@vanillagreen/pi-claude-bridge 1.6.2 → 1.8.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vanillagreen/pi-claude-bridge",
-  "version": "1.6.2",
+  "version": "1.8.0",
   "description": "Pi provider bridge that runs Claude Code through the Claude Agent SDK, with opt-in forwarding for Pi prompt context.",
   "type": "module",
   "keywords": [
@@ -142,8 +142,8 @@
     }
   },
   "dependencies": {
-    "@anthropic-ai/claude-agent-sdk": "0.3.158",
-    "@anthropic-ai/sdk": "0.93.0",
+    "@anthropic-ai/claude-agent-sdk": "^0.3.215",
+    "@anthropic-ai/sdk": "^0.112.4",
     "cc-session-io": "^0.3.1",
     "change-case": "^5.4.4"
   },
@@ -152,8 +152,8 @@
     "@earendil-works/pi-coding-agent": "*"
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "^0.75.0",
-    "@earendil-works/pi-coding-agent": "^0.75.0",
+    "@earendil-works/pi-ai": "^0.80.10",
+    "@earendil-works/pi-coding-agent": "^0.80.10",
     "@types/node": "^24.3.0",
     "esbuild": "^0.28.0",
     "tsx": "^4.21.0",

package/src/agents-md.ts

@@ -2,20 +2,30 @@
 //
 // Pi uses AGENTS.md for long-lived instructions; Claude Code reads the same
 // content under "# CLAUDE.md". We walk up from cwd looking for AGENTS.md,
-// fall back to ~/.pi/agent/AGENTS.md, and rewrite pi-specific references
+// fall back to <piUserDir>/AGENTS.md (~/.pi/agent/AGENTS.md unless
+// PI_CODING_AGENT_DIR points elsewhere), and rewrite pi-specific references
 // (~/.pi, .pi/, .pi, pi) to their Claude Code equivalents so any paths or
 // references in the file still resolve inside the CC subprocess.
+//
+// In isolated mode (CLAUDE_BRIDGE_ISOLATED=1) the cwd walk is disabled: only
+// the piUserDir file is consulted, so a host app that owns the agent dir owns
+// the full instruction surface.
 
 import { existsSync, readFileSync } from "fs";
-import { homedir } from "os";
 import { dirname, join, resolve } from "path";
+import { isolatedFromEnv, piUserDir } from "./config.js";
 
-const GLOBAL_AGENTS_PATH = join(homedir(), ".pi", "agent", "AGENTS.md");
+function globalAgentsPath(): string {
+	return join(piUserDir(), "AGENTS.md");
+}
 
 export function resolveAgentsMdPath(): string | undefined {
-	const fromCwd = findAgentsMdInParents(process.cwd());
-	if (fromCwd) return fromCwd;
-	if (existsSync(GLOBAL_AGENTS_PATH)) return GLOBAL_AGENTS_PATH;
+	if (!isolatedFromEnv()) {
+		const fromCwd = findAgentsMdInParents(process.cwd());
+		if (fromCwd) return fromCwd;
+	}
+	const globalPath = globalAgentsPath();
+	if (existsSync(globalPath)) return globalPath;
 	return undefined;
 }
 

package/src/auth-presence.ts

@@ -0,0 +1,158 @@
+// --- Claude credential presence (availability honesty) ---
+//
+// The bridge may only advertise claude-bridge models when the machine actually
+// has Claude credentials the Claude Agent SDK can authenticate with. Otherwise
+// pi's ModelRegistry.hasConfiguredAuth() would treat the dummy `apiKey:
+// "not-used"` as "configured" and the provider would look connected while every
+// request fails at spawn time.
+//
+// This module answers two pure questions used to gate registration:
+//   1. hasClaudeCredentials() — are real credentials present RIGHT NOW?
+//   2. decideRegistration()   — given credential presence + the primary-instance
+//      / stream-guard tokens, should we register / unregister / do nothing?
+//
+// SECURITY: this module only ever checks for the EXISTENCE of credentials — a
+// file's presence, an env var being non-empty, a settings key being a non-empty
+// string. It NEVER opens or logs `.credentials.json`, and where it must parse
+// `settings.json` (for apiKeyHelper) it reads only whether the key is a
+// non-empty string and never logs its value. Credential CONTENTS are never read
+// or logged.
+
+import { existsSync, readFileSync } from "fs";
+import { homedir, platform as osPlatform } from "os";
+import { join } from "path";
+
+/**
+ * Resolve the Claude config directory the same way the bundled cc-session-io
+ * (getClaudeDir) and Claude Code itself resolve it: an explicit
+ * CLAUDE_CONFIG_DIR wins, otherwise ~/.claude.
+ *
+ * Deliberate divergence from cc-session-io's plain `env ?? default`: we treat a
+ * SET-BUT-EMPTY/whitespace CLAUDE_CONFIG_DIR as unset and fall back to ~/.claude
+ * (an empty string would otherwise resolve credential probes to the process cwd
+ * root). The returned value is trimmed so downstream joins never carry stray
+ * whitespace.
+ */
+export function resolveClaudeConfigDir(env: NodeJS.ProcessEnv = process.env): string {
+	const configured = env.CLAUDE_CONFIG_DIR;
+	if (typeof configured === "string" && configured.trim().length > 0) return configured.trim();
+	return join(homedir(), ".claude");
+}
+
+function nonEmptyEnv(value: string | undefined): boolean {
+	return typeof value === "string" && value.trim().length > 0;
+}
+
+// Matches how Claude Code interprets its boolean provider-routing env flags:
+// only "1" / "true" (case-insensitive) enable them.
+function envTruthy(value: string | undefined): boolean {
+	const v = value?.trim().toLowerCase();
+	return v === "1" || v === "true";
+}
+
+/**
+ * True when `${configDir}/settings.json` exists, parses as JSON, and carries a
+ * non-empty `apiKeyHelper` string (an enterprise/custom auth command that
+ * produces a key). Parse/read errors are tolerated as "not present". The helper
+ * VALUE is never logged — only its presence/non-emptiness is used.
+ */
+function hasApiKeyHelper(configDir: string): boolean {
+	try {
+		const settingsPath = join(configDir, "settings.json");
+		if (!existsSync(settingsPath)) return false;
+		const parsed = JSON.parse(readFileSync(settingsPath, "utf8")) as { apiKeyHelper?: unknown };
+		return typeof parsed?.apiKeyHelper === "string" && parsed.apiKeyHelper.trim().length > 0;
+	} catch {
+		return false;
+	}
+}
+
+/**
+ * True when real Claude credentials are present in any location the Claude Agent
+ * SDK would authenticate from, WITHOUT reading credential contents. Checked in
+ * cheap-first order:
+ *   - env: non-empty CLAUDE_CODE_OAUTH_TOKEN / ANTHROPIC_API_KEY /
+ *     ANTHROPIC_AUTH_TOKEN, or any truthy cloud-provider routing flag the Claude
+ *     Code SDK recognizes — CLAUDE_CODE_USE_BEDROCK / _VERTEX / _FOUNDRY /
+ *     _ANTHROPIC_AWS / _MANTLE (such routing needs no local key file);
+ *   - `.credentials.json` in the resolved config dir (existence only — the file
+ *     is never opened; written mode 0600 by `claude login`);
+ *   - `settings.json` apiKeyHelper (presence only — see hasApiKeyHelper).
+ *
+ * PLATFORM ASYMMETRY: on macOS the `claude` CLI stores OAuth tokens in the login
+ * Keychain, NOT in `.credentials.json`, so file-absence is NOT evidence of
+ * logged-out and we cannot cheaply/safely probe the Keychain here. On darwin,
+ * when no other signal is present, we default to credentialed=true — preserving
+ * the pre-fix "always available" behavior for Mac subscription users. Honesty
+ * enforcement therefore applies on Linux/Windows, where `.credentials.json`
+ * existence is an observable, truthful proxy (empirically, `claude auth logout`
+ * unlinks it).
+ */
+export function hasClaudeCredentials(
+	env: NodeJS.ProcessEnv = process.env,
+	platform: NodeJS.Platform = osPlatform(),
+): boolean {
+	if (nonEmptyEnv(env.CLAUDE_CODE_OAUTH_TOKEN)) return true;
+	if (nonEmptyEnv(env.ANTHROPIC_API_KEY)) return true;
+	if (nonEmptyEnv(env.ANTHROPIC_AUTH_TOKEN)) return true;
+	if (envTruthy(env.CLAUDE_CODE_USE_BEDROCK)) return true;
+	if (envTruthy(env.CLAUDE_CODE_USE_VERTEX)) return true;
+	if (envTruthy(env.CLAUDE_CODE_USE_FOUNDRY)) return true;
+	if (envTruthy(env.CLAUDE_CODE_USE_ANTHROPIC_AWS)) return true;
+	if (envTruthy(env.CLAUDE_CODE_USE_MANTLE)) return true;
+
+	const configDir = resolveClaudeConfigDir(env);
+	if (existsSync(join(configDir, ".credentials.json"))) return true;
+	if (hasApiKeyHelper(configDir)) return true;
+
+	if (platform === "darwin") return true;
+
+	return false;
+}
+
+/**
+ * Snapshot of the inputs to a registration decision.
+ *
+ * The bridge keeps two process-global tokens (Symbol.for): a PRIMARY-instance
+ * token, claimed unconditionally by the first-loaded module instance, and the
+ * stream-guard token holding the registered instance's streamSimple. ONLY the
+ * primary instance may ever register/unregister or claim the stream guard — this
+ * prevents a subagent module reload (a fresh, non-primary instance) from
+ * stealing ownership and registering ITS streamSimple, which would split-brain
+ * the shared session/ctx and break tool-result delivery.
+ */
+export interface RegistrationState {
+	/** Does the machine have Claude credentials right now? */
+	credentialed: boolean;
+	/** Is THIS module instance the primary (first-loaded) instance? */
+	isPrimary: boolean;
+	/** Has this instance already registered (owns the stream guard)? */
+	registered: boolean;
+}
+
+export type RegistrationDecision = "register" | "unregister" | "noop";
+
+/**
+ * Pure decision for extension load, every session_start re-check, and the
+ * pre-spawn fail-fast path.
+ *
+ * Rules:
+ *   - Not the primary instance                    → NOOP (never touch registration).
+ *   - Primary + credentialed + not registered     → REGISTER (claim guard + register).
+ *   - Primary + credentialed + already registered → NOOP.
+ *   - Primary + uncredentialed                    → UNREGISTER (defensive).
+ *
+ * The uncredentialed primary always returns UNREGISTER rather than NOOP:
+ * pi.unregisterProvider is idempotent ("Has no effect if the provider was never
+ * registered"), and a defensive call is the ONLY way to retract a registration
+ * that survived a /reload — the ModelRegistry's registeredProviders is a
+ * process-lifetime Map and module reload does NOT clear it. (At extension-load
+ * time this defensive unregister only filters the pending-registration queue and
+ * cannot mutate the persistent registry; the authoritative retraction happens on
+ * the post-load session_start re-check — see applyProviderRegistration.)
+ */
+export function decideRegistration(state: RegistrationState): RegistrationDecision {
+	if (!state.isPrimary) return "noop";
+	if (state.credentialed) return state.registered ? "noop" : "register";
+	return "unregister";
+}

package/src/config.ts

@@ -13,6 +13,14 @@ export type BridgeEffortLevel = "low" | "medium" | "high" | "xhigh" | "max";
 
 const VALID_EFFORT_LEVELS = new Set<BridgeEffortLevel>(["low", "medium", "high", "xhigh", "max"]);
 
+/**
+ * Per-session control over claude.ai connector WRITE tools when connectors are
+ * enabled. `deny` (default) hides Gmail/Calendar/Drive mutating tools so
+ * connector chat sessions are read-only; `allow` exposes them (used only by the
+ * one-shot approved-write executor). Reads are always available.
+ */
+export type ConnectorWriteMode = "deny" | "allow";
+
 export interface Config {
 	enabled?: boolean;
 	/** Low-level Claude Agent SDK plumbing. Most users won't need these. */
@@ -28,6 +36,27 @@ export interface Config {
 		settingSources?: SettingSource[];
 		strictMcpConfig?: boolean;
 		pathToClaudeCodeExecutable?: string;
+		/**
+		 * Expose the authenticated Claude account's claude.ai cloud MCP
+		 * connectors (Gmail / Google Calendar / Google Drive, etc.) to the model.
+		 * Off by default so Pi owns tool execution and tokens stay lean. Also
+		 * settable via the CLAUDE_BRIDGE_ENABLE_CONNECTORS env var (env OR config
+		 * enables it). See docs/plans/claude-bridge-google-connectors.md.
+		 */
+		enableConnectors?: boolean;
+		/**
+		 * When connectors are enabled, whether their WRITE tools
+		 * (create/update/delete/label/etc.) are exposed. Defaults to `deny`
+		 * (read-only), enforced two ways: known write tools are removed from the
+		 * model's context (disallowedTools by exact id), and a PreToolUse hook
+		 * blocks any connector write tool by name prefix at call time (covers
+		 * future write tools). `allow` disables both — intended ONLY for a
+		 * one-shot approved-write executor process. Also settable via
+		 * CLAUDE_BRIDGE_CONNECTOR_WRITE=deny|allow (env wins over config). Any
+		 * value but exact `allow` is treated as `deny`. Ignored when connectors
+		 * are disabled.
+		 */
+		connectorWriteMode?: ConnectorWriteMode;
 	};
 	/** Extra Pi context forwarded to Claude Code on top of AGENTS.md + skills. */
 	promptContext?: {
@@ -46,10 +75,29 @@ function expandHome(input: string): string {
 	return input;
 }
 
-function piUserDir(): string {
+/**
+ * The Pi agent config dir: `PI_CODING_AGENT_DIR` when set, else `~/.pi/agent`.
+ * Every bridge default that used to hardcode `~/.pi/agent` routes through this
+ * so a host app that owns the agent dir owns those paths too.
+ */
+export function piUserDir(): string {
 	return resolve(expandHome(process.env.PI_CODING_AGENT_DIR?.trim() || "~/.pi/agent"));
 }
 
+/**
+ * Isolated mode (`CLAUDE_BRIDGE_ISOLATED=1`): a host app embedding the bridge
+ * declares that nothing outside its explicitly configured dirs may be read.
+ * Disables every cwd/home discovery fallback — the cwd AGENTS.md walk, project
+ * `.pi/` settings + claude-bridge.json, project APPEND_SYSTEM.md, and the
+ * `$PATH` claude executable search. Reads stay confined to `piUserDir()` (i.e.
+ * `PI_CODING_AGENT_DIR`) and the explicitly configured executable path.
+ * Default (unset) behavior for normal pi CLI users is unchanged.
+ */
+export function isolatedFromEnv(): boolean {
+	const v = (process.env.CLAUDE_BRIDGE_ISOLATED ?? "").trim().toLowerCase();
+	return v === "1" || v === "true" || v === "yes" || v === "on";
+}
+
 function asRecord(value: unknown): SettingsRecord | undefined {
 	return value && typeof value === "object" && !Array.isArray(value) ? value as SettingsRecord : undefined;
 }
@@ -93,6 +141,10 @@ function projectTrustRegistry(): ProjectTrustRegistry {
 
 export function recordProjectTrust(ctx: { cwd?: string; isProjectTrusted?: () => boolean }): void {
 	if (!ctx.cwd) return;
+	// Isolated mode never reads project config, so recording trust would only
+	// run the cwd-ancestor `.pi/settings.json` walk (a filesystem probe outside
+	// the host-owned dirs) for a result nothing consumes. Skip it entirely.
+	if (isolatedFromEnv()) return;
 	let trusted = true;
 	try {
 		trusted = ctx.isProjectTrusted?.() === true;
@@ -111,6 +163,7 @@ function projectSettingsTrusted(settingsPath: string): boolean {
 
 function settingsPaths(cwd: string): string[] {
 	const user = join(piUserDir(), "settings.json");
+	if (isolatedFromEnv()) return [user];
 	const project = projectSettingsPath(cwd);
 	return projectSettingsTrusted(project) ? [user, project] : [user];
 }
@@ -155,6 +208,13 @@ function hasOwn(raw: SettingsRecord, key: string): boolean {
 	return Object.prototype.hasOwnProperty.call(raw, key);
 }
 
+export function normalizeConnectorWriteMode(value: unknown): ConnectorWriteMode | undefined {
+	if (typeof value !== "string") return undefined;
+	const normalized = value.trim().toLowerCase();
+	if (normalized === "deny" || normalized === "allow") return normalized;
+	return undefined;
+}
+
 export function normalizeEffortLevel(value: unknown): BridgeEffortLevel | undefined {
 	if (typeof value !== "string") return undefined;
 	const normalized = value.trim().toLowerCase();
@@ -195,6 +255,13 @@ function normalizeProviderConfig(provider: Config["provider"] | undefined): Conf
 	const modelEffortOverrides = normalizeModelEffortOverrides(raw.modelEffortOverrides);
 	if (modelEffortOverrides) out.modelEffortOverrides = modelEffortOverrides;
 	else delete out.modelEffortOverrides;
+	// Fail closed: legacy config files are merged raw, so an unvalidated
+	// connectorWriteMode (e.g. "Deny", "read-only", true) must not slip through as
+	// a truthy non-"allow" value. Drop anything that isn't exactly deny/allow so
+	// the resolver falls back to the default deny.
+	const connectorWriteMode = normalizeConnectorWriteMode(raw.connectorWriteMode);
+	if (connectorWriteMode) out.connectorWriteMode = connectorWriteMode;
+	else delete out.connectorWriteMode;
 	return out;
 }
 
@@ -216,6 +283,10 @@ function managerToConfig(raw: SettingsRecord): Partial<Config> {
 	}
 	const strictMcpConfig = boolFrom(raw, "strictMcpConfig");
 	if (strictMcpConfig !== undefined) provider.strictMcpConfig = strictMcpConfig;
+	const enableConnectors = boolFrom(raw, "enableConnectors");
+	if (enableConnectors !== undefined) provider.enableConnectors = enableConnectors;
+	const connectorWriteMode = normalizeConnectorWriteMode(raw.connectorWriteMode);
+	if (connectorWriteMode) provider.connectorWriteMode = connectorWriteMode;
 	const claudePath = stringFrom(raw, "pathToClaudeCodeExecutable");
 	if (claudePath) provider.pathToClaudeCodeExecutable = claudePath;
 
@@ -237,8 +308,9 @@ function managerToConfig(raw: SettingsRecord): Partial<Config> {
 
 export function loadConfig(cwd: string): Config {
 	const global = tryParseJson(join(piUserDir(), "claude-bridge.json"));
-	const projectSettings = projectSettingsPath(cwd);
-	const trustedProject = projectSettingsTrusted(projectSettings);
+	const isolated = isolatedFromEnv();
+	const projectSettings = isolated ? undefined : projectSettingsPath(cwd);
+	const trustedProject = projectSettings !== undefined && projectSettingsTrusted(projectSettings);
 	const project = trustedProject ? tryParseJson(join(dirname(projectSettings), "claude-bridge.json")) : {};
 	const manager = managerToConfig(readManagerConfig(cwd));
 	const provider = normalizeProviderConfig({ ...global.provider, ...project.provider, ...manager.provider });