@erichll/pi-auto-review 0.8.0 → 0.8.1

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.8.1 - 2026-08-21
+
+- Restore TUI auto-confirm for capped `path` / `external_directory` allows on
+  permission-system 26.x. `permissions:ui_prompt` no longer carries `message`;
+  the bridge now binds `requestId` plus `request.value` (falling back to the
+  display `value`, then the legacy `message`) and fingerprints the live dialog
+  with those fields. Top-level display `surface` is not treated as the gate.
+
 ## 0.8.0 - 2026-08-21
 
 - Add `/auto-review-approve` for exact non-critical denial retries and remove

package/README.md

@@ -4,7 +4,8 @@ A fail-closed, model-backed boundary reviewer for the Pi coding agent.
 
 The extension participates in `@gotgenes/pi-permission-system` as the
 `pi-auto-review` authorizer and exposes a process-local broker for OS sandbox
-adapters. The npm package and reviewer model have separate names:
+adapters. It is an authorizer *inside* the permission system, so installing
+that dependency is a hard prerequisite (see [Install and enable](#install-and-enable)). The npm package and reviewer model have separate names:
 
 - package: `@erichll/pi-auto-review`
 - authorizer: `pi-auto-review`
@@ -12,12 +13,18 @@ adapters. The npm package and reviewer model have separate names:
 
 ## Install and enable
 
-Install the package outside the agent-writable workspace:
+> **Prerequisite:** pi-auto-review is an authorizer inside
+> `@gotgenes/pi-permission-system`. Pi does not auto-install peer packages, so
+> install the permission system separately (once per machine) before this
+> extension:
 
 ```bash
+pi install npm:@gotgenes/pi-permission-system
 pi install npm:@erichll/pi-auto-review
 ```
 
+Install the package outside the agent-writable workspace:
+
 Add it to the permission-system authorizer chain:
 
 ```json

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@erichll/pi-auto-review",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "Model-backed boundary approval broker for Pi",
   "type": "module",
   "license": "MIT",
@@ -49,12 +49,12 @@
   "peerDependencies": {
     "@earendil-works/pi-ai": "^0.84.1",
     "@earendil-works/pi-coding-agent": "^0.84.1",
-    "@gotgenes/pi-permission-system": "^25.1.0"
+    "@gotgenes/pi-permission-system": "^26.0.0"
   },
   "devDependencies": {
     "@earendil-works/pi-ai": "^0.84.1",
     "@earendil-works/pi-coding-agent": "^0.84.1",
-    "@gotgenes/pi-permission-system": "^25.1.0",
+    "@gotgenes/pi-permission-system": "^26.0.0",
     "@types/node": "^26.2.0",
     "typescript": "^6.0.3"
   }

package/src/ui-auto-confirm.ts

@@ -7,9 +7,15 @@ type UiCustom = ExtensionUIContext["custom"];
 
 type PermissionUiPromptEvent = {
   requestId: string;
-  message: string;
+  /** Value the live dialog is expected to show (command, path, or legacy message). */
+  fingerprint: string;
+  /** Gate surface from `request.surface`, when the 26.x payload carries it. */
+  gateSurface?: string;
 };
 
+/** Prefix length that survives the default 400-char prompt field cap. */
+const FINGERPRINT_PREFIX = 80;
+
 type PendingApproval = {
   surface: string;
   expiresAt: number;
@@ -79,6 +85,9 @@ export class PermissionUiAutoConfirmer {
     this.pending.delete(event.requestId);
 
     if (!this.enabledSurfaces().includes(pending.surface)) return;
+    // Top-level event.surface is the display tool name (e.g. bash), not the
+    // gate. Only request.surface is comparable to the staged allow.
+    if (event.gateSurface && event.gateSurface !== pending.surface) return;
     this.settleActiveForConflict();
 
     const attempt: PromptAttempt = {
@@ -258,13 +267,24 @@ function parsePermissionUiPromptEvent(
   raw: unknown,
 ): PermissionUiPromptEvent | undefined {
   if (!isRecord(raw)) return;
-  if (
-    typeof raw.requestId !== "string" ||
-    typeof raw.message !== "string"
-  ) {
-    return;
-  }
-  return { requestId: raw.requestId, message: raw.message };
+  const requestId = nonemptyString(raw.requestId);
+  if (!requestId) return;
+
+  const request = isRecord(raw.request) ? raw.request : undefined;
+  // permission-system 26+ removed `message`. Prefer the structured value the
+  // dialog actually renders, then the display projection, then the legacy
+  // assembled sentence.
+  const fingerprint =
+    nonemptyString(request?.value) ??
+    nonemptyString(raw.value) ??
+    nonemptyString(raw.message);
+  if (!fingerprint) return;
+
+  return {
+    requestId,
+    fingerprint,
+    gateSurface: nonemptyString(request?.surface),
+  };
 }
 
 function isPermissionPromptComponent(
@@ -280,17 +300,23 @@ function isPermissionPromptComponent(
     const rendered = value.render(2_000);
     if (!Array.isArray(rendered)) return false;
     const plain = normalizeWhitespace(stripAnsi(rendered.join("\n")));
-    const messagePrefix = normalizeWhitespace(event.message).slice(0, 120);
+    const needle = event.fingerprint.slice(0, FINGERPRINT_PREFIX);
     return (
       plain.includes("Permission Required") &&
-      messagePrefix.length > 0 &&
-      plain.includes(messagePrefix)
+      needle.length > 0 &&
+      plain.includes(needle)
     );
   } catch {
     return false;
   }
 }
 
+function nonemptyString(value: unknown): string | undefined {
+  if (typeof value !== "string") return;
+  const compact = normalizeWhitespace(value);
+  return compact || undefined;
+}
+
 function invokeUiCustom(
   method: UiCustom,
   ui: ExtensionUIContext,