
+        unread,
+        unfinished: unfinishedOf(settings, rows, withBuiltIn, told, stop.on),
+        toWatch: new Set([...unread.map((rule) => rule.rule), ...(reads === 'default' ? [] : withBuiltIn)]).size,
+        addTo,
+        // Read from the built-in list, the whole of it goes into the file the hooks will read from then on; read from a
+        // file, only what that file lacks.
+        withBuiltIn,
+        canAdd: canWrite && read !== undefined,
+        developer: developerRows(settings, known ? hooks : undefined, reads, unread),
+        ...(hooks.codex === undefined ? {} : { codex: hooks.codex }),
+    };
+}
+const FILES = ['local', 'shared'];
+/**
+ * The rules of agentwhy's own a file holds: whole rules, the kind `init` writes and can take back out (`IndexRule`). A
+ * rule written by hand is somebody's own work and stays where they put it, so it neither splits the scope nor moves.
+ */
+function ownRules(settings, file) {
+    return (settings.held?.[file] ?? []).flatMap((pattern) => {
+        const rule = settings.mine?.[pattern];
+        return rule !== undefined && rule.whole ? [rule.rule] : [];
+    });
+}
+function scopeOf(settings, hooks) {
+    const used = FILES.filter((file) => hooks.watch === file || hooks.refuse === file || ownRules(settings, file).length > 0);
+    return used.length === 2 ? 'mixed' : used[0];
+}
+function movesInto(settings, hooks, into) {
+    const other = into === 'local' ? 'shared' : 'local';
+    return {
+        patterns: [...new Set(ownRules(settings, other))],
+        hooks: ['watch', 'refuse'].filter((hook) => hooks[hook] === other),
+    };
+}
+function uninstallFrom(settings, hooks) {
+    return Object.fromEntries(FILES.flatMap((file) => {
+        const rules = [...new Set(ownRules(settings, file))];
+        return hooks.watch === file || hooks.refuse === file || rules.length > 0 ? [[file, rules]] : [];
+    }));
+}
+function hookOf(where) {
+    return where === false ? { on: false } : { on: true, who: where };
+}
+/** The patterns the hooks watch, or undefined where they read a policy or a file this page cannot see into. */
+function readPatterns(settings, reads) {
+    if (reads === 'default')
+        return new Set(BUILT_IN);
+    if (reads === 'local' || reads === 'shared')
+        return new Set(settings.held?.[reads] ?? []);
+    return undefined;
+}
+/** Every pattern of both told lists that could be read (F57). */
+function toldIn(settings) {
+    return new Set(FILES.flatMap((file) => {
+        const list = settings.told?.[file];
+        return list === undefined || list === 'unreadable' ? [] : list;
+    }));
+}
+/**
+ * The rows where the hooks read the built-in list or a project file: the named groups first, in F33's order, each
+ * watched where the file holds any of its patterns or a told list does, then every other rule the file holds, as its
+ * pattern, then every told pattern no rule holds (F57). A row's switch goes to the other mode where this page can write
+ * both halves of it: the rules out of the files and the pattern into a list, or the other way round.
+ */
+function fileRows(settings, reads, read, told, canTell) {
+    const ruleOf = (pattern) => {
+        const rule = settings.mine?.[pattern];
+        return rule !== undefined && rule.whole ? rule.rule : undefined;
+    };
+    // Going to `tell` takes the rules out; where one is a rule somebody wrote by hand, the page cannot, and offers nothing.
+    const toTell = (patterns) => {
+        if (!canTell)
+            return undefined;
+        const rules = reads === 'default' ? [] : patterns.map(ruleOf);
+        return rules.every((rule) => rule !== undefined) ? { to: 'tell', patterns, rules: rules } : undefined;
+    };
+    const toBlock = (patterns) => (canTell ? { to: 'block', patterns, rules: [] } : undefined);
+    const named = RULE_NAMES.map((group) => {
+        const blocked = group.patterns.filter((pattern) => read.has(pattern) && !told.has(pattern));
+        const toldHere = group.patterns.filter((pattern) => told.has(pattern));
+        if (blocked.length > 0)
+            return withSwitch({ name: group.name, patterns: blocked, source: 'agentwhy', watched: true, mode: 'block' }, toTell(blocked));
+        if (toldHere.length > 0)
+            return withSwitch({ name: group.name, patterns: toldHere, source: 'agentwhy', watched: true, mode: 'tell' }, toBlock(toldHere));
+        return { name: group.name, patterns: group.patterns, source: 'agentwhy', watched: false, mode: 'block' };
+    });
+    const own = [...read].filter((pattern) => !BUILT_IN.includes(pattern) && !told.has(pattern)).map((pattern) => {
+        const rule = settings.mine?.[pattern];
+        // Only a whole rule in the file the hooks read is one `init` could have written and can take back out; half a
+        // pair is somebody's own work (`IndexRule.whole`), and a pattern `mine` places in the other file cannot be
+        // removed from this one by name.
+        const removable = rule !== undefined && rule.whole && rule.file === reads;
+        return withSwitch({
+            patterns: [pattern],
+            source: removable ? 'you' : 'project',
+            watched: true,
+            mode: 'block',
+            ...(removable ? { remove: { rule: rule.rule, file: rule.file } } : {}),
+        }, toTell([pattern]));
+    });
+    const toldOnly = [...told].filter((pattern) => !BUILT_IN.includes(pattern)).map((pattern) => withSwitch({ patterns: [pattern], source: 'you', watched: true, mode: 'tell', ...(canTell ? { untell: [pattern] } : {}) }, toBlock([pattern])));
+    return [...named, ...own, ...toldOnly];
+}
+function withSwitch(row, switchTo) {
+    return switchTo === undefined ? row : { ...row, switchTo };
+}
+/**
+ * Where the hooks read a policy or another file, or what they read is unknown: the list this run read, as it is, and
+ * nothing here can change it. The built-in list is named in words where it is what the run read.
+ */
+function policyRows(settings) {
+    const builtIn = settings.origin.kind === 'default';
+    const named = builtIn
+        ? RULE_NAMES.flatMap((group) => {
+            const held = group.patterns.filter((pattern) => settings.protected.includes(pattern));
+            return held.length === 0 ? [] : [{ name: group.name, patterns: held, source: 'agentwhy', watched: true, mode: 'block' }];
+        })
+        : [];
+    const rest = settings.protected.filter((pattern) => !builtIn || !BUILT_IN.includes(pattern));
+    return [...named, ...rest.map((pattern) => ({ patterns: [pattern], source: 'project', watched: true, mode: 'block' }))];
+}
+/**
+ * K1, K2: a watched `block` row, read for both halves of a block - its rules in either settings file, which Claude Code
+ * applies both of (R4d), and `refuse` running over rules that hold every pattern of it. Where `refuse` reads a policy or
+ * a file this page cannot see into, only the rules are claimed.
+ */
+function keptOf(row, settings, hooks) {
+    if (!row.watched || row.mode !== 'block' || settings.held === undefined)
+        return row;
+    const ruled = row.patterns.filter((pattern) => denied(settings, pattern));
+    if (ruled.length === 0)
+        return { ...row, kept: 'none' };
+    const searched = hooks.refuse === false ? new Set() : readPatterns(settings, hooks.reads.refuse);
+    const whole = ruled.length === row.patterns.length && (searched === undefined || row.patterns.every((pattern) => searched.has(pattern)));
+    return whole ? row : { ...row, kept: 'open' };
+}
+function denied(settings, pattern) {
+    return FILES.some((file) => settings.held?.[file]?.includes(pattern) ?? false);
+}
+/**
+ * K9: what one confirmed write closes. Rules no file holds are written as an add writes them - with the built-in list,
+ * so that pointing the hooks at a file drops nothing they watched (S4.3), and never a pattern the person chose to be
+ * told about (F57) - and `refuse` with them. Where every rule is there, `refuse` alone, where it does not run. Where it
+ * runs and reads other rules, `init` does not point it again without writing a rule (R4d), so nothing is offered.
+ */
+function unfinishedOf(settings, rows, withBuiltIn, told, refuseOn) {
+    const open = rows.filter((row) => row.kept !== undefined);
+    const missing = open.flatMap((row) => row.patterns.filter((pattern) => !denied(settings, pattern)));
+    const patterns = missing.length === 0 ? [] : [...new Set([...withBuiltIn, ...missing])].filter((pattern) => !told.has(pattern));
+    return { rows: open.length, patterns, refuse: open.length > 0 && patterns.length === 0 && !refuseOn };
+}
+/** F34: a rule a project file holds that the hooks do not read. A built-in pattern read anyway is not one. */
+function unreadRules(settings, read) {
+    return Object.entries(settings.mine ?? {})
+        .filter(([pattern]) => !read.has(pattern))
+        .map(([, rule]) => ({ rule: rule.rule, file: rule.file }));
+}
+/** `hooks` is absent where the project's file could not be read: then what runs, and what it reads, is not known. */
+function developerRows(settings, known, reads, unread) {
+    const hooks = known ?? NO_HOOKS;
+    const pathOf = (file) => (file === 'shared' ? hooks.sharedPath : hooks.path);
+    const where = (hook) => {
+        if (known === undefined)
+            return { word: 'set.dev.unknown' };
+        const file = hooks[hook];
+        return file === false ? { word: 'set.dev.notInstalled' } : pathOf(file);
+    };
+    const notices = settings.notices;
+    const rules = reads === 'local' || reads === 'shared'
+        ? [...(settings.held?.[reads] ?? [])].join('  ') + '  (' + pathOf(reads) + ')'
+        : reads === 'default' ? BUILT_IN.join('  ') : settings.protected.join('  ');
+    const unreadFiles = [...new Set(unread.map((rule) => pathOf(rule.file)))];
+    return [
+        { key: 'set.dev.watch', value: where('watch') },
+        { key: 'set.dev.refuse', value: where('refuse') },
+        { key: 'set.dev.reads', value: known === undefined ? { word: 'set.dev.unknown' } : reads === 'local' || reads === 'shared' ? pathOf(reads) : { word: 'set.dev.reads.' + reads } },
+        { key: 'set.dev.rules', value: known === undefined ? settings.protected.join('  ') : rules },
+        { key: 'set.dev.unread', value: unreadFiles.length === 0 ? { word: 'set.dev.none' } : unreadFiles.join('  ') },
+        { key: 'set.dev.exceptions', value: settings.allowed.length === 0 ? { word: 'set.dev.none' } : settings.allowed.join('  ') },
+        { key: 'set.dev.notices', value: notices === undefined ? { word: 'set.dev.none' } : notices.path },
+        { key: 'set.dev.on', value: notices?.on ?? DEFAULT_THRESHOLD },
+        { key: 'set.dev.clean', value: notices?.clean ?? DEFAULT_CLEAN },
+        ...(notices === undefined ? [] : [{ key: 'set.dev.said', value: notices.say + ' · ' + notices.notify.join(', ') }]),
+    ];
+}