@erichll/pi-auto-review 0.1.1 → 0.3.0

package/README.md

@@ -20,14 +20,24 @@ The broker applies the following order:
 
 1. Deterministic hard denies
 2. Model review
-3. Human terminal when the model returns `defer` or `failureMode` is `defer`
+3. Local terminal when the authorizer chain requires one
 4. Exact, expiring, one-use grants for external sandbox adapters
 
 Model approval cannot override `pi-permission-system`'s bounded-delegation
 checkpoint. In version 24, an authorizer's `allow` on `path` or
-`external_directory` is still downgraded to `defer` and reaches the human
-terminal. Sandbox adapters should use concrete surfaces such as
-`filesystem-read`, `filesystem-write`, and `network`.
+`external_directory` is still downgraded to `defer`. In an interactive v24 TUI,
+`autoConfirmBoundedAllows` can bind that exact model allow to the immediately
+following local permission dialog and complete it as `auto_approved`. The
+default enables this bridge only for `external_directory`; `path`, non-TUI
+modes, UI mismatches, and reviewer defers still reach the human terminal.
+Sandbox adapters should use concrete surfaces such as `filesystem-read`,
+`filesystem-write`, and `network`.
+
+The TUI bridge is request-ID-bound, expires after ten seconds, is consumed
+once, and recognizes the v24 inline permission component before completing it.
+Any event ordering, request, mode, component, or shared-UI wrapper mismatch
+fails closed to the original dialog. This is a compatibility bridge around the
+v24 delegation envelope, not permission-system authority-chain API.
 
 The broker stops automatic review for a turn after three consecutive denials
 or ten denials in the rolling last fifty reviews. An explicit denial is
@@ -67,13 +77,17 @@ Edit `src/config.json`, using `config/config.example.json` as the reference:
   "maxToolTranscriptTokens": 1200,
   "maxRelevantResultTokens": 800,
   "failureMode": "deny",
-  "grantTtlMs": 60000
+  "grantTtlMs": 60000,
+  "autoConfirmBoundedAllows": ["external_directory"]
 }
 ```
 
 The configured provider must be registered in Pi and must support the
 configured model. `failureMode: "deny"` is the fail-closed default;
 `failureMode: "defer"` falls through to the normal human terminal.
+Set `autoConfirmBoundedAllows` to `[]` to keep every bounded allow manual, or
+include `"path"` as well to opt into the same TUI bridge for the cross-cutting
+path surface.
 
 Add the link to the permission-system configuration:
 
@@ -100,8 +114,8 @@ import {
 } from "@erichll/pi-auto-review";
 
 const request: BoundaryRequest = {
-  id: "landstrip-query-id",
-  source: "landstrip",
+  id: "sandbox-runtime-query-id",
+  source: "sandbox-runtime",
   surface: "network",
   operation: "connect",
   cwd: "/workspace/project",
@@ -144,7 +158,7 @@ may additionally receive only these bounded result classes:
   a pending deletion target.
 - `git remote`, branch, status, revision, and remote configuration results for
   a pending Git push.
-- The current structured Landstrip trap.
+- The current structured Sandbox Runtime trap.
 
 Unrelated tool results and assistant prose remain excluded. Selected results
 have a separate `maxRelevantResultTokens` budget, common secret/token forms are
@@ -152,19 +166,18 @@ redacted, and markup characters are escaped before the evidence is sent to the
 reviewer. Results remain explicitly labeled as untrusted and possibly
 incomplete.
 
-## Landstrip status
+## Sandbox adapter status
 
 The broker-facing contract is implemented, but this package does not intercept
-Landstrip prompts by itself. A Landstrip adapter must translate its structured
-filesystem/network trap into `BoundaryRequest`, consume the exact grant, and
-then use a supported Landstrip retry or dynamic-grant mechanism.
+OS sandbox events by itself. Adapters translate a concrete boundary into a
+`BoundaryRequest` and must consume the exact grant before allowing the
+operation.
 
-This monorepo also contains `pi-sandbox`, a Linux Landstrip and macOS Seatbelt
-integration that owns Bash and process-backed subagent execution, provides
-domain-based proxy approval, and consumes this broker service directly. Its
-Linux native paths are tested. The macOS implementation has deterministic
-orchestration and policy tests, but still awaits native smoke coverage on real
-x64/arm64 hosts. Do not load `pi-sandbox` and `pi-landstrip` together.
+This monorepo's `pi-sandbox` uses Anthropic Sandbox Runtime. Filesystem policy
+is static and fails closed; unmatched public network destinations use the
+broker for per-connection approval. Each Bash command or built-in subagent
+session owns an independent Sandbox Runtime broker process. Adapters should use
+the `./sandbox` export.
 
 Do not implement the adapter by writing broad permanent rules to
 `.pi/sandbox.json`.
@@ -189,9 +202,10 @@ PI_AUTO_REVIEW_ALLOW_UNTRUSTED_DEV=1 pi --approve
 The trusted package configuration is copied and frozen at `session_start`.
 An optional workspace file at `.pi/pi-auto-review.json` may only lower
 timeouts, token/evidence limits, retries, and grant TTL, or set `failureMode`
-to `deny`. It cannot select a model, weaken fail-closed behavior, or raise a
-trusted limit. Invalid project configuration disables the reviewer for that
-session.
+to `deny`. It may remove entries from `autoConfirmBoundedAllows`, but cannot
+add a surface not enabled by the trusted package configuration. It cannot
+select a model, weaken fail-closed behavior, or raise a trusted limit. Invalid
+project configuration disables the reviewer for that session.
 
 Writes to the installed reviewer package, project security configuration,
 global Pi security configuration, and the global audit directory are

package/config/config.example.json

@@ -8,5 +8,6 @@
   "maxToolTranscriptTokens": 1200,
   "maxRelevantResultTokens": 800,
   "failureMode": "deny",
-  "grantTtlMs": 60000
+  "grantTtlMs": 60000,
+  "autoConfirmBoundedAllows": ["external_directory"]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@erichll/pi-auto-review",
-  "version": "0.1.1",
+  "version": "0.3.0",
   "description": "Model-backed boundary approval broker for Pi",
   "type": "module",
   "license": "MIT",
@@ -35,7 +35,7 @@
   "exports": {
     ".": "./src/index.ts",
     "./broker": "./src/broker/index.ts",
-    "./landstrip": "./src/integrations/landstrip.ts"
+    "./sandbox": "./src/integrations/sandbox.ts"
   },
   "pi": {
     "extensions": [

package/src/broker/types.ts

@@ -9,7 +9,7 @@ export type BoundarySurface =
 
 export type BoundarySource =
   | "permission-system"
-  | "landstrip"
+  | "sandbox-runtime"
   | (string & {});
 
 export type BoundaryRequest = {

package/src/config.json

@@ -8,5 +8,6 @@
   "maxToolTranscriptTokens": 1200,
   "maxRelevantResultTokens": 800,
   "failureMode": "deny",
-  "grantTtlMs": 60000
+  "grantTtlMs": 60000,
+  "autoConfirmBoundedAllows": ["external_directory"]
 }

package/src/index.ts

@@ -33,16 +33,17 @@ import {
   type BoundaryReview,
   type BoundaryReviewerContext,
 } from "./broker/index.ts";
+import { PermissionUiAutoConfirmer } from "./ui-auto-confirm.ts";
 
 export { parseDecision } from "./policy.ts";
 export * from "./broker/index.ts";
 export {
-  landstripTrapToBoundaryRequest,
-  type LandstripBoundaryTrap,
-  type LandstripFilesystemTrap,
-  type LandstripNetworkTrap,
-  type LandstripRequestContext,
-} from "./integrations/landstrip.ts";
+  sandboxTrapToBoundaryRequest,
+  type SandboxBoundaryTrap,
+  type SandboxFilesystemTrap,
+  type SandboxNetworkTrap,
+  type SandboxRequestContext,
+} from "./integrations/sandbox.ts";
 
 type ReasoningLevel =
   | "off"
@@ -53,6 +54,8 @@ type ReasoningLevel =
   | "xhigh"
   | "max";
 
+type BoundedSurface = "external_directory" | "path";
+
 export type Config = {
   model: string;
   reasoning: ReasoningLevel;
@@ -64,6 +67,7 @@ export type Config = {
   maxRelevantResultTokens: number;
   failureMode: "deny" | "defer";
   grantTtlMs: number;
+  autoConfirmBoundedAllows: readonly BoundedSurface[];
 };
 
 type CompletionMessage = {
@@ -109,6 +113,7 @@ const DEFAULT_CONFIG: Config = {
   maxRelevantResultTokens: 800,
   failureMode: "deny",
   grantTtlMs: 60_000,
+  autoConfirmBoundedAllows: Object.freeze(["external_directory"]),
 };
 
 const REVIEWER_SYSTEM_PROMPT = `You are a fail-closed permission reviewer.
@@ -163,6 +168,7 @@ function validateConfig(value: unknown, source: string): Config {
     "maxRelevantResultTokens",
     "failureMode",
     "grantTtlMs",
+    "autoConfirmBoundedAllows",
   ]);
   const unknownKeys = Object.keys(raw).filter((key) => !allowedKeys.has(key));
   if (unknownKeys.length > 0) {
@@ -212,6 +218,18 @@ function validateConfig(value: unknown, source: string): Config {
   ) {
     throw new Error(`${EXTENSION_NAME}: grantTtlMs must be 1000..300000`);
   }
+  if (
+    !Array.isArray(config.autoConfirmBoundedAllows) ||
+    config.autoConfirmBoundedAllows.some(
+      (surface) => !BOUNDED_SURFACES.has(surface),
+    ) ||
+    new Set(config.autoConfirmBoundedAllows).size !==
+      config.autoConfirmBoundedAllows.length
+  ) {
+    throw new Error(
+      `${EXTENSION_NAME}: autoConfirmBoundedAllows must contain unique external_directory/path entries`,
+    );
+  }
   for (const [name, entry] of [
     ["maxUserTranscriptTokens", config.maxUserTranscriptTokens],
     ["maxToolTranscriptTokens", config.maxToolTranscriptTokens],
@@ -221,7 +239,12 @@ function validateConfig(value: unknown, source: string): Config {
       throw new Error(`${EXTENSION_NAME}: ${name} must be 32..8000`);
     }
   }
-  return config;
+  return {
+    ...config,
+    autoConfirmBoundedAllows: Object.freeze([
+      ...config.autoConfirmBoundedAllows,
+    ]),
+  };
 }
 
 export function loadConfig(): Config {
@@ -260,6 +283,7 @@ export function applyProjectConfig(
   const allowed = new Set<string>([
     ...TIGHTENABLE_NUMBER_KEYS,
     "failureMode",
+    "autoConfirmBoundedAllows",
   ]);
   const forbidden = Object.keys(raw).filter((key) => !allowed.has(key));
   if (forbidden.length > 0) {
@@ -289,6 +313,25 @@ export function applyProjectConfig(
     }
     merged.failureMode = "deny";
   }
+  if (raw.autoConfirmBoundedAllows !== undefined) {
+    if (
+      !Array.isArray(raw.autoConfirmBoundedAllows) ||
+      raw.autoConfirmBoundedAllows.some(
+        (surface) =>
+          typeof surface !== "string" ||
+          !trusted.autoConfirmBoundedAllows.includes(
+            surface as BoundedSurface,
+          ),
+      )
+    ) {
+      throw new Error(
+        `${EXTENSION_NAME}: project autoConfirmBoundedAllows may only remove trusted surfaces`,
+      );
+    }
+    merged.autoConfirmBoundedAllows = [
+      ...new Set(raw.autoConfirmBoundedAllows as BoundedSurface[]),
+    ];
+  }
   return Object.freeze(validateConfig(merged, "effective project config"));
 }
 
@@ -376,6 +419,12 @@ function sessionConfig(
 }
 
 function surfaceOf(details: PromptPermissionDetails): string {
+  if (
+    typeof details.accessIntent?.surface === "string" &&
+    details.accessIntent.surface
+  ) {
+    return details.accessIntent.surface;
+  }
   if (typeof details.surface === "string" && details.surface) {
     return details.surface;
   }
@@ -721,6 +770,9 @@ export function createPiAutoReviewExtension(
   let disposeBrokerService: (() => void) | undefined;
   const reviewResults = new Map<string, ReviewResult>();
   let broker: BoundaryApprovalBroker | undefined;
+  const uiAutoConfirmer = new PermissionUiAutoConfirmer(
+    () => config.autoConfirmBoundedAllows,
+  );
 
   const createBroker = (): BoundaryApprovalBroker =>
     new BoundaryApprovalBroker({
@@ -831,6 +883,7 @@ export function createPiAutoReviewExtension(
     disposeBrokerService?.();
     broker?.clear();
     reviewResults.clear();
+    uiAutoConfirmer.clear();
     try {
       config = sessionConfig(
         ctx.cwd,
@@ -852,6 +905,10 @@ export function createPiAutoReviewExtension(
     }
   });
 
+  pi.events.on("permissions:ui_prompt", (event) => {
+    if (context) uiAutoConfirmer.handlePrompt(event, context);
+  });
+
   pi.events.on("permissions:ready", () => {
     try {
       const service = permissionsService();
@@ -880,6 +937,11 @@ export function createPiAutoReviewExtension(
           const result = reviewResults.get(request.id);
           reviewResults.delete(request.id);
           const allowCapped = decision.kind === "allow" && boundedRequest(details);
+          const autoConfirmQueued =
+            allowCapped &&
+            context.mode === "tui" &&
+            context.hasUI &&
+            uiAutoConfirmer.stage(request.id, surface);
           log.review("pi_auto_review_decision", {
             requestId: request.id,
             surface,
@@ -890,6 +952,7 @@ export function createPiAutoReviewExtension(
             userAuthorization: decision.review.userAuthorization,
             rationale: decision.review.rationale,
             allowCapped,
+            autoConfirmQueued,
             circuitBreakerTripped:
               decision.kind === "deny"
                 ? decision.circuitBreakerTripped
@@ -931,6 +994,7 @@ export function createPiAutoReviewExtension(
     broker?.clear();
     broker = undefined;
     reviewResults.clear();
+    uiAutoConfirmer.clear();
     context = undefined;
   });
   };

package/src/integrations/{landstrip.ts → sandbox.ts}

@@ -1,13 +1,12 @@
 import type { BoundaryRequest } from "../broker/types.ts";
 
-export type LandstripFilesystemTrap = {
+export type SandboxFilesystemTrap = {
   kind: "filesystem";
-  code: "FILESYSTEM_DENIED";
-  query_id?: string;
   operation: "read" | "write";
   path: string;
   requested_path?: string;
   reason?: string;
+  query_id?: string;
   process?: {
     pid?: number;
     exe?: string | null;
@@ -15,12 +14,11 @@ export type LandstripFilesystemTrap = {
   };
 };
 
-export type LandstripNetworkTrap = {
+export type SandboxNetworkTrap = {
   kind: "network";
-  code: "NETWORK_DENIED";
-  query_id?: string;
   operation: "connect" | "bind";
   target: string;
+  query_id?: string;
   process?: {
     pid?: number;
     exe?: string | null;
@@ -28,29 +26,29 @@ export type LandstripNetworkTrap = {
   };
 };
 
-export type LandstripBoundaryTrap =
-  | LandstripFilesystemTrap
-  | LandstripNetworkTrap;
+export type SandboxBoundaryTrap =
+  | SandboxFilesystemTrap
+  | SandboxNetworkTrap;
 
-export type LandstripRequestContext = {
+export type SandboxRequestContext = {
   command?: string;
   cwd: string;
   agentName?: string;
 };
 
-export function landstripTrapToBoundaryRequest(
-  trap: LandstripBoundaryTrap,
-  context: LandstripRequestContext,
+export function sandboxTrapToBoundaryRequest(
+  trap: SandboxBoundaryTrap,
+  context: SandboxRequestContext,
 ): BoundaryRequest {
   const processSuffix =
     trap.process?.pid === undefined ? "" : `:${trap.process.pid}`;
   const id = trap.query_id
-    ? `landstrip:${trap.query_id}`
-    : `landstrip:${trap.kind}:${trap.operation}${processSuffix}`;
+    ? `sandbox-runtime:${trap.query_id}`
+    : `sandbox-runtime:${trap.kind}:${trap.operation}${processSuffix}`;
   if (trap.kind === "filesystem") {
     return {
       id,
-      source: "landstrip",
+      source: "sandbox-runtime",
       surface:
         trap.operation === "read"
           ? "filesystem-read"
@@ -70,7 +68,7 @@ export function landstripTrapToBoundaryRequest(
   }
   return {
     id,
-    source: "landstrip",
+    source: "sandbox-runtime",
     surface: "network",
     operation: trap.operation,
     cwd: trap.process?.cwd || context.cwd,

package/src/policy.ts

@@ -582,7 +582,7 @@ function relevantResultEvidence(
 function sandboxTrapEvidence(
   request: RelevantBoundaryRequest,
 ): string | undefined {
-  if (request.source !== "landstrip") return;
+  if (request.source !== "sandbox-runtime") return;
   return `<sandbox-trap>
 ${boundedString({
     surface: request.surface,

package/src/ui-auto-confirm.ts

@@ -0,0 +1,323 @@
+import type {
+  ExtensionContext,
+  ExtensionUIContext,
+} from "@earendil-works/pi-coding-agent";
+
+type UiCustom = ExtensionUIContext["custom"];
+
+type PermissionUiPromptEvent = {
+  requestId: string;
+  message: string;
+};
+
+type PendingApproval = {
+  surface: string;
+  expiresAt: number;
+};
+
+type PromptAttempt = {
+  controller: AbortController;
+  settled: boolean;
+  recognized: boolean;
+  autoApprove?: () => void;
+  denyForUiConflict?: () => void;
+  restore?: () => void;
+};
+
+const AUTO_APPROVED_DECISION = {
+  approved: true,
+  state: "approved",
+  autoApproved: true,
+} as const;
+
+const UI_CONFLICT_DENIED_DECISION = {
+  approved: false,
+  state: "denied",
+} as const;
+
+const DEFAULT_PENDING_TTL_MS = 10_000;
+
+/**
+ * Bridges a model allow that the permission-system delegation envelope capped
+ * to defer into the immediately following local TUI terminal.
+ *
+ * The bridge is deliberately request-bound and one-shot. Any timing, event, UI,
+ * component, or wrapper mismatch leaves the normal human dialog in control.
+ */
+export class PermissionUiAutoConfirmer {
+  private readonly pending = new Map<string, PendingApproval>();
+  private activeAttempt: PromptAttempt | undefined;
+
+  constructor(
+    private readonly enabledSurfaces: () => readonly string[],
+    private readonly pendingTtlMs = DEFAULT_PENDING_TTL_MS,
+  ) {}
+
+  stage(requestId: string, surface: string): boolean {
+    this.pruneExpired();
+    if (!this.enabledSurfaces().includes(surface)) return false;
+    this.pending.set(requestId, {
+      surface,
+      expiresAt: Date.now() + this.pendingTtlMs,
+    });
+    return true;
+  }
+
+  handlePrompt(raw: unknown, ctx: ExtensionContext): void {
+    const event = parsePermissionUiPromptEvent(raw);
+    if (!event || ctx.mode !== "tui" || !ctx.hasUI) return;
+
+    this.pruneExpired();
+    const pending = this.pending.get(event.requestId);
+    if (!pending) {
+      // A staged allow is valid only for the immediately following prompt.
+      // Never leave it latent after a different request reaches the terminal.
+      this.pending.clear();
+      this.settleActiveForConflict();
+      return;
+    }
+    this.pending.delete(event.requestId);
+
+    if (!this.enabledSurfaces().includes(pending.surface)) return;
+    this.settleActiveForConflict();
+
+    const attempt: PromptAttempt = {
+      controller: new AbortController(),
+      settled: false,
+      recognized: false,
+    };
+    this.activeAttempt = attempt;
+    if (!this.installOneShotInterceptor(ctx.ui, event, attempt)) {
+      attempt.controller.abort();
+      attempt.settled = true;
+      this.activeAttempt = undefined;
+    }
+  }
+
+  clear(): void {
+    this.pending.clear();
+    const attempt = this.activeAttempt;
+    this.activeAttempt = undefined;
+    if (!attempt) return;
+    attempt.restore?.();
+    attempt.controller.abort();
+    attempt.settled = true;
+  }
+
+  private installOneShotInterceptor(
+    ui: ExtensionUIContext,
+    event: PermissionUiPromptEvent,
+    attempt: PromptAttempt,
+  ): boolean {
+    const previousCustom = ui.custom;
+    let invoked = false;
+    let wrapper: UiCustom;
+
+    const release = () => {
+      if (this.activeAttempt === attempt) this.activeAttempt = undefined;
+    };
+    const restore = () => {
+      try {
+        if (ui.custom === wrapper) ui.custom = previousCustom;
+      } catch {
+        // A shared-UI wrapper conflict degrades to the normal human dialog.
+      }
+    };
+
+    wrapper = ((factory: (...args: any[]) => any, options?: any) => {
+      if (invoked) {
+        return invokeUiCustom(previousCustom, ui, factory, options);
+      }
+      invoked = true;
+      restore();
+
+      if (options?.overlay !== false) {
+        this.releaseUnrecognized(attempt, release);
+        return invokeUiCustom(previousCustom, ui, factory, options);
+      }
+
+      const wrappedFactory = (
+        tui: unknown,
+        theme: unknown,
+        keybindings: unknown,
+        done: (result: unknown) => void,
+      ) => {
+        let uiFinished = false;
+        const finish = (result: unknown) => {
+          if (uiFinished) return;
+          uiFinished = true;
+          if (!attempt.settled) {
+            attempt.settled = true;
+            attempt.controller.abort();
+            release();
+          }
+          done(result);
+        };
+
+        attempt.autoApprove = () => finish(AUTO_APPROVED_DECISION);
+        attempt.denyForUiConflict = () => finish(UI_CONFLICT_DENIED_DECISION);
+
+        let produced: unknown;
+        try {
+          produced = factory(tui, theme, keybindings, finish);
+        } catch (error) {
+          this.releaseUnrecognized(attempt, release);
+          throw error;
+        }
+
+        if (isPromiseLike(produced)) {
+          return Promise.resolve(produced).then(
+            (component) =>
+              this.recognizeComponent(component, event, attempt, release),
+            (error) => {
+              this.releaseUnrecognized(attempt, release);
+              throw error;
+            },
+          );
+        }
+        return this.recognizeComponent(produced, event, attempt, release);
+      };
+
+      return invokeUiCustom(previousCustom, ui, wrappedFactory, options);
+    }) as UiCustom;
+
+    attempt.restore = restore;
+    try {
+      ui.custom = wrapper;
+    } catch {
+      return false;
+    }
+
+    // v24 opens the permission component synchronously after the event. Never
+    // leave a wrapper installed long enough to catch an unrelated custom UI.
+    queueMicrotask(() => {
+      if (invoked) return;
+      restore();
+      this.releaseUnrecognized(attempt, release);
+    });
+    return true;
+  }
+
+  private recognizeComponent(
+    component: unknown,
+    event: PermissionUiPromptEvent,
+    attempt: PromptAttempt,
+    release: () => void,
+  ): unknown {
+    if (!isPermissionPromptComponent(component, event)) {
+      this.releaseUnrecognized(attempt, release);
+      return component;
+    }
+    attempt.recognized = true;
+    queueMicrotask(() => {
+      try {
+        if (!attempt.settled && attempt.recognized) {
+          attempt.autoApprove?.();
+        }
+      } catch {
+        attempt.controller.abort();
+        attempt.settled = true;
+        release();
+      }
+    });
+    return component;
+  }
+
+  private releaseUnrecognized(
+    attempt: PromptAttempt,
+    release: () => void,
+  ): void {
+    if (attempt.recognized || attempt.settled) return;
+    attempt.restore?.();
+    attempt.controller.abort();
+    attempt.settled = true;
+    release();
+  }
+
+  private settleActiveForConflict(): void {
+    const attempt = this.activeAttempt;
+    if (!attempt || attempt.settled) return;
+    try {
+      attempt.denyForUiConflict?.();
+    } catch {
+      attempt.controller.abort();
+      attempt.settled = true;
+      this.activeAttempt = undefined;
+    }
+  }
+
+  private pruneExpired(): void {
+    const now = Date.now();
+    for (const [requestId, pending] of this.pending) {
+      if (pending.expiresAt < now) this.pending.delete(requestId);
+    }
+  }
+}
+
+function parsePermissionUiPromptEvent(
+  raw: unknown,
+): PermissionUiPromptEvent | undefined {
+  if (!isRecord(raw)) return;
+  if (
+    typeof raw.requestId !== "string" ||
+    typeof raw.message !== "string"
+  ) {
+    return;
+  }
+  return { requestId: raw.requestId, message: raw.message };
+}
+
+function isPermissionPromptComponent(
+  value: unknown,
+  event: PermissionUiPromptEvent,
+): boolean {
+  if (!isRecord(value) || typeof value.render !== "function") return false;
+  const constructorName =
+    typeof value.constructor === "function" ? value.constructor.name : "";
+  if (constructorName !== "PermissionPromptComponent") return false;
+
+  try {
+    const rendered = value.render(2_000);
+    if (!Array.isArray(rendered)) return false;
+    const plain = normalizeWhitespace(stripAnsi(rendered.join("\n")));
+    const messagePrefix = normalizeWhitespace(event.message).slice(0, 120);
+    return (
+      plain.includes("Permission Required") &&
+      messagePrefix.length > 0 &&
+      plain.includes(messagePrefix)
+    );
+  } catch {
+    return false;
+  }
+}
+
+function invokeUiCustom(
+  method: UiCustom,
+  ui: ExtensionUIContext,
+  factory: (...args: any[]) => any,
+  options: any,
+): Promise<any> {
+  return Reflect.apply(method as (...args: any[]) => Promise<any>, ui, [
+    factory,
+    options,
+  ]);
+}
+
+function isPromiseLike(value: unknown): value is PromiseLike<unknown> {
+  return isRecord(value) && typeof value.then === "function";
+}
+
+function isRecord(value: unknown): value is Record<string, any> {
+  return typeof value === "object" && value !== null;
+}
+
+function stripAnsi(value: string): string {
+  return value.replace(
+    /\x1B(?:\[[0-?]*[ -/]*[@-~]|\][^\x07]*(?:\x07|\x1B\\))/g,
+    "",
+  );
+}
+
+function normalizeWhitespace(value: string): string {
+  return value.replace(/\s+/g, " ").trim();
+}