pi-seatbelt 0.3.0 → 0.4.0

package/.github/workflows/test.yml

@@ -0,0 +1,19 @@
+name: Test
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+
+      - name: Smoke test
+        run: node smoke.mjs

package/README.md

@@ -1,25 +1,41 @@
 # pi-seatbelt
 
-A safe, ergonomic permission system for pi. Your agent, your
-rules: safety without slowing you down.
+<p align="center">
+	<img src="assets/logo.svg" width="144" alt="pi-seatbelt logo: a diagonal seatbelt strap with a buckle">
+</p>
 
-The headline feature: one approval for a whole chain of tool calls. A cheap
-classifier model labels every call `safe`, `caution`, or `DANGEROUS`, says
-what it does, and when something is dangerous, says why. You see the full
-chain, you approve once, the agent runs. No more approving commands one at
-a time.
+[![npm version](https://img.shields.io/npm/v/pi-seatbelt)](https://www.npmjs.com/package/pi-seatbelt)
+[![license](https://img.shields.io/npm/l/pi-seatbelt)](LICENSE)
+
+A permissions system for pi that you configure and that learns from your
+decisions.
+
+Every gated tool call gets a danger label from a small classifier model:
+`safe`, `caution`, or `DANGEROUS`, with a one-line purpose and, when
+dangerous, the reason. A whole chain of calls is approved in one dialog
+instead of one at a time. In `auto` mode the labeller also sees what you
+approved or rejected earlier in the session, rejection reasons included, so
+its judgment tracks yours.
 
 ![The batch approval dialog: every call with its danger label, what it does, and why it's dangerous](assets/multiple.png)
 
-Three choices: `Approve all`, `Reject all`, or `Reject with message`. The
-message goes straight back to the agent as the rejection reason, so it knows
-why and can adjust instead of blindly retrying.
+Three choices per batch: `Approve all`, `Reject all`, or `Reject with
+message`. The message goes back to the agent as the rejection reason, so it
+can adjust instead of blindly retrying.
 
-You decide which tools are gated (default: `bash`), which mode you run in,
-and what the labeller calls dangerous. Your rules, your machine.
+You pick which tools are gated (default: `bash`), which mode each session
+runs in, and what the labeller calls dangerous.
 
 ## Install
 
+From npm:
+
+```sh
+pi install npm:pi-seatbelt
+```
+
+Or from GitHub:
+
 ```sh
 pi install git:github.com/mikesposito/pi-seatbelt
 ```
@@ -27,32 +43,35 @@ pi install git:github.com/mikesposito/pi-seatbelt
 Try it once without installing:
 
 ```sh
-pi -e git:github.com/mikesposito/pi-seatbelt
+pi -e npm:pi-seatbelt
 ```
 
-Local development: symlink the checkout into your extensions directory, or
-load it per run.
+For local development, symlink the checkout into your extensions directory,
+or load it per run:
 
 ```sh
 ln -s /path/to/pi-seatbelt ~/.pi/agent/extensions/seatbelt
 pi -e /path/to/pi-seatbelt
 ```
 
-No runtime dependencies. The package manifest declares the host-provided pi
-packages as peers.
+No runtime dependencies. The host-provided pi packages are declared as peers.
 
-## Three modes, one key
+## Modes
 
 Press the mode key to cycle: `alt+b` by default, or any key you set (see
-`shortcut` under [Configure](#configure)). Or switch without the keyboard:
-`/seatbelt:mode` cycles, `/seatbelt:mode auto` sets a mode directly. The
-status bar always shows
-where you are: `seatbelt:fastened 🔒` (green), `seatbelt:auto 🤖` (yellow),
-`seatbelt:unfastened 💀` (red). The choice persists.
+`shortcut` under [Configure](#configure)). Or use `/seatbelt:mode`: no
+argument cycles, `/seatbelt:mode auto` sets a mode directly. The status bar
+always shows where you are: `seatbelt:fastened 🔒` (green),
+`seatbelt:auto 🤖` (yellow), `seatbelt:unfastened 💀` (red).
+
+The mode is per session: switching affects only the current session, and
+each session remembers its mode across restarts. New sessions start in the
+default mode from config; set it with `/seatbelt:default auto` (no argument
+shows the current default).
 
 - `fastened`: every chain asks once. The default.
-- `auto`: no dialog unless something is `DANGEROUS`. Labels decide what runs
-  silently, so pair it with a good policy file.
+- `auto`: no dialog unless something is `DANGEROUS`. The labeller sees your
+  earlier decisions in the session, so pair it with a good policy file.
 - `unfastened`: no gating, no classifier calls, no cost.
 
 Headless modes (print, JSON) have no dialogs: only `safe` calls auto-run,
@@ -61,9 +80,9 @@ everything else is blocked with a reason.
 Calls made through nested execution (codemode scripts) never appear in an
 assistant message, so they are approved one at a time as a fallback.
 
-## Your policy decides what is dangerous
+## What counts as dangerous is your call
 
-The labels come from the classifier model. You steer the model with a plain
+The labels come from the classifier model. You steer it with a plain
 markdown file: `~/.pi/agent/seatbelt/policy.md`.
 
 - Write plain sentences. No syntax to learn.
@@ -83,8 +102,8 @@ Example:
 - Treat any command that writes outside /tmp as dangerous.
 ```
 
-One limit: policy shapes the model's labels. With no model configured, a
-built-in regex fallback labels calls and the policy file is not consulted.
+Policy shapes the model's labels. With no model configured the policy file
+is not consulted; gated calls always require approval.
 
 ## Configure
 
@@ -104,28 +123,26 @@ built-in regex fallback labels calls and the policy file is not consulted.
   `mcp__github__create_issue`) or prefix patterns (`mcp__slack__*` for a
   whole server, `*` for everything). Non-bash calls are shown to the
   labeller as tool name plus arguments, truncated to 500 characters.
-- `shortcut`: the key that cycles the permission modes, as a pi key id
-  (`"alt+b"`, `"ctrl+shift+p"`, `"f9"`, `"super+b"` for ⌘ on macOS).
-  Read at startup, so a change needs a new session. Anything malformed
-  falls back to `alt+b`.
-  Some combos need the terminal to report modifiers distinctly: through
-  tmux without `set -s extended-keys on`, `ctrl+shift+b` arrives as plain
-  `ctrl+b` (cursor-left) — `alt`- and `F`1–`F12` keys work everywhere.
-  `super` (⌘) needs a terminal with Kitty keyboard protocol support
-  (Ghostty, kitty, WezTerm) and is usually intercepted by the terminal or
-  OS before it reaches pi. If a key combo does not work, `/seatbelt:mode`
-  always does.
+- `shortcut`: the key that cycles the modes, as a pi key id (`"alt+b"`,
+  `"ctrl+shift+p"`, `"f9"`, `"super+b"` for ⌘ on macOS). Read at startup,
+  so a change needs a new session. Anything malformed falls back to
+  `alt+b`. Some combos need the terminal to report modifiers distinctly:
+  through tmux without `set -s extended-keys on`, `ctrl+shift+b` arrives
+  as plain `ctrl+b` (cursor-left), while `alt`- and `F`1–`F`12` keys work
+  everywhere. `super` (⌘) needs a terminal with Kitty keyboard protocol
+  support (Ghostty, kitty, WezTerm) and is usually intercepted by the
+  terminal or OS before it reaches pi. If a key combo does not work,
+  `/seatbelt:mode` always does.
+- `mode`: the default mode for new sessions. Per-session switching never
+  touches it; use `/seatbelt:default` to change it.
 - `model`: the labeller. Pick one with `/seatbelt`, or pass it directly:
   `/seatbelt litellm/gpt-4o-mini`. Fast and cheap works well; the prompt
-  is tiny. Without a model, or if the call fails or times out, the regex
-  fallback takes over.
-- `timeoutMs`: give up on the labeller after this long and fall back.
-
-Both config files are seeded as templates on first load. Fresh installs get a
-one-time notice to run `/seatbelt`.
-
-## Test
-
-```sh
-node smoke.mjs
-```
+  is tiny. Without a model, or if the call fails or times out, the
+  approval dialog is shown unlabeled (always shown, even in auto mode),
+  with a warning naming the cause; without a UI the call is blocked. A
+  missing model also raises a recurring toast pointing at `/seatbelt`.
+- `timeoutMs`: give up on the labeller after this long; past it the batch
+  is treated as failed (unlabeled approval).
+
+Both config files are seeded as templates on first load. Fresh installs get
+a one-time notice to run `/seatbelt`.

package/assets/logo.svg

@@ -0,0 +1,33 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512" role="img" aria-label="pi-seatbelt logo">
+	<defs>
+		<linearGradient id="bg" x1="0" y1="0" x2="1" y2="1">
+			<stop offset="0" stop-color="#1e293b"/>
+			<stop offset="1" stop-color="#0b1220"/>
+		</linearGradient>
+		<linearGradient id="strap" x1="0" y1="0" x2="0" y2="1">
+			<stop offset="0" stop-color="#f8fafc"/>
+			<stop offset="1" stop-color="#cbd5e1"/>
+		</linearGradient>
+		<linearGradient id="buckle" x1="0" y1="0" x2="0" y2="1">
+			<stop offset="0" stop-color="#fbbf24"/>
+			<stop offset="1" stop-color="#f59e0b"/>
+		</linearGradient>
+		<clipPath id="frame">
+			<rect x="16" y="16" width="480" height="480" rx="112"/>
+		</clipPath>
+	</defs>
+	<rect x="16" y="16" width="480" height="480" rx="112" fill="url(#bg)"/>
+	<!-- the belt: full diagonal, entering and leaving off-frame -->
+	<g clip-path="url(#frame)">
+		<g transform="rotate(50 256 256)">
+			<rect x="-140" y="220" width="792" height="72" fill="url(#strap)" stroke="#0b1220" stroke-width="8"/>
+			<line x1="-120" y1="256" x2="640" y2="256" stroke="#64748b" stroke-width="6" stroke-dasharray="16 14" stroke-linecap="round"/>
+		</g>
+	</g>
+	<!-- buckle riding on the belt, strap continues past it out of frame -->
+	<g transform="rotate(50 301 310)">
+		<rect x="243" y="259" width="116" height="102" rx="24" fill="url(#buckle)" stroke="#0b1220" stroke-width="8"/>
+		<rect x="269" y="297" width="64" height="26" rx="10" fill="#0b1220"/>
+		<circle cx="301" cy="310" r="7" fill="#4ade80"/>
+	</g>
+</svg>

package/core.ts

@@ -66,25 +66,6 @@ export function withPolicy(base: string, policy: string): string {
 		: base;
 }
 
-const DANGEROUS_PATTERNS = [
-	/\brm\s+(-[a-z]*[rf][a-z]*|--recursive|--force)/i,
-	/\bsudo\b/i,
-	/\b(chmod|chown)\b[^;&|]*\b777\b/i,
-	/\bgit\s+push\b[^;&|]*(--force\b|\s-f\b)/i,
-	/\bdd\b/i,
-	/\bmkfs\b/i,
-	/\b(shutdown|reboot|halt)\b/i,
-	/\bkill(all)?\s+-9\b/i,
-	/(curl|wget)[^;&|]*\|\s*(sudo\s+)?(ba|z|fi)?sh\b/i,
-];
-
-const CAUTION_PATTERNS = [
-	/\b(git\s+(commit|reset|checkout|rebase|merge)|npm|npx|pnpm|yarn|pip|cargo|brew)\b/i,
-	/\b(curl|wget|ssh|scp|rsync)\b/i,
-	/\b(mv|cp|mkdir|touch|tee|sed\s+-i|chmod|chown|rm)\b/i,
-	/\b(kill|pkill)\b/i,
-];
-
 /** Exact tool name, or prefix match with a trailing "*" (e.g. "mcp__slack__*"). */
 export function matchesTool(patterns: readonly string[], name: string): boolean {
 	return patterns.some((p) => (p.endsWith("*") ? name.startsWith(p.slice(0, -1)) : p === name));
@@ -98,27 +79,32 @@ export function describeCall(toolName: string, args: Record<string, unknown>): s
 	return json === "{}" ? toolName : `${toolName} ${json}`;
 }
 
-const READ_ONLY_TOOLS = new Set(["read", "ls", "grep", "find"]);
+/** One user decision from the current session, used as classifier context. */
+export type DecisionRecord = {
+	tool: string;
+	/** The call as shown in the dialog (describeCall output). */
+	display: string;
+	allowed: boolean;
+	/** The user's stated reason, present only on rejects with a message. */
+	reason?: string;
+};
 
-/** Fallback labels when no classifier model is configured or the call fails. */
-export function getHeuristicAssessment(toolName: string, input: string): Assessment {
-	const purpose = "no purpose (local heuristic label)";
-	if (toolName !== "bash") {
-		return { danger: READ_ONLY_TOOLS.has(toolName) ? "safe" : "caution", purpose, risk: "" };
-	}
-	if (DANGEROUS_PATTERNS.some((p) => p.test(input))) {
-		return { danger: "dangerous", purpose, risk: "matches a known dangerous pattern (local heuristic label)" };
-	}
-	if (CAUTION_PATTERNS.some((p) => p.test(input))) {
-		return { danger: "caution", purpose, risk: "" };
-	}
-	return { danger: "safe", purpose, risk: "" };
+/** Prior user decisions as classifier-prompt context; empty string when there is none. Most recent last, capped. */
+export function formatHistory(records: readonly DecisionRecord[], max = 20): string {
+	if (records.length === 0) return "";
+	const lines = records
+		.slice(-max)
+		.map(
+			(r) =>
+				`- ${r.allowed ? "approved" : "rejected"}: ${r.display}${r.reason ? ` (user said: ${r.reason})` : ""}`,
+		);
+	return `Earlier user decisions in this session (most recent last):\n${lines.join("\n")}`;
 }
 
 /**
  * Parse the classifier's reply. Expects a JSON array of {danger, purpose},
- * exactly `count` items, in input order. Returns undefined on any mismatch so
- * the caller falls back to heuristics.
+ * exactly `count` items, in input order. Returns undefined on any mismatch
+ * so the caller treats classification as failed.
  */
 export function parseAssessments(raw: string, count: number): Assessment[] | undefined {
 	const start = raw.indexOf("[");
@@ -178,6 +164,35 @@ export function formatBatch(
 	return lines.join("\n");
 }
 
+/** Why the classifier could not label calls: no model configured, or the call itself failed. */
+export type ClassifyFailure = "no-model" | "unavailable";
+
+/** Body for the approval dialog when the classifier failed: calls listed without labels. */
+export function formatUnlabeled(
+	commands: string[],
+	failure: ClassifyFailure,
+	style: DialogStyle = plainStyle,
+): string {
+	const warning =
+		failure === "no-model"
+			? "! no classifier model set: these calls could not be labeled (pick one with /seatbelt)"
+			: "! classifier unavailable: these calls could not be labeled";
+	const lines = [
+		commands.length === 1 ? "Approve this tool call?" : `Approve ${commands.length} tool calls?`,
+		"",
+		style.label("caution", warning),
+		"",
+	];
+	for (let i = 0; i < commands.length; i++) {
+		lines.push(` ${String(i + 1).padEnd(2)} ${style.dim("> ")}${style.text(truncate(commands[i], 300))}`);
+		lines.push("");
+	}
+	if (commands.length > 1) {
+		lines.push(style.dim("One approval covers every tool call in this batch."));
+	}
+	return lines.join("\n");
+}
+
 /** Body for the single-call fallback dialog, also embedded by formatBatch. */
 export function formatSingle(command: string, assessment: Assessment, style: DialogStyle = plainStyle): string {
 	const lines = [

package/index.ts

@@ -15,11 +15,14 @@
  * /seatbelt. Custom labeling rules go in policy.md next to the config:
  * its whole content is sent to the labeller as user policy that overrides
  * the built-in defaults, and it is re-read on every batch. Without a usable
- * model, local heuristics label the calls instead (the policy file only
- * affects the model).
+ * model, every gated call requires approval (the policy file only affects
+ * the model).
  *
  * Permission modes (cycled with the configured shortcut key, default alt+b,
- * shown in the status bar):
+ * shown in the status bar) are per session: switching affects only the
+ * current session and is remembered per session id, so resuming a session
+ * restores its mode. New sessions start in the config's default "mode",
+ * settable with /seatbelt:default.
  * - "fastened" (default): one approval dialog per chain of gated tool calls.
  * - "auto": chains without a dangerous call run without asking; a dangerous
  *   call still shows the approval dialog.
@@ -34,11 +37,12 @@ import type { Model, UserMessage } from "@earendil-works/pi-ai";
 import {
 	DEFAULT_SHORTCUT,
 	describeCall,
-	getHeuristicAssessment,
 	matchesTool,
 	parseAssessments,
 	formatBatch,
 	formatSingle,
+	formatUnlabeled,
+	formatHistory,
 	normalizeMode,
 	normalizeShortcut,
 	isPermissionMode,
@@ -46,6 +50,8 @@ import {
 	plainStyle,
 	withPolicy,
 	type Assessment,
+	type ClassifyFailure,
+	type DecisionRecord,
 	type DialogStyle,
 	type PermissionMode,
 } from "./core.ts";
@@ -53,6 +59,7 @@ import {
 const CONFIG_DIR = join(homedir(), ".pi", "agent", "seatbelt");
 const CONFIG_PATH = join(CONFIG_DIR, "config.json");
 const POLICY_PATH = join(CONFIG_DIR, "policy.md");
+const SESSION_MODES_PATH = join(CONFIG_DIR, "session-modes.json");
 
 const POLICY_TEMPLATE = `# Seatbelt policy
 
@@ -118,8 +125,46 @@ function readPolicy(): string {
 	}
 }
 
-function getCurrentMode(): PermissionMode {
-	return normalizeMode(readConfig().mode);
+function getCurrentMode(ctx: ExtensionContext): PermissionMode {
+	return sessionModes.get(ctx.sessionManager.getSessionId()) ?? normalizeMode(readConfig().mode);
+}
+
+// Per-session mode overrides, persisted by session id so a resumed session
+// keeps its mode. shortcut: entries are never pruned; revisit if this grows large
+const sessionModes = new Map<string, PermissionMode>();
+
+function loadSessionModes(): void {
+	try {
+		// Safe cast: values are validated with isPermissionMode before use.
+		const raw = JSON.parse(readFileSync(SESSION_MODES_PATH, "utf8")) as Record<string, unknown>;
+		for (const [id, mode] of Object.entries(raw)) {
+			if (isPermissionMode(mode)) sessionModes.set(id, mode);
+		}
+	} catch {}
+}
+
+function setSessionMode(ctx: ExtensionContext, mode: PermissionMode): void {
+	sessionModes.set(ctx.sessionManager.getSessionId(), mode);
+	mkdirSync(CONFIG_DIR, { recursive: true });
+	writeFileSync(SESSION_MODES_PATH, `${JSON.stringify(Object.fromEntries(sessionModes), null, 2)}\n`);
+}
+
+// User decisions from the current session, fed to the classifier as context.
+const sessionHistory = new Map<string, DecisionRecord[]>();
+
+function recordDecisions(
+	ctx: ExtensionContext,
+	entries: readonly GatedCall[],
+	displays: readonly string[],
+	isAllowed: boolean,
+	rejectMessage?: string,
+): void {
+	const id = ctx.sessionManager.getSessionId();
+	const history = sessionHistory.get(id) ?? [];
+	for (const [i, entry] of entries.entries()) {
+		history.push({ tool: entry.tool, display: displays[i], allowed: isAllowed, reason: isAllowed ? undefined : rejectMessage });
+	}
+	sessionHistory.set(id, history);
 }
 
 function getGatedTools(): string[] {
@@ -147,10 +192,14 @@ For each call return:
 - "purpose": one line, max 12 words, saying what the call does for the task.
 - "risk": one line, max 12 words, saying WHY the call is dangerous; the empty string "" when danger is not "dangerous".
 
+When earlier user decisions from this session are given, use them as context:
+a call similar to one the user approved leans safer; a call similar to one the
+user rejected, especially with a stated reason, leans dangerous.
+
 Respond with ONLY a JSON array in input order, no markdown fences:
 [{"danger":"safe","purpose":"...","risk":"..."}]`;
 
-type Decision = { isAllowed: boolean; assessment: Assessment; rejectMessage?: string };
+type Decision = { isAllowed: boolean; rejectMessage?: string };
 
 const decisions = new Map<string, Decision>();
 
@@ -160,20 +209,34 @@ type GatedCall = {
 	args: Record<string, unknown>;
 };
 
+/** classifyCalls result: labels on success, the failure reason otherwise. */
+type ClassifyResult = { ok: true; assessments: Assessment[] } | { ok: false; failure: ClassifyFailure };
+
 async function classifyCalls(
 	calls: GatedCall[],
 	taskContext: string,
 	ctx: ExtensionContext,
-): Promise<Assessment[]> {
+): Promise<ClassifyResult> {
 	const { model: spec, timeoutMs = 20000 } = readConfig();
 	const system = withPolicy(CLASSIFIER_SYSTEM, readPolicy());
 	const inputs = calls.map((c) => ({ tool: c.tool, input: describeCall(c.tool, c.args) }));
 	const model = findModel(spec, ctx);
-	if (!model) return inputs.map((i) => getHeuristicAssessment(i.tool, i.input));
+	if (!model) return { ok: false, failure: "no-model" };
 
 	const user: UserMessage = {
 		role: "user",
-		content: [{ type: "text", text: `Task context:\n${taskContext || "(none)"}\n\nTool calls:\n${JSON.stringify(inputs)}` }],
+		content: [
+			{
+				type: "text",
+				text: [
+					`Task context:\n${taskContext || "(none)"}`,
+					formatHistory(sessionHistory.get(ctx.sessionManager.getSessionId()) ?? []),
+					`Tool calls:\n${JSON.stringify(inputs)}`,
+				]
+					.filter(Boolean)
+					.join("\n\n"),
+			},
+		],
 		timestamp: Date.now(),
 	};
 	try {
@@ -187,9 +250,9 @@ async function classifyCalls(
 			.map((c) => c.text)
 			.join("\n");
 		const parsed = parseAssessments(text, calls.length);
-		if (parsed) return parsed;
+		if (parsed) return { ok: true, assessments: parsed };
 	} catch {}
-	return inputs.map((i) => getHeuristicAssessment(i.tool, i.input));
+	return { ok: false, failure: "unavailable" };
 }
 
 const DANGER_COLOR = {
@@ -210,6 +273,15 @@ function getDialogStyle(ctx: ExtensionContext): DialogStyle {
 	};
 }
 
+function notifyClassifyFailure(failure: ClassifyFailure, ctx: ExtensionContext): void {
+	if (failure === "no-model" && ctx.hasUI) {
+		ctx.ui.notify(
+			"seatbelt: no classifier model set, so every gated call requires approval. Pick one with /seatbelt.",
+			"warning",
+		);
+	}
+}
+
 // Runs the approval dialog (or headless fallback) and stores one decision per
 // call. Returns the rejection message when the user wrote one.
 async function approveWithDialog(
@@ -238,33 +310,50 @@ async function approveBatch(
 	taskContext: string,
 	ctx: ExtensionContext,
 ): Promise<void> {
-	const mode = getCurrentMode();
+	const mode = getCurrentMode(ctx);
 	if (mode === "unfastened") return;
-	const assessments = await classifyCalls(entries, taskContext, ctx);
+	const result = await classifyCalls(entries, taskContext, ctx);
 	const displays = entries.map((e) => describeCall(e.tool, e.args));
 	let isAllowed: boolean;
 	let rejectMessage: string | undefined;
-	if (mode === "auto" && assessments.every((a) => a.danger !== "dangerous")) {
+	if (!result.ok) {
+		// classifier failed: always ask, no matter the mode (fastened/auto); fail-safe without a UI
+		notifyClassifyFailure(result.failure, ctx);
+		if (ctx.hasUI) {
+			const decision = await approveWithDialog(
+				formatUnlabeled(displays, result.failure, getDialogStyle(ctx)),
+				entries.length === 1,
+				ctx,
+			);
+			isAllowed = decision.isAllowed;
+			rejectMessage = decision.rejectMessage;
+			recordDecisions(ctx, entries, displays, isAllowed, rejectMessage);
+		} else {
+			isAllowed = false;
+		}
+	} else if (mode === "auto" && result.assessments.every((a) => a.danger !== "dangerous")) {
 		isAllowed = true;
 	} else if (ctx.hasUI) {
 		const decision = await approveWithDialog(
-			formatBatch(displays, assessments, getDialogStyle(ctx)),
+			formatBatch(displays, result.assessments, getDialogStyle(ctx)),
 			entries.length === 1,
 			ctx,
 		);
 		isAllowed = decision.isAllowed;
 		rejectMessage = decision.rejectMessage;
+		recordDecisions(ctx, entries, displays, isAllowed, rejectMessage);
 	} else {
 		// no UI: fail-safe, only clearly safe calls pass without a human
-		isAllowed = assessments.every((a) => a.danger === "safe");
+		isAllowed = result.assessments.every((a) => a.danger === "safe");
 	}
-	for (const [i, entry] of entries.entries()) {
-		decisions.set(entry.id, { isAllowed, assessment: assessments[i], rejectMessage });
+	for (const entry of entries) {
+		decisions.set(entry.id, { isAllowed, rejectMessage });
 	}
 }
 
 export default function (pi: ExtensionAPI) {
 	ensureConfigFiles();
+	loadSessionModes();
 
 	// The assistant message is finalized before its tool calls execute, so the
 	// whole chain is known here and can be approved in one dialog.
@@ -278,7 +367,7 @@ export default function (pi: ExtensionAPI) {
 			)
 			.map((c) => ({ id: c.id, tool: c.name, args: c.arguments ?? {} }));
 		if (calls.length === 0) return;
-		if (getCurrentMode() === "unfastened") return;
+		if (getCurrentMode(ctx) === "unfastened") return;
 		const taskContext = message.content
 			.filter((c): c is { type: "text"; text: string } => c.type === "text")
 			.map((c) => c.text)
@@ -289,27 +378,46 @@ export default function (pi: ExtensionAPI) {
 
 	pi.on("tool_call", async (event, ctx) => {
 		if (!matchesTool(getGatedTools(), event.toolName)) return undefined;
-		if (getCurrentMode() === "unfastened") return undefined;
+		if (getCurrentMode(ctx) === "unfastened") return undefined;
 		if (!decisions.has(event.toolCallId)) {
 			// Nested or otherwise unseen call (for example a codemode script): approve it on its own
 			const entry: GatedCall = { id: event.toolCallId, tool: event.toolName, args: getCallArgs(event.input) };
-			const [assessment] = await classifyCalls([entry], "", ctx);
+			const result = await classifyCalls([entry], "", ctx);
 			let isAllowed: boolean;
 			let rejectMessage: string | undefined;
-			if (getCurrentMode() === "auto" && assessment.danger !== "dangerous") {
-				isAllowed = true;
-			} else if (ctx.hasUI) {
-				const decision = await approveWithDialog(
-					formatSingle(describeCall(entry.tool, entry.args), assessment, getDialogStyle(ctx)),
-					true,
-					ctx,
-				);
-				isAllowed = decision.isAllowed;
-				rejectMessage = decision.rejectMessage;
+			if (!result.ok) {
+				// classifier failed: always ask, no matter the mode (fastened/auto); fail-safe without a UI
+				notifyClassifyFailure(result.failure, ctx);
+				if (ctx.hasUI) {
+					const decision = await approveWithDialog(
+						formatUnlabeled([describeCall(entry.tool, entry.args)], result.failure, getDialogStyle(ctx)),
+						true,
+						ctx,
+					);
+					isAllowed = decision.isAllowed;
+					rejectMessage = decision.rejectMessage;
+					recordDecisions(ctx, [entry], [describeCall(entry.tool, entry.args)], isAllowed, rejectMessage);
+				} else {
+					isAllowed = false;
+				}
 			} else {
-				isAllowed = assessment.danger === "safe";
+				const assessment = result.assessments[0];
+				if (getCurrentMode(ctx) === "auto" && assessment.danger !== "dangerous") {
+					isAllowed = true;
+				} else if (ctx.hasUI) {
+					const decision = await approveWithDialog(
+						formatSingle(describeCall(entry.tool, entry.args), assessment, getDialogStyle(ctx)),
+						true,
+						ctx,
+					);
+					isAllowed = decision.isAllowed;
+					rejectMessage = decision.rejectMessage;
+					recordDecisions(ctx, [entry], [describeCall(entry.tool, entry.args)], isAllowed, rejectMessage);
+				} else {
+					isAllowed = assessment.danger === "safe";
+				}
 			}
-			decisions.set(event.toolCallId, { isAllowed, assessment, rejectMessage });
+			decisions.set(event.toolCallId, { isAllowed, rejectMessage });
 		}
 		const decision = decisions.get(event.toolCallId);
 		decisions.delete(event.toolCallId);
@@ -326,7 +434,7 @@ export default function (pi: ExtensionAPI) {
 	pi.registerCommand("seatbelt", {
 		description: "Show or set the model that labels tool calls for approval",
 		handler: async (args, ctx) => {
-			const current = readConfig().model ?? "(none, using local heuristics)";
+			const current = readConfig().model ?? "(none, every gated call requires approval)";
 			let value = args.trim();
 			if (!value) {
 				if (!ctx.hasUI) {
@@ -377,7 +485,7 @@ export default function (pi: ExtensionAPI) {
 
 	function updateStatus(ctx: ExtensionContext): void {
 		if (!ctx.hasUI) return;
-		const mode = getCurrentMode();
+		const mode = getCurrentMode(ctx);
 		const label = `seatbelt:${MODE_LABELS[mode]}`;
 		const text = ctx.mode === "tui" ? ctx.ui.theme.fg(MODE_COLOR[mode], label) : label;
 		ctx.ui.setStatus("seatbelt", text);
@@ -392,10 +500,34 @@ export default function (pi: ExtensionAPI) {
 				return;
 			}
 			// Safe cast: wanted is non-empty and passed isPermissionMode above.
-			const mode = (wanted || nextMode(getCurrentMode())) as PermissionMode;
-			writeConfig({ ...readConfig(), mode });
+			const mode = (wanted || nextMode(getCurrentMode(ctx))) as PermissionMode;
+			setSessionMode(ctx, mode);
 			updateStatus(ctx);
-			ctx.ui.notify(`Seatbelt: ${mode} (${MODE_HINTS[mode]})`, "info");
+			ctx.ui.notify(`Seatbelt: ${mode} (${MODE_HINTS[mode]}), this session only`, "info");
+		},
+	});
+
+	pi.registerCommand("seatbelt:default", {
+		description: "Set the default mode for new sessions (fastened, auto, unfastened); no argument shows it",
+		handler: async (args, ctx) => {
+			const wanted = args.trim();
+			if (!wanted) {
+				const current = normalizeMode(readConfig().mode);
+				ctx.ui.notify(
+					`Default mode for new sessions: ${current}. Usage: /seatbelt:default fastened|auto|unfastened`,
+					"info",
+				);
+				return;
+			}
+			if (!isPermissionMode(wanted)) {
+				ctx.ui.notify(`Unknown mode: ${wanted}. Use fastened, auto, or unfastened.`, "error");
+				return;
+			}
+			writeConfig({ ...readConfig(), mode: wanted });
+			ctx.ui.notify(
+				`New sessions will start ${wanted} (${MODE_HINTS[wanted]}). This session stays ${getCurrentMode(ctx)}.`,
+				"info",
+			);
 		},
 	});
 
@@ -403,7 +535,7 @@ export default function (pi: ExtensionAPI) {
 		updateStatus(ctx);
 		if (hasSeededFreshConfig && ctx.hasUI) {
 			ctx.ui.notify(
-				"seatbelt: no labeller model set, using local heuristics. Pick one with /seatbelt.",
+				"seatbelt: no labeller model set, so every gated call requires approval. Pick one with /seatbelt.",
 				"info",
 			);
 		}
@@ -417,10 +549,10 @@ export default function (pi: ExtensionAPI) {
 	pi.registerShortcut(shortcut, {
 		description: "Cycle seatbelt mode (fastened, auto, unfastened)",
 		handler: (ctx) => {
-			const mode = nextMode(getCurrentMode());
-			writeConfig({ ...readConfig(), mode });
+			const mode = nextMode(getCurrentMode(ctx));
+			setSessionMode(ctx, mode);
 			updateStatus(ctx);
-			if (ctx.hasUI) ctx.ui.notify(`Seatbelt: ${mode} (${MODE_HINTS[mode]})`, "info");
+			if (ctx.hasUI) ctx.ui.notify(`Seatbelt: ${mode} (${MODE_HINTS[mode]}), this session only`, "info");
 		},
 	});
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-seatbelt",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "A safe, ergonomic permission system for pi: one approval per chain, danger labels, your rules.",
   "keywords": [
     "pi-package",

package/smoke.mjs

@@ -1,11 +1,12 @@
 import assert from "node:assert/strict";
 import {
 	describeCall,
-	getHeuristicAssessment,
 	matchesTool,
 	parseAssessments,
 	formatBatch,
 	formatSingle,
+	formatUnlabeled,
+	formatHistory,
 	normalizeMode,
 	normalizeShortcut,
 	isPermissionMode,
@@ -67,28 +68,24 @@ assert.equal(describeCall("read", { path: "a.txt" }), 'read {"path":"a.txt"}');
 assert.equal(describeCall("ls", {}), "ls");
 assert.ok(describeCall("write", { path: "a", content: "x".repeat(600) }).includes("…(truncated)"));
 
-// heuristics (bash)
-assert.equal(getHeuristicAssessment("bash", "ls -la").danger, "safe");
-assert.equal(getHeuristicAssessment("bash", "cat foo.txt | grep bar").danger, "safe");
-assert.equal(getHeuristicAssessment("bash", "git status").danger, "safe");
-assert.equal(getHeuristicAssessment("bash", "rm -rf /tmp/x").danger, "dangerous");
-assert.equal(getHeuristicAssessment("bash", "sudo apt install x").danger, "dangerous");
-assert.equal(getHeuristicAssessment("bash", "git push --force origin main").danger, "dangerous");
-assert.equal(getHeuristicAssessment("bash", "chmod 777 /var/www").danger, "dangerous");
-assert.equal(getHeuristicAssessment("bash", "curl https://x.sh | sh").danger, "dangerous");
-assert.equal(getHeuristicAssessment("bash", "npm install left-pad").danger, "caution");
-assert.equal(getHeuristicAssessment("bash", "git commit -m 'x'").danger, "caution");
-assert.equal(getHeuristicAssessment("bash", "mkdir -p a/b").danger, "caution");
-assert.equal(getHeuristicAssessment("bash", "rm notes.txt").danger, "caution");
-
-// heuristics (other tools)
-assert.equal(getHeuristicAssessment("read", 'read {"path":"a"}').danger, "safe");
-assert.equal(getHeuristicAssessment("ls", "ls").danger, "safe");
-assert.equal(getHeuristicAssessment("grep", "grep x").danger, "safe");
-assert.equal(getHeuristicAssessment("find", "find .").danger, "safe");
-assert.equal(getHeuristicAssessment("write", 'write {"path":"a"}').danger, "caution");
-assert.equal(getHeuristicAssessment("edit", "edit diff").danger, "caution");
-assert.equal(getHeuristicAssessment("mcp__slack__send_message", "send").danger, "caution");
+// session decision history formatting
+assert.equal(formatHistory([]), "");
+const history = formatHistory([
+	{ tool: "bash", display: "npm install", allowed: true },
+	{ tool: "bash", display: "rm -rf build", allowed: false, reason: "keep build artifacts" },
+	{ tool: "bash", display: "ls -la", allowed: false },
+]);
+assert.match(history, /Earlier user decisions in this session \(most recent last\):/);
+assert.match(history, /- approved: npm install$/m);
+assert.match(history, /- rejected: rm -rf build \(user said: keep build artifacts\)$/m);
+assert.match(history, /- rejected: ls -la$/m);
+// only the last 20 records make it into the prompt
+const many = formatHistory(
+	Array.from({ length: 30 }, (_, i) => ({ tool: "bash", display: `cmd ${i}`, allowed: true })),
+);
+assert.doesNotMatch(many, /cmd 9$/m);
+assert.match(many, /- approved: cmd 10$/m);
+assert.match(many, /- approved: cmd 29$/m);
 
 // parser
 assert.deepEqual(
@@ -114,11 +111,6 @@ assert.deepEqual(
 	["safe", "dangerous"],
 );
 
-// heuristics carry a risk line only for dangerous calls
-assert.ok(getHeuristicAssessment("bash", "rm -rf /tmp/x").risk.length > 0);
-assert.equal(getHeuristicAssessment("bash", "ls").risk, "");
-assert.equal(getHeuristicAssessment("read", "read").risk, "");
-
 // formatting
 const batch = formatBatch(
 	["ls -la", "rm -rf /tmp/batch-demo"],
@@ -149,4 +141,23 @@ assert.match(
 // plain style passes fragments through untouched
 assert.doesNotMatch(formatBatch(["ls"], [{ danger: "safe", purpose: "x", risk: "" }]), /\u001b\[/);
 
+// unlabeled dialog when the classifier fails
+const unlabeledSingle = formatUnlabeled(["ls -la"], "unavailable");
+assert.match(unlabeledSingle, /Approve this tool call\?/);
+assert.match(unlabeledSingle, /! classifier unavailable: these calls could not be labeled/);
+assert.match(unlabeledSingle, /> ls -la/);
+assert.ok(!unlabeledSingle.includes("One approval covers"));
+assert.ok(!unlabeledSingle.includes("What it does:"));
+const unlabeledBatch = formatUnlabeled(["ls -la", "rm -rf /tmp/batch-demo"], "unavailable");
+assert.match(unlabeledBatch, /Approve 2 tool calls\?/);
+assert.match(unlabeledBatch, /> ls -la/);
+assert.match(unlabeledBatch, /> rm -rf \/tmp\/batch-demo/);
+assert.match(unlabeledBatch, /One approval covers every tool call/);
+assert.ok(!unlabeledBatch.includes("What it does:"));
+assert.ok(!unlabeledBatch.includes("DANGEROUS"));
+// the no-model failure gets a more specific warning
+const noModelSingle = formatUnlabeled(["ls -la"], "no-model");
+assert.match(noModelSingle, /! no classifier model set: these calls could not be labeled \(pick one with \/seatbelt\)/);
+assert.ok(!noModelSingle.includes("classifier unavailable"));
+
 console.log("pi-seatbelt core: all checks passed");