@huseynsnmz/pi-suite 0.2.4 → 0.2.5

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## [0.2.5]
+
+### Security
+
+- `auto`: a path Pi rewrites before writing, such as `@.git/hooks/pre-commit`, `@/etc/x` or `file:///etc/x`, went past the project check. These now go to the judge.
+- `auto`: `.GIT` and `.Github` on a case-insensitive disk went past the guarded folder check.
+- The `cd` rules matched `cd <project>/../x`, paths the shell works out later, and symlinks out of the project. They now ask. Projects that already have the rules get the new ones at the next start.
+- An agent started in the default mode, not its parent's, so a parent in `normal` could have a child in `auto`. It now takes its parent's mode. From `plan` it's `read-only`, and from `yolo` it's `normal`.
+- A tool named `agent` from another package no longer skips the judge and your review.
+- `/review-permissions` refuses `cd*`, which also matches `cdk deploy`.
+
+### Fixes
+
+- A `cd` to a folder that isn't there could run somewhere else: `cd build && rm -rf *` in a folder with no `build` went to the project's top `build`. It now fails as in a shell.
+- The bash folder is kept across `/reload` and `/resume`, and follows moves in `/tree`.
+- With no `bash` rules and a catch-all of `allow`, adding the `cd` rules made every command ask. `/review-permissions` had the same problem. Rules now start from your catch-all.
+- `cd` rules work in projects with a space in the path.
+- `/mastermind` no longer marks sessions as reviewed when the answer was cut off or can't be read, and a retry keeps the proposals it didn't repeat.
+- Non-English text in an agent's answer can't be garbled where it's split across chunks.
+
 ## [0.2.4]
 
 ### Features

package/README.md

@@ -25,7 +25,7 @@ There's no setting per project, so a repository can't choose where your code goe
 Requires Pi 1.5 or newer.
 
 ```bash
-pi install npm:@huseynsnmz/pi-suite@0.2.4
+pi install npm:@huseynsnmz/pi-suite@0.2.5
 ```
 
 If you installed any of these separately, remove them first:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@huseynsnmz/pi-suite",
-  "version": "0.2.4",
+  "version": "0.2.5",
   "description": "One Pi package for all of it: modes and permissions, a framed screen, an agent board, memory, web tools with a separate page reader, and a model router. Turn off what you don't want with /suite.",
   "type": "module",
   "license": "MIT",

package/packages/board/README.md

@@ -26,7 +26,7 @@ Requires Pi 1.5 or newer.
 1. Install it:
 
    ```bash
-   pi install npm:@huseynsnmz/pi-suite@0.2.4
+   pi install npm:@huseynsnmz/pi-suite@0.2.5
    ```
 
 2. Restart Pi, and press `Left` twice on an empty prompt, or run `/agent-board`.

package/packages/frame/README.md

@@ -19,7 +19,7 @@ Requires Pi 1.5 or newer.
 2. Install it:
 
    ```bash
-   pi install npm:@huseynsnmz/pi-suite@0.2.4
+   pi install npm:@huseynsnmz/pi-suite@0.2.5
    ```
 
 3. Restart Pi. The start card says `π-frame`.

package/packages/memory/README.md

@@ -9,7 +9,7 @@ Long-term memory for [Pi](https://pi.dev). It reviews your past conversations, k
 Requires Pi 1.5 or newer, on Node 22.18 or newer.
 
 ```bash
-pi install npm:@huseynsnmz/pi-suite@0.2.4
+pi install npm:@huseynsnmz/pi-suite@0.2.5
 ```
 
 ## Use

package/packages/memory/src/mastermind.ts

@@ -4,7 +4,7 @@
  */
 import { randomBytes } from "node:crypto";
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
-import { COMPACT_SYSTEM, compactPrompt, GLOBAL, parseProposals, PLAYBOOK_CHARS, readPlaybook, REVIEW_SYSTEM, reviewPrompt, writePlaybook } from "./playbook.ts";
+import { COMPACT_SYSTEM, compactPrompt, GLOBAL, parseProposals, PLAYBOOK_CHARS, readPlaybook, readProposals, REVIEW_SYSTEM, reviewPrompt, writePlaybook } from "./playbook.ts";
 import { nextBatch } from "./review.ts";
 import { hasSecret } from "./secrets.ts";
 import type { MemoryStore } from "./store.ts";
@@ -31,16 +31,18 @@ async function ask(ctx: ExtensionContext, chosen: Mastermind, systemPrompt: stri
   ).result();
   // Not the provider's message, as some repeat part of the request, and that's your conversations.
   if (response.stopReason === "error" || response.stopReason === "aborted") throw new Error(`${chosen.model} failed (${response.stopReason})`);
+  if (response.stopReason === "length") throw new Error(`${chosen.model} ran out of room before it finished, so nothing was marked as reviewed. Try a lower reasoning level in /router.`);
   return response.content.flatMap((part) => (part.type === "text" ? [part.text] : [])).join("\n");
 }
 
 /** The model has one chance to fit the limit. After that it's yours to trim in the editor. */
 async function propose(ctx: ExtensionContext, chosen: Mastermind, system: string, text: string, allowed: ReadonlySet<string>): Promise<Map<string, string>> {
-  const first = parseProposals(await ask(ctx, chosen, system, text), allowed);
+  const first = readProposals(await ask(ctx, chosen, system, text), allowed);
   if (![...first.values()].some((doc) => doc.length > PLAYBOOK_CHARS)) return first;
   const again = `${text}\n\nYour last answer went over the limit of ${PLAYBOOK_CHARS} characters:\n\n${[...first].map(([scope, doc]) => `<playbook scope="${scope}">${doc}</playbook>`).join("\n")}\n\nAnswer again within the limit.`;
   const second = parseProposals(await ask(ctx, chosen, system, again), allowed);
-  return second.size > 0 ? second : first;
+  // It may answer again for only the ones that were too long.
+  return new Map([...first, ...second]);
 }
 
 function why(text: string): string | undefined {

package/packages/memory/src/playbook.ts

@@ -82,6 +82,13 @@ export function compactPrompt(playbooks: Map<string, string>): string {
 }
 
 /** What the model proposes, by scope. Only scopes it was given can come back, so it can't write to any other folder. */
+/** A reply that's neither rules nor NONE was cut off or went wrong, and must not count as having nothing to say. */
+export function readProposals(reply: string, allowed: ReadonlySet<string>): Map<string, string> {
+  const proposals = parseProposals(reply, allowed);
+  if (proposals.size === 0 && !/\bNONE\W*$/.test(reply)) throw new Error("Its answer couldn't be read, so nothing was marked as reviewed. Try again.");
+  return proposals;
+}
+
 export function parseProposals(reply: string, allowed: ReadonlySet<string>): Map<string, string> {
   const proposals = new Map<string, string>();
   for (const match of reply.matchAll(/<playbook scope="([^"]*)">([\s\S]*?)<\/playbook>/g)) {

package/packages/modes/README.md

@@ -23,7 +23,7 @@ Requires Pi 1.5 or newer.
 1. Install it:
 
    ```bash
-   pi install npm:@huseynsnmz/pi-suite@0.2.4
+   pi install npm:@huseynsnmz/pi-suite@0.2.5
    ```
 
 2. Move pi-suite above `@gotgenes/pi-permission-system`, because `pi install` adds packages last. Otherwise, in `plan` and `read-only` you may be asked to approve an action that is then blocked anyway. It stays blocked either way, and the extension warns you at startup. Skip this step if you don't use that package.
@@ -122,9 +122,9 @@ In `auto`, `edit` and `write` on files in the project skip the judge, so you are
 
 `/review-permissions` also reads the judge's decisions from the review log, and says why `auto` keeps asking.
 
-**Moving around:** bash keeps its folder, as in Claude Code. A `cd` at the start of a command carries over to later commands while it stays in the project, and the command's result tells the model so. A move outside runs once, and then the result says `Shell cwd was reset`. Later commands run as `cd <folder> && <command>`, which the permission system follows, so paths are checked from the right place. A `cd` it can't follow, such as `cd "$DIR"`, works for that command only. `read`, `edit` and `write` paths don't move.
+**Moving around:** bash keeps its folder, as in Claude Code. A `cd` at the start of a command carries over to later commands while it stays in the project, and the command's result tells the model so. A move outside runs once, and then the result says `Shell cwd was reset`. The folder is saved in the session, so it's still there after `/reload` or `/resume`, and moving in `/tree` goes back to the folder that point was in. A folder that isn't there fails as it would in a shell, unless the model is repeating the move it just made. Later commands run as `cd <folder> && <command>`, which the permission system follows, so paths are checked from the right place. A `cd` it can't follow, such as `cd "$DIR"`, works for that command only. `read`, `edit` and `write` paths don't move.
 
-The permission system judges each part of a chain, so with `"*": "ask"`, every `cd x && go test` would ask about the `cd`. The first time you start Pi in a project, pi-modes allows `cd` inside that project in your bash rules, keeps a backup, and tells you. The rest of the command is still checked, and so is a `cd` anywhere else or one it can't read, such as `cd "$DIR"`. A blanket `"cd *": "allow"` is not the same: the permission system doesn't follow a new file's name into the folder a `cd` reached, so `cd /elsewhere && touch new` would go unchecked. It won't overwrite a rule of your own, and if you remove the rules, they stay removed. If the permission system loaded before pi-suite, restart Pi once for them to apply. Without a permission judge, add `"agent": "allow"` too, or you'll be asked about each `agent` call.
+The permission system judges each part of a chain, so with `"*": "ask"`, every `cd x && go test` would ask about the `cd`. The first time you start Pi in a project, pi-modes allows `cd` inside that project in your bash rules, keeps a backup, and tells you. The rest of the command is still checked, and so is a `cd` anywhere else, one it can't read, such as `cd "$DIR"`, or one that leaves through `..` or a symlink. A blanket `"cd *": "allow"` is not the same: the permission system doesn't follow a new file's name into the folder a `cd` reached, so `cd /elsewhere && touch new` would go unchecked. It won't overwrite a rule of your own, and if you remove the rules, they stay removed. If the permission system loaded before pi-suite, restart Pi once for them to apply. Without a permission judge, add `"agent": "allow"` too, or you'll be asked about each `agent` call.
 
 Without a classifier, `auto` behaves like `normal`, and the extension warns you when you switch to it.
 

package/packages/modes/src/index.ts

@@ -9,10 +9,10 @@ import { gitRisk } from "./git-safety.ts";
 import { registerInterview } from "./interview.ts";
 import { registerReviewTools } from "./review/tools.ts";
 import { aliasDefinitions, DENY_OFF_PROMPT, withAliases, withoutAliases } from "./deny-off.ts";
-import { addCdRules, registerWorkdir } from "./workdir.ts";
-import { clearGate, hasPermissionSystem, installJudgeGate, JUDGE_NAMES, judgeGated, noteEditPaths, registerYoloLink, setGateCwd, setGateMode, YOLO_LINK } from "./judge-gate.ts";
+import { addCdGuards, addCdRules, registerWorkdir } from "./workdir.ts";
+import { clearGate, hasPermissionSystem, installJudgeGate, JUDGE_NAMES, judgeGated, noteEditPaths, registerYoloLink, setGateAgentOurs, setGateCwd, setGateMode, YOLO_LINK } from "./judge-gate.ts";
 import { readSection, writeSection } from "../../../src/settings.ts";
-import { decideToolCall, displayCommand, fromExpectedPackage, notReadOnly, isMode, scriptedChange, loadsAfterPermissionSystem, type Mode, MODES, modePrompt, nextMode, resumedMode, startingMode, SUBMIT_PLAN_TOOL } from "./modes.ts";
+import { AGENT_TOOL, decideToolCall, displayCommand, fromExpectedPackage, notReadOnly, isMode, scriptedChange, loadsAfterPermissionSystem, type Mode, MODES, modePrompt, nextMode, resumedMode, startingMode, SUBMIT_PLAN_TOOL } from "./modes.ts";
 
 const STATUS_KEY = "pi-modes";
 const DENY_STATUS_KEY = "pi-modes-deny";
@@ -108,7 +108,7 @@ function restoredMode(ctx: ExtensionContext): Mode {
     const saved: unknown = (entry.data as { mode?: unknown } | undefined)?.mode;
     if (isMode(saved)) mode = saved;
   }
-  if (mode === undefined && process.env.PI_MODES_START === "auto") return "auto"; // An agent started in auto.
+  if (mode === undefined && process.env.PI_SUBAGENT_CHILD === "1") return startingMode(process.env.PI_MODES_START); // Its parent's say, not the default.
   return mode === undefined ? startingMode(readConfig().defaultMode) : resumedMode(mode);
 }
 
@@ -119,7 +119,9 @@ export default function piModes(pi: ExtensionAPI): void {
   const project = realpathSync(process.cwd());
   const cdFolders = readConfig().cdRuleFolders;
   const handled = Array.isArray(cdFolders) ? (cdFolders as string[]) : [];
-  const cdRule = process.env.PI_SUBAGENT_CHILD === "1" || handled.includes(project) ? { handled: false } : addCdRules(getAgentDir(), project);
+  const isChild = process.env.PI_SUBAGENT_CHILD === "1";
+  if (!isChild && handled.includes(project)) addCdGuards(getAgentDir(), project);
+  const cdRule = isChild || handled.includes(project) ? { handled: false } : addCdRules(getAgentDir(), project);
   if (cdRule.handled) writeSection(getAgentDir(), "modes", { ...readConfig(), cdRuleFolders: [...handled, project] });
   let cdNotice = cdRule.notice;
 
@@ -148,6 +150,8 @@ export default function piModes(pi: ExtensionAPI): void {
     if (next !== "yolo") denyOff = false;
     setGateMode(ctx.sessionManager.getSessionId(), next);
     setGateCwd(ctx.sessionManager.getSessionId(), ctx.cwd);
+    const agentTool = pi.getAllTools().find((tool) => tool.name === AGENT_TOOL);
+    setGateAgentOurs(ctx.sessionManager.getSessionId(), agentTool !== undefined && fromExpectedPackage(AGENT_TOOL, agentTool.sourceInfo.path));
     let others = withoutAliases(pi.getActiveTools().filter((name) => name !== SUBMIT_PLAN_TOOL), replacedTools);
     replacedTools = [];
     if (denyOff) ({ active: others, replaced: replacedTools } = withAliases(others));

package/packages/modes/src/judge-gate.ts

@@ -39,6 +39,8 @@ interface SessionState {
   mode: Mode;
   judgeGated: boolean;
   cwd?: string;
+  /** Whether the `agent` tool is pi-suite's own. Another package's could do anything. */
+  agentIsOurs?: boolean;
   /** Where the model's latest edits and writes go, by call id, as an ask doesn't say. */
   editPaths?: Map<string, string>;
 }
@@ -46,6 +48,12 @@ interface SessionState {
 /** Inside a project, but they run code or change what Pi does, so the judge still looks. */
 const GUARDED = new Set([".git", ".pi", ".claude", ".husky", ".github", ".vscode", ".envrc"]);
 
+/**
+ * Pi's edit and write tools rewrite these before opening the file, so the path as written isn't the one written to.
+ * The judge sees them rather than this copying Pi's rules, which could drift.
+ */
+const REWRITTEN_BY_PI = /^@|^file:|[\u00A0\u2000-\u200A\u202F\u205F\u3000]/;
+
 /** The path with symlinks followed, as far as it exists. Undefined for a link that leads nowhere. */
 function realTarget(path: string): string | undefined {
   if (existsSync(path)) return realpathSync(path);
@@ -63,19 +71,20 @@ function realTarget(path: string): string | undefined {
 /** An edit or write to an ordinary file in the project: what `auto` lets through without asking anyone. */
 export function isProjectEdit(details: unknown, cwd: string | undefined): boolean {
   const { toolName, path } = (details ?? {}) as { toolName?: unknown; path?: unknown };
-  if ((toolName !== "edit" && toolName !== "write") || typeof path !== "string" || cwd === undefined) return false;
+  if ((toolName !== "edit" && toolName !== "write") || typeof path !== "string" || cwd === undefined || REWRITTEN_BY_PI.test(path)) return false;
   const expanded = path === "~" || path.startsWith("~/") ? join(homedir(), path.slice(1)) : path;
   const target = realTarget(resolve(cwd, expanded));
   const root = realTarget(cwd);
   if (target === undefined || root === undefined) return false;
   const inside = relative(root, target);
   if (inside === "" || inside === ".." || inside.startsWith(`..${sep}`) || isAbsolute(inside)) return false;
-  return !inside.split(sep).some((part) => GUARDED.has(part));
+  // Lowercase, as macOS finds `.GIT` at `.git` by default.
+  return !inside.split(sep).some((part) => GUARDED.has(part.toLowerCase()));
 }
 
 /** It does nothing by itself: what the agent then does is still checked. */
-function needsNoAsk(details: unknown): boolean {
-  return (details as { toolName?: unknown } | undefined)?.toolName === AGENT_TOOL;
+function needsNoAsk(state: SessionState, details: unknown): boolean {
+  return state.agentIsOurs === true && (details as { toolName?: unknown } | undefined)?.toolName === AGENT_TOOL;
 }
 
 function autoAllows(state: SessionState, details: unknown, log: unknown): boolean {
@@ -113,7 +122,7 @@ function gateService(store: Store, sessionId: string, service: ServiceLike): voi
     stateFor(store, sessionId).judgeGated = true;
     return register(name, async (details, query, log) => {
       const state = stateFor(store, sessionId);
-      if (needsNoAsk(details)) return { kind: "allow" };
+      if (needsNoAsk(state, details)) return { kind: "allow" };
       if (state.mode !== "auto") return { kind: "defer" };
       return autoAllows(state, details, log) ? { kind: "allow" } : authorize(details, query, log);
     });
@@ -146,7 +155,7 @@ export function registerYoloLink(sessionId: string, store: Store = globalThis as
   if (typeof service?.registerAuthorizer !== "function") return undefined;
   return service.registerAuthorizer(YOLO_LINK, async (details, _query, log) => {
     const state = stateFor(store, sessionId);
-    return needsNoAsk(details) || state.mode === "yolo" || autoAllows(state, details, log) ? { kind: "allow" } : { kind: "defer" };
+    return needsNoAsk(state, details) || state.mode === "yolo" || autoAllows(state, details, log) ? { kind: "allow" } : { kind: "defer" };
   });
 }
 
@@ -175,6 +184,10 @@ export function setGateCwd(sessionId: string, cwd: string, store: Store = global
   stateFor(store, sessionId).cwd = cwd;
 }
 
+export function setGateAgentOurs(sessionId: string, ours: boolean, store: Store = globalThis as unknown as Store): void {
+  stateFor(store, sessionId).agentIsOurs = ours;
+}
+
 export function judgeGated(sessionId: string, store: Store = globalThis as unknown as Store): boolean {
   return stateFor(store, sessionId).judgeGated;
 }

package/packages/modes/src/review/apply.mjs

@@ -17,6 +17,7 @@ const REFUSED_SURFACES = new Set(["bash", "path", "external_directory", "mcp", "
 export function refuseBash(pattern) {
   const text = pattern.trim();
   if (text === "" || text.startsWith("*") || text.startsWith("?")) return "it matches any command";
+  if (text === "cd*") return "it also matches cdk and other commands, so write `cd *`";
   if (/[\n;&|`$<>()]/.test(text)) return "it holds shell syntax, and a rule matches one command";
   const words = text.split(/\s+/);
   const bare = words.length === 1 && text.endsWith("*") ? text.slice(0, -1) : words.length === 2 && words[1] === "*" ? words[0] : undefined;
@@ -36,15 +37,18 @@ export function refuseTool(tool) {
  * Rules are order-dependent and the last match wins, so new allows go straight after the
  * catch-all. Every existing `deny` or `ask` comes later and keeps overriding them.
  */
-export function withBashAllows(rules, patterns) {
+export function withBashAllows(rules, patterns, guards = []) {
   const entries = Object.entries(rules ?? { "*": "ask" });
   const fresh = patterns.filter((pattern) => !entries.some(([existing]) => existing === pattern));
   const at = entries[0]?.[0] === "*" ? 1 : 0;
   const next = [...entries.slice(0, at), ...fresh.map((pattern) => [pattern, "allow"]), ...entries.slice(at)];
+  // Guards ask about part of what those allows match, so they go after them, wherever they are.
+  const last = Math.max(...patterns.map((pattern) => next.findIndex(([existing]) => existing === pattern)));
+  next.splice(last + 1, 0, ...guards.filter((pattern) => !entries.some(([existing]) => existing === pattern)).map((pattern) => [pattern, "ask"]));
   return Object.fromEntries(next);
 }
 
-export function applyRules(config, { bash = [], tools = [] }) {
+export function applyRules(config, { bash = [], tools = [], guards = [] }) {
   const refusals = [
     ...bash.flatMap((pattern) => {
       const why = refuseBash(pattern);
@@ -60,7 +64,8 @@ export function applyRules(config, { bash = [], tools = [] }) {
   if (bash.length > 0) {
     if (permission.bash !== undefined && (typeof permission.bash !== "object" || permission.bash === null))
       return { refusals: [`bash: its rule is the single word "${permission.bash}", so convert it to a map by hand`] };
-    permission.bash = withBashAllows(permission.bash, bash);
+    // With no bash rules, bash follows the catch-all, so a new map has to start from it.
+    permission.bash = withBashAllows(permission.bash ?? { "*": permission["*"] ?? "ask" }, bash, guards);
   }
   for (const tool of tools) if (permission[tool] !== "deny") permission[tool] = "allow";
   return { config: { ...config, permission }, refusals: [] };
@@ -121,13 +126,13 @@ function writeWithBackup(path, config) {
   return backup;
 }
 
-function planChoices(agent, { bash = [], tools = [], read = [], write = [], domains = [] }) {
+function planChoices(agent, { bash = [], tools = [], guards = [], read = [], write = [], domains = [] }) {
   const path = join(agent, "extensions", "pi-permission-system", "config.json");
   const sandboxPath = join(agent, "sandbox.json");
   const wantsRules = bash.length > 0 || tools.length > 0;
   const wantsSandbox = read.length > 0 || write.length > 0 || domains.length > 0;
   if (wantsRules && !existsSync(path)) return { refusals: [`No config at ${path}.`] };
-  const rules = wantsRules ? applyRules(JSON.parse(readFileSync(path, "utf8")), { bash, tools }) : { refusals: [] };
+  const rules = wantsRules ? applyRules(JSON.parse(readFileSync(path, "utf8")), { bash, tools, guards }) : { refusals: [] };
   let sandboxConfig = {};
   if (wantsSandbox && existsSync(sandboxPath)) {
     try {

package/packages/modes/src/workdir.ts

@@ -6,14 +6,18 @@
  */
 import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { homedir } from "node:os";
-import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
-import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { isAbsolute, join, normalize, relative, resolve, sep } from "node:path";
+import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { applyChoices, checkChoices } from "./review/apply.mjs";
 import { ruleFor } from "./review/collect.mjs";
 
 const LEADING_CD = /^\s*cd\s+(?:'([^']*)'|"([^"$`\\]*)"|([^\s;&|`$<>()'"\\]+))(?=\s*(?:&&|;|\n|$))/;
+/** A cd anywhere in a chain, with a path that's plain text. */
+const ANY_CD = /(^|&&|\|\||[;|\n({]|\b(?:then|do|else)\b)(\s*cd\s+)(?:'([^']*)'|"([^"$`\\]*)"|([^\s;&|`$<>()'"\\]+))(?=\s*(?:&&|\|\||[;|\n)}]|$))/g;
+const WORKDIR_ENTRY = "pi-modes-workdir";
+const PLAIN = /^[\w@%+=:,./-]+$/;
 /** Bare when it can be, as a rule like `cd /work/app/*` only matches the path as written. */
-const quoted = (text: string) => (/^[\w@%+=:,./-]+$/.test(text) ? text : `'${text.replaceAll("'", "'\\''")}'`);
+const quoted = (text: string) => (PLAIN.test(text) ? text : `'${text.replaceAll("'", "'\\''")}'`);
 
 function folderAt(path: string): string | undefined {
   try {
@@ -23,24 +27,41 @@ function folderAt(path: string): string | undefined {
   }
 }
 
-/** Where a cd goes. A model often repeats a move it already made, so a path that isn't here is tried from the top and from one up. */
+/**
+ * Where a cd goes. A model often repeats a move it already made, so a path that isn't here counts if it's how the
+ * current folder ends. Nothing else is guessed: `cd build && rm -rf *` has to fail if there's no build folder here.
+ */
 export function cdTarget(root: string, here: string | undefined, target: string): string | undefined {
   if (target === "-") return undefined;
   const path = target === "~" || target.startsWith("~/") ? join(homedir(), target.slice(1)) : target;
   const from = here ?? root;
-  for (const base of [from, root, dirname(from)]) {
-    const folder = folderAt(resolve(base, path));
-    if (folder !== undefined) return folder;
-  }
-  return undefined;
+  const folder = folderAt(resolve(from, path));
+  if (folder !== undefined) return folder;
+  const repeat = normalize(`${path}/`).slice(0, -1);
+  const below = relative(root, from);
+  return below === repeat || below.endsWith(`${sep}${repeat}`) ? from : undefined;
+}
+
+/**
+ * A cd rule for the project also matches `cd <root>/link` and `cd <root>/../x`, which leave it. Written as where they
+ * really go, the rule no longer matches, and the permission system asks.
+ */
+export function realCds(root: string, command: string): string {
+  return command.replace(ANY_CD, (all, before: string, cd: string, single?: string, double?: string, bare?: string) => {
+    const path = single ?? double ?? bare ?? "";
+    if (!path.startsWith(`${root}/`)) return all;
+    const real = folderAt(path) ?? resolve(path);
+    return real === path ? all : `${before}${cd}${quoted(real)}`;
+  });
 }
 
 /** The command to really run, and the folder it moves to if it starts with a cd. */
 export function planCommand(root: string, here: string | undefined, command: string): { command: string; move?: string } {
   const match = LEADING_CD.exec(command);
   const move = match === null ? undefined : cdTarget(root, here, match[1] ?? match[2] ?? match[3] ?? "");
-  if (match !== null && move !== undefined) return { command: `cd ${quoted(move)}${command.slice(match[0].length)}`, move };
-  return { command: here === undefined ? command : `cd ${quoted(here)} && ${command}` };
+  if (match !== null && move !== undefined) return { command: realCds(root, `cd ${quoted(move)}${command.slice(match[0].length)}`), move };
+  const rest = realCds(root, command);
+  return { command: here === undefined ? rest : `cd ${quoted(here)} && ${rest}` };
 }
 
 export function isInside(root: string, folder: string): boolean {
@@ -50,7 +71,30 @@ export function isInside(root: string, folder: string): boolean {
 
 /** A cd inside the project, as typed or as its full path. Nothing shorter is safe: the permission system doesn't follow a new file's name into the folder a cd reached. */
 export function cdRules(root: string): string[] {
-  return [`cd ${root}`, `cd ${root}/*`];
+  return [`cd ${word(root)}`, `cd ${word(root, "/*")}`];
+}
+
+/** What the rules above match but can't vouch for: a way out of the project, or text the shell turns into a path. */
+export function cdGuards(root: string): string[] {
+  return ["..", "$", "`", "\\"].map((risky) => `cd ${word(root, `/*${risky}*`)}`);
+}
+
+/** The folder as bash gets it, as a rule only matches what's written. */
+function word(root: string, tail = ""): string {
+  return PLAIN.test(root) ? `${root}${tail}` : `'${`${root}${tail}`.replaceAll("'", "'\\''")}'`;
+}
+
+/** Rules added before the guards existed get them. Nothing else changes, and removed rules stay removed. */
+export function addCdGuards(agentDir: string, root: string): void {
+  const path = join(agentDir, "extensions", "pi-permission-system", "config.json");
+  try {
+    const bash = JSON.parse(readFileSync(path, "utf8")).permission?.bash;
+    const rules = cdRules(root);
+    if (typeof bash !== "object" || bash === null || bash[rules[1] as string] !== "allow" || cdGuards(root).every((guard) => guard in bash)) return;
+    applyChoices(agentDir, { bash: rules, guards: cdGuards(root) });
+  } catch {
+    // Not ours to fix. It's tried again next start.
+  }
 }
 
 /**
@@ -62,25 +106,37 @@ export function addCdRules(agentDir: string, root: string): { handled: boolean;
   const path = join(agentDir, "extensions", "pi-permission-system", "config.json");
   if (root === "/" || !existsSync(path)) return { handled: false };
   try {
-    const bash = JSON.parse(readFileSync(path, "utf8")).permission?.bash;
-    const asks = bash === undefined || (typeof bash === "object" && bash !== null && ruleFor(bash, `cd ${root}/x`) === "ask");
+    const permission = JSON.parse(readFileSync(path, "utf8")).permission ?? {};
+    const { bash } = permission;
+    // With no bash rules, bash follows the catch-all, which is ask when that isn't set either.
+    const asks = bash === undefined ? (permission["*"] ?? "ask") === "ask" : typeof bash === "object" && bash !== null && ruleFor(bash, `cd ${root}/x`) === "ask";
     if (!asks) return { handled: true };
     const rules = cdRules(root);
     if (checkChoices(agentDir, { bash: rules }).length > 0) return { handled: true }; // A path a rule can't hold.
-    applyChoices(agentDir, { bash: rules });
+    applyChoices(agentDir, { bash: rules, guards: cdGuards(root) });
     return { handled: true, notice: `pi-modes allowed cd inside this project in your bash rules, so you aren't asked about each one. The rest of each command, and a cd anywhere else, are still checked. Remove them from ${path} if you'd rather be asked.` };
   } catch {
     return { handled: false }; // Not ours to fix. It's tried again next start.
   }
 }
 
+/** The folder this point of the session was in, so what the model was told stays true after a reload, a resume or a move in the tree. */
+export function savedFolder(root: string, entries: readonly { type: string; customType?: string; data?: unknown }[]): string | undefined {
+  let saved: unknown;
+  for (const entry of entries) if (entry.type === "custom" && entry.customType === WORKDIR_ENTRY) saved = (entry.data as { folder?: unknown } | undefined)?.folder;
+  if (typeof saved !== "string" || saved === root || !isInside(root, saved)) return undefined;
+  return folderAt(saved) === saved ? saved : undefined;
+}
+
 export function registerWorkdir(pi: ExtensionAPI) {
   let here: string | undefined;
   const moves = new Map<string, string>();
-  pi.on("session_start", () => {
-    here = undefined;
+  const restore = (_event: unknown, ctx: ExtensionContext) => {
+    here = savedFolder(realpathSync(ctx.cwd), ctx.sessionManager.getBranch());
     moves.clear();
-  });
+  };
+  pi.on("session_start", restore);
+  pi.on("session_tree", restore);
   pi.on("tool_result", (event, ctx) => {
     const move = moves.get(event.toolCallId);
     if (move === undefined) return undefined;
@@ -88,7 +144,9 @@ export function registerWorkdir(pi: ExtensionAPI) {
     if (event.isError) return undefined;
     const root = realpathSync(ctx.cwd);
     const stays = isInside(root, move);
-    here = stays && move !== root ? move : undefined;
+    const next = stays && move !== root ? move : undefined;
+    if (next !== here) pi.appendEntry(WORKDIR_ENTRY, { folder: next ?? null });
+    here = next;
     // Told here rather than in the system prompt, which would cost every request and replace the subscription part's prompt.
     const note = stays ? `Bash stays in ${move} for later commands, so don't repeat the cd.` : `Shell cwd was reset to ${root}`;
     return { content: [...event.content, { type: "text" as const, text: `\n${note}` }] };

package/packages/router/README.md

@@ -9,7 +9,7 @@ Adds `router/auto` to [Pi](https://pi.dev): one choice in `/model` that uses a s
 Requires Pi 1.5 or newer.
 
 ```bash
-pi install npm:@huseynsnmz/pi-suite@0.2.4
+pi install npm:@huseynsnmz/pi-suite@0.2.5
 ```
 
 Log in to the providers you want with `/login`, run `/router` to choose a model for each role, then pick `router/auto` in `/model`. It's always listed there, and until `plan` and `build` are set it stops with a message telling you to run `/router`.

package/packages/subagent/src/index.ts

@@ -19,9 +19,15 @@ export function childArgs({ type, model, thinking }: ChildOptions): string[] {
   return ["-p", "--no-session", ...(model === undefined ? [] : ["--model", model]), ...(thinking === undefined ? [] : ["--thinking", thinking]), ...(type === "explore" ? ["--tools", READ_ONLY_TOOLS.join(",")] : [])];
 }
 
-/** How the permission system and pi-router know this is a child, and pi-modes knows auto carries over. */
+/** The mode a child runs in. Plan's only way out is a person, so its explore agents just read, and yolo has to be asked for. */
+function childMode(mode: string): string {
+  if (mode === "plan") return "read-only";
+  return mode === "yolo" ? "normal" : mode;
+}
+
+/** How the permission system and pi-router know this is a child, and pi-modes knows its mode. */
 export function childEnv(base: NodeJS.ProcessEnv, parentSession: string, mode: string | undefined): NodeJS.ProcessEnv {
-  return { ...base, PI_SUBAGENT_CHILD: "1", PI_SUBAGENT_PARENT_SESSION: parentSession, ...(mode === "auto" ? { PI_MODES_START: "auto" } : {}) };
+  return { ...base, PI_SUBAGENT_CHILD: "1", PI_SUBAGENT_PARENT_SESSION: parentSession, ...(mode === undefined ? {} : { PI_MODES_START: childMode(mode) }) };
 }
 
 export function trimAnswer(answer: string): string {
@@ -29,14 +35,14 @@ export function trimAnswer(answer: string): string {
   return text.length > ANSWER_CHARS ? `${text.slice(0, ANSWER_CHARS)}\n[The answer was cut at ${ANSWER_CHARS} characters.]` : text;
 }
 
-function runChild(cwd: string, args: string[], env: NodeJS.ProcessEnv, prompt: string, signal: AbortSignal | undefined): Promise<string> {
+export function runChild(cwd: string, command: string[], env: NodeJS.ProcessEnv, prompt: string, signal: AbortSignal | undefined): Promise<string> {
   return new Promise((resolve, reject) => {
-    // Pi may run from a compiled binary, with no script to name.
-    const script = process.argv[1];
-    const command = script !== undefined && existsSync(script) ? [script, ...args] : args;
     const child = spawn(process.execPath, command, { cwd, env, stdio: ["pipe", "pipe", "pipe"], signal });
     let out = "";
     let err = "";
+    // A character can be split across two chunks.
+    child.stdout.setEncoding("utf8");
+    child.stderr.setEncoding("utf8");
     child.stdout.on("data", (data) => (out += data));
     child.stderr.on("data", (data) => (err = (err + data).slice(-ERROR_CHARS)));
     child.stdin.on("error", () => {}); // It can exit before reading. Its exit code says why.
@@ -69,7 +75,10 @@ export default function piSubagent(pi: ExtensionAPI): void {
       pi.events.emit("pi-modes:mode", probe);
       const model = ctx.model === undefined ? undefined : `${ctx.model.provider}/${ctx.model.id}`;
       const args = childArgs({ type: params.type ?? "explore", model, thinking: pi.getThinkingLevel() });
-      const answer = await runChild(ctx.cwd, args, childEnv(process.env, ctx.sessionManager.getSessionId(), probe.mode), params.prompt, signal);
+      // Pi may run from a compiled binary, with no script to name.
+      const script = process.argv[1];
+      const command = script !== undefined && existsSync(script) ? [script, ...args] : args;
+      const answer = await runChild(ctx.cwd, command, childEnv(process.env, ctx.sessionManager.getSessionId(), probe.mode), params.prompt, signal);
       return { content: [{ type: "text" as const, text: answer }], details: {} };
     },
   });

package/packages/web/README.md

@@ -9,7 +9,7 @@ A web page can hold instructions aimed at the AI reading it. So a separate model
 ## Install
 
 ```bash
-pi install npm:@huseynsnmz/pi-suite@0.2.4
+pi install npm:@huseynsnmz/pi-suite@0.2.5
 ```
 
 `web_fetch` works straight away. It reads pages with the session's model, unless you set `readerModel` or use [pi-router](https://github.com/huseynsnmz/pi-suite/tree/main/packages/router), which can choose the reader. `web_search` stays off until you choose where searches go.