zelari-code 2.54.0 → 2.56.0

package/dist/cli/slashHandlers/permissions.js

@@ -0,0 +1,170 @@
+import { appendSystem } from '../hooks/messageHelpers.js';
+import { defaultPermissionPolicy } from '../safety/toolPermissions.js';
+import { PERMISSION_RULE_CATEGORIES } from '../safety/permissionPolicy.js';
+import { addSessionPermissionRule, listSessionPermissionRules, loadProjectPermissionRules, removeSessionPermissionRule, clearSessionPermissionRules, } from '../safety/permissionRules.js';
+import { clearPermissionDenials, listRecentPermissionDenials, } from '../safety/permissionGate.js';
+export const PERMISSIONS_USAGE = [
+    '/permissions — active rules (source: default | project | session) + recent denials',
+    '/permissions add <id> <allow|ask|deny> [tool=<name|glob>] [category=read|write|execute|network|ui] [pathPrefix=<p>] [host=<h>] [note=<text>]',
+    '/permissions remove <id> — drop a session rule',
+    '/permissions clear — drop every session rule',
+    '/permissions denials [--clear] — recent denials',
+].join('\n');
+const MATCHER_KEYS = ['tool', 'category', 'pathPrefix', 'host', 'note'];
+/** `id effect tool=bash pathPrefix=docs` → the raw rule object (zod validates it). */
+function parseRuleArgs(args) {
+    const [id, effect, ...rest] = args;
+    if (!id || !effect)
+        return { ok: false, error: 'usage: /permissions add <id> <allow|ask|deny> [matchers…]' };
+    const raw = { id, effect };
+    for (const token of rest) {
+        const eq = token.indexOf('=');
+        if (eq <= 0)
+            return { ok: false, error: `unparseable argument '${token}' (expected key=value)` };
+        const key = token.slice(0, eq);
+        const value = token.slice(eq + 1);
+        if (!MATCHER_KEYS.includes(key)) {
+            return { ok: false, error: `unknown matcher '${key}' (expected ${MATCHER_KEYS.join('/')})` };
+        }
+        if (value === '')
+            return { ok: false, error: `empty value for '${key}'` };
+        raw[key] = value;
+    }
+    return { ok: true, raw };
+}
+function formatRuleLine(source, id, effect, matchers, note) {
+    return `  [${source}] ${id} → ${effect}${matchers ? ` (${matchers})` : ''}${note ? ` — ${note}` : ''}`;
+}
+function matchersOf(rule) {
+    return [
+        rule.tool !== undefined ? `tool=${rule.tool}` : '',
+        rule.category !== undefined ? `category=${rule.category}` : '',
+        rule.pathPrefix !== undefined ? `pathPrefix=${rule.pathPrefix}` : '',
+        rule.host !== undefined ? `host=${rule.host}` : '',
+    ]
+        .filter(Boolean)
+        .join(' ');
+}
+export function formatPermissionDenialLine(d) {
+    const when = new Date(d.ts).toISOString();
+    return `  ${when} ${d.tool} blocked by [${d.source}] '${d.matchedRuleId}'`;
+}
+/** The full `/permissions` report (pure — same input, same text). */
+export function formatPermissionsReport(cwd) {
+    const policy = defaultPermissionPolicy();
+    const project = loadProjectPermissionRules(cwd);
+    const session = listSessionPermissionRules();
+    const denials = listRecentPermissionDenials(10);
+    const lines = [
+        '[permissions] local policy engine (WS1) — evaluated before every tool dispatch',
+        '  precedence: deny > ask > allow, then most specific rule, then session before project',
+        '',
+        `default (5 categories, unchanged): read=${policy.read} write=${policy.write} execute=${policy.execute} network=${policy.network} ui=${policy.ui}${policy.auto ? ' auto=on' : ''}`,
+        `  editable via ZELARI_PERMISSION_<CATEGORY> / --permissions <preset> — not here`,
+        '',
+        `project: ${project.path}`,
+    ];
+    if (project.error !== undefined) {
+        lines.push(`  FAIL-CLOSED: ${project.error}`, '  (every unmatched tool call asks until the file is fixed)');
+    }
+    else if (project.rules.length === 0) {
+        lines.push('  (no rules — absent or empty file)');
+    }
+    else {
+        for (const { rule } of project.rules) {
+            lines.push(formatRuleLine('project', rule.id, rule.effect, matchersOf(rule), rule.note));
+        }
+    }
+    lines.push('', `session (${session.length} rule${session.length === 1 ? '' : 's'}, runtime-only)`);
+    if (session.length === 0)
+        lines.push('  (none — /permissions add <id> <effect> [matchers…])');
+    else {
+        for (const { rule } of session) {
+            lines.push(formatRuleLine('session', rule.id, rule.effect, matchersOf(rule), rule.note));
+        }
+    }
+    lines.push('', `recent denials (${denials.length})`);
+    if (denials.length === 0)
+        lines.push('  (none this session)');
+    else
+        for (const d of denials)
+            lines.push(formatPermissionDenialLine(d));
+    lines.push('', `categories: ${PERMISSION_RULE_CATEGORIES.join(', ')}`, '', PERMISSIONS_USAGE);
+    return lines.join('\n');
+}
+/**
+ * `/permissions [subcommand] …`. Mirrors the /trust handler shape: it renders
+ * a system message and returns the text it renders (handy for tests).
+ */
+export function handlePermissions(ctx, subcommand, args = [], cwd = process.cwd()) {
+    const sub = (subcommand ?? '').toLowerCase();
+    switch (sub) {
+        case '':
+        case 'list':
+        case 'show': {
+            const text = formatPermissionsReport(cwd);
+            appendSystem(ctx.setMessages, text);
+            return text;
+        }
+        case 'add': {
+            const parsed = parseRuleArgs(args);
+            if (!parsed.ok) {
+                appendSystem(ctx.setMessages, `[permissions] ${parsed.error}\n\n${PERMISSIONS_USAGE}`);
+                return parsed.error;
+            }
+            const res = addSessionPermissionRule(parsed.raw);
+            if (!res.ok) {
+                // Return what is rendered: the caller-facing text must carry the
+                // REJECTION verdict, not just the bare schema error.
+                const rejected = `[permissions] rejected: ${res.error}`;
+                appendSystem(ctx.setMessages, rejected);
+                return rejected;
+            }
+            const text = `[permissions] session rule '${res.rule.id}' → ${res.rule.effect}${matchersOf(res.rule) ? ` (${matchersOf(res.rule)})` : ''} — effective on the next dispatch (this process only, never persisted).`;
+            appendSystem(ctx.setMessages, text);
+            return text;
+        }
+        case 'remove':
+        case 'rm':
+        case 'delete': {
+            const id = args[0];
+            if (!id) {
+                appendSystem(ctx.setMessages, '[permissions] usage: /permissions remove <id>');
+                return '';
+            }
+            const removed = removeSessionPermissionRule(id);
+            const text = removed
+                ? `[permissions] removed session rule '${id}'.`
+                : `[permissions] no session rule '${id}' (project rules are edited in ${loadProjectPermissionRules(cwd).path}).`;
+            appendSystem(ctx.setMessages, text);
+            return text;
+        }
+        case 'clear': {
+            clearSessionPermissionRules();
+            appendSystem(ctx.setMessages, '[permissions] all session rules cleared.');
+            return 'cleared';
+        }
+        case 'denials':
+        case 'denied': {
+            if (args[0] === '--clear') {
+                clearPermissionDenials();
+                appendSystem(ctx.setMessages, '[permissions] denial ledger cleared.');
+                return 'cleared';
+            }
+            const denials = listRecentPermissionDenials(20);
+            const text = denials.length === 0
+                ? '[permissions] no denials recorded this session.'
+                : ['[permissions] recent denials:', ...denials.map(formatPermissionDenialLine)].join('\n');
+            appendSystem(ctx.setMessages, text);
+            return text;
+        }
+        default: {
+            // Return the text that was rendered — it names the bogus subcommand —
+            // instead of the bare usage block, so a caller can SEE the rejection.
+            const text = `[permissions] unknown subcommand '${sub}'.\n\n${PERMISSIONS_USAGE}`;
+            appendSystem(ctx.setMessages, text);
+            return text;
+        }
+    }
+}
+//# sourceMappingURL=permissions.js.map

package/dist/cli/slashHandlers/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../../src/cli/slashHandlers/permissions.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,0BAA0B,EAC1B,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,sBAAsB,EACtB,2BAA2B,GAE5B,MAAM,6BAA6B,CAAC;AAMrC,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,oFAAoF;IACpF,8IAA8I;IAC9I,gDAAgD;IAChD,8CAA8C;IAC9C,iDAAiD;CAClD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,CAAU,CAAC;AAEjF,sFAAsF;AACtF,SAAS,aAAa,CAAC,IAAuB;IAG5C,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IACnC,IAAI,CAAC,EAAE,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2DAA2D,EAAE,CAAC;IAC7G,MAAM,GAAG,GAA4B,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;IACpD,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,EAAE,IAAI,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,KAAK,wBAAwB,EAAE,CAAC;QACjG,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAClC,IAAI,CAAE,YAAkC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACvD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,GAAG,eAAe,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;QAC/F,CAAC;QACD,IAAI,KAAK,KAAK,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,GAAG,GAAG,EAAE,CAAC;QAC1E,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,cAAc,CAAC,MAAc,EAAE,EAAU,EAAE,MAAc,EAAE,QAAgB,EAAE,IAAa;IACjG,OAAO,MAAM,MAAM,KAAK,EAAE,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACzG,CAAC;AAED,SAAS,UAAU,CAAC,IAKnB;IACC,OAAO;QACL,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE;QAClD,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE;QAC9D,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE;QACpE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE;KACnD;SACE,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,CAAyB;IAClE,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1C,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,gBAAgB,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,aAAa,GAAG,CAAC;AAC7E,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,uBAAuB,CAAC,GAAW;IACjD,MAAM,MAAM,GAAG,uBAAuB,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,0BAA0B,EAAE,CAAC;IAC7C,MAAM,OAAO,GAAG,2BAA2B,CAAC,EAAE,CAAC,CAAC;IAChD,MAAM,KAAK,GAAa;QACtB,gFAAgF;QAChF,wFAAwF;QACxF,EAAE;QACF,2CAA2C,MAAM,CAAC,IAAI,UAAU,MAAM,CAAC,KAAK,YAAY,MAAM,CAAC,OAAO,YAAY,MAAM,CAAC,OAAO,OAAO,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE;QAClL,iFAAiF;QACjF,EAAE;QACF,YAAY,OAAO,CAAC,IAAI,EAAE;KAC3B,CAAC;IACF,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,kBAAkB,OAAO,CAAC,KAAK,EAAE,EAAE,4DAA4D,CAAC,CAAC;IAC9G,CAAC;SAAM,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IACpD,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YACrC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,OAAO,CAAC,MAAM,QAAQ,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC,CAAC;IACnG,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;SACzF,CAAC;QACJ,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,OAAO,EAAE,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,mBAAmB,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IACrD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;;QACzD,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,eAAe,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,CAAC,CAAC;IAC9F,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAA0B,EAC1B,UAA8B,EAC9B,OAA0B,EAAE,EAC5B,MAAc,OAAO,CAAC,GAAG,EAAE;IAE3B,MAAM,GAAG,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC7C,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,EAAE,CAAC;QACR,KAAK,MAAM,CAAC;QACZ,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,IAAI,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;YAC1C,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,iBAAiB,MAAM,CAAC,KAAK,OAAO,iBAAiB,EAAE,CAAC,CAAC;gBACvF,OAAO,MAAM,CAAC,KAAK,CAAC;YACtB,CAAC;YACD,MAAM,GAAG,GAAG,wBAAwB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,iEAAiE;gBACjE,qDAAqD;gBACrD,MAAM,QAAQ,GAAG,2BAA2B,GAAG,CAAC,KAAK,EAAE,CAAC;gBACxD,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;gBACxC,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,MAAM,IAAI,GAAG,+BAA+B,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,GAC3E,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EACxD,yEAAyE,CAAC;YAC1E,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,QAAQ,CAAC;QACd,KAAK,IAAI,CAAC;QACV,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACnB,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,+CAA+C,CAAC,CAAC;gBAC/E,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,MAAM,OAAO,GAAG,2BAA2B,CAAC,EAAE,CAAC,CAAC;YAChD,MAAM,IAAI,GAAG,OAAO;gBAClB,CAAC,CAAC,uCAAuC,EAAE,IAAI;gBAC/C,CAAC,CAAC,kCAAkC,EAAE,kCAAkC,0BAA0B,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC;YACnH,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,2BAA2B,EAAE,CAAC;YAC9B,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,0CAA0C,CAAC,CAAC;YAC1E,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,KAAK,SAAS,CAAC;QACf,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC1B,sBAAsB,EAAE,CAAC;gBACzB,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,sCAAsC,CAAC,CAAC;gBACtE,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,OAAO,GAAG,2BAA2B,CAAC,EAAE,CAAC,CAAC;YAChD,MAAM,IAAI,GACR,OAAO,CAAC,MAAM,KAAK,CAAC;gBAClB,CAAC,CAAC,iDAAiD;gBACnD,CAAC,CAAC,CAAC,+BAA+B,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/F,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACR,sEAAsE;YACtE,sEAAsE;YACtE,MAAM,IAAI,GAAG,qCAAqC,GAAG,SAAS,iBAAiB,EAAE,CAAC;YAClF,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/cli/statusline/inboxFeed.js

@@ -0,0 +1,76 @@
+/**
+ * inboxFeed — the `inbox` status-line item: "what is waiting on YOU", derived
+ * from the CURRENT session spine (derive-only, ADR-0016/0024).
+ *
+ * Same discipline as verdictFeed (t124): this module READS entries.jsonl, never
+ * writes and never feeds the model. The item is OPT-IN (`/statusline on inbox`),
+ * so the default bar is unchanged; the counts come from the very same
+ * projections `/inbox` prints:
+ *   - `questions` — unanswered `ask_user` calls (inbox.ts, t125);
+ *   - `needs`     — open needs: un-cleared verify debt + permission denials;
+ *   - `finished`  — tentacle completions you have not spoken past yet.
+ *
+ * Kill switch: `ZELARI_INBOX=0` (the t125 switch, reused — one switch for the
+ * whole inbox surface, not a second knob) ⇒ `inboxFeedText()` returns null and
+ * the item paints nothing.
+ *
+ * HONESTY: nothing recorded (or an unreadable spine) ⇒ zero rows ⇒ no item
+ * text. A zero is never printed as if it were a measurement of "all clear".
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import path from 'node:path';
+import { parseSessionLogText, resolveSessionsDir } from '@zelari/core/session';
+import { getCurrentSessionId } from '../sessionManager.js';
+import { deriveInboxQuestions, inboxEnabled } from '../inbox.js';
+import { deriveInboxSourceRows } from '../inboxSources.js';
+/** The honest "nothing derived" feed. */
+export function emptyInboxFeed() {
+    return { questions: 0, needs: 0, finished: 0, total: 0 };
+}
+/**
+ * Project ONE session's events into the feed. Pure: no I/O, no clock. The
+ * session id is a label here (the rows are counted, not reported), hence the
+ * neutral `current` handle.
+ */
+export function deriveInboxFeed(events) {
+    const questions = deriveInboxQuestions(events, { sessionId: 'current' }).length;
+    const rows = deriveInboxSourceRows(events);
+    const needs = rows.filter((r) => r.source === 'needs-input').length;
+    return { questions, needs, finished: rows.length - needs, total: questions + rows.length };
+}
+/**
+ * Item text for the `inbox` statusline item, or null when there is nothing
+ * honest to say (kill switch off, or nothing waiting). Terse on purpose: the
+ * bar is one line. `inbox 3` / `inbox 3 (1 need)`.
+ */
+export function inboxFeedText(feed, env = process.env) {
+    if (!inboxEnabled(env))
+        return null;
+    if (!feed || feed.total === 0)
+        return null;
+    return feed.needs > 0 ? `inbox ${feed.total} (${feed.needs} need)` : `inbox ${feed.total}`;
+}
+/**
+ * Read the inbox feed of the CURRENT run from its spine log. Tolerant by
+ * contract: a missing marker/file, a corrupt log or a kill-switched inbox all
+ * return the empty feed.
+ */
+export function readInboxFeed(opts = {}) {
+    const env = opts.env ?? process.env;
+    if (!inboxEnabled(env))
+        return emptyInboxFeed();
+    const sessionId = opts.sessionId ?? getCurrentSessionId();
+    if (!sessionId)
+        return emptyInboxFeed();
+    const dir = opts.sessionsDir ?? resolveSessionsDir({ workspaceRoot: opts.cwd, env });
+    const file = path.join(dir, sessionId, 'events.jsonl');
+    try {
+        if (!existsSync(file))
+            return emptyInboxFeed();
+        return deriveInboxFeed(parseSessionLogText(file, readFileSync(file, 'utf-8')).events);
+    }
+    catch {
+        return emptyInboxFeed();
+    }
+}
+//# sourceMappingURL=inboxFeed.js.map

package/dist/cli/statusline/inboxFeed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inboxFeed.js","sourceRoot":"","sources":["../../../src/cli/statusline/inboxFeed.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAuB,MAAM,aAAa,CAAC;AACtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAa3D,yCAAyC;AACzC,MAAM,UAAU,cAAc;IAC5B,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAAiC;IAC/D,MAAM,SAAS,GAAG,oBAAoB,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;IAChF,MAAM,IAAI,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,MAAM,CAAC;IACpE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,GAAG,KAAK,EAAE,KAAK,EAAE,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;AAC7F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,IAAsB,EAAE,MAAyB,OAAO,CAAC,GAAG;IACxF,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,OAAO,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC;AAC7F,CAAC;AAWD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAA6B,EAAE;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;QAAE,OAAO,cAAc,EAAE,CAAC;IAChD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,mBAAmB,EAAE,CAAC;IAC1D,IAAI,CAAC,SAAS;QAAE,OAAO,cAAc,EAAE,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,kBAAkB,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IACrF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,cAAc,EAAE,CAAC;QAC/C,OAAO,eAAe,CAAC,mBAAmB,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,cAAc,EAAE,CAAC;IAC1B,CAAC;AACH,CAAC"}

package/dist/cli/statusline/statuslineItems.js

@@ -50,11 +50,21 @@ export const STATUSLINE_CUSTOM_ID = 'custom';
  * that no renderer paints yet must not be reported as enabled.
  */
 export const STATUSLINE_VERDICT_ID = 'verdict';
+/**
+ * `inbox` — what is waiting on YOU, derived from the current session spine
+ * (inboxFeed.ts: the same projections `/inbox` prints — unanswered ask_user,
+ * open needs, tentacle completions). OPT-IN for the same reason as `verdict`:
+ * the default list mirrors the chips StatusBar paints with no configuration.
+ *
+ * WS2 (notification bus): shares the t125 kill switch `ZELARI_INBOX=0`.
+ */
+export const STATUSLINE_INBOX_ID = 'inbox';
 /** Any id a configuration may reference (built-ins + the opt-in items). */
 export const STATUSLINE_ITEM_IDS = [
     ...DEFAULT_STATUSLINE_ITEMS,
     STATUSLINE_CUSTOM_ID,
     STATUSLINE_VERDICT_ID,
+    STATUSLINE_INBOX_ID,
 ];
 /** Catalog for `/statusline` (order = the default order). */
 export const STATUSLINE_ITEMS = [
@@ -80,6 +90,11 @@ export const STATUSLINE_ITEMS = [
         label: 'verdict',
         description: 'verification progress from spine events (derive-only; opt-in)',
     },
+    {
+        id: STATUSLINE_INBOX_ID,
+        label: 'inbox',
+        description: 'what is waiting on you: ask_user, needs input, tentacle finished (derive-only; opt-in)',
+    },
 ];
 /** True when `id` is a known item (built-in, `custom` or `verdict`). */
 export function isStatusLineItemId(id) {

package/dist/cli/statusline/statuslineItems.js.map

@@ -1 +1 @@
-{"version":3,"file":"statuslineItems.js","sourceRoot":"","sources":["../../../src/cli/statusline/statuslineItems.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAsB;IACzD,WAAW;IACX,OAAO;IACP,MAAM;IACN,QAAQ;IACR,aAAa;IACb,MAAM;IACN,UAAU;IACV,OAAO;IACP,KAAK;IACL,YAAY;IACZ,SAAS;IACT,OAAO;IACP,OAAO;IACP,YAAY;IACZ,aAAa;IACb,SAAS;IACT,MAAM;IACN,SAAS;CACV,CAAC;AAEF,+EAA+E;AAC/E,MAAM,CAAC,MAAM,oBAAoB,GAAG,QAAQ,CAAC;AAE7C;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,SAAS,CAAC;AAE/C,2EAA2E;AAC3E,MAAM,CAAC,MAAM,mBAAmB,GAAsB;IACpD,GAAG,wBAAwB;IAC3B,oBAAoB;IACpB,qBAAqB;CACtB,CAAC;AASF,6DAA6D;AAC7D,MAAM,CAAC,MAAM,gBAAgB,GAAkC;IAC7D,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,2BAA2B,EAAE;IACzE,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,2CAA2C,EAAE;IACvF,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,+BAA+B,EAAE;IAC9E,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,6BAA6B,EAAE;IAChF,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,sBAAsB,EAAE;IAClE,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,oBAAoB,EAAE;IACxE,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE;IAC5D,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,6BAA6B,EAAE;IACvE,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,6BAA6B,EAAE;IAC5E,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,0BAA0B,EAAE;IACxE,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE;IACpE,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,4BAA4B,EAAE;IACnF,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,0BAA0B,EAAE;IAC9E,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,0BAA0B,EAAE;IACxE,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,8BAA8B,EAAE;IAC1E,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE;IAC9D,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,kDAAkD,EAAE;IAC9G;QACE,EAAE,EAAE,qBAAqB;QACzB,KAAK,EAAE,SAAS;QAChB,WAAW,EAAE,+DAA+D;KAC7E;CACF,CAAC;AAEF,wEAAwE;AACxE,MAAM,UAAU,kBAAkB,CAAC,EAAU;IAC3C,OAAO,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,mBAAmB,CAAC,EAAU;IAC5C,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;AAChE,CAAC;AAcD;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAwB,EACxB,KAAwB,EACxB,UAA0B;IAE1B,MAAM,GAAG,GAA6B,EAAE,CAAC;IACzC,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,EAAE,KAAK,oBAAoB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAClE,MAAM,IAAI,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,qBAAqB,CAAC,KAAwB;IAC5D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/B,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAC7H,IAAI,CACL,CAAC;AACJ,CAAC"}
+{"version":3,"file":"statuslineItems.js","sourceRoot":"","sources":["../../../src/cli/statusline/statuslineItems.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAsB;IACzD,WAAW;IACX,OAAO;IACP,MAAM;IACN,QAAQ;IACR,aAAa;IACb,MAAM;IACN,UAAU;IACV,OAAO;IACP,KAAK;IACL,YAAY;IACZ,SAAS;IACT,OAAO;IACP,OAAO;IACP,YAAY;IACZ,aAAa;IACb,SAAS;IACT,MAAM;IACN,SAAS;CACV,CAAC;AAEF,+EAA+E;AAC/E,MAAM,CAAC,MAAM,oBAAoB,GAAG,QAAQ,CAAC;AAE7C;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,SAAS,CAAC;AAE/C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,OAAO,CAAC;AAE3C,2EAA2E;AAC3E,MAAM,CAAC,MAAM,mBAAmB,GAAsB;IACpD,GAAG,wBAAwB;IAC3B,oBAAoB;IACpB,qBAAqB;IACrB,mBAAmB;CACpB,CAAC;AASF,6DAA6D;AAC7D,MAAM,CAAC,MAAM,gBAAgB,GAAkC;IAC7D,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,2BAA2B,EAAE;IACzE,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,2CAA2C,EAAE;IACvF,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,+BAA+B,EAAE;IAC9E,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,6BAA6B,EAAE;IAChF,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,sBAAsB,EAAE;IAClE,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,oBAAoB,EAAE;IACxE,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE;IAC5D,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,6BAA6B,EAAE;IACvE,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,6BAA6B,EAAE;IAC5E,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,0BAA0B,EAAE;IACxE,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE;IACpE,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,4BAA4B,EAAE;IACnF,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,0BAA0B,EAAE;IAC9E,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,0BAA0B,EAAE;IACxE,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,8BAA8B,EAAE;IAC1E,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE;IAC9D,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,kDAAkD,EAAE;IAC9G;QACE,EAAE,EAAE,qBAAqB;QACzB,KAAK,EAAE,SAAS;QAChB,WAAW,EAAE,+DAA+D;KAC7E;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,KAAK,EAAE,OAAO;QACd,WAAW,EAAE,wFAAwF;KACtG;CACF,CAAC;AAEF,wEAAwE;AACxE,MAAM,UAAU,kBAAkB,CAAC,EAAU;IAC3C,OAAO,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,mBAAmB,CAAC,EAAU;IAC5C,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;AAChE,CAAC;AAcD;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAwB,EACxB,KAAwB,EACxB,UAA0B;IAE1B,MAAM,GAAG,GAA6B,EAAE,CAAC;IACzC,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,EAAE,KAAK,oBAAoB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAClE,MAAM,IAAI,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,qBAAqB,CAAC,KAAwB;IAC5D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/B,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAC7H,IAAI,CACL,CAAC;AACJ,CAAC"}

package/dist/cli/toolRegistry.js

@@ -57,6 +57,11 @@ import { PROVIDERS } from './keyStore.js';
 import { activePermissionPreset, defaultPermissionPolicy, intersectPermissionPolicy, isSessionGranted, resolveToolPermission, } from './safety/toolPermissions.js';
 // v2.32 (S5): destructive-shape escalation at the same choke-point.
 import { destructiveCommandHit } from './safety/destructiveCommands.js';
+// WS1 (t133): local permission policy (allow/ask/deny rules) — evaluated
+// BEFORE dispatch, with the structured `permission.denied` spine event.
+import { applyAllowRule, emitAutoApproveGranted, emitPermissionAsked, emitPermissionDenied, emitPermissionObserverHooks, evaluateToolDispatch, permissionDenialMessage, autoApproveOrigin, } from './safety/permissionGate.js';
+// WS7 slice 4 (t139): best-effort writer for the remaining decision kinds.
+import { emitJailBlocked } from './safety/decisionEmit.js';
 import { provenanceAppliesTo, provenanceMatchIn, recordResultForProvenance, } from './safety/provenance.js';
 import { createDefaultLifecycleHooks, HOOKS_FAILURE_ENV, resolveHookFailureMode } from './safety/lifecycleHooks.js';
 // ADR-0033 (t76): post-write AST gate with auto-revert on the write path.
@@ -77,6 +82,9 @@ import { wrapWithBashWriteDetection } from './tools/bashWriteWatch.js';
 import { appendKrakenRadio } from './tools/krakenRadio.js';
 import { withResultCache } from './toolResultCache.js';
 import { inspectCommand } from './safety/selfKillGuard.js';
+// WS7 slice 4b (t139): the ONE binding that makes ToolContext.emitSessionEvent
+// live on a real host path (see safety/sessionSink.ts for the full WHY).
+import { withSessionEventSink } from './safety/sessionSink.js';
 import { typedErr } from '@zelari/core/harness/tools/toolTypes';
 import { cliToolToEnhanced, registerCustomTool } from '@zelari/core/skills';
 /**
@@ -243,7 +251,10 @@ export function createBuiltinToolRegistry(options = {}) {
         }
     })();
     const agentPolicyLayers = agentLayersFor(agentPolicySet, options.policyAgent ?? 'lead');
-    const withPerm = (t) => wrapWithPermissions(t, permPolicy, options.onPermissionAsk, agentPolicyLayers, agentPolicySet.precedence, root);
+    const withPerm = (t) => wrapWithPermissions(t, permPolicy, options.onPermissionAsk, agentPolicyLayers, agentPolicySet.precedence, root, 
+    // WS5 (t137): the SAME runner the registry gates Pre/PostToolUse with —
+    // one runner per registry, no second hook universe.
+    hooks);
     // Observe tools — always registered.
     registry.register(withPerm(safeReadFile));
     registry.register(withPerm(safeGrepContent));
@@ -476,12 +487,21 @@ export function createBuiltinToolRegistry(options = {}) {
                 ...(options.onPermissionAsk ? { onPermissionAsk: options.onPermissionAsk } : {}),
                 ...(options.subAgentProvider ? { provider: options.subAgentProvider } : {}),
                 ...(options.subAgentModel ? { model: options.subAgentModel } : {}),
+                // WS7 slice 4b (t139): a tentacle's own registry is built here, so it
+                // needs the parent turn's sink too — otherwise a tentacle's file.applied
+                // / file.rejected (and its permission refusals) would stay invisible on
+                // the very spine that recorded its `task` spawn.
+                ...(options.sessionEventSink ? { sessionEventSink: options.sessionEventSink } : {}),
             }),
             ...(options.memoryService ? { memoryService: options.memoryService } : {}),
             ...(options.memoryAutoWrite !== undefined
                 ? { memoryAutoWrite: options.memoryAutoWrite }
                 : {}),
             ...(options.onTentacleEvent ? { onTentacleEvent: options.onTentacleEvent } : {}),
+            // WS5 (t137): the registry's own hook runner — SubagentStart/End (and
+            // the finished-tentacle Notification) ride the SAME runner that gates
+            // Pre/PostToolUse, so one config location covers every hook.
+            lifecycleHooks: hooks,
         }, options.planMode === true ? { allowedAgents: ['explore'] } : undefined);
         registry.register(withPerm(taskTool));
         tools.push({
@@ -570,6 +590,25 @@ export function createBuiltinToolRegistry(options = {}) {
             }
         }
     }
+    // WS7 slice 4b (t139): populate `ToolContext.emitSessionEvent` for EVERY
+    // registered tool, applied LAST (outermost) so the sink reaches the
+    // permission gate, the sandbox, the jail preflight and the tool body alike.
+    // WHY the host-side injection exists at all: both hosts hand this registry to
+    // `AgentHarness`, whose dispatch calls
+    // `registry.invoke(name, args, { cwd, sessionId, signal })` — the harness
+    // forwards NO host sink into the invoke options (AgentHarness.ts:839/1848).
+    // That one missing hop is why the whole tool-side telemetry surface (ADR-0033
+    // file.*, WS1 permission.denied, the WS7 slice-4 decision events) was dormant
+    // in production while its tests passed (they hand-build a ToolContext).
+    // No sink ⇒ no wrap: a registry built without one is byte-identical to before.
+    if (options.sessionEventSink) {
+        const sessionSink = options.sessionEventSink;
+        for (const name of registry.list()) {
+            const def = registry.get(name);
+            if (def)
+                registry.register(withSessionEventSink(def, sessionSink));
+        }
+    }
     return { registry, tools };
 }
 /**
@@ -720,7 +759,7 @@ export function resolveTentacleThinkingInput(agent, taskArg, env = process.env)
  * (F6) — can build a `TaskToolDeps` without duplicating this wiring.
  */
 export function createKrakenSubAgentContextFactory(opts) {
-    const { root, audit, sessionId, provider: providerOverride, model: modelOverride, parentPolicy, onPermissionAsk } = opts;
+    const { root, audit, sessionId, provider: providerOverride, model: modelOverride, parentPolicy, onPermissionAsk, sessionEventSink } = opts;
     return async ({ agent, cwd: subCwd, thinkingEffort }) => {
         const cfg = providerOverride
             ? await providerConfigFor(providerOverride)
@@ -792,6 +831,9 @@ export function createKrakenSubAgentContextFactory(opts) {
             ...(onPermissionAsk ? { onPermissionAsk } : {}),
             // P0.5: the tentacle's agent identity drives per-agent policy rules.
             policyAgent: agent,
+            // WS7 slice 4b (t139): inherit the parent turn's spine sink (absent ⇒
+            // the tentacle's tools emit nothing, i.e. today's behavior).
+            ...(sessionEventSink ? { sessionEventSink } : {}),
         });
         const wrapTentacleStream = (primary, primaryProviderId) => wrapWithHeadlessFailover({
             primary,
@@ -834,8 +876,13 @@ export function createKrakenSubAgentContextFactory(opts) {
 }
 /**
  * Gate tool execution with allow/ask/deny policy (OpenCode-style permissions).
+ *
+ * WS5 (t137): `hooks` is the lifecycle-hook runner used ONLY for the
+ * observation-only `PermissionRequest` (+ denied-`Notification`) events. It is
+ * called fire-and-forget and its verdict is discarded by construction, so
+ * passing it can never change the verdict computed below.
  */
-function wrapWithPermissions(original, policy, onAsk, agentLayers, precedence = 'restrict-only', root) {
+function wrapWithPermissions(original, policy, onAsk, agentLayers, precedence = 'restrict-only', root, hooks) {
     const required = (original.permissions ?? []);
     // Pure read tools under allow policy — no wrap overhead.
     const decisionProbe = resolveToolPermission(original.name, required, policy);
@@ -872,14 +919,36 @@ function wrapWithPermissions(original, policy, onAsk, agentLayers, precedence =
             // other layer or the category decision (same deny>ask>allow lattice).
             // No scoped contract ⇒ null ⇒ this slot is inert.
             const contractRule = matchContractCapabilityRule(requiredNow, (input ?? {}), root ?? process.cwd());
-            let action = intersectEffects(mergeRuleEffect(decision.action, rule), claims?.effect, contractRule?.effect);
+            // WS1 (t133): the local permission policy (`.zelari/permissions.json` +
+            // runtime session rules) is evaluated BEFORE the call is dispatched.
+            // null = no rule configured, or no rule matched → today's category
+            // decision stands, byte-identical. An 'allow' rule promotes only a
+            // CATEGORY ask (skip the prompt) — a category deny and every other
+            // layer's ask/deny stay restrict-only. An 'ask'/'deny' rule intersects
+            // like any other restriction.
+            const policyVerdict = evaluateToolDispatch({
+                toolName: original.name,
+                required: requiredNow,
+                args: input,
+                root: root ?? process.cwd(),
+            });
+            const categoryAction = policyVerdict?.decision === 'allow'
+                ? applyAllowRule(decision.action)
+                : policyVerdict?.decision === 'ask' || policyVerdict?.decision === 'deny'
+                    ? mergeRuleEffect(decision.action, {
+                        match: policyVerdict.matchedRuleId ?? 'permissions',
+                        effect: policyVerdict.decision,
+                        reason: policyVerdict.reason,
+                    })
+                    : decision.action;
+            let action = intersectEffects(mergeRuleEffect(categoryAction, rule), claims?.effect, contractRule?.effect);
             // W3.1 (t46): provenance escalation at the choke-point. Write/execute
             // args that EMBED fingerprinted non-user content (web fetch, MCP output,
             // file reads — safety/provenance.ts) escalate an "allow" to "ask":
             // injected instructions can no longer sail through on category
             // defaults. Deterministic substring match, zero LLM (P2); ask/deny
             // already gated pass through; ZELARI_PROVENANCE=0 opts out entirely.
-            let actionReason = decision.reason;
+            let actionReason = policyVerdict?.decision === 'ask' ? policyVerdict.reason : decision.reason;
             if (action !== 'deny' && (requiredNow.includes('write') || requiredNow.includes('execute'))) {
                 const provHit = provenanceMatchIn(JSON.stringify(input ?? {}));
                 if (provHit && provenanceAppliesTo(provHit.source, requiredNow)) {
@@ -921,19 +990,88 @@ function wrapWithPermissions(original, policy, onAsk, agentLayers, precedence =
                     : claimHit
                         ? `[policy] claim '${claimHit.match}'${claimHit.reason ? ` — ${claimHit.reason}` : ''}`
                         : '';
+            // WS7 slice 4 (t139): did THIS dispatch's ask get auto-answered by yolo?
+            // `autoApproveOrigin` needs the fact, not a re-derivation.
+            let yoloPromoted = false;
             // t65: yolo = full access — every residual ask (policy rules, claims,
             // contract, provenance) auto-approves instead of hitting the phone with
             // a permission.request. Explicit deny still denies ("deny is never
             // promoted", toolPermissions.ts contract).
             if (action === 'ask' && activePermissionPreset() === 'yolo') {
                 action = 'allow';
+                yoloPromoted = true;
+            }
+            // WS5 (t137): `action` is FINAL here — every layer merged, provenance
+            // applied, yolo promoted — which is exactly the moment a permission is
+            // requested or refused. Observation-only hooks fire from here:
+            // fire-and-forget, and `emitPermissionObserverHooks` swallows internal
+            // failures, so a hook can never block, slow or alter this dispatch.
+            if (action === 'ask' || action === 'deny') {
+                void emitPermissionObserverHooks(hooks, {
+                    tool: original.name,
+                    categories: requiredNow,
+                    effect: action,
+                    verdict: policyVerdict,
+                    args: input,
+                }, { sessionId: ctx.sessionId, cwd: ctx.cwd });
+            }
+            // WS7 slice 4 (t139): the DECISION, on the spine — `permission.asked` when
+            // the gate resolved this dispatch to a PROMPT (the fail-closed branch
+            // below included: the decision WAS "ask", there was simply nobody to ask),
+            // `auto_approve.granted` when it resolved to ALLOW with no prompt. Both go
+            // through the SAME sink `permission.denied` and the file.* telemetry use;
+            // both are best-effort (an absent or throwing sink changes nothing about
+            // the dispatch) and both are validated against their slice-2 contract
+            // before a single byte is written. The allow side is deliberately
+            // selective — see `autoApproveOrigin`: rule match, yolo promotion, and
+            // execute/network category grants only, never the read/write flood.
+            if (action === 'ask') {
+                await emitPermissionAsked(ctx.emitSessionEvent, {
+                    tool: original.name,
+                    categories: requiredNow,
+                    verdict: policyVerdict,
+                    args: input,
+                    reason: policyVerdict?.decision === 'ask' ? policyVerdict.reason : decision.reason,
+                });
+            }
+            else if (action === 'allow') {
+                const origin = autoApproveOrigin({
+                    effect: action,
+                    categories: requiredNow,
+                    verdict: policyVerdict,
+                    yoloPromoted,
+                });
+                if (origin) {
+                    await emitAutoApproveGranted(ctx.emitSessionEvent, {
+                        tool: original.name,
+                        categories: requiredNow,
+                        origin,
+                    });
+                }
             }
             if (action === 'deny') {
+                // WS1 (t133): a RULE deny is structured — the message names the
+                // matched rule id and the denial lands on the spine
+                // (`permission.denied`) through the same sink the file.* telemetry
+                // uses, so a replayed session exposes it. yolo never promotes a deny.
+                if (policyVerdict?.decision === 'deny') {
+                    await emitPermissionDenied(ctx.emitSessionEvent, {
+                        tool: original.name,
+                        verdict: policyVerdict,
+                        sessionId: ctx.sessionId,
+                    });
+                    return typedErr(`[permission] ${permissionDenialMessage(original.name, policyVerdict)}`);
+                }
                 return typedErr(`[permission] ${rulePrefix || decision.reason}`);
             }
             if (action === 'ask') {
                 if (!onAsk) {
-                    return typedErr(`[permission] ${rulePrefix ? `${rulePrefix} ` : ''}${decision.reason} No interactive approval available ` +
+                    // WS1 (t133): when the RULE layer forced (or failed closed on) this
+                    // ask, its reason is the one that names the matched rule id and the
+                    // offending `.zelari/permissions.json` — surface THAT, not the bare
+                    // category reason, or a malformed config reads as a category ask.
+                    const askReason = policyVerdict?.decision === 'ask' ? policyVerdict.reason : decision.reason;
+                    return typedErr(`[permission] ${rulePrefix ? `${rulePrefix} ` : ''}${askReason} No interactive approval available ` +
                         `(set ZELARI_AUTO=1 to auto-allow, or configure onPermissionAsk).`);
                 }
                 try {
@@ -1386,6 +1524,11 @@ function wrapWithShellSafety(original, audit, sessionId, root, jail) {
                 if (mode !== 'off' && !probe.available) {
                     if (mode === 'required') {
                         const reason = jailDenyReason(probe, mode);
+                        // WS7 slice 4 (t139): the deny this seam SURFACES is the typed
+                        // `[jail]` one, and the sibling spawn seam records exactly that
+                        // (spawnJailed already prefixed it) — so the spine carries the same
+                        // text the caller (and the model) got, never a twin spelling.
+                        const jailError = `[jail] ${reason}`;
                         await audit.append({
                             ts: new Date().toISOString(),
                             sessionId,
@@ -1396,7 +1539,18 @@ function wrapWithShellSafety(original, audit, sessionId, root, jail) {
                             durationMs: 0,
                             error: 'jail_denied',
                         });
-                        return { ok: false, error: `[jail] ${reason}` };
+                        // WS7 slice 4 (t139): `jail.blocked` — the jail REFUSED this spawn
+                        // (t28 golden rule: required + no honest backend ⇒ deny, never a
+                        // silent unjailed run). The backend + mode that failed it ride the
+                        // payload, so a replay can tell WHICH containment was missing.
+                        // Best-effort: same sink as every other decision event.
+                        await emitJailBlocked(ctx.emitSessionEvent, {
+                            backend: probe.backend,
+                            mode,
+                            reason: jailError,
+                            tool: original.name,
+                        });
+                        return { ok: false, error: jailError };
                     }
                     await audit.append({
                         ts: new Date().toISOString(),