@andares/pi-toolkits 0.9.3 → 0.9.5

package/README.md

@@ -106,7 +106,7 @@ Enter with `/ask` (press it again to exit). Meant for the case where you only wa
 - `/ask-perm allow allow allow ask` — positional form (`in-read in-write out-read out-write`), enables immediately without a dialog. Missing arguments fall back to the defaults. This is the form autostart uses.
 - `/ask-perm` again — turns it off.
 
-Repeating the argument form with the modes already in force is a **no-op**: no second "ON" notice and no loss of the session grants collected so far. Changing any mode notifies and clears those grants, because they were made under the old policy.
+Repeating the argument form with the modes already in force is a **no-op**: no second "ON" notice and no loss of the session grants collected so far. Changing any mode records the change and clears those grants, because they were made under the old policy.
 
 **Defaults**: in-project read/write allowed, outside read allowed, outside write asks.
 
@@ -141,7 +141,7 @@ Repeating the argument form with the modes already in force is a **no-op**: no s
 run = ["/ask-perm allow allow allow ask"]
 ```
 
-> **Implementation notes**: state is reset on `session_start` and cleared on `session_shutdown`; the footer shows `perm i:A/A o:A/ask` while on (`A` allow, `a` ask, `D` deny). Subagent sessions start with their own state and do not inherit the parent's mode — when child sessions must be gated too, enable it through the project's autostart file. POSIX hosts (Linux / macOS / WSL) are the tested target; native Windows Git-Bash path spellings are approximated, not verified. bash decomposition uses `shell-quote`; unknown variables expand to a sentinel that makes the unit ask instead of silently becoming an empty path. Added directories are read from pi-add-dir's session entry (`add-dir:state`). Heuristic, not a sandbox: project-internal destructive commands are covered by the fixed table, not by a sandbox. One known blind spot: a *read* command's bare filename operand (`cat notes.txt`) is not collected as a target, so with `out read = ask` only absolute-path-shaped read operands are questioned — reads never write, so the four modes' write side is unaffected.
+> **Implementation notes**: a new session resets the state on `session_start` (a repeated emission for the same session keeps it); the footer shows `perm i:A/A o:A/ask` while on (`A` allow, `a` ask, `D` deny). Subagent sessions start with their own state and do not inherit the parent's mode — when child sessions must be gated too, enable it through the project's autostart file. POSIX hosts (Linux / macOS / WSL) are the tested target; native Windows Git-Bash path spellings are approximated, not verified. bash decomposition uses `shell-quote`; unknown variables expand to a sentinel that makes the unit ask instead of silently becoming an empty path. Added directories are read from pi-add-dir's session entry (`add-dir:state`). Heuristic, not a sandbox: project-internal destructive commands are covered by the fixed table, not by a sandbox. One known blind spot: a *read* command's bare filename operand (`cat notes.txt`) is not collected as a target, so with `out read = ask` only absolute-path-shaped read operands are questioned — reads never write, so the four modes' write side is unaffected.
 
 ---
 

package/README.zh-CN.md

@@ -141,7 +141,7 @@ pi -e ./src/index.ts
 run = ["/ask-perm allow allow allow ask"]
 ```
 
-> **实现说明**:状态在 `session_start` 重置、`session_shutdown` 清空;开启时 footer 显示 `perm i:A/A o:A/ask`(`A` allow、`a` ask、`D` deny)。子代理会话有自己的状态、不继承父会话的模式;需要子会话也受控时,通过项目 autostart 再开启一次。实测目标是 POSIX 宿主(Linux/macOS/WSL);原生 Windows Git-Bash 的路径拼写只做了近似,未验证。bash 拆解使用 `shell-quote`;未知变量会展开成哨兵而不是空字符串,使该命令转为询问而不是被悄悄当成空路径。add-dir 目录从 pi-add-dir 的会话条目 `add-dir:state` 读取。启发式,不是沙箱:项目内的破坏性操作由固定表兜底,而不是靠沙箱。已知盲区一处:**读命令的裸文件名参数**(`cat notes.txt`)不被收集为目标,所以把 `out read` 调成 `ask` 时只有绝对路径形状的读目标会被问——读本身不会写,四格模式的写侧不受影响。
+> **实现说明**:新会话在 `session_start` 重置状态(同一会话的重复 emission 保持状态);开启时 footer 显示 `perm i:A/A o:A/ask`(`A` allow、`a` ask、`D` deny)。子代理会话有自己的状态、不继承父会话的模式;需要子会话也受控时,通过项目 autostart 再开启一次。实测目标是 POSIX 宿主(Linux/macOS/WSL);原生 Windows Git-Bash 的路径拼写只做了近似,未验证。bash 拆解使用 `shell-quote`;未知变量会展开成哨兵而不是空字符串,使该命令转为询问而不是被悄悄当成空路径。add-dir 目录从 pi-add-dir 的会话条目 `add-dir:state` 读取。启发式,不是沙箱:项目内的破坏性操作由固定表兜底,而不是靠沙箱。已知盲区一处:**读命令的裸文件名参数**(`cat notes.txt`)不被收集为目标,所以把 `out read` 调成 `ask` 时只有绝对路径形状的读目标会被问——读本身不会写,四格模式的写侧不受影响。
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@andares/pi-toolkits",
-  "version": "0.9.3",
+  "version": "0.9.5",
   "description": "Integrated toolkit extension for pi — ask mode (read-only Q&A), session-scoped permission checks, model favorites, prompt stash, third-party code review, session autostart, and a dedicated compaction model",
   "type": "module",
   "license": "MIT",

package/src/features/autostart/autostart.test.ts

@@ -21,6 +21,7 @@ import {
 	RUNNABLE_REASONS,
 	shouldReplay,
 } from "./autostart.js";
+import { consumeStartupCommand } from "../../lib/startup.js";
 import { registerAutostart } from "./index.js";
 
 describe("parseAutostartConfig", () => {
@@ -159,6 +160,7 @@ interface Harness {
 	notifications: Array<{ message: string; type?: string }>;
 	commands: Array<{ name: string; source: string }>;
 	failCommands: Set<string>;
+	startupAtDispatch: Array<{ command: string; startup: boolean }>;
 	setTrusted(trusted: boolean): void;
 	/** Simulate a session that already had a conversation (resumed process). */
 	setHistory(entries: Array<{ type: string }>): void;
@@ -201,7 +203,9 @@ async function makeHarness(
 	const commands: Harness["commands"] = [
 		{ name: "add-dir", source: "extension" },
 		{ name: "ask", source: "extension" },
+		{ name: "ask-perm", source: "extension" },
 	];
+	const startupAtDispatch: Harness["startupAtDispatch"] = [];
 	const failCommands = new Set<string>();
 	const pi = {
 		on: (event: string, h: SessionStartHandler) => {
@@ -213,6 +217,10 @@ async function makeHarness(
 			options?: { expandPromptTemplates?: boolean },
 		) => {
 			sent.push({ command, options }); // records attempts, including failures
+			startupAtDispatch.push({
+				command,
+				startup: consumeStartupCommand("ask-perm"),
+			});
 			if (failCommands.has(command)) {
 				return Promise.reject(new Error("boom"));
 			}
@@ -222,6 +230,7 @@ async function makeHarness(
 	return {
 		handler,
 		sent,
+		startupAtDispatch,
 		notifications,
 		commands,
 		failCommands,
@@ -315,6 +324,23 @@ describe("registerAutostart", () => {
 		expect(h.notifications).toEqual([]);
 	});
 
+	it("marks our own command as a startup notice and clears the mark", async () => {
+		const h = await harness('[command]\nrun = ["/ask-perm allow"]');
+		await h.start("startup");
+		expect(h.startupAtDispatch).toEqual([
+			{ command: "/ask-perm allow", startup: true },
+		]);
+		expect(consumeStartupCommand("ask-perm")).toBe(false);
+	});
+
+	it("leaves other extensions' commands unmarked", async () => {
+		const h = await harness(fullConfig);
+		await h.start("startup");
+		expect(h.startupAtDispatch.every((entry) => entry.startup === false)).toBe(
+			true,
+		);
+	});
+
 	it("replays once per session even if session_start is emitted twice", async () => {
 		const h = await harness(fullConfig);
 		await h.start("startup");

package/src/features/autostart/index.ts

@@ -40,6 +40,7 @@ import { readFile } from "node:fs/promises";
 import { join } from "node:path";
 import { getAgentDir } from "@earendil-works/pi-coding-agent";
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { clearStartupCommand, markStartupCommand } from "../../lib/startup.js";
 import {
 	AUTOSTART_CONFIG_PATH,
 	AutostartParseError,
@@ -213,6 +214,12 @@ export function registerAutostart(
 				}
 				if (dispatched.has(command)) continue;
 				dispatched.add(command);
+				// Our own command answers a startup notice with a session entry
+				// instead of a status line: at startup several commands emit status
+				// lines and a later UI invalidation would paint our text on all of
+				// them (see lib/startup.ts).
+				const startup = name === "ask-perm";
+				if (startup) markStartupCommand(name);
 				// One failing command must not cancel the rest of the list.
 				try {
 					await pi.sendUserMessage(command, { expandPromptTemplates: true });
@@ -221,6 +228,8 @@ export function registerAutostart(
 						`autostart: "${command}" failed — ${messageOf(err)}`,
 						"error",
 					);
+				} finally {
+					if (startup) clearStartupCommand(name);
 				}
 			}
 		}

package/src/features/permission/index.test.ts

@@ -15,6 +15,7 @@ import type {
 	ToolCallEvent,
 } from "@earendil-works/pi-coding-agent";
 import type { AskDecision, GateHub, ToolGate } from "../../lib/gates.js";
+import { markStartupCommand } from "../../lib/startup.js";
 import { registerPermission } from "./index.js";
 
 function bashEvent(command: string): ToolCallEvent {
@@ -50,6 +51,7 @@ interface Harness {
 	readonly gate: ToolGate;
 	readonly statuses: Array<[string, string | undefined]>;
 	readonly notes: Array<{ message: string; kind?: string }>;
+	readonly entries: Array<{ type: string; data: unknown }>;
 	readonly branch: Array<Record<string, unknown>>;
 	setSessionId(id: string): void;
 	evaluate(event: ToolCallEvent): Promise<unknown>;
@@ -62,6 +64,7 @@ function makeHarness(): Harness {
 	const cwd = realpathSync(mkdtempSync(join(tmpdir(), "pi-perm-test-")));
 	const statuses: Harness["statuses"] = [];
 	const notes: Harness["notes"] = [];
+	const entries: Harness["entries"] = [];
 	const branch: Harness["branch"] = [];
 	let sessionId = "session-1";
 	const ctx = {
@@ -102,6 +105,10 @@ function makeHarness(): Harness {
 		) {
 			if (name === "ask-perm") commandHandler = options.handler;
 		},
+		appendEntry(type: string, data: unknown) {
+			entries.push({ type, data });
+		},
+		registerEntryRenderer() {},
 	} as unknown as ExtensionAPI;
 
 	registerPermission(pi, hub);
@@ -114,6 +121,7 @@ function makeHarness(): Harness {
 		gate,
 		statuses,
 		notes,
+		entries,
 		branch,
 		setSessionId(id: string) {
 			sessionId = id;
@@ -208,6 +216,29 @@ describe("/ask-perm", () => {
 		expect(await h.evaluate(bashEvent("rm -rf /tmp/outside"))).toBeUndefined();
 	});
 
+	it("writes a startup notice as an entry instead of a status line", async () => {
+		const h = makeHarness();
+		markStartupCommand("ask-perm");
+		await h.command("allow allow allow ask");
+		expect(h.notes).toHaveLength(0);
+		expect(h.entries).toHaveLength(1);
+		expect((h.entries[0]?.data as { text: string }).text).toContain(
+			"Permission ON",
+		);
+		expect(h.statuses.at(-1)?.[1]).toContain("perm");
+		expect(asAsk(await h.evaluate(bashEvent("rm -rf /tmp/outside"))).kind).toBe(
+			"ask",
+		);
+	});
+
+	it("still reports an invalid argument from autostart", async () => {
+		const h = makeHarness();
+		markStartupCommand("ask-perm");
+		await h.command("deny");
+		expect(h.notes.at(-1)?.kind).toBe("error");
+		expect(h.entries).toHaveLength(0);
+	});
+
 	it("keeps the mode off when the panel is cancelled", async () => {
 		const h = makeHarness();
 		await h.command("");

package/src/features/permission/index.ts

@@ -3,9 +3,9 @@
  *
  * Design notes:
  *  - Off by default and never persisted. The mode, the modes, and every session
- *    grant live in this closure; `session_start` resets them and
- *    `session_shutdown` clears them. A forgotten toggle cannot follow the
- *    operator into the next session.
+ *    grant live in this closure; `session_start` resets them for a new session
+ *    and keeps them across a rebind of the same session. A forgotten toggle
+ *    cannot follow the operator into the next session.
  *  - Toggling: no arguments flips on→off, off→panel. Arguments configure and
  *    enable in one step (`/ask-perm allow allow allow ask`), which is also the
  *    autostart path and never opens a dialog.
@@ -21,7 +21,9 @@ import type {
 	ExtensionContext,
 	ToolCallEvent,
 } from "@earendil-works/pi-coding-agent";
+import { Text } from "@earendil-works/pi-tui";
 import type { AskRequest, GateHub } from "../../lib/gates.js";
+import { consumeStartupCommand } from "../../lib/startup.js";
 import {
 	DEFAULT_MODES,
 	type PermissionModes,
@@ -96,7 +98,37 @@ function toolUnit(
 	};
 }
 
+/**
+ * Chat notices are custom session entries, not `ctx.ui.notify("info")`.
+ *
+ * The host renders every info notice as a `ThemedText` whose builder reads one
+ * shared `lastStatusMessage` field, and `ui.invalidate()` (theme switch, theme
+ * file edit, syntax-grammar load at startup) rebuilds *every* status line from
+ * that field. Any earlier status line — for example `/add-dir`'s — then shows
+ * our text too, so a single command looks like it ran twice. The invalidate is
+ * also why the duplicate depends on startup timing and terminal.
+ *
+ * A custom entry carries its own text and is rendered from that data, so it is
+ * immune to invalidation. Entries stay out of the model context (same pattern
+ * as pi-chrome) and survive the startup chat rebuild instead of being wiped.
+ *
+ * Only startup notices (dispatched by autostart, `lib/startup.ts`) use an
+ * entry. Interactive toggles keep `ctx.ui.notify`: consecutive info notices
+ * update the previous line in place, so ON/OFF/ON does not scroll the screen.
+ */
+const NOTICE_ENTRY = "ask-perm:notice";
+
+interface NoticeData {
+	text: string;
+}
+
 export function registerPermission(pi: ExtensionAPI, gates: GateHub): void {
+	pi.registerEntryRenderer?.(NOTICE_ENTRY, (entry, _options, theme) => {
+		const text = (entry.data as NoticeData | undefined)?.text;
+		return text === undefined
+			? undefined
+			: new Text(theme.fg("dim", text), 1, 0);
+	});
 	let enabled = false;
 	let modes: PermissionModes = { ...DEFAULT_MODES };
 	// Session this state belongs to. A runtime rebind can emit `session_start`
@@ -263,6 +295,12 @@ export function registerPermission(pi: ExtensionAPI, gates: GateHub): void {
 		description:
 			"Toggle permission checks; with arguments: /ask-perm [in-read] [in-write] [out-read] [out-write]",
 		handler: async (args, ctx) => {
+			// Startup notices are entries; interactive ones stay in-place toasts.
+			const startup = consumeStartupCommand("ask-perm");
+			const notice = (text: string): void => {
+				if (startup) pi.appendEntry<NoticeData>(NOTICE_ENTRY, { text });
+				else ctx.ui.notify(text, "info");
+			};
 			const raw = args.trim();
 
 			if (raw !== "") {
@@ -283,10 +321,7 @@ export function registerPermission(pi: ExtensionAPI, gates: GateHub): void {
 				if (changed) rules.clear();
 				enabled = true;
 				syncStatus(ctx);
-				ctx.ui.notify(
-					`Permission ON — ${formatModes(modes)}. /ask-perm to turn off.`,
-					"info",
-				);
+				notice(`Permission ON — ${formatModes(modes)}. /ask-perm to turn off.`);
 				return;
 			}
 
@@ -294,18 +329,14 @@ export function registerPermission(pi: ExtensionAPI, gates: GateHub): void {
 				enabled = false;
 				rules.clear();
 				syncStatus(ctx);
-				ctx.ui.notify(
-					"Permission OFF — no boundary checks in this session.",
-					"info",
-				);
+				notice("Permission OFF — no boundary checks in this session.");
 				return;
 			}
 
 			const chosen = await openPermissionPanel(ctx, modes);
 			if (!chosen) {
-				ctx.ui.notify(
+				notice(
 					"ask-perm: cancelled. Use /ask-perm allow allow allow ask to enable from the argument form.",
-					"info",
 				);
 				return;
 			}
@@ -314,10 +345,7 @@ export function registerPermission(pi: ExtensionAPI, gates: GateHub): void {
 			rules.clear();
 			enabled = true;
 			syncStatus(ctx);
-			ctx.ui.notify(
-				`Permission ON — ${formatModes(modes)}. /ask-perm to turn off.`,
-				"info",
-			);
+			notice(`Permission ON — ${formatModes(modes)}. /ask-perm to turn off.`);
 		},
 	});
 

package/src/lib/startup.test.ts

@@ -0,0 +1,26 @@
+import { describe, expect, it } from "vitest";
+import {
+	clearStartupCommand,
+	consumeStartupCommand,
+	markStartupCommand,
+} from "./startup.js";
+
+describe("startup handoff", () => {
+	it("consumes a mark exactly once", () => {
+		markStartupCommand("ask-perm");
+		expect(consumeStartupCommand("ask-perm")).toBe(true);
+		expect(consumeStartupCommand("ask-perm")).toBe(false);
+	});
+
+	it("ignores other commands", () => {
+		markStartupCommand("ask-perm");
+		expect(consumeStartupCommand("third-review")).toBe(false);
+		expect(consumeStartupCommand("ask-perm")).toBe(true);
+	});
+
+	it("can be cleared without a consumer", () => {
+		markStartupCommand("ask-perm");
+		clearStartupCommand("ask-perm");
+		expect(consumeStartupCommand("ask-perm")).toBe(false);
+	});
+});

package/src/lib/startup.ts

@@ -0,0 +1,36 @@
+/**
+ * Startup handoff for commands dispatched by autostart.
+ *
+ * Why the distinction: the host renders an info notice (`ctx.ui.notify`) as a
+ * `ThemedText` whose builder reads one shared `lastStatusMessage` field, and a
+ * UI invalidation (theme switch, theme-file edit, syntax-grammar load at
+ * startup) rebuilds *every* status line from that field. At startup several
+ * commands emit status lines (/add-dir, …), so our notice makes the earlier
+ * lines display our text too — one command looks like it ran twice.
+ *
+ * Interactive toggles have the opposite preference: consecutive info notices
+ * update the previous line in place, so ON/OFF/ON does not scroll the screen.
+ *
+ * Autostart therefore marks the commands it starts, and our command answers
+ * differently: a startup notice is a custom session entry (own text, immune to
+ * invalidation), while an interactive one stays a transient status line.
+ *
+ * The mark is keyed by command name and is always cleared by the dispatcher
+ * (`finally`), so it cannot leak into a later manual invocation.
+ */
+const startupCommands = new Set<string>();
+
+/** Mark `commandName` as dispatched by autostart. */
+export function markStartupCommand(commandName: string): void {
+	startupCommands.add(commandName);
+}
+
+/** Drop a mark whether or not the command consumed it. */
+export function clearStartupCommand(commandName: string): void {
+	startupCommands.delete(commandName);
+}
+
+/** `true` once, when the command was started by autostart; consumes the mark. */
+export function consumeStartupCommand(commandName: string): boolean {
+	return startupCommands.delete(commandName);
+}