@gotgenes/pi-permission-system 36.1.0 → 36.2.1

package/src/logging/command-redaction.ts

@@ -1,13 +1,11 @@
 import { inlineShellPayloadNode } from "#src/access-intent/bash/command-enumeration";
-import {
-  ARG_NODE_TYPES,
-  resolveNodeText,
-} from "#src/access-intent/bash/node-text";
+import { ARG_NODE_TYPES, WordReader } from "#src/access-intent/bash/node-text";
 import {
   type BashReparser,
   getWarmBashParser,
   type TSNode,
 } from "#src/access-intent/bash/parser";
+import { ShellVariables } from "#src/access-intent/bash/shell-variable-expansion";
 import { isPlainRecord } from "#src/value-guards";
 import { isSensitiveName, REDACTED_PLACEHOLDER } from "./log-redaction";
 
@@ -80,7 +78,7 @@ export function redactCommandSecrets(command: string): string {
  * carries.
  *
  * A payload is re-parsed from its **verbatim inner slice** rather than
- * `resolveNodeText`'s shell value: the resolved text concatenates children and
+ * `WordReader.text`'s shell value: the resolved text concatenates children and
  * expands `$HOME`, which destroys the offset correspondence this shift relies
  * on. Because the slice excludes the payload's quotes, no span recovered from it
  * can reach one, so the masked payload stays quoted as it was written.
@@ -124,6 +122,14 @@ function collectSpansIn(
   }
 }
 
+/**
+ * How the masker reads a word: at the startup values of `HOME` and `PWD`,
+ * whatever the command rebinds. What it masks is decided by the *name* a value
+ * is bound to, and neither spelling of either variable is a sensitive name, so
+ * reading them as rebound would change no span.
+ */
+const WORDS = new WordReader(ShellVariables.UNREBOUND);
+
 /**
  * How many payload layers to descend.
  *
@@ -175,7 +181,7 @@ function collectInlineShellPayloads(
   payloads: PayloadSource[],
 ): void {
   if (node.type === "command") {
-    const payload = inlineShellPayloadNode(node);
+    const payload = inlineShellPayloadNode(node, WORDS);
     if (payload) payloads.push(payloadSourceOf(payload));
   }
   for (let i = 0; i < node.childCount; i++) {
@@ -191,7 +197,7 @@ function collectInlineShellPayloads(
  * A `word` payload is the program already. A `string`/`raw_string` wraps it in
  * one quote pair and an `ansi_c_string` in a `$` plus one quote pair, so each is
  * a slice at a known offset. Anything else — a `concatenation`, an expansion —
- * is stitched: `resolveNodeText` knows how to read its shell value, and that
+ * is stitched: `WordReader.text` knows how to read its shell value, and that
  * value's own offsets describe no span of the command.
  */
 function payloadSourceOf(node: TSNode): PayloadSource {
@@ -216,7 +222,7 @@ function payloadSourceOf(node: TSNode): PayloadSource {
         start: node.startIndex + quoteAt + 1,
         end: node.endIndex - 1,
       }
-    : { kind: "stitched", text: resolveNodeText(node), ...bounds };
+    : { kind: "stitched", text: WORDS.text(node), ...bounds };
 }
 
 /**
@@ -318,7 +324,7 @@ const HEADER_FIELD = /^([A-Za-z][A-Za-z0-9_-]*)[ \t]*:[ \t]*\S/;
 
 function headerValueSpan(node: TSNode): MaskSpan | null {
   if (!ARG_NODE_TYPES.has(node.type)) return null;
-  const match = HEADER_FIELD.exec(resolveNodeText(node));
+  const match = HEADER_FIELD.exec(WORDS.text(node));
   const field = match?.[1];
   if (!field || !isSensitiveName(field) || isCamelCased(field)) return null;
   const colon = node.text.indexOf(":");

package/src/path/expand-home.ts

@@ -29,14 +29,30 @@ const HOME_PREFIXES = ["~", "$HOME", "${HOME}"] as const;
  * All other patterns are returned unchanged.
  */
 export function expandHomePath(pattern: string): string {
-  for (const prefix of HOME_PREFIXES) {
-    if (pattern === prefix) return homedir();
-    if (!pattern.startsWith(prefix)) continue;
+  const rest = afterHomePrefix(pattern);
+  if (rest === undefined) return pattern;
+  return rest === "" ? homedir() : join(homedir(), rest.slice(1));
+}
+
+/**
+ * Whether {@link expandHomePath} reads `value` as starting at the home
+ * directory.
+ */
+export function hasHomePrefix(value: string): boolean {
+  return afterHomePrefix(value) !== undefined;
+}
 
-    const rest = pattern.slice(prefix.length);
-    if (rest.startsWith("/") || rest.startsWith("\\")) {
-      return join(homedir(), rest.slice(1));
+/**
+ * What follows a recognized home prefix (`""`, or a separator and the rest),
+ * or `undefined` when `value` has none.
+ */
+function afterHomePrefix(value: string): string | undefined {
+  for (const prefix of HOME_PREFIXES) {
+    if (!value.startsWith(prefix)) continue;
+    const rest = value.slice(prefix.length);
+    if (rest === "" || rest.startsWith("/") || rest.startsWith("\\")) {
+      return rest;
     }
   }
-  return pattern;
+  return undefined;
 }

package/src/presentation/prompt-notification.ts

@@ -1,41 +1,102 @@
+import { basename } from "node:path";
 import type { PromptNotificationChannel } from "#src/config/config-schema";
+import type { PromptRequestFacts } from "./prompt-payload";
 
 const BEL = "\x07";
 const OSC = "\x1b]";
 
-/** The OSC 777 title; the body carries the dialog title. */
-const OSC_777_TITLE = "pi";
+/** What a prompt notification says: OSC 777 carries both fields. */
+export interface PromptNotice {
+  readonly title: string;
+  readonly body: string;
+}
+
+/** The session facts a notice names, read when the prompt opens. */
+export interface NotificationSession {
+  readonly name: string | undefined;
+  readonly cwd: string;
+}
+
+/** The request facts a notice may name: labels only, never the value. */
+export type NoticeRequestFacts = Pick<
+  PromptRequestFacts,
+  "toolName" | "surface" | "requester"
+>;
+
+/**
+ * What a prompt notification says: which session is waiting, and what is
+ * being asked and by whom.
+ *
+ * Labels only. The request's value (the command, path, MCP target, or skill)
+ * never appears: the OS notification history is a store this package does not
+ * control, outside the owner-only logs and their key-name masking.
+ */
+export function describePromptNotice(
+  dialogTitle: string,
+  request: NoticeRequestFacts,
+  session: NotificationSession,
+): PromptNotice {
+  const label = sessionLabel(session);
+  const subject = askSubject(request);
+  return {
+    title: label ? `pi — ${label}` : "pi",
+    body: subject ? `${dialogTitle}: ${subject}` : dialogTitle,
+  };
+}
+
+/** The session's name, or the name of the directory it runs in, as Pi's own terminal title does. */
+function sessionLabel(session: NotificationSession): string {
+  // eslint-disable-next-line @typescript-eslint/prefer-nullish-coalescing -- || intentional: an empty name is unnamed
+  return session.name || basename(session.cwd);
+}
+
+/** What is asked (the tool, else the gate surface) and by which agent. */
+function askSubject(request: NoticeRequestFacts): string {
+  const what = request.toolName ?? request.surface;
+  const who = request.requester.agentName;
+  if (what && who) return `${what} (${who})`;
+  // eslint-disable-next-line @typescript-eslint/prefer-nullish-coalescing -- || intentional: an empty label names nothing
+  return what || who || "";
+}
 
 /**
  * The bytes that ask a terminal for attention as a permission dialog opens.
  *
  * One sequence per configured channel, in configured order; an empty list
- * renders nothing. The message is stripped of control characters, so it cannot
+ * renders nothing. Every field is stripped of control characters, so it cannot
  * end a sequence early or start another one.
  */
 export function renderPromptNotification(
   channels: readonly PromptNotificationChannel[],
-  message: string,
+  notice: PromptNotice,
 ): string {
-  const text = withoutControlCharacters(message);
-  return channels.map((channel) => renderChannel(channel, text)).join("");
+  const clean: PromptNotice = {
+    title: withoutControlCharacters(notice.title),
+    body: withoutControlCharacters(notice.body),
+  };
+  return channels.map((channel) => renderChannel(channel, clean)).join("");
 }
 
 function renderChannel(
   channel: PromptNotificationChannel,
-  text: string,
+  notice: PromptNotice,
 ): string {
   switch (channel) {
     case "bell":
       return BEL;
     case "osc9":
-      return `${OSC}9;${text}${BEL}`;
+      // One field, so the title leads it: it is what names the session.
+      return `${OSC}9;${notice.title}: ${notice.body}${BEL}`;
     case "osc777":
-      // `;` separates OSC 777's fields, so one in the body would split it.
-      return `${OSC}777;notify;${OSC_777_TITLE};${text.replaceAll(";", ":")}${BEL}`;
+      return `${OSC}777;notify;${osc777Field(notice.title)};${osc777Field(notice.body)}${BEL}`;
   }
 }
 
+/** `;` separates OSC 777's fields, so one inside a field would split it. */
+function osc777Field(text: string): string {
+  return text.replaceAll(";", ":");
+}
+
 function withoutControlCharacters(value: string): string {
   // Code points, not grapheme clusters: a control character is always one.
   return Array.from(value)