@pugi/cli 0.1.0-beta.18 → 0.1.0-beta.19

package/dist/runtime/cli.js

@@ -28,7 +28,9 @@ import { runConfigCommand } from './commands/config.js';
 import { runPrivacyCommand } from './commands/privacy.js';
 import { runReport } from './commands/report.js';
 import { runDoctorCommand, defaultHome as defaultDoctorHome } from './commands/doctor.js';
+import { runStatusCommand, defaultStatusHome, } from './commands/status.js';
 import { runUndoCommand } from './commands/undo.js';
+import { runCompactCommand } from './commands/compact.js';
 import { runBudgetCommand } from './commands/budget.js';
 import { runSkillsCommand } from './commands/skills.js';
 import { installDefaultSkills } from '../core/skills/defaults.js';
@@ -39,6 +41,8 @@ import { runWorktreeCommand } from './commands/worktree.js';
 import { resolveWorkspaceLabel } from '../core/repl/workspace-context.js';
 import { runReviewConsensus } from './commands/review-consensus.js';
 import { runMcpCommand } from './commands/mcp.js';
+import { runPermissionsCommand } from './commands/permissions.js';
+import { parsePermissionMode } from '../core/permissions/index.js';
 import { DECOMPOSE_PROMPT_SUFFIX, parseDecompositionFromText, writeDecomposition, } from './plan-decompose.js';
 import { FtsSyntaxError, SqliteSessionStore, resolveProjectStoreDir } from '../core/repl/store/index.js';
 import { slugForCwd } from '../core/repl/history.js';
@@ -86,6 +90,8 @@ const handlers = {
     lsp: dispatchLsp,
     mcp: dispatchMcp,
     patch: dispatchPatch,
+    permissions: dispatchPermissions,
+    perms: dispatchPermissions,
     plan: runEngineTask('plan'),
     'plan-review': dispatchPlanReview,
     privacy: dispatchPrivacy,
@@ -98,8 +104,10 @@ const handlers = {
     roster: dispatchRoster,
     sessions,
     skills: dispatchSkills,
+    status,
     sync,
     undo: dispatchUndo,
+    compact: dispatchCompact,
     version,
     web: dispatchWeb,
     whoami,
@@ -353,12 +361,64 @@ async function dispatchUndo(args, flags, session) {
         writeOutput: (payload, text) => writeOutput(flags, payload, text),
     });
 }
+/**
+ * Leak L8 (2026-05-27) — `pugi compact` summarises older REPL turns
+ * into a single boundary marker, freeing context for the next `pugi
+ * resume <id>`. The slash `/compact` inside a live REPL forwards
+ * through the same runner via session.ts so the surface stays single-
+ * sourced.
+ */
+async function dispatchCompact(args, flags, _session) {
+    const result = await runCompactCommand(args, {
+        workspaceRoot: process.cwd(),
+        writeOutput: (payload, text) => writeOutput(flags, payload, text),
+    });
+    if (result.status === 'failed_no_session'
+        || result.status === 'failed_transport'
+        || result.status === 'failed_store') {
+        process.exitCode = 1;
+        return;
+    }
+    if (result.status === 'noop_empty' || result.status === 'noop_recent_marker') {
+        process.exitCode = 2;
+    }
+}
 async function dispatchBudget(args, flags, _session) {
     await runBudgetCommand(args, {
         workspaceRoot: process.cwd(),
         writeOutput: (payload, text) => writeOutput(flags, payload, text),
     });
 }
+/**
+ * Leak L6 — `pugi permissions [mode] [--persist] [--confirm]`.
+ *
+ * Surface the same intent as the in-REPL `/permissions` slash. Mode
+ * arg is positional; `--persist` and `--confirm` are zero-arg flags
+ * already consumed by `parseArgs` into `flags.persist` / `flags.confirm`.
+ *
+ * Examples:
+ *   pugi permissions                  -> show current mode + table
+ *   pugi permissions plan             -> flip workspace state to plan
+ *   pugi permissions allow --persist  -> flip + write ~/.pugi/config.json
+ *   pugi permissions bypass --confirm -> flip to bypass (acknowledge banner)
+ */
+async function dispatchPermissions(args, flags, _session) {
+    const head = args[0];
+    if (head && parsePermissionMode(head) === null) {
+        writeOutput(flags, { error: 'unknown_mode', mode: head }, `Unknown mode '${head}'. Allowed: plan, ask, allow, bypass.`);
+        process.exitCode = 1;
+        return;
+    }
+    const mode = head ? parsePermissionMode(head) : undefined;
+    await runPermissionsCommand({
+        ...(mode ? { mode } : {}),
+        persist: Boolean(flags.persist),
+        confirmBypass: Boolean(flags.confirm),
+    }, {
+        workspaceRoot: process.cwd(),
+        writeOutput: (text) => writeOutput(flags, { text }, text),
+    });
+}
 async function dispatchSkills(args, flags, _session) {
     await runSkillsCommand(args, {
         workspaceRoot: process.cwd(),
@@ -613,6 +673,11 @@ function parseArgs(argv) {
         // β-headless: --no-tools default OFF so existing flag-free invocations
         // keep tool advertisement. Flipped only by explicit operator opt-in.
         noTools: false,
+        // Leak L6 — `pugi permissions <mode> --persist/--confirm`. Default
+        // false so existing invocations stay no-op on the new permission
+        // surface.
+        persist: false,
+        confirm: false,
     };
     const args = [];
     // Sprint 2E: `pugi --version` / `-v` are universal install-test conventions
@@ -807,6 +872,32 @@ function parseArgs(argv) {
             flags.base = next;
             index += 1;
         }
+        else if (arg.startsWith('--mode=')) {
+            // Leak L6: top-level `--mode plan|ask|allow|bypass`. Validation
+            // happens at the consumer side (parsePermissionMode) so the
+            // parser stays string-typed; an invalid value surfaces a clean
+            // error in the dispatcher rather than blowing up here.
+            flags.mode = arg.slice('--mode='.length);
+        }
+        else if (arg === '--mode') {
+            const next = argv[index + 1];
+            if (!next || next.startsWith('--')) {
+                throw new Error('--mode requires plan|ask|allow|bypass');
+            }
+            flags.mode = next;
+            index += 1;
+        }
+        else if (arg === '--persist') {
+            // Leak L6: paired with `pugi permissions <mode>` to also write
+            // the mode to ~/.pugi/config.json::defaultPermissionMode.
+            flags.persist = true;
+        }
+        else if (arg === '--confirm') {
+            // Leak L6: required for `pugi permissions bypass` (bypass
+            // disables policy hooks; the gate refuses the flip without
+            // acknowledgement).
+            flags.confirm = true;
+        }
         else {
             args.push(arg);
         }
@@ -995,6 +1086,20 @@ const COMMAND_HELP_BODIES = {
         'event log, settings), permission mode, and the capability matrix per',
         'engine adapter. Safe to run anywhere; no network calls.',
     ],
+    status: [
+        'pugi status — concise session snapshot.',
+        '',
+        'Different from `pugi doctor` (environment health). Status answers',
+        '"what is this Pugi session doing right now?" — session id + age,',
+        'cwd, permission mode, CLI version, token usage, active + completed',
+        'dispatches, last command, compact boundary count, auth identity.',
+        '',
+        '  --json                  Emit a structured envelope to stdout.',
+        '',
+        'Live REPL state (tokens, last command) is only available via the',
+        'in-REPL `/status` slash; the shell path degrades those fields к',
+        '"n/a" and exits 0.',
+    ],
     report: [
         'pugi report — capture a bug report from the most-recent session.',
         '',
@@ -1133,6 +1238,30 @@ async function doctor(_args, flags, _session) {
         writeOutput: (payload, text) => writeOutput(flags, payload, text),
     });
 }
+/**
+ * `pugi status` — Leak L34 (2026-05-27). Concise session-state probe
+ * mirroring Claude Code's `/status`. Distinct from `pugi doctor`
+ * (environment health) — `status` answers "what is THIS Pugi
+ * session doing right now?" with session id + age, cwd, permission
+ * mode, CLI version, token usage, dispatch count, last command,
+ * compact boundaries, and auth identity.
+ *
+ * The top-level shell invocation has no live REPL state — fields
+ * that need a live session (`tokens`, `lastCommand`) degrade к the
+ * `n/a` sentinel. The same handler powers the in-REPL `/status`
+ * slash, which passes live state through `StatusCommandContext`.
+ *
+ * Always exits 0 — the command is informational, never a gate.
+ */
+async function status(_args, flags, _session) {
+    await runStatusCommand({
+        cwd: process.cwd(),
+        home: defaultStatusHome(),
+        env: process.env,
+        json: flags.json,
+        writeOutput: (payload, text) => writeOutput(flags, payload, text),
+    });
+}
 /**
  * Programmatic init scaffolder. Idempotent — every helper call is a
  * `*_IfMissing` write, so re-running over an existing .pugi/ workspace

package/dist/runtime/commands/compact.js

@@ -0,0 +1,296 @@
+/**
+ * `pugi compact` — top-level command + companion to the REPL slash.
+ *
+ * Summarises older events from the most recent SessionStore session
+ * into a single boundary marker, freeing context budget for the next
+ * REPL session that resumes the same id.
+ *
+ * Wire: writeOutput contract matches every other dispatch in cli.ts
+ * (one structured payload + one human line). Exit code:
+ *   0  — boundary marker appended
+ *   1  — summarizer transport failed / store unavailable
+ *   2  — no events to compact / nothing to do
+ *
+ * The companion REPL slash dispatches through this same runner so the
+ * surface stays single-sourced.
+ */
+import { homedir } from 'node:os';
+import { loadRuntimeConfig } from '@pugi/sdk';
+import { AnvilEngineLoopClient } from '../../core/engine/anvil-client.js';
+import { SqliteSessionStore, resolveProjectStoreDir, } from '../../core/repl/store/session-store.js';
+import { appendCompactBoundary, isCompactBoundary, } from '../../core/compact/buffer-rewriter.js';
+import { summarizeEvents, SummarizerError } from '../../core/compact/summarizer.js';
+/** Number of tail turns preserved verbatim on every compaction. */
+export const KEPT_TAIL_TURNS = 5;
+/** Minimum source events before we accept a compaction. */
+const MIN_EVENTS_TO_COMPACT = 6;
+/**
+ * Entry point reused by the slash command + the top-level dispatcher.
+ *
+ * The function is exhaustive: every early-exit branch produces a
+ * structured `CompactCommandResult` for the JSON path AND a one-line
+ * human message for the TTY path. Tests assert on the returned shape;
+ * the top-level dispatcher forwards it to `writeOutput`.
+ */
+export async function runCompactCommand(_args, ctx) {
+    const trigger = ctx.trigger ?? 'manual';
+    // Resolve the target session id. When the caller supplied a store
+    // (REPL slash path, tests) we trust it has the session bound; the
+    // standalone CLI path needs to discover the most-recent id via the
+    // read-only view + then open the live store on that id.
+    let store = ctx.store ?? null;
+    let sessionId = ctx.sessionId ?? null;
+    if (store === null) {
+        sessionId = sessionId ?? (await pickMostRecentSessionIdReadOnly(ctx.workspaceRoot));
+        if (!sessionId) {
+            return emit(ctx, {
+                command: 'compact',
+                status: 'failed_no_session',
+                trigger,
+                reason: 'No active session to compact. Start a REPL with `pugi`.',
+            });
+        }
+        store = await openStoreForCwd(ctx.workspaceRoot, sessionId);
+        if (!store) {
+            return emit(ctx, {
+                command: 'compact',
+                status: 'failed_no_session',
+                trigger,
+                reason: 'Local session store unavailable (lock held by REPL?).',
+            });
+        }
+    }
+    else if (sessionId === null) {
+        // Caller supplied a store but no session id — try to discover one.
+        sessionId = await pickMostRecentSessionId(store, ctx.workspaceRoot);
+        if (!sessionId) {
+            return emit(ctx, {
+                command: 'compact',
+                status: 'failed_no_session',
+                trigger,
+                reason: 'No active session to compact.',
+            });
+        }
+    }
+    // Snapshot the events. We pass `coversUntilOffset` as the count of
+    // events at the moment of the snapshot so the marker's anchor is
+    // accurate even if other writers race afterwards.
+    let events;
+    try {
+        events = await store.loadEvents(sessionId);
+    }
+    catch (error) {
+        return emit(ctx, {
+            command: 'compact',
+            status: 'failed_store',
+            sessionId,
+            trigger,
+            reason: `Could not load events: ${errMsg(error)}`,
+        });
+    }
+    if (events.length < MIN_EVENTS_TO_COMPACT) {
+        return emit(ctx, {
+            command: 'compact',
+            status: 'noop_empty',
+            sessionId,
+            trigger,
+            reason: `Only ${events.length} events on disk; need at least ${MIN_EVENTS_TO_COMPACT}.`,
+        });
+    }
+    // Locate the source slice: everything strictly after the latest
+    // compact-boundary, EXCLUDING the kept-tail window. If no prior
+    // boundary exists, walk from offset 0.
+    const lastBoundaryIdx = findLastCompactBoundaryIndex(events);
+    const sliceStart = lastBoundaryIdx === -1 ? 0 : lastBoundaryIdx + 1;
+    const sliceEnd = Math.max(sliceStart, events.length - KEPT_TAIL_TURNS);
+    const sourceSlice = events.slice(sliceStart, sliceEnd);
+    if (sourceSlice.length === 0) {
+        return emit(ctx, {
+            command: 'compact',
+            status: 'noop_recent_marker',
+            sessionId,
+            trigger,
+            reason: 'Conversation already compact — nothing new to fold.',
+        });
+    }
+    // Build the engine client. Production uses Anvil; tests inject a
+    // fixture client to avoid the network round-trip.
+    const engineClient = ctx.engineClient ?? buildAnvilClient();
+    if (!engineClient) {
+        return emit(ctx, {
+            command: 'compact',
+            status: 'failed_transport',
+            sessionId,
+            trigger,
+            reason: 'Could not build engine client (run `pugi login`).',
+        });
+    }
+    // Run the summariser.
+    let summary;
+    try {
+        summary = await summarizeEvents({
+            events: sourceSlice,
+            client: engineClient,
+            personaSlug: 'mira',
+        });
+    }
+    catch (error) {
+        const code = error instanceof SummarizerError ? error.code : 'unknown';
+        const message = error instanceof Error ? error.message : String(error);
+        return emit(ctx, {
+            command: 'compact',
+            status: 'failed_transport',
+            sessionId,
+            trigger,
+            reason: `Summarizer failed (${code}): ${message}`,
+        });
+    }
+    // Append the boundary marker. Recompute `coversUntilOffset` AFTER
+    // the summariser round-trip so any events that landed mid-flight
+    // fall into the kept-tail window — the operator does not lose work
+    // that arrived during compaction. The next event we append (the
+    // marker itself) lands at index `coversUntilOffset` in the on-disk
+    // log.
+    let postRoundTripEvents;
+    try {
+        postRoundTripEvents = await store.loadEvents(sessionId);
+    }
+    catch (error) {
+        return emit(ctx, {
+            command: 'compact',
+            status: 'failed_store',
+            sessionId,
+            trigger,
+            reason: `Could not refresh events: ${errMsg(error)}`,
+        });
+    }
+    const coversUntilOffset = postRoundTripEvents.length;
+    try {
+        await appendCompactBoundary({
+            store,
+            trigger,
+            summary: summary.summary,
+            summaryTokenCount: summary.tokensSummarised,
+            summaryTurnsBefore: summary.eventsSummarised,
+            keptTailTurns: KEPT_TAIL_TURNS,
+            coversUntilOffset,
+            ...(ctx.now !== undefined ? { now: ctx.now } : {}),
+        });
+    }
+    catch (error) {
+        return emit(ctx, {
+            command: 'compact',
+            status: 'failed_store',
+            sessionId,
+            trigger,
+            reason: `Could not append marker: ${errMsg(error)}`,
+        });
+    }
+    return emit(ctx, {
+        command: 'compact',
+        status: 'compacted',
+        sessionId,
+        trigger,
+        turnsBefore: summary.eventsSummarised,
+        tailKept: KEPT_TAIL_TURNS,
+        tokensSummarised: summary.tokensSummarised,
+    }, `Compacted ${summary.eventsSummarised} events (~${summary.tokensSummarised} tokens) into 1 summary. ` +
+        `Last ${KEPT_TAIL_TURNS} turns kept verbatim.`);
+}
+/* ------------------------------------------------------------------ */
+/* Helpers                                                            */
+/* ------------------------------------------------------------------ */
+/**
+ * Emit a payload through the context and return it for the caller. We
+ * keep the function exhaustive so every branch lands on the same
+ * writeOutput contract (JSON-mode + text-mode).
+ */
+function emit(ctx, payload, text) {
+    const human = text ?? payload.reason ?? `compact: ${payload.status}`;
+    ctx.writeOutput(payload, human);
+    return payload;
+}
+function findLastCompactBoundaryIndex(events) {
+    for (let i = events.length - 1; i >= 0; i -= 1) {
+        if (isCompactBoundary(events[i]))
+            return i;
+    }
+    return -1;
+}
+function errMsg(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+/**
+ * Open the SqliteSessionStore for the workspace's project slug and
+ * bind the active log to `sessionId`. Returns null when the open
+ * fails (lock contention, IO error, missing project dir).
+ *
+ * The PID lockfile contention is the expected failure mode here — a
+ * running REPL holds the lock, and `pugi compact` from a second
+ * terminal cannot grab it. The caller surfaces a clear message rather
+ * than crashing the dispatch.
+ */
+async function openStoreForCwd(workspaceRoot, sessionId) {
+    try {
+        const slug = projectSlugForCwd(workspaceRoot);
+        const store = new SqliteSessionStore({ projectSlug: slug, home: homedir() });
+        await store.open({
+            id: sessionId,
+            workspaceRoot,
+            projectSlug: slug,
+        });
+        return store;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Read-only-view variant of `pickMostRecentSessionId` for the
+ * pre-open phase. Walks `~/.pugi/projects/<slug>/session.db` without
+ * taking the lockfile so a live REPL in another terminal does not
+ * make discovery fail.
+ */
+async function pickMostRecentSessionIdReadOnly(workspaceRoot) {
+    try {
+        const slug = projectSlugForCwd(workspaceRoot);
+        const dir = resolveProjectStoreDir(slug, homedir());
+        const view = await SqliteSessionStore.openReadOnly(dir);
+        try {
+            const rows = await view.list({ project: slug, limit: 1, status: 'active' });
+            return rows.length > 0 ? rows[0].id : null;
+        }
+        finally {
+            await view.close();
+        }
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Locate the most recent active session for the workspace. Returns
+ * null when no session row exists.
+ */
+async function pickMostRecentSessionId(store, workspaceRoot) {
+    const slug = projectSlugForCwd(workspaceRoot);
+    const rows = await store.listSessions({ project: slug, limit: 1, status: 'active' });
+    if (rows.length === 0)
+        return null;
+    return rows[0].id;
+}
+function projectSlugForCwd(workspaceRoot) {
+    const base = workspaceRoot.split('/').filter((s) => s.length > 0).pop() ?? 'workspace';
+    return base.toLowerCase().replace(/[^a-z0-9-]/g, '-').slice(0, 64);
+}
+/**
+ * Construct an Anvil-backed engine client from env-resolved runtime
+ * config. Returns null when the operator is not authenticated.
+ */
+function buildAnvilClient() {
+    const config = loadRuntimeConfig();
+    if (!config)
+        return null;
+    return new AnvilEngineLoopClient(config);
+}
+//# sourceMappingURL=compact.js.map

package/dist/runtime/commands/doctor.js

@@ -48,6 +48,7 @@ import { probeGit } from '../../core/diagnostics/probes/git.js';
 import { probeMcp } from '../../core/diagnostics/probes/mcp.js';
 import { probeConfig } from '../../core/diagnostics/probes/config.js';
 import { probeSession } from '../../core/diagnostics/probes/session.js';
+import { probeDenialTracking } from '../../core/diagnostics/probes/denial-tracking.js';
 /**
  * Default API URL when no PUGI_API_URL env override is set. Mirrors
  * the constant in `core/credentials.ts` (kept local to avoid an
@@ -195,6 +196,16 @@ export function buildDefaultProbes(ctx, options = {}) {
                 ...(options.liveSessionId ? { liveSessionId: options.liveSessionId } : {}),
             }),
         },
+        // α7 L11 (2026-05-27): DENIAL TRACKING probe. Reports the live
+        // session's denial pressure when the REPL adapter wired the
+        // tracker through `runDoctorCommand`; degrades к `skipped` for
+        // top-level `pugi doctor` calls outside the REPL.
+        {
+            name: 'DENIAL TRACKING',
+            run: async () => probeDenialTracking({
+                ...(options.denialTracking ? { tracker: options.denialTracking } : {}),
+            }),
+        },
     ];
     return probes;
 }
@@ -211,6 +222,7 @@ export async function runDoctorCommand(ctx) {
     };
     const probes = buildDefaultProbes(probeCtx, {
         ...(ctx.liveSessionId ? { liveSessionId: ctx.liveSessionId } : {}),
+        ...(ctx.denialTracking ? { denialTracking: ctx.denialTracking } : {}),
     });
     const report = await runProbes(probes);
     // Defensive recompute: even though runProbes already computed the

package/dist/runtime/commands/permissions.js

@@ -0,0 +1,87 @@
+/**
+ * `pugi permissions` / `/permissions` — Leak L6 4-mode gate control.
+ *
+ * Two entry points share one runtime helper:
+ *   1. `/permissions` in the REPL — forwarded by `core/repl/session.ts`.
+ *   2. `pugi permissions ...` top-level CLI command (handler in
+ *      `runtime/cli.ts`).
+ *
+ * Both pass a `PermissionsCommand` payload describing the operator
+ * intent (show / flip / persist) and a `writeOutput` callback that
+ * lets the caller route the rendered lines into the right surface
+ * (REPL transcript vs. stdout). The helper is intentionally I/O-free
+ * itself — it produces lines and lets the caller stream them.
+ */
+import { DEFAULT_PERMISSION_MODE, PERMISSION_MODES, PERMISSION_MODE_GLOSS, getCurrentMode, getGlobalDefaultMode, setCurrentMode, setGlobalDefaultMode, } from '../../core/permissions/index.js';
+/**
+ * Run the `/permissions` or `pugi permissions` flow. Side effects:
+ *   - When `command.mode` is undefined: prints the current mode + the
+ *     4-mode table (no writes).
+ *   - When `command.mode === 'bypass'` without `confirmBypass`: prints
+ *     a refusal + the safety copy, no writes.
+ *   - When `command.mode` is set + valid: writes workspace session
+ *     state; optionally writes global default when `persist` is true.
+ *   - Always prints the new effective mode + a one-line confirmation.
+ */
+export async function runPermissionsCommand(command, ctx) {
+    if (!command.mode) {
+        renderCurrentMode(ctx);
+        renderModeTable(ctx);
+        return;
+    }
+    if (command.mode === 'bypass' && !command.confirmBypass) {
+        ctx.writeOutput('Bypass mode disables policy hooks (skill steering, denial tracking).');
+        ctx.writeOutput('Run `/permissions bypass --confirm` to acknowledge before flipping.');
+        return;
+    }
+    setCurrentMode(ctx.workspaceRoot, command.mode);
+    if (command.persist) {
+        setGlobalDefaultMode(command.mode, ctx.homeDir);
+    }
+    const persistedHint = command.persist
+        ? ' Persisted to ~/.pugi/config.json for future sessions.'
+        : '';
+    ctx.writeOutput(`Permission mode set to '${command.mode}'.${persistedHint} ${PERMISSION_MODE_GLOSS[command.mode]}`);
+    if (command.mode === 'bypass') {
+        ctx.writeOutput('BYPASS MODE — all tools execute without prompts AND policy hooks disabled. Switch back with /permissions allow.');
+    }
+}
+/**
+ * Print the resolved current mode + the layered source. The merge
+ * order mirrors `resolveMode()`: workspace > global > default.
+ */
+function renderCurrentMode(ctx) {
+    const workspace = getCurrentMode(ctx.workspaceRoot);
+    const global = getGlobalDefaultMode(ctx.homeDir);
+    const effective = workspace ?? global ?? DEFAULT_PERMISSION_MODE;
+    const source = workspace
+        ? 'workspace session.json'
+        : global
+            ? 'global ~/.pugi/config.json'
+            : 'default (no override)';
+    ctx.writeOutput(`Current permission mode: ${effective} (source: ${source})`);
+}
+/**
+ * Print the 4-mode reference table. Keeps the gloss + the side-effect
+ * matrix in one place so the operator can see the contract while they
+ * decide which mode to switch to.
+ */
+function renderModeTable(ctx) {
+    ctx.writeOutput('');
+    ctx.writeOutput('Permission modes:');
+    for (const mode of PERMISSION_MODES) {
+        ctx.writeOutput(`  ${mode.padEnd(7)}  ${PERMISSION_MODE_GLOSS[mode]}`);
+    }
+    ctx.writeOutput('');
+    ctx.writeOutput('Switch with `/permissions <mode> [--persist]`. Bypass requires `--confirm`.');
+}
+/**
+ * Render the one-shot banner shown on session boot when the effective
+ * mode is `bypass`. The caller (engine adapter / REPL bootstrap) calls
+ * this once per session — repeated invocations are idempotent in copy
+ * but the caller is responsible for the once-only semantics.
+ */
+export function renderBypassBanner(writeOutput) {
+    writeOutput('BYPASS MODE — all tools execute without prompts AND policy hooks disabled. Switch back with /permissions allow.');
+}
+//# sourceMappingURL=permissions.js.map