@andares/pi-toolkits 0.8.0 → 0.9.1

package/src/features/autostart/autostart.test.ts

@@ -16,8 +16,10 @@ import {
 	AUTOSTART_CONFIG_PATH,
 	AutostartParseError,
 	commandNameOf,
+	GLOBAL_AUTOSTART_FILENAME,
 	parseAutostartConfig,
 	RUNNABLE_REASONS,
+	shouldReplay,
 } from "./autostart.js";
 import { registerAutostart } from "./index.js";
 
@@ -111,6 +113,28 @@ describe("RUNNABLE_REASONS", () => {
 	});
 });
 
+describe("shouldReplay", () => {
+	it("replays a genuinely new session", () => {
+		expect(shouldReplay("startup", false)).toBe(true);
+		expect(shouldReplay("new", false)).toBe(true);
+	});
+
+	it("skips a startup that already has history (a resumed process)", () => {
+		// `pi -c`, `-r`, `--session` and `--fork` all report `startup` for a
+		// session that already carries history.
+		expect(shouldReplay("startup", true)).toBe(false);
+	});
+
+	it("replays a fork even though the branch has history", () => {
+		expect(shouldReplay("fork", true)).toBe(true);
+	});
+
+	it("skips in-process resume and reload", () => {
+		expect(shouldReplay("resume", true)).toBe(false);
+		expect(shouldReplay("reload", true)).toBe(false);
+	});
+});
+
 /* ------------------------------------------------------------------ */
 /* registerAutostart integration (mocked pi surface)                   */
 /* ------------------------------------------------------------------ */
@@ -121,6 +145,7 @@ type SessionStartHandler = (
 		cwd: string;
 		isProjectTrusted: () => boolean;
 		ui: { notify: (message: string, type?: string) => void };
+		sessionManager: { buildContextEntries: () => Array<{ type: string }> };
 	},
 ) => Promise<void>;
 
@@ -132,14 +157,24 @@ interface Harness {
 	commands: Array<{ name: string; source: string }>;
 	failCommands: Set<string>;
 	setTrusted(trusted: boolean): void;
+	/** Simulate a session that already had a conversation (resumed process). */
+	setHistory(entries: Array<{ type: string }>): void;
 	start(reason: string): Promise<void>;
 }
 
 async function makeHarness(
 	config: string | null,
 	configAsDir = false,
+	globalConfig: string | null = null,
 ): Promise<Harness> {
 	const cwd = await mkdtemp(join(tmpdir(), "pi-autostart-test-"));
+	// The agent dir lives inside the temp project so cleanup covers it; passing
+	// it explicitly keeps the real ~/.pi/agent out of the test.
+	const agentDir = join(cwd, "agent");
+	await mkdir(agentDir, { recursive: true });
+	if (globalConfig !== null) {
+		await writeFile(join(agentDir, GLOBAL_AUTOSTART_FILENAME), globalConfig, "utf8");
+	}
 	if (configAsDir) {
 		// EISDIR setup: the config path exists but is a directory.
 		await mkdir(join(cwd, ".pi"), { recursive: true });
@@ -149,6 +184,12 @@ async function makeHarness(
 		await writeFile(join(cwd, AUTOSTART_CONFIG_PATH), config, "utf8");
 	}
 	let trusted = true;
+	// Boot-level entries every session has; a resumed session adds messages.
+	let history: Array<{ type: string }> = [
+		{ type: "session" },
+		{ type: "model_change" },
+		{ type: "thinking_level_change" },
+	];
 	let handler: SessionStartHandler = async () => {};
 	const sent: Harness["sent"] = [];
 	const notifications: Harness["notifications"] = [];
@@ -172,7 +213,7 @@ async function makeHarness(
 			}
 		},
 	} as unknown as ExtensionAPI;
-	registerAutostart(pi);
+	registerAutostart(pi, { agentDir });
 	return {
 		handler,
 		sent,
@@ -182,6 +223,9 @@ async function makeHarness(
 		setTrusted(value: boolean) {
 			trusted = value;
 		},
+		setHistory(entries) {
+			history = entries;
+		},
 		async start(reason: string) {
 			await handler({ reason }, {
 				cwd,
@@ -191,6 +235,7 @@ async function makeHarness(
 						notifications.push({ message, type });
 					},
 				},
+				sessionManager: { buildContextEntries: () => history },
 			});
 		},
 		cwd,
@@ -209,8 +254,9 @@ afterEach(async () => {
 async function harness(
 	config: string | null,
 	configAsDir = false,
+	globalConfig: string | null = null,
 ): Promise<Harness> {
-	const h = await makeHarness(config, configAsDir);
+	const h = await makeHarness(config, configAsDir, globalConfig);
 	current = h;
 	return h;
 }
@@ -256,6 +302,38 @@ describe("registerAutostart", () => {
 		expect(h.notifications).toEqual([]);
 	});
 
+	it("skips a process started on an existing session (pi -c reports startup)", async () => {
+		const h = await harness(fullConfig);
+		h.setHistory([
+			{ type: "session" },
+			{ type: "model_change" },
+			{ type: "message" },
+		]);
+		await h.start("startup");
+		expect(h.sent).toEqual([]);
+		expect(h.notifications).toEqual([]);
+	});
+
+	it("still replays when the session holds only boot-level entries", async () => {
+		const h = await harness(fullConfig);
+		h.setHistory([
+			{ type: "session" },
+			{ type: "model_change" },
+			{ type: "thinking_level_change" },
+			{ type: "session_info" },
+			{ type: "custom" },
+		]);
+		await h.start("startup");
+		expect(h.sent).toHaveLength(2);
+	});
+
+	it("replays a fork of a session that has history", async () => {
+		const h = await harness(fullConfig);
+		h.setHistory([{ type: "message" }]);
+		await h.start("fork");
+		expect(h.sent).toHaveLength(2);
+	});
+
 	it("silently skips when no config file exists", async () => {
 		const h = await harness(null);
 		await h.start("startup");
@@ -312,4 +390,37 @@ describe("registerAutostart", () => {
 		expect(h.notifications).toHaveLength(1);
 		expect(h.notifications[0]?.type).toBe("error");
 	});
+
+	it("runs the global config before the project config", async () => {
+		const h = await harness(
+			'[command]\nrun = ["/add-dir ../project"]',
+			false,
+			'[command]\nrun = ["/ask on"]',
+		);
+		await h.start("startup");
+		expect(h.sent.map((entry) => entry.command)).toEqual([
+			"/ask on",
+			"/add-dir ../project",
+		]);
+		expect(h.notifications).toEqual([]);
+	});
+
+	it("runs the global config in an untrusted project but skips the project one", async () => {
+		const h = await harness(
+			'[command]\nrun = ["/add-dir ../project"]',
+			false,
+			'[command]\nrun = ["/ask on"]',
+		);
+		h.setTrusted(false);
+		await h.start("startup");
+		expect(h.sent.map((entry) => entry.command)).toEqual(["/ask on"]);
+		expect(h.notifications).toHaveLength(1);
+		expect(h.notifications[0]?.type).toBe("warning");
+	});
+
+	it("keeps running the project config when the global one is absent", async () => {
+		const h = await harness('[command]\nrun = ["/ask on"]', false, null);
+		await h.start("startup");
+		expect(h.sent.map((entry) => entry.command)).toEqual(["/ask on"]);
+	});
 });

package/src/features/autostart/autostart.ts

@@ -18,10 +18,12 @@
  */
 import { parse as parseToml } from "smol-toml";
 
-/** Project-relative location of the autostart config (`.pi/` is pi's
- *  project-config convention, precedent: `.pi/mcp.json`). */
+/** Project-relative location of the project autostart config. */
 export const AUTOSTART_CONFIG_PATH = ".pi/autostart.toml";
 
+/** File name of the operator's global autostart config, inside the agent dir. */
+export const GLOBAL_AUTOSTART_FILENAME = "autostart.toml";
+
 /**
  * session_start reasons that replay autostart commands:
  *  - startup / new: fresh session in the project — replay
@@ -39,6 +41,30 @@ export const RUNNABLE_REASONS: ReadonlySet<string> = new Set([
 	"fork",
 ]);
 
+/**
+ * Whether this session start should replay the command lists.
+ *
+ * The reason alone is not enough at process start. `pi -c` (`--continue`),
+ * `-r` (`--resume`), `--session <path>` and `--fork <path>` all open an
+ * existing session *before* the first runtime exists, and that runtime is
+ * created without an explicit session_start event, so extensions see pi's
+ * default reason — `startup` — not `resume` (verified on pi 1.0.0–1.3.0:
+ * `main.js` builds the initial session manager from those flags and calls
+ * `createAgentSessionRuntime` with no `sessionStartEvent`;
+ * `agent-session.js` defaults it to `{ reason: "startup" }`). `resume` is only
+ * emitted for in-process session switches, never for a resumed process.
+ *
+ * So the session content decides: a `startup` on a session that already has
+ * conversation history is a resumed (or forked) process, and its branch already
+ * carries the state a replay would rebuild. `hasHistory` is the same signal pi
+ * itself uses to recognise an existing session
+ * (`buildSessionContext().messages.length > 0`).
+ */
+export function shouldReplay(reason: string, hasHistory: boolean): boolean {
+	if (reason === "startup") return !hasHistory;
+	return RUNNABLE_REASONS.has(reason);
+}
+
 /** Parse/validation failure with a user-facing message. */
 export class AutostartParseError extends Error {}
 

package/src/features/autostart/index.ts

@@ -1,81 +1,157 @@
 /**
- * autostart feature — run project-declared slash commands at session start.
+ * autostart feature — run declared slash commands at session start.
  *
- * Config lives at `<project root>/.pi/autostart.toml` (see autostart.ts for
- * the schema). Execution gates, in order:
+ * Two sources, executed in order, never merged:
  *
- *  1. reason filter — only startup/new/fork replay (see RUNNABLE_REASONS)
- *  2. config file exists — a missing file is a silent opt-in skip
- *  3. `ctx.isProjectTrusted()` — an untrusted project never auto-executes
- *  4. per-command pre-validation against `pi.getCommands()`: only commands
- *     registered by an *extension* are dispatched. This is mandatory:
- *     sendUserMessage with an unhandled "/x" falls through prompt() to the
- *     model as a plain user message (pi agent-session.js), so an unknown
- *     command must be skipped here, never sent.
+ *  1. `<agentDir>/autostart.toml` — the operator's own defaults. Runs in every
+ *     project; no trust gate, because the file lives in pi's config directory
+ *     and is not controlled by the project.
+ *  2. `<project root>/.pi/autostart.toml` — project-declared commands. Gated on
+ *     `ctx.isProjectTrusted()`: an untrusted repository must not execute
+ *     anything.
+ *
+ * Execution gates, in order:
+ *
+ *  - reason filter — see `shouldReplay`: startup/new/fork replay, but a
+ *    `startup` that already carries conversation history is a process started
+ *    on an existing session (`pi -c`/`-r`/`--session`/`--fork`) and does not
+ *  - config file exists — a missing file is a silent opt-in skip
+ *  - project trust (project source only)
+ *  - per-command pre-validation against `pi.getCommands()`: only commands
+ *    registered by an *extension* are dispatched. This is mandatory:
+ *    sendUserMessage with an unhandled "/x" falls through prompt() to the
+ *    model as a plain user message (pi agent-session.js), so an unknown
+ *    command must be skipped here, never sent.
  *
  * Dispatch uses `sendUserMessage(cmd, { expandPromptTemplates: true })` —
  * that flag is what routes "/cmd args" through _tryExecuteExtensionCommand
- * instead of the model prompt path. The wrapper defaults it to false
- * (each byte-identical across every published version of the supported
- * window, 1.0.0 → 1.3.0; see AGENTS.md host-compat
- * discipline for the version matrix).
+ * instead of the model prompt path. The wrapper defaults it to false in this
+ * package (each byte-identical across every published version of the supported
+ * window, 1.0.0 → 1.3.0; see AGENTS.md host-compat discipline for the version
+ * matrix).
  *
  * Only extension commands can run this way. Built-in commands (/compact,
  * /reload, /resume, …) are dispatched at the TUI layer and cannot be
  * triggered from the extension layer; skill commands (/skill:name) expand
- * into prompts rather than execute. First-party use case: `/add-dir`
- * (pi-add-dir), which is idempotent ("Already added" check).
+ * into prompts rather than execute. First-party use cases: `/add-dir`
+ * (pi-add-dir, idempotent) and `/ask-perm` (session-scoped permission).
  */
 import { readFile } from "node:fs/promises";
 import { join } from "node:path";
-import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { getAgentDir } from "@earendil-works/pi-coding-agent";
+import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import {
 	AUTOSTART_CONFIG_PATH,
 	AutostartParseError,
 	commandNameOf,
+	GLOBAL_AUTOSTART_FILENAME,
 	parseAutostartConfig,
-	RUNNABLE_REASONS,
+	shouldReplay,
 } from "./autostart.js";
 
-export function registerAutostart(pi: ExtensionAPI): void {
-	pi.on("session_start", async (event, ctx) => {
-		if (!RUNNABLE_REASONS.has(event.reason)) return;
+export interface AutostartOptions {
+	/** pi's config directory; defaults to `getAgentDir()`. */
+	readonly agentDir?: string;
+}
+
+interface Source {
+	readonly path: string;
+	readonly label: string;
+	/** Project sources require trust; the operator's global file does not. */
+	readonly requiresTrust: boolean;
+}
+
+function messageOf(error: unknown): string {
+	return error instanceof Error ? error.message : String(error);
+}
 
+/**
+ * Entry types that prove the session already held a conversation.
+ *
+ * `buildContextEntries()` returns the active branch's entries including the
+ * boot-level ones (`session`, `model_change`, `thinking_level_change`), so
+ * presence alone is not enough — a brand-new session has those too.
+ */
+const HISTORY_ENTRY_TYPES: ReadonlySet<string> = new Set([
+	"message",
+	"custom_message",
+	"compaction",
+	"branch_summary",
+]);
+
+/**
+ * Whether the session already carries conversation history.
+ *
+ * This is how a `startup` on an existing session (a resumed process) is told
+ * apart from a genuinely new one — see {@link shouldReplay}. An unreadable
+ * session manager counts as new, which keeps the feature working in hosts where
+ * the session surface is unavailable.
+ */
+function hasConversationHistory(ctx: ExtensionContext): boolean {
+	try {
+		return ctx.sessionManager
+			.buildContextEntries()
+			.some((entry) => HISTORY_ENTRY_TYPES.has(entry.type));
+	} catch {
+		return false;
+	}
+}
+
+export function registerAutostart(
+	pi: ExtensionAPI,
+	options: AutostartOptions = {},
+): void {
+	const agentDir = options.agentDir ?? getAgentDir();
+
+	async function readCommands(
+		ctx: ExtensionContext,
+		source: Source,
+	): Promise<string[] | undefined> {
 		let text: string;
 		try {
-			text = await readFile(join(ctx.cwd, AUTOSTART_CONFIG_PATH), "utf8");
+			text = await readFile(source.path, "utf8");
 		} catch (err) {
 			// Missing file = opt-in skip. Any other read failure (EACCES, EISDIR,
 			// …) is a misconfiguration the operator should hear about.
 			if ((err as NodeJS.ErrnoException).code !== "ENOENT") {
 				ctx.ui.notify(
-					`autostart: skipped — cannot read ${AUTOSTART_CONFIG_PATH}: ${err instanceof Error ? err.message : String(err)}`,
+					`autostart: skipped ${source.label} — cannot read ${source.path}: ${messageOf(err)}`,
 					"warning",
 				);
 			}
-			return;
+			return undefined;
 		}
 
-		let commands: string[];
 		try {
-			commands = parseAutostartConfig(text);
+			return parseAutostartConfig(text);
 		} catch (err) {
 			const message = err instanceof AutostartParseError ? err.message : String(err);
 			ctx.ui.notify(
-				`autostart: skipped — ${message} (${AUTOSTART_CONFIG_PATH})`,
+				`autostart: skipped ${source.label} — ${message} (${source.path})`,
 				"error",
 			);
-			return;
+			return undefined;
 		}
-		if (commands.length === 0) return;
+	}
 
-		if (!ctx.isProjectTrusted()) {
-			ctx.ui.notify(
-				`autostart: skipped — project not trusted (${AUTOSTART_CONFIG_PATH})`,
-				"warning",
-			);
-			return;
-		}
+	pi.on("session_start", async (event, ctx) => {
+		// `pi -c` / `-r` / `--session` / `--fork` report `startup` for a session
+		// that already has history; the content is what tells them apart. See
+		// shouldReplay in autostart.ts for the host-side evidence.
+		if (!shouldReplay(event.reason, hasConversationHistory(ctx))) return;
+
+		const sources: Source[] = [
+			{
+				path: join(agentDir, GLOBAL_AUTOSTART_FILENAME),
+				label: "global config",
+				requiresTrust: false,
+			},
+			{
+				path: join(ctx.cwd, AUTOSTART_CONFIG_PATH),
+				label: "project config",
+				requiresTrust: true,
+			},
+		];
 
 		// Only extension-registered commands are dispatchable; skill and
 		// prompt-template entries expand rather than execute.
@@ -87,23 +163,36 @@ export function registerAutostart(pi: ExtensionAPI): void {
 				),
 		);
 
-		for (const command of commands) {
-			const name = commandNameOf(command);
-			if (!name || !dispatchable.has(name)) {
+		for (const source of sources) {
+			const commands = await readCommands(ctx, source);
+			if (commands === undefined || commands.length === 0) continue;
+
+			if (source.requiresTrust && !ctx.isProjectTrusted()) {
 				ctx.ui.notify(
-					`autostart: skipped "${command}" — not a registered extension command`,
+					`autostart: skipped ${source.label} — project not trusted (${source.path})`,
 					"warning",
 				);
 				continue;
 			}
-			// One failing command must not cancel the rest of the list.
-			try {
-				await pi.sendUserMessage(command, { expandPromptTemplates: true });
-			} catch (err) {
-				ctx.ui.notify(
-					`autostart: "${command}" failed — ${err instanceof Error ? err.message : String(err)}`,
-					"error",
-				);
+
+			for (const command of commands) {
+				const name = commandNameOf(command);
+				if (!name || !dispatchable.has(name)) {
+					ctx.ui.notify(
+						`autostart: skipped "${command}" — not a registered extension command`,
+						"warning",
+					);
+					continue;
+				}
+				// One failing command must not cancel the rest of the list.
+				try {
+					await pi.sendUserMessage(command, { expandPromptTemplates: true });
+				} catch (err) {
+					ctx.ui.notify(
+						`autostart: "${command}" failed — ${messageOf(err)}`,
+						"error",
+					);
+				}
 			}
 		}
 	});

package/src/features/permission/constants.test.ts

@@ -0,0 +1,60 @@
+/**
+ * Fixed safety tables: credential paths are denied in every mode, destructive
+ * commands always ask.
+ */
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { describe, expect, it } from "vitest";
+import { dangerReason, secretReason } from "./constants.js";
+
+const HOME = homedir();
+
+describe("secrets table", () => {
+	it("covers the credential directories exactly", () => {
+		expect(secretReason(join(HOME, ".ssh", "id_rsa"))).toBe("credentials");
+		expect(secretReason(join(HOME, ".ssh"))).toBe("credentials");
+		expect(secretReason(join(HOME, ".gnupg", "private-keys-v1.d"))).toBe("credentials");
+		expect(secretReason(join(HOME, ".aws", "credentials"))).toBe("credentials");
+	});
+
+	it("does not over-match a sibling prefix", () => {
+		expect(secretReason(join(HOME, ".ssh-easy", "x"))).toBeUndefined();
+		expect(secretReason(join(HOME, ".ssh_evil", "x"))).toBeUndefined();
+		expect(secretReason(join(HOME, ".awsconfig", "x"))).toBeUndefined();
+	});
+
+	it("covers pi auth files but nothing else under the agent dir", () => {
+		expect(secretReason(join(HOME, ".pi", "agent", "auth.json"))).toBe("pi credentials");
+		expect(secretReason(join(HOME, ".pi", "agent", "auth-foo.json"))).toBe("pi credentials");
+		expect(secretReason(join(HOME, ".pi", "agent", "settings.json"))).toBeUndefined();
+		expect(secretReason(join(HOME, ".pi", "agent", "xauth", "auth.json"))).toBeUndefined();
+	});
+
+	it("covers .env files but not the templates", () => {
+		expect(secretReason("/proj/.env")).toBe("environment file");
+		expect(secretReason("/proj/.env.local")).toBe("environment file");
+		expect(secretReason("/proj/.env.example")).toBeUndefined();
+	});
+});
+
+describe("danger table", () => {
+	it("catches the destructive core", () => {
+		expect(dangerReason("rm", ["-rf", "/"], ["/"], "/proj")).toContain("recursive delete");
+		expect(dangerReason("rm", ["-rf", HOME], [HOME], "/proj")).toContain("recursive delete");
+		expect(dangerReason("rm", ["-rf", "/proj"], ["/proj"], "/proj")).toContain("recursive delete");
+		expect(dangerReason("git", ["push", "--force"], [], "/proj")).toBe("forced git push");
+		expect(dangerReason("git", ["push", "-f"], [], "/proj")).toBe("forced git push");
+		expect(dangerReason("git", ["reset", "--hard"], [], "/proj")).toBe("git reset --hard");
+		expect(dangerReason("git", ["clean", "-fd"], [], "/proj")).toBe("git clean -f");
+		expect(dangerReason("npm", ["publish"], [], "/proj")).toBe("package publish");
+		expect(dangerReason("dd", ["of=/dev/sda"], ["/dev/sda"], "/proj")).toBe("raw device write");
+		expect(dangerReason("sudo", ["rm", "x"], ["/proj/x"], "/proj")).toBe("privileged command");
+	});
+
+	it("does not flag ordinary commands", () => {
+		expect(dangerReason("rm", ["-rf", "/proj/build"], ["/proj/build"], "/proj")).toBeUndefined();
+		expect(dangerReason("git", ["push"], [], "/proj")).toBeUndefined();
+		expect(dangerReason("git", ["log"], [], "/proj")).toBeUndefined();
+		expect(dangerReason("npm", ["view", "react"], [], "/proj")).toBeUndefined();
+	});
+});