@hank-warren/pi-auto-permissions 0.15.0 → 0.16.1

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # @hank-warren/pi-auto-permissions
 
+## 0.16.1
+
+### Patch Changes
+
+- d0c46a5: Two fixes found by the live canary:
+
+  - `/auto-permissions` → Recent denials → "Allow on retry" dispatched the retry while the settings menu was still open; the approval prompt then stacked on top of it and the composer stopped submitting until Pi was restarted. The menu now closes before the retry is sent.
+  - With `ui.placement: "toolRow"`, a review waiting its turn behind another review rendered as `✗ blocked`; it now shows the queued frame.
+
+  Internally `index.ts` was split into `classify.ts`, `guardian-reviewer.ts`, `review-display.ts`, `session-overrides.ts`, `settings-command.ts`, `prompt-select.ts` and `review-scope.ts`; the decision pipeline, prompts, log formats, session entries and events are unchanged and are now pinned by an extension-level test suite.
+
+## 0.16.0
+
+### Minor Changes
+
+- c079c51: Serialize guardian-backed reviews, show a queued command instead of a blank gap, and stage `request_override`.
+
+  Two guarded commands issued in the same assistant turn used to open two reviewer conversations at once and race for the same widget and bash review row, letting the second verdict land against the first command's display. Guardian reviews now run one at a time behind a FIFO queue. Denies, convention blocks, trusted commands, and already-approved execution never enter it, so the ordinary path is unchanged.
+
+  Because the critical section spans the human approval prompt, a queued command now renders a `queued behind another review` row as soon as it starts waiting, and the wait is cancellable: `Esc` or a reviewer-lifecycle reset releases it immediately instead of stranding it behind a review it is no longer waiting for. An aborted waiter never lets the command behind it overtake the review still in progress.
+
+  `request_override` activates only after a convention denial in an interactive session, so a session that is never blocked does not carry its schema. The tool stays registered for transcript replay.
+
 ## 0.15.0
 
 ### Minor Changes

package/approval-pulse.ts

@@ -2,7 +2,7 @@ import { truncateToWidth, type Component } from "@earendil-works/pi-tui";
 
 export const APPROVAL_PULSE_INTERVAL_MS = 600;
 
-export interface ApprovalPulseTheme {
+interface ApprovalPulseTheme {
   fg(role: "warning" | "dim", text: string): string;
   bold(text: string): string;
 }

package/classify.ts

@@ -0,0 +1,66 @@
+import type { AutoPermissionsConfig } from "./config.js";
+import { ALL_SHELL_GATE, findGates, type Gate } from "./gates.js";
+
+/**
+ * What the ruleset says about one command, before any guardian is involved.
+ *
+ * `pass` means nothing gated it: no rule matched, or the only rules that did
+ * are ones this project trusts or has already granted an override for.
+ */
+export type CommandClassification =
+  | { kind: "pass" }
+  | { kind: "deny" | "convention" | "review"; gate: Gate };
+
+/**
+ * Rules that matched and still apply.
+ *
+ * Deny rules are hard policy boundaries: a project-scoped trusted-ops file
+ * must not be able to lift one, or a checked-in file could disarm the
+ * circuit breaker. Only guarded and convention matches honor the bypass.
+ */
+export function untrustedMatches(
+  command: string,
+  config: AutoPermissionsConfig,
+  trustedGroups: ReadonlySet<string>,
+): Gate[] {
+  return findGates(command, config.rules).filter(
+    (gate) => gate.level === "deny" || !trustedGroups.has(gate.group),
+  );
+}
+
+/**
+ * Decide a command's fate from the ruleset alone.
+ *
+ * Level priority across all matches, never first-match: a convention or
+ * guarded rule earlier in config order must not shadow a deny rule later.
+ */
+export function classifyCommand(
+  command: string,
+  config: AutoPermissionsConfig,
+  trustedGroups: ReadonlySet<string>,
+  allowedConventionCommands: ReadonlySet<string>,
+): CommandClassification {
+  const ruleMatches = findGates(command, config.rules);
+  const matches = ruleMatches.filter(
+    (gate) => gate.level === "deny" || !trustedGroups.has(gate.group),
+  );
+
+  const deny = matches.find((gate) => gate.level === "deny");
+  if (deny) return { kind: "deny", gate: deny };
+
+  const convention = matches.find((gate) => gate.level === "convention");
+  if (convention && !allowedConventionCommands.has(command)) {
+    return { kind: "convention", gate: convention };
+  }
+
+  let gate = matches.find((candidate) => candidate.level === "guarded");
+  // With reviewAllShell on, a command no rule names at all still gets a
+  // guardian review under the generic gate. "No rule" is judged before the
+  // trusted-groups filter: a command whose matching group the project
+  // trusts was explicitly waved through, not left unnamed, and must not be
+  // re-captured by the blanket gate.
+  if (!gate && !ruleMatches.length && config.reviewAllShell && !trustedGroups.has(ALL_SHELL_GATE.group)) {
+    gate = ALL_SHELL_GATE;
+  }
+  return gate ? { kind: "review", gate } : { kind: "pass" };
+}

package/config-writer.ts

@@ -23,7 +23,7 @@ export interface ReviewerBlock {
   timeoutMs: number;
 }
 
-export interface ConfigPatch {
+interface ConfigPatch {
   enabled?: boolean;
   reviewer?: ReviewerBlock;
   /**

package/config.ts

@@ -194,7 +194,7 @@ function compileRule(value: unknown, index: number): Gate {
 }
 
 /** The literal a `rules` array uses to splice the built-in ruleset in place. */
-export const DEFAULT_RULES_TOKEN = "$defaults";
+const DEFAULT_RULES_TOKEN = "$defaults";
 
 /**
  * Compile an authored `rules` array, splicing `defaults` wherever the literal
@@ -248,7 +248,7 @@ function resolvePrompt(
  * `loop-context.ts` names `PI_LOOP_ACTIVE`: no import, no dependency, and no
  * behaviour at all when pi-loop is not installed.
  */
-export const DEFAULT_USER_MESSAGE_TYPES = ["loop-objective"] as const;
+const DEFAULT_USER_MESSAGE_TYPES = ["loop-objective"] as const;
 
 const EVIDENCE_PRUNING_DEFAULTS = {
   toolRecordMaxChars: 500,

package/denial-log.ts

@@ -3,7 +3,7 @@ import { randomUUID } from "node:crypto";
 import { dirname } from "node:path";
 
 /** Rotate once the sidecar grows past this size; one previous generation is kept. */
-export const DENIAL_LOG_ROTATE_BYTES = 16 * 1024 * 1024;
+const DENIAL_LOG_ROTATE_BYTES = 16 * 1024 * 1024;
 
 /** The two ways a review can end without the command running. */
 export type DenialVerdict = "revise" | "block";

package/evaluation-log.ts

@@ -65,7 +65,7 @@ export interface PromptEvaluationRecord {
  * command and compact evidence for offline labelling against the same
  * criteria as prompted records.
  */
-export interface PrefilterEvaluationRecord {
+interface PrefilterEvaluationRecord {
   version: 2;
   timestamp: string;
   sessionId: string;
@@ -83,7 +83,7 @@ export interface PrefilterEvaluationRecord {
   decisionSource: "prefilter";
 }
 
-export type EvaluationRecord = PromptEvaluationRecord | PrefilterEvaluationRecord;
+type EvaluationRecord = PromptEvaluationRecord | PrefilterEvaluationRecord;
 
 export function classifyPromptChoice(choice: string | undefined): PromptChoiceClassification | undefined {
   if (choice === "Allow") return { allowsExecution: true };