auto-permission-system 3.9.0 → 3.9.1

package/CHANGELOG.md

@@ -3,15 +3,6 @@
 All notable changes to this project will be documented in this file.
 Entries below [1.0.0] are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from [Conventional Commits](https://www.conventionalcommits.org/) — do not edit by hand.
 
-# [3.9.0](https://github.com/Navin009/auto-permission-system/compare/v3.8.0...v3.9.0) (2026-10-13)
-
-### Features
-
-* **demo:** crisp widescreen HD terminal recording (`demo.mp4`, `demo.gif`) demonstrating Cloud Auto Mode and Advanced Secure Mode
-* **branding:** official security shield logo and banner in documentation and package
-* **docs:** comprehensive FAQ, Cloud Auto Mode architecture, interactive prompt guides, and zero-trust documentation
-* **metadata:** package keywords, clean npm manifest, and remove legacy PyPI references
-
 # [2.0.0](https://github.com/Navin009/auto-permission-system/compare/v1.2.0...v2.0.0) (2026-10-02)
 
 

package/README.md

@@ -11,11 +11,11 @@
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](./LICENSE)
 [![Pi package](https://img.shields.io/badge/pi--package-gallery-blueviolet)](https://pi.dev/packages)
 [![CI](https://github.com/Navin009/auto-permission-system/actions/workflows/ci.yml/badge.svg)](https://github.com/Navin009/auto-permission-system/actions/workflows/ci.yml)
-[![Cloud Auto Mode for Pi](https://img.shields.io/badge/Pi-Cloud_Auto_Mode-blue.svg)](#secure-auto-mode--cloud-auto-mode)
+[![Claude Auto Mode for Pi](https://img.shields.io/badge/Pi-Claude_Auto_Mode-blue.svg)](#secure-auto-mode--claude-auto-mode)
 [![Security for Pi](https://img.shields.io/badge/Security-for_Pi-green.svg)](#security-for-pi-how-it-works)
 [![Permission System for Pi](https://img.shields.io/badge/Permission_System-for_Pi-orange.svg)](#permission-system--modes)
 
-**Auto Permission System** is a zero-trust permission architecture and **Secure Auto Mode / Cloud Auto Mode for the [Pi coding agent](https://pi.dev)**. It brings the confidence of **Claude's auto mode** to Pi—enabling autonomous agent workflows while actively scanning files, shell commands, and tool content to **prevent data breaches and credential exfiltration**.
+**Auto Permission System** is a zero-trust permission architecture and **Secure Auto Mode / Claude Auto Mode for the [Pi coding agent](https://pi.dev)**. It brings the confidence of **Claude's auto mode** to Pi—enabling autonomous agent workflows while actively scanning files, shell commands, and tool content to **prevent data breaches and credential exfiltration**.
 
 Whether running interactively with keyboard-driven ask prompts or running headlessly in CI/CD pipelines, this package enforces multi-layer boundaries across filesystem access, network egress, shell commands, and MCP tools.
 
@@ -25,14 +25,12 @@ Whether running interactively with keyboard-driven ask prompts or running headle
 
 ![Auto Permission System Demo](https://raw.githubusercontent.com/Navin009/auto-permission-system/main/assets/demo.gif)
 
-> **High-Definition Video:** Watch or download the full-resolution recording at [assets/demo.mp4](https://raw.githubusercontent.com/Navin009/auto-permission-system/main/assets/demo.mp4) (H.264, 60fps). Run `./demo/run-demo.sh` locally to reproduce this live simulation.
-
 ### Demonstrated Moments in the Recording:
 1. **Interactive `.env` Read Guard:** Intercepts `read(".env")` before the AI can see secrets. Displays a 10s countdown prompt defaulting to `No` (Block).
 2. **Kernel OS Sandbox Confinement:** Prevents bash commands from writing to system paths outside allowed roots (`EROFS: Read-only file system`).
 3. **Governed Network Egress:** Catches unknown outbound connections (`curl`) with an interactive domain ask prompt and a 15s countdown timer.
 4. **Real-Time API Key & Secret Redaction:** Automatically detects exposed API tokens (`sk-proj-...`, `ghp_...`) in command output and replaces them with `***REDACTED***` before reaching the LLM context.
-5. **Autonomous Cloud Auto Mode:** Demonstrates headless, fail-closed CI execution (`pi -p`) with zero deadlocks and zero hangs.
+5. **Autonomous Claude Auto Mode:** Demonstrates headless, fail-closed CI execution (`pi -p`) with zero deadlocks and zero hangs.
 
 ---
 
@@ -43,7 +41,7 @@ Whether running interactively with keyboard-driven ask prompts or running headle
 - [Key Features at a Glance](#key-features-at-a-glance)
 - [Security for Pi: How It Works](#security-for-pi-how-it-works)
 - [Interactive Ask Prompts](#interactive-ask-prompts)
-- [Secure Auto Mode & Cloud Auto Mode](#secure-auto-mode--cloud-auto-mode)
+- [Secure Auto Mode & Claude Auto Mode](#secure-auto-mode--claude-auto-mode)
 - [Real-Time Secret Detection & Content Scanning](#real-time-secret-detection--content-scanning)
 - [Permission System & Modes](#permission-system--modes)
 - [Configuration Reference](#configuration-reference)
@@ -100,7 +98,7 @@ Once installed, the extension automatically loads whenever you launch `pi`. Chec
 | Feature | Description | Protection Level |
 |---|---|---|
 | 🛡️ **3-Layer Defense** | OS Kernel sandbox (`bubblewrap`/`sandbox-exec`) + in-process tool guard + real-time content redactor. | Zero-Trust |
-| ⚡ **Secure Auto Mode** | Autonomous execution inspired by Claude's auto mode; scans files and output to prevent data breaches. | Autonomous / Cloud |
+| ⚡ **Secure Auto Mode** | Autonomous execution inspired by Claude's auto mode; scans files and output to prevent data breaches. | Autonomous / Claude |
 | 🔑 **Interactive Ask Prompts** | Real-time terminal prompts with 10s countdowns (`Once`, `Session`, `Project`, `Global`). | Interactive Human-in-the-Loop |
 | 🔍 **AST & Regex Secret Scanner** | Scans tool stdout/stderr for API keys, private keys, and tokens, redacting them before model context. | Data Breach Prevention |
 | 🌐 **Network Egress Gate** | Intercepts unapproved network connections and prompts for confirmation with wildcards. | Data Leak Prevention |
@@ -162,7 +160,7 @@ When an unlisted domain, `.env` file, or directory write is requested during an
 
   > No
     Yes, just this once
-    Yes, for this session
+    Yes, for this conversation
 
   Default: No (10s)
 ```
@@ -179,7 +177,7 @@ When an unlisted domain, `.env` file, or directory write is requested during an
 
   > No
     Yes, just this once
-    Yes, all in group for this session
+    Yes, all in group for this conversation
     Yes, always…
 
   Default: Yes, just this once (15s)
@@ -191,33 +189,34 @@ When an unlisted domain, `.env` file, or directory write is requested during an
 ⚠  Sensitive information detected: API Secret Key
 
     Tool     bash (node verify_service.js)
-    Finding  sk-(?!ant-)[A-Za-z0-9_-] (score: 90 / CRITICAL)
+    Finding  23: sk-(?!ant-)[A-Za-z0-9_-]
     Question Should the AI be allowed to see it?
 
   > No, keep private  (recommended)
     Yes, allow
 ```
+- `Finding` prints the **complete** detected line and its line number — one `Finding` row per match when several secrets appear, with no truncation.
 - Choosing **No, keep private** replaces the token with `***REDACTED***` in the model's context window, preventing credentials from leaking to LLM providers.
 
 ---
 
-## Secure Auto Mode & Cloud Auto Mode
+## Secure Auto Mode & Claude Auto Mode
 
 In modern AI coding tools like Claude Code, developers love **auto mode** because the agent can execute tasks autonomously without constantly prompting for confirmation on trivial, harmless steps.
 
 However, unconstrained auto mode is a significant data breach risk. If an autonomous agent reads credentials, runs unvetted scripts, or sends code to third-party endpoints, the entire developer environment can be compromised.
 
-**Cloud Auto Mode for Pi** delivers **Claude-style auto mode with zero-trust security**:
+**Claude Auto Mode for Pi** delivers **Claude-style auto mode with zero-trust security**:
 - **Autonomous Execution with Real-Time Guardrails:** The agent operates autonomously within approved boundaries, allowing rapid development while guarding sensitive resources.
 - **Advanced Secure Scanning:** Uses `advanced-secure` mode to scan files, commands, and content to stop data breaches before they can occur.
 - **Fail-Closed in Headless CI/CD:** When running unattended (`pi -p`, GitHub Actions, Docker, remote devboxes), unapproved operations fail closed immediately with a structured reason instead of hanging or deadlocking the pipeline.
 
-### Activating Cloud Auto Mode in CI/CD:
+### Activating Claude Auto Mode in CI/CD:
 
 ```bash
-# 1. Copy the shipped Cloud Auto Mode template to your repository:
+# 1. Copy the shipped Claude Auto Mode template to your repository:
 mkdir -p .pi
-cp node_modules/auto-permission-system/sandbox.cloud.json .pi/sandbox.json
+cp node_modules/auto-permission-system/sandbox.claude.json .pi/sandbox.json
 
 # 2. Run Pi headlessly with complete automated protection:
 pi -p "Review pull request changes, verify dependencies, and execute test suite"
@@ -240,10 +239,10 @@ jobs:
         run: |
           npm install -g @earendil-works/pi-coding-agent
           pi install npm:auto-permission-system
-      - name: Activate Cloud Auto Mode Preset
+      - name: Activate Claude Auto Mode Preset
         run: |
           mkdir -p .pi
-          cp node_modules/auto-permission-system/sandbox.cloud.json .pi/sandbox.json
+          cp node_modules/auto-permission-system/sandbox.claude.json .pi/sandbox.json
       - name: Run Autonomous Review in Auto Mode
         run: |
           pi -p "Verify changes, run npm test, and flag security issues"
@@ -394,11 +393,11 @@ grep '"finding"' ~/.pi/agent/audit.log | tail -n 10
 
 A selection of common questions is below. For the complete, detailed guide, read **[docs/FAQ.md](docs/FAQ.md)**.
 
-### How does Cloud Auto Mode secure unattended runs?
+### How does Claude Auto Mode secure unattended runs?
 In headless mode (`pi -p` or subagent executions), interactive ask prompts cannot be presented to a human. Auto Permission System operates in a fail-closed posture: any tool call or bash command targeting an unlisted domain, credential file, or outside-project path is automatically blocked, and the refusal reason is provided to the agent and recorded in the audit log.
 
-### What is the relationship between Cloud Auto Mode and Claude's auto mode?
-Claude Code popularized autonomous "auto mode", allowing developers to let AI code without stopping for confirmation on harmless steps. Cloud Auto Mode brings this exact convenience to the Pi coding agent, but adds essential zero-trust boundaries: using Advanced Secure Mode to scan files, shell commands, and content to guarantee that autonomous execution never leads to data breaches or leaked API tokens.
+### What is the relationship between Claude Auto Mode and Claude's auto mode?
+Claude Code popularized autonomous "auto mode", allowing developers to let AI code without stopping for confirmation on harmless steps. Claude Auto Mode brings this exact convenience to the Pi coding agent, but adds essential zero-trust boundaries: using Advanced Secure Mode to scan files, shell commands, and content to guarantee that autonomous execution never leads to data breaches or leaked API tokens.
 
 ### How do I allow the agent to reach a new domain?
 Add it to `network.allowedDomains` in `<cwd>/.pi/sandbox.json` or `~/.pi/agent/extensions/sandbox.json`, or run a curl command once and select **Yes, always… → All in group in this project**.

package/extensions/guard.ts

@@ -65,7 +65,7 @@ async function askDetection(
 	if (choice === "session") {
 		detectionGrants.add(key);
 		audit({ layer: 2, tool: kind, subject, reason, decision: "session", note: "advanced-secure", cwd: ctx.cwd });
-		ctx.ui.notify(`security-guard: allowed for this session (not saved) → ${subject}`, "info");
+		ctx.ui.notify(`security-guard: allowed for this conversation (not saved) → ${subject}`, "info");
 		return null;
 	}
 	audit({ layer: 2, tool: kind, subject, reason, decision: "no", note: "advanced-secure", cwd: ctx.cwd });
@@ -288,7 +288,7 @@ export default function (pi: ExtensionAPI) {
 			if (typeof rawPath === "string" && rawPath) return rawPath;
 			if (event.toolName === "bash") {
 				const cmd = (event.input as { command?: string } | undefined)?.command;
-				return cmd ? `bash: ${cmd}` : "bash";
+				return cmd ? `bash (${cmd})` : "bash";
 			}
 			return event.toolName;
 		})();
@@ -301,15 +301,15 @@ export default function (pi: ExtensionAPI) {
 			if (choice === "program-session" && programId) {
 				grantProgramOutputSession(programId);
 				audit({ layer: 2, tool: event.toolName, decision: "session", grant: programId, note: "advanced-secure-output", findings, cwd: ctx.cwd });
-				ctx.ui.notify(`🛡 Advanced Secure: you allowed all ${programId} output for the rest of this session.`, "info");
+				ctx.ui.notify(`🧠 Advanced Secure: you allowed all ${programId} output for the rest of this conversation.`, "info");
 			} else {
 				audit({ layer: 2, tool: event.toolName, decision: "yes", note: "advanced-secure-output", findings, cwd: ctx.cwd });
-				ctx.ui.notify(`🛡 Advanced Secure: you allowed ${event.toolName} output to be sent.`, "warning");
+				ctx.ui.notify(`🧠 Advanced Secure: you allowed ${event.toolName} output to be sent.`, "warning");
 			}
 			return;
 		}
 		audit({ layer: 2, tool: event.toolName, decision: "no", note: "advanced-secure-output", findings, cwd: ctx.cwd });
-		ctx.ui.notify(`🛡 Advanced Secure: blocked ${event.toolName} output — it may contain sensitive information. Nothing was sent to the model.`, "warning");
+		ctx.ui.notify(`🧠 Advanced Secure: blocked ${event.toolName} output — it may contain sensitive information. Nothing was sent to the model.`, "warning");
 		return { content: [{ type: "text", text: withheldNotice(subject) }] };
 	});
 
@@ -349,7 +349,7 @@ export default function (pi: ExtensionAPI) {
 				}
 				recordProjectTrust(file, TRUST_STORE);
 				audit({ layer: 2, event: "project-trusted", file, applied: changes, cwd: ctx.cwd });
-				ctx.ui.notify("Done. The file applies now. Start a new session so the bash sandbox uses it too.", "info");
+				ctx.ui.notify("Done. The file applies now. Start a new conversation so the bash sandbox uses it too.", "info");
 				return;
 			}
 			if (!active) {
@@ -367,7 +367,7 @@ export default function (pi: ExtensionAPI) {
 				`  cwd:               ${ctx.cwd}`,
 				`  hasUI:             ${(ctx as { hasUI?: boolean }).hasUI !== false}`,
 				`  subagent.network:  ${policy.subagent?.network ?? "allow"}`,
-				`  session grants:    ${sessionGrantSummary() || "(none)"}`,
+				`  conversation grants:    ${sessionGrantSummary() || "(none)"}`,
 				`  project file:      ${!existsSync(projectPolicyPath(ctx.cwd)) ? "none" : projectTrusted(ctx.cwd) ? "trusted" : untrustedProjectChanges(ctx.cwd).length ? `not trusted, its weaker settings are ignored (/security trust)` : "only block rules, they apply"}`,
 				`  outside project:   read ${policy.filesystem.outsideProject?.read ?? "allow"}${(policy.filesystem.outsideProject?.allowRead ?? []).length ? `, allowRead ${policy.filesystem.outsideProject?.allowRead?.join(", ")}` : ""}`,
 				"",

package/extensions/permission-mode.ts

@@ -46,7 +46,7 @@ const EXPLANATION = [
 	"  No file contents are inspected.",
 	"",
 	"YOLO",
-	"  Turns every layer off. Saved like the other modes, so new sessions",
+	"  Turns every layer off. Saved like the other modes, so new conversations",
 	"  start with it too until you pick Default or Advanced Secure again.",
 ].join("\n");
 
@@ -72,8 +72,8 @@ function renderSandboxChip(ctx: ExtensionContext): void {
 }
 
 function modeNotice(mode: PermissionMode): { text: string; level: "info" | "warning" } {
-	if (mode === "yolo") return { text: "⚠️  YOLO — all security layers disabled. Saved; new sessions start this way too.", level: "warning" };
-	if (mode === "advanced-secure") return { text: "🛡 Advanced Secure on. File reads, MCP calls, and tool output are checked for secrets.", level: "info" };
+	if (mode === "yolo") return { text: "⚠️  YOLO — all security layers disabled. Saved; new conversations start this way too.", level: "warning" };
+	if (mode === "advanced-secure") return { text: "🧠 Advanced Secure on. File reads, MCP calls, and tool output are checked for secrets.", level: "info" };
 	return { text: "🛡 Default mode. Rule-based policy only.", level: "info" };
 }
 
@@ -92,7 +92,7 @@ async function pickMode(pi: ExtensionAPI, ctx: ExtensionContext, yolo: { active:
 			emitYolo(pi.events, true);
 			audit({ layer: 0, event: "permission-mode", mode: "yolo", cwd: ctx.cwd, note: "runtime-sync" });
 			renderSandboxChip(ctx);
-			ctx.ui.notify("⚠️  YOLO — all security layers disabled for this session.", "warning");
+			ctx.ui.notify("⚠️  YOLO — all security layers disabled for this conversation.", "warning");
 			return;
 		}
 		ctx.ui.notify(`Permission mode is already ${modeLabel(next)}.`, "info");

package/extensions/sandbox.ts

@@ -218,7 +218,7 @@ export default function (pi: ExtensionAPI) {
 				`  Allow Write: ${config.filesystem?.allowWrite?.join(", ") || "(none)"}`,
 				`  Deny Write: ${config.filesystem?.denyWrite?.join(", ") || "(none)"}`,
 				`  Outside project reads: ${config.filesystem?.outsideProject?.read ?? "allow"}`,
-				`  Session grants: ${filesystemSessionGrantSummary() || "(none)"}`,
+				`  Conversation grants: ${filesystemSessionGrantSummary() || "(none)"}`,
 			];
 			ctx.ui.notify(lines.join("\n"), "info");
 		},

package/package.json

@@ -1,36 +1,34 @@
 {
   "name": "auto-permission-system",
-  "version": "3.9.0",
-  "description": "Secure auto mode & cloud auto mode for Pi. A zero-trust permission system for the Pi coding agent powered by Advanced Secure mode to scan files, content, and tools to prevent data breaches.",
+  "version": "3.9.1",
+  "description": "Claude auto mode for Pi & security for Pi. A zero-trust permission system for Pi coding agent powered by Advanced Secure mode to scan files, content, and tools to prevent data breaches.",
   "type": "module",
   "author": "Navin Kumar",
   "keywords": [
     "pi-package",
     "pi",
     "pi-coding-agent",
+    "claude-auto-mode-for-pi",
     "pi-extension",
     "pi-permission",
     "pi-permissions",
     "pi-permission-system",
     "pi-security",
-    "cloud-auto-mode-for-pi",
     "security-for-pi",
     "permission-system-for-pi",
     "secure-pi",
-    "cloud-auto-mode",
-    "pi-cloud-auto-mode",
+    "claude-auto-mode",
+    "pi-claude-auto-mode",
     "auto-permission-system",
     "auto-secure",
     "secure",
     "secure-it",
     "auto-mode",
     "safe-auto-mode",
-    "claude-auto-mode",
     "data-breach-prevention",
     "content-scan",
-    "cloud",
-    "cloud-security",
-    "auto-mode",
+    "claude",
+    "claude-security",
     "permission",
     "permissions",
     "permission-system",
@@ -91,7 +89,7 @@
     "assets/",
     "sandbox.example.json",
     "sandbox.default.json",
-    "sandbox.cloud.json",
+    "sandbox.claude.json",
     "banner.png",
     "README.md",
     "CHANGELOG.md",

package/skills/auto-permission-system/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: auto-permission-system
-description: Use this skill when the user asks about auto-permission-system, security for Pi, permission system for Pi, how to secure Pi, Cloud auto mode for Pi, security policy configuration, why a tool call was blocked, how to add an allow-list entry, or how to configure sandbox behavior. Covers the two-layer sandbox (OS-level bash sandbox and in-process tool guard), policy file locations and fields, Cloud auto mode preset (sandbox.cloud.json), ask-tier prompt options, absolute-deny paths, escape hatches (--yolo, --no-sandbox, /permission-mode → YOLO), the audit log, and common tasks like allowing a new domain or write path.
+description: Use this skill when the user asks about auto-permission-system, security for Pi, permission system for Pi, how to secure Pi, Claude auto mode for Pi, security policy configuration, why a tool call was blocked, how to add an allow-list entry, or how to configure sandbox behavior. Covers the two-layer sandbox (OS-level bash sandbox and in-process tool guard), policy file locations and fields, Claude auto mode preset (sandbox.claude.json), ask-tier prompt options, absolute-deny paths, escape hatches (--yolo, --no-sandbox, /permission-mode → YOLO), the audit log, and common tasks like allowing a new domain or write path.
 ---
 
 # Security for Pi (Pi Permission System) — Skill
 
-Use this skill when the user asks about the auto-permission-system extension, security for Pi, permission system for Pi, how to secure Pi, or configuring Cloud auto mode for Pi.
+Use this skill when the user asks about the auto-permission-system extension, security for Pi, permission system for Pi, how to secure Pi, or configuring Claude auto mode for Pi.
 
 ## What this extension does
 
@@ -14,19 +14,19 @@ Wraps the `bash` tool with `sandbox-exec` (macOS) or `bubblewrap` (Linux). Block
 - Filesystem writes outside `allowWrite`
 - Filesystem reads of `denyRead` paths (defaults include `~/.ssh`, `~/.aws`, `~/.gnupg`, `~/.pi/agent`)
 - Filesystem reads outside the project when `outsideProject.read` is `"ask"` or `"deny"` — when set, the home dir (and the project's parent) is fenced with `denyRead` and the project plus `allowWrite`/`outsideProject.allowRead` are re-exposed (ADR-014). With `"ask"`, a bash command that *plainly* names an outside path is confirmed with you **before it runs** (ADR-015): allow (`yes — this once`, or a persistent `always` grant) → the real, complete output; deny → the command is not run at all (no silently trimmed output). `install`/`npm` under `~/.pi/agent` are pre-allowed via `outsideProject.allowRead`, so they never prompt. Obfuscated reads still hit the fence and stay masked.
-- Network egress to domains not in `allowedDomains`: a host in neither list asks before the proxy decides (ADR-023) — `yes — this once` covers that bash command's connections to the host, `yes — for this session` lasts until the session ends, and `always` writes `overrides.allowDomains` and applies live. A host in `deniedDomains`, or `network.strictAllowlist: true`, is a hard deny that is never ask-able; headless blocks.
+- Network egress to domains not in `allowedDomains`: a host in neither list asks before the proxy decides (ADR-023) — `yes — this once` covers that bash command's connections to the host, `yes — for this conversation` lasts until the conversation ends, and `always` writes `overrides.allowDomains` and applies live. A host in `deniedDomains`, or `network.strictAllowlist: true`, is a hard deny that is never ask-able; headless blocks.
 
 **Layer 2 — In-process tool guard**
 Hooks `tool_call` for `read`, `grep`, `find`, `ls`, `write`, `edit`, `fetch_content`, `web_search`, `get_search_content`. Applies the same policy file as Layer 1. For `grep`, `find` and `ls` the search root is checked like a `read` path. A `tool_result` hook also removes `grep` output lines from denied files beneath an allowed root (for example a `.env` deep in the tree); approving the root does not approve those files. When a call is blocked, shows an interactive prompt with persistence options.
 
-**Layer 3 — Subagent posture & Cloud Auto Mode**
-When `ctx.hasUI === false` (subagents, `-p`, JSON mode, CI/CD runs), applies the `subagent.network` policy: `allow` (default) | `deny` | `research-only`. In Cloud Auto Mode, unapproved prompts fail closed.
+**Layer 3 — Subagent posture & Claude Auto Mode**
+When `ctx.hasUI === false` (subagents, `-p`, JSON mode, CI/CD runs), applies the `subagent.network` policy: `allow` (default) | `deny` | `research-only`. In Claude Auto Mode, unapproved prompts fail closed.
 
 ## Policy files
 
 Merged in order (later wins):
 1. `sandbox.default.json` — shipped baseline (`outsideProject.read: "ask"`, full `denyRead`/`denyWrite`, `modelDenyRead`)
-2. `sandbox.cloud.json` — shipped Cloud Auto Mode preset for headless, Docker, and CI/CD runs (`strictAllowlist: true`, `outsideProject.read: "deny"`)
+2. `sandbox.claude.json` — shipped Claude Auto Mode preset for headless, Docker, and CI/CD runs (`strictAllowlist: true`, `outsideProject.read: "deny"`)
 3. `~/.pi/agent/extensions/sandbox.json` — global user policy
 4. `<cwd>/.pi/sandbox.json` — project-local overrides (also written by ask-tier prompts)
 
@@ -87,7 +87,7 @@ A project `.pi/sandbox.json` applies in full only after the user trusted its exa
 When a normal (non-absolute-deny) call is blocked:
 - **no — block** — hard deny (default, pre-selected)
 - **yes — this once** — allow just this call
-- **yes — for this session** — this file, its parent folder, or this domain until the session ends; not saved
+- **yes — for this conversation** — this file, its parent folder, or this domain until the conversation ends; not saved
 - **always for CURRENT project** — whitelist this file in `<cwd>/.pi/sandbox.json`
 - **always for CURRENT project (folder)** — whitelist the parent directory
 - **always for ALL projects** — whitelist in `~/.pi/agent/extensions/sandbox.json`
@@ -99,7 +99,7 @@ For a Layer 1 bash **write** blocked after the command already ran, `yes — thi
 
 Every prompt waits **15 seconds** by default and shows it live as `Default: … (Ns)` under the body. For file reads/writes no answer means the safe default: **block / deny**, and Esc blocks. For a network ask, an unanswered countdown means **allow once** (Esc still denies) — ADR-024. In the TUI the `Default:` line disappears as soon as you press ↑/↓ and the timer restarts, so the hint never competes with an active choice (ADR-031). The prompt is keyboard-only (ADR-036): ↑/↓ move the highlight, Enter selects, Esc cancels — a mouse click or wheel over the prompt does nothing.
 
-The same options apply to a bash command whose network request reaches a host outside `allowedDomains` (ADR-023), with the countdown default and live footer from ADR-024/ADR-031: `No` / `Yes, just this once` / `Yes, all in group for this session` / `Yes, always…`, and an untouched countdown counts as allow-once. Because the sandbox proxy asks per connection, `Allow (default)` covers that bash command rather than one connection — redirects and parallel connections to the same host do not re-prompt. A host in `deniedDomains`, or `network.strictAllowlist: true`, is blocked outright: the prompt never appears. A remembered host is written to `overrides.allowDomains` and takes effect immediately, so the waiting request completes without a retry. Prompts from both layers are serialized through one queue (`src/ui/ask-flow.ts`), so two unknown hosts cannot replace each other's selector and hang the waiting connection.
+The same options apply to a bash command whose network request reaches a host outside `allowedDomains` (ADR-023), with the countdown default and live footer from ADR-024/ADR-031: `No` / `Yes, just this once` / `Yes, all in group for this conversation` / `Yes, always…`, and an untouched countdown counts as allow-once. Because the sandbox proxy asks per connection, `Allow (default)` covers that bash command rather than one connection — redirects and parallel connections to the same host do not re-prompt. A host in `deniedDomains`, or `network.strictAllowlist: true`, is blocked outright: the prompt never appears. A remembered host is written to `overrides.allowDomains` and takes effect immediately, so the waiting request completes without a retry. Prompts from both layers are serialized through one queue (`src/ui/ask-flow.ts`), so two unknown hosts cannot replace each other's selector and hang the waiting connection.
 
 ## Sensitive reads ask
 
@@ -113,7 +113,7 @@ The same options apply to a bash command whose network request reaches a host ou
 - **`advanced-secure`** (recommended) — adds secret/credential detection, and **only adds asks or blocks** (never loosens):
   - file reads whose name looks like a credential store ask before the read;
   - risky `mcp__<server>__<tool>` calls ask before they run. The gate ignores the `mcp__<server>__` namespace, takes the operation from the head verb of the name (or the first verb of the description), and asks for destructive names, mutating names (`update_*`, `create_*`, `run_*`, `evaluate_*`), and destructive arguments (SQL `DELETE`/`UPDATE` without `WHERE`, `rm -rf`, `*` targets, HTTP `DELETE`, production targets). A documented tool with an unclassified name (`context`, `capture`, `logs`) does not ask; a tool with **no description** counts as opaque and does. Tune it under `mcp` in `sandbox.json` (ADR-032): `allowTools` / `allowPrefixes` skip asks, `askTools` forces them, `trustAnnotations` lets a server's `readOnlyHint` allow the call, `askThreshold` moves the score line (default 30). An untrusted project file may only tighten it (add `askTools`, lower `askThreshold`, turn `allowSimpleUpdates`/`trustAnnotations` off).
-  - before any tool/command/file output reaches the model, a secret-like hit shows the file and each detected line as `lineNo: text`, with two choices — **No, keep private** or **Yes, allow**. No, keep private withholds the output and tells the model it was withheld because it may contain sensitive information (not a failure, not an empty result).
+  - before any tool/command/file output reaches the model, a secret-like hit shows the tool and each detected line as `Finding  <lineNo>: <complete line>` — one `Finding` row per match, no truncation — plus `Question Should the AI be allowed to see it?`, with two choices — **No, keep private** or **Yes, allow**. No, keep private withholds the output and tells the model it was withheld because it may contain sensitive information (not a failure, not an empty result).
 
 Switch with `/permission-mode`; all three modes are saved to the global `sandbox.json` and reflected in the footer's sandbox chip (`Sandbox: 🧠 N domains, M paths` for advanced-secure, `Sandbox: 🔒 …` for default). An untrusted project may move the mode **up** (toward stricter), never down: it cannot turn on YOLO or turn off Advanced Secure. The third choice, **YOLO**, disables every layer; the chip reads `⚠️ YOLO — all security layers disabled` until you pick another mode (ADR-020).
 

package/src/core/trust.ts

@@ -67,7 +67,7 @@ export function isProjectFileDeclined(projectPath: string, storePath: string): b
  * and share only the store file (ADR-018/ADR-020).
  */
 export interface ProjectTrust {
-	/** Record pi's own project-trust answer for this session. Declined is never trusted. */
+	/** Record pi's own project-trust answer for this conversation. Declined is never trusted. */
 	setDeclined(value: boolean): void;
 	/** The project file applies in full only when its current hash is recorded and pi did not decline. */
 	isTrusted(cwd: string): boolean;

package/src/l1-sandbox/bash-ops.ts

@@ -40,7 +40,7 @@ function linkRow(absPath: string, spelled: string | undefined): string[] {
 const auditL1 = (entry: Record<string, unknown>) => audit({ layer: 1, tool: "bash", ...entry });
 
 /**
- * In-memory filesystem grants from "Yes, for this session" (ADR-010, ADR-012).
+ * In-memory filesystem grants from "Yes, for this conversation" (ADR-010, ADR-012).
  * A read grant is the absolute path; a write grant is the parent directory (a
  * whole path would not let a new file be created — ADR-021), falling back to the
  * exact path when the parent is an unsafe folder to grant (root, home, …).
@@ -48,7 +48,7 @@ const auditL1 = (entry: Record<string, unknown>) => audit({ layer: 1, tool: "bas
  */
 const sessionReadGrants: string[] = [];
 const sessionWriteGrants: string[] = [];
-/** askRead (.env) session grants, kept apart so they never leak into allowRead (ADR-019). */
+/** askRead (.env) conversation grants, kept apart so they never leak into allowRead (ADR-019). */
 const sessionAskReadGrants: string[] = [];
 
 export function clearFilesystemSessionGrants(): void {
@@ -158,7 +158,7 @@ async function preflightOutsideReads(
 		if (choice === MainChoice.Session) {
 			sessionReadGrants.push(absPath);
 			auditL1({ subject: absPath, decision: "session", scope: "session", reason: "outside-project-read", note: "preflight", cwd });
-			opts.ctx.ui?.notify?.(`pi-sandbox: allowed read of ${absPath} for this session (not saved)`, "info");
+			opts.ctx.ui?.notify?.(`pi-sandbox: allowed read of ${absPath} for this conversation (not saved)`, "info");
 			continue;
 		}
 		if (choice !== MainChoice.Remember || !grant) {
@@ -366,8 +366,8 @@ export function createSandboxedBashOps(opts?: SandboxedBashOpts): BashOperations
 									if (choice === MainChoice.Once) readOnce.push(absPath);
 									else sessionReadGrants.push(absPath);
 									auditL1({ subject: absPath, decision: choice, scope: choice === MainChoice.Once ? "invocation" : "session", cwd: opts.ctx.cwd, note: "outside-project-read" });
-									opts.ctx.ui?.notify?.(`pi-sandbox: allowed read of ${absPath} ${choice === MainChoice.Once ? "once" : "for this session"} — re-running the command`, "warning");
-									onData(Buffer.from(`\n✅ pi-sandbox: read of ${absPath} allowed ${choice === MainChoice.Once ? "once" : "for this session"}. Command output with the new permission follows.\n`));
+									opts.ctx.ui?.notify?.(`pi-sandbox: allowed read of ${absPath} ${choice === MainChoice.Once ? "once" : "for this conversation"} — re-running the command`, "warning");
+									onData(Buffer.from(`\n✅ pi-sandbox: read of ${absPath} allowed ${choice === MainChoice.Once ? "once" : "for this conversation"}. Command output with the new permission follows.\n`));
 									resolve(attempt([]));
 									return;
 								}
@@ -441,8 +441,8 @@ export function createSandboxedBashOps(opts?: SandboxedBashOpts): BashOperations
 									sessionWriteGrants.push(value);
 									(value === parentDir ? grantedWriteFolders : grantedWriteFiles).add(value);
 									auditL1({ subject: value, granularity: value === parentDir ? "folder" : "file", original: absPath, decision: "session", scope: "session", cwd: opts.ctx.cwd, note: "write-session" });
-									opts.ctx.ui?.notify?.(`pi-sandbox: allowed ${value} for this session (not saved) — re-running the command`, "info");
-									onData(Buffer.from(`\n✅ pi-sandbox: write to ${value} allowed for this session. Command output with the new permission follows.\n`));
+									opts.ctx.ui?.notify?.(`pi-sandbox: allowed ${value} for this conversation (not saved) — re-running the command`, "info");
+									onData(Buffer.from(`\n✅ pi-sandbox: write to ${value} allowed for this conversation. Command output with the new permission follows.\n`));
 									resolve(attempt([]));
 									return;
 								}

package/src/l1-sandbox/network-ask.ts

@@ -4,7 +4,7 @@
  * Uses the same two-screen ask-tier as Layer 2 (once / session / remember
  * project|global) and the same grant semantics:
  *
- * - session grants: in memory only, cleared at `session_start`, never saved;
+ * - conversation grants: in memory only, cleared at `session_start`, never saved;
  * - "once" grants: one bash command's connections to that host (the proxy
  *   calls back per request, so a redirect or a parallel connection must not
  *   re-prompt), scoped by `beginNetworkCommand`/`endNetworkCommand`;
@@ -14,7 +14,7 @@
  *
  * Headless (`hasUI === false`) denies, like every other gate.
  *
- * Session grants use the parent-domain wildcard when useful (covers all sibling
+ * Conversation grants use the parent-domain wildcard when useful (covers all sibling
  * subdomains). Screen 2 hides the "in this project" rows in untrusted
  * projects so the user can't quietly trust a widening file.
  */
@@ -22,7 +22,7 @@
 import { domainMatches, GrantScope, OverrideKind } from "../core/index";
 import { askMainWithRemember, askRememberHost, ASK_TIMEOUT_MS, MainChoice, parentDomainWildcard, type AskCtx, type HostGrant } from "../ui/ask-flow";
 
-/** In-memory session grants ("Yes, for this session"). Cleared at session_start. */
+/** In-memory conversation grants ("Yes, for this conversation"). Cleared at session_start. */
 const sessionGrants: string[] = [];
 /** Hosts allowed for the current bash command ("Yes, just this once" covers its connections). */
 let commandGrants: Set<string> | null = null;
@@ -87,7 +87,7 @@ function firstWord(command: string | undefined): string | null {
 
 /**
  * Screen 1 (once / session / remember) plus, for remember, screen 2 (scope and
- * pattern). A session grant uses the parent-domain wildcard when the host has
+ * pattern). A conversation grant uses the parent-domain wildcard when the host has
  * a useful parent, so any sibling subdomain is covered for the rest of the
  * session; apex hosts (2 parts) fall back to the exact host because
  * `*.example.com` would not match `example.com`.
@@ -124,7 +124,7 @@ async function decide(deps: NetworkAskDeps, host: string, port: number | undefin
 			bodyParts.join("\n"),
 			{
 				session: true,
-				sessionLabel: "Yes, all in group for this session",
+				sessionLabel: "Yes, all in group for this conversation",
 				allowFirst: true,
 				icon: "net",
 				timeoutMs: ASK_TIMEOUT_MS,
@@ -161,7 +161,7 @@ async function decide(deps: NetworkAskDeps, host: string, port: number | undefin
 	if (mainChoice === MainChoice.Session) {
 		sessionGrants.push(wildcard);
 		deps.audit({ ...base, decision: "session", grant: wildcard, requested: host });
-		ctx.ui.notify?.(`pi-sandbox: allowed for this session (not saved) → ${wildcard}`, "info");
+		ctx.ui.notify?.(`pi-sandbox: allowed for this conversation (not saved) → ${wildcard}`, "info");
 		return true;
 	}
 

package/src/l2-guard/exposure.ts

@@ -5,15 +5,10 @@ import { scanToolOutput } from "../detect/index";
 export interface Exposure {
 	/** Finding types, e.g. ["SECRET_ASSIGNMENT"]. Empty means clean. */
 	types: string[];
-	/** One block: `subject` then `lineNo: text` per detected line (max 8). */
+	/** One block: `Tool` header then `Finding  <lineNo>: <line>` per detected line. */
 	hits: string[];
 }
 
-const MAX_LINES = 8;
-const MAX_LINE_CHARS = 200;
-
-const clip = (s: string) => (s.length > MAX_LINE_CHARS ? `${s.slice(0, MAX_LINE_CHARS)}…` : s);
-
 export function collectExposure(content: ReadonlyArray<{ type: string; text?: string }>, subject: string): Exposure {
 	const types = new Set<string>();
 	const lines: string[] = [];
@@ -29,14 +24,9 @@ export function collectExposure(content: ReadonlyArray<{ type: string; text?: st
 			if (after[i] !== before[i] && before[i].trim()) matchedIndices.push(i);
 		}
 		if (matchedIndices.length === 0) continue;
-		const shown = matchedIndices.slice(0, MAX_LINES);
-		const firstIdx = shown[0];
-		const lastIdx = shown[shown.length - 1];
-		const moreMatched = matchedIndices.length > MAX_LINES;
-		const moreBelow = lastIdx < before.length - 1;
-		if (firstIdx > 0) lines.push("        \u2026");
-		for (const idx of shown) lines.push(`${idx + 1}: ${clip(before[idx].trim())}`);
-		if (moreMatched || moreBelow) lines.push("        \u2026");
+		lines.push(`Tool     ${subject}`);
+		// One `Finding` row per detected line, showing the complete line (no clipping).
+		for (const idx of matchedIndices) lines.push(`Finding  ${idx + 1}: ${before[idx].trim()}`);
 	}
-	return { types: [...types], hits: lines.length ? [`From     ${subject}\n${lines.join("\n")}`] : [] };
+	return { types: [...types], hits: lines.length ? [lines.join("\n")] : [] };
 }

package/src/l2-guard/program-grants.ts

@@ -1,11 +1,11 @@
 /**
- * In-memory session grants for the Advanced Secure output gate (ADR-018).
+ * In-memory conversation grants for the Advanced Secure output gate (ADR-018).
  *
  * When a CLI like `composio` returns output that matches a secret pattern
  * (JWT, OAuth refresh token, etc.), the user can pick "Yes, all <program>
- * output for this session" instead of approving every block. The program id
+ * output for this conversation" instead of approving every block. The program id
  * is added here, and the output gate short-circuits for the rest of the
- * session — same shape as path/host session grants, but for tool output.
+ * conversation — same shape as path/host conversation grants, but for tool output.
  *
  * Cleared at session_start (ADR-010), never written to disk. The credential
  * tier (denyRead / askRead) still wins on the file side; this only loosens
@@ -19,12 +19,12 @@ export function clearProgramOutputSessionGrants(): void {
 	programOutputSessionGrants.clear();
 }
 
-/** Add a program to the session grant list. Idempotent. */
+/** Add a program to the conversation grant list. Idempotent. */
 export function grantProgramOutputSession(programId: string): void {
 	programOutputSessionGrants.add(programId.toLowerCase());
 }
 
-/** True when the program is already granted for the rest of the session. */
+/** True when the program is already granted for the rest of the conversation. */
 export function isProgramOutputGranted(programId: string | undefined): boolean {
 	if (!programId) return false;
 	return programOutputSessionGrants.has(programId.toLowerCase());

package/src/l2-guard/program-id.ts

@@ -1,9 +1,9 @@
 /**
  * Program-id detection for the Advanced Secure output gate.
  *
- * Used to label the "This output may contain a secret" prompt with the binary
+ * Used to label the Advanced Secure output prompt with the binary
  * that produced it (`composio`, `aws`, `gcloud`, …) and to key the per-program
- * session grant (`isProgramOutputGranted`). Pure functions, no pi / fs / audit.
+ * conversation grant (`isProgramOutputGranted`). Pure functions, no pi / fs / audit.
  */
 
 /** Strip env assignments (`FOO=bar`), common wrappers (sudo, nice, command, …), and the
@@ -27,7 +27,7 @@ export function bashBinary(command: string | undefined): string | undefined {
 
 /** The program id for a tool call. Bash binaries only — MCP and other tools return
  *  `undefined` so the Advanced Secure output gate doesn't offer them a per-program
- *  session grant (MCP tools handle their own secrets and don't share the
+ *  conversation grant (MCP tools handle their own secrets and don't share the
  *  composio-style "same binary, same surface" pattern). */
 export function programIdForToolCall(toolName: string | undefined, input: unknown): string | undefined {
 	if (!toolName) return undefined;

package/src/l2-guard/prompts.ts

@@ -1,5 +1,5 @@
 /**
- * Layer 2 ask-tier prompts, session grants, and persisted "always" overrides
+ * Layer 2 ask-tier prompts, conversation grants, and persisted "always" overrides
  * (ADR-009, ADR-010). Owns the interactive UI calls; policy decisions come from
  * matching.ts.
  */
@@ -32,7 +32,7 @@ export function persistOverride(scope: GrantScope, cwd: string, kind: OverrideKi
 }
 
 /**
- * Grants from "yes — for this session" (ADR-010). In memory only, cleared on
+ * Grants from "yes — for this conversation" (ADR-010). In memory only, cleared on
  * session_start, never written to sandbox.json, never consulted for the
  * absolute-deny tier.
  */
@@ -67,7 +67,7 @@ export type UICtx = {
 };
 
 /**
- * Ask the user, then apply the answer: session grants stay in memory, "always"
+ * Ask the user, then apply the answer: conversation grants stay in memory, "always"
  * grants are persisted and announced to the other layer via `onPersist`.
  * Headless asks deny. A `null` return means the call may proceed.
  */
@@ -102,7 +102,7 @@ export async function askOrBlock(
 		const value = ask.overrideKind === OverrideKind.AllowDomains || isSafeFolderGrant(parent, homedir()) ? parent : ask.overrideValue;
 		sessionGrants.push({ kind: ask.overrideKind, value });
 		audit({ layer: 2, tool: ask.tool, subject: ask.subject, reason: ask.reason, decision, grant: value, cwd: ctx.cwd });
-		ctx.ui.notify(`security-guard: allowed for this session (not saved) → ${value}`, "info");
+		ctx.ui.notify(`security-guard: allowed for this conversation (not saved) → ${value}`, "info");
 		return null;
 	}
 	if (decision === Decision.AlwaysCwd || decision === Decision.AlwaysGlobal || decision === Decision.AlwaysCwdFolder || decision === Decision.AlwaysGlobalFolder) {

package/src/ui/ask-flow.ts

@@ -3,7 +3,7 @@
  * it only calls the caller's `ctx.ui.select`, so the contract tests can script it.
  *
  * Every prompt is a question. Answers are uniformly `No` / `Yes, just this once` /
- * `Yes, for this session` / `Yes, always…` so row 2 is always "once". Screen 2
+ * `Yes, for this conversation` / `Yes, always…` so row 2 is always "once". Screen 2
  * collapses to "All in folder · in this project" / "Only <name> · in this project" /
  * "All in folder · in all projects" / "Only <name> · in all projects" — folder /
  * wildcard is preselected (the wider grant is the right answer almost every time).
@@ -294,10 +294,10 @@ function withIcon(icon: string | undefined, header: string): string {
 export type MainOpts = {
 	/** Offer `Yes, just this once` (default on). */
 	once?: boolean;
-	/** Offer `Yes, for this session` (opt-in). */
+	/** Offer `Yes, for this conversation` (opt-in). */
 	session?: boolean;
-	/** Override the session label so the caller can name what the session grant covers
-	 * (`Yes, for this session` for files, `Yes, all in group for this session` for networks). */
+	/** Override the session label so the caller can name what the conversation grant covers
+	 * (`Yes, for this conversation` for files, `Yes, all in group for this conversation` for networks). */
 	sessionLabel?: string;
 	/** Offer `Yes, always…` (default on). */
 	remember?: boolean;
@@ -322,7 +322,7 @@ export type MainOpts = {
  * highlighted.
  */
 export async function askMain(ctx: AskCtx, header: string, body: string, opts: MainOpts = {}): Promise<MainChoice> {
-	const sessionLabel = opts.sessionLabel ?? "Yes, for this session";
+	const sessionLabel = opts.sessionLabel ?? "Yes, for this conversation";
 	const choices: Array<{ label: string; value: MainChoice }> = [];
 	choices.push({ label: "No", value: MainChoice.Block });
 	if (opts.once !== false) choices.push({ label: "Yes, just this once", value: MainChoice.Once });
@@ -444,19 +444,21 @@ export type ExposureChoice = (typeof ExposureChoice)[keyof typeof ExposureChoice
 
 /** Advanced Secure output gate (ADR-018): show where it was found and ask before the output reaches the model.
  *  When `programId` is set, an extra option lets the user grant the rest of the
- *  session for that program — same pattern as path/host session grants, but for
+ *  conversation for that program — same pattern as path/host conversation grants, but for
  *  tool output (display, not access). */
 export async function askExposure(ctx: AskCtx, hits: string[], programId?: string): Promise<ExposureChoice> {
 	const choices: Array<{ label: string; value: ExposureChoice }> = [
 		{ label: "No, keep it hidden   (recommended)", value: ExposureChoice.Block },
 		{ label: "Yes, show it this once", value: ExposureChoice.Allow },
 	];
-	if (programId) choices.push({ label: `Yes, all ${programId} output for this session`, value: ExposureChoice.ProgramSession });
+	if (programId) choices.push({ label: `Yes, all ${programId} output for this conversation`, value: ExposureChoice.ProgramSession });
 	const titleParts = [
-		`${ICON.cred}  This output may contain a secret \u2014 show it to the AI?`,
+		`${ICON.warn}  Sensitive information detected`,
 		"",
 		hits.join("\n\n"),
 		"",
+		"Question Should the AI be allowed to see it?",
+		"",
 		"Note     you'll be asked again each time a secret shows up",
 	];
 	const { picked } = await askSelect(ctx, titleParts.join("\n"), choices.map((c) => c.label), undefined, { footer: "Default: No" });

package/src/ui/ask-selector.ts

@@ -13,7 +13,7 @@
  *
  *   → No
  *     Yes, just this once
- *     Yes, all in group for this session
+ *     Yes, all in group for this conversation
  *     Yes, always…
  *
  * Keyboard only (ADR-036): ↑/↓ move the highlight, Enter selects, Esc cancels.

package/src/ui/ask.ts

@@ -4,7 +4,7 @@
  * ADR-030.
  *
  * Every prompt is a question. Answers are uniformly `No` / `Yes, just this once` /
- * `Yes, for this session` / `Yes, always…`. Body uses the canonical field set
+ * `Yes, for this conversation` / `Yes, always…`. Body uses the canonical field set
  * File / Folder / Site / Group / Command / Why / Risk / Note. Absolute-deny
  * (credentials) collapses to ONE screen with `No` preselected. Untrusted
  * project: screen 2 hides the `in this project` rows and adds a Note.
@@ -192,7 +192,7 @@ export async function askDecision(ctx: AskCtx, ask: AskKind, absoluteDenyPattern
 	}
 
 	const header = headerFor(action, ask.subject, ask);
-	const sessionLabel = action === AskAction.Network ? "Yes, all in group for this session" : "Yes, for this session";
+	const sessionLabel = action === AskAction.Network ? "Yes, all in group for this conversation" : "Yes, for this conversation";
 	const untrusted = ask.projectTrusted === false;
 	const mainOpts = {
 		session: true,