pi-ui-extend 0.1.1

package/external/pi-tools-suite/src/lsp/_shared/config.ts

@@ -0,0 +1,156 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { findUp } from "./paths";
+import { askProjectConfigTrust, sha256 } from "./trust";
+import type { ConfigLayer, LoadedConfig, LspConfigFile, LspServerConfig, MatchableConfig } from "./types";
+
+function defaultAgentDir(): string {
+  return process.env.PI_AGENT_DIR ?? path.join(process.env.HOME ?? "", ".pi", "agent");
+}
+
+function asObject(value: unknown): Record<string, unknown> | undefined {
+  return value && typeof value === "object" && !Array.isArray(value) ? (value as Record<string, unknown>) : undefined;
+}
+
+function cleanStringArray(value: unknown): string[] | undefined {
+  if (!Array.isArray(value)) return undefined;
+  return value.filter((item): item is string => typeof item === "string");
+}
+
+function cleanStringRecord(value: unknown): Record<string, string> | undefined {
+  const object = asObject(value);
+  if (!object) return undefined;
+  const out: Record<string, string> = {};
+  for (const [key, recordValue] of Object.entries(object)) {
+    if (typeof recordValue === "string") out[key] = recordValue;
+  }
+  return out;
+}
+
+function cleanNumber(value: unknown): number | undefined {
+  return typeof value === "number" && Number.isFinite(value) ? value : undefined;
+}
+
+function cleanBoolean(value: unknown): boolean | undefined {
+  return typeof value === "boolean" ? value : undefined;
+}
+
+function cleanMatchable<T extends MatchableConfig>(object: Record<string, unknown>, extra: Omit<T, keyof MatchableConfig>): T | undefined {
+  if (typeof object.id !== "string" || object.id.trim() === "") return undefined;
+  return {
+    id: object.id,
+    enabled: cleanBoolean(object.enabled),
+    include: cleanStringArray(object.include),
+    exclude: cleanStringArray(object.exclude),
+    rootMarkers: cleanStringArray(object.rootMarkers),
+    maxFileSizeBytes: cleanNumber(object.maxFileSizeBytes),
+    ...extra,
+  } as T;
+}
+
+function parseLspItems(parsed: unknown): LspServerConfig[] {
+  const root = asObject(parsed) as LspConfigFile | undefined;
+  const servers = Array.isArray(root?.servers) ? root.servers : [];
+  const out: LspServerConfig[] = [];
+
+  for (const item of servers) {
+    const object = asObject(item);
+    if (!object) continue;
+    const bin = typeof object.bin === "string" ? object.bin : "";
+    if (object.enabled !== false && bin.trim() === "") continue;
+
+    const cleaned = cleanMatchable<LspServerConfig>(object, {
+      bin,
+      args: cleanStringArray(object.args),
+      cwd: typeof object.cwd === "string" ? object.cwd : undefined,
+      env: cleanStringRecord(object.env),
+      config: typeof object.config === "string" ? object.config : undefined,
+      languageIdByExtension: cleanStringRecord(object.languageIdByExtension),
+      startupTimeoutMs: cleanNumber(object.startupTimeoutMs),
+      diagnosticsWaitMs: cleanNumber(object.diagnosticsWaitMs),
+      initializationOptions: object.initializationOptions,
+      settings: object.settings,
+    });
+    if (cleaned) out.push(cleaned);
+  }
+
+  return out;
+}
+
+async function readJsonLayer<TItem extends MatchableConfig>(options: {
+  scope: "global" | "project";
+  filePath: string;
+  parseItems: (parsed: unknown) => TItem[];
+}): Promise<ConfigLayer<TItem> | undefined> {
+  let raw: string;
+  try {
+    raw = await fs.readFile(options.filePath, "utf8");
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return undefined;
+    throw error;
+  }
+
+  const parsed = JSON.parse(raw) as unknown;
+  return {
+    scope: options.scope,
+    path: options.filePath,
+    dir: path.dirname(options.filePath),
+    raw,
+    hash: sha256(raw),
+    items: options.parseItems(parsed),
+  };
+}
+
+function mergeLayers<TItem extends MatchableConfig>(layers: ConfigLayer<TItem>[]): TItem[] {
+  const byId = new Map<string, TItem>();
+  for (const layer of layers) {
+    for (const item of layer.items) {
+      if (item.enabled === false) {
+        byId.delete(item.id);
+        continue;
+      }
+      byId.set(item.id, item);
+    }
+  }
+  return [...byId.values()];
+}
+
+function binariesForLsp(items: LspServerConfig[]): string[] {
+  return items.map((item) => item.bin).filter(Boolean);
+}
+
+export async function loadLspConfig(ctx: ExtensionContext): Promise<LoadedConfig<LspServerConfig>> {
+  const warnings: string[] = [];
+  const layers: ConfigLayer<LspServerConfig>[] = [];
+  const globalPath = path.join(defaultAgentDir(), "lsp.json");
+
+  try {
+    const globalLayer = await readJsonLayer({ scope: "global", filePath: globalPath, parseItems: parseLspItems });
+    if (globalLayer) layers.push(globalLayer);
+  } catch (error) {
+    warnings.push(`Failed to load global lsp config: ${(error as Error).message}`);
+  }
+
+  const projectPath = findUp(ctx.cwd, path.join(".pi", "lsp.json"));
+  if (projectPath) {
+    try {
+      const projectLayer = await readJsonLayer({ scope: "project", filePath: projectPath, parseItems: parseLspItems });
+      if (projectLayer) {
+        const decision = await askProjectConfigTrust({
+          ctx,
+          kind: "lsp",
+          configPath: projectLayer.path,
+          hash: projectLayer.hash,
+          binaries: binariesForLsp(projectLayer.items),
+        });
+        if (decision.trusted) layers.push(projectLayer);
+        else warnings.push(`${projectLayer.path}: ${decision.reason ?? "project-local config rejected"}`);
+      }
+    } catch (error) {
+      warnings.push(`Failed to load project lsp config: ${(error as Error).message}`);
+    }
+  }
+
+  return { items: mergeLayers(layers), layers, warnings };
+}

package/external/pi-tools-suite/src/lsp/_shared/glob.ts

@@ -0,0 +1,60 @@
+function normalizePathForGlob(input: string): string {
+  return input.replace(/\\/g, "/").replace(/^\.\//, "");
+}
+
+function escapeRegExpChar(char: string): string {
+  return /[|\\{}()[\]^$+?.]/.test(char) ? `\\${char}` : char;
+}
+
+export function globToRegExp(pattern: string): RegExp {
+  const normalized = normalizePathForGlob(pattern);
+  let source = "^";
+
+  for (let i = 0; i < normalized.length; i += 1) {
+    const char = normalized[i];
+    const next = normalized[i + 1];
+
+    if (char === "*") {
+      if (next === "*") {
+        const after = normalized[i + 2];
+        if (after === "/") {
+          source += "(?:.*\/)?";
+          i += 2;
+        } else {
+          source += ".*";
+          i += 1;
+        }
+      } else {
+        source += "[^/]*";
+      }
+      continue;
+    }
+
+    if (char === "?") {
+      source += "[^/]";
+      continue;
+    }
+
+    source += escapeRegExpChar(char);
+  }
+
+  source += "$";
+  return new RegExp(source);
+}
+
+export function matchesGlob(pattern: string, relativePath: string): boolean {
+  const normalizedPath = normalizePathForGlob(relativePath);
+  return globToRegExp(pattern).test(normalizedPath);
+}
+
+export function matchesAnyGlob(patterns: string[] | undefined, relativePath: string): boolean {
+  if (!patterns || patterns.length === 0) return false;
+  return patterns.some((pattern) => matchesGlob(pattern, relativePath));
+}
+
+export function isPathIncluded(relativePath: string, include?: string[], exclude?: string[]): boolean {
+  const normalizedPath = normalizePathForGlob(relativePath);
+  const included = !include || include.length === 0 || matchesAnyGlob(include, normalizedPath);
+  if (!included) return false;
+  return !matchesAnyGlob(exclude, normalizedPath);
+}

package/external/pi-tools-suite/src/lsp/_shared/output.ts

@@ -0,0 +1,102 @@
+import path from "node:path";
+import type { Diagnostic, DiagnosticRelatedInformation } from "vscode-languageserver-protocol";
+import type { CommandRunResult } from "./types";
+import { normalizeRelativePath, uriToFilePath } from "./paths";
+
+const DEFAULT_OUTPUT_LIMIT = 4000;
+
+export function textFromContent(content: Array<{ type: string; text?: string }>): string {
+  return content
+    .filter((item): item is { type: "text"; text: string } => item.type === "text" && typeof item.text === "string")
+    .map((item) => item.text)
+    .join("\n");
+}
+
+export function appendTextContent<T extends Array<{ type: string; text?: string }>>(content: T, text: string): T {
+  if (!text.trim()) return content;
+  return [...content, { type: "text", text }] as T;
+}
+
+export function truncateOutput(output: string, limit = DEFAULT_OUTPUT_LIMIT): string {
+  const normalized = output.trim();
+  if (normalized.length <= limit) return normalized;
+  return `${normalized.slice(0, limit)}\n… output truncated (${normalized.length - limit} more characters)`;
+}
+
+export function commandOutput(result: Pick<CommandRunResult, "stdout" | "stderr">): string {
+  return truncateOutput([result.stdout, result.stderr].filter((part) => part.trim().length > 0).join("\n"));
+}
+
+export function formatWarnings(title: string, warnings: string[]): string {
+  if (warnings.length === 0) return "";
+  return `${title}:\n\n${warnings.map((warning) => `⚠️ ${warning}`).join("\n")}`;
+}
+
+export function formatCommandIssue(toolId: string, action: string, result: CommandRunResult): string {
+  const output = commandOutput(result);
+  const suffix = result.killed ? " (killed/timeout)" : "";
+  if (!output) return `⚠️ ${toolId} ${action} failed with exit code ${result.code}${suffix}`;
+  return `⚠️ ${toolId} ${action} failed with exit code ${result.code}${suffix}:\n${output}`;
+}
+
+export function formatDiagnosticOutput(toolId: string, output: string): string {
+  const compact = truncateOutput(output);
+  if (!compact) return `⚠️ ${toolId} found issues`;
+  return `⚠️ ${toolId} found issues:\n${compact}`;
+}
+
+function severityLabel(severity: number | undefined): string {
+  switch (severity) {
+    case 1:
+      return "error";
+    case 2:
+      return "warning";
+    case 3:
+      return "info";
+    case 4:
+      return "hint";
+    default:
+      return "diagnostic";
+  }
+}
+
+function relatedInformationSuffix(relatedInformation: DiagnosticRelatedInformation[] | undefined): string[] {
+  if (!relatedInformation || relatedInformation.length === 0) return [];
+  return relatedInformation.slice(0, 3).map((item) => {
+    let file = item.location.uri;
+    try {
+      file = uriToFilePath(item.location.uri);
+    } catch {
+      // keep URI as-is
+    }
+    return `  related: ${file}:${item.location.range.start.line + 1}:${item.location.range.start.character + 1} ${item.message}`;
+  });
+}
+
+export function formatDiagnostic(file: string, diagnostic: Diagnostic, root?: string): string {
+  const displayPath = root ? normalizeRelativePath(path.relative(root, file) || path.basename(file)) : file;
+  const line = diagnostic.range.start.line + 1;
+  const character = diagnostic.range.start.character + 1;
+  const source = diagnostic.source ? `${diagnostic.source}: ` : "";
+  const code = diagnostic.code === undefined ? "" : ` [${String(diagnostic.code)}]`;
+  const firstLine = `${displayPath}:${line}:${character} - ${severityLabel(diagnostic.severity)}: ${source}${diagnostic.message}${code}`;
+  const related = relatedInformationSuffix(diagnostic.relatedInformation);
+  return [firstLine, ...related].join("\n");
+}
+
+export function formatLspDiagnostics(serverId: string, file: string, diagnostics: Diagnostic[], root?: string): string {
+  if (diagnostics.length === 0) return "";
+  const rendered = diagnostics.slice(0, 20).map((diagnostic) => formatDiagnostic(file, diagnostic, root));
+  if (diagnostics.length > 20) rendered.push(`… ${diagnostics.length - 20} more diagnostics`);
+  return `⚠️ ${serverId}:\n${rendered.join("\n")}`;
+}
+
+export function hasIssueOutput(output: string): boolean {
+  return output.includes("⚠️");
+}
+
+export function joinSections(title: string, lines: string[]): string {
+  const nonEmpty = lines.filter((line) => line.trim().length > 0);
+  if (nonEmpty.length === 0) return "";
+  return `${title}:\n\n${nonEmpty.join("\n")}`;
+}

package/external/pi-tools-suite/src/lsp/_shared/paths.ts

@@ -0,0 +1,138 @@
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import type { CommandConfig, PathPlaceholders, ResolvedCommand } from "./types";
+import { applyTemplate, applyTemplateArray, applyTemplateRecord } from "./template";
+
+export function expandHome(input: string): string {
+  if (input === "~") return process.env.HOME ?? input;
+  if (input.startsWith("~/")) return path.join(process.env.HOME ?? "~", input.slice(2));
+  return input;
+}
+
+export function toAbsolutePath(inputPath: string, cwd: string): string {
+  const expanded = expandHome(inputPath);
+  return path.isAbsolute(expanded) ? path.normalize(expanded) : path.resolve(cwd, expanded);
+}
+
+export function normalizeRelativePath(inputPath: string): string {
+  const normalized = inputPath.split(path.sep).join("/");
+  return normalized === "" ? "." : normalized;
+}
+
+export function isSubPathOrSame(parent: string, child: string): boolean {
+  const relative = path.relative(parent, child);
+  return relative === "" || (!!relative && !relative.startsWith("..") && !path.isAbsolute(relative));
+}
+
+export function markerExists(candidateDir: string, marker: string): boolean {
+  return fs.existsSync(path.resolve(candidateDir, marker));
+}
+
+export function findProjectRoot(filePath: string, rootMarkers: string[] | undefined, fallbackRoot: string): string | undefined {
+  const absoluteFile = toAbsolutePath(filePath, fallbackRoot);
+  let dir = fs.existsSync(absoluteFile) && fs.statSync(absoluteFile).isDirectory() ? absoluteFile : path.dirname(absoluteFile);
+  const markers = rootMarkers?.filter(Boolean) ?? [];
+
+  if (markers.length === 0) {
+    return toAbsolutePath(fallbackRoot, process.cwd());
+  }
+
+  while (true) {
+    if (markers.some((marker) => markerExists(dir, marker))) {
+      return dir;
+    }
+
+    const parent = path.dirname(dir);
+    if (parent === dir) return undefined;
+    dir = parent;
+  }
+}
+
+export function findUp(startDir: string, relativeFile: string): string | undefined {
+  let dir = toAbsolutePath(startDir, process.cwd());
+  while (true) {
+    const candidate = path.join(dir, relativeFile);
+    if (fs.existsSync(candidate)) return candidate;
+    const parent = path.dirname(dir);
+    if (parent === dir) return undefined;
+    dir = parent;
+  }
+}
+
+function resolveConfigPath(config: string | undefined, root: string, baseValues: PathPlaceholders): string | undefined {
+  if (!config) return undefined;
+  const templated = applyTemplate(config, baseValues);
+  const expanded = expandHome(templated);
+  return path.isAbsolute(expanded) ? path.normalize(expanded) : path.resolve(root, expanded);
+}
+
+export function createPathPlaceholders(options: {
+  workspace: string;
+  root: string;
+  file: string;
+  config?: string;
+}): PathPlaceholders {
+  const workspace = toAbsolutePath(options.workspace, process.cwd());
+  const root = toAbsolutePath(options.root, workspace);
+  const file = toAbsolutePath(options.file, root);
+  const dir = path.dirname(file);
+  const relFile = normalizeRelativePath(path.relative(root, file));
+  const relDir = normalizeRelativePath(path.relative(root, dir));
+  const config = options.config ? toAbsolutePath(options.config, root) : "";
+  const configDir = config ? path.dirname(config) : "";
+
+  return { workspace, root, file, relFile, dir, relDir, config, configDir };
+}
+
+export function resolveExecutable(bin: string, root: string): string {
+  const expanded = expandHome(bin);
+  if (path.isAbsolute(expanded)) return path.normalize(expanded);
+  if (expanded.includes("/") || expanded.includes("\\")) return path.resolve(root, expanded);
+  return expanded;
+}
+
+export function resolveWorkingDirectory(cwd: string | undefined, root: string, values: PathPlaceholders): string {
+  if (!cwd) return root;
+  const templated = applyTemplate(cwd, values);
+  const expanded = expandHome(templated);
+  return path.isAbsolute(expanded) ? path.normalize(expanded) : path.resolve(root, expanded);
+}
+
+export function resolveCommand(id: string, command: CommandConfig, options: {
+  workspace: string;
+  root: string;
+  file: string;
+}): ResolvedCommand {
+  const baseValues = createPathPlaceholders({
+    workspace: options.workspace,
+    root: options.root,
+    file: options.file,
+  });
+  const configPath = resolveConfigPath(command.config, options.root, baseValues);
+  const values = createPathPlaceholders({
+    workspace: options.workspace,
+    root: options.root,
+    file: options.file,
+    config: configPath,
+  });
+
+  return {
+    id,
+    bin: resolveExecutable(applyTemplate(command.bin, values), options.root),
+    args: applyTemplateArray(command.args, values),
+    cwd: resolveWorkingDirectory(command.cwd, options.root, values),
+    env: applyTemplateRecord(command.env, values),
+    timeoutMs: command.timeoutMs,
+    configPath,
+    placeholders: values,
+  };
+}
+
+export function filePathToUri(filePath: string): string {
+  return pathToFileURL(path.resolve(filePath)).toString();
+}
+
+export function uriToFilePath(uri: string): string {
+  return fileURLToPath(uri);
+}

package/external/pi-tools-suite/src/lsp/_shared/runner.ts

@@ -0,0 +1,64 @@
+import fs from "node:fs";
+import path from "node:path";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import type { CommandRunResult, ResolvedCommand } from "./types";
+
+function isExecutable(filePath: string): boolean {
+  try {
+    fs.accessSync(filePath, fs.constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function pathCandidates(bin: string): string[] {
+  const pathEntries = (process.env.PATH ?? "").split(path.delimiter).filter(Boolean);
+  const extensions = process.platform === "win32" ? (process.env.PATHEXT ?? ".EXE;.CMD;.BAT;.COM").split(";") : [""];
+  const candidates: string[] = [];
+  for (const entry of pathEntries) {
+    for (const extension of extensions) {
+      candidates.push(path.join(entry, `${bin}${extension}`));
+    }
+  }
+  return candidates;
+}
+
+export function findExecutable(bin: string): string | undefined {
+  if (path.isAbsolute(bin) || bin.includes("/") || bin.includes("\\")) {
+    return isExecutable(bin) ? bin : undefined;
+  }
+  return pathCandidates(bin).find(isExecutable);
+}
+
+export function isExecutableAvailable(bin: string): boolean {
+  return !!findExecutable(bin);
+}
+
+export async function runCommand(
+  pi: ExtensionAPI,
+  command: ResolvedCommand,
+  signal?: AbortSignal,
+): Promise<CommandRunResult> {
+  const startedAt = Date.now();
+  const execOptions = {
+    cwd: command.cwd,
+    timeout: command.timeoutMs,
+    signal,
+    env: command.env ? { ...process.env, ...command.env } : undefined,
+  } as Parameters<ExtensionAPI["exec"]>[2] & { env?: NodeJS.ProcessEnv };
+
+  const result = await pi.exec(command.bin, command.args, execOptions);
+
+  return {
+    id: command.id,
+    bin: command.bin,
+    args: command.args,
+    cwd: command.cwd,
+    stdout: result.stdout,
+    stderr: result.stderr,
+    code: result.code,
+    killed: result.killed,
+    durationMs: Date.now() - startedAt,
+  };
+}

package/external/pi-tools-suite/src/lsp/_shared/template.ts

@@ -0,0 +1,23 @@
+import type { PathPlaceholders } from "./types";
+
+const PLACEHOLDER_PATTERN = /\{(workspace|root|file|relFile|dir|relDir|config|configDir)\}/g;
+
+export function applyTemplate(input: string, values: PathPlaceholders): string {
+  return input.replace(PLACEHOLDER_PATTERN, (_match, key: keyof PathPlaceholders) => values[key] ?? "");
+}
+
+export function applyTemplateArray(inputs: string[] | undefined, values: PathPlaceholders): string[] {
+  return (inputs ?? []).map((input) => applyTemplate(input, values));
+}
+
+export function applyTemplateRecord(
+  inputs: Record<string, string> | undefined,
+  values: PathPlaceholders,
+): Record<string, string> | undefined {
+  if (!inputs) return undefined;
+  const out: Record<string, string> = {};
+  for (const [key, value] of Object.entries(inputs)) {
+    out[key] = applyTemplate(value, values);
+  }
+  return out;
+}

package/external/pi-tools-suite/src/lsp/_shared/trust.ts

@@ -0,0 +1,116 @@
+import crypto from "node:crypto";
+import fs from "node:fs/promises";
+import path from "node:path";
+import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+import type { ConfigKind } from "./types";
+
+export interface TrustStore {
+  version: 1;
+  trustedHashes: string[];
+}
+
+export interface TrustDecision {
+  trusted: boolean;
+  persist: boolean;
+  reason?: string;
+}
+
+const sessionTrustedHashes = new Set<string>();
+
+function sessionTrustKey(kind: ConfigKind, hash: string): string {
+  return `${kind}:${hash}`;
+}
+
+export function sha256(content: string): string {
+  return crypto.createHash("sha256").update(content).digest("hex");
+}
+
+export function getTrustStorePath(kind: ConfigKind, agentDir = process.env.PI_AGENT_DIR ?? path.join(process.env.HOME ?? "", ".pi", "agent")): string {
+  return path.join(agentDir, "trust", `${kind}.json`);
+}
+
+async function readTrustStore(storePath: string): Promise<TrustStore> {
+  try {
+    const raw = await fs.readFile(storePath, "utf8");
+    const parsed = JSON.parse(raw) as Partial<TrustStore>;
+    return {
+      version: 1,
+      trustedHashes: Array.isArray(parsed.trustedHashes) ? parsed.trustedHashes.filter((item): item is string => typeof item === "string") : [],
+    };
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") {
+      return { version: 1, trustedHashes: [] };
+    }
+    throw error;
+  }
+}
+
+async function writeTrustStore(storePath: string, store: TrustStore): Promise<void> {
+  await fs.mkdir(path.dirname(storePath), { recursive: true });
+  await fs.writeFile(storePath, `${JSON.stringify(store, null, 2)}\n`, "utf8");
+}
+
+export async function isHashTrusted(kind: ConfigKind, hash: string): Promise<boolean> {
+  const store = await readTrustStore(getTrustStorePath(kind));
+  return store.trustedHashes.includes(hash);
+}
+
+export async function rememberTrustedHash(kind: ConfigKind, hash: string): Promise<void> {
+  const storePath = getTrustStorePath(kind);
+  const store = await readTrustStore(storePath);
+  if (!store.trustedHashes.includes(hash)) {
+    store.trustedHashes.push(hash);
+    await writeTrustStore(storePath, store);
+  }
+}
+
+function formatBinaryList(binaries: string[]): string {
+  const unique = [...new Set(binaries.filter(Boolean))];
+  if (unique.length === 0) return "  (no binaries declared)";
+  return unique.map((bin) => `  - ${bin}`).join("\n");
+}
+
+export async function askProjectConfigTrust(options: {
+  ctx: ExtensionContext;
+  kind: ConfigKind;
+  configPath: string;
+  hash: string;
+  binaries: string[];
+}): Promise<TrustDecision> {
+  if (sessionTrustedHashes.has(sessionTrustKey(options.kind, options.hash))) {
+    return { trusted: true, persist: false };
+  }
+
+  if (await isHashTrusted(options.kind, options.hash)) {
+    return { trusted: true, persist: true };
+  }
+
+  if (!options.ctx.hasUI) {
+    return { trusted: false, persist: false, reason: "project-local config rejected in non-interactive mode" };
+  }
+
+  const title = [
+    `Project-local ${options.kind} config wants to auto-run binaries.`,
+    "",
+    `Config: ${options.configPath}`,
+    `Hash: ${options.hash}`,
+    "",
+    "Binaries:",
+    formatBinaryList(options.binaries),
+    "",
+    "Trust this config?",
+  ].join("\n");
+
+  const choice = await options.ctx.ui.select(title, ["Trust once", "Trust always", "Reject"]);
+
+  if (choice === "Trust once") {
+    sessionTrustedHashes.add(sessionTrustKey(options.kind, options.hash));
+    return { trusted: true, persist: false };
+  }
+  if (choice === "Trust always") {
+    await rememberTrustedHash(options.kind, options.hash);
+    return { trusted: true, persist: true };
+  }
+
+  return { trusted: false, persist: false, reason: "project-local config rejected by user" };
+}