@trim21/personal-pi-extensions 0.1.561 → 0.1.564

package/README.md

@@ -50,6 +50,10 @@ bash 工具（opencode 风格 `bash`、Claude Code 风格 `Bash`）注册了 `da
 
 建议模型不确定时先尝试沙箱模式，若因沙箱限制失败，再以完整权限重试。
 
+另一条提权路径是编辑类工具（`Edit` / `Write` / `lsp-rename` / `web_fetch`）写工作区外路径，同样经审批框放行。
+
+对话中执行 `/bwrap-deny-request` 后，上述两类提权请求都不再弹审批框，直接按用户无理由拒绝处理（bash 报 `User denied unsandboxed execution.`，编辑类工具报 `user deny <tool>: blocked`）；`/bwrap-allow-request` 恢复审批。该开关只影响提权路径，沙箱内可执行的命令与工作区内写入不受影响，新会话开始时复位。
+
 ### 保护目录
 
 `.pi`、`.agent` 即使在 `workspace-write` 模式下也始终只读；`.git` 同样只读：工作区根是 git 仓库时保护根 `.git`，根不是 git 仓库时才递归扫描嵌套仓库（monorepo 子仓库，跳过 `node_modules`、`.venv` 等包目录）。
@@ -62,6 +66,8 @@ bash 工具（opencode 风格 `bash`、Claude Code 风格 `Bash`）注册了 `da
 - `/bwrap-allow-all` — 切换到 allow-all 模式
 - `/bwrap-workspace-write` — 切换到 workspace-write 模式
 - `/bwrap-readonly` — 切换到 readonly 模式
+- `/bwrap-deny-request` — 拒绝模型的非沙盒请求，不再弹审批框
+- `/bwrap-allow-request` — 恢复非沙盒请求的审批
 
 ### 配置
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trim21/personal-pi-extensions",
-  "version": "0.1.561",
+  "version": "0.1.564",
   "type": "module",
   "description": "Custom pi coding-agent extensions: bwrap sandbox, workspace guard, opencode edit, and more",
   "keywords": [
@@ -24,8 +24,8 @@
     "format": "prettier --write .",
     "test": "vitest run",
     "test:coverage": "vitest run --coverage",
-    "sandbox": "tsx bin/sandbox.ts",
-    "aft-search": "tsx bin/aft-search.ts",
+    "sandbox": "jiti bin/sandbox.ts",
+    "aft-search": "jiti bin/aft-search.ts",
     "build:holder": "esbuild src/bwrap/holder.ts --format=esm --target=node24 --outfile=src/bwrap/holder.js",
     "prepare": "husky"
   },
@@ -56,10 +56,10 @@
     "eslint-plugin-unicorn": "74.0.0",
     "eslint-plugin-unused-imports": "4.4.1",
     "husky": "^9.1.7",
+    "jiti": "^2.7.0",
     "lint-staged": "^17.3.0",
     "prettier": "^3.9.6",
     "shlex": "^3.0.0",
-    "tsx": "^4.23.12",
     "typebox": "1.3.1",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
     "typescript-eslint": "^8.67.0",

package/src/bwrap/runtime.ts

@@ -18,6 +18,7 @@ import { type TObject, Type } from "typebox";
 import { type CommandSpec, parseCommand } from "../lib/cli.js";
 import { fenceCodeBlock } from "../lib/markdown.js";
 import { formatDisplayPath } from "../lib/path.js";
+import { createRequestPolicy, type RequestPolicy } from "../lib/request-policy.js";
 import { type SelectAction, selectMultiple, selectWithOptionalInput } from "../lib/ui.js";
 import { type ApprovalRule, evaluateBashApproval, matchRule } from "./approval-rules.js";
 import { commandPatternsFor } from "./approval-suggest.js";
@@ -283,6 +284,12 @@ function describeNetwork(resolved: ResolvedBwrap): string {
   return "network access is unrestricted";
 }
 
+/**
+ * 用户无理由拒绝非沙盒请求的文案。`/bwrap-deny-request` 生效时的拒绝必须与
+ * 用户在审批框点 Deny 完全一致——模型看到的是一次普通拒绝，而不是另一套错误语义。
+ */
+const UNSANDBOXED_DENIED = "User denied unsandboxed execution.";
+
 /** 命令没经沙箱时沿用 prompt 里的说法，给出在沙盒外重跑的手段。 */
 const SANDBOX_ESCAPE_HATCH =
   "[Sandbox] If the command needs more than that, use the `dangerouslyDisableSandbox` parameter to request unsandboxed execution; the user must approve this request.";
@@ -313,6 +320,15 @@ export class BwrapRuntime {
   private bwrapUnavailable = false;
   /** net-allowlist 首次执行时解析一次 mihomo 路径，之后随 runtime 复用，不逐命令扫描 PATH。 */
   private mihomoPath: string | undefined;
+  /**
+   * 非沙盒请求策略由创建方注入：聚合入口把它与文件工具的 write-guard 共享同一实例，
+   * 独立入口各持一份、经 pi.events 同步。
+   */
+  private readonly policy: RequestPolicy;
+
+  constructor(policy: RequestPolicy) {
+    this.policy = policy;
+  }
 
   setup(pi: ExtensionAPI): void {
     pi.registerFlag("no-bwrap", {
@@ -325,6 +341,7 @@ export class BwrapRuntime {
       this.sandboxDisabled = pi.getFlag("no-bwrap") === true && ctx.hasUI;
       this.resolved = undefined;
       this.bwrapUnavailable = false;
+      this.policy.setDenyRequests(false);
       if (process.platform === "win32") {
         // Windows 没有 bubblewrap：不做 bwrap 检测、不显示 bwrap 状态，
         // 每条 bash 命令在 execute 时逐条人工审批，模型无需知道 bwrap 的存在。
@@ -346,7 +363,7 @@ export class BwrapRuntime {
           return;
         }
       }
-      ctx.ui.setStatus("bwrap", ctx.ui.theme.fg("accent", `bwrap: ${runtime.mode}`));
+      ctx.ui.setStatus("bwrap", ctx.ui.theme.fg("accent", this.statusLabel(runtime.mode)));
       ctx.ui.notify(
         runtime.bwrapEnabled
           ? `bwrap initialized (${runtime.mode})`
@@ -373,9 +390,14 @@ export class BwrapRuntime {
         !isWindows && this.bwrapUnavailable
           ? " bwrap is unavailable (binary not found): bash commands are refused unless the user explicitly approves unsandboxed execution."
           : "";
+      const denyRequestsText =
+        !isWindows && this.policy.deniesRequests()
+          ? " Unsandboxed execution is currently denied by the user: `dangerouslyDisableSandbox` and writes outside the workspace are refused without approval."
+          : "";
       return {
         systemPrompt:
-          event.systemPrompt + `\n\n## Command Execution\n${modeText}${unavailableText}\n`,
+          event.systemPrompt +
+          `\n\n## Command Execution\n${modeText}${unavailableText}${denyRequestsText}\n`,
       };
     });
 
@@ -418,6 +440,11 @@ export class BwrapRuntime {
     // （allow-all 模式是显式 opt-out，仍直接执行）。
     const needsApproval = request.requestFullAccess === true || (isWindows && runtime.bwrapEnabled);
     if (needsApproval && runtime.bwrapEnabled) {
+      // /bwrap-deny-request：非沙盒请求直接拒绝——审批规则与审批框都不再参与，
+      // 拒绝文案与用户点 Deny 相同，直到用户用 /bwrap-allow-request 恢复审批。
+      if (request.requestFullAccess === true && this.policy.deniesRequests()) {
+        throw new Error(UNSANDBOXED_DENIED);
+      }
       // 先按 approvalRules 自动判定：allow 直接放行，deny 直接拒绝，未命中才弹框
       const decision = await evaluateBashApproval(request.command, runtime.approvalRules);
       if (decision === "deny") {
@@ -572,7 +599,7 @@ export class BwrapRuntime {
         if (foreverApprovedPattern.length > 0) {
           await this.persistAllowRule(ctx, command, foreverApprovedPattern);
         }
-        throw new Error("User denied unsandboxed execution.");
+        throw new Error(UNSANDBOXED_DENIED);
       }
       case DENY_WITH_REASON: {
         if (foreverApprovedPattern.length > 0) {
@@ -757,6 +784,18 @@ export class BwrapRuntime {
         description: "Reload bwrap config and restart the network stack",
         flags: Type.Object({}),
       },
+      "bwrap-deny-request": {
+        name: "bwrap-deny-request",
+        usage: "",
+        description: "Deny unsandboxed execution requests without approval",
+        flags: Type.Object({}),
+      },
+      "bwrap-allow-request": {
+        name: "bwrap-allow-request",
+        usage: "",
+        description: "Require user approval for unsandboxed execution requests again",
+        flags: Type.Object({}),
+      },
     } as const satisfies Record<string, CommandSpec<TObject>>;
 
     pi.registerCommand("bwrap", {
@@ -809,13 +848,26 @@ export class BwrapRuntime {
           this.reload(commandCtx);
         }),
     });
+
+    for (const [name, deny] of [
+      ["bwrap-deny-request", true],
+      ["bwrap-allow-request", false],
+    ] as const) {
+      pi.registerCommand(name, {
+        description: specs[name].description,
+        handler: (args, ctx) =>
+          this.runCommand(pi, specs[name], args, ctx, (commandCtx) =>
+            this.setDenyRequests(deny, commandCtx),
+          ),
+      });
+    }
   }
 
   private reload(ctx: ExtensionCommandContext): void {
     this.resolved = undefined;
     this.bwrapUnavailable = false;
     const runtime = this.resolve(ctx);
-    ctx.ui.setStatus("bwrap", ctx.ui.theme.fg("accent", `bwrap: ${runtime.mode}`));
+    ctx.ui.setStatus("bwrap", ctx.ui.theme.fg("accent", this.statusLabel(runtime.mode)));
     ctx.ui.notify(`bwrap config reloaded (mode: ${runtime.mode})`, "info");
   }
 
@@ -825,7 +877,7 @@ export class BwrapRuntime {
       return;
     }
     this.setMode(ctx.cwd, mode);
-    ctx.ui.setStatus("bwrap", ctx.ui.theme.fg("accent", `bwrap: ${mode}`));
+    ctx.ui.setStatus("bwrap", ctx.ui.theme.fg("accent", this.statusLabel(mode)));
     notifyMode(ctx, mode);
     pi.sendMessage({
       customType: "info",
@@ -834,6 +886,29 @@ export class BwrapRuntime {
     });
   }
 
+  /** 状态行文案：模式 + 非沙盒请求策略（拒绝时标注，便于解释模型的请求为何被拒）。 */
+  private statusLabel(mode: BwrapMode): string {
+    return `bwrap: ${mode}${this.policy.deniesRequests() ? " (requests denied)" : ""}`;
+  }
+
+  /**
+   * 切换非沙盒请求策略：拒绝时模型的提权请求（bash 的 `dangerouslyDisableSandbox`、
+   * 编辑类工具的工作区外写入）直接按用户拒绝处理，不再弹审批框。
+   */
+  private setDenyRequests(deny: boolean, ctx: ExtensionCommandContext): void {
+    this.policy.setDenyRequests(deny);
+    ctx.ui.notify(
+      deny
+        ? "Non-sandbox requests are denied without approval; /bwrap-allow-request restores approval."
+        : "Non-sandbox requests require user approval again.",
+      "info",
+    );
+    const runtime = this.resolve(ctx);
+    if (ctx.hasUI && runtime.bwrapEnabled && !this.bwrapUnavailable) {
+      ctx.ui.setStatus("bwrap", ctx.ui.theme.fg("accent", this.statusLabel(runtime.mode)));
+    }
+  }
+
   private runCommand(
     pi: ExtensionAPI,
     spec: CommandSpec<TObject>,
@@ -850,6 +925,7 @@ export class BwrapRuntime {
   }
 }
 
-export function createBwrapRuntime(): BwrapRuntime {
-  return new BwrapRuntime();
+/** 缺省自建一份不跨入口同步的策略；入口通常显式传入 `createRequestPolicy(pi.events)`。 */
+export function createBwrapRuntime(policy: RequestPolicy = createRequestPolicy()): BwrapRuntime {
+  return new BwrapRuntime(policy);
 }

package/src/claude-code/files.ts

@@ -20,6 +20,7 @@ import { createLspManager, type LspService, type LspServiceOptions } from "../li
 import { registerLspRenameTool } from "../lib/lsp/rename-tool.js";
 import { formatSubtitlePath } from "../lib/path.js";
 import type { ToolPendant } from "../lib/pendant.ts";
+import { createRequestPolicy, type RequestPolicy } from "../lib/request-policy.js";
 import { guardWriteAccess } from "../lib/write-guard.js";
 import {
   type ClaudeCodeState,
@@ -230,6 +231,7 @@ export function registerFileTools(
   pi: ExtensionAPI,
   state: ClaudeCodeState,
   getService: () => LspService,
+  policy: RequestPolicy,
 ): void {
   pi.registerTool({
     name: "Read",
@@ -399,6 +401,7 @@ export function registerFileTools(
           newText: params.new_string,
           replaceAll: params.replace_all,
         },
+        policy,
       });
       const [message, details, diagnostics] = await withFileMutationQueue<
         [string, FileToolDetails, DiagnosticReport]
@@ -594,6 +597,7 @@ export function registerFileTools(
         toolName: "Write",
         absolutePath: filePath,
         change: { oldText: "", newText: params.content },
+        policy,
       });
       const [message, details, diagnostics] = await withFileMutationQueue<
         [string, FileToolDetails, DiagnosticReport]
@@ -686,14 +690,25 @@ function restoreFileReads(
   }
 }
 
+export interface ClaudeCodeFileToolOptions extends LspServiceOptions {
+  /** 与 bash runtime 共享的非沙盒请求策略；独立入口不传，自建一份。 */
+  policy?: RequestPolicy;
+}
+
 /**
  * 独立扩展入口：files.ts 可单独经 `-e claude-code/files.ts` 加载（spawn-agent
  * 子代理把 Read/Edit/Write 工具名映射到本文件），无需经 index.ts。reads
  * state 归本文件所有：扩展实例内创建，并随 session 事件从历史分支恢复，
  * 与主进程 index.ts 聚合加载时的行为一致。
  */
-export default function claudeCodeFileTools(pi: ExtensionAPI, options?: LspServiceOptions): void {
+export default function claudeCodeFileTools(
+  pi: ExtensionAPI,
+  options?: ClaudeCodeFileToolOptions,
+): void {
   const state = createClaudeCodeState();
+  // 聚合入口（index.ts）注入与 bash runtime 共享的那一份；独立入口（spawn-agent
+  // 按工具名 `-e` 加载本文件）自建一份，靠 pi.events 跟随同一开关。
+  const policy = options?.policy ?? createRequestPolicy(pi.events);
 
   // LSP 专属工具（lsp-rename / inspect 族）仅在 lsp.json 存在 enabled 服务器时
   // 注册（session_start 校验后）；本工具集跟踪 read-before-write 状态，rename
@@ -703,6 +718,7 @@ export default function claudeCodeFileTools(pi: ExtensionAPI, options?: LspServi
     {
       onEnabled: (pi, service) => {
         registerLspRenameTool(pi, service, {
+          policy,
           recordReads: async (applied) => {
             const reads: Record<string, FileSnapshot> = {};
             for (const fileEdit of applied) {
@@ -736,5 +752,5 @@ export default function claudeCodeFileTools(pi: ExtensionAPI, options?: LspServi
   });
 
   // 文件工具无条件注册；service 惰性获取，disabled 时为 no-op。
-  registerFileTools(pi, state, () => manager.mustLazyGetService());
+  registerFileTools(pi, state, () => manager.mustLazyGetService(), policy);
 }

package/src/claude-code/index.ts

@@ -1,5 +1,7 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 
+import { createBwrapRuntime } from "../bwrap/runtime.js";
+import { createRequestPolicy } from "../lib/request-policy.js";
 import claudeCodeFileTools from "./files.js";
 import { registerSearchTools } from "./search.js";
 import { registerSessionTools } from "./session-tools.js";
@@ -9,12 +11,15 @@ import { registerShellTools } from "./shell.js";
  * Claude Code 风格工具集入口：聚合 files / search / shell / session 四组工具。
  *
  * reads state 的创建与 session 恢复归 files.ts 所有（见其 default export），
- * 本文件不再持有 state；spawn-agent 子代理按工具名直接 `-e` 加载各模块文件
- * （files.ts / grep.ts / glob.ts 均为独立扩展入口）。
+ * 非沙盒请求策略（Read/Edit/Write/lsp-rename 的工作区外写入与 Bash 的
+ * `dangerouslyDisableSandbox` 共用）由本文件创建后注入两侧；spawn-agent
+ * 子代理按工具名直接 `-e` 加载各模块文件（files.ts / grep.ts / glob.ts 均为
+ * 独立扩展入口），那些入口各自创建一份策略并经 pi.events 保持同步。
  */
 export default function claudeCodeTools(pi: ExtensionAPI): void {
-  claudeCodeFileTools(pi);
+  const policy = createRequestPolicy(pi.events);
+  claudeCodeFileTools(pi, { policy });
   registerSearchTools(pi);
-  registerShellTools(pi);
+  registerShellTools(pi, createBwrapRuntime(policy));
   registerSessionTools(pi);
 }

package/src/claude-code/shell.ts

@@ -18,6 +18,7 @@ import {
   sandboxHintBlock,
 } from "../bwrap/runtime.js";
 import { resolveWorkdir } from "../lib/path.js";
+import { createRequestPolicy } from "../lib/request-policy.js";
 
 const DEFAULT_TIMEOUT_MS = 120_000;
 const MAX_TIMEOUT_MS = 7_200_000;
@@ -85,7 +86,7 @@ export function formatBashSuccess(result: Awaited<ReturnType<BwrapRuntime["execu
  */
 export function registerShellTools(
   pi: ExtensionAPI,
-  runtime: BwrapRuntime = createBwrapRuntime(),
+  runtime: BwrapRuntime = createBwrapRuntime(createRequestPolicy(pi.events)),
 ): void {
   runtime.setup(pi);
   pi.registerTool({

package/src/lib/lsp/rename-tool.ts

@@ -23,6 +23,7 @@ import { Type } from "typebox";
 
 import { resolvePathArg } from "../path.js";
 import type { ToolPendant } from "../pendant.ts";
+import type { RequestPolicy } from "../request-policy.js";
 import { guardWriteAccess } from "../write-guard.js";
 import { RenameNotPossibleError } from "./client.js";
 import type { LspService } from "./lsp.js";
@@ -33,7 +34,9 @@ import {
   symbolCandidates,
 } from "./rename.js";
 
-export interface LspRenameHooks {
+export interface LspRenameOptions {
+  /** 调用方所在扩展入口的非沙盒请求策略（与文件工具的 write-guard 同一份）。 */
+  policy: RequestPolicy;
   /**
    * rename 落盘后对每个被修改文件做已读记账；返回的 map 随 details.reads
    * 持久化，供 session 恢复时重放。不跟踪已读状态的工具集不提供该 hook。
@@ -49,7 +52,7 @@ const LSP_RENAME_PROMPT = readFileSync(
 export function registerLspRenameTool(
   pi: ExtensionAPI,
   service: LspService,
-  hooks: LspRenameHooks = {},
+  options: LspRenameOptions,
 ): void {
   pi.registerTool({
     name: "lsp-rename",
@@ -100,7 +103,7 @@ export function registerLspRenameTool(
 
       const notify = (message: string, level: "info" | "warning" | "error") =>
         ctx.ui.notify(message, level);
-      const options = { notify, signal };
+      const requestOptions = { notify, signal };
 
       // ── 按 symbol 名枚举行内候选，逐候选探测与消歧 ────────────────────────
       const candidates = symbolCandidates(
@@ -125,7 +128,7 @@ export function registerLspRenameTool(
             line: candidate.line,
             character: candidate.character,
             newName: params.new_name,
-            options,
+            options: requestOptions,
           });
           successes.push({ result });
         } catch (error) {
@@ -187,6 +190,7 @@ export function registerLspRenameTool(
           toolName: "lsp-rename",
           absolutePath: fileEdit.path,
           change: { oldText: fileEdit.oldText, newText: fileEdit.newText },
+          policy: options.policy,
         });
       }
 
@@ -199,7 +203,8 @@ export function registerLspRenameTool(
           `### ${fileEdit.path} (${fileEdit.changeCount} edit(s))\n\n\`\`\`diff\n${generateDiffString(fileEdit.oldText, fileEdit.newText).diff}\n\`\`\``,
         );
       }
-      const reads = hooks.recordReads === undefined ? undefined : await hooks.recordReads(applied);
+      const reads =
+        options.recordReads === undefined ? undefined : await options.recordReads(applied);
 
       let diagnosticText = "";
       for (const fileEdit of applied) {

package/src/lib/request-policy.ts

@@ -0,0 +1,46 @@
+/**
+ * 非沙盒请求策略：用户执行 `/bwrap-deny-request` 后，模型的提权请求
+ * （bash 的 `dangerouslyDisableSandbox`、编辑类工具的工作区外写入）不再弹审批框，
+ * 一律按用户「无理由拒绝」处理；`/bwrap-allow-request` 恢复审批。
+ *
+ * pi 给每个扩展入口单独建 jiti 实例（loader 里 `moduleCache: false`），模块级状态
+ * 不跨入口共享，所以策略实例由各入口的工厂创建，生命周期随扩展实例，聚合入口
+ * （claude-code / opencode 的 index.ts）创建一份注入给文件工具与 bash runtime。
+ *
+ * 需要跨入口一致时（独立入口的 web_fetch 也要跟随同一个开关）把 `pi.events` 传进来：
+ * 变更广播给同进程内所有订阅者，订阅由 loader 随扩展卸载自动撤销。
+ */
+
+import type { EventBus } from "@earendil-works/pi-coding-agent";
+import { type Static, Type } from "typebox";
+import { Value } from "typebox/value";
+
+/** 策略广播频道；同进程内各入口的策略副本据此保持同步。 */
+export const REQUEST_POLICY_CHANNEL = "bwrap:request-policy";
+
+const requestPolicyMessageSchema = Type.Object({ denyRequests: Type.Boolean() });
+
+export type RequestPolicyMessage = Static<typeof requestPolicyMessageSchema>;
+
+export interface RequestPolicy {
+  /** 是否拒绝一切非沙盒请求（不弹审批框，直接拒绝）。 */
+  deniesRequests(): boolean;
+  setDenyRequests(deny: boolean): void;
+}
+
+/** 不传 events 时策略只在本入口内生效（测试与不需要跨入口同步的场景）。 */
+export function createRequestPolicy(events?: EventBus): RequestPolicy {
+  let denyRequests = false;
+
+  events?.on(REQUEST_POLICY_CHANNEL, (data) => {
+    if (Value.Check(requestPolicyMessageSchema, data)) denyRequests = data.denyRequests;
+  });
+
+  return {
+    deniesRequests: () => denyRequests,
+    setDenyRequests(deny: boolean) {
+      denyRequests = deny;
+      events?.emit(REQUEST_POLICY_CHANNEL, { denyRequests: deny } satisfies RequestPolicyMessage);
+    },
+  };
+}

package/src/lib/write-guard.ts

@@ -8,6 +8,8 @@
  * - Headless sessions (no UI) reject outside writes outright.
  * - Windows (no sandbox fallback): writes are restricted to the workspace;
  *   outside paths are rejected outright, with no approval path.
+ * - `/bwrap-deny-request` (non-sandbox request policy) refuses outside writes
+ *   outright, with the same error as the user picking "Block".
  *
  * Callers have already parsed their tool arguments, so the guard only takes the
  * resolved pieces: the raw target path and the pending change (oldText/newText).
@@ -20,6 +22,7 @@ import { generateUnifiedPatch } from "@earendil-works/pi-coding-agent";
 
 import { applyEdit, normalizeToLF } from "../opencode/edit-engine.js";
 import { fenceCodeBlock } from "./markdown.js";
+import type { RequestPolicy } from "./request-policy.js";
 
 const ALWAYS_ALLOW = ["/tmp"];
 const MAX_PREVIEW_LINES = 100;
@@ -118,6 +121,8 @@ export interface WriteGuardOptions {
    * 待审批的变更内容；缺省时审批对话框不展示 diff 预览，仅按路径审批。
    */
   change?: PendingChange;
+  /** 调用方所在扩展入口持有的非沙盒请求策略（跨入口一致时绑同一个 pi.events）。 */
+  policy: RequestPolicy;
 }
 
 /**
@@ -133,6 +138,12 @@ export async function guardWriteAccess(
   const { absolutePath } = opts;
   if (isPathAllowed(absolutePath, ctx.cwd)) return;
 
+  // 非沙盒请求策略生效时不弹审批框：工作区外写入按用户点 "Block"（无理由）处理。
+  // 放在 win32 / 无 UI 分支之前，策略优先级高于各平台的降级路径。
+  if (opts.policy.deniesRequests()) {
+    throw new Error(`user deny ${opts.toolName}: blocked`);
+  }
+
   if (process.platform === "win32") {
     // Windows 上退化为「只能写工作区」：无沙箱兜底，工作区外写入一律拒绝，
     // 不提供审批路径。

package/src/opencode/bash.ts

@@ -12,6 +12,7 @@ import {
   sandboxHintBlock,
 } from "../bwrap/runtime.js";
 import { resolveWorkdir } from "../lib/path.js";
+import { createRequestPolicy } from "../lib/request-policy.js";
 
 const DEFAULT_TIMEOUT_MS = 120_000;
 const MAX_TIMEOUT_MS = 7_200_000;
@@ -41,7 +42,7 @@ function appendTruncationNotice(
  */
 export default function opencodeBash(
   pi: ExtensionAPI,
-  runtime: BwrapRuntime = createBwrapRuntime(),
+  runtime: BwrapRuntime = createBwrapRuntime(createRequestPolicy(pi.events)),
 ): void {
   // 每个扩展实例持有自己的 runtime：不依赖模块级全局状态，状态随扩展
   // 实例生命周期（进程启动 / /reload / session 切换时工厂重建即重置）。

package/src/opencode/files.ts

@@ -34,6 +34,7 @@ import { registerLspInspectTools } from "../lib/lsp/inspect-tool.js";
 import { createLspManager, type LspService, type LspServiceOptions } from "../lib/lsp/lsp.js";
 import { registerLspRenameTool } from "../lib/lsp/rename-tool.js";
 import { formatSubtitlePath } from "../lib/path.js";
+import { createRequestPolicy, type RequestPolicy } from "../lib/request-policy.js";
 import { guardWriteAccess } from "../lib/write-guard.js";
 import { applyEdit, normalizeToLF, stripBom } from "./edit-engine.js";
 
@@ -534,7 +535,11 @@ const editSchema = Type.Object({
   ),
 });
 
-function registerEditTool(pi: ExtensionAPI, getService: () => LspService): void {
+function registerEditTool(
+  pi: ExtensionAPI,
+  getService: () => LspService,
+  policy: RequestPolicy,
+): void {
   pi.registerTool({
     name: "edit",
     label: "edit",
@@ -565,6 +570,7 @@ function registerEditTool(pi: ExtensionAPI, getService: () => LspService): void
         toolName: "edit",
         absolutePath,
         change: { oldText: oldString, newText: newString, replaceAll },
+        policy,
       });
 
       const [message, details, diagnostics] = await withFileMutationQueue(
@@ -686,7 +692,11 @@ export function resolveBom(
   return { bom: sourceBom || nextBom, text };
 }
 
-function registerWriteTool(pi: ExtensionAPI, getService: () => LspService): void {
+function registerWriteTool(
+  pi: ExtensionAPI,
+  getService: () => LspService,
+  policy: RequestPolicy,
+): void {
   pi.registerTool({
     name: "write",
     label: "write",
@@ -707,6 +717,7 @@ function registerWriteTool(pi: ExtensionAPI, getService: () => LspService): void
         toolName: "write",
         absolutePath,
         change: { oldText: "", newText: content },
+        policy,
       });
       const dir = dirname(absolutePath);
 
@@ -764,25 +775,40 @@ function registerWriteTool(pi: ExtensionAPI, getService: () => LspService): void
 
 // ── 入口 ─────────────────────────────────────────────────────────────────────
 
-export function registerFileTools(pi: ExtensionAPI, getService: () => LspService): void {
+export function registerFileTools(
+  pi: ExtensionAPI,
+  getService: () => LspService,
+  policy: RequestPolicy,
+): void {
   registerReadTool(pi, getService);
-  registerEditTool(pi, getService);
-  registerWriteTool(pi, getService);
+  registerEditTool(pi, getService, policy);
+  registerWriteTool(pi, getService, policy);
   // lsp-rename / inspect 工具由 manager 的 onEnabled 回调注册，不在这里注册。
 }
 
+export interface OpencodeFileToolOptions extends LspServiceOptions {
+  /** 与 bash runtime 共享的非沙盒请求策略；独立入口不传，自建一份。 */
+  policy?: RequestPolicy;
+}
+
 /** 独立入口：创建 LSP manager（session_start 时按配置启用）并注册文件工具。 */
-export default function opencodeFileTools(pi: ExtensionAPI, options?: LspServiceOptions): void {
+export default function opencodeFileTools(
+  pi: ExtensionAPI,
+  options?: OpencodeFileToolOptions,
+): void {
+  // 聚合入口（index.ts）注入与 bash runtime 共享的那一份；独立入口自建并靠
+  // pi.events 跟随同一开关。
+  const policy = options?.policy ?? createRequestPolicy(pi.events);
   const manager = createLspManager(
     pi,
     {
       onEnabled: (pi, service) => {
-        registerLspRenameTool(pi, service);
+        registerLspRenameTool(pi, service, { policy });
         registerLspInspectTools(pi, service);
       },
     },
     options,
   );
   // 文件工具无条件注册；service 惰性获取，disabled 时为 no-op。
-  registerFileTools(pi, () => manager.mustLazyGetService());
+  registerFileTools(pi, () => manager.mustLazyGetService(), policy);
 }

package/src/opencode/index.ts

@@ -14,6 +14,8 @@
 
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 
+import { createBwrapRuntime } from "../bwrap/runtime.js";
+import { createRequestPolicy } from "../lib/request-policy.js";
 import opencodeBash from "./bash.js";
 import opencodeFileTools from "./files.js";
 import opencodeQuestion from "./question.js";
@@ -40,8 +42,11 @@ export { default as opencodeQuestion } from "./question.js";
 export { default as opencodeTodo } from "./todo.js";
 
 export default function opencode(pi: ExtensionAPI) {
-  opencodeFileTools(pi);
+  // 非沙盒请求策略由本入口创建，注入文件工具与 bash runtime 共享同一份；
+  // 独立入口（web/fetch.ts 等）各自创建一份并经 pi.events 保持同步。
+  const policy = createRequestPolicy(pi.events);
+  opencodeFileTools(pi, { policy });
   opencodeTodo(pi);
   opencodeQuestion(pi);
-  opencodeBash(pi);
+  opencodeBash(pi, createBwrapRuntime(policy));
 }

package/src/web/fetch.ts

@@ -23,6 +23,7 @@ import { Type } from "typebox";
 
 import { resolvePathArg } from "../lib/path.js";
 import { createHttpProxy } from "../lib/proxy.js";
+import { createRequestPolicy } from "../lib/request-policy.js";
 import { guardWriteAccess } from "../lib/write-guard.js";
 
 const httpProxy = createHttpProxy();
@@ -310,6 +311,9 @@ function truncateMarkdown(text: string): { text: string; truncated: boolean } {
 }
 
 export default function webFetchTool(pi: ExtensionAPI): void {
+  // 本工具是独立扩展入口（pi 给每个入口单独建 jiti 实例），自建一份非沙盒请求
+  // 策略并订阅 pi.events：/bwrap-deny-request 在 bash 入口切换时会同步过来。
+  const policy = createRequestPolicy(pi.events);
   pi.registerTool({
     name: "web_fetch",
     label: "Web Fetch",
@@ -339,7 +343,7 @@ export default function webFetchTool(pi: ExtensionAPI): void {
       // 落盘位置的审批与写文件工具同一套：工作区与 /tmp 自动放行，其余问用户。
       // 放在 try 外面，拒绝的原因（user deny）不该被改写成「抓取失败」。
       if (destination !== undefined) {
-        await guardWriteAccess(ctx, { toolName: "web_fetch", absolutePath: destination });
+        await guardWriteAccess(ctx, { toolName: "web_fetch", absolutePath: destination, policy });
       }
 
       try {