@hank-warren/pi-auto-permissions 0.8.0 → 0.10.0

package/CHANGELOG.md

@@ -1,5 +1,38 @@
 # @hank-warren/pi-auto-permissions
 
+## 0.10.0
+
+### Minor Changes
+
+- 0e9400e: Remove the built-in `openai-codex-auto-permissions` provider. Additional logins are now the job of `@hank-warren/pi-multi-login`, which adopts the existing credential on first run, so an existing `reviewer.provider` config keeps resolving with no edit.
+
+  Without that package installed the reviewer provider is missing; session start now warns once naming the provider instead of leaving the first guarded command to fail with a bare "review model not found".
+
+## 0.9.0
+
+### Minor Changes
+
+- 7d96995: Stop `pi-herdr-auto-title` depending on `pi-auto-permissions`.
+
+  The pane-title extension deep-imported `guardian-transport.ts` — roughly forty lines resolving `completeSimple` through the host `ModelRuntime` so provider extensions (Anthropic OAuth shaping) apply to background model calls. Reusing it cost an entire dependency on the permissions engine: 125 kB unpacked in `node_modules`, a transitive `pi-permission-selector`, and a no-op release of the title extension every time the guardian shipped.
+
+  The file is now duplicated byte-for-byte into both packages, and `scripts/validate.py` fails if the copies drift. `pi-herdr-auto-title` declares no dependencies at all and its tarball is unchanged apart from the added source file.
+
+  To keep the copies identical, `resolveGuardianCompleteSimple` takes the calling package's name as a second argument and uses it in the compat-fallback warning, replacing the hardcoded `[pi-auto-permissions]` prefix. That is a breaking change only for an external deep import of `@hank-warren/pi-auto-permissions/guardian-transport.ts`; the extension's own behavior is unchanged.
+
+### Patch Changes
+
+- 7d96995: Make every declared dependency accurate.
+
+  `pi-permission-selector` no longer declares a `@earendil-works/pi-coding-agent` peer dependency. It imports nothing from it — the claim was left over from 1.0.0, which removed the extension and the selector monkey patch and turned the package into a pure library.
+
+  `pi-auto-permissions` floors `@hank-warren/pi-permission-selector` at `^1.1.0` and `pi-plan-mode` floors `@narumitw/pi-tui-kit` at `^0.49.3`, in both cases the lowest version the package is actually tested against. Neither uses a feature the old floor lacked, so nothing changes at install time under caret resolution; the ranges simply no longer claim support that nothing verifies.
+
+  `scripts/validate.py` now enforces that a package's Pi `peerDependencies` are exactly the Pi packages its shipped sources import, in both directions.
+
+- Updated dependencies [7d96995]
+  - @hank-warren/pi-permission-selector@1.1.1
+
 ## 0.8.0
 
 ### Minor Changes

package/README.md

@@ -116,10 +116,10 @@ Set `enabled` to `false` to disable the extension. Invalid configuration fails c
 
 By default, the guardian uses Pi's active model with low reasoning effort and a 30-second timeout. You can select a separate low-cost model.
 
-For OpenAI Codex, this package registers a second provider named **OpenAI Codex - Auto Permissions**. Pi keys OAuth credentials by provider id, so this provider can use a different ChatGPT account without replacing the normal `openai-codex` login used by your main agent.
+Giving the guardian its own account keeps reviews from competing with your interactive session for a subscription's rate limits. Pi keys OAuth credentials by provider id, so a second login needs a second provider id — which is what [`@hank-warren/pi-multi-login`](../pi-multi-login/README.md) exists to create. This package no longer registers one itself.
 
-1. Run `/login` and select **OpenAI Codex - Auto Permissions**.
-2. Complete OAuth with the account reserved for guardian reviews.
+1. `pi install npm:@hank-warren/pi-multi-login`
+2. Run `/multi-login`, add a login with base `openai-codex` and suffix `auto-permissions`, and complete OAuth with the account reserved for guardian reviews.
 3. Select the dedicated provider in the Auto Permissions config:
 
 ```json
@@ -133,7 +133,9 @@ For OpenAI Codex, this package registers a second provider named **OpenAI Codex
 }
 ```
 
-The separate credential is stored in Pi's normal `auth.json` under `openai-codex-auto-permissions`; the existing `openai-codex` credential is unchanged. The alias uses Pi's built-in OpenAI Codex OAuth flow, model catalog, and transport. Because it is a normal provider, its models also appear under the dedicated provider name in Pi's model selector after login.
+The separate credential is stored in Pi's normal `auth.json` under `openai-codex-auto-permissions`; the existing `openai-codex` credential is unchanged. The alias uses Pi's built-in OpenAI Codex OAuth flow, model catalog, and transport. Because it is a normal provider, its models also appear in Pi's model selector and in `/login` after login.
+
+If you already used the login this package registered in earlier versions, nothing changes: `pi-multi-login` adopts the existing `openai-codex-auto-permissions` credential on first run, so the config above keeps resolving. Without that package installed, the provider is missing and Auto Permissions warns once per session; point `reviewer.provider` at `openai-codex` (or any signed-in provider) to silence it.
 
 Other reviewer providers continue to work by setting their normal provider and model ids.
 

package/guardian-transport.ts

@@ -1,17 +1,17 @@
 import { completeSimple } from "@earendil-works/pi-ai/compat";
 
 /**
- * Guardian model dispatch seam.
+ * Model dispatch seam for extension-issued background model calls.
  *
  * pi-ai's `compat.completeSimple` dispatches through pi-ai's own api registry,
  * which extension-registered provider transports never reach: pi routes
  * `pi.registerProvider()` configs only through the coding agent's
  * `ModelRuntime` -> `provider-composer.streamWith`. Auth-shaping extensions
  * such as `@gotgenes/pi-anthropic-auth` install their transport wrapper there,
- * so a reviewer request issued via `compat.completeSimple` reaches Anthropic
- * unshaped, and Claude Pro/Max OAuth requests fail with the misleading
- * "extra usage" HTTP 400 (see gotgenes/pi-anthropic-auth
- * docs/architecture.md, "The remaining gap: pi-ai compat dispatch").
+ * so a request issued via `compat.completeSimple` reaches Anthropic unshaped,
+ * and Claude Pro/Max OAuth requests fail with the misleading "extra usage"
+ * HTTP 400 (see gotgenes/pi-anthropic-auth docs/architecture.md, "The
+ * remaining gap: pi-ai compat dispatch").
  *
  * `ExtensionContext.modelRegistry` is a deliberately narrowed facade over
  * `ModelRuntime` that re-exports `complete()` but not `completeSimple()` —
@@ -21,12 +21,24 @@ import { completeSimple } from "@earendil-works/pi-ai/compat";
  * marked `private` in the .d.ts), and fall back to compat dispatch when a
  * future pi release renames the seam — degrading to the historical behavior
  * instead of crashing.
+ *
+ * THIS FILE IS DUPLICATED VERBATIM across packages/pi-auto-permissions and
+ * packages/pi-herdr-auto-title, and `scripts/validate.py` fails if the copies
+ * differ by a single byte. The duplication is deliberate: sharing it made a
+ * pane-titling extension depend on an entire permissions engine to reuse a
+ * dozen lines. Edit one copy, then copy it over the other. Every
+ * package-specific detail must stay behind a parameter — hence `packageLabel`.
+ * The "guardian" in the names is historical: pi-auto-permissions' guardian
+ * reviewer was the first caller.
  */
 export type GuardianCompleteSimple = typeof completeSimple;
 
 let warnedCompatFallback = false;
 
-export function resolveGuardianCompleteSimple(modelRegistry: unknown): GuardianCompleteSimple {
+export function resolveGuardianCompleteSimple(
+  modelRegistry: unknown,
+  packageLabel: string,
+): GuardianCompleteSimple {
   const runtime = (modelRegistry as { runtime?: unknown } | null | undefined)?.runtime;
   const candidate = (runtime as { completeSimple?: unknown } | null | undefined)?.completeSimple;
   if (typeof candidate === "function") {
@@ -35,7 +47,7 @@ export function resolveGuardianCompleteSimple(modelRegistry: unknown): GuardianC
   if (!warnedCompatFallback) {
     warnedCompatFallback = true;
     console.warn(
-      "[pi-auto-permissions] host ModelRuntime completeSimple is unavailable; falling back to pi-ai compat dispatch. Extension-registered provider transports (e.g. Anthropic OAuth shaping) will not apply to reviewer calls.",
+      `[${packageLabel}] host ModelRuntime completeSimple is unavailable; falling back to pi-ai compat dispatch. Extension-registered provider transports (e.g. Anthropic OAuth shaping) will not apply to this extension's model calls.`,
     );
   }
   return completeSimple;

package/index.ts

@@ -1,9 +1,6 @@
 import { cleanupSessionResources, type Message } from "@earendil-works/pi-ai";
 import { resolveGuardianCompleteSimple } from "./guardian-transport.js";
-import {
-  createAutoPermissionsOpenAICodexProvider,
-  isOpenAICodexModel,
-} from "./openai-codex-provider.js";
+import { isOpenAICodexModel } from "./openai-codex-transport.js";
 import { detectSubagentContext } from "./subagent-context.js";
 import * as PiCodingAgent from "@earendil-works/pi-coding-agent";
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
@@ -272,6 +269,29 @@ export default function autoPermissionsExtension(pi: ExtensionAPI) {
     }
   }
 
+  /**
+   * The dedicated `openai-codex-auto-permissions` login used to be registered
+   * here. It now belongs to @hank-warren/pi-multi-login, which adopts the
+   * existing credential, so an existing reviewer config keeps working — but only
+   * if that package is installed. Say so once per session instead of letting the
+   * first guarded command fail with a bare "review model not found".
+   */
+  function warnAboutMissingReviewerProvider(ctx: ExtensionContext): void {
+    let provider: string | undefined;
+    try {
+      provider = currentConfig(ctx).reviewer?.provider;
+    } catch {
+      return; // The config error was already reported by currentConfig().
+    }
+    if (!provider || ctx.modelRegistry.getProvider(provider)) return;
+
+    const message =
+      `reviewer provider "${provider}" is not registered. Install @hank-warren/pi-multi-login to` +
+      ` provide additional logins such as this one, or point reviewer.provider at a signed-in provider.`;
+    console.warn(`[pi-auto-permissions] ${message}`);
+    ctx.ui.notify(`Auto Permissions: ${message}`, "warning");
+  }
+
   async function reviewCommand(
     gate: Gate,
     toolName: string,
@@ -383,7 +403,7 @@ export default function autoPermissionsExtension(pi: ExtensionAPI) {
       }
       // Dispatch through the host ModelRuntime so extension-registered provider
       // transports (e.g. pi-anthropic-auth OAuth shaping) apply; see guardian-transport.ts.
-      const response = await resolveGuardianCompleteSimple(ctx.modelRegistry)(
+      const response = await resolveGuardianCompleteSimple(ctx.modelRegistry, "pi-auto-permissions")(
         model,
         { systemPrompt, messages },
         {
@@ -997,12 +1017,7 @@ export default function autoPermissionsExtension(pi: ExtensionAPI) {
   });
 
   pi.on("session_start", async (_event, ctx) => {
-    const openaiCodex = ctx.modelRegistry.getProvider("openai-codex");
-    if (openaiCodex?.auth.oauth) {
-      pi.registerProvider(createAutoPermissionsOpenAICodexProvider(openaiCodex));
-    } else {
-      console.warn("[pi-auto-permissions] OpenAI Codex OAuth is unavailable; the dedicated Auto Permissions login was not registered.");
-    }
+    warnAboutMissingReviewerProvider(ctx);
 
     reviewerLifecycleController.abort();
     discardReviewerLineage();

package/openai-codex-transport.ts

@@ -0,0 +1,9 @@
+/**
+ * Codex models are reached over a websocket session rather than plain HTTP, and
+ * the guardian has to pick that transport itself. The check is on the model's
+ * api rather than its provider id so it keeps working for a reviewer pointed at
+ * an aliased Codex login (see @hank-warren/pi-multi-login).
+ */
+export function isOpenAICodexModel(model: { api?: string }): boolean {
+  return model.api === "openai-codex-responses";
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hank-warren/pi-auto-permissions",
-  "version": "0.8.0",
+  "version": "0.10.0",
   "description": "Fork of @ogulcancelik/pi-auto-permissions with dialog-answer user evidence: context-aware Bash permissions for Pi with automated guardian review.",
   "type": "module",
   "keywords": [
@@ -42,7 +42,7 @@
     "approval-pulse.ts",
     "config.ts",
     "guardian-transport.ts",
-    "openai-codex-provider.ts",
+    "openai-codex-transport.ts",
     "subagent-context.ts",
     "evaluation-log.ts",
     "gates.ts",
@@ -55,7 +55,7 @@
     "CHANGELOG.md"
   ],
   "dependencies": {
-    "@hank-warren/pi-permission-selector": "^1.0.1"
+    "@hank-warren/pi-permission-selector": "^1.1.1"
   },
   "peerDependencies": {
     "@earendil-works/pi-ai": "*",

package/openai-codex-provider.ts

@@ -1,42 +0,0 @@
-import type { Provider } from "@earendil-works/pi-ai";
-
-export const AUTO_PERMISSIONS_OPENAI_CODEX_PROVIDER_ID = "openai-codex-auto-permissions";
-export const AUTO_PERMISSIONS_OPENAI_CODEX_PROVIDER_NAME = "OpenAI Codex - Auto Permissions";
-
-/**
- * Registering a second provider id gives Pi a second auth.json credential slot.
- * The transport and model catalog still come from Pi's built-in OpenAI Codex
- * provider, so the alias follows the host Pi version instead of duplicating its
- * OAuth or Responses implementation here. The effective catalog is snapshotted
- * when the session starts; the source provider remains the sole owner of any
- * dynamic catalog refresh state.
- */
-export function createAutoPermissionsOpenAICodexProvider(source: Provider): Provider {
-  const models = source.getModels().map((model) => ({
-    ...model,
-    provider: AUTO_PERMISSIONS_OPENAI_CODEX_PROVIDER_ID,
-  }));
-  const oauth = source.auth.oauth;
-
-  if (!oauth) {
-    throw new Error("Pi's OpenAI Codex provider does not expose OAuth authentication");
-  }
-
-  return {
-    ...source,
-    id: AUTO_PERMISSIONS_OPENAI_CODEX_PROVIDER_ID,
-    name: AUTO_PERMISSIONS_OPENAI_CODEX_PROVIDER_NAME,
-    auth: {
-      oauth: {
-        ...oauth,
-        name: AUTO_PERMISSIONS_OPENAI_CODEX_PROVIDER_NAME,
-      },
-    },
-    getModels: () => models,
-    refreshModels: undefined,
-  };
-}
-
-export function isOpenAICodexModel(model: { api?: string }): boolean {
-  return model.api === "openai-codex-responses";
-}