@erichll/pi-auto-review 0.1.1 → 0.1.2

package/README.md

@@ -20,14 +20,24 @@ The broker applies the following order:
 
 1. Deterministic hard denies
 2. Model review
-3. Human terminal when the model returns `defer` or `failureMode` is `defer`
+3. Local terminal when the authorizer chain requires one
 4. Exact, expiring, one-use grants for external sandbox adapters
 
 Model approval cannot override `pi-permission-system`'s bounded-delegation
 checkpoint. In version 24, an authorizer's `allow` on `path` or
-`external_directory` is still downgraded to `defer` and reaches the human
-terminal. Sandbox adapters should use concrete surfaces such as
-`filesystem-read`, `filesystem-write`, and `network`.
+`external_directory` is still downgraded to `defer`. In an interactive v24 TUI,
+`autoConfirmBoundedAllows` can bind that exact model allow to the immediately
+following local permission dialog and complete it as `auto_approved`. The
+default enables this bridge only for `external_directory`; `path`, non-TUI
+modes, UI mismatches, and reviewer defers still reach the human terminal.
+Sandbox adapters should use concrete surfaces such as `filesystem-read`,
+`filesystem-write`, and `network`.
+
+The TUI bridge is request-ID-bound, expires after ten seconds, is consumed
+once, and recognizes the v24 inline permission component before completing it.
+Any event ordering, request, mode, component, or shared-UI wrapper mismatch
+fails closed to the original dialog. This is a compatibility bridge around the
+v24 delegation envelope, not permission-system authority-chain API.
 
 The broker stops automatic review for a turn after three consecutive denials
 or ten denials in the rolling last fifty reviews. An explicit denial is
@@ -67,13 +77,17 @@ Edit `src/config.json`, using `config/config.example.json` as the reference:
   "maxToolTranscriptTokens": 1200,
   "maxRelevantResultTokens": 800,
   "failureMode": "deny",
-  "grantTtlMs": 60000
+  "grantTtlMs": 60000,
+  "autoConfirmBoundedAllows": ["external_directory"]
 }
 ```
 
 The configured provider must be registered in Pi and must support the
 configured model. `failureMode: "deny"` is the fail-closed default;
 `failureMode: "defer"` falls through to the normal human terminal.
+Set `autoConfirmBoundedAllows` to `[]` to keep every bounded allow manual, or
+include `"path"` as well to opt into the same TUI bridge for the cross-cutting
+path surface.
 
 Add the link to the permission-system configuration:
 
@@ -189,9 +203,10 @@ PI_AUTO_REVIEW_ALLOW_UNTRUSTED_DEV=1 pi --approve
 The trusted package configuration is copied and frozen at `session_start`.
 An optional workspace file at `.pi/pi-auto-review.json` may only lower
 timeouts, token/evidence limits, retries, and grant TTL, or set `failureMode`
-to `deny`. It cannot select a model, weaken fail-closed behavior, or raise a
-trusted limit. Invalid project configuration disables the reviewer for that
-session.
+to `deny`. It may remove entries from `autoConfirmBoundedAllows`, but cannot
+add a surface not enabled by the trusted package configuration. It cannot
+select a model, weaken fail-closed behavior, or raise a trusted limit. Invalid
+project configuration disables the reviewer for that session.
 
 Writes to the installed reviewer package, project security configuration,
 global Pi security configuration, and the global audit directory are

package/config/config.example.json

@@ -8,5 +8,6 @@
   "maxToolTranscriptTokens": 1200,
   "maxRelevantResultTokens": 800,
   "failureMode": "deny",
-  "grantTtlMs": 60000
+  "grantTtlMs": 60000,
+  "autoConfirmBoundedAllows": ["external_directory"]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@erichll/pi-auto-review",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Model-backed boundary approval broker for Pi",
   "type": "module",
   "license": "MIT",

package/src/config.json

@@ -8,5 +8,6 @@
   "maxToolTranscriptTokens": 1200,
   "maxRelevantResultTokens": 800,
   "failureMode": "deny",
-  "grantTtlMs": 60000
+  "grantTtlMs": 60000,
+  "autoConfirmBoundedAllows": ["external_directory"]
 }

package/src/index.ts

@@ -33,6 +33,7 @@ import {
   type BoundaryReview,
   type BoundaryReviewerContext,
 } from "./broker/index.ts";
+import { PermissionUiAutoConfirmer } from "./ui-auto-confirm.ts";
 
 export { parseDecision } from "./policy.ts";
 export * from "./broker/index.ts";
@@ -53,6 +54,8 @@ type ReasoningLevel =
   | "xhigh"
   | "max";
 
+type BoundedSurface = "external_directory" | "path";
+
 export type Config = {
   model: string;
   reasoning: ReasoningLevel;
@@ -64,6 +67,7 @@ export type Config = {
   maxRelevantResultTokens: number;
   failureMode: "deny" | "defer";
   grantTtlMs: number;
+  autoConfirmBoundedAllows: readonly BoundedSurface[];
 };
 
 type CompletionMessage = {
@@ -109,6 +113,7 @@ const DEFAULT_CONFIG: Config = {
   maxRelevantResultTokens: 800,
   failureMode: "deny",
   grantTtlMs: 60_000,
+  autoConfirmBoundedAllows: Object.freeze(["external_directory"]),
 };
 
 const REVIEWER_SYSTEM_PROMPT = `You are a fail-closed permission reviewer.
@@ -163,6 +168,7 @@ function validateConfig(value: unknown, source: string): Config {
     "maxRelevantResultTokens",
     "failureMode",
     "grantTtlMs",
+    "autoConfirmBoundedAllows",
   ]);
   const unknownKeys = Object.keys(raw).filter((key) => !allowedKeys.has(key));
   if (unknownKeys.length > 0) {
@@ -212,6 +218,18 @@ function validateConfig(value: unknown, source: string): Config {
   ) {
     throw new Error(`${EXTENSION_NAME}: grantTtlMs must be 1000..300000`);
   }
+  if (
+    !Array.isArray(config.autoConfirmBoundedAllows) ||
+    config.autoConfirmBoundedAllows.some(
+      (surface) => !BOUNDED_SURFACES.has(surface),
+    ) ||
+    new Set(config.autoConfirmBoundedAllows).size !==
+      config.autoConfirmBoundedAllows.length
+  ) {
+    throw new Error(
+      `${EXTENSION_NAME}: autoConfirmBoundedAllows must contain unique external_directory/path entries`,
+    );
+  }
   for (const [name, entry] of [
     ["maxUserTranscriptTokens", config.maxUserTranscriptTokens],
     ["maxToolTranscriptTokens", config.maxToolTranscriptTokens],
@@ -221,7 +239,12 @@ function validateConfig(value: unknown, source: string): Config {
       throw new Error(`${EXTENSION_NAME}: ${name} must be 32..8000`);
     }
   }
-  return config;
+  return {
+    ...config,
+    autoConfirmBoundedAllows: Object.freeze([
+      ...config.autoConfirmBoundedAllows,
+    ]),
+  };
 }
 
 export function loadConfig(): Config {
@@ -260,6 +283,7 @@ export function applyProjectConfig(
   const allowed = new Set<string>([
     ...TIGHTENABLE_NUMBER_KEYS,
     "failureMode",
+    "autoConfirmBoundedAllows",
   ]);
   const forbidden = Object.keys(raw).filter((key) => !allowed.has(key));
   if (forbidden.length > 0) {
@@ -289,6 +313,25 @@ export function applyProjectConfig(
     }
     merged.failureMode = "deny";
   }
+  if (raw.autoConfirmBoundedAllows !== undefined) {
+    if (
+      !Array.isArray(raw.autoConfirmBoundedAllows) ||
+      raw.autoConfirmBoundedAllows.some(
+        (surface) =>
+          typeof surface !== "string" ||
+          !trusted.autoConfirmBoundedAllows.includes(
+            surface as BoundedSurface,
+          ),
+      )
+    ) {
+      throw new Error(
+        `${EXTENSION_NAME}: project autoConfirmBoundedAllows may only remove trusted surfaces`,
+      );
+    }
+    merged.autoConfirmBoundedAllows = [
+      ...new Set(raw.autoConfirmBoundedAllows as BoundedSurface[]),
+    ];
+  }
   return Object.freeze(validateConfig(merged, "effective project config"));
 }
 
@@ -376,6 +419,12 @@ function sessionConfig(
 }
 
 function surfaceOf(details: PromptPermissionDetails): string {
+  if (
+    typeof details.accessIntent?.surface === "string" &&
+    details.accessIntent.surface
+  ) {
+    return details.accessIntent.surface;
+  }
   if (typeof details.surface === "string" && details.surface) {
     return details.surface;
   }
@@ -721,6 +770,9 @@ export function createPiAutoReviewExtension(
   let disposeBrokerService: (() => void) | undefined;
   const reviewResults = new Map<string, ReviewResult>();
   let broker: BoundaryApprovalBroker | undefined;
+  const uiAutoConfirmer = new PermissionUiAutoConfirmer(
+    () => config.autoConfirmBoundedAllows,
+  );
 
   const createBroker = (): BoundaryApprovalBroker =>
     new BoundaryApprovalBroker({
@@ -831,6 +883,7 @@ export function createPiAutoReviewExtension(
     disposeBrokerService?.();
     broker?.clear();
     reviewResults.clear();
+    uiAutoConfirmer.clear();
     try {
       config = sessionConfig(
         ctx.cwd,
@@ -852,6 +905,10 @@ export function createPiAutoReviewExtension(
     }
   });
 
+  pi.events.on("permissions:ui_prompt", (event) => {
+    if (context) uiAutoConfirmer.handlePrompt(event, context);
+  });
+
   pi.events.on("permissions:ready", () => {
     try {
       const service = permissionsService();
@@ -880,6 +937,11 @@ export function createPiAutoReviewExtension(
           const result = reviewResults.get(request.id);
           reviewResults.delete(request.id);
           const allowCapped = decision.kind === "allow" && boundedRequest(details);
+          const autoConfirmQueued =
+            allowCapped &&
+            context.mode === "tui" &&
+            context.hasUI &&
+            uiAutoConfirmer.stage(request.id, surface);
           log.review("pi_auto_review_decision", {
             requestId: request.id,
             surface,
@@ -890,6 +952,7 @@ export function createPiAutoReviewExtension(
             userAuthorization: decision.review.userAuthorization,
             rationale: decision.review.rationale,
             allowCapped,
+            autoConfirmQueued,
             circuitBreakerTripped:
               decision.kind === "deny"
                 ? decision.circuitBreakerTripped
@@ -931,6 +994,7 @@ export function createPiAutoReviewExtension(
     broker?.clear();
     broker = undefined;
     reviewResults.clear();
+    uiAutoConfirmer.clear();
     context = undefined;
   });
   };

package/src/ui-auto-confirm.ts

@@ -0,0 +1,323 @@
+import type {
+  ExtensionContext,
+  ExtensionUIContext,
+} from "@earendil-works/pi-coding-agent";
+
+type UiCustom = ExtensionUIContext["custom"];
+
+type PermissionUiPromptEvent = {
+  requestId: string;
+  message: string;
+};
+
+type PendingApproval = {
+  surface: string;
+  expiresAt: number;
+};
+
+type PromptAttempt = {
+  controller: AbortController;
+  settled: boolean;
+  recognized: boolean;
+  autoApprove?: () => void;
+  denyForUiConflict?: () => void;
+  restore?: () => void;
+};
+
+const AUTO_APPROVED_DECISION = {
+  approved: true,
+  state: "approved",
+  autoApproved: true,
+} as const;
+
+const UI_CONFLICT_DENIED_DECISION = {
+  approved: false,
+  state: "denied",
+} as const;
+
+const DEFAULT_PENDING_TTL_MS = 10_000;
+
+/**
+ * Bridges a model allow that the permission-system delegation envelope capped
+ * to defer into the immediately following local TUI terminal.
+ *
+ * The bridge is deliberately request-bound and one-shot. Any timing, event, UI,
+ * component, or wrapper mismatch leaves the normal human dialog in control.
+ */
+export class PermissionUiAutoConfirmer {
+  private readonly pending = new Map<string, PendingApproval>();
+  private activeAttempt: PromptAttempt | undefined;
+
+  constructor(
+    private readonly enabledSurfaces: () => readonly string[],
+    private readonly pendingTtlMs = DEFAULT_PENDING_TTL_MS,
+  ) {}
+
+  stage(requestId: string, surface: string): boolean {
+    this.pruneExpired();
+    if (!this.enabledSurfaces().includes(surface)) return false;
+    this.pending.set(requestId, {
+      surface,
+      expiresAt: Date.now() + this.pendingTtlMs,
+    });
+    return true;
+  }
+
+  handlePrompt(raw: unknown, ctx: ExtensionContext): void {
+    const event = parsePermissionUiPromptEvent(raw);
+    if (!event || ctx.mode !== "tui" || !ctx.hasUI) return;
+
+    this.pruneExpired();
+    const pending = this.pending.get(event.requestId);
+    if (!pending) {
+      // A staged allow is valid only for the immediately following prompt.
+      // Never leave it latent after a different request reaches the terminal.
+      this.pending.clear();
+      this.settleActiveForConflict();
+      return;
+    }
+    this.pending.delete(event.requestId);
+
+    if (!this.enabledSurfaces().includes(pending.surface)) return;
+    this.settleActiveForConflict();
+
+    const attempt: PromptAttempt = {
+      controller: new AbortController(),
+      settled: false,
+      recognized: false,
+    };
+    this.activeAttempt = attempt;
+    if (!this.installOneShotInterceptor(ctx.ui, event, attempt)) {
+      attempt.controller.abort();
+      attempt.settled = true;
+      this.activeAttempt = undefined;
+    }
+  }
+
+  clear(): void {
+    this.pending.clear();
+    const attempt = this.activeAttempt;
+    this.activeAttempt = undefined;
+    if (!attempt) return;
+    attempt.restore?.();
+    attempt.controller.abort();
+    attempt.settled = true;
+  }
+
+  private installOneShotInterceptor(
+    ui: ExtensionUIContext,
+    event: PermissionUiPromptEvent,
+    attempt: PromptAttempt,
+  ): boolean {
+    const previousCustom = ui.custom;
+    let invoked = false;
+    let wrapper: UiCustom;
+
+    const release = () => {
+      if (this.activeAttempt === attempt) this.activeAttempt = undefined;
+    };
+    const restore = () => {
+      try {
+        if (ui.custom === wrapper) ui.custom = previousCustom;
+      } catch {
+        // A shared-UI wrapper conflict degrades to the normal human dialog.
+      }
+    };
+
+    wrapper = ((factory: (...args: any[]) => any, options?: any) => {
+      if (invoked) {
+        return invokeUiCustom(previousCustom, ui, factory, options);
+      }
+      invoked = true;
+      restore();
+
+      if (options?.overlay !== false) {
+        this.releaseUnrecognized(attempt, release);
+        return invokeUiCustom(previousCustom, ui, factory, options);
+      }
+
+      const wrappedFactory = (
+        tui: unknown,
+        theme: unknown,
+        keybindings: unknown,
+        done: (result: unknown) => void,
+      ) => {
+        let uiFinished = false;
+        const finish = (result: unknown) => {
+          if (uiFinished) return;
+          uiFinished = true;
+          if (!attempt.settled) {
+            attempt.settled = true;
+            attempt.controller.abort();
+            release();
+          }
+          done(result);
+        };
+
+        attempt.autoApprove = () => finish(AUTO_APPROVED_DECISION);
+        attempt.denyForUiConflict = () => finish(UI_CONFLICT_DENIED_DECISION);
+
+        let produced: unknown;
+        try {
+          produced = factory(tui, theme, keybindings, finish);
+        } catch (error) {
+          this.releaseUnrecognized(attempt, release);
+          throw error;
+        }
+
+        if (isPromiseLike(produced)) {
+          return Promise.resolve(produced).then(
+            (component) =>
+              this.recognizeComponent(component, event, attempt, release),
+            (error) => {
+              this.releaseUnrecognized(attempt, release);
+              throw error;
+            },
+          );
+        }
+        return this.recognizeComponent(produced, event, attempt, release);
+      };
+
+      return invokeUiCustom(previousCustom, ui, wrappedFactory, options);
+    }) as UiCustom;
+
+    attempt.restore = restore;
+    try {
+      ui.custom = wrapper;
+    } catch {
+      return false;
+    }
+
+    // v24 opens the permission component synchronously after the event. Never
+    // leave a wrapper installed long enough to catch an unrelated custom UI.
+    queueMicrotask(() => {
+      if (invoked) return;
+      restore();
+      this.releaseUnrecognized(attempt, release);
+    });
+    return true;
+  }
+
+  private recognizeComponent(
+    component: unknown,
+    event: PermissionUiPromptEvent,
+    attempt: PromptAttempt,
+    release: () => void,
+  ): unknown {
+    if (!isPermissionPromptComponent(component, event)) {
+      this.releaseUnrecognized(attempt, release);
+      return component;
+    }
+    attempt.recognized = true;
+    queueMicrotask(() => {
+      try {
+        if (!attempt.settled && attempt.recognized) {
+          attempt.autoApprove?.();
+        }
+      } catch {
+        attempt.controller.abort();
+        attempt.settled = true;
+        release();
+      }
+    });
+    return component;
+  }
+
+  private releaseUnrecognized(
+    attempt: PromptAttempt,
+    release: () => void,
+  ): void {
+    if (attempt.recognized || attempt.settled) return;
+    attempt.restore?.();
+    attempt.controller.abort();
+    attempt.settled = true;
+    release();
+  }
+
+  private settleActiveForConflict(): void {
+    const attempt = this.activeAttempt;
+    if (!attempt || attempt.settled) return;
+    try {
+      attempt.denyForUiConflict?.();
+    } catch {
+      attempt.controller.abort();
+      attempt.settled = true;
+      this.activeAttempt = undefined;
+    }
+  }
+
+  private pruneExpired(): void {
+    const now = Date.now();
+    for (const [requestId, pending] of this.pending) {
+      if (pending.expiresAt < now) this.pending.delete(requestId);
+    }
+  }
+}
+
+function parsePermissionUiPromptEvent(
+  raw: unknown,
+): PermissionUiPromptEvent | undefined {
+  if (!isRecord(raw)) return;
+  if (
+    typeof raw.requestId !== "string" ||
+    typeof raw.message !== "string"
+  ) {
+    return;
+  }
+  return { requestId: raw.requestId, message: raw.message };
+}
+
+function isPermissionPromptComponent(
+  value: unknown,
+  event: PermissionUiPromptEvent,
+): boolean {
+  if (!isRecord(value) || typeof value.render !== "function") return false;
+  const constructorName =
+    typeof value.constructor === "function" ? value.constructor.name : "";
+  if (constructorName !== "PermissionPromptComponent") return false;
+
+  try {
+    const rendered = value.render(2_000);
+    if (!Array.isArray(rendered)) return false;
+    const plain = normalizeWhitespace(stripAnsi(rendered.join("\n")));
+    const messagePrefix = normalizeWhitespace(event.message).slice(0, 120);
+    return (
+      plain.includes("Permission Required") &&
+      messagePrefix.length > 0 &&
+      plain.includes(messagePrefix)
+    );
+  } catch {
+    return false;
+  }
+}
+
+function invokeUiCustom(
+  method: UiCustom,
+  ui: ExtensionUIContext,
+  factory: (...args: any[]) => any,
+  options: any,
+): Promise<any> {
+  return Reflect.apply(method as (...args: any[]) => Promise<any>, ui, [
+    factory,
+    options,
+  ]);
+}
+
+function isPromiseLike(value: unknown): value is PromiseLike<unknown> {
+  return isRecord(value) && typeof value.then === "function";
+}
+
+function isRecord(value: unknown): value is Record<string, any> {
+  return typeof value === "object" && value !== null;
+}
+
+function stripAnsi(value: string): string {
+  return value.replace(
+    /\x1B(?:\[[0-?]*[ -/]*[@-~]|\][^\x07]*(?:\x07|\x1B\\))/g,
+    "",
+  );
+}
+
+function normalizeWhitespace(value: string): string {
+  return value.replace(/\s+/g, " ").trim();
+}