@yagni-app/code 1.0.7 → 1.0.9

package/README.md

@@ -203,7 +203,18 @@ prefix instead of `claude_code`:
 - **Log events:** `user_prompt`, `assistant_response`, `api_request`,
   `api_error`, `tool_result`, `tool_decision`, `permission_mode_changed`
   (as `event.name`, body `yagni_code.<name>`), with `session.id`,
-  `organization.id`, `terminal.type`, and a per-prompt `prompt.id`.
+  `organization.id`, `user.email`, `terminal.type`, and a per-prompt
+  `prompt.id`.
+
+Every signal carries `organization.id` (the workspace) and `user.email` (the
+signed-in developer's account email, learned from the backend at session
+start) so a collector can attribute sessions and spend per person. The LLM
+span additionally declares `user.email` as a Datadog cost tag (the
+`_dd.ml_obs.metadata` attribute, `{"_dd":{"cost_tags":["user.email"]}}`), so
+Datadog's LLM Observability Cost page offers it under Custom Tags → Group by
+and breaks spend down per developer. `OTEL_METRICS_INCLUDE_ACCOUNT_UUID=false`
+drops the email, and that declaration, from all three signals. Prompt,
+response, and tool content never export.
 
 Nothing is exported unless you configure an endpoint. Enable it one of three
 ways (first match wins):

package/dist/extension/askUserQuestionTool.js

@@ -24,7 +24,11 @@ import { logAskQuestion } from "./diagnostics.js";
 const TOOL_NAME = "ask_user_question";
 /** Claude mirrors this as ASK_USER_QUESTION_TOOL_CHIP_WIDTH. */
 const CHIP_WIDTH = 12;
-/** Same fail-closed ceiling as the permission-gate ask. */
+/** Cancel an unanswered question after 2 minutes. This is the structured
+ * QUESTION tool's own UX cap — NOT the permission-ask contract (gate asks
+ * wait indefinitely per Claude Code parity; see agent-safety.md). A stale
+ * question auto-cancels so the agent's turn cannot hang on a chip nobody
+ * is looking at; the user can always re-ask. */
 const ASK_TIMEOUT_MS = 120_000;
 /** Sentinel value representing the "Other" row in the multi-select toggle set. */
 const OTHER_KEY = "__other__";
@@ -523,7 +527,8 @@ async function askOne(ctx, q, qIndex) {
             return;
         }
         ctx.signal?.addEventListener("abort", onAbort, { once: true });
-        // Best-effort timeout, mirroring the permission-gate ask fail-closed.
+        // Best-effort timeout: this surface's own 2-minute question cap (the
+        // permission-gate ask deliberately has none — see ASK_TIMEOUT_MS above).
         const timer = setTimeout(() => settle({ status: "cancelled" }), ASK_TIMEOUT_MS);
         void ctx.ui
             .custom((_tui, theme, keybindings, done) => {

package/dist/extension/config.d.ts

@@ -127,6 +127,12 @@ export interface ContextBrief {
      * The opt-in mining beat fires ONLY on an explicit 0.
      */
     repoDecisionCount?: number;
+    /**
+     * The signed-in developer's account email (additive; absent on older
+     * backends). Feeds the OTel export's `user.email` attribute when the
+     * launcher did not already forward one.
+     */
+    userEmail?: string;
 }
 /**
  * Attribution headers for the model proxy (YAG-471). On the SERVER side these

package/dist/extension/hooks.d.ts

@@ -26,8 +26,8 @@ export interface HookEntry {
 export interface HookGroup {
     matcher?: string;
     hooks: HookEntry[];
-    /** Where this group was loaded from. Project-level groups are gated on workspace trust. */
-    _source?: "user" | "project";
+    /** Where this group was loaded from. Project AND local groups are gated on workspace trust. */
+    _source?: "user" | "project" | "local";
 }
 /** The hooks section of config.json. */
 export type HooksConfig = Record<string, HookGroup[]>;
@@ -55,7 +55,7 @@ export interface HookRunner {
     preToolUse(toolName: string, input: Record<string, unknown>, cwd: string, trusted?: boolean): Promise<PreToolUseHookResult>;
     permissionRequest(toolName: string, input: Record<string, unknown>, cwd: string, trusted?: boolean): Promise<PermissionRequestHookResult>;
 }
-/** Read and merge hooks config from user and project files. Pure I/O, fail-soft. */
+/** Read and merge hooks config from user, project, and local files. Pure I/O, fail-soft. */
 export declare function loadHooksConfig(userHome?: string, cwd?: string, env?: NodeJS.ProcessEnv): HooksConfig;
 /**
  * Check if a matcher matches a tool name. Matches Claude Code / Codex:

package/dist/extension/hooks.js

@@ -36,7 +36,7 @@ const SUPPORTED_EVENTS = [
 // ---------------------------------------------------------------------------
 // Config loading
 // ---------------------------------------------------------------------------
-/** Read and merge hooks config from user and project files. Pure I/O, fail-soft. */
+/** Read and merge hooks config from user, project, and local files. Pure I/O, fail-soft. */
 export function loadHooksConfig(userHome = homedir(), cwd = process.cwd(), env = process.env) {
     if (env.YAGNI_CODE_EVAL_MODE === "1")
         return {};
@@ -47,6 +47,13 @@ export function loadHooksConfig(userHome = homedir(), cwd = process.cwd(), env =
     // Project-level: .yagni-code/config.json — tagged for trust gating at execution time
     const projectPath = join(cwd, ".yagni-code", "config.json");
     mergeHooksFromFile(merged, projectPath, "project");
+    // Local-level: .yagni-code/config.local.json — the personal per-project
+    // tier. Trust-gated like project (NOT always-trusted): a hostile repo can
+    // COMMIT a local file — the gitignore convention only covers untracked
+    // files. Deliberately stricter than Claude Code, which does not
+    // trust-gate its localSettings hooks.
+    const localPath = join(cwd, ".yagni-code", "config.local.json");
+    mergeHooksFromFile(merged, localPath, "local");
     return merged;
 }
 function mergeHooksFromFile(merged, path, source) {
@@ -68,8 +75,20 @@ function mergeHooksFromFile(merged, path, source) {
             }
         }
     }
-    catch {
-        // Fail-soft: missing or malformed config is logged and skipped.
+    catch (err) {
+        // Fail-soft: missing or malformed config is skipped — and LOGGED: a
+        // corrupt local/project config silently dropping its hooks (including
+        // deny-enforcing ones) with zero signal is undiagnosable. Path + error
+        // class only, matching loadConfig.ts's warning behavior.
+        logEvent({
+            source: "hooks",
+            level: "warn",
+            event: "config_warning",
+            fields: {
+                path,
+                error: err instanceof Error ? err.constructor.name : typeof err,
+            },
+        });
     }
 }
 function isValidHookGroup(value) {
@@ -297,11 +316,17 @@ function logHookEvent(env, payload) {
         fields,
     });
 }
-/** Filter hook groups by workspace trust: project-level groups are skipped when untrusted. */
+/**
+ * Filter hook groups by workspace trust: project AND local groups are
+ * skipped when untrusted. Local is gated exactly like project (not like the
+ * always-trusted user tier) because a hostile repo can COMMIT a
+ * config.local.json — the global-gitignore convention only covers
+ * untracked files. Deliberately stricter than Claude Code's localSettings.
+ */
 function filterByTrust(groups, isTrusted) {
     if (isTrusted)
         return groups;
-    return groups.filter((g) => g._source !== "project");
+    return groups.filter((g) => g._source !== "project" && g._source !== "local");
 }
 /**
  * Create a HookRunner for injection into the permission gate. The `isTrusted`

package/dist/extension/index.d.ts

@@ -3,6 +3,7 @@ import { type SpendResponse } from "./costHud.js";
 import { runInitPass as defaultRunInitPass } from "./initPass.js";
 import { startMcp as defaultStartMcp } from "./mcp/startup.js";
 import { type GuardianGateEvent } from "./permission/gate.js";
+import { registerTelemetry as defaultRegisterTelemetry } from "./telemetry/register.js";
 import { type PluginCliRunner } from "./plugins/panel.js";
 import { type FlushOutcome, type SpoolClientOpts } from "./spool.js";
 import { type TokenProvider } from "./tokenProvider.js";
@@ -67,6 +68,11 @@ export interface RegisterYagniDeps {
      * fresh-workspace first-run and is skipped otherwise, without a network or disk.
      */
     runInitPass?: typeof defaultRunInitPass;
+    /**
+     * OTel export registration. Injectable so tests assert the boot handoff of
+     * the /context `userEmail` into the telemetry identity without an SDK.
+     */
+    registerTelemetry?: typeof defaultRegisterTelemetry;
     /** The workspace id the token is bound to (keys the one-time init marker). */
     getWorkspaceId?: () => string | undefined;
     /** Has the init pass already run once for this workspace? Injectable (no disk in tests). */

package/dist/extension/index.js

@@ -1,6 +1,4 @@
 import { createHash } from "node:crypto";
-import { existsSync, readFileSync, renameSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
 import { Text } from "@earendil-works/pi-tui";
 import { DEFAULT_ADVISOR_LIMITS, formatAdvisorSubtotal, makeAdvisorState } from "./advisor.js";
 import { makeChildUsageState } from "./childUsage.js";
@@ -26,6 +24,7 @@ import { logEvent } from "./errorSink.js";
 import { registerFeedbackCommands } from "./feedbackCommand.js";
 import { droppedSessionRuns, sessionRunIds } from "./sessionRuns.js";
 import { codeStateHome } from "./stateHome.js";
+import { mutateLocalConfig } from "./settingsFiles.js";
 import { logTurnLifecycle } from "./turnLog.js";
 import { createYagniFooterFactory, cyclePermissionMode, formatCwd, GIT_MUTATING_PATTERN, isShiftTab } from "./footer.js";
 import { RerouteNotifier } from "./rerouteNotice.js";
@@ -38,7 +37,7 @@ import { registerGoCompareCommand } from "./pipeline/goCompareCommand.js";
 import { DEFAULT_PERMISSION_POLICY, createModeHolder, registerPermissionGate } from "./permission/gate.js";
 import { registerSandbox } from "./sandbox/session.js";
 import { sandboxAutoAllowDecision } from "./sandbox/bash.js";
-import { registerTelemetry } from "./telemetry/register.js";
+import { registerTelemetry as defaultRegisterTelemetry } from "./telemetry/register.js";
 import { loadHooksConfig, makeHookRunner, registerHooks } from "./hooks.js";
 import { loadPermissionRules } from "./permissionRules/loadConfig.js";
 import { registerPluginPanel } from "./plugins/panel.js";
@@ -422,7 +421,7 @@ export async function registerYagni(pi, deps = {}) {
     // OTel export (traces, metrics, log events; Claude Code parity). A no-op
     // unless the launcher's gate set YAGNI_OTEL_EXPORT=1 — see the CLI's
     // otel.ts for the sources and src/telemetry for the exporter.
-    const telemetry = registerTelemetry(pi, { env });
+    const telemetry = (deps.registerTelemetry ?? defaultRegisterTelemetry)(pi, { env });
     {
         let previousMode = modeHolder.get();
         modeHolder.onSet((m) => {
@@ -607,45 +606,41 @@ export async function registerYagni(pi, deps = {}) {
             if (!evalMode)
                 appendGrant(grant);
         },
-        // persist a user-level allow rule (Guardian ask dialog's third
-        // option). Atomic write, never overwrites other keys, fail-soft.
-        persistUserRule: (ruleString) => {
-            if (evalMode)
-                return;
-            try {
-                const userPath = join(rulesStateHome, "config.json");
-                let parsed = {};
-                if (existsSync(userPath)) {
-                    parsed = JSON.parse(readFileSync(userPath, "utf-8"));
-                    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
-                        return;
-                }
-                const perms = (parsed.permissions ?? {});
-                const allow = Array.isArray(perms.allow) ? perms.allow : [];
-                if (!allow.includes(ruleString))
-                    allow.push(ruleString);
-                perms.allow = allow;
-                parsed.permissions = perms;
-                const tmp = join(rulesStateHome, `.config.json.yagni-${process.pid}-${Date.now()}.tmp`);
-                writeFileSync(tmp, `${JSON.stringify(parsed, null, 2)}\n`, { mode: 0o600 });
-                renameSync(tmp, userPath);
+        // persist a project-local allow rule (Guardian ask dialog's third
+        // option — Claude Code's own default save destination for personal
+        // rules is localSettings; ours matches). Atomic write, never overwrites
+        // other keys. THROWS on failure — the gate's catch owns the fail-soft
+        // behavior (notify the user, record ask_approved not remembered); a
+        // catch HERE would swallow the throw and make that path unreachable,
+        // leaving the user believing a rule saved that will not survive restart.
+        // Local writes fire-and-forget the global gitignore helper so the file
+        // is never committed by accident.
+        //
+        // The cwd is the GATE's per-call session cwd (a session can switch
+        // directories; process.cwd() would silently land the rule in another
+        // project's local settings while the dialog claims this one). Not
+        // registered in eval mode: the gate hides the save option when the dep
+        // is absent, so a no-op implementation that would still emit
+        // ask_approved_remembered never exists.
+        ...(evalMode ? {} : {
+            persistUserRule: (ruleString, cwd) => {
+                mutateLocalConfig(cwd, (config) => {
+                    const perms = (config.permissions ?? {});
+                    const allow = Array.isArray(perms.allow) ? [...perms.allow] : [];
+                    if (!allow.includes(ruleString))
+                        allow.push(ruleString);
+                    perms.allow = allow;
+                    config.permissions = perms;
+                });
                 logEvent({
                     source: "permission-rules",
                     level: "info",
-                    event: "user_rule_saved",
+                    event: "rule_saved",
                     sessionId: env.YAGNI_SESSION_ID ?? undefined,
-                    fields: { rule: ruleString },
-                });
-            }
-            catch (err) {
-                logEvent({
-                    source: "permission-rules",
-                    level: "warn",
-                    event: "user_rule_save_failed",
-                    fields: { message: err instanceof Error ? err.message : "unknown" },
+                    fields: { rule: ruleString, destination: "local" },
                 });
-            }
-        },
+            },
+        }),
         // Opt-in storage stream (YAG-510). Tier decides what leaves the machine:
         // "off" → nothing (not even sent); "hash" → sha256 + family prefix +
         // metadata, no command content; "raw" → adds client-REDACTED command and
@@ -845,6 +840,29 @@ export async function registerYagni(pi, deps = {}) {
             contextBrief = undefined;
         }
     }
+    // The developer's account email for the OTel export (`user.email`), so a
+    // collector can attribute sessions per person. Set before session_start
+    // fires, so even the session.count metric carries it. No-op when export is
+    // off or the launcher already forwarded YAGNI_USER_EMAIL.
+    const bootUserEmail = typeof briefResult?.userEmail === "string" ? briefResult.userEmail : undefined;
+    telemetry.setUserEmail(bootUserEmail);
+    if (telemetry.enabled && !bootUserEmail && !telemetry.config.identity.userEmail) {
+        // Attribution would otherwise degrade silently: leave a trail in the local
+        // error sink so "why is user.email missing in the collector" is answerable.
+        // Info, not warn: one line per session start, and an account with no
+        // email hits it by design. The fields name each way the email can be
+        // absent — the boot fetch failed or lacked the field, and whether the
+        // launcher's YAGNI_USER_EMAIL was unset or forwarded blank.
+        logEvent({
+            source: "telemetry",
+            level: "info",
+            event: "user_email_missing",
+            fields: {
+                contextFetch: briefResult === null ? "failed_or_skipped" : "no_email_field",
+                launcherEmail: env.YAGNI_USER_EMAIL === undefined ? "unset" : "blank",
+            },
+        });
+    }
     // M1 ambient judgment recall: after a `read`, append the recorded judgment for
     // that path to the tool result (result modification is supported on pi's
     // `tool_result` event — verified against 0.80.2). No-op when the corpus is thin

package/dist/extension/permission/gate.d.ts

@@ -231,7 +231,11 @@ export interface RegisterPermissionDeps {
      * Wired by index.ts; offered as a third option on Guardian ask dialogs.
      * Fail-soft: the in-session approval applies even if the write fails.
      */
-    persistUserRule?: (ruleString: string) => void;
+    /** Persist an allow rule for the caller; the cwd is the SESSION cwd of
+     * the gate call (may differ from process.cwd() when the session switches
+     * directories) — the rule must land in the project the user is working
+     * in, the same cwd the gate uses for grants and approvals. */
+    persistUserRule?: (ruleString: string, cwd: string) => void;
     /**
      * Called (fire-and-forget) at every terminal prompt-band outcome with the
      * rich storage event (raw command — the wiring layer redacts/hashes).

package/dist/extension/permission/gate.js

@@ -513,45 +513,134 @@ export function registerPermissionGate(pi, deps = {}) {
         const flat = command.replace(/\s+/g, " ").trim();
         return flat.length <= 240 ? flat : `${flat.slice(0, 237)}…`;
     };
-    const ASK_TIMEOUT_MS = 120_000;
     const ASK_YES = "Yes, run it";
     const ASK_NO = "No";
+    /**
+     * The ask dialog now waits indefinitely, so an unanswered ask is a silent
+     * unbounded pause: a lost RPC client or an abandoned dialog hangs the
+     * session with nothing in the trail to explain why. Emit one sanitized
+     * event when the dialog OPENS — kind + tool ONLY. The sink's default-on
+     * contract is content-free (raw content is gated behind YAGNI_DEBUG), and
+     * even the rule string stays out: it is user-authored free text that can
+     * embed secret-bearing fragments (env assignments, URL credentials), and
+     * a rule ask is already fully identified by kind "rule" + the tool. Fail-
+     * soft; the sink never throws into the gate.
+     */
+    const logAskOpened = (kind, toolName) => {
+        try {
+            logEvent({
+                source: "guardian",
+                level: "info",
+                event: "guardian_ask_opened",
+                fields: { kind, tool: toolName },
+            });
+        }
+        catch {
+            /* telemetry must never affect the gate */
+        }
+    };
+    /**
+     * The paired resolution event: with no dialog timeout, the pause DURATION
+     * and its OUTCOME are the story (answered vs ESC-dismissed vs turn-aborted),
+     * and a dismissed dialog would otherwise leave no trail line of its own.
+     * kind + tool + outcome only — all enum values, nothing content-bearing.
+     * durationMs makes the pause directly readable instead of timestamp-diffing
+     * two lines. Same fail-soft contract as the open event.
+     */
+    const logAskResolved = (kind, toolName, outcome, openedAt) => {
+        try {
+            logEvent({
+                source: "guardian",
+                level: "info",
+                event: "guardian_ask_resolved",
+                fields: { kind, tool: toolName, outcome, durationMs: Date.now() - openedAt },
+            });
+        }
+        catch {
+            /* telemetry must never affect the gate */
+        }
+    };
+    /**
+     * The single choice-to-resolution mapping BOTH ask dialogs share — one
+     * place, so the two surfaces can never drift. The option labels the dialog
+     * actually offered are passed in; the rule rung is null when the plain
+     * dialog didn't offer it. An aborted turn wins over any choice value; a
+     * real user ESC maps to "dismissed" (the no-abort, no-answer bucket —
+     * ESC resolves undefined in pi). A THROWN select never reaches this
+     * function: the dialogs route it to thrownChoiceResolution, which is the
+     * ONLY source of outcome "error". Both fail closed identically
+     * downstream — only the telemetry distinguishes them.
+     */
+    const resolveChoice = (choice, opts) => {
+        if (opts.aborted)
+            return "aborted";
+        if (choice === ASK_YES)
+            return "yes";
+        if (opts.rememberLabel !== null && choice === opts.rememberLabel)
+            return "remember";
+        if (opts.ruleLabel != null && choice === opts.ruleLabel)
+            return "rule";
+        if (choice === ASK_NO)
+            return "no";
+        // No abort and no recognizable answer — a real ESC (pi resolves a
+        // dismissed dialog as undefined) or any unmatched value. NEVER the
+        // thrown-select path: that maps to "error" in thrownChoiceResolution.
+        return "dismissed";
+    };
+    /**
+     * Map a THROWN select to its resolution: the UI/RPC layer failed (dead
+     * client, disposed dialog) — never a human answer. Distinct from ESC in
+     * the trail so a lost client is attributable; blocks exactly like a
+     * dismissal downstream (fail closed).
+     */
+    const thrownChoiceResolution = (aborted) => aborted ? "aborted" : "error";
     /**
      * The single human-in-the-loop ask surface (YAG-510): used for ask
      * verdicts, Guardian-unavailable/disabled fallbacks, and the breaker
      * escalation — one UI, one cache, one event stream. Always passes the
-     * turn's abort signal (without it a turn-abort leaves the dialog hanging)
-     * and a timeout (pi renders a countdown; expiry fails closed).
+     * turn's abort signal (without it a turn-abort leaves the dialog hanging).
+     *
+     * No dialog timeout — Claude Code parity: a permission ask waits
+     * indefinitely for the human. The only dismissal paths are the user
+     * answering, dismissing the dialog (ESC), the turn aborting (Ctrl-C /
+     * interrupt), or the UI layer failing (outcome "error", fail closed).
+     * The old 120s auto-fail-closed cap is gone; an unattended dialog pauses
+     * the session rather than denying the command.
      */
-    const askUser = async (ctx, title, rememberLabel) => {
+    const askUser = async (ctx, title, rememberLabel, kind = "guardian_verdict", toolName = "bash") => {
         if (ctx.signal?.aborted)
             return "aborted";
+        logAskOpened(kind, toolName);
+        const openedAt = Date.now();
         const options = rememberLabel ? [ASK_YES, rememberLabel, ASK_NO] : [ASK_YES, ASK_NO];
         let choice;
+        let selectThrew = false;
         try {
             choice = await ctx.ui.select(title, options, {
                 ...(ctx.signal ? { signal: ctx.signal } : {}),
-                timeout: ASK_TIMEOUT_MS,
             });
         }
         catch {
-            choice = undefined;
+            selectThrew = true;
         }
-        if (choice === ASK_YES)
-            return "yes";
-        if (rememberLabel !== null && choice === rememberLabel)
-            return "remember";
-        if (choice === ASK_NO)
-            return "no";
-        return ctx.signal?.aborted ? "aborted" : "dismissed";
+        const resolution = selectThrew
+            ? thrownChoiceResolution(ctx.signal?.aborted ?? false)
+            : resolveChoice(choice, { rememberLabel, aborted: ctx.signal?.aborted ?? false });
+        logAskResolved(kind, toolName, resolution, openedAt);
+        return resolution;
     };
     /**
      * variant: the Guardian ask dialog with an optional third option
-     * (persist a user-level permission rule). Same semantics as askUser.
+     * (persist a user-level permission rule). Same semantics as askUser
+     * (indefinite wait, turn-abort signal only). kind/toolName are threaded
+     * through — never hardcoded here — so a future non-bash caller cannot
+     * silently misattribute the dialog in the trail.
      */
-    const askUserWithOptions = async (ctx, title, rememberLabel, ruleLabel) => {
+    const askUserWithOptions = async (ctx, title, rememberLabel, ruleLabel, kind = "guardian_verdict", toolName = "bash") => {
         if (ctx.signal?.aborted)
             return "aborted";
+        logAskOpened(kind, toolName);
+        const openedAt = Date.now();
         const options = [
             ASK_YES,
             ...(rememberLabel ? [rememberLabel] : []),
@@ -559,24 +648,20 @@ export function registerPermissionGate(pi, deps = {}) {
             ASK_NO,
         ];
         let choice;
+        let selectThrew = false;
         try {
             choice = await ctx.ui.select(title, options, {
                 ...(ctx.signal ? { signal: ctx.signal } : {}),
-                timeout: ASK_TIMEOUT_MS,
             });
         }
         catch {
-            choice = undefined;
+            selectThrew = true;
         }
-        if (choice === ASK_YES)
-            return "yes";
-        if (rememberLabel !== null && choice === rememberLabel)
-            return "remember";
-        if (ruleLabel !== null && choice === ruleLabel)
-            return "rule";
-        if (choice === ASK_NO)
-            return "no";
-        return ctx.signal?.aborted ? "aborted" : "dismissed";
+        const resolution = selectThrew
+            ? thrownChoiceResolution(ctx.signal?.aborted ?? false)
+            : resolveChoice(choice, { rememberLabel, ruleLabel, aborted: ctx.signal?.aborted ?? false });
+        logAskResolved(kind, toolName, resolution, openedAt);
+        return resolution;
     };
     const buildAskTitle = (command, rationale, riskLevel) => {
         const risk = riskLevel ? ` (risk: ${riskLevel})` : "";
@@ -642,7 +727,7 @@ export function registerPermissionGate(pi, deps = {}) {
                 }
                 catch { /* logging must never affect the gate */ }
                 if (ruleVerdict.verdict === "deny") {
-                    const origin = ruleVerdict.rule.source === "project" ? "the project's settings" : "your user settings";
+                    const origin = ruleVerdict.rule.source === "user" ? "your user settings" : ruleVerdict.rule.source === "local" ? "the project's local settings" : "the project's settings";
                     return {
                         block: true,
                         reason: `${event.toolName} was denied by a permission rule in ${origin} (${ruleVerdict.rule.raw}). Do not attempt the same outcome via a workaround or indirect execution — ask the user to change the rule if this action is genuinely needed.`,
@@ -665,8 +750,8 @@ export function registerPermissionGate(pi, deps = {}) {
                     const askKey = ruleAskKey(event.toolName, ruleVerdict.rule.raw, input);
                     if (ruleAskApprovals.has(askKey))
                         return {};
-                    const origin = ruleVerdict.rule.source === "project" ? "the project's settings" : "your user settings";
-                    const choice = await askUser(ctx, `Permission rule (ask) in ${origin}:\n${ruleVerdict.rule.raw}\nAllow ${event.toolName}?`, null);
+                    const origin = ruleVerdict.rule.source === "user" ? "your user settings" : ruleVerdict.rule.source === "local" ? "the project's local settings" : "the project's settings";
+                    const choice = await askUser(ctx, `Permission rule (ask) in ${origin}:\n${ruleVerdict.rule.raw}\nAllow ${event.toolName}?`, null, "rule", event.toolName);
                     if (choice === "yes") {
                         if (ruleAskApprovals.size > APPROVED_CACHE_MAX)
                             ruleAskApprovals.clear();
@@ -816,7 +901,7 @@ export function registerPermissionGate(pi, deps = {}) {
                         if (ctx?.hasUI && !breakerEscalationOffered && !ctx.signal?.aborted) {
                             breakerEscalationOffered = true;
                             const title = `Guardian denied ${guardianState.read().consecutiveDenials} commands in a row.\nAllow the latest command anyway?\n$ ${boundedCommand(command)}`;
-                            const resolution = await askUser(ctx, title, null);
+                            const resolution = await askUser(ctx, title, null, "breaker");
                             if (resolution === "yes") {
                                 guardianState.resetTurn();
                                 rememberApproved(cwd, command);
@@ -982,9 +1067,9 @@ export function registerPermissionGate(pi, deps = {}) {
                             ? `Yes, and don't ask again for \`${describePrefix(grantCandidate.pattern)}\` in this repo`
                             : null;
                         const ruleLabel = grantCandidate && deps.persistUserRule
-                            ? `Yes, and always allow \`${grantCandidate.pattern.join(" ")}\` in my user settings`
+                            ? `Yes, and always allow \`${grantCandidate.pattern.join(" ")}\` in this project's local settings`
                             : null;
-                        const resolution = await askUserWithOptions(ctx, buildAskTitle(command, verdict.rationale, verdict.riskLevel), rememberLabel, ruleLabel);
+                        const resolution = await askUserWithOptions(ctx, buildAskTitle(command, verdict.rationale, verdict.riskLevel), rememberLabel, ruleLabel, "guardian_verdict", "bash");
                         if (resolution === "yes") {
                             rememberApproved(cwd, command);
                             emitGateEvent(slot, {
@@ -1000,29 +1085,35 @@ export function registerPermissionGate(pi, deps = {}) {
                         if (resolution === "rule" && ruleCandidate && deps.persistUserRule) {
                             let persisted = false;
                             try {
-                                deps.persistUserRule(ruleCandidate);
+                                deps.persistUserRule(ruleCandidate, cwd);
                                 persisted = true;
                                 // Also covers this session like a grant would:
                                 rememberApproved(cwd, command);
                             }
                             catch (err) {
-                                // Fail-soft: the in-memory approval still applies THIS
-                                // session. But the user just made an explicit durable choice
-                                // in the dialog — a silent failure would leave them believing
-                                // a rule exists that will not survive restart. Log the
-                                // failure (rule string only, it is user-configured text, plus
-                                // error class — never the thrown message) and tell the user.
+                                // Fail-soft: the in-memory approval covers ONLY this call —
+                                // rememberApproved sits after the throwing call, so a failed
+                                // persist does NOT remember the command for the session (a
+                                // narrower fallback than a grant, deliberately: the user's
+                                // durable choice did not land). But the user just made an
+                                // explicit durable choice in the dialog — a silent failure
+                                // would leave them believing a rule exists that will not
+                                // survive restart. Log the failure (rule string + the thrown
+                                // message — it is mutateConfigJson's own path/reason text,
+                                // never the raw parse error or file content) and tell the
+                                // user.
                                 logEvent({
                                     source: "permission-rules",
                                     level: "warn",
-                                    event: "user_rule_save_failed",
+                                    event: "rule_save_failed",
                                     fields: {
                                         rule: ruleCandidate,
-                                        error: err instanceof Error ? err.constructor.name : typeof err,
+                                        destination: "local",
+                                        error: err instanceof Error ? err.message : String(err),
                                     },
                                 });
                                 if (ctx?.hasUI) {
-                                    ctx.ui.notify(`Could not save the permission rule to your settings — it applies to this session only.`, "warning");
+                                    ctx.ui.notify(`Could not save the permission rule to your settings — it did not persist; you'll be asked again on the next identical command.`, "warning");
                                 }
                             }
                             emitGateEvent(slot, {
@@ -1078,7 +1169,10 @@ export function registerPermissionGate(pi, deps = {}) {
                                 reason: "The user declined this command. Ask what they would like to do differently, or take a different approach.",
                             };
                         }
-                        // dismissed / dialog timeout — neutral reason, no "denied" spin.
+                        // dismissed or UI-layer error — neutral reason, no "denied"
+                        // spin. (No timeout can land here anymore: the dialog waits
+                        // indefinitely, so this is only a real ESC/dismiss — or the
+                        // select itself failed, which fails closed the same way.)
                         return {
                             block: true,
                             reason: "The permission dialog was dismissed; the command was not run. Ask the user how to proceed.",
@@ -1106,7 +1200,7 @@ export function registerPermissionGate(pi, deps = {}) {
                         // bounded per prompt so an outage can't become an ask storm.
                         errorFallbackAsks += 1;
                         const errorMsg = guardianErrorMessage(error);
-                        const resolution = await askUser(ctx, `Guardian unavailable (${errorMsg}).\nRun this command anyway?\n$ ${boundedCommand(command)}`, null);
+                        const resolution = await askUser(ctx, `Guardian unavailable (${errorMsg}).\nRun this command anyway?\n$ ${boundedCommand(command)}`, null, "error_fallback");
                         if (resolution === "yes") {
                             rememberApproved(cwd, command);
                             emitGateEvent(slot, { ...eventBase, outcome: "ask_approved", guardianError: error, durationMs, consulted: false });