@ibartel74/pi-automode-ext 1.0.0

package/extensions/auto-mode/state.ts

@@ -0,0 +1,106 @@
+import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { DENIAL_HISTORY_LIMIT } from "./constants.ts";
+import type { AutoModeState, DenialRecord, EffectiveConfig } from "./types.ts";
+import { safeJson, truncateMiddle } from "./utils.ts";
+
+export function pushDenial(state: AutoModeState, denial: DenialRecord): void {
+  state.recentDenials = [
+    ...state.recentDenials.slice(-(DENIAL_HISTORY_LIMIT - 1)),
+    denial,
+  ];
+}
+
+export function statusLine(
+  config: EffectiveConfig,
+  state: AutoModeState,
+): string {
+  const enabled = state.enabledOverride ?? config.enabled;
+  const circle = enabled ? "●" : "○";
+  const allowed = state.checkedActions - state.blockedActions;
+  const classifier = state.classifierAllowed > 0 || state.classifierDenied > 0
+    ? ` ca:${state.classifierAllowed} cd:${state.classifierDenied}`
+    : "";
+  const confirmed = state.userConfirmed > 0 ? ` uc:${state.userConfirmed}` : "";
+  return `AM${circle} a:${allowed} d:${state.blockedActions}${classifier}${confirmed}`;
+}
+
+export function statusText(
+  config: EffectiveConfig,
+  state: AutoModeState,
+): string {
+  return [
+    `enabled: ${(state.enabledOverride ?? config.enabled) ? "yes" : "no"}`,
+    `classifier: ${config.classifierModel ?? "current session model"}`,
+    `classifier reasoning: ${config.classifierReasoningLevel ?? "server default"}`,
+    `interactive confirm: ${config.interactiveConfirm ? "on" : "off"}`,
+    `checked actions: ${state.checkedActions}`,
+    `blocked actions: ${state.blockedActions}`,
+    `classifier allowed: ${state.classifierAllowed}`,
+    `classifier denied: ${state.classifierDenied}`,
+    `user confirmed: ${state.userConfirmed}`,
+    `permissions.deny rules: ${config.permissionDeny.length}`,
+    `permissions.ask rules: ${config.permissionAsk.length}`,
+    `permissions.allow rules: ${config.permissionAllow.length}`,
+    `environment entries: ${config.environment.length}`,
+    `allow entries: ${config.allow.length}`,
+    `soft_deny entries: ${config.softDeny.length}`,
+    `hard_deny entries: ${config.hardDeny.length}`,
+    `last decision: ${state.lastDecision ?? "none"}`,
+    `last reason: ${state.lastReason ?? "none"}`,
+  ].join("\n");
+}
+
+export function formatDenials(state: AutoModeState): string {
+  if (state.recentDenials.length === 0) return "No recent auto-mode denials.";
+  return state.recentDenials
+    .slice()
+    .reverse()
+    .map(
+      (denial) =>
+        `${
+          new Date(denial.timestamp).toLocaleTimeString()
+        } ${denial.kind} ${denial.toolName}: ${denial.reason}\n  ${
+          truncateMiddle(denial.action, 300)
+        }`,
+    )
+    .join("\n\n");
+}
+
+export function actionSummary(
+  toolName: string,
+  input: Record<string, unknown>,
+): string {
+  return `${toolName} ${safeJson(input, 6000)}`;
+}
+
+export function restoreState(ctx: ExtensionContext): AutoModeState {
+  const entries = ctx.sessionManager.getEntries();
+  for (let i = entries.length - 1; i >= 0; i -= 1) {
+    const entry = entries[i] as {
+      type?: string;
+      customType?: string;
+      data?: Partial<AutoModeState>;
+    };
+    if (
+      entry.type !== "custom" ||
+      entry.customType !== "pi-automode-state" ||
+      !entry.data
+    ) {
+      continue;
+    }
+    return {
+      enabledOverride: entry.data.enabledOverride,
+      lastDecision: entry.data.lastDecision,
+      lastReason: entry.data.lastReason,
+      checkedActions: entry.data.checkedActions ?? 0,
+      blockedActions: entry.data.blockedActions ?? 0,
+      classifierAllowed: entry.data.classifierAllowed ?? 0,
+      classifierDenied: entry.data.classifierDenied ?? 0,
+      userConfirmed: entry.data.userConfirmed ?? 0,
+      recentDenials: Array.isArray(entry.data.recentDenials)
+        ? entry.data.recentDenials.slice(-DENIAL_HISTORY_LIMIT)
+        : [],
+    };
+  }
+  return { checkedActions: 0, blockedActions: 0, classifierAllowed: 0, classifierDenied: 0, userConfirmed: 0, recentDenials: [] };
+}

package/extensions/auto-mode/transcript.ts

@@ -0,0 +1,236 @@
+import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { safeJson, truncateMiddle } from "./utils.ts";
+
+const MAX_USER_ENTRY_TOKENS = 1000;
+const MAX_TOOL_ENTRY_TOKENS = 1000;
+const MAX_RECENT_TOOL_ENTRIES = 40;
+const CHARS_PER_APPROX_TOKEN = 4;
+
+type TranscriptEntry = {
+  index: number;
+  order: number;
+  kind: "user" | "tool";
+  text: string;
+};
+
+export type ClassifierTranscriptBudgets = {
+  maxUserTokens: number;
+  maxToolTokens: number;
+};
+
+function flattenUserContent(content: unknown): string {
+  if (typeof content === "string") return content;
+  if (!Array.isArray(content)) return "";
+  return content
+    .filter(
+      (block): block is { type: string; text?: string } =>
+        !!block && typeof block === "object" && "type" in block,
+    )
+    .filter((block) => block.type === "text" && typeof block.text === "string")
+    .map((block) => block.text ?? "")
+    .join("\n");
+}
+
+function collectAssistantToolCalls(content: unknown): Array<{
+  name: string;
+  input: unknown;
+}> {
+  if (!Array.isArray(content)) return [];
+  return content
+    .filter(
+      (
+        block,
+      ): block is {
+        type: string;
+        name?: string;
+        arguments?: unknown;
+        input?: unknown;
+      } => !!block && typeof block === "object" && "type" in block,
+    )
+    .filter((block) => block.type === "toolCall" || block.type === "tool_use")
+    .map((block) => ({
+      name: String(block.name ?? "tool"),
+      input: "arguments" in block ? block.arguments : block.input,
+    }));
+}
+
+export function approximateTokenCount(text: string): number {
+  return Math.ceil(text.length / CHARS_PER_APPROX_TOKEN);
+}
+
+function truncateToTokenCap(
+  text: string,
+  maxTokens: number,
+): { text: string; truncated: boolean } {
+  if (approximateTokenCount(text) <= maxTokens) {
+    return { text, truncated: false };
+  }
+  const maxCharacters = Math.max(1, maxTokens * CHARS_PER_APPROX_TOKEN);
+  const omittedTokens = Math.max(
+    1,
+    approximateTokenCount(text) - maxTokens,
+  );
+  const marker = `<truncated approx_tokens="${omittedTokens}" />`;
+  if (marker.length >= maxCharacters) {
+    return { text: marker.slice(0, maxCharacters), truncated: true };
+  }
+
+  const retainedCharacters = maxCharacters - marker.length;
+  const prefixCharacters = Math.ceil(retainedCharacters * 0.65);
+  const suffixCharacters = retainedCharacters - prefixCharacters;
+  return {
+    text: `${text.slice(0, prefixCharacters)}${marker}${
+      suffixCharacters > 0 ? text.slice(-suffixCharacters) : ""
+    }`,
+    truncated: true,
+  };
+}
+
+function collectTranscriptEntries(ctx: ExtensionContext): TranscriptEntry[] {
+  const entries: TranscriptEntry[] = [];
+  const sessionManager = ctx.sessionManager as typeof ctx.sessionManager & {
+    buildContextEntries?: () => ReturnType<typeof ctx.sessionManager.getBranch>;
+  };
+  const contextEntries = sessionManager.buildContextEntries?.() ??
+    sessionManager.getBranch();
+
+  for (const [index, entry] of contextEntries.entries()) {
+    if (entry.type !== "message") continue;
+    const message = entry.message as { role?: string; content?: unknown };
+    if (message.role === "user") {
+      const text = flattenUserContent(message.content).trim();
+      if (text) entries.push({ index, order: 0, kind: "user", text });
+      continue;
+    }
+    if (message.role !== "assistant") continue;
+
+    for (const [order, toolCall] of collectAssistantToolCalls(
+      message.content,
+    ).entries()) {
+      entries.push({
+        index,
+        order,
+        kind: "tool",
+        text: `${toolCall.name}: ${safeJson(toolCall.input, 8000)}`,
+      });
+    }
+  }
+
+  return entries;
+}
+
+function selectUserEntries(
+  entries: TranscriptEntry[],
+  maxTokens: number,
+): { selected: TranscriptEntry[]; omitted: boolean } {
+  const users = entries.filter((entry) => entry.kind === "user");
+  if (users.length === 0) return { selected: [], omitted: false };
+
+  const distinctAnchors = users.length > 1;
+  const anchorBudget = distinctAnchors
+    ? Math.max(1, Math.floor(maxTokens / 2))
+    : maxTokens;
+  const entryCap = Math.min(MAX_USER_ENTRY_TOKENS, anchorBudget);
+  const rendered = users.map((entry) => {
+    const truncated = truncateToTokenCap(`User: ${entry.text}`, entryCap);
+    return { ...entry, text: truncated.text, truncated: truncated.truncated };
+  });
+  const selectedIndices = new Set<number>();
+  let usedTokens = 0;
+
+  const include = (index: number): void => {
+    if (selectedIndices.has(index)) return;
+    const entry = rendered[index];
+    if (!entry) return;
+    const tokens = approximateTokenCount(entry.text);
+    if (usedTokens + tokens > maxTokens) return;
+    selectedIndices.add(index);
+    usedTokens += tokens;
+  };
+
+  // Prefer the latest user instruction when an extremely small configured
+  // budget cannot retain both intent anchors.
+  include(rendered.length - 1);
+  include(0);
+  for (let index = rendered.length - 2; index > 0; index -= 1) {
+    include(index);
+  }
+
+  return {
+    selected: rendered.filter((_entry, index) => selectedIndices.has(index)),
+    omitted: selectedIndices.size < users.length || rendered.some((entry) =>
+      entry.truncated
+    ),
+  };
+}
+
+function selectToolEntries(
+  entries: TranscriptEntry[],
+  maxTokens: number,
+): { selected: TranscriptEntry[]; omitted: boolean } {
+  const tools = entries.filter((entry) => entry.kind === "tool");
+  const selected: TranscriptEntry[] = [];
+  let usedTokens = 0;
+
+  for (let index = tools.length - 1; index >= 0; index -= 1) {
+    if (selected.length >= MAX_RECENT_TOOL_ENTRIES) break;
+    const entry = tools[index];
+    if (!entry) continue;
+    const truncated = truncateToTokenCap(
+      `ToolCall ${entry.text}`,
+      Math.min(MAX_TOOL_ENTRY_TOKENS, maxTokens),
+    );
+    const tokens = approximateTokenCount(truncated.text);
+    if (usedTokens + tokens > maxTokens) continue;
+    selected.push({ ...entry, text: truncated.text });
+    usedTokens += tokens;
+  }
+
+  selected.reverse();
+  return {
+    selected,
+    omitted: selected.length < tools.length || tools.some((entry) =>
+      approximateTokenCount(`ToolCall ${entry.text}`) >
+        Math.min(MAX_TOOL_ENTRY_TOKENS, maxTokens)
+    ),
+  };
+}
+
+/** Build classifier evidence from user text and assistant tool-call payloads only. */
+export function buildClassifierTranscript(
+  ctx: ExtensionContext,
+  budgets: ClassifierTranscriptBudgets,
+): string {
+  const entries = collectTranscriptEntries(ctx);
+  const users = selectUserEntries(entries, budgets.maxUserTokens);
+  const tools = selectToolEntries(entries, budgets.maxToolTokens);
+  const selected = [...users.selected, ...tools.selected].sort(
+    (left, right) => left.index - right.index || left.order - right.order,
+  );
+  if (users.omitted || tools.omitted) {
+    selected.push({
+      index: Number.MAX_SAFE_INTEGER,
+      order: 0,
+      kind: "tool",
+      text: "<transcript_entries_omitted />",
+    });
+  }
+  return selected.map((entry) => entry.text).join("\n");
+}
+
+export function loadedContextFromSystemPromptOptions(options: unknown): string {
+  const contextFiles = (
+    options as
+      | { contextFiles?: Array<{ path?: string; content?: string }> }
+      | undefined
+  )?.contextFiles;
+  if (!Array.isArray(contextFiles)) return "";
+  return contextFiles
+    .map(
+      (file) =>
+        `# ${file.path ?? "context"}\n${
+          truncateMiddle(file.content ?? "", 4000)
+        }`,
+    )
+    .join("\n\n");
+}

package/extensions/auto-mode/types.ts

@@ -0,0 +1,210 @@
+import type { AssistantMessage } from "@earendil-works/pi-ai";
+import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+
+export type ClassifierReasoningLevel =
+  | "low"
+  | "medium"
+  | "high"
+  | "xhigh"
+  | "max";
+
+export type EffectiveClassifierReasoningLevel =
+  | "off"
+  | "minimal"
+  | ClassifierReasoningLevel;
+
+export type ClassifierReasoning =
+  | { mode: "server-default" }
+  | {
+    mode: "explicit";
+    requestedLevel: ClassifierReasoningLevel;
+    effectiveLevel: EffectiveClassifierReasoningLevel;
+  };
+
+export type ClassifierReasoningLog =
+  | ClassifierReasoning
+  | {
+    mode: "explicit";
+    requestedLevel: ClassifierReasoningLevel;
+    effectiveLevel?: undefined;
+  };
+
+/** Observability log configuration. Off by default. */
+export type LogConfig = {
+  enabled: boolean;
+  /** When true, also log classifier prompt/response payloads. */
+  classifierIo: boolean;
+};
+
+export type AutoModeSettings = {
+  enabled?: boolean;
+  classifierModel?: string;
+  classifierReasoningLevel?: ClassifierReasoningLevel;
+  /** When true, read-only tools (read/grep/find/ls) are classified instead of auto-allowed. */
+  classifyReadOnlyTools?: boolean;
+  /** Override the fast-stage completion token budget (default 512). */
+  fastClassifierMaxTokens?: number;
+  /** Per-request timeout for classifier completions in milliseconds (default 20000). */
+  classifierTimeoutMs?: number;
+  /** When true, file tools whose resolved path is inside the working directory are allowed deterministically (no classifier), and outside-CWD file access is classified. */
+  allowInsideWorkingDirectory?: boolean;
+  /** When true (default), a classifier block prompts for interactive user confirmation instead of blocking outright, when a UI is available. */
+  interactiveConfirm?: boolean;
+  /** Path glob patterns (file tools) that are always denied before the classifier. Supports `~` and `*` (matches any characters, including `/`). */
+  deniedPaths?: unknown;
+  maxUserTranscriptTokens?: number;
+  maxToolTranscriptTokens?: number;
+  environment?: unknown;
+  allow?: unknown;
+  protectedPaths?: unknown;
+  soft_deny?: unknown;
+  softDeny?: unknown;
+  hard_deny?: unknown;
+  hardDeny?: unknown;
+  log?: Partial<LogConfig>;
+};
+
+export type SettingsFile = {
+  autoMode?: AutoModeSettings;
+  permissions?: {
+    deny?: unknown;
+    ask?: unknown;
+    /**
+     * Deterministic allow tier: matching calls skip the classifier only. Read
+     * from user-owned config sources, never shared project config.
+     */
+    allow?: unknown;
+  };
+};
+
+export type LoadedSettingsFile = {
+  path: string;
+  settings?: SettingsFile;
+  diagnostics: string[];
+};
+
+export type ToolPattern = {
+  raw: string;
+  toolName?: string;
+  argumentPattern?: string;
+};
+
+export type EffectiveConfig = {
+  enabled: boolean;
+  classifierModel?: string;
+  classifierReasoningLevel?: ClassifierReasoningLevel;
+  classifyReadOnlyTools: boolean;
+  fastClassifierMaxTokens: number;
+  classifierTimeoutMs: number;
+  allowInsideWorkingDirectory: boolean;
+  interactiveConfirm: boolean;
+  deniedPaths: string[];
+  maxUserTranscriptTokens: number;
+  maxToolTranscriptTokens: number;
+  environment: string[];
+  allow: string[];
+  protectedPaths: string[];
+  softDeny: string[];
+  hardDeny: string[];
+  permissionDeny: ToolPattern[];
+  permissionAsk: ToolPattern[];
+  permissionAllow: ToolPattern[];
+  log: LogConfig;
+};
+
+export type AutoModeState = {
+  enabledOverride?: boolean;
+  lastDecision?: "allow" | "block";
+  lastReason?: string;
+  checkedActions: number;
+  blockedActions: number;
+  classifierAllowed: number;
+  classifierDenied: number;
+  userConfirmed: number;
+  recentDenials: DenialRecord[];
+};
+
+export type DenialRecord = {
+  timestamp: number;
+  toolName: string;
+  reason: string;
+  action: string;
+  kind:
+    | "permissions.deny"
+    | "permissions.ask"
+    | "deterministic-hard-deny"
+    | "deterministic-path-deny"
+    | "classifier"
+    | "setup";
+};
+
+/** Denial kind plus the deterministic allow fast paths, used for decision log entries. */
+export type DecisionKind =
+  | DenialRecord["kind"]
+  | "permissions.allow"
+  | "read-only"
+  | "inside-working-directory"
+  | "user-confirmed";
+
+export type ClassificationDecision = {
+  decision: "allow" | "block";
+  tier: "hard_deny" | "soft_deny" | "allow" | "explicit_intent" | "none";
+  reason: string;
+};
+
+/** One classifier attempt: the raw model response (or error) and parsed decision. */
+export type ClassifierIoAttempt = {
+  stage: "fast" | "detailed";
+  attempt: number;
+  response?: {
+    stopReason?: string;
+    text: string;
+    model: string;
+    timestamp: number;
+    usage: AssistantMessage["usage"];
+    errorMessage?: string;
+  };
+  parsed?: ClassificationDecision;
+  error?: string;
+  durationMs: number;
+};
+
+/** Full classifier I/O for an action, surfaced for optional observability logging. */
+export type ClassifierIo = {
+  model: string;
+  reasoning: ClassifierReasoning;
+  prompt: {
+    system: string;
+    context: string;
+    action: string;
+    fastInstruction: string;
+    detailedInstruction: string;
+  };
+  attempts: ClassifierIoAttempt[];
+  durationMs: number;
+};
+
+/** Classification decision plus resolved reasoning and the I/O that produced it (when available). */
+export type ClassifyResult = ClassificationDecision & {
+  reasoning?: ClassifierReasoningLog;
+  io?: ClassifierIo;
+};
+
+export type SettingsSources = {
+  globalSettings?: SettingsFile[];
+  projectLocalSettings?: SettingsFile[];
+  projectSharedSettings?: SettingsFile[];
+  inlineSettings?: SettingsFile[];
+};
+
+export type ConfigLoadResult = {
+  config: EffectiveConfig;
+  diagnostics: string[];
+};
+
+export type ClassifyAction = (
+  ctx: ExtensionContext,
+  config: EffectiveConfig,
+  action: string,
+  loadedContext: string,
+) => Promise<ClassifyResult>;

package/extensions/auto-mode/utils.ts

@@ -0,0 +1,54 @@
+export function stringArray(value: unknown): string[] | undefined {
+  if (!Array.isArray(value)) return undefined;
+  return value.filter(
+    (entry): entry is string =>
+      typeof entry === "string" && entry.trim().length > 0,
+  );
+}
+
+export function hasOwn(object: object, key: string): boolean {
+  return Object.prototype.hasOwnProperty.call(object, key);
+}
+
+export function truncateMiddle(text: string, maxLength: number): string {
+  if (text.length <= maxLength) return text;
+  const head = Math.floor(maxLength * 0.65);
+  const tail = maxLength - head - 18;
+  return `${text.slice(0, head)}… […] …${text.slice(text.length - tail)}`;
+}
+
+export function safeJson(value: unknown, maxLength = 4000): string {
+  const seen = new WeakSet<object>();
+  let text = "{}";
+  try {
+    text = JSON.stringify(
+      value,
+      (_key, current) => {
+        if (typeof current === "string") {
+          return truncateMiddle(
+            current,
+            Math.max(200, Math.floor(maxLength / 4)),
+          );
+        }
+        if (Array.isArray(current)) {
+          if (current.length <= 30) return current;
+          return {
+            $truncatedArray: true,
+            items: current.slice(0, 30),
+            omittedEntries: current.length - 30,
+            totalEntries: current.length,
+          };
+        }
+        if (current && typeof current === "object") {
+          if (seen.has(current)) return "[Circular]";
+          seen.add(current);
+        }
+        return current;
+      },
+      2,
+    ) ?? "{}";
+  } catch {
+    text = String(value);
+  }
+  return truncateMiddle(text, maxLength);
+}

package/extensions/auto-mode.ts

@@ -0,0 +1,27 @@
+/**
+ * Claude Code-style auto mode for Pi.
+ *
+ * The enforcement order is deliberately different from simple "auto reviewer" plugins:
+ * permission deny/ask rules and deterministic hard-deny checks run before any fast-path allow.
+ * Only read-only built-in tools bypass classification; every side-effecting action goes through the classifier.
+ */
+
+export * from "./auto-mode/classifier.ts";
+export * from "./auto-mode/bash.ts";
+export * from "./auto-mode/config.ts";
+export * from "./auto-mode/constants.ts";
+export * from "./auto-mode/extension.ts";
+export * from "./auto-mode/hard-deny.ts";
+export * from "./auto-mode/jev.ts";
+export * from "./auto-mode/log.ts";
+export * from "./auto-mode/model.ts";
+export * from "./auto-mode/model-selector.ts";
+export * from "./auto-mode/paths.ts";
+export * from "./auto-mode/permissions.ts";
+export * from "./auto-mode/state.ts";
+export * from "./auto-mode/transcript.ts";
+export * from "./auto-mode/types.ts";
+
+import { createPiAutomode } from "./auto-mode/extension.ts";
+
+export default createPiAutomode();

package/package.json

@@ -0,0 +1,61 @@
+{
+  "name": "@ibartel74/pi-automode-ext",
+  "version": "1.0.0",
+  "description": "Claude Code-style auto mode guardrail for pi.",
+  "repository": {
+    "url": "https://github.com/ibartel/pi-automode-ext"
+  },
+  "type": "module",
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "pi",
+    "pi-extension",
+    "pi-package",
+    "auto-mode",
+    "llm",
+    "coding-agent"
+  ],
+  "scripts": {
+    "typecheck": "tsc --noEmit",
+    "check": "tsc --noEmit",
+    "build": "tsc --noEmit",
+    "test": "node --import tsx --test tests/*.test.ts"
+  },
+  "files": [
+    "CHANGELOG.md",
+    "docs",
+    "extensions",
+    "examples",
+    "skills",
+    "README.md"
+  ],
+  "pi": {
+    "extensions": [
+      "./extensions/auto-mode.ts"
+    ],
+    "skills": [
+      "./skills"
+    ]
+  },
+  "peerDependencies": {
+    "@earendil-works/pi-ai": "*",
+    "@earendil-works/pi-coding-agent": "*",
+    "@earendil-works/pi-tui": "*",
+    "typebox": "*"
+  },
+  "devDependencies": {
+    "@earendil-works/pi-ai": "^0.84.1",
+    "@earendil-works/pi-coding-agent": "^0.84.1",
+    "@earendil-works/pi-tui": "^0.84.1",
+    "@types/node": "^24.0.0",
+    "tsx": "^4.22.4",
+    "typebox": "^1.3.10",
+    "typescript": "^5.8.0"
+  },
+  "dependencies": {
+    "unbash": "4.0.10"
+  }
+}