@vitos-pizza/vitos-pizza 0.1.0

package/packages/permission-system/src/gates/pipeline.ts

@@ -0,0 +1,155 @@
+import { evaluateBashCommand } from "../bash/matcher.ts";
+import type { PermissionEvaluator } from "../permission-evaluator.ts";
+import { inferSkillNameFromPath } from "../sanitizers/skill-prompt.ts";
+import type {
+	FlatPermissionConfig,
+	GateContext,
+	PermissionCheckResult,
+	PermissionState,
+} from "../types.ts";
+import {
+	extractMcpTarget,
+	extractPathFromToolInput,
+	isExternalPath,
+	normalizePathValue,
+} from "./path-utils.ts";
+
+export interface GatePipelineOptions {
+	yoloMode?: boolean;
+	platform?: NodeJS.Platform;
+	skillDirs?: readonly string[];
+	registeredTools?: ReadonlySet<string>;
+}
+
+export function runGatePipeline(
+	permission: FlatPermissionConfig,
+	evaluator: PermissionEvaluator,
+	ctx: GateContext,
+	options: GatePipelineOptions = {},
+): PermissionCheckResult {
+	const { toolName, input, cwd } = ctx;
+	const evalOptions = {
+		yoloMode: options.yoloMode,
+		platform: options.platform,
+	};
+
+	if (options.registeredTools && !options.registeredTools.has(toolName)) {
+		return {
+			state: "deny",
+			reason: `Tool "${toolName}" is not registered`,
+			matchedPattern: "<unregistered-tool>",
+			surface: toolName,
+			value: toolName,
+			origin: "builtin",
+		};
+	}
+
+	const checks: PermissionCheckResult[] = [];
+	const pathValue = extractPathFromToolInput(toolName, input);
+	if (pathValue) {
+		const normalizedPath = normalizePathValue(pathValue, cwd);
+		checks.push(
+			evaluator.evaluateSurface(
+				permission,
+				"path",
+				normalizedPath,
+				"project",
+				evalOptions,
+			),
+		);
+		if (isExternalPath(pathValue, cwd)) {
+			const externalRules = permission.external_directory;
+			if (
+				typeof externalRules === "object" &&
+				externalRules !== null &&
+				!Array.isArray(externalRules)
+			) {
+				checks.push(
+					evaluator.evaluateSurface(
+						permission,
+						"external_directory",
+						normalizedPath,
+						"project",
+						evalOptions,
+					),
+				);
+			} else if (typeof externalRules === "string") {
+				checks.push({
+					state: externalRules as PermissionState,
+					matchedPattern: "external_directory",
+					surface: "external_directory",
+					value: normalizedPath,
+					origin: "project",
+				});
+			}
+		}
+	}
+
+	const toolPermission = permission[toolName];
+	if (typeof toolPermission === "string") {
+		checks.push({
+			state: toolPermission as PermissionState,
+			matchedPattern: toolName,
+			surface: toolName,
+			value: toolName,
+			origin: "project",
+		});
+	} else {
+		checks.push(
+			evaluator.evaluateSurface(
+				permission,
+				"*",
+				toolName,
+				"project",
+				evalOptions,
+			),
+		);
+	}
+
+	if (toolName === "bash" && typeof input.command === "string") {
+		checks.push(
+			evaluateBashCommand(input.command, permission, evaluator, evalOptions),
+		);
+	}
+
+	if (toolName === "mcp") {
+		const target = extractMcpTarget(input);
+		if (target) {
+			checks.push(
+				evaluator.evaluateSurface(
+					permission,
+					"mcp",
+					target,
+					"project",
+					evalOptions,
+				),
+			);
+		}
+	}
+
+	if (toolName === "read" && pathValue && options.skillDirs?.length) {
+		const skillName = inferSkillNameFromPath(pathValue, options.skillDirs);
+		if (skillName) {
+			checks.push(
+				evaluator.evaluateSurface(
+					permission,
+					"skill",
+					skillName,
+					"project",
+					evalOptions,
+				),
+			);
+		}
+	}
+
+	const mostRestrictive = evaluator.pickMostRestrictive(checks);
+	return (
+		mostRestrictive ?? {
+			state: "ask",
+			matchedPattern: "*",
+			surface: toolName,
+			value: toolName,
+			origin: "builtin",
+		}
+	);
+}

package/packages/permission-system/src/handlers/before-agent-start.ts

@@ -0,0 +1,65 @@
+import type {
+	BeforeAgentStartEventResult,
+	ExtensionAPI,
+	ExtensionContext,
+} from "@earendil-works/pi-coding-agent";
+import type { PermissionSession } from "../permission-session.ts";
+import { sanitizeSkillPromptBlocks } from "../sanitizers/skill-prompt.ts";
+import { sanitizeAvailableToolsSection } from "../sanitizers/system-prompt.ts";
+
+export function registerBeforeAgentStart(
+	pi: ExtensionAPI,
+	session: PermissionSession,
+): void {
+	pi.on("before_agent_start", async (event, ctx) => {
+		session.refresh(ctx);
+		const agentName = session.resolveAgentName(ctx, event.systemPrompt);
+		session.setAgentName(agentName);
+
+		const config = session.getConfig();
+		const permission = config.permission ?? {};
+		const activeTools = pi.getActiveTools();
+		const allowedTools: string[] = [];
+
+		for (const toolName of activeTools) {
+			const state = session.evaluator.getToolPermission(permission, toolName, {
+				yoloMode: config.yoloMode,
+				sessionApprovals: session.sessionApprovals,
+			});
+			if (state !== "deny") allowedTools.push(toolName);
+		}
+
+		pi.setActiveTools(allowedTools);
+
+		const toolPromptResult = sanitizeAvailableToolsSection(
+			event.systemPrompt,
+			allowedTools,
+		);
+		const skillPromptResult = sanitizeSkillPromptBlocks(
+			toolPromptResult.prompt,
+			permission,
+			session.evaluator,
+			{ yoloMode: config.yoloMode, agentName },
+		);
+
+		if (
+			skillPromptResult.prompt !== event.systemPrompt ||
+			toolPromptResult.removed
+		) {
+			return { systemPrompt: skillPromptResult.prompt };
+		}
+		return {};
+	});
+}
+
+export function resolveAgentNameFromContext(
+	_ctx: ExtensionContext,
+	systemPrompt?: string,
+): string | undefined {
+	const match = systemPrompt
+		? /<active_agent>\s*([^\s<]+)/i.exec(systemPrompt)
+		: null;
+	return match?.[1];
+}
+
+export type { BeforeAgentStartEventResult };

package/packages/permission-system/src/handlers/skill-input.ts

@@ -0,0 +1 @@
+export { registerSkillInputGate } from "./tool-call-gate.ts";

package/packages/permission-system/src/handlers/tool-call-gate.ts

@@ -0,0 +1,199 @@
+import type {
+	ExtensionAPI,
+	ExtensionContext,
+} from "@earendil-works/pi-coding-agent";
+import {
+	forwardPermissionPrompt,
+	resolveParentSessionId,
+} from "../forwarding/forwarder.ts";
+import { getSubagentSessionRegistry } from "../forwarding/subagent-registry.ts";
+import { runGatePipeline } from "../gates/pipeline.ts";
+import type { PermissionSession } from "../permission-session.ts";
+import { emitPermissionEvent } from "../service.ts";
+import type { GateContext } from "../types.ts";
+import {
+	buildApprovalSummary,
+	buildApprovalTitle,
+} from "../ui/approval-summary.ts";
+import { requestPermissionDecisionFromUi } from "../ui/permission-dialog.ts";
+
+export interface ToolGateDeps {
+	getRegisteredTools?: () => ReadonlySet<string>;
+	getSkillDirs?: () => readonly string[];
+	getParentSessionId?: () => string | null;
+}
+
+export function registerToolCallGate(
+	pi: ExtensionAPI,
+	session: PermissionSession,
+	deps: ToolGateDeps = {},
+): void {
+	pi.on("tool_call", async (event, ctx) => {
+		session.refresh(ctx);
+		const toolName = event.toolName;
+		const config = session.getConfig();
+		const permission = config.permission ?? {};
+		const registeredTools =
+			deps.getRegisteredTools?.() ??
+			new Set(pi.getAllTools().map((tool) => tool.name));
+
+		const gateContext: GateContext = {
+			toolName,
+			input: (event.input ?? {}) as Record<string, unknown>,
+			cwd: ctx.cwd,
+			agentName: session.resolveAgentName(ctx),
+		};
+
+		const result = runGatePipeline(permission, session.evaluator, gateContext, {
+			yoloMode: config.yoloMode,
+			platform: process.platform,
+			skillDirs: deps.getSkillDirs?.() ?? [],
+			registeredTools,
+		});
+
+		emitPermissionEvent(pi, "permissions:decision", {
+			toolName,
+			state: result.state,
+			surface: result.surface,
+			value: result.value,
+			matchedPattern: result.matchedPattern,
+		});
+
+		if (result.state === "deny") {
+			return {
+				block: true,
+				reason: result.reason ?? `Permission denied for ${toolName}`,
+			};
+		}
+
+		if (result.state === "allow") {
+			return;
+		}
+
+		const decision = await resolveAskDecision(
+			pi,
+			ctx,
+			session,
+			gateContext,
+			result.matchedPattern,
+			deps,
+		);
+		if (!decision.approved) {
+			return {
+				block: true,
+				reason:
+					decision.denialReason ??
+					(decision.confirmationUnavailable
+						? "Permission confirmation unavailable"
+						: "Permission denied by user"),
+			};
+		}
+
+		if (decision.state === "approved_for_session" && result.matchedPattern) {
+			session.sessionApprovals.add(result.surface, result.matchedPattern);
+		}
+	});
+}
+
+async function resolveAskDecision(
+	pi: ExtensionAPI,
+	ctx: ExtensionContext,
+	_session: PermissionSession,
+	gateContext: GateContext,
+	matchedPattern: string | undefined,
+	deps: ToolGateDeps,
+) {
+	const title = buildApprovalTitle(gateContext.toolName);
+	const message = buildApprovalSummary(gateContext);
+
+	if (ctx.hasUI) {
+		emitPermissionEvent(pi, "permissions:ui_prompt", {
+			toolName: gateContext.toolName,
+			surface: gateContext.toolName,
+			value: message,
+		});
+		return requestPermissionDecisionFromUi(ctx.ui, title, message, {
+			sessionLabel: matchedPattern
+				? `Yes, for this session (${matchedPattern})`
+				: undefined,
+		});
+	}
+
+	const currentSessionId = ctx.sessionManager.getSessionId?.() ?? null;
+	const registry = getSubagentSessionRegistry();
+	const parentFromRegistry = currentSessionId
+		? registry.get(currentSessionId)?.parentSessionId
+		: undefined;
+	const parentSessionId =
+		parentFromRegistry ??
+		deps.getParentSessionId?.() ??
+		resolveParentSessionId();
+
+	if (!parentSessionId || !currentSessionId) {
+		return {
+			approved: false,
+			state: "denied" as const,
+			confirmationUnavailable: true as const,
+		};
+	}
+
+	const forwarded = await forwardPermissionPrompt({
+		events: pi.events,
+		requesterSessionId: currentSessionId,
+		targetSessionId: parentSessionId,
+		title,
+		message,
+		surface: gateContext.toolName,
+		value: message,
+	});
+
+	if (!forwarded) {
+		return {
+			approved: false,
+			state: "denied" as const,
+			confirmationUnavailable: true as const,
+		};
+	}
+
+	if (forwarded.autoApproved) {
+		return forwarded;
+	}
+
+	return forwarded;
+}
+
+export function registerSkillInputGate(
+	pi: ExtensionAPI,
+	session: PermissionSession,
+): void {
+	pi.on("input", async (event, ctx) => {
+		const text = typeof event.text === "string" ? event.text.trim() : "";
+		if (!text.startsWith("/")) return;
+		const skillName = text.slice(1).split(/\s+/)[0]?.trim();
+		if (!skillName) return;
+
+		session.refresh(ctx);
+		session.trackExplicitSkillInvocation(skillName);
+		const config = session.getConfig();
+		const result = session.evaluator.evaluateSurface(
+			config.permission ?? {},
+			"skill",
+			skillName,
+			"project",
+			{ yoloMode: config.yoloMode, sessionApprovals: session.sessionApprovals },
+		);
+
+		if (result.state === "deny") {
+			ctx.ui.notify(`Skill "${skillName}" is not permitted`, "error");
+			return;
+		}
+
+		if (result.state === "ask" && ctx.hasUI && !config.yoloMode) {
+			const approved = await ctx.ui.confirm(
+				`Load skill ${skillName}?`,
+				`Allow loading skill "${skillName}"`,
+			);
+			if (!approved) return;
+		}
+	});
+}

package/packages/permission-system/src/mode-api.ts

@@ -0,0 +1,44 @@
+import { existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { getProjectConfigPath } from "./config-paths.ts";
+import { loadConfigFile, saveConfigFile } from "./policy-loader.ts";
+import type { ExtensionConfig } from "./types.ts";
+
+export type PermissionPresetName = "default" | "plan" | "yolo";
+
+export const PERMISSION_RELOAD_CONFIG_EVENT = "permission-system:reload-config";
+
+const moduleDir = dirname(fileURLToPath(import.meta.url));
+export const PRESETS_DIR = join(moduleDir, "..", "presets");
+
+export function loadProjectConfig(cwd: string): ExtensionConfig {
+	const path = getProjectConfigPath(cwd);
+	if (!existsSync(path)) {
+		return { permission: { "*": "ask" } };
+	}
+	return loadConfigFile(path);
+}
+
+export function saveProjectConfig(
+	cwd: string,
+	config: ExtensionConfig,
+): void {
+	saveConfigFile(getProjectConfigPath(cwd), config);
+}
+
+export function applyPermissionPreset(
+	cwd: string,
+	preset: PermissionPresetName,
+): ExtensionConfig {
+	const presetPath = join(PRESETS_DIR, `${preset}.json`);
+	const presetConfig = loadConfigFile(presetPath);
+	const existing = loadProjectConfig(cwd);
+	const next: ExtensionConfig = {
+		...existing,
+		yoloMode: presetConfig.yoloMode ?? false,
+		permission: presetConfig.permission ?? { "*": "ask" },
+	};
+	saveProjectConfig(cwd, next);
+	return next;
+}

package/packages/permission-system/src/permission-evaluator.ts

@@ -0,0 +1,216 @@
+import type {
+	FlatPermissionConfig,
+	PatternMap,
+	PatternValue,
+	PermissionCheckResult,
+	PermissionState,
+	RuleOrigin,
+} from "./types.ts";
+import {
+	isDenyWithReason,
+	isPermissionState,
+	permissionStateRank,
+} from "./types.ts";
+import {
+	compileWildcardPatternEntries,
+	findCompiledWildcardMatch,
+	type WildcardMatchOptions,
+} from "./wildcard-matcher.ts";
+
+export interface SessionApprovalRule {
+	surface: string;
+	pattern: string;
+}
+
+export class SessionApprovals {
+	private readonly rules: SessionApprovalRule[] = [];
+
+	add(surface: string, pattern: string): void {
+		this.rules.push({ surface, pattern });
+	}
+
+	clear(): void {
+		this.rules.length = 0;
+	}
+
+	hasMatch(
+		surface: string,
+		value: string,
+		options?: WildcardMatchOptions,
+	): boolean {
+		return this.rules.some(
+			(rule) =>
+				rule.surface === surface &&
+				findCompiledWildcardMatch(
+					compileWildcardPatternEntries([[rule.pattern, true]], options),
+					value,
+				),
+		);
+	}
+}
+
+export interface EvaluateOptions {
+	yoloMode?: boolean;
+	sessionApprovals?: SessionApprovals;
+	platform?: NodeJS.Platform;
+}
+
+function pathMatchOptions(
+	platform?: NodeJS.Platform,
+): WildcardMatchOptions | undefined {
+	if (platform === "win32") {
+		return { caseInsensitive: true, windowsSeparators: true };
+	}
+	return undefined;
+}
+
+function resolvePatternState(
+	value: PatternValue | undefined,
+): { state: PermissionState; reason?: string } | null {
+	if (value === undefined) return null;
+	if (isPermissionState(value)) return { state: value };
+	if (isDenyWithReason(value)) {
+		return { state: "deny", reason: value.reason };
+	}
+	return null;
+}
+
+function evaluatePatternMap(
+	patterns: PatternMap,
+	value: string,
+	origin: RuleOrigin,
+	surface: string,
+	options?: WildcardMatchOptions,
+): PermissionCheckResult | null {
+	const entries = Object.entries(patterns).filter(
+		([pattern]) => pattern !== "*",
+	);
+	const compiled = compileWildcardPatternEntries(entries, options);
+	const match = findCompiledWildcardMatch(compiled, value);
+	if (match) {
+		const resolved = resolvePatternState(match.state);
+		if (!resolved) return null;
+		return {
+			state: resolved.state,
+			reason: resolved.reason,
+			matchedPattern: match.matchedPattern,
+			surface,
+			value,
+			origin,
+		};
+	}
+	const fallback = resolvePatternState(patterns["*"]);
+	if (!fallback) return null;
+	return {
+		state: fallback.state,
+		reason: fallback.reason,
+		matchedPattern: "*",
+		surface,
+		value,
+		origin,
+	};
+}
+
+export class PermissionEvaluator {
+	evaluateSurface(
+		permission: FlatPermissionConfig,
+		surface: string,
+		value: string,
+		origin: RuleOrigin = "project",
+		options: EvaluateOptions = {},
+	): PermissionCheckResult {
+		const matchOptions =
+			surface === "path" || surface === "external_directory"
+				? pathMatchOptions(options.platform)
+				: undefined;
+
+		if (options.sessionApprovals?.hasMatch(surface, value, matchOptions)) {
+			return {
+				state: "allow",
+				matchedPattern: "<session-approval>",
+				surface,
+				value,
+				origin: "session",
+			};
+		}
+
+		const surfaceRules = permission[surface];
+		let result: PermissionCheckResult | null = null;
+
+		if (
+			typeof surfaceRules === "object" &&
+			surfaceRules !== null &&
+			!Array.isArray(surfaceRules) &&
+			!("action" in surfaceRules)
+		) {
+			result = evaluatePatternMap(
+				surfaceRules as PatternMap,
+				value,
+				origin,
+				surface,
+				matchOptions,
+			);
+		} else {
+			const resolved = resolvePatternState(surfaceRules);
+			if (resolved) {
+				result = {
+					state: resolved.state,
+					reason: resolved.reason,
+					matchedPattern: surface,
+					surface,
+					value,
+					origin,
+				};
+			}
+		}
+
+		if (!result) {
+			const wildcard = resolvePatternState(permission["*"]);
+			result = {
+				state: wildcard?.state ?? "ask",
+				reason: wildcard?.reason,
+				matchedPattern: "*",
+				surface,
+				value,
+				origin: "builtin",
+			};
+		}
+
+		if (options.yoloMode && result.state === "ask") {
+			return {
+				...result,
+				state: "allow",
+				matchedPattern: result.matchedPattern ?? "*",
+				origin: "yolo",
+			};
+		}
+
+		return result;
+	}
+
+	getToolPermission(
+		permission: FlatPermissionConfig,
+		toolName: string,
+		options: EvaluateOptions = {},
+	): PermissionState {
+		const toolRule = permission[toolName];
+		if (isPermissionState(toolRule)) {
+			const state = toolRule;
+			if (options.yoloMode && state === "ask") return "allow";
+			return state;
+		}
+		return this.evaluateSurface(permission, "*", toolName, "project", options)
+			.state;
+	}
+
+	pickMostRestrictive(
+		results: readonly PermissionCheckResult[],
+	): PermissionCheckResult | null {
+		if (results.length === 0) return null;
+		return results.reduce((best, current) =>
+			permissionStateRank(current.state) > permissionStateRank(best.state)
+				? current
+				: best,
+		);
+	}
+}