@huseynsnmz/pi-suite 0.2.3 → 0.2.5

package/packages/modes/src/index.ts

@@ -1,4 +1,4 @@
-import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { mkdirSync, readFileSync, writeFileSync, realpathSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { type ExtensionAPI, type ExtensionContext, getAgentDir } from "@earendil-works/pi-coding-agent";
 import { isKeyRelease, matchesKey, Text, wrapTextWithAnsi } from "@earendil-works/pi-tui";
@@ -9,9 +9,10 @@ import { gitRisk } from "./git-safety.ts";
 import { registerInterview } from "./interview.ts";
 import { registerReviewTools } from "./review/tools.ts";
 import { aliasDefinitions, DENY_OFF_PROMPT, withAliases, withoutAliases } from "./deny-off.ts";
-import { clearGate, hasPermissionSystem, installJudgeGate, JUDGE_NAMES, judgeGated, registerYoloLink, setGateMode, YOLO_LINK } from "./judge-gate.ts";
+import { addCdGuards, addCdRules, registerWorkdir } from "./workdir.ts";
+import { clearGate, hasPermissionSystem, installJudgeGate, JUDGE_NAMES, judgeGated, noteEditPaths, registerYoloLink, setGateAgentOurs, setGateCwd, setGateMode, YOLO_LINK } from "./judge-gate.ts";
 import { readSection, writeSection } from "../../../src/settings.ts";
-import { decideToolCall, displayCommand, fromExpectedPackage, notReadOnly, isMode, scriptedChange, loadsAfterPermissionSystem, type Mode, MODES, modePrompt, nextMode, resumedMode, startingMode, SUBMIT_PLAN_TOOL } from "./modes.ts";
+import { AGENT_TOOL, decideToolCall, displayCommand, fromExpectedPackage, notReadOnly, isMode, scriptedChange, loadsAfterPermissionSystem, type Mode, MODES, modePrompt, nextMode, resumedMode, startingMode, SUBMIT_PLAN_TOOL } from "./modes.ts";
 
 const STATUS_KEY = "pi-modes";
 const DENY_STATUS_KEY = "pi-modes-deny";
@@ -107,12 +108,23 @@ function restoredMode(ctx: ExtensionContext): Mode {
     const saved: unknown = (entry.data as { mode?: unknown } | undefined)?.mode;
     if (isMode(saved)) mode = saved;
   }
+  if (mode === undefined && process.env.PI_SUBAGENT_CHILD === "1") return startingMode(process.env.PI_MODES_START); // Its parent's say, not the default.
   return mode === undefined ? startingMode(readConfig().defaultMode) : resumedMode(mode);
 }
 
 export default function piModes(pi: ExtensionAPI): void {
   installJudgeGate();
 
+  // Before the permission system reads its rules, when it loads after this.
+  const project = realpathSync(process.cwd());
+  const cdFolders = readConfig().cdRuleFolders;
+  const handled = Array.isArray(cdFolders) ? (cdFolders as string[]) : [];
+  const isChild = process.env.PI_SUBAGENT_CHILD === "1";
+  if (!isChild && handled.includes(project)) addCdGuards(getAgentDir(), project);
+  const cdRule = isChild || handled.includes(project) ? { handled: false } : addCdRules(getAgentDir(), project);
+  if (cdRule.handled) writeSection(getAgentDir(), "modes", { ...readConfig(), cdRuleFolders: [...handled, project] });
+  let cdNotice = cdRule.notice;
+
   let mode: Mode = "normal";
   let stopListening: (() => void) | undefined;
   let warnedUngated = false;
@@ -129,10 +141,17 @@ export default function piModes(pi: ExtensionAPI): void {
     disposeYoloLink = registerYoloLink(sessionId);
   });
 
+  pi.on("message_end", (event, ctx) => noteEditPaths(ctx.sessionManager.getSessionId(), event.message));
+
+  const bash = registerWorkdir(pi);
+
   function apply(next: Mode, ctx: ExtensionContext): void {
     mode = next;
     if (next !== "yolo") denyOff = false;
     setGateMode(ctx.sessionManager.getSessionId(), next);
+    setGateCwd(ctx.sessionManager.getSessionId(), ctx.cwd);
+    const agentTool = pi.getAllTools().find((tool) => tool.name === AGENT_TOOL);
+    setGateAgentOurs(ctx.sessionManager.getSessionId(), agentTool !== undefined && fromExpectedPackage(AGENT_TOOL, agentTool.sourceInfo.path));
     let others = withoutAliases(pi.getActiveTools().filter((name) => name !== SUBMIT_PLAN_TOOL), replacedTools);
     replacedTools = [];
     if (denyOff) ({ active: others, replaced: replacedTools } = withAliases(others));
@@ -194,6 +213,8 @@ export default function piModes(pi: ExtensionAPI): void {
   }
 
   pi.on("session_start", (_event, ctx) => {
+    if (cdNotice !== undefined && ctx.hasUI) ctx.ui.notify(cdNotice, "info");
+    cdNotice = undefined;
     apply(restoredMode(ctx), ctx);
     if (ctx.mode === "tui") {
       if (sandboxInstalled(pi.getCommands()) && packagesLoadThisFirst()) statuses = borrowStatusReader(ctx.ui as never);
@@ -243,21 +264,25 @@ export default function piModes(pi: ExtensionAPI): void {
     }
     let decision = decideToolCall(mode, event.toolName, event.input);
     if (decision.action === "allow" && (mode === "plan" || mode === "read-only") && event.toolName === "bash") {
-      const risk = runsGit((event.input as { command: string }).command) ? await gitRisk(ctx.cwd) : undefined;
+      const risk = runsGit((event.input as { command: string }).command) ? await gitRisk(bash.folder() ?? ctx.cwd) : undefined;
       if (risk !== undefined) decision = notReadOnly(mode, risk);
     }
     if (decision.action === "allow" && (mode === "plan" || mode === "read-only")) {
       const path = pi.getAllTools().find((tool) => tool.name === event.toolName)?.sourceInfo.path;
       if (!fromExpectedPackage(event.toolName, path)) decision = { action: "block", reason: `${mode} mode blocks ${event.toolName} from another package.` };
     }
-    if (decision.action === "allow") return undefined;
+    // After the mode has read the command as the model wrote it, and before the permission system reads it.
+    const moveBash = () => {
+      if (event.toolName === "bash" || event.toolName === "yolo_bash") bash.apply(event.toolCallId, event.input as { command: string }, ctx.cwd);
+    };
+    if (decision.action === "allow") return moveBash();
     if (decision.action === "block") return { block: true, reason: decision.reason };
 
     const denied = `Plan mode blocked this command: ${decision.reason}.`;
     if (!ctx.hasUI) return { block: true, reason: denied };
     const command = (event.input as { command: string }).command;
     const approved = await ctx.ui.confirm("Plan mode: run this command?", `${displayCommand(decision.reason)}\n\n${displayCommand(command)}`);
-    return approved ? undefined : { block: true, reason: denied };
+    return approved ? moveBash() : { block: true, reason: denied };
   });
 
   registerReviewTools(pi);

package/packages/modes/src/judge-gate.ts

@@ -13,7 +13,10 @@
  * that changes, `judgeGated` stays false and the extension warns.
  */
 
-import type { Mode } from "./modes.ts";
+import { existsSync, lstatSync, realpathSync } from "node:fs";
+import { homedir } from "node:os";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { AGENT_TOOL, type Mode } from "./modes.ts";
 
 export const JUDGE_NAMES: ReadonlySet<string> = new Set(["permission-judge", "classifier"]);
 
@@ -35,6 +38,62 @@ type ServiceMap = Map<string, ServiceLike> & { [PATCHED]?: true };
 interface SessionState {
   mode: Mode;
   judgeGated: boolean;
+  cwd?: string;
+  /** Whether the `agent` tool is pi-suite's own. Another package's could do anything. */
+  agentIsOurs?: boolean;
+  /** Where the model's latest edits and writes go, by call id, as an ask doesn't say. */
+  editPaths?: Map<string, string>;
+}
+
+/** Inside a project, but they run code or change what Pi does, so the judge still looks. */
+const GUARDED = new Set([".git", ".pi", ".claude", ".husky", ".github", ".vscode", ".envrc"]);
+
+/**
+ * Pi's edit and write tools rewrite these before opening the file, so the path as written isn't the one written to.
+ * The judge sees them rather than this copying Pi's rules, which could drift.
+ */
+const REWRITTEN_BY_PI = /^@|^file:|[\u00A0\u2000-\u200A\u202F\u205F\u3000]/;
+
+/** The path with symlinks followed, as far as it exists. Undefined for a link that leads nowhere. */
+function realTarget(path: string): string | undefined {
+  if (existsSync(path)) return realpathSync(path);
+  try {
+    lstatSync(path);
+    return undefined; // It's there, and can't be followed.
+  } catch {
+    const parent = dirname(path);
+    if (parent === path) return undefined;
+    const real = realTarget(parent);
+    return real === undefined ? undefined : join(real, basename(path));
+  }
+}
+
+/** An edit or write to an ordinary file in the project: what `auto` lets through without asking anyone. */
+export function isProjectEdit(details: unknown, cwd: string | undefined): boolean {
+  const { toolName, path } = (details ?? {}) as { toolName?: unknown; path?: unknown };
+  if ((toolName !== "edit" && toolName !== "write") || typeof path !== "string" || cwd === undefined || REWRITTEN_BY_PI.test(path)) return false;
+  const expanded = path === "~" || path.startsWith("~/") ? join(homedir(), path.slice(1)) : path;
+  const target = realTarget(resolve(cwd, expanded));
+  const root = realTarget(cwd);
+  if (target === undefined || root === undefined) return false;
+  const inside = relative(root, target);
+  if (inside === "" || inside === ".." || inside.startsWith(`..${sep}`) || isAbsolute(inside)) return false;
+  // Lowercase, as macOS finds `.GIT` at `.git` by default.
+  return !inside.split(sep).some((part) => GUARDED.has(part.toLowerCase()));
+}
+
+/** It does nothing by itself: what the agent then does is still checked. */
+function needsNoAsk(state: SessionState, details: unknown): boolean {
+  return state.agentIsOurs === true && (details as { toolName?: unknown } | undefined)?.toolName === AGENT_TOOL;
+}
+
+function autoAllows(state: SessionState, details: unknown, log: unknown): boolean {
+  if (state.mode !== "auto") return false;
+  const { toolName, toolCallId } = (details ?? {}) as { toolName?: unknown; toolCallId?: unknown };
+  const path = typeof toolCallId === "string" ? state.editPaths?.get(toolCallId) : undefined;
+  if (!isProjectEdit({ toolName, path }, state.cwd)) return false;
+  (log as { review?: (event: string, fields: unknown) => void } | undefined)?.review?.("pi-modes.project_edit", { path });
+  return true;
 }
 
 type Store = Record<symbol, unknown>;
@@ -61,9 +120,12 @@ function gateService(store: Store, sessionId: string, service: ServiceLike): voi
   service.registerAuthorizer = (name, authorize) => {
     if (!JUDGE_NAMES.has(name)) return register(name, authorize);
     stateFor(store, sessionId).judgeGated = true;
-    return register(name, async (details, query, log) =>
-      stateFor(store, sessionId).mode === "auto" ? authorize(details, query, log) : { kind: "defer" },
-    );
+    return register(name, async (details, query, log) => {
+      const state = stateFor(store, sessionId);
+      if (needsNoAsk(state, details)) return { kind: "allow" };
+      if (state.mode !== "auto") return { kind: "defer" };
+      return autoAllows(state, details, log) ? { kind: "allow" } : authorize(details, query, log);
+    });
   };
 }
 
@@ -91,9 +153,10 @@ export function installJudgeGate(store: Store = globalThis as unknown as Store):
 export function registerYoloLink(sessionId: string, store: Store = globalThis as unknown as Store): (() => void) | undefined {
   const service = (store[SERVICES_KEY] as ServiceMap | undefined)?.get(sessionId);
   if (typeof service?.registerAuthorizer !== "function") return undefined;
-  return service.registerAuthorizer(YOLO_LINK, async () =>
-    stateFor(store, sessionId).mode === "yolo" ? { kind: "allow" } : { kind: "defer" },
-  );
+  return service.registerAuthorizer(YOLO_LINK, async (details, _query, log) => {
+    const state = stateFor(store, sessionId);
+    return needsNoAsk(state, details) || state.mode === "yolo" || autoAllows(state, details, log) ? { kind: "allow" } : { kind: "defer" };
+  });
 }
 
 export function hasPermissionSystem(sessionId: string, store: Store = globalThis as unknown as Store): boolean {
@@ -104,6 +167,27 @@ export function setGateMode(sessionId: string, mode: Mode, store: Store = global
   stateFor(store, sessionId).mode = mode;
 }
 
+/** Called with each message the model finishes, which comes before any of its tools are asked about. */
+export function noteEditPaths(sessionId: string, message: unknown, store: Store = globalThis as unknown as Store): void {
+  const { role, content } = (message ?? {}) as { role?: unknown; content?: unknown };
+  if (role !== "assistant" || !Array.isArray(content)) return;
+  const paths = new Map<string, string>();
+  for (const block of content as { type?: unknown; id?: unknown; name?: unknown; arguments?: { path?: unknown } }[]) {
+    if (block?.type === "toolCall" && (block.name === "edit" || block.name === "write") && typeof block.id === "string" && typeof block.arguments?.path === "string") {
+      paths.set(block.id, block.arguments.path);
+    }
+  }
+  stateFor(store, sessionId).editPaths = paths;
+}
+
+export function setGateCwd(sessionId: string, cwd: string, store: Store = globalThis as unknown as Store): void {
+  stateFor(store, sessionId).cwd = cwd;
+}
+
+export function setGateAgentOurs(sessionId: string, ours: boolean, store: Store = globalThis as unknown as Store): void {
+  stateFor(store, sessionId).agentIsOurs = ours;
+}
+
 export function judgeGated(sessionId: string, store: Store = globalThis as unknown as Store): boolean {
   return stateFor(store, sessionId).judgeGated;
 }

package/packages/modes/src/modes.ts

@@ -14,10 +14,11 @@ const CODEMODE_TOOL = "codemode";
 
 // pi-web's tools only read, and a separate model reads the page for them.
 // Each tool a codemode script calls comes through this check itself, so the script needs none of its own.
+export const AGENT_TOOL = "agent";
 const READ_TOOLS = new Set(["read", "grep", "find", "ls", "web_fetch", "web_search", "todo", ASK_TOOL, CODEMODE_TOOL]);
 
 /** Allowed for what pi-suite's own do. Another package's tool with the name could do anything. */
-const SUITE_TOOLS: ReadonlySet<string> = new Set(["todo", "web_fetch", "web_search", ASK_TOOL]);
+const SUITE_TOOLS: ReadonlySet<string> = new Set(["todo", "web_fetch", "web_search", ASK_TOOL, AGENT_TOOL]);
 const SUITE_ENTRY = fileURLToPath(new URL("../../../src/index.ts", import.meta.url));
 
 function realPath(path: string): string | undefined {
@@ -75,6 +76,8 @@ export function decideToolCall(mode: Mode, toolName: string, input: unknown): To
   if (mode === "normal" || mode === "auto" || mode === "yolo") return ALLOW;
   const leave = "Press Shift+Tab to change mode.";
   if (READ_TOOLS.has(toolName)) return ALLOW;
+  // Its explore type can only read, as the child gets no other tools.
+  if (toolName === AGENT_TOOL && (input as { type?: unknown } | null)?.type !== "general") return ALLOW;
   if (toolName === SUBMIT_PLAN_TOOL && mode === "plan") return ALLOW;
 
   if (toolName === "bash") {

package/packages/modes/src/review/apply.mjs

@@ -9,7 +9,7 @@ const OUTWARD = /^(?:git\s+(?:push|reset|clean|rebase|filter-branch)|gh\s+(?:pr\
  * Commands with no subcommands that only read, so a trailing `*` adds just their options. Not `rg`,
  * whose --pre runs a program, `file`, whose -C writes, or `date`, whose -s sets the clock.
  */
-const READERS = new Set(["ls", "pwd", "wc", "head", "tail", "which", "grep", "tree", "du", "df", "stat", "diff"]);
+const READERS = new Set(["cd", "ls", "pwd", "wc", "head", "tail", "which", "grep", "tree", "du", "df", "stat", "diff"]);
 const BUILT_IN_TOOLS = new Set(["read", "grep", "find", "ls", "submit_plan"]);
 const REFUSED_SURFACES = new Set(["bash", "path", "external_directory", "mcp", "skill", "*"]);
 
@@ -17,6 +17,7 @@ const REFUSED_SURFACES = new Set(["bash", "path", "external_directory", "mcp", "
 export function refuseBash(pattern) {
   const text = pattern.trim();
   if (text === "" || text.startsWith("*") || text.startsWith("?")) return "it matches any command";
+  if (text === "cd*") return "it also matches cdk and other commands, so write `cd *`";
   if (/[\n;&|`$<>()]/.test(text)) return "it holds shell syntax, and a rule matches one command";
   const words = text.split(/\s+/);
   const bare = words.length === 1 && text.endsWith("*") ? text.slice(0, -1) : words.length === 2 && words[1] === "*" ? words[0] : undefined;
@@ -36,15 +37,18 @@ export function refuseTool(tool) {
  * Rules are order-dependent and the last match wins, so new allows go straight after the
  * catch-all. Every existing `deny` or `ask` comes later and keeps overriding them.
  */
-export function withBashAllows(rules, patterns) {
+export function withBashAllows(rules, patterns, guards = []) {
   const entries = Object.entries(rules ?? { "*": "ask" });
   const fresh = patterns.filter((pattern) => !entries.some(([existing]) => existing === pattern));
   const at = entries[0]?.[0] === "*" ? 1 : 0;
   const next = [...entries.slice(0, at), ...fresh.map((pattern) => [pattern, "allow"]), ...entries.slice(at)];
+  // Guards ask about part of what those allows match, so they go after them, wherever they are.
+  const last = Math.max(...patterns.map((pattern) => next.findIndex(([existing]) => existing === pattern)));
+  next.splice(last + 1, 0, ...guards.filter((pattern) => !entries.some(([existing]) => existing === pattern)).map((pattern) => [pattern, "ask"]));
   return Object.fromEntries(next);
 }
 
-export function applyRules(config, { bash = [], tools = [] }) {
+export function applyRules(config, { bash = [], tools = [], guards = [] }) {
   const refusals = [
     ...bash.flatMap((pattern) => {
       const why = refuseBash(pattern);
@@ -60,7 +64,8 @@ export function applyRules(config, { bash = [], tools = [] }) {
   if (bash.length > 0) {
     if (permission.bash !== undefined && (typeof permission.bash !== "object" || permission.bash === null))
       return { refusals: [`bash: its rule is the single word "${permission.bash}", so convert it to a map by hand`] };
-    permission.bash = withBashAllows(permission.bash, bash);
+    // With no bash rules, bash follows the catch-all, so a new map has to start from it.
+    permission.bash = withBashAllows(permission.bash ?? { "*": permission["*"] ?? "ask" }, bash, guards);
   }
   for (const tool of tools) if (permission[tool] !== "deny") permission[tool] = "allow";
   return { config: { ...config, permission }, refusals: [] };
@@ -121,13 +126,13 @@ function writeWithBackup(path, config) {
   return backup;
 }
 
-function planChoices(agent, { bash = [], tools = [], read = [], write = [], domains = [] }) {
+function planChoices(agent, { bash = [], tools = [], guards = [], read = [], write = [], domains = [] }) {
   const path = join(agent, "extensions", "pi-permission-system", "config.json");
   const sandboxPath = join(agent, "sandbox.json");
   const wantsRules = bash.length > 0 || tools.length > 0;
   const wantsSandbox = read.length > 0 || write.length > 0 || domains.length > 0;
   if (wantsRules && !existsSync(path)) return { refusals: [`No config at ${path}.`] };
-  const rules = wantsRules ? applyRules(JSON.parse(readFileSync(path, "utf8")), { bash, tools }) : { refusals: [] };
+  const rules = wantsRules ? applyRules(JSON.parse(readFileSync(path, "utf8")), { bash, tools, guards }) : { refusals: [] };
   let sandboxConfig = {};
   if (wantsSandbox && existsSync(sandboxPath)) {
     try {

package/packages/modes/src/review/collect.mjs

@@ -25,6 +25,8 @@ export function ruleFor(rules, value) {
 /** Two words for tools with subcommands, like `git diff*`, and a narrower rule is the reviewer's to choose. */
 export function suggestPattern(command) {
   const words = command.trim().split(/\s+/);
+  // `cd*` would also match `cdk deploy`. Paths are still checked against the folder it moves to.
+  if (words[0] === "cd") return "cd *";
   const second = words[1];
   return second !== undefined && /^[a-z][\w:-]*$/i.test(second) ? `${words[0]} ${second}*` : `${words[0]}*`;
 }
@@ -47,6 +49,8 @@ export function collect(entries, permission = {}, history = []) {
     const by = entry.decidedBy;
     if (!PERSON.has(by?.kind) && !(by?.kind === "authorizer" && by.name !== "pi-modes")) continue;
     const surface = entry.surface ?? entry.toolName;
+    // Auto lets project edits through by itself, so these say nothing about a rule worth adding.
+    if (by?.kind === "authorizer" && (surface === "edit" || surface === "write")) continue;
 
     if (surface === "bash") {
       const command = entry.executedUnit ?? entry.command;
@@ -76,6 +80,44 @@ export function collect(entries, permission = {}, history = []) {
   return { candidates, skipped };
 }
 
+/**
+ * What the permission judge decided, from its entries in the log: how often, why it passed asks on,
+ * and what you then approved yourself, which is what auto could have spared you.
+ */
+export function collectJudge(entries) {
+  const decisions = entries.filter((entry) => entry.event === "classifier.decision");
+  const verdicts = { allow: 0, deny: 0, defer: 0 };
+  const reasons = new Map();
+  const deferred = new Map();
+  for (const entry of decisions) {
+    if (entry.verdict in verdicts) verdicts[entry.verdict] += 1;
+    if (entry.verdict !== "defer") continue;
+    const reason = entry.deferReason ?? "uncertain";
+    const group = reasons.get(reason) ?? { reason, count: 0, surfaces: new Set(), last: "" };
+    group.count += 1;
+    if (typeof entry.surface === "string") group.surfaces.add(entry.surface);
+    if (String(entry.timestamp ?? "") > group.last) group.last = String(entry.timestamp);
+    reasons.set(reason, group);
+    if (typeof entry.requestId === "string") deferred.set(entry.requestId, { reason, surface: entry.surface, value: entry.value });
+  }
+  const approved = new Map();
+  for (const entry of entries) {
+    const asked = deferred.get(entry.requestId);
+    if (asked === undefined || !APPROVED.has(entry.resolution) || !PERSON.has(entry.decidedBy?.kind)) continue;
+    const value = typeof asked.value === "string" && asked.surface === "bash" && !SECRET.test(asked.value) ? suggestPattern(asked.value) : "";
+    const key = `${asked.surface} ${value} ${asked.reason}`;
+    const group = approved.get(key) ?? { surface: asked.surface, ...(value === "" ? {} : { pattern: value }), reason: asked.reason, approvals: 0 };
+    group.approvals += 1;
+    approved.set(key, group);
+  }
+  return {
+    decisions: decisions.length,
+    ...verdicts,
+    deferReasons: [...reasons.values()].map((group) => ({ ...group, surfaces: [...group.surfaces] })).sort((a, b) => b.count - a.count),
+    deferredThenApproved: [...approved.values()].sort((a, b) => b.approvals - a.approvals).slice(0, MAX_CANDIDATES),
+  };
+}
+
 /**
  * Commands that ran, from one session's chat history. It doesn't say who approved them, so they
  * count separately from approvals. Failed or blocked calls and anything run in yolo are left out.
@@ -196,7 +238,8 @@ export async function reviewData(agent) {
       blocks.push(...sandboxBlocks(entries));
     }
   }
-  const result = capped(collect(logFound ? parseLog(await readFile(logPath, "utf8")) : [], permission, history));
+  const log = logFound ? parseLog(await readFile(logPath, "utf8")) : [];
+  const result = capped(collect(log, permission, history));
   const sandboxPath = join(agent, "sandbox.json");
   let sandboxConfig = {};
   try {
@@ -204,5 +247,5 @@ export async function reviewData(agent) {
   } catch {
     // Comments are allowed there. Already-allowed entries may show up, and apply won't add them twice.
   }
-  return { logFound, ...result, sandbox: capped(collectSandbox(blocks, sandboxConfig)) };
+  return { logFound, ...result, judge: collectJudge(log), sandbox: capped(collectSandbox(blocks, sandboxConfig)) };
 }

package/packages/modes/src/workdir.ts

@@ -0,0 +1,163 @@
+/**
+ * Bash keeps its folder, the way a shell would: a `cd` at the start of a command carries over to later commands while
+ * it stays in the project. Pi starts a new shell for each command, so later ones get the prefix from here, before the
+ * permission system reads them. It follows a literal cd, so paths are judged from the right folder, and this works
+ * with whichever extension runs bash, such as pi-sandbox. Replacing the bash tool would turn that extension off.
+ */
+import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { isAbsolute, join, normalize, relative, resolve, sep } from "node:path";
+import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { applyChoices, checkChoices } from "./review/apply.mjs";
+import { ruleFor } from "./review/collect.mjs";
+
+const LEADING_CD = /^\s*cd\s+(?:'([^']*)'|"([^"$`\\]*)"|([^\s;&|`$<>()'"\\]+))(?=\s*(?:&&|;|\n|$))/;
+/** A cd anywhere in a chain, with a path that's plain text. */
+const ANY_CD = /(^|&&|\|\||[;|\n({]|\b(?:then|do|else)\b)(\s*cd\s+)(?:'([^']*)'|"([^"$`\\]*)"|([^\s;&|`$<>()'"\\]+))(?=\s*(?:&&|\|\||[;|\n)}]|$))/g;
+const WORKDIR_ENTRY = "pi-modes-workdir";
+const PLAIN = /^[\w@%+=:,./-]+$/;
+/** Bare when it can be, as a rule like `cd /work/app/*` only matches the path as written. */
+const quoted = (text: string) => (PLAIN.test(text) ? text : `'${text.replaceAll("'", "'\\''")}'`);
+
+function folderAt(path: string): string | undefined {
+  try {
+    return statSync(path).isDirectory() ? realpathSync(path) : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Where a cd goes. A model often repeats a move it already made, so a path that isn't here counts if it's how the
+ * current folder ends. Nothing else is guessed: `cd build && rm -rf *` has to fail if there's no build folder here.
+ */
+export function cdTarget(root: string, here: string | undefined, target: string): string | undefined {
+  if (target === "-") return undefined;
+  const path = target === "~" || target.startsWith("~/") ? join(homedir(), target.slice(1)) : target;
+  const from = here ?? root;
+  const folder = folderAt(resolve(from, path));
+  if (folder !== undefined) return folder;
+  const repeat = normalize(`${path}/`).slice(0, -1);
+  const below = relative(root, from);
+  return below === repeat || below.endsWith(`${sep}${repeat}`) ? from : undefined;
+}
+
+/**
+ * A cd rule for the project also matches `cd <root>/link` and `cd <root>/../x`, which leave it. Written as where they
+ * really go, the rule no longer matches, and the permission system asks.
+ */
+export function realCds(root: string, command: string): string {
+  return command.replace(ANY_CD, (all, before: string, cd: string, single?: string, double?: string, bare?: string) => {
+    const path = single ?? double ?? bare ?? "";
+    if (!path.startsWith(`${root}/`)) return all;
+    const real = folderAt(path) ?? resolve(path);
+    return real === path ? all : `${before}${cd}${quoted(real)}`;
+  });
+}
+
+/** The command to really run, and the folder it moves to if it starts with a cd. */
+export function planCommand(root: string, here: string | undefined, command: string): { command: string; move?: string } {
+  const match = LEADING_CD.exec(command);
+  const move = match === null ? undefined : cdTarget(root, here, match[1] ?? match[2] ?? match[3] ?? "");
+  if (match !== null && move !== undefined) return { command: realCds(root, `cd ${quoted(move)}${command.slice(match[0].length)}`), move };
+  const rest = realCds(root, command);
+  return { command: here === undefined ? rest : `cd ${quoted(here)} && ${rest}` };
+}
+
+export function isInside(root: string, folder: string): boolean {
+  const inside = relative(root, folder);
+  return inside !== ".." && !inside.startsWith(`..${sep}`) && !isAbsolute(inside);
+}
+
+/** A cd inside the project, as typed or as its full path. Nothing shorter is safe: the permission system doesn't follow a new file's name into the folder a cd reached. */
+export function cdRules(root: string): string[] {
+  return [`cd ${word(root)}`, `cd ${word(root, "/*")}`];
+}
+
+/** What the rules above match but can't vouch for: a way out of the project, or text the shell turns into a path. */
+export function cdGuards(root: string): string[] {
+  return ["..", "$", "`", "\\"].map((risky) => `cd ${word(root, `/*${risky}*`)}`);
+}
+
+/** The folder as bash gets it, as a rule only matches what's written. */
+function word(root: string, tail = ""): string {
+  return PLAIN.test(root) ? `${root}${tail}` : `'${`${root}${tail}`.replaceAll("'", "'\\''")}'`;
+}
+
+/** Rules added before the guards existed get them. Nothing else changes, and removed rules stay removed. */
+export function addCdGuards(agentDir: string, root: string): void {
+  const path = join(agentDir, "extensions", "pi-permission-system", "config.json");
+  try {
+    const bash = JSON.parse(readFileSync(path, "utf8")).permission?.bash;
+    const rules = cdRules(root);
+    if (typeof bash !== "object" || bash === null || bash[rules[1] as string] !== "allow" || cdGuards(root).every((guard) => guard in bash)) return;
+    applyChoices(agentDir, { bash: rules, guards: cdGuards(root) });
+  } catch {
+    // Not ours to fix. It's tried again next start.
+  }
+}
+
+/**
+ * The permission system judges each part of a chain, so with "*" asking, every `cd x && go test` asks about the cd.
+ * Moving inside the project does nothing by itself, so it's allowed for this project, once, with a backup. A cd
+ * anywhere else still asks. Whoever removes the rules keeps them removed. Returns what to tell the user.
+ */
+export function addCdRules(agentDir: string, root: string): { handled: boolean; notice?: string } {
+  const path = join(agentDir, "extensions", "pi-permission-system", "config.json");
+  if (root === "/" || !existsSync(path)) return { handled: false };
+  try {
+    const permission = JSON.parse(readFileSync(path, "utf8")).permission ?? {};
+    const { bash } = permission;
+    // With no bash rules, bash follows the catch-all, which is ask when that isn't set either.
+    const asks = bash === undefined ? (permission["*"] ?? "ask") === "ask" : typeof bash === "object" && bash !== null && ruleFor(bash, `cd ${root}/x`) === "ask";
+    if (!asks) return { handled: true };
+    const rules = cdRules(root);
+    if (checkChoices(agentDir, { bash: rules }).length > 0) return { handled: true }; // A path a rule can't hold.
+    applyChoices(agentDir, { bash: rules, guards: cdGuards(root) });
+    return { handled: true, notice: `pi-modes allowed cd inside this project in your bash rules, so you aren't asked about each one. The rest of each command, and a cd anywhere else, are still checked. Remove them from ${path} if you'd rather be asked.` };
+  } catch {
+    return { handled: false }; // Not ours to fix. It's tried again next start.
+  }
+}
+
+/** The folder this point of the session was in, so what the model was told stays true after a reload, a resume or a move in the tree. */
+export function savedFolder(root: string, entries: readonly { type: string; customType?: string; data?: unknown }[]): string | undefined {
+  let saved: unknown;
+  for (const entry of entries) if (entry.type === "custom" && entry.customType === WORKDIR_ENTRY) saved = (entry.data as { folder?: unknown } | undefined)?.folder;
+  if (typeof saved !== "string" || saved === root || !isInside(root, saved)) return undefined;
+  return folderAt(saved) === saved ? saved : undefined;
+}
+
+export function registerWorkdir(pi: ExtensionAPI) {
+  let here: string | undefined;
+  const moves = new Map<string, string>();
+  const restore = (_event: unknown, ctx: ExtensionContext) => {
+    here = savedFolder(realpathSync(ctx.cwd), ctx.sessionManager.getBranch());
+    moves.clear();
+  };
+  pi.on("session_start", restore);
+  pi.on("session_tree", restore);
+  pi.on("tool_result", (event, ctx) => {
+    const move = moves.get(event.toolCallId);
+    if (move === undefined) return undefined;
+    moves.delete(event.toolCallId);
+    if (event.isError) return undefined;
+    const root = realpathSync(ctx.cwd);
+    const stays = isInside(root, move);
+    const next = stays && move !== root ? move : undefined;
+    if (next !== here) pi.appendEntry(WORKDIR_ENTRY, { folder: next ?? null });
+    here = next;
+    // Told here rather than in the system prompt, which would cost every request and replace the subscription part's prompt.
+    const note = stays ? `Bash stays in ${move} for later commands, so don't repeat the cd.` : `Shell cwd was reset to ${root}`;
+    return { content: [...event.content, { type: "text" as const, text: `\n${note}` }] };
+  });
+  return {
+    folder: () => here,
+    /** Rewrites a bash call in place. */
+    apply(toolCallId: string, input: { command: string }, cwd: string): void {
+      const plan = planCommand(realpathSync(cwd), here, input.command);
+      input.command = plan.command;
+      if (plan.move !== undefined) moves.set(toolCallId, plan.move);
+    },
+  };
+}

package/packages/router/README.md

@@ -9,7 +9,7 @@ Adds `router/auto` to [Pi](https://pi.dev): one choice in `/model` that uses a s
 Requires Pi 1.5 or newer.
 
 ```bash
-pi install npm:@huseynsnmz/pi-suite@0.2.3
+pi install npm:@huseynsnmz/pi-suite@0.2.5
 ```
 
 Log in to the providers you want with `/login`, run `/router` to choose a model for each role, then pick `router/auto` in `/model`. It's always listed there, and until `plan` and `build` are set it stops with a message telling you to run `/router`.
@@ -23,6 +23,7 @@ In `/model`, `Enter` selects a model for this session and `Ctrl+S` saves it as y
 | `plan` | Reads and plans, up to the first edit, and everything in `plan` mode | Required |
 | `build` | Everything after that, and compaction summaries | Required |
 | `reader` | Reads web pages for [pi-web](https://github.com/huseynsnmz/pi-suite/tree/main/packages/web) | Same as `build` |
+| `mastermind` | Reviews past conversations for `/mastermind`, and writes rules for the other models | Not set |
 | `judge` | Decides permission asks for `pi-permission-classifier` | See below |
 | `subagent` | Runs subagents that use `router/auto` | Same as `build` |
 | `fallback` | Takes over when a provider is overloaded or rate limited | Retries on the same model |

package/packages/router/src/config.ts

@@ -2,7 +2,7 @@
 import { readSection, writeSection } from "../../../src/settings.ts";
 
 /** The judge's model lives only in the judge's own config, so there's one answer to which model judges. */
-export const ROLES = ["plan", "build", "reader", "subagent", "fallback"] as const;
+export const ROLES = ["plan", "build", "reader", "subagent", "fallback", "mastermind"] as const;
 export type Role = (typeof ROLES)[number];
 
 export const THINKING_LEVELS = ["off", "minimal", "low", "medium", "high", "xhigh", "max"] as const;
@@ -16,6 +16,7 @@ export interface RouterConfig {
   reader?: string;
   subagent?: string;
   fallback?: string;
+  mastermind?: string;
   thinking?: RoleThinking;
 }
 

package/packages/router/src/index.ts

@@ -7,6 +7,7 @@ import { chooseModel, type RouterState } from "./route.ts";
 
 /** Other extensions emit these with an object, and whoever knows fills it in, whatever the load order. */
 const READER_PROBE = "pi-router:reader-model";
+const MASTERMIND_PROBE = "pi-router:mastermind-model";
 const MODE_PROBE = "pi-modes:mode";
 const SETTINGS_PROBE = "pi-suite:router-settings";
 
@@ -21,6 +22,7 @@ const ROLE_HELP: Record<Role, string> = {
   reader: "reads web pages for pi-web",
   subagent: "runs subagents that use this virtual model",
   fallback: "takes over when a provider is overloaded",
+  mastermind: "reviews past conversations for /mastermind, and writes rules for the other models",
 };
 
 /** What a role shows, and offers to go back to, with no model of its own. */
@@ -28,6 +30,7 @@ const UNSET: Partial<Record<Role, string>> = {
   reader: "same as build",
   subagent: "same as build",
   fallback: "none",
+  mastermind: "none",
 };
 
 function refOf(model: { provider: string; id: string } | undefined): string | undefined {
@@ -53,6 +56,12 @@ export default function piRouter(pi: ExtensionAPI): void {
     probe.thinking = saved.thinking?.[saved.reader === undefined ? "build" : "reader"];
   });
 
+  pi.events.on(MASTERMIND_PROBE, (data) => {
+    const probe = data as { model?: string; thinking?: ThinkingLevel };
+    probe.model = saved.mastermind;
+    probe.thinking = saved.thinking?.mastermind;
+  });
+
   function currentMode(): string | undefined {
     const probe: { mode?: string } = {};
     pi.events.emit(MODE_PROBE, probe);