@czottmann/pi-automode 1.6.0 → 1.8.0

package/extensions/auto-mode/extension.ts

@@ -19,10 +19,15 @@ import {
   writeGlobalClassifierModel,
 } from "./config.ts";
 import { deterministicHardDeny } from "./hard-deny.ts";
+import {
+  createLogger,
+  newDecisionId,
+  resolveLogPath,
+  type Logger,
+} from "./log.ts";
 import { formatModelSpec, parseModelSpec } from "./model.ts";
 import { promptForClassifierModel } from "./model-selector.ts";
 import { matchesToolPattern } from "./permissions.ts";
-import { isProtectedPath, resolveInputPath } from "./paths.ts";
 import {
   actionSummary,
   formatDenials,
@@ -35,7 +40,9 @@ import { loadedContextFromSystemPromptOptions } from "./transcript.ts";
 import type {
   AutoModeState,
   ClassifyAction,
+  ClassifyResult,
   ConfigLoadResult,
+  DecisionKind,
   DenialRecord,
   EffectiveConfig,
 } from "./types.ts";
@@ -50,6 +57,47 @@ export type PiAutomodeOptions = {
   saveClassifierModel?: (classifierModel: string) => void;
 };
 
+type LogCtx = {
+  logger: Logger;
+  decisionId: string;
+  classifierModel?: string;
+};
+
+/** Append ccusage-compatible usage and optional classifier I/O entries. */
+function logClassifierIo(decision: ClassifyResult, log: LogCtx): void {
+  if (!log.logger.enabled || !decision.io) return;
+
+  for (const attempt of decision.io.attempts) {
+    const response = attempt.response;
+    if (!response) continue;
+    log.logger.append({
+      type: "message",
+      timestamp: new Date(response.timestamp).toISOString(),
+      message: {
+        role: "assistant",
+        model: response.model,
+        usage: response.usage,
+      },
+    });
+  }
+
+  if (!log.logger.classifierIo) return;
+  log.logger.append({
+    type: "classifier",
+    ts: new Date().toISOString(),
+    decisionId: log.decisionId,
+    model: decision.io.model,
+    prompt: decision.io.prompt,
+    attempts: decision.io.attempts,
+    durationMs: decision.io.durationMs,
+    parsed: {
+      decision: decision.decision,
+      tier: decision.tier,
+      reason: decision.reason,
+    },
+  });
+}
+
 /** Create a Pi extension instance. Default export uses production dependencies. */
 export function createPiAutomode(options: PiAutomodeOptions = {}) {
   const loadConfigWithDiagnostics = options.loadConfig
@@ -101,6 +149,7 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
     function block(
       ctx: ExtensionContext,
       denial: DenialRecord,
+      logCtx: LogCtx,
     ): { block: true; reason: string } {
       state.blockedActions += 1;
       state.lastDecision = "block";
@@ -108,6 +157,21 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
       pushDenial(state, denial);
       persist();
       updateUi(ctx);
+      if (logCtx.logger.enabled) {
+        logCtx.logger.append({
+          type: "decision",
+          ts: new Date().toISOString(),
+          decisionId: logCtx.decisionId,
+          sessionId: ctx.sessionManager.getSessionId?.(),
+          cwd: ctx.cwd,
+          tool: denial.toolName,
+          summary: denial.action,
+          kind: denial.kind,
+          outcome: "block",
+          reason: denial.reason,
+          classifierModel: logCtx.classifierModel,
+        });
+      }
       if (ctx.hasUI) {
         ctx.ui.notify(
           `Auto mode blocked ${denial.toolName}: ${denial.reason}`,
@@ -117,6 +181,36 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
       return { block: true, reason: `[pi-automode] ${denial.reason}` };
     }
 
+    function allow(
+      ctx: ExtensionContext,
+      kind: DecisionKind,
+      reason: string,
+      toolName: string,
+      summary: string,
+      logCtx: LogCtx,
+    ): undefined {
+      state.lastDecision = "allow";
+      state.lastReason = reason;
+      persist();
+      updateUi(ctx);
+      if (logCtx.logger.enabled) {
+        logCtx.logger.append({
+          type: "decision",
+          ts: new Date().toISOString(),
+          decisionId: logCtx.decisionId,
+          sessionId: ctx.sessionManager.getSessionId?.(),
+          cwd: ctx.cwd,
+          tool: toolName,
+          summary,
+          kind,
+          outcome: "allow",
+          reason,
+          classifierModel: logCtx.classifierModel,
+        });
+      }
+      return undefined;
+    }
+
     pi.on("session_start", (_event, ctx) => {
       loadResult = loadConfigWithDiagnostics(ctx.cwd);
       config = loadResult.config;
@@ -135,10 +229,10 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
     });
 
     pi.on("tool_call", async (event, ctx) => {
-      // Enforcement order mirrors Claude Code's documented model:
+      // Enforcement order:
       // 1. permission deny/ask rules,
       // 2. deterministic hard-deny checks that never consult the model,
-      // 3. read-only fast path,
+      // 3. read-only built-in fast path,
       // 4. classifier for every remaining action, fail-closed on setup/parse errors.
       const cfg = effectiveConfig();
       if (!cfg.enabled) return undefined;
@@ -147,6 +241,17 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
       const input = event.input as Record<string, unknown>;
       const summary = actionSummary(event.toolName, input);
       state.checkedActions += 1;
+      const logCtx: LogCtx = {
+        logger: createLogger({
+          enabled: cfg.log.enabled,
+          classifierIo: cfg.log.classifierIo,
+          sessionFile: ctx.sessionManager.getSessionFile?.(),
+          sessionDir: ctx.sessionManager.getSessionDir?.() ?? ctx.cwd,
+          sessionId: ctx.sessionManager.getSessionId?.() ?? "unknown",
+        }),
+        decisionId: newDecisionId(),
+        classifierModel: cfg.classifierModel,
+      };
 
       for (const pattern of cfg.permissionDeny) {
         if (matchesToolPattern(pattern, event.toolName, input, ctx.cwd)) {
@@ -156,7 +261,7 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
             reason: `Blocked by permissions.deny: ${pattern.raw}`,
             action: summary,
             kind: "permissions.deny",
-          });
+          }, logCtx);
         }
       }
 
@@ -172,7 +277,7 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
               `Matched permissions.ask (${pattern.raw}) but no UI is available`,
             action: summary,
             kind: "permissions.ask",
-          });
+          }, logCtx);
         }
         const allowed = await ctx.ui.confirm(
           "Auto mode permission ask",
@@ -186,7 +291,7 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
             reason: `Declined permissions.ask: ${pattern.raw}`,
             action: summary,
             kind: "permissions.ask",
-          });
+          }, logCtx);
         }
       }
 
@@ -202,49 +307,32 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
           reason: deterministicReason,
           action: summary,
           kind: "deterministic-hard-deny",
-        });
+        }, logCtx);
       }
 
       if (READ_ONLY_TOOLS.has(event.toolName)) {
-        state.lastDecision = "allow";
-        state.lastReason = `Read-only built-in tool: ${event.toolName}`;
-        persist();
-        updateUi(ctx);
-        return undefined;
-      }
-
-      // Protected paths go to the classifier regardless of allow rules.
-      if (event.toolName === "write" || event.toolName === "edit") {
-        const path = resolveInputPath(ctx.cwd, input.path);
-        if (path && isProtectedPath(path, ctx.cwd, cfg.protectedPaths)) {
-          const decision = await classify(ctx, cfg, summary, loadedContext);
-          if (decision.decision === "allow") {
-            state.classifierAllowed += 1;
-            state.lastDecision = "allow";
-            state.lastReason = decision.reason;
-            persist();
-            updateUi(ctx);
-            return undefined;
-          }
-          state.classifierDenied += 1;
-          return block(ctx, {
-            timestamp: Date.now(),
-            toolName: event.toolName,
-            reason: decision.reason,
-            action: summary,
-            kind: "classifier",
-          });
-        }
+        return allow(
+          ctx,
+          "read-only",
+          `Read-only built-in tool: ${event.toolName}`,
+          event.toolName,
+          summary,
+          logCtx,
+        );
       }
 
       const decision = await classify(ctx, cfg, summary, loadedContext);
+      logClassifierIo(decision, logCtx);
       if (decision.decision === "allow") {
         state.classifierAllowed += 1;
-        state.lastDecision = "allow";
-        state.lastReason = decision.reason;
-        persist();
-        updateUi(ctx);
-        return undefined;
+        return allow(
+          ctx,
+          "classifier",
+          decision.reason,
+          event.toolName,
+          summary,
+          logCtx,
+        );
       }
 
       state.classifierDenied += 1;
@@ -254,7 +342,7 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
         reason: decision.reason,
         action: summary,
         kind: "classifier",
-      });
+      }, logCtx);
     });
 
     async function handleAutomodeCommand(
@@ -328,9 +416,18 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
         return;
       }
       if (command === "config") {
+        const logFile = resolveLogPath(
+          ctx.sessionManager.getSessionFile?.(),
+          ctx.sessionManager.getSessionDir?.() ?? ctx.cwd,
+          ctx.sessionManager.getSessionId?.() ?? "unknown",
+        );
         ctx.ui.notify(
           safeJson(
-            { config: effectiveConfig(), diagnostics: configDiagnostics },
+            {
+              config: effectiveConfig(),
+              logFile,
+              diagnostics: configDiagnostics,
+            },
             16000,
           ),
           configDiagnostics.length > 0 ? "warning" : "info",

package/extensions/auto-mode/hard-deny.ts

@@ -4,6 +4,7 @@ import {
   isProfileOrAuthorizedKeysPath,
   isSafetyControlPath,
   resolveInputPath,
+  resolvePathForPolicy,
   shellPathTokenToPath,
 } from "./paths.ts";
 
@@ -331,9 +332,11 @@ export function deterministicHardDeny(
   if (toolName === "write" || toolName === "edit") {
     const path = resolveInputPath(cwd, input.path);
     if (!path) return undefined;
-    const profileReason = isProfileOrAuthorizedKeysPath(path);
+    const policyPath = resolvePathForPolicy(path) ?? path;
+    const policyCwd = resolvePathForPolicy(cwd) ?? cwd;
+    const profileReason = isProfileOrAuthorizedKeysPath(policyPath);
     if (profileReason) return profileReason;
-    if (isSafetyControlPath(path, cwd)) {
+    if (isSafetyControlPath(policyPath, policyCwd)) {
       return "auto-mode or permission safety-control modification is hard-denied";
     }
   }

package/extensions/auto-mode/log.ts

@@ -0,0 +1,115 @@
+import { randomBytes } from "node:crypto";
+import { appendFileSync, mkdirSync } from "node:fs";
+import { basename, dirname, extname, join } from "node:path";
+import type {
+  ClassifierIo,
+  ClassifierIoAttempt,
+  ClassificationDecision,
+  DecisionKind,
+} from "./types.ts";
+
+/** A final allow/block decision for a tool call. */
+export type DecisionLogEntry = {
+  type: "decision";
+  ts: string;
+  decisionId: string;
+  sessionId?: string;
+  cwd: string;
+  tool: string;
+  summary: string;
+  kind: DecisionKind;
+  outcome: "allow" | "block";
+  reason: string;
+  classifierModel?: string;
+};
+
+/** The classifier prompt, raw responses, and parsed decision for one action. */
+export type ClassifierLogEntry = {
+  type: "classifier";
+  ts: string;
+  decisionId: string;
+  model: string;
+  prompt: ClassifierIo["prompt"];
+  attempts: ClassifierIoAttempt[];
+  durationMs: number;
+  parsed: ClassificationDecision;
+};
+
+/** A ccusage-compatible record for one classifier model response. */
+export type ClassifierUsageLogEntry = {
+  type: "message";
+  timestamp: string;
+  message: {
+    role: "assistant";
+    model: string;
+    usage: NonNullable<ClassifierIoAttempt["response"]>["usage"];
+  };
+};
+
+export type LogEntry =
+  | DecisionLogEntry
+  | ClassifierLogEntry
+  | ClassifierUsageLogEntry;
+
+export type Logger = {
+  enabled: boolean;
+  classifierIo: boolean;
+  append(entry: LogEntry): void;
+};
+
+export type LoggerOptions = {
+  enabled: boolean;
+  classifierIo: boolean;
+  sessionFile?: string;
+  sessionDir: string;
+  sessionId: string;
+};
+
+/** Short id linking a classifier entry to its decision entry in the same file. */
+export function newDecisionId(): string {
+  return randomBytes(4).toString("hex");
+}
+
+/**
+ * Derive the log file path from the current session: the session file's
+ * directory with `-pi-automode` inserted before the extension. Falls back to
+ * `<sessionDir>/<sessionId>-pi-automode.jsonl` when no session file is set.
+ */
+export function resolveLogPath(
+  sessionFile: string | undefined,
+  sessionDir: string,
+  sessionId: string,
+): string {
+  if (sessionFile) {
+    const ext = extname(sessionFile);
+    const stem = ext ? basename(sessionFile, ext) : basename(sessionFile);
+    return join(dirname(sessionFile), `${stem}-pi-automode${ext}`);
+  }
+  return join(sessionDir, `${sessionId}-pi-automode.jsonl`);
+}
+
+/** Append one JSON object as a line. Failures are swallowed: logging must
+ *  never change a safety decision. */
+function appendJsonl(path: string, entry: unknown): void {
+  try {
+    mkdirSync(dirname(path), { recursive: true });
+    appendFileSync(path, `${JSON.stringify(entry)}\n`, "utf8");
+  } catch {
+    // Fail open.
+  }
+}
+
+/** Build a logger bound to one session's log path. No-ops when disabled. */
+export function createLogger(opts: LoggerOptions): Logger {
+  const { enabled, classifierIo } = opts;
+  const path = resolveLogPath(opts.sessionFile, opts.sessionDir, opts.sessionId);
+  return {
+    enabled,
+    classifierIo,
+    append(entry) {
+      if (!enabled) return;
+      if (entry.type === "classifier" && !classifierIo) return;
+      appendJsonl(path, entry);
+    },
+  };
+}

package/extensions/auto-mode/paths.ts

@@ -1,9 +1,8 @@
-import { realpathSync } from "node:fs";
+import { lstatSync, readlinkSync, realpathSync } from "node:fs";
 import {
   basename,
   dirname,
   isAbsolute,
-  join,
   normalize,
   relative,
   resolve,
@@ -34,53 +33,85 @@ export function isInside(child: string, parent: string): boolean {
   return rel === "" || (!!rel && !rel.startsWith("..") && !isAbsolute(rel));
 }
 
-export function isProtectedPath(
+/** Resolve symlinks through the nearest existing ancestor of a path. */
+export function resolvePathForPolicy(path: string): string | undefined {
+  return resolvePathForPolicyInner(resolve(path), new Set<string>());
+}
+
+function resolvePathForPolicyInner(
   path: string,
-  cwd: string,
-  protectedPaths: string[],
-): boolean {
-  // Resolve symlinks so writes through symlinks (e.g. not-git -> .git) are caught.
-  let resolved = path;
-  try {
-    resolved = realpathSync(path);
-  } catch {
-    // File doesn't exist yet — try resolving the parent directory.
+  visitedSymlinks: Set<string>,
+): string | undefined {
+  let current = path;
+  const missingSegments: string[] = [];
+
+  while (true) {
     try {
-      const dir = dirname(path);
-      const base = basename(path);
-      resolved = join(realpathSync(dir), base);
+      return resolve(realpathSync(current), ...missingSegments);
     } catch {
-      // Parent doesn't exist either — fall through with raw path.
+      try {
+        const stat = lstatSync(current);
+        if (!stat.isSymbolicLink() || visitedSymlinks.has(current)) {
+          return undefined;
+        }
+        visitedSymlinks.add(current);
+        const target = resolve(dirname(current), readlinkSync(current));
+        return resolvePathForPolicyInner(
+          resolve(target, ...missingSegments),
+          visitedSymlinks,
+        );
+      } catch (error) {
+        const code = error && typeof error === "object" && "code" in error
+          ? String(error.code)
+          : undefined;
+        if (code !== "ENOENT" && code !== "ENOTDIR") return undefined;
+        const parent = dirname(current);
+        if (parent === current) return undefined;
+        missingSegments.unshift(basename(current));
+        current = parent;
+      }
     }
   }
+}
+
+export function matchesProtectedPath(
+  relativePath: string,
+  protectedPaths: string[],
+): boolean {
+  const normalizedPath = relativePath.replace(/\\/g, "/");
+  return protectedPaths.some((pattern) => {
+    const normalizedPattern = pattern.replace(/\\/g, "/");
+    return normalizedPath === normalizedPattern ||
+      normalizedPath.startsWith(`${normalizedPattern}/`);
+  });
+}
+
+export function isProtectedPath(
+  path: string,
+  cwd: string,
+  protectedPaths: string[],
+): boolean {
+  // Resolve through the nearest existing ancestor so symlinked directories are
+  // respected even when the final write target does not exist yet.
+  const resolved = resolvePathForPolicy(path) ?? path;
+  const resolvedCwd = resolvePathForPolicy(cwd) ?? cwd;
 
   // For paths inside the project: use relative path for matching.
-  if (resolved.startsWith(cwd)) {
-    const relativePath = relative(cwd, resolved);
-    for (const pattern of protectedPaths) {
-      if (
-        relativePath === pattern ||
-        relativePath.startsWith(`${pattern}/`)
-      ) {
-        return true;
-      }
-    }
-    return false;
+  if (isInside(resolved, resolvedCwd)) {
+    return matchesProtectedPath(
+      relative(resolvedCwd, resolved),
+      protectedPaths,
+    );
   }
 
   // For paths outside the project: check every path component suffix.
   // This catches writes like ../other-project/.git/config even when cwd
   // doesn't contain the target.
-  const segments = resolved.split("/").filter(Boolean);
+  const normalizedResolved = resolved.replace(/\\/g, "/");
+  const segments = normalizedResolved.split("/").filter(Boolean);
   for (let i = 0; i < segments.length; i++) {
-    const suffix = segments.slice(i).join("/");
-    for (const pattern of protectedPaths) {
-      if (
-        suffix === pattern ||
-        suffix.startsWith(`${pattern}/`)
-      ) {
-        return true;
-      }
+    if (matchesProtectedPath(segments.slice(i).join("/"), protectedPaths)) {
+      return true;
     }
   }
   return false;