litmus-cli 1.4.24 → 1.4.26

package/dist/lib/ai-tracking.js

@@ -1,14 +1,24 @@
-import { existsSync, readFileSync, writeFileSync, renameSync, mkdirSync, copyFileSync, openSync, closeSync, unlinkSync, statSync, constants as fsConstants, } from "fs";
+import { existsSync, readFileSync, writeFileSync, renameSync, mkdirSync, copyFileSync, openSync, closeSync, unlinkSync, statSync, realpathSync, chmodSync, constants as fsConstants, } from "fs";
 import path from "path";
 import os from "os";
+import { createHash } from "crypto";
 const CLAUDE_DIR = path.join(os.homedir(), ".claude");
 const CLAUDE_SETTINGS = path.join(CLAUDE_DIR, "settings.json");
-const CODEX_DIR = path.join(os.homedir(), ".codex");
+// Codex honours $CODEX_HOME over ~/.codex, and its hook-trust keys embed this
+// path verbatim, so we must resolve it the same way or the pin never matches.
+const CODEX_DIR = process.env.CODEX_HOME?.trim() || path.join(os.homedir(), ".codex");
 const CODEX_HOOKS = path.join(CODEX_DIR, "hooks.json");
+const CODEX_CONFIG = path.join(CODEX_DIR, "config.toml");
 const CURSOR_DIR = path.join(os.homedir(), ".cursor");
 const CURSOR_HOOKS = path.join(CURSOR_DIR, "hooks.json");
 const GEMINI_DIR = path.join(os.homedir(), ".gemini");
 const GEMINI_SETTINGS = path.join(GEMINI_DIR, "settings.json");
+// Gemini's own override for the trust store, honoured so our entry lands in
+// the file Gemini actually reads.
+const GEMINI_TRUSTED_FOLDERS = process.env.GEMINI_CLI_TRUSTED_FOLDERS_PATH?.trim() || path.join(GEMINI_DIR, "trustedFolders.json");
+// Copilot CLI resolves its home as $COPILOT_HOME, else ~/.copilot.
+const COPILOT_DIR = process.env.COPILOT_HOME?.trim() || path.join(os.homedir(), ".copilot");
+const COPILOT_CONFIG = path.join(COPILOT_DIR, "config.json");
 const LITMUS_DIR = path.join(os.homedir(), ".litmus");
 const ACTIVE_ASSESSMENTS = path.join(LITMUS_DIR, "active-assessments.json");
 const REGISTRY_LOCK = path.join(LITMUS_DIR, "registry.lock");
@@ -145,10 +155,32 @@ export function isOurCursorEntry(entry) {
 // atomic, so a crash mid-write leaves either the old file or the new file —
 // never a truncated mix. Avoids leaving the candidate's ~/.claude/settings.json
 // in an unparseable state if the CLI is killed mid-write.
+//
+// Two things a plain tmp+rename would silently change on a file the candidate
+// manages themselves: a symlinked config (dotfiles repos) would have the LINK
+// replaced by a regular file, leaving their repo copy stale; and a file they
+// deliberately chmod'ed (Codex writes trust state 0600, Gemini writes
+// trustedFolders.json 0600) would come back with the umask default. Resolve
+// the link and copy the mode so the rewrite is invisible except for content.
 function atomicWriteFileSync(target, content) {
-    const tmp = `${target}.litmus-tmp-${process.pid}-${Date.now()}`;
-    writeFileSync(tmp, content);
-    renameSync(tmp, target);
+    let dest = target;
+    let mode;
+    try {
+        if (existsSync(target)) {
+            dest = realpathSync(target);
+            mode = statSync(dest).mode & 0o777;
+        }
+    }
+    catch { /* fall back to writing the path as given */ }
+    const tmp = `${dest}.litmus-tmp-${process.pid}-${Date.now()}`;
+    writeFileSync(tmp, content, mode === undefined ? undefined : { mode });
+    if (mode !== undefined) {
+        try {
+            chmodSync(tmp, mode);
+        }
+        catch { /* best effort */ }
+    }
+    renameSync(tmp, dest);
 }
 function atomicCopyFileSync(src, target) {
     const tmp = `${target}.litmus-tmp-${process.pid}-${Date.now()}`;
@@ -358,42 +390,222 @@ export function uninstallUserScopeClaudeHook() {
 // text DIRECTLY in `last_assistant_message` (plus `transcript_path` to the
 // rollout JSONL, which we don't need). Timeout in seconds, default 600.
 //
-// ── Codex BLOCKS third-party hooks until the candidate trusts them (ENG-951) ──
+// ── Codex BLOCKS third-party hooks until they are trusted (ENG-951) ──
+//
+// Writing hooks.json is necessary but NOT sufficient: Codex skips any
+// non-managed hook whose definition has not been trusted, and says nothing
+// beyond a startup line pointing at `/hooks`. Until now we left that to the
+// candidate ("accept the trust prompt"), and it was the single biggest
+// silent-capture loss on Codex cohorts (ENG-1860).
+//
+// The trust store is per hook, in the candidate's own `~/.codex/config.toml`:
 //
-// Writing this file is necessary but NOT sufficient: Codex will not run a hook
-// it has not been told to trust, so capture stays off until the candidate
-// approves it. The comment here used to call that "a review on first run, and
-// that gate is surfaced by Codex itself", which understates it — nothing about
-// our install makes the hook live.
+//   [hooks.state."<hooks.json path>:<event_key>:<group_index>:<handler_index>"]
+//   trusted_hash = "sha256:<hex>"
 //
-// Mechanism, read from a real `~/.codex/config.toml` rather than from docs:
-// trust is recorded per hook entry under a `[hooks.state."<id>"]` table as
-// `trusted_hash = "sha256:..."`, alongside per-project `[projects."<path>"]
-// trust_level` entries. Because the pin is a hash of the entry, CHANGING our
-// command invalidates it — so a candidate who re-runs `litmus init` after their
-// logger path moves has to approve the hook again, and their previous approval
-// does not carry over. Both of our entries (prompt and `Stop`) sit behind this
-// gate, each with its own per-entry pin.
+// Codex compares `trusted_hash` against a hash it derives from the hook's
+// normalized definition. We now compute that same hash and pin it ourselves at
+// install time, exactly as accepting the `/hooks` review would, so a Codex
+// candidate needs no trust step at all. Same idea as pre-seeding
+// `~/.codex/rules/*.rules` to pre-approve a command: the approval lives in the
+// candidate's own config, and Codex reads it at session start — so a Codex
+// that was already open when `litmus init` ran must be restarted before
+// capture begins. `litmus init` says so.
 //
-// We do NOT write that trust store. It is a consent control OpenAI added to
-// stop third parties running hooks without the user's approval, it applies at
-// user scope across all of their Codex usage rather than just the assessment,
-// and the format is undocumented. `litmus init` tells the candidate instead.
+// Derivation, read from openai/codex `codex-rs/hooks/src/engine/discovery.rs`
+// (`hook_hash`, `hook_key`) and `codex-rs/config/src/fingerprint.rs`
+// (`version_for_toml`), and verified against codex-cli 0.153.4's app-server
+// `hooks/list` (our pinned hash == its `currentHash`; `trustStatus` flips
+// from `untrusted` to `trusted`):
 //
-// Not yet verified, and deliberately not asserted in candidate-facing copy: the
-// exact UI by which Codex asks for approval, and the `[hooks.state]` key format
-// for a user-scope hooks.json entry (the live examples were plugin-sourced).
-// That key is what a `litmus status` trust check would need.
+//   key   = `${hooks.json absolute path}:${event_key}:${group_index}:0`
+//           event_key is snake_case ("user_prompt_submit", "stop");
+//           group_index is the entry's index within that event's array.
+//   hash  = "sha256:" + sha256(compact JSON, keys sorted recursively, of
+//             { event_name: event_key,
+//               hooks: [{ type: "command", command, timeout, async: false }] })
+//           `matcher` is dropped for UserPromptSubmit/Stop (Codex forces it
+//           to None for those events); `commandWindows`/`statusMessage` are
+//           absent because we don't set them; `timeout` is our explicit
+//           value so normalization leaves it alone.
+//
+// Because the pin is a hash of the COMMAND, a logger path move re-derives it
+// on the next `litmus init` — fine, since we rewrite the pin too. Because the
+// KEY embeds the group index, a candidate adding their own UserPromptSubmit
+// hook in front of ours orphans the pin until the next init; Codex then shows
+// ours as needing review rather than silently running it, which is the right
+// failure direction.
+//
+// We touch config.toml as TEXT, not through a TOML parser: the CLI has no TOML
+// dependency, and the file is the candidate's whole Codex config (model, MCP
+// servers, auth prefs), so a serializer round-trip could reorder or reformat
+// things they care about. We only ever remove our own `[hooks.state."…"]`
+// tables and append fresh ones. If the key already appears in a form we don't
+// own (e.g. an inline `"…" = { trusted_hash = … }`), appending would make the
+// TOML invalid and take ALL of their config down, so we refuse and fall back
+// to the notice.
 const CODEX_PROMPT_EVENT = "UserPromptSubmit";
 const CODEX_HOOK_EVENTS = [CODEX_PROMPT_EVENT, "Stop"];
+const CODEX_EVENT_KEY = {
+    UserPromptSubmit: "user_prompt_submit",
+    Stop: "stop",
+};
+function canonicalJson(value) {
+    if (Array.isArray(value))
+        return value.map(canonicalJson);
+    if (value && typeof value === "object") {
+        const out = {};
+        for (const k of Object.keys(value).sort()) {
+            out[k] = canonicalJson(value[k]);
+        }
+        return out;
+    }
+    return value;
+}
+/**
+ * Codex's trust hash for one of our command hooks — see the block comment
+ * above for the derivation. Exported for the golden-vector test.
+ */
+export function codexHookTrustHash(event, command, timeoutSec) {
+    const identity = {
+        event_name: CODEX_EVENT_KEY[event],
+        hooks: [{ type: "command", command, timeout: timeoutSec, async: false }],
+    };
+    const json = JSON.stringify(canonicalJson(identity));
+    return "sha256:" + createHash("sha256").update(json).digest("hex");
+}
+// Codex embeds the hooks.json path in every trust key, spelled the way its
+// `find_codex_home` spells it: a $CODEX_HOME value is CANONICALIZED (realpath,
+// with the Windows `\\?\` prefix stripped), while the default `~/.codex` is
+// `home_dir().join(".codex")` taken as-is. Mirror that exactly, in both
+// directions — measured against codex-cli 0.153.4 and 0.154.0 via app-server
+// `hooks/list`: with CODEX_HOME under macOS's `/var -> /private/var`, a key
+// spelled from the raw path reads `untrusted` beside a matching hash, and
+// canonicalizing the DEFAULT would miss the same way on a symlinked home.
+function codexHooksKeyPath() {
+    if (!process.env.CODEX_HOME?.trim())
+        return CODEX_HOOKS;
+    let dir = CODEX_DIR;
+    try {
+        dir = realpathSync.native(CODEX_DIR);
+    }
+    catch {
+        try {
+            dir = realpathSync(CODEX_DIR);
+        }
+        catch { /* not created yet — Codex refuses such a CODEX_HOME itself */ }
+    }
+    return path.join(dir, "hooks.json");
+}
+/** Codex's `hooks.state` key for our entry at `groupIndex` of `event`. */
+export function codexHookStateKey(event, groupIndex) {
+    return `${codexHooksKeyPath()}:${CODEX_EVENT_KEY[event]}:${groupIndex}:0`;
+}
+// TOML basic-string escaping: backslash, quote, and control characters. Keys
+// are filesystem paths, so on Windows every separator is written `\\` — which
+// is why everything that looks for our tables matches on the ESCAPED form,
+// never on the raw path. (The first CI run matched the raw path: on Windows
+// it never found its own tables, so every init stacked a new pair and
+// uninstall removed nothing.)
+function tomlEscape(s) {
+    return s.replace(/[\\"\x00-\x1f\x7f]/g, ch => {
+        if (ch === "\\")
+            return "\\\\";
+        if (ch === '"')
+            return '\\"';
+        return "\\u" + ch.charCodeAt(0).toString(16).padStart(4, "0");
+    });
+}
+function tomlBasicString(s) {
+    return '"' + tomlEscape(s) + '"';
+}
+function escapeRegExp(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+// One `[hooks.state."<key>"]` table — basic (escaped) or literal (single-
+// quoted) header string — from its header line through the line before the
+// next table header, or EOF. `basic` and `literal` are regex sources for the
+// key as it appears inside each quote style.
+function codexStateTableRegex(basic, literal) {
+    return new RegExp(`^[ \\t]*\\[hooks\\.state\\.(?:"${basic}"|'${literal}')\\][^\\n]*\\n?(?:(?![ \\t]*\\[)[^\\n]*(?:\\n|$))*`, "gm");
+}
+function codexStateTableForKey(key) {
+    return codexStateTableRegex(escapeRegExp(tomlEscape(key)), escapeRegExp(key));
+}
+// Any other appearance of the key — an inline table, a dotted key under
+// `[hooks.state]`, anything we can't safely append a table beside.
+function codexKeyAppearsElsewhere(toml, key) {
+    const rest = toml.replace(codexStateTableForKey(key), "");
+    return rest.includes(tomlEscape(key)) || rest.includes(key);
+}
+// Remove every `[hooks.state."<our hooks.json>:…"]` table whose trusted_hash
+// is one of `hashes`. Tables pinning anything else — a candidate's own hook —
+// are left exactly as they were.
+function stripOurCodexTrustTables(toml, hashes) {
+    // Both spellings of our hooks.json path, so a pin written while the dir
+    // resolved one way is still found if it resolves the other way later.
+    const prefixes = [...new Set([codexHooksKeyPath(), CODEX_HOOKS])].map(p => p + ":");
+    const table = codexStateTableRegex(`(?:${prefixes.map(p => escapeRegExp(tomlEscape(p))).join("|")})(?:[^"\\\\\\n]|\\\\.)*`, `(?:${prefixes.map(escapeRegExp).join("|")})[^'\\n]*`);
+    return toml.replace(table, block => {
+        const m = /^\s*trusted_hash\s*=\s*"(sha256:[0-9a-f]+)"/m.exec(block);
+        return m && hashes.has(m[1]) ? "" : block;
+    });
+}
+/**
+ * Pin `trusted_hash` for each of our entries in `~/.codex/config.toml`.
+ * Throws rather than write when it can't do so safely; the caller treats a
+ * throw as "trust not pinned" and falls back to telling the candidate.
+ */
+function writeCodexHookTrust(pins) {
+    let toml = existsSync(CODEX_CONFIG) ? readFileSync(CODEX_CONFIG, "utf8") : "";
+    for (const { key } of pins) {
+        if (codexKeyAppearsElsewhere(toml, key)) {
+            throw new Error(`${CODEX_CONFIG} already defines ${key} in a form we don't manage; refusing to append.`);
+        }
+        // Drop the previous pin at this key (its hash may have changed).
+        toml = toml.replace(codexStateTableForKey(key), "");
+    }
+    // Drop OUR pins left at other group indices by an earlier install, so a
+    // shifted entry doesn't leave a stale table behind.
+    toml = stripOurCodexTrustTables(toml, new Set(pins.map(p => p.hash)));
+    toml = toml.replace(/\s+$/, "");
+    const blocks = pins.map(({ key, hash }) => `[hooks.state.${tomlBasicString(key)}]\ntrusted_hash = ${tomlBasicString(hash)}\n`);
+    atomicWriteFileSync(CODEX_CONFIG, (toml ? toml + "\n\n" : "") + blocks.join("\n"));
+}
+/**
+ * Remove every `[hooks.state."…"]` table under our hooks.json path that pins
+ * OUR command hash. Keyed on the hash rather than the state key so it finds
+ * our pins at any group index, and never touches a pin for someone else's hook.
+ */
+function removeCodexHookTrust() {
+    if (!existsSync(CODEX_CONFIG))
+        return;
+    let toml;
+    try {
+        toml = readFileSync(CODEX_CONFIG, "utf8");
+    }
+    catch {
+        return;
+    }
+    const command = buildHookEntry(USER_SCOPE_LOGGER, "codex").hooks[0];
+    const ourHashes = new Set(CODEX_HOOK_EVENTS.map(ev => codexHookTrustHash(ev, command.command, command.timeout)));
+    const next = stripOurCodexTrustTables(toml, ourHashes);
+    if (next === toml)
+        return;
+    try {
+        atomicWriteFileSync(CODEX_CONFIG, next.replace(/\n{3,}/g, "\n\n"));
+    }
+    catch { /* unwritable, give up silently */ }
+}
 /**
  * Install `UserPromptSubmit` + `Stop` hooks in `~/.codex/hooks.json` pointing
- * at the absolute logger path. Idempotent. Same nested matcher/hooks shape as
- * Claude Code — Codex's hooks system mirrors Claude's design.
+ * at the absolute logger path, then pin their trust in `~/.codex/config.toml`
+ * so Codex runs them without a review step. Idempotent. Same nested
+ * matcher/hooks shape as Claude Code — Codex's hooks system mirrors Claude's.
  *
- * Returning without throwing means the FILE is written, not that capture works:
- * Codex blocks untrusted hooks (see the block comment above), so the candidate
- * still has to approve it. `litmus init` says so prominently.
+ * `trustPinned: false` means hooks.json is in place but Codex will still ask
+ * the candidate to review the hooks — the caller surfaces that. Throws only
+ * when hooks.json itself can't be written.
  */
 export function installUserScopeCodexHook() {
     mkdirSync(CODEX_DIR, { recursive: true });
@@ -410,6 +622,7 @@ export function installUserScopeCodexHook() {
         }
     }
     const hooks = (data.hooks ?? (data.hooks = {}));
+    const pins = [];
     for (const event of CODEX_HOOK_EVENTS) {
         const existingValue = hooks[event];
         if (existingValue !== undefined && !Array.isArray(existingValue)) {
@@ -422,11 +635,24 @@ export function installUserScopeCodexHook() {
         }
         const existing = Array.isArray(existingValue) ? existingValue : [];
         const others = existing.filter(e => !isOurEntry(e));
-        hooks[event] = [...others, buildHookEntry(USER_SCOPE_LOGGER, "codex")];
+        const entry = buildHookEntry(USER_SCOPE_LOGGER, "codex");
+        hooks[event] = [...others, entry];
+        pins.push({
+            key: codexHookStateKey(event, others.length),
+            hash: codexHookTrustHash(event, entry.hooks[0].command, entry.hooks[0].timeout),
+        });
     }
     atomicWriteFileSync(CODEX_HOOKS, JSON.stringify(data, null, 2) + "\n");
+    try {
+        writeCodexHookTrust(pins);
+        return { trustPinned: true };
+    }
+    catch {
+        return { trustPinned: false };
+    }
 }
 export function uninstallUserScopeCodexHook() {
+    removeCodexHookTrust();
     if (!existsSync(CODEX_HOOKS))
         return;
     let data;
@@ -961,16 +1187,33 @@ function readRegistryUnlocked() {
         return null;
     }
 }
+/**
+ * Register an assessment. `added` is true when the path was not registered
+ * before this call AND the registration was written — a fresh assessment at
+ * that folder, as opposed to a re-run of init / doctor / the watcher on one
+ * already in flight. A registration that could not be persisted reports
+ * `added: false`: the next run would find the path missing again and read as
+ * fresh, and the folder-trust installers would then drop the ownership marks
+ * this run wrote (see FolderTrustOptions), leaving the folder trusted after
+ * submit. Not-fresh is the safe reading — the marks stay and submit still
+ * removes exactly the entries we created.
+ */
 export function addActiveAssessment(assessmentPath) {
-    withRegistryLock(() => {
+    return withRegistryLock(() => {
         mkdirSync(LITMUS_DIR, { recursive: true });
         const list = readRegistryUnlocked() ?? [];
-        if (!list.includes(assessmentPath))
+        const added = !list.includes(assessmentPath);
+        if (added)
             list.push(assessmentPath);
         try {
             atomicWriteFileSync(ACTIVE_ASSESSMENTS, JSON.stringify(list, null, 2) + "\n");
         }
-        catch { /* unwritable — fall back to cwd-only capture */ }
+        catch {
+            // Unwritable — fall back to cwd-only capture, and do not claim a fresh
+            // registration we could not record.
+            return { added: false };
+        }
+        return { added };
     });
 }
 /**
@@ -1041,4 +1284,305 @@ export function removeActiveAssessment(assessmentPath) {
         return filtered.length === 0;
     });
 }
+// ── Ownership ledger ──
+// A candidate may already trust the assessment folder's location (a parent
+// they marked TRUST_FOLDER in Gemini, a folder they told Copilot to remember)
+// before `litmus init` ever runs. Then the trust functions above find nothing
+// to write — and `litmus submit` must NOT take that entry away, or finishing
+// an assessment costs them a trust prompt they had already answered. So the
+// installer records which entries IT created, per assessment folder and tool,
+// in ~/.litmus/folder-trust.json, and untrust removes an entry only when the
+// ledger says it is ours. The ledger lives beside the active-assessments
+// registry rather than in the assessment folder because submit deletes that
+// folder before releasing tracking.
+const FOLDER_TRUST_LEDGER = path.join(LITMUS_DIR, "folder-trust.json");
+function ledgerKey(dir) {
+    const real = resolveFolder(dir);
+    return process.platform === "win32" || process.platform === "darwin" ? real.toLowerCase() : real;
+}
+function readFolderTrustLedger() {
+    if (!existsSync(FOLDER_TRUST_LEDGER))
+        return {};
+    const parsed = readJsonObjectOrNull(FOLDER_TRUST_LEDGER);
+    return (parsed ?? {});
+}
+function writeFolderTrustLedger(ledger) {
+    mkdirSync(LITMUS_DIR, { recursive: true });
+    if (Object.keys(ledger).length === 0) {
+        try {
+            unlinkSync(FOLDER_TRUST_LEDGER);
+        }
+        catch { /* already gone */ }
+        return;
+    }
+    atomicWriteFileSync(FOLDER_TRUST_LEDGER, JSON.stringify(ledger, null, 2) + "\n");
+}
+// The ledger and both trust stores are read-modify-write files shared by
+// every concurrent `litmus init` / `litmus submit` on the machine, so all of
+// the folder-trust entry points below run under the same `withRegistryLock()`
+// the active-assessments registry uses. These helpers assume the caller holds
+// it (the lock is not re-entrant).
+function markFolderTrustOwnedLocked(dir, tool) {
+    try {
+        const ledger = readFolderTrustLedger();
+        const key = ledgerKey(dir);
+        ledger[key] = { ...(ledger[key] ?? {}), [tool]: true };
+        writeFolderTrustLedger(ledger);
+    }
+    catch { /* a missing mark only means submit leaves the entry in place */ }
+}
+function isFolderTrustOwnedLocked(dir, tool) {
+    try {
+        return readFolderTrustLedger()[ledgerKey(dir)]?.[tool] === true;
+    }
+    catch {
+        return false;
+    }
+}
+// Cleared only AFTER the trust store no longer holds our entry, so a failed
+// rewrite leaves the mark in place and the next submit/doctor can retry.
+function clearFolderTrustOwnedLocked(dir, tool) {
+    try {
+        const ledger = readFolderTrustLedger();
+        const key = ledgerKey(dir);
+        if (!ledger[key])
+            return;
+        delete ledger[key][tool];
+        if (Object.keys(ledger[key]).length === 0)
+            delete ledger[key];
+        writeFolderTrustLedger(ledger);
+    }
+    catch { /* stale mark: harmless, the next release retries */ }
+}
+// Gemini's normalizePath: absolute, realpath if it exists, lowercased on the
+// case-insensitive platforms. Writing the same form Gemini itself writes keeps
+// one entry per folder instead of one per spelling.
+function geminiFolderKey(dir) {
+    const real = resolveFolder(dir);
+    return process.platform === "win32" || process.platform === "darwin" ? real.toLowerCase() : real;
+}
+// Realpath when the folder exists. When it doesn't — `litmus submit` deletes
+// the assessment folder BEFORE releasing tracking — realpath the parent and
+// re-attach the basename, so a symlinked ancestor (macOS's /var → /private/var,
+// a dotfiles-managed ~/code) still resolves to the key we wrote at init.
+function resolveFolder(dir) {
+    const abs = path.resolve(dir);
+    try {
+        return realpathSync(abs);
+    }
+    catch { /* gone or never created */ }
+    try {
+        return path.join(realpathSync(path.dirname(abs)), path.basename(abs));
+    }
+    catch {
+        return abs;
+    }
+}
+function readJsonObjectOrNull(file) {
+    try {
+        const parsed = JSON.parse(readFileSync(file, "utf8"));
+        return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Mark `assessmentDir` trusted for the Gemini CLI. Returns `trusted: false`
+ * (and touches nothing) when the file can't be parsed or when the candidate
+ * has explicitly marked this folder DO_NOT_TRUST — that is their decision.
+ */
+export function trustAssessmentFolderForGemini(assessmentDir, opts = {}) {
+    return withRegistryLock(() => trustAssessmentFolderForGeminiLocked(assessmentDir, opts));
+}
+function trustAssessmentFolderForGeminiLocked(assessmentDir, opts) {
+    const key = geminiFolderKey(assessmentDir);
+    let config = {};
+    if (existsSync(GEMINI_TRUSTED_FOLDERS)) {
+        const parsed = readJsonObjectOrNull(GEMINI_TRUSTED_FOLDERS);
+        if (!parsed)
+            return { trusted: false };
+        config = parsed;
+    }
+    const current = config[key];
+    if (current === "TRUST_FOLDER" || current === "TRUST_PARENT") {
+        if (opts.freshAssessment)
+            clearFolderTrustOwnedLocked(assessmentDir, "gemini");
+        return { trusted: true };
+    }
+    if (current === "DO_NOT_TRUST") {
+        if (opts.freshAssessment)
+            clearFolderTrustOwnedLocked(assessmentDir, "gemini");
+        return { trusted: false };
+    }
+    config[key] = "TRUST_FOLDER";
+    try {
+        mkdirSync(path.dirname(GEMINI_TRUSTED_FOLDERS), { recursive: true });
+        const created = !existsSync(GEMINI_TRUSTED_FOLDERS);
+        atomicWriteFileSync(GEMINI_TRUSTED_FOLDERS, JSON.stringify(config, null, 2) + "\n");
+        // Gemini creates this file 0600; match it when we are the one creating it.
+        if (created) {
+            try {
+                chmodSync(GEMINI_TRUSTED_FOLDERS, 0o600);
+            }
+            catch { /* best effort */ }
+        }
+        markFolderTrustOwnedLocked(assessmentDir, "gemini");
+        return { trusted: true };
+    }
+    catch {
+        return { trusted: false };
+    }
+}
+/** Drop the Gemini trust entry for `assessmentDir` — only if init created it. */
+export function untrustAssessmentFolderForGemini(assessmentDir) {
+    withRegistryLock(() => {
+        if (!isFolderTrustOwnedLocked(assessmentDir, "gemini"))
+            return;
+        if (removeGeminiTrustEntry(assessmentDir))
+            clearFolderTrustOwnedLocked(assessmentDir, "gemini");
+    });
+}
+// True when the store no longer carries our entry — removed now, or already
+// absent. False when we could not read or rewrite it, so the mark must stay.
+function removeGeminiTrustEntry(assessmentDir) {
+    if (!existsSync(GEMINI_TRUSTED_FOLDERS))
+        return true;
+    const config = readJsonObjectOrNull(GEMINI_TRUSTED_FOLDERS);
+    if (!config)
+        return false;
+    const key = geminiFolderKey(assessmentDir);
+    if (config[key] !== "TRUST_FOLDER")
+        return true;
+    delete config[key];
+    try {
+        atomicWriteFileSync(GEMINI_TRUSTED_FOLDERS, JSON.stringify(config, null, 2) + "\n");
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+// Copilot writes `// …` header lines above the JSON in config.json ("This file
+// is managed automatically."). Split them off so they survive the round-trip.
+function splitCopilotConfig(text) {
+    const lines = text.split("\n");
+    let i = 0;
+    while (i < lines.length && (lines[i].trim() === "" || lines[i].trimStart().startsWith("//")))
+        i++;
+    return { header: lines.slice(0, i).join("\n"), body: lines.slice(i).join("\n") };
+}
+function copilotFolderKey(dir) {
+    return resolveFolder(dir);
+}
+// Both sides resolved the same way, compared case-insensitively where the
+// filesystem is.
+function samePath(a, b) {
+    const ci = process.platform === "win32" || process.platform === "darwin";
+    const na = resolveFolder(a), nb = resolveFolder(b);
+    return ci ? na.toLowerCase() === nb.toLowerCase() : na === nb;
+}
+/**
+ * Add `assessmentDir` to Copilot CLI's `trustedFolders`. Returns
+ * `trusted: false` (and touches nothing) when config.json can't be parsed or
+ * `trustedFolders` isn't the array we expect.
+ */
+export function trustAssessmentFolderForCopilot(assessmentDir, opts = {}) {
+    return withRegistryLock(() => trustAssessmentFolderForCopilotLocked(assessmentDir, opts));
+}
+function trustAssessmentFolderForCopilotLocked(assessmentDir, opts) {
+    const key = copilotFolderKey(assessmentDir);
+    let header = "";
+    let config = {};
+    if (existsSync(COPILOT_CONFIG)) {
+        let text;
+        try {
+            text = readFileSync(COPILOT_CONFIG, "utf8");
+        }
+        catch {
+            return { trusted: false };
+        }
+        const split = splitCopilotConfig(text);
+        header = split.header;
+        let parsed;
+        try {
+            parsed = JSON.parse(split.body);
+        }
+        catch {
+            return { trusted: false };
+        }
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            return { trusted: false };
+        config = parsed;
+    }
+    const existing = config.trustedFolders;
+    if (existing !== undefined && !Array.isArray(existing))
+        return { trusted: false };
+    const folders = Array.isArray(existing) ? existing : [];
+    if (folders.some(f => typeof f === "string" && samePath(f, key))) {
+        if (opts.freshAssessment)
+            clearFolderTrustOwnedLocked(assessmentDir, "copilot");
+        return { trusted: true };
+    }
+    config.trustedFolders = [...folders, key];
+    try {
+        mkdirSync(COPILOT_DIR, { recursive: true });
+        const out = (header ? header + "\n" : "") + JSON.stringify(config, null, 2) + "\n";
+        atomicWriteFileSync(COPILOT_CONFIG, out);
+        markFolderTrustOwnedLocked(assessmentDir, "copilot");
+        return { trusted: true };
+    }
+    catch {
+        return { trusted: false };
+    }
+}
+/** Remove `assessmentDir` from Copilot CLI's `trustedFolders` — only if init added it. */
+export function untrustAssessmentFolderForCopilot(assessmentDir) {
+    withRegistryLock(() => {
+        if (!isFolderTrustOwnedLocked(assessmentDir, "copilot"))
+            return;
+        if (removeCopilotTrustEntry(assessmentDir))
+            clearFolderTrustOwnedLocked(assessmentDir, "copilot");
+    });
+}
+// Same contract as removeGeminiTrustEntry.
+function removeCopilotTrustEntry(assessmentDir) {
+    if (!existsSync(COPILOT_CONFIG))
+        return true;
+    let text;
+    try {
+        text = readFileSync(COPILOT_CONFIG, "utf8");
+    }
+    catch {
+        return false;
+    }
+    const { header, body } = splitCopilotConfig(text);
+    let config;
+    try {
+        const parsed = JSON.parse(body);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            return false;
+        config = parsed;
+    }
+    catch {
+        return false;
+    }
+    const folders = config.trustedFolders;
+    if (!Array.isArray(folders))
+        return true;
+    const kept = folders.filter(f => !(typeof f === "string" && samePath(f, assessmentDir)));
+    if (kept.length === folders.length)
+        return true;
+    if (kept.length === 0)
+        delete config.trustedFolders;
+    else
+        config.trustedFolders = kept;
+    try {
+        atomicWriteFileSync(COPILOT_CONFIG, (header ? header + "\n" : "") + JSON.stringify(config, null, 2) + "\n");
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 //# sourceMappingURL=ai-tracking.js.map