@huseynsnmz/pi-modes 0.2.1 → 0.2.2

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## [0.2.2]
+
+### Changed
+
+- With `pi-sandbox` installed, yolo only runs inside the sandbox and always keeps deny rules on.
+
+### Added
+
+- The `review-permissions` skill lists what `pi-sandbox` blocked and adds your picks to `sandbox.json`.
+
 ## [0.2.1]
 
 ### Added

package/README.md

@@ -21,7 +21,7 @@ Requires Pi 1.5 or newer.
 1. Install it:
 
    ```bash
-   pi install npm:@huseynsnmz/pi-modes@0.2.1
+   pi install npm:@huseynsnmz/pi-modes@0.2.2
    ```
 
 2. Move it above `@gotgenes/pi-permission-system`, because `pi install` adds packages last. Otherwise, in `plan` and `read-only` you may be asked to approve an action that is then blocked anyway. It stays blocked either way, and the extension warns you at startup. Skip this step if you don't use that package.
@@ -71,6 +71,7 @@ jq '.authorizerChain = ((.authorizerChain // []) + ["pi-modes"] | unique)' "$f"
 What it does and doesn't cover:
 
 - **`deny` rules still block, unless you choose otherwise.** A link only answers questions the rules left open. In the warning, `d` turns them off for this run. The agent then gets separate tools (`yolo_bash`, `yolo_read`, `yolo_write`, `yolo_edit`) that your rules don't name, and the footer says `deny rules off`. Other tools, like MCP, stay under the rules, and so do subagents. A top-level `"*": "deny"` still blocks these tools. Leaving yolo puts everything back.
+- **With `pi-sandbox`, yolo stays inside the sandbox.** Deny rules can't be turned off, because the tools that ignore them would run outside it. Yolo won't start with the sandbox off, and if you turn the sandbox off during yolo, the next tool call is blocked and you're back in `normal`. Load `pi-modes` first in `packages`, or yolo is refused. `pi-sandbox`'s own prompts still appear in yolo, and Enter on one picks "Allow for this session".
 - **Subagents are covered.** Their prompts come to your session, and yolo answers them.
 - **Access outside the project can still ask.** The permission system doesn't let any link approve its `external_directory` and `path` surfaces. To stop those prompts too, set those rules to `allow` yourself. That applies in every mode.
 - **The review log says who approved.** Approvals are recorded under the link name `pi-modes`.
@@ -87,6 +88,8 @@ The package includes a skill that turns repeated approvals into allowlist rules.
 
 It reads the permission system's review log and your past chats, and groups what you approved and what ran. The agent rates each group and shows you the list, and only the rules you pick are added. The scripts refuse rules that are too broad, such as `git *`, or that cover `git push`, `rm`, `curl` or an interpreter like `python`. They back up the config first and place new rules so that your `deny` rules still win. What ran in `yolo` is ignored, and so are commands that look like they hold a secret.
 
+With `pi-sandbox`, it also lists the paths and domains the sandbox blocked. What you pick goes in `~/.pi/agent/sandbox.json`. It refuses credential folders, whole home folders, and places where a written file runs later, such as shell profiles and git hooks.
+
 ## How plan mode ends
 
 In plan mode the agent calls the `submit_plan` tool. You then choose one of:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@huseynsnmz/pi-modes",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Shift+Tab permission modes for Pi: normal, auto, plan, read-only and yolo",
   "type": "module",
   "license": "MIT",

package/skills/review-permissions/SKILL.md

@@ -33,6 +33,16 @@ Give each candidate one rating. Read the examples, not only the pattern. The sug
   - reads secrets
   - a pattern so broad it covers these, like `git *` or `npm *`
 
+### What the sandbox blocked
+
+If `pi-sandbox` is in use, `sandbox.candidates` lists what it blocked, each a `read` path, a `write` path or a `domain`, with how often. These blocks may be the sandbox doing its job, so being blocked often is no reason to allow something. Rate them the same way:
+
+- **Recommend:** a folder or domain the user's normal work needs, such as a package registry or a sibling project to read.
+- **Your call:** write access outside the project, or a domain that accepts uploads. Any domain the sandbox allows can receive data, so say so.
+- **Don't add:** credentials, a whole home folder, paste or file-sharing sites, and anything you can't connect to the work.
+
+`sandbox.osBlocks` counts commands the OS stopped, with some of their errors in `sandbox.osExamples`. Some may be failures that have nothing to do with the sandbox. Mention the count, and if an example names a folder worth allowing, rate it like the others.
+
 ## 3. Present
 
 Show a table with the pattern, the rating, the approval count and a one-line reason. Group by rating. Mention each `Don't add` item with its reason, so the user sees it was considered.
@@ -45,6 +55,8 @@ Ask which rules to add, and wait for the answer. Then pass exactly those:
 node <skill-dir>/scripts/apply.mjs --bash 'npm test*' --bash 'git diff*' --tool 'grep'
 ```
 
+Sandbox choices go in the same way, with `--sandbox-read PATH`, `--sandbox-write PATH` and `--sandbox-domain DOMAIN`, and land in Pi's `sandbox.json`.
+
 The script keeps a backup next to the config, refuses unsafe patterns, and places new rules so that existing `deny` and `ask` rules keep winning. If it refuses a pattern, explain why instead of editing the config by hand.
 
 ## 5. Finish

package/skills/review-permissions/scripts/apply.mjs

@@ -65,32 +65,103 @@ export function applyRules(config, { bash = [], tools = [] }) {
   return { config: { ...config, permission }, refusals: [] };
 }
 
+const CREDENTIALS = /(?:^|\/)(?:\.ssh|\.aws|\.gnupg|\.kube|\.docker|\.netrc|\.npmrc|\.pgpass|\.git-credentials|\.pi|\.claude|\.codex|\.elfie|\.config\/gh|\.config\/gcloud|auth\.json|credentials(?:\.\w+)?|\.env(?:\.[^/]*)?)(?:\/|$)|\.(?:pem|key|p12|pfx)$|(?:^|\/)id_[a-z0-9]+$/i;
+const RUNS_LATER = /(?:^|\/)(?:\.git\/hooks|\.git\/config|\.zshrc|\.zshenv|\.zprofile|\.bashrc|\.bash_profile|\.profile|\.gitconfig|Library\/LaunchAgents|\.config\/autostart)(?:\/|$)/;
+
+/** Why a sandbox path must not be allowed, or undefined when it may be. */
+export function refuseSandboxPath(kind, path, home = homedir()) {
+  const text = path.trim().replace(/(.)\/+$/, "$1");
+  if (text === "" || text === "/" || text === "~" || text === home || text === "/Users" || text === "/home" || /[*?[]/.test(text) || text.split("/").includes("..")) return "it covers far more than one folder, so name the folder";
+  if (CREDENTIALS.test(text)) return "this holds credentials";
+  if (kind === "write" && RUNS_LATER.test(text)) return "whatever is written here runs later, outside the sandbox";
+  return undefined;
+}
+
+export function refuseDomain(domain) {
+  const text = domain.trim().replace(/^\*\./, "");
+  if (!/^[a-z0-9-]+(?:\.[a-z0-9-]+)+$/i.test(text)) return "it isn't a single domain";
+  return undefined;
+}
+
+/** pi-sandbox 0.7.3's defaults. They stop applying once a list is set, so a new list starts from them. */
+const SANDBOX_DEFAULTS = {
+  read: [".", "~/.config", "~/.local", "Library"],
+  write: [".", "/tmp"],
+  domain: ["npmjs.org", "*.npmjs.org", "registry.npmjs.org", "registry.yarnpkg.com", "pypi.org", "*.pypi.org", "github.com", "*.github.com", "api.github.com", "raw.githubusercontent.com"],
+};
+
+export function applySandbox(config, { read = [], write = [], domains = [] }) {
+  const refusals = [
+    ...read.flatMap((path) => [refuseSandboxPath("read", path)].filter(Boolean).map((why) => `${path}: ${why}`)),
+    ...write.flatMap((path) => [refuseSandboxPath("write", path)].filter(Boolean).map((why) => `${path}: ${why}`)),
+    ...domains.flatMap((domain) => [refuseDomain(domain)].filter(Boolean).map((why) => `${domain}: ${why}`)),
+  ];
+  if (refusals.length > 0) return { refusals };
+  const add = (existing, kind, fresh) => (fresh.length === 0 ? existing : [...new Set([...(existing ?? SANDBOX_DEFAULTS[kind]), ...fresh])]);
+  const filesystem = { ...config.filesystem };
+  const network = { ...config.network };
+  const allowRead = add(filesystem.allowRead, "read", read);
+  const allowWrite = add(filesystem.allowWrite, "write", write);
+  const allowedDomains = add(network.allowedDomains, "domain", domains);
+  if (allowRead !== undefined) filesystem.allowRead = allowRead;
+  if (allowWrite !== undefined) filesystem.allowWrite = allowWrite;
+  if (allowedDomains !== undefined) network.allowedDomains = allowedDomains;
+  return { config: { ...config, filesystem, network }, refusals: [] };
+}
+
+function writeWithBackup(path, config) {
+  let backup;
+  if (existsSync(path)) {
+    backup = `${path}.bak-${new Date().toISOString().replace(/[:.]/g, "-")}`;
+    copyFileSync(path, backup);
+  }
+  writeFileSync(`${path}.tmp`, `${JSON.stringify(config, null, 2)}\n`, { mode: 0o600 });
+  renameSync(`${path}.tmp`, path);
+  return backup;
+}
+
 if (import.meta.url === pathToFileURL(process.argv[1] ?? "").href) {
   const bash = [];
   const tools = [];
+  const read = [];
+  const write = [];
+  const domains = [];
   const args = process.argv.slice(2);
   for (let i = 0; i < args.length; i += 2) {
     if (args[i] === "--bash" && args[i + 1] !== undefined) bash.push(args[i + 1]);
     else if (args[i] === "--tool" && args[i + 1] !== undefined) tools.push(args[i + 1]);
+    else if (args[i] === "--sandbox-read" && args[i + 1] !== undefined) read.push(args[i + 1]);
+    else if (args[i] === "--sandbox-write" && args[i + 1] !== undefined) write.push(args[i + 1]);
+    else if (args[i] === "--sandbox-domain" && args[i + 1] !== undefined) domains.push(args[i + 1]);
     else {
-      console.error("usage: apply.mjs [--bash PATTERN]... [--tool NAME]...");
+      console.error("usage: apply.mjs [--bash PATTERN]... [--tool NAME]... [--sandbox-read PATH]... [--sandbox-write PATH]... [--sandbox-domain DOMAIN]...");
       process.exit(2);
     }
   }
   const agent = process.env.PI_CODING_AGENT_DIR ?? join(homedir(), ".pi", "agent");
-  const path = join(agent, "extensions", "pi-permission-system", "config.json");
-  if (!existsSync(path)) {
-    console.error(`No config at ${path}.`);
-    process.exit(1);
-  }
-  const result = applyRules(JSON.parse(readFileSync(path, "utf8")), { bash, tools });
-  if (result.refusals.length > 0) {
-    console.error(`Nothing was changed.\n${result.refusals.join("\n")}`);
+  const fail = (message) => {
+    console.error(`Nothing was changed.\n${message}`);
     process.exit(1);
+  };
+  const path = join(agent, "extensions", "pi-permission-system", "config.json");
+  const sandboxPath = join(agent, "sandbox.json");
+  const wantsRules = bash.length > 0 || tools.length > 0;
+  const wantsSandbox = read.length > 0 || write.length > 0 || domains.length > 0;
+  if (wantsRules && !existsSync(path)) fail(`No config at ${path}.`);
+  const rules = wantsRules ? applyRules(JSON.parse(readFileSync(path, "utf8")), { bash, tools }) : { refusals: [] };
+  let sandboxConfig = {};
+  if (wantsSandbox && existsSync(sandboxPath)) {
+    try {
+      sandboxConfig = JSON.parse(readFileSync(sandboxPath, "utf8"));
+    } catch {
+      fail(`${sandboxPath} isn't plain JSON, perhaps because of comments, and writing it back would lose them. Add these by hand.`);
+    }
   }
-  const backup = `${path}.bak-${new Date().toISOString().replace(/[:.]/g, "-")}`;
-  copyFileSync(path, backup);
-  writeFileSync(`${path}.tmp`, `${JSON.stringify(result.config, null, 2)}\n`, { mode: 0o600 });
-  renameSync(`${path}.tmp`, path);
-  console.log(JSON.stringify({ added: { bash, tools }, backup }, null, 2));
+  const sandbox = wantsSandbox ? applySandbox(sandboxConfig, { read, write, domains }) : { refusals: [] };
+  const refusals = [...rules.refusals, ...sandbox.refusals];
+  if (refusals.length > 0) fail(refusals.join("\n"));
+  const backups = [];
+  if (wantsRules) backups.push(writeWithBackup(path, rules.config));
+  if (wantsSandbox) backups.push(writeWithBackup(sandboxPath, sandbox.config));
+  console.log(JSON.stringify({ added: { bash, tools, read, write, domains }, backups: backups.filter(Boolean) }, null, 2));
 }

package/skills/review-permissions/scripts/collect.mjs

@@ -107,6 +107,62 @@ export function ranCommands(entries) {
   return commands;
 }
 
+const SANDBOX_BLOCKS = [
+  ["read", /^Sandbox: read access denied for "(.+)"$/],
+  ["write", /^Sandbox: write access denied for "(.+)" \(not in allowWrite\)$/],
+  ["domain", /^Network access to "(.+)" is blocked \(not in allowedDomains\)\.$/],
+];
+
+/**
+ * What pi-sandbox blocked, from one session's chat history. Paths in denyWrite are left out, since
+ * someone chose those. What the OS stopped has no clean path to allow, so it comes as examples.
+ */
+export function sandboxBlocks(entries) {
+  const blocks = [];
+  for (const entry of entries) {
+    if (entry.type !== "message" || entry.message?.role !== "toolResult" || !Array.isArray(entry.message.content)) continue;
+    const text = entry.message.content.map((part) => part.text ?? "").join("").trim();
+    if (entry.message.isError && entry.message.toolName === "bash" && text.includes("Operation not permitted")) {
+      const example = text.split("\n").find((line) => line.includes("Operation not permitted"));
+      blocks.push({ kind: "os", example, timestamp: entry.timestamp });
+    }
+    for (const [kind, shape] of SANDBOX_BLOCKS) {
+      const value = shape.exec(text)?.[1];
+      if (value !== undefined) blocks.push({ kind, value, timestamp: entry.timestamp });
+    }
+  }
+  return blocks;
+}
+
+/** Blocks grouped by what would have to be allowed, without what the config allows by now. */
+export function collectSandbox(blocks, config = {}) {
+  const allowed = {
+    read: config.filesystem?.allowRead ?? [],
+    write: config.filesystem?.allowWrite ?? [],
+    domain: config.network?.allowedDomains ?? [],
+  };
+  const groups = new Map();
+  let osBlocks = 0;
+  const osExamples = new Set();
+  let skipped = 0;
+  for (const { kind, value, example, timestamp } of blocks) {
+    if (kind === "os") {
+      osBlocks += 1;
+      if (osExamples.size < MAX_EXAMPLES && !SECRET.test(example)) osExamples.add(example.slice(0, 200));
+    } else if (SECRET.test(value)) skipped += 1;
+    else if (!allowed[kind].includes(value)) {
+      const group = groups.get(`${kind} ${value}`) ?? { kind, value, blocks: 0, days: new Set(), last: "" };
+      group.blocks += 1;
+      const at = String(timestamp ?? "");
+      if (at !== "") group.days.add(at.slice(0, 10));
+      if (at > group.last) group.last = at;
+      groups.set(`${kind} ${value}`, group);
+    }
+  }
+  const candidates = [...groups.values()].map((group) => ({ ...group, days: group.days.size })).sort((a, b) => b.blocks - a.blocks);
+  return { candidates, osBlocks, osExamples: [...osExamples], skipped };
+}
+
 function parseLog(text) {
   return text.split("\n").flatMap((line) => {
     try {
@@ -126,7 +182,16 @@ if (import.meta.url === pathToFileURL(process.argv[1] ?? "").href) {
   const permission = existsSync(configPath) ? (JSON.parse(readFileSync(configPath, "utf8")).permission ?? {}) : {};
   const sessions = join(agent, "sessions");
   const files = existsSync(sessions) ? readdirSync(sessions, { recursive: true }).map(String).filter((name) => name.endsWith(".jsonl")) : [];
-  const history = files.flatMap((name) => ranCommands(parseLog(readFileSync(join(sessions, name), "utf8"))));
+  const sessionEntries = files.map((name) => parseLog(readFileSync(join(sessions, name), "utf8")));
+  const history = sessionEntries.flatMap(ranCommands);
   const result = collect(logFound ? parseLog(readFileSync(logPath, "utf8")) : [], permission, history);
-  console.log(JSON.stringify({ logFound, ...result }, null, 2));
+  const sandboxPath = join(agent, "sandbox.json");
+  let sandboxConfig = {};
+  try {
+    if (existsSync(sandboxPath)) sandboxConfig = JSON.parse(readFileSync(sandboxPath, "utf8"));
+  } catch {
+    // Comments are allowed there. Already-allowed entries may show up, and apply won't add them twice.
+  }
+  const sandbox = collectSandbox(sessionEntries.flatMap(sandboxBlocks), sandboxConfig);
+  console.log(JSON.stringify({ logFound, ...result, sandbox }, null, 2));
 }

package/src/index.ts

@@ -3,6 +3,7 @@ import { join } from "node:path";
 import { type ExtensionAPI, type ExtensionContext, getAgentDir } from "@earendil-works/pi-coding-agent";
 import { isKeyRelease, matchesKey, Text, wrapTextWithAnsi } from "@earendil-works/pi-tui";
 import { Type } from "typebox";
+import { borrowStatusReader, loadsFirst, sandboxInstalled, sandboxIsOn, type StatusReader } from "./sandbox.ts";
 import { aliasDefinitions, DENY_OFF_PROMPT, withAliases, withoutAliases } from "./deny-off.ts";
 import { clearGate, hasPermissionSystem, installJudgeGate, JUDGE_NAMES, judgeGated, registerYoloLink, setGateMode, YOLO_LINK } from "./judge-gate.ts";
 import { decideToolCall, displayCommand, isMode, loadsAfterPermissionSystem, type Mode, MODES, modePrompt, nextMode, resumedMode, SUBMIT_PLAN_TOOL } from "./modes.ts";
@@ -32,7 +33,7 @@ function chainNamesJudge(): boolean {
  * Only Enter starts it, so no other key, like a stray y, can agree to it. Deny rules stay on
  * unless the user presses d. Undefined means cancelled.
  */
-async function confirmYolo(ctx: ExtensionContext, canIgnoreDeny: boolean): Promise<{ denyOff: boolean } | undefined> {
+async function confirmYolo(ctx: ExtensionContext, canIgnoreDeny: boolean, sandboxed: boolean): Promise<{ denyOff: boolean } | undefined> {
   let denyOff = false;
   const agreed = await ctx.ui.custom<boolean>((tui, theme, _keys, done) => ({
     invalidate() {},
@@ -55,7 +56,7 @@ async function confirmYolo(ctx: ExtensionContext, canIgnoreDeny: boolean): Promi
         "",
         denyOff
           ? red(theme.bold("Deny rules: IGNORED for bash, read, write and edit. Secrets you protected can be read."))
-          : `Deny rules: ${theme.bold("respected")}`,
+          : `Deny rules: ${theme.bold("respected")}${sandboxed ? `, and everything stays inside the ${theme.bold("sandbox")}` : ""}`,
         "",
         `${red(theme.bold("Enter"))} start   ${canIgnoreDeny ? `${theme.fg("dim", denyOff ? "d respect deny rules" : "d ignore deny rules")}   ` : ""}${theme.fg("dim", "Esc cancel")}`,
       ];
@@ -73,6 +74,14 @@ function loadOrderIsLate(): boolean {
   }
 }
 
+function packagesLoadThisFirst(): boolean {
+  try {
+    return loadsFirst(JSON.parse(readFileSync(join(getAgentDir(), "settings.json"), "utf8")).packages);
+  } catch {
+    return false;
+  }
+}
+
 function restoredMode(ctx: ExtensionContext): Mode {
   let mode: Mode = "normal";
   for (const entry of ctx.sessionManager.getBranch()) {
@@ -92,6 +101,7 @@ export default function piModes(pi: ExtensionAPI): void {
   let disposeYoloLink: (() => void) | undefined;
   let denyOff = false;
   let replacedTools: string[] = [];
+  let statuses: StatusReader | undefined;
 
   for (const tool of aliasDefinitions(() => mode === "yolo" && denyOff)) pi.registerTool(tool);
 
@@ -147,7 +157,13 @@ export default function piModes(pi: ExtensionAPI): void {
         ctx.ui.notify(`Yolo needs "${YOLO_LINK}" in authorizerChain in pi-permission-system's config.json, then a restart. See the README.`, "error");
         return;
       }
-      const agreed = await confirmYolo(ctx, hasPermissionSystem(ctx.sessionManager.getSessionId()));
+      // The tools that ignore deny rules can't reach the sandbox's bash, so they'd run outside it.
+      const sandboxed = sandboxInstalled(pi.getCommands());
+      if (sandboxed && !sandboxIsOn(statuses)) {
+        ctx.ui.notify("Yolo only runs inside the sandbox. Turn it on with /sandbox-enable. If it is on, move pi-modes first in packages in settings.json.", "error");
+        return;
+      }
+      const agreed = await confirmYolo(ctx, hasPermissionSystem(ctx.sessionManager.getSessionId()) && !sandboxed, sandboxed);
       if (agreed === undefined) return;
       denyOff = agreed.denyOff;
     }
@@ -157,6 +173,7 @@ export default function piModes(pi: ExtensionAPI): void {
   pi.on("session_start", (_event, ctx) => {
     apply(restoredMode(ctx), ctx);
     if (ctx.mode === "tui") {
+      if (sandboxInstalled(pi.getCommands()) && packagesLoadThisFirst()) statuses = borrowStatusReader(ctx.ui as never);
       if (loadOrderIsLate()) {
         ctx.ui.notify(
           "pi-modes loads after pi-permission-system, so you may be asked to approve actions that are then blocked. Move it first in packages in settings.json.",
@@ -176,6 +193,7 @@ export default function piModes(pi: ExtensionAPI): void {
   pi.on("session_shutdown", (_event, ctx) => {
     stopListening?.();
     stopListening = undefined;
+    statuses = undefined;
     disposeYoloLink?.();
     disposeYoloLink = undefined;
     clearGate(ctx.sessionManager.getSessionId());
@@ -190,6 +208,11 @@ export default function piModes(pi: ExtensionAPI): void {
   });
 
   pi.on("tool_call", async (event, ctx) => {
+    if (mode === "yolo" && sandboxInstalled(pi.getCommands()) && !sandboxIsOn(statuses)) {
+      change("normal", ctx);
+      if (ctx.hasUI) ctx.ui.notify("The sandbox went off, so yolo ended.", "warning");
+      return { block: true, reason: "Yolo ended because the sandbox is off." };
+    }
     const decision = decideToolCall(mode, event.toolName, event.input);
     if (decision.action === "allow") return undefined;
     if (decision.action === "block") return { block: true, reason: decision.reason };

package/src/sandbox.ts

@@ -0,0 +1,37 @@
+/**
+ * pi-sandbox offers no way to ask whether it is on, but it keeps a status while it is. Only the
+ * footer's data can read statuses, and Pi only hands that to whoever sets a footer. So this sets
+ * one for a moment at the start, which has to happen before any other extension sets its own.
+ */
+const COMMAND = "sandbox-enable";
+const STATUS = "sandbox";
+
+export type StatusReader = { getExtensionStatuses(): ReadonlyMap<string, string> };
+
+export function sandboxInstalled(commands: readonly { name: string }[]): boolean {
+  return commands.some((command) => command.name === COMMAND);
+}
+
+/** Without a reader the sandbox counts as off, so yolo is refused rather than run unconfined. */
+export function sandboxIsOn(reader: StatusReader | undefined): boolean {
+  return Boolean(reader?.getExtensionStatuses().get(STATUS));
+}
+
+export function loadsFirst(packages: unknown): boolean {
+  if (!Array.isArray(packages)) return false;
+  const first: unknown = packages[0];
+  const source = typeof first === "object" && first !== null ? (first as { source?: unknown }).source : first;
+  return typeof source === "string" && /pi-modes(?:@[^/]*)?\/?$/.test(source);
+}
+
+type FooterSetter = { setFooter(factory: ((tui: never, theme: never, data: StatusReader) => { render(): string[]; invalidate(): void }) | undefined): void };
+
+export function borrowStatusReader(ui: FooterSetter): StatusReader | undefined {
+  let reader: StatusReader | undefined;
+  ui.setFooter((_tui, _theme, data) => {
+    reader = data;
+    return { render: () => [], invalidate() {} };
+  });
+  ui.setFooter(undefined);
+  return reader;
+}