@ai-ecoverse/slicc-spectrum 1.108.6 → 1.109.0

package/dist/slicc-ui.js

@@ -49899,6 +49899,7 @@ function truncated(approval) {
 function hintOf(approval) {
   return approval.kind === "sudo" ? commandText(alwaysHint(approval), false) : guestAlwaysHint(approval);
 }
+var deniedSudo = (approval) => approval.kind === "sudo" && approval.verdict?.decision === "deny";
 var tooLong = "This request is too long to show in full, so it can\u2019t be allowed.";
 function guestWaiting(approval) {
   return approval.kind === "guest-message" ? `${approval.requester.name}'s message to ${approval.agentName ?? "this cone"} waits for the owner's approval.` : `${approval.agentName ?? "This cone"} wants to run ${approval.tool} for ${approval.requester.name}, which waits for the owner's approval.`;
@@ -50141,7 +50142,8 @@ var SliccApprovals = class extends ModelElement {
       return;
     const verdict = rulesOf(approval);
     const always = approval.kind === "sudo" || approval.kind !== "tray" && approval.always;
-    if (decision2 === "always" && (!always || verdict.certain || verdict.maybe)) return;
+    if (decision2 === "always" && (!always || deniedSudo(approval) || verdict.certain || verdict.maybe))
+      return;
     this.busy = decision2;
     this.failure = null;
     this.#pending.add(approval.id);
@@ -50269,7 +50271,7 @@ var SliccApprovals = class extends ModelElement {
       ${files.length ? b`<ul class="files" data-attachments>${files.map((file) => b`<li>${file.name} · ${file.mimeType} · ${size3(file.size)}</li>`)}</ul>` : A}`;
   }
   #verdict(approval) {
-    const verdict = approval.kind === "sudo" || approval.kind === "tray" ? void 0 : approval.verdict;
+    const verdict = approval.kind === "tray" ? void 0 : approval.verdict;
     return verdict ? b`<p class="verdict" data-verdict=${verdict.decision}>${verdict.decision === "unsure" ? "The automatic check wasn\u2019t sure" : `The automatic check would ${verdict.decision} this`}: ${verdict.reason}</p>` : A;
   }
   #actions(approval, rejected, always) {
@@ -50278,7 +50280,7 @@ var SliccApprovals = class extends ModelElement {
     const whole = this.#whole(approval);
     return b`${this.#button(approval, "deny", "Deny", "secondary")}
       ${whole && always ? this.#button(approval, "always", inCwd(approval) ? "Always allow in this directory" : "Always allow", "secondary") : A}
-      ${whole ? this.#button(approval, "once", "Allow once", "accent") : A}`;
+      ${whole ? this.#button(approval, "once", deniedSudo(approval) ? "Allow anyway (once)" : "Allow once", "accent") : A}`;
   }
   render() {
     if (this.gone) {
@@ -50301,7 +50303,7 @@ var SliccApprovals = class extends ModelElement {
     const failure2 = this.failure?.id === approval.id ? this.failure.message : "";
     const verdict = rulesOf(approval);
     const rules = verdict.certain ?? verdict.maybe;
-    const always = approval.kind !== "tray" && approval.always && !rules;
+    const always = approval.kind !== "tray" && approval.always && !deniedSudo(approval) && !rules;
     const gate = this.#gate(approval);
     const hint2 = always && this.#whole(approval) ? hintOf(approval) : "";
     return this.#dialog(
@@ -50310,8 +50312,8 @@ var SliccApprovals = class extends ModelElement {
       b`<sp-alert-dialog variant="warning" data-approval-kind=${approval.kind}>
           <h2 id="title" slot="heading">${title(approval)}</h2>
           ${this.#request(approval, true)}
-          ${this.#verdict(approval)}
           ${approval.kind === "sudo" && approval.cwd ? b`<p class="cwd">In ${commandText(approval.cwd, false)}</p>` : A}
+          ${this.#verdict(approval)}
           ${rules ? b`<div class="rules" data-secret-rules=${rules}><swc-icon-alert-triangle size="s" aria-hidden="true"></swc-icon-alert-triangle><p>${verdict.certain ? b`<strong>This changes secret rules.</strong> It names <code>${commandText(rules, false)}</code>, where SLICC keeps which secrets programs may use and where they may be sent.` : b`<strong>This may change secret rules.</strong> SLICC can't tell where <code>${commandText(rules, false)}</code> leads, and it could reach the files where SLICC keeps which secrets programs may use and where they may be sent.`} Allow it only if you asked for this change.</p></div>` : A}
           ${hint2 ? b`<p class="hint">${hint2}</p>` : A}
           ${!failure2 && gate ? b`<p class="hint" data-allow-hint>${gate}</p>` : A}