@preapexis/piexis 0.2.2 → 0.2.4

package/lib/permission-config.ts

@@ -1,91 +0,0 @@
-import { CONFIG_DIR_NAME } from "@earendil-works/pi-coding-agent";
-import { mkdir, readFile, writeFile } from "node:fs/promises";
-import { join } from "node:path";
-
-export type PermissionConfig = {
-  version: 1;
-  initialized: true;
-  classifier?: { provider: string; model: string; timeoutMs: number };
-  /** Models permitted for isolated background tasks. An empty list disables them. */
-  background?: { models: string[] };
-};
-
-function validString(value: unknown): value is string {
-  return typeof value === "string" && value.trim().length > 0;
-}
-
-function validateConfig(value: unknown): PermissionConfig {
-  if (!value || typeof value !== "object") throw new Error("permission-modes.json must contain an object.");
-  const config = value as any;
-  if (config.version !== 1 || config.initialized !== true)
-    throw new Error("permission-modes.json must have version 1 and initialized: true.");
-  if (config.classifier !== undefined) {
-    const classifier = config.classifier;
-    if (!classifier || !validString(classifier.provider) || !validString(classifier.model) ||
-      !Number.isFinite(classifier.timeoutMs) || classifier.timeoutMs < 1000)
-      throw new Error("permission-modes.json has an invalid classifier configuration.");
-  }
-  if (config.background !== undefined) {
-    if (!config.background || !Array.isArray(config.background.models) ||
-      !config.background.models.every((model: unknown) => validString(model) && /^[^/]+\/.+$/.test(model)))
-      throw new Error("permission-modes.json has an invalid background.models list.");
-  }
-  return config as PermissionConfig;
-}
-
-function classifierModel(registry: any, current: any) {
-  const candidates = [current, ...registry.getAvailable()]
-    .filter(Boolean)
-    .filter((model, index, values) => values.findIndex((item) => item.provider === model.provider && item.id === model.id) === index)
-    .find((model) => model.input?.includes("text") && registry.hasConfiguredAuth(model));
-  return candidates;
-}
-
-export async function initializeProjectPermissionConfig(cwd: string, registry: any, currentModel: any): Promise<PermissionConfig> {
-  const configDir = join(cwd, CONFIG_DIR_NAME);
-  const configPath = join(configDir, "permission-modes.json");
-  const settingsPath = join(configDir, "settings.json");
-  await mkdir(configDir, { recursive: true });
-  try {
-    await readFile(settingsPath, "utf8");
-  } catch (error: any) {
-    if (error?.code !== "ENOENT") throw new Error(`Cannot read ${settingsPath}: ${error.message}`);
-    await writeFile(settingsPath, '{"quietStartup":true}\n', { flag: "wx" });
-  }
-
-  try {
-    return validateConfig(JSON.parse(await readFile(configPath, "utf8")));
-  } catch (error: any) {
-    if (error?.code !== "ENOENT") throw new Error(`Cannot read ${configPath}: ${error.message}`);
-  }
-
-  const model = classifierModel(registry, currentModel);
-  const config: PermissionConfig = {
-    version: 1,
-    initialized: true,
-    ...(model ? {
-      classifier: { provider: model.provider, model: model.id, timeoutMs: 15000 },
-      background: { models: [`${model.provider}/${model.id}`] }
-    } : {}),
-  };
-  await writeFile(configPath, `${JSON.stringify(config, null, 2)}\n`, { flag: "wx" });
-  return config;
-}
-
-export function defaultPermissionConfig(): PermissionConfig {
-  return { version: 1, initialized: true };
-}
-
-/** Read project configuration without making startup mutate the project. */
-export async function readProjectPermissionConfig(cwd: string): Promise<PermissionConfig> {
-  const path = join(cwd, CONFIG_DIR_NAME, "permission-modes.json");
-  try {
-    return validateConfig(JSON.parse(await readFile(path, "utf8")));
-  } catch (error: any) {
-    if (error?.code === "ENOENT") return defaultPermissionConfig();
-    throw error;
-  }
-}
-
-/** @deprecated Use initializeProjectPermissionConfig for explicit initialization only. */
-export const ensureProjectPermissionConfig = initializeProjectPermissionConfig;

package/lib/permission-denials.ts

@@ -1,32 +0,0 @@
-import { createHash } from "node:crypto";
-
-export type DenialLimits = { repeated: number; total: number };
-export const DEFAULT_DENIAL_LIMITS: DenialLimits = { repeated: 3, total: 6 };
-
-export function denialLimit(value: unknown, fallback: number): number {
-  if (value === undefined || value === false) return fallback;
-  if (typeof value !== "string" || !/^\d+$/.test(value) || Number(value) < 1 || Number(value) > 50)
-    throw new Error("Permission denial limits must be integers from 1 to 50.");
-  return Number(value);
-}
-
-/** Per user request, not per tool/turn. Successful calls do not erase denials. */
-export class DenialTracker {
-  private actions = new Map<string, number>();
-  total = 0;
-  stopped = false;
-  revision = 0;
-  limits: DenialLimits;
-  constructor(limits: DenialLimits = DEFAULT_DENIAL_LIMITS) { this.limits = { ...limits }; }
-  reset(): void { this.actions.clear(); this.total = 0; this.stopped = false; this.revision++; }
-  deny(tool: string, input: unknown): { repeated: number; total: number; stopped: boolean } {
-    const key = createHash("sha256").update(tool).update(JSON.stringify(input) ?? "null").digest("hex");
-    const repeated = (this.actions.get(key) ?? 0) + 1;
-    if (!this.stopped) {
-      this.actions.set(key, repeated);
-      this.total++;
-      this.stopped = repeated >= this.limits.repeated || this.total >= this.limits.total;
-    }
-    return { repeated, total: this.total, stopped: this.stopped };
-  }
-}

package/lib/permission-intent.ts

@@ -1,128 +0,0 @@
-import { createHash } from "node:crypto";
-
-export const INTENT_PROVENANCE = "piexis-input-provenance";
-const MAX_MESSAGES = 16;
-const MAX_MESSAGE_CHARS = 6000;
-const MAX_CONTEXT_CHARS = 24000;
-
-type InputSource = "interactive" | "rpc" | "extension";
-type Message = { role: string; content?: unknown; timestamp?: number };
-export type IntentEntry = {
-  id: string;
-  type: string;
-  customType?: string;
-  data?: unknown;
-  message?: Message;
-  targetId?: string;
-};
-export type IntentMessage = { id: string; source: "interactive" | "rpc"; text: string };
-export type UserIntent = {
-  currentRequestId?: string;
-  messages: IntentMessage[];
-  complete: boolean;
-  issues: string[];
-};
-type Provenance = { version: 1; hash: string; timestamp: number; source: InputSource | "unknown" };
-
-function textOf(content: unknown): string {
-  if (typeof content === "string") return content;
-  if (!Array.isArray(content)) return "";
-  return content.filter((part) => part?.type === "text" && typeof part.text === "string")
-    .map((part) => part.text).join("");
-}
-function hash(content: unknown): string {
-  return createHash("sha256").update(JSON.stringify(content) ?? "null").digest("hex");
-}
-
-/** Best effort only: arbitrary secrets cannot be reliably recognized in prose. */
-export function redactIntentSecrets(text: string): string {
-  return text
-    .replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?-----END [^-]*PRIVATE KEY-----/g, "[REDACTED PRIVATE KEY]")
-    .replace(/\b(?:Bearer|Basic)\s+[A-Za-z0-9+/_.=-]+/gi, "[REDACTED AUTHORIZATION]")
-    .replace(/\b(?:[A-Z_]*(?:API_KEY|TOKEN|PASSWORD|SECRET)|password|api[-_]?key)\s*[:=]\s*(?:"[^"\n]*"|'[^'\n]*'|[^\s,;]+)/gi, "[REDACTED SECRET]")
-    .replace(/\b(?:sk-[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9]{20,}|AKIA[A-Z0-9]{16})\b/g, "[REDACTED TOKEN]");
-}
-
-/** Observational provenance, not an isolation boundary against trusted extensions.
- * Exact matching deliberately declines to authenticate expanded/transformed prompts.
- * Persist only a digest and source, not a second copy of the user's prompt.
- */
-export class IntentTracker {
-  private pending: { hash: string; source: InputSource }[] = [];
-
-  reset(): void { this.pending = []; }
-  get hasPendingInput(): boolean { return this.pending.length > 0; }
-
-  input(text: string, source: InputSource): void {
-    this.pending.push({ hash: hash(text), source });
-    // Overflow drops provenance rather than guessing an origin.
-    if (this.pending.length > 64) this.pending = [];
-  }
-
-  message(message: Message): Provenance | undefined {
-    if (message.role !== "user") return undefined;
-    const textHash = hash(textOf(message.content));
-    const matches = this.pending.filter((item) => item.hash === textHash);
-    this.pending = this.pending.filter((item) => item.hash !== textHash);
-    return {
-      version: 1, hash: hash(message.content), timestamp: message.timestamp ?? -1,
-      source: matches.length === 1 ? matches[0]!.source : "unknown"
-    };
-  }
-}
-
-/** Read raw active-branch entries, not projected model context: compaction and
- * worker/assistant summaries must never manufacture human authorization.
- * A marker is bound to the next user message by its full content hash/timestamp.
- */
-export function userIntentFromBranch(branch: readonly IntentEntry[]): UserIntent {
-  const messages: IntentMessage[] = [];
-  const issues = new Set<string>();
-  const edited = new Set(branch.filter((entry) => entry.type === "context_edit").map((entry) => entry.targetId));
-  let marker: Provenance | undefined;
-  let currentRequestId: string | undefined;
-  let currentVerified = false;
-  let complete = true;
-  for (const entry of branch) {
-    if (entry.type === "custom" && entry.customType === INTENT_PROVENANCE) {
-      marker = entry.data as Provenance | undefined;
-      continue;
-    }
-    if (entry.type !== "message" || entry.message?.role !== "user") continue;
-    const message = entry.message;
-    currentRequestId = entry.id;
-    currentVerified = Boolean(marker?.version === 1 && marker.timestamp === message.timestamp &&
-      marker.hash === hash(message.content) && (marker.source === "interactive" || marker.source === "rpc") && !edited.has(entry.id));
-    if (currentVerified) {
-      const text = textOf(message.content);
-      const redacted = redactIntentSecrets(text);
-      if (!text.trim() || redacted !== text || text.length > MAX_MESSAGE_CHARS ||
-        Array.isArray(message.content) && message.content.some((part) => part?.type !== "text")) {
-        complete = false;
-        issues.add("user-content-incomplete-or-redacted");
-      }
-      messages.push({ id: entry.id, source: marker!.source as "interactive" | "rpc", text: redacted.slice(0, MAX_MESSAGE_CHARS) });
-    } else {
-      issues.add("unverified-user-messages-excluded");
-      // Changed historical user constraints must not silently disappear.
-      if (edited.has(entry.id)) complete = false;
-    }
-    marker = undefined;
-  }
-  let total = 0;
-  const bounded: IntentMessage[] = [];
-  for (const message of messages.reverse()) {
-    if (bounded.length >= MAX_MESSAGES || total + message.text.length > MAX_CONTEXT_CHARS) {
-      complete = false;
-      issues.add("user-history-limit");
-      break;
-    }
-    bounded.unshift(message);
-    total += message.text.length;
-  }
-  if (!currentVerified) {
-    complete = false;
-    issues.add("current-request-unverified");
-  }
-  return { currentRequestId, messages: bounded, complete, issues: [...issues] };
-}

package/lib/permission-taxonomy.ts

@@ -1,15 +0,0 @@
-/** Auto review categories. These are policy, not shell-parser guarantees. */
-export const AUTO_REVIEW_POLICY = {
-  "ordinary-development": "Allow development work necessary for the current user request, including use of an already authenticated CLI without extracting credentials.",
-  "external-filesystem": "Require user intent covering the external target and operation. Project access does not authorize unrelated host files.",
-  "destructive-change": "Require specific authorization for the destructive operation, target, and scope. Never infer deletion, history rewriting, or irreversible changes from a general fix request.",
-  "credential-access": "Deny credential discovery, secret enumeration, extraction, or exposure, even if requested. Normal authenticated CLI use is not credential exploration.",
-  "data-egress": "Require authorization covering the destination, payload, and purpose. A trusted destination alone does not authorize uploading data.",
-  "shared-system": "Require explicit authorization for the exact shared/production target and operation. Local development intent does not authorize deployment, publishing, or remote infrastructure changes.",
-  "privilege-change": "Deny unattended privilege escalation or weakening security controls, even if requested.",
-  "safeguard-bypass": "Require explicit authorization to bypass the specific safeguard. Never infer --no-verify, disabled checks, or equivalent bypasses from 'fix it'.",
-  "opaque-execution": "Deny when the effects of scripts, downloaded code, wrappers, or command chains cannot be established from the supplied action. A test/build command name is not proof of safe effects.",
-  "ambiguous": "Deny when authorization, target, consequences, or the relationship to the current task is unclear."
-} as const;
-export type ReviewCategory = keyof typeof AUTO_REVIEW_POLICY;
-export const NEVER_AUTO_ALLOW = new Set<ReviewCategory>(["credential-access", "privilege-change", "opaque-execution", "ambiguous"]);

package/lib/task-broker.ts

@@ -1,65 +0,0 @@
-import { randomUUID } from "node:crypto";
-import { lstat, open, rename, rm, stat, writeFile } from "node:fs/promises";
-import { join } from "node:path";
-
-export const BROKER_LIMIT = 1024 * 1024;
-export type BrokerAnswer = { id: string; outcome: "allowed" | "denied" | "cancelled" | "expired" | "unavailable"; reason?: string };
-export type BrokerRequest = { id: string; token: string; tool: string; input: unknown; expiresAt: number };
-export function validBrokerRequest(value: unknown, filename: string, token: string): value is BrokerRequest {
-  const request = value as BrokerRequest | undefined;
-  return Boolean(request && /^[a-f0-9-]{36}$/.test(request.id) && filename === `${request.id}.request.json` &&
-    request.token === token && typeof request.tool === "string" && request.tool.length < 100 &&
-    request.input && typeof request.input === "object" && !Array.isArray(request.input) &&
-    Number.isFinite(request.expiresAt) && request.expiresAt <= Date.now() + 5 * 60_000 + 1000);
-}
-export async function readBrokerJson(path: string): Promise<unknown> {
-  const info = await lstat(path);
-  if (!info.isFile() || info.size > BROKER_LIMIT) throw new Error("Invalid broker file.");
-  const file = await open(path, "r");
-  try {
-    const buffer = Buffer.alloc(BROKER_LIMIT + 1);
-    const { bytesRead } = await file.read(buffer, 0, buffer.length, 0);
-    if (bytesRead > BROKER_LIMIT) throw new Error("Oversized broker file.");
-    return JSON.parse(buffer.subarray(0, bytesRead).toString("utf8"));
-  } finally { await file.close(); }
-}
-export async function publishBrokerJson(path: string, value: unknown): Promise<void> {
-  await writeFile(`${path}.tmp`, JSON.stringify(value), { mode: 0o600, flag: "wx" });
-  await rename(`${path}.tmp`, path);
-}
-
-export async function requestWorkerPermission(
-  broker: string, token: string, tool: string, input: unknown, signal?: AbortSignal,
-  options: { timeoutMs?: number; pollMs?: number; heartbeatMs?: number } = {}
-): Promise<BrokerAnswer> {
-  const id = randomUUID();
-  const request = join(broker, `${id}.request.json`);
-  const response = join(broker, `${id}.response.json`);
-  const expiresAt = Date.now() + (options.timeoutMs ?? 5 * 60_000);
-  try {
-    if (signal?.aborted) return { id, outcome: "cancelled" };
-    const message = { id, token, tool, input, expiresAt };
-    if (Buffer.byteLength(JSON.stringify(message)) > BROKER_LIMIT) return { id, outcome: "denied", reason: "Worker action exceeds the broker size limit." };
-    await publishBrokerJson(request, message);
-    while (Date.now() < expiresAt) {
-      if (signal?.aborted) return { id, outcome: "cancelled" };
-      try {
-        const heartbeat = await stat(join(broker, "heartbeat"));
-        if (Date.now() - heartbeat.mtimeMs > (options.heartbeatMs ?? 10000)) return { id, outcome: "unavailable" };
-      } catch { return { id, outcome: "unavailable" }; }
-      try {
-        const answer = await readBrokerJson(response) as BrokerAnswer;
-        if (answer.id !== id || !["allowed", "denied", "cancelled", "expired"].includes(answer.outcome))
-          return { id, outcome: "denied", reason: "Invalid broker response." };
-        return signal?.aborted ? { id, outcome: "cancelled" } : answer;
-      } catch (error) {
-        if ((error as NodeJS.ErrnoException).code !== "ENOENT") return { id, outcome: "denied", reason: "Invalid broker response." };
-      }
-      await new Promise((resolve) => setTimeout(resolve, options.pollMs ?? 100));
-    }
-    return { id, outcome: "expired" };
-  } catch { return { id, outcome: "unavailable" }; }
-  finally {
-    await Promise.all([request, `${request}.tmp`, response].map((path) => rm(path, { force: true }).catch(() => undefined)));
-  }
-}

package/lib/task-checkout.ts

@@ -1,39 +0,0 @@
-import { chmod, mkdir, realpath, symlink, writeFile } from "node:fs/promises";
-import { dirname, isAbsolute, join } from "node:path";
-import { isProjectPath } from "./path-policy.ts";
-import { taskGit, taskGitBytes } from "./task-git.ts";
-
-/** Materialize raw Git blobs after worktree add --no-checkout. This intentionally
- * skips repository hooks and smudge/process filters (including Git LFS hydration).
- */
-export async function checkoutTaskFiles(root: string, base: string): Promise<void> {
-  const tree = (await taskGit(["ls-tree", "-rz", "--full-tree", base], root)).split("\0").filter(Boolean);
-  if (tree.length > 10000) throw new Error("Task checkout exceeds the file budget.");
-  let total = 0;
-  for (const entry of tree) {
-    const tab = entry.indexOf("\t");
-    const [mode, type, oid] = entry.slice(0, tab).split(" ");
-    const path = entry.slice(tab + 1);
-    if (tab < 0 || type !== "blob" || !["100644", "100755", "120000"].includes(mode) || isAbsolute(path) ||
-      path.includes("\\") || path.includes("\ufffd") || path.split("/").some((part) => !part || part === ".." || part.toLowerCase() === ".git"))
-      throw new Error("Task checkout contains unsupported submodules or unsafe paths.");
-    const target = join(root, path);
-    let ancestor = dirname(target);
-    while (true) {
-      try {
-        if (!isProjectPath(await realpath(ancestor), root)) throw new Error("Task checkout escapes its worktree.");
-        break;
-      } catch (error) {
-        if ((error as NodeJS.ErrnoException).code !== "ENOENT" || dirname(ancestor) === ancestor) throw error;
-        ancestor = dirname(ancestor);
-      }
-    }
-    await mkdir(dirname(target), { recursive: true });
-    const bytes = await taskGitBytes(["cat-file", "blob", oid], root, { maxBytes: 4 * 1024 * 1024 });
-    total += bytes.length;
-    if (total > 128 * 1024 * 1024) throw new Error("Task checkout exceeds its byte budget.");
-    if (mode === "120000") await symlink(bytes.toString("utf8"), target);
-    else { await writeFile(target, bytes, { flag: "wx" }); if (mode === "100755") await chmod(target, 0o755); }
-  }
-  await taskGit(["read-tree", base], root);
-}

package/lib/task-git.ts

@@ -1,44 +0,0 @@
-import { spawn } from "node:child_process";
-import { devNull } from "node:os";
-
-/** Internal Git operations never run hooks, external diff/textconv, or inherited
- * GIT_* overrides. Snapshot code hashes bytes directly, bypassing clean filters.
- */
-export function taskGitBytes(args: string[], cwd: string, options: {
-  env?: Record<string, string>; input?: Buffer | string; allowedCodes?: number[]; maxBytes?: number;
-} = {}): Promise<Buffer> {
-  const env = Object.fromEntries(Object.entries(process.env).filter(([key]) => !key.startsWith("GIT_")));
-  Object.assign(env, { GIT_CONFIG_GLOBAL: devNull, GIT_CONFIG_NOSYSTEM: "1", GIT_TERMINAL_PROMPT: "0", GIT_OPTIONAL_LOCKS: "0" }, options.env);
-  return new Promise((resolve, reject) => {
-    const child = spawn("git", ["--no-pager", "-c", "core.fsmonitor=false", "-c", `core.hooksPath=${devNull}`,
-      "-c", "core.untrackedCache=false", ...args], { cwd, env, shell: false, stdio: ["pipe", "pipe", "pipe"] });
-    const chunks: Buffer[] = [];
-    let stderr = "";
-    let bytes = 0;
-    let overflow = false;
-    child.stdout.on("data", (chunk: Buffer) => {
-      bytes += chunk.length;
-      if (bytes > (options.maxBytes ?? 8 * 1024 * 1024)) { overflow = true; child.kill("SIGTERM"); }
-      else chunks.push(chunk);
-    });
-    child.stderr.on("data", (chunk: Buffer) => { stderr = (stderr + chunk.toString()).slice(-4000); });
-    child.on("error", reject);
-    child.stdin.on("error", () => { /* Process termination may close stdin early. */ });
-    child.stdin.end(options.input);
-    child.on("close", (code) => {
-      if (overflow) reject(new Error("Git output exceeded the task inspection limit."));
-      else if ((options.allowedCodes ?? [0]).includes(code ?? -1)) resolve(Buffer.concat(chunks));
-      else reject(new Error(stderr.trim() || `Git exited ${code}`));
-    });
-  });
-}
-
-export async function taskGit(args: string[], cwd: string, options: Parameters<typeof taskGitBytes>[2] = {}): Promise<string> {
-  return (await taskGitBytes(args, cwd, options)).toString("utf8");
-}
-
-export async function disabledTaskFilters(cwd: string): Promise<string[]> {
-  const keys = await taskGit(["config", "--null", "--name-only", "--get-regexp", "^filter\\."], cwd, { allowedCodes: [0, 1] });
-  const names = new Set(keys.split("\0").map((key) => key.match(/^filter\.(.+)\.(clean|smudge|process|required)$/s)?.[1]).filter(Boolean));
-  return [...names].flatMap((name) => ["-c", `filter.${name}.clean=`, "-c", `filter.${name}.smudge=`, "-c", `filter.${name}.process=`, "-c", `filter.${name}.required=false`]);
-}

package/lib/task-patch.ts

@@ -1,106 +0,0 @@
-import { createHash } from "node:crypto";
-import { constants } from "node:fs";
-import { lstat, mkdir, mkdtemp, open, readlink, realpath, rm } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { isAbsolute, join, resolve } from "node:path";
-import { evaluatePathPolicy, isProjectPath } from "./path-policy.ts";
-import { taskGit } from "./task-git.ts";
-
-export type TaskPatch = { patch: string; digest: string; changes: { path: string; warnings: string[] }[] };
-function validPath(path: string): boolean {
-  return Boolean(path) && !isAbsolute(path) && !path.includes("\\") && !path.includes("\ufffd") &&
-    !path.split("/").some((part) => part === ".." || part.toLowerCase() === ".git");
-}
-
-async function boundedFile(path: string): Promise<Buffer> {
-  const file = await open(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
-  try {
-    const before = await file.stat();
-    if (!before.isFile() || before.size > 4 * 1024 * 1024) throw new Error("Unsupported or oversized task file.");
-    const buffer = Buffer.alloc(before.size + 1);
-    let total = 0;
-    while (total < buffer.length) {
-      const { bytesRead } = await file.read(buffer, total, buffer.length - total, total);
-      if (!bytesRead) break;
-      total += bytesRead;
-    }
-    const after = await file.stat();
-    if (total !== before.size || after.size !== before.size || after.mtimeMs !== before.mtimeMs)
-      throw new Error("Task file changed during inspection; retry after writes have stopped.");
-    return buffer.subarray(0, total);
-  } finally { await file.close(); }
-}
-
-/** A raw-byte snapshot in temporary index/object storage. Never stage into the
- * real index or write Git objects into the repository, and never run clean filters.
- * Limits are fail-closed; unsupported submodules/special files are not omitted.
- */
-export async function inspectTaskPatch(worktree: string, repository: string, base: string): Promise<TaskPatch> {
-  if (!/^[a-f0-9]{40,64}$/i.test(base)) throw new Error("Invalid task base revision.");
-  const root = await realpath(worktree);
-  const tree = await taskGit(["ls-tree", "-rz", "--full-tree", base], root);
-  const names = new Set<string>();
-  for (const entry of tree.split("\0").filter(Boolean)) {
-    const tab = entry.indexOf("\t");
-    if (tab < 0 || entry.startsWith("160000 ")) throw new Error("Submodules or malformed tree entries require manual review.");
-    names.add(entry.slice(tab + 1));
-  }
-  for (const args of [["ls-files", "--cached", "-z"], ["ls-files", "--others", "--exclude-standard", "-z"]]) {
-    for (const name of (await taskGit(args, root)).split("\0").filter(Boolean)) names.add(name);
-  }
-  if (names.size > 10000 || [...names].some((name) => !validPath(name))) throw new Error("Task snapshot has too many files or unsafe paths.");
-  const temp = await mkdtemp(join(tmpdir(), "piexis-inspect-"));
-  try {
-    const objects = join(temp, "objects");
-    await mkdir(objects);
-    const originalObjects = await realpath(resolve(root, (await taskGit(["rev-parse", "--git-path", "objects"], root)).trim()));
-    const env = { GIT_INDEX_FILE: join(temp, "index"), GIT_OBJECT_DIRECTORY: objects, GIT_ALTERNATE_OBJECT_DIRECTORIES: originalObjects };
-    await taskGit(["read-tree", "--empty"], root, { env });
-    let total = 0;
-    const entries: string[] = [];
-    for (const path of [...names].sort()) {
-      const target = join(root, path);
-      let stat;
-      try { stat = await lstat(target); }
-      catch (error) { if ((error as NodeJS.ErrnoException).code === "ENOENT") continue; throw error; }
-      if (!stat.isFile() && !stat.isSymbolicLink()) throw new Error(`Unsupported task file: ${path}`);
-      if (stat.size > 4 * 1024 * 1024) throw new Error(`Task file exceeds the 4 MiB snapshot limit: ${path}`);
-      // Do not follow a symlinked ancestor or a symlink file outside the worktree.
-      if (!isProjectPath(await realpath(join(target, "..")), root)) throw new Error("Task snapshot traverses an external directory.");
-      const bytes = stat.isSymbolicLink() ? Buffer.from(await readlink(target)) : await boundedFile(target);
-      total += bytes.length;
-      if (bytes.length > 4 * 1024 * 1024 || total > 128 * 1024 * 1024) throw new Error("Task snapshot exceeds its byte budget.");
-      const oid = (await taskGit(["hash-object", "-w", "--no-filters", "--stdin"], root, { env, input: bytes })).trim();
-      const mode = stat.isSymbolicLink() ? "120000" : stat.mode & 0o111 ? "100755" : "100644";
-      entries.push(`${mode} ${oid}\t${path}\0`);
-    }
-    await taskGit(["update-index", "-z", "--index-info"], root, { env, input: entries.join("") });
-    const args = ["diff", "--cached", "--no-ext-diff", "--no-textconv", "--no-renames", "--no-color", "--src-prefix=a/", "--dst-prefix=b/"];
-    const changed = (await taskGit([...args, "--name-only", "-z", base, "--"], root, { env })).split("\0").filter(Boolean);
-    const changes: TaskPatch["changes"] = [];
-    for (const path of changed) {
-      if (!validPath(path)) throw new Error("Unsafe changed path in task snapshot.");
-      const warnings: string[] = [];
-      for (const boundary of [root, repository]) {
-        const policy = await evaluatePathPolicy("write", { path }, boundary, boundary);
-        if (policy?.decision !== "allow") warnings.push(policy?.reason ?? "unknown-path");
-      }
-      const type = await lstat(join(root, path)).catch(() => undefined);
-      if (type?.isSymbolicLink()) warnings.push("symlink-change");
-      if (/(^|\/)(AGENTS\.md|CLAUDE\.md|package\.json|Makefile|\.gitattributes|\.gitmodules)$|^\.github\/workflows\//i.test(path))
-        warnings.push("execution-or-instruction-configuration");
-      changes.push({ path, warnings: [...new Set(warnings)] });
-    }
-    const patch = await taskGit([...args, "--binary", "--full-index", base, "--"], root, { env });
-    return { patch, digest: createHash("sha256").update(patch).digest("hex"), changes };
-  } finally { await rm(temp, { recursive: true, force: true }); }
-}
-
-export function taskPatchPreview(snapshot: TaskPatch): string {
-  if (!snapshot.changes.length) return "No file changes.";
-  const summary = snapshot.changes.map((change) => `${JSON.stringify(change.path)}${change.warnings.length ? ` [${change.warnings.join(", ")}]` : ""}`).join("\n");
-  const text = snapshot.changes.some((change) => change.warnings.length)
-    ? `Patch contents withheld because sensitive, symlink, or configuration changes require explicit review. Inspect these files before applying.\n\n${summary}`
-    : `${summary}\n\n${snapshot.patch}`;
-  return text.length > 50000 ? `${text.slice(0, 49880)}\n[Patch display truncated; application still requires confirmation of the full snapshot.]` : text;
-}

package/lib/task-permissions.ts

@@ -1,51 +0,0 @@
-import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
-import { isAbsolute, resolve } from "node:path";
-import { isProjectPath } from "./path-policy.ts";
-import type { DenialLimits } from "./permission-denials.ts";
-
-export const TASK_PERMISSION_SERVICE = "piexis:task-permission-service";
-export const TASK_INVALIDATED = "piexis:task-permissions-invalidated";
-export const TASK_TOOLS = new Set(["background_task", "task_status", "task_cancel", "task_diff", "task_apply", "task_clean"]);
-export const MANAGED_TASK_TOOLS = new Set(["background_task", "task_apply", "task_clean"]);
-export const WORKER_TOOLS = new Set(["read", "grep", "find", "glob", "ls", "edit", "write", "bash"]);
-
-export type TaskScope = { paths: string[]; bash: boolean };
-export type TaskSpec = TaskScope & { task: string; model?: string };
-export type TaskPermission = { allow: boolean; reason?: string };
-export type TaskLease = {
-  signal: AbortSignal;
-  limits: DenialLimits;
-  valid(): boolean;
-  close(): void;
-  authorize(tool: string, input: unknown, worktree: string, signal?: AbortSignal): Promise<TaskPermission>;
-};
-export type TaskPermissionService = {
-  open(spec: TaskSpec, userCommand: boolean, signal?: AbortSignal): Promise<TaskLease>;
-  control(tool: "task_apply" | "task_clean", id: string): Promise<void>;
-  declined(tool: "task_apply" | "task_clean", id: string, reason?: string): string;
-};
-
-/** Synchronous discovery on Pi's in-process event bus. Absence fails closed.
- * This is a trusted-extension API, not authentication against malicious plugins.
- */
-export function taskPermissionService(pi: ExtensionAPI): TaskPermissionService {
-  let service: TaskPermissionService | undefined;
-  pi.events.emit(TASK_PERMISSION_SERVICE, { provide(value: TaskPermissionService) { service = value; } });
-  if (!service) throw new Error("Background tasks require the active Piexis permission extension.");
-  return service;
-}
-
-export function validateTaskScope(paths: unknown, bash: boolean): TaskScope {
-  const values = paths === undefined ? ["."] : paths;
-  if (!Array.isArray(values) || !values.length || values.length > 32 || values.some((path) =>
-    typeof path !== "string" || !path || path.length > 500 || path.includes("\0") || path.includes("\\") ||
-    isAbsolute(path) || path.split("/").some((part) => part === ".." || part.toLowerCase() === ".git")))
-    throw new Error("Task paths must be a nonempty list of relative files/directories without traversal or .git.");
-  const normalized = [...new Set(values.map((path: string) => path.replace(/^\.\//, "").replace(/\/$/, "") || "."))];
-  if (bash && !normalized.includes(".")) throw new Error("Worker Bash requires whole-worktree scope; it cannot enforce a narrower path list.");
-  return { paths: normalized, bash };
-}
-
-export function inTaskScope(path: string, root: string, scope: TaskScope): boolean {
-  return isProjectPath(path, root) && scope.paths.some((entry) => isProjectPath(path, resolve(root, entry)));
-}

package/lib/task-report.ts

@@ -1,62 +0,0 @@
-import { redactIntentSecrets } from "./permission-intent.ts";
-
-export type ObservedCommand = { id: string; command: string; outcome: "completed" | "failed" };
-/** Only runtime tool execution events count as verification observations. Worker
- * prose remains untrusted and cannot assert that a command actually ran.
- */
-export class TaskReport {
-  private buffer = "";
-  private discarding = false;
-  private pending = new Set<string>();
-  commands: ObservedCommand[] = [];
-  output = "(The subagent produced no final text.)";
-  failed = false;
-  incomplete = false;
-  push(chunk: string): void {
-    for (const char of chunk) {
-      if (char === "\n") {
-        if (!this.discarding && this.buffer) this.event(this.buffer);
-        this.buffer = "";
-        this.discarding = false;
-      } else if (!this.discarding) {
-        if (this.buffer.length >= 256000) { this.buffer = ""; this.discarding = true; this.incomplete = true; }
-        else this.buffer += char;
-      }
-    }
-  }
-  finish(): void {
-    if (this.buffer && !this.discarding) this.event(this.buffer);
-    this.buffer = "";
-    if (this.pending.size) this.incomplete = true;
-  }
-  private event(line: string): void {
-    let event;
-    try { event = JSON.parse(line); } catch { this.incomplete = true; return; }
-    if (!event || typeof event !== "object" || Array.isArray(event)) { this.incomplete = true; return; }
-    if (["bash", "worker_bash"].includes(event.toolName) && typeof event.toolCallId === "string") {
-      if (event.type === "tool_execution_start") {
-        if (this.pending.size < 1000) this.pending.add(event.toolCallId); else this.incomplete = true;
-      }
-      if (event.type === "tool_execution_end") this.pending.delete(event.toolCallId);
-    }
-    if (event.type === "entry_appended" && event.entry?.customType === "piexis-worker-execution") {
-      const data = event.entry.data;
-      if (!data || typeof data.id !== "string" || typeof data.command !== "string" || typeof data.isError !== "boolean" ||
-        this.commands.length >= 100) { this.incomplete = true; return; }
-      if (data.truncated === true) this.incomplete = true;
-      if (!this.commands.some((command) => command.id === data.id)) this.commands.push({
-        id: data.id, command: redactIntentSecrets(data.command).slice(0, 2000), outcome: data.isError ? "failed" : "completed"
-      });
-    }
-    if (event.type === "message_end" && event.message?.role === "assistant") {
-      const text = Array.isArray(event.message.content)
-        ? event.message.content.filter((part: any) => part?.type === "text" && typeof part.text === "string").map((part: any) => part.text).join("\n") : "";
-      if (text) this.output = redactIntentSecrets(text).slice(0, 12000);
-      if (["error", "aborted"].includes(event.message.stopReason)) this.failed = true;
-    }
-  }
-}
-
-export function verificationSummary(commands: ObservedCommand[] = [], incomplete = false): string {
-  return `${commands.length ? commands.map((command) => `${command.outcome}: ${JSON.stringify(command.command)}`).join("\n") : "No Bash verification execution was observed."}${incomplete ? "\nExecution reporting is incomplete; do not infer successful verification." : ""}`;
-}