@trim21/personal-pi-extensions 0.0.217 → 0.0.222

package/src/bwrap/runtime.ts

@@ -0,0 +1,296 @@
+import type {
+  ExtensionAPI,
+  ExtensionCommandContext,
+  ExtensionContext,
+} from "@earendil-works/pi-coding-agent";
+import { createBashTool } from "@earendil-works/pi-coding-agent";
+import { type TObject, Type } from "typebox";
+
+import { type CommandSpec, parseCommand } from "../lib/cli.js";
+import {
+  type BwrapMode,
+  createBwrapBashOperations,
+  findBwrap,
+  loadBwrapConfig,
+  resolveBwrap,
+  resolveBwrapPath,
+  type ResolvedBwrap,
+  resolveHeadlessBwrap,
+} from "./core.js";
+
+export type EscalationDecision = { kind: "dialog" } | { kind: "deny"; reason: string };
+
+export function resolveEscalation(opts: { hasUI: boolean }): EscalationDecision {
+  if (!opts.hasUI) {
+    return {
+      kind: "deny",
+      reason:
+        "request_full_access requires an interactive session with user approval; no UI is available in this session.",
+    };
+  }
+  return { kind: "dialog" };
+}
+
+export interface BwrapExecutionRequest {
+  toolCallId: string;
+  command: string;
+  timeout?: number;
+  requestFullAccess?: boolean;
+  requestFullAccessReason?: string;
+  signal?: AbortSignal;
+  onUpdate?: Parameters<ReturnType<typeof createBashTool>["execute"]>[3];
+  ctx: ExtensionContext;
+}
+
+function escapeHtml(text: string): string {
+  return text
+    .replaceAll("&", "&amp;")
+    .replaceAll("<", "&lt;")
+    .replaceAll(">", "&gt;")
+    .replaceAll('"', "&quot;");
+}
+
+function fenceCodeBlock(code: string): string {
+  const longestRun = Math.max(...(code.match(/`+/g)?.map((match) => match.length) ?? [0]));
+  const fence = "`".repeat(Math.max(3, longestRun + 1));
+  return `${fence}\n${code}\n${fence}`;
+}
+
+function notifyMode(
+  ctx: { ui: { notify: (message: string, type?: "info" | "warning" | "error") => void } },
+  mode: BwrapMode,
+): void {
+  const labels: Record<BwrapMode, string> = {
+    "allow-all": "allow-all: sandbox off, network on",
+    "workspace-write": "workspace-write: sandbox on, network off",
+    "allow-net": "allow-net: sandbox on, network on, workspace writable",
+    readonly: "readonly: sandbox on, network off, read-only fs",
+  };
+  ctx.ui.notify(labels[mode], "info");
+}
+
+export class BwrapRuntime {
+  private resolved: ResolvedBwrap | undefined;
+  private sandboxDisabled = false;
+
+  setup(pi: ExtensionAPI): void {
+    pi.registerFlag("no-bwrap", {
+      description: "Disable bwrap sandboxing for bash commands",
+      type: "boolean",
+      default: false,
+    });
+
+    pi.on("session_start", (_event, ctx) => {
+      this.sandboxDisabled = pi.getFlag("no-bwrap") === true && ctx.hasUI;
+      this.resolved = undefined;
+      const runtime = this.resolve(ctx);
+      if (runtime.bwrapEnabled) {
+        try {
+          findBwrap(runtime.bwrapPath);
+        } catch (error) {
+          this.sandboxDisabled = true;
+          this.resolved = undefined;
+          ctx.ui.notify(error instanceof Error ? error.message : "bwrap not found", "error");
+          return;
+        }
+      }
+      ctx.ui.setStatus("bwrap", ctx.ui.theme.fg("accent", `bwrap: ${runtime.mode}`));
+      ctx.ui.notify(
+        runtime.bwrapEnabled
+          ? `bwrap initialized (${runtime.mode})`
+          : `bwrap mode: ${runtime.mode}`,
+        "info",
+      );
+    });
+
+    pi.on("session_shutdown", () => {
+      this.reset();
+    });
+
+    pi.on("before_agent_start", (event, ctx) => {
+      const runtime = this.resolve(ctx);
+      const prompt = ctx.hasUI
+        ? `\n\n## Command Execution\nCurrent bwrap mode: **${runtime.mode}**. The bwrap runtime selects sandboxing and, when requested, user approval for unsandboxed execution.\n`
+        : "\n\n## Command Execution\nThis headless session is forced into bwrap readonly mode. Unsandboxed execution cannot be approved.\n";
+      return { systemPrompt: event.systemPrompt + prompt };
+    });
+
+    this.registerCommands(pi);
+  }
+
+  setMode(cwd: string, mode: BwrapMode): ResolvedBwrap {
+    this.resolved = resolveBwrap({ ...loadBwrapConfig(cwd), mode });
+    this.sandboxDisabled = false;
+    return this.resolved;
+  }
+
+  reset(): void {
+    this.resolved = undefined;
+    this.sandboxDisabled = false;
+  }
+
+  async execute(request: BwrapExecutionRequest) {
+    const runtime = this.resolve(request.ctx);
+    if (request.requestFullAccess === true && runtime.bwrapEnabled) {
+      await this.approveFullAccess(request.ctx, request.command, request.requestFullAccessReason);
+    }
+    const bash =
+      runtime.bwrapEnabled && request.requestFullAccess !== true
+        ? createBashTool(request.ctx.cwd, { operations: createBwrapBashOperations(runtime) })
+        : createBashTool(request.ctx.cwd);
+    return bash.execute(
+      request.toolCallId,
+      { command: request.command, timeout: request.timeout },
+      request.signal,
+      request.onUpdate,
+    );
+  }
+
+  private resolve(ctx: Pick<ExtensionContext, "cwd" | "hasUI">): ResolvedBwrap {
+    const config = loadBwrapConfig(ctx.cwd);
+    if (!ctx.hasUI) return resolveHeadlessBwrap(config);
+    if (this.sandboxDisabled) return resolveBwrap({ ...config, mode: "allow-all" });
+    if (!this.resolved) this.resolved = resolveBwrap(config);
+    return this.resolved;
+  }
+
+  private async approveFullAccess(
+    ctx: ExtensionContext,
+    command: string,
+    reason: string | undefined,
+  ): Promise<void> {
+    const policy = resolveEscalation({ hasUI: ctx.hasUI });
+    if (policy.kind === "deny") throw new Error(policy.reason);
+    const description = `Allow this command to run without sandbox?\n---\n\nReason: ${escapeHtml(reason ?? "(No reason provided by model)")}\n---\n${fenceCodeBlock(command)}`;
+    while (true) {
+      const choice = await ctx.ui.select(
+        description,
+        ["Approve once", "Block", "Block with reason"],
+        {
+          signal: ctx.signal,
+        },
+      );
+      if (choice === undefined) {
+        ctx.abort();
+        throw new Error("User denied the command execution.");
+      }
+      if (choice === "Approve once") return;
+      if (choice === "Block") throw new Error("User denied unsandboxed execution.");
+      const feedback = await ctx.ui.input("Why was this denied?", undefined, {
+        signal: ctx.signal,
+      });
+      if (feedback === undefined) continue;
+      throw new Error(
+        feedback
+          ? `User denied unsandboxed execution: ${feedback}`
+          : "User denied unsandboxed execution.",
+      );
+    }
+  }
+
+  private registerCommands(pi: ExtensionAPI): void {
+    const specs = {
+      bwrap: {
+        name: "bwrap",
+        usage: "",
+        description: "Show bwrap sandbox configuration",
+        flags: Type.Object({}),
+      },
+      "bwrap-allow-all": {
+        name: "bwrap-allow-all",
+        usage: "",
+        description: "Disable bwrap sandbox, full access",
+        flags: Type.Object({}),
+      },
+      "bwrap-workspace-write": {
+        name: "bwrap-workspace-write",
+        usage: "",
+        description: "Sandbox on, network off, workspace writable",
+        flags: Type.Object({}),
+      },
+      "bwrap-allow-net": {
+        name: "bwrap-allow-net",
+        usage: "",
+        description: "Sandbox on, network on, workspace writable",
+        flags: Type.Object({}),
+      },
+      "bwrap-readonly": {
+        name: "bwrap-readonly",
+        usage: "",
+        description: "Sandbox on, network off, no writes",
+        flags: Type.Object({}),
+      },
+    } as const satisfies Record<string, CommandSpec<TObject>>;
+
+    pi.registerCommand("bwrap", {
+      description: specs.bwrap.description,
+      handler: (args, ctx) =>
+        this.runCommand(pi, specs.bwrap, args, ctx, (commandCtx) => {
+          const runtime = this.resolve(commandCtx);
+          if (!runtime.bwrapEnabled) {
+            commandCtx.ui.notify(`bwrap disabled (mode: ${runtime.mode})`, "info");
+            return;
+          }
+          const writable = runtime.writablePaths.map((path) =>
+            resolveBwrapPath(path, commandCtx.cwd),
+          );
+          const tmpfs = runtime.tmpfsPaths.map((path) => resolveBwrapPath(path, commandCtx.cwd));
+          commandCtx.ui.notify(
+            `bwrap ${runtime.mode} ${runtime.network ? "net" : "no-net"} write:[${writable.join(", ")}] tmpfs:[${tmpfs.join(", ") || "-"}]`,
+            "info",
+          );
+        }),
+    });
+
+    for (const [name, mode] of [
+      ["bwrap-allow-all", "allow-all"],
+      ["bwrap-workspace-write", "workspace-write"],
+      ["bwrap-allow-net", "allow-net"],
+      ["bwrap-readonly", "readonly"],
+    ] as const) {
+      pi.registerCommand(name, {
+        description: specs[name].description,
+        handler: (args, ctx) =>
+          this.runCommand(pi, specs[name], args, ctx, (commandCtx) =>
+            this.switchMode(pi, mode, commandCtx),
+          ),
+      });
+    }
+  }
+
+  private switchMode(pi: ExtensionAPI, mode: BwrapMode, ctx: ExtensionCommandContext): void {
+    if (!ctx.hasUI) {
+      ctx.ui.notify("bwrap mode cannot be changed without an interactive UI", "warning");
+      return;
+    }
+    this.setMode(ctx.cwd, mode);
+    ctx.ui.setStatus("bwrap", ctx.ui.theme.fg("accent", `bwrap: ${mode}`));
+    notifyMode(ctx, mode);
+    pi.sendMessage({
+      customType: "info",
+      content: `Bwrap sandbox mode changed to "${mode}".`,
+      display: true,
+    });
+  }
+
+  private runCommand(
+    pi: ExtensionAPI,
+    spec: CommandSpec<TObject>,
+    args: string,
+    ctx: ExtensionCommandContext,
+    run: (ctx: ExtensionCommandContext) => void | Promise<void>,
+  ): Promise<void> {
+    const parsed = parseCommand(spec, args);
+    if (parsed.kind !== "ok") {
+      pi.sendMessage({ customType: "info", content: parsed.text, display: true });
+      return Promise.resolve();
+    }
+    return Promise.resolve(run(ctx));
+  }
+}
+
+export function createBwrapRuntime(): BwrapRuntime {
+  return new BwrapRuntime();
+}
+
+export const bwrapRuntime = createBwrapRuntime();

package/src/claude-code/shell.ts

@@ -1,7 +1,8 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
-import { createBashTool } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
 
+import { bwrapRuntime } from "../bwrap/runtime.js";
+
 const DEFAULT_TIMEOUT_MS = 120_000;
 const MAX_TIMEOUT_MS = 600_000;
 
@@ -47,6 +48,12 @@ export function registerShellTools(pi: ExtensionAPI): void {
         description: Type.Optional(
           Type.String({ description: "Clear, concise description of the command" }),
         ),
+        dangerouslyDisableSandbox: Type.Optional(
+          Type.Boolean({
+            description:
+              "Request one-time unsandboxed execution. The user must approve this request.",
+          }),
+        ),
       },
       { additionalProperties: false },
     ),
@@ -57,13 +64,16 @@ export function registerShellTools(pi: ExtensionAPI): void {
       }
 
       const marker = `__PI_CC_CWD_${id.replaceAll("-", "_")}_${Date.now()}__`;
-      const bash = createBashTool(persistentCwd ?? ctx.cwd);
       try {
-        const result = await bash.execute(
-          id,
-          { command: wrapCommand(params.command, marker), timeout: timeout / 1000 },
+        const result = await bwrapRuntime.execute({
+          ctx: { ...ctx, cwd: persistentCwd ?? ctx.cwd },
+          toolCallId: id,
+          command: wrapCommand(params.command, marker),
+          timeout: timeout / 1000,
+          requestFullAccess: params.dangerouslyDisableSandbox,
+          requestFullAccessReason: params.description,
           signal,
-          onUpdate
+          onUpdate: onUpdate
             ? (update) => {
                 const content = update.content.map((item) => {
                   if (item.type !== "text") return item;
@@ -72,7 +82,7 @@ export function registerShellTools(pi: ExtensionAPI): void {
                 onUpdate({ ...update, content });
               }
             : undefined,
-        );
+        });
         const content = result.content.map((item) => {
           if (item.type !== "text") return item;
           const cleaned = stripCwdMarker(item.text, marker);

package/src/opencode/index.ts

@@ -1,7 +1,7 @@
 /**
  * opencode —— 统一注册 opencode 风格工具扩展。
  *
- * 聚合 read / edit / write / todo 四个工具，一次加载全部注册；
+ * 聚合 read / edit / write / todo / question 五个工具，一次加载全部注册；
  * 各工具的公开 API（匹配引擎、纯函数等）也从这里重新导出，方便
  * 测试与其他模块（如 workspace-guard）引用。
  *
@@ -15,6 +15,7 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 
 import opencodeEdit from "./edit.js";
+import opencodeQuestion from "./question.js";
 import opencodeRead from "./read.js";
 import opencodeTodo from "./todo.js";
 import opencodeWrite from "./write.js";
@@ -28,6 +29,7 @@ export {
   restoreLineEndings,
   stripBom,
 } from "./edit-engine.js";
+export { default as opencodeQuestion } from "./question.js";
 export { default as opencodeRead, truncateHead, type TruncationResult } from "./read.js";
 export { default as opencodeTodo } from "./todo.js";
 export { default as opencodeWrite, resolveBom } from "./write.js";
@@ -37,4 +39,5 @@ export default function opencode(pi: ExtensionAPI) {
   opencodeEdit(pi);
   opencodeWrite(pi);
   opencodeTodo(pi);
+  opencodeQuestion(pi);
 }