@trim21/personal-pi-extensions 0.1.561 → 0.1.562

package/README.md

@@ -50,6 +50,10 @@ bash 工具（opencode 风格 `bash`、Claude Code 风格 `Bash`）注册了 `da
 
 建议模型不确定时先尝试沙箱模式，若因沙箱限制失败，再以完整权限重试。
 
+另一条提权路径是编辑类工具（`Edit` / `Write` / `lsp-rename` / `web_fetch`）写工作区外路径，同样经审批框放行。
+
+对话中执行 `/bwrap-deny-request` 后，上述两类提权请求都不再弹审批框，直接按用户无理由拒绝处理（bash 报 `User denied unsandboxed execution.`，编辑类工具报 `user deny <tool>: blocked`）；`/bwrap-allow-request` 恢复审批。该开关只影响提权路径，沙箱内可执行的命令与工作区内写入不受影响，新会话开始时复位。
+
 ### 保护目录
 
 `.pi`、`.agent` 即使在 `workspace-write` 模式下也始终只读；`.git` 同样只读：工作区根是 git 仓库时保护根 `.git`，根不是 git 仓库时才递归扫描嵌套仓库（monorepo 子仓库，跳过 `node_modules`、`.venv` 等包目录）。
@@ -62,6 +66,8 @@ bash 工具（opencode 风格 `bash`、Claude Code 风格 `Bash`）注册了 `da
 - `/bwrap-allow-all` — 切换到 allow-all 模式
 - `/bwrap-workspace-write` — 切换到 workspace-write 模式
 - `/bwrap-readonly` — 切换到 readonly 模式
+- `/bwrap-deny-request` — 拒绝模型的非沙盒请求，不再弹审批框
+- `/bwrap-allow-request` — 恢复非沙盒请求的审批
 
 ### 配置
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trim21/personal-pi-extensions",
-  "version": "0.1.561",
+  "version": "0.1.562",
   "type": "module",
   "description": "Custom pi coding-agent extensions: bwrap sandbox, workspace guard, opencode edit, and more",
   "keywords": [

package/src/bwrap/runtime.ts

@@ -18,6 +18,7 @@ import { type TObject, Type } from "typebox";
 import { type CommandSpec, parseCommand } from "../lib/cli.js";
 import { fenceCodeBlock } from "../lib/markdown.js";
 import { formatDisplayPath } from "../lib/path.js";
+import { requestPolicy } from "../lib/request-policy.js";
 import { type SelectAction, selectMultiple, selectWithOptionalInput } from "../lib/ui.js";
 import { type ApprovalRule, evaluateBashApproval, matchRule } from "./approval-rules.js";
 import { commandPatternsFor } from "./approval-suggest.js";
@@ -283,6 +284,12 @@ function describeNetwork(resolved: ResolvedBwrap): string {
   return "network access is unrestricted";
 }
 
+/**
+ * 用户无理由拒绝非沙盒请求的文案。`/bwrap-deny-request` 生效时的拒绝必须与
+ * 用户在审批框点 Deny 完全一致——模型看到的是一次普通拒绝，而不是另一套错误语义。
+ */
+const UNSANDBOXED_DENIED = "User denied unsandboxed execution.";
+
 /** 命令没经沙箱时沿用 prompt 里的说法，给出在沙盒外重跑的手段。 */
 const SANDBOX_ESCAPE_HATCH =
   "[Sandbox] If the command needs more than that, use the `dangerouslyDisableSandbox` parameter to request unsandboxed execution; the user must approve this request.";
@@ -325,6 +332,7 @@ export class BwrapRuntime {
       this.sandboxDisabled = pi.getFlag("no-bwrap") === true && ctx.hasUI;
       this.resolved = undefined;
       this.bwrapUnavailable = false;
+      requestPolicy.setDenyRequests(false);
       if (process.platform === "win32") {
         // Windows 没有 bubblewrap：不做 bwrap 检测、不显示 bwrap 状态，
         // 每条 bash 命令在 execute 时逐条人工审批，模型无需知道 bwrap 的存在。
@@ -346,7 +354,7 @@ export class BwrapRuntime {
           return;
         }
       }
-      ctx.ui.setStatus("bwrap", ctx.ui.theme.fg("accent", `bwrap: ${runtime.mode}`));
+      ctx.ui.setStatus("bwrap", ctx.ui.theme.fg("accent", this.statusLabel(runtime.mode)));
       ctx.ui.notify(
         runtime.bwrapEnabled
           ? `bwrap initialized (${runtime.mode})`
@@ -373,9 +381,14 @@ export class BwrapRuntime {
         !isWindows && this.bwrapUnavailable
           ? " bwrap is unavailable (binary not found): bash commands are refused unless the user explicitly approves unsandboxed execution."
           : "";
+      const denyRequestsText =
+        !isWindows && requestPolicy.deniesRequests()
+          ? " Unsandboxed execution is currently denied by the user: `dangerouslyDisableSandbox` and writes outside the workspace are refused without approval."
+          : "";
       return {
         systemPrompt:
-          event.systemPrompt + `\n\n## Command Execution\n${modeText}${unavailableText}\n`,
+          event.systemPrompt +
+          `\n\n## Command Execution\n${modeText}${unavailableText}${denyRequestsText}\n`,
       };
     });
 
@@ -418,6 +431,11 @@ export class BwrapRuntime {
     // （allow-all 模式是显式 opt-out，仍直接执行）。
     const needsApproval = request.requestFullAccess === true || (isWindows && runtime.bwrapEnabled);
     if (needsApproval && runtime.bwrapEnabled) {
+      // /bwrap-deny-request：非沙盒请求直接拒绝——审批规则与审批框都不再参与，
+      // 拒绝文案与用户点 Deny 相同，直到用户用 /bwrap-allow-request 恢复审批。
+      if (request.requestFullAccess === true && requestPolicy.deniesRequests()) {
+        throw new Error(UNSANDBOXED_DENIED);
+      }
       // 先按 approvalRules 自动判定：allow 直接放行，deny 直接拒绝，未命中才弹框
       const decision = await evaluateBashApproval(request.command, runtime.approvalRules);
       if (decision === "deny") {
@@ -572,7 +590,7 @@ export class BwrapRuntime {
         if (foreverApprovedPattern.length > 0) {
           await this.persistAllowRule(ctx, command, foreverApprovedPattern);
         }
-        throw new Error("User denied unsandboxed execution.");
+        throw new Error(UNSANDBOXED_DENIED);
       }
       case DENY_WITH_REASON: {
         if (foreverApprovedPattern.length > 0) {
@@ -757,6 +775,18 @@ export class BwrapRuntime {
         description: "Reload bwrap config and restart the network stack",
         flags: Type.Object({}),
       },
+      "bwrap-deny-request": {
+        name: "bwrap-deny-request",
+        usage: "",
+        description: "Deny unsandboxed execution requests without approval",
+        flags: Type.Object({}),
+      },
+      "bwrap-allow-request": {
+        name: "bwrap-allow-request",
+        usage: "",
+        description: "Require user approval for unsandboxed execution requests again",
+        flags: Type.Object({}),
+      },
     } as const satisfies Record<string, CommandSpec<TObject>>;
 
     pi.registerCommand("bwrap", {
@@ -809,13 +839,26 @@ export class BwrapRuntime {
           this.reload(commandCtx);
         }),
     });
+
+    for (const [name, deny] of [
+      ["bwrap-deny-request", true],
+      ["bwrap-allow-request", false],
+    ] as const) {
+      pi.registerCommand(name, {
+        description: specs[name].description,
+        handler: (args, ctx) =>
+          this.runCommand(pi, specs[name], args, ctx, (commandCtx) =>
+            this.setDenyRequests(deny, commandCtx),
+          ),
+      });
+    }
   }
 
   private reload(ctx: ExtensionCommandContext): void {
     this.resolved = undefined;
     this.bwrapUnavailable = false;
     const runtime = this.resolve(ctx);
-    ctx.ui.setStatus("bwrap", ctx.ui.theme.fg("accent", `bwrap: ${runtime.mode}`));
+    ctx.ui.setStatus("bwrap", ctx.ui.theme.fg("accent", this.statusLabel(runtime.mode)));
     ctx.ui.notify(`bwrap config reloaded (mode: ${runtime.mode})`, "info");
   }
 
@@ -825,7 +868,7 @@ export class BwrapRuntime {
       return;
     }
     this.setMode(ctx.cwd, mode);
-    ctx.ui.setStatus("bwrap", ctx.ui.theme.fg("accent", `bwrap: ${mode}`));
+    ctx.ui.setStatus("bwrap", ctx.ui.theme.fg("accent", this.statusLabel(mode)));
     notifyMode(ctx, mode);
     pi.sendMessage({
       customType: "info",
@@ -834,6 +877,29 @@ export class BwrapRuntime {
     });
   }
 
+  /** 状态行文案：模式 + 非沙盒请求策略（拒绝时标注，便于解释模型的请求为何被拒）。 */
+  private statusLabel(mode: BwrapMode): string {
+    return `bwrap: ${mode}${requestPolicy.deniesRequests() ? " (requests denied)" : ""}`;
+  }
+
+  /**
+   * 切换非沙盒请求策略：拒绝时模型的提权请求（bash 的 `dangerouslyDisableSandbox`、
+   * 编辑类工具的工作区外写入）直接按用户拒绝处理，不再弹审批框。
+   */
+  private setDenyRequests(deny: boolean, ctx: ExtensionCommandContext): void {
+    requestPolicy.setDenyRequests(deny);
+    ctx.ui.notify(
+      deny
+        ? "Non-sandbox requests are denied without approval; /bwrap-allow-request restores approval."
+        : "Non-sandbox requests require user approval again.",
+      "info",
+    );
+    const runtime = this.resolve(ctx);
+    if (ctx.hasUI && runtime.bwrapEnabled && !this.bwrapUnavailable) {
+      ctx.ui.setStatus("bwrap", ctx.ui.theme.fg("accent", this.statusLabel(runtime.mode)));
+    }
+  }
+
   private runCommand(
     pi: ExtensionAPI,
     spec: CommandSpec<TObject>,

package/src/lib/request-policy.ts

@@ -0,0 +1,29 @@
+/**
+ * 非沙盒请求策略：用户执行 `/bwrap-deny-request` 后，模型的提权请求
+ * （bash 的 `dangerouslyDisableSandbox`、编辑类工具的工作区外写入）不再弹审批框，
+ * 一律按用户「无理由拒绝」处理；`/bwrap-allow-request` 恢复审批。
+ *
+ * 状态由闭包持有（AGENTS.md：不用模块级可变变量维护跨调用状态）。
+ * 模块级单例让互相独立的扩展入口（bwrap runtime、claude-code / opencode 的文件工具、
+ * lsp-rename、web_fetch）共享同一份会话状态——各入口分别 createRequestPolicy()
+ * 会得到互不相通的策略，等于开关只对其中一半生效。
+ */
+
+export interface RequestPolicy {
+  /** 是否拒绝一切非沙盒请求（不弹审批框，直接拒绝）。 */
+  deniesRequests(): boolean;
+  setDenyRequests(deny: boolean): void;
+}
+
+export function createRequestPolicy(): RequestPolicy {
+  let denyRequests = false;
+  return {
+    deniesRequests: () => denyRequests,
+    setDenyRequests(deny: boolean) {
+      denyRequests = deny;
+    },
+  };
+}
+
+/** 进程级共享的策略实例；由 `/bwrap-deny-request` / `/bwrap-allow-request` 切换，session_start 复位。 */
+export const requestPolicy = createRequestPolicy();

package/src/lib/write-guard.ts

@@ -8,6 +8,8 @@
  * - Headless sessions (no UI) reject outside writes outright.
  * - Windows (no sandbox fallback): writes are restricted to the workspace;
  *   outside paths are rejected outright, with no approval path.
+ * - `/bwrap-deny-request` (non-sandbox request policy) refuses outside writes
+ *   outright, with the same error as the user picking "Block".
  *
  * Callers have already parsed their tool arguments, so the guard only takes the
  * resolved pieces: the raw target path and the pending change (oldText/newText).
@@ -20,6 +22,7 @@ import { generateUnifiedPatch } from "@earendil-works/pi-coding-agent";
 
 import { applyEdit, normalizeToLF } from "../opencode/edit-engine.js";
 import { fenceCodeBlock } from "./markdown.js";
+import { requestPolicy } from "./request-policy.js";
 
 const ALWAYS_ALLOW = ["/tmp"];
 const MAX_PREVIEW_LINES = 100;
@@ -133,6 +136,12 @@ export async function guardWriteAccess(
   const { absolutePath } = opts;
   if (isPathAllowed(absolutePath, ctx.cwd)) return;
 
+  // 非沙盒请求策略生效时不弹审批框：工作区外写入按用户点 "Block"（无理由）处理。
+  // 放在 win32 / 无 UI 分支之前，策略优先级高于各平台的降级路径。
+  if (requestPolicy.deniesRequests()) {
+    throw new Error(`user deny ${opts.toolName}: blocked`);
+  }
+
   if (process.platform === "win32") {
     // Windows 上退化为「只能写工作区」：无沙箱兜底，工作区外写入一律拒绝，
     // 不提供审批路径。