@czottmann/pi-automode 1.11.0 → 1.13.0

package/extensions/auto-mode/extension.ts

@@ -1,12 +1,19 @@
+import { realpathSync, statSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
 import type {
   ExtensionAPI,
   ExtensionCommandContext,
   ExtensionContext,
 } from "@earendil-works/pi-coding-agent";
+import { StringEnum } from "@earendil-works/pi-ai";
+import { Type } from "typebox";
 import {
   classifierReasoningForConfig,
   defaultClassifyAction,
+  serializeClassifierAction,
 } from "./classifier.ts";
+import { analyzeBash, type BashAnalysis } from "./bash.ts";
 import {
   AUTO_MODE_GUIDANCE,
   DEFAULT_ALLOW,
@@ -15,11 +22,13 @@ import {
   DEFAULT_PROTECTED_PATHS,
   DEFAULT_SOFT_DENY,
   PATH_BEARING_TOOLS,
+  PI_GLOBAL_SETTINGS,
   READ_ONLY_TOOLS,
 } from "./constants.ts";
 import {
-  loadEffectiveConfig,
+  type GlobalConfigPreparation,
   loadEffectiveConfigWithDiagnostics,
+  prepareGlobalConfig,
   writeGlobalClassifierModel,
 } from "./config.ts";
 import { deterministicHardDeny } from "./hard-deny.ts";
@@ -31,14 +40,19 @@ import {
 } from "./log.ts";
 import { formatModelSpec, parseModelSpec } from "./model.ts";
 import { promptForClassifierModel } from "./model-selector.ts";
-import { matchesDeniedPath, matchesToolPattern } from "./permissions.ts";
 import {
-  expandHomePattern,
+  matchesAllowedToolPatterns,
+  matchesDeniedPath,
+  matchesToolPattern,
+  matchingBashCommandText,
+  recursiveSearchMayReachDeniedPath,
+} from "./permissions.ts";
+import {
   extractInputPath,
   isInside,
   isProtectedPath,
-  resolveInputPath,
   resolvePathForPolicy,
+  resolveToolInputPath,
 } from "./paths.ts";
 import {
   actionSummary,
@@ -59,15 +73,55 @@ import type {
   DenialRecord,
   EffectiveConfig,
 } from "./types.ts";
-import { safeJson } from "./utils.ts";
+import { safeJson, truncateMiddle } from "./utils.ts";
+
+const INSPECT_TOOL = "automode_inspect";
+const INSPECTION_ACTIONS = ["status", "config", "defaults", "denials"] as const;
+type InspectionAction = (typeof INSPECTION_ACTIONS)[number];
+
+function matchedCommandSummary(command: string | undefined): string | undefined {
+  return command ? truncateMiddle(command, 500) : undefined;
+}
+
+function canonicalPath(path: string): string {
+  try {
+    return realpathSync(path);
+  } catch {
+    return resolve(path);
+  }
+}
+
+const EXTENSION_PATH = canonicalPath(fileURLToPath(import.meta.url));
+const EXTENSION_ENTRY_PATH = canonicalPath(
+  resolve(dirname(EXTENSION_PATH), "../auto-mode.ts"),
+);
+
+export function modelVisibleConfigDiagnostics(
+  diagnostics: string[],
+): string[] {
+  return diagnostics.map((diagnostic) =>
+    diagnostic.replace(
+      /invalid JSON \([\s\S]*\)$/,
+      "invalid JSON (parser details omitted from model-visible output)",
+    )
+  );
+}
 
 export type PiAutomodeOptions = {
   /** Override config loading in tests. Runtime code uses Pi-owned disk settings. */
-  loadConfig?: (cwd: string) => EffectiveConfig;
+  loadConfig?: (cwd: string, projectTrusted: boolean) => EffectiveConfig;
   /** Override classifier calls in tests so unit tests never need a real LLM/API key. */
   classifyAction?: ClassifyAction;
-  /** Override classifier-model persistence in tests. Runtime code writes ~/.pi/agent/automode.json. */
+  /** Override classifier-model persistence in tests. Runtime code writes the active global config. */
   saveClassifierModel?: (classifierModel: string) => void;
+  /** Override global config migration and path selection in tests. */
+  prepareGlobalConfig?: () => GlobalConfigPreparation;
+  /** Override the application-owned observability log root in tests. */
+  logRoot?: string;
+  /** Override the observability log clock in tests. */
+  now?: () => Date;
+  /** Override Bash analysis in tests. Runtime code uses unbash. */
+  analyzeBash?: typeof analyzeBash;
 };
 
 type LogCtx = {
@@ -117,18 +171,44 @@ function logClassifierIo(decision: ClassifyResult, log: LogCtx): void {
 
 /** Create a Pi extension instance. Default export uses production dependencies. */
 export function createPiAutomode(options: PiAutomodeOptions = {}) {
-  const loadConfigWithDiagnostics = options.loadConfig
-    ? (cwd: string): ConfigLoadResult => ({
-      config: options.loadConfig?.(cwd) ?? loadEffectiveConfig(cwd),
-      diagnostics: [],
-    })
-    : loadEffectiveConfigWithDiagnostics;
   const classify = options.classifyAction ?? defaultClassifyAction;
-  const saveClassifierModel = options.saveClassifierModel ??
-    writeGlobalClassifierModel;
+  const now = options.now ?? (() => new Date());
 
   return function piAutomode(pi: ExtensionAPI) {
-    let loadResult = loadConfigWithDiagnostics(process.cwd());
+    const globalConfig = options.prepareGlobalConfig?.() ??
+      (options.loadConfig
+        ? { status: "current" as const, activePath: PI_GLOBAL_SETTINGS[0] }
+        : prepareGlobalConfig());
+    const loadConfigWithDiagnostics = (
+      cwd: string,
+      projectTrusted: boolean,
+    ): ConfigLoadResult => {
+      const result = options.loadConfig
+        ? {
+          config: options.loadConfig(cwd, projectTrusted),
+          diagnostics: [],
+        }
+        : loadEffectiveConfigWithDiagnostics(
+          cwd,
+          projectTrusted,
+          globalConfig.activePath,
+        );
+      return globalConfig.diagnostic
+        ? {
+          ...result,
+          diagnostics: [...result.diagnostics, globalConfig.diagnostic],
+        }
+        : result;
+    };
+    const persistClassifierModel = options.saveClassifierModel ??
+      ((classifierModel: string) =>
+        writeGlobalClassifierModel(classifierModel, globalConfig.activePath));
+    const saveClassifierModel = globalConfig.writeBlockedReason
+      ? (_classifierModel: string) => {
+        throw new Error(globalConfig.writeBlockedReason);
+      }
+      : persistClassifierModel;
+    let loadResult = loadConfigWithDiagnostics(process.cwd(), false);
     let config: EffectiveConfig = loadResult.config;
     let configDiagnostics: string[] = loadResult.diagnostics;
     let state: AutoModeState = {
@@ -139,6 +219,7 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
       recentDenials: [],
     };
     let loadedContext = "";
+    let globalConfigNoticeShown = false;
 
     function effectiveConfig(): EffectiveConfig {
       return {
@@ -147,6 +228,13 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
       };
     }
 
+    function ownsInspectionTool(): boolean {
+      const tool = pi.getAllTools().find(({ name }) => name === INSPECT_TOOL);
+      if (!tool) return false;
+      const sourcePath = canonicalPath(tool.sourceInfo.path);
+      return sourcePath === EXTENSION_PATH || sourcePath === EXTENSION_ENTRY_PATH;
+    }
+
     function persist(): void {
       pi.appendEntry("pi-automode-state", state);
     }
@@ -163,6 +251,78 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
       );
     }
 
+    function inspectAutomode(
+      action: InspectionAction,
+      ctx: ExtensionContext,
+    ): unknown {
+      const cfg = effectiveConfig();
+      if (action === "status") {
+        const status = [
+          `enabled: ${cfg.enabled ? "yes" : "no"}`,
+          `classifier: ${cfg.classifierModel ?? "current session model"}`,
+          `classifier reasoning: ${cfg.classifierReasoningLevel ?? "server default"}`,
+          `checked actions: ${state.checkedActions}`,
+          `blocked actions: ${state.blockedActions}`,
+          `classifier allowed: ${state.classifierAllowed}`,
+          `classifier denied: ${state.classifierDenied}`,
+          `permissions.deny rules: ${cfg.permissionDeny.length}`,
+          `permissions.ask rules: ${cfg.permissionAsk.length}`,
+          `permissions.allow rules: ${cfg.permissionAllow.length}`,
+          `environment entries: ${cfg.environment.length}`,
+          `allow entries: ${cfg.allow.length}`,
+          `soft_deny entries: ${cfg.softDeny.length}`,
+          `hard_deny entries: ${cfg.hardDeny.length}`,
+          `last decision: ${state.lastDecision ?? "none"}`,
+          "last reason: omitted from model-visible inspection",
+        ].join("\n");
+        return {
+          status,
+          state: {
+            enabledOverride: state.enabledOverride,
+            lastDecision: state.lastDecision,
+            checkedActions: state.checkedActions,
+            blockedActions: state.blockedActions,
+            classifierAllowed: state.classifierAllowed,
+            classifierDenied: state.classifierDenied,
+          },
+        };
+      }
+      if (action === "config") {
+        return {
+          config: cfg,
+          logFile: resolveLogPath(
+            ctx.sessionManager.getSessionFile?.(),
+            ctx.sessionManager.getSessionDir?.() ?? "",
+            ctx.sessionManager.getSessionId?.() ?? "unknown",
+            ctx.cwd,
+            options.logRoot,
+            now(),
+          ),
+          diagnostics: modelVisibleConfigDiagnostics(configDiagnostics),
+        };
+      }
+      if (action === "defaults") {
+        return {
+          environment: DEFAULT_ENVIRONMENT,
+          allow: DEFAULT_ALLOW,
+          protectedPaths: DEFAULT_PROTECTED_PATHS,
+          soft_deny: DEFAULT_SOFT_DENY,
+          hard_deny: DEFAULT_HARD_DENY,
+        };
+      }
+      const denials = state.recentDenials.slice().reverse().map((denial) => ({
+        timestamp: denial.timestamp,
+        kind: denial.kind,
+        toolName: denial.toolName,
+      }));
+      return {
+        summary: denials.length === 0
+          ? "No recent auto-mode denials."
+          : `${denials.length} recent auto-mode denial(s). Reasons and action payloads are omitted.`,
+        denials,
+      };
+    }
+
     function block(
       ctx: ExtensionContext,
       denial: DenialRecord,
@@ -231,10 +391,24 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
     }
 
     pi.on("session_start", (_event, ctx) => {
-      loadResult = loadConfigWithDiagnostics(ctx.cwd);
+      loadResult = loadConfigWithDiagnostics(
+        ctx.cwd,
+        ctx.isProjectTrusted(),
+      );
       config = loadResult.config;
       configDiagnostics = loadResult.diagnostics;
       state = restoreState(ctx);
+      if (
+        ctx.hasUI &&
+        globalConfig.notification &&
+        !globalConfigNoticeShown
+      ) {
+        ctx.ui.notify(
+          globalConfig.notification,
+          globalConfig.status === "migrated" ? "info" : "warning",
+        );
+        globalConfigNoticeShown = true;
+      }
       updateUi(ctx);
     });
 
@@ -251,22 +425,51 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
       // Enforcement order:
       // 1. permission deny/ask rules,
       // 2. deterministic hard-deny checks that never consult the model,
-      // 3. read-only built-in fast path (skipped when classifyReadOnlyTools is set),
-      // 4. classifier for every remaining action, fail-closed on setup/parse errors.
+      // 3. extension-owned read-only inspection tool,
+      // 4. deterministic path denials,
+      // 5. accepted ask rules force classifier review and skip all allow tiers,
+      // 6. inside-CWD, permissions.allow, and read-only allow tiers,
+      // 7. classifier for every remaining action, fail-closed on setup/parse errors.
       const cfg = effectiveConfig();
       if (!cfg.enabled) return undefined;
       if (ctx.signal?.aborted) return { block: true, reason: "Cancelled" };
 
+      const isOwnedInspection = event.toolName === INSPECT_TOOL &&
+        ownsInspectionTool();
       const input = event.input as Record<string, unknown>;
+      let bashAnalysis: BashAnalysis | undefined;
+      if (event.toolName === "bash") {
+        const source = typeof input.command === "string" ? input.command : "";
+        try {
+          bashAnalysis = (options.analyzeBash ?? analyzeBash)(source);
+        } catch (error) {
+          bashAnalysis = {
+            source,
+            commands: [],
+            redirects: [],
+            redirectTargets: [],
+            structure: [],
+            allowStructureSafe: false,
+            errors: [{
+              message: `Bash analysis failed: ${
+                error instanceof Error ? error.message : String(error)
+              }`,
+            }],
+          };
+        }
+      }
       const summary = actionSummary(event.toolName, input);
-      state.checkedActions += 1;
+      if (!isOwnedInspection) state.checkedActions += 1;
       const logCtx: LogCtx = {
         logger: createLogger({
           enabled: cfg.log.enabled,
           classifierIo: cfg.log.classifierIo,
           sessionFile: ctx.sessionManager.getSessionFile?.(),
-          sessionDir: ctx.sessionManager.getSessionDir?.() ?? ctx.cwd,
+          sessionDir: ctx.sessionManager.getSessionDir?.() ?? "",
+          sessionCwd: ctx.cwd,
           sessionId: ctx.sessionManager.getSessionId?.() ?? "unknown",
+          logRoot: options.logRoot,
+          now: now(),
         }),
         decisionId: newDecisionId(),
         classifierModel: cfg.classifierModel,
@@ -274,27 +477,58 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
       };
 
       for (const pattern of cfg.permissionDeny) {
-        if (matchesToolPattern(pattern, event.toolName, input, ctx.cwd)) {
+        if (
+          matchesToolPattern(
+            pattern,
+            event.toolName,
+            input,
+            ctx.cwd,
+            "match",
+            bashAnalysis,
+          )
+        ) {
+          const matchedCommand = matchedCommandSummary(
+            matchingBashCommandText(pattern, bashAnalysis),
+          );
+          if (isOwnedInspection) state.checkedActions += 1;
           return block(ctx, {
             timestamp: Date.now(),
             toolName: event.toolName,
-            reason: `Blocked by permissions.deny: ${pattern.raw}`,
+            reason: `Blocked by permissions.deny: ${pattern.raw}${
+              matchedCommand ? `; matched command: ${matchedCommand}` : ""
+            }`,
             action: summary,
             kind: "permissions.deny",
           }, logCtx);
         }
       }
 
+      let askRequiresClassifier = false;
       for (const pattern of cfg.permissionAsk) {
-        if (!matchesToolPattern(pattern, event.toolName, input, ctx.cwd)) {
+        if (
+          !matchesToolPattern(
+            pattern,
+            event.toolName,
+            input,
+            ctx.cwd,
+            "match",
+            bashAnalysis,
+          )
+        ) {
           continue;
         }
         if (!ctx.hasUI) {
+          const matchedCommand = matchedCommandSummary(
+            matchingBashCommandText(pattern, bashAnalysis),
+          );
+          if (isOwnedInspection) state.checkedActions += 1;
           return block(ctx, {
             timestamp: Date.now(),
             toolName: event.toolName,
             reason:
-              `Matched permissions.ask (${pattern.raw}) but no UI is available`,
+              `Matched permissions.ask (${pattern.raw})${
+                matchedCommand ? ` for command: ${matchedCommand}` : ""
+              } but no UI is available`,
             action: summary,
             kind: "permissions.ask",
           }, logCtx);
@@ -305,22 +539,31 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
           { signal: ctx.signal },
         );
         if (!allowed) {
+          const matchedCommand = matchedCommandSummary(
+            matchingBashCommandText(pattern, bashAnalysis),
+          );
+          if (isOwnedInspection) state.checkedActions += 1;
           return block(ctx, {
             timestamp: Date.now(),
             toolName: event.toolName,
-            reason: `Declined permissions.ask: ${pattern.raw}`,
+            reason: `Declined permissions.ask: ${pattern.raw}${
+              matchedCommand ? `; matched command: ${matchedCommand}` : ""
+            }`,
             action: summary,
             kind: "permissions.ask",
           }, logCtx);
         }
+        askRequiresClassifier = true;
       }
 
       const deterministicReason = deterministicHardDeny(
         event.toolName,
         input,
         ctx.cwd,
+        bashAnalysis,
       );
       if (deterministicReason) {
+        if (isOwnedInspection) state.checkedActions += 1;
         return block(ctx, {
           timestamp: Date.now(),
           toolName: event.toolName,
@@ -330,6 +573,9 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
         }, logCtx);
       }
 
+      if (isOwnedInspection && !askRequiresClassifier) return undefined;
+      if (isOwnedInspection) state.checkedActions += 1;
+
       // Deterministic path gate for file tools.
       //
       // `deniedPaths` always applies: a matching path is hard-denied before any
@@ -343,15 +589,18 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
       // The gate is skipped entirely when both features are off, so the
       // default configuration costs no extra filesystem calls.
       let readOnlyFastPath =
-        !cfg.classifyReadOnlyTools && READ_ONLY_TOOLS.has(event.toolName);
+        !askRequiresClassifier &&
+        !cfg.classifyReadOnlyTools &&
+        READ_ONLY_TOOLS.has(event.toolName);
       if (
         (cfg.deniedPaths.length > 0 || cfg.allowInsideWorkingDirectory) &&
         PATH_BEARING_TOOLS.has(event.toolName)
       ) {
         const inputPath = extractInputPath(event.toolName, input);
         if (inputPath !== undefined) {
-          const expanded = expandHomePattern(inputPath);
-          const resolved = resolveInputPath(ctx.cwd, expanded) ?? expanded;
+          const resolved =
+            resolveToolInputPath(event.toolName, ctx.cwd, inputPath) ??
+            inputPath;
           const policyPath = resolvePathForPolicy(resolved) ?? resolved;
           const denied =
             cfg.deniedPaths.length > 0 &&
@@ -366,19 +615,42 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
               kind: "deterministic-path-deny",
             }, logCtx);
           }
+          let recursiveSearch =
+            event.toolName === "grep" || event.toolName === "find";
+          if (recursiveSearch) {
+            try {
+              recursiveSearch = statSync(policyPath).isDirectory();
+            } catch {
+              // A missing search root will fail in the tool. Treat it as a
+              // directory here so a denied scope cannot fail open in a race.
+            }
+          }
+          const deniedSearchScope =
+            recursiveSearch &&
+            cfg.deniedPaths.length > 0 &&
+            (recursiveSearchMayReachDeniedPath(resolved, cfg.deniedPaths) ||
+              recursiveSearchMayReachDeniedPath(
+                policyPath,
+                cfg.deniedPaths,
+              ));
+          if (deniedSearchScope) {
+            return block(ctx, {
+              timestamp: Date.now(),
+              toolName: event.toolName,
+              reason: `Search scope can contain a path denied by policy: ${policyPath}`,
+              action: summary,
+              kind: "deterministic-path-deny",
+            }, logCtx);
+          }
           if (cfg.allowInsideWorkingDirectory) {
             const policyCwd = resolvePathForPolicy(ctx.cwd) ?? ctx.cwd;
             if (isInside(policyPath, policyCwd)) {
-              // Protected in-tree writes must still reach the classifier;
-              // otherwise the allow tier bypasses the protected-path policy
-              // for sensitive repository content such as .git/hooks/*, .pi/*,
-              // .husky/*, or .gitignore.
-              if (
+              // Protected in-tree writes and accepted ask rules must still
+              // reach the classifier. They cannot use the inside-CWD tier.
+              const protectedWrite =
                 (event.toolName === "write" || event.toolName === "edit") &&
-                isProtectedPath(policyPath, policyCwd, cfg.protectedPaths)
-              ) {
-                readOnlyFastPath = false;
-              } else {
+                isProtectedPath(policyPath, policyCwd, cfg.protectedPaths);
+              if (!askRequiresClassifier && !protectedWrite) {
                 return allow(
                   ctx,
                   "inside-working-directory",
@@ -389,13 +661,54 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
                 );
               }
             }
-            // Outside the working directory: the read-only fast path must not
-            // apply; the classifier reviews this call.
+            // Outside the working directory, protected writes, and accepted
+            // ask rules must not use the read-only fast path.
             readOnlyFastPath = false;
           }
         }
       }
 
+      // Deterministic allow tier. It runs after every deterministic denial.
+      // Accepted ask rules skip this tier and always reach the classifier.
+      if (!askRequiresClassifier) {
+        if (
+          matchesAllowedToolPatterns(
+            cfg.permissionAllow,
+            event.toolName,
+            input,
+            ctx.cwd,
+            bashAnalysis,
+          )
+        ) {
+          // A protected-path write/edit is never covered by permissions.allow;
+          // it stays on the classifier path (same rule as the inside-CWD tier).
+          let protectedWrite = false;
+          if (event.toolName === "write" || event.toolName === "edit") {
+            const inputPath = extractInputPath(event.toolName, input);
+            const resolved = inputPath === undefined
+              ? undefined
+              : resolveToolInputPath(event.toolName, ctx.cwd, inputPath) ??
+                inputPath;
+            if (
+              resolved !== undefined &&
+              isProtectedPath(resolved, ctx.cwd, cfg.protectedPaths)
+            ) {
+              protectedWrite = true;
+            }
+          }
+          if (!protectedWrite) {
+            return allow(
+              ctx,
+              "permissions.allow",
+              "Allowed by permissions.allow",
+              event.toolName,
+              summary,
+              logCtx,
+            );
+          }
+        }
+      }
+
       if (readOnlyFastPath) {
         return allow(
           ctx,
@@ -407,7 +720,12 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
         );
       }
 
-      const decision = await classify(ctx, cfg, summary, loadedContext);
+      const decision = await classify(
+        ctx,
+        cfg,
+        serializeClassifierAction(event.toolName, input),
+        loadedContext,
+      );
       logClassifierIo(decision, logCtx);
       if (decision.decision === "allow") {
         state.classifierAllowed += 1;
@@ -431,6 +749,28 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
       }, logCtx);
     });
 
+    pi.registerTool({
+      name: INSPECT_TOOL,
+      label: "Inspect Auto Mode",
+      description:
+        "Inspect the active pi-automode status, effective config, built-in defaults, or recent denial metadata. This tool is read-only and cannot enable, disable, reload, reset, or reconfigure auto mode. Its output is sent to the current model; denial reasons and action payloads are omitted.",
+      promptSnippet:
+        "Inspect active pi-automode state and diagnostic information without changing it",
+      parameters: Type.Object({
+        action: StringEnum(INSPECTION_ACTIONS, {
+          description: "The read-only auto-mode view to return",
+        }),
+      }),
+      async execute(_toolCallId, params, signal, _onUpdate, ctx) {
+        if (signal?.aborted) throw new Error("Auto-mode inspection cancelled");
+        const result = inspectAutomode(params.action, ctx);
+        return {
+          content: [{ type: "text", text: safeJson(result, 16000) }],
+          details: result,
+        };
+      },
+    });
+
     async function handleAutomodeCommand(
       args: string,
       ctx: ExtensionCommandContext,
@@ -460,7 +800,10 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
         return;
       }
       if (command === "reload") {
-        loadResult = loadConfigWithDiagnostics(ctx.cwd);
+        loadResult = loadConfigWithDiagnostics(
+          ctx.cwd,
+          ctx.isProjectTrusted(),
+        );
         config = loadResult.config;
         configDiagnostics = loadResult.diagnostics;
         persist();
@@ -504,8 +847,11 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
       if (command === "config") {
         const logFile = resolveLogPath(
           ctx.sessionManager.getSessionFile?.(),
-          ctx.sessionManager.getSessionDir?.() ?? ctx.cwd,
+          ctx.sessionManager.getSessionDir?.() ?? "",
           ctx.sessionManager.getSessionId?.() ?? "unknown",
+          ctx.cwd,
+          options.logRoot,
+          now(),
         );
         ctx.ui.notify(
           safeJson(
@@ -561,7 +907,10 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
           );
           return;
         }
-        loadResult = loadConfigWithDiagnostics(ctx.cwd);
+        loadResult = loadConfigWithDiagnostics(
+          ctx.cwd,
+          ctx.isProjectTrusted(),
+        );
         config = loadResult.config;
         configDiagnostics = loadResult.diagnostics;
         persist();