@zhushanwen/pi-permission 1.4.0 → 1.4.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zhushanwen/pi-permission",
-  "version": "1.4.0",
+  "version": "1.4.2",
   "description": "Pi permission extension — four permission modes (yolo/auto/approve/strict) with three-layer pipeline (AST + rules + AI classifier).",
   "type": "module",
   "main": "src/index.ts",
@@ -50,9 +50,9 @@
   "dependencies": {
     "tree-sitter-bash": "^0.25.1",
     "web-tree-sitter": "^0.26.11",
-    "@zhushanwen/pi-ext-guards": "0.2.0",
-    "@zhushanwen/pi-extension-logger": "0.4.0",
-    "@zhushanwen/pi-llm-shared": "0.5.0"
+    "@zhushanwen/pi-ext-guards": "0.2.1",
+    "@zhushanwen/pi-extension-logger": "0.4.1",
+    "@zhushanwen/pi-llm-shared": "0.6.0"
   },
   "peerDependencies": {
     "@earendil-works/pi-ai": "^0.84.4",

package/src/__tests__/config.test.ts

@@ -40,7 +40,7 @@ beforeEach(() => {
 
 afterEach(() => {
 	delete process.env.PI_CODING_AGENT_DIR;
-	rmSync(tempDir, { recursive: true, force: true });
+	rmSync(tempDir, { recursive: true, force: true, maxRetries: 5, retryDelay: 20 });
 	clearConfigCache();
 });
 

package/src/__tests__/extension.test.ts

@@ -26,7 +26,7 @@ beforeEach(() => {
 afterEach(() => {
 	if (originalAgentDirEnv === undefined) delete process.env.PI_CODING_AGENT_DIR;
 	else process.env.PI_CODING_AGENT_DIR = originalAgentDirEnv;
-	rmSync(tempAgentDir, { recursive: true, force: true });
+	rmSync(tempAgentDir, { recursive: true, force: true, maxRetries: 5, retryDelay: 20 });
 });
 
 /** 最小 mock：只记录 registerCommand 和 on 调用 */

package/src/__tests__/index-integration.test.ts

@@ -140,7 +140,7 @@ afterEach(() => {
 	delete process.env.PI_CODING_AGENT_DIR;
 	Reflect.deleteProperty(globalThis, FOOTER_HANDSHAKE_KEY);
 	Reflect.deleteProperty(globalThis, REQUEST_RENDER_KEY);
-	if (existsSync(TMP_ROOT)) rmSync(TMP_ROOT, { recursive: true, force: true });
+	if (existsSync(TMP_ROOT)) rmSync(TMP_ROOT, { recursive: true, force: true, maxRetries: 5, retryDelay: 20 });
 });
 
 // ──────────────────────── 测试 ────────────────────────

package/src/__tests__/session-start-once-guard.test.ts

@@ -90,7 +90,7 @@ beforeEach(() => {
 afterEach(() => {
 	delete process.env.PI_CODING_AGENT_DIR;
 	Reflect.deleteProperty(globalThis, FOOTER_HANDSHAKE_KEY);
-	if (existsSync(TMP_ROOT)) rmSync(TMP_ROOT, { recursive: true, force: true });
+	if (existsSync(TMP_ROOT)) rmSync(TMP_ROOT, { recursive: true, force: true, maxRetries: 5, retryDelay: 20 });
 });
 
 describe("session_start 双派发幂等守卫（oncePerProcess，u-audit-fix）", () => {

package/src/ast/analyzer.ts

@@ -102,90 +102,100 @@ function parseRawString(node: Node): string | null {
 }
 
 /**
- * 从一个 command 节点提取 argv（对应 Rust parse_plain_command_from_node）。
- *
- * 5 分支处理 named children：
- *  1. command_name → 其第一个 named child 必须是 word，取文本
- *  2. word | number → 直接取文本
- *  3. string → parseDoubleQuotedString（含 expansion 则 null）
- *  4. raw_string → parseRawString
- *  5. concatenation（如 -g"*.py"）→ 递归拼接各 part（word/number/string/raw_string）
- *
- * 任一分支失败 → 返回 null（该 command 被跳过，但 clean 已在 DFS 阶段被置 false）。
+ * command_name 分支：其第一个 named child 必须是 word，取文本；否则 null。
  */
-function parsePlainCommand(cmd: Node): string[] | null {
-	if (cmd.type !== "command") {
+function parseCommandName(child: Node): string | null {
+	const wordNode = child.namedChild(0);
+	if (!wordNode || wordNode.type !== "word") {
 		return null;
 	}
+	return wordNode.text;
+}
 
-	const words: string[] = [];
-	for (const child of cmd.namedChildren) {
-		switch (child.type) {
-			case "command_name": {
-				const wordNode = child.namedChild(0);
-				if (!wordNode || wordNode.type !== "word") {
-					return null;
-				}
-				words.push(wordNode.text);
-				break;
-			}
+/**
+ * concatenation 分支（如 -g"*.py" 或 '/usr'"/"'local'/bin）：
+ * 递归拼接各 part（word/number/string/raw_string），空拼接结果 → null。
+ */
+function parseConcatenation(child: Node): string | null {
+	let concatenated = "";
+	for (const part of child.namedChildren) {
+		switch (part.type) {
 			case "word":
-			case "number": {
-				words.push(child.text);
+			case "number":
+				concatenated += part.text;
 				break;
-			}
 			case "string": {
-				const parsed = parseDoubleQuotedString(child);
-				if (parsed === null) {
-					return null;
-				}
-				words.push(parsed);
+				const parsed = parseDoubleQuotedString(part);
+				if (parsed === null) return null;
+				concatenated += parsed;
 				break;
 			}
 			case "raw_string": {
-				const parsed = parseRawString(child);
-				if (parsed === null) {
-					return null;
-				}
-				words.push(parsed);
-				break;
-			}
-			case "concatenation": {
-				// 拼接如 -g"*.py" 或 '/usr'"/"'local'/bin
-				let concatenated = "";
-				for (const part of child.namedChildren) {
-					switch (part.type) {
-						case "word":
-						case "number":
-							concatenated += part.text;
-							break;
-						case "string": {
-							const parsed = parseDoubleQuotedString(part);
-							if (parsed === null) return null;
-							concatenated += parsed;
-							break;
-						}
-						case "raw_string": {
-							const parsed = parseRawString(part);
-							if (parsed === null) return null;
-							concatenated += parsed;
-							break;
-						}
-						default:
-							return null;
-					}
-				}
-				if (concatenated.length === 0) {
-					return null;
-				}
-				words.push(concatenated);
+				const parsed = parseRawString(part);
+				if (parsed === null) return null;
+				concatenated += parsed;
 				break;
 			}
 			default:
-				// 未知 named child（不应发生 —— DFS 阶段已拒，但保险起见 fail-closed）
 				return null;
 		}
 	}
+	if (concatenated.length === 0) {
+		return null;
+	}
+	return concatenated;
+}
+
+/**
+ * 解析 command 的单个 named child 为一个 argv token（分发表）。
+ *
+ * 5 分支：
+ *  1. command_name → parseCommandName（第一个 named child 必须是 word）
+ *  2. word | number → 直接取文本
+ *  3. string → parseDoubleQuotedString（含 expansion 则 null）
+ *  4. raw_string → parseRawString
+ *  5. concatenation → parseConcatenation
+ *
+ * 未知 named child（不应发生 —— DFS 阶段已拒，但保险起见 fail-closed）→ null。
+ * 失败 → 调用方让整个 command 返回 null（该 command 被跳过，但 clean 已在 DFS 阶段被置 false）。
+ */
+function parseChildToken(child: Node): string | null {
+	switch (child.type) {
+		case "command_name":
+			return parseCommandName(child);
+		case "word":
+		case "number":
+			return child.text;
+		case "string":
+			return parseDoubleQuotedString(child);
+		case "raw_string":
+			return parseRawString(child);
+		case "concatenation":
+			return parseConcatenation(child);
+		default:
+			return null;
+	}
+}
+
+/**
+ * 从一个 command 节点提取 argv（对应 Rust parse_plain_command_from_node）。
+ *
+ * 主函数编排：类型守卫 → 逐 named child 分发（parseChildToken）→ 组装 words。
+ * 任一 child 解析失败 → 返回 null。
+ */
+function parsePlainCommand(cmd: Node): string[] | null {
+	if (cmd.type !== "command") {
+		return null;
+	}
+
+	const words: string[] = [];
+	for (const child of cmd.namedChildren) {
+		const token = parseChildToken(child);
+		if (token === null) {
+			return null;
+		}
+		words.push(token);
+	}
 	return words;
 }
 

package/src/classifier/classifier.ts

@@ -119,6 +119,78 @@ function raceResultWithDeadline(
 	});
 }
 
+// ──────────────────────── classifyRisk 分步 helper ────────────────────────
+
+/**
+ * 构造 CallLLMOptions（timeout 秒→毫秒的换算由调用方完成后传入；
+ * signal 透传 callLLM → completeSimple，abort 时 reject 或 resolve(aborted)
+ * 都会归一为 ok:false）。
+ */
+function buildCallOptions(
+	model: Model<Api>,
+	ctx: ToolInvocationContext,
+	config: ClassifierConfig,
+	timeoutMs: number | undefined,
+	signal: AbortSignal | undefined,
+): CallLLMOptions {
+	return {
+		model,
+		systemPrompt: CLASSIFIER_SYSTEM_PROMPT,
+		messages: buildMessages(ctx),
+		...(timeoutMs !== undefined ? { timeoutMs } : {}),
+		...(signal !== undefined ? { signal } : {}),
+		// thinkingLevel 直接透传（含 "off"）；llm-shared 内部会把 "off" 映射为不传 reasoning（provider 默认）
+		reasoning: config.thinkingLevel,
+	};
+}
+
+/** 记录 LLM 调用失败日志（G3 语义：abort 与 error 分开记，即使行为上两者都 fallback 无差别）。 */
+function logFailedCall(
+	result: Extract<CallLLMResult, { ok: false }>,
+	onLog?: (msg: string) => void,
+): void {
+	if (result.stopReason === "aborted") {
+		onLog?.(`[pi-permission] classifier: LLM call aborted (stopReason=aborted), returning fallback`);
+	} else {
+		const stopDetail = result.stopReason !== undefined ? ` (stopReason=${result.stopReason})` : "";
+		onLog?.(`[pi-permission] classifier: LLM call failed: ${result.error}${stopDetail}, returning fallback`);
+	}
+}
+
+/** raceWithDeadline 已收窄的结果形态（timeout/aborted 无 result 字段）。 */
+type SettledRace =
+	| { kind: "ok"; result: CallLLMResult }
+	| { kind: "timeout" }
+	| { kind: "aborted" };
+
+/** settleRacedResult 的输出：fallback = fail-closed ask；ok = 继续解析文本。 */
+type SettledOutcome =
+	| { kind: "fallback"; result: ClassifierResult }
+	| { kind: "ok"; result: Extract<CallLLMResult, { ok: true }> };
+
+/**
+ * race 结果归一：timeout / aborted / ok:false → fail-closed fallback（保留日志区分），
+ * 成功原样透传（调用方收窄后取 content）。
+ */
+function settleRacedResult(settled: SettledRace, timeoutMs: number | undefined, onLog?: (msg: string) => void): SettledOutcome {
+	if (settled.kind === "timeout") {
+		onLog?.(`[pi-permission] classifier: timed out after ${timeoutMs}ms`);
+		return { kind: "fallback", result: { ...CLASSIFY_FALLBACK_RESULT } };
+	}
+	if (settled.kind === "aborted") {
+		onLog?.(`[pi-permission] classifier: aborted by signal`);
+		return { kind: "fallback", result: { ...CLASSIFY_FALLBACK_RESULT } };
+	}
+
+	// ok:false → fallback（fail-closed）。stopReason 独立透传字段保留日志区分
+	const result = settled.result;
+	if (!result.ok) {
+		logFailedCall(result, onLog);
+		return { kind: "fallback", result: { ...CLASSIFY_FALLBACK_RESULT } };
+	}
+	return { kind: "ok", result };
+}
+
 // ──────────────────────── createClassifier ────────────────────────
 
 /**
@@ -148,21 +220,12 @@ export function createClassifier(deps: ClassifierDeps): {
 		// 实证 classifier 真实用到 OAuth/配置的模型（而非 fail-closed 降级）。
 		onLog?.(`[pi-permission] classifier: using model ${model.id}`);
 
-		// 2. 构造 CallLLMOptions（timeout 秒→毫秒；signal 透传 callLLM → completeSimple，
-		//    abort 时 reject 或 resolve(aborted) 都会归一为 ok:false）
+		// 2. 构造 CallLLMOptions
 		const timeoutMs = config.timeout > 0 ? config.timeout * MILLIS_PER_SECOND : undefined;
-		const callPromise = callLLM({
-			model,
-			systemPrompt: CLASSIFIER_SYSTEM_PROMPT,
-			messages: buildMessages(ctx),
-			...(timeoutMs !== undefined ? { timeoutMs } : {}),
-			...(signal !== undefined ? { signal } : {}),
-			// thinkingLevel 直接透传（含 "off"）；llm-shared 内部会把 "off" 映射为不传 reasoning（provider 默认）
-			reasoning: config.thinkingLevel,
-		});
+		const callPromise = callLLM(buildCallOptions(model, ctx, config, timeoutMs, signal));
 
 		// 3. 等待 callLLM + 外层超时/中止兜底（provider 不支持 timeoutMs/signal 时防永挂）
-		let settled: { kind: "ok"; result: CallLLMResult } | { kind: "timeout" } | { kind: "aborted" };
+		let settled: SettledRace;
 		try {
 			settled = await raceResultWithDeadline(callPromise, timeoutMs, signal);
 		} catch (error) {
@@ -171,30 +234,14 @@ export function createClassifier(deps: ClassifierDeps): {
 			return { ...CLASSIFY_FALLBACK_RESULT };
 		}
 
-		if (settled.kind === "timeout") {
-			onLog?.(`[pi-permission] classifier: timed out after ${timeoutMs}ms`);
-			return { ...CLASSIFY_FALLBACK_RESULT };
-		}
-		if (settled.kind === "aborted") {
-			onLog?.(`[pi-permission] classifier: aborted by signal`);
-			return { ...CLASSIFY_FALLBACK_RESULT };
-		}
-
-		// 4. ok:false → fallback（fail-closed）。stopReason 独立透传字段保留日志区分
-		//    （G3 语义：abort 与 error 分开记，即使行为上两者都 fallback 无差别）。
-		const result = settled.result;
-		if (!result.ok) {
-			if (result.stopReason === "aborted") {
-				onLog?.(`[pi-permission] classifier: LLM call aborted (stopReason=aborted), returning fallback`);
-			} else {
-				const stopDetail = result.stopReason !== undefined ? ` (stopReason=${result.stopReason})` : "";
-				onLog?.(`[pi-permission] classifier: LLM call failed: ${result.error}${stopDetail}, returning fallback`);
-			}
-			return { ...CLASSIFY_FALLBACK_RESULT };
+		// 4. timeout / aborted / ok:false → fail-closed fallback；成功 → 收窄透传
+		const settledOutcome = settleRacedResult(settled, timeoutMs, onLog);
+		if (settledOutcome.kind === "fallback") {
+			return settledOutcome.result;
 		}
 
 		// 5. 提取文本 → 三层容错解析
-		return parseClassifierResponse(result.content);
+		return parseClassifierResponse(settledOutcome.result.content);
 	}
 
 	return { classifyRisk };

package/src/pipeline.ts

@@ -442,8 +442,101 @@ export async function runLayer3WithRacing(
 
 // ──────────────────────── checkPermission（纯函数主入口） ────────────────────────
 
+/** ctxBase 形态（checkPermission 第四参之后注入的上下文基线）。 */
+interface ContextBase {
+	cwd: string;
+	agentName?: string;
+	signal?: AbortSignal;
+}
+
+/** 从 input 装配 ToolInvocationContext（command 用 AST/规则，path 其余字段透传给 UI）。 */
+function buildInvocationContext(
+	toolName: string,
+	command: string | undefined,
+	input: Record<string, unknown>,
+	ctxBase: ContextBase,
+): ToolInvocationContext {
+	return {
+		toolName,
+		...(command !== undefined ? { command } : {}),
+		path: typeof input.path === "string" ? input.path : undefined,
+		cwd: ctxBase.cwd,
+		...(ctxBase.agentName !== undefined ? { agentName: ctxBase.agentName } : {}),
+	};
+}
+
+/** 层 2 allow/deny 结果 → PermissionDecision 装配（ask 返回 null 交下游）。 */
+function ruleDecision(layer2: RuleMatchResult): PermissionDecision | null {
+	if (layer2.action === "allow") {
+		return {
+			action: "allow",
+			reason: layer2.matchedRule
+				? `allowed by rule ${layer2.matchedRule.id}`
+				: "allowed by rules (no deny matched)",
+			source: "rule",
+			...(layer2.matchedRule ? { matchedRule: layer2.matchedRule } : {}),
+		};
+	}
+	if (layer2.action === "deny") {
+		return {
+			action: "deny",
+			reason: layer2.matchedRule
+				? `denied by rule ${layer2.matchedRule.id}`
+				: "denied by rules",
+			source: "rule",
+			...(layer2.matchedRule ? { matchedRule: layer2.matchedRule } : {}),
+		};
+	}
+	return null;
+}
+
+/** 层 1 AST 输出：层 2 需要的 argvList + 提前决策（null = 无提前决策，继续层 2）。 */
+interface AstLayerOutcome {
+	argvList: string[][];
+	earlyDecision: PermissionDecision | null;
+}
+
 /**
- * 权限检查主入口（纯函数，deps 注入）。
+ * 层 1 AST（仅 bash 且有 command 时执行）：clean → 透传 argvList 继续；
+ * 非 clean / 异常 → 按模式提前决策（approve 人工 / auto 进层 3 Racing）。
+ */
+async function runAstLayer(
+	toolName: string,
+	command: string | undefined,
+	mode: PermissionMode,
+	config: ClassifierConfig,
+	ctx: ToolInvocationContext,
+	deps: CheckPermissionDeps,
+	ctxBase: ContextBase,
+): Promise<AstLayerOutcome> {
+	let argvList: string[][] = [];
+	if (toolName === "bash" && command !== undefined) {
+		try {
+			const analysis = await deps.analyzeBashStructure(command);
+			argvList = analysis.commands;
+			// AST 检测到危险结构（非 clean）→ 直接 ask（auto→AI，approve→人工）
+			if (!analysis.clean) {
+				const trigger = `AST detected dangerous structure: ${analysis.dangerousStructures.join(", ") || "unknown"}`;
+				if (mode === "approve") {
+					return { argvList, earlyDecision: await askUser(deps, ctx, trigger, ctxBase.signal) };
+				}
+				// auto：进层 3（AI 评估危险命令）。m2：透传 AST 检测的具体危险原因。
+				return { argvList, earlyDecision: await runLayer3WithRacing(deps, ctx, config, ctxBase.signal, trigger) };
+			}
+		} catch {
+			// AST 异常 → fail-closed ask（auto→AI，approve→人工）
+			if (mode === "approve") {
+				return { argvList, earlyDecision: await askUser(deps, ctx, "AST analysis failed (fail-closed)", ctxBase.signal) };
+			}
+			return { argvList, earlyDecision: await runLayer3WithRacing(deps, ctx, config, ctxBase.signal) };
+		}
+	}
+	return { argvList, earlyDecision: null };
+}
+
+/**
+ * 权限检查主入口（纯函数，deps 注入）。主函数只留编排：
+ * yolo/strict 快速路径 → 层 1 AST（runAstLayer）→ 层 2 规则（ruleDecision）→ 下游。
  *
  * 四档模式分支：
  *  - yolo：完全放行（return allow，source='mode'）。不跑任何层。
@@ -471,7 +564,7 @@ export async function checkPermission(
 	config: ClassifierConfig,
 	userRules: Rule[],
 	deps: CheckPermissionDeps,
-	ctxBase: { cwd: string; agentName?: string; signal?: AbortSignal },
+	ctxBase: ContextBase,
 ): Promise<PermissionDecision> {
 	// yolo / disabled → 完全放行
 	if (mode === "yolo") {
@@ -479,13 +572,7 @@ export async function checkPermission(
 	}
 
 	const command = extractCommand(toolName, input);
-	const ctx: ToolInvocationContext = {
-		toolName,
-		...(command !== undefined ? { command } : {}),
-		path: typeof input.path === "string" ? input.path : undefined,
-		cwd: ctxBase.cwd,
-		...(ctxBase.agentName !== undefined ? { agentName: ctxBase.agentName } : {}),
-	};
+	const ctx = buildInvocationContext(toolName, command, input, ctxBase);
 
 	// strict → 全部人工审批（不跑 AST/规则/AI）
 	if (mode === "strict") {
@@ -493,54 +580,20 @@ export async function checkPermission(
 	}
 
 	// auto / approve：层 1 AST + 层 2 规则
-	let argvList: string[][] = [];
-	if (toolName === "bash" && command !== undefined) {
-		try {
-			const analysis = await deps.analyzeBashStructure(command);
-			argvList = analysis.commands;
-			// AST 检测到危险结构（非 clean）→ 直接 ask（auto→AI，approve→人工）
-			if (!analysis.clean) {
-				const trigger = `AST detected dangerous structure: ${analysis.dangerousStructures.join(", ") || "unknown"}`;
-				if (mode === "approve") {
-					return await askUser(deps, ctx, trigger, ctxBase.signal);
-				}
-				// auto：进层 3（AI 评估危险命令）。m2：透传 AST 检测的具体危险原因。
-				return await runLayer3WithRacing(deps, ctx, config, ctxBase.signal, trigger);
-			}
-		} catch {
-			// AST 异常 → fail-closed ask（auto→AI，approve→人工）
-			if (mode === "approve") {
-				return await askUser(deps, ctx, "AST analysis failed (fail-closed)", ctxBase.signal);
-			}
-			return await runLayer3WithRacing(deps, ctx, config, ctxBase.signal);
-		}
+	const ast = await runAstLayer(toolName, command, mode, config, ctx, deps, ctxBase);
+	if (ast.earlyDecision !== null) {
+		return ast.earlyDecision;
 	}
 
 	// 层 2 规则（auto + approve 共用）
 	const rules = [...deps.getDefaultRules(), ...userRules];
 	// C1：传入完整 command（bash 跨 argv 管道 deny 补充检查）；
 	// M5：传入 path（非 bash 工具规则对 path 匹配）。
-	const layer2 = runLayer2ForArgvList(toolName, argvList, rules, deps, command, ctx.path);
+	const layer2 = runLayer2ForArgvList(toolName, ast.argvList, rules, deps, command, ctx.path);
 
-	if (layer2.action === "allow") {
-		return {
-			action: "allow",
-			reason: layer2.matchedRule
-				? `allowed by rule ${layer2.matchedRule.id}`
-				: "allowed by rules (no deny matched)",
-			source: "rule",
-			...(layer2.matchedRule ? { matchedRule: layer2.matchedRule } : {}),
-		};
-	}
-	if (layer2.action === "deny") {
-		return {
-			action: "deny",
-			reason: layer2.matchedRule
-				? `denied by rule ${layer2.matchedRule.id}`
-				: "denied by rules",
-			source: "rule",
-			...(layer2.matchedRule ? { matchedRule: layer2.matchedRule } : {}),
-		};
+	const decided = ruleDecision(layer2);
+	if (decided !== null) {
+		return decided;
 	}
 
 	// layer2.action === 'ask' → 下游

package/src/rule-editor.ts

@@ -91,35 +91,74 @@ async function editViaTui(
 
 // ──────────────────────── RPC 分支（G16） ────────────────────────
 
+/** RPC 循环内的 select/input 句柄（deps mock 优先，缺省回落 ctx.ui）。 */
+interface RpcIo {
+	select: (title: string, options: string[]) => Promise<string | undefined>;
+	input: (title: string, placeholder?: string) => Promise<string | undefined>;
+}
+
 /**
- * RPC 循环编辑：list → action select → fill input → ... 直到 Done / cancel。
+ * 解析 RPC 循环的 input 句柄：
+ * ctx.ui.input 可用 → 用真实文本输入（custom 模板需要自由文本）；
+ * 不可用 → fallback 把 input 降级为单选项 select（占位符文本，仅保底）。
+ */
+function resolveRpcInput(ctx: RuleEditorContext, rpcDeps?: RuleEditorRpcDeps): RpcIo["input"] {
+	return rpcDeps?.input
+		?? (typeof ctx.ui.input === "function"
+			? (title: string, ph?: string) => ctx.ui.input!(title, ph)
+			: (title: string, ph?: string) => ctx.ui.select(title, [ph ?? ""]).then((v) => v === undefined ? undefined : v));
+}
+
+/** 单轮 RPC list 画面：当前规则集（applyOps 反映前序操作）+ 标签 + 选项。 */
+function buildRpcListState(
+	initialRules: readonly Rule[],
+	ops: RuleOp[],
+): { currentRules: Rule[]; ruleLabels: string[]; listOptions: string[] } {
+	const currentRules = applyOps([...initialRules], ops);
+	const ruleLabels = currentRules.map((r) => `[${r.action}] ${r.pattern}`);
+	const listOptions = [...ruleLabels, "[+ Add rule]", "[Done]"];
+	return { currentRules, ruleLabels, listOptions };
+}
+
+/**
+ * 选择了一条现有规则 → edit 模式（rpcEditFlow；ops 原地追加产生的 op）。
+ */
+async function handleRpcRuleSelection(
+	io: RpcIo,
+	listChoice: string,
+	ruleLabels: readonly string[],
+	currentRules: readonly Rule[],
+	ops: RuleOp[],
+): Promise<void> {
+	const ruleIdx = ruleLabels.indexOf(listChoice);
+	if (ruleIdx >= 0 && ruleIdx < currentRules.length) {
+		const existingRule = currentRules[ruleIdx];
+		if (existingRule !== undefined) {
+			const editOp = await rpcEditFlow(io.select, io.input, existingRule);
+			if (editOp !== undefined) {
+				ops.push(editOp);
+			}
+		}
+	}
+}
+
+/**
+ * RPC 循环主体：list → action select → fill input → ... 直到 Done / cancel。
  *
  * G16：每次 op 后 listOptions 更新（反映前序操作）。
- * deps 注入 select/input 便于测试 mock。
  */
-export async function editViaRpc(
-	ctx: RuleEditorContext,
+async function runRpcLoop(
+	io: RpcIo,
 	initialRules: readonly Rule[],
 	sessionIdCounter: () => string,
-	rpcDeps?: RuleEditorRpcDeps,
 ): Promise<RuleEditorResult> {
-	const select = rpcDeps?.select ?? ctx.ui.select;
-	// ctx.ui.input 可用 → 用真实文本输入（custom 模板需要自由文本）；
-	// 不可用 → fallback 把 input 降级为单选项 select（占位符文本，仅保底）。
-	const input = rpcDeps?.input
-		?? (typeof ctx.ui.input === "function"
-			? (title: string, ph?: string) => ctx.ui.input!(title, ph)
-			: (title: string, ph?: string) => ctx.ui.select(title, [ph ?? ""]).then((v) => v === undefined ? undefined : v));
-
 	const ops: RuleOp[] = [];
 
 	for (;;) {
 		// 构建 listOptions（G16：用 applyOps 反映前序操作）
-		const currentRules = applyOps([...initialRules], ops);
-		const ruleLabels = currentRules.map((r) => `[${r.action}] ${r.pattern}`);
-		const listOptions = [...ruleLabels, "[+ Add rule]", "[Done]"];
+		const { currentRules, ruleLabels, listOptions } = buildRpcListState(initialRules, ops);
 
-		const listChoice = await select("[pi-permission] Permission Rules", listOptions);
+		const listChoice = await io.select("[pi-permission] Permission Rules", listOptions);
 		if (listChoice === undefined) {
 			// cancel
 			return undefined;
@@ -130,7 +169,7 @@ export async function editViaRpc(
 		}
 
 		if (listChoice === "[+ Add rule]") {
-			const op = await rpcAddFlow(select, input, sessionIdCounter);
+			const op = await rpcAddFlow(io.select, io.input, sessionIdCounter);
 			if (op !== undefined) {
 				ops.push(op);
 			}
@@ -138,19 +177,29 @@ export async function editViaRpc(
 		}
 
 		// 选择了一条现有规则 → edit 模式
-		const ruleIdx = ruleLabels.indexOf(listChoice);
-		if (ruleIdx >= 0 && ruleIdx < currentRules.length) {
-			const existingRule = currentRules[ruleIdx];
-			if (existingRule !== undefined) {
-				const editOp = await rpcEditFlow(select, input, existingRule);
-				if (editOp !== undefined) {
-					ops.push(editOp);
-				}
-			}
-		}
+		await handleRpcRuleSelection(io, listChoice, ruleLabels, currentRules, ops);
 	}
 }
 
+/**
+ * RPC 循环编辑：list → action select → fill input → ... 直到 Done / cancel。
+ *
+ * G16：每次 op 后 listOptions 更新（反映前序操作）。
+ * deps 注入 select/input 便于测试 mock。
+ */
+export async function editViaRpc(
+	ctx: RuleEditorContext,
+	initialRules: readonly Rule[],
+	sessionIdCounter: () => string,
+	rpcDeps?: RuleEditorRpcDeps,
+): Promise<RuleEditorResult> {
+	const io: RpcIo = {
+		select: rpcDeps?.select ?? ctx.ui.select,
+		input: resolveRpcInput(ctx, rpcDeps),
+	};
+	return await runRpcLoop(io, initialRules, sessionIdCounter);
+}
+
 /** RPC add flow：选模板 → fill。 */
 async function rpcAddFlow(
 	select: (title: string, options: string[]) => Promise<string | undefined>,