@xynogen/pix-commands 0.3.8 → 0.4.0

package/README.md

@@ -4,7 +4,8 @@ Pi extension providing focused slash commands:
 
 - `/clear` — flush Pi's cached model data.
 - `/btw <question>` — ask an isolated side question without interrupting the main agent.
-- `/afk` — toggle AFK mode for unattended runs.
+- `/afk` — toggle AFK mode for unattended runs (yellow auto-allow, red/root auto-deny).
+- `/yolo` — toggle YOLO mode for unattended runs (auto-approve nearly everything incl. red/root; capable models only, session consent required).
 
 ## `/clear`
 
@@ -50,9 +51,66 @@ AFK mode off — approval prompts restored.
 The point is to let the agent keep working on safe, medium-risk actions while you
 are away, without silently permitting destructive ones. It pairs with the herdr
 notification bridge in `pix-runtime`: you still get pinged when something truly
-needs you (a red gate or sudo), and auto-deny turns that into a stop rather than
+needs you (a red gate or root), and auto-deny turns that into a stop rather than
 an approval.
 
+## `/yolo`
+
+`/yolo` toggles YOLO mode: **almost** every permission gate auto-approves,
+**including red (critical) commands and root (`sudo_run`)**. For the vast
+majority of actions there is no human confirming, so a destructive or
+irreversible action can run before anyone stops it. Use it only when you accept
+that. A few things still stop you — the four guardrails below are the deliberate
+exceptions to "auto-approve everything."
+
+```text
+YOLO mode on (model score 82) — every gate including red and root auto-approves.
+```
+
+Four guardrails temper the blast radius:
+
+- **One-time session consent.** The first `/yolo` of each session opens a
+  blocking modal spelling out the damage risk and the AS-IS/no-liability
+  disclaimer; you must explicitly accept before YOLO arms. Cancel leaves the
+  normal prompts in place. Consent is session-scoped — a fresh session asks
+  again, so arming YOLO is always a conscious act, never a forgotten flag.
+
+- **Capable models only.** YOLO refuses to turn on unless the active model has a
+  benchmark score of at least `75` (from `pix-data`). A weaker or off-catalog
+  model is rejected with a message, because auto-approving red and root demands a
+  model that reasons well about consequences.
+- **Root still needs a ticket.** `sudo_run` auto-approves only when a valid PAM
+  ticket is already cached — the password cannot be auto-typed, so a first root
+  command with no cached ticket still shows the password prompt. Bare `sudo` in
+  `bash` is always redirected to `sudo_run`, never run directly.
+- **Circuit breaker.** A short list of catastrophic, unrecoverable commands —
+  `rm -rf /` or `~`, `dd`/redirect onto a raw disk, `mkfs` on a device, a fork
+  bomb — is exempt from *every* mode, including YOLO (see
+  [`pix-gate`](https://www.npmjs.com/package/@xynogen/pix-gate)). This does **not**
+  forbid the command: a genuine `dd`-to-USB or `mkfs` still runs, it just falls
+  back to a one-time Allow/Deny prompt instead of a silent auto-approve. One
+  extra click, only under YOLO, only on the handful of commands you can't undo.
+  Mirrors Claude Code's `bypassPermissions` floor.
+
+`/afk` and `/yolo` are mutually exclusive; turning one on turns the other off.
+
+### Mode awareness (both modes)
+
+A relaxed gate is dangerous mainly because the *model* keeps acting as if a human
+will still catch a bad call. To close that gap, while either mode is active a
+short banner is injected into every turn via `before_agent_start`, telling the
+model the safety net is off and what it now owns:
+
+- **AFK** — plan around auto-deny of red and root; do not depend on a denied step
+  succeeding; stop and summarize when a denial blocks progress.
+- **YOLO** — before any red or root action, state in the reply why it is
+  necessary, its blast radius and worst-case fallout, and whether it is
+  reversible; if it cannot be justified, do not run it; always prefer the least
+  destructive path.
+
+The banner is only present while a mode is on, so it costs no baseline tokens
+otherwise.
+
 ## Install
 
 ```bash

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@xynogen/pix-commands",
-	"version": "0.3.8",
+	"version": "0.4.0",
 	"description": "Pi extension — slash commands for cache clearing and isolated side questions",
 	"type": "module",
 	"main": "src/index.ts",
@@ -45,6 +45,7 @@
 		"@earendil-works/pi-tui": "*"
 	},
 	"dependencies": {
+		"@xynogen/pix-data": "^0.4.0",
 		"@xynogen/pix-pretty": "^1.13.0",
 		"@xynogen/pix-runtime": "^0.6.0"
 	}

package/src/extension.test.ts

@@ -6,6 +6,7 @@ import extension from "./extension.ts";
 afterEach(() => {
 	delete (globalThis as { __pixOnce?: WeakMap<object, Set<string>> }).__pixOnce;
 	delete (globalThis as { __pixAfk?: boolean }).__pixAfk;
+	delete (globalThis as { __pixYolo?: boolean }).__pixYolo;
 });
 
 describe("pix-commands registration", () => {
@@ -29,11 +30,11 @@ describe("pix-commands registration", () => {
 		return { pi, commands, handlers, renderers };
 	}
 
-	test("registers /clear, /btw, /afk, and the BTW renderer once per Pi instance", () => {
+	test("registers /clear, /btw, /afk, /yolo, and the BTW renderer once per Pi instance", () => {
 		const { pi, commands, renderers } = host();
 		extension(pi);
 		extension(pi);
-		expect(commands).toEqual(["clear", "btw", "afk"]);
+		expect(commands).toEqual(["clear", "btw", "afk", "yolo"]);
 		expect(renderers).toEqual(["pix-btw-answer"]);
 	});
 
@@ -42,8 +43,8 @@ describe("pix-commands registration", () => {
 		const second = host();
 		extension(first.pi);
 		extension(second.pi);
-		expect(first.commands).toEqual(["clear", "btw", "afk"]);
-		expect(second.commands).toEqual(["clear", "btw", "afk"]);
+		expect(first.commands).toEqual(["clear", "btw", "afk", "yolo"]);
+		expect(second.commands).toEqual(["clear", "btw", "afk", "yolo"]);
 	});
 
 	test("/afk toggles shared state and status", async () => {

package/src/extension.ts

@@ -1,13 +1,13 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { once } from "@xynogen/pix-runtime/once";
-import registerAfk from "./afk.ts";
 import { registerBtw } from "./btw/index.ts";
 import registerClear from "./clear.ts";
+import registerUnattended from "./unattended.ts";
 
 export default function (pi: ExtensionAPI): void {
 	once(pi, "pix-commands", () => {
 		registerClear(pi);
 		registerBtw(pi);
-		registerAfk(pi);
+		registerUnattended(pi);
 	});
 }

package/src/unattended.test.ts

@@ -0,0 +1,79 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import {
+	confirmYoloConsent,
+	getMode,
+	modelScore,
+	setMode,
+	unattendedBanner,
+	YOLO_MIN_SCORE,
+} from "./unattended.ts";
+
+type G = { __pixAfk?: boolean; __pixYolo?: boolean; __pixYoloConsent?: boolean };
+
+afterEach(() => {
+	delete (globalThis as G).__pixAfk;
+	delete (globalThis as G).__pixYolo;
+	delete (globalThis as G).__pixYoloConsent;
+});
+
+describe("unattended mode state", () => {
+	test("setMode keeps the two globals mutually exclusive", () => {
+		setMode("afk");
+		expect(getMode()).toBe("afk");
+		expect((globalThis as G).__pixYolo).toBe(false);
+
+		setMode("yolo");
+		expect(getMode()).toBe("yolo");
+		expect((globalThis as G).__pixAfk).toBe(false);
+
+		setMode("off");
+		expect(getMode()).toBe("off");
+	});
+});
+
+describe("modelScore", () => {
+	test("returns null for an empty / off-catalog model", () => {
+		expect(modelScore({ model: undefined })).toBeNull();
+		expect(modelScore({ model: { id: "definitely-not-a-real-model-xyz" } })).toBeNull();
+	});
+});
+
+describe("unattendedBanner", () => {
+	test("off => no banner", () => {
+		setMode("off");
+		expect(unattendedBanner()).toBeUndefined();
+	});
+
+	test("afk banner names auto-deny of red and root", () => {
+		setMode("afk");
+		const b = unattendedBanner() ?? "";
+		expect(b).toContain('mode="afk"');
+		expect(b).toContain("auto-DENY");
+	});
+
+	test("yolo banner demands red/root self-justification", () => {
+		setMode("yolo");
+		const b = unattendedBanner() ?? "";
+		expect(b).toContain('mode="yolo"');
+		expect(b).toContain("blast radius");
+		expect(b).toContain("reversible");
+	});
+});
+
+describe("YOLO score threshold", () => {
+	test("is a sane capability floor", () => {
+		expect(YOLO_MIN_SCORE).toBe(75);
+	});
+});
+
+describe("confirmYoloConsent (session gate)", () => {
+	test("short-circuits true once consent is recorded for the session", async () => {
+		(globalThis as G).__pixYoloConsent = true;
+		// No ui passed: if it did not short-circuit it would return false.
+		expect(await confirmYoloConsent({})).toBe(true);
+	});
+
+	test("refuses when there is no ui to render the warning", async () => {
+		expect(await confirmYoloConsent({})).toBe(false);
+	});
+});

package/src/unattended.ts

@@ -0,0 +1,215 @@
+/**
+ * Unattended modes — /afk and /yolo.
+ *
+ * Both relax the permission gate so the agent keeps moving without a human
+ * clicking Allow/Deny. The danger is not the relaxed gate itself: it is that
+ * the *model* keeps acting as if a human will still catch a bad call. When the
+ * net is gone the model must KNOW, so every turn we inject an awareness banner
+ * (see {@link unattendedBanner}) and, for YOLO, a red/root self-justification
+ * directive.
+ *
+ * Behavior read by pix-gate (`unattendedGateDecision`) and pix-sudo via the
+ * `__pixAfk` / `__pixYolo` globals:
+ *   off  — every gate prompts (default).
+ *   afk  — yellow auto-allow; red + root auto-DENY.
+ *   yolo — everything auto-allows, including red + root (root still needs a
+ *          cached PAM ticket; the password cannot be auto-typed).
+ */
+
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { lookupBenchmark } from "@xynogen/pix-data";
+import { showOverlay } from "@xynogen/pix-pretty/gate-overlay";
+import { icon } from "@xynogen/pix-pretty/icon-catalog";
+
+/** Minimum model score allowed to hold YOLO. Below this, red+root auto-approve is off-limits. */
+export const YOLO_MIN_SCORE = 75;
+
+export type UnattendedMode = "off" | "afk" | "yolo";
+type UnattendedGlobal = typeof globalThis & {
+	__pixAfk?: boolean;
+	__pixYolo?: boolean;
+	/** Session-scoped: user acknowledged the YOLO damage warning this session. */
+	__pixYoloConsent?: boolean;
+};
+type StatusUI = {
+	theme: { fg(color: "error", text: string): string };
+	setStatus(key: string, text: string | undefined): void;
+	notify(message: string, kind?: string): void;
+};
+type ModelCtx = { model?: { id?: string } };
+
+const STATUS_KEY = "unattended";
+
+export function getMode(): UnattendedMode {
+	const g = globalThis as UnattendedGlobal;
+	if (g.__pixYolo === true) return "yolo";
+	if (g.__pixAfk === true) return "afk";
+	return "off";
+}
+
+/** Set the mode; the two globals are mutually exclusive so gate/sudo never see both. */
+export function setMode(mode: UnattendedMode): void {
+	const g = globalThis as UnattendedGlobal;
+	g.__pixAfk = mode === "afk";
+	g.__pixYolo = mode === "yolo";
+}
+
+function syncStatus(ui: StatusUI): void {
+	// ponytail: reuses the existing "afk"/"warn" glyphs instead of adding a YOLO
+	//           icon to pix-pretty (that is a public-API minor bump + approval).
+	const labels: Record<UnattendedMode, string | undefined> = {
+		yolo: `${icon("warn")} YOLO`,
+		afk: `${icon("afk")} AFK`,
+		off: undefined,
+	};
+	const label = labels[getMode()];
+	ui.setStatus(STATUS_KEY, label ? ui.theme.fg("error", label) : undefined);
+}
+
+/**
+ * Blocking, session-scoped consent gate. The first `/yolo` enable of a session
+ * shows a modal spelling out the damage risk and the no-liability disclaimer;
+ * the user must explicitly accept before YOLO can arm. Consent does NOT persist
+ * across sessions — a fresh session asks again (moral speed-bump, not a
+ * once-and-forget click-through).
+ */
+export async function confirmYoloConsent(ctx: ModelCtx): Promise<boolean> {
+	const g = globalThis as UnattendedGlobal;
+	if (g.__pixYoloConsent === true) return true;
+	const ui = (ctx as { ui?: unknown }).ui as Parameters<typeof showOverlay>[0] | undefined;
+	if (!ui) return false;
+	const result = await showOverlay(ui, {
+		mode: "confirm",
+		accent: "error",
+		title: "⚠ YOLO MODE — no human confirms anything",
+		body: [
+			"Every gate auto-approves, including RED and root. Destructive,",
+			"irreversible actions (data loss, wiped disks, force-push) can run",
+			"and CANNOT be undone. Only the circuit breaker stays active.",
+			"Watch the model closely — it can rationalize or downplay a risky",
+			"action to get past its own self-justification. Do not trust the",
+			"reasoning blindly.",
+			"You accept all risk; AS IS, no liability (MIT).",
+		],
+		choices: [
+			{ value: "no", label: "Cancel", description: "Keep approval prompts" },
+			{
+				value: "yes",
+				label: "Accept all risk",
+				description: "Enable YOLO this session",
+			},
+		],
+	});
+	const ok = result.action === "approved";
+	if (ok) g.__pixYoloConsent = true;
+	return ok;
+}
+
+/** Current model's benchmark score, or null when unknown/off-catalog. */
+export function modelScore(ctx: ModelCtx): number | null {
+	const id = (ctx.model?.id ?? "").replace(/^[a-z]+\//i, "");
+	if (!id) return null;
+	return lookupBenchmark(id)?.overallScore ?? null;
+}
+
+/**
+ * Per-turn awareness banner. Injected via `before_agent_start` so the model is
+ * told, every turn, that the human safety net is off and what it now owns.
+ */
+export function unattendedBanner(): string | undefined {
+	const mode = getMode();
+	if (mode === "yolo") {
+		return [
+			'<pix-unattended mode="yolo">',
+			"YOLO MODE ACTIVE. Every permission gate — including RED/critical commands and",
+			"root (sudo_run) — auto-approves with NO human confirming. The safety net is OFF:",
+			"nothing will stop a destructive or irreversible action before it runs. You alone",
+			"are accountable for the fallout.",
+			"Before any red-tier or root action, first state in your reply: (1) why it is",
+			"necessary, (2) its blast radius and worst-case fallout, (3) whether it is",
+			"reversible. If you cannot justify it, do not run it. Always prefer the least",
+			"destructive path that still does the job.",
+			"</pix-unattended>",
+		].join("\n");
+	}
+	if (mode === "afk") {
+		return [
+			'<pix-unattended mode="afk">',
+			"AFK MODE ACTIVE. The user is away. Medium-risk (yellow) gates auto-approve; RED/",
+			"critical commands and root (sudo_run) auto-DENY and will fail. No human will",
+			"confirm anything this turn.",
+			"Plan around the auto-deny: do not depend on a red or root step succeeding. State",
+			"the intent and consequence of any gated action. When a denied step blocks",
+			"progress, stop and summarize what needs the user.",
+			"</pix-unattended>",
+		].join("\n");
+	}
+	return undefined;
+}
+
+export default function registerUnattended(pi: ExtensionAPI): void {
+	pi.on("session_start", (_event, ctx) => syncStatus(ctx.ui));
+
+	// Every turn: prepend the awareness banner while a mode is active.
+	pi.on("before_agent_start", async (event) => {
+		const banner = unattendedBanner();
+		if (!banner) return undefined;
+		const existing = (event as { systemPrompt?: string }).systemPrompt ?? "";
+		return { systemPrompt: `${banner}\n\n${existing}` };
+	});
+
+	pi.registerCommand("afk", {
+		description: "Toggle AFK mode — yellow gates auto-allow; red and root auto-deny",
+		handler: async (_args, ctx) => {
+			const turningOn = getMode() !== "afk";
+			setMode(turningOn ? "afk" : "off");
+			syncStatus(ctx.ui);
+			ctx.ui.notify(
+				turningOn
+					? "AFK mode on — yellow gates auto-allow; red and root auto-deny."
+					: "AFK mode off — approval prompts restored.",
+				turningOn ? "warning" : "info",
+			);
+		},
+	});
+
+	pi.registerCommand("yolo", {
+		description: "Toggle YOLO mode — auto-approve everything including red and root",
+		handler: async (_args, ctx) => {
+			if (getMode() === "yolo") {
+				setMode("off");
+				syncStatus(ctx.ui);
+				ctx.ui.notify("YOLO mode off — approval prompts restored.", "info");
+				return;
+			}
+			const score = modelScore(ctx as ModelCtx);
+			if (score === null) {
+				ctx.ui.notify(
+					`YOLO refused — cannot verify this model scores ≥ ${YOLO_MIN_SCORE}. ` +
+						"Auto-approving red and root needs a benchmarked, capable model.",
+					"error",
+				);
+				return;
+			}
+			if (score < YOLO_MIN_SCORE) {
+				ctx.ui.notify(
+					`YOLO refused — model score ${score} is below ${YOLO_MIN_SCORE}. ` +
+						"Use a more capable model to auto-approve red and root actions.",
+					"error",
+				);
+				return;
+			}
+			if (!(await confirmYoloConsent(ctx as ModelCtx))) {
+				ctx.ui.notify("YOLO cancelled — approval prompts remain in place.", "info");
+				return;
+			}
+			setMode("yolo");
+			syncStatus(ctx.ui);
+			ctx.ui.notify(
+				`YOLO mode on (model score ${score}) — every gate including red and root ` +
+					"auto-approves. No human will stop a destructive action. You are accountable.",
+				"warning",
+			);
+		},
+	});
+}

package/src/afk.ts

@@ -1,35 +0,0 @@
-import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
-import { icon } from "@xynogen/pix-pretty/icon-catalog";
-
-const STATUS_KEY = "afk";
-
-type AfkGlobal = typeof globalThis & { __pixAfk?: boolean };
-type StatusUI = {
-	theme: { fg(color: "error", text: string): string };
-	setStatus(key: string, text: string | undefined): void;
-};
-
-function setAfkStatus(ui: StatusUI, active: boolean): void {
-	ui.setStatus(STATUS_KEY, active ? ui.theme.fg("error", `${icon("afk")} AFK`) : undefined);
-}
-
-export default function registerAfk(pi: ExtensionAPI): void {
-	pi.on("session_start", (_event, ctx) => {
-		setAfkStatus(ctx.ui, (globalThis as AfkGlobal).__pixAfk === true);
-	});
-
-	pi.registerCommand("afk", {
-		description: "Toggle unattended gate behavior",
-		handler: async (_args, ctx) => {
-			const state = !(globalThis as AfkGlobal).__pixAfk;
-			(globalThis as AfkGlobal).__pixAfk = state;
-			setAfkStatus(ctx.ui, state);
-			ctx.ui.notify(
-				state
-					? "AFK mode on — yellow gates auto-allow; red and sudo auto-deny."
-					: "AFK mode off — approval prompts restored.",
-				state ? "warning" : "info",
-			);
-		},
-	});
-}