@trim21/personal-pi-extensions 0.0.224 → 0.0.229

package/README.md

@@ -6,17 +6,17 @@
 
 ## 扩展概览
 
-| 扩展                                          | 描述                                                   |
-| --------------------------------------------- | ------------------------------------------------------ |
-| [bwrap](#bwrap)                               | 基于 bubblewrap 的 OS 级沙箱，提供文件系统和网络隔离   |
-| [workspace-guard](#workspace-guard)           | 限制文件写入在 workspace 内，外部写入需用户审批        |
-| [opencode-edit](#opencode-edit)               | 替换内置 edit 工具，使用 opencode 的 schema 和匹配引擎 |
-| [bash-default-timeout](#bash-default-timeout) | 为 bash 工具设置默认超时（180 秒）                     |
-| [vision-agent](#vision-agent)                 | 视觉代理：主模型不支持视觉时，spawn 子 agent 识别图片  |
-| [session-name](#session-name)                 | 首个 user prompt 自动生成会话名，模型命名 + 启发式兜底 |
-| [todowrite](#todowrite)                       | opencode 风格的任务列表工具，完整列表替换语义          |
-| [question](#question)                         | opencode 风格的提问工具，阻塞式询问用户选择            |
-| [talk](#talk)                                 | session 间消息传递，SQLite 邮箱 + 双向 ask 时间戳仲裁  |
+| 扩展                                          | 描述                                                    |
+| --------------------------------------------- | ------------------------------------------------------- |
+| [bwrap](#bwrap)                               | 基于 bubblewrap 的 OS 级沙箱，提供文件系统和网络隔离    |
+| [写保护（内置）](#写保护内置)                 | 写工具内置：限制文件写入在 workspace 内，外部写入需审批 |
+| [opencode-edit](#opencode-edit)               | 替换内置 edit 工具，使用 opencode 的 schema 和匹配引擎  |
+| [bash-default-timeout](#bash-default-timeout) | 为 bash 工具设置默认超时（180 秒）                      |
+| [vision-agent](#vision-agent)                 | 视觉代理：主模型不支持视觉时，spawn 子 agent 识别图片   |
+| [session-name](#session-name)                 | 首个 user prompt 自动生成会话名，模型命名 + 启发式兜底  |
+| [todowrite](#todowrite)                       | opencode 风格的任务列表工具，完整列表替换语义           |
+| [question](#question)                         | opencode 风格的提问工具，阻塞式询问用户选择             |
+| [talk](#talk)                                 | session 间消息传递，SQLite 邮箱 + 双向 ask 时间戳仲裁   |
 
 ---
 
@@ -38,7 +38,7 @@
 
 ### 提权机制
 
-bash 工具注册了 `request_full_access` 和 `request_full_access_reason` 参数。模型需要全权限时须说明原因（如需要网络、写入 workspace 外部路径）。
+bash 工具（opencode 风格 `bash`、Claude Code 风格 `Bash`）注册了 `dangerouslyDisableSandbox` 参数。模型需要全权限时置为 true 并说明原因（如需要网络、写入 workspace 外部路径）。
 
 建议模型不确定时先尝试沙箱模式，若因沙箱限制失败，再以完整权限重试。
 
@@ -86,25 +86,20 @@ pi -e ./src/bwrap/index.ts
 
 ---
 
-## workspace-guard
+## 写保护（内置）
 
-阻止 `write` 和 `edit` 工具写入 workspace 外部的路径。读取工具（`read`、`ls`、`find`、`grep`）不受限制。
+写保护直接内置在各写工具（opencode 风格 `write`/`edit`、Claude Code 风格 `Write`/`Edit`）内部，通过 `src/lib/write-guard.ts` 的 `guardWriteAccess` 实现。读取工具（`read`、`ls`、`find`、`grep`）不受限制。
 
 - workspace 内或 `/tmp` 下的路径自动放行
-- 外部路径需通过确认对话框由用户审批,对话框内以 ```diff 代码块展示将要发生的变更预览(与 opencode-edit 共享匹配引擎,能定位时显示带行号的真实 patch,否则退化为参数 diff)
-- 无需配置
-
-### 使用
-
-```bash
-pi -e ./src/workspace-guard.ts
-```
+- 外部路径需通过确认对话框由用户审批，对话框内以 ```diff 代码块展示将要发生的变更预览（与 opencode-edit 共享匹配引擎，能定位时显示带行号的真实 patch，否则退化为参数 diff）
+- headless（无 UI）会话直接拒绝外部写入
+- 无需配置，随各写工具自动生效
 
 ---
 
 ## opencode-edit
 
-替换内置 `edit` 工具，使用 [opencode](https://github.com/anomalyco/opencode) 的 schema 和模糊匹配引擎。核心 replacer 和 `replace()` 函数直接复制自 opencode，行为与原版完全一致。匹配引擎位于 `src/opencode-edit-engine.ts`，与 workspace-guard 的审批弹窗 diff 预览共享。
+替换内置 `edit` 工具，使用 [opencode](https://github.com/anomalyco/opencode) 的 schema 和模糊匹配引擎。核心 replacer 和 `replace()` 函数直接复制自 opencode，行为与原版完全一致。匹配引擎位于 `src/opencode/edit-engine.ts`，与写保护审批弹窗（`src/lib/write-guard.ts`）的 diff 预览共享。
 
 支持的匹配策略：
 
@@ -363,7 +358,6 @@ pi -e ./src/talk/index.ts
 
 ```bash
 pi -e ./src/bwrap/index.ts
-pi -e ./src/workspace-guard.ts
 ```
 
 ---

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trim21/personal-pi-extensions",
-  "version": "0.0.224",
+  "version": "0.0.229",
   "type": "module",
   "description": "Custom pi coding-agent extensions: bwrap sandbox, workspace guard, opencode edit, and more",
   "keywords": [
@@ -54,13 +54,10 @@
   },
   "pi": {
     "extensions": [
+      "src/opencode/index.ts",
+      "src/claude-code/index.ts",
       "src/vision-agent.ts",
       "src/session-name.ts",
-      "src/bwrap/index.ts",
-      "src/workspace-guard.ts",
-      "src/claude-code/index.ts",
-      "src/opencode/index.ts",
-      "src/bash-default-timeout.ts",
       "src/gh-readonly.ts",
       "src/spawn-agent.ts",
       "src/talk/index.ts"

package/src/claude-code/files.ts

@@ -12,6 +12,7 @@ import {
 } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
 
+import { guardWriteAccess } from "../lib/write-guard.js";
 import {
   type ClaudeCodeState,
   type FileSnapshot,
@@ -241,9 +242,18 @@ export function registerFileTools(pi: ExtensionAPI, state: ClaudeCodeState): voi
       },
       { additionalProperties: false },
     ),
-    async execute(_id, params, signal) {
+    async execute(_id, params, signal, _onUpdate, ctx) {
       throwIfAborted(signal);
       const filePath = requireAbsolutePath(params.file_path);
+      await guardWriteAccess(ctx, {
+        toolName: "Edit",
+        absolutePath: filePath,
+        change: {
+          oldText: params.old_string,
+          newText: params.new_string,
+          replaceAll: params.replace_all,
+        },
+      });
       return withFileMutationQueue(filePath, async () => {
         await requireCurrentRead(state, filePath);
         await access(filePath, constants.R_OK | constants.W_OK);
@@ -287,9 +297,14 @@ export function registerFileTools(pi: ExtensionAPI, state: ClaudeCodeState): voi
       },
       { additionalProperties: false },
     ),
-    async execute(_id, params, signal) {
+    async execute(_id, params, signal, _onUpdate, ctx) {
       throwIfAborted(signal);
       const filePath = requireAbsolutePath(params.file_path);
+      await guardWriteAccess(ctx, {
+        toolName: "Write",
+        absolutePath: filePath,
+        change: { oldText: "", newText: params.content },
+      });
       return withFileMutationQueue(filePath, async () => {
         let original: string | undefined;
         try {

package/src/claude-code/shell.ts

@@ -1,29 +1,14 @@
-import { stat } from "node:fs/promises";
-import { isAbsolute, resolve } from "node:path";
-
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
 
 import { bwrapRuntime } from "../bwrap/runtime.js";
+import { resolveWorkdir } from "../lib/path.js";
 
 const DEFAULT_TIMEOUT_MS = 120_000;
 const MAX_TIMEOUT_MS = 600_000;
 
-async function resolveWorkdir(workdir: string, cwd: string): Promise<string> {
-  const target = isAbsolute(workdir) ? workdir : resolve(cwd, workdir);
-  let info;
-  try {
-    info = await stat(target);
-  } catch {
-    throw new Error(`Working directory does not exist: ${target}`);
-  }
-  if (!info.isDirectory()) {
-    throw new Error(`Working directory is not a directory: ${target}`);
-  }
-  return target;
-}
-
 export function registerShellTools(pi: ExtensionAPI): void {
+  bwrapRuntime.setup(pi);
   pi.registerTool({
     name: "Bash",
     label: "Bash",

package/src/lib/path.ts

@@ -2,6 +2,7 @@
  * Shared path helpers used by multiple extensions.
  */
 
+import { stat } from "node:fs/promises";
 import { homedir } from "node:os";
 import { isAbsolute, join, resolve } from "node:path";
 
@@ -26,3 +27,22 @@ export function resolveHomePath(p: string, baseDir: string): string {
   const expanded = expandHome(p);
   return isAbsolute(expanded) ? resolve(expanded) : resolve(baseDir, expanded);
 }
+
+/**
+ * Resolve a command `workdir` argument: absolute paths are used as-is, relative
+ * paths resolve against `baseDir`. Throws if the target does not exist or is
+ * not a directory.
+ */
+export async function resolveWorkdir(workdir: string, baseDir: string): Promise<string> {
+  const target = isAbsolute(workdir) ? workdir : resolve(baseDir, workdir);
+  let info;
+  try {
+    info = await stat(target);
+  } catch {
+    throw new Error(`Working directory does not exist: ${target}`);
+  }
+  if (!info.isDirectory()) {
+    throw new Error(`Working directory is not a directory: ${target}`);
+  }
+  return target;
+}

package/src/lib/write-guard.ts

@@ -0,0 +1,153 @@
+/**
+ * Workspace write guard, embedded directly in each write/edit tool.
+ *
+ * File-modifying tools gate themselves:
+ * - Paths inside the workspace or /tmp are auto-allowed.
+ * - Paths outside require user approval via a confirmation dialog showing a
+ *   `diff` code block preview of the pending change.
+ * - Headless sessions (no UI) reject outside writes outright.
+ *
+ * Callers have already parsed their tool arguments, so the guard only takes the
+ * resolved pieces: the raw target path and the pending change (oldText/newText).
+ */
+
+import { readFile } from "node:fs/promises";
+import { basename, isAbsolute, relative, sep } from "node:path";
+
+import { generateUnifiedPatch } from "@earendil-works/pi-coding-agent";
+
+import { normalizeForEdit, replace } from "../opencode/edit-engine.js";
+
+const ALWAYS_ALLOW = ["/tmp"];
+const MAX_PREVIEW_LINES = 100;
+
+function isInside(dir: string, filePath: string): boolean {
+  const rel = relative(dir, filePath);
+  return rel === "" || (rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel));
+}
+
+function isPathAllowed(absolutePath: string, cwd: string): boolean {
+  if (isInside(cwd, absolutePath)) return true;
+
+  for (const allowed of ALWAYS_ALLOW) {
+    if (isInside(allowed, absolutePath)) return true;
+  }
+
+  return false;
+}
+
+/** Wrap patch text in a `diff` code block, truncating very large diffs. */
+function wrapDiff(patch: string): string {
+  const lines = patch.split("\n");
+  if (lines.length > MAX_PREVIEW_LINES) {
+    const truncated = lines.slice(0, MAX_PREVIEW_LINES).join("\n");
+    return `\`\`\`diff\n${truncated}\n… (preview truncated to ${MAX_PREVIEW_LINES} lines)\n\`\`\``;
+  }
+  return `\`\`\`diff\n${patch}\n\`\`\``;
+}
+
+/** The pending file change, described by the caller from already-parsed args. */
+export interface PendingChange {
+  /** Text to replace; empty for whole-file writes. */
+  oldText: string;
+  /** Replacement text. */
+  newText: string;
+  /** Replace all occurrences of oldText (edits only). */
+  replaceAll?: boolean;
+}
+
+/**
+ * Build a `diff` code block preview of the pending change.
+ * Returns undefined when the diff cannot be computed.
+ */
+export async function buildDiffPreview(
+  resolvedPath: string,
+  change: PendingChange,
+): Promise<string | undefined> {
+  let oldContent = "";
+  try {
+    oldContent = await readFile(resolvedPath, "utf8");
+  } catch {
+    // Unreadable or missing file: treat as empty so writes show as full additions.
+  }
+
+  if (change.oldText === "") {
+    // Whole-file write: show the full addition/replacement patch.
+    return wrapDiff(generateUnifiedPatch(basename(resolvedPath), oldContent, change.newText, 2));
+  }
+
+  // Edit: reuse the real matching engine to locate oldText, giving a
+  // line-numbered patch when it matches. Fall back to a parameter diff when the
+  // edit cannot be applied (oldText not found, ambiguous, or no file).
+  try {
+    const normalized = normalizeForEdit(oldContent);
+    const newContent = replace(normalized, change.oldText, change.newText, change.replaceAll);
+    // The full path is shown in the dialog title, so the patch header only
+    // carries the file name.
+    return wrapDiff(generateUnifiedPatch(basename(resolvedPath), normalized, newContent, 2));
+  } catch {
+    const removed = change.oldText.split("\n").map((line) => `-${line}`);
+    const added = change.newText.split("\n").map((line) => `+${line}`);
+    return wrapDiff([...removed, ...added].join("\n"));
+  }
+}
+
+export interface WriteGuardContext {
+  cwd: string;
+  hasUI: boolean;
+  abort?: () => void;
+  ui?: {
+    select: (title: string, options: string[]) => Promise<string | undefined>;
+    input: (title: string, placeholder?: string) => Promise<string | undefined>;
+  };
+}
+
+export interface WriteGuardOptions {
+  toolName: string;
+  /** The resolved absolute target path (caller has already parsed its args). */
+  absolutePath: string;
+  change: PendingChange;
+}
+
+/**
+ * Gate a write/edit call by its target path: auto-allows workspace and /tmp
+ * writes, otherwise asks for user approval (or rejects in headless sessions).
+ * Throws when the write is denied.
+ */
+export async function guardWriteAccess(
+  ctx: WriteGuardContext | undefined,
+  opts: WriteGuardOptions,
+): Promise<void> {
+  if (!ctx) return;
+  const { absolutePath } = opts;
+  if (isPathAllowed(absolutePath, ctx.cwd)) return;
+
+  if (!ctx.hasUI || !ctx.ui) {
+    throw new Error(`Path "${absolutePath}" is outside workspace. No UI available for approval.`);
+  }
+
+  while (true) {
+    const diffPreview = await buildDiffPreview(absolutePath, opts.change);
+    const title =
+      `Model requests write access outside workspace:\n\n` +
+      `  Tool:  ${opts.toolName}\n` +
+      `  Path:  ${absolutePath}\n` +
+      (diffPreview ? `\n${diffPreview}\n` : "") +
+      `\nAllow?`;
+
+    const choice = await ctx.ui.select(title, ["Approve once", "Block", "Block with reason"]);
+    if (choice === undefined) {
+      ctx.abort?.();
+      throw new Error("Write outside workspace cancelled by user.");
+    }
+    if (choice === "Approve once") return;
+    if (choice === "Block") throw new Error("Write outside workspace denied by user.");
+    const feedback = await ctx.ui.input("Why was this write denied?");
+    if (feedback === undefined) continue;
+    throw new Error(
+      feedback
+        ? `Write outside workspace denied: ${feedback}`
+        : "Write outside workspace denied by user.",
+    );
+  }
+}

package/src/opencode/bash.ts

@@ -0,0 +1,75 @@
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { Type } from "typebox";
+
+import { bwrapRuntime } from "../bwrap/runtime.js";
+import { resolveWorkdir } from "../lib/path.js";
+
+const DEFAULT_TIMEOUT_MS = 120_000;
+const MAX_TIMEOUT_MS = 600_000;
+
+export default function opencodeBash(pi: ExtensionAPI): void {
+  bwrapRuntime.setup(pi);
+  pi.registerTool({
+    name: "bash",
+    label: "bash",
+    description: [
+      "Executes a given bash command synchronously and returns its output.",
+      "The default working directory is the current directory; use workdir to run elsewhere.",
+      "timeout is in milliseconds, defaults to 120000, and may not exceed 600000.",
+      "Every command runs in the foreground. Background command execution is not supported; shell jobs are waited for before the tool returns.",
+    ].join("\n"),
+    parameters: Type.Object(
+      {
+        command: Type.String({ description: "The command to execute" }),
+        workdir: Type.Optional(
+          Type.String({
+            description:
+              "Working directory to execute the command in. Defaults to the current directory; relative paths resolve from there.",
+          }),
+        ),
+        timeout: Type.Optional(
+          Type.Number({
+            description: "Optional timeout in milliseconds (max 600000)",
+            default: 600,
+          }),
+        ),
+        dangerouslyDisableSandbox: Type.Optional(
+          Type.Boolean({
+            description:
+              "Request one-time unsandboxed execution. The user must approve this request.",
+          }),
+        ),
+      },
+      { additionalProperties: false },
+    ),
+    async execute(id, params, signal, onUpdate, ctx) {
+      const timeout = params.timeout ?? DEFAULT_TIMEOUT_MS;
+      if (!Number.isFinite(timeout) || timeout <= 0 || timeout > MAX_TIMEOUT_MS) {
+        throw new Error(`timeout must be between 1 and ${MAX_TIMEOUT_MS} milliseconds`);
+      }
+
+      const cwd = params.workdir ? await resolveWorkdir(params.workdir, ctx.cwd) : ctx.cwd;
+
+      try {
+        return await bwrapRuntime.execute({
+          ctx: { ...ctx, cwd },
+          toolCallId: id,
+          command: params.command,
+          timeout: timeout / 1000,
+          requestFullAccess: params.dangerouslyDisableSandbox,
+          signal,
+          onUpdate,
+        });
+      } catch (error) {
+        if (!(error instanceof Error)) throw error;
+        const timeoutMatch = /Command timed out after [\d.]+ seconds/.exec(error.message);
+        const message = timeoutMatch
+          ? error.message.slice(0, timeoutMatch.index) +
+            `Command timed out after ${timeout} milliseconds` +
+            error.message.slice(timeoutMatch.index + timeoutMatch[0].length)
+          : error.message;
+        throw new Error(message, { cause: error });
+      }
+    },
+  });
+}

package/src/opencode/edit-engine.ts

@@ -7,8 +7,8 @@
  * and wrapped in a pi extension so the behaviour is identical to opencode.
  *
  * Shared by:
- *   - opencode-edit.ts  — the edit tool implementation
- *   - workspace-guard.ts — the diff preview shown in the approval dialog
+ *   - opencode-edit.ts — the edit tool implementation
+ *   - lib/write-guard.ts — the diff preview shown in the approval dialog
  */
 
 // ── BOM & line ending helpers ─────────────────────────────────────────────────

package/src/opencode/edit.ts

@@ -11,7 +11,7 @@
  * formatter run.
  *
  * The matching engine (replacers + replace()) lives in opencode/edit-engine.ts
- * and is also used by workspace-guard for the diff preview.
+ * and is also used by lib/write-guard for the diff preview.
  *
  * Usage:
  *   pi -e ./opencode-edit.ts
@@ -29,6 +29,7 @@ import {
 } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
 
+import { guardWriteAccess } from "../lib/write-guard.js";
 import {
   detectLineEnding,
   normalizeToLF,
@@ -79,6 +80,12 @@ export default function opencodeEdit(pi: ExtensionAPI) {
 
       const absolutePath = isAbsolute(filePath) ? filePath : resolve(ctx.cwd, filePath);
 
+      await guardWriteAccess(ctx, {
+        toolName: "edit",
+        absolutePath,
+        change: { oldText: oldString, newText: newString, replaceAll },
+      });
+
       const throwIfAborted = (): void => {
         if (signal?.aborted) throw new Error("Operation aborted");
       };

package/src/opencode/index.ts

@@ -1,9 +1,9 @@
 /**
  * opencode —— 统一注册 opencode 风格工具扩展。
  *
- * 聚合 read / edit / write / todo / question 五个工具，一次加载全部注册；
+ * 聚合 read / edit / write / todo / question / bash 六个工具，一次加载全部注册；
  * 各工具的公开 API（匹配引擎、纯函数等）也从这里重新导出，方便
- * 测试与其他模块（如 workspace-guard）引用。
+ * 测试与其他模块（如 lib/write-guard）引用。
  *
  * Usage:
  *   pi -e ./opencode/index.ts
@@ -14,12 +14,14 @@
 
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 
+import opencodeBash from "./bash.js";
 import opencodeEdit from "./edit.js";
 import opencodeQuestion from "./question.js";
 import opencodeRead from "./read.js";
 import opencodeTodo from "./todo.js";
 import opencodeWrite from "./write.js";
 
+export { default as opencodeBash } from "./bash.js";
 export { default as opencodeEdit } from "./edit.js";
 export {
   detectLineEnding,
@@ -40,4 +42,5 @@ export default function opencode(pi: ExtensionAPI) {
   opencodeWrite(pi);
   opencodeTodo(pi);
   opencodeQuestion(pi);
+  opencodeBash(pi);
 }

package/src/opencode/write.ts

@@ -28,6 +28,7 @@ import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { withFileMutationQueue } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
 
+import { guardWriteAccess } from "../lib/write-guard.js";
 import { stripBom } from "./edit-engine.js";
 
 /**
@@ -69,6 +70,11 @@ export default function opencodeWrite(pi: ExtensionAPI) {
     async execute(_toolCallId, params, signal, _onUpdate, ctx) {
       const { filePath: rawPath, content } = params;
       const absolutePath = resolvePath(ctx.cwd, rawPath);
+      await guardWriteAccess(ctx, {
+        toolName: "write",
+        absolutePath,
+        change: { oldText: "", newText: content },
+      });
       const dir = dirname(absolutePath);
 
       const throwIfAborted = () => {

package/src/spawn-agent.ts

@@ -50,11 +50,11 @@ const DEFAULT_TOOLS = ["read", "grep", "find", "ls"];
 const MAX_PROGRESS_LINES = 5;
 
 /**
- * Extensions loaded unconditionally into every subagent: the workspace write
- * guard and the bwrap sandbox. Both are protection layers and must not depend
- * on the agent's declared toolset.
+ * Extensions loaded unconditionally into every subagent: the bwrap sandbox is a
+ * protection layer and must not depend on the agent's declared toolset.
+ * (Workspace write protection is embedded in the opencode write/edit tools.)
  */
-const UNCONDITIONAL_EXTENSIONS = ["workspace-guard.ts", "bwrap/index.ts"] as const;
+const UNCONDITIONAL_EXTENSIONS = ["bwrap/index.ts"] as const;
 
 /**
  * Tool → extension override map: when a subagent's frontmatter enables a

package/src/bash-default-timeout.ts

@@ -1,9 +0,0 @@
-import { type ExtensionAPI, isToolCallEventType } from "@earendil-works/pi-coding-agent";
-
-export default function bashDefaultTimeout(pi: ExtensionAPI) {
-  pi.on("tool_call", (event) => {
-    if (isToolCallEventType("bash", event) && event.input.timeout === undefined) {
-      event.input.timeout = 180;
-    }
-  });
-}

package/src/bwrap/index.ts

@@ -1,56 +0,0 @@
-import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
-import { createBashTool } from "@earendil-works/pi-coding-agent";
-import { Type } from "typebox";
-
-import { bwrapRuntime } from "./runtime.js";
-
-export {
-  type BwrapConfig,
-  resolveBwrap,
-  type ResolvedBwrap,
-  resolveHeadlessBwrap,
-} from "./core.js";
-export { type EscalationDecision, resolveEscalation } from "./runtime.js";
-
-const sandboxedBashSchema = Type.Object(
-  {
-    command: Type.String({ description: "Bash command to execute" }),
-    timeout: Type.Optional(Type.Number({ description: "Timeout in seconds" })),
-    request_full_access: Type.Optional(
-      Type.Boolean({
-        description:
-          "Set true to request unsandboxed execution. The bwrap runtime will ask the user for approval.",
-      }),
-    ),
-    request_full_access_reason: Type.Optional(
-      Type.String({ description: "Explain why unsandboxed execution is required." }),
-    ),
-  },
-  { additionalProperties: false },
-);
-
-export default function bwrapExtension(pi: ExtensionAPI): void {
-  bwrapRuntime.setup(pi);
-  const localBash = createBashTool(process.cwd());
-  pi.registerTool({
-    name: localBash.name,
-    label: "bash (bwrap)",
-    description:
-      localBash.description +
-      "\n\nSet request_full_access to true to request unsandboxed execution.",
-    parameters: sandboxedBashSchema,
-    executionMode: localBash.executionMode,
-    execute(id, params, signal, onUpdate, ctx) {
-      return bwrapRuntime.execute({
-        toolCallId: id,
-        command: params.command,
-        timeout: params.timeout,
-        requestFullAccess: params.request_full_access,
-        requestFullAccessReason: params.request_full_access_reason,
-        signal,
-        onUpdate,
-        ctx,
-      });
-    },
-  });
-}

package/src/workspace-guard.ts

@@ -1,253 +0,0 @@
-/**
- * Workspace Guard Extension
- *
- * File-modifying tools (write, edit) are gated:
- * - Paths inside the workspace or /tmp are auto-allowed.
- * - Paths outside require user approval via confirmation dialog.
- *   The dialog shows a `diff` code block preview of the pending change.
- *
- * Read tools (read, ls, find, grep) are unrestricted.
- *
- * Usage:
- *   pi -e workspace-guard
- */
-
-import { readFile } from "node:fs/promises";
-import { basename, isAbsolute, relative, sep } from "node:path";
-
-import {
-  type ExtensionAPI,
-  generateUnifiedPatch,
-  type ToolCallEvent,
-} from "@earendil-works/pi-coding-agent";
-
-import { resolveHomePath } from "./lib/path.js";
-import { normalizeForEdit, replace } from "./opencode/edit-engine.js";
-
-const WRITE_TOOLS = new Set(["write", "edit"]);
-const ALWAYS_ALLOW = ["/tmp"];
-
-/** Maximum lines of the diff preview shown in the approval dialog. */
-const MAX_PREVIEW_LINES = 100;
-
-export function getWriteTarget(input: ToolCallEvent["input"]): string | undefined {
-  if (typeof input !== "object" || input === null) return undefined;
-  if ("path" in input && typeof input.path === "string") return input.path;
-  if ("filePath" in input && typeof input.filePath === "string") return input.filePath;
-  return undefined;
-}
-
-function isInside(dir: string, filePath: string): boolean {
-  const rel = relative(dir, filePath);
-  return rel === "" || (rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel));
-}
-
-function isPathAllowed(resolvedPath: string, cwd: string): boolean {
-  if (isInside(cwd, resolvedPath)) return true;
-
-  for (const allowed of ALWAYS_ALLOW) {
-    const resolvedAllowed = resolveHomePath(allowed, cwd);
-    if (isInside(resolvedAllowed, resolvedPath)) return true;
-  }
-
-  return false;
-}
-
-/**
- * Type guard for built-in edit entries `{ oldText, newText }`.
- */
-function isEditPair(value: unknown): value is { oldText: string; newText: string } {
-  return (
-    typeof value === "object" &&
-    value !== null &&
-    "oldText" in value &&
-    typeof value.oldText === "string" &&
-    "newText" in value &&
-    typeof value.newText === "string"
-  );
-}
-
-/**
- * Extract the opencode-style edit pair `{ oldString, newString, replaceAll }`.
- */
-function getOpencodeEditPair(
-  input: ToolCallEvent["input"],
-): { oldString: string; newString: string; replaceAll: boolean } | undefined {
-  if (typeof input !== "object" || input === null) return undefined;
-  if (!("oldString" in input) || !("newString" in input)) return undefined;
-  if (typeof input.oldString !== "string" || typeof input.newString !== "string") return undefined;
-  return {
-    oldString: input.oldString,
-    newString: input.newString,
-    replaceAll: "replaceAll" in input && input.replaceAll === true,
-  };
-}
-
-/**
- * Apply the pending write/edit to `content`.
- * Returns undefined when the change cannot be applied (missing fields or oldText not found).
- */
-function applyChange(
-  toolName: string,
-  input: ToolCallEvent["input"],
-  content: string,
-): string | undefined {
-  if (typeof input !== "object" || input === null) return undefined;
-
-  if (toolName === "write") {
-    return "content" in input && typeof input.content === "string" ? input.content : undefined;
-  }
-
-  // Built-in edit: { path, edits: [{ oldText, newText }] }
-  if ("edits" in input && Array.isArray(input.edits)) {
-    let next = content;
-    for (const edit of input.edits) {
-      if (!isEditPair(edit)) return undefined;
-      if (!next.includes(edit.oldText)) return undefined;
-      next = next.replace(edit.oldText, () => edit.newText);
-    }
-    return next;
-  }
-
-  return undefined;
-}
-
-/** Wrap patch text in a `diff` code block, truncating very large diffs. */
-function wrapDiff(patch: string): string {
-  const lines = patch.split("\n");
-  if (lines.length > MAX_PREVIEW_LINES) {
-    const truncated = lines.slice(0, MAX_PREVIEW_LINES).join("\n");
-    return `\`\`\`diff\n${truncated}\n… (preview truncated to ${MAX_PREVIEW_LINES} lines)\n\`\`\``;
-  }
-  return `\`\`\`diff\n${patch}\n\`\`\``;
-}
-
-/**
- * Build a `diff` code block preview of the pending change.
- * Returns undefined when the diff cannot be computed.
- */
-export async function buildDiffPreview(
-  toolName: string,
-  input: ToolCallEvent["input"],
-  resolvedPath: string,
-): Promise<string | undefined> {
-  let oldContent = "";
-  try {
-    oldContent = await readFile(resolvedPath, "utf8");
-  } catch {
-    // Unreadable or missing file: treat as empty so writes show as full additions.
-  }
-
-  // opencode-edit: reuse the real matching engine to locate oldString, giving a
-  // line-numbered patch when it matches. Fall back to a parameter diff when the
-  // edit cannot be applied (oldString not found, ambiguous, or no file).
-  const pair = getOpencodeEditPair(input);
-  if (pair) {
-    try {
-      const normalized = normalizeForEdit(oldContent);
-      const newContent = replace(normalized, pair.oldString, pair.newString, pair.replaceAll);
-      // The full path is shown in the dialog title, so the patch header only
-      // carries the file name.
-      return wrapDiff(generateUnifiedPatch(basename(resolvedPath), normalized, newContent, 2));
-    } catch {
-      const removed = pair.oldString.split("\n").map((line) => `-${line}`);
-      const added = pair.newString.split("\n").map((line) => `+${line}`);
-      return wrapDiff([...removed, ...added].join("\n"));
-    }
-  }
-
-  const newContent = applyChange(toolName, input, oldContent);
-  if (newContent === undefined) return undefined;
-
-  return wrapDiff(generateUnifiedPatch(basename(resolvedPath), oldContent, newContent, 2));
-}
-
-export interface WriteGuardDecision {
-  block: boolean;
-  reason?: string;
-}
-
-/**
- * Decide how to handle a write outside the workspace.
- */
-export function decideOutsideWorkspaceWrite(
-  rawPath: string,
-  opts: { hasUI: boolean },
-): WriteGuardDecision {
-  if (!opts.hasUI) {
-    return {
-      block: true,
-      reason: `Path "${rawPath}" is outside workspace. No UI available for approval.`,
-    };
-  }
-  return { block: false };
-}
-
-export default function workspaceGuard(pi: ExtensionAPI) {
-  pi.on("before_agent_start", (event, ctx) => {
-    const currentCwd = ctx.cwd;
-    return {
-      systemPrompt:
-        event.systemPrompt +
-        `\nWorkspace write protection is active. ` +
-        `write and edit to paths inside the workspace "${currentCwd}" or /tmp are auto-allowed. ` +
-        (ctx.hasUI
-          ? `Paths outside require user approval before execution.`
-          : `Writes outside the workspace are rejected because no UI is available for approval.`),
-    };
-  });
-
-  pi.on("tool_call", async (event, ctx) => {
-    if (!WRITE_TOOLS.has(event.toolName)) return;
-
-    const rawPath = getWriteTarget(event.input);
-    if (!rawPath) return;
-
-    const resolved = resolveHomePath(rawPath, ctx.cwd);
-
-    if (isPathAllowed(resolved, ctx.cwd)) return;
-
-    const decision = decideOutsideWorkspaceWrite(rawPath, {
-      hasUI: ctx.hasUI,
-    });
-    if (decision.block) return decision;
-
-    let choice: string | undefined;
-    while (!choice) {
-      const diffPreview = await buildDiffPreview(event.toolName, event.input, resolved);
-
-      const title =
-        `Model requests write access outside workspace:\n\n` +
-        `  Tool:  ${event.toolName}\n` +
-        `  Path:  ${rawPath}\n` +
-        `  Resolved: ${resolved}\n` +
-        (diffPreview ? `\n${diffPreview}\n` : "") +
-        `\nAllow?`;
-
-      choice = await ctx.ui.select(title, ["Approve once", "Block", "Block with reason"]);
-
-      if (choice === undefined) {
-        ctx.abort();
-        return { block: true, reason: "Write outside workspace cancelled by user." };
-      }
-
-      if (choice === "Block with reason") {
-        const feedback = await ctx.ui.input("Why was this write denied?");
-        if (feedback === undefined) {
-          choice = undefined; // cancelled input, retry select
-          continue;
-        }
-        return {
-          block: true,
-          reason: feedback
-            ? `Write outside workspace denied: ${feedback}`
-            : "Write outside workspace denied by user.",
-        };
-      }
-    }
-
-    if (choice !== "Approve once") {
-      return { block: true, reason: "Write outside workspace denied by user." };
-    }
-  });
-}