@cydm/pie 1.0.37 → 1.0.38

package/README.md

@@ -309,6 +309,8 @@ Pie exposes one default model-visible web tool: `web_research`. Use it for publi
 
 Pie's default tools operate from the current workspace. File tools are workspace-scoped, `~/.pie` is allowlisted for Pie configuration/session support, and shell commands return structured timeout/truncation/error details. The canonical shell tool is still named `bash` for compatibility; on Windows `shell:auto` uses PowerShell, and callers can explicitly request `bash`, `powershell`, or `cmd`. High-risk shell commands require confirmation outside YOLO mode. `/settings/yolo` relaxes filesystem sandbox directory restrictions and should only be used in trusted workspaces. `pie permissions` prints the current policy-derived safety summary.
 
+In interactive Plan mode (`/tools/plan`), workspace editing tools are unavailable. The `bash` guard accepts simple read commands and read-only pipelines such as `rg 'TODO' . | head -20`; it blocks redirects, command substitution, and write-capable subcommands. Use `plan_scratch` to write, read, or list temporary text drafts in a directory dedicated to the current session. Shell redirection to `/tmp` remains blocked in Plan mode. Leave Plan mode before changing workspace files.
+
 ## Code Intelligence
 
 `code_intel` provides read-only JS/TS diagnostics, definition, references, symbols, and hover. CLI uses an isolated TypeScript worker by default and falls back to bounded lightweight text analysis on worker startup/OOM/crash/timeout failures; aborts, permission errors, and path escapes do not fallback. Unity uses a Node sidecar contract for TypeScript intelligence so the PuerTS bundle does not import Node-only parser dependencies.

package/dist/builtin/extensions/ask-user/index.js

@@ -1,9 +1,9 @@
 import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url);
 import {
   createAskUserCapability
-} from "../../../chunks/chunk-MGZHZSHB.js";
-import "../../../chunks/chunk-4B42ZU4B.js";
-import "../../../chunks/chunk-64XJIKVK.js";
+} from "../../../chunks/chunk-2PLCSYFF.js";
+import "../../../chunks/chunk-NTFKTUOW.js";
+import "../../../chunks/chunk-2WHIT2UB.js";
 import "../../../chunks/chunk-TG2EQLX2.js";
 
 // builtin/extensions/ask-user/index.ts

package/dist/builtin/extensions/plan-mode/index.js

@@ -7,14 +7,23 @@ import {
   isPlanModeSafeCommand,
   markCompletedPlanSteps,
   restoreExecutionState
-} from "../../../chunks/chunk-MGZHZSHB.js";
-import "../../../chunks/chunk-4B42ZU4B.js";
-import "../../../chunks/chunk-64XJIKVK.js";
+} from "../../../chunks/chunk-2PLCSYFF.js";
+import "../../../chunks/chunk-NTFKTUOW.js";
+import {
+  Type
+} from "../../../chunks/chunk-2WHIT2UB.js";
 import "../../../chunks/chunk-TG2EQLX2.js";
 
 // builtin/extensions/plan-mode/index.ts
+import { randomUUID } from "node:crypto";
+import { promises as fs, constants as fsConstants } from "node:fs";
+import os from "node:os";
+import path from "node:path";
 var SESSION_METADATA_KEY = "planModeEnabled";
 var EXECUTION_METADATA_KEY = "executionState";
+var SCRATCH_METADATA_KEY = "planScratchId";
+var SCRATCH_NAME = /^[a-zA-Z0-9][a-zA-Z0-9._-]{0,63}$/;
+var MAX_SCRATCH_CHARS = 64e3;
 var planModeEnabled = false;
 var executionMode = false;
 function toPlanTodoItems(state) {
@@ -26,6 +35,62 @@ function toPlanTodoItems(state) {
 }
 function planModeExtension(ctx) {
   const capability = createPlanCapability();
+  function scratchDirectory() {
+    const metadata = ctx.getSessionMetadata();
+    let id = metadata?.[SCRATCH_METADATA_KEY];
+    if (typeof id !== "string" || !/^[0-9a-f-]{36}$/.test(id)) {
+      id = randomUUID();
+      ctx.setSessionMetadata(SCRATCH_METADATA_KEY, id);
+    }
+    return path.join(os.tmpdir(), `pie-plan-${id}`);
+  }
+  ctx.registerTool({
+    name: "plan_scratch",
+    label: "plan_scratch",
+    description: "Read, write, or list session-local temporary text drafts while planning. Use a simple filename; files stay outside the workspace. Shell output redirection is blocked in Plan mode.",
+    parameters: Type.Object({
+      action: Type.Union([Type.Literal("write"), Type.Literal("read"), Type.Literal("list")]),
+      name: Type.Optional(Type.String({ description: "Simple filename within this session's scratch directory" })),
+      content: Type.Optional(Type.String({ description: "Text to write (maximum 64,000 characters)" }))
+    }),
+    risk: { riskClass: "session_mutation", permissionScope: "session", mutatesSession: true, availableInPlanMode: true },
+    async execute(args) {
+      const reply = (text, isError = false) => ({ content: [{ type: "text", text }], isError });
+      try {
+        const directory = scratchDirectory();
+        await fs.mkdir(directory, { recursive: true, mode: 448 });
+        if (!(await fs.lstat(directory)).isDirectory()) return reply("Temporary draft directory is invalid.", true);
+        if (args.action === "list") {
+          const names = (await fs.readdir(directory)).filter((name) => SCRATCH_NAME.test(name)).sort();
+          return reply(names.length ? names.join("\n") : "No temporary drafts in this session.");
+        }
+        if (!args.name || !SCRATCH_NAME.test(args.name) || args.name === "." || args.name === "..") {
+          return reply("Invalid draft filename. Use letters, digits, dots, underscores, or hyphens without directories.", true);
+        }
+        const filename = path.join(directory, args.name);
+        if (args.action === "read") {
+          const handle2 = await fs.open(filename, fsConstants.O_RDONLY | (fsConstants.O_NOFOLLOW || 0));
+          try {
+            return reply(await handle2.readFile("utf8"));
+          } finally {
+            await handle2.close();
+          }
+        }
+        if (typeof args.content !== "string" || args.content.length > MAX_SCRATCH_CHARS) {
+          return reply(`Draft content must be text of at most ${MAX_SCRATCH_CHARS} characters.`, true);
+        }
+        const handle = await fs.open(filename, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_TRUNC | (fsConstants.O_NOFOLLOW || 0), 384);
+        try {
+          await handle.writeFile(args.content, "utf8");
+        } finally {
+          await handle.close();
+        }
+        return reply(`Saved ${args.name} (${args.content.length} characters).`);
+      } catch (error) {
+        return reply(`Temporary draft failed: ${error instanceof Error ? error.message : String(error)}`, true);
+      }
+    }
+  });
   function readPersistedPlanMode() {
     return ctx.getSessionMetadata()?.[SESSION_METADATA_KEY] === true;
   }
@@ -45,7 +110,7 @@ function planModeExtension(ctx) {
       const completed = state.steps.filter((step) => step.status === "completed").length;
       ctx.ui.notify(`\u{1F4CB} Plan: ${completed}/${state.steps.length} completed`, "info");
     } else if (planModeEnabled) {
-      ctx.ui.notify("\u23F8\uFE0F Plan mode active (read-only)", "info");
+      ctx.ui.notify("\u23F8\uFE0F Plan mode active (workspace read-only; session drafts available)", "info");
     }
   }
   function applyPlanModeState(enabled, forcePromptInjection = false) {
@@ -84,11 +149,11 @@ function planModeExtension(ctx) {
     const command = event.args?.command;
     if (command && !isPlanModeSafeCommand(command)) {
       ctx.ui.notify(
-        `Plan mode: Command blocked (not allowlisted). Use /plan to disable plan mode first.
+        `Plan mode: Command blocked. Use read-only commands, or plan_scratch for temporary drafts. Use /plan to leave Plan mode.
 Command: ${command}`,
         "error"
       );
-      return { block: true, reason: `Plan mode: command "${command}" is not in the allowlist. Disable plan mode with /plan to run this command.` };
+      return { block: true, reason: `Plan mode: command "${command}" is not a read-only shell command. Use plan_scratch for temporary drafts, or /plan to leave Plan mode.` };
     }
   });
   ctx.on("agent:start", async () => {

package/dist/builtin/extensions/subagent/index.js

@@ -1,13 +1,13 @@
 import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url);
 import {
   createCliHostCapabilities
-} from "../../../chunks/chunk-QXTAEPLR.js";
+} from "../../../chunks/chunk-IKIEQTVJ.js";
 import {
   createSharedFileSystemTools,
   createSubagentCapability
-} from "../../../chunks/chunk-MGZHZSHB.js";
-import "../../../chunks/chunk-4B42ZU4B.js";
-import "../../../chunks/chunk-64XJIKVK.js";
+} from "../../../chunks/chunk-2PLCSYFF.js";
+import "../../../chunks/chunk-NTFKTUOW.js";
+import "../../../chunks/chunk-2WHIT2UB.js";
 import "../../../chunks/chunk-TG2EQLX2.js";
 
 // builtin/extensions/subagent/index.ts

package/dist/builtin/extensions/todo/index.js

@@ -7,9 +7,9 @@ import {
   executeManageTodoList,
   executionStateToTodos,
   restoreExecutionState
-} from "../../../chunks/chunk-MGZHZSHB.js";
-import "../../../chunks/chunk-4B42ZU4B.js";
-import "../../../chunks/chunk-64XJIKVK.js";
+} from "../../../chunks/chunk-2PLCSYFF.js";
+import "../../../chunks/chunk-NTFKTUOW.js";
+import "../../../chunks/chunk-2WHIT2UB.js";
 import "../../../chunks/chunk-TG2EQLX2.js";
 
 // builtin/extensions/todo/index.ts

package/dist/chunks/{chunk-MGZHZSHB.js → chunk-2PLCSYFF.js}

@@ -1,7 +1,7 @@
 import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url);
 import {
   Agent
-} from "./chunk-4B42ZU4B.js";
+} from "./chunk-NTFKTUOW.js";
 import {
   FileSystemGateway,
   Type,
@@ -11,7 +11,241 @@ import {
   getPlatformConfig,
   hashText,
   streamSimple
-} from "./chunk-64XJIKVK.js";
+} from "./chunk-2WHIT2UB.js";
+import {
+  __commonJS,
+  __toESM
+} from "./chunk-TG2EQLX2.js";
+
+// ../../node_modules/shell-quote/quote.js
+var require_quote = __commonJS({
+  "../../node_modules/shell-quote/quote.js"(exports, module) {
+    "use strict";
+    module.exports = function quote(xs) {
+      return xs.map(function(s) {
+        if (s === "") {
+          return "''";
+        }
+        if (s && typeof s === "object") {
+          return s.op.replace(/(.)/g, "\\$1");
+        }
+        if (/["\s\\]/.test(s) && !/'/.test(s)) {
+          return "'" + s.replace(/(['])/g, "\\$1") + "'";
+        }
+        if (/["'\s]/.test(s)) {
+          return '"' + s.replace(/(["\\$`!])/g, "\\$1") + '"';
+        }
+        return String(s).replace(/([A-Za-z]:)?([#!"$&'()*,:;<=>?@[\\\]^`{|}])/g, "$1\\$2");
+      }).join(" ");
+    };
+  }
+});
+
+// ../../node_modules/shell-quote/parse.js
+var require_parse = __commonJS({
+  "../../node_modules/shell-quote/parse.js"(exports, module) {
+    "use strict";
+    var CONTROL = "(?:" + [
+      "\\|\\|",
+      "\\&\\&",
+      ";;",
+      "\\|\\&",
+      "\\<\\(",
+      "\\<\\<\\<",
+      ">>",
+      ">\\&",
+      "<\\&",
+      "[&;()|<>]"
+    ].join("|") + ")";
+    var controlRE = new RegExp("^" + CONTROL + "$");
+    var META = "|&;()<> \\t";
+    var SINGLE_QUOTE = '"((\\\\"|[^"])*?)"';
+    var DOUBLE_QUOTE = "'((\\\\'|[^'])*?)'";
+    var hash = /^#$/;
+    var SQ = "'";
+    var DQ = '"';
+    var DS = "$";
+    var TOKEN = "";
+    var mult = 4294967296;
+    for (i = 0; i < 4; i++) {
+      TOKEN += (mult * Math.random()).toString(16);
+    }
+    var i;
+    var startsWithToken = new RegExp("^" + TOKEN);
+    function matchAll(s, r) {
+      var origIndex = r.lastIndex;
+      var matches = [];
+      var matchObj;
+      while (matchObj = r.exec(s)) {
+        matches.push(matchObj);
+        if (r.lastIndex === matchObj.index) {
+          r.lastIndex += 1;
+        }
+      }
+      r.lastIndex = origIndex;
+      return matches;
+    }
+    function getVar(env, pre, key) {
+      var r = typeof env === "function" ? env(key) : env[key];
+      if (typeof r === "undefined" && key != "") {
+        r = "";
+      } else if (typeof r === "undefined") {
+        r = "$";
+      }
+      if (typeof r === "object") {
+        return pre + TOKEN + JSON.stringify(r) + TOKEN;
+      }
+      return pre + r;
+    }
+    function parseInternal(string, env, opts) {
+      if (!opts) {
+        opts = {};
+      }
+      var BS = opts.escape || "\\";
+      var BAREWORD = "(\\" + BS + `['"` + META + `]|[^\\s'"` + META + "])+";
+      var chunker = new RegExp([
+        "(" + CONTROL + ")",
+        // control chars
+        "(" + BAREWORD + "|" + SINGLE_QUOTE + "|" + DOUBLE_QUOTE + ")+"
+      ].join("|"), "g");
+      var matches = matchAll(string, chunker);
+      if (matches.length === 0) {
+        return [];
+      }
+      if (!env) {
+        env = {};
+      }
+      var commented = false;
+      return matches.map(function(match2) {
+        var s = match2[0];
+        if (!s || commented) {
+          return void 0;
+        }
+        if (controlRE.test(s)) {
+          return { op: s };
+        }
+        var quote = false;
+        var esc = false;
+        var out = "";
+        var isGlob = false;
+        var i2;
+        function parseEnvVar() {
+          i2 += 1;
+          var varend;
+          var varname;
+          var char = s.charAt(i2);
+          if (char === "{") {
+            i2 += 1;
+            if (s.charAt(i2) === "}") {
+              throw new Error("Bad substitution: " + s.slice(i2 - 2, i2 + 1));
+            }
+            varend = s.indexOf("}", i2);
+            if (varend < 0) {
+              throw new Error("Bad substitution: " + s.slice(i2));
+            }
+            varname = s.slice(i2, varend);
+            i2 = varend;
+          } else if (/[*@#?$!_-]/.test(char)) {
+            varname = char;
+            i2 += 1;
+          } else {
+            var slicedFromI = s.slice(i2);
+            varend = slicedFromI.match(/[^\w\d_]/);
+            if (!varend) {
+              varname = slicedFromI;
+              i2 = s.length;
+            } else {
+              varname = slicedFromI.slice(0, varend.index);
+              i2 += varend.index - 1;
+            }
+          }
+          return getVar(env, "", varname);
+        }
+        for (i2 = 0; i2 < s.length; i2++) {
+          var c = s.charAt(i2);
+          isGlob = isGlob || !quote && (c === "*" || c === "?");
+          if (esc) {
+            out += c;
+            esc = false;
+          } else if (quote) {
+            if (c === quote) {
+              quote = false;
+            } else if (quote == SQ) {
+              out += c;
+            } else {
+              if (c === BS) {
+                i2 += 1;
+                c = s.charAt(i2);
+                if (c === DQ || c === BS || c === DS) {
+                  out += c;
+                } else {
+                  out += BS + c;
+                }
+              } else if (c === DS) {
+                out += parseEnvVar();
+              } else {
+                out += c;
+              }
+            }
+          } else if (c === DQ || c === SQ) {
+            quote = c;
+          } else if (controlRE.test(c)) {
+            return { op: s };
+          } else if (hash.test(c)) {
+            commented = true;
+            var commentObj = { comment: string.slice(match2.index + i2 + 1) };
+            if (out.length) {
+              return [out, commentObj];
+            }
+            return [commentObj];
+          } else if (c === BS) {
+            esc = true;
+          } else if (c === DS) {
+            out += parseEnvVar();
+          } else {
+            out += c;
+          }
+        }
+        if (isGlob) {
+          return { op: "glob", pattern: out };
+        }
+        return out;
+      }).reduce(function(prev, arg) {
+        return typeof arg === "undefined" ? prev : prev.concat(arg);
+      }, []);
+    }
+    module.exports = function parse2(s, env, opts) {
+      var mapped = parseInternal(s, env, opts);
+      if (typeof env !== "function") {
+        return mapped;
+      }
+      return mapped.reduce(function(acc, s2) {
+        if (typeof s2 === "object") {
+          return acc.concat(s2);
+        }
+        var xs = s2.split(RegExp("(" + TOKEN + ".*?" + TOKEN + ")", "g"));
+        if (xs.length === 1) {
+          return acc.concat(xs[0]);
+        }
+        return acc.concat(xs.filter(Boolean).map(function(x) {
+          if (startsWithToken.test(x)) {
+            return JSON.parse(x.split(TOKEN)[1]);
+          }
+          return x;
+        }));
+      }, []);
+    };
+  }
+});
+
+// ../../node_modules/shell-quote/index.js
+var require_shell_quote = __commonJS({
+  "../../node_modules/shell-quote/index.js"(exports) {
+    "use strict";
+    exports.quote = require_quote();
+    exports.parse = require_parse();
+  }
+});
 
 // ../../packages/shared-headless-capabilities/src/loop.ts
 function nowIso() {
@@ -445,6 +679,7 @@ var BUILTIN_TOOL_CAPABILITY_METADATA = {
   unity_log_read: { riskClass: "read_only", concurrencySafe: true, permissionScope: "unity", readsHostResource: true, availableInPlanMode: true, allowedForSubagentByDefault: true, maxOutputChars: 1e5 },
   unity_scene_object_edit: { riskClass: "external_side_effect", concurrencySafe: false, requiresPermission: true, permissionScope: "unity", externalSideEffect: true, highRisk: true },
   unity_refresh: { riskClass: "external_side_effect", concurrencySafe: false, permissionScope: "unity", externalSideEffect: true },
+  unity_tool_call: { riskClass: "external_side_effect", concurrencySafe: false, requiresPermission: true, permissionScope: "unity", externalSideEffect: true, highRisk: true },
   unity_script_run: { riskClass: "external_side_effect", concurrencySafe: false, requiresPermission: true, permissionScope: "unity", externalSideEffect: true, highRisk: true }
 };
 function getToolCapabilityMetadata(tool) {
@@ -493,39 +728,27 @@ function selectToolsForRuntimePolicy(tools, mode) {
 var DEFAULT_PLAN_MODE_TOOL_NAMES = Object.entries(BUILTIN_TOOL_CAPABILITY_METADATA).filter(([, metadata]) => metadata.availableInPlanMode).map(([name]) => name);
 
 // ../../packages/shared-headless-capabilities/src/plan.ts
-var SAFE_PREFIXES = [
-  "cat ",
-  "ls ",
-  "find_files ",
-  "grep_text ",
-  "head ",
-  "tail ",
-  "echo ",
-  "pwd",
-  "cd ",
-  "which ",
-  "git status",
-  "git log",
-  "git diff",
-  "git show",
-  "git branch -a",
-  "git remote -v",
-  "git config --list",
-  "npm list",
-  "npm view"
-];
-var DANGEROUS_PATTERNS = [
-  /\brm\s+-[rf]*/i,
-  />[\s]*\/dev\//,
-  /\|.*\brm\b/,
-  /git\s+push/i,
-  /git\s+reset/i,
-  /git\s+checkout\s+-/,
-  /git\s+revert/i,
-  /npm\s+publish/i,
-  /npm\s+uninstall/i,
-  /npm\s+rm/i
-];
+var import_shell_quote = __toESM(require_shell_quote(), 1);
+var SIMPLE_READ_COMMANDS = /* @__PURE__ */ new Set(["pwd", "ls", "cat", "head", "tail", "wc", "grep", "rg", "which", "type", "echo", "printf", "cd", "true", "false"]);
+var GIT_READ_SUBCOMMANDS = /* @__PURE__ */ new Set(["status", "log", "diff", "show", "rev-parse", "ls-files", "ls-tree"]);
+var UNSAFE_GIT_FLAGS = /^(?:-c|--config-env|--exec|--output|--ext-diff|--textconv)(?:=|$)/;
+var UNSAFE_RG_FLAGS = /^(?:--pre|--pre-glob)(?:=|$)/;
+function isReadOnlySegment(words) {
+  if (words.length === 0) return false;
+  const [program, ...args] = words;
+  if (program === "git") {
+    const subcommand = args[0] ?? "";
+    const isReadSubcommand = GIT_READ_SUBCOMMANDS.has(subcommand) || subcommand === "branch" && args.slice(1).every((arg) => ["-a", "--all", "-r", "--remotes", "--list"].includes(arg)) || subcommand === "remote" && args.length === 2 && args[1] === "-v" || subcommand === "config" && args.length === 2 && args[1] === "--list";
+    return isReadSubcommand && !args.some((arg) => UNSAFE_GIT_FLAGS.test(arg) || arg === "--no-pager" || arg === "-c");
+  }
+  if (program === "npm") return ["list", "view"].includes(args[0] ?? "") && !args.some((arg) => arg === "--script-shell");
+  if (program === "find") {
+    return !args.some((arg) => /^-(?:exec|execdir|ok|okdir|delete|fprint|fls|fprintf)/.test(arg));
+  }
+  if (!SIMPLE_READ_COMMANDS.has(program)) return false;
+  if (program === "rg") return !args.some((arg) => UNSAFE_RG_FLAGS.test(arg) || arg === "--pre" || arg === "--pre-glob");
+  return true;
+}
 function extractPlanTodoItems(text) {
   const items = [];
   const planMatch = text.match(/Plan:\s*\n?([\s\S]*?)(?=\n\n|\n[A-Z]|$)/i);
@@ -545,20 +768,23 @@ function extractPlanTodoItems(text) {
 }
 function isPlanModeSafeCommand(command) {
   const trimmed = command.trim();
-  for (const pattern of DANGEROUS_PATTERNS) {
-    if (pattern.test(trimmed)) {
-      return false;
-    }
+  if (!trimmed || /[$`\n\r\0]/.test(trimmed)) return false;
+  let tokens;
+  try {
+    tokens = (0, import_shell_quote.parse)(trimmed);
+  } catch {
+    return false;
   }
-  for (const prefix of SAFE_PREFIXES) {
-    if (trimmed.startsWith(prefix)) {
-      return true;
+  const segment = [];
+  for (const token of tokens) {
+    if (typeof token === "string") {
+      segment.push(token);
+      continue;
     }
+    if (!("op" in token) || !["|", "&&", "||", ";"].includes(String(token.op)) || !isReadOnlySegment(segment)) return false;
+    segment.length = 0;
   }
-  if (/^[a-z]+$/.test(trimmed)) {
-    return ["pwd", "ls", "clear", "whoami"].includes(trimmed);
-  }
-  return false;
+  return isReadOnlySegment(segment);
 }
 function extractDoneSteps(text) {
   const steps = [];