botholomew 0.22.2 → 0.24.0

package/src/commands/approval.ts

@@ -0,0 +1,130 @@
+import ansis from "ansis";
+import type { Command } from "commander";
+import { decideAndRequeue } from "../approvals/decide.ts";
+import {
+  APPROVAL_STATUSES,
+  type Approval,
+  type ApprovalStatus,
+} from "../approvals/schema.ts";
+import { getApproval, listApprovals } from "../approvals/store.ts";
+import { logger } from "../utils/logger.ts";
+
+function statusColor(status: ApprovalStatus): string {
+  switch (status) {
+    case "approved":
+      return ansis.green(status);
+    case "denied":
+      return ansis.red(status);
+    case "pending":
+      return ansis.yellow(status);
+  }
+}
+
+function printApproval(a: Approval) {
+  console.log(
+    `${ansis.bold(a.id.slice(0, 8))}  ${statusColor(a.status).padEnd(18)}  ${ansis.cyan(`${a.server}/${a.tool}`)}`,
+  );
+  console.log(`  args: ${a.args}`);
+  if (a.task_id) console.log(`  task: ${a.task_id}`);
+  if (a.reason) console.log(`  reason: ${a.reason}`);
+  console.log(`  created: ${a.created_at}`);
+  if (a.decided_at) {
+    console.log(`  decided: ${a.decided_at} by ${a.decided_by ?? "?"}`);
+  }
+}
+
+export function registerApprovalCommand(program: Command) {
+  const approval = program
+    .command("approval")
+    .description("Review and decide pending mcpx tool-call approvals");
+
+  approval
+    .command("list")
+    .description("List approval requests (newest first)")
+    .option(
+      "-s, --status <status>",
+      `filter by status (${APPROVAL_STATUSES.join("|")})`,
+    )
+    .option("-l, --limit <n>", "max number of approvals", Number.parseInt)
+    .option("-o, --offset <n>", "skip first N approvals", Number.parseInt)
+    .action(
+      async (opts: {
+        status?: ApprovalStatus;
+        limit?: number;
+        offset?: number;
+      }) => {
+        if (opts.status && !APPROVAL_STATUSES.includes(opts.status)) {
+          logger.error(
+            `Unknown status: ${opts.status}. Use one of: ${APPROVAL_STATUSES.join(", ")}`,
+          );
+          process.exit(1);
+        }
+        const dir = program.opts().dir;
+        const approvals = await listApprovals(dir, {
+          status: opts.status,
+          limit: opts.limit,
+          offset: opts.offset,
+        });
+        if (approvals.length === 0) {
+          logger.dim("No approvals found.");
+          return;
+        }
+        for (const a of approvals) {
+          printApproval(a);
+          console.log("");
+        }
+        console.log(ansis.dim(`${approvals.length} approval(s)`));
+      },
+    );
+
+  approval
+    .command("view <id>")
+    .description("Show a single approval request")
+    .action(async (id: string) => {
+      const dir = program.opts().dir;
+      const a = await getApproval(dir, id);
+      if (!a) {
+        logger.error(`No approval found with id ${id}.`);
+        process.exit(1);
+      }
+      printApproval(a);
+    });
+
+  approval
+    .command("approve <id>")
+    .description("Approve a pending request and re-queue its task")
+    .action(async (id: string) => {
+      const dir = program.opts().dir;
+      const a = await getApproval(dir, id);
+      if (!a) {
+        logger.error(`No approval found with id ${id}.`);
+        process.exit(1);
+      }
+      if (a.status !== "pending") {
+        logger.warn(`Approval ${id} is already ${a.status}.`);
+        return;
+      }
+      await decideAndRequeue(dir, id, "approved", "cli");
+      logger.success(`Approved ${a.server}/${a.tool} (${id}).`);
+      if (a.task_id) logger.dim(`Re-queued task ${a.task_id} (now pending).`);
+    });
+
+  approval
+    .command("deny <id>")
+    .description("Deny a pending request and re-queue its task to recover")
+    .action(async (id: string) => {
+      const dir = program.opts().dir;
+      const a = await getApproval(dir, id);
+      if (!a) {
+        logger.error(`No approval found with id ${id}.`);
+        process.exit(1);
+      }
+      if (a.status !== "pending") {
+        logger.warn(`Approval ${id} is already ${a.status}.`);
+        return;
+      }
+      await decideAndRequeue(dir, id, "denied", "cli");
+      logger.success(`Denied ${a.server}/${a.tool} (${id}).`);
+      if (a.task_id) logger.dim(`Re-queued task ${a.task_id} (now pending).`);
+    });
+}

package/src/commands/chat.ts

@@ -8,8 +8,9 @@ export function registerChatCommand(program: Command) {
       "Open the interactive chat TUI\n\n" +
         "  Tab navigation (Ctrl+<letter> from any tab):\n" +
         "    Ctrl+a  Chat        Ctrl+t  Tasks       Ctrl+w  Workers\n" +
-        "    Ctrl+o  Tools       Ctrl+e  Threads     Ctrl+g  Help\n" +
-        "    Ctrl+n  Context     Ctrl+s  Schedules   Esc     Return to Chat\n\n" +
+        "    Ctrl+o  Tools       Ctrl+e  Threads     Ctrl+p  Approvals\n" +
+        "    Ctrl+n  Context     Ctrl+s  Schedules   Ctrl+g  Help\n" +
+        "                                            Esc     Return to Chat\n\n" +
         "  Refresh: Ctrl+R refreshes Context · Tasks · Threads · Schedules · Workers\n\n" +
         "  Chat input:\n" +
         "    Enter          Send message\n" +
@@ -21,42 +22,55 @@ export function registerChatCommand(program: Command) {
         "  Slash commands:\n" +
         "    /help           Show chat-command reference (Help tab has the full keymap)\n" +
         "    /skills         List available skills\n" +
+        "    /dream          Reflect on recent threads — consolidate learnings, update beliefs/goals\n" +
         "    /clear          End current thread and start a new one\n" +
         "    /exit           End the chat session",
     )
     .option("--thread-id <id>", "Resume an existing chat thread")
     .option("-p, --prompt <text>", "Start chat with an initial prompt")
-    .action(async (opts: { threadId?: string; prompt?: string }) => {
-      const { render } = await import("ink");
-      const React = await import("react");
-      const { App } = await import("../tui/App.tsx");
-      const dir = program.opts().dir;
-      const config = await loadConfig(dir);
-      const idleTimeoutMs = config.tui_idle_timeout_seconds * 1000;
+    .option(
+      "--unsafe",
+      "bypass the mcpx approval gate (allow every tool without approval)",
+      false,
+    )
+    .action(
+      async (opts: {
+        threadId?: string;
+        prompt?: string;
+        unsafe?: boolean;
+      }) => {
+        const { render } = await import("ink");
+        const React = await import("react");
+        const { App } = await import("../tui/App.tsx");
+        const dir = program.opts().dir;
+        const config = await loadConfig(dir);
+        const idleTimeoutMs = config.tui_idle_timeout_seconds * 1000;
 
-      // VHS/ttyd doesn't fully negotiate the Kitty Keyboard protocol, so
-      // Ink's "enabled" mode drops non-text keystrokes (Tab, Escape) under
-      // capture. Use "disabled" mode in capture to keep text input working;
-      // captures that need Tab/Escape should use the `-p` prompt flag or
-      // a /slash command typed as text instead.
-      const isCapture = process.env.BOTHOLOMEW_FAKE_LLM === "1";
-      const instance = render(
-        React.createElement(App, {
-          projectDir: dir,
-          threadId: opts.threadId,
-          initialPrompt: opts.prompt,
-          idleTimeoutMs,
-        }),
-        {
-          exitOnCtrlC: false,
-          kittyKeyboard: isCapture
-            ? { mode: "disabled" }
-            : {
-                mode: "enabled",
-                flags: ["disambiguateEscapeCodes"],
-              },
-        },
-      );
-      await instance.waitUntilExit();
-    });
+        // VHS/ttyd doesn't fully negotiate the Kitty Keyboard protocol, so
+        // Ink's "enabled" mode drops non-text keystrokes (Tab, Escape) under
+        // capture. Use "disabled" mode in capture to keep text input working;
+        // captures that need Tab/Escape should use the `-p` prompt flag or
+        // a /slash command typed as text instead.
+        const isCapture = process.env.BOTHOLOMEW_FAKE_LLM === "1";
+        const instance = render(
+          React.createElement(App, {
+            projectDir: dir,
+            threadId: opts.threadId,
+            initialPrompt: opts.prompt,
+            idleTimeoutMs,
+            unsafe: opts.unsafe,
+          }),
+          {
+            exitOnCtrlC: false,
+            kittyKeyboard: isCapture
+              ? { mode: "disabled" }
+              : {
+                  mode: "enabled",
+                  flags: ["disambiguateEscapeCodes"],
+                },
+          },
+        );
+        await instance.waitUntilExit();
+      },
+    );
 }

package/src/commands/dream.ts

@@ -0,0 +1,194 @@
+import type { LanguageModel } from "ai";
+import ansis from "ansis";
+import type { Command } from "commander";
+import { type ChatTurnCallbacks, runChatTurn } from "../chat/agent.ts";
+import { DREAM_PROMPT_BODY } from "../chat/dream-prompt.ts";
+import { requireProviderCreds } from "../chat/session.ts";
+import { loadConfig } from "../config/loader.ts";
+import { createMcpxClient, resolveMcpxDir } from "../mcpx/client.ts";
+import type { WithMem } from "../mem/client.ts";
+import {
+  createThread,
+  endThread,
+  ensureThreadsDir,
+  logInteraction,
+} from "../threads/store.ts";
+import { logger } from "../utils/logger.ts";
+import { utcDateString } from "../utils/v7-date.ts";
+
+/** Gray `HH:MM:SS` stamp, matching the logger's line prefix. */
+function ts(): string {
+  return ansis.gray(new Date().toTimeString().slice(0, 8));
+}
+
+/** Collapse a tool-input blob to a single readable line. */
+function previewInput(input: string, max = 100): string {
+  const oneLine = input.replace(/\s+/g, " ").trim();
+  return oneLine.length > max ? `${oneLine.slice(0, max)}…` : oneLine;
+}
+
+export interface DreamOptions {
+  /** ISO date or relative duration (`24h`, `7d`). Defaults to `dream_lookback_hours`. */
+  since?: string;
+  /** Propose edits without writing anything. */
+  dryRun?: boolean;
+  /** Test seam: inject a language model + membot accessor. */
+  _testModel?: LanguageModel;
+  _testWithMem?: WithMem;
+}
+
+const RELATIVE_RE = /^(\d+)\s*([hd])$/i;
+
+/**
+ * Resolve the start of the recall window. Accepts a relative duration
+ * (`24h`, `7d`), an ISO date, or — when omitted — `now - lookbackHours`.
+ */
+export function resolveSince(
+  since: string | undefined,
+  lookbackHours: number,
+  now: Date,
+): Date {
+  if (!since) {
+    return new Date(now.getTime() - lookbackHours * 3600_000);
+  }
+  const rel = RELATIVE_RE.exec(since.trim());
+  if (rel) {
+    const n = Number(rel[1]);
+    const unitHours = rel[2]?.toLowerCase() === "d" ? 24 : 1;
+    return new Date(now.getTime() - n * unitHours * 3600_000);
+  }
+  const parsed = new Date(since);
+  if (Number.isNaN(parsed.getTime())) {
+    throw new Error(
+      `Could not parse --since "${since}". Use an ISO date (2026-06-01) or a relative duration like 24h / 7d.`,
+    );
+  }
+  return parsed;
+}
+
+/**
+ * Run one reflection ("dream") pass: review recent threads, consolidate
+ * durable facts into the knowledge store, and (unless `--dry-run`) apply
+ * justified edits to the agent's prompt files. Reuses the chat agent loop and
+ * its tool set, so this composes the existing primitives — no new machinery.
+ * Returns the audit thread id.
+ */
+export async function runDream(
+  projectDir: string,
+  opts: DreamOptions = {},
+): Promise<string> {
+  const config = await loadConfig(projectDir);
+  requireProviderCreds(config);
+  await ensureThreadsDir(projectDir);
+
+  const now = new Date();
+  const since = resolveSince(opts.since, config.dream_lookback_hours, now);
+
+  const threadId = await createThread(
+    projectDir,
+    "chat_session",
+    undefined,
+    `Dream — ${utcDateString(now)}`,
+  );
+
+  const windowLine = `Scope your recall to conversations from ${since.toISOString()} onward (it is now ${now.toISOString()}).`;
+  const dryRunLine = opts.dryRun
+    ? "\n\nIMPORTANT — DRY RUN: Do NOT call `prompt_edit` or any `membot` write tool. Instead, end with a report describing the reflection you would store and the exact prompt edits you would propose, then stop."
+    : "";
+  const userMessage = `${DREAM_PROMPT_BODY}\n\n${windowLine}${dryRunLine}`;
+
+  await logInteraction(projectDir, threadId, {
+    role: "user",
+    kind: "message",
+    content: userMessage,
+  });
+
+  logger.info(
+    `${ansis.magenta.bold("Dreaming")} — reviewing threads since ${ansis.cyan(
+      since.toISOString(),
+    )}${opts.dryRun ? ` ${ansis.yellow("(dry run)")}` : ""}`,
+  );
+
+  const mcpxClient = await createMcpxClient(resolveMcpxDir(projectDir, config));
+
+  // Chat callbacks don't carry tool durations, so time each call by id.
+  const toolStartedAt = new Map<string, number>();
+  let midStream = false;
+
+  const callbacks: ChatTurnCallbacks = {
+    onToken: (text) => {
+      process.stdout.write(text);
+      midStream = true;
+    },
+    onToolStart: (id, name, input) => {
+      if (midStream) {
+        process.stdout.write("\n");
+        midStream = false;
+      }
+      toolStartedAt.set(id, Date.now());
+      process.stdout.write(
+        `${ts()} ${ansis.yellow("▶")} ${ansis.bold(name)} ${ansis.dim(
+          previewInput(input),
+        )}\n`,
+      );
+    },
+    onToolEnd: (id, name, _output, isError) => {
+      const startedAt = toolStartedAt.get(id);
+      const elapsed = startedAt
+        ? ` ${ansis.dim(`(${((Date.now() - startedAt) / 1000).toFixed(1)}s)`)}`
+        : "";
+      toolStartedAt.delete(id);
+      const mark = isError ? ansis.red("✗") : ansis.green("✓");
+      const status = isError ? ` ${ansis.red("error")}` : "";
+      process.stdout.write(
+        `${ts()} ${mark} ${ansis.bold(name)}${status}${elapsed}\n`,
+      );
+    },
+  };
+
+  try {
+    await runChatTurn({
+      messages: [{ role: "user", content: userMessage }],
+      projectDir,
+      config,
+      threadId,
+      mcpxClient,
+      callbacks,
+      _testModel: opts._testModel,
+      _testWithMem: opts._testWithMem,
+    });
+  } finally {
+    process.stdout.write("\n");
+    await endThread(projectDir, threadId);
+    await mcpxClient?.close();
+  }
+
+  return threadId;
+}
+
+export function registerDreamCommand(program: Command) {
+  program
+    .command("dream")
+    .description(
+      "Reflect on recent threads: consolidate durable facts into the knowledge store and update beliefs/goals",
+    )
+    .option(
+      "-s, --since <when>",
+      "ISO date or relative duration (24h, 7d) to scope recall (default: dream_lookback_hours)",
+    )
+    .option(
+      "--dry-run",
+      "propose edits without writing prompts or the knowledge store",
+      false,
+    )
+    .action(async (opts: { since?: string; dryRun?: boolean }) => {
+      const dir = program.opts().dir;
+      const threadId = await runDream(dir, {
+        since: opts.since,
+        dryRun: opts.dryRun,
+      });
+      logger.success(
+        `Dream complete — audit with ${ansis.cyan(`botholomew thread view ${threadId}`)}`,
+      );
+    });
+}

package/src/commands/nuke.ts

@@ -2,8 +2,14 @@ import { rm } from "node:fs/promises";
 import { join } from "node:path";
 import ansis from "ansis";
 import type { Command } from "commander";
+import { deleteAllApprovals } from "../approvals/store.ts";
 import { loadConfig } from "../config/loader.ts";
-import { SCHEDULES_DIR, TASKS_DIR, THREADS_DIR } from "../constants.ts";
+import {
+  APPROVALS_DIR,
+  SCHEDULES_DIR,
+  TASKS_DIR,
+  THREADS_DIR,
+} from "../constants.ts";
 import { openMembot, resolveMembotDir } from "../mem/client.ts";
 import { deleteAllSchedules } from "../schedules/store.ts";
 import { deleteAllTasks } from "../tasks/store.ts";
@@ -86,6 +92,10 @@ async function runNuke(projectDir: string, scope: NukeScope): Promise<void> {
       `Deleted ${threads} threads (${interactions} interactions) from ${THREADS_DIR}/`,
     );
   }
+  if (scope === "all") {
+    const n = await deleteAllApprovals(projectDir);
+    logger.success(`Deleted ${n} approval file(s) from ${APPROVALS_DIR}/`);
+  }
 }
 
 function registerScope(
@@ -151,6 +161,6 @@ export function registerNukeCommand(program: Command) {
     program,
     nuke,
     "all",
-    "Erase all agent-writable data: membot store, tasks/, schedules/, threads/",
+    "Erase all agent-writable data: membot store, tasks/, schedules/, threads/, approvals/",
   );
 }

package/src/commands/status.ts

@@ -22,10 +22,6 @@ function formatAge(fromIso: string | null, to = new Date()): string {
   return `${Math.floor(hours / 24)}d ago`;
 }
 
-function padColored(colored: string, raw: string, width: number): string {
-  return colored + " ".repeat(Math.max(0, width - raw.length));
-}
-
 function workerStatusColor(status: WorkerStatus): string {
   switch (status) {
     case "running":

package/src/commands/thread.ts

@@ -6,9 +6,12 @@ import {
   getInteractionsAfter,
   getThread,
   type Interaction,
+  type InteractionRole,
   isThreadEnded,
   listThreads,
+  searchThreads,
   type Thread,
+  type ThreadType,
 } from "../threads/store.ts";
 import { logger } from "../utils/logger.ts";
 
@@ -39,6 +42,67 @@ export function registerThreadCommand(program: Command) {
       }
     });
 
+  thread
+    .command("search <query>")
+    .description("Search past conversations for a regex (or plain substring)")
+    .option("--ignore-case", "case-insensitive match (default true)", true)
+    .option("--no-ignore-case", "case-sensitive match")
+    .option(
+      "-r, --role <role>",
+      "filter by role (user, assistant, system, tool)",
+    )
+    .option("-t, --type <type>", "filter by type (worker_tick, chat_session)")
+    .option("--since <iso>", "only threads started on or after this ISO date")
+    .option("--until <iso>", "only threads started on or before this ISO date")
+    .option("-l, --limit <n>", "max hits to return", Number.parseInt)
+    .action(
+      async (
+        query: string,
+        opts: {
+          ignoreCase?: boolean;
+          role?: string;
+          type?: string;
+          since?: string;
+          until?: string;
+          limit?: number;
+        },
+      ) => {
+        const dir = program.opts().dir;
+        let regex: RegExp;
+        try {
+          regex = new RegExp(query, opts.ignoreCase === false ? "" : "i");
+        } catch (err) {
+          logger.error(
+            `Invalid regex: ${err instanceof Error ? err.message : String(err)}`,
+          );
+          process.exit(1);
+        }
+        const { hits, threadsScanned } = await searchThreads(dir, {
+          regex,
+          role: opts.role as InteractionRole | undefined,
+          type: opts.type as ThreadType | undefined,
+          since: opts.since ? new Date(opts.since) : undefined,
+          until: opts.until ? new Date(opts.until) : undefined,
+          maxResults: opts.limit,
+        });
+
+        if (hits.length === 0) {
+          logger.dim(`No hits in ${threadsScanned} thread(s).`);
+          return;
+        }
+
+        for (const h of hits) {
+          const id = ansis.dim(h.thread_id);
+          const seq = ansis.dim(`#${h.sequence}`);
+          const snippet = h.content_snippet.replace(/\n/g, " ");
+          console.log(`  ${id}  ${seq}  ${roleColor(h.role)}  ${snippet}`);
+        }
+        logger.dim(
+          `\n${hits.length} hit(s) in ${threadsScanned} thread(s). View context: botholomew thread view <id>`,
+        );
+      },
+    );
+
   thread
     .command("view <id>")
     .description("View thread details and interactions")

package/src/commands/worker.ts

@@ -64,11 +64,17 @@ export function registerWorkerCommand(program: Command) {
       "run exactly this task (implies one-shot; incompatible with --persist)",
     )
     .option("--no-eval-schedules", "skip schedule evaluation this run")
+    .option(
+      "--unsafe",
+      "bypass the mcpx approval gate (allow every tool without approval)",
+      false,
+    )
     .action(
       async (opts: {
         persist?: boolean;
         taskId?: string;
         evalSchedules?: boolean;
+        unsafe?: boolean;
       }) => {
         if (opts.persist && opts.taskId) {
           logger.error("--persist and --task-id are mutually exclusive.");
@@ -81,6 +87,7 @@ export function registerWorkerCommand(program: Command) {
           mode: opts.persist ? "persist" : "once",
           taskId: opts.taskId,
           evalSchedules: opts.evalSchedules,
+          unsafe: opts.unsafe,
         });
       },
     );
@@ -90,18 +97,30 @@ export function registerWorkerCommand(program: Command) {
     .description("Spawn a worker as a detached background process")
     .option("--persist", "keep running, looping over the tick cycle", false)
     .option("--task-id <id>", "run exactly this task (implies one-shot)")
-    .action(async (opts: { persist?: boolean; taskId?: string }) => {
-      if (opts.persist && opts.taskId) {
-        logger.error("--persist and --task-id are mutually exclusive.");
-        process.exit(1);
-      }
-      const dir = program.opts().dir;
-      const { spawnWorker } = await import("../worker/spawn.ts");
-      await spawnWorker(dir, {
-        mode: opts.persist ? "persist" : "once",
-        taskId: opts.taskId,
-      });
-    });
+    .option(
+      "--unsafe",
+      "bypass the mcpx approval gate (allow every tool without approval)",
+      false,
+    )
+    .action(
+      async (opts: {
+        persist?: boolean;
+        taskId?: string;
+        unsafe?: boolean;
+      }) => {
+        if (opts.persist && opts.taskId) {
+          logger.error("--persist and --task-id are mutually exclusive.");
+          process.exit(1);
+        }
+        const dir = program.opts().dir;
+        const { spawnWorker } = await import("../worker/spawn.ts");
+        await spawnWorker(dir, {
+          mode: opts.persist ? "persist" : "once",
+          taskId: opts.taskId,
+          unsafe: opts.unsafe,
+        });
+      },
+    );
 
   worker
     .command("list")

package/src/config/loader.ts

@@ -3,6 +3,7 @@ import { getConfigPath } from "../constants.ts";
 import { setLogLevel } from "../utils/logger.ts";
 import {
   type BotholomewConfig,
+  DEFAULT_APPROVALS,
   DEFAULT_CHUNKER_LLM,
   DEFAULT_CONFIG,
   DEFAULT_LLM,
@@ -60,6 +61,9 @@ export async function loadConfig(
     ...userConfig,
     llm: mergeLlmBlock(DEFAULT_LLM, userConfig.llm),
     chunker_llm: mergeLlmBlock(DEFAULT_CHUNKER_LLM, userConfig.chunker_llm),
+    // Deep-merge so a config predating the approval gate (or only overriding
+    // one key) still gets the safe defaults — and back-compat keeps the gate ON.
+    approvals: { ...DEFAULT_APPROVALS, ...(userConfig.approvals ?? {}) },
   };
 
   const config = applyEnvOverrides(merged);
@@ -101,3 +105,26 @@ export async function saveConfig(
   const configPath = getConfigPath(projectDir);
   await Bun.write(configPath, `${JSON.stringify(config, null, 2)}\n`);
 }
+
+/**
+ * Append an mcpx tool pattern to `approvals.allowed_tools` on disk, preserving
+ * every other key in the file (a surgical merge, not a full rewrite of merged
+ * defaults). Used by the chat TUI's "always allow" decision. No-op if the
+ * pattern is already present.
+ */
+export async function addAllowedTool(
+  projectDir: string,
+  pattern: string,
+): Promise<void> {
+  const configPath = getConfigPath(projectDir);
+  const file = Bun.file(configPath);
+  const raw: Record<string, unknown> = (await file.exists())
+    ? JSON.parse(await file.text())
+    : {};
+  if (!raw.approvals || typeof raw.approvals !== "object") raw.approvals = {};
+  const approvals = raw.approvals as Record<string, unknown>;
+  if (!Array.isArray(approvals.allowed_tools)) approvals.allowed_tools = [];
+  const allowed = approvals.allowed_tools as string[];
+  if (!allowed.includes(pattern)) allowed.push(pattern);
+  await Bun.write(configPath, `${JSON.stringify(raw, null, 2)}\n`);
+}