@hank-warren/pi-auto-permissions 0.16.2 → 0.17.0

package/session-overrides.ts

@@ -1,87 +1,53 @@
-import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
-import type { AutoPermissionsConfig } from "./config.js";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import type { PromptChoiceClassification } from "./evaluation-log.js";
-import type { PermissionOverride } from "./override-evidence.js";
-import type { ReviewScope } from "./review-scope.js";
+import type { Gate } from "./gates.js";
+import { PERMISSION_OVERRIDE_CHOICES, type PermissionOverride } from "./override-evidence.js";
 import type { DenialSummary } from "./settings-menu.js";
-import {
-  grantStandingApproval,
-  readStandingApprovals,
-  STANDING_APPROVAL_LIMIT,
-  standingApprovalsToPermissionOverrides,
-} from "./standing-overrides.js";
 
 /**
- * Overrides persist as custom session entries the way the loop budget does,
+ * Overrides persist as custom session entries,
  * so a resumed session keeps the user's prompt decisions instead of
  * forgetting every allow and standing block constraint.
  */
 const OVERRIDES_ENTRY_TYPE = "auto-permissions-overrides";
 
 export interface SessionOverrides {
-  /** Commands a `request_override` grant cleared for the rest of this session. */
-  readonly allowedConventionCommands: ReadonlySet<string>;
   /** The override records, live, for merging into reviewer evidence. */
   list(): readonly PermissionOverride[];
-  allowConvention(command: string): void;
-  activateOverrideTool(): void;
-  reconcileOverrideTool(): void;
-  persist(): void;
   restore(branch: readonly unknown[]): void;
-  removeStanding(matches: (override: PermissionOverride) => boolean): void;
-  loadStanding(config: AutoPermissionsConfig, ctx: ExtensionContext): void;
   recordPromptDecision(
-    scope: ReviewScope,
+    gate: Pick<Gate, "label">,
+    command: string,
     classification: PromptChoiceClassification,
     detail: string,
     anchorKey: string | undefined,
   ): void;
   allowRetry(denial: DenialSummary, anchorKey: string | undefined): void;
-  resetForSession(): void;
 }
 
 /**
- * The user's own permission decisions for this session: the exception grants
- * that let a convention-blocked command run, and the override records the
- * guardian is shown as user-source evidence.
+ * The user's own permission decisions for this session: the override records
+ * the guardian is shown as user-source evidence.
  *
- * One owner, because the pieces are one fact seen three ways — the in-memory
- * record, the session entry that survives a resume, and (for standing
- * approvals) the cross-project ledger.
+ * One owner, because the pieces are one fact seen two ways — the in-memory
+ * record and the session entry that survives a resume.
  */
 export function createSessionOverrides(pi: ExtensionAPI): SessionOverrides {
-  const allowedConventionCommands = new Set<string>();
   const permissionOverrides: PermissionOverride[] = [];
   let overrideSeq = 0;
-  let standingApprovalCapNotified = false;
-  let overrideToolActivated = false;
-
-  function reconcileOverrideTool(): void {
-    if (typeof pi.getActiveTools !== "function" || typeof pi.setActiveTools !== "function") return;
-    const active = pi.getActiveTools();
-    const present = active.includes("request_override");
-    if (overrideToolActivated === present) return;
-    pi.setActiveTools(
-      overrideToolActivated
-        ? [...active, "request_override"]
-        : active.filter((name) => name !== "request_override"),
-    );
-  }
 
   function persist(): void {
     try {
       pi.appendEntry(OVERRIDES_ENTRY_TYPE, {
         seq: overrideSeq,
-        overrides: permissionOverrides
-          .filter((override) => !override.standing)
-          .map((override) => ({ ...override })),
+        overrides: permissionOverrides.map((override) => ({ ...override })),
       });
     } catch {
       // Persistence is best-effort; the in-memory records still apply now.
     }
   }
 
-  /** Fail-open like the loop budget: unreadable state means no overrides. */
+  /** Fail-open: unreadable state means no overrides. */
   function restoreOverrides(entries: readonly unknown[]): void {
     permissionOverrides.length = 0;
     overrideSeq = 0;
@@ -98,7 +64,7 @@ export function createSessionOverrides(pi: ExtensionAPI): SessionOverrides {
             || typeof candidate.gateLabel !== "string"
             || typeof candidate.command !== "string"
             || typeof candidate.reviewerReason !== "string"
-            || !["allow", "allow_unnecessary", "allow_appropriate", "block"].includes(candidate.choice)
+            || !PERMISSION_OVERRIDE_CHOICES.includes(candidate.choice)
           ) {
             continue;
           }
@@ -119,52 +85,24 @@ export function createSessionOverrides(pi: ExtensionAPI): SessionOverrides {
     }
   }
 
-  /** Drop matching ledger-backed evidence in place; the array is shared by reference. */
-  function removeStanding(matches: (override: PermissionOverride) => boolean): void {
-    const kept = permissionOverrides.filter((override) => !override.standing || !matches(override));
-    permissionOverrides.splice(0, permissionOverrides.length, ...kept);
+  function addOverride(
+    gateLabel: string,
+    command: string,
+    reviewerReason: string,
+    choice: PermissionOverride["choice"],
+    anchorKey: string | undefined,
+  ): void {
+    permissionOverrides.push({ seq: overrideSeq++, anchorKey, gateLabel, command, reviewerReason, choice });
+    persist();
   }
 
   return {
-    allowedConventionCommands,
     list: () => permissionOverrides,
-    allowConvention(command: string): void {
-      allowedConventionCommands.add(command);
-    },
-    reconcileOverrideTool,
-    activateOverrideTool(): void {
-      overrideToolActivated = true;
-      reconcileOverrideTool();
-    },
-    persist,
-    removeStanding,
 
     restore(branch: readonly unknown[]): void {
       // Restore prompt decisions from the branch: a resumed session keeps its
-      // allows and standing block constraints (parity with the loop budget).
+      // allows and standing block constraints.
       restoreOverrides(branch);
-      for (const entry of branch as Array<{
-        type?: string;
-        message?: { role?: string; toolName?: string; details?: unknown };
-      }>) {
-        if (entry.type !== "message" || entry.message?.role !== "toolResult") continue;
-        if (entry.message.toolName !== "request_override") continue;
-        const details = entry.message.details as { success?: boolean; command?: string } | undefined;
-        if (details?.success && details.command) allowedConventionCommands.add(details.command);
-      }
-    },
-
-    /** Replace only ledger-backed evidence; session prompt decisions stay put. */
-    loadStanding(config: AutoPermissionsConfig, ctx: ExtensionContext): void {
-      removeStanding(() => true);
-      if (!config.standingApprovals.enabled) return;
-      try {
-        const records = readStandingApprovals(config.standingApprovals.path);
-        permissionOverrides.push(...standingApprovalsToPermissionOverrides(records));
-      } catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        ctx.ui.notify(`Could not load standing Auto Permissions approvals: ${message}`, "warning");
-      }
     },
 
     /**
@@ -173,56 +111,15 @@ export function createSessionOverrides(pi: ExtensionAPI): SessionOverrides {
      * a guardian judgment, which is the one case this may be called for.
      */
     recordPromptDecision(
-      scope: ReviewScope,
+      gate: Pick<Gate, "label">,
+      command: string,
       classification: PromptChoiceClassification,
       detail: string,
       anchorKey: string | undefined,
     ): void {
-      const { ctx, config, gate, command } = scope;
       const overrideChoice = classification.userChoice ?? (classification.allowsExecution ? "allow" as const : undefined);
       if (!overrideChoice) return;
-      let recordedStanding = false;
-      if (classification.standingApproval && config.standingApprovals.enabled) {
-        try {
-          const { evicted, override } = grantStandingApproval(
-            config.standingApprovals.path,
-            {
-              gate: { label: gate.label, group: gate.group },
-              command,
-              project: ctx.cwd,
-              reason: detail,
-            },
-            overrideSeq++,
-            anchorKey,
-          );
-          removeStanding(
-            (existing) => existing.standing?.gateGroup === gate.group && existing.command === command,
-          );
-          permissionOverrides.push(override);
-          recordedStanding = true;
-          if (evicted > 0 && !standingApprovalCapNotified) {
-            standingApprovalCapNotified = true;
-            ctx.ui.notify(
-              `Standing approvals reached ${STANDING_APPROVAL_LIMIT} entries; the oldest approval was removed.`,
-              "warning",
-            );
-          }
-        } catch (error) {
-          const message = error instanceof Error ? error.message : String(error);
-          ctx.ui.notify(`Could not save standing approval: ${message}`, "warning");
-        }
-      }
-      if (!recordedStanding) {
-        permissionOverrides.push({
-          seq: overrideSeq++,
-          anchorKey,
-          gateLabel: gate.label,
-          command,
-          reviewerReason: detail,
-          choice: overrideChoice,
-        });
-      }
-      persist();
+      addOverride(gate.label, command, detail, overrideChoice, anchorKey);
     },
 
     /**
@@ -233,15 +130,7 @@ export function createSessionOverrides(pi: ExtensionAPI): SessionOverrides {
      * may retry. No new authorization pathway.
      */
     allowRetry(denial: DenialSummary, anchorKey: string | undefined): void {
-      permissionOverrides.push({
-        seq: overrideSeq++,
-        anchorKey,
-        gateLabel: denial.gateLabel,
-        command: denial.command,
-        reviewerReason: denial.reason,
-        choice: "allow",
-      });
-      persist();
+      addOverride(denial.gateLabel, denial.command, denial.reason, "allow", anchorKey);
       try {
         // The same channel a prompt note uses. This is a real user decision
         // made in the menu, so a user message is honest provenance — and it
@@ -253,12 +142,5 @@ export function createSessionOverrides(pi: ExtensionAPI): SessionOverrides {
         // The override itself is already in force; the nudge is best-effort.
       }
     },
-
-    resetForSession(): void {
-      overrideToolActivated = false;
-      reconcileOverrideTool();
-      standingApprovalCapNotified = false;
-      allowedConventionCommands.clear();
-    },
   };
 }

package/settings-command.ts

@@ -18,18 +18,14 @@ import {
   buildSettingItems,
   createDenialsSubmenu,
   createModelSubmenu,
-  createStandingApprovalsSubmenu,
   createTimeoutSubmenu,
   type DenialsSubmenuHost,
   type DenialSummary,
-  type StandingApprovalsSubmenuHost,
-  type StandingApprovalSummary,
   type MenuModel,
   type ReviewerSettings,
   type SettingChange,
   type SubmenuHost,
 } from "./settings-menu.js";
-import { readStandingApprovals, revokeStandingApproval } from "./standing-overrides.js";
 
 /**
  * What `/auto-permissions setup` says on the user's behalf. Named after the
@@ -75,7 +71,6 @@ export function registerSettingsCommand(
       const path = autoPermissionsConfigPath();
       let settings: ReviewerSettings;
       let denialLog: AutoPermissionsConfig["denialLog"];
-      let standingApprovalsConfig: AutoPermissionsConfig["standingApprovals"];
       try {
         const config = loadAutoPermissionsConfig(path);
         settings = {
@@ -84,7 +79,6 @@ export function registerSettingsCommand(
           systemPromptSource: config.systemPromptSource,
         };
         denialLog = config.denialLog;
-        standingApprovalsConfig = config.standingApprovals;
       } catch (error) {
         // Editing a file we cannot validate is the one way this writer could
         // quietly make things worse, so refuse rather than open.
@@ -142,34 +136,6 @@ export function registerSettingsCommand(
         }
       };
 
-      const standingApprovalSummaries = (): StandingApprovalSummary[] => {
-        if (!standingApprovalsConfig.enabled) return [];
-        try {
-          return readStandingApprovals(standingApprovalsConfig.path).map((record, index) => ({
-            id: `${index}:${record.ts}:${record.gate.label}`,
-            record,
-          }));
-        } catch {
-          return [];
-        }
-      };
-
-      const revokeApproval = (approval: StandingApprovalSummary): void => {
-        try {
-          if (!revokeStandingApproval(standingApprovalsConfig.path, approval.record)) {
-            ctx.ui.notify("That standing approval is no longer in the ledger.", "warning");
-            return;
-          }
-          const config = loadAutoPermissionsConfig(path);
-          overrides.loadStanding(config, ctx);
-          reviewer.discardLineage();
-          ctx.ui.notify("Standing approval revoked.", "info");
-        } catch (error) {
-          const message = error instanceof Error ? error.message : String(error);
-          ctx.ui.notify(`Could not revoke standing approval: ${message}`, "warning");
-        }
-      };
-
       /**
        * Closes the settings dialog. Assigned when `ctx.ui.custom` builds the
        * component, so it is only ever called from inside the dialog it closes.
@@ -213,13 +179,6 @@ export function registerSettingsCommand(
           selectTheme: getSelectListTheme(),
           requestRender: () => tui.requestRender(),
         };
-        const standingHost: StandingApprovalsSubmenuHost = {
-          standingApprovals: standingApprovalSummaries,
-          revokeStandingApproval: revokeApproval,
-          settingsTheme: getSettingsListTheme(),
-          selectTheme: getSelectListTheme(),
-          requestRender: () => tui.requestRender(),
-        };
         const list = new SettingsList(
           buildSettingItems(
             settings,
@@ -227,13 +186,9 @@ export function registerSettingsCommand(
               reviewerModel: createModelSubmenu(host),
               timeout: createTimeoutSubmenu(host),
               ...(denialLog.enabled ? { recentDenials: createDenialsSubmenu(denialsHost) } : {}),
-              ...(standingApprovalsConfig.enabled
-                ? { standingApprovals: createStandingApprovalsSubmenu(standingHost) }
-                : {}),
             },
             undefined,
             denialLog.enabled ? recentDenials().length : undefined,
-            standingApprovalsConfig.enabled ? standingApprovalSummaries().length : undefined,
           ),
           10,
           host.settingsTheme,

package/settings-menu.ts

@@ -2,8 +2,8 @@
  * Row model and pure edit logic behind `/auto-permissions`.
  *
  * Everything that decides *what* a row shows or what an edit means lives here,
- * free of pi's runtime, so it is testable without a TUI. index.ts owns only the
- * wiring: read config, render a SettingsList, persist through config-writer.
+ * free of pi's runtime, so it is testable without a TUI. settings-command.ts owns
+ * only the wiring: read config, render a SettingsList, persist through config-writer.
  */
 import { homedir } from "node:os";
 import {
@@ -24,10 +24,9 @@ import {
   MIN_REVIEWER_TIMEOUT_MS,
   REASONING_EFFORTS,
   type ReasoningEffort,
+  type ReviewerConfig,
   type SystemPromptSource,
 } from "./config.js";
-import type { ReviewerBlock } from "./config-writer.js";
-import type { StandingApprovalRecord } from "./standing-overrides.js";
 
 const ENABLED_ID = "enabled";
 const REVIEWER_MODEL_ID = "reviewerModel";
@@ -35,7 +34,6 @@ const THINKING_LEVEL_ID = "reasoningEffort";
 const TIMEOUT_ID = "timeoutMs";
 const SYSTEM_PROMPT_ID = "systemPrompt";
 export const RECENT_DENIALS_ID = "recentDenials";
-export const STANDING_APPROVALS_ID = "standingApprovals";
 
 export const ON = "on";
 export const OFF = "off";
@@ -48,7 +46,7 @@ const NO_REVIEWER_MESSAGE = "Select a reviewer model first";
 /** The slice of the config the menu edits, plus the read-only prompt source. */
 export interface ReviewerSettings {
   enabled: boolean;
-  reviewer?: ReviewerBlock;
+  reviewer?: ReviewerConfig;
   systemPromptSource: SystemPromptSource;
 }
 
@@ -141,7 +139,6 @@ export interface SettingSubmenus {
   reviewerModel?: SettingItem["submenu"];
   timeout?: SettingItem["submenu"];
   recentDenials?: SettingItem["submenu"];
-  standingApprovals?: SettingItem["submenu"];
 }
 
 /** Build the `/auto-permissions` rows for a settings snapshot. */
@@ -150,13 +147,12 @@ export function buildSettingItems(
   submenus: SettingSubmenus = {},
   home: string = homedir(),
   denialCount?: number,
-  standingApprovalCount?: number,
 ): SettingItem[] {
   return [
     {
       id: ENABLED_ID,
       label: "Enabled",
-      description: "Review guarded commands. Off lets every command run without guardian review.",
+      description: "Review guarded commands. Off disables all gating, including deny rules.",
       currentValue: toggleValue(settings.enabled),
       values: TOGGLE_VALUES,
     },
@@ -196,15 +192,6 @@ export function buildSettingItems(
         submenu: submenus.recentDenials,
       }]
       : []),
-    ...(submenus.standingApprovals
-      ? [{
-        id: STANDING_APPROVALS_ID,
-        label: "Standing approvals",
-        description: "Comparable-command approvals shared across projects. Select one to revoke it.",
-        currentValue: standingApprovalCount === undefined ? "" : String(standingApprovalCount),
-        submenu: submenus.standingApprovals,
-      }]
-      : []),
   ];
 }
 
@@ -568,120 +555,6 @@ export function createDenialsSubmenu(host: DenialsSubmenuHost): NonNullable<Sett
   return (_currentValue, done) => new DenialsSubmenu(host, done);
 }
 
-export interface StandingApprovalSummary {
-  id: string;
-  record: StandingApprovalRecord;
-}
-
-export interface StandingApprovalsSubmenuHost {
-  standingApprovals(): StandingApprovalSummary[];
-  revokeStandingApproval(approval: StandingApprovalSummary): void;
-  settingsTheme: SettingsListTheme;
-  selectTheme: SelectListTheme;
-  requestRender(): void;
-}
-
-export function standingApprovalItem(approval: StandingApprovalSummary): SelectItem {
-  const command = approval.record.command.length > COMMAND_LABEL_MAX
-    ? `${approval.record.command.slice(0, COMMAND_LABEL_MAX - 1)}…`
-    : approval.record.command;
-  return {
-    value: approval.id,
-    label: command,
-    description: `${approval.record.gate.label} · granted ${approval.record.ts.slice(0, 10)} · ${approval.record.project}`,
-  };
-}
-
-class StandingApprovalsSubmenu implements Component {
-  private readonly approvals: StandingApprovalSummary[];
-  private list: SelectList;
-  private selected?: StandingApprovalSummary;
-
-  constructor(
-    private readonly host: StandingApprovalsSubmenuHost,
-    private readonly done: (value?: string) => void,
-  ) {
-    this.approvals = host.standingApprovals();
-    this.list = this.buildApprovalList();
-  }
-
-  private buildApprovalList(): SelectList {
-    const items = this.approvals.length
-      ? this.approvals.map(standingApprovalItem)
-      : [{ value: "", label: "(no standing approvals)", description: "Comparable-command approvals will appear here." }];
-    const list = new SelectList(items, 10, this.host.selectTheme);
-    list.onCancel = () => this.done(undefined);
-    list.onSelect = (item) => {
-      const approval = this.approvals.find((candidate) => candidate.id === item.value);
-      if (!approval) {
-        this.done(undefined);
-        return;
-      }
-      this.selected = approval;
-      this.list = this.buildConfirmList();
-      this.host.requestRender();
-    };
-    return list;
-  }
-
-  private buildConfirmList(): SelectList {
-    const list = new SelectList(
-      [
-        {
-          value: "revoke",
-          label: "Revoke",
-          description: "Removes this approval from the user-scoped standing ledger.",
-        },
-        { value: "back", label: "Back" },
-      ],
-      10,
-      this.host.selectTheme,
-    );
-    const back = () => {
-      this.selected = undefined;
-      this.list = this.buildApprovalList();
-      this.host.requestRender();
-    };
-    list.onCancel = back;
-    list.onSelect = (item) => {
-      if (item.value !== "revoke" || !this.selected) {
-        back();
-        return;
-      }
-      this.host.revokeStandingApproval(this.selected);
-      this.done(undefined);
-    };
-    return list;
-  }
-
-  invalidate(): void {
-    this.list.invalidate();
-  }
-
-  render(width: number): string[] {
-    const title = this.selected
-      ? `  Revoke standing approval?  ${truncateToWidth(this.selected.record.command, Math.max(1, width - 30))}`
-      : "  Standing approvals";
-    return [
-      truncateToWidth(this.host.settingsTheme.hint(title), width),
-      "",
-      ...this.list.render(width),
-      "",
-      truncateToWidth(this.host.settingsTheme.hint("  Enter to select · Esc to go back"), width),
-    ];
-  }
-
-  handleInput(data: string): void {
-    this.list.handleInput(data);
-  }
-}
-
-export function createStandingApprovalsSubmenu(
-  host: StandingApprovalsSubmenuHost,
-): NonNullable<SettingItem["submenu"]> {
-  return (_currentValue, done) => new StandingApprovalsSubmenu(host, done);
-}
-
 export function createTimeoutSubmenu(host: SubmenuHost): NonNullable<SettingItem["submenu"]> {
   return (currentValue, done) =>
     new PromptComponent(

package/usage-log.ts

@@ -1,9 +1,5 @@
-import { appendFileSync, chmodSync, mkdirSync, renameSync, statSync } from "node:fs";
 import { randomUUID } from "node:crypto";
-import { dirname } from "node:path";
-
-/** Rotate once the sidecar grows past this size; one previous generation is kept. */
-export const USAGE_LOG_ROTATE_BYTES = 16 * 1024 * 1024;
+import { appendJsonlRecord, SIDECAR_ROTATE_BYTES } from "./jsonl-sidecar.js";
 
 interface UsageLogTotals {
   input: number;
@@ -55,14 +51,13 @@ export function buildUsageLogRecord(
   model: string,
   usage: unknown,
   label = "guardian",
-  source = "auto-permissions",
   subagent = false,
 ): UsageLogRecord {
   return {
     v: 1,
     id: randomUUID(),
     ts: new Date().toISOString(),
-    source,
+    source: "auto-permissions",
     label,
     provider,
     model,
@@ -71,18 +66,6 @@ export function buildUsageLogRecord(
   };
 }
 
-function rotateIfLarge(path: string): void {
-  try {
-    if (statSync(path).size < USAGE_LOG_ROTATE_BYTES) return;
-    renameSync(path, `${path}.1`);
-  } catch {
-    // A missing or unrotatable sidecar simply keeps appending.
-  }
-}
-
 export function appendUsageRecord(path: string, record: UsageLogRecord): void {
-  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
-  rotateIfLarge(path);
-  appendFileSync(path, `${JSON.stringify(record)}\n`, { encoding: "utf8", mode: 0o600 });
-  chmodSync(path, 0o600);
+  appendJsonlRecord(path, record, SIDECAR_ROTATE_BYTES);
 }

package/widget-status.ts

@@ -18,8 +18,6 @@ interface ReviewStatusFrame {
   glyph: string;
   label: string;
   tone: ReviewStatusTone;
-  /** True once no further frames are needed (state is static). */
-  done: boolean;
 }
 
 export const WAITING_FRAMES = ["✶", "✸", "✻", "✽"] as const;
@@ -41,23 +39,21 @@ export function reviewStatusFrame(
         glyph: "⋯",
         label: "queued behind another review",
         tone: "muted",
-        done: true,
       };
     case "waiting":
       return {
         glyph: WAITING_FRAMES[index % WAITING_FRAMES.length],
         label: `waiting for ${reviewer}`,
         tone: "warning",
-        done: false,
       };
     case "approved":
-      return { glyph: "✓", label: "approved", tone: "success", done: true };
+      return { glyph: "✓", label: "approved", tone: "success" };
     case "revise":
-      return { glyph: "↻", label: "revision requested", tone: "warning", done: true };
+      return { glyph: "↻", label: "revision requested", tone: "warning" };
     case "ask_user":
-      return { glyph: "?", label: "waiting for your approval", tone: "accent", done: true };
+      return { glyph: "?", label: "waiting for your approval", tone: "accent" };
     case "blocked":
-      return { glyph: "✗", label: "blocked", tone: "error", done: true };
+      return { glyph: "✗", label: "blocked", tone: "error" };
   }
 }
 
@@ -74,15 +70,6 @@ export interface ReviewLinePalette {
   error: (text: string) => string;
 }
 
-export const PLAIN_PALETTE: ReviewLinePalette = {
-  header: (text) => text,
-  muted: (text) => text,
-  warning: (text) => text,
-  success: (text) => text,
-  accent: (text) => text,
-  error: (text) => text,
-};
-
 /**
  * Render the widget content: one status line, plus a dim detail line only
  * when a guardian reason is present. The command is intentionally omitted —