@trim21/personal-pi-extensions 0.0.225 → 0.0.230

package/src/spawn-agent.ts

@@ -49,22 +49,28 @@ const DEFAULT_TOOLS = ["read", "grep", "find", "ls"];
 /** Progress log keeps only the most recent lines (rolling window). */
 const MAX_PROGRESS_LINES = 5;
 
-/**
- * Extensions loaded unconditionally into every subagent: the workspace write
- * guard and the bwrap sandbox. Both are protection layers and must not depend
- * on the agent's declared toolset.
- */
-const UNCONDITIONAL_EXTENSIONS = ["workspace-guard.ts", "bwrap/index.ts"] as const;
-
 /**
  * Tool → extension override map: when a subagent's frontmatter enables a
  * built-in tool, the matching opencode extension is loaded via `-e` so the
  * subagent uses the enhanced implementation instead of the built-in one.
+ *
+ * The bash override also carries the bwrap sandbox: opencode/bash.ts calls
+ * bwrapRuntime.setup() and runs commands through bwrapRuntime.execute(), so
+ * agents that declare the bash tool get sandboxing automatically. Agents
+ * without bash need no bwrap setup (there are no commands to sandbox).
+ * (Workspace write protection is embedded in the opencode write/edit tools.)
+ *
+ * Claude Code style tools (capitalized names, e.g. `Grep`/`Glob`) map to
+ * their split claude-code files, so a subagent can enable exactly the search
+ * tools it declares — e.g. `Grep` without `Glob`.
  */
 const TOOL_EXTENSION_OVERRIDES: Record<string, string> = {
   read: "opencode/read.ts",
   edit: "opencode/edit.ts",
   write: "opencode/write.ts",
+  bash: "opencode/bash.ts",
+  Grep: "claude-code/grep.ts",
+  Glob: "claude-code/glob.ts",
 };
 
 // ── schema ───────────────────────────────────────────────────────────────────
@@ -185,15 +191,9 @@ export function buildSubagentArgs(
   // dialog responses over stdin. --no-session keeps the child ephemeral.
   // --no-extensions disables
   // extension discovery; only the extensions explicitly loaded below (the
-  // unconditional guards plus per-tool overrides) run inside the subagent.
+  // per-tool overrides) run inside the subagent.
   const args: string[] = ["--mode", "rpc", "--no-session", "--no-extensions"];
 
-  // Protection layers that must be present in every subagent regardless of
-  // its declared toolset: the workspace write guard and the bwrap sandbox.
-  for (const ext of UNCONDITIONAL_EXTENSIONS) {
-    args.push("-e", extensionPath(ext));
-  }
-
   // Thinking level rides on the model shorthand ("model:level"); it cannot be
   // set without a model, so a level without a model is ignored.
   const model =

package/src/bash-default-timeout.ts

@@ -1,10 +0,0 @@
-import { type ExtensionAPI, isToolCallEventType } from "@earendil-works/pi-coding-agent";
-
-export default function bashDefaultTimeout(pi: ExtensionAPI) {
-  pi.on("tool_call", (event) => {
-    // opencode 风格 bash 的 timeout 单位是毫秒
-    if (isToolCallEventType("bash", event) && event.input.timeout === undefined) {
-      event.input.timeout = 180_000;
-    }
-  });
-}

package/src/bwrap/index.ts

@@ -1,15 +0,0 @@
-import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
-
-import { bwrapRuntime } from "./runtime.js";
-
-export {
-  type BwrapConfig,
-  resolveBwrap,
-  type ResolvedBwrap,
-  resolveHeadlessBwrap,
-} from "./core.js";
-export { type EscalationDecision, resolveEscalation } from "./runtime.js";
-
-export default function bwrapExtension(pi: ExtensionAPI): void {
-  bwrapRuntime.setup(pi);
-}

package/src/workspace-guard.ts

@@ -1,253 +0,0 @@
-/**
- * Workspace Guard Extension
- *
- * File-modifying tools (write, edit) are gated:
- * - Paths inside the workspace or /tmp are auto-allowed.
- * - Paths outside require user approval via confirmation dialog.
- *   The dialog shows a `diff` code block preview of the pending change.
- *
- * Read tools (read, ls, find, grep) are unrestricted.
- *
- * Usage:
- *   pi -e workspace-guard
- */
-
-import { readFile } from "node:fs/promises";
-import { basename, isAbsolute, relative, sep } from "node:path";
-
-import {
-  type ExtensionAPI,
-  generateUnifiedPatch,
-  type ToolCallEvent,
-} from "@earendil-works/pi-coding-agent";
-
-import { resolveHomePath } from "./lib/path.js";
-import { normalizeForEdit, replace } from "./opencode/edit-engine.js";
-
-const WRITE_TOOLS = new Set(["write", "edit"]);
-const ALWAYS_ALLOW = ["/tmp"];
-
-/** Maximum lines of the diff preview shown in the approval dialog. */
-const MAX_PREVIEW_LINES = 100;
-
-export function getWriteTarget(input: ToolCallEvent["input"]): string | undefined {
-  if (typeof input !== "object" || input === null) return undefined;
-  if ("path" in input && typeof input.path === "string") return input.path;
-  if ("filePath" in input && typeof input.filePath === "string") return input.filePath;
-  return undefined;
-}
-
-function isInside(dir: string, filePath: string): boolean {
-  const rel = relative(dir, filePath);
-  return rel === "" || (rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel));
-}
-
-function isPathAllowed(resolvedPath: string, cwd: string): boolean {
-  if (isInside(cwd, resolvedPath)) return true;
-
-  for (const allowed of ALWAYS_ALLOW) {
-    const resolvedAllowed = resolveHomePath(allowed, cwd);
-    if (isInside(resolvedAllowed, resolvedPath)) return true;
-  }
-
-  return false;
-}
-
-/**
- * Type guard for built-in edit entries `{ oldText, newText }`.
- */
-function isEditPair(value: unknown): value is { oldText: string; newText: string } {
-  return (
-    typeof value === "object" &&
-    value !== null &&
-    "oldText" in value &&
-    typeof value.oldText === "string" &&
-    "newText" in value &&
-    typeof value.newText === "string"
-  );
-}
-
-/**
- * Extract the opencode-style edit pair `{ oldString, newString, replaceAll }`.
- */
-function getOpencodeEditPair(
-  input: ToolCallEvent["input"],
-): { oldString: string; newString: string; replaceAll: boolean } | undefined {
-  if (typeof input !== "object" || input === null) return undefined;
-  if (!("oldString" in input) || !("newString" in input)) return undefined;
-  if (typeof input.oldString !== "string" || typeof input.newString !== "string") return undefined;
-  return {
-    oldString: input.oldString,
-    newString: input.newString,
-    replaceAll: "replaceAll" in input && input.replaceAll === true,
-  };
-}
-
-/**
- * Apply the pending write/edit to `content`.
- * Returns undefined when the change cannot be applied (missing fields or oldText not found).
- */
-function applyChange(
-  toolName: string,
-  input: ToolCallEvent["input"],
-  content: string,
-): string | undefined {
-  if (typeof input !== "object" || input === null) return undefined;
-
-  if (toolName === "write") {
-    return "content" in input && typeof input.content === "string" ? input.content : undefined;
-  }
-
-  // Built-in edit: { path, edits: [{ oldText, newText }] }
-  if ("edits" in input && Array.isArray(input.edits)) {
-    let next = content;
-    for (const edit of input.edits) {
-      if (!isEditPair(edit)) return undefined;
-      if (!next.includes(edit.oldText)) return undefined;
-      next = next.replace(edit.oldText, () => edit.newText);
-    }
-    return next;
-  }
-
-  return undefined;
-}
-
-/** Wrap patch text in a `diff` code block, truncating very large diffs. */
-function wrapDiff(patch: string): string {
-  const lines = patch.split("\n");
-  if (lines.length > MAX_PREVIEW_LINES) {
-    const truncated = lines.slice(0, MAX_PREVIEW_LINES).join("\n");
-    return `\`\`\`diff\n${truncated}\n… (preview truncated to ${MAX_PREVIEW_LINES} lines)\n\`\`\``;
-  }
-  return `\`\`\`diff\n${patch}\n\`\`\``;
-}
-
-/**
- * Build a `diff` code block preview of the pending change.
- * Returns undefined when the diff cannot be computed.
- */
-export async function buildDiffPreview(
-  toolName: string,
-  input: ToolCallEvent["input"],
-  resolvedPath: string,
-): Promise<string | undefined> {
-  let oldContent = "";
-  try {
-    oldContent = await readFile(resolvedPath, "utf8");
-  } catch {
-    // Unreadable or missing file: treat as empty so writes show as full additions.
-  }
-
-  // opencode-edit: reuse the real matching engine to locate oldString, giving a
-  // line-numbered patch when it matches. Fall back to a parameter diff when the
-  // edit cannot be applied (oldString not found, ambiguous, or no file).
-  const pair = getOpencodeEditPair(input);
-  if (pair) {
-    try {
-      const normalized = normalizeForEdit(oldContent);
-      const newContent = replace(normalized, pair.oldString, pair.newString, pair.replaceAll);
-      // The full path is shown in the dialog title, so the patch header only
-      // carries the file name.
-      return wrapDiff(generateUnifiedPatch(basename(resolvedPath), normalized, newContent, 2));
-    } catch {
-      const removed = pair.oldString.split("\n").map((line) => `-${line}`);
-      const added = pair.newString.split("\n").map((line) => `+${line}`);
-      return wrapDiff([...removed, ...added].join("\n"));
-    }
-  }
-
-  const newContent = applyChange(toolName, input, oldContent);
-  if (newContent === undefined) return undefined;
-
-  return wrapDiff(generateUnifiedPatch(basename(resolvedPath), oldContent, newContent, 2));
-}
-
-export interface WriteGuardDecision {
-  block: boolean;
-  reason?: string;
-}
-
-/**
- * Decide how to handle a write outside the workspace.
- */
-export function decideOutsideWorkspaceWrite(
-  rawPath: string,
-  opts: { hasUI: boolean },
-): WriteGuardDecision {
-  if (!opts.hasUI) {
-    return {
-      block: true,
-      reason: `Path "${rawPath}" is outside workspace. No UI available for approval.`,
-    };
-  }
-  return { block: false };
-}
-
-export default function workspaceGuard(pi: ExtensionAPI) {
-  pi.on("before_agent_start", (event, ctx) => {
-    const currentCwd = ctx.cwd;
-    return {
-      systemPrompt:
-        event.systemPrompt +
-        `\nWorkspace write protection is active. ` +
-        `write and edit to paths inside the workspace "${currentCwd}" or /tmp are auto-allowed. ` +
-        (ctx.hasUI
-          ? `Paths outside require user approval before execution.`
-          : `Writes outside the workspace are rejected because no UI is available for approval.`),
-    };
-  });
-
-  pi.on("tool_call", async (event, ctx) => {
-    if (!WRITE_TOOLS.has(event.toolName)) return;
-
-    const rawPath = getWriteTarget(event.input);
-    if (!rawPath) return;
-
-    const resolved = resolveHomePath(rawPath, ctx.cwd);
-
-    if (isPathAllowed(resolved, ctx.cwd)) return;
-
-    const decision = decideOutsideWorkspaceWrite(rawPath, {
-      hasUI: ctx.hasUI,
-    });
-    if (decision.block) return decision;
-
-    let choice: string | undefined;
-    while (!choice) {
-      const diffPreview = await buildDiffPreview(event.toolName, event.input, resolved);
-
-      const title =
-        `Model requests write access outside workspace:\n\n` +
-        `  Tool:  ${event.toolName}\n` +
-        `  Path:  ${rawPath}\n` +
-        `  Resolved: ${resolved}\n` +
-        (diffPreview ? `\n${diffPreview}\n` : "") +
-        `\nAllow?`;
-
-      choice = await ctx.ui.select(title, ["Approve once", "Block", "Block with reason"]);
-
-      if (choice === undefined) {
-        ctx.abort();
-        return { block: true, reason: "Write outside workspace cancelled by user." };
-      }
-
-      if (choice === "Block with reason") {
-        const feedback = await ctx.ui.input("Why was this write denied?");
-        if (feedback === undefined) {
-          choice = undefined; // cancelled input, retry select
-          continue;
-        }
-        return {
-          block: true,
-          reason: feedback
-            ? `Write outside workspace denied: ${feedback}`
-            : "Write outside workspace denied by user.",
-        };
-      }
-    }
-
-    if (choice !== "Approve once") {
-      return { block: true, reason: "Write outside workspace denied by user." };
-    }
-  });
-}