@ai-ecoverse/slicc-spectrum 1.111.4 → 1.112.0

package/dist/slicc-ui.js

@@ -10617,8 +10617,8 @@ var Ends = class {
     this.#observer.disconnect();
   }
 };
-function fullCommand(shown4, toggle) {
-  return b`<swc-action-button size="s" quiet class="full-command" data-action="full-command" data-shown=${shown4 ? "" : A} aria-expanded=${shown4 ? "true" : "false"} @click=${toggle}><swc-icon-chevron-down slot="icon" class="chevron" aria-hidden="true"></swc-icon-chevron-down>${shown4 ? "Hide the full command" : "Show the full command"}</swc-action-button>`;
+function fullCommand(shown5, toggle) {
+  return b`<swc-action-button size="s" quiet class="full-command" data-action="full-command" data-shown=${shown5 ? "" : A} aria-expanded=${shown5 ? "true" : "false"} @click=${toggle}><swc-icon-chevron-down slot="icon" class="chevron" aria-hidden="true"></swc-icon-chevron-down>${shown5 ? "Hide the full command" : "Show the full command"}</swc-action-button>`;
 }
 
 // node_modules/@adobe/spectrum-wc/dist/components/ui-icons/ui-icons.types.js
@@ -33402,9 +33402,9 @@ function stopSigningIn(event2, handlers, account, id) {
 function fixButton(fix, item2, handlers, login) {
   const id = item2.id ?? "";
   const signing = login?.state === "signing-in";
-  const shown4 = login?.state === "connected" ? "retry" : fix;
+  const shown5 = login?.state === "connected" ? "retry" : fix;
   const cancel = signing && login.cancel;
-  return b`${cancel ? b`<swc-button size="s" variant="secondary" fill-style="outline" data-action="cancel-login" @click=${(event2) => stopSigningIn(event2, handlers, item2.account, id)}>Cancel</swc-button>` : A}<swc-button size="s" variant="secondary" fill-style="outline" data-action=${shown4} ?pending=${signing} ?disabled=${handlers.readOnly} @click=${() => handlers.action(shown4, item2.id, item2.account)}>${signing ? "Signing in\u2026" : actionLabel(shown4, handlers, id)}</swc-button>`;
+  return b`${cancel ? b`<swc-button size="s" variant="secondary" fill-style="outline" data-action="cancel-login" @click=${(event2) => stopSigningIn(event2, handlers, item2.account, id)}>Cancel</swc-button>` : A}<swc-button size="s" variant="secondary" fill-style="outline" data-action=${shown5} ?pending=${signing} ?disabled=${handlers.readOnly} @click=${() => handlers.action(shown5, item2.id, item2.account)}>${signing ? "Signing in\u2026" : actionLabel(shown5, handlers, id)}</swc-button>`;
 }
 function errorCard(item2, handlers) {
   const id = item2.id ?? "";
@@ -33439,7 +33439,7 @@ function day(at) {
 }
 var stampGap = 2 * 6e4;
 function stamps(messages) {
-  const shown4 = /* @__PURE__ */ new Set();
+  const shown5 = /* @__PURE__ */ new Set();
   let last = -Infinity;
   let seen = "";
   for (const message of messages) {
@@ -33449,10 +33449,10 @@ function stamps(messages) {
       last = -Infinity;
     }
     if (message.role === "system" || message.createdAt - last < stampGap) continue;
-    shown4.add(message.id);
+    shown5.add(message.id);
     last = message.createdAt;
   }
-  return shown4;
+  return shown5;
 }
 function size3(bytes) {
   if (bytes < 1024) return `${bytes} B`;
@@ -33712,10 +33712,10 @@ function toolOnly(message, showThinking) {
   if (message.role === "tool") return [message.tool];
   if (message.role !== "assistant") return null;
   if (message.parts.some((entry) => entry.type === "question")) return null;
-  const shown4 = message.parts.filter((entry) => !silent(entry, showThinking));
-  if (shown4.some((entry) => entry.type !== "tool")) return null;
-  if (!shown4.length && message.status !== "streaming") return null;
-  return shown4.map((entry) => entry.tool);
+  const shown5 = message.parts.filter((entry) => !silent(entry, showThinking));
+  if (shown5.some((entry) => entry.type !== "tool")) return null;
+  if (!shown5.length && message.status !== "streaming") return null;
+  return shown5.map((entry) => entry.tool);
 }
 var attachmentIcons = {
   image: b`<swc-icon-file slot="thumbnail" aria-hidden="true"></swc-icon-file>`,
@@ -34006,9 +34006,9 @@ function decision(message, handlers) {
   const settled4 = expired || guest;
   const { actions: actions2, command: command3 } = decide(message, handlers, settled4);
   const detail = settled4 ? void 0 : handlers.detail;
-  const shown4 = !!detail?.has(message.id);
-  const more = detail ? b`<swc-action-button size="s" quiet class="detail" data-action="ask-detail" aria-expanded=${shown4 ? "true" : "false"} accessible-label=${shown4 ? "Hide details" : "Show details"} @click=${() => detail.toggle(message.id)}><swc-icon-chevron-right slot="icon" class="chevron"></swc-icon-chevron-right></swc-action-button>` : A;
-  return b`<swc-conversation-turn type="system" class="message decision-turn" tabindex="-1" accessible-label=${`Permission request from ${message.title}`} data-id=${message.id} data-pending=${settled4 ? A : ""} data-expired=${expired ? "" : A} data-detail=${shown4 ? "" : A} @click=${reveal} @keydown=${reveal}>
+  const shown5 = !!detail?.has(message.id);
+  const more = detail ? b`<swc-action-button size="s" quiet class="detail" data-action="ask-detail" aria-expanded=${shown5 ? "true" : "false"} accessible-label=${shown5 ? "Hide details" : "Show details"} @click=${() => detail.toggle(message.id)}><swc-icon-chevron-right slot="icon" class="chevron"></swc-icon-chevron-right></swc-action-button>` : A;
+  return b`<swc-conversation-turn type="system" class="message decision-turn" tabindex="-1" accessible-label=${`Permission request from ${message.title}`} data-id=${message.id} data-pending=${settled4 ? A : ""} data-expired=${expired ? "" : A} data-detail=${shown5 ? "" : A} @click=${reveal} @keydown=${reveal}>
     <div class="decision" data-kind="approval">
       <div class="decision-head"><span class="who">${message.title}</span>${timer}${more}</div>
       <p class="decision-text">${message.text}</p>
@@ -34040,8 +34040,8 @@ function lickContent(message, body2, handlers) {
   const scoop = message.channel === "scoop-notify";
   const report = message.report;
   if (!scoop && !report) return b`<pre class="output">${body2}</pre>`;
-  const shown4 = !body2 ? A : scoop ? b`<div class="text">${markdown(body2)}</div>` : b`<pre class="output">${body2}</pre>`;
-  return b`<div class="report">${shown4}${report ? b`<swc-button size="s" variant="secondary" fill-style="outline" data-action="open-report" @click=${() => handlers.open(report)}>Open the report</swc-button>` : A}</div>`;
+  const shown5 = !body2 ? A : scoop ? b`<div class="text">${markdown(body2)}</div>` : b`<pre class="output">${body2}</pre>`;
+  return b`<div class="report">${shown5}${report ? b`<swc-button size="s" variant="secondary" fill-style="outline" data-action="open-report" @click=${() => handlers.open(report)}>Open the report</swc-button>` : A}</div>`;
 }
 function lick(message, handlers, stamp = true) {
   if (pendingApproval(message)) return decision(message, handlers);
@@ -36695,7 +36695,7 @@ var ModelFilter = class {
   items(options3) {
     if (options3.length <= searchable)
       return b`${options3.map((option2) => this.#item(option2, false))}`;
-    const shown4 = options3.filter((option2) => matchesModel(option2, this.#query));
+    const shown5 = options3.filter((option2) => matchesModel(option2, this.#query));
     return b`<sp-search
         size="s"
         data-action="filter-models"
@@ -36707,8 +36707,8 @@ var ModelFilter = class {
         @submit=${(event2) => event2.preventDefault()}
         @keydown=${this.#key}
       ></sp-search>
-      ${options3.map((option2) => this.#item(option2, !shown4.includes(option2)))}
-      ${shown4.length ? A : b`<sp-menu-item disabled data-empty>No matching models</sp-menu-item>`}`;
+      ${options3.map((option2) => this.#item(option2, !shown5.includes(option2)))}
+      ${shown5.length ? A : b`<sp-menu-item disabled data-empty>No matching models</sp-menu-item>`}`;
   }
   #item(option2, hidden) {
     return b`<sp-menu-item value=${option2.id} ?hidden=${hidden}>${option2.label}<span slot="description">${option2.provider}</span></sp-menu-item>`;
@@ -37884,7 +37884,7 @@ var SliccChat = class _SliccChat extends ThemedElement {
   #items(messages, agent) {
     const out = [];
     let previous3 = "";
-    let shown4;
+    let shown5;
     const model = this.model;
     const last = messages.at(-1);
     const suggestion = last?.role === "assistant" && !agent.frozen && !watchOnly(model) && !model.seat && !model.agent.busy(agent.id) ? model.agent.suggestion(agent.id) : null;
@@ -37910,8 +37910,8 @@ var SliccChat = class _SliccChat extends ThemedElement {
         previous3 = label;
       }
       const next = message.role === "assistant" ? message.model : void 0;
-      const changed2 = !!next && next !== shown4;
-      if (changed2) shown4 = next;
+      const changed2 = !!next && next !== shown5;
+      if (changed2) shown5 = next;
       out.push([
         message.id,
         this.#message(
@@ -39814,12 +39814,12 @@ var SliccTray = class extends ModelElement {
     const title2 = provider ? budgetTitle(provider, budget.window) : "";
     const label = `${title2 || "Budget"} ${budget.percent}%`;
     const line = budgetLine(status2, budget);
-    const shown4 = provider ? b`<span>${providerOf(provider)}<span class="window"> ${budget.window}</span> ${budget.percent}%</span>` : label;
+    const shown5 = provider ? b`<span>${providerOf(provider)}<span class="window"> ${budget.window}</span> ${budget.percent}%</span>` : label;
     return b`${this.#item(
       "usage",
       "monitor",
       `${label}. ${line}`,
-      b`<swc-status-light size="s" variant=${budgetVariant(budget.percent)}>${shown4}</swc-status-light>`,
+      b`<swc-status-light size="s" variant=${budgetVariant(budget.percent)}>${shown5}</swc-status-light>`,
       () => this.#open("monitor")
     )}
       <swc-tooltip for="usage" placement="bottom">${title2 ? `${title2}. ${line}` : line}</swc-tooltip>`;
@@ -40886,8 +40886,8 @@ var SliccAgents = class extends ModelElement {
     const rows2 = ordered(list6).filter(
       (agent) => agent.kind === "cone" || this.#expanded.has(agent.parentId)
     );
-    const shown4 = rows2.find((agent) => agent.id === active);
-    const anchor = shown4 ? active : list6.find((agent) => agent.id === active)?.parentId ?? "";
+    const shown5 = rows2.find((agent) => agent.id === active);
+    const anchor = shown5 ? active : list6.find((agent) => agent.id === active)?.parentId ?? "";
     return b`<div class="list"><ul role="tree" aria-label="Cones and scoops" @keydown=${this.#keydown} @focusin=${this.#focusin} @focusout=${this.#focusout}>
         ${c(
       rows2,
@@ -44164,13 +44164,13 @@ function resolve(panels, raw, reachable2, cone) {
   return found?.id ?? null;
 }
 function state(info) {
-  const shown4 = info.active ? "active" : info.visible ? "shown" : info.open ? "open" : "closed";
-  return info.busy ? `${shown4} \xB7 busy: ${info.busy}` : shown4;
+  const shown5 = info.active ? "active" : info.visible ? "shown" : info.open ? "open" : "closed";
+  return info.busy ? `${shown5} \xB7 busy: ${info.busy}` : shown5;
 }
 function table2(rows2) {
   const lines2 = [["ID", "TITLE", "STATE"], ...rows2.map((row) => [row.id, row.title, state(row)])];
   const widths = [0, 1].map((column) => Math.max(...lines2.map((line) => line[column].length)));
-  return lines2.map(([id, title2, shown4]) => `${id.padEnd(widths[0])}  ${title2.padEnd(widths[1])}  ${shown4}`).join("\n");
+  return lines2.map(([id, title2, shown5]) => `${id.padEnd(widths[0])}  ${title2.padEnd(widths[1])}  ${shown5}`).join("\n");
 }
 var done = (result, note = "") => result.code === 0 ? { stdout: `${result.message}${note}
 `, stderr: "", code: 0 } : { stdout: "", stderr: `panel: ${result.message}
@@ -48468,17 +48468,17 @@ var SliccUpdates = class extends ModelElement {
       return A;
     }
     const before = this.#reached.get(key);
-    const shown4 = progress ? { value: Math.max(before?.value ?? 0, phased(progress)), label: count2 } : before;
-    if (!shown4) {
+    const shown5 = progress ? { value: Math.max(before?.value ?? 0, phased(progress)), label: count2 } : before;
+    if (!shown5) {
       return b`<swc-progress-bar size="s" indeterminate accessible-label=${accessible2}></swc-progress-bar>`;
     }
-    this.#reached.set(key, shown4);
+    this.#reached.set(key, shown5);
     return b`<swc-progress-bar
       size="s"
       min-value="0"
       max-value="100"
-      value=${shown4.value}
-      value-label=${shown4.label}
+      value=${shown5.value}
+      value-label=${shown5.label}
       accessible-label=${accessible2}
     ></swc-progress-bar>`;
   }
@@ -48495,12 +48495,12 @@ var SliccUpdates = class extends ModelElement {
   }
   #actions(item2) {
     const developer = typeof this.model?.updates?.setDeveloper === "function";
-    const shown4 = item2.actions.filter(
+    const shown5 = item2.actions.filter(
       (action) => !betaActions.has(action) || developer && (action !== "install-beta" || item2.npm?.state === "offered")
     );
-    if (!shown4.length) return A;
+    if (!shown5.length) return A;
     const busy = this.pending.has(item2.id);
-    return b`<div class="actions">${shown4.map(
+    return b`<div class="actions">${shown5.map(
       (action) => b`<swc-button
           size="m"
           variant="secondary"
@@ -48514,8 +48514,8 @@ var SliccUpdates = class extends ModelElement {
   #checked(at) {
     if (at === null) return b`<span>Not checked yet</span>`;
     const date = new Date(at);
-    const shown4 = date.toLocaleString("en-GB", { dateStyle: "medium", timeStyle: "short" });
-    return b`<span>Checked <time datetime=${date.toISOString()}>${shown4}</time></span>`;
+    const shown5 = date.toLocaleString("en-GB", { dateStyle: "medium", timeStyle: "short" });
+    return b`<span>Checked <time datetime=${date.toISOString()}>${shown5}</time></span>`;
   }
   #title({ release: release3, certified }, label) {
     return b`${secure(release3.url) ? b`<a class="swc-Link swc-Link--standalone" href=${release3.url} target="_blank" rel="noopener noreferrer" data-action="release-notes" aria-label=${`${label} ${release3.version} release notes`}>${release3.version}</a>` : release3.version}${certified ? b`<swc-badge size="s" variant="positive" subtle data-certified>Certified</swc-badge>` : A}`;
@@ -48567,10 +48567,10 @@ var SliccUpdates = class extends ModelElement {
     const label = item2.state === "failed" && item2.from !== null ? "Update failed" : state2;
     const error = this.failures.get(item2.id) ?? item2.error;
     const developer = typeof this.model?.updates?.setDeveloper === "function";
-    const shown4 = developer ? item2 : { ...item2, npm: null };
-    const meta = npmMeta(shown4);
-    const note = npmNote(shown4);
-    const ahead2 = shown4.npm?.state === "offered" ? shown4.npm.latest ?? null : null;
+    const shown5 = developer ? item2 : { ...item2, npm: null };
+    const meta = npmMeta(shown5);
+    const note = npmNote(shown5);
+    const ahead2 = shown5.npm?.state === "offered" ? shown5.npm.latest ?? null : null;
     return b`<swc-divider size="s"></swc-divider>
     <article data-id=${item2.id} data-state=${item2.state} data-npm=${item2.npm?.state ?? A} aria-label=${item2.label}>
       <div class="head">
@@ -48637,7 +48637,7 @@ var SliccUpdates = class extends ModelElement {
     const light = packageLight(item2);
     const busy = this.busy.get(item2.id);
     const actions2 = item2.registry ? item2.actions.filter((action) => action !== "retry") : item2.actions;
-    const shown4 = busy ? [busy] : act2 ? actions2 : [];
+    const shown5 = busy ? [busy] : act2 ? actions2 : [];
     const error = this.problems.get(item2.id) ?? item2.error;
     const managed = managedText(item2);
     return b`<li data-id=${item2.id} data-state=${item2.state} data-registry=${item2.registry ?? A}>
@@ -48645,7 +48645,7 @@ var SliccUpdates = class extends ModelElement {
         <h3 title=${item2.package}>${item2.label}</h3>
         ${light ? b`<swc-status-light size="s" variant=${light[0]}>${light[1]}</swc-status-light>` : A}
       </div>
-      <div class="buttons">${shown4.map(
+      <div class="buttons">${shown5.map(
       (action) => b`<swc-button
             size="s"
             variant="secondary"
@@ -49483,11 +49483,11 @@ var SliccApp = class extends ThemedElement {
   #rail(items, side) {
     const primary = side === "bottom" ? items.filter((item2) => phoneRail.includes(item2.id)) : items;
     const fit = primary.length < items.length ? Math.min(primary.length, railCapacity(this.#width, Infinity)) : railCapacity(this.#width, items.length);
-    const shown4 = side === "bottom" ? primary.slice(0, fit) : items;
-    const grouped = new Set(shown4.map((item2) => item2.cone).filter(Boolean)).size > 1;
-    return b`<nav class=${`rail ${side}`} aria-label=${`Panels, ${side}`} @dragover=${this.#railOver} @dragleave=${this.#railLeave} @drop=${this.#railDrop}>${shown4.map(
-      (item2, index2) => b`${grouped && index2 && shown4[index2 - 1].cone !== item2.cone ? b`<span class="cones" aria-hidden="true"></span>` : A}${this.#railButton(item2, side)}`
-    )}${this.#more(items.filter((item2) => !shown4.includes(item2)))}</nav>`;
+    const shown5 = side === "bottom" ? primary.slice(0, fit) : items;
+    const grouped = new Set(shown5.map((item2) => item2.cone).filter(Boolean)).size > 1;
+    return b`<nav class=${`rail ${side}`} aria-label=${`Panels, ${side}`} @dragover=${this.#railOver} @dragleave=${this.#railLeave} @drop=${this.#railDrop}>${shown5.map(
+      (item2, index2) => b`${grouped && index2 && shown5[index2 - 1].cone !== item2.cone ? b`<span class="cones" aria-hidden="true"></span>` : A}${this.#railButton(item2, side)}`
+    )}${this.#more(items.filter((item2) => !shown5.includes(item2)))}</nav>`;
   }
   #rails() {
     const dock2 = this.renderRoot.querySelector("slicc-dock");
@@ -50336,15 +50336,65 @@ function truncated(approval) {
 function hintOf(approval) {
   return approval.kind === "sudo" ? commandText(alwaysHint(approval), false) : guestAlwaysHint(approval);
 }
-var deniedSudo = (approval) => approval.kind === "sudo" && approval.verdict?.decision === "deny";
 var tooLong = "This request is too long to show in full, so it can\u2019t be allowed.";
 function guestWaiting(approval) {
   return approval.kind === "guest-message" ? `${approval.requester.name}'s message to ${approval.agentName ?? "this cone"} waits for the owner's approval.` : `${approval.agentName ?? "This cone"} wants to run ${approval.tool} for ${approval.requester.name}, which waits for the owner's approval.`;
 }
-var onceOnly = ({ once }) => once ? b`<p class="hint" data-once-only=${once}>Always allow isn’t offered: xargs adds arguments from its input, and they could include a write flag.</p>` : A;
+var levels2 = {
+  1: { name: "routine", label: "Routine." },
+  2: { name: "permissions", label: "Changes permissions." },
+  3: { name: "harm", label: "Could harm the system." }
+};
+var fits = (aligned) => aligned === void 0 ? "" : aligned ? " It fits what you asked for." : " It isn\u2019t clear it serves what you asked for.";
+function leveled(approval) {
+  const level = approval.verdict?.level;
+  return level === 1 || level === 2 || level === 3 ? level : null;
+}
 var clear = { certain: null, maybe: null, once: null };
-function rulesOf(approval) {
-  return approval.kind === "sudo" ? secretRules(approval.command, approval.cwd) : clear;
+function legacyRules(approval) {
+  return approval.kind === "sudo" && leveled(approval) === null ? secretRules(approval.command, approval.cwd) : clear;
+}
+function legacyClean(approval) {
+  if (approval.kind !== "sudo") return true;
+  if (approval.verdict?.decision === "deny") return false;
+  const { certain: certain2, maybe, once } = legacyRules(approval);
+  return !certain2 && !maybe && !once;
+}
+function legacyNotice(approval) {
+  const verdict = legacyRules(approval);
+  const rules = verdict.certain ?? verdict.maybe;
+  if (rules)
+    return b`<div class="rules" data-secret-rules=${rules}><swc-icon-alert-triangle size="s" aria-hidden="true"></swc-icon-alert-triangle><p>${verdict.certain ? b`<strong>This changes secret rules.</strong> It names <code>${commandText(rules, false)}</code>, where SLICC keeps which secrets programs may use and where they may be sent.` : b`<strong>This may change secret rules.</strong> SLICC can't tell where <code>${commandText(rules, false)}</code> leads, and it could reach the files where SLICC keeps which secrets programs may use and where they may be sent.`} Allow it only if you asked for this change.</p></div>`;
+  return verdict.once && approval.kind === "sudo" && approval.always && approval.verdict?.decision !== "deny" ? b`<p class="hint" data-once-only=${verdict.once}>Always allow isn’t offered: xargs adds arguments from its input, and they could include a write flag.</p>` : A;
+}
+function offersAlways(approval) {
+  return approval.kind !== "tray" && approval.always && (leveled(approval) !== null || legacyClean(approval));
+}
+function verdictNote(approval) {
+  if (approval.kind !== "sudo" || offersAlways(approval)) return "";
+  const level = leveled(approval);
+  if (level === 2) return "Always allow isn\u2019t offered for permission changes.";
+  if (!level && !approval.judging && !approval.verdict && approval.verdictError)
+    return "Always allow appears only with a level 1 verdict.";
+  return "";
+}
+var shown4 = (text4) => {
+  const chars = Array.from(text4);
+  return commandText(chars.length > 300 ? `${chars.slice(0, 299).join("")}\u2026` : text4, false);
+};
+function judged(approval) {
+  const { verdict, judging, verdictError } = approval;
+  const level = leveled(approval);
+  if (verdict && level) {
+    const { name, label } = levels2[level];
+    return b`<div class="judged" data-verdict=${name} data-level=${level}>${level === 3 ? b`<swc-icon-alert-triangle size="s" aria-hidden="true"></swc-icon-alert-triangle>` : A}<p><strong>${label}</strong>${verdict.reason ? b` ${shown4(verdict.reason)}` : ""}${fits(verdict.aligned)}</p></div>`;
+  }
+  if (judging) return b`<div class="judged" data-verdict="checking"><p>Checking…</p></div>`;
+  if (verdict?.decision)
+    return b`<p class="verdict" data-verdict=${verdict.decision}>${verdict.decision === "unsure" ? "The automatic check wasn\u2019t sure" : `The automatic check would ${verdict.decision} this`}: ${shown4(verdict.reason)}</p>`;
+  if (verdictError)
+    return b`<div class="judged" data-verdict="none"><p><strong>No verdict:</strong> ${shown4(verdictError)}</p></div>`;
+  return A;
 }
 function waiting2(model, now) {
   return [...model?.approvals?.list() ?? []].filter((approval) => approval.expiresAt > now && Object.hasOwn(titles, approval.kind)).sort((a20, b10) => a20.createdAt - b10.createdAt);
@@ -50518,6 +50568,39 @@ var SliccApprovals = class extends ModelElement {
         font-family: var(--swc-code-font-family-stack);
         overflow-wrap: anywhere;
       }
+      .judged {
+        display: flex;
+        align-items: flex-start;
+        gap: var(--swc-spacing-100);
+        margin-block-start: var(--swc-spacing-200);
+        padding: var(--swc-spacing-200) var(--swc-spacing-300);
+        border-radius: var(--swc-corner-radius-medium-default);
+        background: var(--swc-neutral-subtle-background-color-default);
+        color: var(--swc-neutral-content-color-default);
+        font-size: var(--swc-font-size-75);
+        overflow-wrap: anywhere;
+      }
+      .judged[data-verdict='checking'],
+      .judged[data-verdict='none'] {
+        color: var(--swc-neutral-subdued-content-color-default);
+      }
+      .judged[data-level='1'] {
+        background: var(--swc-positive-subtle-background-color-default);
+      }
+      .judged[data-level='2'] {
+        background: var(--swc-notice-subtle-background-color-default);
+      }
+      .judged[data-level='3'] {
+        background: var(--swc-negative-subtle-background-color-default);
+        --swc-icon-color: var(--swc-icon-color-negative);
+      }
+      .judged swc-icon-alert-triangle {
+        flex: none;
+        margin-block-start: 0.15em;
+      }
+      .judged p {
+        margin: 0;
+      }
       .problem {
         display: flex;
         align-items: flex-start;
@@ -50578,10 +50661,8 @@ var SliccApprovals = class extends ModelElement {
     const port = this.model?.approvals;
     if (!port?.decide || this.busy || decision2 !== "deny" && (!this.#armed || !this.#whole(approval)))
       return;
-    const verdict = rulesOf(approval);
-    const always = approval.kind === "sudo" || approval.kind !== "tray" && approval.always;
-    if (decision2 === "always" && (!always || deniedSudo(approval) || verdict.certain || verdict.maybe || verdict.once))
-      return;
+    const live = port.list().find(({ id }) => id === approval.id);
+    if (decision2 === "always" && !(live && offersAlways(live))) return;
     this.busy = decision2;
     this.failure = null;
     this.#pending.add(approval.id);
@@ -50709,8 +50790,9 @@ var SliccApprovals = class extends ModelElement {
       ${files.length ? b`<ul class="files" data-attachments>${files.map((file) => b`<li>${file.name} · ${file.mimeType} · ${size3(file.size)}</li>`)}</ul>` : A}`;
   }
   #verdict(approval) {
-    const verdict = approval.kind === "tray" ? void 0 : approval.verdict;
-    return verdict ? b`<p class="verdict" data-verdict=${verdict.decision}>${verdict.decision === "unsure" ? "The automatic check wasn\u2019t sure" : `The automatic check would ${verdict.decision} this`}: ${verdict.reason}</p>` : A;
+    if (approval.kind === "tray") return A;
+    const note = verdictNote(approval);
+    return b`<div class="judge" aria-live="polite">${judged(approval)}${note ? b`<p class="hint" data-verdict-note>${note}</p>` : A}</div>`;
   }
   #actions(approval, rejected, always) {
     if (rejected)
@@ -50718,10 +50800,7 @@ var SliccApprovals = class extends ModelElement {
     const whole = this.#whole(approval);
     return b`${this.#button(approval, "deny", "Deny", "secondary")}
       ${whole && always ? this.#button(approval, "always", inCwd(approval) ? "Always allow in this directory" : "Always allow", "secondary") : A}
-      ${whole ? this.#button(approval, "once", deniedSudo(approval) ? "Allow anyway (once)" : "Allow once", "accent") : A}`;
-  }
-  #offered(approval, rules) {
-    return approval.kind !== "tray" && approval.always && !deniedSudo(approval) && !rules;
+      ${whole ? this.#button(approval, "once", "Allow once", "accent") : A}`;
   }
   render() {
     if (this.gone) {
@@ -50742,10 +50821,7 @@ var SliccApprovals = class extends ModelElement {
     const [approval, ...rest] = held2 ? [held2, ...list6.filter(({ id }) => id !== held2.id)] : list6;
     if (!approval) return A;
     const failure3 = this.failure?.id === approval.id ? this.failure.message : "";
-    const verdict = rulesOf(approval);
-    const rules = verdict.certain ?? verdict.maybe;
-    const offered = this.#offered(approval, rules);
-    const always = offered && !verdict.once;
+    const always = offersAlways(approval);
     const gate = this.#gate(approval);
     const hint2 = always && this.#whole(approval) ? hintOf(approval) : "";
     return this.#dialog(
@@ -50756,8 +50832,7 @@ var SliccApprovals = class extends ModelElement {
           ${this.#request(approval, true)}
           ${approval.kind === "sudo" && approval.cwd ? b`<p class="cwd">In ${commandText(approval.cwd, false)}</p>` : A}
           ${this.#verdict(approval)}
-          ${rules ? b`<div class="rules" data-secret-rules=${rules}><swc-icon-alert-triangle size="s" aria-hidden="true"></swc-icon-alert-triangle><p>${verdict.certain ? b`<strong>This changes secret rules.</strong> It names <code>${commandText(rules, false)}</code>, where SLICC keeps which secrets programs may use and where they may be sent.` : b`<strong>This may change secret rules.</strong> SLICC can't tell where <code>${commandText(rules, false)}</code> leads, and it could reach the files where SLICC keeps which secrets programs may use and where they may be sent.`} Allow it only if you asked for this change.</p></div>` : A}
-          ${offered ? onceOnly(verdict) : A}
+          ${legacyNotice(approval)}
           ${hint2 ? b`<p class="hint">${hint2}</p>` : A}
           ${!failure3 && gate ? b`<p class="hint" data-allow-hint>${gate}</p>` : A}
           ${failure3 ? b`<p class="problem" role="alert" data-error><swc-icon-alert-triangle size="s" aria-hidden="true"></swc-icon-alert-triangle><span>${failure3}</span></p>` : b`<p class="timer" data-timer>Denied automatically in ${countdown(approval.expiresAt - this.now)}.</p>`}
@@ -52498,7 +52573,7 @@ var SliccDiffPanel = class extends ThemedElement {
 // src/app/lucide.ts
 var library = null;
 function load2() {
-  library ??= import("./chunk-2UI4FYPN.js");
+  library ??= import("./chunk-GIS2QBSN.js");
   return library;
 }
 function pascal(name) {
@@ -53105,11 +53180,11 @@ var SliccMemory = class extends ModelElement {
     const scopes = this.#scopes;
     const scope = this.scope;
     const option2 = (item2) => b`<sp-menu-item value=${item2.id}>${item2.label}</sp-menu-item>`;
-    const shown4 = visible2(all2, scope, this.tag, this.query);
+    const shown5 = visible2(all2, scope, this.tag, this.query);
     const total = inScope(all2, scope);
     const filtered = this.tag !== "all" || this.query.trim() !== "";
     const current = scopes.find((item2) => item2.id === scope) ?? null;
-    return b`<div class="bar"><span>${shown4.length} of ${total} memories</span><span class="spacer"></span>
+    return b`<div class="bar"><span>${shown5.length} of ${total} memories</span><span class="spacer"></span>
         <swc-action-button size="s" quiet data-action="remember" @click=${() => this.editing = "new"}><swc-icon-add slot="icon"></swc-icon-add>Remember</swc-action-button>
       </div>
       <div class="tools">
@@ -53132,7 +53207,7 @@ var SliccMemory = class extends ModelElement {
       </div>
       <div class="list">
         ${this.editing === "new" ? b`<div class="row">${this.#form({ scope: scope === everyone ? "global" : scope })}</div>` : A}
-        ${shown4.length ? sections(shown4).map(
+        ${shown5.length ? sections(shown5).map(
       ([section, items]) => b`<section><h3>${section}</h3><ul>${items.map((memory) => this.#row(memory, section))}</ul></section>`
     ) : b`<div class="note">${emptyNote(total, filtered, current)}</div>`}
       </div>`;
@@ -54207,8 +54282,8 @@ var SliccSecrets = class extends ThemedElement {
       const before = entries[entries.length - 1]?.seq;
       const page = await vault.audit(before);
       if (this.model?.vault !== vault || !this.isConnected) return;
-      const shown4 = merged(vault.list()?.audit ?? [], this.older);
-      if (shown4[shown4.length - 1]?.seq !== before) return;
+      const shown5 = merged(vault.list()?.audit ?? [], this.older);
+      if (shown5[shown5.length - 1]?.seq !== before) return;
       this.older = merged(this.older, page.audit);
       this.more = page.more;
     } catch (error) {
@@ -54437,7 +54512,7 @@ var SliccSecrets = class extends ThemedElement {
     </li>`;
   }
   #audit(vault, list6, entries, devices) {
-    const shown4 = this.reveals ? entries.filter((entry) => entry.type === "materialize") : entries;
+    const shown5 = this.reveals ? entries.filter((entry) => entry.type === "materialize") : entries;
     const more = this.more ?? list6.auditMore;
     const back = returned(entries);
     return b`<div class="audit-head">
@@ -54446,7 +54521,7 @@ var SliccSecrets = class extends ThemedElement {
       this.reveals = event2.target.checked;
     }}>Only reveals to programs</sp-switch>
       </div>
-      ${shown4.length ? b`<ol class="audit" aria-labelledby="secrets-audit">${shown4.map((entry) => this.#entry(entry, devices, vault, entries, back))}</ol>` : b`<p class="muted" data-audit-empty>${this.reveals ? more ? "No reveals in the activity loaded so far." : "No program has been given a secret." : "Nothing has used a secret yet."}</p>`}
+      ${shown5.length ? b`<ol class="audit" aria-labelledby="secrets-audit">${shown5.map((entry) => this.#entry(entry, devices, vault, entries, back))}</ol>` : b`<p class="muted" data-audit-empty>${this.reveals ? more ? "No reveals in the activity loaded so far." : "No program has been given a secret." : "Nothing has used a secret yet."}</p>`}
       ${more ? b`<div class="row"><swc-button size="s" variant="secondary" fill-style="outline" data-action="older" ?pending=${this.loading} @click=${() => this.showOlder(vault, entries)}>Show older</swc-button></div>` : A}`;
   }
   #feedback() {
@@ -57578,10 +57653,10 @@ var SliccValueRequest = class extends ThemedElement {
     if (!vault || !request2) return A;
     const locked = !!vault.status()?.locked;
     const rest = queue.length - 1;
-    const shown4 = this.problem?.id === request2.id ? this.problem : null;
-    const problem = shown4?.text ?? "";
-    const name = this.#aria("name", shown4);
-    const field3 = this.#aria("value", shown4);
+    const shown5 = this.problem?.id === request2.id ? this.problem : null;
+    const problem = shown5?.text ?? "";
+    const name = this.#aria("name", shown5);
+    const field3 = this.#aria("value", shown5);
     return i23(
       request2.id,
       b`<dialog role="alertdialog" aria-labelledby="title" aria-describedby="asked" data-request=${request2.id} @cancel=${(event2) => {
@@ -84505,8 +84580,8 @@ var SliccFileTree = class extends HTMLElement {
       const item2 = tree?.getItem(path2);
       return item2 && "isExpanded" in item2 ? item2.isExpanded() : null;
     };
-    const shown4 = (path2) => path2.split("/").slice(0, -2).every((_7, i26, parts3) => open(`${parts3.slice(0, i26 + 1).join("/")}/`) !== false);
-    return this.#paths.filter((path2) => path2.endsWith("/") && open(path2) === true && shown4(path2)).map((path2) => path2.slice(0, -1));
+    const shown5 = (path2) => path2.split("/").slice(0, -2).every((_7, i26, parts3) => open(`${parts3.slice(0, i26 + 1).join("/")}/`) !== false);
+    return this.#paths.filter((path2) => path2.endsWith("/") && open(path2) === true && shown5(path2)).map((path2) => path2.slice(0, -1));
   }
   get gitStatus() {
     return this.#status;