@hank-warren/pi-auto-permissions 0.10.0 → 0.11.1

package/CHANGELOG.md

@@ -1,5 +1,38 @@
 # @hank-warren/pi-auto-permissions
 
+## 0.11.1
+
+### Patch Changes
+
+- 3fbf632: Stop evidence truncation from re-appending the whole record. With a per-record cap of 1-3 the head share rounded up to the entire budget, leaving a zero-length tail — and `slice(-0)` is `slice(0)`, so the "truncated" record was longer than its input and carried an elision marker for text the reviewer could still read. Caps of 4 and above, including every shipped default, are unaffected.
+- Updated dependencies [3fbf632]
+  - @hank-warren/pi-permission-selector@1.3.0
+
+## 0.11.0
+
+### Minor Changes
+
+- f93481e: add `/auto-permissions`, a settings menu for the reviewer configuration
+
+  The reviewer model, thinking level and timeout — plus the `enabled` flag — were
+  hand-edited JSON. They are the settings that change most often, and switching a
+  reviewer meant opening `~/.pi/agent/pi-auto-permissions/config.json` and getting
+  a provider id exactly right by memory.
+
+  `/auto-permissions` puts those four on a settings list, with the model picked
+  from the models you are actually signed in to (a configured but unavailable
+  reviewer is pinned first so opening the menu can never silently drop it). A
+  fifth read-only row reports where the active system prompt comes from — the
+  resolved `systemPromptFile` path, or the built-in or inline prompt.
+
+  The menu is a narrow, merging writer: it patches only `enabled` and `reviewer`
+  into whatever is on disk at save time, preserving rules, prompts, evidence
+  settings, log paths, unknown keys and the file's own indentation, so a
+  concurrent hand-edit survives. A config that fails validation is reported and
+  never rewritten. No restart is involved — the config is already re-read on every
+  guarded command, and the reviewer fingerprint already covers the model and
+  reasoning effort, so a save takes effect on the next command in every session.
+
 ## 0.10.0
 
 ### Minor Changes

package/README.md

@@ -119,7 +119,7 @@ By default, the guardian uses Pi's active model with low reasoning effort and a
 Giving the guardian its own account keeps reviews from competing with your interactive session for a subscription's rate limits. Pi keys OAuth credentials by provider id, so a second login needs a second provider id — which is what [`@hank-warren/pi-multi-login`](../pi-multi-login/README.md) exists to create. This package no longer registers one itself.
 
 1. `pi install npm:@hank-warren/pi-multi-login`
-2. Run `/multi-login`, add a login with base `openai-codex` and suffix `auto-permissions`, and complete OAuth with the account reserved for guardian reviews.
+2. Run `/multi-login` and add a login with base `openai-codex` and suffix `auto-permissions`; then run `/login`, pick the new provider, and complete OAuth with the account reserved for guardian reviews.
 3. Select the dedicated provider in the Auto Permissions config:
 
 ```json
@@ -139,6 +139,20 @@ If you already used the login this package registered in earlier versions, nothi
 
 Other reviewer providers continue to work by setting their normal provider and model ids.
 
+### `/auto-permissions`
+
+The reviewer settings that change most often are editable from a settings menu instead of the config file:
+
+| Row | What it edits |
+| --- | --- |
+| Enabled | `enabled` — off lets every command run without guardian review |
+| Reviewer model | `reviewer.provider` / `reviewer.model`, picked from the models you are signed in to |
+| Thinking level | `reviewer.reasoningEffort` |
+| Review timeout | `reviewer.timeoutMs`, entered as `30s` or `45000ms` |
+| System prompt | read-only: the resolved path of the active `systemPromptFile`, or whether the built-in or an inline prompt is in use |
+
+Saves are applied immediately — the config is re-read on every guarded command, so there is nothing to restart, in this session or any other. The menu is a narrow writer: it merges only the keys above into whatever is on disk, so rules, prompts, evidence settings and log paths stay exactly as you wrote them and remain file-only. A config that fails validation is never rewritten; the menu reports the error and refuses to open.
+
 ### Guardian prompt
 
 The bundled prompt evaluates authorization, command risk, and compliance with user constraints. Replace it inline with `systemPrompt`, or load a file:

package/config-writer.ts

@@ -0,0 +1,107 @@
+/**
+ * Narrow, merging writer for the auto-permissions config file.
+ *
+ * The config is hand-maintained: rules, the system prompt, evidence knobs and
+ * log paths all live in the same JSON object the `/auto-permissions` menu
+ * edits. So this writer never serializes a whole config snapshot -- it re-reads
+ * the file, patches only the keys one edit touched, and writes the result back
+ * atomically. Anything it does not know about (including keys a future version
+ * adds, and edits another session made a second ago) survives untouched.
+ */
+import { mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+import { pid } from "node:process";
+import { autoPermissionsConfigPath, type ReasoningEffort } from "./config.js";
+
+export { autoPermissionsConfigPath };
+
+/** The subset of the config the settings UI owns. */
+export interface ReviewerBlock {
+  provider: string;
+  model: string;
+  reasoningEffort: ReasoningEffort;
+  timeoutMs: number;
+}
+
+export interface ConfigPatch {
+  enabled?: boolean;
+  reviewer?: ReviewerBlock;
+}
+
+const DEFAULT_INDENT = "  ";
+
+/**
+ * Keep the file looking like the human left it. Only the first indented line
+ * matters: JSON.stringify takes a single indent string for the whole document.
+ */
+export function detectIndent(text: string): string {
+  const match = /\n([ \t]+)\S/.exec(text);
+  if (!match) return DEFAULT_INDENT;
+  const indent = match[1] ?? DEFAULT_INDENT;
+  return indent.startsWith("\t") ? "\t" : indent;
+}
+
+function readText(path: string): string {
+  try {
+    return readFileSync(path, "utf8");
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return "";
+    throw error;
+  }
+}
+
+function parseObject(text: string): Record<string, unknown> {
+  if (!text.trim()) return {};
+  const parsed: unknown = JSON.parse(text);
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("auto permissions config must be a JSON object");
+  }
+  return parsed as Record<string, unknown>;
+}
+
+/**
+ * Apply `patch` to the object currently on disk and rewrite the file.
+ *
+ * Sparse `enabled`: the loader reads a missing key as enabled, so turning the
+ * guardian back on deletes the key rather than writing `true`. That keeps a
+ * default flip reaching hosts that never touched the setting, matching how
+ * pi-statusline serializes its settings.
+ *
+ * Throws on an unparsable or non-object file rather than clobbering it; the
+ * caller surfaces that as a notification.
+ */
+export function patchAutoPermissionsConfig(
+  path: string = autoPermissionsConfigPath(),
+  patch: ConfigPatch = {},
+): void {
+  const existing = readText(path);
+  const merged = parseObject(existing);
+
+  if (patch.enabled !== undefined) {
+    if (patch.enabled) delete merged.enabled;
+    else merged.enabled = false;
+  }
+  if (patch.reviewer !== undefined) {
+    merged.reviewer = {
+      provider: patch.reviewer.provider,
+      model: patch.reviewer.model,
+      reasoningEffort: patch.reviewer.reasoningEffort,
+      timeoutMs: patch.reviewer.timeoutMs,
+    };
+  }
+
+  const payload = `${JSON.stringify(merged, null, detectIndent(existing))}\n`;
+  const temporary = `${path}.${pid}.tmp`;
+  mkdirSync(dirname(path), { recursive: true });
+  try {
+    writeFileSync(temporary, payload, { mode: 0o600 });
+    renameSync(temporary, path);
+  } catch (error) {
+    try {
+      unlinkSync(temporary);
+    } catch {
+      // The temp file may never have been created; nothing to clean up.
+    }
+    throw error;
+  }
+}

package/config.ts

@@ -7,9 +7,25 @@ import { AUTO_PERMISSIONS_SYSTEM_PROMPT } from "./review.js";
 
 export const CONFIG_FILENAME = "pi-auto-permissions/config.json";
 
-const REASONING_EFFORTS = ["minimal", "low", "medium", "high", "xhigh", "max"] as const;
+export const REASONING_EFFORTS = ["minimal", "low", "medium", "high", "xhigh", "max"] as const;
 export type ReasoningEffort = typeof REASONING_EFFORTS[number];
 
+/** Loader defaults for an incomplete `reviewer` block, shared with the settings UI. */
+export const DEFAULT_REVIEWER_REASONING_EFFORT: ReasoningEffort = "low";
+export const DEFAULT_REVIEWER_TIMEOUT_MS = 30_000;
+export const MIN_REVIEWER_TIMEOUT_MS = 1_000;
+export const MAX_REVIEWER_TIMEOUT_MS = 300_000;
+
+/**
+ * Where the active reviewer system prompt came from. The settings UI shows this
+ * (read-only) so the resolved `systemPromptFile` path is visible without having
+ * to re-derive the loader's relative-path resolution by hand.
+ */
+export type SystemPromptSource =
+  | { kind: "builtin" }
+  | { kind: "inline" }
+  | { kind: "file"; path: string };
+
 export interface AutoPermissionsConfig {
   enabled: boolean;
   reviewer?: {
@@ -19,6 +35,7 @@ export interface AutoPermissionsConfig {
     timeoutMs: number;
   };
   systemPrompt: string;
+  systemPromptSource: SystemPromptSource;
   reviewEvidence: {
     projectInstructions: boolean;
     userAnswerTools: string[];
@@ -54,7 +71,12 @@ interface RuleInput {
   message?: unknown;
 }
 
-function configPath(): string {
+/**
+ * The single config location, honouring the `PI_AUTO_PERMISSIONS_CONFIG`
+ * override. Exported so the settings writer can never target a different file
+ * than the loader reads.
+ */
+export function autoPermissionsConfigPath(): string {
   return process.env.PI_AUTO_PERMISSIONS_CONFIG
     ? resolve(process.env.PI_AUTO_PERMISSIONS_CONFIG)
     : join(getAgentDir(), CONFIG_FILENAME);
@@ -102,18 +124,21 @@ function compileRule(value: unknown, index: number): Gate {
   };
 }
 
-function resolvePrompt(raw: Record<string, unknown>, path: string): string {
+function resolvePrompt(
+  raw: Record<string, unknown>,
+  path: string,
+): { prompt: string; source: SystemPromptSource } {
   const inline = optionalString(raw.systemPrompt, "systemPrompt");
   const file = optionalString(raw.systemPromptFile, "systemPromptFile");
   if (inline && file) throw new Error("set only one of systemPrompt and systemPromptFile");
-  if (inline) return inline;
-  if (!file) return AUTO_PERMISSIONS_SYSTEM_PROMPT;
+  if (inline) return { prompt: inline, source: { kind: "inline" } };
+  if (!file) return { prompt: AUTO_PERMISSIONS_SYSTEM_PROMPT, source: { kind: "builtin" } };
 
   const expanded = file.startsWith("~/") ? join(homedir(), file.slice(2)) : file;
   const resolved = isAbsolute(expanded) ? expanded : resolve(dirname(path), expanded);
   const prompt = readFileSync(resolved, "utf8").trim();
   if (!prompt) throw new Error("systemPromptFile is empty");
-  return prompt;
+  return { prompt, source: { kind: "file", path: resolved } };
 }
 
 const EVIDENCE_PRUNING_DEFAULTS = {
@@ -228,27 +253,34 @@ function resolveReviewer(raw: Record<string, unknown>): AutoPermissionsConfig["r
   const provider = optionalString(reviewer.provider, "reviewer.provider");
   const model = optionalString(reviewer.model, "reviewer.model");
   if (!provider || !model) throw new Error("reviewer requires both provider and model");
-  const reasoningEffort = (optionalString(reviewer.reasoningEffort, "reviewer.reasoningEffort") ?? "low") as ReasoningEffort;
+  const reasoningEffort = (optionalString(reviewer.reasoningEffort, "reviewer.reasoningEffort")
+    ?? DEFAULT_REVIEWER_REASONING_EFFORT) as ReasoningEffort;
   if (!REASONING_EFFORTS.includes(reasoningEffort)) {
     throw new Error("reviewer.reasoningEffort is invalid");
   }
-  const timeoutMs = reviewer.timeoutMs === undefined ? 30_000 : reviewer.timeoutMs;
-  if (!Number.isInteger(timeoutMs) || Number(timeoutMs) < 1_000 || Number(timeoutMs) > 300_000) {
+  const timeoutMs = reviewer.timeoutMs === undefined ? DEFAULT_REVIEWER_TIMEOUT_MS : reviewer.timeoutMs;
+  if (
+    !Number.isInteger(timeoutMs)
+    || Number(timeoutMs) < MIN_REVIEWER_TIMEOUT_MS
+    || Number(timeoutMs) > MAX_REVIEWER_TIMEOUT_MS
+  ) {
     throw new Error("reviewer.timeoutMs must be an integer between 1000 and 300000");
   }
   return { provider, model, reasoningEffort, timeoutMs: Number(timeoutMs) };
 }
 
-export function loadAutoPermissionsConfig(path = configPath()): AutoPermissionsConfig {
+export function loadAutoPermissionsConfig(path = autoPermissionsConfigPath()): AutoPermissionsConfig {
   const raw = readObject(path);
   if (raw.enabled !== undefined && typeof raw.enabled !== "boolean") throw new Error("enabled must be boolean");
   if (raw.rules !== undefined && !Array.isArray(raw.rules)) throw new Error("rules must be an array");
   const customRules = (raw.rules ?? []).map(compileRule);
+  const prompt = resolvePrompt(raw, path);
 
   return {
     enabled: raw.enabled !== false,
     reviewer: resolveReviewer(raw),
-    systemPrompt: resolvePrompt(raw, path),
+    systemPrompt: prompt.prompt,
+    systemPromptSource: prompt.source,
     reviewEvidence: resolveReviewEvidence(raw),
     evaluationLog: resolveEvaluationLog(raw, path),
     usageLog: resolveUsageLog(raw, path),

package/index.ts

@@ -3,13 +3,33 @@ import { resolveGuardianCompleteSimple } from "./guardian-transport.js";
 import { isOpenAICodexModel } from "./openai-codex-transport.js";
 import { detectSubagentContext } from "./subagent-context.js";
 import * as PiCodingAgent from "@earendil-works/pi-coding-agent";
-import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
+import {
+  getSelectListTheme,
+  getSettingsListTheme,
+  type ExtensionAPI,
+  type ExtensionContext,
+} from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
-import { Container, Text, truncateToWidth } from "@earendil-works/pi-tui";
+import { Container, SettingsList, Text, truncateToWidth } from "@earendil-works/pi-tui";
 import { randomBytes, randomUUID } from "node:crypto";
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
-import { loadAutoPermissionsConfig, type AutoPermissionsConfig } from "./config.js";
+import {
+  autoPermissionsConfigPath,
+  loadAutoPermissionsConfig,
+  type AutoPermissionsConfig,
+} from "./config.js";
+import { patchAutoPermissionsConfig } from "./config-writer.js";
+import {
+  applySettingChange,
+  buildSettingItems,
+  createModelSubmenu,
+  createTimeoutSubmenu,
+  type MenuModel,
+  type ReviewerSettings,
+  type SettingChange,
+  type SubmenuHost,
+} from "./settings-menu.js";
 import {
   appendPromptEvaluation,
   classifyPromptChoice,
@@ -1005,6 +1025,111 @@ export default function autoPermissionsExtension(pi: ExtensionAPI) {
     },
   });
 
+  /**
+   * `/auto-permissions`: edit the reviewer model, thinking level, timeout and
+   * the enabled flag without hand-editing config.json.
+   *
+   * There is no live-apply step: every tool call re-reads the config through
+   * currentConfig(), so a saved edit is in force immediately -- in this session
+   * and in every other one. reviewerFingerprint() covers provider, model and
+   * reasoning effort, so the cached reviewer lineage self-invalidates too.
+   */
+  pi.registerCommand("auto-permissions", {
+    description: "Configure Auto Permissions",
+    handler: async (_args, ctx) => {
+      if (ctx.mode !== "tui") {
+        ctx.ui.notify("/auto-permissions requires interactive TUI mode", "warning");
+        return;
+      }
+
+      const path = autoPermissionsConfigPath();
+      let settings: ReviewerSettings;
+      try {
+        const config = loadAutoPermissionsConfig(path);
+        settings = {
+          enabled: config.enabled,
+          reviewer: config.reviewer,
+          systemPromptSource: config.systemPromptSource,
+        };
+      } catch (error) {
+        // Editing a file we cannot validate is the one way this writer could
+        // quietly make things worse, so refuse rather than open.
+        const message = error instanceof Error ? error.message : String(error);
+        ctx.ui.notify(`Auto Permissions config error: ${message} \u2014 fix ${path} first`, "warning");
+        return;
+      }
+
+      /** Persist one accepted edit, then report anything the save surfaced. */
+      const commit = (change: SettingChange): void => {
+        if (change.kind === "ignored") return;
+        if (change.kind === "error") {
+          ctx.ui.notify(change.message, "warning");
+          return;
+        }
+        const previous = settings;
+        settings = change.settings;
+        try {
+          patchAutoPermissionsConfig(path, { enabled: settings.enabled, reviewer: settings.reviewer });
+        } catch (error) {
+          settings = previous;
+          const message = error instanceof Error ? error.message : String(error);
+          ctx.ui.notify(`Could not save Auto Permissions settings: ${message}`, "warning");
+          return;
+        }
+        if (change.kind === "warn") ctx.ui.notify(change.message, "warning");
+        // A breakage elsewhere in the file would otherwise surface at the next
+        // bash call, looking like this edit caused it.
+        try {
+          loadAutoPermissionsConfig(path);
+        } catch (error) {
+          const message = error instanceof Error ? error.message : String(error);
+          ctx.ui.notify(`Auto Permissions config error: ${message}`, "warning");
+        }
+      };
+
+      const reviewerModel = (): MenuModel | undefined => {
+        if (!settings.reviewer) return undefined;
+        return ctx.modelRegistry.find(settings.reviewer.provider, settings.reviewer.model) as MenuModel | undefined;
+      };
+
+      await ctx.ui.custom<void>((tui, _theme, _keybindings, done) => {
+        const host: SubmenuHost = {
+          getSettings: () => settings,
+          commit,
+          availableModels: () => ctx.modelRegistry.getAvailable() as MenuModel[],
+          requestRender: () => tui.requestRender(),
+          settingsTheme: getSettingsListTheme(),
+          selectTheme: getSelectListTheme(),
+        };
+        const list = new SettingsList(
+          buildSettingItems(settings, {
+            reviewerModel: createModelSubmenu(host),
+            timeout: createTimeoutSubmenu(host),
+          }),
+          10,
+          host.settingsTheme,
+          (id, value) => {
+            commit(applySettingChange(settings, id, value, reviewerModel()));
+            tui.requestRender();
+          },
+          () => done(undefined),
+          { enableSearch: true },
+        );
+        return {
+          invalidate(): void {
+            list.invalidate();
+          },
+          handleInput(data: string): void {
+            list.handleInput(data);
+          },
+          render(width: number): string[] {
+            return list.render(width);
+          },
+        };
+      });
+    },
+  });
+
   pi.on("session_shutdown", async (_event, ctx) => {
     sessionActive = false;
     reviewerLifecycleController.abort();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hank-warren/pi-auto-permissions",
-  "version": "0.10.0",
+  "version": "0.11.1",
   "description": "Fork of @ogulcancelik/pi-auto-permissions with dialog-answer user evidence: context-aware Bash permissions for Pi with automated guardian review.",
   "type": "module",
   "keywords": [
@@ -41,6 +41,8 @@
     "index.ts",
     "approval-pulse.ts",
     "config.ts",
+    "config-writer.ts",
+    "settings-menu.ts",
     "guardian-transport.ts",
     "openai-codex-transport.ts",
     "subagent-context.ts",
@@ -55,7 +57,7 @@
     "CHANGELOG.md"
   ],
   "dependencies": {
-    "@hank-warren/pi-permission-selector": "^1.1.1"
+    "@hank-warren/pi-permission-selector": "^1.3.0"
   },
   "peerDependencies": {
     "@earendil-works/pi-ai": "*",

package/review.ts

@@ -46,12 +46,20 @@ const TRUNCATION_HEAD_SHARE = 0.7;
  * the final segment of command chains, so both are preserved; the marker
  * tells the reviewer content is elided so it can never treat truncation as
  * proof of absence.
+ *
+ * A cap small enough that the head share rounds up to the whole budget leaves
+ * no tail. That case must drop the tail segment entirely rather than emit
+ * `slice(-0)`, which is `slice(0)` and would splice the *entire* record back
+ * in behind a marker claiming it had been elided — output longer than the
+ * input, and a marker the reviewer is told to trust.
  */
 export function truncateEvidenceText(text: string, maxChars: number): string {
   if (maxChars <= 0 || text.length <= maxChars) return text;
   const head = Math.ceil(maxChars * TRUNCATION_HEAD_SHARE);
   const tail = maxChars - head;
-  return `${text.slice(0, head)}\n…[truncated ${text.length - maxChars} chars]…\n${text.slice(-tail)}`;
+  const marker = `\n…[truncated ${text.length - maxChars} chars]…`;
+  if (tail <= 0) return `${text.slice(0, head)}${marker}`;
+  return `${text.slice(0, head)}${marker}\n${text.slice(-tail)}`;
 }
 
 const COLLAPSED_TOOL_PATTERN = /^TOOL (\S+)/;

package/settings-menu.ts

@@ -0,0 +1,438 @@
+/**
+ * Row model and pure edit logic behind `/auto-permissions`.
+ *
+ * Everything that decides *what* a row shows or what an edit means lives here,
+ * free of pi's runtime, so it is testable without a TUI. index.ts owns only the
+ * wiring: read config, render a SettingsList, persist through config-writer.
+ */
+import { homedir } from "node:os";
+import {
+  type Component,
+  getKeybindings,
+  Input,
+  type SelectItem,
+  SelectList,
+  type SelectListTheme,
+  type SettingItem,
+  type SettingsListTheme,
+  truncateToWidth,
+} from "@earendil-works/pi-tui";
+import {
+  DEFAULT_REVIEWER_REASONING_EFFORT,
+  DEFAULT_REVIEWER_TIMEOUT_MS,
+  MAX_REVIEWER_TIMEOUT_MS,
+  MIN_REVIEWER_TIMEOUT_MS,
+  REASONING_EFFORTS,
+  type ReasoningEffort,
+  type SystemPromptSource,
+} from "./config.js";
+import type { ReviewerBlock } from "./config-writer.js";
+
+export const ENABLED_ID = "enabled";
+export const REVIEWER_MODEL_ID = "reviewerModel";
+export const THINKING_LEVEL_ID = "reasoningEffort";
+export const TIMEOUT_ID = "timeoutMs";
+export const SYSTEM_PROMPT_ID = "systemPrompt";
+
+export const ON = "on";
+export const OFF = "off";
+const TOGGLE_VALUES = [ON, OFF];
+
+export const UNSET_MODEL = "(unset)";
+const UNAVAILABLE_SUFFIX = "(configured, unavailable)";
+const NO_REVIEWER_MESSAGE = "Select a reviewer model first";
+
+/** The slice of the config the menu edits, plus the read-only prompt source. */
+export interface ReviewerSettings {
+  enabled: boolean;
+  reviewer?: ReviewerBlock;
+  systemPromptSource: SystemPromptSource;
+}
+
+/** The subset of a pi model the menu needs; keeps tests free of pi-ai types. */
+export interface MenuModel {
+  provider: string;
+  id: string;
+  name?: string;
+  contextWindow?: number;
+  thinkingLevelMap?: Partial<Record<ReasoningEffort, string | null>>;
+}
+
+export function modelKey(model: { provider: string; id: string }): string {
+  return `${model.provider}/${model.id}`;
+}
+
+/** Inverse of {@link modelKey}; the provider itself never contains a slash. */
+export function parseModelKey(value: string): { provider: string; model: string } | undefined {
+  const slash = value.indexOf("/");
+  if (slash <= 0 || slash === value.length - 1) return undefined;
+  return { provider: value.slice(0, slash), model: value.slice(slash + 1) };
+}
+
+export function reviewerValue(settings: ReviewerSettings): string {
+  return settings.reviewer ? modelKey({ provider: settings.reviewer.provider, id: settings.reviewer.model }) : UNSET_MODEL;
+}
+
+export function toggleValue(enabled: boolean): string {
+  return enabled ? ON : OFF;
+}
+
+export function thinkingValue(settings: ReviewerSettings): ReasoningEffort {
+  return settings.reviewer?.reasoningEffort ?? DEFAULT_REVIEWER_REASONING_EFFORT;
+}
+
+export function timeoutValue(settings: ReviewerSettings): number {
+  return settings.reviewer?.timeoutMs ?? DEFAULT_REVIEWER_TIMEOUT_MS;
+}
+
+/** `~`-collapse a path so a long prompt path still fits the value column. */
+export function collapseHome(path: string, home: string = homedir()): string {
+  const base = home || homedir();
+  if (!base) return path;
+  if (path === base) return "~";
+  return path.startsWith(`${base}/`) ? `~/${path.slice(base.length + 1)}` : path;
+}
+
+/** Value column for the read-only system-prompt row. */
+export function systemPromptValue(source: SystemPromptSource, home: string = homedir()): string {
+  if (source.kind === "file") return collapseHome(source.path, home);
+  return source.kind === "inline" ? "(inline in config)" : "(built-in default)";
+}
+
+function systemPromptDescription(source: SystemPromptSource): string {
+  if (source.kind === "file") return "Active reviewer system prompt, from systemPromptFile. Edit the file to change it.";
+  if (source.kind === "inline") return "Active reviewer system prompt, from the systemPrompt key in config.json.";
+  return "No systemPrompt or systemPromptFile is set, so the packaged reviewer prompt is used.";
+}
+
+/** Human-readable timeout: seconds, or `m s` past a minute. */
+export function formatTimeout(timeoutMs: number): string {
+  const seconds = timeoutMs / 1000;
+  if (seconds < 60) return `${Number(seconds.toFixed(1))}s`;
+  const minutes = Math.floor(seconds / 60);
+  const rest = Number((seconds - minutes * 60).toFixed(1));
+  return rest === 0 ? `${minutes}m` : `${minutes}m ${rest}s`;
+}
+
+export type TimeoutParse = { timeoutMs: number } | { error: string };
+
+/**
+ * Parse a timeout the user typed. A bare number means seconds, because that is
+ * what the row displays; `ms` is available when an exact millisecond value
+ * matters. The accepted window mirrors the loader's validation exactly.
+ */
+export function parseTimeoutInput(input: string): TimeoutParse {
+  const match = /^([0-9]+(?:\.[0-9]+)?)\s*(ms|s)?$/i.exec(input.trim());
+  if (!match) return { error: "Enter a timeout like 30s or 45000ms" };
+  const amount = Number(match[1]);
+  if (!Number.isFinite(amount)) return { error: "Enter a timeout like 30s or 45000ms" };
+  const timeoutMs = match[2]?.toLowerCase() === "ms" ? amount : amount * 1000;
+  if (!Number.isInteger(timeoutMs)) return { error: "Review timeout must be a whole number of milliseconds" };
+  if (timeoutMs < MIN_REVIEWER_TIMEOUT_MS || timeoutMs > MAX_REVIEWER_TIMEOUT_MS) {
+    return { error: "Review timeout must be between 1s and 300s" };
+  }
+  return { timeoutMs };
+}
+
+export interface SettingSubmenus {
+  reviewerModel?: SettingItem["submenu"];
+  timeout?: SettingItem["submenu"];
+}
+
+/** Build the `/auto-permissions` rows for a settings snapshot. */
+export function buildSettingItems(
+  settings: ReviewerSettings,
+  submenus: SettingSubmenus = {},
+  home: string = homedir(),
+): SettingItem[] {
+  return [
+    {
+      id: ENABLED_ID,
+      label: "Enabled",
+      description: "Review guarded commands. Off lets every command run without guardian review.",
+      currentValue: toggleValue(settings.enabled),
+      values: TOGGLE_VALUES,
+    },
+    {
+      id: REVIEWER_MODEL_ID,
+      label: "Reviewer model",
+      description: "Model the guardian reviews guarded commands with.",
+      currentValue: reviewerValue(settings),
+      ...(submenus.reviewerModel ? { submenu: submenus.reviewerModel } : {}),
+    },
+    {
+      id: THINKING_LEVEL_ID,
+      label: "Thinking level",
+      description: "Reasoning effort requested from the reviewer model.",
+      currentValue: thinkingValue(settings),
+      values: [...REASONING_EFFORTS],
+    },
+    {
+      id: TIMEOUT_ID,
+      label: "Review timeout",
+      description: "How long one review may take before the command is denied.",
+      currentValue: formatTimeout(timeoutValue(settings)),
+      ...(submenus.timeout ? { submenu: submenus.timeout } : {}),
+    },
+    {
+      id: SYSTEM_PROMPT_ID,
+      label: "System prompt",
+      description: systemPromptDescription(settings.systemPromptSource),
+      currentValue: systemPromptValue(settings.systemPromptSource, home),
+    },
+  ];
+}
+
+export type SettingChange =
+  | { kind: "settings"; settings: ReviewerSettings }
+  /** Saved, but the value is worth flagging (e.g. an unsupported thinking level). */
+  | { kind: "warn"; settings: ReviewerSettings; message: string }
+  | { kind: "error"; message: string }
+  | { kind: "ignored" };
+
+/**
+ * Map one row's new display value onto the settings snapshot.
+ *
+ * `model` is the currently configured reviewer model, when the registry knows
+ * it; it is only consulted to warn about unsupported thinking levels.
+ */
+export function applySettingChange(
+  settings: ReviewerSettings,
+  id: string,
+  value: string,
+  model?: MenuModel,
+): SettingChange {
+  if (id === ENABLED_ID) {
+    if (value !== ON && value !== OFF) return { kind: "error", message: `Unknown value for ${id}: ${value}` };
+    const enabled = value === ON;
+    if (enabled === settings.enabled) return { kind: "ignored" };
+    return { kind: "settings", settings: { ...settings, enabled } };
+  }
+
+  if (id === THINKING_LEVEL_ID) {
+    if (!REASONING_EFFORTS.includes(value as ReasoningEffort)) {
+      return { kind: "error", message: `Unknown thinking level: ${value}` };
+    }
+    const reasoningEffort = value as ReasoningEffort;
+    // A reviewer block without provider and model is rejected by the loader, so
+    // there is nothing valid to write until a model is chosen.
+    if (!settings.reviewer) return { kind: "error", message: NO_REVIEWER_MESSAGE };
+    if (settings.reviewer.reasoningEffort === reasoningEffort) return { kind: "ignored" };
+    const next = { ...settings, reviewer: { ...settings.reviewer, reasoningEffort } };
+    if (model?.thinkingLevelMap && model.thinkingLevelMap[reasoningEffort] === null) {
+      return {
+        kind: "warn",
+        settings: next,
+        message: `${modelKey(model)} does not support thinking level "${reasoningEffort}"`,
+      };
+    }
+    return { kind: "settings", settings: next };
+  }
+
+  // The model and timeout submenus commit their own edit and hand back display
+  // text, so there is nothing left to map here.
+  return { kind: "ignored" };
+}
+
+/** Adopt a picked model, creating the reviewer block when there was none. */
+export function applyModelSelection(settings: ReviewerSettings, value: string): SettingChange {
+  const parsed = parseModelKey(value);
+  if (!parsed) return { kind: "error", message: `Unknown model: ${value}` };
+  if (settings.reviewer?.provider === parsed.provider && settings.reviewer.model === parsed.model) {
+    return { kind: "ignored" };
+  }
+  return {
+    kind: "settings",
+    settings: {
+      ...settings,
+      reviewer: {
+        provider: parsed.provider,
+        model: parsed.model,
+        reasoningEffort: settings.reviewer?.reasoningEffort ?? DEFAULT_REVIEWER_REASONING_EFFORT,
+        timeoutMs: settings.reviewer?.timeoutMs ?? DEFAULT_REVIEWER_TIMEOUT_MS,
+      },
+    },
+  };
+}
+
+export function applyTimeoutInput(settings: ReviewerSettings, input: string): SettingChange {
+  if (!settings.reviewer) return { kind: "error", message: NO_REVIEWER_MESSAGE };
+  const parsed = parseTimeoutInput(input);
+  if ("error" in parsed) return { kind: "error", message: parsed.error };
+  if (parsed.timeoutMs === settings.reviewer.timeoutMs) return { kind: "ignored" };
+  return { kind: "settings", settings: { ...settings, reviewer: { ...settings.reviewer, timeoutMs: parsed.timeoutMs } } };
+}
+
+function modelItem(model: MenuModel, unavailable = false): SelectItem {
+  const key = modelKey(model);
+  const details = [model.name, model.contextWindow ? `${Math.round(model.contextWindow / 1000)}k ctx` : undefined]
+    .filter((part): part is string => Boolean(part))
+    .join(" · ");
+  return {
+    value: key,
+    label: unavailable ? `${key}  ${UNAVAILABLE_SUFFIX}` : key,
+    description: unavailable ? `${details ? `${details} · ` : ""}provider not signed in or not registered` : details,
+  };
+}
+
+/**
+ * Available models, provider then id, with a configured-but-unavailable
+ * reviewer pinned first so opening the menu can never silently drop it.
+ */
+export function buildModelItems(available: readonly MenuModel[], settings: ReviewerSettings): SelectItem[] {
+  const sorted = [...available].sort((a, b) => a.provider.localeCompare(b.provider) || a.id.localeCompare(b.id));
+  const items = sorted.map((model) => modelItem(model));
+  const reviewer = settings.reviewer;
+  if (reviewer && !sorted.some((model) => model.provider === reviewer.provider && model.id === reviewer.model)) {
+    items.unshift(modelItem({ provider: reviewer.provider, id: reviewer.model }, true));
+  }
+  return items;
+}
+
+/**
+ * Substring filter over the picker rows.
+ *
+ * `SelectList.setFilter` is a prefix match on `value` alone, which for
+ * `provider/model-id` rows means typing "gpt" matches nothing. Filtering here
+ * instead keeps "gpt", "luna" and "codex" all useful.
+ */
+export function filterModelItems(items: readonly SelectItem[], query: string): SelectItem[] {
+  const needle = query.trim().toLowerCase();
+  if (!needle) return [...items];
+  return items.filter((item) => `${item.label} ${item.description ?? ""}`.toLowerCase().includes(needle));
+}
+
+export interface SubmenuHost {
+  /** Read the live settings; the menu edits a single shared snapshot. */
+  getSettings(): ReviewerSettings;
+  /** Commit an edit: validates, persists, and repaints. */
+  commit(change: SettingChange): void;
+  availableModels(): MenuModel[];
+  requestRender(): void;
+  settingsTheme: SettingsListTheme;
+  selectTheme: SelectListTheme;
+  home?: string;
+}
+
+/** Single-line text prompt, mirroring the one behind `/statusline`'s path rows. */
+export class PromptComponent implements Component {
+  private readonly input = new Input();
+
+  constructor(
+    private readonly title: string,
+    initialValue: string,
+    private readonly hint: (text: string) => string,
+    onSubmit: (value: string) => void,
+    onCancel: () => void,
+  ) {
+    this.input.setValue(initialValue);
+    this.input.focused = true;
+    this.input.onSubmit = onSubmit;
+    this.input.onEscape = onCancel;
+  }
+
+  invalidate(): void {
+    this.input.invalidate();
+  }
+
+  render(width: number): string[] {
+    return [
+      truncateToWidth(this.hint(`  ${this.title}`), width),
+      "",
+      ...this.input.render(width),
+      "",
+      truncateToWidth(this.hint("  Enter to save · Esc to cancel"), width),
+    ];
+  }
+
+  handleInput(data: string): void {
+    this.input.handleInput(data);
+  }
+}
+
+const LIST_KEYS = ["tui.select.up", "tui.select.down", "tui.select.confirm", "tui.select.cancel"] as const;
+
+/** Searchable reviewer-model picker. */
+class ModelSubmenu implements Component {
+  private readonly items: SelectItem[];
+  private list: SelectList;
+  private readonly search = new Input();
+  private query = "";
+
+  constructor(
+    private readonly host: SubmenuHost,
+    private readonly done: (value?: string) => void,
+  ) {
+    const settings = host.getSettings();
+    this.items = buildModelItems(host.availableModels(), settings);
+    this.list = this.buildList(this.items, this.items.findIndex((item) => item.value === reviewerValue(settings)));
+    this.search.focused = true;
+  }
+
+  private buildList(items: SelectItem[], selectedIndex: number): SelectList {
+    const list = new SelectList(items, 10, this.host.selectTheme);
+    if (selectedIndex > 0) list.setSelectedIndex(selectedIndex);
+    list.onCancel = () => this.done(undefined);
+    list.onSelect = (item) => {
+      const change = applyModelSelection(this.host.getSettings(), item.value);
+      this.host.commit(change);
+      this.done(change.kind === "error" ? undefined : item.value);
+    };
+    return list;
+  }
+
+  invalidate(): void {
+    this.search.invalidate();
+    this.list.invalidate();
+  }
+
+  render(width: number): string[] {
+    return [
+      truncateToWidth(this.host.settingsTheme.hint("  Reviewer model"), width),
+      "",
+      ...this.search.render(width),
+      "",
+      ...this.list.render(width),
+      "",
+      truncateToWidth(this.host.settingsTheme.hint("  Type to filter · Enter to select · Esc to go back"), width),
+    ];
+  }
+
+  handleInput(data: string): void {
+    const kb = getKeybindings();
+    // Navigation, Enter and Esc belong to the list; everything else is filter text.
+    if (LIST_KEYS.some((key) => kb.matches(data, key))) {
+      this.list.handleInput(data);
+      return;
+    }
+    this.search.handleInput(data);
+    const query = this.search.getValue();
+    if (query === this.query) return;
+    this.query = query;
+    this.list = this.buildList(filterModelItems(this.items, query), 0);
+    this.host.requestRender();
+  }
+}
+
+export function createModelSubmenu(host: SubmenuHost): NonNullable<SettingItem["submenu"]> {
+  return (_currentValue, done) => new ModelSubmenu(host, done);
+}
+
+export function createTimeoutSubmenu(host: SubmenuHost): NonNullable<SettingItem["submenu"]> {
+  return (currentValue, done) =>
+    new PromptComponent(
+      "Review timeout (e.g. 30s or 45000ms)",
+      currentValue,
+      host.settingsTheme.hint,
+      (value) => {
+        const change = applyTimeoutInput(host.getSettings(), value);
+        host.commit(change);
+        if (change.kind === "error") {
+          done(undefined);
+          return;
+        }
+        done(formatTimeout(timeoutValue(host.getSettings())));
+      },
+      () => done(undefined),
+    );
+}