@tt-a1i/openpi 0.3.1 → 0.5.0

package/extensions/model-info/index.ts

@@ -7,37 +7,11 @@ import {
   MODEL_INFO_CHANNEL,
   REFRESH_CHANNEL,
 } from "../shared/dashboard-state.ts";
+import { createSessionMetricsTracker } from "./session-metrics.ts";
 
 const CHARS_PER_ESTIMATED_TOKEN = 4;
 const LIVE_UPDATE_INTERVAL_MS = 200;
 
-function getSessionMetrics(ctx: ExtensionContext) {
-  let cost = 0;
-  let cacheRead = 0;
-  let promptTokens = 0;
-
-  for (const entry of ctx.sessionManager.getBranch()) {
-    let usage;
-    if (entry.type === "message") {
-      const message = entry.message;
-      if (message.role === "assistant" || message.role === "toolResult") {
-        usage = message.usage;
-      }
-    } else if (entry.type === "compaction" || entry.type === "branch_summary") {
-      usage = entry.usage;
-    }
-    if (!usage) continue;
-    cost += usage.cost.total;
-    cacheRead += usage.cacheRead;
-    promptTokens += usage.input + usage.cacheRead + usage.cacheWrite;
-  }
-
-  return {
-    cost,
-    cachePercent: promptTokens > 0 ? (cacheRead / promptTokens) * 100 : null,
-  };
-}
-
 function estimateContentTokens(characters: number) {
   return Math.ceil(characters / CHARS_PER_ESTIMATED_TOKEN);
 }
@@ -54,6 +28,7 @@ export default function modelInfo(pi: ExtensionAPI) {
   let runContentStreamMs = 0;
   let lastLiveUpdate = 0;
   let currentContext: ExtensionContext | undefined;
+  const sessionMetrics = createSessionMetricsTracker();
 
   const publish = () => pi.events.emit(MODEL_INFO_CHANNEL, { ...state });
 
@@ -61,7 +36,6 @@ export default function modelInfo(pi: ExtensionAPI) {
     currentContext = ctx;
     const model = ctx.model;
     const usage = ctx.getContextUsage();
-    const metrics = getSessionMetrics(ctx);
 
     state = {
       ...state,
@@ -72,12 +46,14 @@ export default function modelInfo(pi: ExtensionAPI) {
       contextTokens: usage?.tokens ?? null,
       contextWindow: usage?.contextWindow ?? model?.contextWindow ?? 0,
       contextPercent: usage?.percent ?? null,
-      cachePercent: metrics.cachePercent,
-      cost: metrics.cost,
     };
     publish();
   }
 
+  function syncSessionMetrics(ctx: ExtensionContext) {
+    state = { ...state, ...sessionMetrics.sync(ctx.sessionManager) };
+  }
+
   function resetMessageTracking() {
     contentStreamStart = null;
     lastContentDeltaAt = null;
@@ -97,6 +73,8 @@ export default function modelInfo(pi: ExtensionAPI) {
     runContentTokens = 0;
     runContentStreamMs = 0;
     state = { ...state, tokensPerSecond: null, generating: false };
+    sessionMetrics.reset();
+    syncSessionMetrics(ctx);
     refresh(ctx);
   });
 
@@ -213,14 +191,23 @@ export default function modelInfo(pi: ExtensionAPI) {
     refresh(ctx);
   });
 
-  pi.on("turn_end", (_event, ctx) => refresh(ctx));
+  pi.on("turn_end", (_event, ctx) => {
+    syncSessionMetrics(ctx);
+    refresh(ctx);
+  });
 
   // Compaction and branch moves rewrite history, so the cached percentage is
   // stale the moment they land. Pi reports unknown occupancy until the next
   // assistant reply, which is the honest state to show.
-  pi.on("session_compact", (_event, ctx) => refresh(ctx));
+  pi.on("session_compact", (_event, ctx) => {
+    syncSessionMetrics(ctx);
+    refresh(ctx);
+  });
 
-  pi.on("session_tree", (_event, ctx) => refresh(ctx));
+  pi.on("session_tree", (_event, ctx) => {
+    syncSessionMetrics(ctx);
+    refresh(ctx);
+  });
 
   pi.on("agent_settled", (_event, ctx) => {
     state = { ...state, generating: false };
@@ -230,5 +217,6 @@ export default function modelInfo(pi: ExtensionAPI) {
   pi.on("session_shutdown", () => {
     stopRefreshListener();
     currentContext = undefined;
+    sessionMetrics.reset();
   });
 }

package/extensions/model-info/session-metrics.ts

@@ -0,0 +1,96 @@
+import type { SessionEntry } from "@earendil-works/pi-coding-agent";
+import type { Usage } from "@earendil-works/pi-ai";
+
+type SessionMetricsManager = {
+  getSessionId(): string;
+  getLeafId(): string | null;
+  getEntry(id: string): SessionEntry | undefined;
+};
+
+type PrefixMetrics = Readonly<{
+  cost: number;
+  cacheRead: number;
+  promptTokens: number;
+}>;
+
+const EMPTY_PREFIX: PrefixMetrics = Object.freeze({
+  cost: 0,
+  cacheRead: 0,
+  promptTokens: 0,
+});
+
+function getUsage(entry: SessionEntry): Usage | undefined {
+  if (entry.type === "message") {
+    return entry.message.role === "assistant" ||
+      entry.message.role === "toolResult"
+      ? entry.message.usage
+      : undefined;
+  }
+  return entry.type === "compaction" || entry.type === "branch_summary"
+    ? entry.usage
+    : undefined;
+}
+
+function addUsage(prefix: PrefixMetrics, entry: SessionEntry): PrefixMetrics {
+  const usage = getUsage(entry);
+  if (!usage) return prefix;
+  return Object.freeze({
+    cost: prefix.cost + usage.cost.total,
+    cacheRead: prefix.cacheRead + usage.cacheRead,
+    promptTokens:
+      prefix.promptTokens + usage.input + usage.cacheRead + usage.cacheWrite,
+  });
+}
+
+function toMetrics(prefix: PrefixMetrics) {
+  return {
+    cost: prefix.cost,
+    cachePercent:
+      prefix.promptTokens > 0
+        ? (prefix.cacheRead / prefix.promptTokens) * 100
+        : null,
+  };
+}
+
+export function createSessionMetricsTracker() {
+  let sessionId: string | undefined;
+  let prefixes = new Map<string, PrefixMetrics>();
+
+  const reset = () => {
+    sessionId = undefined;
+    prefixes = new Map();
+  };
+
+  const sync = (manager: SessionMetricsManager) => {
+    const nextSessionId = manager.getSessionId();
+    if (sessionId !== nextSessionId) reset();
+    sessionId = nextSessionId;
+
+    const leafId = manager.getLeafId();
+    if (!leafId) return toMetrics(EMPTY_PREFIX);
+
+    const cachedLeaf = prefixes.get(leafId);
+    if (cachedLeaf) return toMetrics(cachedLeaf);
+
+    const suffix: SessionEntry[] = [];
+    let currentId: string | null = leafId;
+    while (currentId && !prefixes.has(currentId)) {
+      const entry = manager.getEntry(currentId);
+      if (!entry) break;
+      suffix.push(entry);
+      currentId = entry.parentId;
+    }
+
+    let prefix = currentId
+      ? (prefixes.get(currentId) ?? EMPTY_PREFIX)
+      : EMPTY_PREFIX;
+    for (const entry of suffix.reverse()) {
+      prefix = addUsage(prefix, entry);
+      prefixes.set(entry.id, prefix);
+    }
+
+    return toMetrics(prefixes.get(leafId) ?? EMPTY_PREFIX);
+  };
+
+  return { sync, reset };
+}

package/extensions/plan-mode/bash-policy.ts

@@ -11,11 +11,13 @@
  *
  * THREAT MODEL. The adversary is a model that would start changing things
  * before the user approved a plan — including one steered by injected text it
- * read while investigating. It is NOT a hostile repository: `git diff` honors
- * `diff.external` from the repo's own config, so a checkout whose `.git/config`
- * is attacker-controlled can run a program through a command this module
- * allows. Nothing here can prevent that, and nothing above it tries to: pi
- * already runs the project's own tooling under the user's trust decision.
+ * read while investigating. Repository-configured diff drivers are also in
+ * scope for commands that render patches: raw `git diff`, `git show`,
+ * `git whatchanged`, and diff-generating `git log` forms are refused here. Plan
+ * Mode exposes the structured git-read tools instead; they force
+ * `--no-ext-diff --no-textconv --no-color` in argv. This is not a claim that
+ * every hostile Git configuration is inert: the remaining Git investigation
+ * commands still run under Pi's existing project trust boundary.
  *
  * EVERY LIST BELOW IS AN ALLOWLIST, deliberately. An earlier version scanned
  * for known-dangerous flags instead, and review found four separate escapes in
@@ -50,9 +52,7 @@ const UNQUOTED_GLOB_CHARACTERS = new Set(["*", "?", "[", "]"]);
  */
 const GIT_SUBCOMMANDS = new Set([
   "log",
-  "diff",
   "status",
-  "show",
   "blame",
   "shortlog",
   "describe",
@@ -63,10 +63,11 @@ const GIT_SUBCOMMANDS = new Set([
   "cat-file",
   "merge-base",
   "name-rev",
-  "whatchanged",
   "grep",
 ]);
 
+const GIT_DIFF_SUBCOMMANDS = new Set(["diff", "show", "whatchanged"]);
+
 /**
  * Flags accepted after a git subcommand. The admission rule for this list is
  * narrow: a flag qualifies only if it shapes OUTPUT or SELECTS commits, and
@@ -159,6 +160,27 @@ const GIT_FLAGS = new Set([
   "--count",
 ]);
 
+/**
+ * Options that make `git log` enter the diff machinery. Git enables textconv
+ * by default for porcelain log/diff output, so these must use the structured
+ * git tools even though plain history browsing remains safe and useful.
+ */
+const GIT_LOG_DIFF_FLAGS = new Set([
+  "-p",
+  "--patch",
+  "--stat",
+  "--shortstat",
+  "--numstat",
+  "--summary",
+  "--raw",
+  "--name-only",
+  "--name-status",
+  "--word-diff",
+  "-U",
+  "--unified",
+  "-L",
+]);
+
 /** gh subcommands paired with the verbs under each that only read. */
 const GH_SUBCOMMANDS = new Map<string, ReadonlySet<string>>([
   ["pr", new Set(["view", "list", "diff", "checks", "status"])],
@@ -377,6 +399,16 @@ function flagName(word: string) {
   return eq === -1 ? word : word.slice(0, eq);
 }
 
+function firstMatchedFlag(
+  words: readonly string[],
+  flags: ReadonlySet<string>,
+) {
+  for (const word of words) {
+    if (word === "--") break;
+    if (flags.has(flagName(word))) return word;
+  }
+}
+
 /**
  * Check the argument tail. Words after `--` are pathspecs by definition and
  * need no check; before it, a word either is an allowlisted flag or is not a
@@ -439,11 +471,24 @@ export function planBashDecision(command: unknown): BashPlanDecision {
    */
   if (program === "git") {
     const [subcommand, ...args] = rest;
+    if (subcommand && GIT_DIFF_SUBCOMMANDS.has(subcommand)) {
+      return refuse(
+        `plan mode does not run raw "git ${subcommand}" because repository diff drivers may execute external programs — use git_diff or git_show instead (and git_log to find commits)`,
+      );
+    }
     if (!subcommand || !GIT_SUBCOMMANDS.has(subcommand)) {
       return refuse(
-        `plan mode allows only a read-only git subcommand immediately after "git" (log, diff, status, show, blame, …), not "${subcommand ?? "(none)"}"`,
+        `plan mode allows only a read-only git subcommand immediately after "git" (log, status, blame, …), not "${subcommand ?? "(none)"}"`,
       );
     }
+    if (subcommand === "log") {
+      const diffFlag = firstMatchedFlag(args, GIT_LOG_DIFF_FLAGS);
+      if (diffFlag) {
+        return refuse(
+          `plan mode does not run raw "git log ${diffFlag}" because diff-generating log options may execute repository diff drivers — use git_log to find commits, then git_show or git_diff to inspect changes`,
+        );
+      }
+    }
     return scanArguments(args, GIT_FLAGS, "git");
   }
 

package/extensions/plan-mode/index.ts

@@ -37,6 +37,7 @@ import {
   type PlanModeState,
 } from "../shared/plan-mode-state.ts";
 import {
+  loadOpenPiCapabilities,
   OPENPI_TOOL_SURFACE,
   patchOwnedTools,
 } from "../shared/tool-surface.ts";
@@ -173,6 +174,9 @@ export const PLAN_SAFE_TOOLS = new Set([
   "ls",
   "fd",
   "rg",
+  "git_show",
+  "git_diff",
+  "git_log",
   // Web research without write actions.
   "web_search",
   "source_check",
@@ -208,7 +212,7 @@ export const PLAN_SAFE_TOOLS = new Set([
 ]);
 
 export const BLOCK_REASON =
-  "Plan mode is active: no changes yet. Keep investigating with read-only tools (read, fd, rg, web search, read-only bash like git log/diff/status, and subagent_spawn for parallel exploration — planning children get read-only tools). When the plan is decision-complete, call plan_ready alone with the complete Markdown plan; the user then chooses the next action with `/plan`, or cancels with `/plan off`.";
+  "Plan mode is active: no changes yet. Keep investigating with read-only tools (read, fd, rg, git_log/git_diff/git_show, web search, read-only bash like git log/status, and subagent_spawn for parallel exploration — planning children get read-only tools). Raw git diff/show and diff-generating git log forms are blocked; use the structured Git tools instead. When the plan is decision-complete, call plan_ready alone with the complete Markdown plan; the user then chooses the next action with `/plan`, or cancels with `/plan off`.";
 
 export function planToolCallDecision(
   toolName: string,
@@ -256,6 +260,7 @@ export default function planMode(pi: ExtensionAPI) {
     hasUI: boolean;
     ui: { setStatus: (key: string, value?: string) => void };
   }) => {
+    if (planning) loadOpenPiCapabilities(pi, ["search"]);
     syncPlanTool();
     pi.events.emit(PLAN_MODE_CHANNEL, { planning } satisfies PlanModeState);
     if (!ctx.hasUI) return;
@@ -519,7 +524,7 @@ export default function planMode(pi: ExtensionAPI) {
         {
           customType: "plan-mode-armed",
           content:
-            `Plan mode is on: investigate and propose a plan, but do not change anything yet. Edits and writes are blocked until the user explicitly chooses an implementation action. For files use the read, ls, grep and fd tools; bash is limited to read-only git and gh history commands such as \`git log\`, \`git diff\`, \`git status\`, \`git show\`, \`git blame\` and \`gh pr view\` — one plain command, no pipes or redirects. You can still delegate with \`subagent_spawn\` to explore several parts of the codebase at once: children spawned while planning receive read-only tools, so use them for investigation rather than for work to be done later.${objective ? `\n\nPlan for: ${objective}` : ""}` +
+            `Plan mode is on: investigate and propose a plan, but do not change anything yet. Edits and writes are blocked until the user explicitly chooses an implementation action. For files use the read, ls, grep, fd and rg tools. Use \`git_log\`, \`git_diff\` and \`git_show\` for history and changes; they disable repository external diff and textconv programs. Bash is limited to read-only git and gh commands such as \`git log\`, \`git status\`, \`git blame\` and \`gh pr view\` — raw Git commands that render diffs are blocked, and every Bash call must be one plain command with no pipes or redirects. You can still delegate with \`subagent_spawn\` to explore several parts of the codebase at once: children spawned while planning receive read-only tools, so use them for investigation rather than for work to be done later.${objective ? `\n\nPlan for: ${objective}` : ""}` +
             "\n\nUse read-only tools to ground the plan. When it is decision-complete, call `plan_ready` alone with the complete Markdown plan. That records the plan but does not start implementation; the user chooses the next action with `/plan`.",
           display: true,
           details: {},

package/extensions/post-edit/index.ts

@@ -21,6 +21,14 @@ import { sanitizeTerminalText } from "../shared/terminal-text.ts";
 
 /** Tools whose success means a file on disk changed. */
 const MUTATING_TOOLS = new Set(["write", "edit"]);
+const NOTICE_COMMAND_MAX_CHARS = 160;
+const NOTICE_DETAIL_MAX_CHARS = 320;
+
+function boundedNoticeText(value: string, maxChars: number) {
+  const chars = [...sanitizeTerminalText(value).trim()];
+  if (chars.length <= maxChars) return chars.join("");
+  return `${chars.slice(0, maxChars - 1).join("")}…`;
+}
 
 export default function postEdit(
   pi: ExtensionAPI,
@@ -75,18 +83,20 @@ export default function postEdit(
       })
       .then((result) => {
         if (result.code === 0) return;
-        const detail = sanitizeTerminalText(
+        const commandPreview = boundedNoticeText(ran, NOTICE_COMMAND_MAX_CHARS);
+        const detail = boundedNoticeText(
           result.stderr || result.stdout || "",
-        )
-          .trim()
-          .slice(0, 500);
+          NOTICE_DETAIL_MAX_CHARS,
+        );
         warn(
-          `post-edit command failed (exit ${result.code}): ${sanitizeTerminalText(ran)}${detail ? `\n${detail}` : ""}`,
+          `post-edit command failed (exit ${result.code}): ${commandPreview}${detail ? `\n${detail}` : ""}`,
         );
       })
       .catch((error: unknown) => {
         const detail = error instanceof Error ? error.message : String(error);
-        warn(`post-edit command could not run: ${detail}`);
+        warn(
+          `post-edit command could not run: ${boundedNoticeText(detail, NOTICE_DETAIL_MAX_CHARS)}`,
+        );
       })
       .finally(() => {
         if (active?.controller === controller) active = undefined;