@huseynsnmz/pi-suite 0.0.0-stage → 0.2.0

package/packages/modes/src/index.ts

@@ -0,0 +1,338 @@
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { type ExtensionAPI, type ExtensionContext, getAgentDir } from "@earendil-works/pi-coding-agent";
+import { isKeyRelease, matchesKey, Text, wrapTextWithAnsi } from "@earendil-works/pi-tui";
+import { Type } from "typebox";
+import { borrowStatusReader, loadsFirst, sandboxInstalled, sandboxIsOn, type StatusReader } from "./sandbox.ts";
+import { runsGit } from "./bash.ts";
+import { gitRisk } from "./git-safety.ts";
+import { registerInterview } from "./interview.ts";
+import { registerReviewTools } from "./review/tools.ts";
+import { aliasDefinitions, DENY_OFF_PROMPT, withAliases, withoutAliases } from "./deny-off.ts";
+import { clearGate, hasPermissionSystem, installJudgeGate, JUDGE_NAMES, judgeGated, registerYoloLink, setGateMode, YOLO_LINK } from "./judge-gate.ts";
+import { decideToolCall, displayCommand, fromExpectedPackage, notReadOnly, isMode, loadsAfterPermissionSystem, type Mode, MODES, modePrompt, nextMode, resumedMode, startingMode, SUBMIT_PLAN_TOOL } from "./modes.ts";
+
+const STATUS_KEY = "pi-modes";
+const DENY_STATUS_KEY = "pi-modes-deny";
+const ENTRY_TYPE = "pi-modes";
+const CYCLE_KEY = "shift+tab";
+const DEFAULTABLE: string[] = MODES.filter((name) => name !== "yolo");
+
+const STATUS_COLOR = { normal: "dim", auto: "warning", plan: "accent", "read-only": "success", yolo: "error" } as const;
+
+function chainNames(wanted: (name: unknown) => boolean): boolean {
+  try {
+    const path = join(getAgentDir(), "extensions", "pi-permission-system", "config.json");
+    const chain: unknown = JSON.parse(readFileSync(path, "utf8")).authorizerChain;
+    return Array.isArray(chain) && chain.some(wanted);
+  } catch {
+    return false;
+  }
+}
+
+function chainNamesJudge(): boolean {
+  return chainNames((name) => JUDGE_NAMES.has(name as string));
+}
+
+/**
+ * Only Enter starts it, so no other key, like a stray y, can agree to it. Deny rules stay on
+ * unless the user presses d. Undefined means cancelled.
+ */
+async function confirmYolo(ctx: ExtensionContext, canIgnoreDeny: boolean, sandboxed: boolean): Promise<{ denyOff: boolean } | undefined> {
+  let denyOff = false;
+  const agreed = await ctx.ui.custom<boolean>((tui, theme, _keys, done) => ({
+    invalidate() {},
+    handleInput(data: string) {
+      if (matchesKey(data, "enter")) done(true);
+      else if (matchesKey(data, "escape") || matchesKey(data, "ctrl+c")) done(false);
+      else if (canIgnoreDeny && matchesKey(data, "d")) {
+        denyOff = !denyOff;
+        tui.requestRender();
+      }
+    },
+    render(width: number) {
+      const red = (text: string) => theme.fg("error", text);
+      const rule = red("─".repeat(width));
+      const body = [
+        red(theme.bold("▲ YOLO")),
+        "",
+        "The agent stops asking. Anything it wants to run is approved, including commands that delete files or reach the network.",
+        theme.fg("dim", "It lasts until you change mode or leave this session."),
+        "",
+        denyOff
+          ? red(theme.bold("Deny rules: IGNORED for bash, read, write and edit. Secrets you protected can be read."))
+          : `Deny rules: ${theme.bold("respected")}${sandboxed ? `, and everything stays inside the ${theme.bold("sandbox")}` : ""}`,
+        "",
+        `${red(theme.bold("Enter"))} start   ${canIgnoreDeny ? `${theme.fg("dim", denyOff ? "d respect deny rules" : "d ignore deny rules")}   ` : ""}${theme.fg("dim", "Esc cancel")}`,
+      ];
+      return [rule, ...body.flatMap((line) => (line === "" ? [""] : wrapTextWithAnsi(line, width))), rule];
+    },
+  }));
+  return agreed === true ? { denyOff } : undefined;
+}
+
+function loadOrderIsLate(): boolean {
+  try {
+    return loadsAfterPermissionSystem(JSON.parse(readFileSync(join(getAgentDir(), "settings.json"), "utf8")).packages);
+  } catch {
+    return false;
+  }
+}
+
+function packagesLoadThisFirst(): boolean {
+  try {
+    return loadsFirst(JSON.parse(readFileSync(join(getAgentDir(), "settings.json"), "utf8")).packages);
+  } catch {
+    return false;
+  }
+}
+
+const configPath = () => join(getAgentDir(), "extensions", "pi-modes", "config.json");
+
+function readConfig(): Record<string, unknown> {
+  try {
+    const config: unknown = JSON.parse(readFileSync(configPath(), "utf8"));
+    return typeof config === "object" && config !== null ? (config as Record<string, unknown>) : {};
+  } catch {
+    return {};
+  }
+}
+
+function saveDefaultMode(mode: Mode): void {
+  mkdirSync(dirname(configPath()), { recursive: true });
+  writeFileSync(configPath(), `${JSON.stringify({ ...readConfig(), defaultMode: mode }, null, 2)}\n`);
+}
+
+function restoredMode(ctx: ExtensionContext): Mode {
+  let mode: Mode | undefined;
+  for (const entry of ctx.sessionManager.getBranch()) {
+    if (entry.type !== "custom" || entry.customType !== ENTRY_TYPE) continue;
+    const saved: unknown = (entry.data as { mode?: unknown } | undefined)?.mode;
+    if (isMode(saved)) mode = saved;
+  }
+  return mode === undefined ? startingMode(readConfig().defaultMode) : resumedMode(mode);
+}
+
+export default function piModes(pi: ExtensionAPI): void {
+  installJudgeGate();
+
+  let mode: Mode = "normal";
+  let stopListening: (() => void) | undefined;
+  let warnedUngated = false;
+  let disposeYoloLink: (() => void) | undefined;
+  let denyOff = false;
+  let replacedTools: string[] = [];
+  let statuses: StatusReader | undefined;
+
+  for (const tool of aliasDefinitions(() => mode === "yolo" && denyOff)) pi.registerTool(tool);
+
+  pi.events.on("permissions:ready", (data) => {
+    const sessionId = (data as { sessionId?: unknown } | undefined)?.sessionId;
+    if (disposeYoloLink !== undefined || typeof sessionId !== "string") return;
+    disposeYoloLink = registerYoloLink(sessionId);
+  });
+
+  function apply(next: Mode, ctx: ExtensionContext): void {
+    mode = next;
+    if (next !== "yolo") denyOff = false;
+    setGateMode(ctx.sessionManager.getSessionId(), next);
+    let others = withoutAliases(pi.getActiveTools().filter((name) => name !== SUBMIT_PLAN_TOOL), replacedTools);
+    replacedTools = [];
+    if (denyOff) ({ active: others, replaced: replacedTools } = withAliases(others));
+    pi.setActiveTools(next === "plan" ? [...others, SUBMIT_PLAN_TOOL] : others);
+    if (ctx.hasUI) {
+      ctx.ui.setStatus(STATUS_KEY, ctx.ui.theme.fg(STATUS_COLOR[next], `mode: ${next}`));
+      ctx.ui.setStatus(DENY_STATUS_KEY, denyOff ? ctx.ui.theme.fg("error", "deny rules off") : undefined);
+    }
+  }
+
+  function warnIfJudgeUncontrolled(ctx: ExtensionContext): void {
+    if (warnedUngated || !ctx.hasUI || judgeGated(ctx.sessionManager.getSessionId()) || !chainNamesJudge()) return;
+    warnedUngated = true;
+    ctx.ui.notify(
+      "pi-modes could not take control of the permission judge. It may still auto-approve outside auto mode. See the README.",
+      "warning",
+    );
+  }
+
+  // Whoever asks, such as pi-router, passes an object, so load order doesn't matter.
+  pi.events.on("pi-modes:mode", (probe) => {
+    (probe as { mode?: Mode }).mode = mode;
+  });
+
+  function change(next: Mode, ctx: ExtensionContext): void {
+    if (next === mode) return;
+    apply(next, ctx);
+    pi.appendEntry(ENTRY_TYPE, { mode: next });
+    if (!ctx.hasUI) return;
+    // A judge named in the chain may not have registered yet: some load orders
+    // only register it during the first prompt. agent_start checks that case.
+    if (next === "auto" && !judgeGated(ctx.sessionManager.getSessionId()) && !chainNamesJudge()) {
+      ctx.ui.notify(
+        "Auto has no permission judge, so it behaves like normal. Set up pi-permission-classifier to use it.",
+        "warning",
+      );
+    }
+  }
+
+  /** Every way into a mode a person can pick goes through here, so yolo can't skip its question. */
+  async function pick(next: Mode, ctx: ExtensionContext): Promise<void> {
+    if (next === "yolo" && next !== mode) {
+      if (!ctx.hasUI) return;
+      if (hasPermissionSystem(ctx.sessionManager.getSessionId()) && !chainNames((name) => name === YOLO_LINK)) {
+        ctx.ui.notify(`Yolo needs "${YOLO_LINK}" in authorizerChain in pi-permission-system's config.json, then a restart. See the README.`, "error");
+        return;
+      }
+      // The tools that ignore deny rules can't reach the sandbox's bash, so they'd run outside it.
+      const sandboxed = sandboxInstalled(pi.getCommands());
+      if (sandboxed && !sandboxIsOn(statuses)) {
+        ctx.ui.notify("Yolo only runs inside the sandbox. Turn it on with /sandbox-enable. If it is on, move pi-suite first in packages in settings.json.", "error");
+        return;
+      }
+      const agreed = await confirmYolo(ctx, hasPermissionSystem(ctx.sessionManager.getSessionId()) && !sandboxed, sandboxed);
+      if (agreed === undefined) return;
+      denyOff = agreed.denyOff;
+    }
+    change(next, ctx);
+  }
+
+  pi.on("session_start", (_event, ctx) => {
+    apply(restoredMode(ctx), ctx);
+    if (ctx.mode === "tui") {
+      if (sandboxInstalled(pi.getCommands()) && packagesLoadThisFirst()) statuses = borrowStatusReader(ctx.ui as never);
+      if (loadOrderIsLate()) {
+        ctx.ui.notify(
+          "pi-suite loads after pi-permission-system, so you may be asked to approve actions that are then blocked. Move it first in packages in settings.json.",
+          "warning",
+        );
+      }
+      stopListening = ctx.ui.onTerminalInput((data) => {
+        if (!matchesKey(data, CYCLE_KEY)) return undefined;
+        if (!isKeyRelease(data)) change(nextMode(mode), ctx);
+        return { consume: true };
+      });
+    }
+  });
+
+  pi.on("session_tree", (_event, ctx) => apply(restoredMode(ctx), ctx));
+
+  pi.on("session_shutdown", (_event, ctx) => {
+    stopListening?.();
+    stopListening = undefined;
+    statuses = undefined;
+    disposeYoloLink?.();
+    disposeYoloLink = undefined;
+    clearGate(ctx.sessionManager.getSessionId());
+  });
+
+  // Runs after every before_agent_start handler, which is the judge's last chance to register.
+  pi.on("agent_start", (_event, ctx) => warnIfJudgeUncontrolled(ctx));
+
+  pi.on("before_agent_start", (event) => {
+    const prompt = denyOff ? DENY_OFF_PROMPT : modePrompt(mode);
+    return prompt ? { systemPrompt: `${event.systemPrompt}\n\n${prompt}` } : undefined;
+  });
+
+  pi.on("tool_call", async (event, ctx) => {
+    if (mode === "yolo" && sandboxInstalled(pi.getCommands()) && !sandboxIsOn(statuses)) {
+      change("normal", ctx);
+      if (ctx.hasUI) ctx.ui.notify("The sandbox went off, so yolo ended.", "warning");
+      return { block: true, reason: "Yolo ended because the sandbox is off." };
+    }
+    let decision = decideToolCall(mode, event.toolName, event.input);
+    if (decision.action === "allow" && (mode === "plan" || mode === "read-only") && event.toolName === "bash") {
+      const risk = runsGit((event.input as { command: string }).command) ? await gitRisk(ctx.cwd) : undefined;
+      if (risk !== undefined) decision = notReadOnly(mode, risk);
+    }
+    if (decision.action === "allow" && (mode === "plan" || mode === "read-only")) {
+      const path = pi.getAllTools().find((tool) => tool.name === event.toolName)?.sourceInfo.path;
+      if (!fromExpectedPackage(event.toolName, path)) decision = { action: "block", reason: `${mode} mode blocks ${event.toolName} from another package.` };
+    }
+    if (decision.action === "allow") return undefined;
+    if (decision.action === "block") return { block: true, reason: decision.reason };
+
+    const denied = `Plan mode blocked this command: ${decision.reason}.`;
+    if (!ctx.hasUI) return { block: true, reason: denied };
+    const command = (event.input as { command: string }).command;
+    const approved = await ctx.ui.confirm("Plan mode: run this command?", `${displayCommand(decision.reason)}\n\n${displayCommand(command)}`);
+    return approved ? undefined : { block: true, reason: denied };
+  });
+
+  registerReviewTools(pi);
+
+  registerInterview(pi);
+
+  pi.registerTool({
+    name: SUBMIT_PLAN_TOOL,
+    label: "Submit plan",
+    description: "Show the finished plan to the user for approval. Only available in plan mode.",
+    parameters: Type.Object({
+      plan: Type.String({ description: "The complete plan, as markdown" }),
+    }),
+    renderCall: (args, theme) => new Text(`${theme.bold("Plan")}\n${args.plan ?? ""}`, 0, 0),
+    async execute(_id, _params, _signal, _onUpdate, ctx) {
+      const reply = (text: string) => ({ content: [{ type: "text" as const, text }], details: {} });
+      if (mode !== "plan") return reply("Plan mode is off, so there is nothing to approve.");
+      if (!ctx.hasUI) return reply("Nobody can approve a plan here. Stay in plan mode.");
+
+      const NORMAL = "Approve, and ask before risky actions (normal)";
+      const AUTO = "Approve, and let the judge approve actions (auto)";
+      const KEEP = "Keep planning";
+      const choice = await ctx.ui.select("Approve this plan?", [NORMAL, AUTO, KEEP]);
+
+      if (choice === NORMAL || choice === AUTO) {
+        const next: Mode = choice === AUTO ? "auto" : "normal";
+        change(next, ctx);
+        return reply(`The user approved the plan and switched to ${next} mode. Implement it now.`);
+      }
+      const feedback = await ctx.ui.input("What should change?", "");
+      return reply(`The user did not approve the plan. Stay in plan mode. ${feedback ? `Feedback: ${feedback}` : "Ask what to change."}`);
+    },
+  });
+
+  pi.registerCommand("mode", {
+    description: `Show or set the mode: ${MODES.join(", ")}. "default" sets what new sessions start in`,
+    getArgumentCompletions: (prefix) => {
+      const wanted = prefix.trim();
+      if (wanted.startsWith("default ")) {
+        const name = wanted.slice("default ".length);
+        const items = DEFAULTABLE.filter((value) => value.startsWith(name)).map((value) => ({ value: `default ${value}`, label: value }));
+        return items.length > 0 ? items : null;
+      }
+      const items = [...MODES, "default"].filter((name) => name.startsWith(wanted)).map((value) => ({ value, label: value }));
+      return items.length > 0 ? items : null;
+    },
+    handler: async (args, ctx) => {
+      const requested = args.trim();
+      if (requested === "default" || requested.startsWith("default ")) {
+        const now = startingMode(readConfig().defaultMode);
+        const wanted = requested === "default"
+          ? ctx.hasUI ? await ctx.ui.select(`Mode new sessions start in (now ${now})`, DEFAULTABLE) : undefined
+          : requested.slice("default ".length).trim();
+        if (wanted === undefined) return;
+        if (!DEFAULTABLE.includes(wanted)) {
+          const why = wanted === "yolo" ? "Yolo can't be the default, because it has to be asked for each time." : `Unknown mode ${wanted}.`;
+          ctx.ui.notify(`${why} Use one of: ${DEFAULTABLE.join(", ")}.`, "error");
+          return;
+        }
+        try {
+          saveDefaultMode(wanted as Mode);
+          ctx.ui.notify(`New sessions start in ${wanted}. This session stays in ${mode}.`, "info");
+        } catch (error) {
+          ctx.ui.notify(`Couldn't save the default mode: ${String(error)}`, "error");
+        }
+        return;
+      }
+      if (requested === "") {
+        const picked = ctx.hasUI ? await ctx.ui.select(`Mode (now ${mode})`, [...MODES]) : undefined;
+        if (isMode(picked)) await pick(picked, ctx);
+        return;
+      }
+      if (!isMode(requested)) {
+        ctx.ui.notify(`Unknown mode ${requested}. Use one of: ${MODES.join(", ")}.`, "error");
+        return;
+      }
+      await pick(requested, ctx);
+    },
+  });
+}

package/packages/modes/src/interview.ts

@@ -0,0 +1,206 @@
+// The model asks, the user answers. An answer is only information: tool permissions stay as they are.
+import type { ExtensionAPI, ExtensionUIContext } from "@earendil-works/pi-coding-agent";
+import { matchesKey, Text, truncateToWidth, wrapTextWithAnsi } from "@earendil-works/pi-tui";
+import { Type } from "typebox";
+import { ASK_TOOL, displayCommand } from "./modes.ts";
+
+const TYPES = ["text", "yes_no", "select", "multi_select"] as const;
+type QuestionType = (typeof TYPES)[number];
+const MAX_QUESTIONS = 6;
+const MAX_OPTIONS = 10;
+const MAX_OPTION_CHARS = 200;
+const MAX_QUESTION_CHARS = 500;
+const CALL_LINE_CHARS = 120;
+export const OWN_ANSWER = "Type my own answer";
+
+export interface Question {
+  question: string;
+  type: string;
+  options?: string[];
+}
+
+interface Clean {
+  question: string;
+  type: QuestionType;
+  options: string[];
+}
+
+export type Dialogs = Pick<ExtensionUIContext, "select" | "input" | "custom">;
+
+/** Dialogs draw this text, so it can't drive the terminal or fake another row. */
+function oneLine(text: string): string {
+  return displayCommand(text.replace(/\s+/g, " ").trim());
+}
+
+function cleanOption(option: string): string {
+  return oneLine(option).slice(0, MAX_OPTION_CHARS);
+}
+
+/**
+ * The model writes the rest of the dialog, so this part says who is asking. Without it, a question
+ * could pass for Pi's permission prompts or plan approval.
+ */
+function titleOf(question: string, index: number, total: number): string {
+  return `Agent question${total === 1 ? "" : ` ${index + 1}/${total}`}: ${question}`;
+}
+
+const SENT_TO_MODEL = "(your answer goes to the model)";
+
+/** A bad call tells the model what to fix, before the user sees any of it. */
+export function checkedQuestions(questions: readonly Question[]): Clean[] {
+  if (questions.length === 0) throw new Error("Ask at least one question.");
+  if (questions.length > MAX_QUESTIONS) throw new Error(`Ask at most ${MAX_QUESTIONS} questions at a time.`);
+  return questions.map(({ question, type, options }) => {
+    const text = oneLine(question);
+    if (text === "") throw new Error("A question needs text.");
+    if (text.length > MAX_QUESTION_CHARS) throw new Error(`Keep a question under ${MAX_QUESTION_CHARS} characters.`);
+    if (!(TYPES as readonly string[]).includes(type)) throw new Error(`Unknown question type "${type}". Use ${TYPES.join(", ")}.`);
+    const kind = type as QuestionType;
+    if (kind === "text" || kind === "yes_no") {
+      if (options !== undefined) throw new Error(`A ${kind} question takes no options.`);
+      return { question: text, type: kind, options: kind === "yes_no" ? ["Yes", "No"] : [] };
+    }
+    const clean = (options ?? []).map(cleanOption);
+    if (clean.length < 2 || clean.length > MAX_OPTIONS) throw new Error(`A ${kind} question needs 2 to ${MAX_OPTIONS} options.`);
+    if (clean.includes("") || new Set(clean).size < clean.length) throw new Error("Options must be different and not empty.");
+    if (clean.includes(OWN_ANSWER)) throw new Error(`"${OWN_ANSWER}" is added for you. Leave it out.`);
+    return { question: text, type: kind, options: clean };
+  });
+}
+
+/** Space picks, Enter answers. Undefined means Esc, or the run was stopped. */
+export function pickSeveral(
+  ui: Dialogs,
+  title: string,
+  options: readonly string[],
+  signal?: AbortSignal,
+  already: readonly string[] = [],
+): Promise<string[] | undefined> {
+  return ui.custom<string[] | undefined>((tui, theme, _keys, done) => {
+    const picked = new Set(already.map((option) => options.indexOf(option)).filter((index) => index >= 0));
+    let row = 0;
+    const stop = () => done(undefined);
+    signal?.addEventListener("abort", stop, { once: true });
+    const finish = (value: string[] | undefined) => {
+      signal?.removeEventListener("abort", stop);
+      done(value);
+    };
+    return {
+      invalidate() {},
+      handleInput(data: string) {
+        if (matchesKey(data, "up")) row = (row + options.length - 1) % options.length;
+        else if (matchesKey(data, "down")) row = (row + 1) % options.length;
+        else if (matchesKey(data, "space")) {
+          if (!picked.delete(row)) picked.add(row);
+        } else if (matchesKey(data, "enter")) return finish(options.filter((_option, index) => picked.has(index)));
+        else if (matchesKey(data, "escape") || matchesKey(data, "ctrl+c")) return finish(undefined);
+        tui.requestRender();
+      },
+      render(width: number) {
+        const rule = theme.fg("accent", "─".repeat(width));
+        // Wrapped, not cut: the model receives the whole option, so the user has to see all of it.
+        const rows = options.flatMap((option, index) => {
+          const box = picked.has(index) ? "[x]" : "[ ]";
+          const lead = ` ${index === row ? "→" : " "} ${box} `;
+          return wrapTextWithAnsi(option, Math.max(1, width - lead.length)).map((part, at) => {
+            const line = truncateToWidth(`${at === 0 ? lead : " ".repeat(lead.length)}${part}`, width);
+            return index === row ? theme.fg("accent", line) : line;
+          });
+        });
+        const hint = theme.fg("dim", " ↑↓ navigate  space pick  enter answer  escape cancel");
+        const heading = wrapTextWithAnsi(theme.bold(title), Math.max(1, width - 2)).map((line) => ` ${line}`);
+        return [rule, "", ...heading, "", ...rows, "", truncateToWidth(hint, width), "", rule];
+      },
+    };
+  });
+}
+
+async function ownAnswer(ui: Dialogs, title: string, signal?: AbortSignal): Promise<string | undefined> {
+  const typed = await ui.input(`${title} ${SENT_TO_MODEL}`, "", { signal });
+  return typed?.trim() || undefined;
+}
+
+/** Undefined means the user closed it. Leaving their own answer empty goes back to the options. */
+async function answerOf(ui: Dialogs, question: Clean, title: string, drawsDialogs: boolean, signal?: AbortSignal): Promise<string | undefined> {
+  if (question.type === "text") {
+    const typed = await ui.input(`${title} ${SENT_TO_MODEL}`, "", { signal });
+    return typed === undefined ? undefined : typed.trim() || "(left empty)";
+  }
+  // Only the terminal can draw the list of boxes, and other clients answer it as if the user had closed it.
+  if (question.type === "multi_select" && !drawsDialogs) {
+    const typed = await ui.input(`${title} Pick from: ${question.options.join(" | ")} ${SENT_TO_MODEL}`, "", { signal });
+    return typed === undefined ? undefined : typed.trim() || "(none picked)";
+  }
+  const options = [...question.options, OWN_ANSWER];
+  let already: string[] = [];
+  for (;;) {
+    if (signal?.aborted) return undefined;
+    if (question.type === "multi_select") {
+      const picked = await pickSeveral(ui, title, options, signal, already);
+      if (picked === undefined) return undefined;
+      already = picked;
+      const named = picked.filter((option) => option !== OWN_ANSWER);
+      if (named.length === picked.length) return named.length === 0 ? "(none picked)" : JSON.stringify(named);
+      const typed = await ownAnswer(ui, title, signal);
+      if (typed !== undefined) return JSON.stringify([...named, typed]);
+    } else {
+      const picked = await ui.select(title, options, { signal });
+      if (picked === undefined) return undefined;
+      if (picked !== OWN_ANSWER) return picked;
+      const typed = await ownAnswer(ui, title, signal);
+      if (typed !== undefined) return typed;
+    }
+  }
+}
+
+export async function interview(ui: Dialogs, questions: readonly Clean[], signal?: AbortSignal, drawsDialogs = true): Promise<string> {
+  const lines: string[] = [];
+  for (const [index, question] of questions.entries()) {
+    const title = titleOf(question.question, index, questions.length);
+    const answer = await answerOf(ui, question, title, drawsDialogs, signal);
+    if (answer === undefined) {
+      const left = lines.length === 0 ? "" : `\nAnswered before that:\n${lines.join("\n")}`;
+      const who = signal?.aborted ? "The run was stopped" : "The user closed the questions";
+      return `${who} at: ${question.question}\nDon't guess the rest. Go on only with what they already told you, or ask what they want.${left}`;
+    }
+    lines.push(`Q: ${question.question}\nA: ${answer}`);
+  }
+  return lines.join("\n");
+}
+
+/** The questions, not their JSON. The arguments arrive a piece at a time, so any of it can be missing. */
+export function askedLine(args: { questions?: readonly Partial<Question>[] }): string {
+  const questions = Array.isArray(args.questions) ? args.questions : [];
+  const first = typeof questions[0]?.question === "string" ? oneLine(questions[0].question).slice(0, CALL_LINE_CHARS) : "";
+  return questions.length > 1 ? `${first} (+${questions.length - 1} more)` : first;
+}
+
+export function registerInterview(pi: ExtensionAPI): void {
+  pi.registerTool({
+    name: ASK_TOOL,
+    label: "Ask",
+    description: "Ask the user questions, one dialog at a time, and get their answers. The user can always type their own answer instead of the options.",
+    promptSnippet: "Ask the user questions when a decision is theirs",
+    promptGuidelines: [
+      `Use ${ASK_TOOL} when a decision is the user's to make and the work depends on it, or to interview them about what they want. Don't ask what you can find out by reading, and don't use it for permission to run a tool.`,
+    ],
+    executionMode: "sequential",
+    parameters: Type.Object({
+      questions: Type.Array(
+        Type.Object({
+          question: Type.String(),
+          type: Type.String({ enum: [...TYPES], description: "text: free answer. yes_no. select: one option. multi_select: any number." }),
+          options: Type.Optional(Type.Array(Type.String(), { description: "For select and multi_select" })),
+        }),
+      ),
+    }),
+    renderCall: (args, theme) => new Text(theme.fg("muted", askedLine(args)), 0, 0),
+    async execute(_id, params, signal, _onUpdate, ctx) {
+      const questions = checkedQuestions(params.questions);
+      const text = ctx.hasUI
+        ? await interview(ctx.ui, questions, signal, ctx.mode === "tui")
+        : "Nobody can answer here. Decide for yourself, and say what you assumed.";
+      return { content: [{ type: "text", text }], details: {} };
+    },
+  });
+}

package/packages/modes/src/judge-gate.ts

@@ -0,0 +1,113 @@
+/**
+ * Lets the permission judge run only in auto mode, per session.
+ *
+ * pi-permission-system reads `authorizerChain` from a config file shared by
+ * every Pi process, so editing it would flip auto for all open sessions. It
+ * also has no API to read or disable a registered link. Instead this wraps the
+ * judge at registration: outside auto the wrapper defers, which sends the ask
+ * on to the normal prompt.
+ *
+ * Package load order must not matter, so the wrap is installed where each
+ * session's service is published, which happens before any extension can
+ * register on it. This depends on the service map's documented global key. If
+ * that changes, `judgeGated` stays false and the extension warns.
+ */
+
+import type { Mode } from "./modes.ts";
+
+export const JUDGE_NAMES: ReadonlySet<string> = new Set(["permission-judge", "classifier"]);
+
+export const YOLO_LINK = "pi-modes";
+
+const SERVICES_KEY = Symbol.for("@gotgenes/pi-permission-system:session-services");
+const STATE_KEY = Symbol.for("pi-modes:session-state");
+const PATCHED = Symbol.for("pi-modes:patched");
+
+type Authorize = (details: unknown, query: unknown, log: unknown) => Promise<unknown>;
+
+interface ServiceLike {
+  registerAuthorizer?: (name: string, authorize: Authorize) => () => void;
+  [PATCHED]?: true;
+}
+
+type ServiceMap = Map<string, ServiceLike> & { [PATCHED]?: true };
+
+interface SessionState {
+  mode: Mode;
+  judgeGated: boolean;
+}
+
+type Store = Record<symbol, unknown>;
+
+function sessionStates(store: Store): Map<string, SessionState> {
+  store[STATE_KEY] ??= new Map<string, SessionState>();
+  return store[STATE_KEY] as Map<string, SessionState>;
+}
+
+function stateFor(store: Store, sessionId: string): SessionState {
+  const states = sessionStates(store);
+  let state = states.get(sessionId);
+  if (!state) {
+    state = { mode: "normal", judgeGated: false };
+    states.set(sessionId, state);
+  }
+  return state;
+}
+
+function gateService(store: Store, sessionId: string, service: ServiceLike): void {
+  if (service[PATCHED] || typeof service.registerAuthorizer !== "function") return;
+  service[PATCHED] = true;
+  const register = service.registerAuthorizer.bind(service);
+  service.registerAuthorizer = (name, authorize) => {
+    if (!JUDGE_NAMES.has(name)) return register(name, authorize);
+    stateFor(store, sessionId).judgeGated = true;
+    return register(name, async (details, query, log) =>
+      stateFor(store, sessionId).mode === "auto" ? authorize(details, query, log) : { kind: "defer" },
+    );
+  };
+}
+
+/** Safe to call from every extension instance: the map is patched once per process. */
+export function installJudgeGate(store: Store = globalThis as unknown as Store): void {
+  store[SERVICES_KEY] ??= new Map<string, ServiceLike>();
+  const services = store[SERVICES_KEY] as ServiceMap;
+  if (services[PATCHED]) return;
+  services[PATCHED] = true;
+
+  for (const [sessionId, service] of services) gateService(store, sessionId, service);
+  const set = services.set.bind(services);
+  services.set = (sessionId, service) => {
+    gateService(store, sessionId, service);
+    return set(sessionId, service);
+  };
+}
+
+/**
+ * Registers the link that makes yolo work: it allows every ask in yolo and defers otherwise.
+ * It decides nothing until the user names it in `authorizerChain`, and because it only runs on
+ * an ask, `deny` rules still block. The review log names it, so yolo's approvals stay visible.
+ * Returns a disposer, or undefined when this session has no permission system.
+ */
+export function registerYoloLink(sessionId: string, store: Store = globalThis as unknown as Store): (() => void) | undefined {
+  const service = (store[SERVICES_KEY] as ServiceMap | undefined)?.get(sessionId);
+  if (typeof service?.registerAuthorizer !== "function") return undefined;
+  return service.registerAuthorizer(YOLO_LINK, async () =>
+    stateFor(store, sessionId).mode === "yolo" ? { kind: "allow" } : { kind: "defer" },
+  );
+}
+
+export function hasPermissionSystem(sessionId: string, store: Store = globalThis as unknown as Store): boolean {
+  return (store[SERVICES_KEY] as ServiceMap | undefined)?.has(sessionId) === true;
+}
+
+export function setGateMode(sessionId: string, mode: Mode, store: Store = globalThis as unknown as Store): void {
+  stateFor(store, sessionId).mode = mode;
+}
+
+export function judgeGated(sessionId: string, store: Store = globalThis as unknown as Store): boolean {
+  return stateFor(store, sessionId).judgeGated;
+}
+
+export function clearGate(sessionId: string, store: Store = globalThis as unknown as Store): void {
+  sessionStates(store).delete(sessionId);
+}