@yagni-app/code 0.1.0 → 0.2.1

package/dist/extension/mcpTools.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Workspace MCP servers in YAGNI Code (YAG-446).
+ *
+ * The workspace's registered MCP servers (Connections → MCP Servers) are
+ * the config source: at session start we fetch the list from the backend
+ * and register one pi tool per enabled server tool, named with the same
+ * `mcp_<slug>__<tool>` wire shape the backend executor parses. Calls
+ * execute THROUGH the backend (`POST /api/yagni-code/mcp/call`), so
+ * credentials never reach this machine and the backend's egress guard,
+ * autonomy gate, per-user credential policy, and audit trail all apply.
+ *
+ * Everything here is fail-soft against an older backend or an
+ * un-rescoped token: a 403/404/network failure on the list fetch means
+ * no MCP tools and no startup error.
+ */
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+export interface McpToolInfo {
+    name: string;
+    description: string | null;
+    inputSchema: unknown;
+    riskClass: string;
+}
+export interface McpServerInfo {
+    slug: string;
+    name: string;
+    tools: McpToolInfo[];
+    viewerCredential: {
+        source: "user" | "workspace";
+    };
+}
+export interface McpClientOpts {
+    baseUrl: string;
+    getToken: () => string | undefined;
+    fetchImpl?: typeof fetch;
+}
+export declare function mcpWireToolName(slug: string, tool: string): string;
+/**
+ * Fetch the workspace's MCP servers. Fail-soft by design: any non-OK
+ * response (older backend without the endpoints, token minted before the
+ * `yagni_code:mcp` scope existed) or transport error returns `[]`.
+ */
+export declare function fetchMcpServers(opts: McpClientOpts): Promise<McpServerInfo[]>;
+/**
+ * Register every reachable MCP tool. Returns the wire names of MUTATING
+ * tools so the caller can extend the permission-gate policy — plan mode
+ * holds them, review mode confirms them, exactly like write/edit/bash.
+ */
+export declare function registerMcpTools(pi: ExtensionAPI, servers: McpServerInfo[], opts: McpClientOpts): {
+    mutatingToolNames: string[];
+};
+/** Render the /mcp listing (pure, for tests). */
+export declare function renderMcpListing(servers: McpServerInfo[], baseUrl: string): string;
+/** Wire the `/mcp` command: list servers, tools, and credential status. */
+export declare function registerMcpCommand(pi: ExtensionAPI, servers: McpServerInfo[], opts: {
+    baseUrl: string;
+}): void;
+//# sourceMappingURL=mcpTools.d.ts.map

package/dist/extension/mcpTools.js

@@ -0,0 +1,132 @@
+import { Type } from "typebox";
+import { friendlyFetchError, METERED_POST_FETCH_POLICY, resilientFetch } from "./resilientFetch.js";
+export function mcpWireToolName(slug, tool) {
+    return `mcp_${slug}__${tool}`;
+}
+/**
+ * Fetch the workspace's MCP servers. Fail-soft by design: any non-OK
+ * response (older backend without the endpoints, token minted before the
+ * `yagni_code:mcp` scope existed) or transport error returns `[]`.
+ */
+export async function fetchMcpServers(opts) {
+    try {
+        const res = await resilientFetch(`${opts.baseUrl}/api/yagni-code/mcp/servers`, {
+            method: "GET",
+            headers: { authorization: `Bearer ${opts.getToken() ?? ""}` },
+        }, { fetchImpl: opts.fetchImpl });
+        if (!res.ok)
+            return [];
+        const data = (await res.json());
+        if (!Array.isArray(data.servers))
+            return [];
+        return data.servers;
+    }
+    catch {
+        return [];
+    }
+}
+function schemaFor(tool) {
+    const schema = tool.inputSchema;
+    if (schema !== null &&
+        typeof schema === "object" &&
+        !Array.isArray(schema) &&
+        Object.keys(schema).length > 0) {
+        // MCP inputSchemas are plain JSON Schema objects, which is exactly what
+        // TypeBox schemas are at runtime — pass the server's schema through so
+        // the model sees real parameter shapes.
+        return schema;
+    }
+    return Type.Object({}, { additionalProperties: true });
+}
+function makeMcpTool(server, tool, opts) {
+    const wireName = mcpWireToolName(server.slug, tool.name);
+    return {
+        name: wireName,
+        label: `${server.name}: ${tool.name}`,
+        description: `${tool.description ?? `MCP tool ${tool.name}`} ` +
+            `(MCP server "${server.name}", risk: ${tool.riskClass}; runs through YAGNI)`,
+        parameters: schemaFor(tool),
+        async execute(_toolCallId, params, signal) {
+            const res = await resilientFetch(`${opts.baseUrl}/api/yagni-code/mcp/call`, {
+                method: "POST",
+                headers: {
+                    "content-type": "application/json",
+                    authorization: `Bearer ${opts.getToken() ?? ""}`,
+                },
+                body: JSON.stringify({
+                    slug: server.slug,
+                    tool: tool.name,
+                    args: params ?? {},
+                }),
+            }, { fetchImpl: opts.fetchImpl, signal, policy: METERED_POST_FETCH_POLICY });
+            if (!res.ok) {
+                throw new Error(await friendlyFetchError(wireName, res));
+            }
+            const result = (await res.json());
+            if (!result.success) {
+                const suffix = result.errorCode === "user_credential_required"
+                    ? ` Bind your token at ${opts.baseUrl}/services/mcp.`
+                    : "";
+                throw new Error(`${result.error ?? "MCP tool call failed"}${suffix}`);
+            }
+            const text = typeof result.result === "string"
+                ? result.result
+                : JSON.stringify(result.result ?? null, null, 2);
+            return {
+                content: [{ type: "text", text }],
+                details: { riskClass: tool.riskClass },
+            };
+        },
+    };
+}
+/**
+ * Register every reachable MCP tool. Returns the wire names of MUTATING
+ * tools so the caller can extend the permission-gate policy — plan mode
+ * holds them, review mode confirms them, exactly like write/edit/bash.
+ */
+export function registerMcpTools(pi, servers, opts) {
+    const mutatingToolNames = [];
+    for (const server of servers) {
+        for (const tool of server.tools) {
+            pi.registerTool(makeMcpTool(server, tool, opts));
+            if (tool.riskClass !== "read_only") {
+                mutatingToolNames.push(mcpWireToolName(server.slug, tool.name));
+            }
+        }
+    }
+    return { mutatingToolNames };
+}
+/** Render the /mcp listing (pure, for tests). */
+export function renderMcpListing(servers, baseUrl) {
+    if (servers.length === 0) {
+        return [
+            "No MCP servers connected for this workspace.",
+            `An admin can register one under Connections: ${baseUrl}/services/mcp`,
+        ].join("\n");
+    }
+    const lines = ["Workspace MCP servers:"];
+    for (const server of servers) {
+        const mutating = server.tools.filter((t) => t.riskClass !== "read_only").length;
+        const credential = server.viewerCredential.source === "user"
+            ? "connected as you"
+            : "workspace credential";
+        lines.push(`  ${server.name} (${server.slug}) — ${server.tools.length} tool${server.tools.length === 1 ? "" : "s"}` +
+            `${mutating > 0 ? ` (${mutating} mutating)` : ""} · ${credential}`);
+        for (const tool of server.tools) {
+            lines.push(`    ${mcpWireToolName(server.slug, tool.name)} [${tool.riskClass}]`);
+        }
+    }
+    lines.push(`Bind a personal token (writes carry your authority): ${baseUrl}/services/mcp`);
+    return lines.join("\n");
+}
+/** Wire the `/mcp` command: list servers, tools, and credential status. */
+export function registerMcpCommand(pi, servers, opts) {
+    pi.registerCommand("mcp", {
+        description: "List this workspace's MCP servers, their tools, and your credential status.",
+        handler: async (_args, ctx) => {
+            if (ctx.hasUI)
+                ctx.ui.notify(renderMcpListing(servers, opts.baseUrl), "info");
+        },
+    });
+}
+//# sourceMappingURL=mcpTools.js.map

package/dist/extension/nextWorkTool.d.ts

@@ -0,0 +1,51 @@
+import type { ToolDefinition } from "@earendil-works/pi-coding-agent";
+import { Type } from "typebox";
+import type { Citation } from "./askYagniTool.js";
+/** Options for {@link makeSuggestNextWorkTool}. */
+export interface MakeNextWorkToolOptions {
+    baseUrl: string;
+    getToken: () => string | undefined;
+    fetchImpl?: typeof fetch;
+}
+/** A single offered next action: its id, the label shown, and the editor prompt it prefills. */
+export interface NextActionOption {
+    id: "suggest_next_work" | "bootstrap" | "review";
+    /** Short label shown in the selector. */
+    label: string;
+    /** The message prefilled into the editor when this action is chosen. */
+    prompt: string;
+}
+/**
+ * The one default next action plus its escape hatches. `primary` is the single
+ * most-likely thing to do (ask @yagni what to work on next); `escapeHatches` are
+ * the two alternatives (bootstrap a first ticket, or review the working diff).
+ * This is deliberately a ONE-default-plus-hatches shape, NOT a flat four-option
+ * chooser — defaults over choices (spec §7.3).
+ */
+export interface DefaultNextAction {
+    primary: NextActionOption;
+    escapeHatches: NextActionOption[];
+}
+/**
+ * Build the default next action offered after the init pass. The recommended
+ * default is `suggest_next_work` ("ask @yagni what to work on next"); the escape
+ * hatches are "bootstrap a first ticket and /go" and "review this diff". Pure so
+ * the presenter can render it without a network.
+ */
+export declare function defaultNextAction(): DefaultNextAction;
+declare const parameters: Type.TObject<{
+    context: Type.TOptional<Type.TString>;
+}>;
+/**
+ * Build the `suggest_next_work` tool.
+ *
+ * Asks the YAGNI app for the highest-value next thing to work on, RANKED BY
+ * BUSINESS PRIORITY across open work-items and desk next-moves (not by ticket
+ * order), with the business case for the top pick. Returns a ranked
+ * recommendation plus citations.
+ */
+export declare function makeSuggestNextWorkTool(opts: MakeNextWorkToolOptions): ToolDefinition<typeof parameters, {
+    citations: Citation[];
+}>;
+export {};
+//# sourceMappingURL=nextWorkTool.d.ts.map

package/dist/extension/nextWorkTool.js

@@ -0,0 +1,80 @@
+import { Type } from "typebox";
+import { friendlyFetchError, METERED_POST_FETCH_POLICY, resilientFetch } from "./resilientFetch.js";
+/**
+ * Build the default next action offered after the init pass. The recommended
+ * default is `suggest_next_work` ("ask @yagni what to work on next"); the escape
+ * hatches are "bootstrap a first ticket and /go" and "review this diff". Pure so
+ * the presenter can render it without a network.
+ */
+export function defaultNextAction() {
+    return {
+        primary: {
+            id: "suggest_next_work",
+            label: "Ask @yagni what to work on next (recommended)",
+            prompt: "What should I work on next?",
+        },
+        escapeHatches: [
+            {
+                id: "bootstrap",
+                label: "Bootstrap: pick a first ticket and /go",
+                prompt: "Pick a good first ticket to bootstrap on, then run /go on it.",
+            },
+            {
+                id: "review",
+                label: "Review this diff",
+                prompt: "Review the current working-tree diff for business fit and correctness.",
+            },
+        ],
+    };
+}
+const parameters = Type.Object({
+    context: Type.Optional(Type.String()),
+});
+/**
+ * Build the `suggest_next_work` tool.
+ *
+ * Asks the YAGNI app for the highest-value next thing to work on, RANKED BY
+ * BUSINESS PRIORITY across open work-items and desk next-moves (not by ticket
+ * order), with the business case for the top pick. Returns a ranked
+ * recommendation plus citations.
+ */
+export function makeSuggestNextWorkTool(opts) {
+    return {
+        name: "suggest_next_work",
+        label: "Suggest next work",
+        description: "Ask YAGNI what to work on next, ranked by BUSINESS priority across open work-items " +
+            "and desk next-moves (not just ticket order), with the business case for the top " +
+            "pick and a concrete first step. Optionally pass a `context` to focus the ranking " +
+            "(e.g. 'revenue this week'). Use when deciding what to pick up.",
+        promptSnippet: "suggest_next_work: ask YAGNI for the highest-value next task, ranked by business priority.",
+        promptGuidelines: [
+            "Call suggest_next_work when the user asks what to do next or when you've finished and need the next task.",
+            "Pass a `context` if the user has a focus (a goal, a deadline, an area) so the ranking reflects it.",
+            "Present the recommendation with its business case; let the user confirm before starting.",
+        ],
+        parameters,
+        async execute(_toolCallId, params, signal, onUpdate, ctx) {
+            onUpdate?.({
+                content: [{ type: "text", text: "Ranking the highest-value next work…" }],
+                details: { citations: [] },
+            });
+            const res = await resilientFetch(`${opts.baseUrl}/api/yagni-code/next-action`, {
+                method: "POST",
+                headers: {
+                    "content-type": "application/json",
+                    authorization: `Bearer ${opts.getToken() ?? ""}`,
+                },
+                body: JSON.stringify({ context: params.context, cwd: ctx?.cwd }),
+            }, { fetchImpl: opts.fetchImpl, signal, policy: METERED_POST_FETCH_POLICY });
+            if (!res.ok) {
+                throw new Error(await friendlyFetchError("suggest_next_work", res));
+            }
+            const data = (await res.json());
+            return {
+                content: [{ type: "text", text: data.suggestion }],
+                details: { citations: data.citations ?? [] },
+            };
+        },
+    };
+}
+//# sourceMappingURL=nextWorkTool.js.map

package/dist/extension/permission.d.ts

@@ -0,0 +1,91 @@
+/**
+ * P3 - interactive permission tiers + plan mode, wired to pi's tool-call gate.
+ *
+ * YAGNI Code registers no tool_call handler today, so the interactive session has
+ * no plan/approval surface. P3 adds one on pi's documented `tool_call` block seam
+ * plus a `/mode` command:
+ *   - auto   (default): never blocks. Byte-identical to today, so this is additive.
+ *   - plan   : blocks write/edit/bash so the agent can explore + propose without
+ *              touching the tree.
+ *   - review : surfaces a three-way ctx.ui.select before a write/edit/bash; a
+ *              session bless (policy.isBlessed) auto-approves an action the user
+ *              already OK'd for this tool + directory, so only novel actions
+ *              prompt. Picking "Yes, and don't ask again for <tool> in <dir>"
+ *              adds a session-scoped bless rule AND drafts a decision capture.
+ *
+ * `decideGate` is PURE; the live wiring holds the mode in a small closure (no
+ * module-global state). The default auto mode remains fail-open, but stricter
+ * modes fail closed for side-effect tools if the gate itself errors. Bless rules
+ * are session-scoped, path-prefix-bound, never persisted, and never consulted in
+ * plan mode (plan blocks outright before isBlessed is reached).
+ *
+ * Plan mode is a full mode, not just a blocker: while active, every agent turn
+ * carries a hidden [PLAN MODE ACTIVE] context message so the model plans
+ * instead of flailing against held writes, and a footer chip shows the mode.
+ * When the mode leaves plan, stale plan-context messages are filtered out of
+ * the context so the model doesn't keep believing it is restricted.
+ */
+import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { type BlessStore } from "./bless.js";
+export type PermissionMode = "auto" | "plan" | "review";
+/** Which tools each tier acts on, plus the optional grounding-bless predicate. */
+export interface PermissionPolicy {
+    /** Tools blocked outright in plan mode (write/exec). */
+    planBlockTools: string[];
+    /** Tools that prompt for confirmation in review mode. */
+    reviewConfirmTools: string[];
+    /**
+     * Optional: a recorded decision already blesses this action, so it auto-runs in
+     * review mode instead of prompting. The hook for tying the gate to captured
+     * judgment; default undefined (nothing pre-blessed).
+     */
+    isBlessed?: (toolName: string, params: Record<string, unknown>) => boolean;
+}
+export declare const DEFAULT_PERMISSION_POLICY: PermissionPolicy;
+/** A pure gate verdict: block outright, ask to confirm, or allow. */
+export interface GateDecision {
+    block: boolean;
+    reason?: string;
+    /** review mode only: the caller should ctx.ui.confirm before allowing. */
+    confirm?: boolean;
+}
+/**
+ * Pure permission decision for one tool call under a mode + policy. auto always
+ * allows; plan blocks the write/exec set; review marks writes for confirmation
+ * unless a recorded decision blesses them.
+ */
+export declare function decideGate(toolName: string, params: Record<string, unknown>, mode: PermissionMode, policy: PermissionPolicy): GateDecision;
+/** What was blessed with "don't ask again", handed to the capture hook. */
+export interface BlessRememberInfo {
+    tool: string;
+    /** A human-readable directory label (cwd-relative when inside the tree). */
+    dir: string;
+}
+export interface RegisterPermissionDeps {
+    policy?: PermissionPolicy;
+    /** Initial mode (default auto). */
+    mode?: PermissionMode;
+    /** Session bless store factory (needs the cwd from the first tool_call). */
+    makeBlessStore?: (cwd: string) => BlessStore;
+    /**
+     * Called (fire-and-forget) when the user picks "Yes, and don't ask again".
+     * The judgment-capture hook: draft a decision so YAGNI remembers. Fail-soft;
+     * never blocks the approved tool call.
+     */
+    onBlessRemember?: (ctx: ExtensionContext, info: BlessRememberInfo) => void | Promise<void>;
+}
+/** The customType tag on injected plan-mode context (filterable later). */
+export declare const PLAN_CONTEXT_TYPE = "yagni-plan-context";
+export declare const PLAN_CONTEXT_MESSAGE = "[PLAN MODE ACTIVE]\nYou are in plan mode: explore and design, change nothing.\n- write, edit, and bash are held by the permission gate; do not attempt them.\n- Read, search, and ask_yagni freely to ground the plan in how this company works.\n- Produce a concrete numbered plan of the steps you would take, with the files involved.\n- End by asking the user to review the plan; they run /mode auto (or /mode review) to execute it.\n- Once executing, track the plan's steps with todo_write.";
+/**
+ * Drop previously injected plan-mode context once plan mode is off, so the
+ * model stops believing writes are held. Pure; returns the SAME array when
+ * nothing needs filtering so callers can cheaply detect a no-op.
+ */
+export declare function filterStalePlanContext<T>(messages: T[]): T[];
+/**
+ * Wire the tool_call gate + the /mode command onto a shared mode holder. Default
+ * auto, so absent any /mode this is a no-op over today's behavior.
+ */
+export declare function registerPermissionGate(pi: ExtensionAPI, deps?: RegisterPermissionDeps): void;
+//# sourceMappingURL=permission.d.ts.map

package/dist/extension/permission.js

@@ -0,0 +1,236 @@
+/**
+ * P3 - interactive permission tiers + plan mode, wired to pi's tool-call gate.
+ *
+ * YAGNI Code registers no tool_call handler today, so the interactive session has
+ * no plan/approval surface. P3 adds one on pi's documented `tool_call` block seam
+ * plus a `/mode` command:
+ *   - auto   (default): never blocks. Byte-identical to today, so this is additive.
+ *   - plan   : blocks write/edit/bash so the agent can explore + propose without
+ *              touching the tree.
+ *   - review : surfaces a three-way ctx.ui.select before a write/edit/bash; a
+ *              session bless (policy.isBlessed) auto-approves an action the user
+ *              already OK'd for this tool + directory, so only novel actions
+ *              prompt. Picking "Yes, and don't ask again for <tool> in <dir>"
+ *              adds a session-scoped bless rule AND drafts a decision capture.
+ *
+ * `decideGate` is PURE; the live wiring holds the mode in a small closure (no
+ * module-global state). The default auto mode remains fail-open, but stricter
+ * modes fail closed for side-effect tools if the gate itself errors. Bless rules
+ * are session-scoped, path-prefix-bound, never persisted, and never consulted in
+ * plan mode (plan blocks outright before isBlessed is reached).
+ *
+ * Plan mode is a full mode, not just a blocker: while active, every agent turn
+ * carries a hidden [PLAN MODE ACTIVE] context message so the model plans
+ * instead of flailing against held writes, and a footer chip shows the mode.
+ * When the mode leaves plan, stale plan-context messages are filtered out of
+ * the context so the model doesn't keep believing it is restricted.
+ */
+import { makeBlessStore as defaultMakeBlessStore } from "./bless.js";
+export const DEFAULT_PERMISSION_POLICY = {
+    planBlockTools: ["write", "edit", "bash"],
+    reviewConfirmTools: ["write", "edit", "bash"],
+};
+/**
+ * Pure permission decision for one tool call under a mode + policy. auto always
+ * allows; plan blocks the write/exec set; review marks writes for confirmation
+ * unless a recorded decision blesses them.
+ */
+export function decideGate(toolName, params, mode, policy) {
+    if (mode === "auto")
+        return { block: false };
+    if (mode === "plan") {
+        if (policy.planBlockTools.includes(toolName)) {
+            return {
+                block: true,
+                reason: `plan mode: ${toolName} is a write or exec action and is held. Switch to /mode auto to apply changes.`,
+            };
+        }
+        return { block: false };
+    }
+    // review
+    if (policy.reviewConfirmTools.includes(toolName)) {
+        if (policy.isBlessed?.(toolName, params))
+            return { block: false };
+        return { block: false, confirm: true };
+    }
+    return { block: false };
+}
+/** The customType tag on injected plan-mode context (filterable later). */
+export const PLAN_CONTEXT_TYPE = "yagni-plan-context";
+const PLAN_MARKER = "[PLAN MODE ACTIVE]";
+export const PLAN_CONTEXT_MESSAGE = `${PLAN_MARKER}
+You are in plan mode: explore and design, change nothing.
+- write, edit, and bash are held by the permission gate; do not attempt them.
+- Read, search, and ask_yagni freely to ground the plan in how this company works.
+- Produce a concrete numbered plan of the steps you would take, with the files involved.
+- End by asking the user to review the plan; they run /mode auto (or /mode review) to execute it.
+- Once executing, track the plan's steps with todo_write.`;
+function mentionsPlanMarker(content) {
+    if (typeof content === "string")
+        return content.includes(PLAN_MARKER);
+    if (Array.isArray(content)) {
+        return content.some((c) => typeof c?.text === "string" &&
+            (c.text.includes(PLAN_MARKER)));
+    }
+    return false;
+}
+/**
+ * Drop previously injected plan-mode context once plan mode is off, so the
+ * model stops believing writes are held. Pure; returns the SAME array when
+ * nothing needs filtering so callers can cheaply detect a no-op.
+ */
+export function filterStalePlanContext(messages) {
+    const keep = messages.filter((m) => {
+        const msg = m;
+        if (msg?.customType === PLAN_CONTEXT_TYPE)
+            return false;
+        if (msg?.role === "user" && mentionsPlanMarker(msg.content))
+            return false;
+        return true;
+    });
+    return keep.length === messages.length ? messages : keep;
+}
+const MODE_STATUS = {
+    auto: undefined,
+    plan: "⏸ plan",
+    review: "✓ review",
+};
+const MODE_COPY = {
+    auto: "auto: changes apply without prompting (default).",
+    plan: "plan: write, edit, and bash are held so the agent can explore and propose only.",
+    review: "review: you confirm each write, edit, or bash command before it applies.",
+};
+function isMode(value) {
+    return value === "auto" || value === "plan" || value === "review";
+}
+function sideEffectTools(policy) {
+    return new Set([...policy.planBlockTools, ...policy.reviewConfirmTools]);
+}
+/**
+ * Wire the tool_call gate + the /mode command onto a shared mode holder. Default
+ * auto, so absent any /mode this is a no-op over today's behavior.
+ */
+export function registerPermissionGate(pi, deps = {}) {
+    const basePolicy = deps.policy ?? DEFAULT_PERMISSION_POLICY;
+    let mode = deps.mode ?? "auto";
+    const makeStore = deps.makeBlessStore ?? defaultMakeBlessStore;
+    // The session bless store is created lazily on the first tool_call (it needs
+    // the cwd). Its isBlessed backs the review-mode auto-approve, UNLESS the caller
+    // injected its own isBlessed (e.g. a test policy) — that always wins.
+    let blessStore = null;
+    const effectivePolicy = {
+        planBlockTools: basePolicy.planBlockTools,
+        reviewConfirmTools: basePolicy.reviewConfirmTools,
+        isBlessed: basePolicy.isBlessed ?? ((tool, params) => blessStore?.isBlessed(tool, params) ?? false),
+    };
+    const sideEffects = sideEffectTools(effectivePolicy);
+    pi.on("tool_call", async (event, ctx) => {
+        try {
+            const input = event.input ?? {};
+            const decision = decideGate(event.toolName, input, mode, effectivePolicy);
+            if (decision.block)
+                return { block: true, reason: decision.reason };
+            if (decision.confirm) {
+                // Review mode needs a confirmation. With no dialog-capable UI (headless),
+                // fail CLOSED: the user explicitly chose a stricter mode, so a write we
+                // cannot get consent for is held rather than silently auto-applied (this
+                // mirrors plan mode, which blocks regardless of UI).
+                if (!ctx?.hasUI) {
+                    return { block: true, reason: `review mode: ${event.toolName} held (no UI to confirm). Switch to /mode auto to apply.` };
+                }
+                // Lazily bind the bless store to this session's cwd.
+                if (!blessStore)
+                    blessStore = makeStore(ctx.cwd ?? ".");
+                // Three-way prompt (pi's confirm is boolean-only, so use select): Yes,
+                // Yes-and-remember (only when a path-prefix bless is meaningful), or No.
+                const dir = blessStore.describeDir(input);
+                const blessable = dir !== null;
+                const yes = "Yes";
+                const no = "No";
+                const remember = blessable
+                    ? `Yes, and don't ask again for ${event.toolName} in ${dir}`
+                    : undefined;
+                const options = blessable ? [yes, remember, no] : [yes, no];
+                const choice = await ctx.ui.select("YAGNI Code review mode", options);
+                if (choice === yes)
+                    return {};
+                if (blessable && choice === remember) {
+                    // Session-scoped bless, then a fire-and-forget decision capture so the
+                    // approved tool call is never delayed by the capture prompt.
+                    blessStore.add(event.toolName, input);
+                    if (deps.onBlessRemember) {
+                        void Promise.resolve(deps.onBlessRemember(ctx, { tool: event.toolName, dir: dir })).catch(() => { });
+                    }
+                    return {};
+                }
+                // "No" or a dismissed dialog (undefined) → held.
+                return { block: true, reason: `declined ${event.toolName} in review mode` };
+            }
+            return {};
+        }
+        catch {
+            if (mode !== "auto" && sideEffects.has(event.toolName)) {
+                return {
+                    block: true,
+                    reason: `permission gate failed while ${mode} mode was active; held ${event.toolName}. Switch to /mode auto to apply.`,
+                };
+            }
+            return {};
+        }
+    });
+    // Model awareness: while plan mode is on, every agent start carries a hidden
+    // plan-mode context message so the model plans instead of attempting held
+    // writes. Off-plan turns inject nothing.
+    pi.on("before_agent_start", async () => {
+        if (mode !== "plan")
+            return;
+        return {
+            message: { customType: PLAN_CONTEXT_TYPE, content: PLAN_CONTEXT_MESSAGE, display: false },
+        };
+    });
+    // Once plan mode is off, strip the stale plan context so the model does not
+    // keep believing writes are held.
+    pi.on("context", async (event) => {
+        if (mode === "plan")
+            return;
+        const filtered = filterStalePlanContext(event.messages);
+        if (filtered === event.messages)
+            return;
+        return { messages: filtered };
+    });
+    const paintMode = (ctx) => {
+        try {
+            if (ctx.hasUI)
+                ctx.ui.setStatus?.("yagni-mode", MODE_STATUS[mode]);
+        }
+        catch {
+            // The chip is chrome; never let it break /mode.
+        }
+    };
+    pi.registerCommand("mode", {
+        description: "Set the permission tier: /mode auto | plan | review. No argument shows the current mode.",
+        handler: async (args, ctx) => {
+            const notify = (m, t) => {
+                if (ctx.hasUI)
+                    ctx.ui.notify(m, t);
+            };
+            const arg = args.trim().toLowerCase();
+            if (!arg) {
+                notify(`Permission mode is ${mode}. ${MODE_COPY[mode]}`, "info");
+                return;
+            }
+            if (!isMode(arg)) {
+                notify(`Unknown mode "${arg}". Use auto, plan, or review.`, "warning");
+                return;
+            }
+            const leavingPlan = mode === "plan" && arg !== "plan";
+            mode = arg;
+            paintMode(ctx);
+            notify(`Permission mode set to ${mode}. ${MODE_COPY[mode]}`, "info");
+            if (leavingPlan) {
+                notify("Plan mode off. Tell the agent to execute the plan; it tracks steps with /todos.", "info");
+            }
+        },
+    });
+}
+//# sourceMappingURL=permission.js.map