vigthoria-cli 1.13.20 → 1.13.23

package/dist/utils/session.js

@@ -5,28 +5,11 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import * as os from 'os';
-import { atomicWriteJson, secureFileMode } from './cli-state.js';
-function createSessionLoadError(message, details) {
-    return {
-        code: 'SESSION_LOAD_FAILED',
-        message,
-        details,
-        isCritical: true,
-    };
-}
-function normalizeAuthState(raw) {
-    if (!raw || typeof raw !== 'object') {
-        return { token: null, expiresAt: null, isValid: false };
-    }
-    const source = raw.auth && typeof raw.auth === 'object' ? raw.auth : raw;
-    const rawToken = source.token ?? source.accessToken ?? source.jwt ?? null;
-    const rawExpiresAt = source.expiresAt ?? null;
-    const token = typeof rawToken === 'string' && rawToken.trim().length > 0 ? rawToken.trim() : null;
-    const expiresAt = typeof rawExpiresAt === 'number' && Number.isFinite(rawExpiresAt) ? rawExpiresAt : null;
-    const session = { token, expiresAt, isValid: false };
-    session.isValid = validateSession(session, { silent: true });
-    return session;
-}
+import { createHash, randomUUID } from 'crypto';
+import { secureFileMode } from './cli-state.js';
+import { redactSensitiveText } from './secret-policy.js';
+import { Config } from './config.js';
+import { DurableJsonStore } from './durable-json.js';
 /**
  * Validate persisted authentication state without assuming any field is present.
  *
@@ -68,27 +51,19 @@ export function validateSession(session, options = {}) {
  * exception.  Callers that need a hard failure can inspect ``isValid``.
  */
 export async function loadSession() {
-    const configDir = path.join(os.homedir(), '.vigthoria');
-    const candidateFiles = [
-        path.join(configDir, 'auth.json'),
-        path.join(configDir, 'session.json'),
-        path.join(configDir, 'config.json'),
-    ];
-    const sessionFile = candidateFiles.find((filePath) => {
-        try {
-            return fs.existsSync(filePath);
-        }
-        catch {
-            return false;
-        }
-    });
-    if (!sessionFile) {
-        return { token: null, expiresAt: null, isValid: false };
-    }
     try {
-        const content = fs.readFileSync(sessionFile, 'utf-8');
-        const parsed = JSON.parse(content);
-        return normalizeAuthState(parsed);
+        const token = new Config().get('authToken');
+        if (!token)
+            return { token: null, expiresAt: null, isValid: false };
+        const segments = token.split('.');
+        if (segments.length !== 3) {
+            // Opaque credentials were server-accepted before persistence. Their
+            // expiry cannot be inferred locally and is revalidated at the gateway.
+            return { token, expiresAt: null, isValid: true };
+        }
+        const payload = JSON.parse(Buffer.from(segments[1], 'base64url').toString('utf8'));
+        const expiresAt = typeof payload.exp === 'number' && Number.isFinite(payload.exp) ? payload.exp * 1000 : null;
+        return { token, expiresAt, isValid: expiresAt !== null && expiresAt > Date.now() };
     }
     catch (error) {
         if (process.env.VIGTHORIA_DEBUG === '1') {
@@ -97,8 +72,25 @@ export async function loadSession() {
         return { token: null, expiresAt: null, isValid: false };
     }
 }
+const AGENT_STATUS_TRANSITIONS = {
+    submitted: new Set(['running', 'completed', 'failed', 'cancelled']),
+    retry: new Set(['running', 'completed', 'failed', 'cancelled']),
+    continue: new Set(['running', 'completed', 'failed', 'cancelled']),
+    running: new Set(['completed', 'failed', 'cancelled']),
+    completed: new Set(['retry', 'continue']),
+    failed: new Set(['retry', 'continue', 'cancelled']),
+    cancelled: new Set(['retry', 'continue']),
+};
+export function assertAgentStatusTransition(from, to) {
+    if (from === to)
+        return;
+    if (!AGENT_STATUS_TRANSITIONS[from]?.has(to)) {
+        throw new Error(`Invalid agent execution transition: ${from} -> ${to}`);
+    }
+}
 export class SessionManager {
     sessionsDir;
+    indexStore;
     compactThreshold = 40;
     retainRecentMessages = 18;
     /** Keep at most this many session files on disk per CLI install. */
@@ -107,34 +99,136 @@ export class SessionManager {
     retentionWindowMs = 90 * 24 * 60 * 60 * 1000;
     /** Avoid running prune on every save — at most once per CLI process. */
     prunedThisProcess = false;
-    constructor() {
-        this.sessionsDir = path.join(os.homedir(), '.vigthoria', 'sessions');
+    constructor(stateRoot) {
+        this.sessionsDir = path.join(stateRoot || os.homedir(), '.vigthoria', 'sessions');
         this.ensureDir();
+        this.indexStore = new DurableJsonStore({
+            filePath: path.join(this.sessionsDir, 'index.json'),
+            schemaVersion: 1,
+            defaultValue: () => ({ sessions: {} }),
+            validate: (value) => Boolean(value && typeof value === 'object'
+                && value.sessions
+                && typeof value.sessions === 'object'),
+            migrate: (value) => value && typeof value === 'object' && value.sessions
+                ? value
+                : { sessions: {} },
+        });
     }
-    ensureDir() {
+    workspaceSessionsDir(project) {
+        const candidate = String(project || '').trim();
+        if (!candidate || !path.isAbsolute(candidate))
+            return null;
         try {
-            if (!fs.existsSync(this.sessionsDir)) {
-                fs.mkdirSync(this.sessionsDir, { recursive: true, mode: 0o700 });
-            }
-            if (process.platform !== 'win32') {
-                try {
-                    fs.chmodSync(this.sessionsDir, 0o700);
-                }
-                catch { /* best-effort */ }
+            if (!fs.existsSync(candidate) || !fs.statSync(candidate).isDirectory())
+                return null;
+        }
+        catch {
+            return null;
+        }
+        try {
+            const realWorkspace = fs.realpathSync(candidate);
+            const sessionsCandidate = path.join(realWorkspace, '.vigthoria', 'sessions');
+            const vigthoriaCandidate = path.dirname(sessionsCandidate);
+            if (fs.existsSync(vigthoriaCandidate)) {
+                const realVigthoria = fs.realpathSync(vigthoriaCandidate);
+                if (realVigthoria !== path.join(realWorkspace, '.vigthoria'))
+                    return null;
             }
+            return sessionsCandidate;
         }
-        catch (error) {
-            if (error?.code === 'EACCES' || error?.code === 'EPERM') {
-                this.sessionsDir = path.join(os.tmpdir(), 'vigthoria-sessions');
-                try {
-                    if (!fs.existsSync(this.sessionsDir)) {
-                        fs.mkdirSync(this.sessionsDir, { recursive: true });
-                    }
-                }
-                catch {
-                    // If even tmpdir is unwritable we'll fail at write time with a useful error.
+        catch {
+            return null;
+        }
+    }
+    sessionStore(filePath, fallback) {
+        return new DurableJsonStore({
+            filePath,
+            schemaVersion: 3,
+            defaultValue: () => fallback,
+            validate: (value) => Boolean(value && typeof value === 'object'
+                && typeof value.id === 'string'
+                && typeof value.project === 'string'
+                && Array.isArray(value.messages)),
+            migrate: (value) => {
+                if (!value || typeof value !== 'object')
+                    throw new Error('Session is not an object.');
+                const legacy = value;
+                if (!legacy.id || !legacy.project || !Array.isArray(legacy.messages))
+                    throw new Error('Session identity is incomplete.');
+                if (legacy.activeAgentRun) {
+                    const allowed = new Set(['submitted', 'retry', 'continue', 'running', 'completed', 'failed', 'cancelled']);
+                    if (!allowed.has(legacy.activeAgentRun.status))
+                        legacy.activeAgentRun.status = 'failed';
                 }
+                return this.ensureMessageIds(legacy);
+            },
+        });
+    }
+    ensureMessageIds(session) {
+        const hadIds = Array.isArray(session.messageIds);
+        const ids = hadIds ? [...session.messageIds] : [];
+        if (ids.length > session.messages.length)
+            ids.length = session.messages.length;
+        for (let index = ids.length; index < session.messages.length; index += 1) {
+            ids.push(hadIds
+                ? randomUUID()
+                : `legacy-${createHash('sha256').update(`${session.id}\0${index}\0${JSON.stringify(session.messages[index])}`).digest('hex')}`);
+        }
+        const seen = new Set();
+        session.messageIds = ids.map((id) => {
+            const normalized = typeof id === 'string' && id.trim() ? id.trim() : randomUUID();
+            if (seen.has(normalized)) {
+                const replacement = randomUUID();
+                seen.add(replacement);
+                return replacement;
             }
+            seen.add(normalized);
+            return normalized;
+        });
+        return session;
+    }
+    readSessionFile(filePath) {
+        try {
+            let parsed;
+            try {
+                parsed = JSON.parse(fs.readFileSync(filePath, 'utf8'));
+            }
+            catch {
+                parsed = JSON.parse(fs.readFileSync(`${filePath}.bak`, 'utf8'));
+            }
+            const fallbackCandidate = parsed && typeof parsed === 'object' && 'data' in parsed
+                ? parsed.data
+                : parsed;
+            const fallback = fallbackCandidate;
+            if (!fallback?.id || !fallback?.project || !Array.isArray(fallback.messages))
+                return null;
+            return this.ensureMessageIds(this.sessionStore(filePath, fallback).read());
+        }
+        catch {
+            return null;
+        }
+    }
+    readSessionsFromDir(directory) {
+        if (!directory)
+            return [];
+        try {
+            return fs.readdirSync(directory)
+                .filter((name) => name.endsWith('.json'))
+                .map((name) => {
+                return this.readSessionFile(path.join(directory, name));
+            })
+                .filter((session) => Boolean(session?.id && session?.project));
+        }
+        catch {
+            return [];
+        }
+    }
+    ensureDir() {
+        if (!fs.existsSync(this.sessionsDir)) {
+            fs.mkdirSync(this.sessionsDir, { recursive: true, mode: 0o700 });
+        }
+        if (process.platform !== 'win32') {
+            fs.chmodSync(this.sessionsDir, 0o700);
         }
     }
     /**
@@ -149,7 +243,7 @@ export class SessionManager {
         try {
             const now = Date.now();
             const files = fs.readdirSync(this.sessionsDir)
-                .filter((f) => f.endsWith('.json'))
+                .filter((f) => f.endsWith('.json') && f !== 'index.json')
                 .map((f) => {
                 const full = path.join(this.sessionsDir, f);
                 let mtimeMs = 0;
@@ -163,7 +257,7 @@ export class SessionManager {
             for (const entry of files) {
                 if (entry.mtimeMs === 0 || now - entry.mtimeMs > this.retentionWindowMs) {
                     try {
-                        fs.unlinkSync(entry.full);
+                        this.delete(path.basename(entry.file, '.json'));
                     }
                     catch { /* ignore */ }
                 }
@@ -175,7 +269,7 @@ export class SessionManager {
             if (remaining.length > this.maxRetainedSessions) {
                 for (const entry of remaining.slice(this.maxRetainedSessions)) {
                     try {
-                        fs.unlinkSync(entry.full);
+                        this.delete(path.basename(entry.file, '.json'));
                     }
                     catch { /* ignore */ }
                 }
@@ -193,6 +287,34 @@ export class SessionManager {
         const random = Math.random().toString(36).substring(2, 8);
         return `${timestamp}-${random}`;
     }
+    getProjectId(project, create) {
+        const workspaceDir = this.workspaceSessionsDir(project);
+        if (!workspaceDir)
+            return undefined;
+        const vigthoriaDir = path.dirname(workspaceDir);
+        const marker = path.join(vigthoriaDir, 'project-id');
+        try {
+            const existing = fs.readFileSync(marker, 'utf8').trim();
+            if (/^[a-f0-9-]{20,64}$/i.test(existing))
+                return existing.toLowerCase();
+        }
+        catch { /* marker not created yet */ }
+        if (!create)
+            return undefined;
+        fs.mkdirSync(vigthoriaDir, { recursive: true, mode: 0o700 });
+        const projectId = randomUUID();
+        try {
+            fs.writeFileSync(marker, `${projectId}\n`, { encoding: 'utf8', mode: 0o600, flag: 'wx' });
+            secureFileMode(marker);
+            return projectId;
+        }
+        catch (error) {
+            if (error.code === 'EEXIST') {
+                return fs.readFileSync(marker, 'utf8').trim().toLowerCase();
+            }
+            throw error;
+        }
+    }
     /**
      * Create a new session
      */
@@ -203,12 +325,14 @@ export class SessionManager {
             project,
             model,
             messages: [],
+            messageIds: [],
             memorySummary: '',
             compactedAt: null,
             createdAt: new Date().toISOString(),
             updatedAt: new Date().toISOString(),
             agentMode,
             operatorMode,
+            projectId: this.getProjectId(project, true),
         };
         this.save(session);
         return session;
@@ -219,37 +343,89 @@ export class SessionManager {
      */
     save(session) {
         const compacted = this.compactSession(session);
-        const targetSession = compacted.session;
+        const targetSession = this.ensureMessageIds(compacted.session);
         targetSession.updatedAt = new Date().toISOString();
+        targetSession.projectId = targetSession.projectId || this.getProjectId(targetSession.project, true);
         const filePath = path.join(this.sessionsDir, `${session.id}.json`);
-        try {
-            atomicWriteJson(filePath, targetSession, 0o600);
-            secureFileMode(filePath);
-        }
-        catch (error) {
-            // Surface a best-effort hint rather than crashing the active chat.
-            if (process.env.VIGTHORIA_DEBUG === '1') {
-                console.error('[vigthoria] session save failed:', error?.message ?? error);
+        const persisted = this.sessionStore(filePath, targetSession).update((current) => this.mergeConcurrentSession(current, targetSession)).data;
+        secureFileMode(filePath);
+        const mirrors = [];
+        // Mirror agent checkpoints into the bound workspace. This makes interrupted
+        // direct runs resumable when a packaged/sandboxed CLI cannot write the
+        // process home directory, and keeps state attached to the correct project
+        // across terminals and external client machines.
+        if (persisted.activeAgentRun || persisted.lastAgentRunOutcome) {
+            const workspaceDir = this.workspaceSessionsDir(persisted.project);
+            if (workspaceDir) {
+                fs.mkdirSync(workspaceDir, { recursive: true, mode: 0o700 });
+                const workspaceFile = path.join(workspaceDir, `${persisted.id}.json`);
+                this.sessionStore(workspaceFile, persisted).update((current) => this.mergeConcurrentSession(current, persisted));
+                secureFileMode(workspaceFile);
+                mirrors.push(workspaceFile);
             }
         }
+        this.indexStore.update((index) => ({
+            sessions: {
+                ...index.sessions,
+                [persisted.id]: {
+                    projectId: persisted.projectId,
+                    project: persisted.project,
+                    mirrors: [...new Set([...(index.sessions[persisted.id]?.mirrors || []), ...mirrors])],
+                    updatedAt: persisted.updatedAt,
+                },
+            },
+        }));
         this.pruneIfNeeded();
     }
+    mergeConcurrentSession(current, incoming) {
+        if (current.id !== incoming.id)
+            return incoming;
+        this.ensureMessageIds(current);
+        this.ensureMessageIds(incoming);
+        const compactedChanged = Boolean(incoming.compactedAt && incoming.compactedAt !== current.compactedAt);
+        const messages = compactedChanged ? incoming.messages : [...current.messages];
+        const messageIds = compactedChanged ? [...incoming.messageIds] : [...current.messageIds];
+        if (!compactedChanged) {
+            const indexById = new Map(messageIds.map((id, index) => [id, index]));
+            for (let index = 0; index < incoming.messages.length; index += 1) {
+                const message = incoming.messages[index];
+                const id = incoming.messageIds[index];
+                const existingIndex = indexById.get(id);
+                if (existingIndex === undefined) {
+                    indexById.set(id, messages.length);
+                    messageIds.push(id);
+                    messages.push(message);
+                }
+                else {
+                    messages[existingIndex] = message;
+                }
+            }
+        }
+        const checkpointTimes = [incoming.activeAgentRun, current.activeAgentRun]
+            .filter((checkpoint) => Boolean(checkpoint))
+            .sort((left, right) => Date.parse(right.updatedAt) - Date.parse(left.updatedAt));
+        return {
+            ...current,
+            ...incoming,
+            messages,
+            messageIds,
+            activeAgentRun: checkpointTimes[0] || incoming.activeAgentRun || current.activeAgentRun,
+            lastAgentRunOutcome: incoming.lastAgentRunOutcome || current.lastAgentRunOutcome,
+            updatedAt: new Date(Math.max(Date.parse(current.updatedAt) || 0, Date.parse(incoming.updatedAt) || 0)).toISOString(),
+        };
+    }
     /**
      * Load session by ID
      */
     load(id) {
+        const indexRecord = this.indexStore.read().sessions[id];
+        if (indexRecord?.deletedAt)
+            return null;
         const filePath = path.join(this.sessionsDir, `${id}.json`);
         if (!fs.existsSync(filePath)) {
             return null;
         }
-        try {
-            const content = fs.readFileSync(filePath, 'utf-8');
-            return JSON.parse(content);
-        }
-        catch (error) {
-            console.warn(`Failed to load session ${id}:`, error);
-            return null;
-        }
+        return this.readSessionFile(filePath);
     }
     normalizeProjectKey(projectPath) {
         const raw = String(projectPath || '').trim();
@@ -273,24 +449,30 @@ export class SessionManager {
      * Get the most recent session for a project
      */
     getLatest(project) {
-        const sessions = this.list();
+        const primarySessions = this.list()
+            .map((metadata) => this.load(metadata.id))
+            .filter((session) => Boolean(session));
+        const workspaceSessions = this.readSessionsFromDir(this.workspaceSessionsDir(project));
+        const sessionsById = new Map();
+        const index = this.indexStore.read();
+        for (const session of [...primarySessions, ...workspaceSessions]) {
+            if (index.sessions[session.id]?.deletedAt)
+                continue;
+            const existing = sessionsById.get(session.id);
+            if (!existing || new Date(session.updatedAt).getTime() >= new Date(existing.updatedAt).getTime()) {
+                sessionsById.set(session.id, session);
+            }
+        }
+        const sessions = [...sessionsById.values()];
         const projectKey = this.normalizeProjectKey(project);
-        const projectBase = path.basename(projectKey || '').toLowerCase();
+        const projectId = this.getProjectId(project, false);
         const exactMatches = sessions
-            .filter((s) => this.normalizeProjectKey(s.project) === projectKey)
+            .filter((s) => projectId && s.projectId
+            ? s.projectId === projectId
+            : this.normalizeProjectKey(s.project) === projectKey)
             .sort((a, b) => new Date(b.updatedAt).getTime() - new Date(a.updatedAt).getTime());
         if (exactMatches.length > 0) {
-            return this.load(exactMatches[0].id);
-        }
-        // Fallback: if old sessions stored inconsistent slash/case forms, allow
-        // latest same-folder match (e.g., C:\Proj and C:/proj) to preserve /retry UX.
-        if (projectBase) {
-            const softMatches = sessions
-                .filter((s) => path.basename(this.normalizeProjectKey(s.project) || '').toLowerCase() === projectBase)
-                .sort((a, b) => new Date(b.updatedAt).getTime() - new Date(a.updatedAt).getTime());
-            if (softMatches.length > 0) {
-                return this.load(softMatches[0].id);
-            }
+            return exactMatches[0];
         }
         return null;
     }
@@ -301,16 +483,18 @@ export class SessionManager {
     list() {
         let files = [];
         try {
-            files = fs.readdirSync(this.sessionsDir).filter(f => f.endsWith('.json'));
+            files = fs.readdirSync(this.sessionsDir).filter(f => f.endsWith('.json') && f !== 'index.json');
         }
         catch {
             return [];
         }
         return files.map(f => {
             try {
-                const content = fs.readFileSync(path.join(this.sessionsDir, f), 'utf-8');
-                const session = JSON.parse(content);
-                const { messages, ...metadata } = session;
+                const session = this.readSessionFile(path.join(this.sessionsDir, f));
+                if (!session || this.indexStore.read().sessions[session.id]?.deletedAt)
+                    return null;
+                const { messages, messageIds: _messageIds, ...metadata } = session;
+                void _messageIds;
                 return { ...metadata, messages: [] };
             }
             catch (error) {
@@ -326,20 +510,73 @@ export class SessionManager {
      */
     delete(id) {
         const filePath = path.join(this.sessionsDir, `${id}.json`);
-        if (fs.existsSync(filePath)) {
-            fs.unlinkSync(filePath);
-            return true;
+        const index = this.indexStore.read();
+        const record = index.sessions[id];
+        const targets = [filePath, ...(record?.mirrors || [])];
+        let removed = false;
+        for (const target of targets) {
+            if (path.basename(target) !== `${id}.json` || path.basename(path.dirname(target)) !== 'sessions')
+                continue;
+            try {
+                fs.unlinkSync(target);
+                removed = true;
+            }
+            catch (error) {
+                if (error.code !== 'ENOENT')
+                    throw error;
+            }
         }
-        return false;
+        this.indexStore.update((current) => ({
+            sessions: {
+                ...current.sessions,
+                [id]: {
+                    projectId: record?.projectId,
+                    project: record?.project || '',
+                    mirrors: record?.mirrors || [],
+                    updatedAt: record?.updatedAt || new Date().toISOString(),
+                    deletedAt: new Date().toISOString(),
+                },
+            },
+        }));
+        return removed;
     }
     /**
      * Clear all sessions
      */
     clearAll() {
         const files = fs.readdirSync(this.sessionsDir)
-            .filter(f => f.endsWith('.json'));
-        files.forEach(f => fs.unlinkSync(path.join(this.sessionsDir, f)));
-        return files.length;
+            .filter(f => f.endsWith('.json') && f !== 'index.json');
+        const ids = new Set([
+            ...files.map((file) => path.basename(file, '.json')),
+            ...Object.keys(this.indexStore.read().sessions),
+        ]);
+        let removed = 0;
+        for (const id of ids) {
+            if (this.delete(id))
+                removed += 1;
+        }
+        return removed;
+    }
+    markCancelledByContext(contextId) {
+        let updated = 0;
+        for (const metadata of this.list()) {
+            const session = this.load(metadata.id);
+            const checkpoint = session?.activeAgentRun;
+            if (!session || !checkpoint || checkpoint.contextId !== contextId)
+                continue;
+            if (!['submitted', 'retry', 'continue', 'running', 'failed'].includes(checkpoint.status))
+                continue;
+            assertAgentStatusTransition(checkpoint.status, 'cancelled');
+            session.activeAgentRun = {
+                ...checkpoint,
+                status: 'cancelled',
+                updatedAt: new Date().toISOString(),
+                error: 'Cancelled by user request.',
+            };
+            this.save(session);
+            updated += 1;
+        }
+        return updated;
     }
     /**
      * Add message to session
@@ -358,13 +595,16 @@ export class SessionManager {
         return [
             'Session memory summary from earlier conversation turns.',
             'Use this as compressed context for follow-up questions and resume behavior.',
-            session.memorySummary.trim(),
+            redactSensitiveText(session.memorySummary.trim()),
         ].join('\n');
     }
     compactSession(session) {
+        this.ensureMessageIds(session);
         if (session.messages.length <= this.compactThreshold) {
             return { session, compacted: false };
         }
+        const priorMessages = [...session.messages];
+        const priorIds = [...session.messageIds];
         const systemMessages = session.messages.filter((message) => message.role === 'system' && this.isPersistentSystemMessage(message.content));
         const recentMessages = session.messages.slice(-this.retainRecentMessages);
         const olderMessages = session.messages.slice(0, -this.retainRecentMessages);
@@ -372,6 +612,10 @@ export class SessionManager {
         session.memorySummary = nextSummary;
         session.compactedAt = new Date().toISOString();
         session.messages = this.mergePersistentAndRecent(systemMessages, recentMessages);
+        session.messageIds = session.messages.map((message) => {
+            const index = priorMessages.indexOf(message);
+            return index >= 0 ? priorIds[index] : randomUUID();
+        });
         return { session, compacted: true };
     }
     isPersistentSystemMessage(content) {
@@ -434,7 +678,7 @@ export class SessionManager {
         return summaryLines.slice(-14).join('\n');
     }
     normalizeMessageContent(content) {
-        const collapsed = String(content || '')
+        const collapsed = redactSensitiveText(String(content || ''))
             .replace(/<tool_call>[\s\S]*?<\/tool_call>/g, ' ')
             .replace(/\s+/g, ' ')
             .trim();

package/dist/utils/tool-approval-service.d.ts

@@ -0,0 +1,17 @@
+import type { Logger } from './logger.js';
+import type { ApprovalScope } from './process-policy.js';
+export declare class ToolApprovalService {
+    private readonly workspace;
+    private readonly logger;
+    private readonly sessionOperations;
+    private readonly store;
+    constructor(workspace: string, logger: Logger, permissionsFile?: string);
+    private report;
+    private read;
+    hasPersistent(scope: ApprovalScope): boolean;
+    hasSession(scope: ApprovalScope): boolean;
+    recordSession(scope: ApprovalScope): void;
+    recordPersistent(scope: ApprovalScope): void;
+    clearSession(): void;
+    sessionKeys(): string[];
+}