@trim21/personal-pi-extensions 0.0.156 → 0.0.160

package/README.md

@@ -4,13 +4,12 @@
 
 ## 扩展概览
 
-| 扩展                                              | 描述                                                         |
-| ------------------------------------------------- | ------------------------------------------------------------ |
-| [bwrap](#bwrap)                                   | 基于 bubblewrap 的 OS 级沙箱，提供文件系统和网络隔离         |
-| [workspace-guard](#workspace-guard)               | 限制文件写入在 workspace 内，外部写入需用户审批              |
-| [opencode-edit](#opencode-edit)                   | 替换内置 edit 工具，使用 opencode 的 schema 和匹配引擎       |
-| [bash-default-timeout](#bash-default-timeout)     | 为 bash 工具设置默认超时（180 秒）                           |
-| [agents-md-user-message](#agents-md-user-message) | 将项目级 AGENTS.md 移至 user message，避免占用 system prompt |
+| 扩展                                          | 描述                                                   |
+| --------------------------------------------- | ------------------------------------------------------ |
+| [bwrap](#bwrap)                               | 基于 bubblewrap 的 OS 级沙箱，提供文件系统和网络隔离   |
+| [workspace-guard](#workspace-guard)           | 限制文件写入在 workspace 内，外部写入需用户审批        |
+| [opencode-edit](#opencode-edit)               | 替换内置 edit 工具，使用 opencode 的 schema 和匹配引擎 |
+| [bash-default-timeout](#bash-default-timeout) | 为 bash 工具设置默认超时（180 秒）                     |
 
 ---
 
@@ -134,23 +133,6 @@ pi -e ./src/bash-default-timeout.ts
 
 ---
 
-## agents-md-user-message
-
-将项目级 `AGENTS.md` 从 system prompt 移至 user message，减少 system prompt 占用。
-
-- 项目级 `AGENTS.md` → 放入 user message（仅首次消息注入一次）
-- 全局 `~/.pi/agent/AGENTS.md` → 保留在 system prompt
-
-需要配合 `--no-context-files` 参数禁用 pi 默认的上下文文件加载。
-
-### 使用
-
-```bash
-pi -e ./src/agents-md-user-message.ts --no-context-files
-```
-
----
-
 ## 安装
 
 ### 通过 npm/git 包

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trim21/personal-pi-extensions",
-  "version": "0.0.156",
+  "version": "0.0.160",
   "type": "module",
   "description": "Custom pi coding-agent extensions: bwrap sandbox, workspace guard, opencode edit, and more",
   "keywords": [

package/src/bwrap/index.ts

@@ -104,8 +104,29 @@ work inside the sandbox, run it WITHOUT full access first. If it fails with
 and set \`request_full_access_reason\` to describe the failure.
 `;
 
+const SUBAGENT_SANDBOX_PROMPT = `
+## Command Execution (subagent sandbox)
+
+You are running inside a read-only sandbox in a subagent session.
+
+- The bash tool is read-only: no filesystem writes, no network access, and
+  \`request_full_access\` is denied. Do not pass \`request_full_access\`.
+- Use the write/edit tools for file changes inside your workspace.
+- Writes outside the workspace are rejected. If a change outside the
+  workspace is needed, ask the parent session to apply it.
+- If a command truly requires network or system-level access, stop and ask
+  the parent session to run it, where the user can approve it.
+`;
+
 const PROTECTED_DIRS = [".git", ".pi", ".agent"];
 
+/**
+ * pi-subagents sets PI_SUBAGENT_CHILD=1 in every spawned child session
+ * (foreground and async alike). Subagent sessions are headless and must not
+ * be able to bypass the sandbox, so bwrap forces read-only bash there.
+ */
+const isSubagentChild = process.env.PI_SUBAGENT_CHILD === "1";
+
 const bwrapPath = findDefaultBwrap();
 
 function findDefaultBwrap(): string {
@@ -134,7 +155,7 @@ function findBwrap(override?: string): string {
 
 type BwrapMode = "allow-all" | "workspace-write" | "readonly";
 
-interface BwrapConfig {
+export interface BwrapConfig {
   mode: BwrapMode;
   bwrapPath?: string;
   writablePaths?: string[];
@@ -143,7 +164,7 @@ interface BwrapConfig {
   extraArgs?: string[];
 }
 
-interface ResolvedBwrap {
+export interface ResolvedBwrap {
   mode: BwrapMode;
   bwrapEnabled: boolean;
   network: boolean;
@@ -176,6 +197,22 @@ function resolveBwrap(config: BwrapConfig): ResolvedBwrap {
   }
 }
 
+/**
+ * Subagent sessions are forced read-only regardless of config: no writable
+ * paths (including configured extraWritablePaths), no network, and no
+ * user-supplied extra args that could add writable mounts.
+ */
+export function resolveSubagentBwrap(config: BwrapConfig): ResolvedBwrap {
+  return resolveBwrap({
+    ...config,
+    mode: "readonly",
+    writablePaths: [],
+    extraWritablePaths: [],
+    tmpfsPaths: [],
+    extraArgs: [],
+  });
+}
+
 const DEFAULT_CONFIG: BwrapConfig = {
   mode: "workspace-write",
   writablePaths: [".", "/tmp"],
@@ -483,6 +520,36 @@ function notifyMode(
   ctx.ui.notify(labels[mode], "info");
 }
 
+export type EscalationDecision = { kind: "dialog" } | { kind: "deny"; reason: string };
+
+/**
+ * Escalation (`request_full_access`) policy:
+ * - Subagent sessions are always denied: bash is read-only there and there is
+ *   no approval path (headless), so escalation would silently bypass the sandbox.
+ * - Any other headless session is denied: there is no user to approve.
+ * - Interactive sessions require the user approval dialog.
+ */
+export function resolveEscalation(opts: {
+  hasUI: boolean;
+  isSubagentChild: boolean;
+}): EscalationDecision {
+  if (opts.isSubagentChild) {
+    return {
+      kind: "deny",
+      reason:
+        "request_full_access is disabled in subagent sessions: the bash tool is read-only and cannot escalate. Ask the parent session to run this command.",
+    };
+  }
+  if (!opts.hasUI) {
+    return {
+      kind: "deny",
+      reason:
+        "request_full_access requires an interactive session with user approval; no UI is available in this session.",
+    };
+  }
+  return { kind: "dialog" };
+}
+
 const sandboxedBashSchema = Type.Object({
   command: Type.String({ description: "Bash command to execute" }),
   timeout: Type.Optional(
@@ -517,6 +584,10 @@ export default function bwrapExtension(pi: ExtensionAPI) {
   let resolved: ResolvedBwrap | null = null;
 
   function getResolved(): ResolvedBwrap {
+    // Subagents ignore config and runtime switches: bash is always read-only.
+    if (isSubagentChild) {
+      return resolveSubagentBwrap(loadConfig(localCwd));
+    }
     if (!resolved) {
       resolved = resolveBwrap(loadConfig(localCwd));
     }
@@ -524,6 +595,7 @@ export default function bwrapExtension(pi: ExtensionAPI) {
   }
 
   function setMode(mode: BwrapMode) {
+    if (isSubagentChild) return; // mode switching is not allowed in subagents
     const config = loadConfig(localCwd);
     config.mode = mode;
     resolved = resolveBwrap(config);
@@ -550,6 +622,11 @@ export default function bwrapExtension(pi: ExtensionAPI) {
       const escalate = params.request_full_access === true;
 
       if (escalate) {
+        const policy = resolveEscalation({ hasUI: ctx?.hasUI ?? false, isSubagentChild });
+        if (policy.kind === "deny") {
+          throw new Error(policy.reason);
+        }
+
         if (ctx?.hasUI) {
           const reason = params.request_full_access_reason;
           const reasonText = reason
@@ -595,7 +672,9 @@ export default function bwrapExtension(pi: ExtensionAPI) {
   pi.on("session_start", (_event, ctx) => {
     const noBwrap = pi.getFlag("no-bwrap") === true;
 
-    if (noBwrap) {
+    // Subagent sessions are always sandboxed read-only; --no-bwrap must not
+    // disable that (the flag is only honored in the parent session).
+    if (noBwrap && !isSubagentChild) {
       resolved = null;
       ctx.ui.notify("bwrap sandbox disabled via --no-bwrap", "warning");
       return;
@@ -612,7 +691,7 @@ export default function bwrapExtension(pi: ExtensionAPI) {
     }
 
     const config = loadConfig(ctx.cwd);
-    resolved = resolveBwrap(config);
+    resolved = isSubagentChild ? resolveSubagentBwrap(config) : resolveBwrap(config);
 
     if (resolved.bwrapEnabled) {
       try {
@@ -644,8 +723,9 @@ export default function bwrapExtension(pi: ExtensionAPI) {
     const r = getResolved();
 
     return {
-      systemPrompt:
-        event.systemPrompt + "\n\n" + SANDBOX_PROMPT + `\n\nCurrent mode: **${r.mode}**\n`,
+      systemPrompt: isSubagentChild
+        ? event.systemPrompt + "\n\n" + SUBAGENT_SANDBOX_PROMPT
+        : event.systemPrompt + "\n\n" + SANDBOX_PROMPT + `\n\nCurrent mode: **${r.mode}**\n`,
     };
   });
 

package/src/workspace-guard.ts

@@ -27,6 +27,13 @@ import { normalizeForEdit, replace } from "./opencode-edit-engine.js";
 const WRITE_TOOLS = new Set(["write", "edit"]);
 const ALWAYS_ALLOW = ["/tmp"];
 
+/**
+ * pi-subagents sets PI_SUBAGENT_CHILD=1 in every spawned child session.
+ * Subagents are headless, so there is no approval path: writes outside the
+ * workspace are rejected outright instead of asking for approval.
+ */
+const isSubagentChild = process.env.PI_SUBAGENT_CHILD === "1";
+
 /** Maximum lines of the diff preview shown in the approval dialog. */
 const MAX_PREVIEW_LINES = 100;
 
@@ -173,15 +180,48 @@ export async function buildDiffPreview(
   return wrapDiff(generateUnifiedPatch(basename(resolvedPath), oldContent, newContent, 2));
 }
 
+export interface WriteGuardDecision {
+  block: boolean;
+  reason?: string;
+}
+
+/**
+ * Decide how to handle a write outside the workspace.
+ * Subagent sessions (and any other headless session) have no approval path,
+ * so the write is rejected outright.
+ */
+export function decideOutsideWorkspaceWrite(
+  rawPath: string,
+  opts: { hasUI: boolean; isSubagentChild: boolean },
+): WriteGuardDecision {
+  if (opts.isSubagentChild) {
+    return {
+      block: true,
+      reason: `Path "${rawPath}" is outside the subagent workspace. Writes outside the workspace are rejected in subagent sessions; ask the parent session to apply this change.`,
+    };
+  }
+  if (!opts.hasUI) {
+    return {
+      block: true,
+      reason: `Path "${rawPath}" is outside workspace. No UI available for approval.`,
+    };
+  }
+  return { block: false };
+}
+
 export default function workspaceGuard(pi: ExtensionAPI) {
   pi.on("before_agent_start", (event, ctx) => {
     const currentCwd = ctx.cwd;
     return {
-      systemPrompt:
-        event.systemPrompt +
-        `\nWorkspace write protection is active. ` +
-        `write and edit to paths inside the workspace "${currentCwd}" or /tmp are auto-allowed. ` +
-        `Paths outside require user approval before execution.`,
+      systemPrompt: isSubagentChild
+        ? event.systemPrompt +
+          `\nSubagent write protection is active. ` +
+          `write and edit are allowed inside "${currentCwd}" and /tmp. ` +
+          `Writes outside the workspace are rejected without approval — ask the parent session to make such changes.`
+        : event.systemPrompt +
+          `\nWorkspace write protection is active. ` +
+          `write and edit to paths inside the workspace "${currentCwd}" or /tmp are auto-allowed. ` +
+          `Paths outside require user approval before execution.`,
     };
   });
 
@@ -195,12 +235,11 @@ export default function workspaceGuard(pi: ExtensionAPI) {
 
     if (isPathAllowed(resolved, ctx.cwd)) return;
 
-    if (!ctx.hasUI) {
-      return {
-        block: true,
-        reason: `Path "${rawPath}" is outside workspace. No UI available for approval.`,
-      };
-    }
+    const decision = decideOutsideWorkspaceWrite(rawPath, {
+      hasUI: ctx.hasUI,
+      isSubagentChild,
+    });
+    if (decision.block) return decision;
 
     let choice: string | undefined;
     while (!choice) {

package/src/agents-md-user-message.ts

@@ -1,71 +0,0 @@
-/**
- * AGENTS.md User Message
- *
- * Moves project-level AGENTS.md from system prompt to user message.
- * Global ~/.pi/agent/AGENTS.md stays in system prompt.
- *
- * Requires --no-context-files to disable pi's default context file loading.
- *
- * Usage:
- *   pi -e ./agents-md-user-message --no-context-files
- */
-
-import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
-import { getAgentDir, loadProjectContextFiles } from "@earendil-works/pi-coding-agent";
-
-export default function agentsMdUserMessage(pi: ExtensionAPI) {
-  let messageInjected = false;
-
-  pi.on("before_agent_start", (event) => {
-    const contextFiles = event.systemPromptOptions.contextFiles ?? [];
-    if (contextFiles.length > 0) return; // pi already handled them
-
-    // --no-context-files was used, we handle everything
-    const files = loadProjectContextFiles({
-      cwd: event.systemPromptOptions.cwd,
-      agentDir: getAgentDir(),
-    });
-    if (files.length === 0) return;
-
-    const agentDir = getAgentDir();
-    const globalFiles = files.filter((f) => f.path.startsWith(agentDir));
-    const projectFiles = files.filter((f) => !f.path.startsWith(agentDir));
-
-    if (projectFiles.length === 0) return;
-
-    let systemPrompt = event.systemPrompt;
-    if (globalFiles.length > 0) {
-      let block = "\n\n<project_context>\n\nProject-specific instructions and guidelines:\n\n";
-      for (const { path, content } of globalFiles) {
-        block += `<project_instructions path="${path}">\n${content}\n</project_instructions>\n\n`;
-      }
-      block += "</project_context>\n";
-      systemPrompt += block;
-    }
-
-    if (!messageInjected) {
-      messageInjected = true;
-
-      const content = projectFiles
-        .map(
-          (f) => `<project_instructions path="${f.path}">\n${f.content}\n</project_instructions>`,
-        )
-        .join("\n\n");
-
-      return {
-        systemPrompt,
-        message: {
-          customType: "agents-md-user",
-          content,
-          display: true,
-        },
-      };
-    }
-
-    return { systemPrompt };
-  });
-
-  pi.on("session_shutdown", () => {
-    messageInjected = false;
-  });
-}