one-code-extension 0.5.0 → 0.6.0

package/extensions/permissions/index.ts

@@ -77,7 +77,9 @@ import { canShowCustomUi, rpcReadOnlyText } from "../lib/headless-output.ts";
 import { sessionResultsDir } from "../lib/persisted-output.ts";
 import { privateSessionScratchpadDir } from "../lib/scratchpad.ts";
 import { CONTEXT_ORDER, REMINDER_CHANNEL, type ReminderPayload } from "../lib/reminders.ts";
-import { CONTEXT_BASELINE_CHANNEL, restoredContext } from "../lib/context-stack.ts";
+import { readState, readStringsState, recordState } from "../lib/ledger/state.ts";
+import { processState } from "../lib/process-state.ts";
+import { type EntryLike, readRecord } from "../lib/ledger/records.ts";
 import {
 	decide,
 	extractSubject,
@@ -89,7 +91,7 @@ import {
 	isPathSubjectTool,
 } from "./matcher.ts";
 import { type SessionGrant, sessionGrant } from "./session-grant.ts";
-import { formatModel, modeBadge, nextMode, PERMISSION_STATUS_CHANNEL, type PermissionStatus, CYCLE_KEY } from "./modes.ts";
+import { formatModel, modeBadge, nextMode, PERMISSION_MODE_STATE, PERMISSION_STATUS_CHANNEL, type PermissionStatus, CYCLE_KEY } from "./modes.ts";
 import { intrinsicTier, usesClaudeCodeFastPaths } from "../lib/model-tier.ts";
 import { type ChildToolCall, type ChildGateDecision, sessionPermissionBridge, SUBAGENT_GATE_CHANNEL } from "./subagent-gate.ts";
 import { trackOriginalCommands } from "../lib/original-command.ts";
@@ -264,6 +266,24 @@ const denyReason = (result: { cause?: string; rule?: { raw?: string } }): string
  * here, next to the emitter it belongs to.
  */
 const STANDING_REMINDER_MODES: ReadonlySet<PermissionMode> = new Set<PermissionMode>(["plan", "auto"]);
+/** The `one-code:state` key for the directories added to the workspace for this session. */
+const WORKSPACE_DIRS_STATE = "workspace-dirs";
+
+/**
+ * What the user granted "for this session" and what auto mode's loop-breaker
+ * counted. This is process state (lib/process-state.ts): pi re-runs this
+ * factory at a /reload, which is the same conversation and keeps them
+ * (decisions/modes.md), and every other session start clears them. Only the
+ * main session loads this extension (children reach it through the bridge),
+ * so one slot per process is one per conversation.
+ */
+interface SessionGate {
+	/** Rules minted by "Yes, and don't ask again … this session" (session-grant.ts). */
+	allows: PermissionRule[];
+	pause: PauseTracker;
+	/** Classifier denials, and the one-shot grants `/permissions` mints from them. */
+	denials: DenialStore;
+}
 
 const YES = "Yes";
 const NO = "No, tell the agent what to do differently";
@@ -327,8 +347,10 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 	let bypassInCycle = false;
 	/** Whether auto mode is a stop on the cycle — only when a classifier model is reachable. */
 	let autoInCycle = false;
-	/** Whether this conversation's first turn has decided on Claude Code's auto-mode note. */
-	let autoNoteDecided = false;
+	/** The mode the branch's latest `one-code:state` entry holds: the mode follows the branch. */
+	let branchMode: PermissionMode | undefined;
+	/** Whether a request went out on this branch: only then was its model told the branch's mode. */
+	let requestOnBranch = false;
 	let deny: PermissionRule[] = [];
 	let ask: PermissionRule[] = [];
 	let allow: PermissionRule[] = [];
@@ -346,9 +368,10 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 	 * Rules minted by "Yes, and don't ask again … this session" (session-grant.ts).
 	 * Never applied in auto mode: there the classifier is the boundary and a
 	 * standing grant would be a bypass of it (PERMISSIONS-REVIEW-2026-09-05 M2).
-	 * Cleared with the session (L1).
+	 * Cleared with the session (L1), kept by a reload (SessionGate).
 	 */
-	const sessionAllows: PermissionRule[] = [];
+	const sessionGate = processState<SessionGate>("permissions:session-gate", () => ({ allows: [], pause: new PauseTracker(), denials: new DenialStore() }));
+	const sessionAllows = sessionGate.allows;
 	const activeSessionAllows = () => (mode === "auto" ? [] : sessionAllows);
 	let unparsableRules: string[] = [];
 	let warnedUnparsable = "";
@@ -391,6 +414,11 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 	 */
 	let settingsWorkspaceDirs: SourcedDirectory[] = [];
 	let flagWorkspaceDirs: string[] = [];
+	/**
+	 * Added for this session. This is branch state: the /add-dir breadcrumb told
+	 * the branch's model they are in its workspace. Recorded on every change and
+	 * read back, validated again, at every session start and /tree switch.
+	 */
 	const sessionWorkspaceDirs: string[] = [];
 	/** The workspace directories in force, as real paths: what the user and the system prompt see. */
 	let workspacePaths: string[] = [];
@@ -405,6 +433,36 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 		workspacePaths = [...new Set([...trusted, ...flagWorkspaceDirs, ...sessionWorkspaceDirs].map((dir) => tryRealpath(dir) ?? dir))];
 		workspaceDirs = [...new Set(workspacePaths.map(resolvedOrSelf))];
 		readableRoots = [...harnessReadableRoots, ...docsDirPaths, ...workspaceDirs];
+		if (sessionStarted) announceWorkspace();
+	};
+	/** What the system prompt was last told the workspace is (lib/workspace-channel.ts). */
+	let announcedWorkspace: string | undefined;
+	let sessionStarted = false;
+	/**
+	 * The environment block lists the workspace: a change mid-session reaches
+	 * the next epoch's message 1 (a compaction), while inside the epoch the
+	 * /add-dir output already told the model (R3-L4).
+	 */
+	const announceWorkspace = () => {
+		const key = workspacePaths.join("\0");
+		if (key === announcedWorkspace) return;
+		announcedWorkspace = key;
+		pi.events.emit(WORKSPACE_CHANNEL, { dirs: workspacePaths } satisfies WorkspaceAnnouncement);
+	};
+	const recordSessionWorkspace = () => recordState(pi, WORKSPACE_DIRS_STATE, [...sessionWorkspaceDirs]);
+	/**
+	 * Take the branch's session directories. Each is validated again, as a live
+	 * /add-dir is: the stored list says only that the user once added it, so a
+	 * directory that is gone, or one too broad for a workspace, is not applied.
+	 */
+	const restoreSessionWorkspace = (ctx: ExtensionContext) => {
+		const restored: string[] = [];
+		for (const dir of readStringsState(ctx, WORKSPACE_DIRS_STATE)) {
+			const checked = validateWorkspaceDirectory(dir, ctx.cwd, os.homedir(), restored);
+			if ("path" in checked) restored.push(checked.path);
+			else if (ctx.hasUI) ctx.ui.notify(`${dir}, added earlier in this conversation, is no longer in the workspace: ${checked.error}`, "warning");
+		}
+		sessionWorkspaceDirs.splice(0, sessionWorkspaceDirs.length, ...restored);
 	};
 
 	/**
@@ -467,6 +525,7 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 			paused: pauseTracker.isPaused(),
 			classifier: display.classifier,
 			pinned: display.pinned,
+			bypassAvailable: bypassInCycle,
 			...(toolCallId ? { toolCallId } : {}),
 		} satisfies PermissionStatus);
 	};
@@ -501,7 +560,9 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 	};
 	// Keyed by cwd: a worktree-isolated child classifies against ITS checkout's
 	// CLAUDE.md/AGENTS.md, and must not poison the cache the main agent's own
-	// calls (a different cwd) read for the rest of the session.
+	// calls (a different cwd) read for the rest of the session. The main
+	// session's calls read the entered worktree's. Dropped where the agent's own
+	// instructions are read again: a session start and a compaction.
 	const projectInstructionsByCwd = new Map<string, string | undefined>();
 	const instructionsFor = (cwd: string): string | undefined => {
 		if (!projectInstructionsByCwd.has(cwd)) {
@@ -509,9 +570,8 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 		}
 		return projectInstructionsByCwd.get(cwd);
 	};
-	const pauseTracker = new PauseTracker();
-	/** Classifier denials this session, and the one-shot grants `/permissions` mints from them. */
-	const denials = new DenialStore();
+	const pauseTracker = sessionGate.pause;
+	const denials = sessionGate.denials;
 	/**
 	 * Which model the classifier settled on. Held here so the choice is pinned for
 	 * the session rather than re-resolved per call, and so a model that turns out
@@ -794,6 +854,8 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 	/** `startup`: the session opens in this mode, so there is no switch to announce, only the mode's standing block. */
 	const setMode = (next: PermissionMode, startup = false, toolCallId?: string) => {
 		const changed = mode !== next;
+		/** The mode the branch recorded before this switch; its model was told it once a request went out. */
+		const told = branchMode;
 		mode = next;
 		process.env[MODE_ENV] = next;
 		// Close the standing block of the mode being left BEFORE the status
@@ -803,11 +865,15 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 		// becomes plan — removing the key afterwards would undo that re-add and
 		// leave a turn entered mid-stream with no plan reminder until the next
 		// prompt (STEERING-REVIEW-2026-09-05 M3). Auto installs its own block below.
-		const previousMode = restoredContext(pi.events)?.baselines["permission-mode"];
-		if (mode !== "auto" && !(mode === "plan" && (startup ? previousMode === "plan" : !changed))) {
+		if (mode !== "auto" && !(mode === "plan" && (startup ? branchMode === "plan" : !changed))) {
 			pi.events.emit(REMINDER_CHANNEL, { remove: true, key: "permission-mode" });
 		}
-		pi.events.emit(CONTEXT_BASELINE_CHANNEL, { key: "permission-mode", value: mode });
+		// The mode follows the branch: recorded on every change, so a resume, a
+		// fork, /reload or a /tree switch starts from it (decisions/modes.md).
+		if (mode !== branchMode) {
+			recordState(pi, PERMISSION_MODE_STATE, mode);
+			branchMode = mode;
+		}
 		applyBadge(undefined, toolCallId);
 		// Every switch is announced once on the tail of the next request (the next
 		// tool result mid-turn, the prompt between turns), so the model learns of
@@ -822,8 +888,9 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 				: "";
 		// Not at startup: "is now" beside the mode's own standing block read as a
 		// duplicate to both GPT-6 models in the 2026-10-04 self-test, and Claude
-		// Code announces only a switch.
-		if (!startup) {
+		// Code announces only a switch. A startup that leaves the mode the branch
+		// recorded (a flag, a stored bypass that needs its flag again) is one.
+		if (!startup || (told !== undefined && told !== mode && requestOnBranch)) {
 			pi.events.emit(REMINDER_CHANNEL, {
 				text: `The user's permission mode is now "${mode}".${planNote}`,
 				key: "permission-mode-change",
@@ -836,7 +903,6 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 					"Auto mode is active: your tool calls run without per-action prompts, but each one is screened by an approval classifier that blocks anything irreversible, destructive, or aimed outside this environment. " +
 					"Work normally — do not narrate the classifier or try to phrase calls to get past it. If a call is blocked, take the block at face value: do not retry it, and do not reach the same result another way. Continue with work that does not depend on it, or explain what you were trying to do and let the user decide. " +
 					"Attempting to weaken this gate (editing permission settings, changing the mode, or routing work around it) is itself blocked.",
-				scope: "every-turn",
 				key: "permission-mode",
 				// Session state: rides every user message since auto mode came on, so
 				// the cached prefix holds turn to turn (lib/reminders.ts).
@@ -896,7 +962,11 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 		return settings;
 	};
 
-	const reloadSettings = (ctx: ExtensionContext) => {
+	/**
+	 * `launching`: the process is starting (reason "startup"), when its flags
+	 * pick the mode. `carried`: the mode a /clear or /new carries onto its empty branch.
+	 */
+	const reloadSettings = (ctx: ExtensionContext, launching: boolean, carried: PermissionMode | undefined) => {
 		const settings = reloadRules(ctx);
 		projectAllowDeclined = false;
 		// Dropped so edited autoMode rules and instruction files are picked up on
@@ -907,14 +977,15 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 		// Claude Code's resolution order (flags, then settings' defaultMode), with
 		// bypassPermissions refused wherever a settings source disabled it — before
 		// 2026-09-05 (H3) that policy was silently not in force here.
-		const startup = resolveStartupMode(
-			[
-				pi.getFlag("dangerously-skip-permissions") === true ? "bypassPermissions" : undefined,
-				normalizePermissionMode(pi.getFlag("permission-mode")),
-				settings.defaultMode,
-			],
-			settings,
-		);
+		// The mode follows the branch: at launch the flags win over it, and after
+		// that (/reload, /resume, /fork, /clear in the same process) the branch's
+		// own mode wins over the launch flags, so a switch the user made is kept.
+		// A stored bypassPermissions is never restored by itself: it needs its flag.
+		const bypassFlag = pi.getFlag("dangerously-skip-permissions") === true ? ("bypassPermissions" as const) : undefined;
+		const modeFlag = normalizePermissionMode(pi.getFlag("permission-mode"));
+		const fromBranch = branchMode ?? carried;
+		const restored = fromBranch === "bypassPermissions" ? undefined : fromBranch;
+		const startup = resolveStartupMode(launching ? [bypassFlag, modeFlag, restored, settings.defaultMode] : [restored, bypassFlag, modeFlag, settings.defaultMode], settings);
 		if (startup.mode) mode = startup.mode;
 		if (startup.bypassRefused && ctx.hasUI) ctx.ui.notify("Bypass permissions mode was disabled by settings", "warning");
 		bypassInCycle = mode === "bypassPermissions";
@@ -934,16 +1005,17 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 	};
 
 	// Claude Code's auto-mode note joins the mid-conversation system message
-	// when the conversation opens in auto mode, decided once on its first turn
-	// so message 1 never changes later (auto-mode/system-note.ts).
+	// when the conversation opens in auto mode (auto-mode/system-note.ts). It is
+	// live state, rendered only by a request that opens an epoch, so message 1
+	// never changes inside one; a compaction or a model switch decides it again.
 	pi.on("turn_start", (_event, ctx) => {
-		if (autoNoteDecided) return;
-		autoNoteDecided = true;
 		const note = mode === "auto" && ctx.model ? autoModeSystemNote(ctx.model) : undefined;
-		if (!note) return;
+		if (!note) {
+			pi.events.emit(REMINDER_CHANNEL, { remove: true, key: "auto-mode-note" });
+			return;
+		}
 		pi.events.emit(REMINDER_CHANNEL, {
 			text: note,
-			scope: "every-turn",
 			key: "auto-mode-note",
 			placement: "first-prepend",
 			order: CONTEXT_ORDER.autoModeNote,
@@ -979,18 +1051,21 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 		});
 		// A new session (`/clear`, `/resume`, a fork) starts with a clean gate: the
 		// previous conversation's user messages are not intent evidence for this
-		// one, its "don't ask again" grants and its pause state do not carry over
-		// (PERMISSIONS-REVIEW-2026-09-05 L1). A reload keeps them — same conversation.
+		// one, and its "don't ask again" grants, approved denials and pause state
+		// do not carry over (PERMISSIONS-REVIEW-2026-09-05 L1). A reload keeps
+		// them, the same conversation: they are process state (SessionGate),
+		// which the factory pi re-runs there does not reset.
 		if (event.reason !== "reload") {
-			autoNoteDecided = false;
 			sessionAllows.length = 0;
 			currentMainToolCallId = undefined;
 			inFlightMainCalls = [];
 			pendingInputs.length = 0;
 			pauseTracker.reset();
 			denials.reset();
-			sessionWorkspaceDirs.length = 0;
 		}
+		// The directories this branch was told it added follow it, so a reload, a
+		// resume and a fork keep them and a /clear starts without.
+		restoreSessionWorkspace(ctx);
 		// With auto-memory off the folder is nobody's working space: no grant.
 		memoryDirPath = autoMemoryEnabled(ctx.cwd) ? projectMemoryDir(ctx.cwd) : undefined;
 		// Working space only when it is private to this user: another local user
@@ -1012,21 +1087,43 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 		oneCodeProjectSettingsFile = oneCodeProjectSettingsPath(ctx.cwd, os.homedir());
 		protectedDirs = runtimeProtectedDirs();
 		secretPaths = runtimeSecretPaths(os.homedir());
-		reloadSettings(ctx);
-		// Stored mode is announcement history only: live settings/flags still
-		// decide the gate. A resume into another mode is an ordinary switch.
-		const restored = restoredContext(pi.events);
-		const previousMode = normalizePermissionMode(restored?.baselines["permission-mode"]);
-		if (restored && previousMode && previousMode !== mode) setMode(mode);
-		else if (restored && !STANDING_REMINDER_MODES.has(mode)) pi.events.emit(REMINDER_CHANNEL, { remove: true, key: "permission-mode" });
-		pi.events.emit(CONTEXT_BASELINE_CHANNEL, { key: "permission-mode", value: mode });
+		branchMode = normalizePermissionMode(readState(ctx, PERMISSION_MODE_STATE));
+		requestOnBranch = (ctx.sessionManager.getBranch() as EntryLike[]).some((entry) => readRecord(entry)?.kind === "request");
+		// Claude Code keeps the mode across /clear: the new branch starts from the
+		// mode this process last published (MODE_ENV), and records it.
+		const carried = event.reason === "new" && !branchMode ? normalizePermissionMode(process.env[MODE_ENV]) : undefined;
+		reloadSettings(ctx, event.reason === "startup", carried);
+		if (!STANDING_REMINDER_MODES.has(mode)) setMode(mode, true);
 		// The system prompt lists the workspace as the session starts (lib/workspace-channel.ts).
-		pi.events.emit(WORKSPACE_CHANNEL, { dirs: workspacePaths } satisfies WorkspaceAnnouncement);
+		sessionStarted = true;
+		announcedWorkspace = undefined;
+		announceWorkspace();
 		resetClassifierChoice(ctx.model, "batched");
 		// The bridge reads live mode/rules, but belongs to this parent session only.
 		pi.events.emit(SUBAGENT_GATE_CHANNEL, { decide: sessionPermissionBridge(evaluateChildToolCall, childPermissionSession.signal) });
 	});
 
+	// A /tree switch selects a branch whose model was told that branch's mode:
+	// take it, as a resume would, without announcing a switch. A stored
+	// bypassPermissions is never taken.
+	pi.on("session_tree", (_event, ctx) => {
+		// The selected branch's model was told its own session directories.
+		restoreSessionWorkspace(ctx);
+		refreshWorkspace();
+		const onBranch = normalizePermissionMode(readState(ctx, PERMISSION_MODE_STATE));
+		if (!onBranch || onBranch === "bypassPermissions" || onBranch === mode) return;
+		branchMode = onBranch;
+		setMode(onBranch, true);
+	});
+
+	// claude-context re-reads the instruction files at a compaction, and the
+	// summary's epoch renders them, so the classifier judges against the same
+	// set from then on. Unchanged files give the same bytes, so its cache holds;
+	// an edit costs one classifier cache write at this boundary.
+	pi.on("session_compact", () => {
+		projectInstructionsByCwd.clear();
+	});
+
 	// The published bridge stays: aborted, it denies every call a retained child
 	// makes, while a parent without this extension keeps the local gate.
 	pi.on("session_shutdown", (_event, ctx) => {
@@ -1087,7 +1184,12 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 	pi.events.on(MODE_CHANNEL, (data) => {
 		const request = data as { mode?: unknown; toolCallId?: unknown } | undefined;
 		const requested = normalizePermissionMode(request?.mode);
-		if (requested) setMode(requested, false, typeof request?.toolCallId === "string" ? request.toolCallId : undefined);
+		if (!requested) return;
+		// Another extension asks (plan mode's exit restores the mode it came from,
+		// read from the branch). A stored value never grants a permission by
+		// itself: bypass only where this session has it, else the default mode.
+		const allowed = requested === "bypassPermissions" && !bypassInCycle ? "default" : requested;
+		setMode(allowed, false, typeof request?.toolCallId === "string" ? request.toolCallId : undefined);
 	});
 
 	// The plan-mode extension announces the plan file on PLAN_FILE_CHANNEL;
@@ -1941,7 +2043,10 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 			reloadRules(ctx);
 			return `Added directory ${path} to workspace and saved to ${tildify(target, home)}`;
 		}
-		if (!sessionWorkspaceDirs.includes(path)) sessionWorkspaceDirs.push(path);
+		if (!sessionWorkspaceDirs.includes(path)) {
+			sessionWorkspaceDirs.push(path);
+			recordSessionWorkspace();
+		}
 		refreshWorkspace();
 		return `Added directory ${path} to workspace for this session`;
 	};
@@ -2026,7 +2131,10 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 				const [source, settingsPath, raw] = key.split("\0");
 				if (source === "session") {
 					const index = sessionWorkspaceDirs.indexOf(raw);
-					if (index >= 0) sessionWorkspaceDirs.splice(index, 1);
+					if (index >= 0) {
+						sessionWorkspaceDirs.splice(index, 1);
+						recordSessionWorkspace();
+					}
 					refreshWorkspace();
 				} else if (source === ("onecode-user" satisfies RuleSource) || source === ("onecode-project" satisfies RuleSource)) {
 					if (!removeWorkspaceDirectory(raw, settingsPath)) throw new Error(`${raw} is no longer in ${tildify(settingsPath, home)}.`);
@@ -2195,7 +2303,8 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 				toolName: "subagent-review",
 				transcript: [...transcript, ...childEntries],
 				userMessages: [...userMessages],
-				claudeMd: instructionsFor(ctx.cwd),
+				// The main session's instructions, read where its own calls read them.
+				claudeMd: instructionsFor(workCwd(ctx.cwd)),
 				username: classifierUsername,
 				environment: autoConfig.environment,
 				// AutoModeConfig is structurally a RuleExtras; the user's own deny rules

package/extensions/permissions/modes.ts

@@ -128,6 +128,9 @@ function badgeBase(mode: PermissionMode, opts?: { paused?: boolean; classifier?:
  */
 export const PERMISSION_STATUS_CHANNEL = "one-code:permission-status";
 
+/** The `one-code:state` key the permission mode is recorded under on the branch; a fork's file carries the parent's. */
+export const PERMISSION_MODE_STATE = "permission-mode";
+
 export interface PermissionStatus {
 	mode: string;
 	paused: boolean;
@@ -137,6 +140,8 @@ export interface PermissionStatus {
 	classifier?: string;
 	/** Whether `classifier` is pinned by a real call, or still the planned first candidate. */
 	pinned?: boolean;
+	/** Whether this session can enter bypassPermissions (it started in it); a request for it otherwise lands in default. */
+	bypassAvailable?: boolean;
 }
 
 /**