@czottmann/pi-automode 1.11.0 → 1.12.0

package/extensions/auto-mode/extension.ts

@@ -1,11 +1,17 @@
+import { realpathSync, statSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
 import type {
   ExtensionAPI,
   ExtensionCommandContext,
   ExtensionContext,
 } from "@earendil-works/pi-coding-agent";
+import { StringEnum } from "@earendil-works/pi-ai";
+import { Type } from "typebox";
 import {
   classifierReasoningForConfig,
   defaultClassifyAction,
+  serializeClassifierAction,
 } from "./classifier.ts";
 import {
   AUTO_MODE_GUIDANCE,
@@ -18,7 +24,6 @@ import {
   READ_ONLY_TOOLS,
 } from "./constants.ts";
 import {
-  loadEffectiveConfig,
   loadEffectiveConfigWithDiagnostics,
   writeGlobalClassifierModel,
 } from "./config.ts";
@@ -31,14 +36,17 @@ import {
 } from "./log.ts";
 import { formatModelSpec, parseModelSpec } from "./model.ts";
 import { promptForClassifierModel } from "./model-selector.ts";
-import { matchesDeniedPath, matchesToolPattern } from "./permissions.ts";
 import {
-  expandHomePattern,
+  matchesDeniedPath,
+  matchesToolPattern,
+  recursiveSearchMayReachDeniedPath,
+} from "./permissions.ts";
+import {
   extractInputPath,
   isInside,
   isProtectedPath,
-  resolveInputPath,
   resolvePathForPolicy,
+  resolveToolInputPath,
 } from "./paths.ts";
 import {
   actionSummary,
@@ -61,13 +69,45 @@ import type {
 } from "./types.ts";
 import { safeJson } from "./utils.ts";
 
+const INSPECT_TOOL = "automode_inspect";
+const INSPECTION_ACTIONS = ["status", "config", "defaults", "denials"] as const;
+type InspectionAction = (typeof INSPECTION_ACTIONS)[number];
+
+function canonicalPath(path: string): string {
+  try {
+    return realpathSync(path);
+  } catch {
+    return resolve(path);
+  }
+}
+
+const EXTENSION_PATH = canonicalPath(fileURLToPath(import.meta.url));
+const EXTENSION_ENTRY_PATH = canonicalPath(
+  resolve(dirname(EXTENSION_PATH), "../auto-mode.ts"),
+);
+
+export function modelVisibleConfigDiagnostics(
+  diagnostics: string[],
+): string[] {
+  return diagnostics.map((diagnostic) =>
+    diagnostic.replace(
+      /invalid JSON \([\s\S]*\)$/,
+      "invalid JSON (parser details omitted from model-visible output)",
+    )
+  );
+}
+
 export type PiAutomodeOptions = {
   /** Override config loading in tests. Runtime code uses Pi-owned disk settings. */
-  loadConfig?: (cwd: string) => EffectiveConfig;
+  loadConfig?: (cwd: string, projectTrusted: boolean) => EffectiveConfig;
   /** Override classifier calls in tests so unit tests never need a real LLM/API key. */
   classifyAction?: ClassifyAction;
   /** Override classifier-model persistence in tests. Runtime code writes ~/.pi/agent/automode.json. */
   saveClassifierModel?: (classifierModel: string) => void;
+  /** Override the application-owned observability log root in tests. */
+  logRoot?: string;
+  /** Override the observability log clock in tests. */
+  now?: () => Date;
 };
 
 type LogCtx = {
@@ -118,17 +158,18 @@ function logClassifierIo(decision: ClassifyResult, log: LogCtx): void {
 /** Create a Pi extension instance. Default export uses production dependencies. */
 export function createPiAutomode(options: PiAutomodeOptions = {}) {
   const loadConfigWithDiagnostics = options.loadConfig
-    ? (cwd: string): ConfigLoadResult => ({
-      config: options.loadConfig?.(cwd) ?? loadEffectiveConfig(cwd),
+    ? (cwd: string, projectTrusted: boolean): ConfigLoadResult => ({
+      config: options.loadConfig!(cwd, projectTrusted),
       diagnostics: [],
     })
     : loadEffectiveConfigWithDiagnostics;
   const classify = options.classifyAction ?? defaultClassifyAction;
   const saveClassifierModel = options.saveClassifierModel ??
     writeGlobalClassifierModel;
+  const now = options.now ?? (() => new Date());
 
   return function piAutomode(pi: ExtensionAPI) {
-    let loadResult = loadConfigWithDiagnostics(process.cwd());
+    let loadResult = loadConfigWithDiagnostics(process.cwd(), false);
     let config: EffectiveConfig = loadResult.config;
     let configDiagnostics: string[] = loadResult.diagnostics;
     let state: AutoModeState = {
@@ -147,6 +188,13 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
       };
     }
 
+    function ownsInspectionTool(): boolean {
+      const tool = pi.getAllTools().find(({ name }) => name === INSPECT_TOOL);
+      if (!tool) return false;
+      const sourcePath = canonicalPath(tool.sourceInfo.path);
+      return sourcePath === EXTENSION_PATH || sourcePath === EXTENSION_ENTRY_PATH;
+    }
+
     function persist(): void {
       pi.appendEntry("pi-automode-state", state);
     }
@@ -163,6 +211,77 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
       );
     }
 
+    function inspectAutomode(
+      action: InspectionAction,
+      ctx: ExtensionContext,
+    ): unknown {
+      const cfg = effectiveConfig();
+      if (action === "status") {
+        const status = [
+          `enabled: ${cfg.enabled ? "yes" : "no"}`,
+          `classifier: ${cfg.classifierModel ?? "current session model"}`,
+          `classifier reasoning: ${cfg.classifierReasoningLevel ?? "server default"}`,
+          `checked actions: ${state.checkedActions}`,
+          `blocked actions: ${state.blockedActions}`,
+          `classifier allowed: ${state.classifierAllowed}`,
+          `classifier denied: ${state.classifierDenied}`,
+          `permissions.deny rules: ${cfg.permissionDeny.length}`,
+          `permissions.ask rules: ${cfg.permissionAsk.length}`,
+          `environment entries: ${cfg.environment.length}`,
+          `allow entries: ${cfg.allow.length}`,
+          `soft_deny entries: ${cfg.softDeny.length}`,
+          `hard_deny entries: ${cfg.hardDeny.length}`,
+          `last decision: ${state.lastDecision ?? "none"}`,
+          "last reason: omitted from model-visible inspection",
+        ].join("\n");
+        return {
+          status,
+          state: {
+            enabledOverride: state.enabledOverride,
+            lastDecision: state.lastDecision,
+            checkedActions: state.checkedActions,
+            blockedActions: state.blockedActions,
+            classifierAllowed: state.classifierAllowed,
+            classifierDenied: state.classifierDenied,
+          },
+        };
+      }
+      if (action === "config") {
+        return {
+          config: cfg,
+          logFile: resolveLogPath(
+            ctx.sessionManager.getSessionFile?.(),
+            ctx.sessionManager.getSessionDir?.() ?? "",
+            ctx.sessionManager.getSessionId?.() ?? "unknown",
+            ctx.cwd,
+            options.logRoot,
+            now(),
+          ),
+          diagnostics: modelVisibleConfigDiagnostics(configDiagnostics),
+        };
+      }
+      if (action === "defaults") {
+        return {
+          environment: DEFAULT_ENVIRONMENT,
+          allow: DEFAULT_ALLOW,
+          protectedPaths: DEFAULT_PROTECTED_PATHS,
+          soft_deny: DEFAULT_SOFT_DENY,
+          hard_deny: DEFAULT_HARD_DENY,
+        };
+      }
+      const denials = state.recentDenials.slice().reverse().map((denial) => ({
+        timestamp: denial.timestamp,
+        kind: denial.kind,
+        toolName: denial.toolName,
+      }));
+      return {
+        summary: denials.length === 0
+          ? "No recent auto-mode denials."
+          : `${denials.length} recent auto-mode denial(s). Reasons and action payloads are omitted.`,
+        denials,
+      };
+    }
+
     function block(
       ctx: ExtensionContext,
       denial: DenialRecord,
@@ -231,7 +350,10 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
     }
 
     pi.on("session_start", (_event, ctx) => {
-      loadResult = loadConfigWithDiagnostics(ctx.cwd);
+      loadResult = loadConfigWithDiagnostics(
+        ctx.cwd,
+        ctx.isProjectTrusted(),
+      );
       config = loadResult.config;
       configDiagnostics = loadResult.diagnostics;
       state = restoreState(ctx);
@@ -251,22 +373,30 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
       // Enforcement order:
       // 1. permission deny/ask rules,
       // 2. deterministic hard-deny checks that never consult the model,
-      // 3. read-only built-in fast path (skipped when classifyReadOnlyTools is set),
-      // 4. classifier for every remaining action, fail-closed on setup/parse errors.
+      // 3. extension-owned read-only inspection tool,
+      // 4. deterministic path denials,
+      // 5. accepted ask rules force classifier review and skip all allow tiers,
+      // 6. inside-CWD, permissions.allow, and read-only allow tiers,
+      // 7. classifier for every remaining action, fail-closed on setup/parse errors.
       const cfg = effectiveConfig();
       if (!cfg.enabled) return undefined;
       if (ctx.signal?.aborted) return { block: true, reason: "Cancelled" };
 
+      const isOwnedInspection = event.toolName === INSPECT_TOOL &&
+        ownsInspectionTool();
       const input = event.input as Record<string, unknown>;
       const summary = actionSummary(event.toolName, input);
-      state.checkedActions += 1;
+      if (!isOwnedInspection) state.checkedActions += 1;
       const logCtx: LogCtx = {
         logger: createLogger({
           enabled: cfg.log.enabled,
           classifierIo: cfg.log.classifierIo,
           sessionFile: ctx.sessionManager.getSessionFile?.(),
-          sessionDir: ctx.sessionManager.getSessionDir?.() ?? ctx.cwd,
+          sessionDir: ctx.sessionManager.getSessionDir?.() ?? "",
+          sessionCwd: ctx.cwd,
           sessionId: ctx.sessionManager.getSessionId?.() ?? "unknown",
+          logRoot: options.logRoot,
+          now: now(),
         }),
         decisionId: newDecisionId(),
         classifierModel: cfg.classifierModel,
@@ -275,6 +405,7 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
 
       for (const pattern of cfg.permissionDeny) {
         if (matchesToolPattern(pattern, event.toolName, input, ctx.cwd)) {
+          if (isOwnedInspection) state.checkedActions += 1;
           return block(ctx, {
             timestamp: Date.now(),
             toolName: event.toolName,
@@ -285,11 +416,13 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
         }
       }
 
+      let askRequiresClassifier = false;
       for (const pattern of cfg.permissionAsk) {
         if (!matchesToolPattern(pattern, event.toolName, input, ctx.cwd)) {
           continue;
         }
         if (!ctx.hasUI) {
+          if (isOwnedInspection) state.checkedActions += 1;
           return block(ctx, {
             timestamp: Date.now(),
             toolName: event.toolName,
@@ -305,6 +438,7 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
           { signal: ctx.signal },
         );
         if (!allowed) {
+          if (isOwnedInspection) state.checkedActions += 1;
           return block(ctx, {
             timestamp: Date.now(),
             toolName: event.toolName,
@@ -313,6 +447,7 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
             kind: "permissions.ask",
           }, logCtx);
         }
+        askRequiresClassifier = true;
       }
 
       const deterministicReason = deterministicHardDeny(
@@ -321,6 +456,7 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
         ctx.cwd,
       );
       if (deterministicReason) {
+        if (isOwnedInspection) state.checkedActions += 1;
         return block(ctx, {
           timestamp: Date.now(),
           toolName: event.toolName,
@@ -330,6 +466,9 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
         }, logCtx);
       }
 
+      if (isOwnedInspection && !askRequiresClassifier) return undefined;
+      if (isOwnedInspection) state.checkedActions += 1;
+
       // Deterministic path gate for file tools.
       //
       // `deniedPaths` always applies: a matching path is hard-denied before any
@@ -343,15 +482,18 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
       // The gate is skipped entirely when both features are off, so the
       // default configuration costs no extra filesystem calls.
       let readOnlyFastPath =
-        !cfg.classifyReadOnlyTools && READ_ONLY_TOOLS.has(event.toolName);
+        !askRequiresClassifier &&
+        !cfg.classifyReadOnlyTools &&
+        READ_ONLY_TOOLS.has(event.toolName);
       if (
         (cfg.deniedPaths.length > 0 || cfg.allowInsideWorkingDirectory) &&
         PATH_BEARING_TOOLS.has(event.toolName)
       ) {
         const inputPath = extractInputPath(event.toolName, input);
         if (inputPath !== undefined) {
-          const expanded = expandHomePattern(inputPath);
-          const resolved = resolveInputPath(ctx.cwd, expanded) ?? expanded;
+          const resolved =
+            resolveToolInputPath(event.toolName, ctx.cwd, inputPath) ??
+            inputPath;
           const policyPath = resolvePathForPolicy(resolved) ?? resolved;
           const denied =
             cfg.deniedPaths.length > 0 &&
@@ -366,19 +508,42 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
               kind: "deterministic-path-deny",
             }, logCtx);
           }
+          let recursiveSearch =
+            event.toolName === "grep" || event.toolName === "find";
+          if (recursiveSearch) {
+            try {
+              recursiveSearch = statSync(policyPath).isDirectory();
+            } catch {
+              // A missing search root will fail in the tool. Treat it as a
+              // directory here so a denied scope cannot fail open in a race.
+            }
+          }
+          const deniedSearchScope =
+            recursiveSearch &&
+            cfg.deniedPaths.length > 0 &&
+            (recursiveSearchMayReachDeniedPath(resolved, cfg.deniedPaths) ||
+              recursiveSearchMayReachDeniedPath(
+                policyPath,
+                cfg.deniedPaths,
+              ));
+          if (deniedSearchScope) {
+            return block(ctx, {
+              timestamp: Date.now(),
+              toolName: event.toolName,
+              reason: `Search scope can contain a path denied by policy: ${policyPath}`,
+              action: summary,
+              kind: "deterministic-path-deny",
+            }, logCtx);
+          }
           if (cfg.allowInsideWorkingDirectory) {
             const policyCwd = resolvePathForPolicy(ctx.cwd) ?? ctx.cwd;
             if (isInside(policyPath, policyCwd)) {
-              // Protected in-tree writes must still reach the classifier;
-              // otherwise the allow tier bypasses the protected-path policy
-              // for sensitive repository content such as .git/hooks/*, .pi/*,
-              // .husky/*, or .gitignore.
-              if (
+              // Protected in-tree writes and accepted ask rules must still
+              // reach the classifier. They cannot use the inside-CWD tier.
+              const protectedWrite =
                 (event.toolName === "write" || event.toolName === "edit") &&
-                isProtectedPath(policyPath, policyCwd, cfg.protectedPaths)
-              ) {
-                readOnlyFastPath = false;
-              } else {
+                isProtectedPath(policyPath, policyCwd, cfg.protectedPaths);
+              if (!askRequiresClassifier && !protectedWrite) {
                 return allow(
                   ctx,
                   "inside-working-directory",
@@ -389,13 +554,54 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
                 );
               }
             }
-            // Outside the working directory: the read-only fast path must not
-            // apply; the classifier reviews this call.
+            // Outside the working directory, protected writes, and accepted
+            // ask rules must not use the read-only fast path.
             readOnlyFastPath = false;
           }
         }
       }
 
+      // Deterministic allow tier. It runs after every deterministic denial.
+      // Accepted ask rules skip this tier and always reach the classifier.
+      if (!askRequiresClassifier) {
+        for (const pattern of cfg.permissionAllow) {
+          if (
+            !matchesToolPattern(
+              pattern,
+              event.toolName,
+              input,
+              ctx.cwd,
+              "no-match",
+            )
+          ) {
+            continue;
+          }
+          // A protected-path write/edit is never covered by permissions.allow;
+          // it stays on the classifier path (same rule as the inside-CWD tier).
+          if (event.toolName === "write" || event.toolName === "edit") {
+            const inputPath = extractInputPath(event.toolName, input);
+            const resolved = inputPath === undefined
+              ? undefined
+              : resolveToolInputPath(event.toolName, ctx.cwd, inputPath) ??
+                inputPath;
+            if (
+              resolved !== undefined &&
+              isProtectedPath(resolved, ctx.cwd, cfg.protectedPaths)
+            ) {
+              break;
+            }
+          }
+          return allow(
+            ctx,
+            "permissions.allow",
+            `Allowed by permissions.allow: ${pattern.raw}`,
+            event.toolName,
+            summary,
+            logCtx,
+          );
+        }
+      }
+
       if (readOnlyFastPath) {
         return allow(
           ctx,
@@ -407,7 +613,12 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
         );
       }
 
-      const decision = await classify(ctx, cfg, summary, loadedContext);
+      const decision = await classify(
+        ctx,
+        cfg,
+        serializeClassifierAction(event.toolName, input),
+        loadedContext,
+      );
       logClassifierIo(decision, logCtx);
       if (decision.decision === "allow") {
         state.classifierAllowed += 1;
@@ -431,6 +642,28 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
       }, logCtx);
     });
 
+    pi.registerTool({
+      name: INSPECT_TOOL,
+      label: "Inspect Auto Mode",
+      description:
+        "Inspect the active pi-automode status, effective config, built-in defaults, or recent denial metadata. This tool is read-only and cannot enable, disable, reload, reset, or reconfigure auto mode. Its output is sent to the current model; denial reasons and action payloads are omitted.",
+      promptSnippet:
+        "Inspect active pi-automode state and diagnostic information without changing it",
+      parameters: Type.Object({
+        action: StringEnum(INSPECTION_ACTIONS, {
+          description: "The read-only auto-mode view to return",
+        }),
+      }),
+      async execute(_toolCallId, params, signal, _onUpdate, ctx) {
+        if (signal?.aborted) throw new Error("Auto-mode inspection cancelled");
+        const result = inspectAutomode(params.action, ctx);
+        return {
+          content: [{ type: "text", text: safeJson(result, 16000) }],
+          details: result,
+        };
+      },
+    });
+
     async function handleAutomodeCommand(
       args: string,
       ctx: ExtensionCommandContext,
@@ -460,7 +693,10 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
         return;
       }
       if (command === "reload") {
-        loadResult = loadConfigWithDiagnostics(ctx.cwd);
+        loadResult = loadConfigWithDiagnostics(
+          ctx.cwd,
+          ctx.isProjectTrusted(),
+        );
         config = loadResult.config;
         configDiagnostics = loadResult.diagnostics;
         persist();
@@ -504,8 +740,11 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
       if (command === "config") {
         const logFile = resolveLogPath(
           ctx.sessionManager.getSessionFile?.(),
-          ctx.sessionManager.getSessionDir?.() ?? ctx.cwd,
+          ctx.sessionManager.getSessionDir?.() ?? "",
           ctx.sessionManager.getSessionId?.() ?? "unknown",
+          ctx.cwd,
+          options.logRoot,
+          now(),
         );
         ctx.ui.notify(
           safeJson(
@@ -561,7 +800,10 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
           );
           return;
         }
-        loadResult = loadConfigWithDiagnostics(ctx.cwd);
+        loadResult = loadConfigWithDiagnostics(
+          ctx.cwd,
+          ctx.isProjectTrusted(),
+        );
         config = loadResult.config;
         configDiagnostics = loadResult.diagnostics;
         persist();

package/extensions/auto-mode/log.ts

@@ -1,6 +1,7 @@
-import { randomBytes } from "node:crypto";
+import { createHash, randomBytes } from "node:crypto";
 import { appendFileSync, mkdirSync } from "node:fs";
-import { basename, dirname, extname, join } from "node:path";
+import { homedir } from "node:os";
+import { basename, dirname, extname, isAbsolute, join, resolve } from "node:path";
 import type {
   ClassifierIo,
   ClassifierIoAttempt,
@@ -65,9 +66,32 @@ export type LoggerOptions = {
   classifierIo: boolean;
   sessionFile?: string;
   sessionDir: string;
+  /** Effective cwd for an in-memory session. */
+  sessionCwd?: string;
   sessionId: string;
+  /** Test/embedder override. Runtime uses ~/.pi/agent/extensions/pi-automode/logs. */
+  logRoot?: string;
+  /** Test clock used for the UTC date partition. */
+  now?: Date;
 };
 
+export const DEFAULT_AUTOMODE_LOG_ROOT = join(
+  homedir(),
+  ".pi/agent/extensions/pi-automode/logs",
+);
+
+const VALID_SESSION_ID =
+  /^[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?$/;
+
+function safeLogSessionId(sessionId: string): string {
+  if (VALID_SESSION_ID.test(sessionId)) return sessionId;
+  const digest = createHash("sha256")
+    .update(sessionId)
+    .digest("hex")
+    .slice(0, 16);
+  return `invalid-${digest}`;
+}
+
 /** Short id linking a classifier entry to its decision entry in the same file. */
 export function newDecisionId(): string {
   return randomBytes(4).toString("hex");
@@ -76,19 +100,43 @@ export function newDecisionId(): string {
 /**
  * Derive the log file path from the current session: the session file's
  * directory with `-pi-automode` inserted before the extension. Falls back to
- * `<sessionDir>/<sessionId>-pi-automode.jsonl` when no session file is set.
+ * an absolute session directory when one is available. In-memory sessions use
+ * an application-owned, project- and date-partitioned directory instead of a
+ * relative path resolved against the launching process cwd.
  */
 export function resolveLogPath(
   sessionFile: string | undefined,
   sessionDir: string,
   sessionId: string,
+  sessionCwd = process.cwd(),
+  logRoot = DEFAULT_AUTOMODE_LOG_ROOT,
+  now = new Date(),
 ): string {
   if (sessionFile) {
     const ext = extname(sessionFile);
     const stem = ext ? basename(sessionFile, ext) : basename(sessionFile);
     return join(dirname(sessionFile), `${stem}-pi-automode${ext}`);
   }
-  return join(sessionDir, `${sessionId}-pi-automode.jsonl`);
+
+  const logFile = `${safeLogSessionId(sessionId)}-pi-automode.jsonl`;
+  if (isAbsolute(sessionDir)) {
+    return join(sessionDir, logFile);
+  }
+
+  const resolvedCwd = resolve(sessionCwd);
+  const projectDir = `--${
+    resolvedCwd.replace(/^[/\\]/, "").replace(/[/\\:]/g, "-")
+  }--`;
+  const dateDir = now.toISOString().slice(0, 10);
+  const resolvedLogRoot = isAbsolute(logRoot)
+    ? logRoot
+    : DEFAULT_AUTOMODE_LOG_ROOT;
+  return join(
+    resolvedLogRoot,
+    projectDir,
+    dateDir,
+    logFile,
+  );
 }
 
 /** Append one JSON object as a line. Failures are swallowed: logging must
@@ -105,7 +153,14 @@ function appendJsonl(path: string, entry: unknown): void {
 /** Build a logger bound to one session's log path. No-ops when disabled. */
 export function createLogger(opts: LoggerOptions): Logger {
   const { enabled, classifierIo } = opts;
-  const path = resolveLogPath(opts.sessionFile, opts.sessionDir, opts.sessionId);
+  const path = resolveLogPath(
+    opts.sessionFile,
+    opts.sessionDir,
+    opts.sessionId,
+    opts.sessionCwd,
+    opts.logRoot,
+    opts.now,
+  );
   return {
     enabled,
     classifierIo,