@dieulc/workflow 0.9.2 → 0.11.0

package/package.json

@@ -1,15 +1,16 @@
 {
   "name": "@dieulc/workflow",
-  "version": "0.9.2",
+  "version": "0.11.0",
   "type": "module",
   "private": false,
   "keywords": ["pi-package", "workflow", "plan-mode", "review-mode", "questionnaire", "rewind"],
   "description": "Plan↔Build mode with an independent Review Mode reviewer, questionnaire, subagent explore, todos and shadow-checkpoint rewind for Pi.",
   "license": "MIT",
   "scripts": {
-    "test": "node --test utils.todo.test.ts permissions.test.ts shell-text.test.ts roles.test.ts profiles.test.ts thinking-levels.test.ts workflow-status.test.ts picker.test.ts questionnaire-layout.test.ts questionnaire-view.test.ts model-default.test.ts review.test.ts review-ui.test.ts extension.test.ts commit-policy.test.ts edit-policy.test.ts tab-policy.test.ts tab-editor.test.ts",
+    "test": "node --test utils.todo.test.ts todo-panel.test.ts permissions.test.ts shell-text.test.ts roles.test.ts profiles.test.ts provider-retarget.test.ts thinking-levels.test.ts workflow-status.test.ts picker.test.ts questionnaire-layout.test.ts questionnaire-view.test.ts model-default.test.ts review.test.ts review-handoff.test.ts review-ui.test.ts extension.test.ts commit-policy.test.ts edit-policy.test.ts tab-policy.test.ts tab-editor.test.ts folder-policy.test.ts shell-paths.test.ts read-policy.test.ts read-policy-tools.test.ts read-policy-redact.test.ts read-policy-gate.test.ts folder-floor-write.test.ts folder-floor-commit.test.ts",
     "typecheck": "tsc --noEmit -p tsconfig.json",
     "check:policy": "node --experimental-transform-types scripts/verify-write-policy.mjs",
+    "check:read-policy": "node --experimental-transform-types scripts/verify-read-policy.mjs",
     "prepublishOnly": "node ../../../scripts/verify-packages.mjs --pack-only --packages workflow"
   },
   "repository": {
@@ -29,6 +30,11 @@
     "utils.ts",
     "checkpoint.ts",
     "commit-policy.ts",
+    "folder-policy.ts",
+    "shell-paths.ts",
+    "read-policy.ts",
+    "read-policy-tools.ts",
+    "read-policy-redact.ts",
     "edit-policy.ts",
     "roles.ts",
     "profiles.ts",
@@ -37,6 +43,7 @@
     "tab-editor.ts",
     "thinking-levels.ts",
     "workflow-status.ts",
+    "todo-panel.ts",
     "questionnaire-layout.ts",
     "questionnaire-view.ts",
     "model-default.ts",
@@ -44,6 +51,9 @@
     "shell-text.ts",
     "review.ts",
     "review-providers.ts",
+    "review-recovery.ts",
+    "review-handoff.ts",
+    "provider-retarget.ts",
     "review-tools.ts",
     "review-runtime.ts",
     "review-ui.ts",
@@ -65,10 +75,10 @@
     "typebox": "*"
   },
   "devDependencies": {
-    "@earendil-works/pi-agent-core": "0.84.4",
-    "@earendil-works/pi-ai": "0.84.4",
-    "@earendil-works/pi-coding-agent": "0.84.4",
-    "@earendil-works/pi-tui": "0.84.4",
+    "@earendil-works/pi-agent-core": "1.5.0",
+    "@earendil-works/pi-ai": "1.5.0",
+    "@earendil-works/pi-coding-agent": "1.5.0",
+    "@earendil-works/pi-tui": "1.5.0",
     "typebox": "1.3.7",
     "@types/node": "^20.19.43",
     "typescript": "5.5.4"

package/provider-retarget.ts

@@ -0,0 +1,258 @@
+/**
+ * Workflow Extension — provider retarget for profiles.json / roles.json.
+ *
+ * The maintained Command Code provider registers as `commandcode`; the
+ * hand-written workaround often registers as `command-code`. Migrating a user
+ * should not mean hand-editing two JSON files and hoping every other key
+ * survives. This module rewrites only `{ provider, id }` model refs, preserves
+ * every other field, and backs up the original before writing.
+ *
+ * Pure parsing/formatting is separated from the filesystem so the tests can
+ * exercise both a dry run and an apply without touching a real profile.
+ */
+
+import * as fs from "node:fs";
+import * as path from "node:path";
+
+export type RetargetFileStatus =
+  "changed" | "would-change" | "unchanged" | "missing" | "invalid" | "blocked";
+
+export interface RetargetFileResult {
+  path: string;
+  status: RetargetFileStatus;
+  changes: number;
+  backup?: string;
+  error?: string;
+}
+
+export interface RetargetFilesResult {
+  oldProvider: string;
+  newProvider: string;
+  dryRun: boolean;
+  profiles: RetargetFileResult;
+  roles: RetargetFileResult;
+}
+
+export interface RetargetFilesInput {
+  profilesPath: string;
+  rolesPath: string;
+  oldProvider: string;
+  newProvider: string;
+  /** When true, compute only; never write. */
+  dryRun?: boolean;
+}
+
+export type RetargetDocumentResult =
+  { ok: true; text: string; changes: number } | { ok: false; error: string };
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+/**
+ * Rewrite every `{ provider: oldProvider, id: <string> }` object in a parsed
+ * profile/role document. Unknown keys and their order are preserved because the
+ * input is mutated in place and serialized with the same 2-space layout.
+ */
+function retargetValue(
+  value: unknown,
+  oldProvider: string,
+  newProvider: string,
+  counter: { changes: number },
+  depth: number,
+): void {
+  if (depth > 64) return;
+  if (Array.isArray(value)) {
+    for (const entry of value) {
+      retargetValue(entry, oldProvider, newProvider, counter, depth + 1);
+    }
+    return;
+  }
+  if (!isRecord(value)) return;
+  if (value.provider === oldProvider && typeof value.id === "string") {
+    value.provider = newProvider;
+    counter.changes += 1;
+  }
+  for (const entry of Object.values(value)) {
+    retargetValue(entry, oldProvider, newProvider, counter, depth + 1);
+  }
+}
+
+/**
+ * Retarget one JSON document. Malformed JSON or a non-object root is an error;
+ * the caller must not write in that case. A same-provider request is a no-op.
+ */
+export function retargetProviderDocument(
+  text: string,
+  oldProvider: string,
+  newProvider: string,
+): RetargetDocumentResult {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(text);
+  } catch (error) {
+    return {
+      ok: false,
+      error: `not valid JSON: ${error instanceof Error ? error.message : String(error)}`,
+    };
+  }
+  if (!isRecord(parsed)) {
+    return { ok: false, error: "the document root is not a JSON object" };
+  }
+  if (oldProvider === newProvider) {
+    return { ok: true, text, changes: 0 };
+  }
+  const counter = { changes: 0 };
+  retargetValue(parsed, oldProvider, newProvider, counter, 0);
+  if (counter.changes === 0) return { ok: true, text, changes: 0 };
+  const trailing = text.endsWith("\n") ? "\n" : "";
+  return {
+    ok: true,
+    text: `${JSON.stringify(parsed, null, 2)}${trailing}`,
+    changes: counter.changes,
+  };
+}
+
+interface FilePlan {
+  result: RetargetFileResult;
+  nextText?: string;
+}
+
+function readPlan(
+  filePath: string,
+  oldProvider: string,
+  newProvider: string,
+): FilePlan {
+  if (!fs.existsSync(filePath)) {
+    return { result: { path: filePath, status: "missing", changes: 0 } };
+  }
+  let text: string;
+  try {
+    text = fs.readFileSync(filePath, "utf8");
+  } catch (error) {
+    return {
+      result: {
+        path: filePath,
+        status: "invalid",
+        changes: 0,
+        error: error instanceof Error ? error.message : String(error),
+      },
+    };
+  }
+  const rewritten = retargetProviderDocument(text, oldProvider, newProvider);
+  if (!rewritten.ok) {
+    return {
+      result: {
+        path: filePath,
+        status: "invalid",
+        changes: 0,
+        error: rewritten.error,
+      },
+    };
+  }
+  if (rewritten.changes === 0) {
+    return { result: { path: filePath, status: "unchanged", changes: 0 } };
+  }
+  return {
+    result: {
+      path: filePath,
+      status: "would-change",
+      changes: rewritten.changes,
+    },
+    nextText: rewritten.text,
+  };
+}
+
+function applyPlan(plan: FilePlan): RetargetFileResult {
+  if (plan.result.status !== "would-change" || plan.nextText === undefined) {
+    return plan.result;
+  }
+  const filePath = plan.result.path;
+  const backup = `${filePath}.bak`;
+  const temporary = `${filePath}.${process.pid}.${Date.now()}.tmp`;
+  try {
+    fs.copyFileSync(filePath, backup);
+    fs.writeFileSync(temporary, plan.nextText, "utf8");
+    fs.renameSync(temporary, filePath);
+    return { ...plan.result, status: "changed", backup };
+  } catch (error) {
+    try {
+      fs.rmSync(temporary, { force: true });
+    } catch {
+      // Best-effort cleanup must not replace the write error.
+    }
+    return {
+      ...plan.result,
+      status: "invalid",
+      error: error instanceof Error ? error.message : String(error),
+    };
+  }
+}
+
+/**
+ * Retarget both files. Two-phase: if either document is invalid, neither file
+ * is written. A dry run never writes or creates a backup.
+ */
+export function retargetProviderFiles(
+  input: RetargetFilesInput,
+): RetargetFilesResult {
+  const oldProvider = String(input.oldProvider ?? "").trim();
+  const newProvider = String(input.newProvider ?? "").trim();
+  const dryRun = input.dryRun === true;
+  const profiles = readPlan(input.profilesPath, oldProvider, newProvider);
+  const roles = readPlan(input.rolesPath, oldProvider, newProvider);
+  const invalid =
+    profiles.result.status === "invalid" || roles.result.status === "invalid";
+  const finish = (plan: FilePlan): RetargetFileResult => {
+    if (invalid) {
+      return plan.result.status === "invalid"
+        ? plan.result
+        : plan.result.status === "would-change"
+          ? {
+              ...plan.result,
+              status: "blocked",
+              error: "not written because the other document is invalid",
+            }
+          : plan.result;
+    }
+    if (dryRun) return plan.result;
+    return applyPlan(plan);
+  };
+  return {
+    oldProvider,
+    newProvider,
+    dryRun,
+    profiles: finish(profiles),
+    roles: finish(roles),
+  };
+}
+
+function statusLabel(result: RetargetFileResult): string {
+  switch (result.status) {
+    case "changed":
+      return `changed ${result.changes} model ref(s)${result.backup ? `; backup ${path.basename(result.backup)}` : ""}`;
+    case "would-change":
+      return `would change ${result.changes} model ref(s)`;
+    case "unchanged":
+      return "no model refs to change";
+    case "missing":
+      return "not present";
+    case "invalid":
+      return `not changed — ${result.error ?? "invalid document"}`;
+    case "blocked":
+      return `not written — ${result.error ?? "blocked by another invalid file"}`;
+  }
+}
+
+/** Human-readable command result; safe for `ctx.ui.notify`. */
+export function formatRetargetResult(result: RetargetFilesResult): string {
+  const verb = result.dryRun ? "Dry run" : "Retarget";
+  return [
+    `${verb}: provider ${result.oldProvider} → ${result.newProvider}`,
+    `  profiles.json  ${statusLabel(result.profiles)}`,
+    `  roles.json     ${statusLabel(result.roles)}`,
+    ...(result.dryRun
+      ? ["Add --apply to write; each changed file keeps a .bak."]
+      : []),
+  ].join("\n");
+}

package/read-policy-redact.ts

@@ -0,0 +1,319 @@
+/**
+ * Workflow Extension — Read-policy output redaction
+ *
+ * Defence in depth for channels the tool-call gate cannot fully see:
+ *
+ *   - `grep` searches a directory with `rg --hidden`; a `.env` that is not
+ *     gitignored would otherwise be returned in matched lines.
+ *   - `find` / `ls` list sensitive names; listings omit them.
+ *   - `bash` can print `git diff`/`git show` sections or `rg`-style lines.
+ *   - Pi's truncated bash output writes the full text to a temp file and tells
+ *     the model its path; when we redact, that escape hatch is removed.
+ *   - a successful `read` of a sensitive path is replaced as a safety net.
+ *
+ * Textual redaction is best-effort (custom renderers/structured content could
+ * bypass); callers drop `structuredContent` whenever content changes.
+ */
+
+import * as fs from "node:fs";
+import * as path from "node:path";
+
+import type { FolderPolicyConfig } from "./folder-policy.ts";
+import { matchSensitivePath, toPosixPath } from "./folder-policy.ts";
+
+export interface RedactableBlock {
+  type: string;
+  text?: string;
+  [key: string]: unknown;
+}
+
+export interface RedactableToolResult {
+  toolName: string;
+  input: Record<string, unknown>;
+  content: RedactableBlock[];
+  details?: unknown;
+  structuredContent?: unknown;
+}
+
+export interface RedactedToolResult {
+  content?: RedactableBlock[];
+  details?: unknown;
+  structuredContent?: undefined;
+}
+
+export interface RedactTextResult {
+  text: string;
+  redacted: boolean;
+}
+
+function searchBase(input: Record<string, unknown>, cwd: string): string {
+  const raw = input.path;
+  if (typeof raw !== "string" || !raw.trim()) return cwd;
+  const resolved = path.resolve(cwd, raw);
+  try {
+    return fs.statSync(resolved).isDirectory() ? resolved : path.dirname(resolved);
+  } catch {
+    return resolved;
+  }
+}
+
+function isSensitive(pathValue: string, config: FolderPolicyConfig, cwd: string): boolean {
+  return matchSensitivePath(pathValue, config, cwd).sensitive;
+}
+
+function resolveOutputPath(
+  raw: string,
+  base: string,
+  cwd: string,
+): string {
+  if (path.isAbsolute(raw)) return raw;
+  const joined = path.resolve(base, raw);
+  // `grep` relativises against the search root; if the joined path does not
+  // exist, the raw path may already be cwd-relative.
+  try {
+    if (fs.existsSync(joined)) return joined;
+  } catch {
+    /* ignore */
+  }
+  return path.resolve(cwd, raw);
+}
+
+function redactGrep(
+  text: string,
+  input: Record<string, unknown>,
+  cwd: string,
+  config: FolderPolicyConfig,
+): RedactTextResult {
+  const base = searchBase(input, cwd);
+  const out: string[] = [];
+  let redacted = false;
+  for (const line of text.split("\n")) {
+    const match = /^(.+?)(?::(\d+):|-(\d+)-)(.*)$/.exec(line);
+    if (!match) {
+      out.push(line);
+      continue;
+    }
+    const rawPath = match[1];
+    if (rawPath.includes("://")) {
+      out.push(line);
+      continue;
+    }
+    const resolved = resolveOutputPath(rawPath, base, cwd);
+    if (isSensitive(resolved, config, cwd)) {
+      redacted = true;
+      continue;
+    }
+    out.push(line);
+  }
+  if (redacted && out.every((line) => !line.trim())) {
+    return {
+      text:
+        "[matches in sensitive files were withheld by read policy]",
+      redacted: true,
+    };
+  }
+  return { text: out.join("\n"), redacted };
+}
+
+function redactFind(
+  text: string,
+  input: Record<string, unknown>,
+  cwd: string,
+  config: FolderPolicyConfig,
+): RedactTextResult {
+  const base = searchBase(input, cwd);
+  const out: string[] = [];
+  let redacted = false;
+  for (const line of text.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed) {
+      out.push(line);
+      continue;
+    }
+    const resolved = resolveOutputPath(trimmed.replace(/\/$/, ""), base, cwd);
+    if (isSensitive(resolved, config, cwd)) {
+      redacted = true;
+      continue;
+    }
+    out.push(line);
+  }
+  if (redacted && out.every((line) => !line.trim())) {
+    return { text: "[entries withheld by read policy]", redacted: true };
+  }
+  return { text: out.join("\n"), redacted };
+}
+
+function redactLs(
+  text: string,
+  input: Record<string, unknown>,
+  cwd: string,
+  config: FolderPolicyConfig,
+): RedactTextResult {
+  const raw = input.path;
+  const base =
+    typeof raw === "string" && raw.trim()
+      ? path.resolve(cwd, raw)
+      : cwd;
+  const out: string[] = [];
+  let redacted = false;
+  for (const line of text.split("\n")) {
+    const entry = line.trim().replace(/\/$/, "");
+    if (!entry) {
+      out.push(line);
+      continue;
+    }
+    if (isSensitive(path.join(base, entry), config, cwd)) {
+      redacted = true;
+      continue;
+    }
+    out.push(line);
+  }
+  if (redacted && out.every((line) => !line.trim())) {
+    return { text: "[entries withheld by read policy]", redacted: true };
+  }
+  return { text: out.join("\n"), redacted };
+}
+
+function redactBash(
+  text: string,
+  cwd: string,
+  config: FolderPolicyConfig,
+): RedactTextResult {
+  const lines = text.split("\n");
+  const out: string[] = [];
+  let redacted = false;
+  let inSensitiveDiff = false;
+  for (const line of lines) {
+    const diffHeader = /^diff --git a\/(.+?) b\/(.+)$/.exec(line);
+    if (diffHeader) {
+      const targetA = resolveOutputPath(diffHeader[1], cwd, cwd);
+      const targetB = resolveOutputPath(diffHeader[2], cwd, cwd);
+      inSensitiveDiff =
+        isSensitive(targetA, config, cwd) ||
+        isSensitive(targetB, config, cwd);
+      if (inSensitiveDiff) {
+        redacted = true;
+        out.push("[diff section withheld by read policy]");
+      } else {
+        out.push(line);
+      }
+      continue;
+    }
+    if (inSensitiveDiff) {
+      redacted = true;
+      continue;
+    }
+    if (/^Full output: /.test(line)) {
+      // Remove the temp-file escape hatch only when something was redacted;
+      // the caller also drops details.fullOutputPath.
+      if (redacted) continue;
+    }
+    const prefixed = /^(.+?)(?::(\d+):|-(\d+)-)(.*)$/.exec(line);
+    if (prefixed && !prefixed[1].includes("://")) {
+      const resolved = resolveOutputPath(prefixed[1], cwd, cwd);
+      if (isSensitive(resolved, config, cwd)) {
+        redacted = true;
+        continue;
+      }
+    }
+    out.push(line);
+  }
+  if (redacted && out.every((line) => !line.trim())) {
+    return { text: "[output withheld by read policy]", redacted: true };
+  }
+  return { text: out.join("\n"), redacted };
+}
+
+/**
+ * Redact one text payload. `kind` is the tool name (grep/find/ls/bash/read).
+ */
+export function redactSensitiveText(
+  text: string,
+  kind: string,
+  input: Record<string, unknown>,
+  cwd: string,
+  config: FolderPolicyConfig,
+): RedactTextResult {
+  if (!text) return { text, redacted: false };
+  if (kind === "grep") return redactGrep(text, input, cwd, config);
+  if (kind === "find") return redactFind(text, input, cwd, config);
+  if (kind === "ls") return redactLs(text, input, cwd, config);
+  if (kind === "bash" || kind === "powershell")
+    return redactBash(text, cwd, config);
+  return { text, redacted: false };
+}
+
+function inputPath(input: Record<string, unknown>): string {
+  const raw =
+    input.path ?? input.file ?? input.filePath ?? input.file_path ?? undefined;
+  return typeof raw === "string" ? raw.trim() : "";
+}
+
+/**
+ * Redact a tool result. Returns `undefined` when nothing changed (the caller
+ * leaves the result untouched). Any change drops `structuredContent`, per the
+ * Pi tool_result contract.
+ */
+export function redactToolResult(
+  event: RedactableToolResult,
+  config: FolderPolicyConfig,
+  cwd: string,
+): RedactedToolResult | undefined {
+  const tool = String(event.toolName ?? "");
+  const readTools = new Set([
+    "read",
+    "read_symbol",
+    "read_enclosing",
+    "module_report",
+    "effective_config",
+  ]);
+  if (readTools.has(tool)) {
+    const target = inputPath(event.input);
+    if (target && isSensitive(path.resolve(cwd, target), config, cwd)) {
+      return {
+        content: [
+          {
+            type: "text",
+            text: "[blocked by read policy: sensitive file]",
+          },
+        ],
+        structuredContent: undefined,
+      };
+    }
+    return undefined;
+  }
+
+  if (!["grep", "find", "ls", "bash", "powershell"].includes(tool))
+    return undefined;
+  let changed = false;
+  const content = (event.content ?? []).map((block) => {
+    if (block?.type !== "text" || typeof block.text !== "string") return block;
+    const result = redactSensitiveText(
+      block.text,
+      tool,
+      event.input ?? {},
+      cwd,
+      config,
+    );
+    if (!result.redacted) return block;
+    changed = true;
+    return { ...block, text: result.text };
+  });
+  if (!changed) return undefined;
+
+  const result: RedactedToolResult = { content, structuredContent: undefined };
+  if (event.details && typeof event.details === "object") {
+    const details = { ...(event.details as Record<string, unknown>) };
+    if (tool === "bash" || tool === "powershell") {
+      delete details.fullOutputPath;
+      delete details.full_output_path;
+    }
+    result.details = details;
+  }
+  return result;
+}
+
+/** A short display path for refusals/diagnostics. */
+export function displayRedactPath(value: string, cwd: string): string {
+  return toPosixPath(path.relative(cwd, value) || value);
+}