@cruxy/cli 1.7.0 → 1.8.0

package/dist/approval/policy.js

@@ -8,16 +8,118 @@ import { promptForApproval } from "./prompt.js";
  */
 export class SessionAllowlist {
     grants = [];
-    /** Record a session grant for `request`'s scope. No-op when nothing is safe to grant. */
+    /**
+     * Record a session grant for `request`'s scope. No-op when nothing is safe to
+     * grant — and no-op when an identical grant is already held (cli#196).
+     *
+     * DEDUPE ON WRITE. Approving `git status` twice recorded two entries that
+     * matched exactly the same set of future actions, and `size()` counted both.
+     * That was invisible while nothing listed them: two identical rows change no
+     * decision, and `allows()` short-circuits on the first. `/permissions` is the
+     * surface that makes it visible, and a list showing the same grant twice reads
+     * as two different permissions the user cannot tell apart — or, worse, invites
+     * revoking one and being surprised the other still allows the command.
+     *
+     * Identity is the (tier, scope) pair, which is exactly what `allows()` matches
+     * on: two entries agreeing on both are indistinguishable to every reader, so
+     * collapsing them removes a row and never a permission.
+     */
     grant(request) {
         if (request.scope.kind === "none")
             return;
-        this.grants.push({ tier: request.tier, scope: request.scope });
+        const entry = { tier: request.tier, scope: request.scope };
+        if (this.grants.some((g) => sameGrant(g, entry)))
+            return;
+        this.grants.push(entry);
     }
-    /** Does an existing grant cover `request`? Requires same tier **and** scope match. */
+    /**
+     * Does an existing grant cover `request`? Requires same tier **and** scope
+     * match — and, before either, that the action is **reversible**.
+     *
+     * THE CEILING OUTRANKS THE GRANT (cli#193). A session grant is keyed on the
+     * program token, so approving `git status` with "allow this session" grants
+     * `git` — and without this line a later `git push --force` in the same root
+     * matched that grant and ran silently. The asymmetry that made it indefensible:
+     * with no grant at all, a force-push prompts even in auto-approve; the safest-
+     * feeling act available to a user (approving a read-only command) was what
+     * disarmed the gate.
+     *
+     * The check lives HERE, in the allowlist, rather than at either policy's call
+     * site, because there are two of them and they share one allowlist:
+     * `InteractivePolicy.decide` and `PlanExecutionPolicy.decide` each ask
+     * `allows()` first, so a fix in either one leaves the other open. This is the
+     * chokepoint every grant lookup passes through — the only place the ceiling
+     * cannot be routed around by adding a third caller.
+     *
+     * The gate is `irreversible`, NOT `tier` (every shell command is
+     * `destructive`, `ls` included) — see {@link ApprovalRequest.irreversible}.
+     *
+     * The cost is real and was accepted knowingly: a granted `git` no longer covers
+     * `git commit`, so an edit→commit loop re-prompts. The grant keeps its value
+     * for everything the checkpoint can restore, and the prompt now says out loud
+     * why the grant did not apply (see {@link overriddenGrant}) rather than looking
+     * like the grant was forgotten.
+     */
     allows(request) {
+        if (request.irreversible)
+            return false;
         return this.grants.some((g) => g.tier === request.tier && scopeCovers(g.scope, request));
     }
+    /**
+     * The grant the ceiling just overrode, or `null` if there was none.
+     *
+     * Purely for the prompt's copy: when a user who said "allow `git` this
+     * session" is asked anyway, the only useful thing to tell them is that we
+     * remember the grant and this action is outside what it can cover. Without it
+     * the re-prompt is indistinguishable from the allowlist having lost the grant.
+     *
+     * Deliberately answers `null` for a reversible request — there the grant was
+     * not overridden, {@link allows} already honored it.
+     */
+    overriddenGrant(request) {
+        if (!request.irreversible)
+            return null;
+        const match = this.grants.find((g) => g.tier === request.tier && scopeCovers(g.scope, request));
+        return match ? match.scope : null;
+    }
+    /**
+     * Every standing grant, in the order they were made — the read side
+     * `/permissions` renders (cli#196).
+     *
+     * The order is the API, not an implementation detail: {@link revoke} takes a
+     * position in THIS list, because a `Scope` has no stable id and the user is
+     * pointing at a row they can see.
+     */
+    list() {
+        return this.grants;
+    }
+    /**
+     * Drop the grant at `index` in {@link list} order. Returns what was removed,
+     * or `null` when the index names no row.
+     *
+     * #196 said this view would hold "nothing mutable", and revoking is a
+     * DELIBERATE REVERSAL of that line rather than something that slipped in
+     * beside it. The argument there was the failure mode: an agent mid-turn
+     * holding a grant that vanishes. The answer is to define what revoking means
+     * narrowly enough that the failure cannot occur — **no future lookup
+     * matches** — and to say so out loud on the surface that offers it. An action
+     * already past `allows()` keeps the decision it was given; nothing reaches
+     * back into a turn to un-approve work that is running. What the user gets is
+     * the guarantee they actually asked for, which is about the NEXT command.
+     *
+     * Deliberately NOT routed through `approvalMutex`. The mutex serializes
+     * prompting and checkpointing so two actions cannot interleave a snapshot;
+     * this touches neither. Taking it would buy nothing and cost the thing that
+     * makes revoke worth having — with a prompt pending, `runExclusive` would
+     * block `/permissions revoke` behind the very action the user is trying to
+     * stop granting.
+     */
+    revoke(index) {
+        if (!Number.isInteger(index) || index < 0 || index >= this.grants.length) {
+            return null;
+        }
+        return this.grants.splice(index, 1)[0];
+    }
     clear() {
         this.grants = [];
     }
@@ -25,6 +127,36 @@ export class SessionAllowlist {
         return this.grants.length;
     }
 }
+/**
+ * Whether two grants allow exactly the same set of actions — the dedupe test.
+ *
+ * Field by field per scope kind rather than a JSON compare, because identity
+ * here means "matches the same requests" and not every field participates in
+ * matching: `file-subtree.exact` is a label for the prompt, and two entries
+ * differing only there cover an identical set of targets. The mirror of
+ * {@link scopeCovers} — if a field is read there, it is compared here.
+ */
+function sameGrant(a, b) {
+    if (a.tier !== b.tier || a.scope.kind !== b.scope.kind)
+        return false;
+    const [x, y] = [a.scope, b.scope];
+    if (x.kind === "shell-prefix" && y.kind === "shell-prefix") {
+        return x.token === y.token && x.root === y.root;
+    }
+    if (x.kind === "shell-exact" && y.kind === "shell-exact") {
+        return x.command === y.command && x.root === y.root;
+    }
+    if (x.kind === "mcp-tool" && y.kind === "mcp-tool") {
+        return x.server === y.server && x.tool === y.tool && x.root === y.root;
+    }
+    if (x.kind === "file-subtree" && y.kind === "file-subtree") {
+        // `exact` is not compared: it describes the same absolute path either way,
+        // and `scopeCovers` never reads it — two entries differing only there cover
+        // an identical set of targets.
+        return x.root === y.root;
+    }
+    return false;
+}
 /**
  * Whether `scope` covers `request`. Shell: the command must be *provably simple*
  * ({@link commandTokens}) and its program token must equal the granted token —
@@ -95,7 +227,9 @@ export class InteractivePolicy {
     }
     async decide(request) {
         // A grant the allowlist answers shows the user nothing (P3) — left
-        // unflagged so a caller can render the change instead.
+        // unflagged so a caller can render the change instead. `allows` enforces the
+        // ceiling itself (cli#193), so an irreversible action never lands here no
+        // matter how broad the grant that would otherwise cover it.
         if (this.allowlist.allows(request))
             return { allow: true };
         // Auto-approve: allowed without a prompt, and deliberately NOT flagged as
@@ -120,7 +254,10 @@ export class InteractivePolicy {
         // dishonest. See `ApprovalRequest.irreversible`.
         if (this.autoApprove() && !request.irreversible)
             return { allow: true };
-        const choice = await promptForApproval(request, this.io);
+        // If a grant matched and the ceiling refused it anyway, name it at the
+        // prompt — a user who said "allow `git` this session" is owed the reason
+        // they are being asked again (cli#193).
+        const choice = await promptForApproval(request, this.io, this.allowlist.overriddenGrant(request));
         switch (choice.kind) {
             case "once":
                 return { allow: true, prompted: true };

package/dist/approval/prompt.js

@@ -9,14 +9,19 @@ import { themeForColor } from "../theme/index.js";
  * read a follow-up line (reason / instruction). Anything else — including EOF —
  * is a reject.
  */
-export async function promptForApproval(request, io) {
+export async function promptForApproval(request, io, 
+/**
+ * The session grant the irreversibility ceiling overrode, when there is one
+ * (cli#193). Optional and defaulted, so every existing caller is unchanged.
+ */
+overriddenGrant = null) {
     // The terminal is about to belong to this prompt: yield the live region
     // BEFORE the question lands, or it would be painted into a region the next
     // repaint erases (U.2/U.4). `finally` gives it back on every path, including
     // the default-deny ones.
     io.beginPrompt?.();
     try {
-        io.write(render(request, io.color, io.columns ?? resolveColumns()));
+        io.write(render(request, io.color, io.columns ?? resolveColumns(), overriddenGrant));
         const key = (await io.readKey()).toLowerCase();
         io.write("\n");
         switch (key) {
@@ -46,7 +51,7 @@ export async function promptForApproval(request, io) {
     }
 }
 /** Render the full prompt block: header, detail (diff or command+cwd), choices. */
-export function render(request, color, columns = resolveColumns()) {
+export function render(request, color, columns = resolveColumns(), overriddenGrant = null) {
     const t = themeForColor(color);
     const destructive = request.tier === "destructive";
     // Risk survives all FOUR degradations now (U.11 color/unicode/reader + U.12
@@ -58,11 +63,34 @@ export function render(request, color, columns = resolveColumns()) {
     const label = tierLabel(request.tier, t);
     const lines = [];
     lines.push(...header(request.summary, mark, label, t, columns));
+    lines.push(...grantOverridden(overriddenGrant, t, columns));
     lines.push(...whyAsking(request.irreversible, t, columns));
     lines.push(detail(request, t, columns));
     lines.push(choices(request.scope, t));
     return lines.filter((l) => l !== "").join("\n") + " ";
 }
+/**
+ * The line that says the ceiling outranked a grant the user really did give
+ * (cli#193). It is shown ONLY when a grant actually matched and was refused for
+ * irreversibility — not on every irreversible prompt — so it never claims a
+ * permission the user never gave.
+ *
+ * It exists because the alternative reads as a bug. A user who chose "allow
+ * `git` this session" and is then asked about `git push --force` has no way to
+ * tell "we remember, and this one is outside it" from "the grant was dropped";
+ * the second reading makes the whole feature look unreliable and trains people
+ * to stop reading prompts. The label is the SAME string the `[a]` choice offered
+ * at grant time (`scopeLabel`), so the sentence quotes back the words the user
+ * actually agreed to rather than a paraphrase of them.
+ *
+ * Reflowed, never truncated — a half-sentence here would be worse than silence.
+ */
+function grantOverridden(scope, t, width) {
+    const label = scope ? scopeLabel(scope) : null;
+    if (label === null)
+        return [];
+    return reflow(`you allowed ${label} this session, but this action is irreversible and always asks`, Math.max(1, width - 2)).map((l) => t.warning(`  ${l}`));
+}
 /**
  * The one-clause reason the checkpoint cannot restore this action, when there is
  * one. Rendered for every mode, not just the auto ones — the prompt has no way
@@ -155,14 +183,31 @@ function choices(scope, t) {
         : `[a] allow ${t.strong(grant)} this session`;
     return `  ${t.muted(`[y] approve once ${t.glyph.sep}`)} ${a} ${t.muted(`${t.glyph.sep} [n] reject ${t.glyph.sep} [t] reject & instruct:`)}`;
 }
-/** Short human label for what a session grant would allow, or null if none. */
-function scopeLabel(scope) {
+/**
+ * Short human label for what a session grant covers, or null when a scope
+ * grants nothing.
+ *
+ * THE PROMPT'S OWN WORDS, and exported because `/permissions` has to speak them
+ * (cli#196): a view that renamed a grant would be describing a permission the
+ * user never agreed to, and the row would not match the sentence they said yes
+ * to. One function, so the two cannot drift.
+ *
+ * The file case was wrong in both surfaces until now. `file-subtree` is a
+ * directory grant OR — under the root-cap in `fileScope` — an exact-file grant,
+ * and both rendered as `changes under package.json/`: a directory that does not
+ * exist, claiming every file "under" it. `Scope.exact` is what separates them,
+ * and the exact form names the file it actually covers.
+ */
+export function scopeLabel(scope) {
     if (scope.kind === "shell-prefix")
         return `${scope.token} commands`;
     if (scope.kind === "shell-exact")
         return `re-runs of \`${scope.command}\``;
-    if (scope.kind === "file-subtree")
-        return `changes under ${path.basename(scope.root)}/`;
+    if (scope.kind === "file-subtree") {
+        return scope.exact
+            ? `changes to ${path.basename(scope.root)}`
+            : `changes under ${path.basename(scope.root)}/`;
+    }
     if (scope.kind === "mcp-tool")
         return `re-calls of \`${scope.tool}\` on ${scope.server}`;
     return null;

package/dist/budget/session-budget.js

@@ -1,4 +1,4 @@
-import { bindingWindow } from "../limits/index.js";
+import { scarcestWindow } from "../limits/index.js";
 import { compactTokens } from "../render/units.js";
 import { MAX_TIER_MULTIPLIER, multiplierForTier, weightedFor, } from "../usage/weighted.js";
 /**
@@ -31,6 +31,31 @@ export class SessionBudget {
     attachLimits(limits) {
         this.limits = limits;
     }
+    /**
+     * Kick a re-read of the server denominator. Fire-and-forget, and deliberately
+     * NOT awaited by any caller (cli#212).
+     *
+     * WHOSE JOB THIS IS MOVED. The only thing driving `refresh` used to be the
+     * TUI's post-turn hook, which skipped the probe entirely while the limits
+     * panel was closed — defensible while the reading was only a status figure,
+     * and wrong the moment it became the denominator an admission check divides
+     * by. A closed panel meant one reading for a whole session, and the REPL and
+     * headless runs — which have no panel at all — never probed once, so every
+     * fan-out they admitted was weighed against whatever the first probe said.
+     *
+     * The reading is not a panel's, so the turn drives it: `Session.send` calls
+     * this on EVERY turn, on every surface. Nothing blocks on it — a turn that
+     * waited on a status read would be the paint-path mistake one layer up — so
+     * this turn still admits against the previous answer, which is the price of
+     * never letting the gateway hold a turn. It lands in time for the fan-out
+     * seam inside this turn, and for the next turn's admission.
+     */
+    refreshLimits() {
+        // Swallowed rather than propagated: this is a background read for a bound
+        // nobody is waiting on, and the honest response to not getting an answer is
+        // the `unreadable` headroom the last reading already yields.
+        void this.limits?.refresh?.().catch(() => { });
+    }
     /** The session cap in weighted tokens, or `null` when the user has set none. */
     get limit() {
         return this.limitWeighted;
@@ -75,7 +100,18 @@ export class SessionBudget {
             return null;
         return Math.max(0, this.limitWeighted - this.spentWeighted);
     }
-    /** The server's denominator, resolved to a statement (see {@link ServerHeadroom}). */
+    /**
+     * The server's denominator, resolved to a statement (see {@link ServerHeadroom}).
+     *
+     * `scarcestWindow`, NOT the rail's `bindingWindow`. Both windows gate every
+     * request, so what may be spent right now is `min(remaining)` — a token count.
+     * The rail's rule picks the smaller remaining FRACTION, which is the right
+     * answer to a different question ("which one will stop you first") and can
+     * name the window with more tokens left in it. `limits/reduce.ts` carries the
+     * worked example of the two disagreeing; the short version is that using the
+     * fraction here would hand this function a ceiling the other window refuses,
+     * and it would refuse it after the tokens were spent.
+     */
     serverHeadroom() {
         const state = this.limits?.current();
         if (!state)
@@ -104,8 +140,8 @@ export class SessionBudget {
                 why: `this account is ${budget.kind}, which has no weighted pool`,
             };
         }
-        const binding = bindingWindow(budget.monthly, budget.burst);
-        if (!binding) {
+        const scarcest = scarcestWindow(budget.monthly, budget.burst);
+        if (!scarcest) {
             return {
                 kind: "unreadable",
                 why: "the pool reported no readable window",
@@ -113,9 +149,9 @@ export class SessionBudget {
         }
         return {
             kind: "window",
-            name: binding.name,
-            remaining: binding.window.remaining,
-            cap: binding.window.cap,
+            name: scarcest.name,
+            remaining: scarcest.window.remaining,
+            cap: scarcest.window.cap,
         };
     }
     /**

package/dist/checkpoint/capture.js

@@ -1,17 +1,20 @@
 import { promises as fsp } from "node:fs";
 import path from "node:path";
 import { runGitCapture } from "../vcs/git.js";
-import { isSecretPath, walkRepo } from "../indexing/walker.js";
-import { GLOBAL_DIR_NAME } from "../constants.js";
+import { walkRepo } from "../indexing/walker.js";
+import { captureExclusion } from "./coverage.js";
 /**
  * Snapshot-scope enumeration (C.32): every regular file the agent could touch —
  * tracked + untracked-non-ignored — and nothing it must never see:
  *   • gitignored paths (they are not the run's undo unit and may be huge),
- *   • the C.17 secrets denylist ({@link isSecretPath} — a checkpoint must never
- *     copy a secret into `.cruxy/` or the git object DB),
- *   • `.cruxy/` itself (a checkpoint of the checkpoints would recurse),
+ *   • everything {@link captureExclusion} names — the secrets denylist, `.git/`,
+ *     `node_modules/`, and `.cruxy/` itself,
  *   • symlinks and other non-regular files (restore writes plain files only).
  *
+ * The per-path filter is {@link captureExclusion} rather than a local predicate
+ * because auto-approve's irreversibility rule reads the same function: what the
+ * snapshot skips is exactly what the ceiling must refuse to call restorable.
+ *
  * In a git repo the file list comes from `git ls-files` (read-only), which
  * honors `.gitignore`, `.git/info/exclude`, and the user's global excludes
  * exactly. Outside a repo, the indexing walker enumerates with its gitignore
@@ -25,7 +28,7 @@ export async function captureFiles(root, gitWorkTree) {
         : await walkerCandidates(absRoot);
     const files = [];
     for (const relPath of candidates) {
-        if (relPath === "" || isExcluded(relPath))
+        if (relPath === "" || captureExclusion(relPath) !== null)
             continue;
         const absPath = path.join(absRoot, ...relPath.split("/"));
         // lstat: a symlink must be seen as a symlink, not its target.
@@ -43,12 +46,6 @@ export async function captureFiles(root, gitWorkTree) {
     files.sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
     return files;
 }
-/** Never capture cruxy's own state dir or a secret-bearing path. */
-function isExcluded(relPath) {
-    return (relPath === GLOBAL_DIR_NAME ||
-        relPath.startsWith(`${GLOBAL_DIR_NAME}/`) ||
-        isSecretPath(relPath));
-}
 /** Tracked + untracked-non-ignored, straight from git (paths relative to root). */
 async function gitCandidates(absRoot) {
     const res = runGitCapture(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], absRoot);

package/dist/checkpoint/coverage.js

@@ -0,0 +1,70 @@
+import { GLOBAL_DIR_NAME } from "../constants.js";
+import { ALWAYS_IGNORE_DIRS, isSecretPath } from "../indexing/walker.js";
+/**
+ * What a checkpoint does **not** capture, stated once and consumed by both sides
+ * of the guarantee:
+ *
+ *   • {@link captureFiles} filters its enumeration through it, so the snapshot
+ *     never contains these paths.
+ *   • `classify.ts` derives `irreversible` from it, so auto-approve never runs
+ *     an action targeting them unprompted.
+ *
+ * One predicate, two consumers, because the bug this exists to prevent is the
+ * two drifting apart. The ceiling used to reason about *root containment* —
+ * "inside the workspace, therefore restorable" — while the capturer had always
+ * excluded four classes of path inside that same workspace. Every path in the
+ * gap auto-ran with nothing to restore from. Adding an exclusion here now
+ * tightens the ceiling in the same commit that narrows the snapshot; they cannot
+ * disagree again.
+ *
+ * ── What this does NOT cover ──
+ * The capture set also excludes anything **gitignored** (`git ls-files
+ * --exclude-standard`, and the walker's `IgnoreMatcher` outside a repo), which
+ * cannot be decided from a path alone — it needs the repo's ignore files, and
+ * `classify` is a pure synchronous function by design (it runs on every action,
+ * including the tier check in `approval/mutex.ts`). So a gitignored build
+ * directory — `rm -rf dist` — is still classified reversible when it is not.
+ * That residual is deliberate and bounded: the four classes below are the ones
+ * whose loss is *permanent* (history, secrets, the checkpoint store itself),
+ * while generic ignored output is regenerable. It is recorded in cli#241 rather
+ * than papered over.
+ */
+export function captureExclusion(relPath) {
+    const first = relPath.split("/")[0];
+    const reason = NEVER_CAPTURED_DIRS.get(first);
+    if (reason)
+        return reason;
+    if (isSecretPath(relPath)) {
+        return "it matches the secrets denylist, which the checkpoint refuses to copy into `.cruxy/` or the git object DB";
+    }
+    return null;
+}
+/**
+ * Directory names never enumerated by either capture substrate, with the reason
+ * the checkpoint cannot restore what is under them. Keyed on the first path
+ * segment: exclusion is inherited by everything beneath.
+ *
+ * Sourced from {@link ALWAYS_IGNORE_DIRS} — the walker's own always-ignore set —
+ * so the two lists are the same list. The assertion below fails the build if a
+ * name is added there without a reason here.
+ */
+const NEVER_CAPTURED_DIRS = new Map([
+    [
+        ".git",
+        "`.git/` is never enumerated, so history, refs, the index, and the stash are outside every checkpoint",
+    ],
+    [
+        "node_modules",
+        "`node_modules/` is always ignored, so nothing installed there is captured",
+    ],
+    [
+        GLOBAL_DIR_NAME,
+        `\`${GLOBAL_DIR_NAME}/\` holds the checkpoints themselves, which a checkpoint cannot contain`,
+    ],
+]);
+for (const name of ALWAYS_IGNORE_DIRS) {
+    if (!NEVER_CAPTURED_DIRS.has(name)) {
+        throw new Error(`checkpoint/coverage.ts: no reason recorded for always-ignored directory \`${name}\` — ` +
+            `every path the capturer skips must be one auto-approve refuses to treat as restorable`);
+    }
+}

package/dist/cli/command-catalog.js

@@ -42,6 +42,11 @@ export const COMMAND_CATALOG = [
     { name: "/init", summary: "scaffold a project CRUXY.md and load it" },
     { name: "/reload", summary: "re-read project instructions (CRUXY.md)" },
     { name: "/status", summary: "show what this session is set up to do" },
+    {
+        name: "/permissions",
+        summary: "show what runs without asking, and drop a standing grant",
+        args: "[revoke <n>]",
+    },
     {
         name: "/diff",
         summary: "show uncommitted changes in the workspace",

package/dist/cli/commands/run.js

@@ -16,7 +16,7 @@ import { SandboxService } from "../../sandbox/index.js";
 import { buildHooksService, buildHooksRouter } from "../../hooks/index.js";
 import { DEFAULT_MODE, } from "../../agent/index.js";
 import { runInteractive } from "../repl.js";
-import { ContextGauge, createKeyLease, createGitView, createOverviewView, createSettingsView, createTasksView, runTui, TuiRenderer, WorkspaceDiskCache, WorkspaceGitCache, } from "../../tui/index.js";
+import { ContextGauge, createKeyLease, createGitView, createOverviewView, createPermissionsView, createSettingsView, createTasksView, runTui, TuiRenderer, WorkspaceDiskCache, WorkspaceGitCache, } from "../../tui/index.js";
 import { buildAgentSession } from "../session-factory.js";
 import { apiKeyEnvVar, maybeRunOnboarding } from "../onboard.js";
 import { resetLspServices } from "../../lsp/index.js";
@@ -384,6 +384,11 @@ export async function executeRun(promptParts, opts) {
         tui.attachViews([
             createOverviewView(session, workspaceGit, () => tui.servedTier(), workspaceDisk),
             createGitView(() => session.toolContext.workspace.roots(), workspaceGit),
+            // Next to Overview, which reports the mode: this one reports what the
+            // mode plus the session's standing grants add up to. Registered
+            // unconditionally — a session with no grants yet is exactly the session
+            // whose user most needs to find the screen before there are any.
+            createPermissionsView(session),
             // Registered even when background jobs are disabled — the view says so,
             // and a nav whose rows appear and vanish with config is worse than one
             // row that explains itself. `session.jobs` is undefined in that case.

package/dist/cli/session-commands.js

@@ -3,6 +3,7 @@ import { existsSync, writeFileSync } from "node:fs";
 import { resolve } from "node:path";
 import { COMMAND_CATALOG } from "./command-catalog.js";
 import { contextReport } from "../agent/context.js";
+import { permissionsReport, revokedLine } from "../agent/permissions.js";
 import { buildSessionStatus } from "../agent/status.js";
 import { resolveCheckpointDiff } from "../checkpoint/diff.js";
 import { rollbackLatestRun } from "../checkpoint/run-rollback.js";
@@ -11,6 +12,7 @@ import { resolveSlash } from "../hooks/index.js";
 import { contextReportLines } from "../render/context-view.js";
 import { compactTokens } from "../render/units.js";
 import { renderUnifiedDiff } from "../render/index.js";
+import { permissionsReportLines } from "../render/permissions-view.js";
 import { sessionStatusLines } from "../render/status-view.js";
 import { defaultExportName, exportMarkdown } from "../session/index.js";
 import { readDiskCapacitySync } from "../utils/disk.js";
@@ -104,6 +106,10 @@ export async function dispatchCommand(input, ctx) {
         handleStatus(ctx);
         return { kind: "handled" };
     }
+    if (trimmed === "/permissions" || trimmed.startsWith("/permissions ")) {
+        handlePermissions(trimmed, ctx);
+        return { kind: "handled" };
+    }
     if (trimmed === "/diff" || trimmed.startsWith("/diff ")) {
         await handleDiff(trimmed, ctx);
         return { kind: "handled" };
@@ -337,6 +343,59 @@ function handleStatus(ctx) {
         out.print(out.fit(line));
     }
 }
+/**
+ * `/permissions` (cli#196) — what this session may do without asking, and the
+ * one way to take a standing grant back.
+ *
+ * REVOKE IS THE ARGUMENT FORM, not a selectable row. Views take no input: the
+ * TUI's key lease belongs to overlays, and a permissions screen that grabbed it
+ * to offer a cursor would be a drawer wearing a view's clothes. The argument
+ * form is also the one a user can script, a test can drive, and a REPL without
+ * a picker can still reach — `/permissions revoke 2` means the same thing in
+ * every shell.
+ *
+ * The number is the row number the list just printed. A `Scope` has no stable
+ * id to name instead, and inventing one would put a token on screen that exists
+ * for no other purpose; the user is pointing at a visible row, so the row's
+ * position is the honest handle. It is re-read from `list()` at the moment of
+ * the revoke, so a grant recorded since the last print shifts nothing — the
+ * order is append-only and a revoke only ever removes.
+ */
+function handlePermissions(input, ctx) {
+    const { out, session } = ctx;
+    const t = out.theme;
+    const arg = input.slice("/permissions".length).trim();
+    if (arg !== "") {
+        const match = /^revoke\s+(\S+)$/.exec(arg);
+        if (!match) {
+            out.print(t.muted("usage: /permissions [revoke <n>]"));
+            return;
+        }
+        const allowlist = session.allowlist;
+        if (!allowlist) {
+            // Not "nothing to revoke": a session with no allowlist wired has no grant
+            // surface at all, and saying which is more useful than a failed lookup.
+            out.print(t.muted("this session does not track grants"));
+            return;
+        }
+        // Parsed strictly — `Number("2x")` is NaN but `parseInt("2x")` is 2, and a
+        // typo must never resolve to a row the user did not mean to drop.
+        const n = /^\d+$/.test(match[1]) ? Number(match[1]) : NaN;
+        const grant = Number.isNaN(n) ? null : allowlist.revoke(n - 1);
+        if (!grant) {
+            const count = allowlist.size();
+            out.print(t.muted(count === 0
+                ? "no standing grants to revoke"
+                : `no grant ${match[1]} — /permissions lists 1${count === 1 ? "" : `-${count}`}`));
+            return;
+        }
+        out.print(t.muted(revokedLine(grant)));
+        return;
+    }
+    for (const line of permissionsReportLines(permissionsReport(session), t)) {
+        out.print(out.fit(line));
+    }
+}
 /**
  * `/diff` (P6 track 4) — what has changed on disk, without leaving the session.
  *

package/dist/cli/session-factory.js

@@ -522,6 +522,10 @@ opts = {}) {
         onRunUsage,
         budget: sessionBudget,
         jobs: jobManager,
+        // The SAME allowlist the plan policy and the interactive policy share, so
+        // `/permissions` lists the grants this session's prompts actually spend —
+        // not a second list that agrees with them only by luck.
+        allowlist,
         recorder: opts.recorder,
         restore: opts.restore,
     });