kritya 0.8.2-beta

package/dist/tools/shell.js

@@ -0,0 +1,134 @@
+import { exec, execFile } from "node:child_process";
+import { scrubbedShellEnv } from "../config/config.js";
+import { gitDiffStat } from "../git/git.js";
+import { backgroundManager } from "../shell/background.js";
+import { buildSandboxedCommand, requiresSandbox, sandboxUnavailableReason, shouldSandbox, } from "../shell/sandbox.js";
+import { commandTouchesSensitivePath, truncateTail } from "./common.js";
+import { redactSecrets } from "./secretScan.js";
+const DEFAULT_TIMEOUT_S = 120;
+const MAX_TIMEOUT_S = 600;
+/** git subcommands that rewrite the working tree, index, or history. */
+const GIT_MUTATING_RE = /\bgit\s+(commit|merge|rebase|pull|checkout|reset|clean|stash|cherry-pick|revert|apply|am|rm|mv|restore|add)\b/i;
+/** The markers `run` appends when a command didn't complete successfully. */
+const FAILURE_MARKER = /^\[(?:exit code: |command timed out |command cancelled |command refused: )/m;
+export const shellTool = {
+    name: "shell",
+    description: "Run a shell command from the workspace root (sh on Linux/macOS, cmd on Windows). " +
+        "Returns stdout, stderr, and the exit code. Use `cd subdir && cmd` to run in a subdirectory. " +
+        "For long-running processes (dev servers, watchers) pass background:true — the command " +
+        "returns an id immediately; use bg_output to read its output and bg_kill to stop it. " +
+        "Foreground commands time out after timeout_seconds (default 120, max 600).",
+    parameters: {
+        type: "object",
+        properties: {
+            command: { type: "string", description: "The command to run" },
+            timeout_seconds: {
+                type: "number",
+                description: "Foreground timeout in seconds (default 120, max 600)",
+            },
+            background: {
+                type: "boolean",
+                description: "Run detached for servers/watchers; returns an id for bg_output/bg_kill",
+            },
+        },
+        required: ["command"],
+    },
+    requiresPermission: true,
+    // Self-managed: timeout_seconds (max 600) is enforced by exec below, and a
+    // background command returns immediately. A second, shorter cap from the
+    // agent loop would cut off commands the user explicitly asked to run longer.
+    timeoutMs: 0,
+    summarize: (args) => `Run${args.background ? " in background" : ""}: ${args.command}`,
+    // A command that printed nothing needs no preview to say so — but every
+    // other command's output is the answer, so keep it (null = show the preview).
+    resultSummary: (output) => (output.trim() === "(no output)" ? "no output" : null),
+    // A nonzero exit resolves rather than throwing, so the model still sees the
+    // output — but the trailing marker this tool wrote is what the UI needs to
+    // show a failure rather than a green check.
+    failed: (output) => FAILURE_MARKER.test(output),
+    async preview(args, ctx) {
+        const command = String(args.command ?? "");
+        if (!GIT_MUTATING_RE.test(command))
+            return null;
+        return gitDiffStat(ctx.workspace) || null;
+    },
+    execute(args, ctx, signal) {
+        const command = String(args.command);
+        const sensitivePath = commandTouchesSensitivePath(command);
+        if (sensitivePath) {
+            throw new Error(`Command references "${sensitivePath}", which looks like a secret file, and is blocked from tool access`);
+        }
+        if (args.background) {
+            const { id } = backgroundManager.start(command, ctx.workspace, ctx.sandboxMode);
+            // Echoing the command back can leak a credential embedded in it (e.g. a
+            // curl Authorization header), so redact it here just like bg_output does.
+            const { redacted } = redactSecrets(command);
+            return Promise.resolve(`Started background process ${id}: ${redacted}\nUse bg_output {"id":"${id}"} to read its output and bg_kill {"id":"${id}"} to stop it.`);
+        }
+        const timeoutS = Math.min(Math.max(Number(args.timeout_seconds) || DEFAULT_TIMEOUT_S, 1), MAX_TIMEOUT_S);
+        const runOpts = {
+            cwd: ctx.workspace,
+            env: scrubbedShellEnv(),
+            timeout: timeoutS * 1000,
+            maxBuffer: 10 * 1024 * 1024,
+            windowsHide: true,
+            signal,
+        };
+        const finish = (resolve, error, stdout, stderr, note) => {
+            const parts = [];
+            if (note)
+                parts.push(note);
+            if (stdout)
+                parts.push(stdout.trimEnd());
+            if (stderr)
+                parts.push(`[stderr]\n${stderr.trimEnd()}`);
+            if (error) {
+                if (signal?.aborted) {
+                    parts.push("[command cancelled by user]");
+                }
+                else if (error.killed) {
+                    parts.push(`[command timed out after ${timeoutS}s — for servers/watchers use background:true]`);
+                }
+                else {
+                    parts.push(`[exit code: ${error.code ?? "unknown"}]`);
+                }
+            }
+            const joined = parts.join("\n") || "(no output)";
+            const { redacted, matches } = redactSecrets(joined);
+            const withNote = matches.length > 0
+                ? `[${matches.length} secret(s) redacted from output: ${matches.map((m) => m.kind).join(", ")}]\n${redacted}`
+                : redacted;
+            resolve(truncateTail(withNote));
+        };
+        return new Promise((resolve) => {
+            if (shouldSandbox(ctx.sandboxMode, command)) {
+                const wrapped = buildSandboxedCommand(command, ctx.workspace);
+                if (wrapped) {
+                    const opts = wrapped.env
+                        ? { ...runOpts, env: { ...runOpts.env, ...wrapped.env } }
+                        : runOpts;
+                    execFile(wrapped.cmd, wrapped.args, opts, (error, stdout, stderr) => {
+                        wrapped.cleanup?.();
+                        finish(resolve, error, stdout, stderr);
+                    });
+                    return;
+                }
+                // Sandboxing was requested but no sandbox binary is available here.
+                // In "strict" mode that's a hard requirement, not a best-effort one —
+                // refuse to run rather than silently falling back to an unconfined
+                // command. Other modes fall back to a plain run, flagged with a note.
+                if (requiresSandbox(ctx.sandboxMode)) {
+                    resolve(`[command refused: sandboxExec is "strict" but sandboxing is unavailable here ` +
+                        `(${sandboxUnavailableReason()}) — set sandboxExec to "auto"/"always" to allow ` +
+                        `an unsandboxed fallback, or install the required sandbox binary]`);
+                    return;
+                }
+                exec(command, runOpts, (error, stdout, stderr) => finish(resolve, error, stdout, stderr, `[sandbox unavailable (${sandboxUnavailableReason()}) — ran without sandbox]`));
+                return;
+            }
+            // exec (not execFile) on purpose: this tool exists to run arbitrary
+            // shell commands, and every invocation is gated by a user permission prompt.
+            exec(command, runOpts, (error, stdout, stderr) => finish(resolve, error, stdout, stderr));
+        });
+    },
+};

package/dist/tools/skills.js

@@ -0,0 +1,69 @@
+import fs from "node:fs";
+import path from "node:path";
+import { defaultExtraSkillRoots, parseSkillFrontmatter, scanSkills, skillsDir, } from "../agent/skills.js";
+import { truncateResult } from "./common.js";
+const BUNDLE_DIRS = ["scripts", "references", "assets"];
+function listBundledFiles(skillDir) {
+    const sections = [];
+    for (const sub of BUNDLE_DIRS) {
+        let entries;
+        try {
+            entries = fs.readdirSync(path.join(skillDir, sub), { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        if (!entries.length)
+            continue;
+        const names = entries.map((e) => `  ${e.name}${e.isDirectory() ? "/" : ""}`).join("\n");
+        sections.push(`${sub}/\n${names}`);
+    }
+    return sections.join("\n\n");
+}
+export const loadSkillTool = {
+    name: "load_skill",
+    description: "Load the full instructions for an available skill by name. Call this when a task matches a skill listed in the system prompt.",
+    parameters: {
+        type: "object",
+        properties: {
+            name: { type: "string", description: "The skill's name, as listed in the system prompt" },
+        },
+        required: ["name"],
+    },
+    requiresPermission: false,
+    summarize: (args) => `Load skill "${args.name}"`,
+    async execute(args, ctx) {
+        const name = String(args.name ?? "");
+        // Re-scan on every call (no session-start caching) so a skill added
+        // mid-session is usable immediately -- cheap since these are a handful
+        // of small file reads.
+        // Workspace-controlled skill roots (.kritya/skills, workspace plugin
+        // skills) are the same trust-gated surface as KRITYA.md -- a full skill
+        // body is arbitrary instructions the model then follows, so an untrusted
+        // workspace's own skills/plugins are excluded from the scan (user-global
+        // ones under ~/.kritya still apply). `trustWorkspace` undefined (tool
+        // contexts that don't go through the trust flow) is treated as trusted,
+        // matching the rest of the codebase's convention.
+        const trustWorkspace = ctx.trustWorkspace !== false;
+        const skills = scanSkills([
+            ...(trustWorkspace ? [skillsDir(ctx.workspace)] : []),
+            ...defaultExtraSkillRoots(ctx.workspace, trustWorkspace),
+        ]);
+        const skill = skills.find((s) => s.name === name);
+        if (!skill) {
+            const available = skills.map((s) => s.name).join(", ") || "(none)";
+            // Throwing (rather than returning an "Error: ..." string) matches this
+            // codebase's convention (see resolveSafe): the agent loop's catch path
+            // marks the call failed and formats the message for the model.
+            throw new Error(`skill "${name}" not found. Available: ${available}`);
+        }
+        // skill.dir came from scanSkills' own directory listing, never from the
+        // model-supplied `name` -- a hallucinated/malicious name can only fail
+        // the lookup above, never build a path.
+        const raw = fs.readFileSync(path.join(skill.dir, "SKILL.md"), "utf8");
+        const parsed = parseSkillFrontmatter(raw);
+        const body = parsed?.body ?? "";
+        const bundled = listBundledFiles(skill.dir);
+        return truncateResult(bundled ? `${body}\n\n# Bundled files\n${bundled}` : body);
+    },
+};

package/dist/tools/subagent.js

@@ -0,0 +1,57 @@
+const MAX_AGENTS = 6;
+/**
+ * Dispatches one or more focused, read-only subtasks to fresh agents that each
+ * get their own context window and return only a summary. Useful for wide
+ * searches and codebase questions that would otherwise flood the main
+ * conversation with tool output. Subagents cannot write, edit, or run shell
+ * commands. Multiple tasks run concurrently.
+ */
+export const spawnAgentTool = {
+    name: "spawn_agent",
+    description: "Run one or more read-only subagents on focused investigations (e.g. 'find everywhere X is " +
+        "used and summarize how it works'), each in its own fresh context. They can read, list, glob, " +
+        "and grep, but cannot modify files or run commands. Pass multiple tasks to investigate several " +
+        "independent things at once — they run concurrently. Returns each subagent's findings. Prefer " +
+        "this for broad searches so the main context stays lean.",
+    parameters: {
+        type: "object",
+        properties: {
+            tasks: {
+                type: "array",
+                items: { type: "string" },
+                minItems: 1,
+                maxItems: MAX_AGENTS,
+                description: "Self-contained instructions for each subagent, one per investigation. Each must include " +
+                    "all context it needs; subagents do not see the current conversation.",
+            },
+        },
+        required: ["tasks"],
+    },
+    requiresPermission: false,
+    // Self-managed: each subagent has its own wall-clock cap and the batch runs
+    // several in sequence, so the total legitimately exceeds any per-tool limit.
+    timeoutMs: 0,
+    async execute(args, ctx, signal) {
+        const tasks = Array.isArray(args.tasks)
+            ? args.tasks.map((t) => String(t).trim()).filter(Boolean)
+            : [];
+        if (!tasks.length)
+            return "Error: tasks is required and must be a non-empty array of strings.";
+        if (tasks.length > MAX_AGENTS)
+            return `Error: at most ${MAX_AGENTS} tasks per call.`;
+        if (!ctx.spawnAgents)
+            return "Error: subagents are not available in this session.";
+        const results = await ctx.spawnAgents(tasks.map((task) => ({ task, write: false })), signal);
+        if (results.length === 1)
+            return results[0].summary;
+        return results
+            .map((r, i) => `--- Subagent ${i + 1}: ${r.task.slice(0, 60)} ---\n${r.summary}`)
+            .join("\n\n");
+    },
+    summarize: (args) => {
+        const tasks = Array.isArray(args.tasks) ? args.tasks : [];
+        if (tasks.length <= 1)
+            return `Subagent: ${String(tasks[0] ?? "").slice(0, 60)}`;
+        return `${tasks.length} subagents in parallel`;
+    },
+};

package/dist/tools/tasks.js

@@ -0,0 +1,43 @@
+const VALID_STATUS = new Set(["pending", "in_progress", "done"]);
+export const updateTasksTool = {
+    name: "update_tasks",
+    description: "Maintain a visible checklist for multi-step work. Call with the FULL task list " +
+        "(it replaces the previous list) whenever you plan steps or a step's status changes. " +
+        "Use it at the start of any request that needs more than 2 distinct steps.",
+    parameters: {
+        type: "object",
+        properties: {
+            tasks: {
+                type: "array",
+                description: "The complete, ordered task list",
+                items: {
+                    type: "object",
+                    properties: {
+                        text: { type: "string", description: "Short description of the step" },
+                        status: { type: "string", enum: ["pending", "in_progress", "done"] },
+                    },
+                    required: ["text", "status"],
+                },
+            },
+        },
+        required: ["tasks"],
+    },
+    requiresPermission: false,
+    summarize: (args) => {
+        const tasks = Array.isArray(args.tasks) ? args.tasks : [];
+        const done = tasks.filter((t) => t.status === "done").length;
+        return `Update tasks (${done}/${tasks.length} done)`;
+    },
+    async execute(args, ctx) {
+        if (!Array.isArray(args.tasks))
+            throw new Error("tasks must be an array");
+        const tasks = args.tasks.map((t) => ({
+            text: String(t.text ?? ""),
+            status: VALID_STATUS.has(String(t.status))
+                ? String(t.status)
+                : "pending",
+        }));
+        ctx.onTasksUpdate?.(tasks);
+        return `Task list updated (${tasks.length} tasks).`;
+    },
+};

package/dist/tools/webSearch.js

@@ -0,0 +1,97 @@
+import { truncateResult } from "./common.js";
+const SEARCH_TIMEOUT_MS = 30_000;
+/**
+ * Raw Tavily search call, returning the parsed structured response. Shared by
+ * the web_search tool (which formats it for display) and deep_research (which
+ * needs the result URLs to fetch full pages). Throws on any error so callers
+ * can decide how to surface it.
+ */
+export async function tavilyRaw(query, maxResults = 5, opts = {}) {
+    const apiKey = process.env.TAVILY_API_KEY;
+    if (!apiKey) {
+        throw new Error("TAVILY_API_KEY is not set. Add it to your .env file to enable web search.");
+    }
+    const body = {
+        query,
+        max_results: Math.min(Math.max(maxResults, 1), 10),
+        include_answer: true,
+    };
+    if (opts.topic)
+        body.topic = opts.topic;
+    // `days` is a news-topic filter; setting it implies topic "news" so the
+    // recency window is actually applied (and publish dates come back).
+    if (opts.days !== undefined && Number.isFinite(opts.days)) {
+        body.topic = "news";
+        body.days = Math.max(1, Math.floor(opts.days));
+    }
+    // Bounded explicitly: a fetch with no signal waits on the socket forever, and
+    // this is also called outside the agent loop (the /web-search command), where
+    // the loop's per-tool deadline isn't there to catch it.
+    const res = await fetch("https://api.tavily.com/search", {
+        signal: AbortSignal.timeout(SEARCH_TIMEOUT_MS),
+        method: "POST",
+        headers: {
+            "Content-Type": "application/json",
+            Authorization: `Bearer ${apiKey}`,
+        },
+        body: JSON.stringify(body),
+    });
+    if (!res.ok) {
+        const errBody = await res.text().catch(() => "");
+        throw new Error(`Tavily search failed (HTTP ${res.status}) ${errBody.slice(0, 300)}`);
+    }
+    return (await res.json());
+}
+export async function tavilySearch(query, maxResults = 5, opts = {}) {
+    let data;
+    try {
+        data = await tavilyRaw(query, maxResults, opts);
+    }
+    catch (err) {
+        return `Error: ${err instanceof Error ? err.message : String(err)}`;
+    }
+    const parts = [];
+    if (data.answer)
+        parts.push(`Answer: ${data.answer}`);
+    for (const [i, r] of (data.results ?? []).entries()) {
+        const date = r.published_date ? ` (published ${r.published_date})` : "";
+        parts.push(`${i + 1}. ${r.title ?? "(untitled)"}${date}\n   ${r.url ?? ""}\n   ${(r.content ?? "").slice(0, 400)}`);
+    }
+    return truncateResult(parts.join("\n\n") || "(no results)");
+}
+/** Distinguishes "omitted" (use default) from an explicit value like 0. */
+export function parseMaxResults(raw, defaultValue = 5) {
+    return raw === undefined || raw === null ? defaultValue : Number(raw);
+}
+export const webSearchTool = {
+    name: "web_search",
+    description: "Search the web (via Tavily) for current information: documentation, error messages, " +
+        "library versions, news. Returns an answer summary plus result snippets with URLs. " +
+        "For time-sensitive queries ('latest', 'this week', recent news), set recency_days to the " +
+        "window so results are restricted to that period and labeled with publish dates.",
+    parameters: {
+        type: "object",
+        properties: {
+            query: { type: "string", description: "The search query" },
+            max_results: { type: "number", description: "Number of results, 1-10 (default 5)" },
+            recency_days: {
+                type: "number",
+                description: "Restrict results to the last N days and return publish dates (news sources). " +
+                    "Set this for recent/time-sensitive queries; omit for timeless ones.",
+            },
+        },
+        required: ["query"],
+    },
+    // Requires a prompt (rather than running silently) so the query text is
+    // visible before it's sent out — under prompt injection, a search query is
+    // an easy channel to smuggle file contents to an external service.
+    requiresPermission: true,
+    external: true,
+    summarize: (args) => `Web search: ${args.query}`,
+    async execute(args) {
+        const days = args.recency_days === undefined || args.recency_days === null
+            ? undefined
+            : Number(args.recency_days);
+        return tavilySearch(String(args.query), parseMaxResults(args.max_results), { days });
+    },
+};

package/dist/tools/write.js

@@ -0,0 +1,47 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { writeFileAtomic } from "../atomicWrite.js";
+import { resolveSafe } from "./common.js";
+import { diffLines } from "./diff.js";
+import { formatSecretWarning, scanForSecrets } from "./secretScan.js";
+export const writeFileTool = {
+    name: "write_file",
+    description: "Create or overwrite a file in the workspace with the given content. " +
+        "Parent directories are created automatically.",
+    parameters: {
+        type: "object",
+        properties: {
+            path: { type: "string", description: "File path relative to the workspace root" },
+            content: { type: "string", description: "Full content to write" },
+        },
+        required: ["path", "content"],
+    },
+    requiresPermission: true,
+    // The summary line already names the file and its size; "Wrote <path>" under
+    // it is the same sentence twice.
+    resultSummary: () => "",
+    summarize: (args) => `Write ${args.path} (${Buffer.byteLength(String(args.content ?? ""), "utf8")} bytes)`,
+    async preview(args, ctx) {
+        const abs = resolveSafe(ctx.workspace, String(args.path));
+        let existing;
+        try {
+            existing = await fs.readFile(abs, "utf8");
+        }
+        catch {
+            existing = "";
+        }
+        return diffLines(existing, String(args.content ?? ""));
+    },
+    async execute(args, ctx) {
+        const abs = resolveSafe(ctx.workspace, String(args.path));
+        const content = String(args.content);
+        const secrets = scanForSecrets(content);
+        if (secrets.length > 0) {
+            throw new Error(formatSecretWarning(secrets, String(args.path)));
+        }
+        await fs.mkdir(path.dirname(abs), { recursive: true });
+        ctx.undo?.snapshot(abs, String(args.path));
+        await writeFileAtomic(abs, content);
+        return `Wrote ${args.path}`;
+    },
+};

package/dist/tools/writeAgent.js

@@ -0,0 +1,72 @@
+const MAX_AGENTS = 4;
+/**
+ * Dispatches one or more subagents that can write files, edit files, and run
+ * shell commands — each isolated on its own git branch/worktree so nothing
+ * touches the user's real working tree until they review and merge it.
+ * Always requires permission: this is the one tool that lets the model make
+ * unattended file/shell changes, so the user approves the task list up front.
+ */
+export const spawnWriteAgentTool = {
+    name: "spawn_write_agent",
+    description: "Run one or more subagents that can write/edit files and run shell commands, for independent " +
+        "chunks of work that can proceed in parallel (e.g. 'implement the API client' and 'write its " +
+        "tests' at the same time). Each subagent works in an isolated git worktree on its own branch — " +
+        "it never touches your real working tree. Requires the workspace to be a git repository. " +
+        "Returns a summary of each subagent's changes and the branch name to review/merge " +
+        "(git diff <base>...<branch>, git merge <branch>); branches with no changes are cleaned up " +
+        "automatically. Destructive shell commands (rm -rf, force push, etc.) are still blocked inside " +
+        "these subagents since there's no one to confirm them.",
+    parameters: {
+        type: "object",
+        properties: {
+            tasks: {
+                type: "array",
+                items: { type: "string" },
+                minItems: 1,
+                maxItems: MAX_AGENTS,
+                description: "Self-contained instructions for each subagent, one per independent piece of work. Each " +
+                    "must include all context it needs — subagents do not see the current conversation.",
+            },
+        },
+        required: ["tasks"],
+    },
+    requiresPermission: true,
+    // Self-managed, same as spawn_agent: per-subagent timeout plus batching.
+    timeoutMs: 0,
+    summarize: (args) => {
+        const tasks = Array.isArray(args.tasks) ? args.tasks : [];
+        if (tasks.length <= 1)
+            return `Write subagent: ${String(tasks[0] ?? "").slice(0, 60)}`;
+        return `${tasks.length} write subagents in parallel`;
+    },
+    async preview(args) {
+        const tasks = Array.isArray(args.tasks) ? args.tasks : [];
+        return (`About to run ${tasks.length} write-capable subagent(s), each isolated on its own git branch:\n` +
+            tasks.map((t, i) => `  ${i + 1}. ${String(t).slice(0, 100)}`).join("\n") +
+            `\n\nNone of this touches your working tree directly — review each branch's diff before merging.`);
+    },
+    async execute(args, ctx, signal) {
+        const tasks = Array.isArray(args.tasks)
+            ? args.tasks.map((t) => String(t).trim()).filter(Boolean)
+            : [];
+        if (!tasks.length)
+            return "Error: tasks is required and must be a non-empty array of strings.";
+        if (tasks.length > MAX_AGENTS)
+            return `Error: at most ${MAX_AGENTS} tasks per call.`;
+        if (!ctx.spawnAgents)
+            return "Error: subagents are not available in this session.";
+        const results = await ctx.spawnAgents(tasks.map((task) => ({ task, write: true })), signal);
+        return results
+            .map((r, i) => {
+            const header = `--- Write subagent ${i + 1}: ${r.task.slice(0, 60)} ---`;
+            if (r.error)
+                return `${header}\n${r.summary}\n[error: ${r.error}]`;
+            const branchNote = r.branch
+                ? `\n\nChanges committed to branch "${r.branch}". Review with ` +
+                    `\`git diff main...${r.branch}\` (or your base branch), merge with \`git merge ${r.branch}\`.`
+                : "\n\n(no file changes were made)";
+            return `${header}\n${r.summary}${branchNote}`;
+        })
+            .join("\n\n");
+    },
+};

package/dist/trust/aiDisclosure.js

@@ -0,0 +1,45 @@
+import fs from "node:fs";
+import path from "node:path";
+import { CONFIG_DIR } from "../config/config.js";
+import { hardenWindowsDir } from "../config/winAcl.js";
+import { debugLog } from "../config/debug.js";
+/**
+ * Tracks which workspaces have already seen the one-time "kritya is an AI
+ * agent" notice (see AiDisclosurePrompt.tsx), keyed by resolved workspace
+ * path — same shape and persistence pattern as trust.ts's trusted.json, so a
+ * dismissal in one workspace doesn't suppress the notice in every other one.
+ *
+ * Values are the ISO timestamp the notice was acknowledged, not a plain
+ * boolean: if this file is ever pointed to as evidence the user was told
+ * ("Art. 50(1) disclosure happened"), a bare true/false has no record of
+ * *when* — the timestamp is what makes it worth citing.
+ */
+const DISCLOSURE_FILE = path.join(CONFIG_DIR, "ai-disclosure.json");
+function loadStore(storeFile) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(storeFile, "utf8"));
+        return parsed && typeof parsed === "object" ? parsed : {};
+    }
+    catch (err) {
+        // A missing file means "not shown anywhere yet" (normal); a malformed one
+        // means every workspace re-shows the notice, worth being able to see.
+        debugLog(`loadStore(${storeFile})`, err);
+        return {};
+    }
+}
+/** Whether the AI disclosure notice has already been shown and dismissed for this workspace. */
+export function isAiDisclosureShown(workspace, storeFile = DISCLOSURE_FILE) {
+    return typeof loadStore(storeFile)[path.resolve(workspace)] === "string";
+}
+/** When the AI disclosure notice was shown and dismissed for this workspace, if it was. */
+export function aiDisclosureShownAt(workspace, storeFile = DISCLOSURE_FILE) {
+    return loadStore(storeFile)[path.resolve(workspace)];
+}
+/** Record that the AI disclosure notice has been shown and dismissed for this workspace, now. */
+export function markAiDisclosureShown(workspace, storeFile = DISCLOSURE_FILE) {
+    const store = loadStore(storeFile);
+    store[path.resolve(workspace)] = new Date().toISOString();
+    fs.mkdirSync(path.dirname(storeFile), { recursive: true, mode: 0o700 });
+    hardenWindowsDir(path.dirname(storeFile));
+    fs.writeFileSync(storeFile, JSON.stringify(store, null, 2) + "\n", { mode: 0o600 });
+}