@hank-warren/pi-auto-permissions 0.21.0 → 0.22.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @hank-warren/pi-auto-permissions
 
+## 0.22.0
+
+### Minor Changes
+
+- Opt-in `remoteAnswers`: announce open approval prompts on `auto-permissions:prompt` and accept an answer for one on `auto-permissions:answer`, so another extension can relay a prompt to another device. Off by default; nothing is emitted or accepted until it is set.
+
 ## 0.21.0
 
 ### Minor Changes

package/README.md

@@ -430,6 +430,20 @@ When the environment variable `HERDR_ENV` is set to exactly `1`, the extension a
 
 This is an optional integration and nothing needs to be configured to use it. Outside Herdr the variable is unset, the emit is skipped entirely, and every other feature behaves identically; the extension has no dependency on Herdr being installed.
 
+### Answering a prompt from another device
+
+Off by default. Set `"remoteAnswers": true` to let another extension relay an open approval prompt elsewhere, such as to your phone, and answer it from there. Nothing changes until you do: with the setting off, no event is sent and every answer is ignored.
+
+With it on:
+
+- **When a prompt opens**, the extension emits `auto-permissions:prompt` on `pi.events`: `{ active: true, id, gate, header, command, noteLabel, note, options, cwd, sessionId, openedAt }`.
+- **When it settles**, it emits `{ active: false, id, choice?, remote }`. `choice` is absent when the prompt was cancelled; `remote` says whether the answer came from the event.
+- **To answer**, emit `auto-permissions:answer` with `{ id, choice }`. The answer is honoured only while that prompt is still open, and only with one of the `options` it announced. It settles the prompt exactly as the matching keypress would, including the override evidence and the evaluation log.
+- **The terminal prompt stays live.** Whichever answer comes first wins, and a later one is ignored.
+- **Subagent prompts are not announced.** They are rendered by the parent session (RPC mode), which owns answering them.
+
+The events stay inside the pi process; how a relay reaches another device, and who may answer there, is that extension's job. Only enable this with a relay you trust: any extension that can emit the answer event can approve a prompt.
+
 ## Trusted groups
 
 In a trusted project, create `.pi/trusted-ops` to bypass selected rule groups:

package/config.ts

@@ -80,6 +80,12 @@ export interface AutoPermissionsConfig {
    * `classifyAllShell` — full coverage for one guardian call per command.
    */
   reviewAllShell: boolean;
+  /**
+   * Announce open approval prompts on pi's event bus (`auto-permissions:prompt`) and accept
+   * an answer for one from another extension (`auto-permissions:answer`), for relaying a
+   * prompt to another device. Default false: nothing is emitted or accepted.
+   */
+  remoteAnswers: boolean;
   /**
    * How many guardian reviews may run at once when several guarded commands
    * are pending together (parallel tool calls, codemode scripts). Verdicts are
@@ -339,6 +345,7 @@ export function loadAutoPermissionsConfig(path = autoPermissionsConfigPath()): A
   const raw = readObject(path);
   optionalBoolean(raw.enabled, "enabled");
   optionalBoolean(raw.reviewAllShell, "reviewAllShell");
+  optionalBoolean(raw.remoteAnswers, "remoteAnswers");
   if (raw.rules !== undefined && !Array.isArray(raw.rules)) throw new Error("rules must be an array");
   // Absent means the built-in ruleset is active; an authored array replaces it
   // entirely unless it splices "$defaults" back in; an explicit [] gates
@@ -357,6 +364,7 @@ export function loadAutoPermissionsConfig(path = autoPermissionsConfigPath()): A
     denialLog: resolveSidecar(raw, "denialLog", "denials.jsonl", true, path),
     rules,
     reviewAllShell: raw.reviewAllShell === true,
+    remoteAnswers: raw.remoteAnswers === true,
     reviewConcurrency: boundedInteger(
       raw.reviewConcurrency,
       DEFAULT_REVIEW_CONCURRENCY,

package/index.ts

@@ -21,6 +21,7 @@ import type { Gate } from "./gates.js";
 import { classifyCommand } from "./classify.js";
 import type { PermissionVerdict, ReviewEvidenceRecord } from "./review.js";
 import { promptSelect, setHerdrBlocked } from "./prompt-select.js";
+import { RemotePrompts, type RemotePromptHandle } from "./remote-answers.js";
 import { createReviewDisplay } from "./review-display.js";
 import { createSessionOverrides } from "./session-overrides.js";
 import { createGuardianReviewer } from "./guardian-reviewer.js";
@@ -193,6 +194,9 @@ function assistantToolCalls(message: unknown): AssistantToolCall[] {
 
 export default function autoPermissionsExtension(pi: ExtensionAPI) {
   const overrides = createSessionOverrides(pi);
+  // Opt-in (`remoteAnswers`); with it off no prompt registers, so answers are ignored.
+  const remotePrompts = new RemotePrompts(pi);
+  remotePrompts.listen();
   let trustedGroups = new Set<string>();
   // Set per session: a subagent child (PI_SUBAGENT_CHILD=1) revises before it
   // asks. `reviseFirst` maps each command it was told to revise to the turn
@@ -457,22 +461,32 @@ export default function autoPermissionsExtension(pi: ExtensionAPI) {
 
     const evaluationContext = config.evaluationLog.enabled ? reviewer.collectEvidence(scope) : [];
     setHerdrBlocked(pi, true, gate.label);
+    const content = {
+      header: `${gate.label} — Auto Permissions needs approval`,
+      command,
+      noteLabel: decisionSource === "guardian" ? "Guardian" : "Review failed",
+      note: detail,
+      inTranscript: scope.target.scriptToolCallId === undefined,
+    };
+    const options = permissionPromptOptions(config.evaluationLog.enabled);
+    // RPC prompts render in another process (a subagent's parent), which owns answering them.
+    let remote: RemotePromptHandle | undefined;
+    if (config.remoteAnswers && ctx.mode !== "rpc") {
+      remote = remotePrompts.begin({
+        gate: gate.label,
+        header: content.header,
+        command,
+        noteLabel: content.noteLabel,
+        note: detail,
+        options,
+        cwd: ctx.cwd,
+        sessionId: ctx.sessionManager.getSessionId(),
+      });
+    }
+    let choice: string | undefined;
     try {
-      let choice: string | undefined;
       try {
-        choice = await promptSelect(
-          pi,
-          ctx,
-          {
-            header: `${gate.label} — Auto Permissions needs approval`,
-            command,
-            noteLabel: decisionSource === "guardian" ? "Guardian" : "Review failed",
-            note: detail,
-            inTranscript: scope.target.scriptToolCallId === undefined,
-          },
-          permissionPromptOptions(config.evaluationLog.enabled),
-          promptSignal,
-        );
+        choice = await promptSelect(pi, ctx, content, options, promptSignal, remote?.attach);
       } catch (error) {
         if (!lifecycleStale() && !reviewCancelled(signal)) throw error;
         if (!lifecycleStale()) discardLineageIfTurnCancelled(scope);
@@ -502,6 +516,7 @@ export default function autoPermissionsExtension(pi: ExtensionAPI) {
         block: "Blocked by user",
       });
     } finally {
+      remote?.close(choice);
       if (!lifecycleStale()) setHerdrBlocked(pi, false);
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hank-warren/pi-auto-permissions",
-  "version": "0.21.0",
+  "version": "0.22.0",
   "description": "Fork of @ogulcancelik/pi-auto-permissions with dialog-answer user evidence: context-aware Bash permissions for Pi with automated guardian review.",
   "type": "module",
   "keywords": [
@@ -62,6 +62,7 @@
     "widget-status.ts",
     "classify.ts",
     "prompt-select.ts",
+    "remote-answers.ts",
     "approval-prompt.ts",
     "review-display.ts",
     "review-scope.ts",

package/prompt-select.ts

@@ -37,17 +37,21 @@ export function promptSelect(
   content: ApprovalPromptContent,
   values: string[],
   signal: AbortSignal,
+  /** Receives a function that settles this prompt with a choice, as a keypress would (remote answers). */
+  onAnswerable?: (answer: (choice: string) => boolean) => void,
 ): Promise<string | undefined> {
   if (ctx.mode === "rpc") return ctx.ui.select(approvalPromptText(content), values, { signal });
   return ctx.ui.custom<string | undefined>((tui, theme, _keybindings, done) => {
     let finished = false;
     const onAbort = () => finish(undefined);
-    const finish = (result: string | undefined) => {
-      if (finished) return;
+    const finish = (result: string | undefined): boolean => {
+      if (finished) return false;
       finished = true;
       signal.removeEventListener("abort", onAbort);
       done(result);
+      return true;
     };
+    onAnswerable?.((choice) => finish(choice));
     const selector = new OptionSelector({
       options: values.map((value) => ({ value, label: value })),
       allowComment: true,

package/remote-answers.ts

@@ -0,0 +1,115 @@
+import { randomUUID } from "node:crypto";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+
+/**
+ * Remote answers: opt-in (`"remoteAnswers": true`), off by default.
+ *
+ * While an approval prompt is open, it is announced on pi's event bus, and another
+ * extension in the same pi process may answer it — for example one that relays the
+ * prompt to the user's phone. The terminal prompt is unchanged and stays live: whichever
+ * answer comes first settles it, through the same path as a keypress.
+ *
+ * Off, nothing is emitted and every answer is ignored, because no prompt is ever
+ * registered. An answer is honoured only for a prompt that is open right now, by its
+ * id, and only with one of the options that prompt offers; everything else is dropped.
+ */
+
+/** Emitted when a prompt opens (`active: true`) and when it settles (`active: false`). */
+export const PROMPT_EVENT = "auto-permissions:prompt";
+/** Listened on: `{ id, choice }` answers the open prompt `id` with `choice`. */
+export const ANSWER_EVENT = "auto-permissions:answer";
+
+export interface RemotePromptOpened {
+  active: true;
+  /** Unique per prompt; an answer must name it. */
+  id: string;
+  gate: string;
+  header: string;
+  command: string;
+  noteLabel: string;
+  note: string;
+  /** The options exactly as the prompt offers them, in order. */
+  options: string[];
+  cwd: string;
+  sessionId?: string;
+  openedAt: number;
+}
+
+export interface RemotePromptClosed {
+  active: false;
+  id: string;
+  /** The option picked, or undefined when the prompt was cancelled (Esc, abort, shutdown). */
+  choice?: string;
+  /** True when the choice came through ANSWER_EVENT rather than the terminal. */
+  remote: boolean;
+}
+
+export interface RemoteAnswer {
+  id: string;
+  choice: string;
+}
+
+interface OpenPrompt {
+  options: readonly string[];
+  answer?: (choice: string) => boolean;
+  remote: boolean;
+}
+
+/** A registered prompt: `attach` receives the prompt's answer function, `close` announces the outcome. */
+export interface RemotePromptHandle {
+  id: string;
+  /** `answer` settles the prompt with a choice and returns false when it had already settled. */
+  attach(answer: (choice: string) => boolean): void;
+  close(choice: string | undefined): void;
+}
+
+export class RemotePrompts {
+  private readonly open = new Map<string, OpenPrompt>();
+
+  constructor(private readonly pi: ExtensionAPI) {}
+
+  /** Subscribe to ANSWER_EVENT. Inert while no prompt is registered. */
+  listen(): () => void {
+    return this.pi.events.on(ANSWER_EVENT, (data) => {
+      this.answer(data);
+    });
+  }
+
+  /** Register an open prompt and announce it. */
+  begin(prompt: Omit<RemotePromptOpened, "active" | "id" | "openedAt">): RemotePromptHandle {
+    const id = randomUUID();
+    const entry: OpenPrompt = { options: [...prompt.options], remote: false };
+    this.open.set(id, entry);
+    this.emit({ active: true, id, ...prompt, options: [...prompt.options], openedAt: Date.now() } satisfies RemotePromptOpened);
+    return {
+      id,
+      attach: (answer) => {
+        entry.answer = answer;
+      },
+      close: (choice) => {
+        if (!this.open.delete(id)) return;
+        this.emit({ active: false, id, ...(choice === undefined ? {} : { choice }), remote: entry.remote } satisfies RemotePromptClosed);
+      },
+    };
+  }
+
+  /** Apply an answer; true when it settled an open prompt. */
+  answer(data: unknown): boolean {
+    if (!data || typeof data !== "object") return false;
+    const { id, choice } = data as Partial<RemoteAnswer>;
+    if (typeof id !== "string" || typeof choice !== "string") return false;
+    const entry = this.open.get(id);
+    if (!entry?.answer || !entry.options.includes(choice)) return false;
+    if (!entry.answer(choice)) return false;
+    entry.remote = true;
+    return true;
+  }
+
+  private emit(payload: RemotePromptOpened | RemotePromptClosed): void {
+    try {
+      this.pi.events.emit(PROMPT_EVENT, payload);
+    } catch {
+      // A listener's failure must never break the approval flow.
+    }
+  }
+}