pi-squire 0.14.0 → 0.16.0

package/src/tree-view.ts

@@ -0,0 +1,246 @@
+// Read-only projection. Shared ancestry locates records; only each direct
+// parent's local child facts carry semantic results. Never imports outcomes.
+import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { readChildRecords } from "./child-tasks.ts";
+import { type Identity, maxDepth, readIdentity } from "./identity.ts";
+import { isStarted, type Recorded, type Results, type StartedRecorded, sessionIdOf } from "./results.ts";
+import { sessionIsOwned } from "./session-owner.ts";
+import { descendants, readTree, type TreeEntry } from "./tree-registry.ts";
+import { assertRootPlacement } from "./window-placement.ts";
+
+export function recordedIdentity(record: StartedRecorded): Identity | undefined {
+	const durable: Identity | undefined = readIdentity(sessionIdOf(record));
+	if (
+		durable &&
+		record.identity &&
+		(durable.parent !== record.identity.parent ||
+			durable.root !== record.identity.root ||
+			durable.rootPlacement !== record.identity.rootPlacement ||
+			durable.depth !== record.identity.depth)
+	)
+		throw new Error(`conflicting ownership for delegation ${record.id}`);
+	const own: Identity | undefined = durable ?? record.identity;
+	if (own) assertRootPlacement(own.rootPlacement);
+	return own;
+}
+export function belongsTo(record: Recorded, ctx: ExtensionContext): boolean {
+	if (!isStarted(record)) return record.parentId === ctx.sessionManager.getSessionId();
+	if (record.identity?.parent && record.identity.parent !== ctx.sessionManager.getSessionId()) return false;
+	if (!record.identity && ctx.sessionManager.getHeader?.()?.parentSession) return false;
+	const identity: Identity | undefined = recordedIdentity(record);
+	if (identity) return identity.parent === ctx.sessionManager.getSessionId();
+	// Legacy starts without identity may be restored by their original session,
+	// never by a branch copied into a fresh session file.
+	return !ctx.sessionManager.getHeader?.()?.parentSession;
+}
+export function assertResumeAuthority(record: StartedRecorded, ctx: ExtensionContext): void {
+	const child: Identity | undefined = recordedIdentity(record);
+	if (!belongsTo(record, ctx))
+		throw new Error(
+			`only direct parent ${child?.parent ?? "(original session)"} may resume delegation ${record.id}; reopen that parent session`,
+		);
+	if (!child) throw new Error(`delegation ${record.id} has no original root placement identity; resume refused`);
+	const parent: Identity | undefined = readIdentity(ctx.sessionManager.getSessionId());
+	if (
+		child.root !== (parent?.root ?? ctx.sessionManager.getSessionId()) ||
+		child.depth !== (parent?.depth ?? 0) + 1 ||
+		(parent && child.rootPlacement !== parent.rootPlacement)
+	)
+		throw new Error(`delegation ${record.id} has inconsistent root/depth or rootPlacement ownership; resume refused`);
+	if (child.depth > maxDepth())
+		throw new Error(
+			`delegation ${record.id} depth ${child.depth} exceeds maxDepth ${maxDepth()} in squire/settings.json`,
+		);
+	const state = readTree(child.root);
+	const newer: TreeEntry | undefined = newestSuccessor(state.entries, record.id);
+	if (newer)
+		throw new Error(
+			`delegation ${record.id} was already resumed; resume its newest delegation ${newer.id} instead (it continues the same session)`,
+		);
+}
+function newestSuccessor(entries: TreeEntry[], id: string): TreeEntry | undefined {
+	const seen: Set<string> = new Set([id]);
+	let newest: TreeEntry | undefined;
+	let current: string = id;
+	for (;;) {
+		const next: TreeEntry | undefined = entries.find(
+			(entry) => entry.resumedFrom === current && (entry.phase === "started" || entry.phase === "dispatched"),
+		);
+		if (!next) return newest;
+		if (seen.has(next.id)) throw new Error("invalid shared resume chain; resume refused");
+		seen.add(next.id);
+		newest = next;
+		current = next.id;
+	}
+}
+export type VisibleFact = { record: Recorded; semantic?: Recorded; entry?: TreeEntry };
+export type VisibleFacts = { records: Recorded[]; facts: VisibleFact[]; complete: boolean };
+
+export function visibleRecords(results: Results, ctx: ExtensionContext): Recorded[] {
+	return visibleRecordFacts(results, ctx).records;
+}
+
+/** Same scoped projection, with unoverlaid parent facts and explicit coverage for read-only summaries. */
+export function visibleRecordFacts(
+	results: Results,
+	ctx: ExtensionContext,
+	timeoutMs = 5000,
+	notify = true,
+): VisibleFacts {
+	const session: string = ctx.sessionManager.getSessionId();
+	const root: string = readIdentity(session)?.root ?? session;
+	const records: Map<string, Recorded> = new Map(results.list().map((record) => [record.id, record]));
+	const semantic: Map<string, Recorded> = new Map(records);
+	const parents: Map<string, Recorded[]> = new Map();
+	let complete = true;
+	let entries: TreeEntry[];
+	try {
+		entries = descendants(readTree(root, timeoutMs), session).filter((entry) => entry.phase !== "not-started");
+	} catch (error) {
+		if (notify)
+			ctx.ui.notify(
+				`delegate: descendant accounting unavailable: ${String(error)}; showing saved local children only.`,
+				"warning",
+			);
+		return {
+			records: [...records.values()],
+			facts: [...records.values()].map((record) => ({ record, semantic: record })),
+			complete: false,
+		};
+	}
+	for (const entry of entries) {
+		const local: Recorded | undefined = cachedParent(parents, entry.identity.parent, ctx, notify).find(
+			(record) => record.id === entry.id,
+		);
+		if (rememberSemantic(semantic, entry.id, local)) complete = false;
+		const record: Recorded = local ?? entry.launch ?? registryView(entry);
+		if (reattached(entry, record) && isStarted(record)) {
+			records.set(entry.id, {
+				...record,
+				identity: entry.identity,
+				windowId: entry.windowId ?? record.windowId,
+				windowName: entry.windowName ?? record.windowName,
+			});
+		} else if (!records.has(entry.id)) records.set(entry.id, { ...record, identity: entry.identity });
+	}
+	const ordered: Recorded[] = hierarchy(withCloses(records, entries), session);
+	return {
+		records: ordered,
+		facts: ordered.map((record) => ({
+			record,
+			semantic: semantic.get(record.id),
+			entry: entries.find((entry) => entry.id === record.id),
+		})),
+		complete,
+	};
+}
+function cachedParent(
+	parents: Map<string, Recorded[]>,
+	parent: string,
+	ctx: ExtensionContext,
+	notify: boolean,
+): Recorded[] {
+	let records: Recorded[] | undefined = parents.get(parent);
+	if (!records) {
+		records = parentRecords(parent, ctx, notify);
+		parents.set(parent, records);
+	}
+	return records;
+}
+function rememberSemantic(semantic: Map<string, Recorded>, id: string, local: Recorded | undefined): boolean {
+	if (local && !semantic.has(id)) semantic.set(id, local);
+	return !semantic.has(id);
+}
+function reattached(entry: TreeEntry, record: Recorded): boolean {
+	return entry.gone === true && !entry.finished && sessionIsOwned(entry.sessionId) && isStarted(record);
+}
+function withCloses(records: Map<string, Recorded>, entries: TreeEntry[]): Recorded[] {
+	for (const entry of entries) {
+		const record: Recorded | undefined = records.get(entry.id);
+		if (entry.closed && record && isStarted(record)) records.set(entry.id, { ...record, closed: true });
+	}
+	return [...records.values()];
+}
+function parentRecords(parent: string, ctx: ExtensionContext, notify: boolean): Recorded[] {
+	try {
+		return readChildRecords(parent);
+	} catch (error) {
+		if (notify)
+			ctx.ui.notify(
+				`delegate: child facts for ${parent} unavailable: ${String(error)}; showing registry metadata only.`,
+				"warning",
+			);
+		return [];
+	}
+}
+export function restoredStarts(ctx: ExtensionContext): StartedRecorded[] {
+	const session: string = ctx.sessionManager.getSessionId();
+	const root: string = readIdentity(session)?.root ?? session;
+	return readTree(root)
+		.entries.filter((entry) => entry.identity.parent === session && entry.phase === "started")
+		.flatMap((entry) => (entry.launch && entry.requestId && entry.windowId ? [entry.launch] : []));
+}
+function registryView(entry: TreeEntry): StartedRecorded {
+	return {
+		id: entry.id,
+		sessionId: entry.sessionId,
+		identity: entry.identity,
+		accountingOnly: true,
+		agent: entry.identity.agent,
+		autoExit: entry.identity.autoExit,
+		model: "unknown",
+		thinking: "unknown",
+		windowId: entry.windowId ?? "not-recorded",
+		windowName: entry.windowName ?? "not-recorded",
+		requestId: entry.requestId ?? "not-recorded",
+		cwd: entry.cwd,
+		sessionDir: entry.sessionDir,
+		workspace: entry.workspace,
+		resumedFrom: entry.resumedFrom,
+	};
+}
+function hierarchy(records: Recorded[], viewer: string): Recorded[] {
+	const byParent: Map<string, Recorded[]> = new Map();
+	const latest: Map<string, string> = new Map();
+	for (const record of records) {
+		const parent: string = isStarted(record) ? (record.identity?.parent ?? viewer) : record.parentId;
+		byParent.set(parent, [...(byParent.get(parent) ?? []), record]);
+		if (isStarted(record)) latest.set(sessionIdOf(record), record.id);
+	}
+	const ordered: Recorded[] = [];
+	const seen: Set<string> = new Set();
+	const walk = (parent: string): void => {
+		for (const record of byParent.get(parent) ?? []) {
+			if (seen.has(record.id)) continue;
+			seen.add(record.id);
+			ordered.push(record);
+			if (isStarted(record) && latest.get(sessionIdOf(record)) === record.id) walk(sessionIdOf(record));
+		}
+	};
+	walk(viewer);
+	return [...ordered, ...records.filter((record) => !seen.has(record.id))];
+}
+/** A view can know terminal accounting while its owner has not received mail. */
+export function accountingFor(record: StartedRecorded): string | undefined {
+	if (!record.identity) return undefined;
+	let entry: TreeEntry | undefined;
+	try {
+		entry = readTree(record.identity.root).entries.find((item) => item.id === record.id);
+	} catch {
+		return "unavailable";
+	}
+	if (!entry) return undefined;
+	if (entry.closed) return "closed";
+	if (entry.closing) return "closing";
+	if (entry.finished) return "finished";
+	if (entry.gone) return sessionIsOwned(entry.sessionId) ? "reattached" : "gone";
+	return entry.phase;
+}
+export function historicalRecord(id: string, ctx: ExtensionContext): StartedRecorded | undefined {
+	for (const entry of ctx.sessionManager.getEntries())
+		if (entry.type === "custom" && entry.customType === "delegate") {
+			const value = entry.data as StartedRecorded | undefined;
+			if (value?.id === id && typeof value.requestId === "string") return value;
+		}
+	return undefined;
+}

package/src/trust-control.ts

@@ -0,0 +1,214 @@
+// Root-owned, non-model project-trust control. Each runtime has a fresh token;
+// sockets and pending prompts die on replacement. Nothing is replayed on reopen.
+import { randomUUID } from "node:crypto";
+import { unlinkSync } from "node:fs";
+import { createServer, type Server, type Socket } from "node:net";
+import { isAbsolute } from "node:path";
+import { type ExtensionAPI, type ExtensionContext, getAgentDir } from "@earendil-works/pi-coding-agent";
+import { type Identity, readIdentity } from "./identity.ts";
+import { readState, writeState } from "./local-state.ts";
+import {
+	TRUST_TIMEOUT_MS,
+	type TrustDecision,
+	TrustPrompts,
+	type TrustQuestion,
+	type TrustResolver,
+	trustLifetime,
+	trustStopped,
+} from "./trust-prompt.ts";
+import {
+	readTrustFrame,
+	requestRootTrust,
+	type TrustEndpoint,
+	type TrustRequest,
+	trustEndpointPath,
+	trustProof,
+	writeTrustFrame,
+} from "./trust-wire.ts";
+
+function validRequest(value: unknown, root: string, token: string): TrustRequest {
+	const request: TrustRequest = value as TrustRequest;
+	if (
+		!request ||
+		request.token !== token ||
+		request.root !== root ||
+		typeof request.id !== "string" ||
+		typeof request.requester !== "string" ||
+		!Array.isArray(request.chain) ||
+		!request.chain.every((name) => typeof name === "string" && /^[a-zA-Z0-9_-]+$/.test(name)) ||
+		typeof request.directory !== "string" ||
+		!isAbsolute(request.directory) ||
+		typeof request.key !== "string" ||
+		!isAbsolute(request.key) ||
+		!Number.isSafeInteger(request.expiresAt) ||
+		request.expiresAt <= Date.now() ||
+		request.expiresAt > Date.now() + TRUST_TIMEOUT_MS
+	)
+		throw new Error("invalid or expired project trust request; nothing was launched");
+	const own: Identity | undefined = readIdentity(request.requester);
+	if (
+		!own ||
+		own.root !== root ||
+		request.chain.length !== own.chain.length + 1 ||
+		!own.chain.every((name, index) => name === request.chain[index])
+	)
+		throw new Error("project trust requester does not belong to this root; nothing was launched");
+	return request;
+}
+
+class TrustRuntime {
+	readonly stopped: AbortController = new AbortController();
+	readonly prompts: TrustPrompts;
+	private readonly agentDir: string;
+	private readonly root: string;
+	private readonly token: string = randomUUID();
+	private server: Server | undefined;
+	private readonly sockets: Set<Socket> = new Set();
+
+	constructor(ctx: ExtensionContext, agentDir: string, attended: boolean) {
+		this.agentDir = agentDir;
+		this.root = ctx.sessionManager.getSessionId();
+		this.prompts = new TrustPrompts(ctx, agentDir, attended);
+	}
+
+	async start(): Promise<void> {
+		const server: Server = createServer((socket) => this.accept(socket));
+		this.server = server;
+		await new Promise<void>((resolve, reject) => {
+			server.once("error", reject);
+			server.listen(0, "127.0.0.1", () => {
+				server.removeListener("error", reject);
+				resolve();
+			});
+		});
+		server.unref();
+		server.on("error", () => this.stop());
+		if (this.stopped.signal.aborted) {
+			server.close();
+			return;
+		}
+		const address: ReturnType<Server["address"]> = server.address();
+		if (!address || typeof address === "string") throw new Error("project trust endpoint has no loopback port");
+		writeState(trustEndpointPath(this.agentDir, this.root), { port: address.port, token: this.token });
+	}
+
+	stop(): void {
+		if (this.stopped.signal.aborted) return;
+		this.stopped.abort(new Error("the project trust session was replaced or stopped; nothing was launched"));
+		for (const socket of this.sockets) socket.destroy();
+		this.server?.close(() => {});
+		const path: string = trustEndpointPath(this.agentDir, this.root);
+		try {
+			if (readState<TrustEndpoint>(path)?.token === this.token) unlinkSync(path);
+		} catch {
+			/* A stale descriptor cannot authenticate a new runtime. */
+		}
+	}
+
+	private accept(socket: Socket): void {
+		this.sockets.add(socket);
+		const closed: AbortController = new AbortController();
+		socket.on("error", () => socket.destroy());
+		socket.on("close", () => {
+			this.sockets.delete(socket);
+			closed.abort(new Error("the requesting launch was canceled or stopped; nothing was launched"));
+		});
+		// Bound connections which never provide a complete first frame.
+		socket.setTimeout(1000, () => socket.destroy());
+		readTrustFrame(
+			socket,
+			(value) => {
+				if (
+					!value ||
+					typeof value !== "object" ||
+					!("nonce" in value) ||
+					typeof value.nonce !== "string" ||
+					value.nonce.length > 128
+				) {
+					socket.destroy();
+					return;
+				}
+				writeTrustFrame(socket, { proof: trustProof(this.token, value.nonce) });
+				readTrustFrame(
+					socket,
+					(request) => {
+						socket.setTimeout(0);
+						this.answer(socket, request, closed.signal).catch(() => socket.destroy());
+					},
+					() => socket.destroy(),
+				);
+			},
+			() => socket.destroy(),
+		);
+	}
+
+	private async answer(socket: Socket, value: unknown, disconnected: AbortSignal): Promise<void> {
+		const id: string | undefined =
+			typeof value === "object" && value !== null && "id" in value && typeof value.id === "string"
+				? value.id
+				: undefined;
+		let request: TrustRequest | undefined;
+		try {
+			request = validRequest(value, this.root, this.token);
+			const lifetime: ReturnType<typeof trustLifetime> = trustLifetime(request.expiresAt, [
+				disconnected,
+				this.stopped.signal,
+			]);
+			try {
+				const decision: TrustDecision = await this.prompts.ask(request, lifetime.signal, request.expiresAt);
+				decision.assertLive();
+				socket.once("close", decision.release);
+				writeTrustFrame(socket, { id: request.id, answer: decision.answer });
+			} finally {
+				lifetime.dispose();
+			}
+		} catch (error) {
+			writeTrustFrame(socket, { id, error: error instanceof Error ? error.message : String(error) });
+			socket.end();
+		}
+	}
+}
+
+export type TrustControl = { forAgent(agent: string, ctx: ExtensionContext): TrustResolver };
+export function registerTrustControl(pi: ExtensionAPI, identity: () => Identity | undefined): TrustControl {
+	const agentDir: string = getAgentDir();
+	const attended: boolean = process.env.PI_UNATTENDED !== "1";
+	let runtime: TrustRuntime | undefined;
+	pi.on("session_start", async (_event, ctx) => {
+		runtime?.stop();
+		const active: TrustRuntime = new TrustRuntime(ctx, agentDir, attended);
+		runtime = active;
+		if (identity() || !ctx.hasUI || !attended) return;
+		try {
+			await active.start();
+		} catch (error) {
+			active.stop();
+			// A transport failure must not take away the root's existing local UI.
+			if (runtime === active) runtime = new TrustRuntime(ctx, agentDir, attended);
+			ctx.ui.notify(`delegate: could not start root project trust control: ${String(error)}`, "error");
+		}
+	});
+	pi.on("session_shutdown", () => runtime?.stop());
+	return {
+		forAgent: (agent: string, ctx: ExtensionContext): TrustResolver => {
+			const active: TrustRuntime | undefined = runtime;
+			if (!active) throw new Error("project trust session has not started");
+			const own: Identity | undefined = identity();
+			return (directory: string, key: string, signal?: AbortSignal): Promise<TrustDecision> => {
+				const question: TrustQuestion = {
+					directory,
+					key,
+					requester: ctx.sessionManager.getSessionId(),
+					chain: [...(own?.chain ?? []), agent],
+				};
+				const combined: AbortSignal = AbortSignal.any([
+					active.stopped.signal,
+					...[signal].filter((item): item is AbortSignal => item !== undefined),
+				]);
+				trustStopped(combined);
+				if (own) return requestRootTrust(agentDir, own.root, question, combined);
+				return active.prompts.ask(question, combined);
+			};
+		},
+	};
+}

package/src/trust-prompt.ts

@@ -0,0 +1,163 @@
+// Project-trust presentation shared by local and root-forwarded requests.
+// Decisions are returned, not saved here: only the live requester may save one.
+
+import { dirname } from "node:path";
+import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { ProjectTrustStore } from "@earendil-works/pi-coding-agent";
+
+export const TRUST_TIMEOUT_MS = 10 * 60 * 1000;
+export type TrustQuestion = { directory: string; key: string; requester: string; chain: readonly string[] };
+export type TrustAnswer = { saved: boolean } | { label: string };
+export type TrustDecision = { answer: TrustAnswer; assertLive(): void; release(): void };
+export type TrustResolver = (directory: string, key: string, signal?: AbortSignal) => Promise<TrustDecision>;
+export type TrustChoice = { label: string; trusted: boolean; updates: { path: string; decision: boolean | null }[] };
+
+export function trustChoices(key: string): TrustChoice[] {
+	const parent: string = dirname(key);
+	return [
+		{ label: "Trust", trusted: true, updates: [{ path: key, decision: true }] },
+		...(parent === key
+			? []
+			: [
+					{
+						label: `Trust parent folder (${parent})`,
+						trusted: true,
+						updates: [
+							{ path: parent, decision: true },
+							{ path: key, decision: null },
+						],
+					},
+				]),
+		{ label: "Trust (this session only)", trusted: true, updates: [] },
+		{ label: "Do not trust", trusted: false, updates: [{ path: key, decision: false }] },
+		{ label: "Do not trust (this session only)", trusted: false, updates: [] },
+	];
+}
+
+export function trustStopped(signal?: AbortSignal): void {
+	if (signal?.aborted)
+		throw signal.reason instanceof Error ? signal.reason : new Error("the launch was aborted; nothing was launched");
+}
+
+/** Also bounds UIs which ignore their cancellation signal; late resolutions have no side effects. */
+export async function waitForTrust<T>(work: Promise<T>, signal: AbortSignal): Promise<T> {
+	trustStopped(signal);
+	let abort: () => void = () => {};
+	const canceled: Promise<never> = new Promise((_, reject) => {
+		abort = (): void =>
+			reject(
+				signal.reason instanceof Error ? signal.reason : new Error("the launch was aborted; nothing was launched"),
+			);
+		signal.addEventListener("abort", abort, { once: true });
+	});
+	try {
+		return await Promise.race([work, canceled]);
+	} finally {
+		signal.removeEventListener("abort", abort);
+	}
+}
+
+export function trustLifetime(
+	expiresAt: number,
+	signals: (AbortSignal | undefined)[],
+): { signal: AbortSignal; dispose(): void } {
+	const timeout: AbortController = new AbortController();
+	const remaining: number = expiresAt - Date.now();
+	const expire = (): void => timeout.abort(new Error("the project trust request expired; nothing was launched"));
+	const timer: ReturnType<typeof setTimeout> = setTimeout(expire, Math.max(0, remaining));
+	timer.unref();
+	if (remaining <= 0) expire();
+	const signal: AbortSignal = AbortSignal.any([
+		timeout.signal,
+		...signals.filter((item): item is AbortSignal => item !== undefined),
+	]);
+	return { signal, dispose: () => clearTimeout(timer) };
+}
+
+export class TrustPrompts {
+	private readonly ctx: ExtensionContext;
+	private readonly agentDir: string;
+	private readonly attended: boolean;
+	private queue: Promise<unknown> = Promise.resolve();
+
+	constructor(ctx: ExtensionContext, agentDir: string, attended = true) {
+		this.ctx = ctx;
+		this.agentDir = agentDir;
+		this.attended = attended;
+	}
+
+	async ask(
+		question: TrustQuestion,
+		signal?: AbortSignal,
+		expiresAt = Date.now() + TRUST_TIMEOUT_MS,
+	): Promise<TrustDecision> {
+		const lifetime: ReturnType<typeof trustLifetime> = trustLifetime(expiresAt, [signal]);
+		let deliver: (decision: TrustDecision) => void = () => {};
+		let fail: (error: unknown) => void = () => {};
+		const response: Promise<TrustDecision> = new Promise((resolve, reject) => {
+			deliver = resolve;
+			fail = reject;
+		});
+		const assertLive = (): void => {
+			trustStopped(lifetime.signal);
+			if (Date.now() >= expiresAt) throw new Error("the project trust request expired; nothing was launched");
+		};
+		const run = async (): Promise<void> => {
+			assertLive();
+			if (!this.ctx.hasUI || !this.attended)
+				throw new Error(
+					`the target exposes project resources and project trust needs an attended root with a dialog-capable UI; open Pi in ${question.key}, answer its trust question, then delegate again; nothing was launched`,
+				);
+			const answer: TrustAnswer = await this.select(question, lifetime.signal, expiresAt);
+			let release: () => void = () => {};
+			const released: Promise<void> = new Promise((resolve) => {
+				release = resolve;
+			});
+			assertLive();
+			deliver({ answer, assertLive, release });
+			// Keep the queue through requester persistence (or disconnect/cancel).
+			await waitForTrust(released, lifetime.signal);
+		};
+		const turn: Promise<void> = this.queue.then(run, run);
+		this.queue = turn.catch(fail).finally(() => lifetime.dispose());
+		return waitForTrust(response, lifetime.signal);
+	}
+
+	private async select(question: TrustQuestion, signal: AbortSignal, expiresAt: number): Promise<TrustAnswer> {
+		const saved: boolean | null = new ProjectTrustStore(this.agentDir).get(question.key);
+		if (saved !== null) return { saved };
+		const title: string = [
+			"A delegate is about to start in a directory with project resources Pi loads only when trusted.",
+			...(question.chain.length
+				? [`Agent chain: ${question.chain.join(" → ")}`, `Requester session: ${question.requester}`]
+				: []),
+			`Directory: ${question.directory}`,
+			...(question.key === question.directory ? [] : [`Main repository: ${question.key}`]),
+			`"Trust" and "Do not trust" save the decision for ${question.key}; "Trust parent folder" saves it for the folder named; "this session only" applies to this launch alone.`,
+		].join("\n");
+		const options: string[] = trustChoices(question.key).map((option) => option.label);
+		const label: string | undefined = await waitForTrust(
+			this.ctx.ui.select(title, options, {
+				signal,
+				timeout: Math.max(1, expiresAt - Date.now()),
+			}),
+			signal,
+		);
+		trustStopped(signal);
+		if (label === undefined || !options.includes(label))
+			throw new Error(`the trust question for ${question.directory} was cancelled; nothing was launched`);
+		return { label };
+	}
+}
+
+const standalone: WeakMap<ExtensionContext, TrustPrompts> = new WeakMap();
+export function localTrust(ctx: ExtensionContext, agentDir: string): TrustResolver {
+	let prompts: TrustPrompts | undefined = standalone.get(ctx);
+	if (!prompts) {
+		prompts = new TrustPrompts(ctx, agentDir, process.env.PI_UNATTENDED !== "1");
+		standalone.set(ctx, prompts);
+	}
+	const queue: TrustPrompts = prompts;
+	return (directory: string, key: string, signal?: AbortSignal): Promise<TrustDecision> =>
+		queue.ask({ directory, key, chain: [], requester: ctx.sessionManager.getSessionId() }, signal);
+}