@axplusb/kepler 2.0.7 → 2.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@axplusb/kepler",
-  "version": "2.0.7",
+  "version": "2.2.0",
   "description": "Kepler — AI coding agent with operating brief, preflight planning, and sub-agents. SWE-bench Lite evaluated.",
   "type": "module",
   "bin": {
@@ -14,7 +14,7 @@
   "readme": "KEPLER-README.md",
   "scripts": {
     "start": "node src/terminal/main.mjs",
-    "test": "node test/test-sse-client.mjs && node test/test-tool-executor.mjs && node test/test-project-artifacts.mjs && node test/test-skills.mjs && node test/test-callback.mjs && node test/test-formatter.mjs && node test/test-terminal-rendering.mjs && node test/test-slash-commands.mjs && node test/test-approval.mjs && node test/test-session-manager.mjs && node test/test-safety.mjs && node test/test-jsonl-writer.mjs && node test/test-analytics.mjs && node test/test-stagnation.mjs"
+    "test": "KEPLER_HOME=/tmp/kepler-test-home node test/test-sse-client.mjs && KEPLER_HOME=/tmp/kepler-test-home node test/test-tool-executor.mjs && KEPLER_HOME=/tmp/kepler-test-home node test/test-project-artifacts.mjs && KEPLER_HOME=/tmp/kepler-test-home node test/test-skills.mjs && KEPLER_HOME=/tmp/kepler-test-home node test/test-callback.mjs && KEPLER_HOME=/tmp/kepler-test-home node test/test-rate-limit-display.mjs && KEPLER_HOME=/tmp/kepler-test-home node test/test-preflight.mjs && KEPLER_HOME=/tmp/kepler-test-home node test/test-formatter.mjs && KEPLER_HOME=/tmp/kepler-test-home node test/test-terminal-rendering.mjs && KEPLER_HOME=/tmp/kepler-test-home node test/test-slash-commands.mjs && KEPLER_HOME=/tmp/kepler-test-home node test/test-approval.mjs && KEPLER_HOME=/tmp/kepler-test-home node test/test-approval-log.mjs && KEPLER_HOME=/tmp/kepler-test-home node test/test-kepler-contract.mjs && KEPLER_HOME=/tmp/kepler-test-home node test/test-session-manager.mjs && KEPLER_HOME=/tmp/kepler-test-home node test/test-safety.mjs && KEPLER_HOME=/tmp/kepler-test-home node test/test-jsonl-writer.mjs && KEPLER_HOME=/tmp/kepler-test-home node test/test-analytics.mjs && KEPLER_HOME=/tmp/kepler-test-home node test/test-stagnation.mjs"
   },
   "engines": {
     "node": ">=18.0.0"

package/src/config/hook-runner.mjs

@@ -0,0 +1,100 @@
+import { execFile } from 'node:child_process';
+import * as path from 'node:path';
+import { loadKeplerSettings } from './settings-loader.mjs';
+
+function asArray(value) {
+  if (!value) return [];
+  return Array.isArray(value) ? value : [value];
+}
+
+function matchesHook(hook, toolName) {
+  const matcher = hook.matcher || hook.toolName || hook.tool;
+  if (!matcher) return true;
+  try {
+    return new RegExp(matcher).test(toolName);
+  } catch {
+    return matcher === toolName;
+  }
+}
+
+function runCommand(command, { cwd, env, timeoutMs, input }) {
+  return new Promise((resolve) => {
+    const child = execFile('/bin/sh', ['-lc', command], {
+      cwd,
+      env,
+      timeout: timeoutMs,
+      windowsHide: true,
+    }, (error, stdout, stderr) => {
+      let parsed = null;
+      try { parsed = stdout.trim() ? JSON.parse(stdout.trim()) : null; }
+      catch { parsed = stdout.trim() ? { output: stdout.trim() } : null; }
+      resolve({
+        ok: !error,
+        code: error?.code ?? 0,
+        signal: error?.signal || null,
+        stdout,
+        stderr,
+        parsed,
+        error,
+      });
+    });
+    if (input) child.stdin?.end(JSON.stringify(input));
+  });
+}
+
+export class HookRunner {
+  constructor({ cwd = process.cwd(), settings = null, sessionId = null } = {}) {
+    this.cwd = cwd;
+    this.sessionId = sessionId;
+    this.settings = settings || loadKeplerSettings({ cwd }).settings;
+  }
+
+  reload() {
+    this.settings = loadKeplerSettings({ cwd: this.cwd }).settings;
+  }
+
+  hooksFor(event) {
+    return asArray(this.settings?.hooks?.[event]);
+  }
+
+  async run(event, payload = {}) {
+    const results = [];
+    for (const hook of this.hooksFor(event)) {
+      const toolName = payload.toolName || payload.tool || '';
+      if ((event === 'PreToolUse' || event === 'PostToolUse') && !matchesHook(hook, toolName)) continue;
+      const timeoutSeconds = hook.timeout ?? this.settings?.hooks?.timeout ?? 5;
+      const input = {
+        event,
+        tool_name: toolName,
+        tool_input: payload.input || payload.args || {},
+        tool_result: payload.result || null,
+        project_dir: this.cwd,
+        session_id: this.sessionId || '',
+      };
+      const env = {
+        ...process.env,
+        ...(this.settings?.env || {}),
+        KEPLER_TOOL_NAME: toolName,
+        KEPLER_TOOL_INPUT_FILE_PATH: input.tool_input.file_path || input.tool_input.path || '',
+        KEPLER_PROJECT_DIR: this.cwd,
+        KEPLER_SESSION_ID: this.sessionId || '',
+        KEPLER_TURN_ID: payload.turnId || '',
+      };
+      const result = await runCommand(hook.command, {
+        cwd: path.resolve(this.cwd),
+        env,
+        timeoutMs: timeoutSeconds * 1000,
+        input,
+      });
+      results.push({ hook, ...result });
+      if (result.code === 2 || result.parsed?.block === true || result.parsed?.decision === 'deny') {
+        return {
+          blocked: true,
+          message: result.parsed?.message || result.stderr?.trim() || `Blocked by hook: ${hook.command}`,
+          results,
+        };
+      }
+    }
+    return { blocked: false, results };
+  }
+}

package/src/config/memory-loader.mjs

@@ -0,0 +1,32 @@
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+function readIfExists(filePath, maxChars = 12000) {
+  try {
+    if (!fs.existsSync(filePath)) return null;
+    const content = fs.readFileSync(filePath, 'utf-8');
+    return {
+      path: filePath,
+      content: content.length > maxChars
+        ? content.slice(0, maxChars) + '\n\n[...truncated...]'
+        : content,
+    };
+  } catch {
+    return null;
+  }
+}
+
+export function loadKeplerMemory({ cwd = process.cwd() } = {}) {
+  const files = [];
+  const global = readIfExists(path.join(os.homedir(), '.kepler', 'KEPLER.md'));
+  if (global) files.push({ source: 'global', ...global });
+
+  const topLevel = readIfExists(path.join(cwd, 'KEPLER.md'));
+  if (topLevel) files.push({ source: 'project-top-level', ...topLevel });
+
+  const project = readIfExists(path.join(cwd, '.kepler', 'KEPLER.md'));
+  if (project) files.push({ source: 'project', ...project });
+
+  return files;
+}

package/src/config/settings-loader.mjs

@@ -0,0 +1,45 @@
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { deepMerge } from '../core/policy-resolver.mjs';
+
+export const DEFAULT_KEPLER_SETTINGS = Object.freeze({
+  env: {},
+  permissions: {
+    shellAllowlist: [],
+    editDenylist: [],
+  },
+  hooks: {
+    UserPromptSubmit: [],
+    PreToolUse: [],
+    PostToolUse: [],
+    Stop: [],
+  },
+});
+
+function readJson(filePath) {
+  try {
+    if (!fs.existsSync(filePath)) return null;
+    return JSON.parse(fs.readFileSync(filePath, 'utf-8'));
+  } catch (err) {
+    return { __error: err.message };
+  }
+}
+
+export function loadKeplerSettings({ cwd = process.cwd() } = {}) {
+  const base = path.join(cwd, '.kepler');
+  const layers = [
+    { name: 'default', path: null, data: DEFAULT_KEPLER_SETTINGS },
+  ];
+  for (const [name, file] of [
+    ['project', path.join(base, 'settings.json')],
+    ['local', path.join(base, 'settings.local.json')],
+  ]) {
+    const data = readJson(file);
+    if (data && !data.__error) layers.push({ name, path: file, data });
+    else if (data?.__error) layers.push({ name, path: file, error: data.__error, data: {} });
+  }
+
+  let settings = {};
+  for (const layer of layers) settings = deepMerge(settings, layer.data || {});
+  return { settings, layers };
+}

package/src/core/approval-log.mjs

@@ -0,0 +1,104 @@
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+const REDACTED = 'REDACTED';
+const SENSITIVE_KEY_RE = /^(?:authorization|api[-_]?key|apikey|key|token|access[-_]?token|refresh[-_]?token|secret|password|passwd|pwd|access[-_]?key|secret[-_]?access[-_]?key)$|(?:^|[-_])(?:api[-_]?key|apikey|token|secret|password|passwd|pwd|access[-_]?key|secret[-_]?access[-_]?key)(?:$|[-_])/i;
+const SENSITIVE_ASSIGNMENT_KEY = String.raw`[A-Z0-9_-]*(?:API[-_]?KEY|APIKEY|TOKEN|SECRET|PASSWORD|PASSWD|PWD|ACCESS[-_]?KEY|SECRET[-_]?ACCESS[-_]?KEY)[A-Z0-9_-]*`;
+const SENSITIVE_JSON_KEY = String.raw`(?:authorization|api[-_]?key|apikey|key|token|access[-_]?token|refresh[-_]?token|secret|password|passwd|pwd|access[-_]?key|secret[-_]?access[-_]?key|[A-Z0-9_-]*(?:API[-_]?KEY|APIKEY|TOKEN|SECRET|PASSWORD|PASSWD|PWD|ACCESS[-_]?KEY|SECRET[-_]?ACCESS[-_]?KEY)[A-Z0-9_-]*)`;
+
+export function redactSensitive(str) {
+  let s = String(str ?? '');
+
+  // Authorization headers in shell commands, curl args, and copied HTTP snippets.
+  s = s.replace(/(Authorization\s*:\s*(?:Bearer|Basic)\s+)(?:"[^"]*"|'[^']*'|[^\s"',;]+)/gi, `$1${REDACTED}`);
+
+  // Secret-bearing query/form parameters.
+  s = s.replace(/([?&](?:api_key|apikey|api-key|key|token|access_token|refresh_token|password|secret)=)([^&\s"']+)/gi, `$1${REDACTED}`);
+
+  // Env-style assignments, including quoted values.
+  s = s.replace(
+    new RegExp(`(^|[\\s;,])(${SENSITIVE_ASSIGNMENT_KEY}\\s*=\\s*)(?:"[^"]*"|'[^']*'|[^\\s"',;]+)`, 'gi'),
+    (_match, prefix, key) => `${prefix}${key}${REDACTED}`
+  );
+
+  // JSON fragments that arrive as strings rather than structured objects.
+  s = s.replace(
+    new RegExp(`("(?:${SENSITIVE_JSON_KEY})"\\s*:\\s*)(?:"(?:\\\\.|[^"\\\\])*"|[^,}\\s]+)`, 'gi'),
+    `$1"${REDACTED}"`
+  );
+
+  return s;
+}
+
+function isSensitiveKey(key) {
+  return SENSITIVE_KEY_RE.test(String(key || ''));
+}
+
+function sanitizeForLog(value, depth = 0) {
+  if (depth > 12) return '[MaxDepth]';
+  if (typeof value === 'string') return redactSensitive(value);
+  if (value == null || typeof value !== 'object') return value;
+  if (Array.isArray(value)) return value.slice(0, 100).map(item => sanitizeForLog(item, depth + 1));
+
+  const out = {};
+  for (const [key, item] of Object.entries(value)) {
+    out[key] = isSensitiveKey(key) ? REDACTED : sanitizeForLog(item, depth + 1);
+  }
+  return out;
+}
+
+function safeArgs(args) {
+  if (args?.command) return redactSensitive(String(args.command)).slice(0, 500);
+  if (args?.file_path || args?.path) return redactSensitive(String(args.file_path || args.path)).slice(0, 500);
+  try { return JSON.stringify(sanitizeForLog(args || {})).slice(0, 500); }
+  catch { return redactSensitive(String(args || '')).slice(0, 500); }
+}
+
+function safeText(value, max = 500) {
+  if (!value) return undefined;
+  return redactSensitive(String(value)).slice(0, max);
+}
+
+export class ApprovalLog {
+  constructor({ cwd = process.cwd() } = {}) {
+    this.cwd = cwd;
+    this.filePath = path.join(cwd, '.kepler', 'approvals.log');
+  }
+
+  append(entry) {
+    try {
+      fs.mkdirSync(path.dirname(this.filePath), { recursive: true, mode: 0o700 });
+      const line = JSON.stringify({
+        ts: new Date().toISOString(),
+        tier: entry.tier,
+        tool: entry.tool,
+        args: safeArgs(entry.args),
+        decision: entry.decision,
+        scope: entry.scope || 'once',
+        rule_id: entry.rule_id || null,
+        reason: safeText(entry.reason),
+      });
+      fs.appendFileSync(this.filePath, line + '\n', { mode: 0o600 });
+      try { fs.chmodSync(this.filePath, 0o600); } catch {}
+    } catch { /* approval logging must not block execution */ }
+  }
+
+  readRecent(limit = 20) {
+    try {
+      if (!fs.existsSync(this.filePath)) return [];
+      return fs.readFileSync(this.filePath, 'utf-8')
+        .trim()
+        .split('\n')
+        .filter(Boolean)
+        .slice(-limit)
+        .map(line => {
+          try { return JSON.parse(line); }
+          catch { return null; }
+        })
+        .filter(Boolean)
+        .reverse();
+    } catch {
+      return [];
+    }
+  }
+}

package/src/core/approval.mjs

@@ -20,9 +20,12 @@ import {
 } from './risk-tier.mjs';
 import {
   renderApprovalPrompt,
-  renderInlinePrompt,
+  renderTrustedApproval,
   defaultOptions as approvalOptions,
 } from '../ui/approval.mjs';
+import { ApprovalLog } from './approval-log.mjs';
+import { TrustStore } from './trust.mjs';
+import { loadEffectivePolicy } from './policy-resolver.mjs';
 
 // ── Tool Classification ──
 //
@@ -36,6 +39,8 @@ const WRITE_TOOLS = new Set([
 
 function defaultWhy(tier, tool, args) {
     switch (tier) {
+        case TIERS.SENSITIVE_READ:
+            return `Reads a sensitive path (${toolDisplaySummary(tool, args) || 'secret-like file'}). Confirm before exposing its contents to the agent.`;
         case TIERS.SHELL_DANGEROUS:
             return `Shell command matches a high-risk pattern (rm -rf, sudo, force push, etc.). Confirm before running.`;
         case TIERS.DESTRUCTIVE:
@@ -66,12 +71,17 @@ const write = (s) => process.stderr.write(s);
 // ── Approval Manager ──
 
 export class ApprovalManager {
-    constructor({ autoApprove = false, planMode = false } = {}) {
+    constructor({ autoApprove = false, planMode = false, cwd = process.cwd(), policy = null, trustStore = null, approvalLog = null } = {}) {
         this.autoApprove = autoApprove;
         this.planMode = planMode;
+        this.cwd = cwd;
+        this.policy = policy || loadEffectivePolicy({ cwd }).policy;
+        this.trustStore = trustStore || new TrustStore({ cwd, policy: this.policy });
+        this.approvalLog = approvalLog || new ApprovalLog({ cwd });
         this.approveAll = false;
         this.approvedToolTypes = new Set();
         this.history = [];
+        this.rejectionHints = [];
         this._rl = null;
     }
 
@@ -86,7 +96,8 @@ export class ApprovalManager {
         const wasActive = this.approveAll || this.approvedToolTypes.size > 0;
         this.approveAll = false;
         this.approvedToolTypes.clear();
-        return wasActive;
+        const trustActive = this.trustStore?.revoke?.() || false;
+        return wasActive || trustActive;
     }
 
     getModeLabel() {
@@ -122,14 +133,32 @@ export class ApprovalManager {
             return { approved: true, tier, requireCheckpoint: true };
         }
 
+        const trust = this.trustStore?.find?.(toolName, args, tier);
+        if (trust?.decision === 'deny') {
+            this.history.push({ tool: toolName, decision: 'trusted-deny', tier, time: Date.now(), rule_id: trust.rule?.id });
+            this.approvalLog.append({ tool: toolName, args, tier, decision: 'deny_trusted', scope: trust.rule?.scope, rule_id: trust.rule?.id });
+            return { approved: false, tier, reason: `Denied by trust rule ${trust.rule?.id || ''}`.trim() };
+        }
+        if (trust?.decision === 'allow') {
+            this.history.push({ tool: toolName, decision: 'auto_trusted', tier, time: Date.now(), rule_id: trust.rule?.id });
+            this.approvalLog.append({ tool: toolName, args, tier, decision: 'auto_trusted', scope: trust.rule?.scope, rule_id: trust.rule?.id });
+            write(renderTrustedApproval({ tool: toolName, args, scope: trust.rule?.scope, ruleId: trust.rule?.id }));
+            return { approved: true, tier, scope: trust.rule?.scope, rule_id: trust.rule?.id };
+        }
+        if (trust?.decision === 'reask' && trust.reason) {
+            context.reason = context.reason || context.why || `Re-asking: ${trust.reason}`;
+        }
+
         // Honor approve-all / type-allow shortcuts for non-explicit tiers only.
         if (!requiresExplicitApproval(tier)) {
             if (this.approveAll) {
                 this.history.push({ tool: toolName, decision: 'auto-all', tier, time: Date.now() });
+                this.approvalLog.append({ tool: toolName, args, tier, decision: 'auto-all', scope: 'session' });
                 return { approved: true, tier };
             }
             if (this.approvedToolTypes.has(toolName)) {
                 this.history.push({ tool: toolName, decision: 'type-auto', tier, time: Date.now() });
+                this.approvalLog.append({ tool: toolName, args, tier, decision: 'type-auto', scope: 'session' });
                 return { approved: true, tier };
             }
         }
@@ -139,10 +168,9 @@ export class ApprovalManager {
 
     async _prompt(toolName, args, context = {}) {
         const tier = context.tier || classifyTier(toolName, args);
-        const explicit = requiresExplicitApproval(tier);
         const why = context.reason || context.why || defaultWhy(tier, toolName, args);
         const summary = toolDisplaySummary(toolName, args);
-        const options = approvalOptions(tier);
+        const options = this._optionsFor(tier);
 
         let selected = 0; // arrow-driven cursor
         let printedHeight = 0;
@@ -151,12 +179,10 @@ export class ApprovalManager {
         // live. For non-TTYs / pipes we just print once and read a line.
         const isInteractive = process.stdin.isTTY;
         if (!isInteractive) {
-            write(explicit
-                ? renderApprovalPrompt({ tool: toolName, args, tier, why, selected, options }) + '\n'
-                : renderInlinePrompt({ tool: toolName, args, tier, why }) + '\n');
+            write(renderApprovalPrompt({ tool: toolName, args, tier, why, selected, options }) + '\n');
         }
 
-        const drawExplicit = () => {
+        const drawPrompt = () => {
             // Move up over the previous render before re-printing.
             if (printedHeight > 0) {
                 write(`\x1b[${printedHeight}F`); // cursor to start of N lines above
@@ -167,8 +193,7 @@ export class ApprovalManager {
             printedHeight = block.split('\n').length;
         };
 
-        if (isInteractive && explicit) drawExplicit();
-        if (isInteractive && !explicit) write(renderInlinePrompt({ tool: toolName, args, tier, why }) + '\n');
+        if (isInteractive) drawPrompt();
 
         // ── Input loop ─────────────────────────────────────────────────
         const choose = async () => {
@@ -176,15 +201,15 @@ export class ApprovalManager {
                 const k = await this._readKey();
 
                 if (k === 'up' || k === 'left') {
-                    if (!explicit || !isInteractive) continue;
+                    if (!isInteractive) continue;
                     selected = (selected - 1 + options.length) % options.length;
-                    drawExplicit();
+                    drawPrompt();
                     continue;
                 }
                 if (k === 'down' || k === 'right' || k === 'tab') {
-                    if (!explicit || !isInteractive) continue;
+                    if (!isInteractive) continue;
                     selected = (selected + 1) % options.length;
-                    drawExplicit();
+                    drawPrompt();
                     continue;
                 }
                 if (k === 'return') {
@@ -198,7 +223,7 @@ export class ApprovalManager {
                     const idx = options.findIndex(o => o.key === lower);
                     if (idx >= 0) {
                         selected = idx;
-                        if (isInteractive && explicit) drawExplicit();
+                        if (isInteractive) drawPrompt();
                         return options[idx].value;
                     }
                 }
@@ -212,25 +237,51 @@ export class ApprovalManager {
             case 'approve':
                 write(`  ${GREEN}✓${RST}  ${DIM}${toolName}${RST} ${DIM}${summary.slice(0, 60)}${RST}\n\n`);
                 this.history.push({ tool: toolName, decision: 'yes', tier, time: Date.now() });
+                this.approvalLog.append({ tool: toolName, args, tier, decision: 'approve', scope: 'once' });
                 return { approved: true, tier };
 
+            case 'allow-session': {
+                if (!this.policy.hitl?.allowSessionTrust) return this._prompt(toolName, args, context);
+                const rule = this.trustStore.add({ tool: toolName, args, tier, scope: 'SESSION' });
+                write(`  ${GREEN}✓${RST}  ${DIM}trusted for this session: ${rule.pattern}${RST}\n\n`);
+                this.history.push({ tool: toolName, decision: 'session-trust', tier, time: Date.now(), rule_id: rule.id });
+                this.approvalLog.append({ tool: toolName, args, tier, decision: 'approve_trusted', scope: 'SESSION', rule_id: rule.id });
+                return { approved: true, tier, scope: 'SESSION', rule_id: rule.id };
+            }
+
+            case 'allow-project': {
+                if (!this.policy.hitl?.allowProjectTrust) return this._prompt(toolName, args, context);
+                const rule = this.trustStore.add({ tool: toolName, args, tier, scope: 'PROJECT' });
+                write(`  ${GREEN}✓${RST}  ${DIM}trusted for this project: ${rule.pattern}${RST}\n\n`);
+                this.history.push({ tool: toolName, decision: 'project-trust', tier, time: Date.now(), rule_id: rule.id });
+                this.approvalLog.append({ tool: toolName, args, tier, decision: 'approve_trusted', scope: 'PROJECT', rule_id: rule.id });
+                return { approved: true, tier, scope: 'PROJECT', rule_id: rule.id };
+            }
+
             case 'reject':
-                write(`  ${RED}✗${RST}  ${DIM}denied${RST}\n\n`);
-                this.history.push({ tool: toolName, decision: 'no', tier, time: Date.now() });
-                return { approved: false, tier, reason: 'User denied' };
+            {
+                const reason = 'User stopped the command';
+                write(`  ${RED}✗${RST}  ${DIM}stopped${RST}\n\n`);
+                this.history.push({ tool: toolName, decision: 'no', tier, time: Date.now(), reason });
+                this.approvalLog.append({ tool: toolName, args, tier, decision: 'reject', scope: 'once', reason });
+                this._rememberRejection({ tool: toolName, args, tier, decision: 'reject', reason, note: '' });
+                return { approved: false, tier, reason };
+            }
 
             case 'allow-all':
-                if (explicit) return this._prompt(toolName, args, context);
+                if (requiresExplicitApproval(tier)) return this._prompt(toolName, args, context);
                 this.approveAll = true;
                 write(`  ${GREEN}✓✓${RST} ${DIM}allow-all activated${RST}\n\n`);
                 this.history.push({ tool: toolName, decision: 'approve-all', tier, time: Date.now() });
+                this.approvalLog.append({ tool: toolName, args, tier, decision: 'approve-all', scope: 'session' });
                 return { approved: true, tier };
 
             case 'allow-type':
-                if (explicit) return this._prompt(toolName, args, context);
+                if (requiresExplicitApproval(tier)) return this._prompt(toolName, args, context);
                 this.approvedToolTypes.add(toolName);
                 write(`  ${GREEN}✓${RST}  ${DIM}always allow ${toolName}${RST}\n\n`);
                 this.history.push({ tool: toolName, decision: 'type-approve', tier, time: Date.now() });
+                this.approvalLog.append({ tool: toolName, args, tier, decision: 'type-approve', scope: 'session' });
                 return { approved: true, tier };
 
             case 'why':
@@ -240,9 +291,15 @@ export class ApprovalManager {
 
             case 'edit':
             case 'replan':
-                write(`  ${YELLOW}↩${RST}  ${DIM}reject with hint — rework the plan${RST}\n\n`);
-                this.history.push({ tool: toolName, decision: 'replan', tier, time: Date.now() });
-                return { approved: false, tier, reason: 'User asked to re-plan' };
+            {
+                const note = await this._readLinePrompt(`  ${DIM}How would you like to proceed? ${RST}`);
+                const reason = note ? `User asked to re-plan: ${note}` : 'User asked to re-plan';
+                write(`  ${YELLOW}↩${RST}  ${DIM}${note ? `re-plan — ${truncateNote(note)}` : 'reject with hint — rework the plan'}${RST}\n\n`);
+                this.history.push({ tool: toolName, decision: 'replan', tier, time: Date.now(), reason });
+                this.approvalLog.append({ tool: toolName, args, tier, decision: 'replan', scope: 'once', reason });
+                this._rememberRejection({ tool: toolName, args, tier, decision: 'replan', reason, note });
+                return { approved: false, tier, reason };
+            }
 
             default:
                 return this._prompt(toolName, args, context);
@@ -287,6 +344,70 @@ export class ApprovalManager {
         });
     }
 
+    _readLinePrompt(label) {
+        return new Promise((resolve) => {
+            if (!process.stdin.isTTY) {
+                resolve('');
+                return;
+            }
+
+            if (this._execPause) this._execPause();
+            if (this._rl) this._rl.pause();
+
+            const wasRaw = process.stdin.isRaw;
+            if (typeof process.stdin.setRawMode === 'function') {
+                process.stdin.setRawMode(false);
+            }
+            process.stdin.resume();
+            write(label);
+
+            let buffer = '';
+            const cleanup = () => {
+                process.stdin.off('data', onData);
+                if (typeof process.stdin.setRawMode === 'function') {
+                    process.stdin.setRawMode(wasRaw || false);
+                }
+                if (this._rl) this._rl.resume();
+                if (this._execResume) this._execResume();
+            };
+            const finish = () => {
+                cleanup();
+                resolve(buffer.trim());
+            };
+            const onData = (data) => {
+                const str = data.toString();
+                if (data[0] === 0x03) process.exit(0);
+                if (data[0] === 0x1b) {
+                    buffer = '';
+                    write('\n');
+                    finish();
+                    return;
+                }
+                if (str.includes('\n') || str.includes('\r')) {
+                    buffer += str.replace(/[\r\n].*$/s, '');
+                    finish();
+                    return;
+                }
+                buffer += str;
+            };
+
+            process.stdin.on('data', onData);
+        });
+    }
+
+    _optionsFor(tier) {
+        const options = approvalOptions(tier);
+        if (requiresExplicitApproval(tier)) {
+            if (this.policy.hitl?.allowSessionTrust) {
+                options.splice(1, 0, { key: 's', label: 'session', value: 'allow-session', hint: 'trust this pattern until expiry' });
+            }
+            if (this.policy.hitl?.allowProjectTrust) {
+                options.splice(1, 0, { key: 'a', label: 'project', value: 'allow-project', hint: 'trust this pattern in this repo' });
+            }
+        }
+        return options;
+    }
+
     getSummary() {
         const approved = this.history.filter(h => h.decision !== 'no').length;
         const denied = this.history.filter(h => h.decision === 'no').length;
@@ -296,6 +417,25 @@ export class ApprovalManager {
             denied,
             autoApproveAll: this.approveAll,
             autoApprovedTypes: [...this.approvedToolTypes],
+            trust: this.trustStore?.summary?.() || { sessionRules: 0, projectRules: 0 },
         };
     }
+
+    _rememberRejection(entry) {
+        this.rejectionHints.push({ ...entry, time: Date.now() });
+        if (this.rejectionHints.length > 10) {
+            this.rejectionHints.splice(0, this.rejectionHints.length - 10);
+        }
+    }
+
+    consumeRejectionHints() {
+        const hints = [...this.rejectionHints];
+        this.rejectionHints = [];
+        return hints;
+    }
+}
+
+function truncateNote(note) {
+    const text = String(note || '').trim();
+    return text.length <= 120 ? text : text.slice(0, 119) + '…';
 }

package/src/core/context-envelope.mjs

@@ -0,0 +1,54 @@
+import { contextToPromptBlock } from './project-context-loader.mjs';
+
+export function buildContextEnvelope({
+  cwd = process.cwd(),
+  command = null,
+  args = [],
+  source = 'repl',
+  dryRun = false,
+  aliasesResolved = [],
+  effectivePolicy,
+  projectContext,
+  activeHints = [],
+  projectResources = [],
+  agentContext = {},
+} = {}) {
+  const policy = effectivePolicy?.policy || {};
+  const commandTimeouts = policy.commands?.timeouts || {};
+  const enabled = policy.commands?.enabled || [];
+  const activeCommand = command || null;
+  const specificTimeout = activeCommand ? commandTimeouts[`${activeCommand}Seconds`] : null;
+
+  return {
+    cwd,
+    project_resources: projectResources,
+    agent_context: agentContext,
+    project_context: {
+      loaded_files: projectContext?.loaded || [],
+      changed_files: projectContext?.changed?.map(f => ({ label: f.label, path: f.path, hash: f.hash })) || [],
+      prompt_block: contextToPromptBlock(projectContext),
+    },
+    command_context: {
+      active_command: activeCommand,
+      source,
+      args,
+      dry_run: dryRun,
+      aliases_resolved: aliasesResolved,
+      runtime_limits: {
+        command_timeout_seconds: specificTimeout || commandTimeouts.defaultSeconds || 300,
+        tool_timeout_seconds: 120,
+        approval_timeout_seconds: null,
+      },
+    },
+    effective_options: {
+      commands_enabled: enabled,
+      plan_owner: policy.planning?.owner || 'auto',
+      hitl_default_scope: policy.hitl?.defaultScope || 'once',
+      reask_after_minutes: policy.hitl?.reaskAfterMinutes ?? 30,
+      hook_timeout_seconds: policy.hooks?.timeoutSeconds ?? 5,
+    },
+    context_hints: activeHints,
+    available_skills: projectContext?.available_skills || [],
+    task_state: projectContext?.task_state || [],
+  };
+}