allye-pi 2.16.1 → 2.17.0

package/README.md

@@ -79,7 +79,7 @@ When paired, hooks send Allye the state of your sessions (started, working, wait
 
 #### Answering from Allye (Claude Code only, optional)
 
-With Live reporting on, a blocking `PermissionRequest` hook (`hooks/live-answer.sh`, timeout 120 s) lets you answer a question (`AskUserQuestion`) or allow once / deny a normal-risk permission from Allye while the dialog is open. The terminal always keeps the last word (the dialog stays usable while the hook waits) and on any doubt the hook exits with no output; nothing is ever "always allow", and the tool input changes only by adding your question answers. **High risk** (`Bash`, protected paths such as dotfiles, `scripts/`, manifests, lockfiles and CI files, paths outside `CLAUDE_PROJECT_DIR` or all path tools when it is unset, any Allye MCP write, other MCP or unknown tools) can only be denied from Allye or answered in the terminal; a repository `.mcp.json` server named `plugin_allye_allye` cannot be told from the plugin's by name (known limit; the API keeps any higher risk it computes). **What leaves the machine**, per request: the session hash, the kind, a hash of tool name and input (SHA-256 of `jq -S -c` over `[tool_name, tool_input]`; for a question, over its `questions`), the risk class, the tool name (other MCP servers as `mcp`), the cleaned activity phrase and, for a question, its cleaned texts (neither is sent, and no question is opened, when Detailed Live is off) and the reporter's last `seq`; the reporter also sends the call id `tu` and, when a call ends, `cmd_end` `{tu, h, seq, at, ok}`. Never the raw command, path, prompt or tool input. **The wait** is up to 110 s (hook timeout 120 s); it stops at once when Allye reports the request terminal, expired or not answerable, cancels the request on exit while pending, and after an answer in the terminal keeps waiting until Allye ends the request or the 110 s pass. `/allye:hooks live off` (also unpaired, no credential or an unusable origin) stops the events and `cmd_end`, and the hook exits at once with no network call; the origin comes only from the pairing file; after a failed open it pauses 60 s (10 minutes after a 404 or 405). **Spike verdict** `VERDICT: permission=go question=go` (questions use the `PermissionRequest` decision `updatedInput.answers`; a `PreToolUse` hook shows no dialog): [docs/spikes/live-return-channel.md](docs/spikes/live-return-channel.md); check it with `node --test test/test-spike-doc.mjs` (or `npm run test:hooks-config`); a real rerun needs an interactive Claude Code session. **Known limits:** decision texts get NFC only when `uconv` is installed, length caps count code points, the hook tests use GNU tools and there is no CI for them yet; update the plugin only after the Allye API that accepts the new fields is live (releases happen on merge to `main`, API first). Details in [docs/live-reporting.md](docs/live-reporting.md).
+With Live reporting on, a blocking `PermissionRequest` hook (`hooks/live-answer.sh`, timeout 120 s) lets you answer a question (`AskUserQuestion`) or answer a permission from Allye, with the same options the terminal shows as far as a hook can reproduce them, while the dialog is open. The terminal always keeps the last word (the dialog stays usable while the hook waits) and on any doubt the hook exits with no output. **Options** (seven fixed ids with fixed labels): `allow_once` "Yes", `allow_edits_session` "Yes, allow all edits this session", `allow_session` "Yes, allow for this session", `allow_folder` "Yes, allow this folder", `allow_always` "Yes, always allow" (saved in a settings file, it outlives the session), `switch_auto` "Yes, switch to auto mode" (only `Bash`, in the `default` and `acceptEdits` modes) and `deny` "No". `allow_once` and `deny` are always offered; the others only when the hook can reproduce them for that call, and when the terminal shows something it does not offer (an unmapped rule, the option for a protected `.claude` folder, a folder it refuses) the request is flagged `options_partial`, so Allye knows the terminal shows more than it offers. `allow_folder` is never offered for `/`, your home folder or their ancestors. **Rules stay on your machine**: the rule text, directories and modes Claude Code suggests are held in memory only and are rebuilt into the answer of the option you chose; Allye can only pick one of the ids the hook offered (plus a cleaned deny message), never supply a rule. **Risk** (`Bash`, protected paths such as dotfiles, `scripts/`, manifests, lockfiles and CI files, paths outside `CLAUDE_PROJECT_DIR` or all path tools when it is unset, any Allye MCP write, other MCP or unknown tools) is still computed and shown, but no longer limits what you can choose. Allye asks for a fresh password or MFA (valid for 300 s) for every allow except `allow_once` at normal risk; the API enforces it and the app prompts, outside the hook. Tools on a short denied list (`ExitPlanMode`) and unknown tools get no phrase and are answered in the terminal; with texts off (Detailed Live or `live activity off`) no options are sent and only the legacy allow once at normal risk, or deny, applies. A repository `.mcp.json` server named `plugin_allye_allye` cannot be told from the plugin's by name (known limit; the API keeps any higher risk it computes). **What leaves the machine**, per request: the session hash, the kind, a hash of tool name and input (SHA-256 of `jq -S -c` over `[tool_name, tool_input]`; for a question, over its `questions`), the risk class, the tool name (other MCP servers as `mcp`), the cleaned activity phrase (a fixed phrase such as "Use a tool" for other MCP tools, `WebFetch` and the tools with an option proven), for a permission the option ids with their fixed labels and `options_partial`, for a question its cleaned texts (none is sent, and no question is opened, when Detailed Live is off) and the reporter's last `seq`; the reporter also sends the call id `tu` and, when a call ends, `cmd_end` `{tu, h, seq, at, ok}`. Never the raw command, path, prompt, tool input, rule text, directory, suggestion entry, mode or destination. **The wait** is up to 110 s (hook timeout 120 s); it stops at once when Allye reports the request terminal, expired or not answerable, cancels the request on exit while pending, and after an answer in the terminal keeps waiting until Allye ends the request or the 110 s pass. `/allye:hooks live off` (also unpaired, no credential or an unusable origin) stops the events and `cmd_end`, and the hook exits at once with no network call; the origin comes only from the pairing file; after a failed open it pauses 60 s (10 minutes after a 404 or 405). **Spike verdict** `VERDICT: permission=go question=go` (questions use the `PermissionRequest` decision `updatedInput.answers`; a `PreToolUse` hook shows no dialog): [docs/spikes/live-return-channel.md](docs/spikes/live-return-channel.md); check it with `node --test test/test-spike-doc.mjs` (or `npm run test:hooks-config`); a real rerun needs an interactive Claude Code session. **Known limits:** decision texts get NFC only when `uconv` is installed, length caps count code points, the hook tests use GNU tools and there is no CI for them yet; update the plugin only after the Allye API that accepts the new fields is live (releases happen on merge to `main`, API first). Details in [docs/live-reporting.md](docs/live-reporting.md).
 
 ### Codex, OpenCode
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "allye-pi",
-  "version": "2.16.1",
+  "version": "2.17.0",
   "description": "Allye extension for Pi and OMP: the Allye bootstrap, the Bridge skill and the repository-to-project link",
   "type": "module",
   "keywords": [