@llm4ts/core 2.45.0 → 2.46.0

package/src/providers/GeminiCliProvider.ts

@@ -129,6 +129,10 @@ export class GeminiCliExecutionContext extends Schema.Class<GeminiCliExecutionCo
   /** The seat's own environment (a roster `env`), under llm4ts's own keys. */
   envVars: Schema.Record(Schema.String, Schema.String).pipe(
     Schema.withConstructorDefault(Effect.succeed<Readonly<Record<string, string>>>({}))
+  ),
+  /** Globs under `cwd` the policy denies every tool (`CliConnectorConfig.deniedPaths`). */
+  deniedPaths: Schema.Array(Schema.String).pipe(
+    Schema.withConstructorDefault(Effect.succeed(emptyDirectories))
   )
 }) {}
 
@@ -141,6 +145,7 @@ export const geminiCliExecutionContextFrom = (
     readOnly: config.readOnly,
     isolated: config.isolated,
     envVars: config.envVars,
+    deniedPaths: config.deniedPaths ?? emptyDirectories,
     ...(config.sandbox === undefined
       ? {}
       : {
@@ -202,6 +207,66 @@ export const geminiHarnessPolicyToml = [
   ""
 ].join("\n")
 
+const regexEscape = (text: string): string => text.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&")
+
+/** A TOML basic string: backslashes and quotes escaped. */
+const tomlString = (text: string): string =>
+  `"${text.replace(/\\/gu, "\\\\").replace(/"/gu, '\\"')}"`
+
+/**
+ * The pattern that catches `glob` (a directory glob such as `.llm4ts/**`)
+ * in a tool call's arguments: the name as a path segment at the start of
+ * a relative path (after a quote, a space or `=` in the JSON) or
+ * right under `cwd` as an absolute one. A seat whose working directory is
+ * a shard worktree under `.llm4ts/port/shards/` therefore keeps its own
+ * tree: its paths pass through `.llm4ts` deeper down, under another root.
+ * Separators match either way, as the JSON doubles a Windows backslash.
+ * It is a match over the argument text: a path reached through `..`, a
+ * variable or a glob slips past it, which is why the grade is `partial`.
+ */
+export const geminiDeniedPathPattern = (glob: string, cwd: string | undefined): string => {
+  const separator = "[\\\\/]+"
+  const name = regexEscape(glob.replace(/\/\*\*$/u, ""))
+  // A path starts after a quote, whitespace, `=` or a shell operator, and
+  // may be spelled `./name`. The working directory as it appears in an
+  // argument is anchored the same way, so `/repo` never matches inside
+  // `/other/repo/`.
+  const boundary = `["'\\s=;&|(\`$]`
+  const dot = `(?:\\.${separator})?`
+  const under =
+    cwd === undefined
+      ? ""
+      : `(?:${/^[\\/]/u.test(cwd) ? separator : ""}${cwd
+          .split(/[\\/]+/u)
+          .filter((segment) => segment.length > 0)
+          .map(regexEscape)
+          .join(separator)}${separator})?`
+  return `${boundary}${dot}${under}${name}(?=${separator}|["'\\s;&|)]|$)`
+}
+
+/**
+ * The harness policy with one admin-tier deny per denied path on top: any
+ * tool call — the shell included — whose arguments name the run's own
+ * state is refused with a message that says whose it is.
+ */
+export const geminiHarnessPolicyFor = (context: GeminiCliExecutionContext): string =>
+  [
+    geminiHarnessPolicyToml,
+    ...context.deniedPaths.map((glob) =>
+      [
+        "[[rule]]",
+        'toolName = "*"',
+        `argsPattern = ${tomlString(geminiDeniedPathPattern(glob, context.cwd))}`,
+        'decision = "deny"',
+        "priority = 999",
+        `denyMessage = ${tomlString(
+          `${glob} is the run state of llm4ts, the tool running you: traces, plans and transcripts that are not part of your task. Do not read, change or delete it.`
+        )}`,
+        ""
+      ].join("\n")
+    )
+  ].join("\n")
+
 /** Whether `gemini --help` lists `--admin-policy`, the flag the harness policy needs. */
 export const geminiSupportsAdminPolicy = (help: string): boolean => help.includes("--admin-policy")
 
@@ -760,9 +825,13 @@ export const makeGeminiCliProvider = (
   executor: GeminiCliExecutorShape,
   executionContext: GeminiCliExecutionContext = GeminiCliExecutionContext.make({})
 ): CliConnectorShape => {
+  // `gemini --version` proves the install, not the login: the CLI has no auth
+  // status subcommand, and its account file records the last login rather than
+  // whether that token still works, so the login stays Unknown. `llm4ts doctor`
+  // reports the environment routes (API key, Vertex, project) separately.
   const healthy = HealthStatus.make({
     availability: "Healthy",
-    authStatus: "Valid"
+    authStatus: "Unknown"
   })
   const unhealthy = HealthStatus.make({
     availability: "Unhealthy",
@@ -958,7 +1027,12 @@ export const makeGeminiCliProvider = (
     capabilities: ConnectorCapabilities.make({
       interactiveSessions: true,
       readOnlyEnforcement: "enforced",
-      isolatedHeadless: "partial"
+      isolatedHeadless: "partial",
+      // An admin-tier policy rule over every tool (`geminiHarnessPolicyFor`)
+      // on a CLI that takes `--admin-policy` (older CLIs run without it),
+      // matched over the argument text: a path spelled another way (`..`,
+      // a variable, a glob) slips past, so the grade is partial.
+      pathDeny: "partial"
     })
   })
 

package/src/providers/GrokCliConnector.ts

@@ -112,6 +112,7 @@ export const makeGrokCliConnector = (
     buildInteractiveArgv: (_context) => ["grok", ...extraArgs],
     complete,
     completeStream,
+    // No auth probe: grok offers `login` but no status subcommand; Unknown.
     versionProbe: { executor, binary: "grok", cwd }
   })
 }

package/src/providers/OpenCodeCliConnector.ts

@@ -145,6 +145,8 @@ export const makeOpenCodeCliConnector = (
     buildInteractiveArgv: (_context) => ["opencode"],
     complete,
     completeStream,
+    // No auth probe: `opencode auth list` lists stored credentials by
+    // provider, not whether the provider this seat runs has any; Unknown.
     versionProbe: { executor, binary: "opencode", cwd }
   })
 }

package/src/providers/PiConnector.ts

@@ -1,6 +1,6 @@
 import * as Effect from "effect/Effect"
 import * as Stream from "effect/Stream"
-import { makeCliConnector, type CliConnectorShape } from "../Connector.ts"
+import { makeCliConnector, type CliAuthProbe, type CliConnectorShape } from "../Connector.ts"
 import type { CliConnectorConfig } from "../ConnectorConfig.ts"
 import { InvalidRequestError, ProviderError, type LlmError } from "../Errors.ts"
 import { ConnectorCapabilities, ConnectorIds, LlmChunk, TokenUsage } from "../Models.ts"
@@ -16,6 +16,7 @@ import {
   jsonStringField,
   optionalModelArgs,
   parseJsonLine,
+  parseJsonOutput,
   sortedFlagArgs,
   toolEventChunk,
   toolResultChunk,
@@ -25,6 +26,31 @@ import {
   statusChunk
 } from "./CliSupport.ts"
 
+/**
+ * `pi auth check --model <model> --no-refresh --json` says whether pi holds
+ * credentials for the provider that model resolves to:
+ * `{"status":"ready"}` or `{"status":"not_ready","reason":...}`. pi needs a
+ * provider or model to answer, so a seat with no model configured has no
+ * probe. `--no-refresh` keeps an expired OAuth token where it is: the check
+ * stays offline and reports it as not ready.
+ */
+export const piAuthProbe = (model: string): CliAuthProbe => ({
+  args: ["auth", "check", "--model", model, "--no-refresh", "--json"],
+  interpret: (result) => {
+    const json = parseJsonOutput(result.stdout)
+    switch (jsonStringField(json, "status")) {
+      case "ready":
+        return "Valid"
+      case "not_ready":
+        return jsonStringField(json, "reason") === "credentials_not_configured"
+          ? "Missing"
+          : "Invalid"
+      default:
+        return "Unknown"
+    }
+  }
+})
+
 /**
  * The first pi whose `--tools` allowlist can be kept free of MCP tools: from
  * 1.0.4 `--tools read` keeps every MCP tool the user configured in
@@ -284,6 +310,11 @@ export const makePiConnector = (
     buildInteractiveArgv: (_context) => ["pi", ...extraArgs],
     complete,
     completeStream,
-    versionProbe: { executor, binary: "pi", cwd }
+    versionProbe: {
+      executor,
+      binary: "pi",
+      cwd,
+      ...(config.model === undefined ? {} : { authProbe: piAuthProbe(config.model) })
+    }
   })
 }