@andares/pi-toolkits 0.9.6 → 0.9.8

package/src/features/permission/index.test.ts

@@ -8,13 +8,18 @@
 import { mkdtempSync, realpathSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { describe, expect, it } from "vitest";
+import { beforeEach, describe, expect, it } from "vitest";
 import type {
 	ExtensionAPI,
 	ExtensionContext,
 	ToolCallEvent,
 } from "@earendil-works/pi-coding-agent";
 import type { AskDecision, GateHub, ToolGate } from "../../lib/gates.js";
+import {
+	clearJailedTool,
+	markJailedTool,
+	resetJailedTools,
+} from "../../lib/tools.js";
 import { markStartupCommand } from "../../lib/startup.js";
 import { registerPermission } from "./index.js";
 
@@ -391,8 +396,7 @@ describe("model-facing banner", () => {
 	});
 });
 
-describe("session grants cover repeat asks", () => {
-	it("stops asking for a destructive in-project command once allowed", async () => {
+describe("session grants cover repeat asks", () => {	it("stops asking for a destructive in-project command once allowed", async () => {
 		const h = makeHarness();
 		await h.command("allow allow allow ask");
 		const first = asAsk(await h.evaluate(bashEvent("rm -rf .")));
@@ -411,3 +415,23 @@ describe("session grants cover repeat asks", () => {
 		expect(await h.evaluate(bashEvent(command))).toBeUndefined();
 	});
 });
+
+describe("self-jailed tools", () => {
+	beforeEach(() => {
+		resetJailedTools();
+	});
+
+	it("skips the boundary check only while the owning feature marks the tool", async () => {
+		const h = makeHarness();
+		// Make the judgement observable: with in-project writes set to ask, an
+		// unmarked pathless tool would raise a dialog.
+		await h.command("ask ask ask ask");
+		expect(asAsk(await h.evaluate(customEvent("scratchpad"))).kind).toBe("ask");
+
+		markJailedTool("scratchpad");
+		expect(await h.evaluate(customEvent("scratchpad"))).toBeUndefined();
+
+		clearJailedTool("scratchpad");
+		expect(asAsk(await h.evaluate(customEvent("scratchpad"))).kind).toBe("ask");
+	});
+});

package/src/features/permission/index.ts

@@ -23,6 +23,7 @@ import type {
 } from "@earendil-works/pi-coding-agent";
 import { Text } from "@earendil-works/pi-tui";
 import type { AskRequest, GateHub } from "../../lib/gates.js";
+import { isJailedTool } from "../../lib/tools.js";
 import { consumeStartupCommand } from "../../lib/startup.js";
 import {
 	DEFAULT_MODES,
@@ -356,6 +357,11 @@ export function registerPermission(pi: ExtensionAPI, gates: GateHub): void {
 		order: 20,
 		evaluate(event, ctx) {
 			if (!enabled) return undefined;
+			// A self-jailed tool (ask's `scratchpad`) can only reach the temp directory
+			// it owns: there is no boundary to judge, and the operator sanctioned that
+			// space by entering the mode that activates the tool. The owning feature
+			// marks it only while active, so an inactive tool is judged normally.
+			if (isJailedTool(event.toolName)) return undefined;
 			const units = unitsFor(event, ctx.cwd);
 			if (units.length === 0) return undefined;
 			const decision = decideProgram(units, {

package/src/features/stash/stash.ts

@@ -21,7 +21,7 @@ import type { KeyId } from "@earendil-works/pi-tui";
 /**
  * Stash hotkey.
  *
- * Compatibility rationale (verified against pi 1.0.0–1.3.0 keybindings, live
+ * Compatibility rationale (verified against pi 0.99.0–1.4.0 keybindings, live
  * matchesKey probes and terminal/OS behavior):
  *  - pi: no default binding for ctrl+alt+<letter> (only ctrl+alt+] is taken);
  *    extension shortcuts dispatch first while the editor is focused

package/src/lib/gates.ts

@@ -17,6 +17,10 @@
  *    slot; a second presentation would mount over the first and strand its
  *    promise. The queue serializes our own presentations; the host slot is
  *    still shared with other extensions (pi does not arbitrate globally).
+ *    pi 1.4.0 stacks extension dialogs so a second one no longer strands the
+ *    first (#11166), but the 1.1–1.3 hosts in the supported window still
+ *    replace it — the queue stays, and it also keeps one confirmation visible
+ *    at a time instead of a pile of stacked dialogs on 1.4.0.
  *  - A gate that throws blocks the call (fail closed), matching pi's own
  *    `tool_call` handler contract.
  */

package/src/lib/model-config.ts

@@ -4,8 +4,8 @@
  * (review, compact-model — favorites keeps its own store-local key logic).
  *
  * Types are derived from pi-coding-agent's own exports (ModelRegistry)
- * rather than imported from @earendil-works/pi-ai: pi-ai's index.d.ts (1.0.0
- * through 1.3.0 alike) re-exports `Model`/`Api` via extensioned
+ * rather than imported from @earendil-works/pi-ai: pi-ai's index.d.ts (1.1.0
+ * through 1.4.0 alike) re-exports `Model`/`Api` via extensioned
  * `./types.ts` specifiers, which tsc 5.9 bundler resolution substitutes to
  * `.d.ts` but some tsserver builds do not. Deriving from ModelRegistry keeps
  * every resolver in agreement with the exact type

package/src/lib/model-picker.ts

@@ -9,7 +9,7 @@
  *
  * The component is driven through a small ModelRuntime facade backed by
  * ctx.modelRegistry (pi's extension-facing wrapper). SAFETY: verified
- * against pi 1.0.0–1.3.0 dist (modes/interactive/components/model-selector.js +
+ * against pi 1.1.0–1.4.0 dist (modes/interactive/components/model-selector.js +
  * model-catalog-refresh.js — byte-identical across that span) — the
  * component only calls getAvailableSnapshot, getModel, getError and refresh
  * on modelRuntime, and ModelRegistry provides exactly those

package/src/lib/tools.ts

@@ -1,5 +1,9 @@
 /**
  * Shared tool-set management helpers (feature-agnostic).
+ *
+ * Two concerns live here because both are about tool identity rather than any
+ * one feature: snapshotting/restoring the active set, and the registry of
+ * self-jailed tools that the boundary gate consults.
  */
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 
@@ -23,3 +27,47 @@ export function withoutTools(
 ): string[] {
 	return active.filter((name) => !removed.has(name));
 }
+
+/**
+ * Self-jailed tools — a registry the boundary gate consults.
+ *
+ * A tool can be *jailed*: its own implementation only reaches a place it
+ * created and owns, so there is no boundary for `permission` to judge and no
+ * dialog to raise. Example: ask mode's `scratchpad` writes into the session's
+ * temp directory through a relative, validated name; running it through the
+ * boundary analysis would ask "outside the project, write?" on every note even
+ * though the operator already sanctioned that space by entering ask mode.
+ *
+ * This is intentionally a registry rather than a bypass baked into
+ * `permission`: the owning feature marks the tool only while it is active, and
+ * `permission` does not need to know which feature that is. A tool that is not
+ * marked is judged normally, so forgetting to clear the mark would widen the
+ * boundary — hence the owning feature clears it on exit.
+ *
+ * Narrow on purpose: the registry covers tool *names*, not paths. A tool only
+ * belongs here when its caller cannot point it at a path.
+ */
+const jailed = new Set<string>();
+
+/** Mark a tool as self-jailed (call while it is active). */
+export function markJailedTool(name: string): void {
+	jailed.add(name);
+}
+
+/** Remove the mark (call when the tool is deactivated). */
+export function clearJailedTool(name: string): void {
+	jailed.delete(name);
+}
+
+/** Whether `name` is a self-jailed tool that is currently active. */
+export function isJailedTool(name: string): boolean {
+	return jailed.has(name);
+}
+
+/**
+ * Drop every mark. Tests call this between cases; production code clears one
+ * tool at a time when the owning feature exits.
+ */
+export function resetJailedTools(): void {
+	jailed.clear();
+}