@fungi.computer/truffle 0.3.0 → 0.3.1

package/dist/private-local-exec-review.d.ts

@@ -7,4 +7,6 @@ export declare function localExecEscapeReview(request: {
     escape?: {
         justification: string;
     } | undefined;
-}, cwd: string): LocalApprovalReview;
+}, cwd: string, gitGrant?: {
+    configuredRemotes: ReadonlySet<string>;
+}): LocalApprovalReview;

package/dist/private-local-exec-review.js

@@ -1,4 +1,4 @@
-import { rulePrefix } from "./private-local-exec-rules.js";
+import { gitRuleCoverage, rulePrefix } from "./private-local-exec-rules.js";
 const gitHookGrantSubcommands = new Set([
     "add",
     "branch",
@@ -17,14 +17,15 @@ const gitHookGrantSubcommands = new Set([
     "tag",
 ]);
 /** Build the host's review before the approval record is staged or displayed. */
-export function localExecEscapeReview(request, cwd) {
+export function localExecEscapeReview(request, cwd, gitGrant) {
     if (request.escape === undefined)
         throw new Error("An escape requires a justification");
     const command = request.command ??
         JSON.stringify([request.executable, ...(request.args ?? [])]);
-    const prefix = request.executable === undefined
+    const prefix = request.executable === undefined ||
+        (request.executable === "git" && gitGrant === undefined)
         ? undefined
-        : rulePrefix([request.executable, ...(request.args ?? [])]);
+        : rulePrefix([request.executable, ...(request.args ?? [])], gitGrant?.configuredRemotes);
     const review = {
         command,
         cwd,
@@ -32,19 +33,30 @@ export function localExecEscapeReview(request, cwd) {
     };
     if (prefix !== undefined) {
         review.prefix = prefix;
-        if (prefix[0] === "git") {
-            const hookCapable = gitHookGrantSubcommands.has(prefix[1] ?? "");
-            review.warning =
-                (hookCapable
-                    ? "Project hooks can run code as you under this grant. Only the hooksPath setting must pre-exist; this Agent can create missing hook files there. A configured fsmonitor path in the worktree may also be Agent-writable."
-                    : "This command runs as you outside the sandbox.") +
-                    (prefix[1] === "push"
-                        ? " This grant can push all branches, force-update them, or delete remote branches."
-                        : "") +
-                    (["push", "fetch", "pull"].includes(prefix[1] ?? "")
-                        ? " Remote URLs can invoke ssh with your HOME and keys."
-                        : "");
-        }
+        review.alwaysAllowCoverage =
+            prefix[0] === "git"
+                ? gitRuleCoverage(prefix[1] ?? "")
+                : `Direct argv commands beginning ${JSON.stringify(prefix)} in this project; shell commands still ask.`;
     }
+    if (request.executable === "git") {
+        const hookCapable = gitHookGrantSubcommands.has(request.args?.[0] ?? "");
+        review.warning =
+            (hookCapable
+                ? "Project hooks can run code as you under this grant. Only the hooksPath setting must pre-exist; this Agent can create missing hook files there. A configured fsmonitor path in the worktree may also be Agent-writable."
+                : "This command runs as you outside the sandbox.") +
+                (request.args?.[0] === "push"
+                    ? " This grant can push all branches, force-update them, or delete remote branches."
+                    : "") +
+                (["push", "fetch", "pull"].includes(request.args?.[0] ?? "")
+                    ? " Remote URLs can invoke ssh with your HOME and keys."
+                    : "");
+    }
+    if (prefix === undefined)
+        review.alwaysAllowUnavailableReason =
+            request.executable === undefined
+                ? "Shell command text cannot match a saved argv rule; Approve once or Deny."
+                : request.executable === "git" && gitGrant === undefined
+                    ? "A protected project Git repository is unavailable; no reusable Git rule can match."
+                    : "This command or option cannot match a safe reusable rule; Approve once or Deny.";
     return review;
 }

package/dist/private-local-exec-rules.d.ts

@@ -1,9 +1,11 @@
-/** Offer only direct, narrow grants; extension installs require a fresh card. */
-export declare function rulePrefix(argv: readonly string[]): string[] | undefined;
+/** Offer only direct commands that this same matcher can authorize. */
+export declare function rulePrefix(argv: readonly string[], configuredRemotes?: ReadonlySet<string>): string[] | undefined;
+/** Text for the same Git option profile that gates matching, not a second list. */
+export declare function gitRuleCoverage(subcommand: string): string;
 /** One host-owned project file; every Agent in the project sees the same rules. */
 export declare function localExecRules(project: string): {
     list: () => string[][];
-    add: (prefix: readonly string[]) => void;
+    add: (prefix: readonly string[]) => import("@fungi.computer/cairn").CairnId<"local-exec-rules", "rule", 1>;
     remove: (prefix: readonly string[]) => void;
     match: (argv: readonly string[], configuredRemotes?: ReadonlySet<string>) => {
         ruleId: import("@fungi.computer/cairn").CairnId<"local-exec-rules", "rule", 1>;

package/dist/private-local-exec-rules.js

@@ -62,7 +62,7 @@ const gitOptions = {
             "-s",
             "--signoff",
         ],
-        values: ["-m", "--message"],
+        values: ["-m", "--message", "-am"],
     },
     diff: {
         flags: [
@@ -250,8 +250,8 @@ function validPrefix(prefix) {
                 prefix.length === 2 &&
                 gitBuiltins.has(prefix[1] ?? ""))));
 }
-/** Offer only direct, narrow grants; extension installs require a fresh card. */
-export function rulePrefix(argv) {
+/** Offer only direct commands that this same matcher can authorize. */
+export function rulePrefix(argv, configuredRemotes) {
     if (argv.length === 0 ||
         argv[0]?.startsWith(".") ||
         argv[0]?.includes("/") ||
@@ -260,7 +260,9 @@ export function rulePrefix(argv) {
         return undefined;
     if (basename(argv[0] ?? "") === "git") {
         const prefix = argv.slice(0, 2);
-        return validPrefix(prefix) ? prefix : undefined;
+        return validPrefix(prefix) && safeGitCommand(argv, configuredRemotes)
+            ? prefix
+            : undefined;
     }
     if (basename(argv[0] ?? "") === "fungi" &&
         argv[1] === "extension" &&
@@ -269,6 +271,21 @@ export function rulePrefix(argv) {
     const parsed = prefixSchema.safeParse(argv.slice(0, 2));
     return parsed.success && validPrefix(parsed.data) ? parsed.data : undefined;
 }
+/** Text for the same Git option profile that gates matching, not a second list. */
+export function gitRuleCoverage(subcommand) {
+    const profile = gitProfiles.get(subcommand);
+    if (profile === undefined)
+        throw new Error("No reusable Git option profile");
+    const flags = profile.flags.filter((flag) => flag !== "--").join(", ");
+    const values = profile.values.map((option) => `${option} VALUE`).join(", ");
+    const remote = subcommand === "push" ||
+        subcommand === "fetch" ||
+        subcommand === "pull" ||
+        subcommand === "remote"
+        ? " Remote operands must be configured names or permitted explicit URLs."
+        : "";
+    return `Direct argv git ${subcommand} for Workspace Agents in this protected project repository. Only these options are reusable: ${flags || "none"}${values ? `; ${values}` : ""}; -- and permitted operands.${remote} Shell commands and unlisted Git options still ask.`;
+}
 function safeRemote(remote, configuredRemotes) {
     if (remote === undefined)
         return true;
@@ -378,14 +395,18 @@ export function localExecRules(project) {
         const parsed = prefixSchema.parse(prefix);
         if (!validPrefix(parsed))
             throw new Error("Unsafe Always-allow prefix");
+        let ruleId;
         lockedUpdate(project, () => {
             const existing = readProject(project).rules;
-            if (!existing.some((rule) => JSON.stringify(rule.prefix) === JSON.stringify(parsed)))
-                writeProject(project, [
-                    ...existing,
-                    { id: projectRuleIds.rule.generate(), prefix: parsed },
-                ]);
+            ruleId = existing.find((rule) => JSON.stringify(rule.prefix) === JSON.stringify(parsed))?.id;
+            if (ruleId === undefined) {
+                ruleId = projectRuleIds.rule.generate();
+                writeProject(project, [...existing, { id: ruleId, prefix: parsed }]);
+            }
         });
+        if (ruleId === undefined)
+            throw new Error("Exec rule was not persisted");
+        return ruleId;
     };
     const remove = (prefix) => {
         const parsed = prefixSchema.parse(prefix);

package/dist/private-local-runtime-host.d.ts

@@ -48,6 +48,13 @@ export type PrivateLocalTools = Readonly<{
     /** Background Computer processes, scoped per Session; the host closes them. */
     processes: PrivateLocalComputerProcesses;
 }>;
+export type ExecApprovalDecision = {
+    agentId: string;
+    recordId: string;
+    decision: "approve" | "deny";
+    scope?: "once" | "always";
+    ruleId?: string;
+};
 /** Inputs for the one private local Agent opener. */
 export type PrivateLocalRuntimeHostOptions = Readonly<{
     /** Service-selected host configuration, independent of this Agent's Files root. */
@@ -63,6 +70,8 @@ export type PrivateLocalRuntimeHostOptions = Readonly<{
         executable: string;
         ruleId: string;
     }>) => void;
+    /** The human's committed approval choice, without command text or secrets. */
+    onExecApprovalDecision?: (event: Readonly<ExecApprovalDecision>) => void;
     /** Existing Agent database to reopen instead of creating a fresh local store. */
     databasePath?: string | undefined;
     /** Stable Local store identity for replaying one Agent create request. */

package/dist/private-local-runtime-host.js

@@ -466,7 +466,7 @@ export function createPrivateLocalModelSource(models, providerId, modelId, provi
             signal,
         });
         if (startup === null)
-            throw new ShiitakeError("model", "rejected", "No signed-in model provider is available. Run /login, then choose a model with /model.");
+            throw new ShiitakeError("model", "rejected", "No signed-in model provider is available. Use your own Claude or ChatGPT subscription: /login in a Session, or fungi login --provider anthropic --auth-type oauth (Claude) or fungi login --provider openai --auth-type oauth (ChatGPT) in the CLI. For hosted Fungi: fungi login --provider fungi.");
         const choice = startup.preference;
         const selectedProvider = choice.providerId;
         if (selectedProvider === "fungi") {
@@ -1125,14 +1125,29 @@ export async function openPrivateLocalRuntimeHost(input, suppliedModels) {
         const grantRepository = lstatSync(join(root, ".git"), { throwIfNoEntry: false }) === undefined
             ? undefined
             : gitDirectories(root, root);
+        const gitGrantFor = (cwd, executionPath) => {
+            // A nested/Agent-created repository has writable config and hooks.
+            const protectedGit = grantRepository === undefined
+                ? undefined
+                : gitDirectories(root, root, executionPath);
+            const selectedGit = gitDirectories(root, cwd, executionPath);
+            if (protectedGit?.common === undefined ||
+                protectedGit.common !== grantRepository?.common ||
+                protectedGit.worktree !== grantRepository.worktree ||
+                selectedGit?.common !== protectedGit.common ||
+                selectedGit.worktree !== protectedGit.worktree)
+                return undefined;
+            const configuredRemotes = protectedGitRemoteNames(root, protectedGit.common, executionPath);
+            return configuredRemotes === undefined
+                ? undefined
+                : { configuredRemotes };
+        };
         // The attached human's answer, never form JSON or the model, selects
         // this short-lived intent. Commit the rule before dispatching the command.
         const ruleIntents = new Map();
         const selectRule = (recordId, prefix) => (selected) => {
             if (selected === "prefix")
-                ruleIntents.set(recordId, () => {
-                    execRules.add(prefix);
-                });
+                ruleIntents.set(recordId, () => execRules.add(prefix));
             else
                 ruleIntents.delete(recordId);
         };
@@ -1192,12 +1207,32 @@ export async function openPrivateLocalRuntimeHost(input, suppliedModels) {
             decision: async (recordId) => {
                 const answered = escapeLedger.get(recordId);
                 if (answered?.state === "approved") {
+                    let ruleId;
                     if (answered.module === "computer" &&
                         answered.operation === "exec" &&
                         answered.authorityFence === escapeFence())
-                        ruleIntents.get(recordId)?.();
+                        ruleId = ruleIntents.get(recordId)?.();
+                    if (answered.module === "computer" && answered.operation === "exec") {
+                        const event = {
+                            agentId,
+                            recordId,
+                            decision: "approve",
+                            scope: ruleIntents.has(recordId) ? "always" : "once",
+                        };
+                        if (ruleId !== undefined)
+                            event.ruleId = ruleId;
+                        input.onExecApprovalDecision?.(event);
+                    }
                     await escapeLedger.apply(recordId, escapeApply);
                 }
+                if (answered?.state === "denied" &&
+                    answered.module === "computer" &&
+                    answered.operation === "exec")
+                    input.onExecApprovalDecision?.({
+                        agentId,
+                        recordId,
+                        decision: "deny",
+                    });
                 for (const pending of escapeLedger.pendingHandoffs())
                     await deliverEscapeResult(pending);
             },
@@ -1246,7 +1281,9 @@ export async function openPrivateLocalRuntimeHost(input, suppliedModels) {
                 recordId: staged.record.recordId,
                 description: staged.record.description,
             };
-            const review = localExecEscapeReview(request, cwd);
+            const review = localExecEscapeReview(request, cwd, "executable" in request && request.executable === "git"
+                ? gitGrantFor(cwd, executionPath)
+                : undefined);
             const presented = await localTools.presentApproval(sessionId, pending, escapeApprovals, review, review.prefix === undefined
                 ? undefined
                 : selectRule(pending.recordId, review.prefix));
@@ -1259,19 +1296,7 @@ export async function openPrivateLocalRuntimeHost(input, suppliedModels) {
                 return undefined;
             let configuredRemotes;
             if (request.executable === "git") {
-                // Only the project's own protected common Git directory may use a
-                // Git grant. A nested/Agent-created repository has writable config.
-                const protectedGit = grantRepository === undefined
-                    ? undefined
-                    : gitDirectories(root, root, executionPath);
-                const selectedGit = gitDirectories(root, cwd, executionPath);
-                if (protectedGit?.common === undefined ||
-                    protectedGit.common !== grantRepository?.common ||
-                    protectedGit.worktree !== grantRepository.worktree ||
-                    selectedGit?.common !== protectedGit.common ||
-                    selectedGit.worktree !== protectedGit.worktree)
-                    return undefined;
-                configuredRemotes = protectedGitRemoteNames(root, protectedGit.common, executionPath);
+                configuredRemotes = gitGrantFor(cwd, executionPath)?.configuredRemotes;
                 if (configuredRemotes === undefined)
                     return undefined;
             }

package/dist/private-local-service-listener.js

@@ -97,7 +97,7 @@ readRecoveryManifest, root = capturePrivateLocalConfigRoot()) {
         if (native === undefined)
             throw new Error("Local service native staging is not ready");
         return native;
-    });
+    }, diagnostics.approvalDecision);
     const prefix = `/service/${serviceId}`;
     const releaseAccountOwner = registerFungiAccountOwner(root.credentialPath, () => owners.refreshMesh());
     const app = new Hono();

package/dist/private-local-service-log.d.ts

@@ -55,6 +55,13 @@ export type ServiceLogEvent = Readonly<{
     agentId: string;
     executable: string;
     ruleId: string;
+}> | Readonly<{
+    event: "exec-approval-decision";
+    agentId: string;
+    recordId: string;
+    decision: "approve" | "deny";
+    scope?: "once" | "always";
+    ruleId?: string;
 }> | Readonly<{
     event: "memory";
     rss: number;
@@ -88,6 +95,9 @@ export type ServiceLogLifecycle = Readonly<{
     ruleMatch: (match: Omit<Extract<ServiceLogEvent, {
         event: "exec-rule-match";
     }>, "event">) => void;
+    approvalDecision: (decision: Omit<Extract<ServiceLogEvent, {
+        event: "exec-approval-decision";
+    }>, "event">) => void;
     recoveryDisabled: (code: RecoveryPersistenceFailureCode) => void;
     /** Synchronous, so it lands before the bounded drain exits the process. */
     drainTimeout: (drain: Readonly<{

package/dist/private-local-service-log.js

@@ -290,6 +290,9 @@ export function createServiceLogLifecycle(input) {
         ruleMatch(match) {
             emit({ event: "exec-rule-match", ...match });
         },
+        approvalDecision(decision) {
+            emit({ event: "exec-approval-decision", ...decision });
+        },
         recoveryDisabled(code) {
             if (closed || recovery !== undefined)
                 return;

package/dist/private-local-service-owner.d.ts

@@ -38,7 +38,7 @@ readRecoveryManifest?: (path: string) => Promise<string>,
 /** Report only the classification, never the manifest or exception text. */
 onRecoveryDisabled?: ServiceLogLifecycle["recoveryDisabled"], configRoot?: PrivateLocalConfigRoot, meshLinksFactory?: typeof createLocalMeshLinks, onExecRuleMatch?: NonNullable<Parameters<typeof openPrivateLocalRuntimeHost>[0]["onExecRuleMatch"]>, 
 /** Supplied by the listener after startup; individual Agents never close it. */
-serviceNative?: () => NonNullable<Parameters<typeof openPrivateLocalRuntimeHost>[0]["native"]>): {
+serviceNative?: () => NonNullable<Parameters<typeof openPrivateLocalRuntimeHost>[0]["native"]>, onExecApprovalDecision?: NonNullable<Parameters<typeof openPrivateLocalRuntimeHost>[0]["onExecApprovalDecision"]>): {
     refreshMesh: () => Promise<void>;
     createSession: (creation: PrivateLocalSessionCreation) => Promise<{
         agentId: string;

package/dist/private-local-service-owner.js

@@ -71,7 +71,7 @@ readRecoveryManifest = (path) => readFile(path, "utf8"),
 /** Report only the classification, never the manifest or exception text. */
 onRecoveryDisabled = () => undefined, configRoot = capturePrivateLocalConfigRoot(), meshLinksFactory = createLocalMeshLinks, onExecRuleMatch = () => undefined, 
 /** Supplied by the listener after startup; individual Agents never close it. */
-serviceNative) {
+serviceNative, onExecApprovalDecision = () => undefined) {
     const extensions = suppliedExtensions ?? localExtensions({ home: configRoot.home });
     const recoveryPath = recoveryDirectory === undefined
         ? undefined
@@ -734,6 +734,7 @@ serviceNative) {
                 mail: projectControl ? mailRouting(invocationRoot) : undefined,
                 meshAdmission,
                 onExecRuleMatch,
+                onExecApprovalDecision,
             };
             if (serviceNative !== undefined)
                 options = { ...options, native: serviceNative() };
@@ -1049,6 +1050,7 @@ serviceNative) {
                             agentControl: directory(invocationRoot),
                             mail: mailRouting(invocationRoot),
                             onExecRuleMatch,
+                            onExecApprovalDecision,
                         };
                         if (serviceNative !== undefined)
                             options = { ...options, native: serviceNative() };

package/dist/private-mcp-form-contract.d.ts

@@ -185,6 +185,8 @@ export declare const mcpFormApprovalContract: {
                     readonly justification: Schema.String;
                     readonly prefix: Schema.optionalKey<Schema.$Array<Schema.String>>;
                     readonly warning: Schema.optionalKey<Schema.String>;
+                    readonly alwaysAllowCoverage: Schema.optionalKey<Schema.String>;
+                    readonly alwaysAllowUnavailableReason: Schema.optionalKey<Schema.String>;
                 }>>;
             }>>;
         }>;

package/dist/private-mcp-form-contract.js

@@ -38,6 +38,8 @@ const McpFormPendingSchema = Schema.Struct({
         justification: Schema.String,
         prefix: Schema.optionalKey(Schema.Array(Schema.String)),
         warning: Schema.optionalKey(Schema.String),
+        alwaysAllowCoverage: Schema.optionalKey(Schema.String),
+        alwaysAllowUnavailableReason: Schema.optionalKey(Schema.String),
     })),
 });
 /** The existing Session extension slot carries only display-safe form data. */

package/dist/private-mcp-form-session.d.ts

@@ -7,6 +7,8 @@ export type LocalApprovalReview = {
     justification: string;
     prefix?: readonly string[];
     warning?: string;
+    alwaysAllowCoverage?: string;
+    alwaysAllowUnavailableReason?: string;
 };
 type Pending = {
     sessionId: string;
@@ -129,6 +131,8 @@ export declare function createMcpFormSession(): {
                 readonly justification: string;
                 readonly prefix?: readonly string[];
                 readonly warning?: string;
+                readonly alwaysAllowCoverage?: string;
+                readonly alwaysAllowUnavailableReason?: string;
             };
         }[];
     }, {
@@ -181,6 +185,8 @@ export declare function createMcpFormSession(): {
                 readonly justification: string;
                 readonly prefix?: readonly string[];
                 readonly warning?: string;
+                readonly alwaysAllowCoverage?: string;
+                readonly alwaysAllowUnavailableReason?: string;
             };
         }[];
     }>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fungi.computer/truffle",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "private": false,
   "description": "Truffle: Fungi's local Agent runtime, bundled into the fungi command",
   "type": "module",