@hank-warren/pi-auto-permissions 0.16.2 → 0.17.0

package/index.ts

@@ -1,13 +1,6 @@
-import { detectLoopContext } from "./loop-context.js";
 import { createReviewQueue } from "./review-queue.js";
-import {
-  LoopReviseBudget,
-  loopBlockReason,
-  type LoopReviseCharge,
-} from "./loop-revise-budget.js";
 import * as PiCodingAgent from "@earendil-works/pi-coding-agent";
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
-import { Type } from "typebox";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { loadAutoPermissionsConfig, type AutoPermissionsConfig } from "./config.js";
@@ -22,11 +15,10 @@ import {
   classifyPromptChoice,
   expectedDecisionForChoice,
   permissionPromptOptions,
-  shouldOfferStandingApproval,
   type PromptEvaluationUserChoice,
 } from "./evaluation-log.js";
 import type { Gate } from "./gates.js";
-import { classifyCommand, untrustedMatches } from "./classify.js";
+import { classifyCommand } from "./classify.js";
 import type { ReviewEvidenceRecord } from "./review.js";
 import { promptSelect, setHerdrBlocked } from "./prompt-select.js";
 import { createReviewDisplay } from "./review-display.js";
@@ -75,14 +67,15 @@ function loadTrustedGroups(cwd: string): Set<string> {
 }
 
 function denyReason(gate: Gate): string {
-  return `Blocked by policy: ${gate.label}\n\n${gate.message ?? "This operation is denied by rule."}\n\nThis is a deny rule: it cannot be overridden with request_override, trusted groups, or user approval. Choose a different approach.`;
+  return `Blocked by policy: ${gate.label}\n\n${gate.message ?? "This operation is denied by rule."}\n\nThis is a deny rule: it cannot be overridden by trusted groups or user approval. Choose a different approach.`;
+}
+
+function reviewCancelledResult(): BlockResult {
+  return { block: true, reason: "Auto Permissions review cancelled" };
 }
 
-function conventionReason(gate: Gate, command: string): string {
-  let reason = `Convention violation: ${gate.label}\n\n${gate.message ?? "Use the configured project tooling."}`;
-  const suggestion = gate.suggest?.(command);
-  if (suggestion && suggestion !== command) reason += `\n\nSuggested command:\n  ${suggestion}`;
-  return `${reason}\n\nIf this is a legitimate edge case, explain why and call \`request_override\` with the exact command.`;
+function withLifecycle(signal: AbortSignal | undefined, lifecycle: AbortSignal): AbortSignal {
+  return signal ? AbortSignal.any([signal, lifecycle]) : lifecycle;
 }
 
 export default function autoPermissionsExtension(pi: ExtensionAPI) {
@@ -90,21 +83,12 @@ export default function autoPermissionsExtension(pi: ExtensionAPI) {
   let trustedGroups = new Set<string>();
   let lastConfigError: string | undefined;
   let lastEvaluationLogError: string | undefined;
-  let sessionActive = true;
-  /**
-   * Revision rounds spent per guardian concern while a loop is active.
-   *
-   * Session-scoped and held here rather than in the review closure, so a
-   * context compaction (which rewrites the conversation, not this process)
-   * cannot reset it. Restored from the session branch at session_start so a
-   * resume cannot reset it either.
-   */
-  const loopReviseBudget = new LoopReviseBudget();
-  /** The loop these counts belong to, so a new loop starts with a clean budget. */
-  let loopReviseBudgetLoopId: string | undefined;
   const guardianReviewQueue = createReviewQueue();
-  const display = createReviewDisplay(pi, { isSessionActive: () => sessionActive });
-  const reviewer = createGuardianReviewer({ isSessionActive: () => sessionActive, overrides });
+  // The session is active exactly while the reviewer lifecycle is unaborted:
+  // session_shutdown aborts it, session_start synchronously aborts and replaces
+  // it, and nothing else touches it.
+  const reviewer = createGuardianReviewer({ overrides });
+  const display = createReviewDisplay({ isSessionActive: () => !reviewer.lifecycleSignal.aborted });
 
   /**
    * Record a non-approved outcome: a `pi.events` emit (the PermissionDenied
@@ -182,13 +166,8 @@ export default function autoPermissionsExtension(pi: ExtensionAPI) {
    * if that package is installed. Say so once per session instead of letting the
    * first guarded command fail with a bare "review model not found".
    */
-  function warnAboutMissingReviewerProvider(ctx: ExtensionContext): void {
-    let provider: string | undefined;
-    try {
-      provider = currentConfig(ctx).reviewer?.provider;
-    } catch {
-      return; // The config error was already reported by currentConfig().
-    }
+  function warnAboutMissingReviewerProvider(ctx: ExtensionContext, config: AutoPermissionsConfig): void {
+    const provider = config.reviewer?.provider;
     if (!provider || ctx.modelRegistry.getProvider(provider)) return;
 
     const message =
@@ -199,7 +178,15 @@ export default function autoPermissionsExtension(pi: ExtensionAPI) {
   }
 
   function reviewCancelled(signal: AbortSignal | undefined): boolean {
-    return !sessionActive || signal?.aborted === true;
+    return signal?.aborted === true;
+  }
+
+  function cancelledAfterAwait(scope: ReviewScope, lifecycleSignal: AbortSignal): BlockResult | undefined {
+    if (reviewer.isStale(lifecycleSignal)) return reviewCancelledResult();
+    if (!reviewCancelled(scope.ctx.signal)) return undefined;
+    reviewer.discardLineage();
+    display.clear(scope);
+    return reviewCancelledResult();
   }
 
   function logPromptEvaluation(
@@ -243,33 +230,6 @@ export default function autoPermissionsExtension(pi: ExtensionAPI) {
     }
   }
 
-  /**
-   * Charge one revision round against a guardian concern and persist the
-   * budget. A loop id different from the one the counts belong to means a new
-   * loop: it inherits nothing from the last one's arguments with the guardian.
-   */
-  function chargeLoopRevision(
-    loopId: string | undefined,
-    gateLabel: string,
-    reason: string,
-  ): LoopReviseCharge {
-    if (loopReviseBudgetLoopId !== loopId) {
-      loopReviseBudget.clear();
-      loopReviseBudgetLoopId = loopId;
-    }
-    const charge = loopReviseBudget.charge(gateLabel, reason);
-    try {
-      pi.appendEntry(LoopReviseBudget.entryType, {
-        ...loopReviseBudget.snapshot(),
-        ...(loopId ? { loopId } : {}),
-      });
-    } catch {
-      // Persistence is what survives a restore; the in-memory count is what
-      // survives a compaction. Losing the former never widens the bound now.
-    }
-    return charge;
-  }
-
   async function askUser(
     scope: ReviewScope,
     detail: string,
@@ -279,8 +239,8 @@ export default function autoPermissionsExtension(pi: ExtensionAPI) {
     const { ctx, config, gate, command } = scope;
     const signal = ctx.signal;
     const lifecycleStale = () => reviewer.isStale(lifecycleSignal);
-    const promptSignal = signal ? AbortSignal.any([signal, lifecycleSignal]) : lifecycleSignal;
-    const cancelled = (): BlockResult => ({ block: true, reason: "Auto Permissions review cancelled" });
+    const promptSignal = withLifecycle(signal, lifecycleSignal);
+    const cancelled = reviewCancelledResult;
     if (lifecycleStale() || reviewCancelled(signal)) {
       if (!lifecycleStale()) reviewer.discardLineage();
       return cancelled();
@@ -290,7 +250,7 @@ export default function autoPermissionsExtension(pi: ExtensionAPI) {
       return settle(scope, {
         display: "blocked",
         verdict: "block",
-        source: decisionSource === "guardian" ? "guardian" : "review_failure",
+        source: decisionSource,
         reason: detail,
         block: `${gate.label} requires user approval: ${detail}\nThis session has no interactive user to ask. Prefer an approach that avoids the gated operation, or report this blocker in your final output instead of retrying the same command.`,
       });
@@ -305,32 +265,24 @@ export default function autoPermissionsExtension(pi: ExtensionAPI) {
           pi,
           ctx,
           `${gate.label} — Auto Permissions needs approval\n\n${detail}\n\n${command}`,
-          permissionPromptOptions(
-            config.evaluationLog.enabled,
-            shouldOfferStandingApproval(decisionSource, config.standingApprovals.enabled),
-          ),
+          permissionPromptOptions(config.evaluationLog.enabled),
           promptSignal,
-          { allowComment: true },
         );
       } catch (error) {
         if (!lifecycleStale() && !reviewCancelled(signal)) throw error;
         if (!lifecycleStale()) reviewer.discardLineage();
         return cancelled();
       }
-      if (lifecycleStale()) return cancelled();
-      if (reviewCancelled(signal)) {
-        reviewer.discardLineage();
-        if (sessionActive) display.clear(scope);
-        return cancelled();
-      }
+      const cancelledResult = cancelledAfterAwait(scope, lifecycleSignal);
+      if (cancelledResult) return cancelledResult;
       const classification = classifyPromptChoice(choice);
       // Feed the user's decision back to the guardian as session-scoped
       // user-source evidence. review_failure prompts are excluded: their
       // "concern" is an infrastructure error, not a guardian judgment.
       if (decisionSource === "guardian" && classification) {
-        overrides.recordPromptDecision(scope, classification, detail, reviewer.lastEvidenceKey);
+        overrides.recordPromptDecision(gate, command, classification, detail, reviewer.lastEvidenceKey);
       }
-      if (config.evaluationLog.enabled && classification?.userChoice) {
+      if (classification?.userChoice) {
         logPromptEvaluation(scope, detail, evaluationContext, decisionSource, classification.userChoice);
       }
       if (classification?.allowsExecution) {
@@ -364,7 +316,7 @@ export default function autoPermissionsExtension(pi: ExtensionAPI) {
     }
     if (!config.enabled) return;
     const target: ReviewTarget = { toolName: event.toolName, toolCallId: event.toolCallId };
-    const classified = classifyCommand(command, config, trustedGroups, overrides.allowedConventionCommands);
+    const classified = classifyCommand(command, config, trustedGroups);
     if (classified.kind === "pass") return;
     const gate = classified.gate;
     const scope: ReviewScope = { ctx, config, gate, command, target };
@@ -376,15 +328,6 @@ export default function autoPermissionsExtension(pi: ExtensionAPI) {
         block: denyReason(gate),
       });
     }
-    if (classified.kind === "convention") {
-      if (ctx.hasUI) overrides.activateOverrideTool();
-      return settle(scope, {
-        verdict: "block",
-        source: "convention",
-        reason: gate.message ?? gate.label,
-        block: conventionReason(gate, command),
-      });
-    }
 
     // Show the queued row *before* waiting, and only when there is actually
     // something to wait for: the critical section spans the human prompt, so a
@@ -397,55 +340,25 @@ export default function autoPermissionsExtension(pi: ExtensionAPI) {
     // Same composite the ask path builds, so Esc and a reviewer-lifecycle reset
     // both release a queued command instead of stranding it behind a review it
     // is no longer waiting for.
-    const queueSignal = ctx.signal ? AbortSignal.any([ctx.signal, lifecycleSignal]) : lifecycleSignal;
+    const queueSignal = withLifecycle(ctx.signal, lifecycleSignal);
     let releaseReviewSlot: () => void;
     try {
       releaseReviewSlot = await guardianReviewQueue.acquire(queueSignal);
     } catch {
-      return { block: true, reason: "Auto Permissions review cancelled" };
+      return reviewCancelledResult();
     }
     try {
       if (lifecycleStale() || reviewCancelled(ctx.signal)) {
-        return { block: true, reason: "Auto Permissions review cancelled" };
+        return reviewCancelledResult();
       }
       const signal = ctx.signal;
       display.show(scope, "waiting");
       try {
         const verdict = await reviewer.review(scope, event.input as Record<string, unknown>);
-        if (lifecycleStale()) {
-          return { block: true, reason: "Auto Permissions review cancelled" };
-        }
-        if (reviewCancelled(signal)) {
-          reviewer.discardLineage();
-          if (sessionActive) display.clear(scope);
-          return { block: true, reason: "Auto Permissions review cancelled" };
-        }
+        const cancelledResult = cancelledAfterAwait(scope, lifecycleSignal);
+        if (cancelledResult) return cancelledResult;
         if (verdict.decision === "approve") {
-          const approved = settle(scope, { display: "approved", reason: verdict.reason });
-          // An approval ends the argument at this gate: the per-gate bound exists
-          // to stop an agent grinding, not to ration a long loop's whole session.
-          loopReviseBudget.settle(gate.label);
-          return approved;
-        }
-        // An unattended loop cannot answer a modal and must not be handed an
-        // unbounded retry loop either, so both non-approving verdicts come back
-        // as one bounded block. The verdict itself is unchanged: nothing is
-        // approved here that would not have been approved with a user present.
-        const loopContext = detectLoopContext();
-        if (loopContext) {
-          const charge = chargeLoopRevision(loopContext.loopId, gate.label, verdict.reason);
-          return settle(scope, {
-            display: verdict.decision === "revise" ? "revise" : "blocked",
-            verdict: verdict.decision === "revise" ? "revise" : "block",
-            source: "loop",
-            reason: verdict.reason,
-            block: loopBlockReason({
-              gateLabel: gate.label,
-              reason: verdict.reason,
-              decision: verdict.decision,
-              ...charge,
-            }),
-          });
+          return settle(scope, { display: "approved", reason: verdict.reason });
         }
         if (verdict.decision === "revise") {
           return settle(scope, {
@@ -459,22 +372,10 @@ export default function autoPermissionsExtension(pi: ExtensionAPI) {
         return askUser(scope, verdict.reason, lifecycleSignal, "guardian");
       } catch (error) {
         if (lifecycleStale() || reviewCancelled(signal)) {
-          if (!lifecycleStale() && sessionActive) display.clear(scope);
-          return { block: true, reason: "Auto Permissions review cancelled" };
+          if (!lifecycleStale()) display.clear(scope);
+          return reviewCancelledResult();
         }
         const reason = error instanceof Error ? error.message : String(error);
-        // A review that failed is an infrastructure fault, not a guardian
-        // judgment, so it charges no revision round — but it still must not open
-        // a modal in a session with nobody to answer it.
-        if (detectLoopContext()) {
-          return settle(scope, {
-            display: "blocked",
-            verdict: "block",
-            source: "review_failure",
-            reason,
-            block: `${gate.label} could not be reviewed (${reason}), and this session is running an unattended /loop, so there is no one to ask. Do not retry the same command hoping the reviewer recovers: call loop_wait naming the reviewer failure, or advance the objective another way.`,
-          });
-        }
         return askUser(scope, `Automatic review failed: ${reason}`, lifecycleSignal, "review_failure");
       }
     } finally {
@@ -482,130 +383,25 @@ export default function autoPermissionsExtension(pi: ExtensionAPI) {
     }
   });
 
-  pi.registerTool({
-    name: "request_override",
-    executionMode: "sequential",
-    label: "Request Override",
-    description: "Request a one-session exception for a command that violates a tooling convention. This cannot bypass guarded commands or deny rules.",
-    parameters: Type.Object({
-      command: Type.String({ description: "Exact command to allow" }),
-      reason: Type.String({ description: "Why the convention does not apply" }),
-    }),
-    async execute(_toolCallId, params, signal, _onUpdate, ctx) {
-      let config: AutoPermissionsConfig;
-      try {
-        config = currentConfig(ctx);
-      } catch (error) {
-        return {
-          content: [{ type: "text", text: error instanceof Error ? error.message : String(error) }],
-          details: { success: false },
-        };
-      }
-      const matches = untrustedMatches(params.command, config, trustedGroups);
-      if (matches.some((gate) => gate.level === "deny")) {
-        return {
-          content: [{ type: "text", text: "The command matches a deny rule, which is a hard policy boundary. Deny rules cannot be bypassed with request_override; choose a different approach." }],
-          details: { success: false },
-        };
-      }
-      if (!matches.length || matches.some((gate) => gate.level === "guarded")) {
-        return {
-          content: [{ type: "text", text: "The command is not a convention violation. Guarded commands cannot be bypassed with request_override." }],
-          details: { success: false },
-        };
-      }
-      const gate = matches[0];
-      const lifecycleSignal = reviewer.lifecycleSignal;
-      const lifecycleStale = () => reviewer.isStale(lifecycleSignal);
-      const promptSignal = signal ? AbortSignal.any([signal, lifecycleSignal]) : lifecycleSignal;
-      const cancelled = () => ({
-        content: [{ type: "text" as const, text: "Override cancelled." }],
-        details: { success: false },
-      });
-      if (lifecycleStale() || reviewCancelled(signal)) return cancelled();
-      if (!ctx.hasUI) {
-        return {
-          content: [{ type: "text", text: "Cannot request an override without an interactive UI." }],
-          details: { success: false },
-        };
-      }
-
-      setHerdrBlocked(pi, true, gate.label);
-      try {
-        let choice: string | undefined;
-        try {
-          // The override prompt never had Tab-to-comment (the monkey patch only
-          // enabled it on titles matching /needs approval/i), so keep parity.
-          choice = await promptSelect(
-            pi,
-            ctx,
-            `Convention override: ${gate.label}\n\n${params.reason}\n\n${params.command}`,
-            ["Allow for this session", "Keep blocked"],
-            promptSignal,
-            { allowComment: false },
-          );
-        } catch (error) {
-          if (!lifecycleStale() && !reviewCancelled(signal)) throw error;
-          return cancelled();
-        }
-        if (lifecycleStale() || reviewCancelled(signal)) return cancelled();
-        if (choice === "Allow for this session") {
-          overrides.allowConvention(params.command);
-          return {
-            content: [{ type: "text", text: `Override granted for this session:\n  ${params.command}` }],
-            details: { success: true, command: params.command },
-          };
-        }
-        return {
-          content: [{ type: "text", text: gate.message ?? "Use the configured project tooling." }],
-          details: { success: false },
-        };
-      } finally {
-        if (!lifecycleStale()) setHerdrBlocked(pi, false);
-      }
-    },
-  });
-
-  // The override schema is useful only after a convention denial has named an
-  // exact command. It is kept registered for replay and narrowed out of the
-  // active set at session_start — never here, because Pi refuses action methods
-  // during extension loading.
-
   registerSettingsCommand(pi, { overrides, reviewer });
 
   pi.on("session_shutdown", async (_event, ctx) => {
-    sessionActive = false;
-    reviewer.abortLifecycle();
-    reviewer.discardLineage();
+    reviewer.endSession();
     display.shutdown(ctx);
     setHerdrBlocked(pi, false);
   });
 
   pi.on("session_start", async (_event, ctx) => {
-    overrides.resetForSession();
-    warnAboutMissingReviewerProvider(ctx);
-
-    reviewer.abortLifecycle();
-    reviewer.discardLineage();
-    reviewer.resetLifecycle();
-    sessionActive = true;
-    overrides.restore(ctx.sessionManager.getBranch());
-    // Rebuild the revise budget before the first tool call: a resumed session
-    // that forgot its spent rounds would hand the agent a fresh set of them.
-    loopReviseBudget.restore(ctx.sessionManager.getBranch());
-    loopReviseBudgetLoopId = detectLoopContext()?.loopId;
-    trustedGroups = ctx.isProjectTrusted() ? loadTrustedGroups(ctx.cwd) : new Set();
-    // Snapshot the trust baseline at session start: remotes configured now are
-    // inside the boundary, anything added or repointed later is not. Re-capture
-    // on every session_start (resume, branch switch) so the baseline follows
-    // the session the reviews belong to; the fingerprint covers the change.
-    reviewer.captureEnvironment(ctx.cwd);
+    let config: AutoPermissionsConfig | undefined;
     try {
-      const config = currentConfig(ctx);
-      overrides.loadStanding(config, ctx);
-      if (config.ui.placement === "toolRow") display.registerGuardedBash(ctx);
+      config = currentConfig(ctx);
     } catch {
-      // The first bash call will fail closed with the configuration error.
+      // Reported by currentConfig; the first bash call fails closed.
     }
+    if (config) warnAboutMissingReviewerProvider(ctx, config);
+
+    reviewer.startSession(ctx.cwd);
+    overrides.restore(ctx.sessionManager.getBranch());
+    trustedGroups = ctx.isProjectTrusted() ? loadTrustedGroups(ctx.cwd) : new Set();
   });
 }

package/jsonl-sidecar.ts

@@ -0,0 +1,22 @@
+import { appendFileSync, chmodSync, mkdirSync, renameSync, statSync } from "node:fs";
+import { dirname } from "node:path";
+
+/** Rotate once a sidecar grows past this size; one previous generation is kept. */
+export const SIDECAR_ROTATE_BYTES = 16 * 1024 * 1024;
+
+function rotateIfLarge(path: string, rotateBytes: number): void {
+  try {
+    if (statSync(path).size < rotateBytes) return;
+    renameSync(path, `${path}.1`);
+  } catch {
+    // A missing or unrotatable sidecar simply keeps appending.
+  }
+}
+
+/** Append one JSON line to an owner-only sidecar, rotating first when `rotateBytes` is set. */
+export function appendJsonlRecord(path: string, record: unknown, rotateBytes?: number): void {
+  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+  if (rotateBytes !== undefined) rotateIfLarge(path, rotateBytes);
+  appendFileSync(path, `${JSON.stringify(record)}\n`, { encoding: "utf8", mode: 0o600 });
+  chmodSync(path, 0o600);
+}

package/override-evidence.ts

@@ -6,6 +6,8 @@ import type { ReviewEvidenceRecord } from "./review.js";
  * evidence stream as user-source records so the guardian can treat them as
  * authorization (allows) or standing constraints (blocks).
  */
+export const PERMISSION_OVERRIDE_CHOICES = ["allow", "allow_unnecessary", "allow_appropriate", "block"] as const;
+
 export interface PermissionOverride {
   seq: number;
   /**
@@ -18,13 +20,7 @@ export interface PermissionOverride {
   gateLabel: string;
   command: string;
   reviewerReason: string;
-  choice: "allow" | "allow_unnecessary" | "allow_appropriate" | "block";
-  /** Present only for a user-scoped ledger approval loaded at session start. */
-  standing?: {
-    grantedAt: string;
-    project: string;
-    gateGroup: string;
-  };
+  choice: (typeof PERMISSION_OVERRIDE_CHOICES)[number];
 }
 
 /** Anchor value meaning "before every collected record". */
@@ -43,16 +39,6 @@ export function overrideEvidenceRecord(override: PermissionOverride): ReviewEvid
   const command = JSON.stringify(commandPreview(override.command));
   const gate = JSON.stringify(override.gateLabel);
   const concern = JSON.stringify(commandPreview(override.reviewerReason));
-  if (override.standing) {
-    const granted = override.standing.grantedAt.slice(0, 10);
-    const project = JSON.stringify(commandPreview(override.standing.project));
-    const group = JSON.stringify(override.standing.gateGroup);
-    return {
-      key: `override:${override.seq}`,
-      source: "user",
-      text: `USER (standing permission override, granted ${granted} in ${project}): allowed gated command ${command} (gate ${gate}, group ${group}) despite reviewer concern ${concern}. Treat comparable actions in any project as authorized unless a later user statement or block contradicts this. This never authorizes an action of a materially higher risk class.`,
-    };
-  }
   let text: string;
   switch (override.choice) {
     case "allow_unnecessary":

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hank-warren/pi-auto-permissions",
-  "version": "0.16.2",
+  "version": "0.17.0",
   "description": "Fork of @ogulcancelik/pi-auto-permissions with dialog-answer user evidence: context-aware Bash permissions for Pi with automated guardian review.",
   "type": "module",
   "keywords": [
@@ -43,24 +43,20 @@
     "NOTICE.md",
     "auto-permissions-setup",
     "index.ts",
-    "approval-pulse.ts",
     "config.ts",
     "config-writer.ts",
     "default-rules.ts",
     "denial-log.ts",
     "settings-menu.ts",
     "guardian-transport.ts",
-    "openai-codex-transport.ts",
     "subagent-context.ts",
-    "loop-context.ts",
-    "loop-revise-budget.ts",
     "evaluation-log.ts",
     "gates.ts",
+    "jsonl-sidecar.ts",
     "override-evidence.ts",
     "review.ts",
     "review-queue.ts",
     "session-environment.ts",
-    "standing-overrides.ts",
     "usage-log.ts",
     "widget-status.ts",
     "classify.ts",
@@ -80,7 +76,6 @@
   "peerDependencies": {
     "@earendil-works/pi-ai": "*",
     "@earendil-works/pi-coding-agent": "*",
-    "@earendil-works/pi-tui": "*",
-    "typebox": "*"
+    "@earendil-works/pi-tui": "*"
   }
 }

package/prompt-select.ts

@@ -1,6 +1,5 @@
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { OptionSelector } from "@hank-warren/pi-permission-selector/selector.ts";
-import { PulsingApprovalIndicator } from "./approval-pulse.js";
 
 /**
  * Tell Herdr this pane is waiting on a human, so a supervising agent can see
@@ -33,23 +32,20 @@ export function promptSelect(
   title: string,
   values: string[],
   signal: AbortSignal,
-  opts: { allowComment: boolean },
 ): Promise<string | undefined> {
-  let indicator: PulsingApprovalIndicator | undefined;
   return ctx.ui.custom<string | undefined>((tui, theme, _keybindings, done) => {
     let finished = false;
     const onAbort = () => finish(undefined);
     const finish = (result: string | undefined) => {
       if (finished) return;
       finished = true;
-      indicator?.stop();
       signal.removeEventListener("abort", onAbort);
       done(result);
     };
     const selector = new OptionSelector({
-      title,
+      title: `${theme.fg("warning", theme.bold("●"))} ${title}`,
       options: values.map((value) => ({ value, label: value })),
-      allowComment: opts.allowComment,
+      allowComment: true,
       theme,
       onSelect: (option, comment) => {
         if (comment) {
@@ -64,17 +60,10 @@ export function promptSelect(
       onCancel: () => finish(undefined),
       requestRender: () => tui.requestRender(),
     });
-    indicator = new PulsingApprovalIndicator(
-      title.split("\n", 1)[0] ?? "Auto Permissions needs approval",
-      selector,
-      theme,
-      () => tui.requestRender(),
-    );
     signal.addEventListener("abort", onAbort, { once: true });
     // `done` before the factory resolves is safe: pi marks the dialog closed
     // and never mounts the component.
     if (signal.aborted) onAbort();
-    else indicator.start();
-    return indicator;
-  }).finally(() => indicator?.stop());
+    return selector;
+  });
 }