@andares/pi-toolkits 0.11.0 → 0.11.2

package/src/features/permission/units.ts

@@ -57,6 +57,23 @@ export interface CommandUnit {
 
 const SENTINEL = "\u0000";
 
+/**
+ * Device sinks: writing to them is a no-op, not a boundary decision. They are
+ * excluded whenever they appear as a plain operand (`curl -o /dev/null`),
+ * not just as a redirect target (`cmd > /dev/null`). Commands that mutate the
+ * node itself (`rm /dev/null`, `mv /dev/null x`) still collect the target —
+ * the write-path branch below keeps them visible to the policy.
+ */
+const DEVICE_SINKS = new Set(["/dev/null", "/dev/stdout", "/dev/stderr"]);
+
+/**
+ * Commands whose ordinary arguments are never filesystem paths. `echo` /
+ * `printf` can only write through a redirect, which is collected separately,
+ * so skipping their operands cannot hide a write and avoids treating a
+ * message containing `/` plus an unresolved variable as an opaque path.
+ */
+const NO_PATH_OPERANDS = new Set(["echo", "printf"]);
+
 /* -------------------------------------------------------------------------- */
 /* Read/write classification                                                  */
 /* -------------------------------------------------------------------------- */
@@ -768,9 +785,7 @@ function analyzeSegment(
 	for (const redirect of redirects) {
 		if (redirect.target === undefined) continue;
 		if (redirect.op === "<<<") continue; // herestring: data, not a path
-		if (redirect.target === "/dev/null" || redirect.target === "/dev/stdout" || redirect.target === "/dev/stderr") {
-			continue;
-		}
+		if (DEVICE_SINKS.has(redirect.target)) continue;
 		const descriptor =
 			(redirect.op === ">&" || redirect.op === "<&" || redirect.op === "&>") &&
 			/^\d+$/.test(redirect.target);
@@ -839,9 +854,12 @@ function analyzeSegment(
 			}
 			targets.push({ path: pathValue, effect: "write", source: "operand" });
 		}
-	} else if (command === "dd") {		for (const arg of args) {
+	} else if (command === "dd") {
+		for (const arg of args) {
 			if (arg.startsWith("of=")) {
-				const pathValue = resolveTargetPath(base, arg.slice(3));
+				const value = arg.slice(3);
+				if (DEVICE_SINKS.has(value)) continue;
+				const pathValue = resolveTargetPath(base, value);
 				if (pathValue === undefined) {
 					return {
 						units: [opaqueUnit(raw, headWord, command, base, "unresolved dd target")],
@@ -858,28 +876,35 @@ function analyzeSegment(
 		}
 	}
 
-	// Path-like arguments are targets for every command.
-	for (const arg of args) {
-		if (!looksLikePath(arg)) continue;
-		// `sed -i` operands were already classified above; its script is not a path.
-		if (command === "sed" && effect === "write") continue;
-		const pathValue = resolveTargetPath(commandBase, arg);
-		if (pathValue === undefined) {
-			return {
-				units: [opaqueUnit(raw, headWord, command, base, "unresolved path argument")],
-				nextBase: base,
-			};
+	// Path-like arguments are targets for every command, except for commands
+	// whose arguments are data (`echo`, `printf`) and device sinks.
+	if (!NO_PATH_OPERANDS.has(command)) {
+		for (const arg of args) {
+			if (DEVICE_SINKS.has(arg)) continue;
+			if (!looksLikePath(arg)) continue;
+			// `sed -i` operands were already classified above; its script is not a path.
+			if (command === "sed" && effect === "write") continue;
+			const pathValue = resolveTargetPath(commandBase, arg);
+			if (pathValue === undefined) {
+				return {
+					units: [opaqueUnit(raw, headWord, command, base, "unresolved path argument")],
+					nextBase: base,
+				};
+			}
+			targets.push({ path: pathValue, effect, source: "operand" });
 		}
-		targets.push({ path: pathValue, effect, source: "operand" });
 	}
 
-	// `-o FILE` / `--output FILE` writes whatever the command is.
-	for (let i = 0; i < args.length; i++) {
-		if (args[i] !== "-o" && args[i] !== "--output") continue;
-		const value = args[i + 1];
-		if (value === undefined) continue;
-		const pathValue = resolveTargetPath(commandBase, value);
-		if (pathValue) targets.push({ path: pathValue, effect: "write", source: "operand" });
+	// `-o FILE` / `--output FILE` writes whatever the command is. `echo` and
+	// `printf` do not have an output option, so their `-o` is data too.
+	if (!NO_PATH_OPERANDS.has(command)) {
+		for (let i = 0; i < args.length; i++) {
+			if (args[i] !== "-o" && args[i] !== "--output") continue;
+			const value = args[i + 1];
+			if (value === undefined || DEVICE_SINKS.has(value)) continue;
+			const pathValue = resolveTargetPath(commandBase, value);
+			if (pathValue) targets.push({ path: pathValue, effect: "write", source: "operand" });
+		}
 	}
 
 	units.push({

package/src/features/stash/stash.ts

@@ -21,7 +21,7 @@ import type { KeyId } from "@earendil-works/pi-tui";
 /**
  * Stash hotkey.
  *
- * Compatibility rationale (verified against pi 0.99.0–1.4.0 keybindings, live
+ * Compatibility rationale (verified against pi 0.99.0–1.5.0 keybindings, live
  * matchesKey probes and terminal/OS behavior):
  *  - pi: no default binding for ctrl+alt+<letter> (only ctrl+alt+] is taken);
  *    extension shortcuts dispatch first while the editor is focused

package/src/lib/gates.ts

@@ -18,9 +18,9 @@
  *    promise. The queue serializes our own presentations; the host slot is
  *    still shared with other extensions (pi does not arbitrate globally).
  *    pi 1.4.0 stacks extension dialogs so a second one no longer strands the
- *    first (#11166), but the 1.1–1.3 hosts in the supported window still
+ *    first (#11166), but the 1.2–1.3 hosts in the supported window still
  *    replace it — the queue stays, and it also keeps one confirmation visible
- *    at a time instead of a pile of stacked dialogs on 1.4.0.
+ *    at a time instead of a pile of stacked dialogs on later hosts.
  *  - A gate that throws blocks the call (fail closed), matching pi's own
  *    `tool_call` handler contract.
  *

package/src/lib/model-config.ts

@@ -4,8 +4,8 @@
  * (review, compact-model — favorites keeps its own store-local key logic).
  *
  * Types are derived from pi-coding-agent's own exports (ModelRegistry)
- * rather than imported from @earendil-works/pi-ai: pi-ai's index.d.ts (1.1.0
- * through 1.4.0 alike) re-exports `Model`/`Api` via extensioned
+ * rather than imported from @earendil-works/pi-ai: pi-ai's index.d.ts (1.2.0
+ * through 1.5.0 alike) re-exports `Model`/`Api` via extensioned
  * `./types.ts` specifiers, which tsc 5.9 bundler resolution substitutes to
  * `.d.ts` but some tsserver builds do not. Deriving from ModelRegistry keeps
  * every resolver in agreement with the exact type

package/src/lib/model-picker.ts

@@ -9,11 +9,12 @@
  *
  * The component is driven through a small ModelRuntime facade backed by
  * ctx.modelRegistry (pi's extension-facing wrapper). SAFETY: verified
- * against pi 1.1.0–1.4.0 dist (modes/interactive/components/model-selector.js +
- * model-catalog-refresh.js — byte-identical across that span) — the
- * component only calls getAvailableSnapshot, getModel, getError and refresh
- * on modelRuntime, and ModelRegistry provides exactly those
- * (getAvailable/find/getError/refresh).
+ * against pi 1.2.0–1.5.0 dist (modes/interactive/components/model-selector.js +
+ * model-catalog-refresh.js) — the component only calls getAvailableSnapshot,
+ * getModel and getError on modelRuntime (plus refresh, which ModelRegistry
+ * provides) across that whole span. 1.5.0 changed the selector's rendering
+ * and key handling (page keys, disambiguating model names, viewport-input
+ * capture) but not the runtime surface this facade implements.
  *
  * `current` is passed as the component's currentModel: the built-in selector
  * preselects, ✓-marks and sorts-first its currentModel, so one Enter accepts