@trim21/personal-pi-extensions 0.0.249 → 0.0.252

package/README.md

@@ -81,9 +81,18 @@ bash 工具（opencode 风格 `bash`、Claude Code 风格 `Bash`）注册了 `da
   "tmpfsPaths": [],
   // 额外 bwrap 参数
   "extraArgs": ["--die-with-parent"],
+  // 全权限执行的自动审批规则：命中规则的命令不弹确认框
+  // allow 直接放行，deny 直接拒绝；命令用 tree-sitter 解析，
+  // 按 BashArity 生成模式（git checkout main → "git checkout *"）
+  "approvalRules": [
+    { "action": "allow", "pattern": "git status *" },
+    { "action": "deny", "pattern": "git push *" },
+  ],
 }
 ```
 
+`dangerouslyDisableSandbox: true` 的审批流程：先按 `approvalRules` 匹配（含嵌套 `$(...)` 内的命令，规则后写优先），命中 allow/deny 直接放行/拒绝，未命中才弹确认框。
+
 ### 使用
 
 bwrap 已集成进 bash 工具实现（opencode 风格 `bash` 位于 `src/opencode/bash.ts`，Claude Code 风格 `Bash` 位于 `src/claude-code/shell.ts`），随对应扩展一起加载，无需单独安装。bash 工具内置默认超时 120 秒。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trim21/personal-pi-extensions",
-  "version": "0.0.249",
+  "version": "0.0.252",
   "type": "module",
   "description": "Custom pi coding-agent extensions: bwrap sandbox, workspace guard, opencode edit, and more",
   "keywords": [
@@ -77,5 +77,9 @@
       "prettier --write"
     ]
   },
-  "packageManager": "pnpm@11.21.0"
+  "packageManager": "pnpm@11.21.0",
+  "dependencies": {
+    "tree-sitter-bash": "^0.25.1",
+    "web-tree-sitter": "^0.26.12"
+  }
 }

package/src/bwrap/approval-rules.ts

@@ -0,0 +1,229 @@
+/**
+ * approval-rules —— bash 命令审核组件（对齐 opencode 的权限方法）：
+ * 用 tree-sitter 解析命令（含嵌套 `$(...)`），按 BashArity 生成命令模式
+ * （`git checkout main` → `git checkout *`），再用通配匹配对 allow/deny
+ * 规则求值。接入 bwrap 的 `dangerouslyDisableSandbox` 审批：命中规则自动
+ * 放行/拒绝，未命中才弹审批对话框。
+ *
+ * 参考实现：
+ * - opencode packages/opencode/src/permission/arity.ts（BashArity 表）
+ * - opencode packages/core/src/util/wildcard.ts（通配匹配）
+ * - opencode packages/opencode/src/tool/shell.ts（tree-sitter 命令提取）
+ */
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+import type { Node } from "web-tree-sitter";
+
+import { resolvePackageWasm } from "../lib/wasm.js";
+
+/** 解析后的单个命令：命令名 + 参数 + 原文 + 嵌套命令（命令替换里的）。 */
+export interface BashCommand {
+  name: string;
+  args: string[];
+  raw: string;
+  nested: BashCommand[];
+}
+
+export interface ParsedBash {
+  commands: BashCommand[];
+  /** 语法错误时的提示（解析失败不抛错，退化为无法匹配）。 */
+  error?: string;
+}
+
+export type ApprovalAction = "allow" | "deny";
+
+export interface ApprovalRule {
+  action: ApprovalAction;
+  /** 命令模式，如 `git push *`、`curl *`、`npm install *`。 */
+  pattern: string;
+}
+
+// ── tree-sitter ──────────────────────────────────────────────────────────────
+
+interface BashParser {
+  parse: (source: string) => unknown;
+}
+
+/**
+ * 延迟初始化 tree-sitter bash parser（wasm 加载开销大，只做一次）。
+ * Node 环境：主 wasm 由 web-tree-sitter 按自身路径自动加载，
+ * bash grammar 的 wasm 显式读文件传入。
+ */
+function createParserLoader(): () => Promise<BashParser> {
+  let parserPromise: Promise<BashParser> | undefined;
+  return function loadParser(): Promise<BashParser> {
+    parserPromise ??= (async () => {
+      const { Language, Parser } = await import("web-tree-sitter");
+      await Parser.init();
+      const bashWasm = readFileSync(
+        fileURLToPath(resolvePackageWasm("tree-sitter-bash", "tree-sitter-bash.wasm")),
+      );
+      const language = await Language.load(bashWasm);
+      const parser = new Parser();
+      parser.setLanguage(language);
+      return { parse: (source: string) => parser.parse(source) };
+    })();
+    return parserPromise;
+  };
+}
+const loadParser = createParserLoader();
+
+// ── 命令提取（对齐 opencode shell.ts 的 commands/parts）────────────────────
+
+/** 命令参数中需要跳过的节点类型。 */
+const SKIP_ARG_TYPES = new Set(["command_argument_sep", "redirection"]);
+
+function extractParts(node: Node): { name: string; args: string[] } {
+  const name: string[] = [];
+  const args: string[] = [];
+  const visit = (child: Node) => {
+    if (child.type === "command_name" || child.type === "command_name_expr") {
+      name.push(child.text);
+      return;
+    }
+    if (child.type === "command_elements") {
+      for (let i = 0; i < child.childCount; i++) {
+        const item = child.child(i);
+        if (item && !SKIP_ARG_TYPES.has(item.type)) {
+          // 参数词与命令替换都保留原文（命令替换内部的命令由 nested 提取）
+          args.push(item.text);
+        }
+      }
+      return;
+    }
+    if (
+      child.type === "word" ||
+      child.type === "string" ||
+      child.type === "raw_string" ||
+      child.type === "concatenation"
+    ) {
+      args.push(child.text);
+    }
+  };
+  for (let i = 0; i < node.childCount; i++) {
+    const child = node.child(i);
+    if (child) visit(child);
+  }
+  return { name: name.join(" "), args };
+}
+
+function collectCommand(node: Node, all: Node[]): BashCommand | undefined {
+  const { name, args } = extractParts(node);
+  if (!name) return undefined;
+  // 嵌套命令 = 完全落在本命令范围内的其他 command 节点（含 `$(...)` 内的）。
+  // 用位置判断而非 descendantsOfType 递归：0.26 的 descendantsOfType 会包含
+  // 自身且每次返回新 wrapper，`===` 比较失效会无限递归。
+  const nested: BashCommand[] = [];
+  for (const descendant of all) {
+    if (descendant === node) continue;
+    if (descendant.startIndex >= node.startIndex && descendant.endIndex <= node.endIndex) {
+      const inner = collectCommand(descendant, all);
+      if (inner) nested.push(inner);
+    }
+  }
+  return { name, args, raw: node.text, nested };
+}
+
+/**
+ * 解析 bash 命令，返回所有命令（含嵌套 `$(...)` 与管道两端）。
+ * 语法错误时返回 `error` 而不抛错——审核失败应拒绝而非崩溃。
+ */
+export async function parseBashCommands(command: string): Promise<ParsedBash> {
+  try {
+    const parser = await loadParser();
+    const tree = parser.parse(command) as { rootNode: Node };
+    const all = tree.rootNode.descendantsOfType("command");
+    const commands: BashCommand[] = [];
+    for (const node of all) {
+      const parsed = collectCommand(node, all);
+      if (parsed) commands.push(parsed);
+    }
+    return { commands };
+  } catch (error) {
+    return {
+      commands: [],
+      error: error instanceof Error ? error.message : String(error),
+    };
+  }
+}
+
+// ── BashArity：命令前缀 → token 数（参考 opencode arity.ts）─────────────────
+
+/**
+ * 命令前缀 → 定义该命令的 token 数。`git checkout main` → `git` 的 arity 2，
+ * 权限模式取前 2 个 token + `*`（`git checkout *`），避免具体参数进规则。
+ * 表来自 opencode packages/opencode/src/permission/arity.ts（Apache-2.0），
+ * 数据存放在 arity.json（所有 key 带引号）。
+ */
+const ARITY = JSON.parse(readFileSync(new URL("arity.json", import.meta.url), "utf8")) as Record<
+  string,
+  number
+>;
+
+/**
+ * 生成命令的权限模式：BashArity 前缀 + `*`。
+ * `git checkout main` → `git checkout *`；未收录的命令 → 命令名 + `*`。
+ */
+export function commandPattern(command: BashCommand): string {
+  const tokens = [command.name, ...command.args];
+  for (let len = tokens.length; len > 0; len--) {
+    const prefix = tokens.slice(0, len).join(" ");
+    const arity = ARITY[prefix];
+    if (arity !== undefined) return [...tokens.slice(0, arity), "*"].join(" ");
+  }
+  if (tokens.length === 0) return "*";
+  return [tokens[0], "*"].join(" ");
+}
+
+// ── 通配匹配（参考 opencode wildcard.ts）────────────────────────────────────
+
+/**
+ * `*` 匹配任意字符序列，`?` 匹配单个字符；规则模式是正则字面量。
+ * `git push *` 匹配 `git push main` 等。
+ */
+export function matchRule(input: string, pattern: string): boolean {
+  let escaped = pattern
+    .replaceAll(/[.+^${}()|[\]\\]/g, String.raw`\$&`)
+    .replaceAll("*", ".*")
+    .replaceAll("?", ".");
+  if (escaped.endsWith(" .*")) escaped = escaped.slice(0, -3) + "( .*)?";
+  return new RegExp(`^${escaped}$`, "s").test(input);
+}
+
+// ── 规则求值 ────────────────────────────────────────────────────────────────
+
+/**
+ * 命令（含所有嵌套命令）的权限模式列表（命令替换里的命令也展开）。
+ * 供规则求值与"allow forever"写规则复用。
+ */
+export async function commandPatternsFor(command: string): Promise<string[]> {
+  const parsed = await parseBashCommands(command);
+  const flat: string[] = [];
+  const visit = (cmd: BashCommand) => {
+    flat.push(commandPattern(cmd));
+    for (const nested of cmd.nested) visit(nested);
+  };
+  for (const cmd of parsed.commands) visit(cmd);
+  return flat;
+}
+
+/**
+ * 对命令（含所有嵌套命令）求值：任一命令命中规则即生效，规则后写优先
+ * （findLast，对齐 opencode PermissionV2）。返回 allow/deny；无规则命中
+ * 返回 undefined（交给人审）。
+ */
+export function evaluateBashApproval(
+  command: string,
+  rules: readonly ApprovalRule[],
+): Promise<ApprovalAction | undefined> {
+  return commandPatternsFor(command).then((patterns) => {
+    if (patterns.length === 0) return;
+    // 规则后写优先（对齐 opencode PermissionV2 的 findLast）
+    for (const pattern of patterns) {
+      const rule = rules.findLast((r) => matchRule(pattern, r.pattern));
+      if (rule) return rule.action;
+    }
+    return;
+  });
+}

package/src/bwrap/arity.json

@@ -0,0 +1,138 @@
+{
+  "cat": 1,
+  "cd": 1,
+  "chmod": 1,
+  "chown": 1,
+  "cp": 1,
+  "echo": 1,
+  "env": 1,
+  "export": 1,
+  "grep": 1,
+  "kill": 1,
+  "killall": 1,
+  "ln": 1,
+  "ls": 1,
+  "mkdir": 1,
+  "mv": 1,
+  "ps": 1,
+  "pwd": 1,
+  "rm": 1,
+  "rmdir": 1,
+  "sleep": 1,
+  "source": 1,
+  "tail": 1,
+  "touch": 1,
+  "unset": 1,
+  "which": 1,
+  "aws": 3,
+  "az": 3,
+  "bazel": 2,
+  "brew": 2,
+  "bun": 2,
+  "bun run": 3,
+  "bun x": 3,
+  "cargo": 2,
+  "cargo add": 3,
+  "cargo run": 3,
+  "cdk": 2,
+  "cf": 2,
+  "cmake": 2,
+  "composer": 2,
+  "consul": 2,
+  "consul kv": 3,
+  "crictl": 2,
+  "deno": 2,
+  "deno task": 3,
+  "doctl": 3,
+  "docker": 2,
+  "docker builder": 3,
+  "docker compose": 3,
+  "docker container": 3,
+  "docker image": 3,
+  "docker network": 3,
+  "docker volume": 3,
+  "eksctl": 2,
+  "eksctl create": 3,
+  "firebase": 2,
+  "flyctl": 2,
+  "gcloud": 3,
+  "gh": 3,
+  "git": 2,
+  "git config": 3,
+  "git remote": 3,
+  "git stash": 3,
+  "go": 2,
+  "gradle": 2,
+  "helm": 2,
+  "heroku": 2,
+  "hugo": 2,
+  "ip": 2,
+  "ip addr": 3,
+  "ip link": 3,
+  "ip netns": 3,
+  "ip route": 3,
+  "kind": 2,
+  "kind create": 3,
+  "kubectl": 2,
+  "kubectl kustomize": 3,
+  "kubectl rollout": 3,
+  "kustomize": 2,
+  "make": 2,
+  "mc": 2,
+  "mc admin": 3,
+  "minikube": 2,
+  "mongosh": 2,
+  "mysql": 2,
+  "mvn": 2,
+  "ng": 2,
+  "npm": 2,
+  "npm exec": 3,
+  "npm init": 3,
+  "npm run": 3,
+  "npm view": 3,
+  "nvm": 2,
+  "nx": 2,
+  "openssl": 2,
+  "openssl req": 3,
+  "openssl x509": 3,
+  "pip": 2,
+  "pipenv": 2,
+  "pnpm": 2,
+  "pnpm dlx": 3,
+  "pnpm exec": 3,
+  "pnpm run": 3,
+  "poetry": 2,
+  "podman": 2,
+  "podman container": 3,
+  "podman image": 3,
+  "psql": 2,
+  "pulumi": 2,
+  "pulumi stack": 3,
+  "pyenv": 2,
+  "python": 2,
+  "rake": 2,
+  "rbenv": 2,
+  "redis-cli": 2,
+  "rustup": 2,
+  "serverless": 2,
+  "sfdx": 3,
+  "skaffold": 2,
+  "sls": 2,
+  "sst": 2,
+  "swift": 2,
+  "systemctl": 2,
+  "terraform": 2,
+  "terraform workspace": 3,
+  "tmux": 2,
+  "turbo": 2,
+  "ufw": 2,
+  "vault": 2,
+  "vault auth": 3,
+  "vault kv": 3,
+  "vercel": 2,
+  "volta": 2,
+  "wp": 2,
+  "yarn": 2,
+  "yarn dlx": 3,
+  "yarn run": 3
+}

package/src/bwrap/core.ts

@@ -12,6 +12,7 @@ import { type Static, Type } from "typebox";
 import { Value } from "typebox/value";
 
 import { expandHome } from "../lib/path.js";
+import { type ApprovalRule } from "./approval-rules.js";
 
 const PROTECTED_DIRS = [".git", ".pi", ".agent"];
 
@@ -26,6 +27,17 @@ const bwrapConfigProperties = {
   extraWritablePaths: Type.Array(Type.String()),
   tmpfsPaths: Type.Array(Type.String()),
   extraArgs: Type.Array(Type.String()),
+  approvalRules: Type.Optional(
+    Type.Array(
+      Type.Object(
+        {
+          action: StringEnum(["allow", "deny"] as const),
+          pattern: Type.String({ description: '命令模式，如 "git push *"、"npm install *"' }),
+        },
+        { additionalProperties: false },
+      ),
+    ),
+  ),
 };
 
 export const bwrapConfigSchema = Type.Object(bwrapConfigProperties, {
@@ -48,6 +60,8 @@ export interface ResolvedBwrap {
   extraWritablePaths: string[];
   tmpfsPaths: string[];
   extraArgs: string[];
+  /** 全权限执行的自动审批规则（allow/deny 命令模式）。 */
+  approvalRules: ApprovalRule[];
 }
 
 const DEFAULT_CONFIG: BwrapConfig = {
@@ -66,6 +80,7 @@ export function resolveBwrap(config: BwrapConfig): ResolvedBwrap {
     extraWritablePaths: config.extraWritablePaths,
     tmpfsPaths: config.tmpfsPaths ?? [],
     extraArgs: config.extraArgs ?? [],
+    approvalRules: config.approvalRules ?? [],
   };
   switch (config.mode) {
     case "allow-all": {
@@ -102,6 +117,7 @@ function deepMerge(base: BwrapConfig, overrides: Partial<BwrapConfig>): BwrapCon
     extraWritablePaths: [...base.extraWritablePaths, ...(overrides.extraWritablePaths ?? [])],
     tmpfsPaths: overrides.tmpfsPaths ?? base.tmpfsPaths,
     extraArgs: overrides.extraArgs ?? base.extraArgs,
+    approvalRules: [...(base.approvalRules ?? []), ...(overrides.approvalRules ?? [])],
   };
 }
 

package/src/bwrap/runtime.ts

@@ -1,18 +1,30 @@
+import { randomUUID } from "node:crypto";
+import { createWriteStream, existsSync, mkdirSync, readFileSync, type WriteStream } from "node:fs";
+import { mkdir, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+
 import type {
   AgentToolUpdateCallback,
   ExtensionAPI,
   ExtensionCommandContext,
   ExtensionContext,
 } from "@earendil-works/pi-coding-agent";
-import { createLocalBashOperations } from "@earendil-works/pi-coding-agent";
+import {
+  createLocalBashOperations,
+  getAgentDir,
+  truncateTail,
+  type TruncationResult,
+} from "@earendil-works/pi-coding-agent";
 import { type TObject, Type } from "typebox";
 
 import { type CommandSpec, parseCommand } from "../lib/cli.js";
-import { selectWithOptionalInput } from "../lib/ui.js";
+import { type SelectAction, selectWithOptionalInput } from "../lib/ui.js";
+import { type ApprovalRule, commandPatternsFor, evaluateBashApproval } from "./approval-rules.js";
 import {
   type BwrapMode,
   createBwrapBashOperations,
   findBwrap,
+  getBwrapConfigPaths,
   loadBwrapConfig,
   resolveBwrap,
   resolveBwrapPath,
@@ -33,6 +45,20 @@ export function resolveEscalation(opts: { hasUI: boolean }): EscalationDecision
   return { kind: "dialog" };
 }
 
+/** 全权限审批对话框的选项 label（也作为 switch 匹配键与测试引用）。 */
+export const ALLOW_ONCE = "Allow once";
+export const ALLOW_FOREVER = "Allow forever";
+export const DENY = "Deny";
+export const DENY_WITH_REASON = "Deny with reason";
+
+/** 审批对话框选项：允许一次 / 永久允许 / 拒绝 / 拒绝并附理由。 */
+export const FULL_ACCESS_CHOICES: readonly SelectAction[] = [
+  { label: ALLOW_ONCE },
+  { label: ALLOW_FOREVER },
+  { label: DENY },
+  { label: DENY_WITH_REASON, inputPrompt: "Why was this denied?" },
+];
+
 export interface BwrapExecutionRequest {
   toolCallId: string;
   command: string;
@@ -45,12 +71,18 @@ export interface BwrapExecutionRequest {
 }
 
 /**
- * 底层执行结果：完整退出码 + 完整输出（stdout/stderr 合并，未截断）。
- * 退出码语义（grep exit 1 等）由上层 Bash 工具解释，这里不做成败判定。
+ * 底层执行结果：完整退出码 + 截断后的输出文本。
+ * 输出在运行时就直接写入 agent-dir/tmp/{uuid}.txt（完整内容），内存不保留全量；
+ * `truncation.totalLines/totalBytes` 是精确统计值（非尾部缓冲的）。
+ * 退出码语义由上层 Bash 工具解释，这里不做成败判定。
  */
 export interface BwrapExecutionResult {
   exitCode: number | null;
+  /** 截断后的输出（尾部），未截断时为完整输出；空输出为空字符串。 */
   output: string;
+  /** 完整输出的文件路径；无输出时不存在。 */
+  fullOutputPath?: string;
+  truncation: TruncationResult;
 }
 
 function escapeHtml(text: string): string {
@@ -71,30 +103,87 @@ function fenceCodeBlock(code: string): string {
 const BASH_UPDATE_THROTTLE_MS = 100;
 /** 进度快照只保留尾部内容，避免大输出每 100ms 全量推给 TUI。 */
 const BASH_UPDATE_TAIL_BYTES = 64 * 1024;
+/** 内存尾部缓冲上限：必须大于 truncateTail 的默认上限（50KB / 2000 行）。 */
+const BASH_TAIL_LIMIT_BYTES = 1024 * 1024;
+
+function countNewlines(data: Buffer): number {
+  let count = 0;
+  for (const byte of data) {
+    if (byte === 0x0a) count++;
+  }
+  return count;
+}
 
 /**
- * 合并 stdout/stderr 的流式输出累积器。
- * 内存中保留全部输出供最终结果使用；进度快照只取尾部。
+ * 合并 stdout/stderr 的流式输出累积器：输出在运行时就直接写入
+ * agent-dir/tmp/{uuid}.txt（完整内容），内存只保留尾部缓冲。
+ * 大输出不会撑爆内存；最终结果只返回截断后的文本。
  */
 class BashOutput {
-  private chunks: Buffer[] = [];
+  private stream: WriteStream | undefined;
+  private writeError: Error | undefined;
+  private tail: Buffer[] = [];
+  private tailBytes = 0;
   private totalBytes = 0;
+  private totalLines = 0;
+  filePath: string | undefined;
 
   append(data: Buffer): void {
-    this.chunks.push(data);
     this.totalBytes += data.length;
+    this.totalLines += countNewlines(data);
+    if (!this.stream) {
+      const dir = join(getAgentDir(), "tmp");
+      mkdirSync(dir, { recursive: true });
+      this.filePath = join(dir, `${randomUUID()}.txt`);
+      this.stream = createWriteStream(this.filePath, { flags: "w" });
+      this.stream.on("error", (error) => {
+        this.writeError = error;
+      });
+    }
+    this.stream.write(data);
+    this.tail.push(data);
+    this.tailBytes += data.length;
+    while (this.tailBytes > BASH_TAIL_LIMIT_BYTES && this.tail.length > 1) {
+      this.tailBytes -= this.tail[0].length;
+      this.tail.shift();
+    }
+    if (this.tailBytes > BASH_TAIL_LIMIT_BYTES && this.tail.length === 1) {
+      // 单个 chunk 超过上限：截掉头部，只保留尾部
+      this.tail[0] = this.tail[0].subarray(this.tailBytes - BASH_TAIL_LIMIT_BYTES);
+      this.tailBytes = BASH_TAIL_LIMIT_BYTES;
+    }
+  }
+
+  close(): Promise<void> {
+    if (!this.stream) return Promise.resolve();
+    const stream = this.stream;
+    this.stream = undefined;
+    return new Promise((resolve) => {
+      stream.end(() => {
+        if (this.writeError) {
+          // 落盘失败（如 readonly 沙箱）：降级为纯内存模式，命令仍正常返回
+          this.filePath = undefined;
+        }
+        resolve();
+      });
+    });
+  }
+
+  /** 尾部文本（截断结果的候选，未截断时即完整输出）。 */
+  tailText(): string {
+    return Buffer.concat(this.tail, this.tailBytes).toString("utf8");
   }
 
-  toString(): string {
-    return Buffer.concat(this.chunks, this.totalBytes).toString("utf8");
+  get stats(): { totalBytes: number; totalLines: number } {
+    return { totalBytes: this.totalBytes, totalLines: this.totalLines };
   }
 
   /** 尾部快照（用于流式进度显示）。 */
   tailSnapshot(): string {
     let remaining = BASH_UPDATE_TAIL_BYTES;
     const tail: Buffer[] = [];
-    for (let i = this.chunks.length - 1; i >= 0 && remaining > 0; i--) {
-      const chunk = this.chunks[i];
+    for (let i = this.tail.length - 1; i >= 0 && remaining > 0; i--) {
+      const chunk = this.tail[i];
       if (chunk.length <= remaining) {
         tail.unshift(chunk);
         remaining -= chunk.length;
@@ -202,7 +291,14 @@ export class BwrapRuntime {
       );
     }
     if (request.requestFullAccess === true && runtime.bwrapEnabled) {
-      await this.approveFullAccess(request.ctx, request.command, request.requestFullAccessReason);
+      // 先按 approvalRules 自动判定：allow 直接放行，deny 直接拒绝，未命中才弹框
+      const decision = await evaluateBashApproval(request.command, runtime.approvalRules);
+      if (decision === "deny") {
+        throw new Error(`Command denied by bwrap approval rule: ${request.command}`);
+      }
+      if (decision === undefined) {
+        await this.approveFullAccess(request.ctx, request.command, request.requestFullAccessReason);
+      }
     }
     const operations =
       runtime.bwrapEnabled && request.requestFullAccess !== true
@@ -251,7 +347,15 @@ export class BwrapRuntime {
         signal: request.signal,
         timeout: request.timeout,
       });
-      return { exitCode, output: output.toString() };
+      await output.close();
+      const truncation = truncateTail(output.tailText());
+      return {
+        exitCode,
+        output: truncation.content,
+        ...(output.filePath && { fullOutputPath: output.filePath }),
+        // 用精确统计值覆盖尾部缓冲的估算（提示文本的行数/字节数要准确）
+        truncation: { ...truncation, ...output.stats },
+      };
     } catch (error) {
       // 底层统一把超时/中断转成可读文案（对齐 pi 内置 bash 工具）
       if (error instanceof Error && error.message.startsWith("timeout:")) {
@@ -267,6 +371,7 @@ export class BwrapRuntime {
     } finally {
       if (updateTimer) clearTimeout(updateTimer);
       if (onUpdate && dirty) emitUpdate();
+      await output.close();
     }
   }
 
@@ -287,36 +392,57 @@ export class BwrapRuntime {
     if (policy.kind === "deny") throw new Error(policy.reason);
     const description = `Allow this command to run without sandbox?\n---\n\nReason: ${escapeHtml(reason ?? "(No reason provided by model)")}\n---\n${fenceCodeBlock(command)}`;
 
-    // 单选 1：允许还是拦截（关闭对话框 = 中断并拒绝）
-    const verdict = await selectWithOptionalInput(
-      description,
-      [{ label: "Approve once" }, { label: "Block" }],
-      ctx.ui,
-      { signal: ctx.signal },
-    );
+    // 单选：允许一次 / 永久允许（写入规则）/ 拒绝 / 拒绝并附理由（弹输入框）
+    const verdict = await selectWithOptionalInput(description, FULL_ACCESS_CHOICES, ctx.ui, {
+      signal: ctx.signal,
+    });
+    // 关闭对话框 = 中断并拒绝，不循环重问
     if (verdict === undefined) {
       ctx.abort();
       throw new Error("User denied the command execution.");
     }
-    if (verdict.label === "Approve once") return;
-
-    // 单选 2 + input 组合：直接拦截还是附带理由；选 "Block with reason"
-    // 自动弹输入框。关闭对话框/取消输入/空白都按无理由拒绝，不循环重问。
-    const style = await selectWithOptionalInput(
-      "Block this command?",
-      [{ label: "Block" }, { label: "Block with reason", inputPrompt: "Why was this denied?" }],
-      ctx.ui,
-      { signal: ctx.signal },
-    );
-    if (style === undefined || style.label === "Block") {
-      throw new Error("User denied unsandboxed execution.");
+    switch (verdict.label) {
+      case ALLOW_ONCE: {
+        return;
+      }
+      case ALLOW_FOREVER: {
+        await this.persistAllowRule(ctx, command);
+        return;
+      }
+      case DENY: {
+        throw new Error("User denied unsandboxed execution.");
+      }
+      case DENY_WITH_REASON: {
+        const feedback = verdict.input?.trim() ?? "";
+        throw new Error(
+          feedback
+            ? `User denied unsandboxed execution: ${feedback}`
+            : "User denied unsandboxed execution.",
+        );
+      }
+    }
+  }
+
+  /** 把命令的权限模式写入项目 bwrap.json 的 approvalRules（allow forever）。 */
+  private async persistAllowRule(ctx: ExtensionContext, command: string): Promise<void> {
+    const patterns = await commandPatternsFor(command);
+    if (patterns.length === 0) return; // 解析失败：本次放行，不写规则
+    const newRules: ApprovalRule[] = patterns.map((pattern) => ({ action: "allow", pattern }));
+    const { project } = getBwrapConfigPaths(ctx.cwd);
+    let config: Record<string, unknown> = {};
+    if (existsSync(project)) {
+      config = JSON.parse(readFileSync(project, "utf8")) as Record<string, unknown>;
+    }
+    const existing = Array.isArray(config.approvalRules)
+      ? (config.approvalRules as ApprovalRule[])
+      : [];
+    config.approvalRules = [...existing, ...newRules];
+    await mkdir(dirname(project), { recursive: true });
+    await writeFile(project, `${JSON.stringify(config, null, 2)}\n`, "utf8");
+    // 更新缓存的规则，立即生效
+    if (this.resolved) {
+      this.resolved.approvalRules = [...this.resolved.approvalRules, ...newRules];
     }
-    const feedback = style.input?.trim() ?? "";
-    throw new Error(
-      feedback
-        ? `User denied unsandboxed execution: ${feedback}`
-        : "User denied unsandboxed execution.",
-    );
   }
 
   private registerCommands(pi: ExtensionAPI): void {

package/src/claude-code/shell.ts

@@ -1,17 +1,9 @@
-import { randomUUID } from "node:crypto";
 import { readFileSync } from "node:fs";
-import { mkdir, writeFile } from "node:fs/promises";
-import { join } from "node:path";
+import { readFile } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
 
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
-import {
-  type BashToolDetails,
-  DEFAULT_MAX_BYTES,
-  formatSize,
-  getAgentDir,
-  truncateTail,
-} from "@earendil-works/pi-coding-agent";
+import { type BashToolDetails, formatSize } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
 
 import { type BwrapRuntime, createBwrapRuntime } from "../bwrap/runtime.js";
@@ -42,24 +34,17 @@ function formatBashError(exitCode: number | null, output: string): string {
 }
 
 /**
- * 成功路径：truncateTail 截断 + 全量落盘临时文件，
- * 提示文本 `[Showing lines X-Y of N. Full output: path]`。
+ * 成功路径：消费 runtime 的截断结果（输出已由 runtime 截断并落盘），
+ * 截断时追加 `[Showing lines X-Y of N. Full output: path]` 提示。
  * opencode 套件的 bash 工具复用同一逻辑。
  */
-export async function formatBashSuccess(
-  output: string,
-): Promise<{ content: { type: "text"; text: string }[]; details: BashToolDetails | undefined }> {
-  const truncation = truncateTail(output);
-  let text = truncation.content || "(no output)";
-  let details: BashToolDetails | undefined;
-  if (truncation.truncated) {
-    // 完整输出落盘到 agent 数据目录的 tmp 子目录（与 pi 的 agent 状态同处，
-    // 模型可读；系统临时目录可能被清理）
-    const dir = join(getAgentDir(), "tmp");
-    await mkdir(dir, { recursive: true });
-    const fullOutputPath = join(dir, `${randomUUID()}.txt`);
-    await writeFile(fullOutputPath, output, "utf8");
-    details = { truncation, fullOutputPath };
+export function formatBashSuccess(result: Awaited<ReturnType<BwrapRuntime["execute"]>>): {
+  content: { type: "text"; text: string }[];
+  details: BashToolDetails | undefined;
+} {
+  const { output, truncation, fullOutputPath } = result;
+  let text = output || "(no output)";
+  if (fullOutputPath && truncation.truncated) {
     const startLine = truncation.totalLines - truncation.outputLines + 1;
     const endLine = truncation.totalLines;
     if (truncation.lastLinePartial) {
@@ -70,10 +55,13 @@ export async function formatBashSuccess(
     } else if (truncation.truncatedBy === "lines") {
       text += `\n\n[Showing lines ${startLine}-${endLine} of ${truncation.totalLines}. Full output: ${fullOutputPath}]`;
     } else {
-      text += `\n\n[Showing lines ${startLine}-${endLine} of ${truncation.totalLines} (${formatSize(truncation.maxBytes ?? DEFAULT_MAX_BYTES)} limit). Full output: ${fullOutputPath}]`;
+      text += `\n\n[Showing lines ${startLine}-${endLine} of ${truncation.totalLines} (${formatSize(truncation.maxBytes)} limit). Full output: ${fullOutputPath}]`;
     }
   }
-  return { content: [{ type: "text", text }], details };
+  return {
+    content: [{ type: "text", text }],
+    details: fullOutputPath && truncation.truncated ? { truncation, fullOutputPath } : undefined,
+  };
 }
 
 /**
@@ -151,13 +139,16 @@ export function registerShellTools(
       }
 
       // 对齐 Claude Code：非 0 退出码视为错误（不做 grep/find 等命令语义化特判，
-      // 任何非 0 都抛错）；成功路径返回纯输出
+      // 任何非 0 都抛错）；错误文本用完整输出（从落盘文件读取，必要时头尾截断）
       if (result.exitCode !== 0 && result.exitCode !== null) {
-        throw new Error(formatBashError(result.exitCode, result.output), {
+        const full = result.fullOutputPath
+          ? await readFile(result.fullOutputPath, "utf8")
+          : result.output;
+        throw new Error(formatBashError(result.exitCode, full), {
           cause: result,
         });
       }
-      return formatBashSuccess(result.output);
+      return formatBashSuccess(result);
     },
   });
 }

package/src/claude-code/skills/claude-code-tools/SKILL.md

@@ -57,9 +57,12 @@ The capitalized tools below follow Claude Code behavior with a few deliberate de
 
 ## Bash
 
-- Commands run through the bwrap sandbox (modes: `allow-all` / `workspace-write` / `allow-net` / `readonly`), switchable via `/bwrap-*` commands. `dangerouslyDisableSandbox: true` requests one-time unsandboxed execution and needs user approval (denied in headless sessions).
+- Commands run through the bwrap sandbox (modes: `allow-all` / `workspace-write` / `allow-net` / `readonly`), switchable via `/bwrap-*` commands. `dangerouslyDisableSandbox: true` requests one-time unsandboxed execution. Approval flow: commands are parsed (tree-sitter, including nested `$(...)`) and matched against `approvalRules` from `bwrap.json` — an `allow` rule auto-approves, a `deny` rule rejects outright (last matching rule wins), and only unmatched commands show the approval dialog. In headless sessions unsandboxed execution is denied.
 - `timeout` is in milliseconds, default 120000, max 600000. `workdir` overrides the working directory.
-- **Deviation from Claude Code:** no auto-backgrounding on timeout — a timed-out command is killed and the error reports the timeout.
+- **Non-zero exit code is a tool failure**: the error text starts with `Exit code N` followed by the full output (head/tail-truncated at 10000 chars if larger). **Deviation from Claude Code:** no command-semantics special cases — `grep` with no matches (exit 1), `diff` differences, `test` false, etc. all fail like any other non-zero exit.
+- Output is streamed to a file under `agent-dir/tmp/<uuid>.txt` during execution; the tool result only contains the truncated tail (2000 lines / 50 KB). On truncation a note is appended: `[Showing lines X-Y of N. Full output: <path>]` — read that file for the complete output. In a read-only sandbox where the write fails, the result degrades to the in-memory tail only.
+- **Deviation from Claude Code:** no auto-backgrounding on timeout — a timed-out command is killed and the error reports `Command timed out after N milliseconds`.
+- The lowercase opencode-style `bash` tool differs: it **never throws** on non-zero exit — it returns the output plus a `Command exited with code N.` status text block; a timeout returns `Command exceeded timeout of N ms. Retry with a larger timeout...` instead of failing.
 
 ## TodoWrite
 

package/src/lib/wasm.ts

@@ -0,0 +1,9 @@
+/**
+ * wasm —— 运行时定位 npm 包内的 wasm 文件。
+ * Node ESM 下 `import.meta.resolve` 返回 file URL（受包 exports 约束）。
+ */
+
+export function resolvePackageWasm(packageName: string, subpath: string): URL {
+  const resolved = import.meta.resolve(`${packageName}/${subpath}`);
+  return new URL(resolved);
+}

package/src/opencode/bash.ts

@@ -2,16 +2,25 @@ import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
 
 import { type BwrapRuntime, createBwrapRuntime } from "../bwrap/runtime.js";
-import { formatBashSuccess } from "../claude-code/shell.js";
 import { resolveWorkdir } from "../lib/path.js";
 
 const DEFAULT_TIMEOUT_MS = 120_000;
 const MAX_TIMEOUT_MS = 600_000;
 
-export default function opencodeBash(pi: ExtensionAPI): void {
+/** 对齐上游 opencode 的截断提示文案（tools/BashTool/bash.ts）。 */
+const CAPTURE_TRUNCATED_NOTICE = "[output capture truncated at the in-memory safety limit]";
+
+/**
+ * 对齐上游 opencode（packages/core/src/tool/bash.ts）：
+ * 命令失败（非 0 退出码）与超时都不抛错，输出与状态文本一起返回，
+ * 由模型根据 `Command exited with code N.` 自行判断。
+ */
+export default function opencodeBash(
+  pi: ExtensionAPI,
+  runtime: BwrapRuntime = createBwrapRuntime(),
+): void {
   // 每个扩展实例持有自己的 runtime：不依赖模块级全局状态，状态随扩展
   // 实例生命周期（进程启动 / /reload / session 切换时工厂重建即重置）。
-  const runtime = createBwrapRuntime();
   runtime.setup(pi);
   pi.registerTool({
     name: "bash",
@@ -68,23 +77,39 @@ export default function opencodeBash(pi: ExtensionAPI): void {
         });
       } catch (error) {
         if (!(error instanceof Error)) throw error;
-        const timeoutMatch = /Command timed out after [\d.]+ seconds/.exec(error.message);
-        const message = timeoutMatch
-          ? error.message.slice(0, timeoutMatch.index) +
-            `Command timed out after ${timeout} milliseconds` +
-            error.message.slice(timeoutMatch.index + timeoutMatch[0].length)
-          : error.message;
-        throw new Error(message, { cause: error });
+        // 对齐上游 opencode：超时不抛错，返回提示文本（丢弃部分输出）
+        if (/Command timed out after [\d.]+ seconds/.test(error.message)) {
+          return {
+            content: [
+              {
+                type: "text" as const,
+                text: `Command exceeded timeout of ${timeout} ms. Retry with a larger timeout if the command is expected to take longer.`,
+              },
+              { type: "text" as const, text: "Command timed out before completion." },
+            ],
+            details: { timeout: true },
+          };
+        }
+        throw error;
       }
 
-      // 任何非 0 退出码都视为失败（不做命令语义化特判）
-      if (result.exitCode !== 0 && result.exitCode !== null) {
-        const status = `Command exited with code ${result.exitCode}`;
-        throw new Error(result.output ? `${result.output}\n\n${status}` : status, {
-          cause: result,
-        });
+      // 命令失败（非 0 退出码）不抛错：输出与状态文本一起返回
+      let text = result.output || "(no output)";
+      if (result.truncation.truncated) {
+        text += `\n\n${CAPTURE_TRUNCATED_NOTICE}`;
+        if (result.fullOutputPath) text += `\nFull output: ${result.fullOutputPath}`;
       }
-      return formatBashSuccess(result.output);
+      return {
+        content: [
+          { type: "text" as const, text },
+          { type: "text" as const, text: `Command exited with code ${result.exitCode}.` },
+        ],
+        details: {
+          exitCode: result.exitCode,
+          truncated: result.truncation.truncated,
+          ...(result.fullOutputPath && { fullOutputPath: result.fullOutputPath }),
+        },
+      };
     },
   });
 }