@pipod/cli 0.1.9 → 0.1.11

package/docs/config-simplification.md

@@ -18,7 +18,7 @@
 Retired config keys fail closed in `validateConfig` (and in `planAccountLaunch`
 before resolve — covering nested `pi.hostConfig` lists and the machine layer
 `~/.pi-pod/config.json`, whose only ever-read keys are the template pin,
-`secretResolver`, and `pi.chords`/`pi.sessionNaming`) because silently ignoring a
+`secretResolver`, and `pi.chords`/`pi.sessionNaming`/`pi.podExtensions`) because silently ignoring a
 custom script path would read the wrong file. Server-resident bundles carrying
 retired keys (old templates) are stripped with a warning on pull and
 launch-preview — `push` clears them; `diff` strips silently by design (it is
@@ -33,7 +33,7 @@ One deep boundary, `stripNonBundleKeys` (`toOutgoingBundleConfig` for raw files)
 drops everything a bundle payload must not contain: the rejected keys
 (`template` — the local pin, a template id travels instead; `reuse`;
 `envFile`/`initScript`/`bakeScript`; `pi.hostConfig.skills`/`extensions`) plus
-client-only metadata (`$schema`, `secretResolver`, `pi.chords`/`pi.sessionNaming`).
+client-only metadata (`$schema`, `secretResolver`, `pi.chords`/`pi.sessionNaming`/`pi.podExtensions`).
 Covered paths: project/user/org-dir compilation, the launch bootstrap preview,
 `templates create/edit --config`, and `settings user|org edit|set` — the settings
 verbs validate the edited config locally first (types and retired keys fail
@@ -58,6 +58,7 @@ explicit `set reuse true` fails visibly rather than vanishing.
   server-side; `packages` is enforced on both sides (local sanitize/filter plus
   the server install gate).
 - `pi.chords` / `pi.sessionNaming` — client-only UI preferences, stripped before anything travels.
+- `pi.podExtensions` — client-only: whether a pod's attested Pi extensions run on this machine without asking (`"ask"` or `"run"`). Read only from `~/.pi-pod/config.json`, so no server layer can choose to run code on someone's machine.
 - `secretResolver` / `$schema` — client-only op:// resolution config / schema hint; never travel.
 
 ## Retained: CLI surface (complete inventory)
@@ -114,15 +115,17 @@ ignored, except `--dry-run`/`--on`-with-fork which are usage errors.
   `--from-here`), `edit` (`--name/--description/--config/--init-script/--bake-script`;
   `--org` rejected — org-wide goes through `share`; whole-snapshot replace goes through `push`), `share` (one-way),
   `rm|delete [-y]`. A global `--yes` is honored (no false scope warning).
-- `push [template [<name>]|user|org]`: whole-bundle replace from the layer's
-  local source (project `.pi-pod/`+`.pi/`, user `~/.pi-pod`+`~/.pi/agent`, org
-  `~/.pi-pod/org/` or `--dir`), after a diff preview. `--with-secrets` uploads
-  env values (else a prompt per bundle); `-y` applies without confirming.
-- `pull [layer]`: reverse of push (same sources; `--dir` for org; `-y`).
+- `push [template [<name>]|user|org|policy]`: whole-bundle replace from the
+  layer's local source (project `.pi-pod/`+`.pi/`, user `~/.pi-pod`+`~/.pi/agent`,
+  org `~/.pi-pod/org/` or `--dir`, policy `policy.json` in that org directory),
+  after a diff preview. The policy is config only and validated by the server.
+  `--with-secrets` uploads env values (else a prompt per bundle); `-y` applies
+  without confirming.
+- `pull [layer]`: reverse of push (same sources; `--dir` for org and policy; `-y`).
   Client-only keys, host-coupled settings, and model credential values survive;
   server scripts with no local file warn instead of writing.
 - `diff [layer]`: same sources, secrets by name only; exit 1 on drift (`--dir`
-  for org; no `-y` — it never writes).
+  for org and policy; no `-y` — it never writes).
 - `settings <user|org> [show|edit|set <key> <json-value>]`: config-only
   compare-and-swap edits (scripts/Pi files untouched — that is `push`).
   `show` prints JSON; `edit` uses `$VISUAL`/`$EDITOR`; `set` takes a dotted key

package/man/pipod-config.5

@@ -1,4 +1,4 @@
-.TH "PIPOD\-CONFIG" "5" "October 2026" "0.1.9"
+.TH "PIPOD\-CONFIG" "5" "October 2026" "0.1.11"
 .SH "NAME"
 \fBpipod-config\fR \- pi pod configuration files
 .SH SYNOPSIS
@@ -94,6 +94,10 @@ pi\.chords                keystrokes for /pod commands while attached:
                            "bindings": { "d": "detach", "a": "archive", "s": "status",
                                          "l": "list", "w": "switch" } }
 pi\.sessionNaming         "auto" (default) names a session from its first prompt; "off"
+pi\.podExtensions         a pod's Pi extensions run on this machine, as you, to render in
+                         the terminal: "ask" (default) confirms each new extension
+                         version; "run" runs them without asking (read only from
+                         ~/\.pi\-pod/config\.json)
 $schema                  ignored
 .fi
 .RE

package/man/pipod-config.5.md

@@ -91,6 +91,10 @@ pi.chords                keystrokes for /pod commands while attached:
                            "bindings": { "d": "detach", "a": "archive", "s": "status",
                                          "l": "list", "w": "switch" } }
 pi.sessionNaming         "auto" (default) names a session from its first prompt; "off"
+pi.podExtensions         a pod's Pi extensions run on this machine, as you, to render in
+                         the terminal: "ask" (default) confirms each new extension
+                         version; "run" runs them without asking (read only from
+                         ~/.pi-pod/config.json)
 $schema                  ignored
 ```
 

package/man/pipod.1

@@ -1,4 +1,4 @@
-.TH "PIPOD" "1" "October 2026" "0.1.9"
+.TH "PIPOD" "1" "October 2026" "0.1.11"
 .SH "NAME"
 \fBpipod\fR \- run pi coding\-agent sessions in server\-managed pods
 .SH SYNOPSIS
@@ -90,9 +90,9 @@ bake script that is built into the pod image once, and Pi files\. Secrets are st
 the layers and reach pods as environment variables\. \fBpipod help layers\fP explains how they
 combine\.
 .P
-Every server layer has a local source of truth: a directory you edit with any editor, then
-upload with \fBpipod push\fP\|\. \fBpipod pull\fP writes the server's copy back, and \fBpipod diff\fP
-compares the two\.
+Every server layer, organization policy included, has a local source of truth: files you edit
+with any editor, then upload with \fBpipod push\fP\|\. \fBpipod pull\fP writes the server's copy back, and
+\fBpipod diff\fP compares the two\.
 .SH SETUP
 .P
 Setting pi pod up for yourself or an organization, in order\. A person has to do the steps
@@ -137,8 +137,20 @@ pipod push org
 .RE
 .P
 Values for secrets the whole organization shares: \fBpipod secrets set org <NAME>\fP (person)\.
-Organization policy (limits rather than defaults) is set in the web dashboard,
-\fB<server>/dashboard/\fP\|\.
+.P
+Organization policy (limits rather than defaults) needs the policy:write permission\. Its source
+is policy\.json beside the organization layer's files:
+.RS 2
+.nf
+pipod pull policy                # writes ~/\.pi\-pod/org/policy\.json
+                                 # edit it
+pipod diff policy
+pipod push policy
+.fi
+.RE
+.P
+To keep the organization's source in a repository instead, give each of these commands
+\fB\-\-dir <path>\fP\|\.
 .SS 5\. Your own defaults
 .P
 Your model and thinking level, your Pi settings, personal setup such as a git identity:
@@ -217,8 +229,8 @@ and the server refuses a literal key\.
 .P
 Organization policy holds limits rather than defaults: maximum idle and archive times,
 allowed providers, a required template, network rules, concurrency\. It clamps the merged
-result, and \fBpipod doctor\fP and \fBpipod \-\-dry\-run\fP report every clamp\. It is set in the web
-dashboard by someone with the policy:write permission\.
+result, and \fBpipod doctor\fP and \fBpipod \-\-dry\-run\fP report every clamp\. Someone with the
+policy:write permission changes it with \fBpipod push policy\fP or in the web dashboard\.
 .P
 Where each layer's source lives, and the commands that change it:
 .RS 2
@@ -229,6 +241,8 @@ user       ~/\.pi\-pod/config\.json and ~/\.pi/agent/
            pipod pull|diff|push user; pipod settings user set
 template   a project: \.pi\-pod/config\.json, init\.sh, bake\.sh, env, and \.pi/
            pipod pull|diff|push [template [<name>]]; pipod templates
+policy     ~/\.pi\-pod/org/policy\.json
+           pipod pull|diff|push policy                           (policy:write)
 .fi
 .RE
 .P
@@ -459,7 +473,7 @@ A personal template sits above your user layer and an org\-wide one below it
 .SS pipod push
 .RS 2
 .nf
-Usage: pipod push [template [<name>] | user | org] [\-\-dir <path>]
+Usage: pipod push [template [<name>] | user | org | policy] [\-\-dir <path>]
                   [\-\-with\-secrets] [\-\-yes]
 
 Replace a server config bundle with its local source, whole\. The layer names
@@ -475,13 +489,16 @@ Layers and their local source:
                      models\.json, mcporter\.json, subagents\.json, agents/)
   org                ~/\.pi\-pod/org/: config\.json, init\.sh, bake\.sh, pi/…, and
                      an optional env file whose values become org secrets
+  policy             ~/\.pi\-pod/org/policy\.json: the organization policy, one
+                     JSON object of limits, checked by the server
 
 Inside a project the layer defaults to template; elsewhere it is required\.
 Provider credentials, hooks, mcpServers, and model credential values never
 leave this machine\.
 
 Options:
-  \-\-dir <path>     org only: read the org source from <path> instead
+  \-\-dir <path>     org and policy: read the org source directory from <path>
+                   instead
   \-\-with\-secrets   Also upload the layer's env values as secrets
   \-y, \-\-yes        Apply the replacement without the confirmation prompt
 .fi
@@ -493,7 +510,8 @@ confirm on, push declines unless \fB\-\-yes\fP is given\.
 .SS pipod pull
 .RS 2
 .nf
-Usage: pipod pull [template [<name>] | user | org] [\-\-dir <path>] [\-\-yes]
+Usage: pipod pull [template [<name>] | user | org | policy] [\-\-dir <path>]
+                  [\-\-yes]
 
 Write a server config bundle into its local source files (see
 `pipod push \-\-help` for the layer → directory table)\. A diff preview
@@ -501,7 +519,7 @@ precedes the confirmation; nothing is written when the two already match\.
 
 What pull keeps from the local files:
   config\.json    client\-only keys: $schema, template, secretResolver,
-                 pi\.chords, pi\.sessionNaming
+                 pi\.chords, pi\.sessionNaming, pi\.podExtensions
   settings\.json  hooks and mcpServers (and packages when hostConfig\.packages
                  is off)
   models\.json    credential values the push had dropped
@@ -511,21 +529,23 @@ Secrets stay on the server; their names are listed\. The user layer has no
 local script files, so user bundle scripts are shown but not written\.
 
 Options:
-  \-\-dir <path>   org only: write the org source to <path> instead
+  \-\-dir <path>   org and policy: write the org source directory at <path>
+                 instead
   \-y, \-\-yes      Apply the local changes without the confirmation prompt
 .fi
 .RE
 .SS pipod diff
 .RS 2
 .nf
-Usage: pipod diff [template [<name>] | user | org] [\-\-dir <path>]
+Usage: pipod diff [template [<name>] | user | org | policy] [\-\-dir <path>]
 
 Compare a config layer's local source with its server bundle (see
 `pipod push \-\-help` for the layer → directory table)\. Secrets compare by
 name only\. Exits 1 when they differ, 0 when they match\.
 
 Options:
-  \-\-dir <path>   org only: read the org source from <path> instead
+  \-\-dir <path>   org and policy: read the org source directory from <path>
+                 instead
 .fi
 .RE
 .SS pipod secrets

package/man/pipod.1.md

@@ -89,9 +89,9 @@ bake script that is built into the pod image once, and Pi files. Secrets are sto
 the layers and reach pods as environment variables. `pipod help layers` explains how they
 combine.
 
-Every server layer has a local source of truth: a directory you edit with any editor, then
-upload with `pipod push`. `pipod pull` writes the server's copy back, and `pipod diff`
-compares the two.
+Every server layer, organization policy included, has a local source of truth: files you edit
+with any editor, then upload with `pipod push`. `pipod pull` writes the server's copy back, and
+`pipod diff` compares the two.
 
 ## SETUP
 
@@ -139,8 +139,19 @@ pipod push org
 ```
 
 Values for secrets the whole organization shares: `pipod secrets set org <NAME>` (person).
-Organization policy (limits rather than defaults) is set in the web dashboard,
-`<server>/dashboard/`.
+
+Organization policy (limits rather than defaults) needs the policy:write permission. Its source
+is policy.json beside the organization layer's files:
+
+```
+pipod pull policy                # writes ~/.pi-pod/org/policy.json
+                                 # edit it
+pipod diff policy
+pipod push policy
+```
+
+To keep the organization's source in a repository instead, give each of these commands
+`--dir <path>`.
 
 ### 5. Your own defaults
 
@@ -207,8 +218,8 @@ project's .pi-pod/config.json. Within the layers:
 
 Organization policy holds limits rather than defaults: maximum idle and archive times,
 allowed providers, a required template, network rules, concurrency. It clamps the merged
-result, and `pipod doctor` and `pipod --dry-run` report every clamp. It is set in the web
-dashboard by someone with the policy:write permission.
+result, and `pipod doctor` and `pipod --dry-run` report every clamp. Someone with the
+policy:write permission changes it with `pipod push policy` or in the web dashboard.
 
 Where each layer's source lives, and the commands that change it:
 
@@ -219,6 +230,8 @@ user       ~/.pi-pod/config.json and ~/.pi/agent/
            pipod pull|diff|push user; pipod settings user set
 template   a project: .pi-pod/config.json, init.sh, bake.sh, env, and .pi/
            pipod pull|diff|push [template [<name>]]; pipod templates
+policy     ~/.pi-pod/org/policy.json
+           pipod pull|diff|push policy                           (policy:write)
 ```
 
 What belongs where: the organization layer holds what everyone needs (pod size, network
@@ -451,7 +464,7 @@ A personal template sits above your user layer and an org-wide one below it
 ### pipod push
 
 ```
-Usage: pipod push [template [<name>] | user | org] [--dir <path>]
+Usage: pipod push [template [<name>] | user | org | policy] [--dir <path>]
                   [--with-secrets] [--yes]
 
 Replace a server config bundle with its local source, whole. The layer names
@@ -467,13 +480,16 @@ Layers and their local source:
                      models.json, mcporter.json, subagents.json, agents/)
   org                ~/.pi-pod/org/: config.json, init.sh, bake.sh, pi/…, and
                      an optional env file whose values become org secrets
+  policy             ~/.pi-pod/org/policy.json: the organization policy, one
+                     JSON object of limits, checked by the server
 
 Inside a project the layer defaults to template; elsewhere it is required.
 Provider credentials, hooks, mcpServers, and model credential values never
 leave this machine.
 
 Options:
-  --dir <path>     org only: read the org source from <path> instead
+  --dir <path>     org and policy: read the org source directory from <path>
+                   instead
   --with-secrets   Also upload the layer's env values as secrets
   -y, --yes        Apply the replacement without the confirmation prompt
 ```
@@ -485,7 +501,8 @@ confirm on, push declines unless `--yes` is given.
 ### pipod pull
 
 ```
-Usage: pipod pull [template [<name>] | user | org] [--dir <path>] [--yes]
+Usage: pipod pull [template [<name>] | user | org | policy] [--dir <path>]
+                  [--yes]
 
 Write a server config bundle into its local source files (see
 `pipod push --help` for the layer → directory table). A diff preview
@@ -493,7 +510,7 @@ precedes the confirmation; nothing is written when the two already match.
 
 What pull keeps from the local files:
   config.json    client-only keys: $schema, template, secretResolver,
-                 pi.chords, pi.sessionNaming
+                 pi.chords, pi.sessionNaming, pi.podExtensions
   settings.json  hooks and mcpServers (and packages when hostConfig.packages
                  is off)
   models.json    credential values the push had dropped
@@ -503,21 +520,23 @@ Secrets stay on the server; their names are listed. The user layer has no
 local script files, so user bundle scripts are shown but not written.
 
 Options:
-  --dir <path>   org only: write the org source to <path> instead
+  --dir <path>   org and policy: write the org source directory at <path>
+                 instead
   -y, --yes      Apply the local changes without the confirmation prompt
 ```
 
 ### pipod diff
 
 ```
-Usage: pipod diff [template [<name>] | user | org] [--dir <path>]
+Usage: pipod diff [template [<name>] | user | org | policy] [--dir <path>]
 
 Compare a config layer's local source with its server bundle (see
 `pipod push --help` for the layer → directory table). Secrets compare by
 name only. Exits 1 when they differ, 0 when they match.
 
 Options:
-  --dir <path>   org only: read the org source from <path> instead
+  --dir <path>   org and policy: read the org source directory from <path>
+                 instead
 ```
 
 ### pipod secrets

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pipod/cli",
-  "version": "0.1.9",
+  "version": "0.1.11",
   "description": "Run pi coding-agent sessions in server-managed pods",
   "type": "module",
   "license": "AGPL-3.0-only",

package/templates/user-config.jsonc

@@ -20,6 +20,10 @@
         "w": "switch"
       }
     },
-    "sessionNaming": "auto"
+    "sessionNaming": "auto",
+
+    // A pod's Pi extensions run on this machine, as you, to render in your terminal. "ask"
+    // confirms each new extension version; "run" runs them all without asking.
+    "podExtensions": "ask"
   }
 }