@vitos-pizza/vitos-pizza 0.1.0 → 0.2.0

package/node_modules/@vitos-pizza/permission-system/src/handlers/before-agent-start.ts

@@ -1,65 +1,86 @@
-import type {
-	BeforeAgentStartEventResult,
-	ExtensionAPI,
-	ExtensionContext,
-} from "@earendil-works/pi-coding-agent";
-import type { PermissionSession } from "../permission-session.ts";
-import { sanitizeSkillPromptBlocks } from "../sanitizers/skill-prompt.ts";
-import { sanitizeAvailableToolsSection } from "../sanitizers/system-prompt.ts";
-
-export function registerBeforeAgentStart(
-	pi: ExtensionAPI,
-	session: PermissionSession,
-): void {
-	pi.on("before_agent_start", async (event, ctx) => {
-		session.refresh(ctx);
-		const agentName = session.resolveAgentName(ctx, event.systemPrompt);
-		session.setAgentName(agentName);
-
-		const config = session.getConfig();
-		const permission = config.permission ?? {};
-		const activeTools = pi.getActiveTools();
-		const allowedTools: string[] = [];
-
-		for (const toolName of activeTools) {
-			const state = session.evaluator.getToolPermission(permission, toolName, {
-				yoloMode: config.yoloMode,
-				sessionApprovals: session.sessionApprovals,
-			});
-			if (state !== "deny") allowedTools.push(toolName);
-		}
-
-		pi.setActiveTools(allowedTools);
-
-		const toolPromptResult = sanitizeAvailableToolsSection(
-			event.systemPrompt,
-			allowedTools,
-		);
-		const skillPromptResult = sanitizeSkillPromptBlocks(
-			toolPromptResult.prompt,
-			permission,
-			session.evaluator,
-			{ yoloMode: config.yoloMode, agentName },
-		);
-
-		if (
-			skillPromptResult.prompt !== event.systemPrompt ||
-			toolPromptResult.removed
-		) {
-			return { systemPrompt: skillPromptResult.prompt };
-		}
-		return {};
-	});
-}
-
-export function resolveAgentNameFromContext(
-	_ctx: ExtensionContext,
-	systemPrompt?: string,
-): string | undefined {
-	const match = systemPrompt
-		? /<active_agent>\s*([^\s<]+)/i.exec(systemPrompt)
-		: null;
-	return match?.[1];
-}
-
-export type { BeforeAgentStartEventResult };
+import type {
+	BeforeAgentStartEventResult,
+	ExtensionAPI,
+	ExtensionContext,
+} from "@earendil-works/pi-coding-agent";
+import type {
+	EvaluateOptions,
+	PermissionEvaluator,
+} from "../permission-evaluator.ts";
+import type { PermissionSession } from "../permission-session.ts";
+import { sanitizeSkillPromptBlocks } from "../sanitizers/skill-prompt.ts";
+import { sanitizeAvailableToolsSection } from "../sanitizers/system-prompt.ts";
+import type { FlatPermissionConfig } from "../types.ts";
+
+export function selectAllowedToolNames(
+	toolNames: readonly string[],
+	permission: FlatPermissionConfig,
+	evaluator: PermissionEvaluator,
+	options: EvaluateOptions = {},
+): string[] {
+	const allowedTools: string[] = [];
+	for (const toolName of toolNames) {
+		const state = evaluator.getToolPermission(permission, toolName, options);
+		if (state !== "deny") allowedTools.push(toolName);
+	}
+	return allowedTools;
+}
+
+export function registerBeforeAgentStart(
+	pi: ExtensionAPI,
+	session: PermissionSession,
+): void {
+	pi.on("before_agent_start", async (event, ctx) => {
+		session.refresh(ctx);
+		const agentName = session.resolveAgentName(ctx, event.systemPrompt);
+		session.setAgentName(agentName);
+
+		const config = session.getConfig();
+		const permission = config.permission ?? {};
+		// Start from all registered tools so leaving a narrowed mode (e.g. plan)
+		// can expand write/edit/bash again — getActiveTools() only shrinks.
+		const candidateTools = pi.getAllTools().map((tool) => tool.name);
+		const allowedTools = selectAllowedToolNames(
+			candidateTools,
+			permission,
+			session.evaluator,
+			{
+				yoloMode: config.yoloMode,
+				sessionApprovals: session.sessionApprovals,
+			},
+		);
+
+		pi.setActiveTools(allowedTools);
+
+		const toolPromptResult = sanitizeAvailableToolsSection(
+			event.systemPrompt,
+			allowedTools,
+		);
+		const skillPromptResult = sanitizeSkillPromptBlocks(
+			toolPromptResult.prompt,
+			permission,
+			session.evaluator,
+			{ yoloMode: config.yoloMode, agentName },
+		);
+
+		if (
+			skillPromptResult.prompt !== event.systemPrompt ||
+			toolPromptResult.removed
+		) {
+			return { systemPrompt: skillPromptResult.prompt };
+		}
+		return {};
+	});
+}
+
+export function resolveAgentNameFromContext(
+	_ctx: ExtensionContext,
+	systemPrompt?: string,
+): string | undefined {
+	const match = systemPrompt
+		? /<active_agent>\s*([^\s<]+)/i.exec(systemPrompt)
+		: null;
+	return match?.[1];
+}
+
+export type { BeforeAgentStartEventResult };

package/node_modules/@vitos-pizza/permission-system/src/handlers/skill-input.ts

@@ -1 +1 @@
-export { registerSkillInputGate } from "./tool-call-gate.ts";
+export { registerSkillInputGate } from "./tool-call-gate.ts";

package/node_modules/@vitos-pizza/permission-system/src/handlers/tool-call-gate.ts

@@ -1,199 +1,204 @@
-import type {
-	ExtensionAPI,
-	ExtensionContext,
-} from "@earendil-works/pi-coding-agent";
-import {
-	forwardPermissionPrompt,
-	resolveParentSessionId,
-} from "../forwarding/forwarder.ts";
-import { getSubagentSessionRegistry } from "../forwarding/subagent-registry.ts";
-import { runGatePipeline } from "../gates/pipeline.ts";
-import type { PermissionSession } from "../permission-session.ts";
-import { emitPermissionEvent } from "../service.ts";
-import type { GateContext } from "../types.ts";
-import {
-	buildApprovalSummary,
-	buildApprovalTitle,
-} from "../ui/approval-summary.ts";
-import { requestPermissionDecisionFromUi } from "../ui/permission-dialog.ts";
-
-export interface ToolGateDeps {
-	getRegisteredTools?: () => ReadonlySet<string>;
-	getSkillDirs?: () => readonly string[];
-	getParentSessionId?: () => string | null;
-}
-
-export function registerToolCallGate(
-	pi: ExtensionAPI,
-	session: PermissionSession,
-	deps: ToolGateDeps = {},
-): void {
-	pi.on("tool_call", async (event, ctx) => {
-		session.refresh(ctx);
-		const toolName = event.toolName;
-		const config = session.getConfig();
-		const permission = config.permission ?? {};
-		const registeredTools =
-			deps.getRegisteredTools?.() ??
-			new Set(pi.getAllTools().map((tool) => tool.name));
-
-		const gateContext: GateContext = {
-			toolName,
-			input: (event.input ?? {}) as Record<string, unknown>,
-			cwd: ctx.cwd,
-			agentName: session.resolveAgentName(ctx),
-		};
-
-		const result = runGatePipeline(permission, session.evaluator, gateContext, {
-			yoloMode: config.yoloMode,
-			platform: process.platform,
-			skillDirs: deps.getSkillDirs?.() ?? [],
-			registeredTools,
-		});
-
-		emitPermissionEvent(pi, "permissions:decision", {
-			toolName,
-			state: result.state,
-			surface: result.surface,
-			value: result.value,
-			matchedPattern: result.matchedPattern,
-		});
-
-		if (result.state === "deny") {
-			return {
-				block: true,
-				reason: result.reason ?? `Permission denied for ${toolName}`,
-			};
-		}
-
-		if (result.state === "allow") {
-			return;
-		}
-
-		const decision = await resolveAskDecision(
-			pi,
-			ctx,
-			session,
-			gateContext,
-			result.matchedPattern,
-			deps,
-		);
-		if (!decision.approved) {
-			return {
-				block: true,
-				reason:
-					decision.denialReason ??
-					(decision.confirmationUnavailable
-						? "Permission confirmation unavailable"
-						: "Permission denied by user"),
-			};
-		}
-
-		if (decision.state === "approved_for_session" && result.matchedPattern) {
-			session.sessionApprovals.add(result.surface, result.matchedPattern);
-		}
-	});
-}
-
-async function resolveAskDecision(
-	pi: ExtensionAPI,
-	ctx: ExtensionContext,
-	_session: PermissionSession,
-	gateContext: GateContext,
-	matchedPattern: string | undefined,
-	deps: ToolGateDeps,
-) {
-	const title = buildApprovalTitle(gateContext.toolName);
-	const message = buildApprovalSummary(gateContext);
-
-	if (ctx.hasUI) {
-		emitPermissionEvent(pi, "permissions:ui_prompt", {
-			toolName: gateContext.toolName,
-			surface: gateContext.toolName,
-			value: message,
-		});
-		return requestPermissionDecisionFromUi(ctx.ui, title, message, {
-			sessionLabel: matchedPattern
-				? `Yes, for this session (${matchedPattern})`
-				: undefined,
-		});
-	}
-
-	const currentSessionId = ctx.sessionManager.getSessionId?.() ?? null;
-	const registry = getSubagentSessionRegistry();
-	const parentFromRegistry = currentSessionId
-		? registry.get(currentSessionId)?.parentSessionId
-		: undefined;
-	const parentSessionId =
-		parentFromRegistry ??
-		deps.getParentSessionId?.() ??
-		resolveParentSessionId();
-
-	if (!parentSessionId || !currentSessionId) {
-		return {
-			approved: false,
-			state: "denied" as const,
-			confirmationUnavailable: true as const,
-		};
-	}
-
-	const forwarded = await forwardPermissionPrompt({
-		events: pi.events,
-		requesterSessionId: currentSessionId,
-		targetSessionId: parentSessionId,
-		title,
-		message,
-		surface: gateContext.toolName,
-		value: message,
-	});
-
-	if (!forwarded) {
-		return {
-			approved: false,
-			state: "denied" as const,
-			confirmationUnavailable: true as const,
-		};
-	}
-
-	if (forwarded.autoApproved) {
-		return forwarded;
-	}
-
-	return forwarded;
-}
-
-export function registerSkillInputGate(
-	pi: ExtensionAPI,
-	session: PermissionSession,
-): void {
-	pi.on("input", async (event, ctx) => {
-		const text = typeof event.text === "string" ? event.text.trim() : "";
-		if (!text.startsWith("/")) return;
-		const skillName = text.slice(1).split(/\s+/)[0]?.trim();
-		if (!skillName) return;
-
-		session.refresh(ctx);
-		session.trackExplicitSkillInvocation(skillName);
-		const config = session.getConfig();
-		const result = session.evaluator.evaluateSurface(
-			config.permission ?? {},
-			"skill",
-			skillName,
-			"project",
-			{ yoloMode: config.yoloMode, sessionApprovals: session.sessionApprovals },
-		);
-
-		if (result.state === "deny") {
-			ctx.ui.notify(`Skill "${skillName}" is not permitted`, "error");
-			return;
-		}
-
-		if (result.state === "ask" && ctx.hasUI && !config.yoloMode) {
-			const approved = await ctx.ui.confirm(
-				`Load skill ${skillName}?`,
-				`Allow loading skill "${skillName}"`,
-			);
-			if (!approved) return;
-		}
-	});
-}
+import type {
+	ExtensionAPI,
+	ExtensionContext,
+} from "@earendil-works/pi-coding-agent";
+import {
+	forwardPermissionPrompt,
+	resolveParentSessionId,
+} from "../forwarding/forwarder.ts";
+import { getSubagentSessionRegistry } from "../forwarding/subagent-registry.ts";
+import { runGatePipeline } from "../gates/pipeline.ts";
+import { patternForSessionApproval } from "../permission-evaluator.ts";
+import type { PermissionSession } from "../permission-session.ts";
+import { emitPermissionEvent } from "../service.ts";
+import type { GateContext } from "../types.ts";
+import {
+	buildApprovalSummary,
+	buildApprovalTitle,
+} from "../ui/approval-summary.ts";
+import { requestPermissionDecisionFromUi } from "../ui/permission-dialog.ts";
+
+export interface ToolGateDeps {
+	getRegisteredTools?: () => ReadonlySet<string>;
+	getSkillDirs?: () => readonly string[];
+	getParentSessionId?: () => string | null;
+}
+
+export function registerToolCallGate(
+	pi: ExtensionAPI,
+	session: PermissionSession,
+	deps: ToolGateDeps = {},
+): void {
+	pi.on("tool_call", async (event, ctx) => {
+		session.refresh(ctx);
+		const toolName = event.toolName;
+		const config = session.getConfig();
+		const permission = config.permission ?? {};
+		const registeredTools =
+			deps.getRegisteredTools?.() ??
+			new Set(pi.getAllTools().map((tool) => tool.name));
+
+		const gateContext: GateContext = {
+			toolName,
+			input: (event.input ?? {}) as Record<string, unknown>,
+			cwd: ctx.cwd,
+			agentName: session.resolveAgentName(ctx),
+		};
+
+		const result = runGatePipeline(permission, session.evaluator, gateContext, {
+			yoloMode: config.yoloMode,
+			platform: process.platform,
+			skillDirs: deps.getSkillDirs?.() ?? [],
+			registeredTools,
+			sessionApprovals: session.sessionApprovals,
+		});
+
+		emitPermissionEvent(pi, "permissions:decision", {
+			toolName,
+			state: result.state,
+			surface: result.surface,
+			value: result.value,
+			matchedPattern: result.matchedPattern,
+		});
+
+		if (result.state === "deny") {
+			return {
+				block: true,
+				reason: result.reason ?? `Permission denied for ${toolName}`,
+			};
+		}
+
+		if (result.state === "allow") {
+			return;
+		}
+
+		const decision = await resolveAskDecision(
+			pi,
+			ctx,
+			session,
+			gateContext,
+			result.matchedPattern,
+			deps,
+		);
+		if (!decision.approved) {
+			return {
+				block: true,
+				reason:
+					decision.denialReason ??
+					(decision.confirmationUnavailable
+						? "Permission confirmation unavailable"
+						: "Permission denied by user"),
+			};
+		}
+
+		if (decision.state === "approved_for_session" && result.matchedPattern) {
+			session.sessionApprovals.add(
+				result.surface,
+				patternForSessionApproval(result.surface, result.matchedPattern),
+			);
+		}
+	});
+}
+
+async function resolveAskDecision(
+	pi: ExtensionAPI,
+	ctx: ExtensionContext,
+	_session: PermissionSession,
+	gateContext: GateContext,
+	matchedPattern: string | undefined,
+	deps: ToolGateDeps,
+) {
+	const title = buildApprovalTitle(gateContext.toolName);
+	const message = buildApprovalSummary(gateContext);
+
+	if (ctx.hasUI) {
+		emitPermissionEvent(pi, "permissions:ui_prompt", {
+			toolName: gateContext.toolName,
+			surface: gateContext.toolName,
+			value: message,
+		});
+		return requestPermissionDecisionFromUi(ctx.ui, title, message, {
+			sessionLabel: matchedPattern
+				? `Yes, for this session (${matchedPattern})`
+				: undefined,
+		});
+	}
+
+	const currentSessionId = ctx.sessionManager.getSessionId?.() ?? null;
+	const registry = getSubagentSessionRegistry();
+	const parentFromRegistry = currentSessionId
+		? registry.get(currentSessionId)?.parentSessionId
+		: undefined;
+	const parentSessionId =
+		parentFromRegistry ??
+		deps.getParentSessionId?.() ??
+		resolveParentSessionId();
+
+	if (!parentSessionId || !currentSessionId) {
+		return {
+			approved: false,
+			state: "denied" as const,
+			confirmationUnavailable: true as const,
+		};
+	}
+
+	const forwarded = await forwardPermissionPrompt({
+		events: pi.events,
+		requesterSessionId: currentSessionId,
+		targetSessionId: parentSessionId,
+		title,
+		message,
+		surface: gateContext.toolName,
+		value: message,
+	});
+
+	if (!forwarded) {
+		return {
+			approved: false,
+			state: "denied" as const,
+			confirmationUnavailable: true as const,
+		};
+	}
+
+	if (forwarded.autoApproved) {
+		return forwarded;
+	}
+
+	return forwarded;
+}
+
+export function registerSkillInputGate(
+	pi: ExtensionAPI,
+	session: PermissionSession,
+): void {
+	pi.on("input", async (event, ctx) => {
+		const text = typeof event.text === "string" ? event.text.trim() : "";
+		if (!text.startsWith("/")) return;
+		const skillName = text.slice(1).split(/\s+/)[0]?.trim();
+		if (!skillName) return;
+
+		session.refresh(ctx);
+		session.trackExplicitSkillInvocation(skillName);
+		const config = session.getConfig();
+		const result = session.evaluator.evaluateSurface(
+			config.permission ?? {},
+			"skill",
+			skillName,
+			"project",
+			{ yoloMode: config.yoloMode, sessionApprovals: session.sessionApprovals },
+		);
+
+		if (result.state === "deny") {
+			ctx.ui.notify(`Skill "${skillName}" is not permitted`, "error");
+			return;
+		}
+
+		if (result.state === "ask" && ctx.hasUI && !config.yoloMode) {
+			const approved = await ctx.ui.confirm(
+				`Load skill ${skillName}?`,
+				`Allow loading skill "${skillName}"`,
+			);
+			if (!approved) return;
+		}
+	});
+}

package/node_modules/@vitos-pizza/permission-system/src/mode-api.ts

@@ -1,44 +1,44 @@
-import { existsSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
-import { getProjectConfigPath } from "./config-paths.ts";
-import { loadConfigFile, saveConfigFile } from "./policy-loader.ts";
-import type { ExtensionConfig } from "./types.ts";
-
-export type PermissionPresetName = "default" | "plan" | "yolo";
-
-export const PERMISSION_RELOAD_CONFIG_EVENT = "permission-system:reload-config";
-
-const moduleDir = dirname(fileURLToPath(import.meta.url));
-export const PRESETS_DIR = join(moduleDir, "..", "presets");
-
-export function loadProjectConfig(cwd: string): ExtensionConfig {
-	const path = getProjectConfigPath(cwd);
-	if (!existsSync(path)) {
-		return { permission: { "*": "ask" } };
-	}
-	return loadConfigFile(path);
-}
-
-export function saveProjectConfig(
-	cwd: string,
-	config: ExtensionConfig,
-): void {
-	saveConfigFile(getProjectConfigPath(cwd), config);
-}
-
-export function applyPermissionPreset(
-	cwd: string,
-	preset: PermissionPresetName,
-): ExtensionConfig {
-	const presetPath = join(PRESETS_DIR, `${preset}.json`);
-	const presetConfig = loadConfigFile(presetPath);
-	const existing = loadProjectConfig(cwd);
-	const next: ExtensionConfig = {
-		...existing,
-		yoloMode: presetConfig.yoloMode ?? false,
-		permission: presetConfig.permission ?? { "*": "ask" },
-	};
-	saveProjectConfig(cwd, next);
-	return next;
-}
+import { existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { getProjectConfigPath } from "./config-paths.ts";
+import { loadConfigFile, saveConfigFile } from "./policy-loader.ts";
+import type { ExtensionConfig } from "./types.ts";
+
+export type PermissionPresetName = "default" | "plan" | "yolo";
+
+export const PERMISSION_RELOAD_CONFIG_EVENT = "permission-system:reload-config";
+
+const moduleDir = dirname(fileURLToPath(import.meta.url));
+export const PRESETS_DIR = join(moduleDir, "..", "presets");
+
+export function loadProjectConfig(cwd: string): ExtensionConfig {
+	const path = getProjectConfigPath(cwd);
+	if (!existsSync(path)) {
+		return { permission: { "*": "ask" } };
+	}
+	return loadConfigFile(path);
+}
+
+export function saveProjectConfig(
+	cwd: string,
+	config: ExtensionConfig,
+): void {
+	saveConfigFile(getProjectConfigPath(cwd), config);
+}
+
+export function applyPermissionPreset(
+	cwd: string,
+	preset: PermissionPresetName,
+): ExtensionConfig {
+	const presetPath = join(PRESETS_DIR, `${preset}.json`);
+	const presetConfig = loadConfigFile(presetPath);
+	const existing = loadProjectConfig(cwd);
+	const next: ExtensionConfig = {
+		...existing,
+		yoloMode: presetConfig.yoloMode ?? false,
+		permission: presetConfig.permission ?? { "*": "ask" },
+	};
+	saveProjectConfig(cwd, next);
+	return next;
+}