5 Commits

Include renames

Author	SHA1	Message	Date
NotExpectedYet	a9a25490db	fix: judge a search that names no path against the directory it would use ... The guard's rule was that a call naming no path is not judged, because a tool that names no path cannot leave the facet. That is true of a tool with no path argument and false of three that have one with a default: `grep` and `glob` document theirs as "Defaults to the session workspace", and `recall` falls back to a directory its own marker search picks. On any session whose facet is narrower than its directory — every session whose focus was set from the panel rather than by starting the conversation in the folder — a bare `grep` searches outside the facet and returns what it finds. An absent argument is not an absent path; it is the default one. The three tools are now judged against the directory they would have searched, through the same containment test that decides every other call, and the refusal is its own sentence rather than the "that path is outside" one: the path at issue is one the model never wrote, so the remedy is a second argument, not a grant. A tool with no path argument at all is still left alone. `bash` is still the documented way out, and the first deployment running this plugin confirmed it is a real one: an agent scoped to one module used a shell command to parse a config file outside its facet, having been told in the same prompt not to. That is what this plugin is for, and what it cannot do is stated in the README rather than implied.	2026-09-27 07:42:54 +01:00
NotExpectedYet	d9caf4eeec	feat: scope a session from a declaration the agent cannot widen ... The facet root was the session's working directory and nothing else, so the only way to scope a conversation to a module was to make the module a workspace — and the only way to reach anything outside it was `extraRoots`, which is a fact about the deployment rather than about one conversation. Scope now has two layers, and the split is the point. The **user layer** is `config.scopes[sessionId]` — a `focus` and a list of `extras`, written only from the browser context panel through the settings service, which is what `settings.mutate` requiring a volatile path buys us. The **agent layer** is in memory: a narrowing `focus` and its grants. Both can only ever reduce what the user layer allows, so an agent that goes wrong cannot widen its own scope. `facet action=focus` is therefore the one scope change the agent may make unasked, bounded by the scope already in force and decided on canonical targets. `reset` clears the agent's side only, landing on the user's declaration rather than on the session directory — landing on the directory would have made `reset` a widening. `extraRoots` demotes to an optional deployment-wide seed. The binding now names the context panel as the way to widen, because it is: in a deployment with no approval channel, `facet action=add` cannot be granted at all.	2026-09-27 06:10:53 +01:00
NotExpectedYet	a1c8ecb1e8	fix: say so when a session has no approval channel to ask through ... `ask` mode promises that an out-of-facet call is put to the user, and that promise needs a channel. A session can be composed without one: the `danger-full-access` permission preset sets `approval: never`, and the approval service's `decide()` then returns "rejected" before consulting any answerer. The call is refused, `facet action=add` is refused with it — widening is itself a question — and the scope can never be widened. The model is told none of that. `serviceAsk` replaces a rejected ask with `the user rejected tool \"…\"`, discarding the reason this guard wrote, so the binding is the only channel left that can state what is true. It now reads the session's effective approval policy and, when there is no channel, says the call was refused rather than asked and names the mechanism that still works: `extraRoots` is configuration applied by the profile, not a grant asked for per conversation. A missing approval service counts as no channel (the tool pipeline denies an ask it cannot route); an unreadable policy counts as a channel, so a transient failure never tells a user to go and edit their configuration.	2026-09-26 09:02:48 +01:00
NotExpectedYet	28f20a8aac	fix: show the settings card, and make an edit actually take effect ... `mode` and `extraRoots` carried no `volatile()` marker, so the framework's form projection dropped the whole entry from `settings.describe` and the plugin had no card under Plugins at all. The marker is what creates the card. It is also what turns each field into a reference rather than a value: the resolved config hands `apply` a `{get(), [write]}` per volatile field, which is how a settings write lands in a running plugin without re-applying it. So the policy and the guard now read both fields at the point of use instead of snapshotting them at mount, and `sectionOrder`/`contextOrder` stay unmarked because a prompt section cannot be re-ordered without a remount. A section is also registered once as a plain string, so the rule could not follow a live `mode` without freezing at load. The mode-specific sentence moved into the binding, which is a callback.	2026-09-26 07:13:33 +01:00
NotExpectedYet	0858862cda	init	2026-09-26 06:45:50 +01:00