@hank-warren/pi-auto-permissions 0.8.0 → 0.9.0

package/CHANGELOG.md

@@ -1,5 +1,30 @@
 # @hank-warren/pi-auto-permissions
 
+## 0.9.0
+
+### Minor Changes
+
+- 7d96995: Stop `pi-herdr-auto-title` depending on `pi-auto-permissions`.
+
+  The pane-title extension deep-imported `guardian-transport.ts` — roughly forty lines resolving `completeSimple` through the host `ModelRuntime` so provider extensions (Anthropic OAuth shaping) apply to background model calls. Reusing it cost an entire dependency on the permissions engine: 125 kB unpacked in `node_modules`, a transitive `pi-permission-selector`, and a no-op release of the title extension every time the guardian shipped.
+
+  The file is now duplicated byte-for-byte into both packages, and `scripts/validate.py` fails if the copies drift. `pi-herdr-auto-title` declares no dependencies at all and its tarball is unchanged apart from the added source file.
+
+  To keep the copies identical, `resolveGuardianCompleteSimple` takes the calling package's name as a second argument and uses it in the compat-fallback warning, replacing the hardcoded `[pi-auto-permissions]` prefix. That is a breaking change only for an external deep import of `@hank-warren/pi-auto-permissions/guardian-transport.ts`; the extension's own behavior is unchanged.
+
+### Patch Changes
+
+- 7d96995: Make every declared dependency accurate.
+
+  `pi-permission-selector` no longer declares a `@earendil-works/pi-coding-agent` peer dependency. It imports nothing from it — the claim was left over from 1.0.0, which removed the extension and the selector monkey patch and turned the package into a pure library.
+
+  `pi-auto-permissions` floors `@hank-warren/pi-permission-selector` at `^1.1.0` and `pi-plan-mode` floors `@narumitw/pi-tui-kit` at `^0.49.3`, in both cases the lowest version the package is actually tested against. Neither uses a feature the old floor lacked, so nothing changes at install time under caret resolution; the ranges simply no longer claim support that nothing verifies.
+
+  `scripts/validate.py` now enforces that a package's Pi `peerDependencies` are exactly the Pi packages its shipped sources import, in both directions.
+
+- Updated dependencies [7d96995]
+  - @hank-warren/pi-permission-selector@1.1.1
+
 ## 0.8.0
 
 ### Minor Changes

package/guardian-transport.ts

@@ -1,17 +1,17 @@
 import { completeSimple } from "@earendil-works/pi-ai/compat";
 
 /**
- * Guardian model dispatch seam.
+ * Model dispatch seam for extension-issued background model calls.
  *
  * pi-ai's `compat.completeSimple` dispatches through pi-ai's own api registry,
  * which extension-registered provider transports never reach: pi routes
  * `pi.registerProvider()` configs only through the coding agent's
  * `ModelRuntime` -> `provider-composer.streamWith`. Auth-shaping extensions
  * such as `@gotgenes/pi-anthropic-auth` install their transport wrapper there,
- * so a reviewer request issued via `compat.completeSimple` reaches Anthropic
- * unshaped, and Claude Pro/Max OAuth requests fail with the misleading
- * "extra usage" HTTP 400 (see gotgenes/pi-anthropic-auth
- * docs/architecture.md, "The remaining gap: pi-ai compat dispatch").
+ * so a request issued via `compat.completeSimple` reaches Anthropic unshaped,
+ * and Claude Pro/Max OAuth requests fail with the misleading "extra usage"
+ * HTTP 400 (see gotgenes/pi-anthropic-auth docs/architecture.md, "The
+ * remaining gap: pi-ai compat dispatch").
  *
  * `ExtensionContext.modelRegistry` is a deliberately narrowed facade over
  * `ModelRuntime` that re-exports `complete()` but not `completeSimple()` —
@@ -21,12 +21,24 @@ import { completeSimple } from "@earendil-works/pi-ai/compat";
  * marked `private` in the .d.ts), and fall back to compat dispatch when a
  * future pi release renames the seam — degrading to the historical behavior
  * instead of crashing.
+ *
+ * THIS FILE IS DUPLICATED VERBATIM across packages/pi-auto-permissions and
+ * packages/pi-herdr-auto-title, and `scripts/validate.py` fails if the copies
+ * differ by a single byte. The duplication is deliberate: sharing it made a
+ * pane-titling extension depend on an entire permissions engine to reuse a
+ * dozen lines. Edit one copy, then copy it over the other. Every
+ * package-specific detail must stay behind a parameter — hence `packageLabel`.
+ * The "guardian" in the names is historical: pi-auto-permissions' guardian
+ * reviewer was the first caller.
  */
 export type GuardianCompleteSimple = typeof completeSimple;
 
 let warnedCompatFallback = false;
 
-export function resolveGuardianCompleteSimple(modelRegistry: unknown): GuardianCompleteSimple {
+export function resolveGuardianCompleteSimple(
+  modelRegistry: unknown,
+  packageLabel: string,
+): GuardianCompleteSimple {
   const runtime = (modelRegistry as { runtime?: unknown } | null | undefined)?.runtime;
   const candidate = (runtime as { completeSimple?: unknown } | null | undefined)?.completeSimple;
   if (typeof candidate === "function") {
@@ -35,7 +47,7 @@ export function resolveGuardianCompleteSimple(modelRegistry: unknown): GuardianC
   if (!warnedCompatFallback) {
     warnedCompatFallback = true;
     console.warn(
-      "[pi-auto-permissions] host ModelRuntime completeSimple is unavailable; falling back to pi-ai compat dispatch. Extension-registered provider transports (e.g. Anthropic OAuth shaping) will not apply to reviewer calls.",
+      `[${packageLabel}] host ModelRuntime completeSimple is unavailable; falling back to pi-ai compat dispatch. Extension-registered provider transports (e.g. Anthropic OAuth shaping) will not apply to this extension's model calls.`,
     );
   }
   return completeSimple;

package/index.ts

@@ -383,7 +383,7 @@ export default function autoPermissionsExtension(pi: ExtensionAPI) {
       }
       // Dispatch through the host ModelRuntime so extension-registered provider
       // transports (e.g. pi-anthropic-auth OAuth shaping) apply; see guardian-transport.ts.
-      const response = await resolveGuardianCompleteSimple(ctx.modelRegistry)(
+      const response = await resolveGuardianCompleteSimple(ctx.modelRegistry, "pi-auto-permissions")(
         model,
         { systemPrompt, messages },
         {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hank-warren/pi-auto-permissions",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Fork of @ogulcancelik/pi-auto-permissions with dialog-answer user evidence: context-aware Bash permissions for Pi with automated guardian review.",
   "type": "module",
   "keywords": [
@@ -55,7 +55,7 @@
     "CHANGELOG.md"
   ],
   "dependencies": {
-    "@hank-warren/pi-permission-selector": "^1.0.1"
+    "@hank-warren/pi-permission-selector": "^1.1.1"
   },
   "peerDependencies": {
     "@earendil-works/pi-ai": "*",