@armadra/agent 0.7.5 → 0.8.0

package/dist/drivers/native/codex-app-server.js

@@ -231,11 +231,13 @@ class CodexSession {
         const start = this.tokensAtStart;
         const end = this.tokensTotal;
         if (end !== undefined) {
+            // Codex 的 inputTokens 含缓存命中部分；ama 的 input 不含（与 cacheRead 相加才是总输入）
+            const cacheRead = end.cachedInputTokens - (start?.cachedInputTokens ?? 0);
             turn.push({
                 type: "usage",
-                input: end.inputTokens - (start?.inputTokens ?? 0),
+                input: end.inputTokens - (start?.inputTokens ?? 0) - cacheRead,
                 output: end.outputTokens - (start?.outputTokens ?? 0),
-                cacheRead: end.cachedInputTokens - (start?.cachedInputTokens ?? 0),
+                cacheRead,
                 ...(this.contextTokens !== undefined ? { contextTokens: this.contextTokens } : {}),
                 ...(this.contextWindow !== undefined ? { contextWindow: this.contextWindow } : {}),
             });

package/dist/drivers/native/oneshot.js

@@ -36,7 +36,15 @@ export function oneshotArgs(dialect, options, session, prompt) {
             return args;
         }
         case "codex": {
-            const common = ["--json", "-c", 'sandbox_mode="read-only"', "-c", 'approval_policy="never"'];
+            // ama 只在自己已信任的目录里起外部 Agent：跳过 codex 自己的 git 仓库检查（非 git 目录否则直接失败）
+            const common = [
+                "--json",
+                "--skip-git-repo-check",
+                "-c",
+                'sandbox_mode="read-only"',
+                "-c",
+                'approval_policy="never"',
+            ];
             if (options.model !== undefined)
                 common.push("-m", options.model);
             return session.resume
@@ -243,9 +251,11 @@ class OneshotSession {
             }
             case "turn.completed": {
                 const u = (msg["usage"] ?? {});
+                // input_tokens 含缓存命中部分；ama 的 input 不含
+                const input = u["input_tokens"];
                 turn.push({
                     type: "usage",
-                    ...(u["input_tokens"] !== undefined ? { input: u["input_tokens"] } : {}),
+                    ...(input !== undefined ? { input: input - (u["cached_input_tokens"] ?? 0) } : {}),
                     ...(u["output_tokens"] !== undefined ? { output: u["output_tokens"] } : {}),
                     ...(u["cached_input_tokens"] !== undefined
                         ? { cacheRead: u["cached_input_tokens"] }

package/dist/drivers/native/pi-gate.d.ts

@@ -0,0 +1,19 @@
+/**
+ * pi 的审批闸（#198）：pi 自己没有审批通道，ama 以 `-e <文件>` 给这一次运行加载一个最小扩展，
+ * 把只读内置工具以外的每次工具调用经 RPC 的扩展对话框（`extension_ui_request{method: confirm}`）
+ * 交给 ama——ama 再按模式决定直接拒绝、直接放行（auto-edit 下的文件编辑）或交给人。
+ *
+ * 扩展文件写在每个会话自己的临时目录（`mkdtemp`，只有当前用户可写），会话关闭时删除；
+ * 不写 pi 的配置目录，不改用户的扩展设置。
+ */
+/** 对话框标题：ama 只认这个标题的 confirm，其它扩展的对话框一律取消（不代答）。 */
+export declare const PI_GATE_TITLE = "ama-approval";
+/** pi 不经审批就放行的内置只读工具（也用于只读模式的 `--tools`）。 */
+export declare const PI_READ_ONLY_TOOLS: readonly string[];
+/** 扩展源码（pi 用 jiti 加载 TypeScript；这里只用纯 JS 语法）。 */
+export declare const PI_GATE_SOURCE: string;
+/** 写一份闸扩展，返回路径与清理函数。 */
+export declare function writePiGate(): {
+    path: string;
+    dispose(): void;
+};

package/dist/drivers/native/pi-gate.js

@@ -0,0 +1,39 @@
+/**
+ * pi 的审批闸（#198）：pi 自己没有审批通道，ama 以 `-e <文件>` 给这一次运行加载一个最小扩展，
+ * 把只读内置工具以外的每次工具调用经 RPC 的扩展对话框（`extension_ui_request{method: confirm}`）
+ * 交给 ama——ama 再按模式决定直接拒绝、直接放行（auto-edit 下的文件编辑）或交给人。
+ *
+ * 扩展文件写在每个会话自己的临时目录（`mkdtemp`，只有当前用户可写），会话关闭时删除；
+ * 不写 pi 的配置目录，不改用户的扩展设置。
+ */
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+/** 对话框标题：ama 只认这个标题的 confirm，其它扩展的对话框一律取消（不代答）。 */
+export const PI_GATE_TITLE = "ama-approval";
+/** pi 不经审批就放行的内置只读工具（也用于只读模式的 `--tools`）。 */
+export const PI_READ_ONLY_TOOLS = ["read", "grep", "find", "ls"];
+/** 扩展源码（pi 用 jiti 加载 TypeScript；这里只用纯 JS 语法）。 */
+export const PI_GATE_SOURCE = `// Generated by ama for one pi run: routes non-read-only tool calls to ama for approval.
+const READ_ONLY = new Set(${JSON.stringify(PI_READ_ONLY_TOOLS)});
+export default function (pi) {
+  pi.on("tool_call", async (event, ctx) => {
+    if (READ_ONLY.has(event.toolName)) return undefined;
+    const ok = await ctx.ui.confirm(
+      ${JSON.stringify(PI_GATE_TITLE)},
+      JSON.stringify({ id: event.toolCallId, tool: event.toolName, input: event.input }),
+    );
+    return ok ? undefined : { block: true, reason: event.toolName + " was not approved by the user" };
+  });
+}
+`;
+/** 写一份闸扩展，返回路径与清理函数。 */
+export function writePiGate() {
+    const dir = mkdtempSync(join(tmpdir(), "ama-pi-"));
+    const path = join(dir, "ama-approval-gate.ts");
+    writeFileSync(path, PI_GATE_SOURCE, { mode: 0o600 });
+    return {
+        path,
+        dispose: () => rmSync(dir, { recursive: true, force: true }),
+    };
+}

package/dist/drivers/native/pi-rpc.d.ts

@@ -0,0 +1,29 @@
+/**
+ * pi 原生驱动：`pi --mode rpc` 长驻进程（stdin 命令 / stdout 响应与事件，严格按 LF 分帧）。[#198]
+ *
+ * `pi --mode rpc --session-id <uuid> [--model <m>] -e <审批闸> [--tools read,grep,find,ls]`
+ * （新会话与续聊都用 `--session-id`：pi 找到同 id 的项目会话就续上，否则新建）。
+ *
+ * - 回合：`prompt` → 响应 `disposition`（`handled` 时没有运行，直接结束）→ 事件流 → `agent_settled`
+ *   结束（`aborted` 为真即中断）；运行中追加用 `steer`；中断 `abort`（15 s 看门狗）。
+ * - 审批：pi 自己不问人，ama 以 `-e` 加载审批闸（{@link PI_GATE_SOURCE}），只读内置工具以外的调用
+ *   经 `extension_ui_request{confirm, title: "ama-approval"}` 到这里：plan / allowlist 直接拒绝（并以
+ *   `--tools` 只开只读工具），auto-edit / auto / full-auto 放行 `edit` / `write`，其余交给人（只交给人，
+ *   不代答）。其它扩展的对话框（select / input / editor / 别的 confirm）一律取消并提示。
+ * - 用量：assistant `message_end` 的 usage 累加（input 不含缓存命中，cost.total 是 pi 按价目表的估算）；
+ *   回合结束后 `get_session_stats` 的 `contextUsage` 记上下文占用与窗口。
+ */
+import { type DriverDeps } from "../base.js";
+import type { CatalogCandidate } from "../catalog.js";
+import type { AcpToolKind, AgentDriver, DriverOpenOptions, DriverProbe, DriverSession } from "../types.js";
+export declare function piArgs(options: Pick<DriverOpenOptions, "mode" | "model">, sessionId: string, gatePath: string): string[];
+export declare function piToolKind(tool: string): AcpToolKind;
+export declare class PiRpcDriver implements AgentDriver {
+    readonly agentId: string;
+    private readonly candidate;
+    private readonly deps;
+    readonly kind: "pi-rpc";
+    constructor(agentId: string, candidate: CatalogCandidate, deps?: DriverDeps);
+    probe(): Promise<DriverProbe>;
+    open(options: DriverOpenOptions): Promise<DriverSession>;
+}

package/dist/drivers/native/pi-rpc.js

@@ -0,0 +1,483 @@
+/**
+ * pi 原生驱动：`pi --mode rpc` 长驻进程（stdin 命令 / stdout 响应与事件，严格按 LF 分帧）。[#198]
+ *
+ * `pi --mode rpc --session-id <uuid> [--model <m>] -e <审批闸> [--tools read,grep,find,ls]`
+ * （新会话与续聊都用 `--session-id`：pi 找到同 id 的项目会话就续上，否则新建）。
+ *
+ * - 回合：`prompt` → 响应 `disposition`（`handled` 时没有运行，直接结束）→ 事件流 → `agent_settled`
+ *   结束（`aborted` 为真即中断）；运行中追加用 `steer`；中断 `abort`（15 s 看门狗）。
+ * - 审批：pi 自己不问人，ama 以 `-e` 加载审批闸（{@link PI_GATE_SOURCE}），只读内置工具以外的调用
+ *   经 `extension_ui_request{confirm, title: "ama-approval"}` 到这里：plan / allowlist 直接拒绝（并以
+ *   `--tools` 只开只读工具），auto-edit / auto / full-auto 放行 `edit` / `write`，其余交给人（只交给人，
+ *   不代答）。其它扩展的对话框（select / input / editor / 别的 confirm）一律取消并提示。
+ * - 用量：assistant `message_end` 的 usage 累加（input 不含缓存命中，cost.total 是 pi 按价目表的估算）；
+ *   回合结束后 `get_session_stats` 的 `contextUsage` 记上下文占用与窗口。
+ */
+import { randomUUID } from "node:crypto";
+import { resolve as resolvePath } from "node:path";
+import { AmaError } from "../../errors.js";
+import { createLineReader } from "../../modes/rpc/jsonl.js";
+import { armCancelWatchdog, isReadOnlyMode, probeCandidate, spawnOf, } from "../base.js";
+import { stderrHint } from "../process.js";
+import { TurnCollector, oneLine } from "../turn.js";
+import { PI_GATE_TITLE, PI_READ_ONLY_TOOLS, writePiGate } from "./pi-gate.js";
+import { msg } from "../../i18n/index.js";
+const DIALOG_METHODS = new Set(["select", "confirm", "input", "editor"]);
+/** auto-edit 及更宽的模式下不问人的文件编辑工具。 */
+const EDIT_TOOLS = new Set(["edit", "write"]);
+export function piArgs(options, sessionId, gatePath) {
+    const args = ["--session-id", sessionId];
+    if (options.model !== undefined)
+        args.push("--model", options.model);
+    args.push("-e", gatePath);
+    if (isReadOnlyMode(options.mode))
+        args.push("--tools", PI_READ_ONLY_TOOLS.join(","));
+    return args;
+}
+export function piToolKind(tool) {
+    switch (tool) {
+        case "bash":
+        case "powershell":
+            return "execute";
+        case "edit":
+        case "write":
+            return "edit";
+        case "read":
+            return "read";
+        case "grep":
+        case "find":
+        case "ls":
+            return "search";
+        default:
+            return "other";
+    }
+}
+function piToolTitle(tool, input) {
+    if (typeof input["command"] === "string")
+        return `$ ${oneLine(input["command"], 100)}`;
+    if (typeof input["path"] === "string")
+        return `${tool} ${input["path"]}`;
+    if (typeof input["pattern"] === "string")
+        return `${tool} ${oneLine(input["pattern"], 80)}`;
+    return tool;
+}
+function textOf(message) {
+    const content = message["content"];
+    if (typeof content === "string")
+        return content;
+    if (!Array.isArray(content))
+        return "";
+    return content
+        .map((b) => (b["type"] === "text" && typeof b["text"] === "string" ? b["text"] : ""))
+        .join("");
+}
+export class PiRpcDriver {
+    agentId;
+    candidate;
+    deps;
+    kind = "pi-rpc";
+    constructor(agentId, candidate, deps = {}) {
+        this.agentId = agentId;
+        this.candidate = candidate;
+        this.deps = deps;
+    }
+    probe() {
+        return probeCandidate(this.candidate, this.deps);
+    }
+    async open(options) {
+        const probed = await probeCandidate(this.candidate, this.deps);
+        const sessionId = options.resume ?? randomUUID();
+        const gate = writePiGate();
+        const transport = spawnOf(this.deps)({
+            program: probed.path ?? this.candidate.program,
+            args: [...this.candidate.args, ...piArgs(options, sessionId, gate.path)],
+            cwd: options.cwd,
+            env: options.env,
+        });
+        const session = new PiSession(this.agentId, sessionId, transport, options, this.deps, () => gate.dispose());
+        if (probed.warning !== undefined)
+            session.notices.push(probed.warning);
+        try {
+            await session.start(options.signal);
+        }
+        catch (error) {
+            await session.close();
+            throw new AmaError("agent_start_failed", `${this.agentId}: failed to start (${error.message})${stderrHint(transport) !== "" ? `: ${stderrHint(transport)}` : ""}`, { cause: error });
+        }
+        return session;
+    }
+}
+class PiSession {
+    agentId;
+    id;
+    transport;
+    options;
+    deps;
+    dispose;
+    notices = [];
+    nextId = 1;
+    pending = new Map();
+    permissions = new Set();
+    turn;
+    hooks;
+    settle;
+    running;
+    usage = { input: 0, output: 0, cacheRead: 0, costUsd: 0, seen: false };
+    lastAssistant;
+    interrupted = false;
+    closed = false;
+    exited = false;
+    exitWaiters = new Set();
+    constructor(agentId, id, transport, options, deps, dispose) {
+        this.agentId = agentId;
+        this.id = id;
+        this.transport = transport;
+        this.options = options;
+        this.deps = deps;
+        this.dispose = dispose;
+        createLineReader(transport.stdout, (line) => this.onLine(line), () => this.onExit());
+        transport.stdin.on?.("error", () => undefined);
+    }
+    get sessionId() {
+        return this.id;
+    }
+    /** 握手：`get_state` 确认进程起来了，并取 pi 实际使用的会话 id。 */
+    async start(signal) {
+        const aborted = new Promise((_, reject) => {
+            if (signal.aborted)
+                reject(new Error("aborted"));
+            signal.addEventListener("abort", () => reject(new Error("aborted")), { once: true });
+        });
+        void aborted.catch(() => undefined);
+        const state = await Promise.race([this.request({ type: "get_state" }), aborted]);
+        const data = (state["data"] ?? {});
+        if (typeof data["sessionId"] === "string" && data["sessionId"] !== "")
+            this.id = data["sessionId"];
+    }
+    async prompt(content, hooks) {
+        if (this.closed || this.exited)
+            throw new AmaError("agent_closed", `${this.agentId} session is closed`);
+        if (this.running !== undefined)
+            throw new AmaError("busy", `${this.agentId} is already running`);
+        const turn = new TurnCollector((e) => hooks.onEvent(e));
+        for (const text of this.notices.splice(0))
+            turn.push({ type: "notice", level: "warn", text });
+        this.turn = turn;
+        this.hooks = hooks;
+        this.interrupted = false;
+        this.usage = { input: 0, output: 0, cacheRead: 0, costUsd: 0, seen: false };
+        this.lastAssistant = undefined;
+        this.running = this.run(content, turn);
+        try {
+            return await this.running;
+        }
+        finally {
+            this.running = undefined;
+            this.turn = undefined;
+            this.hooks = undefined;
+            this.settle = undefined;
+            this.exitWaiters.clear();
+        }
+    }
+    async run(content, turn) {
+        // 先让出一拍：`this.running` 赋值之后再写命令（同步回显的对端里事件可能立刻到达并触发 cancel）
+        await Promise.resolve();
+        const settled = new Promise((resolve) => (this.settle = resolve));
+        const response = await this.request({ type: "prompt", ...this.message(content) });
+        if (response["success"] !== true)
+            throw new AmaError("agent_failed", `${this.agentId} rejected the prompt: ${oneLine(String(response["error"] ?? "unknown"), 300)}`);
+        const disposition = (response["data"] ?? {})["disposition"];
+        if (disposition === "handled")
+            return turn.result("end_turn");
+        const aborted = await Promise.race([settled, this.exitPromise()]);
+        await this.reportContext(turn);
+        return this.complete(turn, aborted);
+    }
+    async steer(content) {
+        if (this.closed || this.exited)
+            throw new AmaError("agent_closed", `${this.agentId} session is closed`);
+        await this.request({ type: "steer", ...this.message(content) });
+    }
+    async cancel() {
+        const running = this.running;
+        if (running === undefined || this.closed)
+            return;
+        this.interrupted = true;
+        for (const c of this.permissions)
+            c.abort();
+        void this.request({ type: "abort" }).catch(() => undefined);
+        armCancelWatchdog(this.transport, running.catch(() => undefined), this.deps);
+    }
+    async close() {
+        if (this.closed)
+            return;
+        this.closed = true;
+        for (const c of this.permissions)
+            c.abort();
+        if (this.running !== undefined) {
+            this.interrupted = true;
+            this.write({ type: "abort" });
+        }
+        try {
+            await this.transport.terminate();
+        }
+        finally {
+            this.dispose();
+        }
+    }
+    message(content) {
+        const text = content.map((b) => (b.type === "text" ? b.text : "")).join("\n");
+        const images = content.flatMap((b) => b.type === "image" ? [{ type: "image", data: b.data, mimeType: b.mimeType }] : []);
+        return { message: text, ...(images.length > 0 ? { images } : {}) };
+    }
+    complete(turn, aborted) {
+        const u = this.usage;
+        if (u.seen)
+            turn.push({
+                type: "usage",
+                input: u.input,
+                output: u.output,
+                cacheRead: u.cacheRead,
+                costUsd: u.costUsd,
+            });
+        const last = this.lastAssistant;
+        if (last !== undefined) {
+            const text = textOf(last);
+            if (text !== "")
+                turn.setFinalText(text);
+        }
+        if (aborted || this.interrupted)
+            return turn.result("cancelled");
+        switch (last?.["stopReason"]) {
+            case "error":
+                throw new AmaError("agent_failed", `${this.agentId} failed: ${oneLine(String(last["errorMessage"] ?? "unknown error"), 300)}`);
+            case "aborted":
+                return turn.result("cancelled");
+            case "length":
+                return turn.result("max_tokens");
+            default:
+                return turn.result("end_turn");
+        }
+    }
+    /** `get_session_stats.contextUsage` → 上下文占用与窗口（拿不到就算了）。 */
+    async reportContext(turn) {
+        if (this.exited)
+            return;
+        try {
+            const stats = await Promise.race([
+                this.request({ type: "get_session_stats" }),
+                new Promise((resolve) => setTimeout(() => resolve({}), 5_000).unref()),
+            ]);
+            const usage = ((stats["data"] ?? {})["contextUsage"] ?? {});
+            const tokens = usage["tokens"];
+            const window = usage["contextWindow"];
+            if (typeof tokens === "number" || typeof window === "number")
+                turn.push({
+                    type: "usage",
+                    ...(typeof tokens === "number" ? { contextTokens: tokens } : {}),
+                    ...(typeof window === "number" ? { contextWindow: window } : {}),
+                });
+        }
+        catch {
+            // 统计拿不到不影响回合
+        }
+    }
+    exitPromise() {
+        return new Promise((_, reject) => {
+            if (this.exited)
+                reject(this.exitError());
+            else
+                this.exitWaiters.add(reject);
+        });
+    }
+    exitError() {
+        const hint = stderrHint(this.transport);
+        return new AmaError("agent_exited", `${this.agentId} process exited${hint !== "" ? `: ${hint}` : ""}`);
+    }
+    request(command) {
+        if (this.exited)
+            return Promise.reject(this.exitError());
+        const id = `ama-${this.nextId++}`;
+        return new Promise((resolve, reject) => {
+            this.pending.set(id, { resolve, reject });
+            this.write({ id, ...command });
+        });
+    }
+    write(record) {
+        if (this.exited)
+            return;
+        this.transport.stdin.write(`${JSON.stringify(record)}\n`);
+    }
+    onExit() {
+        this.exited = true;
+        const error = this.exitError();
+        for (const p of this.pending.values())
+            p.reject(error);
+        this.pending.clear();
+        for (const reject of this.exitWaiters)
+            reject(error);
+        this.exitWaiters.clear();
+        for (const c of this.permissions)
+            c.abort();
+    }
+    onLine(line) {
+        let record;
+        try {
+            record = JSON.parse(line);
+        }
+        catch {
+            this.deps.log?.("debug", msg().drivers.agent.nonJson(this.agentId));
+            return;
+        }
+        switch (record["type"]) {
+            case "response": {
+                const id = record["id"];
+                const pending = typeof id === "string" ? this.pending.get(id) : undefined;
+                if (pending === undefined || typeof id !== "string")
+                    return;
+                this.pending.delete(id);
+                pending.resolve(record);
+                return;
+            }
+            case "agent_settled":
+                this.settle?.(record["aborted"] === true);
+                return;
+            case "extension_ui_request":
+                void this.onDialog(record);
+                return;
+            default:
+                this.onEvent(record);
+        }
+    }
+    onEvent(record) {
+        const turn = this.turn;
+        if (turn === undefined)
+            return;
+        switch (record["type"]) {
+            case "message_update": {
+                const event = (record["assistantMessageEvent"] ?? {});
+                const delta = event["delta"];
+                if (typeof delta !== "string")
+                    return;
+                if (event["type"] === "text_delta")
+                    turn.push({ type: "message_delta", text: delta });
+                else if (event["type"] === "thinking_delta")
+                    turn.push({ type: "thought_delta", text: delta });
+                return;
+            }
+            case "message_end": {
+                const message = (record["message"] ?? {});
+                if (message["role"] !== "assistant")
+                    return;
+                this.lastAssistant = message;
+                const usage = (message["usage"] ?? {});
+                const num = (key) => typeof usage[key] === "number" ? usage[key] : 0;
+                const cost = (usage["cost"] ?? {})["total"];
+                this.usage = {
+                    input: this.usage.input + num("input"),
+                    output: this.usage.output + num("output"),
+                    cacheRead: this.usage.cacheRead + num("cacheRead"),
+                    costUsd: this.usage.costUsd + (typeof cost === "number" ? cost : 0),
+                    seen: true,
+                };
+                return;
+            }
+            case "tool_execution_start":
+            case "tool_execution_end": {
+                const tool = String(record["toolName"] ?? "tool");
+                const known = turn.tool(String(record["toolCallId"] ?? ""));
+                const input = (record["args"] ?? {});
+                const path = typeof input["path"] === "string" ? input["path"] : undefined;
+                const locations = path !== undefined ? [resolvePath(this.options.cwd, path)] : known?.locations;
+                turn.push({
+                    type: "tool_call",
+                    id: String(record["toolCallId"] ?? ""),
+                    title: known?.title ?? piToolTitle(tool, input),
+                    kind: piToolKind(tool),
+                    status: record["type"] === "tool_execution_start"
+                        ? "in_progress"
+                        : record["isError"] === true
+                            ? "failed"
+                            : "completed",
+                    ...(locations !== undefined && locations.length > 0 ? { locations } : {}),
+                });
+                return;
+            }
+            case "auto_retry_start":
+                turn.push({
+                    type: "notice",
+                    level: "warn",
+                    text: msg().drivers.agent.error(this.agentId, oneLine(String(record["errorMessage"] ?? "error"), 200), true),
+                });
+                return;
+            default:
+                return;
+        }
+    }
+    /** 扩展对话框：ama 的审批闸按模式决定或交给人；其它扩展的对话框取消（不代答）。 */
+    async onDialog(record) {
+        const id = String(record["id"] ?? "");
+        const method = String(record["method"] ?? "");
+        if (!DIALOG_METHODS.has(method)) {
+            if (record["method"] === "notify" && record["notifyType"] !== "info")
+                this.turn?.push({
+                    type: "notice",
+                    level: "warn",
+                    text: `${this.agentId}: ${oneLine(String(record["message"] ?? ""), 200)}`,
+                });
+            return;
+        }
+        if (method !== "confirm" || record["title"] !== PI_GATE_TITLE) {
+            this.turn?.push({
+                type: "notice",
+                level: "warn",
+                text: msg().drivers.agent.extensionDialog(this.agentId, oneLine(String(record["title"] ?? method), 80)),
+            });
+            this.write({ type: "extension_ui_response", id, cancelled: true });
+            return;
+        }
+        const confirmed = await this.decide(record);
+        this.write({ type: "extension_ui_response", id, confirmed });
+    }
+    async decide(record) {
+        let call;
+        try {
+            call = JSON.parse(String(record["message"] ?? "{}"));
+        }
+        catch {
+            return false;
+        }
+        const tool = String(call["tool"] ?? "tool");
+        const input = (call["input"] ?? {});
+        const mode = this.options.mode;
+        if (isReadOnlyMode(mode))
+            return false;
+        if (mode !== "default" && EDIT_TOOLS.has(tool))
+            return true;
+        const hooks = this.hooks;
+        if (hooks === undefined || this.interrupted || this.closed)
+            return false;
+        const known = this.turn?.tool(String(call["id"] ?? ""));
+        const path = typeof input["path"] === "string" ? input["path"] : undefined;
+        const controller = new AbortController();
+        this.permissions.add(controller);
+        try {
+            const outcome = await hooks.onPermission({
+                toolCall: {
+                    title: known?.title ?? piToolTitle(tool, input),
+                    kind: piToolKind(tool),
+                    ...(path !== undefined ? { locations: [resolvePath(this.options.cwd, path)] } : {}),
+                    inputSummary: oneLine(JSON.stringify(input), 300),
+                },
+                options: [
+                    { optionId: "allow", kind: "allow_once" },
+                    { optionId: "reject", kind: "reject_once" },
+                ],
+            }, controller.signal);
+            return (!controller.signal.aborted && outcome.outcome === "selected" && outcome.optionId === "allow");
+        }
+        finally {
+            this.permissions.delete(controller);
+        }
+    }
+}

package/dist/drivers/runner.js

@@ -144,6 +144,7 @@ const TURN_INTERRUPT = new Set([
     "acp-adapter",
     "claude-stream",
     "codex-app-server",
+    "pi-rpc",
 ]);
 class ProcessHandle {
     runner;

package/dist/drivers/types.d.ts

@@ -20,7 +20,7 @@ export interface DriverCapabilities {
     usage: "tokens" | "usd" | "requests" | "none";
     images: boolean;
 }
-export type DriverKind = "acp" | "acp-adapter" | "claude-stream" | "codex-app-server" | "oneshot" | "host";
+export type DriverKind = "acp" | "acp-adapter" | "claude-stream" | "codex-app-server" | "pi-rpc" | "oneshot" | "host";
 export interface DriverProbe {
     installed: boolean;
     version?: string;

package/dist/i18n/catalog.d.ts

@@ -534,6 +534,7 @@ declare const en: {
             backgroundStopped: (jobId: string, command: string) => string;
             compactionFailed: (error: string) => string;
             compactionCancelled: string;
+            imageReadBackFailed: (id: string) => string;
         };
         statusLine: {
             usage: string;
@@ -1446,6 +1447,7 @@ declare const en: {
             "subagents.maxPending": string;
             "subagents.retainSessions": string;
             "subagents.defaultModel": string;
+            "subagents.forkMaxContextRatio": string;
             "subagents.background": string;
             "subagents.autoBackgroundAfterMs": string;
             models: string;
@@ -1606,6 +1608,7 @@ declare const en: {
             resumeUnsupported: (agent: string) => string;
             resumeNotFound: (agent: string, id: string) => string;
             noMatchingMode: (agent: string, mode: string) => string;
+            noMatchingModel: (agent: string, model: string) => string;
             noImages: (agent: string) => string;
             noImagesDriver: (agent: string) => string;
             noImagesOneshot: (agent: string) => string;
@@ -1616,6 +1619,7 @@ declare const en: {
             error: (agent: string, message: string, retrying: boolean) => string;
             askedQuestion: (agent: string, tool: string) => string;
             askedQuestionCodex: (agent: string) => string;
+            extensionDialog: (agent: string, title: string) => string;
             mcpElicitation: (agent: string) => string;
         };
         hooks: {
@@ -2078,6 +2082,7 @@ declare const en: {
         };
         request: {
             notEligible: string;
+            modelUnavailable: (model: string) => string;
             flavorMismatch: (current: string, ref: string, pinned: string) => string;
         };
         errors: {