@glbgpt/cli 0.1.4 → 0.2.1

package/dist/src/coding/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/coding/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAKhF,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EACL,oBAAoB,GAKrB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,YAAY,EAA4D,MAAM,kBAAkB,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACnF,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAE3D,sFAAsF;AACtF,MAAM,CAAC,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC;IAC5D,MAAM;IACN,YAAY;IACZ,WAAW;IACX,aAAa;IACb,WAAW;CACZ,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAQjC;IACC,OAAO;QACL,cAAc,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACzG,mBAAmB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QACpF,kBAAkB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QACnF,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACzG,CAAC;AACJ,CAAC"}

package/dist/src/coding/outputAccumulator.d.ts

@@ -0,0 +1,34 @@
+import type { TailTruncation } from './truncate.js';
+/**
+ * Bounded-memory accumulator for streaming command output (pi's design):
+ * memory only ever holds a rolling tail of ~2x the display byte cap; the
+ * moment the stream exceeds the display limits, ALL raw bytes start flowing
+ * to a spill file so the model can read the full output afterwards. A command
+ * that dumps gigabytes therefore costs disk, not RSS.
+ */
+export declare class OutputAccumulator {
+    private readonly maxLines;
+    private readonly maxBytes;
+    private readonly spillDir;
+    private readonly chunks;
+    private tailBytes;
+    private totalBytes;
+    private totalNewlines;
+    private spill;
+    private spillPath;
+    private spillError;
+    constructor(maxLines?: number, maxBytes?: number, spillDir?: string);
+    append(chunk: Buffer): void;
+    private overDisplayLimit;
+    private openSpill;
+    /**
+     * Close the spill (if any) and produce the model-facing text: the truncated
+     * tail plus a footnote naming the full-output path. The decoded tail drops
+     * its first (possibly chunk-severed) partial line when rolling occurred.
+     */
+    finalize(): Promise<{
+        text: string;
+        truncation: TailTruncation;
+        fullOutputPath: string | null;
+    }>;
+}

package/dist/src/coding/outputAccumulator.js

@@ -0,0 +1,111 @@
+import { createWriteStream } from 'node:fs';
+import { randomBytes } from 'node:crypto';
+import os from 'node:os';
+import path from 'node:path';
+import { DEFAULT_MAX_OUTPUT_BYTES, DEFAULT_MAX_OUTPUT_LINES, truncateTail, truncationFootnote, } from './truncate.js';
+/**
+ * Bounded-memory accumulator for streaming command output (pi's design):
+ * memory only ever holds a rolling tail of ~2x the display byte cap; the
+ * moment the stream exceeds the display limits, ALL raw bytes start flowing
+ * to a spill file so the model can read the full output afterwards. A command
+ * that dumps gigabytes therefore costs disk, not RSS.
+ */
+export class OutputAccumulator {
+    maxLines;
+    maxBytes;
+    spillDir;
+    chunks = [];
+    tailBytes = 0;
+    totalBytes = 0;
+    totalNewlines = 0;
+    spill = null;
+    spillPath = null;
+    spillError = null;
+    constructor(maxLines = DEFAULT_MAX_OUTPUT_LINES, maxBytes = DEFAULT_MAX_OUTPUT_BYTES, spillDir = os.tmpdir()) {
+        this.maxLines = maxLines;
+        this.maxBytes = maxBytes;
+        this.spillDir = spillDir;
+    }
+    append(chunk) {
+        this.totalBytes += chunk.length;
+        for (const b of chunk)
+            if (b === 0x0a)
+                this.totalNewlines += 1;
+        if (!this.spill && this.overDisplayLimit()) {
+            this.openSpill();
+        }
+        if (this.spill) {
+            this.spill.write(chunk);
+        }
+        this.chunks.push(chunk);
+        this.tailBytes += chunk.length;
+        // Roll the in-memory tail: drop whole chunks from the head while over 2x cap.
+        while (this.tailBytes > this.maxBytes * 2 && this.chunks.length > 1) {
+            const dropped = this.chunks.shift();
+            this.tailBytes -= dropped.length;
+        }
+    }
+    overDisplayLimit() {
+        // totalNewlines + 1 approximates the line count; both caps checked like the truncator.
+        return this.totalBytes > this.maxBytes || this.totalNewlines + 1 > this.maxLines;
+    }
+    openSpill() {
+        this.spillPath = path.join(this.spillDir, `glbgpt-bash-${randomBytes(8).toString('hex')}.log`);
+        try {
+            this.spill = createWriteStream(this.spillPath, { flags: 'w' });
+            this.spill.on('error', (err) => {
+                this.spillError = err;
+            });
+            // Replay everything captured so far — the rolling tail still holds ALL
+            // chunks at this point (spill opens the moment the cap is first crossed,
+            // and rolling only starts beyond 2x the cap).
+            for (const c of this.chunks)
+                this.spill.write(c);
+        }
+        catch (err) {
+            this.spill = null;
+            this.spillPath = null;
+            this.spillError = err instanceof Error ? err : new Error(String(err));
+        }
+    }
+    /**
+     * Close the spill (if any) and produce the model-facing text: the truncated
+     * tail plus a footnote naming the full-output path. The decoded tail drops
+     * its first (possibly chunk-severed) partial line when rolling occurred.
+     */
+    async finalize() {
+        if (this.spill) {
+            await new Promise((resolve) => this.spill.end(() => resolve()));
+        }
+        let decoded = Buffer.concat(this.chunks).toString('utf8');
+        if (this.totalBytes > this.tailBytes) {
+            // Rolling dropped the true start; also drop the first (possibly partial) decoded line
+            // so the snapshot never begins mid-line or mid-character.
+            const nl = decoded.indexOf('\n');
+            decoded = nl >= 0 ? decoded.slice(nl + 1) : decoded;
+        }
+        const truncation = truncateTail(decoded, this.maxLines, this.maxBytes);
+        // Report the REAL total when rolling lost lines the truncator cannot see.
+        const rolledAwayLines = this.totalNewlines + 1 - splitCount(decoded);
+        if (rolledAwayLines > 0) {
+            truncation.totalLines += rolledAwayLines;
+            truncation.startLine += rolledAwayLines;
+            truncation.truncated = true;
+            if (!truncation.truncatedBy)
+                truncation.truncatedBy = 'lines';
+        }
+        const fullOutputPath = this.spillError ? null : this.spillPath;
+        const text = truncation.truncated && fullOutputPath
+            ? `${truncation.text}\n${truncationFootnote(truncation, fullOutputPath)}`
+            : truncation.text;
+        return { text, truncation, fullOutputPath };
+    }
+}
+function splitCount(s) {
+    let n = 1;
+    for (let i = 0; i < s.length; i++)
+        if (s.charCodeAt(i) === 10)
+            n += 1;
+    return n;
+}
+//# sourceMappingURL=outputAccumulator.js.map

package/dist/src/coding/outputAccumulator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outputAccumulator.js","sourceRoot":"","sources":["../../../src/coding/outputAccumulator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAoB,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EACxB,YAAY,EACZ,kBAAkB,GACnB,MAAM,eAAe,CAAC;AAGvB;;;;;;GAMG;AACH,MAAM,OAAO,iBAAiB;IAUT;IACA;IACA;IAXF,MAAM,GAAa,EAAE,CAAC;IAC/B,SAAS,GAAG,CAAC,CAAC;IACd,UAAU,GAAG,CAAC,CAAC;IACf,aAAa,GAAG,CAAC,CAAC;IAClB,KAAK,GAAuB,IAAI,CAAC;IACjC,SAAS,GAAkB,IAAI,CAAC;IAChC,UAAU,GAAiB,IAAI,CAAC;IAExC,YACmB,WAAmB,wBAAwB,EAC3C,WAAmB,wBAAwB,EAC3C,WAAmB,EAAE,CAAC,MAAM,EAAE;QAF9B,aAAQ,GAAR,QAAQ,CAAmC;QAC3C,aAAQ,GAAR,QAAQ,CAAmC;QAC3C,aAAQ,GAAR,QAAQ,CAAsB;IAC9C,CAAC;IAEJ,MAAM,CAAC,KAAa;QAClB,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC,MAAM,CAAC;QAChC,KAAK,MAAM,CAAC,IAAI,KAAK;YAAE,IAAI,CAAC,KAAK,IAAI;gBAAE,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC;QAE/D,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;YAC3C,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC;QAC/B,8EAA8E;QAC9E,OAAO,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,QAAQ,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpE,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAY,CAAC;YAC9C,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC;QACnC,CAAC;IACH,CAAC;IAEO,gBAAgB;QACtB,uFAAuF;QACvF,OAAO,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,aAAa,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;IACnF,CAAC;IAEO,SAAS;QACf,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/F,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/D,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBAC7B,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC;YACxB,CAAC,CAAC,CAAC;YACH,uEAAuE;YACvE,yEAAyE;YACzE,8CAA8C;YAC9C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM;gBAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YAClB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;YACtB,IAAI,CAAC,UAAU,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ;QACZ,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,KAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;YACrC,sFAAsF;YACtF,0DAA0D;YAC1D,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACjC,OAAO,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACtD,CAAC;QACD,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvE,0EAA0E;QAC1E,MAAM,eAAe,GAAG,IAAI,CAAC,aAAa,GAAG,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QACrE,IAAI,eAAe,GAAG,CAAC,EAAE,CAAC;YACxB,UAAU,CAAC,UAAU,IAAI,eAAe,CAAC;YACzC,UAAU,CAAC,SAAS,IAAI,eAAe,CAAC;YACxC,UAAU,CAAC,SAAS,GAAG,IAAI,CAAC;YAC5B,IAAI,CAAC,UAAU,CAAC,WAAW;gBAAE,UAAU,CAAC,WAAW,GAAG,OAAO,CAAC;QAChE,CAAC;QACD,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;QAC/D,MAAM,IAAI,GACR,UAAU,CAAC,SAAS,IAAI,cAAc;YACpC,CAAC,CAAC,GAAG,UAAU,CAAC,IAAI,KAAK,kBAAkB,CAAC,UAAU,EAAE,cAAc,CAAC,EAAE;YACzE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC;IAC9C,CAAC;CACF;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE;YAAE,CAAC,IAAI,CAAC,CAAC;IACtE,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/src/coding/permissionGate.d.ts

@@ -0,0 +1,65 @@
+import type { CodingAction, GateVerdict, PermissionGate } from './permissions.js';
+import type { PersistedRules, PersistRule } from './permissionStore.js';
+/**
+ * Permission modes (product decision 2026-08-21):
+ * - default: every bash/write/edit asks, with "allow for session" building a session allowlist;
+ * - accept-edits: file writes auto-approved (workspace-jailed by the tools), bash still asks;
+ * - yolo: everything auto-approved (explicit opt-in flag only).
+ */
+export type PermissionMode = 'default' | 'accept-edits' | 'yolo';
+export type ApprovalDecision = 'allow-once' | 'allow-session' | 'allow-project' | 'deny';
+export interface ApprovalRequest {
+    action: CodingAction;
+    /** One-line headline for the dialog, e.g. `Run command` / `Edit file`. */
+    title: string;
+    /** The command text or workspace-relative path. */
+    detail: string;
+    /** Diff / content preview (edit/write), when available. */
+    preview?: string;
+    /** Whether "Allow for session"/"Always allow (project)" may be offered (never for dangerous commands). */
+    allowSession: boolean;
+}
+/** Interactive approver (TUI bridge). Absent approver = headless surface (exec). */
+export interface Approver {
+    approve(req: ApprovalRequest): Promise<ApprovalDecision>;
+}
+/**
+ * The coding-tools permission gate. Single choke point (spec 2026-08-21): tools call
+ * check() after validating arguments and before any side effect.
+ *
+ * Guardrails that survive every mode except yolo, and that session allowlists never
+ * override: `.git/` writes always ask; dangerous bash (sudo, forced rm, ...) always
+ * asks and is never allowlistable. Headless (no approver) fails CLOSED: anything
+ * that would ask is denied with a message naming the enable flag.
+ */
+export declare class CodingPermissionGate implements PermissionGate {
+    private mode;
+    private readonly approver;
+    private readonly root;
+    /** Explicit per-category headless enables (exec --allow-bash / --allow-write). */
+    private readonly headlessAllow;
+    private readonly bashAllowlist;
+    private readonly bashExactAllowlist;
+    private readonly writeDirAllowlist;
+    /** Persist callback for 'allow-project' decisions (run.tsx wires the PermissionStore). */
+    private readonly onPersist;
+    constructor(opts: {
+        root: string;
+        approver?: Approver | null;
+        mode?: PermissionMode;
+        headlessAllow?: {
+            bash?: boolean;
+            write?: boolean;
+        };
+        /** Rules loaded from the per-workspace permission store (TUI only). */
+        persisted?: PersistedRules;
+        onPersist?: (rule: PersistRule) => void;
+    });
+    getMode(): PermissionMode;
+    setMode(mode: PermissionMode): void;
+    check(action: CodingAction): Promise<GateVerdict>;
+    private checkBash;
+    private allowedByBashList;
+    private checkWrite;
+    private allowedByDirList;
+}

package/dist/src/coding/permissionGate.js

@@ -0,0 +1,138 @@
+import path from 'node:path';
+import { allowlistPrefixFor, isCompoundCommand, isDangerousCommand, matchesAllowlistPrefix, } from './dangerousCommands.js';
+const DENIED_BY_USER = 'The user denied permission for this action. Adjust your approach or ask the user.';
+/**
+ * The coding-tools permission gate. Single choke point (spec 2026-08-21): tools call
+ * check() after validating arguments and before any side effect.
+ *
+ * Guardrails that survive every mode except yolo, and that session allowlists never
+ * override: `.git/` writes always ask; dangerous bash (sudo, forced rm, ...) always
+ * asks and is never allowlistable. Headless (no approver) fails CLOSED: anything
+ * that would ask is denied with a message naming the enable flag.
+ */
+export class CodingPermissionGate {
+    mode;
+    approver;
+    root;
+    /** Explicit per-category headless enables (exec --allow-bash / --allow-write). */
+    headlessAllow;
+    bashAllowlist = new Set(); // two-word prefixes
+    bashExactAllowlist = new Set(); // full commands (compound/banned-prefix)
+    writeDirAllowlist = new Set(); // directory subtrees
+    /** Persist callback for 'allow-project' decisions (run.tsx wires the PermissionStore). */
+    onPersist;
+    constructor(opts) {
+        this.root = opts.root;
+        this.approver = opts.approver ?? null;
+        this.mode = opts.mode ?? 'default';
+        this.headlessAllow = {
+            bash: opts.headlessAllow?.bash === true,
+            write: opts.headlessAllow?.write === true,
+        };
+        this.onPersist = opts.onPersist;
+        for (const p of opts.persisted?.bashPrefixes ?? [])
+            this.bashAllowlist.add(p);
+        for (const c of opts.persisted?.bashExact ?? [])
+            this.bashExactAllowlist.add(c);
+        for (const d of opts.persisted?.writeDirs ?? [])
+            this.writeDirAllowlist.add(d);
+    }
+    getMode() {
+        return this.mode;
+    }
+    setMode(mode) {
+        this.mode = mode;
+    }
+    async check(action) {
+        if (this.mode === 'yolo')
+            return { ok: true };
+        return action.kind === 'bash' ? this.checkBash(action.command) : this.checkWrite(action);
+    }
+    async checkBash(command) {
+        if (this.headlessAllow.bash)
+            return { ok: true };
+        const dangerous = isDangerousCommand(command);
+        if (!dangerous && this.allowedByBashList(command))
+            return { ok: true };
+        if (!this.approver) {
+            return {
+                ok: false,
+                message: 'Shell commands are disabled here. The user must re-run with --allow-bash (or --yolo) to enable them.',
+            };
+        }
+        const decision = await this.approver.approve({
+            action: { kind: 'bash', command },
+            title: dangerous ? 'Run command (DANGEROUS)' : 'Run command',
+            detail: command,
+            allowSession: !dangerous,
+        });
+        if (decision === 'deny')
+            return { ok: false, message: DENIED_BY_USER };
+        if ((decision === 'allow-session' || decision === 'allow-project') && !dangerous) {
+            const prefix = allowlistPrefixFor(command);
+            if (prefix)
+                this.bashAllowlist.add(prefix);
+            else
+                this.bashExactAllowlist.add(command);
+            if (decision === 'allow-project') {
+                this.onPersist?.(prefix ? { type: 'bash-prefix', value: prefix } : { type: 'bash-exact', value: command });
+            }
+        }
+        return { ok: true };
+    }
+    allowedByBashList(command) {
+        if (this.bashExactAllowlist.has(command))
+            return true;
+        if (isCompoundCommand(command))
+            return false; // prefixes NEVER match compound commands
+        for (const prefix of this.bashAllowlist) {
+            if (matchesAllowlistPrefix(command, prefix))
+                return true;
+        }
+        return false;
+    }
+    async checkWrite(action) {
+        const rel = path.relative(this.root, action.path);
+        const touchesGit = rel.split(path.sep).includes('.git');
+        if (!touchesGit) {
+            if (this.headlessAllow.write)
+                return { ok: true };
+            if (this.mode === 'accept-edits')
+                return { ok: true };
+            if (this.allowedByDirList(action.path))
+                return { ok: true };
+        }
+        if (!this.approver) {
+            return {
+                ok: false,
+                message: touchesGit
+                    ? 'Writing inside .git/ is not allowed here.'
+                    : 'File writes are disabled here. The user must re-run with --allow-write (or --yolo) to enable them.',
+            };
+        }
+        const decision = await this.approver.approve({
+            action,
+            title: action.kind === 'edit' ? 'Edit file' : 'Write file',
+            detail: rel || action.path,
+            preview: action.preview,
+            allowSession: !touchesGit,
+        });
+        if (decision === 'deny')
+            return { ok: false, message: DENIED_BY_USER };
+        if ((decision === 'allow-session' || decision === 'allow-project') && !touchesGit) {
+            const dir = path.dirname(action.path);
+            this.writeDirAllowlist.add(dir);
+            if (decision === 'allow-project')
+                this.onPersist?.({ type: 'write-dir', value: dir });
+        }
+        return { ok: true };
+    }
+    allowedByDirList(file) {
+        for (const dir of this.writeDirAllowlist) {
+            if (file === dir || file.startsWith(dir + path.sep))
+                return true;
+        }
+        return false;
+    }
+}
+//# sourceMappingURL=permissionGate.js.map

package/dist/src/coding/permissionGate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionGate.js","sourceRoot":"","sources":["../../../src/coding/permissionGate.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AA6BhC,MAAM,cAAc,GAAG,mFAAmF,CAAC;AAE3G;;;;;;;;GAQG;AACH,MAAM,OAAO,oBAAoB;IACvB,IAAI,CAAiB;IACZ,QAAQ,CAAkB;IAC1B,IAAI,CAAS;IAC9B,kFAAkF;IACjE,aAAa,CAAoC;IACjD,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC,CAAC,oBAAoB;IACvD,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC,CAAC,yCAAyC;IACjF,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC,CAAC,qBAAqB;IAE7E,0FAA0F;IACzE,SAAS,CAA4C;IAEtE,YAAY,IAQX;QACC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC;QACnC,IAAI,CAAC,aAAa,GAAG;YACnB,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,KAAK,IAAI;YACvC,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,KAAK,KAAK,IAAI;SAC1C,CAAC;QACF,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,YAAY,IAAI,EAAE;YAAE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC9E,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,SAAS,IAAI,EAAE;YAAE,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAChF,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,SAAS,IAAI,EAAE;YAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACjF,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,OAAO,CAAC,IAAoB;QAC1B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,MAAoB;QAC9B,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAC9C,OAAO,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAC3F,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,OAAe;QACrC,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACjD,MAAM,SAAS,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACvE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EACL,sGAAsG;aACzG,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC3C,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;YACjC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,aAAa;YAC5D,MAAM,EAAE,OAAO;YACf,YAAY,EAAE,CAAC,SAAS;SACzB,CAAC,CAAC;QACH,IAAI,QAAQ,KAAK,MAAM;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;QACvE,IAAI,CAAC,QAAQ,KAAK,eAAe,IAAI,QAAQ,KAAK,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACjF,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,MAAM;gBAAE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;;gBACtC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC1C,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;gBACjC,IAAI,CAAC,SAAS,EAAE,CACd,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,CACzF,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAEO,iBAAiB,CAAC,OAAe;QACvC,IAAI,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QACtD,IAAI,iBAAiB,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,yCAAyC;QACvF,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACxC,IAAI,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC3D,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,MAAyD;QAChF,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAExD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,IAAI,CAAC,aAAa,CAAC,KAAK;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YAClD,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YACtD,IAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAC9D,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,UAAU;oBACjB,CAAC,CAAC,2CAA2C;oBAC7C,CAAC,CAAC,oGAAoG;aACzG,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC3C,MAAM;YACN,KAAK,EAAE,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY;YAC1D,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,IAAI;YAC1B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,YAAY,EAAE,CAAC,UAAU;SAC1B,CAAC,CAAC;QACH,IAAI,QAAQ,KAAK,MAAM;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;QACvE,IAAI,CAAC,QAAQ,KAAK,eAAe,IAAI,QAAQ,KAAK,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YAClF,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,QAAQ,KAAK,eAAe;gBAAE,IAAI,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAEO,gBAAgB,CAAC,IAAY;QACnC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACzC,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;QACnE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/src/coding/permissionStore.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Persistent per-workspace permission rules ("Always allow for this project",
+ * P1 2026-08-21). One JSON file under the CLI config dir, keyed by workspace
+ * root realpath, so rules never leak across projects.
+ *
+ * Consumed by the TUI only: exec stays fail-closed on explicit flags — a
+ * headless run must never gain shell access from an approval granted in some
+ * earlier interactive session.
+ *
+ * Dangerous commands can never reach here (the gate refuses to remember them),
+ * and every write is best-effort: a corrupt or unwritable store degrades to
+ * session-only behavior, never to an error the user sees mid-approval.
+ */
+export interface PersistedRules {
+    bashPrefixes: string[];
+    bashExact: string[];
+    writeDirs: string[];
+}
+export type PersistRule = {
+    type: 'bash-prefix';
+    value: string;
+} | {
+    type: 'bash-exact';
+    value: string;
+} | {
+    type: 'write-dir';
+    value: string;
+};
+export declare class PermissionStore {
+    private readonly filePath;
+    constructor(filePath?: string);
+    load(workspaceRoot: string): Promise<PersistedRules>;
+    /** Append one rule (read-modify-write; best-effort, never throws). */
+    add(workspaceRoot: string, rule: PersistRule): Promise<void>;
+    private read;
+}

package/dist/src/coding/permissionStore.js

@@ -0,0 +1,56 @@
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import { configDir } from '../config/paths.js';
+const EMPTY = { bashPrefixes: [], bashExact: [], writeDirs: [] };
+export class PermissionStore {
+    filePath;
+    constructor(filePath = path.join(configDir(), 'permissions.json')) {
+        this.filePath = filePath;
+    }
+    async load(workspaceRoot) {
+        const store = await this.read();
+        const ws = store.workspaces[workspaceRoot];
+        if (!ws)
+            return { ...EMPTY };
+        return {
+            bashPrefixes: dedupeStrings(ws.bashPrefixes),
+            bashExact: dedupeStrings(ws.bashExact),
+            writeDirs: dedupeStrings(ws.writeDirs),
+        };
+    }
+    /** Append one rule (read-modify-write; best-effort, never throws). */
+    async add(workspaceRoot, rule) {
+        try {
+            const store = await this.read();
+            const ws = (store.workspaces[workspaceRoot] ??= {});
+            const key = rule.type === 'bash-prefix' ? 'bashPrefixes' : rule.type === 'bash-exact' ? 'bashExact' : 'writeDirs';
+            const list = (ws[key] ??= []);
+            if (!list.includes(rule.value))
+                list.push(rule.value);
+            await fs.mkdir(path.dirname(this.filePath), { recursive: true });
+            await fs.writeFile(this.filePath, JSON.stringify(store, null, 2) + '\n', 'utf8');
+        }
+        catch {
+            // Best-effort: the in-memory session rule still applies.
+        }
+    }
+    async read() {
+        try {
+            const parsed = JSON.parse(await fs.readFile(this.filePath, 'utf8'));
+            if (typeof parsed === 'object' &&
+                parsed !== null &&
+                parsed.version === 1 &&
+                typeof parsed.workspaces === 'object') {
+                return parsed;
+            }
+        }
+        catch {
+            // Missing or corrupt → fresh store.
+        }
+        return { version: 1, workspaces: {} };
+    }
+}
+function dedupeStrings(v) {
+    return Array.isArray(v) ? [...new Set(v.filter((x) => typeof x === 'string'))] : [];
+}
+//# sourceMappingURL=permissionStore.js.map

package/dist/src/coding/permissionStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionStore.js","sourceRoot":"","sources":["../../../src/coding/permissionStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAgC/C,MAAM,KAAK,GAAmB,EAAE,YAAY,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;AAEjF,MAAM,OAAO,eAAe;IACG;IAA7B,YAA6B,WAAmB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,kBAAkB,CAAC;QAA7D,aAAQ,GAAR,QAAQ,CAAqD;IAAG,CAAC;IAE9F,KAAK,CAAC,IAAI,CAAC,aAAqB;QAC9B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,EAAE,GAAG,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;QAC3C,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;QAC7B,OAAO;YACL,YAAY,EAAE,aAAa,CAAC,EAAE,CAAC,YAAY,CAAC;YAC5C,SAAS,EAAE,aAAa,CAAC,EAAE,CAAC,SAAS,CAAC;YACtC,SAAS,EAAE,aAAa,CAAC,EAAE,CAAC,SAAS,CAAC;SACvC,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,KAAK,CAAC,GAAG,CAAC,aAAqB,EAAE,IAAiB;QAChD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAChC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC;YACpD,MAAM,GAAG,GACP,IAAI,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC;YACxG,MAAM,IAAI,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACtD,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACjE,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;QACnF,CAAC;QAAC,MAAM,CAAC;YACP,yDAAyD;QAC3D,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;YAC7E,IACE,OAAO,MAAM,KAAK,QAAQ;gBAC1B,MAAM,KAAK,IAAI;gBACd,MAAqB,CAAC,OAAO,KAAK,CAAC;gBACpC,OAAQ,MAAqB,CAAC,UAAU,KAAK,QAAQ,EACrD,CAAC;gBACD,OAAO,MAAoB,CAAC;YAC9B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,oCAAoC;QACtC,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IACxC,CAAC;CACF;AAED,SAAS,aAAa,CAAC,CAAU;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACnG,CAAC"}

package/dist/src/coding/permissions.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Permission gate contract for the coding tools (bash / write_file / edit_file).
+ *
+ * Single choke point (pi's beforeToolCall shape): tools call {@link PermissionGate.check}
+ * AFTER parsing/validating arguments and BEFORE any side effect. A denial is returned to
+ * the model as an error tool result — the turn continues and the model can adapt.
+ *
+ * The full implementation (modes / session allowlist / dangerous-command detection /
+ * interactive approver) lives in permissionGate.ts; this file is the dependency surface
+ * the tools import, so they stay decoupled from UI concerns.
+ */
+export type CodingAction = {
+    kind: 'bash';
+    command: string;
+} | {
+    kind: 'write';
+    path: string;
+    preview?: string;
+} | {
+    kind: 'edit';
+    path: string;
+    preview?: string;
+};
+export type GateVerdict = {
+    ok: true;
+} | {
+    ok: false;
+    message: string;
+};
+export interface PermissionGate {
+    check(action: CodingAction): Promise<GateVerdict>;
+}
+/** Gate that allows everything — unit tests and yolo mode. */
+export declare const allowAllGate: PermissionGate;

package/dist/src/coding/permissions.js

@@ -0,0 +1,18 @@
+/**
+ * Permission gate contract for the coding tools (bash / write_file / edit_file).
+ *
+ * Single choke point (pi's beforeToolCall shape): tools call {@link PermissionGate.check}
+ * AFTER parsing/validating arguments and BEFORE any side effect. A denial is returned to
+ * the model as an error tool result — the turn continues and the model can adapt.
+ *
+ * The full implementation (modes / session allowlist / dangerous-command detection /
+ * interactive approver) lives in permissionGate.ts; this file is the dependency surface
+ * the tools import, so they stay decoupled from UI concerns.
+ */
+/** Gate that allows everything — unit tests and yolo mode. */
+export const allowAllGate = {
+    async check() {
+        return { ok: true };
+    },
+};
+//# sourceMappingURL=permissions.js.map

package/dist/src/coding/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../../src/coding/permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAaH,8DAA8D;AAC9D,MAAM,CAAC,MAAM,YAAY,GAAmB;IAC1C,KAAK,CAAC,KAAK;QACT,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;CACF,CAAC"}

package/dist/src/coding/projectContext.d.ts

@@ -0,0 +1,21 @@
+export declare const PROJECT_CONTEXT_MAX_BYTES: number;
+export interface ProjectContextFile {
+    path: string;
+    content: string;
+}
+/**
+ * Collect context files from the repo root down to `workspaceRoot` (root-first order),
+ * within one shared byte budget. Files that would blow the budget are skipped whole
+ * (never truncated mid-file — a half instruction is worse than none).
+ */
+export declare function loadProjectContext(workspaceRoot: string, maxBytes?: number): Promise<ProjectContextFile[]>;
+/**
+ * The coding-guidance system message. Kept deliberately short (pi style): tool-choice
+ * strategy the tool descriptions cannot express, the safety posture, and the project
+ * instructions. Written to degrade gracefully for models without tool_use — every
+ * rule is scoped to "when the tools are available".
+ */
+export declare function buildCodingSystemMessage(opts: {
+    workspaceRoot: string;
+    contextFiles: ProjectContextFile[];
+}): string;