@trim21/personal-pi-extensions 0.1.562 → 0.1.564

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trim21/personal-pi-extensions",
-  "version": "0.1.562",
+  "version": "0.1.564",
   "type": "module",
   "description": "Custom pi coding-agent extensions: bwrap sandbox, workspace guard, opencode edit, and more",
   "keywords": [
@@ -24,8 +24,8 @@
     "format": "prettier --write .",
     "test": "vitest run",
     "test:coverage": "vitest run --coverage",
-    "sandbox": "tsx bin/sandbox.ts",
-    "aft-search": "tsx bin/aft-search.ts",
+    "sandbox": "jiti bin/sandbox.ts",
+    "aft-search": "jiti bin/aft-search.ts",
     "build:holder": "esbuild src/bwrap/holder.ts --format=esm --target=node24 --outfile=src/bwrap/holder.js",
     "prepare": "husky"
   },
@@ -56,10 +56,10 @@
     "eslint-plugin-unicorn": "74.0.0",
     "eslint-plugin-unused-imports": "4.4.1",
     "husky": "^9.1.7",
+    "jiti": "^2.7.0",
     "lint-staged": "^17.3.0",
     "prettier": "^3.9.6",
     "shlex": "^3.0.0",
-    "tsx": "^4.23.12",
     "typebox": "1.3.1",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
     "typescript-eslint": "^8.67.0",

package/src/bwrap/runtime.ts

@@ -18,7 +18,7 @@ import { type TObject, Type } from "typebox";
 import { type CommandSpec, parseCommand } from "../lib/cli.js";
 import { fenceCodeBlock } from "../lib/markdown.js";
 import { formatDisplayPath } from "../lib/path.js";
-import { requestPolicy } from "../lib/request-policy.js";
+import { createRequestPolicy, type RequestPolicy } from "../lib/request-policy.js";
 import { type SelectAction, selectMultiple, selectWithOptionalInput } from "../lib/ui.js";
 import { type ApprovalRule, evaluateBashApproval, matchRule } from "./approval-rules.js";
 import { commandPatternsFor } from "./approval-suggest.js";
@@ -320,6 +320,15 @@ export class BwrapRuntime {
   private bwrapUnavailable = false;
   /** net-allowlist 首次执行时解析一次 mihomo 路径，之后随 runtime 复用，不逐命令扫描 PATH。 */
   private mihomoPath: string | undefined;
+  /**
+   * 非沙盒请求策略由创建方注入：聚合入口把它与文件工具的 write-guard 共享同一实例，
+   * 独立入口各持一份、经 pi.events 同步。
+   */
+  private readonly policy: RequestPolicy;
+
+  constructor(policy: RequestPolicy) {
+    this.policy = policy;
+  }
 
   setup(pi: ExtensionAPI): void {
     pi.registerFlag("no-bwrap", {
@@ -332,7 +341,7 @@ export class BwrapRuntime {
       this.sandboxDisabled = pi.getFlag("no-bwrap") === true && ctx.hasUI;
       this.resolved = undefined;
       this.bwrapUnavailable = false;
-      requestPolicy.setDenyRequests(false);
+      this.policy.setDenyRequests(false);
       if (process.platform === "win32") {
         // Windows 没有 bubblewrap：不做 bwrap 检测、不显示 bwrap 状态，
         // 每条 bash 命令在 execute 时逐条人工审批，模型无需知道 bwrap 的存在。
@@ -382,7 +391,7 @@ export class BwrapRuntime {
           ? " bwrap is unavailable (binary not found): bash commands are refused unless the user explicitly approves unsandboxed execution."
           : "";
       const denyRequestsText =
-        !isWindows && requestPolicy.deniesRequests()
+        !isWindows && this.policy.deniesRequests()
           ? " Unsandboxed execution is currently denied by the user: `dangerouslyDisableSandbox` and writes outside the workspace are refused without approval."
           : "";
       return {
@@ -433,7 +442,7 @@ export class BwrapRuntime {
     if (needsApproval && runtime.bwrapEnabled) {
       // /bwrap-deny-request：非沙盒请求直接拒绝——审批规则与审批框都不再参与，
       // 拒绝文案与用户点 Deny 相同，直到用户用 /bwrap-allow-request 恢复审批。
-      if (request.requestFullAccess === true && requestPolicy.deniesRequests()) {
+      if (request.requestFullAccess === true && this.policy.deniesRequests()) {
         throw new Error(UNSANDBOXED_DENIED);
       }
       // 先按 approvalRules 自动判定：allow 直接放行，deny 直接拒绝，未命中才弹框
@@ -879,7 +888,7 @@ export class BwrapRuntime {
 
   /** 状态行文案：模式 + 非沙盒请求策略（拒绝时标注，便于解释模型的请求为何被拒）。 */
   private statusLabel(mode: BwrapMode): string {
-    return `bwrap: ${mode}${requestPolicy.deniesRequests() ? " (requests denied)" : ""}`;
+    return `bwrap: ${mode}${this.policy.deniesRequests() ? " (requests denied)" : ""}`;
   }
 
   /**
@@ -887,7 +896,7 @@ export class BwrapRuntime {
    * 编辑类工具的工作区外写入）直接按用户拒绝处理，不再弹审批框。
    */
   private setDenyRequests(deny: boolean, ctx: ExtensionCommandContext): void {
-    requestPolicy.setDenyRequests(deny);
+    this.policy.setDenyRequests(deny);
     ctx.ui.notify(
       deny
         ? "Non-sandbox requests are denied without approval; /bwrap-allow-request restores approval."
@@ -916,6 +925,7 @@ export class BwrapRuntime {
   }
 }
 
-export function createBwrapRuntime(): BwrapRuntime {
-  return new BwrapRuntime();
+/** 缺省自建一份不跨入口同步的策略；入口通常显式传入 `createRequestPolicy(pi.events)`。 */
+export function createBwrapRuntime(policy: RequestPolicy = createRequestPolicy()): BwrapRuntime {
+  return new BwrapRuntime(policy);
 }

package/src/claude-code/files.ts

@@ -20,6 +20,7 @@ import { createLspManager, type LspService, type LspServiceOptions } from "../li
 import { registerLspRenameTool } from "../lib/lsp/rename-tool.js";
 import { formatSubtitlePath } from "../lib/path.js";
 import type { ToolPendant } from "../lib/pendant.ts";
+import { createRequestPolicy, type RequestPolicy } from "../lib/request-policy.js";
 import { guardWriteAccess } from "../lib/write-guard.js";
 import {
   type ClaudeCodeState,
@@ -230,6 +231,7 @@ export function registerFileTools(
   pi: ExtensionAPI,
   state: ClaudeCodeState,
   getService: () => LspService,
+  policy: RequestPolicy,
 ): void {
   pi.registerTool({
     name: "Read",
@@ -399,6 +401,7 @@ export function registerFileTools(
           newText: params.new_string,
           replaceAll: params.replace_all,
         },
+        policy,
       });
       const [message, details, diagnostics] = await withFileMutationQueue<
         [string, FileToolDetails, DiagnosticReport]
@@ -594,6 +597,7 @@ export function registerFileTools(
         toolName: "Write",
         absolutePath: filePath,
         change: { oldText: "", newText: params.content },
+        policy,
       });
       const [message, details, diagnostics] = await withFileMutationQueue<
         [string, FileToolDetails, DiagnosticReport]
@@ -686,14 +690,25 @@ function restoreFileReads(
   }
 }
 
+export interface ClaudeCodeFileToolOptions extends LspServiceOptions {
+  /** 与 bash runtime 共享的非沙盒请求策略；独立入口不传，自建一份。 */
+  policy?: RequestPolicy;
+}
+
 /**
  * 独立扩展入口：files.ts 可单独经 `-e claude-code/files.ts` 加载（spawn-agent
  * 子代理把 Read/Edit/Write 工具名映射到本文件），无需经 index.ts。reads
  * state 归本文件所有：扩展实例内创建，并随 session 事件从历史分支恢复，
  * 与主进程 index.ts 聚合加载时的行为一致。
  */
-export default function claudeCodeFileTools(pi: ExtensionAPI, options?: LspServiceOptions): void {
+export default function claudeCodeFileTools(
+  pi: ExtensionAPI,
+  options?: ClaudeCodeFileToolOptions,
+): void {
   const state = createClaudeCodeState();
+  // 聚合入口（index.ts）注入与 bash runtime 共享的那一份；独立入口（spawn-agent
+  // 按工具名 `-e` 加载本文件）自建一份，靠 pi.events 跟随同一开关。
+  const policy = options?.policy ?? createRequestPolicy(pi.events);
 
   // LSP 专属工具（lsp-rename / inspect 族）仅在 lsp.json 存在 enabled 服务器时
   // 注册（session_start 校验后）；本工具集跟踪 read-before-write 状态，rename
@@ -703,6 +718,7 @@ export default function claudeCodeFileTools(pi: ExtensionAPI, options?: LspServi
     {
       onEnabled: (pi, service) => {
         registerLspRenameTool(pi, service, {
+          policy,
           recordReads: async (applied) => {
             const reads: Record<string, FileSnapshot> = {};
             for (const fileEdit of applied) {
@@ -736,5 +752,5 @@ export default function claudeCodeFileTools(pi: ExtensionAPI, options?: LspServi
   });
 
   // 文件工具无条件注册；service 惰性获取，disabled 时为 no-op。
-  registerFileTools(pi, state, () => manager.mustLazyGetService());
+  registerFileTools(pi, state, () => manager.mustLazyGetService(), policy);
 }

package/src/claude-code/index.ts

@@ -1,5 +1,7 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 
+import { createBwrapRuntime } from "../bwrap/runtime.js";
+import { createRequestPolicy } from "../lib/request-policy.js";
 import claudeCodeFileTools from "./files.js";
 import { registerSearchTools } from "./search.js";
 import { registerSessionTools } from "./session-tools.js";
@@ -9,12 +11,15 @@ import { registerShellTools } from "./shell.js";
  * Claude Code 风格工具集入口：聚合 files / search / shell / session 四组工具。
  *
  * reads state 的创建与 session 恢复归 files.ts 所有（见其 default export），
- * 本文件不再持有 state；spawn-agent 子代理按工具名直接 `-e` 加载各模块文件
- * （files.ts / grep.ts / glob.ts 均为独立扩展入口）。
+ * 非沙盒请求策略（Read/Edit/Write/lsp-rename 的工作区外写入与 Bash 的
+ * `dangerouslyDisableSandbox` 共用）由本文件创建后注入两侧；spawn-agent
+ * 子代理按工具名直接 `-e` 加载各模块文件（files.ts / grep.ts / glob.ts 均为
+ * 独立扩展入口），那些入口各自创建一份策略并经 pi.events 保持同步。
  */
 export default function claudeCodeTools(pi: ExtensionAPI): void {
-  claudeCodeFileTools(pi);
+  const policy = createRequestPolicy(pi.events);
+  claudeCodeFileTools(pi, { policy });
   registerSearchTools(pi);
-  registerShellTools(pi);
+  registerShellTools(pi, createBwrapRuntime(policy));
   registerSessionTools(pi);
 }

package/src/claude-code/shell.ts

@@ -18,6 +18,7 @@ import {
   sandboxHintBlock,
 } from "../bwrap/runtime.js";
 import { resolveWorkdir } from "../lib/path.js";
+import { createRequestPolicy } from "../lib/request-policy.js";
 
 const DEFAULT_TIMEOUT_MS = 120_000;
 const MAX_TIMEOUT_MS = 7_200_000;
@@ -85,7 +86,7 @@ export function formatBashSuccess(result: Awaited<ReturnType<BwrapRuntime["execu
  */
 export function registerShellTools(
   pi: ExtensionAPI,
-  runtime: BwrapRuntime = createBwrapRuntime(),
+  runtime: BwrapRuntime = createBwrapRuntime(createRequestPolicy(pi.events)),
 ): void {
   runtime.setup(pi);
   pi.registerTool({

package/src/lib/lsp/rename-tool.ts

@@ -23,6 +23,7 @@ import { Type } from "typebox";
 
 import { resolvePathArg } from "../path.js";
 import type { ToolPendant } from "../pendant.ts";
+import type { RequestPolicy } from "../request-policy.js";
 import { guardWriteAccess } from "../write-guard.js";
 import { RenameNotPossibleError } from "./client.js";
 import type { LspService } from "./lsp.js";
@@ -33,7 +34,9 @@ import {
   symbolCandidates,
 } from "./rename.js";
 
-export interface LspRenameHooks {
+export interface LspRenameOptions {
+  /** 调用方所在扩展入口的非沙盒请求策略（与文件工具的 write-guard 同一份）。 */
+  policy: RequestPolicy;
   /**
    * rename 落盘后对每个被修改文件做已读记账；返回的 map 随 details.reads
    * 持久化，供 session 恢复时重放。不跟踪已读状态的工具集不提供该 hook。
@@ -49,7 +52,7 @@ const LSP_RENAME_PROMPT = readFileSync(
 export function registerLspRenameTool(
   pi: ExtensionAPI,
   service: LspService,
-  hooks: LspRenameHooks = {},
+  options: LspRenameOptions,
 ): void {
   pi.registerTool({
     name: "lsp-rename",
@@ -100,7 +103,7 @@ export function registerLspRenameTool(
 
       const notify = (message: string, level: "info" | "warning" | "error") =>
         ctx.ui.notify(message, level);
-      const options = { notify, signal };
+      const requestOptions = { notify, signal };
 
       // ── 按 symbol 名枚举行内候选，逐候选探测与消歧 ────────────────────────
       const candidates = symbolCandidates(
@@ -125,7 +128,7 @@ export function registerLspRenameTool(
             line: candidate.line,
             character: candidate.character,
             newName: params.new_name,
-            options,
+            options: requestOptions,
           });
           successes.push({ result });
         } catch (error) {
@@ -187,6 +190,7 @@ export function registerLspRenameTool(
           toolName: "lsp-rename",
           absolutePath: fileEdit.path,
           change: { oldText: fileEdit.oldText, newText: fileEdit.newText },
+          policy: options.policy,
         });
       }
 
@@ -199,7 +203,8 @@ export function registerLspRenameTool(
           `### ${fileEdit.path} (${fileEdit.changeCount} edit(s))\n\n\`\`\`diff\n${generateDiffString(fileEdit.oldText, fileEdit.newText).diff}\n\`\`\``,
         );
       }
-      const reads = hooks.recordReads === undefined ? undefined : await hooks.recordReads(applied);
+      const reads =
+        options.recordReads === undefined ? undefined : await options.recordReads(applied);
 
       let diagnosticText = "";
       for (const fileEdit of applied) {

package/src/lib/request-policy.ts

@@ -3,27 +3,44 @@
  * （bash 的 `dangerouslyDisableSandbox`、编辑类工具的工作区外写入）不再弹审批框，
  * 一律按用户「无理由拒绝」处理；`/bwrap-allow-request` 恢复审批。
  *
- * 状态由闭包持有（AGENTS.md：不用模块级可变变量维护跨调用状态）。
- * 模块级单例让互相独立的扩展入口（bwrap runtime、claude-code / opencode 的文件工具、
- * lsp-rename、web_fetch）共享同一份会话状态——各入口分别 createRequestPolicy()
- * 会得到互不相通的策略，等于开关只对其中一半生效。
+ * pi 给每个扩展入口单独建 jiti 实例（loader 里 `moduleCache: false`），模块级状态
+ * 不跨入口共享，所以策略实例由各入口的工厂创建，生命周期随扩展实例，聚合入口
+ * （claude-code / opencode 的 index.ts）创建一份注入给文件工具与 bash runtime。
+ *
+ * 需要跨入口一致时（独立入口的 web_fetch 也要跟随同一个开关）把 `pi.events` 传进来：
+ * 变更广播给同进程内所有订阅者，订阅由 loader 随扩展卸载自动撤销。
  */
 
+import type { EventBus } from "@earendil-works/pi-coding-agent";
+import { type Static, Type } from "typebox";
+import { Value } from "typebox/value";
+
+/** 策略广播频道；同进程内各入口的策略副本据此保持同步。 */
+export const REQUEST_POLICY_CHANNEL = "bwrap:request-policy";
+
+const requestPolicyMessageSchema = Type.Object({ denyRequests: Type.Boolean() });
+
+export type RequestPolicyMessage = Static<typeof requestPolicyMessageSchema>;
+
 export interface RequestPolicy {
   /** 是否拒绝一切非沙盒请求（不弹审批框，直接拒绝）。 */
   deniesRequests(): boolean;
   setDenyRequests(deny: boolean): void;
 }
 
-export function createRequestPolicy(): RequestPolicy {
+/** 不传 events 时策略只在本入口内生效（测试与不需要跨入口同步的场景）。 */
+export function createRequestPolicy(events?: EventBus): RequestPolicy {
   let denyRequests = false;
+
+  events?.on(REQUEST_POLICY_CHANNEL, (data) => {
+    if (Value.Check(requestPolicyMessageSchema, data)) denyRequests = data.denyRequests;
+  });
+
   return {
     deniesRequests: () => denyRequests,
     setDenyRequests(deny: boolean) {
       denyRequests = deny;
+      events?.emit(REQUEST_POLICY_CHANNEL, { denyRequests: deny } satisfies RequestPolicyMessage);
     },
   };
 }
-
-/** 进程级共享的策略实例；由 `/bwrap-deny-request` / `/bwrap-allow-request` 切换，session_start 复位。 */
-export const requestPolicy = createRequestPolicy();

package/src/lib/write-guard.ts

@@ -22,7 +22,7 @@ import { generateUnifiedPatch } from "@earendil-works/pi-coding-agent";
 
 import { applyEdit, normalizeToLF } from "../opencode/edit-engine.js";
 import { fenceCodeBlock } from "./markdown.js";
-import { requestPolicy } from "./request-policy.js";
+import type { RequestPolicy } from "./request-policy.js";
 
 const ALWAYS_ALLOW = ["/tmp"];
 const MAX_PREVIEW_LINES = 100;
@@ -121,6 +121,8 @@ export interface WriteGuardOptions {
    * 待审批的变更内容；缺省时审批对话框不展示 diff 预览，仅按路径审批。
    */
   change?: PendingChange;
+  /** 调用方所在扩展入口持有的非沙盒请求策略（跨入口一致时绑同一个 pi.events）。 */
+  policy: RequestPolicy;
 }
 
 /**
@@ -138,7 +140,7 @@ export async function guardWriteAccess(
 
   // 非沙盒请求策略生效时不弹审批框：工作区外写入按用户点 "Block"（无理由）处理。
   // 放在 win32 / 无 UI 分支之前，策略优先级高于各平台的降级路径。
-  if (requestPolicy.deniesRequests()) {
+  if (opts.policy.deniesRequests()) {
     throw new Error(`user deny ${opts.toolName}: blocked`);
   }
 

package/src/opencode/bash.ts

@@ -12,6 +12,7 @@ import {
   sandboxHintBlock,
 } from "../bwrap/runtime.js";
 import { resolveWorkdir } from "../lib/path.js";
+import { createRequestPolicy } from "../lib/request-policy.js";
 
 const DEFAULT_TIMEOUT_MS = 120_000;
 const MAX_TIMEOUT_MS = 7_200_000;
@@ -41,7 +42,7 @@ function appendTruncationNotice(
  */
 export default function opencodeBash(
   pi: ExtensionAPI,
-  runtime: BwrapRuntime = createBwrapRuntime(),
+  runtime: BwrapRuntime = createBwrapRuntime(createRequestPolicy(pi.events)),
 ): void {
   // 每个扩展实例持有自己的 runtime：不依赖模块级全局状态，状态随扩展
   // 实例生命周期（进程启动 / /reload / session 切换时工厂重建即重置）。

package/src/opencode/files.ts

@@ -34,6 +34,7 @@ import { registerLspInspectTools } from "../lib/lsp/inspect-tool.js";
 import { createLspManager, type LspService, type LspServiceOptions } from "../lib/lsp/lsp.js";
 import { registerLspRenameTool } from "../lib/lsp/rename-tool.js";
 import { formatSubtitlePath } from "../lib/path.js";
+import { createRequestPolicy, type RequestPolicy } from "../lib/request-policy.js";
 import { guardWriteAccess } from "../lib/write-guard.js";
 import { applyEdit, normalizeToLF, stripBom } from "./edit-engine.js";
 
@@ -534,7 +535,11 @@ const editSchema = Type.Object({
   ),
 });
 
-function registerEditTool(pi: ExtensionAPI, getService: () => LspService): void {
+function registerEditTool(
+  pi: ExtensionAPI,
+  getService: () => LspService,
+  policy: RequestPolicy,
+): void {
   pi.registerTool({
     name: "edit",
     label: "edit",
@@ -565,6 +570,7 @@ function registerEditTool(pi: ExtensionAPI, getService: () => LspService): void
         toolName: "edit",
         absolutePath,
         change: { oldText: oldString, newText: newString, replaceAll },
+        policy,
       });
 
       const [message, details, diagnostics] = await withFileMutationQueue(
@@ -686,7 +692,11 @@ export function resolveBom(
   return { bom: sourceBom || nextBom, text };
 }
 
-function registerWriteTool(pi: ExtensionAPI, getService: () => LspService): void {
+function registerWriteTool(
+  pi: ExtensionAPI,
+  getService: () => LspService,
+  policy: RequestPolicy,
+): void {
   pi.registerTool({
     name: "write",
     label: "write",
@@ -707,6 +717,7 @@ function registerWriteTool(pi: ExtensionAPI, getService: () => LspService): void
         toolName: "write",
         absolutePath,
         change: { oldText: "", newText: content },
+        policy,
       });
       const dir = dirname(absolutePath);
 
@@ -764,25 +775,40 @@ function registerWriteTool(pi: ExtensionAPI, getService: () => LspService): void
 
 // ── 入口 ─────────────────────────────────────────────────────────────────────
 
-export function registerFileTools(pi: ExtensionAPI, getService: () => LspService): void {
+export function registerFileTools(
+  pi: ExtensionAPI,
+  getService: () => LspService,
+  policy: RequestPolicy,
+): void {
   registerReadTool(pi, getService);
-  registerEditTool(pi, getService);
-  registerWriteTool(pi, getService);
+  registerEditTool(pi, getService, policy);
+  registerWriteTool(pi, getService, policy);
   // lsp-rename / inspect 工具由 manager 的 onEnabled 回调注册，不在这里注册。
 }
 
+export interface OpencodeFileToolOptions extends LspServiceOptions {
+  /** 与 bash runtime 共享的非沙盒请求策略；独立入口不传，自建一份。 */
+  policy?: RequestPolicy;
+}
+
 /** 独立入口：创建 LSP manager（session_start 时按配置启用）并注册文件工具。 */
-export default function opencodeFileTools(pi: ExtensionAPI, options?: LspServiceOptions): void {
+export default function opencodeFileTools(
+  pi: ExtensionAPI,
+  options?: OpencodeFileToolOptions,
+): void {
+  // 聚合入口（index.ts）注入与 bash runtime 共享的那一份；独立入口自建并靠
+  // pi.events 跟随同一开关。
+  const policy = options?.policy ?? createRequestPolicy(pi.events);
   const manager = createLspManager(
     pi,
     {
       onEnabled: (pi, service) => {
-        registerLspRenameTool(pi, service);
+        registerLspRenameTool(pi, service, { policy });
         registerLspInspectTools(pi, service);
       },
     },
     options,
   );
   // 文件工具无条件注册；service 惰性获取，disabled 时为 no-op。
-  registerFileTools(pi, () => manager.mustLazyGetService());
+  registerFileTools(pi, () => manager.mustLazyGetService(), policy);
 }

package/src/opencode/index.ts

@@ -14,6 +14,8 @@
 
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 
+import { createBwrapRuntime } from "../bwrap/runtime.js";
+import { createRequestPolicy } from "../lib/request-policy.js";
 import opencodeBash from "./bash.js";
 import opencodeFileTools from "./files.js";
 import opencodeQuestion from "./question.js";
@@ -40,8 +42,11 @@ export { default as opencodeQuestion } from "./question.js";
 export { default as opencodeTodo } from "./todo.js";
 
 export default function opencode(pi: ExtensionAPI) {
-  opencodeFileTools(pi);
+  // 非沙盒请求策略由本入口创建，注入文件工具与 bash runtime 共享同一份；
+  // 独立入口（web/fetch.ts 等）各自创建一份并经 pi.events 保持同步。
+  const policy = createRequestPolicy(pi.events);
+  opencodeFileTools(pi, { policy });
   opencodeTodo(pi);
   opencodeQuestion(pi);
-  opencodeBash(pi);
+  opencodeBash(pi, createBwrapRuntime(policy));
 }

package/src/web/fetch.ts

@@ -23,6 +23,7 @@ import { Type } from "typebox";
 
 import { resolvePathArg } from "../lib/path.js";
 import { createHttpProxy } from "../lib/proxy.js";
+import { createRequestPolicy } from "../lib/request-policy.js";
 import { guardWriteAccess } from "../lib/write-guard.js";
 
 const httpProxy = createHttpProxy();
@@ -310,6 +311,9 @@ function truncateMarkdown(text: string): { text: string; truncated: boolean } {
 }
 
 export default function webFetchTool(pi: ExtensionAPI): void {
+  // 本工具是独立扩展入口（pi 给每个入口单独建 jiti 实例），自建一份非沙盒请求
+  // 策略并订阅 pi.events：/bwrap-deny-request 在 bash 入口切换时会同步过来。
+  const policy = createRequestPolicy(pi.events);
   pi.registerTool({
     name: "web_fetch",
     label: "Web Fetch",
@@ -339,7 +343,7 @@ export default function webFetchTool(pi: ExtensionAPI): void {
       // 落盘位置的审批与写文件工具同一套：工作区与 /tmp 自动放行，其余问用户。
       // 放在 try 外面，拒绝的原因（user deny）不该被改写成「抓取失败」。
       if (destination !== undefined) {
-        await guardWriteAccess(ctx, { toolName: "web_fetch", absolutePath: destination });
+        await guardWriteAccess(ctx, { toolName: "web_fetch", absolutePath: destination, policy });
       }
 
       try {