@wrongstack/cli 1.0.24 → 1.0.26

package/dist/fleet/host-types.d.ts

@@ -3,7 +3,7 @@ import type { BrainArbiter, ProviderModelStatusTracker } from '@wrongstack/core/
 import type { HookRunner } from '@wrongstack/core/hooks';
 import type { Container, EventBus } from '@wrongstack/core/kernel';
 import type { ProviderRegistry, ToolRegistry } from '@wrongstack/core/registry';
-import type { ConfigStore, ModelsRegistry, Renderer, SecretScrubber, SessionWriter, SkillLoader, SystemPromptBuilder, TokenCounter } from '@wrongstack/core/types';
+import type { ConfigStore, ModelsRegistry, Renderer, SecretScrubber, SessionWriter, SkillLoader, SystemPromptBuilder, TokenCounter, Tracer } from '@wrongstack/core/types';
 export interface MultiAgentDeps {
     container: Container;
     toolRegistry: ToolRegistry;
@@ -23,6 +23,8 @@ export interface MultiAgentDeps {
     projectRoot: string;
     cwd: string;
     secretScrubber: SecretScrubber;
+    /** OTLP tracer shared with the leader, so worker runs join its traces. */
+    tracer?: Tracer | undefined;
     /** Loader used to resolve the roster's per-role skill names. */
     skillLoader?: SkillLoader | undefined;
     renderer?: Renderer | undefined;

package/dist/goal-commands.d.ts

@@ -0,0 +1,47 @@
+/** Async `fs.access`-style existence check — never throws. */
+export declare function pathExists(p: string): Promise<boolean>;
+/**
+ * Cap on captured command output. Verification commands (`pnpm test` across
+ * a large monorepo) can emit tens of MB on a verbose run — accumulating the
+ * full transcript spikes the host heap for output nothing ever reads in
+ * full. runCmd keeps the TAIL (the failure summary lives at the end of a
+ * test run); gitText keeps the head (its commands are tiny).
+ */
+export declare const MAX_CMD_OUTPUT = 200000;
+/** Run a git command, returning trimmed stdout (empty string on failure). */
+export declare function gitText(args: string[], cwd: string): Promise<{
+    code: number;
+    out: string;
+}>;
+export declare function isGitRepo(cwd: string): Promise<boolean>;
+export declare const GOAL_BASE_SAFE_CMDS: ReadonlySet<string>;
+export declare let goalAllowed: Set<string>;
+/**
+ * Extend/trim the autonomous goal command allowlist from the user's exec
+ * policy. Mirrors `configureExecPolicy` but keeps goal's narrower base.
+ * Idempotent (always rebuilt from the base).
+ */
+export declare function configureGoalPolicy(opts?: {
+    allow?: readonly string[] | undefined;
+    deny?: readonly string[] | undefined;
+}): void;
+/** Reset the goal allowlist to its built-in base (tests / re-init). */
+export declare function resetGoalPolicy(): void;
+/** Whether `cmd` may run in autonomous goal verification. */
+export declare function isGoalCommandAllowed(cmd: string): boolean;
+export declare const DESTRUCTIVE_PATTERNS: readonly RegExp[];
+/** Run an arbitrary command, capturing combined stdout+stderr. */
+export declare function runCmd(cmd: string, args: string[], cwd: string, shell?: boolean): Promise<{
+    code: number;
+    out: string;
+}>;
+/**
+ * Detect the project's package manager from lockfiles at the repo root.
+ * Async so the verify-step boot path doesn't block the event loop on `stat`
+ * for missing files in CWD or in monorepo setups where the lockfile lives
+ * several levels up.
+ */
+export declare function detectPackageManager(root: string): Promise<string>;
+/** Read package.json scripts for a directory (empty on any failure). */
+export declare function readScripts(cwd: string): Promise<Record<string, string>>;
+//# sourceMappingURL=goal-commands.d.ts.map

package/dist/goal-host.d.ts

@@ -1,3 +1,4 @@
+export { configureGoalPolicy, isGoalCommandAllowed, resetGoalPolicy } from './goal-commands.js';
 /**
  * Goal host wiring for the CLI.
  *
@@ -20,19 +21,6 @@ import { type PhaseGraph, type PhaseProgress } from '@wrongstack/core/goal';
 import type { EventBus } from '@wrongstack/core/kernel';
 import type { Config, TaskNode } from '@wrongstack/core/types';
 import type { MultiAgentHost } from './multi-agent.js';
-/**
- * Extend/trim the autonomous goal command allowlist from the user's exec
- * policy. Mirrors `configureExecPolicy` but keeps goal's narrower base.
- * Idempotent (always rebuilt from the base).
- */
-export declare function configureGoalPolicy(opts?: {
-    allow?: readonly string[] | undefined;
-    deny?: readonly string[] | undefined;
-}): void;
-/** Reset the goal allowlist to its built-in base (tests / re-init). */
-export declare function resetGoalPolicy(): void;
-/** Whether `cmd` may run in autonomous goal verification. */
-export declare function isGoalCommandAllowed(cmd: string): boolean;
 export interface GoalHostDeps {
     multiAgentHost: MultiAgentHost;
     /** Read the *current* Config lazily (it may be patched, e.g. YOLO toggles). */
@@ -103,5 +91,4 @@ export interface GoalHostHooks {
     onWorktree: (action: 'list' | 'merge' | 'prune' | 'clean', target?: string) => Promise<string>;
 }
 export declare function createGoalHost(deps: GoalHostDeps): GoalHostHooks;
-export {};
 //# sourceMappingURL=goal-host.d.ts.map

package/dist/{hq-JTUTFI4L.js → hq-GLZ7QESM.js}

@@ -1,6 +1,3 @@
-import {
-  parseTokenTtlValue
-} from "./chunk-UZ2TMHNH.js";
 import {
   resolveHqPasswordInput
 } from "./chunk-AUQDGU5D.js";
@@ -11,6 +8,9 @@ import {
 import {
   parseHqIpAllowlist
 } from "./chunk-Q7E3BPDU.js";
+import {
+  parseTokenTtlValue
+} from "./chunk-UZ2TMHNH.js";
 
 // src/subcommands/handlers/hq.ts
 import {
@@ -316,7 +316,7 @@ var hqCmd = async (args, deps) => {
     return hqAlertsCmd(args.slice(1), deps);
   }
   if (sub === "service") {
-    const { hqServiceCmd } = await import("./hq-service-NW56MUP2.js");
+    const { hqServiceCmd } = await import("./hq-service-BMMJAHRT.js");
     return hqServiceCmd(args.slice(1), deps);
   }
   if (sub === "help" || sub === "--help") {
@@ -329,7 +329,7 @@ var hqCmd = async (args, deps) => {
   return 1;
 };
 async function startServer(deps) {
-  const { startHqServer } = await import("./hq-server-PC7GZMPT.js");
+  const { startHqServer } = await import("./hq-server-YTKDVQPY.js");
   const dataDir = resolveDataDir(deps);
   const flags = deps.flags ?? {};
   const rawPublicUrl = typeof flags["hq-public-url"] === "string" ? flags["hq-public-url"] : process.env.WRONGSTACK_HQ_PUBLIC_URL;
@@ -1003,4 +1003,4 @@ export {
   hqCmd,
   resolveAuditActor
 };
-//# sourceMappingURL=hq-JTUTFI4L.js.map
+//# sourceMappingURL=hq-GLZ7QESM.js.map

package/dist/{hq-server-PC7GZMPT.js → hq-server-YTKDVQPY.js}

@@ -10,7 +10,7 @@ import {
   readLocalSubagentTranscript,
   sanitizeApiError,
   startHqServer
-} from "./chunk-DRM7PSW7.js";
+} from "./chunk-OAVBM55Q.js";
 import "./chunk-HXJYHAR4.js";
 import "./chunk-5EA6OTLJ.js";
 import "./chunk-Q7E3BPDU.js";
@@ -27,4 +27,4 @@ export {
   sanitizeApiError,
   startHqServer
 };
-//# sourceMappingURL=hq-server-PC7GZMPT.js.map
+//# sourceMappingURL=hq-server-YTKDVQPY.js.map

package/dist/{hq-service-NW56MUP2.js → hq-service-BMMJAHRT.js}

@@ -4,10 +4,10 @@ import {
 import {
   detectUpdatePackageManager,
   detectUpdatePackageName
-} from "./chunk-QFPQXKCG.js";
+} from "./chunk-KOEO4CJG.js";
 import "./chunk-U3SS4NRH.js";
-import "./chunk-ZZRSG7VK.js";
-import "./chunk-YBUCXXYZ.js";
+import "./chunk-RZ4ZDRYA.js";
+import "./chunk-F5DCFAKI.js";
 
 // src/hq-service.ts
 import { spawn } from "node:child_process";
@@ -511,4 +511,4 @@ export {
   hqServiceCmd,
   renderHqServiceAssets
 };
-//# sourceMappingURL=hq-service-NW56MUP2.js.map
+//# sourceMappingURL=hq-service-BMMJAHRT.js.map

package/dist/import-claude-code-32PCSIQI.js

@@ -0,0 +1,236 @@
+import {
+  normalizeMcpServerEntry
+} from "./chunk-HLSHFXTO.js";
+import {
+  activeProfileConfigPath
+} from "./chunk-YMXXOOFN.js";
+import {
+  restoreFlags
+} from "./chunk-CSAPOCBP.js";
+
+// src/subcommands/handlers/import-claude-code.ts
+import * as fs from "node:fs/promises";
+import * as os from "node:os";
+import * as path from "node:path";
+import { readJsonObjectFile, setJsonPath, updateJsonObjectFile } from "@wrongstack/core/utils";
+import { mcpEnvPlaceholders } from "@wrongstack/mcp";
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function samePath(a, b) {
+  const norm = (p) => {
+    const resolved = path.resolve(p).replace(/[\\/]+$/, "");
+    return process.platform === "win32" ? resolved.toLowerCase() : resolved;
+  };
+  return norm(a) === norm(b);
+}
+function projectEntry(userState, projectRoot) {
+  const projects = userState?.["projects"];
+  if (!isRecord(projects)) return void 0;
+  for (const [key, value] of Object.entries(projects)) {
+    if (isRecord(value) && samePath(key, projectRoot)) return value;
+  }
+  return void 0;
+}
+function planClaudeCodeImport(opts) {
+  const { sources } = opts;
+  const mcp = [];
+  const seen = /* @__PURE__ */ new Set();
+  const collect = (servers, source) => {
+    if (!isRecord(servers)) return;
+    for (const [name, raw] of Object.entries(servers)) {
+      if (seen.has(name)) continue;
+      seen.add(name);
+      let config;
+      try {
+        config = normalizeMcpServerEntry(name, raw);
+      } catch (err) {
+        mcp.push({
+          name,
+          source,
+          config: {},
+          action: "skip-invalid",
+          enabled: false,
+          note: err.message
+        });
+        continue;
+      }
+      const exists2 = Object.hasOwn(opts.existingServers, name);
+      const repository = source === "repository";
+      const enabled = !repository || opts.enableProjectServers;
+      const reads = mcpEnvPlaceholders(config);
+      const notes2 = [
+        repository && !enabled ? "from the repository \u2014 imported disabled; review, then `/mcp enable`" : void 0,
+        reads.length > 0 ? `reads environment: ${reads.join(", ")}` : void 0
+      ].filter((note) => note !== void 0);
+      mcp.push({
+        name,
+        source,
+        config,
+        action: exists2 ? opts.overwrite ? "overwrite" : "skip-exists" : "add",
+        enabled,
+        ...notes2.length > 0 ? { note: notes2.join("; ") } : {}
+      });
+    }
+  };
+  collect(
+    projectEntry(sources.userState, opts.projectRoot)?.["mcpServers"],
+    "claude-project-local"
+  );
+  collect(sources.projectMcp?.["mcpServers"] ?? sources.projectMcp, "repository");
+  collect(sources.userState?.["mcpServers"], "claude-user");
+  const notes = [];
+  if (sources.skillDirs.length > 0) {
+    notes.push(
+      `Skills: ${sources.skillDirs.join(", ")} \u2014 already loaded in place (skills.readClaudeSkills); nothing to copy.`
+    );
+  }
+  let hookCount = 0;
+  let ruleCount = 0;
+  for (const { content } of sources.settings) {
+    const hooks = content["hooks"];
+    if (isRecord(hooks)) {
+      for (const list of Object.values(hooks)) if (Array.isArray(list)) hookCount += list.length;
+    }
+    const permissions = content["permissions"];
+    if (isRecord(permissions)) {
+      for (const key of ["allow", "deny", "ask"]) {
+        const list = permissions[key];
+        if (Array.isArray(list)) ruleCount += list.length;
+      }
+    }
+  }
+  if (hookCount > 0) {
+    notes.push(
+      `Hooks: ${hookCount} found \u2014 not imported (matcher semantics differ). Recreate under config.hooks; see docs/hooks.md.`
+    );
+  }
+  if (ruleCount > 0) {
+    notes.push(
+      `Permission rules: ${ruleCount} found \u2014 not imported (a mistranslated deny is worse than none). Use /permissions or --allowed-tools/--disallowed-tools.`
+    );
+  }
+  for (const file of sources.instructionFiles) {
+    notes.push(
+      `Instructions: ${file} \u2014 not imported. Project context lives in .wrongstack/AGENTS.md; merge what applies there.`
+    );
+  }
+  return { mcp, notes };
+}
+async function readJson(file) {
+  let raw;
+  try {
+    raw = await fs.readFile(file, "utf8");
+  } catch {
+    return void 0;
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    return isRecord(parsed) ? parsed : void 0;
+  } catch {
+    throw new Error(`${file} is not valid JSON`);
+  }
+}
+async function exists(p) {
+  try {
+    await fs.access(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function readClaudeCodeSources(projectRoot, userHome = os.homedir()) {
+  const settingsFiles = [
+    path.join(userHome, ".claude", "settings.json"),
+    path.join(projectRoot, ".claude", "settings.json"),
+    path.join(projectRoot, ".claude", "settings.local.json")
+  ];
+  const settings = [];
+  for (const file of settingsFiles) {
+    const content = await readJson(file);
+    if (content) settings.push({ file, content });
+  }
+  const instructionCandidates = [
+    path.join(userHome, ".claude", "CLAUDE.md"),
+    path.join(projectRoot, "CLAUDE.md"),
+    path.join(projectRoot, ".claude", "CLAUDE.md")
+  ];
+  const skillCandidates = [
+    path.join(userHome, ".claude", "skills"),
+    path.join(projectRoot, ".claude", "skills")
+  ];
+  return {
+    userState: await readJson(path.join(userHome, ".claude.json")),
+    projectMcp: await readJson(path.join(projectRoot, ".mcp.json")),
+    settings,
+    instructionFiles: (await Promise.all(instructionCandidates.map(async (f) => await exists(f) ? f : null))).filter((f) => f !== null),
+    skillDirs: (await Promise.all(skillCandidates.map(async (d) => await exists(d) ? d : null))).filter((d) => d !== null)
+  };
+}
+var SOURCE_LABEL = {
+  "claude-user": "~/.claude.json (user)",
+  "claude-project-local": "~/.claude.json (this project)",
+  repository: ".mcp.json (repository)"
+};
+var importClaudeCodeCmd = async (args, deps) => {
+  args = restoreFlags(args, deps, ["apply", "overwrite", "enable-project-servers"]);
+  const apply = args.includes("--apply");
+  const overwrite = args.includes("--overwrite");
+  const enableProjectServers = args.includes("--enable-project-servers");
+  let sources;
+  try {
+    sources = await readClaudeCodeSources(deps.projectRoot, deps.userHome);
+  } catch (err) {
+    deps.renderer.writeError(`import-claude-code: ${err.message}`);
+    return 1;
+  }
+  const configPath = activeProfileConfigPath(deps.paths, deps.config);
+  const current = await readJsonObjectFile(configPath);
+  const existingServers = isRecord(current["mcpServers"]) ? current["mcpServers"] : {};
+  const plan = planClaudeCodeImport({
+    sources,
+    projectRoot: deps.projectRoot,
+    existingServers,
+    overwrite,
+    enableProjectServers
+  });
+  const out = (line) => deps.renderer.write(`${line}
+`);
+  out(apply ? "Importing from Claude Code:" : "Claude Code import preview (nothing written):");
+  if (plan.mcp.length === 0) out("  MCP servers: none found");
+  for (const c of plan.mcp) {
+    const state = c.action.startsWith("skip") ? "" : c.enabled ? " [enabled]" : " [disabled]";
+    const verb = {
+      add: "add",
+      overwrite: "overwrite",
+      "skip-exists": "skip (exists; --overwrite to replace)",
+      "skip-invalid": "skip (invalid)"
+    }[c.action];
+    out(`  MCP ${c.name} \u2014 ${verb}${state} \u2014 ${SOURCE_LABEL[c.source]}`);
+    if (c.note) out(`      ${c.note}`);
+  }
+  for (const note of plan.notes) out(`  ${note}`);
+  const writes = plan.mcp.filter((c) => c.action === "add" || c.action === "overwrite");
+  if (!apply) {
+    if (writes.length > 0)
+      out(`
+Run with --apply to write ${writes.length} server(s) to ${configPath}.`);
+    return 0;
+  }
+  if (writes.length > 0) {
+    await updateJsonObjectFile(configPath, (config) => {
+      for (const c of writes) {
+        setJsonPath(config, ["mcpServers", c.name], { ...c.config, enabled: c.enabled });
+      }
+    });
+  }
+  out(`
+Wrote ${writes.length} server(s) to ${configPath}.`);
+  return 0;
+};
+export {
+  importClaudeCodeCmd,
+  planClaudeCodeImport,
+  readClaudeCodeSources
+};
+//# sourceMappingURL=import-claude-code-32PCSIQI.js.map

package/dist/index.js

@@ -2,28 +2,32 @@
 import {
   applyNodeEnvDefault,
   applySessionShellDefault
-} from "./chunk-QBBF7GIK.js";
-import {
-  parseArgs
-} from "./chunk-MHEBWVXL.js";
+} from "./chunk-LBPLTTZ6.js";
 import {
   CLI_VERSION
-} from "./chunk-YBUCXXYZ.js";
+} from "./chunk-F5DCFAKI.js";
+import {
+  parseArgs
+} from "./chunk-Q4INH2DG.js";
 
 // src/cli-entry-main.ts
 async function main(argv) {
   applyNodeEnvDefault();
   applySessionShellDefault();
   const earlyFlags = parseArgs(argv).flags;
+  if (earlyFlags["ascii"] === true || process.env["WRONGSTACK_TUI_ICON_STYLE"]) {
+    const { applyAsciiMode } = await import("./ascii-mode-SG4PRNLP.js");
+    applyAsciiMode(earlyFlags);
+  }
   if (earlyFlags["help"] === true || earlyFlags["version"] === true) {
-    const { handleHelpVersionShortCircuit } = await import("./short-circuit-flags-SDT53OML.js");
+    const { handleHelpVersionShortCircuit } = await import("./short-circuit-flags-74Y5N6CF.js");
     const earlyExit = await handleHelpVersionShortCircuit(argv);
     if (earlyExit !== null) return earlyExit;
   }
-  const { initializeCli } = await import("./cli-context-34Q5IJRA.js");
+  const { initializeCli } = await import("./cli-context-UVGAN3NO.js");
   const cliCtx = await initializeCli(argv);
   if (typeof cliCtx === "number") return cliCtx;
-  const { runInteractive } = await import("./cli-main-AELJDBGU.js");
+  const { runInteractive } = await import("./cli-main-TN3KZ2P6.js");
   return runInteractive(cliCtx);
 }
 

package/dist/{mailbox-serve-WDOCH6KR.js → mailbox-serve-NW5VZG7R.js}

@@ -1,7 +1,7 @@
 import {
   startCliHqConnection
-} from "./chunk-BLD5DSVA.js";
-import "./chunk-YBUCXXYZ.js";
+} from "./chunk-KJS5543T.js";
+import "./chunk-F5DCFAKI.js";
 
 // src/subcommands/handlers/mailbox-serve.ts
 import { createServer } from "node:http";
@@ -361,4 +361,4 @@ function printHelp(deps) {
 export {
   mailboxServeCmd
 };
-//# sourceMappingURL=mailbox-serve-WDOCH6KR.js.map
+//# sourceMappingURL=mailbox-serve-NW5VZG7R.js.map

package/dist/{modeldiag-36OGAL5C.js → modeldiag-36VODVIH.js}

@@ -1,6 +1,9 @@
 import {
   applyProviderOAuthRefresh
-} from "./chunk-3OCUS3VN.js";
+} from "./chunk-LDCGZJTC.js";
+import {
+  discoverAndMergeProviders
+} from "./chunk-D5GB5MHA.js";
 import {
   checkMark,
   costLabel,
@@ -15,18 +18,15 @@ import {
   scoreBar,
   speedLabel
 } from "./chunk-BBHWW6LR.js";
-import {
-  discoverAndMergeProviders
-} from "./chunk-D5GB5MHA.js";
-import {
-  activeProfileConfigPath
-} from "./chunk-YMXXOOFN.js";
 import {
   resolveRawProviderConnection
 } from "./chunk-S4FFHDJG.js";
 import {
   mutateConfigProviders
 } from "./chunk-LUMETJFO.js";
+import {
+  activeProfileConfigPath
+} from "./chunk-YMXXOOFN.js";
 
 // src/subcommands/handlers/modeldiag.ts
 import * as fs from "node:fs/promises";
@@ -825,4 +825,4 @@ var modeldiagCmd = async (args, deps) => {
 export {
   modeldiagCmd
 };
-//# sourceMappingURL=modeldiag-36OGAL5C.js.map
+//# sourceMappingURL=modeldiag-36VODVIH.js.map

package/dist/{per-subcommand-help-XE77MTGJ.js → per-subcommand-help-QDAQASPZ.js}

@@ -7,7 +7,7 @@ import {
   renderFocusedHelpToString,
   renderGenericHelp,
   subcommandsWithFocusedHelp
-} from "./chunk-SKPDE62W.js";
+} from "./chunk-EPR42SWM.js";
 import "./chunk-YTEOAWOJ.js";
 export {
   deepSubcommandsWithFocusedHelp,
@@ -19,4 +19,4 @@ export {
   renderGenericHelp,
   subcommandsWithFocusedHelp
 };
-//# sourceMappingURL=per-subcommand-help-XE77MTGJ.js.map
+//# sourceMappingURL=per-subcommand-help-QDAQASPZ.js.map

package/dist/permission-prompt.d.ts

@@ -2,6 +2,14 @@ import type { InputReader, Tool } from '@wrongstack/core/types';
 type PromptDecision = 'yes' | 'no' | 'always' | 'always-exact' | 'always-command' | 'always-tool' | 'deny';
 /** Signature the Agent expects for confirming tool calls. */
 export type ConfirmAwaiter = (tool: Tool, input: unknown, toolUseId: string, suggestedPattern: string) => Promise<'yes' | 'no' | 'always' | 'always-exact' | 'always-command' | 'always-tool' | 'deny'>;
+/**
+ * Approval "prompt" for a process with no terminal on stdin — a script, CI,
+ * `wstack "task" < /dev/null`, piped input. Nobody can answer, and the
+ * terminal prompt used to wait for a key that never came, so the run hung
+ * until it was killed. Refuse instead, and say on stderr (stdout may be a
+ * JSON payload) how to grant it up front.
+ */
+export declare function makeHeadlessPromptDelegate(write?: (text: string) => void): (tool: Tool) => Promise<PromptDecision>;
 /**
  * The terminal approval prompt.
  *
@@ -16,6 +24,12 @@ export declare function makePromptDelegate(reader: InputReader): (tool: Tool, in
  * Create a ConfirmAwaiter for the CLI path. Wraps makePromptDelegate
  * with the ConfirmAwaiter type signature expected by the Agent.
  */
+/**
+ * The terminal prompt when stdin is a terminal, the headless refusal
+ * otherwise. Both approval paths (policy prompt and executor confirm) go
+ * through this, so neither can wait on a keypress nobody can make.
+ */
+export declare function makeStdinPromptDelegate(reader: InputReader, stdinIsTTY?: boolean): ReturnType<typeof makePromptDelegate>;
 export declare function makeConfirmAwaiter(reader: InputReader): ConfirmAwaiter;
 export {};
 //# sourceMappingURL=permission-prompt.d.ts.map

package/dist/permission-rules-view.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Text views of the permission rule list and of one explained call, shared by
+ * `wstack permissions` and the in-session `/permissions` command.
+ */
+import type { Context } from '@wrongstack/core/agent';
+import type { PermissionPolicy, PermissionRule, PermissionTrace, Tool } from '@wrongstack/core/types';
+export interface ExplainedCall {
+    trace: PermissionTrace;
+    rules: PermissionRule[];
+    /** The rule that decided the call. */
+    rule: PermissionRule | undefined;
+}
+/** Trace one call through the policy and the executor's gate, and name its rule. */
+export declare function explainCall(policy: Pick<PermissionPolicy, 'explain' | 'listRules'>, tool: Tool, input: unknown, ctx: Context, yolo: boolean): Promise<ExplainedCall>;
+export declare function describePermissionRule(rule: PermissionRule): string;
+export declare function formatPermissionRules(rules: readonly PermissionRule[]): string;
+export declare function formatExplainedCall({ trace, rule }: ExplainedCall): string;
+//# sourceMappingURL=permission-rules-view.d.ts.map