@dieulc/workflow 0.5.1 → 0.6.0

package/permissions.ts

@@ -424,8 +424,14 @@ const DESTRUCTIVE_PATTERNS: RegExp[] = [
   /(^|\s)(sh|bash|dash|zsh|fish|ksh|csh|tcsh|pwsh|powershell|cmd|cscript|wscript|perl|ruby)(\.exe)?(\s|$)/i,
 ];
 
-/** Writing/formatting flags that must never reach a verify-class command. */
-const DENIED_FLAG_RE =
+/**
+ * Writing/formatting flags that must never reach a verify-class command.
+ *
+ * Exported for the write policy's command classification (edit-policy.ts):
+ * a verify-class command that carries one of these still rewrites files
+ * (`eslint --fix`), so the write gate must treat it as a write.
+ */
+export const DENIED_FLAG_RE =
   /(^|\s)(--fix|--fix-dry-run|--write|--update|--update-snapshots?|--updateSnapshot|--test-update-snapshots|--watch|--watchAll|--inspect|--inspect-brk|--in-place|--output)(\s|$|=)/i;
 
 /**
@@ -547,6 +553,22 @@ function packageScriptArg(segment: string): string | undefined {
 const NULL_DEVICE_REDIRECT_RE =
   /(^|[\s;&|()])(?:[12]|&)?>>?\s*\/dev\/null(?=$|[\s;&|)])/g;
 
+/**
+ * Strip harmless redirection tokens from a command: fd duplications
+ * (`2>&1` / `1>&2`) and null-device targets (`> /dev/null`). Neither writes
+ * a file the user can see, so both are removed before the command is
+ * classified by its first word — otherwise `2>/dev/null ls` would look like
+ * an unknown binary and be treated as a write.
+ *
+ * Exported for the write policy's command classification (edit-policy.ts).
+ */
+export function stripHarmlessRedirects(command: unknown): string {
+  const raw = typeof command === "string" ? command : "";
+  return raw
+    .replace(/\d*>&\d+/g, " ")
+    .replace(NULL_DEVICE_REDIRECT_RE, "$1");
+}
+
 /**
  * Why a command's syntax cannot be classified (`null` = the syntax is fine).
  * Mirrors the order the gate has always used, so a refusal can name the first
@@ -556,9 +578,7 @@ export function forbiddenSyntaxReason(command: unknown): string | null {
   const raw = typeof command === "string" ? command : "";
   // `2>&1` / `1>&2` are fd duplications, not file writes; `/dev/null` targets
   // are a bit bucket, not a file.
-  const scrubbed = raw
-    .replace(/\d*>&\d+/g, " ")
-    .replace(NULL_DEVICE_REDIRECT_RE, "$1");
+  const scrubbed = stripHarmlessRedirects(raw);
   if (scrubbed.replace(/&&/g, " ").includes("&"))
     return "a background `&` (only `&&` chains are allowed)";
   if (raw.includes("$(")) return "command substitution `$(...)`";

package/profiles.ts

@@ -40,6 +40,8 @@ import {
   roleIcon,
 } from "./roles.ts";
 import { COMMIT_CONFIG_DIR, WORKFLOW_SETTINGS_KEY } from "./commit-policy.ts";
+import type { ArgumentCompletion } from "./utils.ts";
+import { joinArgumentValue, suppressExactArgumentMatch } from "./utils.ts";
 
 // ── Types ────────────────────────────────────────────────────────────
 
@@ -66,7 +68,7 @@ export const PROFILE_CONFIG_VERSION = 1;
 export const MAX_PROFILE_NAME_LENGTH = 40;
 
 /** Reserved words — they collide with `/profile use <name|none>` and `/role use` style keywords. */
-export const RESERVED_PROFILE_NAMES: readonly string[] = ["none", "auto"];
+export const RESERVED_PROFILE_NAMES: readonly string[] = ["none", "auto", "off"];
 
 /** Fallback thinking level when a sanitized model omits an invalid one. */
 const DEFAULT_THINKING: ThinkingLevel = "medium";
@@ -615,3 +617,208 @@ export function writeDefaultProfileSetting(
     };
   }
 }
+
+// ── Argument completions (/profile) ──────────────────────────────────
+
+/** Subcommands that take a profile-name argument (position 2). */
+const PROFILE_NAME_SUBS: ReadonlySet<string> = new Set([
+  "use",
+  "edit",
+  "show",
+  "delete",
+  "default",
+  "rename",
+]);
+
+/** Aliases the /profile handler accepts, mapped to their canonical subcommand. */
+const PROFILE_CMD_ALIASES: Readonly<Record<string, string>> = {
+  activate: "use",
+  config: "edit",
+  remove: "delete",
+  rm: "delete",
+  mv: "rename",
+  new: "create",
+  add: "create",
+};
+
+/** Write-scope descriptions for `/profile default <name> <scope>` completions. */
+const SCOPE_DESCRIPTIONS: Readonly<Record<string, string>> = {
+  global: "write to ~/.pi/agent/settings.json",
+  project: "write to <cwd>/.pi/settings.json",
+};
+
+interface ProfileSubMeta {
+  name: string;
+  /** Takes an argument → completion `value` carries a trailing space. */
+  takesArg: boolean;
+  label: string;
+  description: string;
+}
+
+const PROFILE_SUBS: readonly ProfileSubMeta[] = [
+  {
+    name: "list",
+    takesArg: false,
+    label: "list",
+    description: "show all profiles",
+  },
+  {
+    name: "use",
+    takesArg: true,
+    label: "use <name|none>",
+    description: "activate/deactivate for this session",
+  },
+  {
+    name: "create",
+    takesArg: true,
+    label: "create <name>",
+    description: "create a profile (seeded from current models)",
+  },
+  {
+    name: "edit",
+    takesArg: true,
+    label: "edit <name>",
+    description: "open the tabbed model editor",
+  },
+  {
+    name: "rename",
+    takesArg: true,
+    label: "rename <old> <new>",
+    description: "rename a profile",
+  },
+  {
+    name: "delete",
+    takesArg: true,
+    label: "delete <name>",
+    description: "delete a profile",
+  },
+  {
+    name: "default",
+    takesArg: true,
+    label: "default [name|none] [global|project]",
+    description: "default profile for new sessions",
+  },
+  {
+    name: "show",
+    takesArg: true,
+    label: "show <name>",
+    description: "show one profile's models",
+  },
+];
+
+/** Profile names matching a lowercased partial token, case-insensitively. */
+function profileNameMatches(
+  profiles: readonly Profile[],
+  partial: string,
+): Profile[] {
+  if (!partial) return [...profiles];
+  return profiles.filter((p) =>
+    p.name.toLowerCase().startsWith(partial.toLowerCase()),
+  );
+}
+
+function profileCompletions(
+  profiles: readonly Profile[],
+  join: (token: string) => string,
+): ArgumentCompletion[] {
+  return profiles.map((p) => ({
+    value: join(p.name),
+    label: p.name,
+    ...(p.description ? { description: p.description } : {}),
+  }));
+}
+
+/**
+ * Argument completions for `/profile` (pure; unit-tested in profiles.test.ts).
+ *
+ * `argumentPrefix` is the ENTIRE typed argument text after "/profile " (what
+ * pi's CombinedAutocompleteProvider passes). Per the pi-tui contract, every
+ * returned item's `value` is the complete replacement for that argument text
+ * (`joinArgumentValue`), never a bare token — accepting `"use Syn-De" →
+ * "Syn-…"` would otherwise drop the `use` subcommand (see the /mcp
+ * extension for the reference implementation).
+ *
+ * Returns null when there is nothing useful to offer (unknown subcommand,
+ * `rename <old> <new>` second arg, `create`, …) or when the typed token is
+ * already an exact, unique match (exact-match suppression → the dropdown
+ * closes and the first Enter submits the command).
+ */
+export function profileArgumentCompletions(
+  argumentPrefix: string,
+  profiles: readonly Profile[],
+): ArgumentCompletion[] | null {
+  const raw = String(argumentPrefix ?? "");
+  const join = (token: string) => joinArgumentValue(raw, token);
+
+  // ── Subcommand position: no whitespace typed yet ────────────────────
+  if (!raw.trim() || !/\s/.test(raw)) {
+    const lower = raw.trim().toLowerCase();
+    const matching = PROFILE_SUBS.filter((s) =>
+      s.name.startsWith(lower),
+    );
+    if (matching.length > 0) {
+      return matching.map((s) => ({
+        value: s.takesArg ? `${s.name} ` : s.name,
+        label: s.label,
+        description: s.description,
+      }));
+    }
+    // Bare profile name → `/profile <name>` shows detail (mirrors /role).
+    const names = profileNameMatches(profiles, lower);
+    if (names.length === 0) return null;
+    return profileCompletions(names, join);
+  }
+
+  // ── Argument position ────────────────────────────────────────────────
+  const tokens = raw.trim().split(/\s+/).filter(Boolean);
+  const head = tokens[0] ?? "";
+  const canonical = PROFILE_CMD_ALIASES[head.toLowerCase()] ?? head.toLowerCase();
+  const endsWithWs = /\s$/.test(raw);
+  const committedCount = endsWithWs ? tokens.length : tokens.length - 1;
+  const partial = endsWithWs ? "" : (tokens[tokens.length - 1] ?? "");
+
+  let items: ArgumentCompletion[] | null = null;
+
+  if (canonical === "default") {
+    if (committedCount <= 1) {
+      // Second token: profile name | none.
+      const names = profileNameMatches(profiles, partial);
+      const none: ArgumentCompletion[] =
+        "none".startsWith(partial.toLowerCase())
+          ? [{ value: join("none"), label: "none", description: "no profile" }]
+          : [];
+      items = [...profileCompletions(names, join), ...none];
+    } else {
+      // Third token: scope.
+      items = ["global", "project"].flatMap((s) =>
+        s.startsWith(partial.toLowerCase())
+          ? [
+              {
+                value: join(s),
+                label: s,
+                description: SCOPE_DESCRIPTIONS[s],
+              },
+            ]
+          : [],
+      );
+    }
+  } else if (canonical === "rename") {
+    // First arg: existing name; second arg (new name) is free text.
+    if (committedCount <= 1) {
+      items = profileCompletions(profileNameMatches(profiles, partial), join);
+    }
+  } else if (PROFILE_NAME_SUBS.has(canonical)) {
+    const names = profileNameMatches(profiles, partial);
+    const none: ArgumentCompletion[] =
+      canonical === "use" && "none".startsWith(partial.toLowerCase())
+        ? [{ value: join("none"), label: "none", description: "no profile" }]
+        : [];
+    items = [...profileCompletions(names, join), ...none];
+  }
+  // create|new|add (new name is free text), list, unknown → items stays null.
+
+  if (!items || items.length === 0) return null;
+  const candidateTokens = items.map((i) => i.label);
+  if (suppressExactArgumentMatch(candidateTokens, partial)) return null;
+  return items;
+}

package/roles.ts

@@ -13,6 +13,11 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { CONFIG_DIR_NAME, getAgentDir } from "@earendil-works/pi-coding-agent";
+import type { ArgumentCompletion } from "./utils.ts";
+import {
+  joinArgumentValue,
+  suppressExactArgumentMatch,
+} from "./utils.ts";
 
 // ── Types ────────────────────────────────────────────────────────────
 
@@ -430,3 +435,140 @@ export function formatRolesForDisplay(config: RoleConfig): string {
   );
   return lines.join("\n");
 }
+
+// ── Argument completions (/role) ─────────────────────────────────────
+
+interface RoleSubMeta {
+  name: string;
+  /** Takes an argument → completion `value` carries a trailing space. */
+  takesArg: boolean;
+  label: string;
+  description: string;
+}
+
+const ROLE_SUBS: readonly RoleSubMeta[] = [
+  { name: "list", takesArg: false, label: "list", description: "show all roles" },
+  {
+    name: "show",
+    takesArg: false,
+    label: "show",
+    description: "show all roles (alias of list)",
+  },
+  {
+    name: "config",
+    takesArg: true,
+    label: "config",
+    description: "open the role config screen (picker)",
+  },
+  {
+    name: "set",
+    takesArg: true,
+    label: "set <role> <provider/model> [thinking]",
+    description: "configure one role's model",
+  },
+  {
+    name: "add",
+    takesArg: true,
+    label: "add <name> [provider/model] [thinking]",
+    description: "add a custom role",
+  },
+  {
+    name: "remove",
+    takesArg: true,
+    label: "remove <name>",
+    description: "remove a custom role",
+  },
+  {
+    name: "reset",
+    takesArg: false,
+    label: "reset",
+    description: "reset roles to defaults",
+  },
+  {
+    name: "use",
+    takesArg: true,
+    label: "use <role|auto>",
+    description: "activate one role for the whole workflow",
+  },
+];
+
+/**
+ * Argument completions for `/role` (pure; unit-tested in roles.test.ts).
+ *
+ * Follows the pi-tui full-argument contract (see `joinArgumentValue` and the
+ * /mcp extension): every returned `value` is the complete replacement for the
+ * typed argument text — `set planner opencode-go/muse-…`, never a bare token.
+ * Positional rules mirror the /role handler:
+ *   - `set` arg1 = existing role names, arg2 = model refs (`provider/id`,
+ *     null when `opts.models` is empty), arg3 = thinking levels;
+ *   - `use` = role names + `auto`;
+ *   - `remove` = role names;
+ *   - `add` arg1 is a NEW name → no completions.
+ * Returns null when nothing useful can be offered, including when the typed
+ * token is already an exact unique match (exact-match suppression — the
+ * dropdown closes so the first Enter submits).
+ */
+export function roleArgumentCompletions(
+  argumentPrefix: string,
+  opts: { roleNames: readonly string[]; models?: readonly string[] },
+): ArgumentCompletion[] | null {
+  const raw = String(argumentPrefix ?? "");
+  const join = (token: string) => joinArgumentValue(raw, token);
+
+  // ── Subcommand position: no whitespace typed yet ────────────────────
+  if (!raw.trim() || !/\s/.test(raw)) {
+    const lower = raw.trim().toLowerCase();
+    const matching = ROLE_SUBS.filter((s) => s.name.startsWith(lower));
+    if (matching.length === 0) return null;
+    return matching.map((s) => ({
+      value: s.takesArg ? `${s.name} ` : s.name,
+      label: s.label,
+      description: s.description,
+    }));
+  }
+
+  // ── Argument position ────────────────────────────────────────────────
+  const tokens = raw.trim().split(/\s+/).filter(Boolean);
+  const cmd = (tokens[0] ?? "").toLowerCase();
+  const endsWithWs = /\s$/.test(raw);
+  const committedCount = endsWithWs ? tokens.length : tokens.length - 1;
+  const partial = endsWithWs ? "" : (tokens[tokens.length - 1] ?? "");
+  const matchToken = (t: string) => t.toLowerCase().startsWith(partial.toLowerCase());
+
+  const roleNameItems = (): ArgumentCompletion[] =>
+    opts.roleNames.flatMap((n) =>
+      matchToken(n) ? [{ value: join(n), label: n }] : [],
+    );
+
+  let items: ArgumentCompletion[] | null = null;
+
+  if (cmd === "set") {
+    if (committedCount <= 1) {
+      items = roleNameItems();
+    } else if (committedCount === 2) {
+      items = (opts.models ?? []).flatMap((m) =>
+        matchToken(m) ? [{ value: join(m), label: m }] : [],
+      );
+    } else {
+      items = VALID_THINKING_LEVELS.flatMap((t) =>
+        matchToken(t) ? [{ value: join(t), label: t }] : [],
+      );
+    }
+  } else if (cmd === "use") {
+    items = [
+      ...roleNameItems(),
+      ...("auto".startsWith(partial.toLowerCase())
+        ? [{ value: join("auto"), label: "auto" }]
+        : []),
+    ];
+  } else if (cmd === "remove") {
+    items = roleNameItems();
+  }
+  // add (new name is free text), config, list/show, reset, unknown → null.
+
+  if (!items || items.length === 0) return null;
+  if (suppressExactArgumentMatch(items.map((i) => i.label), partial)) {
+    return null;
+  }
+  return items;
+}

package/utils.ts

@@ -1583,3 +1583,63 @@ export function renderReviewContextBlock(
   }
   return out;
 }
+
+// ── Slash-command argument completions (pi-tui contract) ─────────────
+//
+// `CombinedAutocompleteProvider.getSuggestions` (pi-tui dist/autocomplete.js)
+// passes `getArgumentCompletions(argumentText)` the ENTIRE typed argument
+// text after the command name and, on accept, `applyCompletion` replaces
+// that whole argument text with `item.value` (the slash-argument branch:
+// `newLine = beforePrefix + item.value`). So an argument-position item's
+// `value` must be the complete replacement — e.g. `"use <name>"`, never the
+// bare token. Pi's own /mcp extension follows this contract
+// (`value: `${action} ${name}``). `joinArgumentValue` is the single helper
+// that enforces it: it keeps every committed token and appends (or replaces
+// the last partial token with) `token`.
+
+/** One slash-command argument completion item (pi-tui `AutocompleteItem` shape). */
+export interface ArgumentCompletion {
+  value: string;
+  label: string;
+  description?: string;
+}
+
+/**
+ * Build the full-argument replacement `value` for a completion token.
+ *
+ * `prefix` is the typed argument text so far. Tokens separated by whitespace
+ * are "committed"; if `prefix` ends with whitespace the user is starting a
+ * fresh token, so `token` is appended — otherwise it replaces the trailing
+ * partial token. Pure; never throws.
+ *
+ *   joinArgumentValue("use Syn-De", "Syn-Deepseek-v4.1-Flash-Planner")
+ *     → "use Syn-Deepseek-v4.1-Flash-Planner"
+ *   joinArgumentValue("use ", "none") → "use none"
+ *   joinArgumentValue("", "list")     → "list"
+ */
+export function joinArgumentValue(prefix: string, token: string): string {
+  const raw = String(prefix ?? "");
+  const endsWithWs = /\s$/.test(raw);
+  const parts = raw.trim().split(/\s+/).filter(Boolean);
+  const committed = endsWithWs ? parts : parts.slice(0, -1);
+  return [...committed, token].join(" ");
+}
+
+/**
+ * Exact-match suppression for slash-command argument completions: when the
+ * token being typed (`partial`, "" while the prefix ends with whitespace)
+ * already equals the ONLY remaining candidate, return true so the completer
+ * yields null — pi's editor then closes the dropdown and the FIRST Enter
+ * submits instead of being consumed by the completion-accept handler
+ * (editor.js `tui.select.confirm`). Pure.
+ */
+export function suppressExactArgumentMatch(
+  candidates: readonly string[],
+  partial: string,
+): boolean {
+  if (!partial) return false;
+  return (
+    candidates.length === 1 &&
+    candidates[0].toLowerCase() === partial.toLowerCase()
+  );
+}