@nemus-cli/nemus 0.2.1

package/dist/pi-extensions/permission-sync.ts.template

@@ -0,0 +1,41 @@
+/**
+ * Pi Permission Sync Extension (auto-generated by workspace-manager)
+ *
+ * Equivalent of Claude Code's sync-permissions.sh Stop hook.
+ * Syncs project-level permissions to global settings on session shutdown.
+ */
+
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { spawn } from "node:child_process";
+
+const SYNC_SCRIPT = "__SYNC_PERMISSIONS_SCRIPT__";
+
+async function syncPermissions(): Promise<void> {
+  return new Promise((resolve) => {
+    const proc = spawn("bash", [SYNC_SCRIPT], {
+      detached: true,
+      stdio: "ignore",
+      env: { ...process.env, CLAUDE_PROJECT_DIR: process.cwd() },
+    });
+    proc.unref();
+    resolve();
+  });
+}
+
+export default function (pi: ExtensionAPI) {
+  pi.on("session_shutdown", async () => {
+    try { await syncPermissions(); } catch { /* ignore */ }
+  });
+
+  pi.registerCommand("sync-permissions", {
+    description: "Sync project permissions to global settings",
+    handler: async (_args, ctx) => {
+      try {
+        await syncPermissions();
+        ctx.ui.notify("Permissions synced to global settings", "success");
+      } catch (error) {
+        ctx.ui.notify(`Failed to sync permissions: ${error}`, "error");
+      }
+    },
+  });
+}

package/dist/pi-extensions/permissions-gate.ts.template

@@ -0,0 +1,69 @@
+/**
+ * Pi Permissions Gate Extension (auto-generated by workspace-manager)
+ *
+ * Equivalent of Claude Code's permission system.
+ * Confirms before running dangerous bash commands.
+ */
+
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { isToolCallEventType } from "@earendil-works/pi-coding-agent";
+
+const DANGEROUS_PATTERNS = [
+  /\brm\s+-rf\b/,
+  /\brm\s+-r\b/,
+  /\brm\s+.*\*\b/,
+  /\brm\s+.*\/\b/,
+  /\bsudo\s+rm\b/,
+  /\bdd\s+if=/,
+  /\bmkfs\b/,
+  /\b:\(\)\{\s*:\|:\s*&\s*\};\s*:/,
+  />\s*\/dev\/sd/,
+  /\bgit\s+push\s+.*--force\b/,
+  /\bgit\s+reset\s+--hard\b/,
+  /\bkillall\s+-9\b/,
+  /\bpkill\s+-9\b/,
+];
+
+const PROTECTED_PATHS = [
+  ".env", ".env.local", ".env.production",
+  "node_modules", ".git", "~/.ssh", "~/.gnupg",
+];
+
+export default function (pi: ExtensionAPI) {
+  pi.on("tool_call", async (event, ctx) => {
+    if (!isToolCallEventType("bash", event)) return;
+    const command = event.input.command || "";
+
+    for (const pattern of DANGEROUS_PATTERNS) {
+      if (pattern.test(command)) {
+        const ok = await ctx.ui.confirm(
+          "⚠️ Dangerous Command",
+          `This command looks destructive:\n\n${command.substring(0, 200)}${command.length > 200 ? "..." : ""}\n\nProceed?`
+        );
+        if (!ok) return { block: true, reason: "Blocked by permission gate (dangerous command)" };
+        break;
+      }
+    }
+  });
+
+  pi.on("tool_call", async (event, ctx) => {
+    if (isToolCallEventType("write", event)) {
+      const filePath = event.input.path || "";
+      const basename = filePath.split("/").pop() || "";
+      for (const pp of PROTECTED_PATHS) {
+        if (filePath.includes(pp) || basename === pp) {
+          const ok = await ctx.ui.confirm(
+            "🔒 Protected Path",
+            `Writing to ${filePath} may be unsafe.\n\nProceed?`
+          );
+          if (!ok) return { block: true, reason: "Blocked by permission gate (protected path)" };
+          break;
+        }
+      }
+    }
+  });
+
+  pi.on("session_start", async (_event, ctx) => {
+    ctx.ui.notify("Permission gate active - dangerous commands require confirmation", "info");
+  });
+}

package/dist/pi-extensions/pr-fix-trigger.ts.template

@@ -0,0 +1,124 @@
+/**
+ * Pi PR-Fix Trigger Extension (auto-generated by workspace-manager)
+ *
+ * Equivalent of Claude Code's check-pr-fix-trigger.sh PostToolUse hook.
+ * Detects `gh pr create` in bash tool results, extracts the PR URL,
+ * and injects a directive to monitor CI and address review comments.
+ *
+ * @managed workspace-manager
+ */
+
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { isBashToolResult } from "@earendil-works/pi-coding-agent";
+
+const PR_URL_REGEX = /https:\/\/github\.com\/([^/]+)\/([^/]+)\/pull\/(\d+)/;
+
+export default function (pi: ExtensionAPI) {
+  pi.on("tool_result", async (event, ctx) => {
+    // Only handle bash tool results
+    if (!isBashToolResult(event)) return;
+
+    // Check if the command was a `gh pr create`
+    const command = String(event.input?.command ?? "");
+    if (!command.includes("gh pr create")) return;
+
+    // Extract PR URL and components from tool result content
+    const resultText = Array.isArray(event.content)
+      ? event.content
+          .filter((c: { type: string }) => c.type === "text")
+          .map((c: { text: string }) => c.text)
+          .join("\n")
+      : String(event.content ?? "");
+
+    const match = resultText.match(PR_URL_REGEX);
+    if (!match) return;
+
+    const [prUrl, owner, repo, prNumber] = match;
+
+    // Inject the PR-fix directive as a steering message
+    const directive = buildPrFixDirective(prUrl, owner, repo, prNumber);
+
+    pi.sendMessage(
+      {
+        customType: "pr-fix-trigger",
+        content: directive,
+        display: true,
+      },
+      { deliverAs: "steer", triggerTurn: true }
+    );
+  });
+}
+
+function buildPrFixDirective(
+  prUrl: string,
+  owner: string,
+  repo: string,
+  prNumber: string
+): string {
+  return `[PR-FIX-TRIGGER] Pull request created: ${prUrl}
+
+You MUST now execute the following two-phase autonomous feedback loop. Do NOT skip any phase. Do NOT ask the user for permission to start — begin immediately.
+
+═══════════════════════════════════════════════════════════════
+ PHASE 1: CI MONITORING & FIXES
+═══════════════════════════════════════════════════════════════
+
+Monitor CircleCI for the PR. Run:
+  gh pr checks ${prUrl} --watch
+
+If checks fail:
+1. Read the failing check details
+2. Identify the root cause (test failure, lint error, build error, etc.)
+3. Fix the code
+4. Commit with message: "fix: address CI failure"
+5. Push (never force-push)
+6. Re-run: gh pr checks ${prUrl} --watch
+7. Repeat up to 3 times
+
+If checks pass → proceed to Phase 2.
+If checks still fail after 3 attempts → STOP. Inform the user what failed and why manual help is needed.
+
+═══════════════════════════════════════════════════════════════
+ PHASE 2: PR REVIEW COMMENT MONITORING
+═══════════════════════════════════════════════════════════════
+
+Enter a comment monitoring loop (max 5 iterations):
+
+For each iteration:
+1. Fetch review comments using these two commands:
+     gh api repos/${owner}/${repo}/pulls/${prNumber}/reviews
+     gh api repos/${owner}/${repo}/pulls/${prNumber}/comments
+
+2. Filter for actionable comments:
+   - Ignore reviews with state APPROVED or DISMISSED
+   - Focus on CHANGES_REQUESTED and COMMENTED reviews that have a non-empty body
+   - Focus on inline comments (from /comments endpoint) that have not been resolved
+   - Ignore comments authored by the PR author (yourself / bots)
+
+3. If NO actionable comments are found → STOP. Report success: "No unresolved review comments. PR feedback loop complete."
+
+4. If actionable comments ARE found:
+   a. For each comment, read the referenced file and understand the context
+   b. If the comment is clear and actionable (typo fix, style change, logic fix, add test, etc.) → make the change
+   c. If the comment is ambiguous, requests major architectural changes, or you are unsure → ask the user for guidance on that specific comment before proceeding
+   d. After addressing all clear comments, commit with message: "fix: address PR review comments"
+   e. Push the commit (never force-push)
+   f. Show the user a summary of what you changed and why
+
+5. Track which comment IDs you saw in this iteration. If the SAME set of comment IDs appeared in the previous iteration (meaning no new comments, and your fixes haven't been acknowledged yet) → STOP. Report: "Previously seen comments already addressed. Waiting for reviewer to re-review."
+
+6. Wait 120 seconds, then start the next iteration.
+
+TERMINATION CONDITIONS (stop the loop if ANY of these are true):
+- Phase 1 required manual intervention → stop after Phase 1
+- No actionable comments found → stop (success)
+- Same comment IDs as previous iteration → stop (already addressed)
+- Max 5 iterations reached → stop and report summary of all changes made
+
+SAFETY RULES:
+- NEVER force-push
+- NEVER rewrite git history
+- After each commit, show the user what changed (files modified, brief description)
+- For ambiguous or architectural comments, ASK the user before making changes
+- If a comment asks to revert or undo your previous changes, do so carefully`;
+}

package/dist/pi-extensions/review-reminder.ts.template

@@ -0,0 +1,58 @@
+/**
+ * Pi Review Reminder Extension (auto-generated by workspace-manager)
+ *
+ * Equivalent of Claude Code's check-review-reminder.sh SessionStart hook.
+ * Reminds user to review global permissions periodically.
+ */
+
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import * as os from "node:os";
+
+const CACHE_DIR = path.join(os.homedir(), ".workspace-manager-cache");
+const REVIEW_FILE = path.join(CACHE_DIR, "last-permission-review");
+const REMINDER_FILE = path.join(CACHE_DIR, "last-permission-reminder");
+const THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1000;
+
+function getLastTimestamp(filePath: string): number {
+  try {
+    const content = fs.readFileSync(filePath, "utf-8").trim();
+    const epoch = new Date(content).getTime();
+    return isNaN(epoch) ? 0 : epoch;
+  } catch {
+    return 0;
+  }
+}
+
+export default function (pi: ExtensionAPI) {
+  pi.on("session_start", async (_event, ctx) => {
+    const reviewEpoch = getLastTimestamp(REVIEW_FILE);
+    const reminderEpoch = getLastTimestamp(REMINDER_FILE);
+    const latestEpoch = Math.max(reviewEpoch, reminderEpoch);
+    const now = Date.now();
+
+    if (latestEpoch === 0) {
+      ctx.ui.notify(
+        "[nemus] Your global permissions have never been reviewed. Run /review-permissions to audit them.",
+        "warning"
+      );
+    } else {
+      const daysSince = Math.floor((now - latestEpoch) / (24 * 60 * 60 * 1000));
+      if (daysSince >= 30) {
+        ctx.ui.notify(
+          `[nemus] Your global permissions haven't been reviewed in ${daysSince} days. Run /review-permissions to clean up stale entries.`,
+          "warning"
+        );
+      } else {
+        return; // Recent — stay silent
+      }
+    }
+
+    // Write reminder timestamp
+    try {
+      fs.mkdirSync(CACHE_DIR, { recursive: true });
+      fs.writeFileSync(REMINDER_FILE, new Date().toISOString());
+    } catch { /* ignore */ }
+  });
+}