fullcourtdefense-cli 1.34.21 → 1.34.25

package/dist/devConfirm.js

@@ -33,7 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CONFIRMED_ACTION_TTL_MS = exports.CONFIRM_PENDING_TTL_MS = exports.MIN_HUMAN_ANSWER_MS = void 0;
+exports.GRANT_TTL_MS = exports.CONFIRMED_ACTION_TTL_MS = exports.CONFIRM_PENDING_TTL_MS = exports.DIALOG_SCRIPT_MARKER = exports.DIALOG_BUTTON_DENY = exports.DIALOG_BUTTON_ONCE = exports.DIALOG_BUTTON_ALWAYS = exports.MIN_HUMAN_ANSWER_MS = void 0;
 exports.looksLikeClientAutoAnswer = looksLikeClientAutoAnswer;
 exports.confirmNativeAction = confirmNativeAction;
 exports.nativeDialogAvailable = nativeDialogAvailable;
@@ -49,6 +49,13 @@ exports.raiseDeveloperConfirmation = raiseDeveloperConfirmation;
 exports.settleDeveloperConfirmation = settleDeveloperConfirmation;
 exports.rejectDeveloperConfirmation = rejectDeveloperConfirmation;
 exports.sweepExpiredConfirmations = sweepExpiredConfirmations;
+exports.shellPrograms = shellPrograms;
+exports.findDeveloperGrant = findDeveloperGrant;
+exports.recordDeveloperGrant = recordDeveloperGrant;
+exports.listDeveloperGrants = listDeveloperGrants;
+exports.revokeDeveloperGrants = revokeDeveloperGrants;
+exports.describeGrantScope = describeGrantScope;
+exports.grantScopeFor = grantScopeFor;
 exports.isConfirmationRemembered = isConfirmationRemembered;
 /**
  * Developer self-confirmation ledger (F2 — approval.scope: developer).
@@ -64,7 +71,7 @@ exports.isConfirmationRemembered = isConfirmationRemembered;
  *     tool + digest  => the developer approved  -> `allow`, approvedBy: developer
  *   - no post-hook within the window            => denied or ignored -> `block` on sweep
  *
- * `remember: session | 1h` stores the confirmation so the same tool + operation is not asked
+ * `remember: session | 1h` stores the confirmation so the same action + policy + session is not asked
  * again within that window. Everything here is minimized facts on disk (no raw command
  * bodies — a SHA-256 digest of the canonical args), per-user, best-effort: a ledger failure
  * must never change a verdict, only lose a record.
@@ -78,6 +85,7 @@ const crypto = __importStar(require("crypto"));
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
+const approvalPrompt_1 = require("./approvalPrompt");
 /**
  * Fastest plausible HUMAN answer to a confirmation prompt. A person has to notice
  * the dialog, read at least the tool name and press a button; MCP clients that
@@ -102,6 +110,12 @@ function looksLikeClientAutoAnswer(answer, latencyMs) {
 async function confirmNativeAction(reason, timeoutMs = 60_000) {
     return (await confirmNativeActionDetailed(reason, timeoutMs)).outcome === 'allow';
 }
+/** Button labels — one vocabulary on every platform and in every test. */
+exports.DIALOG_BUTTON_ALWAYS = 'Always allow';
+exports.DIALOG_BUTTON_ONCE = 'Allow once';
+exports.DIALOG_BUTTON_DENY = 'Deny';
+/** Marker inside the Windows dialog script; tests recognize the spawn by it. */
+exports.DIALOG_SCRIPT_MARKER = 'FullCourtDefense.Dialog';
 /** True when this process can put a dialog in front of a person on this machine. */
 function nativeDialogAvailable() {
     if (!isHumanPresent())
@@ -110,60 +124,121 @@ function nativeDialogAvailable() {
         return true;
     return Boolean(process.env.DISPLAY || process.env.WAYLAND_DISPLAY);
 }
-async function confirmNativeActionDetailed(reason, timeoutMs = 60_000) {
+/**
+ * Windows: a small owned window (System.Windows.Forms) — `WScript.Shell.Popup`
+ * cannot label its buttons, and "Yes / No / Cancel" is not an approval UI.
+ * TopMost keeps it above the IDE that triggered it; Enter/Escape both mean Deny.
+ * Exit codes: 0 = Allow once, 3 = Always allow, 2 = timed out, anything else = Deny.
+ */
+function windowsDialogScript(message, timeoutSeconds, options) {
+    const encoded = Buffer.from(message, 'utf8').toString('base64');
+    return [
+        `# ${exports.DIALOG_SCRIPT_MARKER}`,
+        'Add-Type -AssemblyName System.Windows.Forms; Add-Type -AssemblyName System.Drawing',
+        '[System.Windows.Forms.Application]::EnableVisualStyles()',
+        `$msg=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${encoded}'))`,
+        "$f=New-Object Windows.Forms.Form; $f.Text='FullCourtDefense'; $f.TopMost=$true; $f.StartPosition='CenterScreen'; $f.FormBorderStyle='FixedDialog'; $f.MaximizeBox=$false; $f.MinimizeBox=$false; $f.ShowInTaskbar=$true; $f.AutoSize=$true; $f.AutoSizeMode='GrowAndShrink'; $f.Padding=New-Object Windows.Forms.Padding(18,16,18,16); $f.Font=New-Object Drawing.Font('Segoe UI',9.75)",
+        "$t=New-Object Windows.Forms.TableLayoutPanel; $t.AutoSize=$true; $t.AutoSizeMode='GrowAndShrink'; $t.ColumnCount=1; $t.RowCount=2; $t.Dock='Fill'",
+        "$l=New-Object Windows.Forms.Label; $l.Text=$msg; $l.AutoSize=$true; $l.MaximumSize=New-Object Drawing.Size(600,0); $l.Margin=New-Object Windows.Forms.Padding(0,0,0,14); $t.Controls.Add($l,0,0)",
+        "$b=New-Object Windows.Forms.FlowLayoutPanel; $b.FlowDirection='RightToLeft'; $b.AutoSize=$true; $b.AutoSizeMode='GrowAndShrink'; $b.Dock='Fill'; $b.WrapContents=$false",
+        `$deny=New-Object Windows.Forms.Button; $deny.Text='${exports.DIALOG_BUTTON_DENY}'; $deny.AutoSize=$true; $deny.MinimumSize=New-Object Drawing.Size(96,30); $deny.DialogResult='Cancel'; $deny.TabIndex=0; $b.Controls.Add($deny)`,
+        `$once=New-Object Windows.Forms.Button; $once.Text='${exports.DIALOG_BUTTON_ONCE}'; $once.AutoSize=$true; $once.MinimumSize=New-Object Drawing.Size(96,30); $once.DialogResult='OK'; $once.TabIndex=1; $b.Controls.Add($once)`,
+        options.allowAlways
+            ? `$always=New-Object Windows.Forms.Button; $always.Text='${exports.DIALOG_BUTTON_ALWAYS}'; $always.AutoSize=$true; $always.MinimumSize=New-Object Drawing.Size(110,30); $always.DialogResult='Yes'; $always.TabIndex=2; $b.Controls.Add($always)`
+            : '',
+        "$t.Controls.Add($b,0,1); $f.Controls.Add($t); $f.CancelButton=$deny; $f.AcceptButton=$deny; $f.ActiveControl=$deny",
+        `$timer=New-Object Windows.Forms.Timer; $timer.Interval=${timeoutSeconds * 1000}; $timer.Add_Tick({ $f.DialogResult='Abort'; $f.Close() })`,
+        // The hook spawns PowerShell with a hidden startup show-state (no console flash);
+        // WinForms applies that state to the FIRST window, so the form would run
+        // invisibly. Bouncing WindowState issues a real ShowWindow(SW_RESTORE).
+        "$f.Add_Load({ $f.WindowState='Minimized'; $f.WindowState='Normal' })",
+        "$f.Add_Shown({ $f.Activate(); $deny.Select(); $deny.Focus(); $timer.Start() })",
+        "$r=$f.ShowDialog(); $timer.Stop()",
+        "if($r -eq 'OK'){exit 0} elseif($r -eq 'Yes'){exit 3} elseif($r -eq 'Abort'){exit 2} else {exit 1}",
+    ].filter(Boolean).join('\n');
+}
+async function confirmNativeActionDetailed(reason, timeoutMs = 60_000, options = {}) {
     if (!nativeDialogAvailable())
         return { outcome: 'unavailable', latencyMs: 0 };
     const started = Date.now();
     let executable;
     let args;
-    const message = `FullCourtDefense — developer approval\n\n${reason.slice(0, 1800)}\n\nAllow this action once?`;
+    const message = (0, approvalPrompt_1.nativeApprovalMessage)(reason, { allowAlways: options.allowAlways, alwaysScopeLabel: options.alwaysScopeLabel });
     const timeoutSeconds = Math.max(1, Math.ceil(timeoutMs / 1000));
     if (process.platform === 'win32') {
         executable = 'powershell.exe';
-        const encoded = Buffer.from(message, 'utf8').toString('base64');
-        // 292 = Yes/No + question icon + "No" default; +4096 (MB_SYSTEMMODAL) keeps the
-        // popup above the IDE window that triggered it, so a fallback ask is never
-        // hidden behind Codex/Cursor and silently timed out.
-        const script = `$msg=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${encoded}')); $w=New-Object -ComObject WScript.Shell; $answer=$w.Popup($msg,${timeoutSeconds},'FullCourtDefense',4388); if($answer -eq 6){exit 0}else{exit 1}`;
-        args = ['-NoProfile', '-NonInteractive', '-EncodedCommand', Buffer.from(script, 'utf16le').toString('base64')];
+        args = ['-NoProfile', '-NonInteractive', '-EncodedCommand', Buffer.from(windowsDialogScript(message, timeoutSeconds, options), 'utf16le').toString('base64')];
     }
     else if (process.platform === 'darwin') {
         executable = '/usr/bin/osascript';
-        args = ['-e', 'on run argv', '-e', `display dialog (item 1 of argv) buttons {"Deny", "Allow once"} default button "Deny" giving up after ${timeoutSeconds}`, '-e', 'if gave up of result or button returned of result is not "Allow once" then error number -128', '-e', 'end run', message];
+        const buttons = options.allowAlways
+            ? `{"${exports.DIALOG_BUTTON_DENY}", "${exports.DIALOG_BUTTON_ONCE}", "${exports.DIALOG_BUTTON_ALWAYS}"}`
+            : `{"${exports.DIALOG_BUTTON_DENY}", "${exports.DIALOG_BUTTON_ONCE}"}`;
+        // The pressed label is printed on stdout; Deny is the cancel button (exit 1).
+        args = ['-e', 'on run argv', '-e', `set r to display dialog (item 1 of argv) with title "FullCourtDefense" buttons ${buttons} default button "${exports.DIALOG_BUTTON_DENY}" cancel button "${exports.DIALOG_BUTTON_DENY}" giving up after ${timeoutSeconds}`, '-e', 'if gave up of r then return "timeout"', '-e', 'return button returned of r', '-e', 'end run', message];
     }
     else {
         executable = 'zenity';
-        args = ['--question', '--default-cancel', '--title=FullCourtDefense', `--text=${message}`, '--ok-label=Allow once', '--cancel-label=Deny', `--timeout=${timeoutSeconds}`];
+        args = ['--question', '--default-cancel', '--title=FullCourtDefense', `--text=${message}`, `--ok-label=${exports.DIALOG_BUTTON_ONCE}`, `--cancel-label=${exports.DIALOG_BUTTON_DENY}`, `--timeout=${timeoutSeconds}`];
+        // zenity prints the extra button's label on stdout and exits 1 when it is pressed.
+        if (options.allowAlways)
+            args.push(`--extra-button=${exports.DIALOG_BUTTON_ALWAYS}`);
     }
     return new Promise(resolve => {
         let finished = false;
         let child;
+        let stdout = '';
         const done = (outcome) => {
             if (finished)
                 return;
             finished = true;
             clearTimeout(timer);
             process.removeListener('exit', cancelChild);
-            resolve({ outcome, latencyMs: Date.now() - started });
+            // A third button that was never offered can never be "pressed".
+            resolve({ outcome: outcome === 'allow_always' && !options.allowAlways ? 'deny' : outcome, latencyMs: Date.now() - started });
         };
         const cancelChild = () => child?.kill();
         const timer = setTimeout(() => { child?.kill(); done('timeout'); }, timeoutMs + 1000);
         try {
-            child = (0, child_process_1.spawn)(executable, args, { stdio: 'ignore', windowsHide: true });
+            child = (0, child_process_1.spawn)(executable, args, { stdio: ['ignore', 'pipe', 'ignore'], windowsHide: true });
         }
         catch {
             done('unavailable');
             return;
         }
         process.once('exit', cancelChild);
-        // Spawn failure (binary missing, no permission) = nothing was shown. A child
-        // that ran and exited non-zero = the person (or the dialog's give-up) said no;
-        // the dialog cannot tell Deny from close from give-up, so a "no" that arrives
-        // at the deadline is reported as a timeout.
+        child.stdout?.on('data', (chunk) => { if (stdout.length < 256)
+            stdout += String(chunk); });
+        // Spawn failure (binary missing, no permission) = nothing was shown. Windows
+        // reports the button by exit code; osascript / zenity print the pressed label.
+        // A "no" that arrives at the deadline is reported as a timeout.
         child.on('error', () => done('unavailable'));
         child.on('exit', code => {
-            if (code === 0)
-                return done('allow');
+            const pressed = stdout.trim();
+            if (process.platform === 'win32') {
+                if (code === 0)
+                    return done('allow');
+                if (code === 3)
+                    return done('allow_always');
+                if (code === 2)
+                    return done('timeout');
+            }
+            else if (process.platform === 'darwin') {
+                if (code === 0 && pressed === exports.DIALOG_BUTTON_ONCE)
+                    return done('allow');
+                if (code === 0 && pressed === exports.DIALOG_BUTTON_ALWAYS)
+                    return done('allow_always');
+                if (code === 0 && pressed === 'timeout')
+                    return done('timeout');
+            }
+            else {
+                if (code === 0)
+                    return done('allow');
+                if (code === 1 && pressed === exports.DIALOG_BUTTON_ALWAYS)
+                    return done('allow_always');
+                if (code === 5)
+                    return done('timeout');
+            }
             done(Date.now() - started >= timeoutMs - 500 ? 'timeout' : 'deny');
         });
     });
@@ -178,6 +253,9 @@ const MAX_REMEMBERED = 200;
 /** The hook's dialog answer only carries over to the gateway call it was given for. */
 exports.CONFIRMED_ACTION_TTL_MS = 2 * 60_000;
 const MAX_CONFIRMED_ACTIONS = 50;
+/** "Always" is long, not forever: a standing grant lapses after 30 days unless renewed by use of the dialog. */
+exports.GRANT_TTL_MS = 30 * 24 * 60 * 60_000;
+const MAX_GRANTS = 100;
 /** CI / pipeline environments — no human at a keyboard. Shared by hooks and discovery. */
 function isCiEnvironment(env = process.env) {
     return env.GITHUB_ACTIONS === 'true'
@@ -206,58 +284,107 @@ function ledgerFile() {
 function readLedger() {
     try {
         const parsed = JSON.parse(fs.readFileSync(ledgerFile(), 'utf8'));
+        // Version 2 remembered entire rules and discarded MCP server identity.
+        if (parsed?.formatVersion !== 3)
+            return { pending: [], remembered: [], confirmedActions: [], grants: [] };
         return {
             pending: Array.isArray(parsed?.pending) ? parsed.pending.filter((p) => p && typeof p === 'object') : [],
             // Older ledgers could remember declines. Require fresh affirmative consent.
-            remembered: parsed?.formatVersion === 2 && Array.isArray(parsed?.remembered) ? parsed.remembered.filter((r) => r && typeof r === 'object') : [],
+            remembered: Array.isArray(parsed?.remembered) ? parsed.remembered.filter((r) => r && typeof r === 'object') : [],
             confirmedActions: Array.isArray(parsed?.confirmedActions) ? parsed.confirmedActions.filter((c) => c && typeof c === 'object') : [],
+            // Grants are an additive field on the same format (older CLIs ignore them).
+            grants: Array.isArray(parsed?.grants) ? parsed.grants.filter((g) => g && typeof g === 'object' && typeof g.key === 'string' && g.scope && typeof g.scope === 'object') : [],
         };
     }
     catch {
-        return { pending: [], remembered: [], confirmedActions: [] };
+        return { pending: [], remembered: [], confirmedActions: [], grants: [] };
     }
 }
 function writeLedger(ledger) {
+    const temp = `${ledgerFile()}.${process.pid}.${crypto.randomUUID()}.tmp`;
     try {
-        fs.mkdirSync(path.dirname(ledgerFile()), { recursive: true });
-        const temp = `${ledgerFile()}.${process.pid}.${crypto.randomUUID()}.tmp`;
-        fs.writeFileSync(temp, JSON.stringify({ ...ledger, formatVersion: 2 }), { encoding: 'utf8', mode: 0o600 });
+        const fd = fs.openSync(temp, 'wx', 0o600);
+        try {
+            fs.writeFileSync(fd, JSON.stringify({ ...ledger, formatVersion: 3 }), 'utf8');
+            fs.fsyncSync(fd);
+        }
+        finally {
+            fs.closeSync(fd);
+        }
         fs.renameSync(temp, ledgerFile());
     }
-    catch { /* best-effort — losing a record must never change a verdict */ }
+    finally {
+        try {
+            fs.unlinkSync(temp);
+        }
+        catch { /* renamed or not created */ }
+    }
+}
+/** Serialize every mutation: a stale writer must not resurrect a consumed approval.
+ * Contention, failed persistence or a leftover lock loses reuse, never grants access.
+ * No stale-lock stealing: deleting another process's lock introduces a replay race.
+ */
+function mutateLedger(fallback, mutate) {
+    const lock = `${ledgerFile()}.lock`;
+    let fd;
+    try {
+        fs.mkdirSync(path.dirname(lock), { recursive: true });
+        fd = fs.openSync(lock, 'wx', 0o600);
+        return mutate();
+    }
+    catch {
+        return fallback;
+    }
+    finally {
+        if (fd !== undefined) {
+            try {
+                fs.closeSync(fd);
+            }
+            catch { /* best effort */ }
+            try {
+                fs.unlinkSync(lock);
+            }
+            catch { /* fail closed on next reuse */ }
+        }
+    }
 }
 function sha256(value) {
     return crypto.createHash('sha256').update(value).digest('hex');
 }
-/**
- * Canonical digest of what the agent is about to do. Shell: the trimmed command. MCP/file: the
- * tool args with keys sorted, so the pre- and post-hook payloads (which the IDE serializes
- * independently) hash the same.
- */
+/** Canonical JSON action, including cwd and every argument. Invalid inputs cannot reuse consent. */
 function actionDigest(toolArgs) {
-    const command = toolArgs.command ?? toolArgs.cmd;
-    if (typeof command === 'string' && command.trim())
-        return sha256(`cmd:${command.trim()}`);
-    const stable = (value) => {
+    let nodes = 0;
+    const stable = (value, depth = 0) => {
+        if (++nodes > 10000 || depth > 40)
+            throw new Error('Action too complex');
+        if (value === null || typeof value === 'string' || typeof value === 'boolean')
+            return value;
+        if (typeof value === 'number' && Number.isFinite(value))
+            return value;
         if (Array.isArray(value))
-            return value.map(stable);
-        if (value && typeof value === 'object') {
-            return Object.keys(value).sort().reduce((acc, key) => {
-                acc[key] = stable(value[key]);
-                return acc;
-            }, {});
+            return value.map(v => stable(v, depth + 1));
+        if (value && typeof value === 'object' && [Object.prototype, null].includes(Object.getPrototypeOf(value))) {
+            const result = Object.create(null);
+            for (const key of Object.keys(value).sort()) {
+                const descriptor = Object.getOwnPropertyDescriptor(value, key);
+                if (!('value' in descriptor))
+                    throw new Error('Action accessor');
+                if (descriptor.value !== undefined)
+                    result[key] = stable(descriptor.value, depth + 1);
+            }
+            return result;
         }
-        return value;
+        throw new Error('Non-JSON action');
     };
     try {
-        return sha256(`args:${JSON.stringify(stable(toolArgs))}`);
+        return sha256(`args-v3:${JSON.stringify(stable(toolArgs))}`);
     }
     catch {
-        return sha256('args:unserializable');
+        return sha256(`invalid-action:${crypto.randomUUID()}`);
     }
 }
 function pendingKey(event, toolName, argsDigest) {
-    return sha256(`${event}|${toolName.toLowerCase()}|${argsDigest}`);
+    return sha256(JSON.stringify([event, toolName, argsDigest]));
 }
 /**
  * The tool name as the MCP server sees it. The IDE hook names an MCP call
@@ -275,25 +402,37 @@ function bareToolName(toolName) {
     }
     return name.toLowerCase();
 }
+/** Preserve the server and case; display-name normalization is not authorization. */
+function qualifiedToolIdentity(toolName) {
+    const match = /^mcp__([^]+?)__(.+)$/.exec(toolName);
+    if (match)
+        return JSON.stringify([match[1], match[2]]);
+    const slash = toolName.indexOf('/');
+    if (slash > 0)
+        return JSON.stringify([toolName.slice(0, slash), toolName.slice(slash + 1)]);
+    return JSON.stringify([null, toolName]);
+}
 function confirmedActionKey(toolName, argsDigest) {
-    return sha256(`confirmed|${bareToolName(toolName)}|${argsDigest}`);
+    return sha256(JSON.stringify(['confirmed-v3', qualifiedToolIdentity(toolName), argsDigest]));
 }
 /** The IDE hook's OS dialog got an explicit "Allow once" for this exact action. */
 function recordConfirmedAction(toolName, argsDigest, now = new Date()) {
     const entry = {
         key: confirmedActionKey(toolName, argsDigest),
-        toolName: bareToolName(toolName),
+        toolName,
         argsDigest,
         confirmedAt: now.toISOString(),
         expiresAt: new Date(now.getTime() + exports.CONFIRMED_ACTION_TTL_MS).toISOString(),
     };
-    const ledger = readLedger();
-    ledger.confirmedActions = ledger.confirmedActions.filter(c => c.key !== entry.key && Date.parse(c.expiresAt) > now.getTime());
-    ledger.confirmedActions.push(entry);
-    if (ledger.confirmedActions.length > MAX_CONFIRMED_ACTIONS)
-        ledger.confirmedActions = ledger.confirmedActions.slice(-MAX_CONFIRMED_ACTIONS);
-    writeLedger(ledger);
-    return entry;
+    return mutateLedger(entry, () => {
+        const ledger = readLedger();
+        ledger.confirmedActions = ledger.confirmedActions.filter(c => c.key !== entry.key && Date.parse(c.expiresAt) > now.getTime());
+        ledger.confirmedActions.push(entry);
+        if (ledger.confirmedActions.length > MAX_CONFIRMED_ACTIONS)
+            ledger.confirmedActions = ledger.confirmedActions.slice(-MAX_CONFIRMED_ACTIONS);
+        writeLedger(ledger);
+        return entry;
+    });
 }
 /**
  * Take (and remove) a still-valid hook-dialog approval for this exact action, so the
@@ -301,21 +440,24 @@ function recordConfirmedAction(toolName, argsDigest, now = new Date()) {
  * tool, different arguments, an expired entry, or the same entry twice.
  */
 function consumeConfirmedAction(toolName, argsDigest, now = new Date()) {
-    const ledger = readLedger();
-    const key = confirmedActionKey(toolName, argsDigest);
-    const hit = ledger.confirmedActions.find(c => c.key === key);
-    const live = ledger.confirmedActions.filter(c => Number.isFinite(Date.parse(c.expiresAt)) && Date.parse(c.expiresAt) > now.getTime());
-    const valid = hit && live.includes(hit) ? hit : undefined;
-    const next = live.filter(c => c !== valid);
-    if (next.length !== ledger.confirmedActions.length) {
-        ledger.confirmedActions = next;
-        writeLedger(ledger);
-    }
-    return valid;
+    return mutateLedger(undefined, () => {
+        const ledger = readLedger();
+        const key = confirmedActionKey(toolName, argsDigest);
+        const hit = ledger.confirmedActions.find(c => c.key === key);
+        const live = ledger.confirmedActions.filter(c => Number.isFinite(Date.parse(c.expiresAt)) && Date.parse(c.expiresAt) > now.getTime());
+        const valid = hit && live.includes(hit) && Number.isFinite(Date.parse(hit.confirmedAt))
+            && Date.parse(hit.confirmedAt) <= now.getTime()
+            && Date.parse(hit.expiresAt) - Date.parse(hit.confirmedAt) <= exports.CONFIRMED_ACTION_TTL_MS ? hit : undefined;
+        const next = live.filter(c => c !== valid);
+        if (next.length !== ledger.confirmedActions.length) {
+            ledger.confirmedActions = next;
+            writeLedger(ledger);
+        }
+        return valid;
+    });
 }
 function rememberKey(scope) {
-    const rule = scope.policyId ? `${scope.policyId}|${scope.matchedRule || ''}` : `op:${scope.operation.toLowerCase()}`;
-    return sha256(`${scope.toolName.toLowerCase()}|${rule}`);
+    return sha256(JSON.stringify([scope.toolName, scope.operation, scope.argsDigest, scope.policyId, scope.matchedRule, scope.policyHash, scope.authorizationContext]));
 }
 /** Record that the IDE was asked to confirm this action. Returns the marker (for logging). */
 function raiseDeveloperConfirmation(input, now = new Date()) {
@@ -324,13 +466,15 @@ function raiseDeveloperConfirmation(input, now = new Date()) {
         key: pendingKey(input.event, input.toolName, input.argsDigest),
         raisedAt: now.toISOString(),
     };
-    const ledger = readLedger();
-    ledger.pending = ledger.pending.filter(p => p.key !== marker.key);
-    ledger.pending.push(marker);
-    if (ledger.pending.length > MAX_PENDING)
-        ledger.pending = ledger.pending.slice(-MAX_PENDING);
-    writeLedger(ledger);
-    return marker;
+    return mutateLedger(marker, () => {
+        const ledger = readLedger();
+        ledger.pending = ledger.pending.filter(p => p.key !== marker.key);
+        ledger.pending.push(marker);
+        if (ledger.pending.length > MAX_PENDING)
+            ledger.pending = ledger.pending.slice(-MAX_PENDING);
+        writeLedger(ledger);
+        return marker;
+    });
 }
 /**
  * A post-execution hook fired for this action: the developer approved it in the IDE prompt.
@@ -339,39 +483,43 @@ function raiseDeveloperConfirmation(input, now = new Date()) {
  * the action was simply allowed and this post-hook is noise.
  */
 function settleDeveloperConfirmation(event, toolName, argsDigest, now = new Date()) {
-    const ledger = readLedger();
-    const key = pendingKey(event, toolName, argsDigest);
-    const marker = ledger.pending.find(p => p.key === key);
-    if (!marker)
-        return undefined;
-    ledger.pending = ledger.pending.filter(p => p.key !== key);
-    if (marker.remember !== 'none' && Date.parse(marker.raisedAt) <= now.getTime() && now.getTime() - Date.parse(marker.raisedAt) < exports.CONFIRM_PENDING_TTL_MS) {
-        const ttl = marker.remember === '1h' ? REMEMBER_1H_MS : REMEMBER_SESSION_MAX_MS;
-        const remembered = {
-            key: rememberKey(marker),
-            toolName: marker.toolName,
-            operation: marker.operation,
-            policyId: marker.policyId,
-            matchedRule: marker.matchedRule,
-            remember: marker.remember,
-            sessionId: marker.sessionId,
-            confirmedAt: now.toISOString(),
-            expiresAt: new Date(now.getTime() + ttl).toISOString(),
-        };
-        ledger.remembered = ledger.remembered.filter(r => r.key !== remembered.key);
-        ledger.remembered.push(remembered);
-        if (ledger.remembered.length > MAX_REMEMBERED)
-            ledger.remembered = ledger.remembered.slice(-MAX_REMEMBERED);
-    }
-    writeLedger(ledger);
-    return { marker, confirmLatencyMs: Math.max(0, now.getTime() - Date.parse(marker.raisedAt)) };
+    return mutateLedger(undefined, () => {
+        const ledger = readLedger();
+        const key = pendingKey(event, toolName, argsDigest);
+        const marker = ledger.pending.find(p => p.key === key);
+        if (!marker)
+            return undefined;
+        ledger.pending = ledger.pending.filter(p => p.key !== key);
+        if (marker.policyHash && marker.remember !== 'none' && Date.parse(marker.raisedAt) <= now.getTime() && now.getTime() - Date.parse(marker.raisedAt) < exports.CONFIRM_PENDING_TTL_MS) {
+            const ttl = marker.remember === '1h' ? REMEMBER_1H_MS : REMEMBER_SESSION_MAX_MS;
+            const remembered = {
+                key: rememberKey(marker),
+                toolName: marker.toolName,
+                operation: marker.operation,
+                policyId: marker.policyId,
+                matchedRule: marker.matchedRule,
+                remember: marker.remember,
+                sessionId: marker.sessionId,
+                confirmedAt: now.toISOString(),
+                expiresAt: new Date(now.getTime() + ttl).toISOString(),
+            };
+            ledger.remembered = ledger.remembered.filter(r => r.key !== remembered.key);
+            ledger.remembered.push(remembered);
+            if (ledger.remembered.length > MAX_REMEMBERED)
+                ledger.remembered = ledger.remembered.slice(-MAX_REMEMBERED);
+        }
+        writeLedger(ledger);
+        return { marker, confirmLatencyMs: Math.max(0, now.getTime() - Date.parse(marker.raisedAt)) };
+    });
 }
 /** Reject or cancel a pending request without creating approval memory. */
 function rejectDeveloperConfirmation(event, toolName, argsDigest) {
-    const ledger = readLedger();
-    const key = pendingKey(event, toolName, argsDigest);
-    ledger.pending = ledger.pending.filter(p => p.key !== key);
-    writeLedger(ledger);
+    return mutateLedger(undefined, () => {
+        const ledger = readLedger();
+        const key = pendingKey(event, toolName, argsDigest);
+        ledger.pending = ledger.pending.filter(p => p.key !== key);
+        writeLedger(ledger);
+    });
 }
 /**
  * Markers older than the TTL never saw a post-execution hook: the developer denied the IDE
@@ -379,24 +527,201 @@ function rejectDeveloperConfirmation(event, toolName, argsDigest) {
  * record them as not approved.
  */
 function sweepExpiredConfirmations(now = new Date(), ttlMs = exports.CONFIRM_PENDING_TTL_MS) {
-    const ledger = readLedger();
-    const cutoff = now.getTime() - ttlMs;
-    const expired = ledger.pending.filter(p => Date.parse(p.raisedAt) < cutoff);
-    const remembered = ledger.remembered.filter(r => Date.parse(r.expiresAt) > now.getTime());
-    const confirmedActions = ledger.confirmedActions.filter(c => Date.parse(c.expiresAt) > now.getTime());
-    if (expired.length > 0 || remembered.length !== ledger.remembered.length || confirmedActions.length !== ledger.confirmedActions.length) {
-        ledger.pending = ledger.pending.filter(p => Date.parse(p.raisedAt) >= cutoff);
-        ledger.remembered = remembered;
-        ledger.confirmedActions = confirmedActions;
+    return mutateLedger([], () => {
+        const ledger = readLedger();
+        const cutoff = now.getTime() - ttlMs;
+        const expired = ledger.pending.filter(p => Date.parse(p.raisedAt) < cutoff);
+        const remembered = ledger.remembered.filter(r => Date.parse(r.expiresAt) > now.getTime());
+        const confirmedActions = ledger.confirmedActions.filter(c => Date.parse(c.expiresAt) > now.getTime());
+        const grants = ledger.grants.filter(g => Date.parse(g.expiresAt) > now.getTime());
+        if (expired.length > 0 || remembered.length !== ledger.remembered.length || confirmedActions.length !== ledger.confirmedActions.length || grants.length !== ledger.grants.length) {
+            ledger.pending = ledger.pending.filter(p => Date.parse(p.raisedAt) >= cutoff);
+            ledger.remembered = remembered;
+            ledger.confirmedActions = confirmedActions;
+            ledger.grants = grants;
+            writeLedger(ledger);
+        }
+        return expired;
+    });
+}
+// ---------------------------------------------------------------------------
+// "Always allow" grants
+// ---------------------------------------------------------------------------
+/** Shell words that run the program that follows them, not a program of their own. */
+const SHELL_LEAD_WRAPPERS = new Set(['sudo', 'doas', 'env', 'nice', 'nohup', 'time', 'command', 'builtin', 'exec', 'xargs', 'timeout', 'stdbuf', 'chronic', 'busybox', 'call', 'start', '&']);
+/** Cheap quote-aware split on `; && || | \n` — the grant needs program NAMES, not semantics. */
+function splitShellSegments(command) {
+    const segments = [];
+    let current = '';
+    let quote = null;
+    for (let i = 0; i < command.length; i++) {
+        const ch = command[i];
+        if (quote) {
+            current += ch;
+            if (ch === quote)
+                quote = null;
+            else if (ch === '\\' && quote === '"' && i + 1 < command.length)
+                current += command[++i];
+            continue;
+        }
+        if (ch === '"' || ch === "'" || ch === '`') {
+            quote = ch;
+            current += ch;
+            continue;
+        }
+        if (ch === '\n' || ch === ';' || ch === '|' || (ch === '&' && command[i + 1] === '&')) {
+            if (ch === '&')
+                i++;
+            if (ch === '|' && command[i + 1] === '|')
+                i++;
+            segments.push(current);
+            current = '';
+            continue;
+        }
+        current += ch;
+    }
+    segments.push(current);
+    return segments;
+}
+/**
+ * The programs a shell line runs — one per segment, the wrapper (`sudo`, `env`),
+ * the `$var =` assignment, `KEY=value` prefixes and a leading `(` peeled off; the
+ * path and `.exe` dropped; lower-cased. Sorted and unique. A segment with no
+ * program (pure block structure like `} catch {`) contributes nothing.
+ */
+function shellPrograms(command) {
+    const out = new Set();
+    for (const raw of splitShellSegments(command)) {
+        const words = raw.trim().replace(/^[\s({]+/, '').split(/\s+/).filter(Boolean);
+        let i = 0;
+        // `$r = Invoke-WebRequest …` / `$r=Invoke-WebRequest …` / `FOO=bar cmd …`
+        while (i < words.length) {
+            const w = words[i];
+            if (/^\$[\w:.]+$/.test(w) && words[i + 1] && /^[+-]?=$/.test(words[i + 1])) {
+                i += 2;
+                continue;
+            }
+            if (/^\$[\w:.]+[+-]?=/.test(w) || /^[A-Za-z_][\w]*=/.test(w)) {
+                i++;
+                continue;
+            }
+            if (SHELL_LEAD_WRAPPERS.has(w.toLowerCase()) || /^-/.test(w)) {
+                i++;
+                continue;
+            }
+            break;
+        }
+        const lead = words[i];
+        if (!lead || /^[$@(){}\]\[|&;<>#'"`-]/.test(lead) || /^(if|then|else|elif|fi|do|done|for|while|until|case|esac|try|catch|finally|foreach|function|return|switch|break|continue)$/i.test(lead))
+            continue;
+        const name = lead.replace(/^["']|["']$/g, '').split(/[\\/]/).pop().replace(/\.(exe|cmd|bat|ps1|sh)$/i, '').toLowerCase();
+        if (name)
+            out.add(name);
+    }
+    return [...out].sort();
+}
+function grantKey(scope, policyId, matchedRule, policyHash) {
+    return sha256(JSON.stringify([scope.event, scope.toolName, scope.programs || null, scope.operation, scope.destinationDomain || null, policyId || null, matchedRule || null, policyHash]));
+}
+/**
+ * Does a live grant cover this action under this exact rule? Shell programs match by
+ * INCLUSION: a grant for `{gh, git}` covers a line that only runs `gh`, never a line
+ * that also runs `curl`. Everything else must be equal. Touch counts a use.
+ */
+function findDeveloperGrant(scope, rule, now = new Date()) {
+    if (!rule.policyHash)
+        return undefined;
+    return mutateLedger(undefined, () => {
+        const ledger = readLedger();
+        const hit = ledger.grants.find(g => g.policyHash === rule.policyHash
+            && (g.policyId || null) === (rule.policyId || null)
+            && (g.matchedRule || null) === (rule.matchedRule || null)
+            && g.scope.event === scope.event
+            && g.scope.toolName === scope.toolName
+            && g.scope.operation === scope.operation
+            && (g.scope.destinationDomain || null) === (scope.destinationDomain || null)
+            && Number.isFinite(Date.parse(g.expiresAt)) && Date.parse(g.expiresAt) > now.getTime()
+            && Number.isFinite(Date.parse(g.grantedAt)) && Date.parse(g.grantedAt) <= now.getTime()
+            && Date.parse(g.expiresAt) - Date.parse(g.grantedAt) <= exports.GRANT_TTL_MS
+            && (scope.event !== 'shell'
+                || (Array.isArray(g.scope.programs) && (scope.programs || []).length > 0 && (scope.programs || []).every(p => g.scope.programs.includes(p)))));
+        if (!hit)
+            return undefined;
+        hit.lastUsedAt = now.toISOString();
+        hit.uses = (Number(hit.uses) || 0) + 1;
+        writeLedger(ledger);
+        return hit;
+    });
+}
+/** The developer pressed "Always allow": store the grant (replacing any prior one for the same key). */
+function recordDeveloperGrant(scope, rule, now = new Date()) {
+    if (scope.event === 'shell' && (!scope.programs || scope.programs.length === 0))
+        return undefined;
+    const grant = {
+        key: grantKey(scope, rule.policyId, rule.matchedRule, rule.policyHash),
+        scope,
+        policyId: rule.policyId,
+        policyName: rule.policyName,
+        matchedRule: rule.matchedRule,
+        policyHash: rule.policyHash,
+        grantedAt: now.toISOString(),
+        expiresAt: new Date(now.getTime() + exports.GRANT_TTL_MS).toISOString(),
+        uses: 0,
+    };
+    return mutateLedger(undefined, () => {
+        const ledger = readLedger();
+        ledger.grants = ledger.grants.filter(g => g.key !== grant.key && Date.parse(g.expiresAt) > now.getTime());
+        ledger.grants.push(grant);
+        if (ledger.grants.length > MAX_GRANTS)
+            ledger.grants = ledger.grants.slice(-MAX_GRANTS);
         writeLedger(ledger);
+        return grant;
+    });
+}
+function listDeveloperGrants(now = new Date()) {
+    return readLedger().grants.filter(g => Date.parse(g.expiresAt) > now.getTime());
+}
+/** Remove one grant by key, or every grant when `key` is omitted. Returns how many were removed. */
+function revokeDeveloperGrants(key) {
+    return mutateLedger(0, () => {
+        const ledger = readLedger();
+        const before = ledger.grants.length;
+        ledger.grants = key ? ledger.grants.filter(g => g.key !== key) : [];
+        if (ledger.grants.length !== before)
+            writeLedger(ledger);
+        return before - ledger.grants.length;
+    });
+}
+/** One line a person can read on the button and in the grant list: what "Always allow" covers. */
+function describeGrantScope(scope) {
+    const what = scope.event === 'shell'
+        ? `\`${(scope.programs || []).join('`, `')}\` commands`
+        : scope.event === 'mcp'
+            ? `${scope.toolName.replace(/^mcp__/, '').replace(/__/g, ' / ')} calls`
+            : `${scope.toolName} ${scope.event} actions`;
+    const op = scope.operation && scope.operation !== 'SHELL' ? ` (${scope.operation.toLowerCase()})` : '';
+    const where = scope.destinationDomain ? ` to ${scope.destinationDomain}` : '';
+    return `${what}${op}${where}`;
+}
+/** The scope a grant would have for this action — from engine facts, never from text. */
+function grantScopeFor(event, toolName, toolArgs, operation, context) {
+    const scope = { event, toolName, operation: String(operation || '').trim() || 'unknown' };
+    if (event === 'shell') {
+        const command = typeof toolArgs?.command === 'string' ? toolArgs.command : typeof toolArgs?.cmd === 'string' ? toolArgs.cmd : '';
+        scope.programs = shellPrograms(command);
     }
-    return expired;
+    const domain = context?.['destination.domain'];
+    if (typeof domain === 'string' && domain.trim())
+        scope.destinationDomain = domain.trim().toLowerCase();
+    return scope;
 }
 /**
- * Is this tool + rule covered by a still-valid developer confirmation? Session memory only
- * matches the same IDE session id; 1h memory matches any session on this machine.
+ * Is this exact action covered in the same session and policy context?
+ * The 1h choice is a shorter expiry, never authorization for another session.
  */
 function isConfirmationRemembered(scope, sessionId, now = new Date()) {
+    if (!scope.policyHash || !scope.argsDigest)
+        return undefined;
     const ledger = readLedger();
     const key = rememberKey(scope);
     const hit = ledger.remembered.find(r => r.key === key);
@@ -404,7 +729,12 @@ function isConfirmationRemembered(scope, sessionId, now = new Date()) {
         return undefined;
     if (!Number.isFinite(Date.parse(hit.expiresAt)) || Date.parse(hit.expiresAt) <= now.getTime())
         return undefined;
-    if (hit.remember === 'session' && (!sessionId || hit.sessionId !== sessionId))
+    if (!sessionId || hit.sessionId !== sessionId)
+        return undefined;
+    if (!['session', '1h'].includes(hit.remember) || !Number.isFinite(Date.parse(hit.confirmedAt)) || Date.parse(hit.confirmedAt) > now.getTime())
+        return undefined;
+    const maxTtl = hit.remember === '1h' ? REMEMBER_1H_MS : REMEMBER_SESSION_MAX_MS;
+    if (Date.parse(hit.expiresAt) - Date.parse(hit.confirmedAt) > maxTtl)
         return undefined;
     return hit;
 }