@dieulc/workflow 0.11.0 → 0.11.1

package/read-policy-tools.ts

@@ -181,7 +181,9 @@ export function classifyReadCall(
   const result: ReadCallClassification = { tool, targets: [], uncertain: [] };
 
   if (tool === "bash" || tool === "powershell") {
-    const analysis = analyzeShellPaths(obj.command, cwd);
+    const analysis = analyzeShellPaths(obj.command, cwd, {
+      family: tool === "powershell" ? "powershell" : "posix",
+    });
     result.targets = analysis.reads;
     result.uncertain = analysis.uncertain;
     return result;

package/read-policy.ts

@@ -37,6 +37,7 @@ import type {
   FolderOutsideAction,
 } from "./folder-policy.ts";
 import {
+  dialogGrantRootForTarget,
   grantRootForTarget,
   outsideProjectRootForTarget,
 } from "./folder-policy.ts";
@@ -327,6 +328,8 @@ export type ReadGateDecision = "allow" | "ask" | "block";
 export interface ReadGateInput {
   /** A target matches the sensitive deny list. */
   sensitive: boolean;
+  /** A target IS an excluded folder (never askable). */
+  excluded?: boolean;
   /** A target is outside the folder roots. */
   outside: boolean;
   outsideAction: FolderOutsideAction;
@@ -339,6 +342,7 @@ export interface ReadGateInput {
 
 /**
  *   sensitive            → block (never softened by a grant)
+ *   excluded             → block (never askable)
  *   outside + block      → block
  *   outside + ask        → ask unless already granted
  *   uncertain + strict   → ask
@@ -346,6 +350,7 @@ export interface ReadGateInput {
  */
 export function decideReadGate(input: ReadGateInput): ReadGateDecision {
   if (input.sensitive) return "block";
+  if (input.excluded) return "block";
   if (input.outside) {
     if (input.outsideAction === "block") return "block";
     if (!input.granted) return "ask";
@@ -390,7 +395,10 @@ export type ReadGateChoice =
   | "deny";
 
 /** Labels for the ask dialog; the parser and the UI share this table. */
-export function readGateOptions(kind: ReadGateItemKind): readonly string[] {
+export function readGateOptions(
+  kind: ReadGateItemKind,
+  opts: { allowAlways?: boolean } = {},
+): readonly string[] {
   const always =
     kind === "folder"
       ? "Always allow this folder"
@@ -401,7 +409,7 @@ export function readGateOptions(kind: ReadGateItemKind): readonly string[] {
           : "";
   return [
     "Allow once (this turn)",
-    ...(always ? [always] : []),
+    ...(opts.allowAlways !== false && always ? [always] : []),
     "Deny",
     READ_DENY_WITH_INSTRUCTIONS_LABEL,
   ];
@@ -435,7 +443,7 @@ export function sanitizeReadInstruction(raw: unknown): string {
 }
 
 export interface ReadDenyReasonInput {
-  kind: "sensitive" | "outside" | "uncertain" | "blocked";
+  kind: "sensitive" | "excluded" | "outside" | "uncertain" | "blocked";
   target: string;
   pattern?: string;
   outsideAction?: FolderOutsideAction;
@@ -456,6 +464,13 @@ export function buildReadDenyReason(input: ReadDenyReasonInput): string {
         ". This cannot be overridden by a folder grant. Do not retry; ask the user if they want to add a manual `sensitiveExemptions` entry." +
         guidance
       );
+    case "excluded":
+      return (
+        `Read policy: \`${input.target}\` is excluded by \`workflow.folderPolicy.excludePaths\`` +
+        (input.pattern ? ` (${input.pattern})` : "") +
+        ". The excluded folder itself is off-limits and cannot be approved from a dialog. Do not retry; a specific sub-folder can still be requested (it needs the user's approval), or ask the user to revoke the rule with `/folder-policy exclude revoke`." +
+        guidance
+      );
     case "blocked":
       return (
         `Read policy: \`${input.target}\` is outside the permitted folders and the folder policy is 'block'. Do not retry. Ask the user to open the project at that folder or change /folder-policy.` +
@@ -497,15 +512,14 @@ export function readGateItemFromTarget(
   tool: string,
   target: FolderTarget,
   why: string,
+  cwd: string,
   baseRoot?: string,
 ): ReadGateItem {
-  const grantRoot =
-    (baseRoot && outsideProjectRootForTarget(target, baseRoot)) ||
-    grantRootForTarget(target);
+  const { root } = dialogGrantRootForTarget(target, baseRoot, cwd);
   return {
     tool,
     target,
-    grantRoot,
+    grantRoot: root,
     why,
     key: readGateTargetKey(target),
   };
@@ -565,12 +579,16 @@ export function readGateDetail(
 export function readGateTitle(
   items: readonly ReadGateItem[],
   base?: string,
+  opts: { grantBlockedReason?: string } = {},
 ): string {
   const detail = readGateDetail(items);
   return (
     `Read policy: allow ${describeReadGateItems(items)}?` +
     (base ? `\nOutside: ${base}` : "") +
-    (detail ? `\n${detail}` : "")
+    (detail ? `\n${detail}` : "") +
+    (opts.grantBlockedReason
+      ? `\nGrant not available: ${opts.grantBlockedReason}`
+      : "")
   );
 }
 

package/review-runtime.ts

@@ -75,6 +75,15 @@ const SETTLE_IN_FLIGHT_FALLBACK_MS = 60_000;
 export interface ReviewRuntimeDeps {
   cwd: string;
   agentDir: string;
+  /**
+   * The parent's effective folder policy (sensitive extras, `excludePaths`)
+   * and read grants, handed to the reviewer's guarded tools. Optional so
+   * existing tests and embedders keep working.
+   */
+  folderPolicy?: () => {
+    config: import("./folder-policy.ts").FolderPolicyConfig;
+    grants: readonly string[];
+  };
   config: () => ReviewModeConfig | undefined;
   /** Resolve the reviewer role's model (falls back to the planner when unset). */
   reviewerModel: () =>
@@ -822,6 +831,7 @@ export function createReviewRuntime(deps: ReviewRuntimeDeps): ReviewRuntime {
         const built = createReviewTools(sdk, {
           cwd: deps.cwd,
           log: deps.log,
+          folderPolicy: deps.folderPolicy,
           explore: {
             // Step 8: Planner recon rides along in the prompt — when it is
             // present the reviewer verifies instead of re-exploring.

package/review-tools.ts

@@ -58,6 +58,11 @@ export interface ReviewBashDeps {
     cwd: string;
     /** Surface refusals and anomalies to the parent session. */
     log: (message: string, level?: "info" | "warning" | "error") => void;
+    /** The parent's folder policy + read grants (see ReviewToolDeps). */
+    folderPolicy?: () => {
+        config: FolderPolicyConfig;
+        grants: readonly string[];
+    };
 }
 
 /** Injectable shell-tool builder so this module is testable without the SDK. */
@@ -155,18 +160,24 @@ export function createReviewBashTool(
                 };
             }
 
-            const guard = reviewerReadGuard(deps.cwd);
+            const guard = reviewerReadGuard(deps.cwd, deps.folderPolicy?.());
             const readPaths = analyzeShellPaths(command, deps.cwd).reads;
             const readEval = evaluateFolderTargets(readPaths, {
                 config: guard.config,
-                grants: [],
+                grants: guard.grants,
                 cwd: deps.cwd,
                 lockedRoots: [guard.root],
+                explicitGrants: guard.grants,
                 action: "read",
             });
-            if (readEval.sensitive.length > 0 || readEval.outside.length > 0) {
+            if (
+                readEval.sensitive.length > 0 ||
+                readEval.excluded.length > 0 ||
+                readEval.outside.length > 0
+            ) {
                 const target =
                     readEval.sensitive[0]?.path ??
+                    readEval.excluded[0]?.path ??
                     readEval.outside[0]?.path ??
                     "the requested path";
                 deps.log(
@@ -192,7 +203,14 @@ export function createReviewBashTool(
                     onUpdate,
                     ctx,
                 )) as ReviewToolTextResult;
-                return redactReviewResult(result, "bash", rawParams, deps.cwd, guard.config);
+                return redactReviewResult(
+                    result,
+                    "bash",
+                    rawParams,
+                    deps.cwd,
+                    guard.config,
+                    { base: [guard.root] },
+                );
             } catch (e: unknown) {
                 return {
                     content: [
@@ -380,6 +398,15 @@ export interface ReviewToolDeps {
     explore: ReviewExploreDeps;
     submit: ReviewSubmitDeps;
     passDone: ReviewPassDoneDeps;
+    /**
+     * The parent's effective folder policy (sensitive extras, `excludePaths`)
+     * and read grants. The reviewer is a separate session with no ambient
+     * extensions, so without this it would ignore the user's deny layer.
+     */
+    folderPolicy?: () => {
+        config: FolderPolicyConfig;
+        grants: readonly string[];
+    };
 }
 
 // ── Steps 9-11: review_submit_plan ───────────────────────────────────
@@ -499,6 +526,10 @@ export function createReviewPlanBeginTool(deps: ReviewSubmitDeps): {
             ),
         }),
         async execute(...args: unknown[]): Promise<ReviewToolTextResult> {
+            // SAFETY: Pi calls every tool `execute(toolCallId, params, …)`,
+            // so index 1 is the model-supplied params object. This tool's
+            // schema declares `totalChunks`, which is narrowed below before
+            // use — nothing else is read off the value.
             const [, rawParams] = args as unknown as [
                 string,
                 { totalChunks?: unknown },
@@ -574,6 +605,9 @@ export function createReviewPlanChunkTool(deps: ReviewSubmitDeps): {
             }),
         }),
         async execute(...args: unknown[]): Promise<ReviewToolTextResult> {
+            // SAFETY: Pi calls every tool `execute(toolCallId, params, …)`,
+            // so index 1 is the model-supplied params object. `index` and
+            // `content` are narrowed below before use.
             const [, rawParams] = args as unknown as [
                 string,
                 { index?: unknown; content?: unknown },
@@ -1057,16 +1091,22 @@ export function createReviewPassDoneTool(deps: ReviewPassDoneDeps): {
 interface ReviewerReadGuard {
     root: string;
     config: FolderPolicyConfig;
+    /** Explicit grants that can re-open an excluded subtree. */
+    grants: readonly string[];
 }
 
-function reviewerReadGuard(cwd: string): ReviewerReadGuard {
+function reviewerReadGuard(
+    cwd: string,
+    parent?: { config: FolderPolicyConfig; grants: readonly string[] },
+): ReviewerReadGuard {
     return {
         root: detectRepoRoot(cwd) ?? cwd,
         config: {
-            ...DEFAULT_FOLDER_POLICY_CONFIG,
+            ...(parent?.config ?? DEFAULT_FOLDER_POLICY_CONFIG),
             mode: "cwd",
             outside: "block",
         },
+        grants: parent?.grants ?? [],
     };
 }
 
@@ -1108,13 +1148,17 @@ function guardReviewerTarget(
     const hit = matchSensitivePath(value, guard.config, cwd);
     const evaluation = evaluateFolderTargets([target], {
         config: guard.config,
-        grants: [],
+        grants: guard.grants,
         cwd,
         lockedRoots: [guard.root],
+        explicitGrants: guard.grants,
         action: "read",
     });
     if (hit.sensitive || evaluation.sensitive.length > 0)
         return reviewerRefusal(target);
+    // The excluded folder itself, or a path inside it that no approved grant
+    // re-opens, is refused to the reviewer too.
+    if (evaluation.excluded.length > 0) return reviewerRefusal(target);
     if (evaluation.outside.length > 0) return reviewerRefusal(target);
     return undefined;
 }
@@ -1125,11 +1169,19 @@ function redactReviewResult(
     input: Record<string, unknown>,
     cwd: string,
     config: FolderPolicyConfig,
+    roots?: { base?: readonly string[]; grants?: readonly string[] },
 ): ReviewToolTextResult {
     let redacted = false;
     const content = (result.content ?? []).map((block) => {
         if (block?.type !== "text") return block;
-        const next = redactSensitiveText(block.text, tool, input, cwd, config);
+        const next = redactSensitiveText(
+            block.text,
+            tool,
+            input,
+            cwd,
+            config,
+            roots,
+        );
         if (next.redacted) redacted = true;
         return next.redacted ? { ...block, text: next.text } : block;
     });
@@ -1140,10 +1192,11 @@ function redactReviewResult(
 function createGuardedBuiltinTools(
     sdk: PiCodingAgentSdk | undefined,
     cwd: string,
+    parent?: { config: FolderPolicyConfig; grants: readonly string[] },
 ): { tools: unknown[]; unavailable: string[] } {
     const tools: unknown[] = [];
     const unavailable: string[] = [];
-    const guard = reviewerReadGuard(cwd);
+    const guard = reviewerReadGuard(cwd, parent);
     const builders: Array<[string, string, unknown]> = [
         ["read", "read", (sdk as any)?.createReadToolDefinition],
         ["grep", "grep", (sdk as any)?.createGrepToolDefinition],
@@ -1169,7 +1222,9 @@ function createGuardedBuiltinTools(
                 const result = (await definition.execute(
                     ...args,
                 )) as ReviewToolTextResult;
-                return redactReviewResult(result, tool, input, cwd, guard.config);
+                return redactReviewResult(result, tool, input, cwd, guard.config, {
+                    base: [guard.root],
+                });
             },
         });
     }
@@ -1196,7 +1251,11 @@ export function createReviewTools(
     // The reviewer session has NO ambient extensions, so its built-in
     // read/grep/find/ls are otherwise a complete bypass of the read gate.
     // Custom tools with those names override the built-ins.
-    const guarded = createGuardedBuiltinTools(sdk, deps.cwd);
+    const guarded = createGuardedBuiltinTools(
+        sdk,
+        deps.cwd,
+        deps.folderPolicy?.(),
+    );
     tools.push(...guarded.tools);
     unavailable.push(...guarded.unavailable);
 

package/shell-paths.ts

@@ -25,6 +25,14 @@ import {
   type FolderTarget,
   normalizePolicyPath,
 } from "./folder-policy.ts";
+import { translateMsysTempPath } from "./utils.ts";
+
+export type ShellPathFamily = "posix" | "powershell" | "cmd";
+
+export interface ShellPathOptions {
+  /** MSYS `/tmp` translation is a POSIX-shell concern (default: "posix"). */
+  family?: ShellPathFamily;
+}
 
 export type GitCommitHit = "add" | "commit" | "push";
 
@@ -225,6 +233,7 @@ function dedupeTargets(targets: FolderTarget[]): FolderTarget[] {
 export function analyzeShellPaths(
   command: unknown,
   cwd: string,
+  options: ShellPathOptions = {},
 ): ShellPathAnalysis {
   const analysis: ShellPathAnalysis = {
     reads: [],
@@ -234,13 +243,18 @@ export function analyzeShellPaths(
   if (typeof command !== "string" || !command.trim()) return analysis;
   const parsed = analyzeCommand(command);
   let virtualCwd = normalizePolicyPath(cwd, cwd);
+  const family = options.family ?? "posix";
+  const translate = (value: string): string =>
+    family === "posix" ? translateMsysTempPath(value, { cwd }) : value;
+  const normalizeShellPath = (value: string, base = virtualCwd): string =>
+    normalizePolicyPath(translate(value), base);
 
   // Best-effort command substitution: `echo $(cat ../x)` / backticks. Only
   // simple, non-nested bodies are parsed; the rest stays uncertain.
   for (const match of command.matchAll(/\$\(([^()]*)\)|`([^`]*)`/g)) {
     const inner = (match[1] ?? match[2] ?? "").trim();
     if (!inner) continue;
-    const nested = analyzeShellPaths(inner, virtualCwd);
+    const nested = analyzeShellPaths(inner, virtualCwd, { family });
     for (const target of nested.reads) analysis.reads.push(target);
     for (const target of nested.writes) analysis.writes.push(target);
     for (const reason of nested.uncertain) analysis.uncertain.push(reason);
@@ -248,7 +262,7 @@ export function analyzeShellPaths(
   }
 
   const addRead = (value: string, kind: FolderTarget["kind"] = "file") => {
-    const normalized = normalizePolicyPath(value, virtualCwd);
+    const normalized = normalizeShellPath(value);
     if (!normalized || normalized === "-") return;
     if (/^\d+$/.test(normalized)) return;
     if (normalized.endsWith("/dev/null") || normalized.endsWith("/dev/stdin"))
@@ -258,7 +272,7 @@ export function analyzeShellPaths(
     analysis.reads.push({ path: normalized, kind });
   };
   const addWrite = (value: string, kind: FolderTarget["kind"] = "file") => {
-    const normalized = normalizePolicyPath(value, virtualCwd);
+    const normalized = normalizeShellPath(value);
     if (!normalized || normalized === "-") return;
     if (normalized.endsWith("/dev/null")) return;
     analysis.writes.push({ path: normalized, kind });
@@ -269,6 +283,8 @@ export function analyzeShellPaths(
       analysis,
       addRead,
       addWrite,
+      family,
+      normalizePath: (value: string) => normalizeShellPath(value),
       get cwd() {
         return virtualCwd;
       },
@@ -286,6 +302,9 @@ export function analyzeShellPaths(
 interface SegmentContext {
   analysis: ShellPathAnalysis;
   cwd: string;
+  family: ShellPathFamily;
+  /** Translate + normalize one shell path against the current cwd. */
+  normalizePath: (value: string) => string;
   addRead: (value: string, kind?: FolderTarget["kind"]) => void;
   addWrite: (value: string, kind?: FolderTarget["kind"]) => void;
 }
@@ -317,7 +336,7 @@ function analyzeSegment(segment: SegmentAnalysis, ctx: SegmentContext): void {
       ctx.analysis.uncertain.push(`cd ${target}`);
       return;
     }
-    const next = normalizePolicyPath(target, ctx.cwd);
+    const next = ctx.normalizePath(target);
     if (next) ctx.cwd = next;
     return;
   }
@@ -759,7 +778,7 @@ function analyzeShell(
         ctx.analysis.uncertain.push(`${command} ${word} without a command`);
         return;
       }
-      mergeAnalysis(ctx, analyzeShellPaths(inner, ctx.cwd));
+      mergeAnalysis(ctx, analyzeShellPaths(inner, ctx.cwd, { family: ctx.family }));
       return;
     }
     if (isFlag(word)) continue;
@@ -827,7 +846,7 @@ function analyzeGit(words: string[], ctx: SegmentContext): void {
   const subcommand = (command[index] ?? "").toLowerCase();
   const args = command.slice(index + 1);
   const repoRoot = rootFlag
-    ? normalizePolicyPath(rootFlag, ctx.cwd)
+    ? ctx.normalizePath(rootFlag)
     : normalizePolicyPath(ctx.cwd, ctx.cwd);
   if (rootFlag) {
     // Git metadata and worktree are both read; the commit policy uses repoRoot.
@@ -884,7 +903,9 @@ function analyzeGit(words: string[], ctx: SegmentContext): void {
     ctx.analysis.git = {
       hit: subcommand,
       repoRoot,
-      explicitPaths: explicitPaths.map((p) => normalizePolicyPath(p, repoRoot)),
+      explicitPaths: explicitPaths.map((p) =>
+        normalizePolicyPath(ctx.normalizePath(p), repoRoot),
+      ),
       allPaths,
       amend,
       usesCwd,
@@ -953,7 +974,7 @@ function addGitRead(
   value: string,
   repoRoot: string,
 ): void {
-  const normalized = normalizePolicyPath(value, repoRoot);
+  const normalized = normalizePolicyPath(ctx.normalizePath(value), repoRoot);
   if (normalized) ctx.analysis.reads.push({ path: normalized, kind: "file" });
 }
 

package/utils.ts

@@ -5,6 +5,7 @@
  */
 
 import * as fs from "node:fs";
+import * as path from "node:path";
 import { fileURLToPath } from "node:url";
 
 import { isCommandAllowedForRole } from "./permissions.ts";
@@ -74,6 +75,103 @@ export function translateForeignPath(value: unknown): {
   return { path: raw };
 }
 
+/** Options for the Git-Bash `/tmp` translator (injectable for tests). */
+export interface MsysPathOptions {
+  env?: NodeJS.ProcessEnv;
+  platform?: NodeJS.Platform;
+  exists?: (value: string) => boolean;
+  /** Only translate when the session cwd is a native Windows path. */
+  cwd?: string;
+}
+
+/** A native Windows absolute path (drive-absolute or UNC). */
+export function isNativeWindowsPath(value: string): boolean {
+  return /^[A-Za-z]:[\\/]/.test(value) || /^\\\\/.test(value);
+}
+
+let msysTempCache: { key: string; root: string | undefined } | undefined;
+
+function msysTempCacheKey(env: NodeJS.ProcessEnv): string {
+  return [
+    env.MSYSTEM ?? "",
+    env.SHELL ?? "",
+    env.ProgramFiles ?? "",
+    env.PI_MSYS_TMP ?? "",
+    env.TMP ?? "",
+    env.TEMP ?? "",
+    env.TMPDIR ?? "",
+    env.LOCALAPPDATA ?? "",
+    env.USERPROFILE ?? "",
+  ].join("\0");
+}
+
+/**
+ * The real Windows directory behind Git-Bash's `/tmp`.
+ *
+ * Only meaningful for MSYS/Git-Bash (Pi's default Windows shell): Git for
+ * Windows is detected by `%ProgramFiles%\Git\bin\bash.exe`, `MSYSTEM`, or a
+ * bash `SHELL`. Candidates are tried in order and the first existing one
+ * wins. Injected `env`/`exists` options bypass the cache (tests); no
+ * `cygpath` subprocess.
+ */
+export function resolveMsysTempRoot(
+  opts: MsysPathOptions = {},
+): string | undefined {
+  const platform = opts.platform ?? process.platform;
+  if (platform !== "win32") return undefined;
+  const env = opts.env ?? process.env;
+  const exists = opts.exists ?? fs.existsSync;
+  const injected =
+    opts.env !== undefined ||
+    opts.exists !== undefined ||
+    opts.platform !== undefined;
+  const key = msysTempCacheKey(env);
+  if (!injected && msysTempCache?.key === key) return msysTempCache.root;
+  const enabled =
+    Boolean(env.PI_MSYS_TMP) ||
+    Boolean(env.MSYSTEM) ||
+    /bash(?:\.exe)?$/i.test(env.SHELL ?? "") ||
+    Boolean(
+      env.ProgramFiles &&
+        exists(path.join(env.ProgramFiles, "Git", "bin", "bash.exe")),
+    );
+  if (!enabled) {
+    if (!injected) msysTempCache = { key, root: undefined };
+    return undefined;
+  }
+  const candidates: string[] = [];
+  if (env.PI_MSYS_TMP && isNativeWindowsPath(env.PI_MSYS_TMP))
+    candidates.push(env.PI_MSYS_TMP);
+  for (const value of [env.TMP, env.TEMP, env.TMPDIR]) {
+    if (value && isNativeWindowsPath(value)) candidates.push(value);
+  }
+  if (env.LOCALAPPDATA)
+    candidates.push(path.join(env.LOCALAPPDATA, "Temp"));
+  if (env.USERPROFILE)
+    candidates.push(path.join(env.USERPROFILE, "AppData", "Local", "Temp"));
+  const root = candidates.find((candidate) => exists(candidate));
+  if (!injected) msysTempCache = { key, root };
+  return root;
+}
+
+/**
+ * Translate the literal `/tmp` prefix (and only that) to the real Windows
+ * temp directory for a POSIX shell. Direct tool paths keep Node semantics
+ * (`/tmp` really is `C:/tmp` there), so callers opt in.
+ */
+export function translateMsysTempPath(
+  value: string,
+  opts: MsysPathOptions = {},
+): string {
+  if (!value) return value;
+  const platform = opts.platform ?? process.platform;
+  if (platform !== "win32") return value;
+  if (!/^\/tmp(?=\/|$)/.test(value)) return value;
+  if (opts.cwd && !isNativeWindowsPath(opts.cwd)) return value;
+  const root = resolveMsysTempRoot(opts);
+  return root ? `${root}${value.slice(4)}` : value;
+}
+
 /**
  * Backward-compatible alias for Plan Mode's command policy (read-only plus
  * test/lint/typecheck). New code should call