talos-code 0.0.1 → 0.1.0

package/dist/tui/overlays/approval-dialog.js

@@ -0,0 +1,640 @@
+import { compileRules, PATH_BOUNDARY_RULE, patternNamesOnlyAVerb } from "../../security/evaluate.js";
+import { explainPermission, simulatePermission } from "../../security/permission-explanation.js";
+import { permissionActionToRule } from "../../security/persist.js";
+import { splitGraphemes } from "../text-width.js";
+import { sliceByHeights } from "./scroll-window.js";
+import { t } from "../../i18n/index.js";
+import { lineDiff } from "../line-diff.js";
+import { isKernelTool, permissionToolFor, toolDisplay } from "../tool-display.js";
+/*
+ * R3 gate E11, owner decisions Q-R3-5/6/14. Four choices, Deny highlighted by default, so a reflexive Enter never runs
+ * anything; ↑/↓ move the highlight, Enter confirms it, a digit picks at once. "Deny always" is offered in the full review
+ * only (or /permissions). The highlighted Deny denies and lets the turn continue; Esc denies and stops the turn from the
+ * summary, and goes back from the full review. Every choice row starts at the left edge with the highlight marker or a
+ * space and then `[digit]`, where model text (always indented by TEXT_INDENT) can never start, so a command cannot forge
+ * a choice.
+ */
+export const APPROVAL_CHOICES = Object.freeze([
+    { action: 'approval-once', digit: '1', label: 'approval.choice.once' },
+    { action: 'approval-session', digit: '2', label: 'approval.choice.session' },
+    { action: 'approval-always', digit: '3', label: 'approval.choice.always' },
+    { action: 'approval-deny-once', digit: '4', label: 'approval.choice.deny' },
+]);
+export const APPROVAL_DEFAULT_SELECTED = 3;
+const SELECTED_MARKER = '›';
+function choiceText(index, selected) { const row = APPROVAL_CHOICES[index]; return `${index === selected ? SELECTED_MARKER : ' '}[${row.digit}] ${t(row.label)}`; }
+/*
+ * R3 approval key race, owner decision (binding): for APPROVAL_GRACE_MS after the dialog is first shown for a request,
+ * keys keep going to the composer (type-ahead is preserved, and a key typed in advance never answers the approval);
+ * after that the dialog takes every key, whatever the render has caught up with (app.ts reads a ref set synchronously).
+ */
+export const APPROVAL_GRACE_MS = 300;
+export function approvalInputGate(shown, now) {
+    if (!shown)
+        return 'none';
+    return now - shown.shownAt < APPROVAL_GRACE_MS ? 'grace' : 'dialog';
+}
+/* One key in the dialog → what it does. `approvalChoiceForAction` stays the one mapping from a key action to a choice. */
+export function approvalKeyOutcome(action, { expanded, selected, escape }) {
+    if (!action)
+        return { kind: 'ignore' };
+    if (action === 'approval-view')
+        return { kind: 'toggle-review' };
+    if (action === 'approval-up')
+        return { kind: 'select', selected: Math.max(0, selected - 1) };
+    if (action === 'approval-down')
+        return { kind: 'select', selected: Math.min(APPROVAL_CHOICES.length - 1, selected + 1) };
+    if (action === 'approval-confirm') {
+        const row = APPROVAL_CHOICES[selected] ?? APPROVAL_CHOICES[APPROVAL_DEFAULT_SELECTED];
+        return { kind: 'answer', choice: approvalChoiceForAction(row.action), stop: false };
+    }
+    if (action === 'approval-cancel' && escape && expanded)
+        return { kind: 'back' };
+    if (action === 'approval-cancel' || action === 'interrupt')
+        return { kind: 'answer', choice: approvalChoiceForAction(action), stop: true };
+    if (action === 'approval-deny-always' && !expanded)
+        return { kind: 'ignore' };
+    const choice = approvalChoiceForAction(action);
+    return choice ? { kind: 'answer', choice, stop: false } : { kind: 'ignore' };
+}
+// The verdict a pending approval answers. The coordinator only surfaces an engine `ask`.
+const VERDICT_BEING_ANSWERED = 'ask';
+// Mirrors `bashRuleNarrowsNothing` in security/persist.ts, which is not exported. The test
+// "the refusal shown in the preview is the persistence layer's own refusal" runs both against the
+// same commands, so a drift between the two turns that test red instead of lying on screen.
+function bashRuleNarrowsNothing(rule) { const match = /^Bash\((.*)\)$/u.exec(rule); if (!match)
+    return false; const pattern = match[1]; return pattern === '' || patternNamesOnlyAVerb(pattern); }
+function errorText(error) { return error instanceof Error ? error.message : String(error); }
+/*
+ * R2 (Q-R2-4, coordinator note to lane T): a refusal names its code ONCE. Lane E moves the code of the 8 `CODE: prose`
+ * sites from the message to `error.code`, so both shapes are read: the code from `error.code` or from the message's
+ * `CODE:` prefix, the sentence without that prefix. The code comes first, beside "refused", so it stays on the first row.
+ */
+const CODE_SHAPE = /^[A-Z][A-Z0-9_]*$/u;
+function errorCode(error) {
+    const own = error?.code;
+    if (typeof own === 'string' && CODE_SHAPE.test(own))
+        return own;
+    return /^([A-Z][A-Z0-9_]*)(?::|$)/u.exec(errorText(error))?.[1] ?? null;
+}
+export function refusalText(error) {
+    const code = errorCode(error);
+    let sentence = errorText(error).trim();
+    if (code && (sentence === code || sentence.startsWith(`${code}:`)))
+        sentence = sentence.slice(code.length + 1).trim();
+    return `would be refused${code ? ` (${code})` : ''}${sentence ? `: ${sentence}` : ''}`;
+}
+function simulateAllowAlways({ rules, action, projectRoot, persists }) {
+    if (!persists)
+        return { writes: null, refused: 'writes no rule: no configuration path is attached to this session' };
+    let rule;
+    try {
+        rule = permissionActionToRule(action, projectRoot);
+    }
+    catch (error) {
+        return { writes: null, refused: refusalText(error) };
+    }
+    if (action.tool === 'Bash' && bashRuleNarrowsNothing(rule))
+        return { writes: null, refused: `would be refused: ${rule} would narrow nothing` };
+    try {
+        return { writes: rule, simulation: simulatePermission({ rules: { ...rules, allow: [...rules.allow, rule] }, action, projectRoot }) };
+    }
+    // The rule is already printed on the line above: report the code, not the rule a second time.
+    catch (error) {
+        return { writes: rule, failure: errorCode(error) ?? errorText(error) };
+    }
+}
+// Computed ONCE, when the approval arrives, from the same rules the engine was built with. Never in
+// render: the path boundary resolves real paths, and a render runs on every keystroke. And it never
+// throws: a failure here must not stop the approval from reaching the person, it is reported instead.
+// ⛔ The account and the simulation fail SEPARATELY. Round 1 wrapped both in one try, so a command
+// with a quoted line break (whose persisted rule cannot be compiled) lost every segment row too.
+export function explainApproval({ rules, action, projectRoot, persists }) {
+    let explanation;
+    try {
+        explanation = explainPermission(compileRules(rules), action, { projectRoot });
+    }
+    catch (error) {
+        return { explanationError: errorText(error) };
+    }
+    try {
+        return { explanation, alwaysSimulation: simulateAllowAlways({ rules, action, projectRoot, persists }) };
+    }
+    catch (error) {
+        return { explanation, alwaysSimulation: { writes: null, refused: `cannot be previewed: ${errorText(error)}` } };
+    }
+}
+function segmentRows(explanation) {
+    // A single command is exactly what the summary line already says: no row adds anything to it.
+    if (explanation.segments.length < 2)
+        return [];
+    return explanation.segments.map((segment, index) => {
+        const boundary = segment.rule === PATH_BOUNDARY_RULE;
+        const decidedBy = boundary ? 'path-boundary' : segment.rule ? 'rule' : segment.effect === 'ask' ? 'no-rule' : 'built-in';
+        return { position: index + 1, operatorBefore: segment.operatorBefore, command: segment.command, effect: segment.effect, decidedBy, ...(segment.rule && !boundary ? { rule: segment.rule } : {}), reason: segment.reason, decisive: index === explanation.decisiveSegment };
+    });
+}
+// The detail is shown only while it tells the same story as the verdict being answered: same
+// effect, same rule, same decisive segment. Anything else is withheld, never shown beside it.
+function accountAgrees(pending, explanation) {
+    if (explanation.effect !== VERDICT_BEING_ANSWERED)
+        return false;
+    if ((explanation.rule ?? null) !== (pending.rule ?? null))
+        return false;
+    const segment = /^segment (\d+): /u.exec(pending.reason);
+    if (segment && Number(segment[1]) - 1 !== explanation.decisiveSegment)
+        return false;
+    return true;
+}
+function alwaysPreview(pending, simulation) {
+    if (simulation.writes === null)
+        return { writes: null, refused: simulation.refused, decidedByNewRule: false, wildcard: false, compound: false, changedSegments: [] };
+    if ('failure' in simulation)
+        return { writes: simulation.writes, failure: simulation.failure, decidedByNewRule: false, wildcard: false, compound: false, changedSegments: [] };
+    const after = simulation.simulation.explanation;
+    // The persisted rule is an ALLOW rule. An ask or deny rule can carry the very same text, and
+    // matching on text alone would credit the new rule with a decision the old one made.
+    const byNewRule = (decision) => decision.rule === simulation.writes && decision.effect === 'allow';
+    const decidedByNewRule = byNewRule(after) || after.segments.some(byNewRule);
+    // In a Bash rule `*` is literal text unless it is the whole pattern or a trailing `:*`, and the
+    // persistence layer refuses both. Every other tool matches its rule as a glob.
+    const pattern = simulation.writes.slice(simulation.writes.indexOf('(') + 1, -1);
+    const wildcard = pending.action.tool !== 'Bash' && pattern.includes('*');
+    const before = pending.explanation?.segments ?? [];
+    const changedSegments = segmentRows(after).filter((row, index) => before[index]?.effect !== row.effect || before[index]?.rule !== after.segments[index]?.rule);
+    return { writes: simulation.writes, effect: simulation.simulation.effect, decidedByNewRule, wildcard, compound: after.segments.length > 1, changedSegments };
+}
+/*
+ * R2 lane T (Q-R2-3, gate E3): the title and summary name the tool by its on-screen label ("Permission: Shell"); rule text
+ * keeps its grammar (`Bash(…)`). The TITLE is drawn from a closed set only — a kernel tool's label from the table, and
+ * only when the table judges that tool as the action being answered, otherwise the permission tool's own label: a name
+ * chosen by a model, an MCP server or a plugin author never reaches the one fixed line that starts at the left edge.
+ * The summary is model text (indented, bounded) and may carry the humanised name of a tool the kernel did not declare.
+ */
+function approvalLabel(action, name) {
+    if (isKernelTool(name) && permissionToolFor(name) === action.tool)
+        return toolDisplay(name).label;
+    return t(`tool.permission.${action.tool}`);
+}
+/*
+ * R3 gate E11 (§0.10): the full review is written for a person. It was `JSON.stringify` of the kernel payload, which put
+ * kernel keys and tool names on screen (`"tool": "scrivi"`, `"contenutoPrima": null`). Every field the kernel sends is
+ * named in English; the before/after texts become the diff below; a field this table does not know yet is still shown,
+ * under "Other details", so nothing the approval covers is hidden from the person who answers it.
+ */
+const REVIEW_SKIPPED = new Set(['tool', 'tipo', 'toolCallId', 'displayName', 'contenutoPrima', 'contenutoProposto', 'trifecta', 'path', 'percorso', 'command', 'comando', 'format', 'formato', 'url', 'serverId', 'operation', 'sensitive', 'segreto']);
+function field(payload, ...keys) { for (const key of keys) {
+    const value = payload[key];
+    if (typeof value === 'string' && value.length > 0)
+        return value;
+} return undefined; }
+function reviewText(pending, label) {
+    const payload = pending.rawPayload ?? {};
+    const lines = [`${t('approval.review.tool')}: ${label}`];
+    const add = (id, value) => { if (value !== undefined)
+        lines.push(`${t(id)}: ${value}`); };
+    add('approval.review.path', field(payload, 'path', 'percorso'));
+    add('approval.review.command', field(payload, 'command', 'comando'));
+    add('approval.review.format', field(payload, 'format', 'formato'));
+    add('approval.review.address', field(payload, 'url'));
+    add('approval.review.server', field(payload, 'serverId'));
+    add('approval.review.operation', field(payload, 'operation'));
+    const sensitive = payload.sensitive ?? payload.segreto;
+    if (sensitive && typeof sensitive === 'object') {
+        const where = field(sensitive, 'path', 'percorso');
+        lines.push(where ? t('approval.review.sensitive', { path: where }) : t('approval.review.sensitiveHidden'));
+    }
+    if (payload.trifecta === true || pending.runtimeHint === 'trifecta')
+        lines.push(t('approval.review.trifecta'));
+    const other = Object.entries(payload).filter(([key]) => !REVIEW_SKIPPED.has(key));
+    if (other.length) {
+        lines.push(`${t('approval.review.other')}:`);
+        for (const [key, value] of other)
+            lines.push(`${key}: ${typeof value === 'string' ? value : JSON.stringify(value)}`);
+    }
+    return lines.join('\n');
+}
+/* Q-R3-4: a write or an edit carries the text before and the text proposed (talosHarness.mjs:8252-8256, 8449-8451). */
+function approvalChange(pending) {
+    const payload = pending.rawPayload ?? {};
+    const proposed = payload.contenutoProposto;
+    if (typeof proposed !== 'string' || (pending.action.tool !== 'Write' && pending.action.tool !== 'Edit'))
+        return undefined;
+    const before = typeof payload.contenutoPrima === 'string' ? payload.contenutoPrima : null;
+    const diff = lineDiff(before, proposed, { path: field(payload, 'path', 'percorso') ?? 'file' });
+    const counts = before === null ? t('approval.change.newFile', { lines: diff.added }) : diff.added === 0 && diff.removed === 0 ? t('approval.change.none') : t('approval.change.counts', { added: diff.added, removed: diff.removed });
+    const rows = [...diff.model.plain, ...diff.model.files.flatMap(file => file.rows)].map(row => ({ kind: row.kind === 'add' || row.kind === 'remove' || row.kind === 'context' ? row.kind : 'meta', text: row.text }));
+    return { counts, rows };
+}
+export function approvalDialogModel(pending, input) {
+    const action = pending.action;
+    const name = pending.rawPayload?.tipo ?? pending.rawPayload?.tool;
+    const label = approvalLabel(action, name);
+    // A kernel tool's operation IS its raw name, which stays in the full review (Q-R2-3); another tool's is humanised.
+    const operation = typeof name === 'string' && action.operation === name ? (isKernelTool(name) ? undefined : toolDisplay(name).label) : action.operation;
+    const target = action.command ?? action.resource ?? [action.serverId, operation].filter(Boolean).join(':');
+    const summary = [label, target].filter(Boolean).join(' · ');
+    const fullPayload = input.expanded ? reviewText(pending, label) : summary;
+    const selected = Math.max(0, Math.min(APPROVAL_CHOICES.length - 1, Math.floor(input.selected ?? APPROVAL_DEFAULT_SELECTED)));
+    const questionId = `approval.question.${action.tool}`;
+    const question = t(questionId in QUESTION_IDS ? questionId : 'approval.question');
+    /* Q-R3-13 (R0 decision 4): a command approval on a host with no verified sandbox says so in its title. */
+    const title = t('tool.approval.title', { label }) + (input.unsandboxed === true && action.tool === 'Bash' ? ` ${t('approval.unsandboxed')}` : '');
+    const change = approvalChange(pending);
+    const ruleLine = pending.rule === PATH_BOUNDARY_RULE ? 'decided by the path boundary' : pending.rule ? `rule ${pending.rule}` : undefined;
+    const explanation = pending.explanation;
+    let segments = [];
+    let segmentsWithheld;
+    if (explanation) {
+        const rows = segmentRows(explanation);
+        if (rows.length && !accountAgrees(pending, explanation))
+            segmentsWithheld = 'explanation unavailable: the account disagreed with the decision (possible race)';
+        else
+            segments = rows;
+    }
+    return {
+        title, summary, fullPayload, expanded: input.expanded, reason: pending.reason, ...(pending.rule ? { rule: pending.rule } : {}), ...(pending.runtimeHint ? { runtimeHint: pending.runtimeHint } : {}),
+        ...(ruleLine ? { ruleLine } : {}), segments, ...(segmentsWithheld ? { segmentsWithheld } : {}), ...(pending.explanationError ? { explanationError: pending.explanationError } : {}),
+        ...(input.expanded && pending.alwaysSimulation ? { alwaysPreview: alwaysPreview(pending, pending.alwaysSimulation) } : {}),
+        question, selected, ...(change ? { change } : {}),
+    };
+}
+const QUESTION_IDS = { 'approval.question.Bash': true, 'approval.question.Write': true, 'approval.question.Edit': true, 'approval.question.Read': true, 'approval.question.WebFetch': true, 'approval.question.Mcp': true, 'approval.question.Hook': true, 'approval.question.Plugin': true, 'approval.question.TalosService': true };
+/*
+ * Every character that moves the cursor, ends a line, drives the terminal or renders as nothing is
+ * shown as its code point instead of being written. Same convention as slice 14's human error line
+ * (`\uXXXX` over C0, DEL, C1 — U+0085 NEL and U+009B CSI included — U+2028 and U+2029), extended
+ * with the whole Unicode Bidi_Control set and every Default_Ignorable_Code_Point (zero-width
+ * characters, word joiner, tag characters, variation selectors): a dialog that asks for consent
+ * must not contain text the person cannot see. ESC is C0, so no SGR, OSC or CSI sequence survives.
+ * Nothing is dropped: a hidden character becomes a visible one.
+ */
+const TERMINAL_UNSAFE = /[\x5c\x00-\x1f\x7f-\x9f\u2028\u2029\p{Bidi_Control}\p{Default_Ignorable_Code_Point}]/gu;
+// Round 3: the backslash is escaped too. Without it, a real ESC made inert and a command that
+// literally contains the six characters of that escape rendered byte-identically, which teaches a
+// person to read escapes as noise. The full review is JSON, whose own escaping already doubles every
+// backslash, so there the backslash is left exactly as JSON wrote it.
+const BACKSLASH = String.fromCharCode(92);
+export function inertText(value, { json = false } = {}) {
+    return value.replace(TERMINAL_UNSAFE, character => {
+        if (character === BACKSLASH)
+            return json ? BACKSLASH : BACKSLASH + BACKSLASH;
+        const code = character.codePointAt(0);
+        return code > 0xffff ? `${BACKSLASH}u{${code.toString(16)}}` : `${BACKSLASH}u${code.toString(16).padStart(4, '0')}`;
+    });
+}
+const EFFECT_WIDTH = 5;
+const COMMAND_WIDTH_CAP = 32;
+const COLUMN_GAP = 2;
+// Free text derived from the model is indented by this much, so none of its lines, wrapped or not,
+// can start at the left edge where a row starts.
+const TEXT_INDENT = 2;
+const PRECEDENCE_HEADER = 'Segments in execution order; the strictest decides (deny > ask > allow):';
+// `summaryReason` is the engine's reason printed right above the rows. The decisive row already IS
+// that sentence ("segment N: …"), so it names its decider without printing the sentence twice.
+function deciderText(row, summaryReason) {
+    const said = row.decisive && summaryReason === `segment ${row.position}: ${row.reason}`;
+    const detail = (label) => said ? label : `${label}: ${row.reason}`;
+    if (row.decidedBy === 'path-boundary')
+        return detail('path boundary');
+    if (row.decidedBy === 'rule')
+        return row.reason === `matched ${row.effect} rule` ? `rule ${row.rule}` : detail(`rule ${row.rule}`);
+    if (row.decidedBy === 'built-in')
+        return detail('built-in');
+    return row.reason;
+}
+/*
+ * Round 3 — MODEL TEXT HAS A HEIGHT LIMIT.
+ *
+ * Measured by the adversarial review and reproduced through the real TuiApp at 80x24: a single-segment
+ * `curl … | sh` whose second argument was NBSP filler sized to the terminal height, followed by a
+ * forged dialog, pushed the real title off the visible screen and drew a whole forged
+ * `Permission: Bash / Segments… / >2 ask && npm test / [1] once…` block, at the very indent of the
+ * real reason and summary. Indentation cannot tell the two apart, and styling disappears with colour
+ * off, so the defence is HEIGHT: collapsed, every piece of model-derived text takes at most
+ * COLLAPSED_TEXT_LINES rendered lines, the last of which says how much was cut. The title, the
+ * precedence header, every row and the key line always render; `v` shows everything.
+ *
+ * The wrapping is done here and not by Ink, so the number of lines is known before rendering: each
+ * wrapped piece is its own Text with `truncate-end`, which can shorten a line but never add one.
+ */
+// Width is measured CONSERVATIVELY: printable ASCII is one column, every other grapheme two. Ink
+// measures with string-width, which this CLI does not depend on, and the TUI's own displayWidth reads
+// 8,451 single code points narrower than Ink does (measured: U+2630 and up, keycap sequences, flags).
+// Measuring too wide only makes a line shorter; measuring too narrow would let Ink cut the end of a
+// line without the cut marker saying so.
+const PRINTABLE_ASCII = /^[\x20-\x7e]$/u;
+export function conservativeCells(text) { let total = 0; for (const grapheme of splitGraphemes(text))
+    total += PRINTABLE_ASCII.test(grapheme) ? 1 : 2; return total; }
+const COLLAPSED_TEXT_LINES = 3;
+const BORDER_WIDTH = 2;
+const MIN_COMMAND_COLUMN = 8;
+// Word wrap that loses nothing: the lines concatenate back to the text exactly. A word that does not
+// fit the rest of the line moves to the next one; a word longer than a whole line fills the current
+// line and is broken inside, as Ink's own wrap does, so no line is wasted before a hard break.
+export function wrapToWidth(text, width) {
+    const limit = Math.max(1, width);
+    const lines = [];
+    let line = '';
+    let used = 0;
+    const breakInside = (token) => { for (const grapheme of splitGraphemes(token)) {
+        const cells = conservativeCells(grapheme);
+        if (line !== '' && used + cells > limit) {
+            lines.push(line);
+            line = '';
+            used = 0;
+        }
+        line += grapheme;
+        used += cells;
+    } };
+    for (const token of text.split(/( +)/u)) {
+        if (token === '')
+            continue;
+        const cells = conservativeCells(token);
+        if (used + cells <= limit) {
+            line += token;
+            used += cells;
+            continue;
+        }
+        if (token.startsWith(' ') || cells > limit) {
+            breakInside(token);
+            continue;
+        }
+        if (line !== '') {
+            lines.push(line);
+            line = '';
+            used = 0;
+        }
+        line = token;
+        used = cells;
+    }
+    if (line !== '' || !lines.length)
+        lines.push(line);
+    return lines;
+}
+function cutMarker(hiddenCharacters, width) {
+    const count = hiddenCharacters.toLocaleString('en-US');
+    for (const marker of [`… ${count} more characters — press v to review in full`, `… ${count} more — press v`, `… ${count} more`])
+        if (conservativeCells(marker) <= width)
+            return marker;
+    return '…';
+}
+// `limit` null means the full review: nothing is cut.
+function boundedLines(text, width, limit) {
+    const lines = wrapToWidth(text, width);
+    if (limit === null || lines.length <= limit)
+        return lines;
+    const kept = lines.slice(0, limit - 1);
+    return [...kept, cutMarker([...lines.slice(limit - 1).join('')].length, width)];
+}
+function segmentLines(rows, summaryReason, tone, inner, limit) {
+    const commands = rows.map(row => inertText(row.operatorBefore && row.operatorBefore !== 'newline' ? `${row.operatorBefore} ${row.command}` : row.command));
+    const commandWidth = Math.min(COMMAND_WIDTH_CAP, Math.max(...commands.map(command => conservativeCells(command))));
+    // The position is padded on the right, never the left: the digit always sits right after the marker.
+    const digits = String(Math.max(...rows.map(row => row.position))).length;
+    const gutterWidth = 1 + digits + 1 + EFFECT_WIDTH + COLUMN_GAP;
+    // Explicit column widths, computed once for every row: left to flex layout, each row shrank its own
+    // columns by its own content and the rule column started somewhere else on every row.
+    const available = Math.max(0, inner - gutterWidth);
+    const commandColumn = Math.max(MIN_COMMAND_COLUMN, Math.min(commandWidth + COLUMN_GAP, Math.floor(available / 2)));
+    const deciderColumn = Math.max(1, available - commandColumn);
+    return rows.map((row, index) => {
+        const gutter = `${row.decisive ? '>' : ' '}${String(row.position).padEnd(digits)} ${row.effect.padEnd(EFFECT_WIDTH)}`;
+        const commandLines = boundedLines(commands[index], commandColumn - COLUMN_GAP, limit);
+        const deciderLines = boundedLines(inertText(deciderText(row, summaryReason)), deciderColumn, limit);
+        return { kind: 'row', tone, gutter, gutterWidth, commandLines, commandColumn, deciderLines, deciderColumn, text: `${gutter.padEnd(gutterWidth)}${commandLines.join('').padEnd(commandWidth + COLUMN_GAP)}${deciderLines.join('')}` };
+    });
+}
+function fixedLine(text, tone, indent) { return { kind: 'text', text: inertText(text), tone, indent, modelText: false }; }
+function modelLines(text, tone, inner, limit, { json = false } = {}) {
+    return boundedLines(inertText(text, { json }), inner - TEXT_INDENT, limit).map(piece => ({ kind: 'text', text: piece, tone, indent: TEXT_INDENT, modelText: true }));
+}
+// The exact lines the TUI renders, in order, already made inert. The terminal only maps a tone to a
+// style and a row to its columns.
+export function approvalDialogLines(model, { columns = 80 } = {}) {
+    const inner = Math.max(1, columns - BORDER_WIDTH);
+    const limit = model.expanded ? null : COLLAPSED_TEXT_LINES;
+    const lines = [fixedLine(model.title, 'title', 0), ...modelLines(model.reason, 'plain', inner, limit)];
+    if (model.ruleLine)
+        lines.push(...modelLines(model.ruleLine, 'dim', inner, limit));
+    if (model.segments.length) {
+        lines.push(fixedLine(PRECEDENCE_HEADER, 'dim', 0));
+        lines.push(...segmentLines(model.segments, model.reason, 'plain', inner, limit));
+    }
+    if (model.segmentsWithheld)
+        lines.push(fixedLine(model.segmentsWithheld, 'dim', TEXT_INDENT));
+    if (model.explanationError)
+        lines.push(...modelLines(`per-segment account unavailable: ${model.explanationError}`, 'dim', inner, limit));
+    // R3 E11: the full review is one field per line (reviewText), and a field's own line breaks stay data: each field is made
+    // inert on its own, so a value can never open a line of its own. Collapsed, the payload IS the command.
+    if (model.expanded)
+        for (const reviewLine of model.fullPayload.split('\n'))
+            lines.push(...modelLines(reviewLine, 'plain', inner, limit));
+    else
+        lines.push(...modelLines(model.fullPayload, 'plain', inner, limit));
+    if (model.change)
+        lines.push(...changeLines(model.change, inner, model.expanded));
+    const preview = model.alwaysPreview;
+    if (preview) {
+        if (preview.writes === null)
+            lines.push(...modelLines(`[3] always ${preview.refused}`, 'dim', inner, limit));
+        else {
+            lines.push(...modelLines(`[3] always writes ${preview.writes}`, 'dim', inner, limit));
+            if (preview.failure !== undefined)
+                lines.push(...modelLines(`    that rule cannot be evaluated: ${preview.failure}`, 'dim', inner, limit));
+            else {
+                if (preview.wildcard)
+                    lines.push(fixedLine('    wildcard: this rule covers more than this request', 'dim', TEXT_INDENT));
+                const outcome = preview.decidedByNewRule ? `${preview.effect} by this rule` : `still ${preview.effect}: the rule ${preview.compound ? 'matches no segment' : 'does not decide this request'}`;
+                lines.push(fixedLine(`    with that rule this command is: ${outcome}`, 'dim', TEXT_INDENT));
+                if (preview.changedSegments.length)
+                    lines.push(...segmentLines(preview.changedSegments, '', 'dim', inner, limit));
+            }
+        }
+    }
+    lines.push(...controlLines(model));
+    return lines;
+}
+/* Q-R3-4: the diff of a write or an edit, model text (indented, inert). Collapsed it is bounded; `v` shows all of it. */
+const CHANGE_SUMMARY_ROWS = 12;
+function changeLines(change, inner, expanded) {
+    const out = [{ kind: 'text', text: inertText(change.counts), tone: 'dim', indent: TEXT_INDENT, modelText: true }];
+    const rows = expanded ? change.rows : change.rows.slice(0, CHANGE_SUMMARY_ROWS);
+    for (const row of rows) {
+        const prefix = row.kind === 'add' ? '+ ' : row.kind === 'remove' ? '- ' : row.kind === 'context' ? '  ' : '';
+        const tone = row.kind === 'add' ? 'add' : row.kind === 'remove' ? 'remove' : 'dim';
+        for (const piece of wrapToWidth(inertText(prefix + row.text), Math.max(1, inner - TEXT_INDENT)))
+            out.push({ kind: 'text', text: piece, tone, indent: TEXT_INDENT, modelText: true });
+    }
+    if (!expanded && change.rows.length > CHANGE_SUMMARY_ROWS)
+        out.push({ kind: 'text', text: t('approval.change.more', { count: change.rows.length - CHANGE_SUMMARY_ROWS }), tone: 'dim', indent: TEXT_INDENT, modelText: true });
+    return out;
+}
+/* The question, the four choices (the highlighted one marked) and the keys. Fixed text: every row starts at the left edge. */
+function controlLines(model) {
+    return [
+        fixedLine(model.question, 'plain', 0),
+        ...APPROVAL_CHOICES.map((_, index) => fixedLine(choiceText(index, model.selected), index === model.selected ? 'selected' : 'plain', 0)),
+        fixedLine(t(model.expanded ? 'approval.hint.review' : 'approval.hint.summary'), 'dim', 0),
+    ];
+}
+/* When the height is short, the same choices on as few rows as the width allows; all of them, and the deny path, stay.
+   Items are packed whole (a choice is never split across two rows unless it is wider than a row); the question goes
+   first when there is room for it. */
+function compactControlLines(model, inner, { question }) {
+    const items = [...(question ? [model.question] : []), ...APPROVAL_CHOICES.map((_, index) => choiceText(index, model.selected).trimStart()), model.expanded ? `[5] ${t('approval.choice.denyAlways')}` : t('approval.hint.compact')].map(item => inertText(item));
+    const width = Math.max(1, inner), rows = [];
+    let row = '';
+    for (const item of items) {
+        const joined = row ? `${row}  ${item}` : item;
+        if (conservativeCells(joined) <= width) {
+            row = joined;
+            continue;
+        }
+        if (row)
+            rows.push(row);
+        if (conservativeCells(item) <= width) {
+            row = item;
+            continue;
+        }
+        const pieces = wrapToWidth(item, width);
+        rows.push(...pieces.slice(0, -1));
+        row = pieces.at(-1) ?? '';
+    }
+    if (row)
+        rows.push(row);
+    return rows.map(text => ({ kind: 'text', text, tone: 'plain', indent: 0, modelText: false }));
+}
+const CONTROL_ROWS = APPROVAL_CHOICES.length + 2;
+function approvalLineHeight(line) { return line.kind === 'row' ? Math.max(1, line.commandLines.length, line.deciderLines.length) : 1; }
+function clippedApprovalLine(line, height) {
+    if (line.kind === 'text' || approvalLineHeight(line) <= height)
+        return line;
+    return { ...line, commandLines: line.commandLines.slice(0, height), deciderLines: line.deciderLines.slice(0, height) };
+}
+function oneModelLine(text, tone, inner) {
+    return modelLines(text, tone, inner, 1)[0] ?? fixedLine('', tone, TEXT_INDENT);
+}
+export function approvalDialogViewport(model, { columns = 80, rows = 12, scrollOffset = 0 } = {}) {
+    const all = approvalDialogLines(model, { columns });
+    const budget = Math.max(6, Math.floor(rows));
+    const total = all.reduce((sum, line) => sum + approvalLineHeight(line), 0);
+    if (total <= budget)
+        return { lines: all, offset: 0, maxOffset: 0 };
+    const inner = Math.max(1, columns - BORDER_WIDTH);
+    const decisive = model.segments.find(row => row.decisive);
+    const operation = decisive ? `${decisive.effect}: ${decisive.command}` : model.summary;
+    const firstPayloadField = model.expanded ? model.fullPayload.split('\n').find(line => { const value = line.trim(); return value !== '' && value !== '{' && value !== '}'; }) : undefined;
+    const header = [fixedLine(model.title, 'title', 0), oneModelLine(model.reason, 'plain', inner), oneModelLine(operation, 'plain', inner), ...(firstPayloadField ? [oneModelLine(firstPayloadField, 'dim', inner)] : [])];
+    const controls = compactControlLines(model, inner, { question: false });
+    const body = all.slice(1, all.length - CONTROL_ROWS);
+    const reserved = header.length + controls.length + (model.expanded ? 1 : 0);
+    /* R3 E11: the header already carries the reason and the operation, so a short view may show no body line at all. */
+    const bodyBudget = Math.max(0, budget - reserved);
+    let used = 0, maxOffset = body.length;
+    for (let index = body.length - 1; index >= 0; index -= 1) {
+        const height = approvalLineHeight(body[index]);
+        if (used + height > bodyBudget)
+            break;
+        used += height;
+        maxOffset = index;
+    }
+    const offset = Math.max(0, Math.min(maxOffset, Math.floor(Number.isFinite(scrollOffset) ? scrollOffset : 0)));
+    const visible = [];
+    used = 0;
+    for (let index = offset; index < body.length; index += 1) {
+        const line = body[index], height = approvalLineHeight(line);
+        if (used + height > bodyBudget) {
+            if (visible.length === 0 && bodyBudget > 0)
+                visible.push(clippedApprovalLine(line, bodyBudget));
+            break;
+        }
+        visible.push(line);
+        used += height;
+    }
+    const scroll = model.expanded ? fixedLine(`Review ${offset + 1}/${maxOffset + 1} · PgUp/PgDn scroll`, 'dim', 0) : null;
+    return { lines: [...header, ...(scroll ? [scroll] : []), ...visible, ...controls], offset, maxOffset };
+}
+function wrappedFixed(text, tone, width, indent = 0) {
+    return wrapToWidth(inertText(text), Math.max(1, width - indent)).map(piece => ({ kind: 'text', text: piece, tone, indent, modelText: false }));
+}
+// One row, cut with `…` when longer: a header row only names the operation; the preview below is where it is read.
+function oneRow(text, tone, width) {
+    const limit = Math.max(1, width - TEXT_INDENT), pieces = wrapToWidth(inertText(text), limit);
+    let row = pieces[0] ?? '';
+    if (pieces.length > 1) {
+        const graphemes = splitGraphemes(row);
+        while (graphemes.length && conservativeCells(graphemes.join('') + '…') > limit)
+            graphemes.pop();
+        row = graphemes.join('') + '…';
+    }
+    return { kind: 'text', text: row, tone, indent: TEXT_INDENT, modelText: true };
+}
+export function approvalDialogFit(model, { columns = 80, maxRows, scrollOffset = 0 } = {}) {
+    const border = maxRows === undefined || maxRows >= 4;
+    const inner = Math.max(1, columns - (border ? BORDER_WIDTH : 0));
+    const budget = maxRows === undefined ? Number.POSITIVE_INFINITY : Math.max(0, Math.floor(maxRows) - (border ? 2 : 0));
+    const all = approvalDialogLines(model, { columns: inner + BORDER_WIDTH });
+    const exact = (line) => line.kind === 'text' && !line.modelText ? wrappedFixed(line.text, line.tone, inner, line.indent) : [line];
+    const title = exact(all[0]).slice(0, 1);
+    const body = all.slice(1, all.length - CONTROL_ROWS).flatMap(exact);
+    /* R3 E11: the question and the four choices on their own rows while at least the title and the operation fit above
+       them; below that, the same choices on as few rows as the width allows. Every choice and the deny path stay. */
+    const fullControls = all.slice(all.length - CONTROL_ROWS).flatMap(exact);
+    const withQuestion = compactControlLines(model, inner, { question: true });
+    const controls = budget - fullControls.length >= 2 ? fullControls : budget - withQuestion.length >= 1 ? withQuestion : compactControlLines(model, inner, { question: false });
+    const heights = body.map(approvalLineHeight), bodyRows = heights.reduce((sum, value) => sum + value, 0);
+    const total = title.length + bodyRows + controls.length;
+    const compact = controls !== fullControls;
+    if (total <= budget)
+        return { lines: [...title, ...body, ...controls], rows: total, offset: 0, maxOffset: 0, below: 0, border, compact };
+    let left = budget;
+    const keep = (lines) => { const taken = lines.slice(0, Math.max(0, left)); left -= taken.length; return taken; };
+    const shownControls = keep(controls), shownTitle = keep(title);
+    const decisive = model.segments.find(row => row.decisive);
+    const operation = keep([oneRow(decisive ? `${decisive.effect}: ${decisive.command}` : model.summary, 'plain', inner)]);
+    let marker = left >= 1 ? 1 : 0;
+    left -= marker;
+    const reason = left >= 3 ? keep([oneRow(model.reason, 'plain', inner)]) : [];
+    const scroll = model.expanded && left >= 3 ? 1 : 0;
+    left -= scroll;
+    const view = sliceByHeights(heights, { budget: left + marker, offset: scrollOffset });
+    // The whole preview fits once the marker row is given back to it: nothing is cut, nothing is announced.
+    if (view.above === 0 && view.below === 0 && view.clip === null) {
+        left += marker;
+        marker = 0;
+    }
+    const visible = [];
+    for (let index = view.start; index < view.end && left > 0; index++) {
+        const line = body[index], height = approvalLineHeight(line);
+        visible.push(height <= left ? line : clippedApprovalLine(line, left));
+        left -= Math.min(height, left);
+    }
+    const below = heights.slice(view.start + visible.length).reduce((sum, value) => sum + value, 0) + (visible.length ? approvalLineHeight(body[view.start + visible.length - 1]) - approvalLineHeight(visible.at(-1)) : 0);
+    const hint = model.expanded ? 'PgDn scrolls' : 'press v to review in full';
+    const more = marker && below > 0 ? [fixedLine(`… ${below} more line${below === 1 ? '' : 's'} · ${hint}`, 'dim', 0)] : [];
+    const review = scroll ? [fixedLine(`Review ${view.start + 1}/${view.maxOffset + 1} · PgUp/PgDn scroll`, 'dim', 0)] : [];
+    const lines = [...shownTitle, ...reason, ...operation, ...review, ...visible, ...more, ...shownControls].map(line => line.kind === 'text' && !line.modelText ? { ...line, text: wrapToWidth(line.text, Math.max(1, inner - line.indent))[0] ?? '' } : line);
+    return { lines, rows: lines.reduce((sum, line) => sum + approvalLineHeight(line), 0), offset: view.start, maxOffset: view.maxOffset, below: marker ? below : 0, border, compact };
+}
+// The dialog as Ink elements. Model text arrives already wrapped: one Text per terminal line, cut
+// rather than wrapped by Ink, so its height is exactly what the viewport decided. With `maxRows` every
+// row is pre-wrapped (approvalDialogFit), so every text row is cut, never wrapped.
+export function renderApprovalDialog(h, Ink, model, { accentColor, columns = 80, rows, maxRows, scrollOffset = 0 } = {}) {
+    const fitted = maxRows === undefined ? null : approvalDialogFit(model, { columns, maxRows, scrollOffset });
+    const lines = fitted ? fitted.lines : rows === undefined ? approvalDialogLines(model, { columns }) : approvalDialogViewport(model, { columns, rows, scrollOffset }).lines;
+    return h(Ink.Box, fitted && !fitted.border ? { flexDirection: 'column', flexShrink: 0 } : { borderStyle: 'round', flexDirection: 'column', ...(fitted ? { flexShrink: 0 } : {}) }, ...lines.map((line, index) => {
+        const style = line.tone === 'title' ? { bold: true, color: accentColor } : line.tone === 'dim' ? { dimColor: true } : line.tone === 'selected' ? { bold: true, color: accentColor } : line.tone === 'add' ? { color: 'green' } : line.tone === 'remove' ? { color: 'red' } : {};
+        const piece = (text, key) => h(Ink.Text, { ...style, key, wrap: 'truncate-end' }, text);
+        if (line.kind === 'text')
+            return h(Ink.Box, { key: index, paddingLeft: line.indent }, line.modelText || fitted ? piece(line.text, 0) : h(Ink.Text, style, line.text));
+        return h(Ink.Box, { key: index, flexDirection: 'row' }, h(Ink.Box, { width: line.gutterWidth, flexShrink: 0 }, h(Ink.Text, style, line.gutter)), 
+        // The gap is padding, not width: a hard-wrapped command must never touch the rule beside it.
+        h(Ink.Box, { width: line.commandColumn, paddingRight: COLUMN_GAP, flexShrink: 0, flexDirection: 'column' }, ...line.commandLines.map(piece)), h(Ink.Box, { width: line.deciderColumn, flexShrink: 0, flexDirection: 'column' }, ...line.deciderLines.map(piece)));
+    }));
+}
+const APPROVAL_ACTIONS = {
+    'approval-once': 'allow-once', 'approval-session': 'allow-session', 'approval-always': 'allow-always',
+    'approval-deny-once': 'deny-once', 'approval-deny-always': 'deny-always', 'approval-cancel': 'deny-once', 'interrupt': 'deny-once',
+};
+export function approvalChoiceForAction(action) { return APPROVAL_ACTIONS[action]; }