@openlines/opl-pi-sht 0.2.8 → 0.2.9

package/README.md

@@ -14,15 +14,16 @@
 
 A portable collection of various Pi coding agent extensions. Repository directories and config files use `opl-`; established Pi-facing commands and tool names stay compatible.
 
-<div align="center">
-
 >
-> ### v0.2.8 (29 Sept 2026) - **SSRF and tool-safety hardening**: `opl-webaccess` and `opl-browser` block private/link-local hosts by default and cloud metadata always (localhost stays available for dev), fetch redirects are re-checked per hop, screenshots refuse to overwrite existing files, and `evaluate` no longer crashes on `undefined`. <br/>See [CHANGELOG.md](CHANGELOG.md) for details.
+> ### v0.2.9 - pi dependencies patch, updated test scripts
+> - `devDependencies` updated to `>=0.87.0`, conforming to latest pi release `v0.99.x`; TUI and tests updates
+> ### v0.2.8 - SSRF and tool-safety hardening
+> - `opl-webaccess` and `opl-browser` block private/link-local hosts by default and cloud metadata always (localhost stays available for dev), fetch redirects are re-checked per hop, screenshots refuse to overwrite existing files, and `evaluate` no longer crashes on `undefined`.
 >
-> `Current project state also marked 'SAFE' for pi v0.99.0 release`<br/>*confirmed this because I was literally typing to push the patches when I noticed the release notif*
+> See [CHANGELOG](CHANGELOG.md) for more details.
+>
+> `Current project state also marked 'SAFE' for pi v0.99.x release`
 >
-
-</div>
 
 ## Installation
 

package/extensions/opl-guardian/README.md

@@ -1,6 +1,6 @@
 # opl-guardian
 
-A configurable session and tool safety extension. `opl-guardian` filters malformed assistant tool calls, prompts before dangerous Bash commands, blocks operations on protected paths, and confirms destructive session transitions. It replaces the standalone `permission-gate`, `protected-paths`, and `confirm-destructive` extensions while retaining malformed-call diagnostics. It adds no tools, commands, prompts, or model-facing schema overhead.
+A configurable session and tool safety extension. `opl-guardian` filters malformed assistant tool calls, prompts before dangerous Bash commands, blocks operations on protected paths, and confirms destructive session transitions. It replaces the standalone `permission-gate`, `protected-paths`, and `confirm-destructive` extensions while retaining malformed-call diagnostics. It adds no tools, commands, prompts, or model-facing schema overhead. All Guardian notification, selection-prompt, and confirmation message text is rendered in fixed red, regardless of Pi's theme; choice labels retain Pi's normal styling.
 
 ## Configuration
 

package/extensions/opl-guardian/index.ts

@@ -20,6 +20,12 @@ import {
 import { getProtectedPathBlock, hasPendingUserWork } from "./policies.js";
 
 const LOG_PATH = join("err", "guardian.jsonl");
+const RED = "\u001b[31m";
+const RESET_FOREGROUND = "\u001b[39m";
+
+function red(text: string): string {
+  return `${RED}${text}${RESET_FOREGROUND}`;
+}
 
 export async function appendIncident(cwd: string, incident: GuardianIncident): Promise<void> {
   const directory = join(cwd, "err");
@@ -103,7 +109,7 @@ export function createToolCallHandler(config: GuardianConfig) {
         const reason = blocked.unresolved
           ? `[opl-guardian] Cannot safely resolve path "${blocked.path}"; ${blocked.operation} denied by protected-path policy.`
           : `[opl-guardian] Path "${blocked.path}" is protected (${blocked.operation} denied).`;
-        if (ctx.hasUI) ctx.ui.notify(reason, "warning");
+        if (ctx.hasUI) ctx.ui.notify(red(reason), "warning");
         return { block: true, reason };
       }
     }
@@ -124,7 +130,7 @@ export function createToolCallHandler(config: GuardianConfig) {
     const options = ["No", "Yes"];
     if (ctx.mode === "rpc") {
       try {
-        const choice = await ctx.ui.select(`Dangerous command: ${preview.slice(0, 256)}\nAllow?`, options);
+        const choice = await ctx.ui.select(red(`Dangerous command:\n\n${preview.slice(0, 256)}\n\nAllow?`), options);
         if (choice === "Yes") return undefined;
       } catch {
         // A failed RPC dialog is not approval.
@@ -132,10 +138,10 @@ export function createToolCallHandler(config: GuardianConfig) {
       return { block: true, reason: "[opl-guardian] Command blocked; confirmation was declined or unavailable." };
     }
 
-    const choice = await ctx.ui.select(`Dangerous command: ${preview.slice(0, 256)}\nAllow?`, options);
+    const choice = await ctx.ui.select(red(`Dangerous command:\n\n${preview.slice(0, 256)}\n\nAllow?`), options);
     if (choice === "Yes") return undefined;
     const reason = "[opl-guardian] Command blocked by user because it matches a dangerous pattern.";
-    ctx.ui.notify(reason, "warning");
+    ctx.ui.notify(red(reason), "warning");
     return { block: true, reason };
   };
 }
@@ -151,7 +157,7 @@ export function createMessageEndHandler(config: GuardianConfig) {
       sessionId: ctx.sessionManager.getSessionId(),
     });
     if (!guarded) return undefined;
-    ctx.ui?.notify(guarded.diagnostic, "warning");
+    ctx.ui?.notify(red(guarded.diagnostic), "warning");
     return { message: guarded.message };
   };
 }
@@ -172,7 +178,7 @@ export function createSessionBeforeSwitchHandler(config: GuardianConfig) {
     }
 
     if (!ctx.hasUI) return config.confirmDestructive.blockWithoutUI ? { cancel: true } : undefined;
-    return await ctx.ui.confirm(title, message) ? undefined : { cancel: true };
+    return await ctx.ui.confirm(red(title), red(message)) ? undefined : { cancel: true };
   };
 }
 
@@ -181,8 +187,8 @@ export function createSessionBeforeForkHandler(config: GuardianConfig) {
     if (!config.confirmDestructive.forkSession) return undefined;
     if (!ctx.hasUI) return config.confirmDestructive.blockWithoutUI ? { cancel: true } : undefined;
     const confirmed = await ctx.ui.confirm(
-      `Fork from entry ${event.entryId.slice(0, 8)}?`,
-      "Create a new session branch from this point?",
+      red(`Fork from entry ${event.entryId.slice(0, 8)}?`),
+      red("Create a new session branch from this point?"),
     );
     return confirmed ? undefined : { cancel: true };
   };
@@ -192,7 +198,7 @@ export default function (pi: ExtensionAPI) {
   const { config, warnings } = loadGuardianConfig();
   pi.on("session_start", async (_event, ctx) => {
     if (warnings.length && ctx.hasUI) {
-      ctx.ui.notify(`[opl-guardian] Configuration warning(s):\n${warnings.join("\n")}`, "warning");
+      ctx.ui.notify(red(`[opl-guardian] Configuration warning(s):\n${warnings.join("\n")}`), "warning");
     }
   });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openlines/opl-pi-sht",
-  "version": "0.2.8",
+  "version": "0.2.9",
   "description": "opl-pi-sht (shouldHaveThat) Pi coding-agent extension kit: token-efficient context, tool and session safety, fingerprinted /init, model benchmarking, web access, and browser automation.",
   "repository": {
     "type": "git",
@@ -40,7 +40,7 @@
   },
   "type": "module",
   "scripts": {
-    "test": "npm run test:opl-browser && npm run test:opl-footer && npm run test:opl-guardian && npm run test:opl-init && npm run test:opl-input && npm run test:opl-modes && npm run test:opl-questionnaire && npm run test:opl-todo && npm run test:opl-webaccess && npm run test:opl-simplebench && npm run test:opl-ctxtrim && npm run test:pi-host",
+    "test": "node tests/test-summary.mjs",
     "test:opl-browser": "bun test tests/opl-browser-helpers.test.mjs && OPL_EXTENSION=opl-browser bun test tests/extension-smoke.test.mjs",
     "test:opl-footer": "bun test tests/opl-footer-helpers.test.mjs && OPL_EXTENSION=opl-footer bun test tests/extension-smoke.test.mjs",
     "test:opl-guardian": "bun test tests/opl-guardian.test.mjs && OPL_EXTENSION=opl-guardian bun test tests/extension-smoke.test.mjs",
@@ -55,6 +55,6 @@
     "test:pi-host": "bun test tests/pi-host-loader.test.mjs"
   },
   "devDependencies": {
-    "@earendil-works/pi-coding-agent": "^0.87.0"
+    "@earendil-works/pi-coding-agent": ">=0.87.0"
   }
 }