@danypops/pi-packed 0.2.1 → 0.3.0

package/README.md

@@ -11,8 +11,8 @@ inside the supervised Bun daemon.
 ```text
 ┌─ Pi extension (Node-compatible) ──────────────┐
 │ pkg_search · pkg_info · pkg_install           │
-│ /packages · session_start update notification │
-│ confirmation gates · no Bun/SQLite dependency │
+│ /packages · /packed security settings          │
+│ policy-driven approval · no Bun/SQLite access  │
 └──────────────────┬────────────────────────────┘
                    │ authenticated loopback HTTP
 ┌─ packed.service (Bun) ────────────────────────┐
@@ -37,9 +37,7 @@ packed installed --json
 /packages
 ```
 
-Packages execute arbitrary code. `pkg_install` always requires interactive user
-confirmation before the extension sends the mutation to the authenticated
-daemon.
+Packages execute arbitrary code. `pkg_install` uses daemon-owned security settings with secure default `installApproval: always`. Open `/packed` to choose **Always require approval** or explicitly opt out with **Never require approval**. The unsafe opt-out allows agent installs without an interactive UI. `/packages` remains the package browser.
 
 ## CLI
 
@@ -53,6 +51,7 @@ daemon.
 | `packed catalog [--json]` | Inspect the local package index |
 | `packed install <source> [--json]` | Authenticated daemon install for `npm:`, `git:`, or `https://` sources |
 | `packed remove <name> [--json]` | Authenticated daemon removal by bare npm name |
+| `packed security [always\|never] [--json]` | Read or set the install approval policy |
 | `packed serve` | Run the loopback daemon |
 | `packed service` | Print the systemd user unit |
 | `packed version` | Print the package/service version |
@@ -77,13 +76,15 @@ The daemon listens on loopback only.
 | `GET` | `/search?q=&limit=&offline=1` |
 | `GET` | `/info?name=` |
 | `GET` | `/installed` |
+| `GET` | `/security` |
+| `POST` | `/security` with `{ "installApproval": "always" | "never" }` |
 | `GET` | `/updates` |
 | `GET` | `/catalog` |
 | `POST` | `/install` with `{ "source": "..." }` |
 | `POST` | `/remove` with `{ "name": "..." }` |
 
 State defaults to `~/.cache/pi-packed/` and contains `token`, `port`,
-`updates.json`, and `packed.db`. Relevant environment variables:
+`updates.json`, `security.json`, and `packed.db`. Relevant environment variables:
 
 - `PI_PACKED_HOME`
 - `PI_PACKED_PI_HOME`

package/extension/src/index.ts

@@ -13,6 +13,7 @@ import { registerTools } from "./tools.js";
 import { showPackages } from "./tui.js";
 import { createNatives } from "./packed.js";
 import { formatUpdateNotice } from "./model.js";
+import { showPackedSettings } from "./security-tui.js";
 
 // Async factory (pi awaits it): the seam creates authenticated daemon
 // clients lazily. It never executes Bun-only adapters or opens SQLite.
@@ -20,6 +21,13 @@ export default async function (pi: ExtensionAPI) {
 	const natives = await createNatives();
 	registerTools(pi, natives);
 
+	pi.registerCommand("packed", {
+		description: "Configure pi-packed security settings",
+		handler: async (_args, ctx) => {
+			await showPackedSettings(ctx, natives);
+		},
+	});
+
 	pi.registerCommand("packages", {
 		description: "Browse and manage installed Pi packages (pi-packed)",
 		handler: async (_args, ctx) => {

package/extension/src/packed.ts

@@ -8,6 +8,7 @@
  */
 import type { PackageDaemonPort as ClientPackageDaemonPort } from "../../src/client.ts";
 import type { InstalledPkg, Pkg, PkgInfo, UpdateEntry } from "../../src/ports.ts";
+import type { InstallApproval, SecuritySettings } from "../../src/security.ts";
 
 export type { InstalledPkg, UpdateEntry };
 export type PackageInfo = PkgInfo;
@@ -25,6 +26,8 @@ export interface Natives {
 	info(name: string): Promise<PackageInfo>;
 	installed(): Promise<InstalledPkg[]>;
 	updates(): Promise<UpdateEntry[]>;
+	security(): Promise<SecuritySettings>;
+	setInstallApproval(value: InstallApproval): Promise<SecuritySettings>;
 	install(source: string): Promise<string>;
 	remove(name: string): Promise<string>;
 }
@@ -58,6 +61,8 @@ export async function createNatives(connect: PackageDaemonConnector = connectDef
 		info: (name) => call((daemon) => daemon.info(name)),
 		installed: () => call((daemon) => daemon.installed()),
 		updates: () => call((daemon) => daemon.updates()),
+		security: () => call((daemon) => daemon.security()),
+		setInstallApproval: (value) => call((daemon) => daemon.setInstallApproval(value)),
 		install: (source) => call((daemon) => daemon.install(source)),
 		remove: (name) => call((daemon) => daemon.remove(name)),
 	};

package/extension/src/security-tui.ts

@@ -0,0 +1,33 @@
+import type { ExtensionCommandContext } from "@earendil-works/pi-coding-agent";
+import type { InstallApproval } from "../../src/security.ts";
+import type { Natives } from "./packed.ts";
+
+const OPTIONS: Array<{ value: InstallApproval; label: string }> = [
+	{ value: "always", label: "Always require approval (recommended)" },
+	{ value: "never", label: "Never require approval (unsafe opt-out)" },
+];
+
+export async function showPackedSettings(ctx: ExtensionCommandContext, natives: Natives): Promise<void> {
+	if (!ctx.hasUI) {
+		ctx.ui.notify("/packed requires interactive mode", "warning");
+		return;
+	}
+	try {
+		const current = await natives.security();
+		const choice = await ctx.ui.select(
+			`Package install approval · current: ${current.installApproval}`,
+			[...OPTIONS.map(({ label }) => label), "Cancel"],
+		);
+		const selected = OPTIONS.find(({ label }) => label === choice);
+		if (!selected || selected.value === current.installApproval) return;
+		const updated = await natives.setInstallApproval(selected.value);
+		ctx.ui.notify(
+			updated.installApproval === "always"
+				? "Package installs now require confirmation."
+				: "Package install confirmation disabled. Packages can execute arbitrary code.",
+			updated.installApproval === "always" ? "info" : "warning",
+		);
+	} catch (error) {
+		ctx.ui.notify(`packed security settings failed: ${error instanceof Error ? error.message : error}`, "error");
+	}
+}

package/extension/src/tools.ts

@@ -10,6 +10,28 @@ function text(t: string, details: Record<string, unknown> = {}) {
 	return { content: [{ type: "text" as const, text: t }], details };
 }
 
+export async function installPackageWithPolicy(
+	source: string,
+	natives: Pick<Natives, "security" | "install">,
+	ctx: { hasUI: boolean; ui: { confirm(title: string, message: string): Promise<boolean> } },
+) {
+	try {
+		const { installApproval } = await natives.security();
+		if (installApproval === "always") {
+			if (!ctx.hasUI) return text("pkg_install requires interactive approval; change installApproval in /packed to opt out.");
+			const ok = await ctx.ui.confirm(
+				"Install Pi package",
+				`Run: pi install ${source}\n\nPackages execute arbitrary code. Continue?`,
+			);
+			if (!ok) return text("Install cancelled by user.");
+		}
+		const out = await natives.install(source);
+		return text(out || `Installed ${source}. Reload with /reload to activate.`);
+	} catch (error) {
+		return text(`install failed: ${error instanceof Error ? error.message : error}`);
+	}
+}
+
 export function registerTools(pi: ExtensionAPI, natives: Natives): void {
 	pi.registerTool({
 		name: "pkg_search",
@@ -71,25 +93,12 @@ export function registerTools(pi: ExtensionAPI, natives: Natives): void {
 		label: "Pi Package Install",
 		description:
 			"Install a Pi package (pi install). Supports npm:<pkg>[@ver], git:<host>/<owner>/<repo>[@ref], " +
-			"or https:// URLs. Packages execute arbitrary code — the user confirms every install.",
+			"or https:// URLs. Packages execute arbitrary code. Approval follows the installApproval policy configured in /packed (secure default: always).",
 		parameters: Type.Object({
 			source: Type.String({ description: "e.g. 'npm:pi-lsp', 'npm:@scope/pkg@1.2.3', 'git:github.com/u/r@v1'" }),
 		}),
 		async execute(_id, params, _signal, _onUpdate, ctx) {
-			if (!ctx.hasUI) {
-				return text("pkg_install requires an interactive session (the user must confirm).");
-			}
-			const ok = await ctx.ui.confirm(
-				"Install Pi package",
-				`Run: pi install ${params.source}\n\nPackages execute arbitrary code. Continue?`,
-			);
-			if (!ok) return text("Install cancelled by user.");
-			try {
-				const out = await natives.install(params.source);
-				return text(out || `Installed ${params.source}. Reload with /reload to activate.`);
-			} catch (e) {
-				return text(`install failed: ${e instanceof Error ? e.message : e}`);
-			}
+			return installPackageWithPolicy(params.source, natives, ctx);
 		},
 	});
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@danypops/pi-packed",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "Package service for the Pi agent: search/info/install/updates + /packages TUI, backed by a long-running Bun service",
   "type": "module",
   "keywords": [

package/src/cli.ts

@@ -11,6 +11,7 @@ import { checkUpdates } from "./watcher.ts";
 import { syncCatalog } from "./catalog.ts";
 import { openDb, searchLocal, catalogList, getSyncMeta, latestVersion, dbPath } from "./db.ts";
 import { NAME_RE, defaultPiBin } from "./install.ts";
+import type { InstallApproval, SecuritySettingsPort } from "./security.ts";
 
 function defaultPiBinForUnit(): string | undefined {
 	const b = defaultPiBin();
@@ -33,6 +34,7 @@ usage:
   packed catalog [--json]                      local package index (apt-cache stats)
   packed install <source> [--json]             pi install npm:|git:|https://… via daemon
   packed remove <name> [--json]                remove by bare npm name via daemon
+  packed security [always|never] [--json]       read or set install approval policy
   packed serve                                 run the long-running daemon
   packed service                               print a systemd user unit
   packed version                               print version
@@ -41,6 +43,7 @@ usage:
 export interface CliDeps {
 	reg: Registry;
 	inst: Installer;
+	security: SecuritySettingsPort;
 	stateDir: string;
 	piHome: string;
 	execPath?: string; // bun binary (defaults to process.execPath)
@@ -199,6 +202,22 @@ const commands: Record<string, { usage: string; run: Command }> = {
 		},
 	},
 
+	security: {
+		usage: "packed security [always|never] [--json]",
+		async run(_rest, d, flags, pos) {
+			const requested = pos[0];
+			if (requested !== undefined && requested !== "always" && requested !== "never") {
+				return usageErr(`usage: ${commands["security"]!.usage}\n`);
+			}
+			const settings = requested
+				? await d.security.setInstallApproval(requested as InstallApproval)
+				: await d.security.security();
+			return flags.json
+				? ok(`${JSON.stringify(settings)}\n`)
+				: ok(`install approval: ${settings.installApproval}\n`);
+		},
+	},
+
 	remove: {
 		usage: "packed remove <name> [--json]  (bare npm name, e.g. pi-lsp or @scope/pkg)",
 		async run(_rest, d, flags, pos) {
@@ -277,7 +296,7 @@ if (import.meta.main) {
 	} else {
 		const { stateDir } = await import("./state.ts");
 		const { defaultPiHome } = await import("./installed.ts");
-		const { DaemonBackedInstaller, resolveRegistry } = await import("./client.ts");
+		const { DaemonBackedSecurity, DaemonBackedInstaller, resolveRegistry } = await import("./client.ts");
 		const dir = stateDir();
 		// mirror talks to UPSTREAM, not the daemon cache — apt update semantics.
 		const reg =
@@ -287,6 +306,7 @@ if (import.meta.main) {
 		const { code, out } = await cliRun(args, {
 			reg,
 			inst: new DaemonBackedInstaller(dir),
+			security: new DaemonBackedSecurity(dir),
 			stateDir: dir,
 			piHome: defaultPiHome(),
 		});

package/src/client.ts

@@ -8,6 +8,7 @@ import { join } from "node:path";
 import type { InstalledPkg, Installer, PkgInfo, Registry, SearchPage, UpdateEntry, UpdatesSnapshot } from "./ports.ts";
 import { HttpRegistry } from "./registry.ts";
 import { DAEMON_HOST, PROBE_TIMEOUT_MS, REGISTRY_FETCH_TIMEOUT_MS, PORT_FILE, TOKEN_FILE } from "./constants.ts";
+import type { InstallApproval, SecuritySettings } from "./security.ts";
 
 export type FetchTransport = (request: Request) => Promise<Response>;
 
@@ -16,6 +17,8 @@ export interface PackageDaemonPort {
 	info(name: string): Promise<PkgInfo>;
 	installed(): Promise<InstalledPkg[]>;
 	updates(): Promise<UpdateEntry[]>;
+	security(): Promise<SecuritySettings>;
+	setInstallApproval(value: InstallApproval): Promise<SecuritySettings>;
 	install(source: string): Promise<string>;
 	remove(name: string): Promise<string>;
 }
@@ -85,6 +88,14 @@ export class PackageDaemonClient implements PackageDaemonPort {
 		return (await this.request<UpdatesSnapshot>("/updates")).updates;
 	}
 
+	security(): Promise<SecuritySettings> {
+		return this.request("/security");
+	}
+
+	setInstallApproval(installApproval: InstallApproval): Promise<SecuritySettings> {
+		return this.request("/security", { method: "POST", body: JSON.stringify({ installApproval }) });
+	}
+
 	async install(source: string): Promise<string> {
 		const result = await this.request<MutationResponse>("/install", {
 			method: "POST",
@@ -119,6 +130,16 @@ export class PackageDaemonInstaller implements Installer {
 	}
 }
 
+export class DaemonBackedSecurity {
+	constructor(private readonly stateDirectory: string) {}
+	async security(): Promise<SecuritySettings> {
+		return (await connectPackageDaemon(this.stateDirectory)).security();
+	}
+	async setInstallApproval(value: InstallApproval): Promise<SecuritySettings> {
+		return (await connectPackageDaemon(this.stateDirectory)).setInstallApproval(value);
+	}
+}
+
 export class DaemonBackedInstaller implements Installer {
 	constructor(private readonly stateDirectory: string) {}
 

package/src/constants.ts

@@ -31,7 +31,7 @@ export const IDLE_BUDGET_DEFAULT_MS = 10 * 60_000; // on-demand self-exit
 export const WATCHDOG_TICK_MS = 15_000;
 
 // --- Identity ---
-export const VERSION = "0.2.1";
+export const VERSION = "0.3.0";
 
 // --- State-dir file names ---
 export const TOKEN_FILE = "token";
@@ -39,6 +39,7 @@ export const PORT_FILE = "port";
 export const UPDATES_FILE = "updates.json";
 export const DB_FILE = "packed.db";
 export const SETTINGS_FILE = "settings.json";
+export const SECURITY_FILE = "security.json";
 
 // --- Environment knobs ---
 export const ENV = {

package/src/security.ts

@@ -0,0 +1,34 @@
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { SECURITY_FILE } from "./constants.ts";
+
+export const INSTALL_APPROVAL_VALUES = ["always", "never"] as const;
+export type InstallApproval = typeof INSTALL_APPROVAL_VALUES[number];
+export interface SecuritySettings { installApproval: InstallApproval }
+export interface SecuritySettingsPort {
+	security(): Promise<SecuritySettings>;
+	setInstallApproval(value: InstallApproval): Promise<SecuritySettings>;
+}
+
+export const DEFAULT_SECURITY_SETTINGS: SecuritySettings = { installApproval: "always" };
+
+export function readSecuritySettings(stateDir: string): SecuritySettings {
+	try {
+		const value = JSON.parse(readFileSync(join(stateDir, SECURITY_FILE), "utf8")) as { installApproval?: unknown };
+		return INSTALL_APPROVAL_VALUES.includes(value.installApproval as InstallApproval)
+			? { installApproval: value.installApproval as InstallApproval }
+			: { ...DEFAULT_SECURITY_SETTINGS };
+	} catch {
+		return { ...DEFAULT_SECURITY_SETTINGS };
+	}
+}
+
+export function writeSecuritySettings(stateDir: string, settings: SecuritySettings): SecuritySettings {
+	if (!INSTALL_APPROVAL_VALUES.includes(settings.installApproval)) throw new Error("installApproval must be always or never");
+	mkdirSync(stateDir, { recursive: true, mode: 0o700 });
+	const target = join(stateDir, SECURITY_FILE);
+	const temporary = `${target}.tmp`;
+	writeFileSync(temporary, `${JSON.stringify(settings)}\n`, { mode: 0o600 });
+	renameSync(temporary, target);
+	return { ...settings };
+}

package/src/service.ts

@@ -11,6 +11,7 @@ import { readInstalledPackages, defaultPiHome } from "./installed.ts";
 import { openDb, searchLocal, catalogList, getSyncMeta, dbPath } from "./db.ts";
 import { VERSION, SEARCH_DEFAULT_LIMIT, SEARCH_MAX_LIMIT } from "./constants.ts";
 import { createLogger } from "./log.ts";
+import { readSecuritySettings, writeSecuritySettings, type InstallApproval } from "./security.ts";
 
 const log = createLogger("service");
 
@@ -45,6 +46,23 @@ export function createApp(deps: Deps): { fetch: (req: Request) => Promise<Respon
 			return json({ ok: true, version: VERSION });
 		}
 
+		if (path === "/security" && req.method === "GET") {
+			return json(readSecuritySettings(deps.stateDir));
+		}
+
+		if (path === "/security" && req.method === "POST") {
+			let installApproval: unknown;
+			try {
+				installApproval = ((await req.json()) as { installApproval?: unknown }).installApproval;
+			} catch {
+				return err(400, "invalid security settings JSON");
+			}
+			if (installApproval !== "always" && installApproval !== "never") {
+				return err(400, "installApproval must be always or never");
+			}
+			return json(writeSecuritySettings(deps.stateDir, { installApproval: installApproval as InstallApproval }));
+		}
+
 		if (path === "/search" && req.method === "GET") {
 			const q = url.searchParams.get("q") ?? "";
 			const limit = clampLimit(Number(url.searchParams.get("limit")), SEARCH_DEFAULT_LIMIT, SEARCH_MAX_LIMIT);
@@ -143,7 +161,7 @@ export function createApp(deps: Deps): { fetch: (req: Request) => Promise<Respon
 				return err(401, "missing or invalid bearer token");
 			}
 			// Cache successful GETs by URI (smart-proxy concern).
-			if (req.method === "GET" && !["/health", "/updates", "/catalog"].includes(new URL(req.url).pathname)) {
+			if (req.method === "GET" && !["/health", "/updates", "/catalog", "/security"].includes(new URL(req.url).pathname)) {
 				const hit = cache.get(req.url);
 				if (hit) {
 					log.debug("request", { path: new URL(req.url).pathname, cache: "hit", ms: Date.now() - t0 });