@hank-warren/pi-auto-permissions 0.16.2 → 0.18.0

package/session-overrides.ts

@@ -1,87 +1,53 @@
-import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
-import type { AutoPermissionsConfig } from "./config.js";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import type { PromptChoiceClassification } from "./evaluation-log.js";
-import type { PermissionOverride } from "./override-evidence.js";
-import type { ReviewScope } from "./review-scope.js";
+import type { Gate } from "./gates.js";
+import { PERMISSION_OVERRIDE_CHOICES, type PermissionOverride } from "./override-evidence.js";
 import type { DenialSummary } from "./settings-menu.js";
-import {
-  grantStandingApproval,
-  readStandingApprovals,
-  STANDING_APPROVAL_LIMIT,
-  standingApprovalsToPermissionOverrides,
-} from "./standing-overrides.js";
 
 /**
- * Overrides persist as custom session entries the way the loop budget does,
+ * Overrides persist as custom session entries,
  * so a resumed session keeps the user's prompt decisions instead of
  * forgetting every allow and standing block constraint.
  */
 const OVERRIDES_ENTRY_TYPE = "auto-permissions-overrides";
 
 export interface SessionOverrides {
-  /** Commands a `request_override` grant cleared for the rest of this session. */
-  readonly allowedConventionCommands: ReadonlySet<string>;
   /** The override records, live, for merging into reviewer evidence. */
   list(): readonly PermissionOverride[];
-  allowConvention(command: string): void;
-  activateOverrideTool(): void;
-  reconcileOverrideTool(): void;
-  persist(): void;
   restore(branch: readonly unknown[]): void;
-  removeStanding(matches: (override: PermissionOverride) => boolean): void;
-  loadStanding(config: AutoPermissionsConfig, ctx: ExtensionContext): void;
   recordPromptDecision(
-    scope: ReviewScope,
+    gate: Pick<Gate, "label">,
+    command: string,
     classification: PromptChoiceClassification,
     detail: string,
     anchorKey: string | undefined,
   ): void;
   allowRetry(denial: DenialSummary, anchorKey: string | undefined): void;
-  resetForSession(): void;
 }
 
 /**
- * The user's own permission decisions for this session: the exception grants
- * that let a convention-blocked command run, and the override records the
- * guardian is shown as user-source evidence.
+ * The user's own permission decisions for this session: the override records
+ * the guardian is shown as user-source evidence.
  *
- * One owner, because the pieces are one fact seen three ways — the in-memory
- * record, the session entry that survives a resume, and (for standing
- * approvals) the cross-project ledger.
+ * One owner, because the pieces are one fact seen two ways — the in-memory
+ * record and the session entry that survives a resume.
  */
 export function createSessionOverrides(pi: ExtensionAPI): SessionOverrides {
-  const allowedConventionCommands = new Set<string>();
   const permissionOverrides: PermissionOverride[] = [];
   let overrideSeq = 0;
-  let standingApprovalCapNotified = false;
-  let overrideToolActivated = false;
-
-  function reconcileOverrideTool(): void {
-    if (typeof pi.getActiveTools !== "function" || typeof pi.setActiveTools !== "function") return;
-    const active = pi.getActiveTools();
-    const present = active.includes("request_override");
-    if (overrideToolActivated === present) return;
-    pi.setActiveTools(
-      overrideToolActivated
-        ? [...active, "request_override"]
-        : active.filter((name) => name !== "request_override"),
-    );
-  }
 
   function persist(): void {
     try {
       pi.appendEntry(OVERRIDES_ENTRY_TYPE, {
         seq: overrideSeq,
-        overrides: permissionOverrides
-          .filter((override) => !override.standing)
-          .map((override) => ({ ...override })),
+        overrides: permissionOverrides.map((override) => ({ ...override })),
       });
     } catch {
       // Persistence is best-effort; the in-memory records still apply now.
     }
   }
 
-  /** Fail-open like the loop budget: unreadable state means no overrides. */
+  /** Fail-open: unreadable state means no overrides. */
   function restoreOverrides(entries: readonly unknown[]): void {
     permissionOverrides.length = 0;
     overrideSeq = 0;
@@ -98,7 +64,7 @@ export function createSessionOverrides(pi: ExtensionAPI): SessionOverrides {
             || typeof candidate.gateLabel !== "string"
             || typeof candidate.command !== "string"
             || typeof candidate.reviewerReason !== "string"
-            || !["allow", "allow_unnecessary", "allow_appropriate", "block"].includes(candidate.choice)
+            || !PERMISSION_OVERRIDE_CHOICES.includes(candidate.choice)
           ) {
             continue;
           }
@@ -119,52 +85,24 @@ export function createSessionOverrides(pi: ExtensionAPI): SessionOverrides {
     }
   }
 
-  /** Drop matching ledger-backed evidence in place; the array is shared by reference. */
-  function removeStanding(matches: (override: PermissionOverride) => boolean): void {
-    const kept = permissionOverrides.filter((override) => !override.standing || !matches(override));
-    permissionOverrides.splice(0, permissionOverrides.length, ...kept);
+  function addOverride(
+    gateLabel: string,
+    command: string,
+    reviewerReason: string,
+    choice: PermissionOverride["choice"],
+    anchorKey: string | undefined,
+  ): void {
+    permissionOverrides.push({ seq: overrideSeq++, anchorKey, gateLabel, command, reviewerReason, choice });
+    persist();
   }
 
   return {
-    allowedConventionCommands,
     list: () => permissionOverrides,
-    allowConvention(command: string): void {
-      allowedConventionCommands.add(command);
-    },
-    reconcileOverrideTool,
-    activateOverrideTool(): void {
-      overrideToolActivated = true;
-      reconcileOverrideTool();
-    },
-    persist,
-    removeStanding,
 
     restore(branch: readonly unknown[]): void {
       // Restore prompt decisions from the branch: a resumed session keeps its
-      // allows and standing block constraints (parity with the loop budget).
+      // allows and standing block constraints.
       restoreOverrides(branch);
-      for (const entry of branch as Array<{
-        type?: string;
-        message?: { role?: string; toolName?: string; details?: unknown };
-      }>) {
-        if (entry.type !== "message" || entry.message?.role !== "toolResult") continue;
-        if (entry.message.toolName !== "request_override") continue;
-        const details = entry.message.details as { success?: boolean; command?: string } | undefined;
-        if (details?.success && details.command) allowedConventionCommands.add(details.command);
-      }
-    },
-
-    /** Replace only ledger-backed evidence; session prompt decisions stay put. */
-    loadStanding(config: AutoPermissionsConfig, ctx: ExtensionContext): void {
-      removeStanding(() => true);
-      if (!config.standingApprovals.enabled) return;
-      try {
-        const records = readStandingApprovals(config.standingApprovals.path);
-        permissionOverrides.push(...standingApprovalsToPermissionOverrides(records));
-      } catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        ctx.ui.notify(`Could not load standing Auto Permissions approvals: ${message}`, "warning");
-      }
     },
 
     /**
@@ -173,56 +111,15 @@ export function createSessionOverrides(pi: ExtensionAPI): SessionOverrides {
      * a guardian judgment, which is the one case this may be called for.
      */
     recordPromptDecision(
-      scope: ReviewScope,
+      gate: Pick<Gate, "label">,
+      command: string,
       classification: PromptChoiceClassification,
       detail: string,
       anchorKey: string | undefined,
     ): void {
-      const { ctx, config, gate, command } = scope;
       const overrideChoice = classification.userChoice ?? (classification.allowsExecution ? "allow" as const : undefined);
       if (!overrideChoice) return;
-      let recordedStanding = false;
-      if (classification.standingApproval && config.standingApprovals.enabled) {
-        try {
-          const { evicted, override } = grantStandingApproval(
-            config.standingApprovals.path,
-            {
-              gate: { label: gate.label, group: gate.group },
-              command,
-              project: ctx.cwd,
-              reason: detail,
-            },
-            overrideSeq++,
-            anchorKey,
-          );
-          removeStanding(
-            (existing) => existing.standing?.gateGroup === gate.group && existing.command === command,
-          );
-          permissionOverrides.push(override);
-          recordedStanding = true;
-          if (evicted > 0 && !standingApprovalCapNotified) {
-            standingApprovalCapNotified = true;
-            ctx.ui.notify(
-              `Standing approvals reached ${STANDING_APPROVAL_LIMIT} entries; the oldest approval was removed.`,
-              "warning",
-            );
-          }
-        } catch (error) {
-          const message = error instanceof Error ? error.message : String(error);
-          ctx.ui.notify(`Could not save standing approval: ${message}`, "warning");
-        }
-      }
-      if (!recordedStanding) {
-        permissionOverrides.push({
-          seq: overrideSeq++,
-          anchorKey,
-          gateLabel: gate.label,
-          command,
-          reviewerReason: detail,
-          choice: overrideChoice,
-        });
-      }
-      persist();
+      addOverride(gate.label, command, detail, overrideChoice, anchorKey);
     },
 
     /**
@@ -233,15 +130,7 @@ export function createSessionOverrides(pi: ExtensionAPI): SessionOverrides {
      * may retry. No new authorization pathway.
      */
     allowRetry(denial: DenialSummary, anchorKey: string | undefined): void {
-      permissionOverrides.push({
-        seq: overrideSeq++,
-        anchorKey,
-        gateLabel: denial.gateLabel,
-        command: denial.command,
-        reviewerReason: denial.reason,
-        choice: "allow",
-      });
-      persist();
+      addOverride(denial.gateLabel, denial.command, denial.reason, "allow", anchorKey);
       try {
         // The same channel a prompt note uses. This is a real user decision
         // made in the menu, so a user message is honest provenance — and it
@@ -253,12 +142,5 @@ export function createSessionOverrides(pi: ExtensionAPI): SessionOverrides {
         // The override itself is already in force; the nudge is best-effort.
       }
     },
-
-    resetForSession(): void {
-      overrideToolActivated = false;
-      reconcileOverrideTool();
-      standingApprovalCapNotified = false;
-      allowedConventionCommands.clear();
-    },
   };
 }

package/settings-command.ts

@@ -18,18 +18,14 @@ import {
   buildSettingItems,
   createDenialsSubmenu,
   createModelSubmenu,
-  createStandingApprovalsSubmenu,
   createTimeoutSubmenu,
   type DenialsSubmenuHost,
   type DenialSummary,
-  type StandingApprovalsSubmenuHost,
-  type StandingApprovalSummary,
   type MenuModel,
   type ReviewerSettings,
   type SettingChange,
   type SubmenuHost,
 } from "./settings-menu.js";
-import { readStandingApprovals, revokeStandingApproval } from "./standing-overrides.js";
 
 /**
  * What `/auto-permissions setup` says on the user's behalf. Named after the
@@ -44,8 +40,8 @@ export function registerSettingsCommand(
   { overrides, reviewer }: { overrides: SessionOverrides; reviewer: GuardianReviewer },
 ): void {
   /**
-   * `/auto-permissions`: edit the reviewer model, thinking level, timeout and
-   * the enabled flag without hand-editing config.json.
+   * `/auto-permissions`: edit the reviewer model, thinking level, timeout,
+   * parallel reviews and the enabled flag without hand-editing config.json.
    *
    * There is no live-apply step: every tool call re-reads the config through
    * currentConfig(), so a saved edit is in force immediately -- in this session
@@ -75,16 +71,15 @@ export function registerSettingsCommand(
       const path = autoPermissionsConfigPath();
       let settings: ReviewerSettings;
       let denialLog: AutoPermissionsConfig["denialLog"];
-      let standingApprovalsConfig: AutoPermissionsConfig["standingApprovals"];
       try {
         const config = loadAutoPermissionsConfig(path);
         settings = {
           enabled: config.enabled,
           reviewer: config.reviewer,
+          reviewConcurrency: config.reviewConcurrency,
           systemPromptSource: config.systemPromptSource,
         };
         denialLog = config.denialLog;
-        standingApprovalsConfig = config.standingApprovals;
       } catch (error) {
         // Editing a file we cannot validate is the one way this writer could
         // quietly make things worse, so refuse rather than open.
@@ -103,7 +98,14 @@ export function registerSettingsCommand(
         const previous = settings;
         settings = change.settings;
         try {
-          patchAutoPermissionsConfig(path, { enabled: settings.enabled, reviewer: settings.reviewer });
+          patchAutoPermissionsConfig(path, {
+            enabled: settings.enabled,
+            reviewer: settings.reviewer,
+            // Only when this edit changed it, so a hand-written value is never rewritten by an unrelated save.
+            ...(settings.reviewConcurrency !== previous.reviewConcurrency
+              ? { reviewConcurrency: settings.reviewConcurrency }
+              : {}),
+          });
         } catch (error) {
           settings = previous;
           const message = error instanceof Error ? error.message : String(error);
@@ -142,34 +144,6 @@ export function registerSettingsCommand(
         }
       };
 
-      const standingApprovalSummaries = (): StandingApprovalSummary[] => {
-        if (!standingApprovalsConfig.enabled) return [];
-        try {
-          return readStandingApprovals(standingApprovalsConfig.path).map((record, index) => ({
-            id: `${index}:${record.ts}:${record.gate.label}`,
-            record,
-          }));
-        } catch {
-          return [];
-        }
-      };
-
-      const revokeApproval = (approval: StandingApprovalSummary): void => {
-        try {
-          if (!revokeStandingApproval(standingApprovalsConfig.path, approval.record)) {
-            ctx.ui.notify("That standing approval is no longer in the ledger.", "warning");
-            return;
-          }
-          const config = loadAutoPermissionsConfig(path);
-          overrides.loadStanding(config, ctx);
-          reviewer.discardLineage();
-          ctx.ui.notify("Standing approval revoked.", "info");
-        } catch (error) {
-          const message = error instanceof Error ? error.message : String(error);
-          ctx.ui.notify(`Could not revoke standing approval: ${message}`, "warning");
-        }
-      };
-
       /**
        * Closes the settings dialog. Assigned when `ctx.ui.custom` builds the
        * component, so it is only ever called from inside the dialog it closes.
@@ -213,13 +187,6 @@ export function registerSettingsCommand(
           selectTheme: getSelectListTheme(),
           requestRender: () => tui.requestRender(),
         };
-        const standingHost: StandingApprovalsSubmenuHost = {
-          standingApprovals: standingApprovalSummaries,
-          revokeStandingApproval: revokeApproval,
-          settingsTheme: getSettingsListTheme(),
-          selectTheme: getSelectListTheme(),
-          requestRender: () => tui.requestRender(),
-        };
         const list = new SettingsList(
           buildSettingItems(
             settings,
@@ -227,13 +194,9 @@ export function registerSettingsCommand(
               reviewerModel: createModelSubmenu(host),
               timeout: createTimeoutSubmenu(host),
               ...(denialLog.enabled ? { recentDenials: createDenialsSubmenu(denialsHost) } : {}),
-              ...(standingApprovalsConfig.enabled
-                ? { standingApprovals: createStandingApprovalsSubmenu(standingHost) }
-                : {}),
             },
             undefined,
             denialLog.enabled ? recentDenials().length : undefined,
-            standingApprovalsConfig.enabled ? standingApprovalSummaries().length : undefined,
           ),
           10,
           host.settingsTheme,

package/settings-menu.ts

@@ -2,8 +2,8 @@
  * Row model and pure edit logic behind `/auto-permissions`.
  *
  * Everything that decides *what* a row shows or what an edit means lives here,
- * free of pi's runtime, so it is testable without a TUI. index.ts owns only the
- * wiring: read config, render a SettingsList, persist through config-writer.
+ * free of pi's runtime, so it is testable without a TUI. settings-command.ts owns
+ * only the wiring: read config, render a SettingsList, persist through config-writer.
  */
 import { homedir } from "node:os";
 import {
@@ -20,22 +20,22 @@ import {
 import {
   DEFAULT_REVIEWER_REASONING_EFFORT,
   DEFAULT_REVIEWER_TIMEOUT_MS,
+  MAX_REVIEW_CONCURRENCY,
   MAX_REVIEWER_TIMEOUT_MS,
   MIN_REVIEWER_TIMEOUT_MS,
   REASONING_EFFORTS,
   type ReasoningEffort,
+  type ReviewerConfig,
   type SystemPromptSource,
 } from "./config.js";
-import type { ReviewerBlock } from "./config-writer.js";
-import type { StandingApprovalRecord } from "./standing-overrides.js";
 
 const ENABLED_ID = "enabled";
 const REVIEWER_MODEL_ID = "reviewerModel";
 const THINKING_LEVEL_ID = "reasoningEffort";
 const TIMEOUT_ID = "timeoutMs";
+const REVIEW_CONCURRENCY_ID = "reviewConcurrency";
 const SYSTEM_PROMPT_ID = "systemPrompt";
 export const RECENT_DENIALS_ID = "recentDenials";
-export const STANDING_APPROVALS_ID = "standingApprovals";
 
 export const ON = "on";
 export const OFF = "off";
@@ -48,10 +48,21 @@ const NO_REVIEWER_MESSAGE = "Select a reviewer model first";
 /** The slice of the config the menu edits, plus the read-only prompt source. */
 export interface ReviewerSettings {
   enabled: boolean;
-  reviewer?: ReviewerBlock;
+  reviewer?: ReviewerConfig;
+  reviewConcurrency: number;
   systemPromptSource: SystemPromptSource;
 }
 
+const CONCURRENCY_PRESETS = [1, 2, 4, 8, 16];
+
+/**
+ * The values the parallel-reviews row cycles through. A hand-written value
+ * outside the presets is kept in the cycle, so opening the menu never moves it.
+ */
+export function concurrencyValues(current: number): string[] {
+  return [...new Set([...CONCURRENCY_PRESETS, current])].sort((a, b) => a - b).map(String);
+}
+
 /** The subset of a pi model the menu needs; keeps tests free of pi-ai types. */
 export interface MenuModel {
   provider: string;
@@ -141,7 +152,6 @@ export interface SettingSubmenus {
   reviewerModel?: SettingItem["submenu"];
   timeout?: SettingItem["submenu"];
   recentDenials?: SettingItem["submenu"];
-  standingApprovals?: SettingItem["submenu"];
 }
 
 /** Build the `/auto-permissions` rows for a settings snapshot. */
@@ -150,13 +160,12 @@ export function buildSettingItems(
   submenus: SettingSubmenus = {},
   home: string = homedir(),
   denialCount?: number,
-  standingApprovalCount?: number,
 ): SettingItem[] {
   return [
     {
       id: ENABLED_ID,
       label: "Enabled",
-      description: "Review guarded commands. Off lets every command run without guardian review.",
+      description: "Review guarded commands. Off disables all gating, including deny rules.",
       currentValue: toggleValue(settings.enabled),
       values: TOGGLE_VALUES,
     },
@@ -181,6 +190,13 @@ export function buildSettingItems(
       currentValue: formatTimeout(timeoutValue(settings)),
       ...(submenus.timeout ? { submenu: submenus.timeout } : {}),
     },
+    {
+      id: REVIEW_CONCURRENCY_ID,
+      label: "Parallel reviews",
+      description: "How many guardian reviews may run at once. 1 reviews one command at a time, none ahead of its turn.",
+      currentValue: String(settings.reviewConcurrency),
+      values: concurrencyValues(settings.reviewConcurrency),
+    },
     {
       id: SYSTEM_PROMPT_ID,
       label: "System prompt",
@@ -196,15 +212,6 @@ export function buildSettingItems(
         submenu: submenus.recentDenials,
       }]
       : []),
-    ...(submenus.standingApprovals
-      ? [{
-        id: STANDING_APPROVALS_ID,
-        label: "Standing approvals",
-        description: "Comparable-command approvals shared across projects. Select one to revoke it.",
-        currentValue: standingApprovalCount === undefined ? "" : String(standingApprovalCount),
-        submenu: submenus.standingApprovals,
-      }]
-      : []),
   ];
 }
 
@@ -254,6 +261,15 @@ export function applySettingChange(
     return { kind: "settings", settings: next };
   }
 
+  if (id === REVIEW_CONCURRENCY_ID) {
+    const reviewConcurrency = Number(value);
+    if (!Number.isInteger(reviewConcurrency) || reviewConcurrency < 1 || reviewConcurrency > MAX_REVIEW_CONCURRENCY) {
+      return { kind: "error", message: `Parallel reviews must be a whole number from 1 to ${MAX_REVIEW_CONCURRENCY}` };
+    }
+    if (reviewConcurrency === settings.reviewConcurrency) return { kind: "ignored" };
+    return { kind: "settings", settings: { ...settings, reviewConcurrency } };
+  }
+
   // The model and timeout submenus commit their own edit and hand back display
   // text, so there is nothing left to map here.
   return { kind: "ignored" };
@@ -568,120 +584,6 @@ export function createDenialsSubmenu(host: DenialsSubmenuHost): NonNullable<Sett
   return (_currentValue, done) => new DenialsSubmenu(host, done);
 }
 
-export interface StandingApprovalSummary {
-  id: string;
-  record: StandingApprovalRecord;
-}
-
-export interface StandingApprovalsSubmenuHost {
-  standingApprovals(): StandingApprovalSummary[];
-  revokeStandingApproval(approval: StandingApprovalSummary): void;
-  settingsTheme: SettingsListTheme;
-  selectTheme: SelectListTheme;
-  requestRender(): void;
-}
-
-export function standingApprovalItem(approval: StandingApprovalSummary): SelectItem {
-  const command = approval.record.command.length > COMMAND_LABEL_MAX
-    ? `${approval.record.command.slice(0, COMMAND_LABEL_MAX - 1)}…`
-    : approval.record.command;
-  return {
-    value: approval.id,
-    label: command,
-    description: `${approval.record.gate.label} · granted ${approval.record.ts.slice(0, 10)} · ${approval.record.project}`,
-  };
-}
-
-class StandingApprovalsSubmenu implements Component {
-  private readonly approvals: StandingApprovalSummary[];
-  private list: SelectList;
-  private selected?: StandingApprovalSummary;
-
-  constructor(
-    private readonly host: StandingApprovalsSubmenuHost,
-    private readonly done: (value?: string) => void,
-  ) {
-    this.approvals = host.standingApprovals();
-    this.list = this.buildApprovalList();
-  }
-
-  private buildApprovalList(): SelectList {
-    const items = this.approvals.length
-      ? this.approvals.map(standingApprovalItem)
-      : [{ value: "", label: "(no standing approvals)", description: "Comparable-command approvals will appear here." }];
-    const list = new SelectList(items, 10, this.host.selectTheme);
-    list.onCancel = () => this.done(undefined);
-    list.onSelect = (item) => {
-      const approval = this.approvals.find((candidate) => candidate.id === item.value);
-      if (!approval) {
-        this.done(undefined);
-        return;
-      }
-      this.selected = approval;
-      this.list = this.buildConfirmList();
-      this.host.requestRender();
-    };
-    return list;
-  }
-
-  private buildConfirmList(): SelectList {
-    const list = new SelectList(
-      [
-        {
-          value: "revoke",
-          label: "Revoke",
-          description: "Removes this approval from the user-scoped standing ledger.",
-        },
-        { value: "back", label: "Back" },
-      ],
-      10,
-      this.host.selectTheme,
-    );
-    const back = () => {
-      this.selected = undefined;
-      this.list = this.buildApprovalList();
-      this.host.requestRender();
-    };
-    list.onCancel = back;
-    list.onSelect = (item) => {
-      if (item.value !== "revoke" || !this.selected) {
-        back();
-        return;
-      }
-      this.host.revokeStandingApproval(this.selected);
-      this.done(undefined);
-    };
-    return list;
-  }
-
-  invalidate(): void {
-    this.list.invalidate();
-  }
-
-  render(width: number): string[] {
-    const title = this.selected
-      ? `  Revoke standing approval?  ${truncateToWidth(this.selected.record.command, Math.max(1, width - 30))}`
-      : "  Standing approvals";
-    return [
-      truncateToWidth(this.host.settingsTheme.hint(title), width),
-      "",
-      ...this.list.render(width),
-      "",
-      truncateToWidth(this.host.settingsTheme.hint("  Enter to select · Esc to go back"), width),
-    ];
-  }
-
-  handleInput(data: string): void {
-    this.list.handleInput(data);
-  }
-}
-
-export function createStandingApprovalsSubmenu(
-  host: StandingApprovalsSubmenuHost,
-): NonNullable<SettingItem["submenu"]> {
-  return (_currentValue, done) => new StandingApprovalsSubmenu(host, done);
-}
-
 export function createTimeoutSubmenu(host: SubmenuHost): NonNullable<SettingItem["submenu"]> {
   return (currentValue, done) =>
     new PromptComponent(

package/usage-log.ts

@@ -1,9 +1,5 @@
-import { appendFileSync, chmodSync, mkdirSync, renameSync, statSync } from "node:fs";
 import { randomUUID } from "node:crypto";
-import { dirname } from "node:path";
-
-/** Rotate once the sidecar grows past this size; one previous generation is kept. */
-export const USAGE_LOG_ROTATE_BYTES = 16 * 1024 * 1024;
+import { appendJsonlRecord, SIDECAR_ROTATE_BYTES } from "./jsonl-sidecar.js";
 
 interface UsageLogTotals {
   input: number;
@@ -55,14 +51,13 @@ export function buildUsageLogRecord(
   model: string,
   usage: unknown,
   label = "guardian",
-  source = "auto-permissions",
   subagent = false,
 ): UsageLogRecord {
   return {
     v: 1,
     id: randomUUID(),
     ts: new Date().toISOString(),
-    source,
+    source: "auto-permissions",
     label,
     provider,
     model,
@@ -71,18 +66,6 @@ export function buildUsageLogRecord(
   };
 }
 
-function rotateIfLarge(path: string): void {
-  try {
-    if (statSync(path).size < USAGE_LOG_ROTATE_BYTES) return;
-    renameSync(path, `${path}.1`);
-  } catch {
-    // A missing or unrotatable sidecar simply keeps appending.
-  }
-}
-
 export function appendUsageRecord(path: string, record: UsageLogRecord): void {
-  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
-  rotateIfLarge(path);
-  appendFileSync(path, `${JSON.stringify(record)}\n`, { encoding: "utf8", mode: 0o600 });
-  chmodSync(path, 0o600);
+  appendJsonlRecord(path, record, SIDECAR_ROTATE_BYTES);
 }