@trim21/personal-pi-extensions 0.0.168 → 0.0.171

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trim21/personal-pi-extensions",
-  "version": "0.0.168",
+  "version": "0.0.171",
   "type": "module",
   "description": "Custom pi coding-agent extensions: bwrap sandbox, workspace guard, opencode edit, and more",
   "keywords": [

package/src/bwrap/index.ts

@@ -104,29 +104,22 @@ work inside the sandbox, run it WITHOUT full access first. If it fails with
 and set \`request_full_access_reason\` to describe the failure.
 `;
 
-const SUBAGENT_SANDBOX_PROMPT = `
-## Command Execution (subagent sandbox)
+const HEADLESS_SANDBOX_PROMPT = `
+## Command Execution (headless sandbox)
 
-You are running inside a read-only sandbox in a subagent session.
+You are running inside a read-only sandbox without an interactive UI.
 
 - The bash tool is read-only: no filesystem writes, no network access, and
   \`request_full_access\` is denied. Do not pass \`request_full_access\`.
 - Use the write/edit tools for file changes inside your workspace.
-- Writes outside the workspace are rejected. If a change outside the
-  workspace is needed, ask the parent session to apply it.
-- If a command truly requires network or system-level access, stop and ask
-  the parent session to run it, where the user can approve it.
+- Writes outside the workspace are rejected because no UI is available for
+  approval.
+- If a command truly requires network or system-level access, explain that it
+  cannot be approved in this session.
 `;
 
 const PROTECTED_DIRS = [".git", ".pi", ".agent"];
 
-/**
- * pi-subagents sets PI_SUBAGENT_CHILD=1 in every spawned child session
- * (foreground and async alike). Subagent sessions are headless and must not
- * be able to bypass the sandbox, so bwrap forces read-only bash there.
- */
-const isSubagentChild = process.env.PI_SUBAGENT_CHILD === "1";
-
 const bwrapPath = findDefaultBwrap();
 
 function findDefaultBwrap(): string {
@@ -198,11 +191,11 @@ function resolveBwrap(config: BwrapConfig): ResolvedBwrap {
 }
 
 /**
- * Subagent sessions are forced read-only regardless of config: no writable
+ * Headless sessions are forced read-only regardless of config: no writable
  * paths (including configured extraWritablePaths), no network, and no
  * user-supplied extra args that could add writable mounts.
  */
-export function resolveSubagentBwrap(config: BwrapConfig): ResolvedBwrap {
+export function resolveHeadlessBwrap(config: BwrapConfig): ResolvedBwrap {
   return resolveBwrap({
     ...config,
     mode: "readonly",
@@ -524,22 +517,10 @@ export type EscalationDecision = { kind: "dialog" } | { kind: "deny"; reason: st
 
 /**
  * Escalation (`request_full_access`) policy:
- * - Subagent sessions are always denied: bash is read-only there and there is
- *   no approval path (headless), so escalation would silently bypass the sandbox.
- * - Any other headless session is denied: there is no user to approve.
- * - Interactive sessions require the user approval dialog.
+ * - Headless sessions are denied because there is no user to approve.
+ * - Sessions with UI require the user approval dialog.
  */
-export function resolveEscalation(opts: {
-  hasUI: boolean;
-  isSubagentChild: boolean;
-}): EscalationDecision {
-  if (opts.isSubagentChild) {
-    return {
-      kind: "deny",
-      reason:
-        "request_full_access is disabled in subagent sessions: the bash tool is read-only and cannot escalate. Ask the parent session to run this command.",
-    };
-  }
+export function resolveEscalation(opts: { hasUI: boolean }): EscalationDecision {
   if (!opts.hasUI) {
     return {
       kind: "deny",
@@ -583,10 +564,10 @@ export default function bwrapExtension(pi: ExtensionAPI) {
 
   let resolved: ResolvedBwrap | null = null;
 
-  function getResolved(): ResolvedBwrap {
-    // Subagents ignore config and runtime switches: bash is always read-only.
-    if (isSubagentChild) {
-      return resolveSubagentBwrap(loadConfig(localCwd));
+  function getResolved(hasUI: boolean): ResolvedBwrap {
+    // Without an approval path, ignore config and force bash read-only.
+    if (!hasUI) {
+      return resolveHeadlessBwrap(loadConfig(localCwd));
     }
     if (!resolved) {
       resolved = resolveBwrap(loadConfig(localCwd));
@@ -595,7 +576,6 @@ export default function bwrapExtension(pi: ExtensionAPI) {
   }
 
   function setMode(mode: BwrapMode) {
-    if (isSubagentChild) return; // mode switching is not allowed in subagents
     const config = loadConfig(localCwd);
     config.mode = mode;
     resolved = resolveBwrap(config);
@@ -613,7 +593,8 @@ export default function bwrapExtension(pi: ExtensionAPI) {
     },
     executionMode: localBash.executionMode,
     async execute(id, params, signal, onUpdate, ctx) {
-      const r = getResolved();
+      const hasUI = ctx?.hasUI ?? false;
+      const r = getResolved(hasUI);
 
       if (!r.bwrapEnabled) {
         return localBash.execute(id, params, signal, onUpdate);
@@ -622,7 +603,7 @@ export default function bwrapExtension(pi: ExtensionAPI) {
       const escalate = params.request_full_access === true;
 
       if (escalate) {
-        const policy = resolveEscalation({ hasUI: ctx?.hasUI ?? false, isSubagentChild });
+        const policy = resolveEscalation({ hasUI });
         if (policy.kind === "deny") {
           throw new Error(policy.reason);
         }
@@ -672,9 +653,9 @@ export default function bwrapExtension(pi: ExtensionAPI) {
   pi.on("session_start", (_event, ctx) => {
     const noBwrap = pi.getFlag("no-bwrap") === true;
 
-    // Subagent sessions are always sandboxed read-only; --no-bwrap must not
-    // disable that (the flag is only honored in the parent session).
-    if (noBwrap && !isSubagentChild) {
+    // Headless sessions are always sandboxed read-only because they cannot
+    // approve disabling the sandbox.
+    if (noBwrap && ctx.hasUI) {
       resolved = null;
       ctx.ui.notify("bwrap sandbox disabled via --no-bwrap", "warning");
       return;
@@ -691,7 +672,7 @@ export default function bwrapExtension(pi: ExtensionAPI) {
     }
 
     const config = loadConfig(ctx.cwd);
-    resolved = isSubagentChild ? resolveSubagentBwrap(config) : resolveBwrap(config);
+    resolved = ctx.hasUI ? resolveBwrap(config) : resolveHeadlessBwrap(config);
 
     if (resolved.bwrapEnabled) {
       try {
@@ -719,20 +700,20 @@ export default function bwrapExtension(pi: ExtensionAPI) {
     resolved = null;
   });
 
-  pi.on("before_agent_start", (event) => {
-    const r = getResolved();
+  pi.on("before_agent_start", (event, ctx) => {
+    const r = getResolved(ctx.hasUI);
 
     return {
-      systemPrompt: isSubagentChild
-        ? event.systemPrompt + "\n\n" + SUBAGENT_SANDBOX_PROMPT
-        : event.systemPrompt + "\n\n" + SANDBOX_PROMPT + `\n\nCurrent mode: **${r.mode}**\n`,
+      systemPrompt: ctx.hasUI
+        ? event.systemPrompt + "\n\n" + SANDBOX_PROMPT + `\n\nCurrent mode: **${r.mode}**\n`
+        : event.systemPrompt + "\n\n" + HEADLESS_SANDBOX_PROMPT,
     };
   });
 
   pi.registerCommand("bwrap", {
     description: "Show bwrap sandbox configuration",
     handler: (_args, ctx) => {
-      const r = getResolved();
+      const r = getResolved(ctx.hasUI);
       if (!r.bwrapEnabled) {
         ctx.ui.notify(`bwrap disabled (mode: ${r.mode})`, "info");
         return Promise.resolve();
@@ -758,8 +739,13 @@ export default function bwrapExtension(pi: ExtensionAPI) {
         theme: Theme;
         setStatus: (k: string, t: string | undefined) => void;
       };
+      hasUI: boolean;
     },
   ) {
+    if (!ctx.hasUI) {
+      ctx.ui.notify("bwrap mode cannot be changed without an interactive UI", "warning");
+      return;
+    }
     setMode(mode);
 
     ctx.ui.setStatus("bwrap", ctx.ui.theme.fg("accent", `bwrap: ${mode}`));

package/src/spawn-agent.ts

@@ -29,7 +29,10 @@ import type { AgentMessage, AgentToolResult } from "@earendil-works/pi-agent-cor
 import {
   type AgentSessionEvent,
   type ExtensionAPI,
+  type ExtensionUIContext,
   getMarkdownTheme,
+  type RpcExtensionUIRequest,
+  type RpcExtensionUIResponse,
   truncateTail,
   withFileMutationQueue,
 } from "@earendil-works/pi-coding-agent";
@@ -176,18 +179,18 @@ async function writePromptToTempFile(agentName: string, prompt: string): Promise
 
 export function buildSubagentArgs(
   agent: AgentConfig,
-  task: string,
+  _task: string,
   systemPromptPath: string | undefined,
 ): string[] {
-  // --mode json: emit events as JSON lines; -p: single-shot answer;
-  // --no-session: ephemeral, do not persist. --no-extensions disables
+  // RPC mode emits agent and extension UI events as JSON lines and accepts
+  // dialog responses over stdin. --no-session keeps the child ephemeral.
+  // --no-extensions disables
   // extension discovery; only the extensions explicitly loaded below (the
   // unconditional guards plus per-tool overrides) run inside the subagent.
-  const args: string[] = ["--mode", "json", "-p", "--no-session", "--no-extensions"];
+  const args: string[] = ["--mode", "rpc", "--no-session", "--no-extensions"];
 
   // Protection layers that must be present in every subagent regardless of
-  // its declared toolset: the workspace write guard and the bwrap sandbox
-  // (forced read-only for subagents via PI_SUBAGENT_CHILD=1).
+  // its declared toolset: the workspace write guard and the bwrap sandbox.
   for (const ext of UNCONDITIONAL_EXTENSIONS) {
     args.push("-e", extensionPath(ext));
   }
@@ -210,7 +213,6 @@ export function buildSubagentArgs(
   }
   args.push("--tools", tools.join(","));
   if (systemPromptPath) args.push("--append-system-prompt", systemPromptPath);
-  args.push(`Task: ${task}`);
   return args;
 }
 
@@ -218,12 +220,86 @@ export function buildSubagentArgs(
 
 type OnUpdateCallback = (partial: AgentToolResult<SubagentDetails>) => void;
 
+function dialogOptions(signal: AbortSignal | undefined, timeout: number | undefined) {
+  return {
+    ...(signal && { signal }),
+    ...(timeout !== undefined && { timeout }),
+  };
+}
+
+/** Forward one RPC extension UI request to the parent session. */
+export async function forwardSubagentUIRequest(
+  request: RpcExtensionUIRequest,
+  ui: ExtensionUIContext,
+  signal?: AbortSignal,
+): Promise<RpcExtensionUIResponse | undefined> {
+  switch (request.method) {
+    case "select": {
+      const value = await ui.select(
+        request.title,
+        request.options,
+        dialogOptions(signal, request.timeout),
+      );
+      return value === undefined
+        ? { type: "extension_ui_response", id: request.id, cancelled: true }
+        : { type: "extension_ui_response", id: request.id, value };
+    }
+    case "confirm": {
+      const confirmed = await ui.confirm(
+        request.title,
+        request.message,
+        dialogOptions(signal, request.timeout),
+      );
+      return { type: "extension_ui_response", id: request.id, confirmed };
+    }
+    case "input": {
+      const value = await ui.input(
+        request.title,
+        request.placeholder,
+        dialogOptions(signal, request.timeout),
+      );
+      return value === undefined
+        ? { type: "extension_ui_response", id: request.id, cancelled: true }
+        : { type: "extension_ui_response", id: request.id, value };
+    }
+    case "editor": {
+      const value = await ui.editor(request.title, request.prefill);
+      return value === undefined
+        ? { type: "extension_ui_response", id: request.id, cancelled: true }
+        : { type: "extension_ui_response", id: request.id, value };
+    }
+    case "notify": {
+      ui.notify(request.message, request.notifyType);
+      return undefined;
+    }
+    case "setStatus": {
+      ui.setStatus(request.statusKey, request.statusText);
+      return undefined;
+    }
+    case "setWidget": {
+      ui.setWidget(request.widgetKey, request.widgetLines, {
+        placement: request.widgetPlacement,
+      });
+      return undefined;
+    }
+    case "setTitle": {
+      ui.setTitle(request.title);
+      return undefined;
+    }
+    case "set_editor_text": {
+      ui.setEditorText(request.text);
+      return undefined;
+    }
+  }
+}
+
 export async function runAgent(
   agent: AgentConfig,
   task: string,
   cwd: string,
   signal: AbortSignal | undefined,
   onUpdate: OnUpdateCallback | undefined,
+  parentUI?: ExtensionUIContext,
 ): Promise<SubagentDetails> {
   const result: SubagentDetails = {
     agent: agent.name,
@@ -253,10 +329,8 @@ export async function runAgent(
     const proc = spawn(invocation.command, invocation.args, {
       cwd,
       shell: false,
-      stdio: ["ignore", "pipe", "pipe"],
-      // Mark the child as a subagent so extensions running inside it (e.g.
-      // bwrap's subagent policy) can recognize and treat it accordingly.
-      env: { ...process.env, PI_SUBAGENT_CHILD: "1" },
+      stdio: ["pipe", "pipe", "pipe"],
+      env: { ...process.env },
     });
 
     let logLines: string[] = [];
@@ -281,10 +355,57 @@ export async function runAgent(
 
     let buffer = "";
 
+    const sendRpc = (message: object) => {
+      proc.stdin.write(`${JSON.stringify(message)}\n`);
+    };
+
+    let requestedShutdown = false;
+    const requestShutdown = () => {
+      if (requestedShutdown) return;
+      requestedShutdown = true;
+      proc.stdin.end();
+    };
+
     const processLine = (line: string) => {
       if (!line.trim()) return;
-      const event = parseJsonEvent(line);
-      if (!event) return;
+      const record = parseJsonRecord(line);
+      if (!record) return;
+
+      if (record.type === "extension_ui_request") {
+        const request = record as RpcExtensionUIRequest;
+        if (!parentUI) {
+          if (
+            request.method === "select" ||
+            request.method === "confirm" ||
+            request.method === "input" ||
+            request.method === "editor"
+          ) {
+            sendRpc({ type: "extension_ui_response", id: request.id, cancelled: true });
+          }
+          return;
+        }
+        void forwardSubagentUIRequest(request, parentUI, signal)
+          .then((response) => {
+            if (response) sendRpc(response);
+            return;
+          })
+          .catch(() => {
+            sendRpc({ type: "extension_ui_response", id: request.id, cancelled: true });
+          });
+        return;
+      }
+
+      if (record.type === "response") {
+        if (record.command === "prompt" && record.success === false) {
+          result.errorMessage =
+            typeof record.error === "string" ? record.error : "Subagent prompt was rejected";
+          result.stopReason = "error";
+          requestShutdown();
+        }
+        return;
+      }
+
+      const event = record as AgentSessionEvent;
 
       switch (event.type) {
         case "message_update": {
@@ -323,6 +444,10 @@ export async function runAgent(
 
           break;
         }
+        case "agent_settled": {
+          requestShutdown();
+          break;
+        }
         // No default
       }
     };
@@ -338,6 +463,12 @@ export async function runAgent(
       result.stderr += data.toString();
     });
 
+    proc.stdin.on("error", (error) => {
+      if (!requestedShutdown) result.stderr += error.message;
+    });
+
+    sendRpc({ type: "prompt", message: `Task: ${task}` });
+
     const exitCode = await new Promise<number>((resolve) => {
       proc.on("close", (code) => {
         if (buffer.trim()) processLine(buffer);
@@ -372,12 +503,10 @@ export async function runAgent(
 }
 
 /**
- * Parse one line of the subagent's `--mode json` event stream into a typed
- * event. Non-JSON lines and non-event records (e.g. the session header) are
- * rejected. The cast here is the single trust boundary: downstream branches
- * are fully type-narrowed via the `AgentSessionEvent` discriminated union.
+ * Parse one line of the subagent's RPC stream into a JSON object. Non-JSON
+ * lines and records without a type discriminator are rejected.
  */
-function parseJsonEvent(line: string): AgentSessionEvent | null {
+function parseJsonRecord(line: string): Record<string, unknown> | null {
   let raw: unknown;
   try {
     raw = JSON.parse(line);
@@ -386,7 +515,7 @@ function parseJsonEvent(line: string): AgentSessionEvent | null {
   }
   if (typeof raw !== "object" || raw === null) return null;
   if (typeof (raw as Record<string, unknown>).type !== "string") return null;
-  return raw as AgentSessionEvent;
+  return raw as Record<string, unknown>;
 }
 
 /** Session entry customType used to mark the injected subagent list. */
@@ -395,7 +524,7 @@ export function formatAgentListSection(agents: AgentConfig[]): string {
   return [
     "## Available subagents",
     "",
-    "You can delegate tasks to the following subagent types by calling the `spawn_agent` tool with their name in the `agent` parameter:",
+    "You can delegate tasks to the following subagent types by calling the `spawn-agent` tool with their name in the `agent` parameter:",
     "",
     ...lines,
   ].join("\n");
@@ -460,7 +589,14 @@ export default function spawnAgent(pi: ExtensionAPI) {
         };
       }
 
-      const result = await runAgent(agent, params.task, ctx.cwd, signal, onUpdate);
+      const result = await runAgent(
+        agent,
+        params.task,
+        ctx.cwd,
+        signal,
+        onUpdate,
+        ctx.hasUI ? ctx.ui : undefined,
+      );
 
       const isError =
         result.exitCode !== 0 || result.stopReason === "error" || result.stopReason === "aborted";

package/src/workspace-guard.ts

@@ -27,13 +27,6 @@ import { normalizeForEdit, replace } from "./opencode-edit-engine.js";
 const WRITE_TOOLS = new Set(["write", "edit"]);
 const ALWAYS_ALLOW = ["/tmp"];
 
-/**
- * pi-subagents sets PI_SUBAGENT_CHILD=1 in every spawned child session.
- * Subagents are headless, so there is no approval path: writes outside the
- * workspace are rejected outright instead of asking for approval.
- */
-const isSubagentChild = process.env.PI_SUBAGENT_CHILD === "1";
-
 /** Maximum lines of the diff preview shown in the approval dialog. */
 const MAX_PREVIEW_LINES = 100;
 
@@ -187,19 +180,11 @@ export interface WriteGuardDecision {
 
 /**
  * Decide how to handle a write outside the workspace.
- * Subagent sessions (and any other headless session) have no approval path,
- * so the write is rejected outright.
  */
 export function decideOutsideWorkspaceWrite(
   rawPath: string,
-  opts: { hasUI: boolean; isSubagentChild: boolean },
+  opts: { hasUI: boolean },
 ): WriteGuardDecision {
-  if (opts.isSubagentChild) {
-    return {
-      block: true,
-      reason: `Path "${rawPath}" is outside the subagent workspace. Writes outside the workspace are rejected in subagent sessions; ask the parent session to apply this change.`,
-    };
-  }
   if (!opts.hasUI) {
     return {
       block: true,
@@ -213,15 +198,13 @@ export default function workspaceGuard(pi: ExtensionAPI) {
   pi.on("before_agent_start", (event, ctx) => {
     const currentCwd = ctx.cwd;
     return {
-      systemPrompt: isSubagentChild
-        ? event.systemPrompt +
-          `\nSubagent write protection is active. ` +
-          `write and edit are allowed inside "${currentCwd}" and /tmp. ` +
-          `Writes outside the workspace are rejected without approval — ask the parent session to make such changes.`
-        : event.systemPrompt +
-          `\nWorkspace write protection is active. ` +
-          `write and edit to paths inside the workspace "${currentCwd}" or /tmp are auto-allowed. ` +
-          `Paths outside require user approval before execution.`,
+      systemPrompt:
+        event.systemPrompt +
+        `\nWorkspace write protection is active. ` +
+        `write and edit to paths inside the workspace "${currentCwd}" or /tmp are auto-allowed. ` +
+        (ctx.hasUI
+          ? `Paths outside require user approval before execution.`
+          : `Writes outside the workspace are rejected because no UI is available for approval.`),
     };
   });
 
@@ -237,7 +220,6 @@ export default function workspaceGuard(pi: ExtensionAPI) {
 
     const decision = decideOutsideWorkspaceWrite(rawPath, {
       hasUI: ctx.hasUI,
-      isSubagentChild,
     });
     if (decision.block) return decision;