auto-permission-system 3.0.0 → 3.6.0

package/src/l1-sandbox/manager.ts

@@ -1,6 +1,6 @@
 /**
- * Layer 1 sandbox-runtime lifecycle: initialize, reset/reload, and persist an
- * ask-tier "always" grant into sandbox.json.
+ * Layer 1 sandbox-runtime lifecycle: initialize, reset/reload, persist an
+ * ask-tier "always" grant into sandbox.json, and apply network grants live.
  *
  * Adapter module: owns the SandboxManager singleton and the on-disk policy.
  */
@@ -8,13 +8,15 @@
 import { mkdirSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { SandboxManager } from "@anthropic-ai/sandbox-runtime";
+import { SandboxManager, type SandboxRuntimeConfig } from "@anthropic-ai/sandbox-runtime";
 import { getAgentDir } from "@earendil-works/pi-coding-agent";
 import { readPolicyForUpdate, recordProjectTrust, sandboxFilesystem } from "../core/index";
 import { loadConfig, projectTrusted, TRUST_STORE, type SandboxConfig } from "./config";
+import { createNetworkAsk, type NetworkAskDeps } from "./network-ask";
 
-export async function initSandbox(cwd: string, config: SandboxConfig): Promise<void> {
-	await SandboxManager.initialize({
+/** The sandbox-runtime view of a SandboxConfig (pi-only fields stripped). */
+function runtimeConfig(cwd: string, config: SandboxConfig): SandboxRuntimeConfig {
+	return {
 		network: config.network,
 		// Strip pi-only fields (modelDenyRead, _comment_*) so SandboxManager
 		// doesn't see keys it doesn't understand; modelDenyRead is enforced by
@@ -25,7 +27,16 @@ export async function initSandbox(cwd: string, config: SandboxConfig): Promise<v
 			: { denyRead: [], allowRead: [], allowWrite: [], denyWrite: [], disabled: true },
 		ignoreViolations: config.ignoreViolations,
 		enableWeakerNestedSandbox: config.enableWeakerNestedSandbox,
-	});
+	};
+}
+
+/**
+ * `deps` registers the unknown-domain ask callback (ADR-023). Without it the
+ * proxy hard-denies hosts outside `allowedDomains` (sandbox-runtime's own
+ * behavior when no callback is registered).
+ */
+export async function initSandbox(cwd: string, config: SandboxConfig, deps?: NetworkAskDeps): Promise<void> {
+	await SandboxManager.initialize(runtimeConfig(cwd, config), deps ? createNetworkAsk(deps) : undefined);
 }
 
 export async function resetSandbox(): Promise<void> {
@@ -36,17 +47,35 @@ export async function resetSandbox(): Promise<void> {
 	}
 }
 
-export async function reloadSandbox(cwd: string): Promise<void> {
+export async function reloadSandbox(cwd: string, deps?: NetworkAskDeps): Promise<void> {
 	const config = loadConfig(cwd);
 	await resetSandbox();
-	await initSandbox(cwd, config);
+	await initSandbox(cwd, config, deps);
 }
 
-/** Persist an "always" Layer 1 override (scope: cwd or global) and live-reload SandboxManager. */
-export async function persistLayer1Override(
+/**
+ * Add a host to the running proxy's allowlist in place. `updateConfig` swaps
+ * the config the proxy reads per request; a `reset()`/`initialize()` here
+ * would tear down the proxy that is serving the request being approved.
+ */
+export function applyNetworkGrant(host: string): void {
+	const current = SandboxManager.getConfig();
+	if (!current) return;
+	const pattern = host.toLowerCase();
+	if (current.network.allowedDomains.some((p) => p.toLowerCase() === pattern)) return;
+	SandboxManager.updateConfig({
+		...current,
+		network: { ...current.network, allowedDomains: [...current.network.allowedDomains, pattern] },
+	});
+}
+
+type Layer1OverrideKind = "allowWrite" | "allowRead" | "allowDomains";
+
+/** File write only — the caller decides whether (and how) to apply it live. */
+async function writeLayer1Override(
 	cwd: string,
-	kind: "allowWrite" | "allowRead",
-	absPath: string,
+	kind: Layer1OverrideKind,
+	value: string,
 	scope: "cwd" | "global",
 ): Promise<string> {
 	const { dir, path } =
@@ -59,15 +88,35 @@ export async function persistLayer1Override(
 		throw new Error(`${path} is not trusted; run /security trust first, or choose an "ALL projects" option`);
 	}
 	// Throws on an unparseable file: never overwrite a hand-written policy we could not read.
-	const existing = readPolicyForUpdate(path) as { overrides?: { allowWrite?: string[]; allowRead?: string[] } };
+	const existing = readPolicyForUpdate(path) as { overrides?: Partial<Record<Layer1OverrideKind, string[]>> };
 	const overrides = existing.overrides ?? {};
 	const list = overrides[kind] ?? [];
-	if (!list.includes(absPath)) list.push(absPath);
+	if (!list.includes(value)) list.push(value);
 	overrides[kind] = list;
 	existing.overrides = overrides;
 	mkdirSync(dir, { recursive: true });
 	writeFileSync(path, `${JSON.stringify(existing, null, 2)}\n`);
 	if (scope === "cwd") recordProjectTrust(path, TRUST_STORE);
-	await reloadSandbox(cwd);
+	return path;
+}
+
+/**
+ * Write an "always" domain grant (file only). The network ask applies it live
+ * with `applyNetworkGrant` right after, so the in-flight request survives.
+ */
+export async function writeNetworkOverride(cwd: string, host: string, scope: "cwd" | "global"): Promise<string> {
+	return writeLayer1Override(cwd, "allowDomains", host, scope);
+}
+
+/** Persist an "always" Layer 1 override (scope: cwd or global) and live-reload SandboxManager. */
+export async function persistLayer1Override(
+	cwd: string,
+	kind: "allowWrite" | "allowRead",
+	absPath: string,
+	scope: "cwd" | "global",
+	deps?: NetworkAskDeps,
+): Promise<string> {
+	const path = await writeLayer1Override(cwd, kind, absPath, scope);
+	await reloadSandbox(cwd, deps);
 	return path;
 }

package/src/l1-sandbox/network-ask.ts

@@ -0,0 +1,198 @@
+/**
+ * Layer 1 network ask (ADR-023): the sandbox-runtime proxy asks before it
+ * denies a host that matched neither `allowedDomains` nor `deniedDomains`.
+ * Uses the same two-screen ask-tier as Layer 2 (once / session / remember
+ * project|global) and the same grant semantics:
+ *
+ * - session grants: in memory only, cleared at `session_start`, never saved;
+ * - "once" grants: one bash command's connections to that host (the proxy
+ *   calls back per request, so a redirect or a parallel connection must not
+ *   re-prompt), scoped by `beginNetworkCommand`/`endNetworkCommand`;
+ * - remember grants: written to `overrides.allowDomains` by the caller and
+ *   applied live with `SandboxManager.updateConfig` (a reload here would tear
+ *   down the proxy serving the request being approved).
+ *
+ * Headless (`hasUI === false`) denies, like every other gate.
+ *
+ * Session grants use the parent-domain wildcard when useful (covers all sibling
+ * subdomains). Screen 2 hides the "in this project" rows in untrusted
+ * projects so the user can't quietly trust a widening file.
+ */
+
+import { domainMatches } from "../core/index";
+import { askMain, askRememberHost, ASK_TIMEOUT_MS, parentDomainWildcard, type AskCtx, type MainChoice } from "../ui/ask-flow";
+
+/** In-memory session grants ("Yes, for this session"). Cleared at session_start. */
+const sessionGrants: string[] = [];
+/** Hosts allowed for the current bash command ("Yes, just this once" covers its connections). */
+let commandGrants: Set<string> | null = null;
+let commandDepth = 0;
+/** Single-flight: one prompt per host even when several connections overlap. */
+const pending = new Map<string, Promise<boolean>>();
+
+export function clearNetworkSessionGrants(): void {
+	sessionGrants.length = 0;
+}
+
+export function networkSessionGrantSummary(): string {
+	return sessionGrants.join(", ");
+}
+
+export function beginNetworkCommand(): void {
+	commandDepth += 1;
+	commandGrants ??= new Set();
+}
+
+export function endNetworkCommand(): void {
+	commandDepth = Math.max(0, commandDepth - 1);
+	if (commandDepth === 0) commandGrants = null;
+}
+
+/** The active pi context at ask time (set at session_start; sandbox.ts owns it). */
+export type NetworkAskCtx = AskCtx & {
+	ui: AskCtx["ui"] & { notify?: (m: string, l?: string) => void };
+};
+
+export interface NetworkAskDeps {
+	cwd: string;
+	getCtx: () => NetworkAskCtx | undefined;
+	/** Write the host into `overrides.allowDomains` (file only); returns the path written. */
+	persist: (host: string, scope: "cwd" | "global") => Promise<string>;
+	/** Make a grant effective in the running sandbox without restarting the proxy. */
+	applyLive: (host: string) => void;
+	audit: (entry: Record<string, unknown>) => void;
+	/** True when the cwd's project sandbox.json isn't trusted (ADR-013). */
+	projectTrusted?: boolean;
+	/** The bash command that triggered the proxy ask (shown in the body as `Command`). */
+	command?: string;
+}
+
+function granted(host: string): "session" | "command" | null {
+	if (sessionGrants.some((g) => domainMatches(host, g))) return "session";
+	if (commandGrants?.has(host)) return "command";
+	return null;
+}
+
+/** Display subject: host, plus a non-default port when the proxy reports one. */
+function subjectOf(host: string, port: number | undefined): string {
+	return port && port !== 443 && port !== 80 ? `${host}:${port}` : host;
+}
+
+/** First whitespace-separated word of a bash command \u2014 used to name the binary in the title. */
+function firstWord(command: string | undefined): string | null {
+	if (!command) return null;
+	const w = command.trim().split(/\s+/)[0] ?? "";
+	// Strip common prefixes.
+	return w.replace(/^sudo$/, "").replace(/^command$/, "").replace(/^\\\//, "") || null;
+}
+
+async function decide(deps: NetworkAskDeps, host: string, port: number | undefined): Promise<boolean> {
+	const subject = subjectOf(host, port);
+	const base = { layer: 1, tool: "network", subject, cwd: deps.cwd, note: "network-ask" };
+	const ctx = deps.getCtx();
+	if (!ctx || ctx.hasUI === false || !ctx.ui?.select) {
+		deps.audit({ ...base, decision: "no", note: "network-ask-headless" });
+		return false;
+	}
+
+	const wild = parentDomainWildcard(host);
+	const verb = firstWord(deps.command) ?? "this command";
+	const header = `Let ${verb} connect to ${host}?`;
+	const bodyParts: string[] = [];
+	bodyParts.push(`Site     ${host}`);
+	if (wild !== host.toLowerCase()) {
+		const bare = wild.replace(/^\*\./, "");
+		bodyParts.push(`Group    ${wild}   (every ${bare} site)`);
+	}
+	if (deps.command) bodyParts.push(`Command  ${deps.command}`);
+	bodyParts.push(`Why      this site isn't on your allowed list yet`);
+
+	let mainChoice: MainChoice;
+	try {
+		mainChoice = await askMain(ctx, header, bodyParts.join("\n"), {
+			session: true,
+			sessionLabel: "Yes, all in group for this session",
+			allowFirst: true,
+			icon: "net",
+			timeoutMs: ASK_TIMEOUT_MS,
+		});
+	} catch {
+		deps.audit({ ...base, decision: "no", note: "screen1-threw" });
+		return false;
+	}
+
+	if (mainChoice === "block") {
+		deps.audit({ ...base, decision: "no" });
+		return false;
+	}
+	if (mainChoice === "once") {
+		commandGrants?.add(host);
+		deps.audit({ ...base, decision: "yes" });
+		return true;
+	}
+	if (mainChoice === "session") {
+		// ADR-030: session grant uses the parent-domain wildcard (e.g. *.composio.dev)
+		// when the host has a useful parent, so any sibling subdomain is also covered
+		// for the rest of the session without re-prompting. Apex hosts (2 parts)
+		// fall back to the exact host since `*.example.com` would not match `example.com`.
+		const grant = wild;
+		sessionGrants.push(grant);
+		deps.audit({ ...base, decision: "session", grant, requested: host });
+		ctx.ui.notify?.(`pi-sandbox: allowed for this session (not saved) \u2192 ${grant}`, "info");
+		return true;
+	}
+
+	// mainChoice === "remember" \u2014 screen 2 picks the wildcard or exact host pattern.
+	const title = "Always allow connecting \u2014 what, and where?";
+	const body: string[] = [];
+	body.push(`Site     ${host}`);
+	if (wild !== host.toLowerCase()) {
+		const bare = wild.replace(/^\*\./, "");
+		body.push(`Group    ${wild}   (every ${bare} site)`);
+	}
+	body.push(`Note     the rule works for any command, not just ${verb}`);
+	if (deps.projectTrusted === false) {
+		body.push(`Note     this project isn't trusted \u2014 run /security trust to save rules here`);
+	}
+	const picked = await askRememberHost(ctx, title, body.join("\n"), host, { icon: "save", untrusted: deps.projectTrusted === false });
+	if (!picked) {
+		deps.audit({ ...base, decision: "no", note: "remember-screen-cancelled" });
+		return false;
+	}
+	const scope = picked.scope;
+	const pattern = picked.pattern;
+	try {
+		const path = await deps.persist(pattern, scope);
+		deps.applyLive(pattern);
+		deps.audit({ ...base, decision: scope === "cwd" ? "always-cwd" : "always-global", scope, persisted_to: path, pattern, requested: host });
+		ctx.ui.notify?.(`pi-sandbox: persisted ${scope} override \u2192 ${path}`, "warning");
+	} catch (e) {
+		// Mirror Layer 2: a failed write still allows the call, covering the
+		// whole command so a redirect cannot loop the prompt.
+		commandGrants?.add(host);
+		deps.audit({ ...base, decision: "yes", note: `always-persist-failed: ${e}`, scope });
+		ctx.ui.notify?.(`pi-sandbox: could not persist ${scope} override (${e}); allowing this command only`, "warning");
+	}
+	return true;
+}
+
+/**
+ * Build the `SandboxAskCallback` for `SandboxManager.initialize`. One asker
+ * per sandbox start; the session and command grants it consults are shared, so
+ * a reload keeps them.
+ */
+export function createNetworkAsk(deps: NetworkAskDeps): (params: { host: string; port?: number }) => Promise<boolean> {
+	return async ({ host, port }) => {
+		const key = host.toLowerCase();
+		const hit = granted(key);
+		if (hit) {
+			deps.audit({ layer: 1, tool: "network", subject: subjectOf(key, port), cwd: deps.cwd, decision: hit === "session" ? "session-grant" : "yes", note: `${hit}-grant` });
+			return true;
+		}
+		const inflight = pending.get(key);
+		if (inflight) return inflight;
+		const decision = decide(deps, key, port).finally(() => pending.delete(key));
+		pending.set(key, decision);
+		return decision;
+	};
+}

package/src/l2-guard/exposure.ts

@@ -24,9 +24,19 @@ export function collectExposure(content: ReadonlyArray<{ type: string; text?: st
 		for (const f of r.findings) types.add(f.type);
 		const before = c.text.split("\n");
 		const after = String(r.redactedOutput ?? "").split("\n");
-		for (let i = 0; i < before.length && lines.length < MAX_LINES; i++) {
-			if (after[i] !== before[i] && before[i].trim()) lines.push(`${i + 1}: ${clip(before[i].trim())}`);
+		const matchedIndices: number[] = [];
+		for (let i = 0; i < before.length; i++) {
+			if (after[i] !== before[i] && before[i].trim()) matchedIndices.push(i);
 		}
+		if (matchedIndices.length === 0) continue;
+		const shown = matchedIndices.slice(0, MAX_LINES);
+		const firstIdx = shown[0];
+		const lastIdx = shown[shown.length - 1];
+		const moreMatched = matchedIndices.length > MAX_LINES;
+		const moreBelow = lastIdx < before.length - 1;
+		if (firstIdx > 0) lines.push("        \u2026");
+		for (const idx of shown) lines.push(`${idx + 1}: ${clip(before[idx].trim())}`);
+		if (moreMatched || moreBelow) lines.push("        \u2026");
 	}
-	return { types: [...types], hits: lines.length ? [`${subject}\n${lines.join("\n")}`] : [] };
+	return { types: [...types], hits: lines.length ? [`From     ${subject}\n${lines.join("\n")}`] : [] };
 }

package/src/l2-guard/program-grants.ts

@@ -0,0 +1,35 @@
+/**
+ * In-memory session grants for the Advanced Secure output gate (ADR-018).
+ *
+ * When a CLI like `composio` returns output that matches a secret pattern
+ * (JWT, OAuth refresh token, etc.), the user can pick "Yes, all <program>
+ * output for this session" instead of approving every block. The program id
+ * is added here, and the output gate short-circuits for the rest of the
+ * session — same shape as path/host session grants, but for tool output.
+ *
+ * Cleared at session_start (ADR-010), never written to disk. The credential
+ * tier (denyRead / askRead) still wins on the file side; this only loosens
+ * the *output* gate, which is about display, not access.
+ */
+
+/** The binary / MCP server / tool that produced the output. Case-folded. */
+const programOutputSessionGrants = new Set<string>();
+
+export function clearProgramOutputSessionGrants(): void {
+	programOutputSessionGrants.clear();
+}
+
+/** Add a program to the session grant list. Idempotent. */
+export function grantProgramOutputSession(programId: string): void {
+	programOutputSessionGrants.add(programId.toLowerCase());
+}
+
+/** True when the program is already granted for the rest of the session. */
+export function isProgramOutputGranted(programId: string | undefined): boolean {
+	if (!programId) return false;
+	return programOutputSessionGrants.has(programId.toLowerCase());
+}
+
+export function programOutputSessionGrantSummary(): string {
+	return [...programOutputSessionGrants].join(", ");
+}

package/src/l2-guard/program-id.ts

@@ -0,0 +1,37 @@
+/**
+ * Program-id detection for the Advanced Secure output gate.
+ *
+ * Used to label the "This output may contain a secret" prompt with the binary
+ * that produced it (`composio`, `aws`, `gcloud`, …) and to key the per-program
+ * session grant (`isProgramOutputGranted`). Pure functions, no pi / fs / audit.
+ */
+
+/** Strip env assignments (`FOO=bar`), common wrappers (sudo, nice, command, …), and the
+ *  flags they take to find the real binary name in a bash command. Handles `nice -n 10`,
+ *  `sudo -u user -- composio`, `command -v`, `strace -f -o /tmp/log aws s3 ls`, etc.
+ *  Returns undefined for empty input. */
+export function bashBinary(command: string | undefined): string | undefined {
+	if (!command) return undefined;
+	const tokens = command.trim().split(/\s+/).filter(Boolean);
+	let i = 0;
+	while (i < tokens.length && /^[A-Z_][A-Z0-9_]*=/.test(tokens[i])) i++;
+	const WRAPPERS = new Set(["sudo", "nice", "command", "time", "strace", "stdbuf", "timeout"]);
+	while (i < tokens.length) {
+		if (WRAPPERS.has(tokens[i])) { i++; continue; }
+		if (tokens[i] === "-n" && i + 1 < tokens.length && /^\d+$/.test(tokens[i + 1])) { i += 2; continue; }
+		if (tokens[i].startsWith("-") && tokens[i].length > 1) { i++; continue; }
+		break;
+	}
+	return tokens[i];
+}
+
+/** The program id for a tool call. Bash binaries only — MCP and other tools return
+ *  `undefined` so the Advanced Secure output gate doesn't offer them a per-program
+ *  session grant (MCP tools handle their own secrets and don't share the
+ *  composio-style "same binary, same surface" pattern). */
+export function programIdForToolCall(toolName: string | undefined, input: unknown): string | undefined {
+	if (!toolName) return undefined;
+	if (toolName !== "bash") return undefined;
+	const cmd = (input as { command?: string } | undefined)?.command;
+	return bashBinary(cmd);
+}

package/src/l2-guard/prompts.ts

@@ -8,14 +8,14 @@ import { mkdirSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { getAgentDir } from "@earendil-works/pi-coding-agent";
-import { extractUserMessages, readPolicyForUpdate, recordProjectTrust, userNamedFile } from "../core/index";
+import { extractUserMessages, isSafeFolderGrant, readPolicyForUpdate, recordProjectTrust, userNamedFile } from "../core/index";
 import { audit } from "../shared/audit";
 import { canonicalize, matchPattern } from "./matching";
 import { projectTrusted, TRUST_STORE } from "./policy";
 import { domainMatches } from "./url";
-import { askDecision, denyMessage, type AskKind, type OverrideKind } from "./ask";
+import { askDecision, denyMessage, type AskCtx, type AskKind, type OverrideKind } from "../ui/ask";
 
-export type { AskKind, Decision, OverrideKind } from "./ask";
+export type { AskKind, Decision, OverrideKind } from "../ui/ask";
 export type Scope = "cwd" | "global";
 
 export function persistOverride(scope: Scope, cwd: string, kind: OverrideKind, value: string): string {
@@ -68,14 +68,15 @@ function sessionGranted(k: AskKind, cwd: string): string | null {
 export type UICtx = {
 	cwd: string;
 	hasUI?: boolean;
-	ui: {
-		select: (t: string, o: string[], op?: { timeout?: number }) => Promise<string | undefined>;
+	/** pi's run mode; `"tui"` enables the custom footer selector (ADR-031). */
+	mode?: string;
+	ui: AskCtx["ui"] & {
 		input: (t: string, p?: string, op?: { timeout?: number }) => Promise<string | undefined>;
 		notify: (m: string, l?: string) => void;
 	};
 };
 
-export async function askOrBlock(ctx: UICtx, k: AskKind, absoluteDenyPattern: string | null): Promise<{ block: true; reason: string } | null> {
+export async function askOrBlock(ctx: UICtx, k: AskKind, absoluteDenyPattern: string | null, onPersist?: (kind: OverrideKind, value: string, scope: Scope) => void): Promise<{ block: true; reason: string } | null> {
 	if (!absoluteDenyPattern) {
 		const granted = sessionGranted(k, ctx.cwd);
 		if (granted) {
@@ -92,13 +93,17 @@ export async function askOrBlock(ctx: UICtx, k: AskKind, absoluteDenyPattern: st
 			}
 		}
 	}
-	const decision = await askDecision(ctx, k, absoluteDenyPattern);
+	const decision = await askDecision(ctx, { ...k, projectTrusted: projectTrusted(ctx.cwd) }, absoluteDenyPattern);
 	if (decision === "no") {
 		audit({ layer: 2, tool: k.tool, subject: k.subject, reason: k.reason, decision: "no", cwd: ctx.cwd });
 		return { block: true, reason: denyMessage(k.overrideKind, k.reason) };
 	}
 	if (decision === "session" || decision === "session-folder") {
-		const value = decision === "session-folder" ? dirname(k.overrideValue) : k.overrideValue;
+		// ADR-030: a session grant for a file covers the whole folder, so a CLI writing
+		// many files under ~/.composio/ stops re-prompting after the first grant. Falls
+		// back to the exact path when the parent folder is unsafe (root, home, …).
+		const parent = k.overrideKind === "allowDomains" ? k.overrideValue : dirname(k.overrideValue);
+		const value = k.overrideKind === "allowDomains" || isSafeFolderGrant(parent, homedir()) ? parent : k.overrideValue;
 		sessionGrants.push({ kind: k.overrideKind, value });
 		audit({ layer: 2, tool: k.tool, subject: k.subject, reason: k.reason, decision, grant: value, cwd: ctx.cwd });
 		ctx.ui.notify(`security-guard: allowed for this session (not saved) → ${value}`, "info");
@@ -114,6 +119,7 @@ export async function askOrBlock(ctx: UICtx, k: AskKind, absoluteDenyPattern: st
 		const value = useFolder ? dirname(k.overrideValue) : k.overrideValue;
 		try {
 			const path = persistOverride(scope, ctx.cwd, k.overrideKind, value);
+			onPersist?.(k.overrideKind, value, scope);
 			audit({ layer: 2, tool: k.tool, subject: k.subject, reason: k.reason, decision, scope, granularity: useFolder ? "folder" : "file", cwd: ctx.cwd, persisted_to: path, override: { [k.overrideKind]: value } });
 			ctx.ui.notify(`security-guard: persisted ${scope}${useFolder ? " (folder)" : ""} override → ${path}`, "warning");
 		} catch (e) {

package/src/l2-guard/url.ts

@@ -1,32 +1,27 @@
 /**
  * Layer 2 domain allow/deny matching for the URL tools.
- * Pure: no pi, no OS.
+ * Pure: no pi, no OS. Host/pattern primitives live in src/core (shared with
+ * the Layer 1 network ask, ADR-023).
  */
 
+import { domainMatches, hostnameOf } from "../core/policy/domains";
 import type { Policy } from "./policy";
 
-export function hostnameOf(url: string): string | null {
-	try {
-		return new URL(url).hostname.toLowerCase();
-	} catch {
-		return null;
-	}
-}
+export { domainMatches, hostnameOf };
 
-export function domainMatches(host: string, pattern: string): boolean {
-	const p = pattern.toLowerCase();
-	if (p.startsWith("*.")) {
-		const suffix = p.slice(1); // ".npmjs.org"
-		return host === p.slice(2) || host.endsWith(suffix);
-	}
-	return host === p;
+/** The hard-deny tier: a host on `deniedDomains` is never ask-able in either layer. */
+export function deniedUrlReason(url: string, policy: Policy): string | null {
+	const host = hostnameOf(url);
+	if (!host) return null;
+	if (policy.network.deniedDomains.some((p) => domainMatches(host, p))) return `denied domain: ${host}`;
+	return null;
 }
 
 export function isAllowedUrl(url: string, policy: Policy): string | null {
 	const host = hostnameOf(url);
 	if (!host) return `not a valid URL: ${url}`;
-	if (policy.network.deniedDomains.some((p) => domainMatches(host, p)))
-		return `denied domain: ${host}`;
+	const denied = deniedUrlReason(url, policy);
+	if (denied) return denied;
 	if ((policy.overrides?.allowDomains ?? []).some((p) => domainMatches(host, p))) return null;
 	if (policy.network.allowedDomains.length === 0) return null;
 	if (policy.network.allowedDomains.some((p) => domainMatches(host, p))) return null;

package/src/shared/network-grants.ts

@@ -0,0 +1,31 @@
+/**
+ * Cross-layer network grant notification (ADR-023), shared by every layer
+ * entrypoint.
+ *
+ * Layer 2's "Allow and remember" writes `overrides.allowDomains`; Layer 1's
+ * running proxy only learns about it on reload. The entrypoints share no
+ * memory (ADR-018/020), so the grant travels over pi's process-wide event bus:
+ * guard.ts emits, sandbox.ts applies it live with SandboxManager.updateConfig.
+ */
+
+/** pi's shared event bus channel for persisted domain grants. */
+export const DOMAIN_GRANT_CHANNEL = "auto-permission-system:domain-grant";
+
+/** The pi bus APIs this module needs; kept structural so tests can fake them. */
+export interface DomainGrantBus {
+	emit(channel: string, data: unknown): void;
+	on(channel: string, handler: (data: unknown) => void): () => void;
+}
+
+/** Announce that `host` was persisted into overrides.allowDomains. */
+export function emitDomainGrant(bus: DomainGrantBus, host: string): void {
+	bus.emit(DOMAIN_GRANT_CHANNEL, { host });
+}
+
+/** Subscribe to persisted domain grants; ignores malformed payloads. Returns an unsubscribe. */
+export function onDomainGrant(bus: DomainGrantBus, handler: (host: string) => void): () => void {
+	return bus.on(DOMAIN_GRANT_CHANNEL, (data) => {
+		const host = (data as { host?: unknown } | null | undefined)?.host;
+		if (typeof host === "string" && host) handler(host);
+	});
+}