gentle-pi 4.0.0 → 4.2.0

package/lib/agents-runner.ts

@@ -1,14 +1,17 @@
 import { isSessionChangeEvidence, type SessionChangeEvidence } from "./session-changes.ts";
-import { chmodSync, existsSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import type { Duplex, Readable, Writable } from "node:stream";
+import { chmodSync, existsSync, mkdtempSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { DefaultPackageManager, SettingsManager } from "@earendil-works/pi-coding-agent";
+import { tmpdir, userInfo } from "node:os";
+import { join, resolve } from "node:path";
+import { Duplex, type Readable, type Writable } from "node:stream";
 import { stripVTControlCharacters } from "node:util";
 import { withoutInteractiveHost } from "./rpc-host.ts";
+import { childPackageExtensionArgs } from "./child-package-injection.ts";
 import { AGENT_MODE, formatModelRef, type AgentDefinition, type AgentMode, type ModelRef } from "./agents-config.ts";
 import { CHILD_QUERY_MAX_INFLIGHT, CHILD_QUERY_TIMEOUT_MS, parseChildFrame, validChildMessage, validChildQueryId } from "./agents-messaging.ts";
 import { ParentStandingReviewPermissionBroker } from "./review-session-standing-permission-ipc.ts";
 import { isFinished, normalizeRpcEvent, ToolArgumentProgress, TASK_EVENT, TASK_STATUS, taskLabel, type AskRequest, type ChildResponseObservation, type TaskRecord, type TaskStore } from "./agents-protocol.ts";
+import { WriterSurfaceRegistry, writerSurfaceConflictMessage } from "./writer-surfaces.ts";
 
 // Gentle Agents runner. Every subagent is its own `pi --mode rpc` process:
 // the host never runs subagent work on the TUI thread. It writes JSON
@@ -16,12 +19,12 @@ import { isFinished, normalizeRpcEvent, ToolArgumentProgress, TASK_EVENT, TASK_S
 // and enforces an inactivity watchdog per task.
 
 export interface ChildLike {
-	pid: number | undefined;
+	pid?: number;
 	connected?: boolean;
-	stdin: Writable;
-	stdout: Readable;
+	stdin: Writable | null;
+	stdout: Readable | null;
 	stderr: Readable | null | undefined;
-	stdio?: Array<Duplex | null | undefined>;
+	stdio?: Array<Readable | Writable | null | undefined>;
 	kill(signal?: NodeJS.Signals): boolean;
 	send?(message: Record<string, unknown>, callback?: (error: Error | null) => void): boolean;
 	disconnect?(): void;
@@ -35,6 +38,7 @@ export interface SpawnOptions {
 	cwd: string;
 	env: NodeJS.ProcessEnv;
 	detached?: boolean;
+	windowsHide?: boolean;
 	stdio?: Array<"pipe" | "ignore" | "inherit" | "ipc" | "overlapped">;
 }
 
@@ -126,8 +130,18 @@ export interface TaskRequest {
 	sessionDir: string;
 	resumeSessionPath: string | undefined;
 	env: NodeJS.ProcessEnv;
-	// Untrusted narrowing intent; paths come only from matching host provenance.
+	// Host-provided only: the launcher's package injection signal (#1690) or
+	// the curated fallback. Never derived from tool input or agent definitions.
 	extensionPaths?: string[];
+	// Same host-only provenance as extensionPaths (#1690).
+	noExtensions?: boolean;
+	// Parsed `## Allowed edit surfaces` of a bounded writer. While the task is
+	// queued or running it claims them in `cwd`; run() rejects an overlapping
+	// claim (gentle-shell#1731). Read-only agents leave this unset.
+	writerSurfaces?: readonly string[];
+	// Canonical worktree root the claim is keyed to; the parent computes it before
+	// run() so admission stays synchronous. Defaults to `cwd`.
+	writerRoot?: string;
 	// Synchronous admission recheck at dequeue, before any OS spawn. Throws fail
 	// only this task; unlike onLaunch, it must never persist Changes evidence.
 	beforeSpawn?: () => void;
@@ -216,6 +230,8 @@ const MAX_TRANSPORT_PREFIX_CHARS = 64;
 const CHILD_MARKER = "GENTLE_PI_AGENTS_CHILD";
 const IPC_MARKER = "GENTLE_PI_AGENTS_OWNED_IPC";
 const PARENT_NOTIFICATION_TOOL = "subagent_parent_message";
+/** The exact --tools list, so the child can report requested names Pi dropped silently (#1690). */
+export const REQUESTED_TOOLS_ENV = "GENTLE_PI_AGENTS_REQUESTED_TOOLS";
 const DEFAULT_TOOLS: readonly string[] = [];
 const TERMINATION_GRACE_MS = 250;
 const GROUP_CONFIRM_MS = 25;
@@ -255,14 +271,53 @@ export function formatChildExit(code: number | null | undefined, signal?: string
 
 const hostProcess: ProcessControl = { platform: process.platform, kill: (pid, signal) => process.kill(pid, signal) };
 
+// The --tools value, or undefined when Pi keeps its default tools.
+function requestedTools(request: TaskRequest): string | undefined {
+	const tools = request.agent.tools.length > 0 ? [...new Set([...request.agent.tools, PARENT_NOTIFICATION_TOOL])] : DEFAULT_TOOLS;
+	return tools.length > 0 ? tools.join(",") : undefined;
+}
+
+const WEB_TOOL_NAMES = ["web_enable", "web_search", "source_check", "fetch_content", "get_search_content"];
+
+/** Resolve one already installed, explicitly requested package. Pi's own loader
+ * follows its manifest and supplies SDK aliases; no install or ambient discovery. */
+function requestedWebPackagePaths(request: TaskRequest): string[] {
+	if (!WEB_TOOL_NAMES.every(name => request.agent.tools.includes(name))) return [];
+	try {
+		let agentDir = request.env.PI_CODING_AGENT_DIR;
+		if (!agentDir || /^~(?:$|[/\\])/.test(agentDir)) {
+			const home = (process.platform === "win32" ? request.env.USERPROFILE : request.env.HOME) || userInfo().homedir;
+			agentDir = agentDir ? agentDir.replace(/^~/, home) : join(home, ".pi", "agent");
+		}
+		const manager = new DefaultPackageManager({
+			cwd: request.cwd,
+			agentDir,
+			settingsManager: SettingsManager.inMemory(),
+		});
+		const installed = manager.getInstalledPath("npm:pi-web-access", "user");
+		return installed ? [realpathSync(installed)] : [];
+	} catch {
+		// Missing/incompatible package remains an observable child capability gap.
+		return [];
+	}
+}
+
 export function childArguments(request: TaskRequest, instructionsPath?: string): string[] {
 	const args = ["--mode", "rpc", "--session-dir", request.sessionDir];
-	for (const path of request.extensionPaths ?? []) args.push("--extension", path);
+	const extensionPaths = [...new Set(request.extensionPaths ?? [])];
+	for (const packagePath of requestedWebPackagePaths(request)) {
+		const injected = extensionPaths.some(path => {
+			try { return realpathSync(resolve(request.cwd, path)) === packagePath; }
+			catch { return false; }
+		});
+		if (!injected) extensionPaths.push(packagePath);
+	}
+	args.push(...childPackageExtensionArgs({ noExtensions: request.noExtensions === true, extensionPaths }));
 	if (request.resumeSessionPath) args.push("--session", request.resumeSessionPath);
 	if (request.model) args.push("--model", request.thinking ? `${formatModelRef(request.model)}:${request.thinking}` : formatModelRef(request.model));
 	else if (request.thinking) args.push("--thinking", request.thinking);
-	const tools = request.agent.tools.length > 0 ? [...new Set([...request.agent.tools, PARENT_NOTIFICATION_TOOL])] : DEFAULT_TOOLS;
-	if (tools.length > 0) args.push("--tools", tools.join(","));
+	const tools = requestedTools(request);
+	if (tools !== undefined) args.push("--tools", tools);
 	if (instructionsPath) {
 		args.push("--append-system-prompt", instructionsPath);
 	} else if (request.agent.instructions.length > 0) {
@@ -325,6 +380,7 @@ export class AgentRunner {
 	private readonly waiters = new Map<string, Array<(task: TaskRecord) => void>>();
 	private readonly queryWaiters = new Map<string, Array<(query: TaskQuery | undefined) => void>>();
 	private readonly firstQueries = new Map<string, TaskQuery>();
+	private readonly writers = new WriterSurfaceRegistry();
 	private counter = 0;
 
 	constructor(store: TaskStore, limits: RunnerLimits, deps: RunnerDeps, hooks: RunnerHooks) {
@@ -366,8 +422,15 @@ export class AgentRunner {
 		return task;
 	}
 
+	// Check and claim happen in this one synchronous call, so two launches can
+	// never both pass admission for overlapping surfaces; finish() releases.
 	run(request: TaskRequest): TaskRecord {
+		if (request.writerSurfaces) {
+			const conflicts = this.writers.conflicts(request.writerRoot ?? request.cwd, request.writerSurfaces);
+			if (conflicts.length) throw new Error(writerSurfaceConflictMessage(conflicts));
+		}
 		const task = this.createTask(request);
+		if (request.writerSurfaces) this.writers.claim(task.id, request.writerRoot ?? request.cwd, request.writerSurfaces);
 		this.queue.push({ task, request });
 		queueMicrotask(() => this.pump());
 		return task;
@@ -477,6 +540,9 @@ export class AgentRunner {
 		// Do not forward stale legacy child selection or authorization.
 		delete env.GENTLE_PI_SDD_REMEDIATION_PLAN;
 		delete env.GENTLE_PI_RESEARCH_SELECTION;
+		const tools = requestedTools(request);
+		if (tools !== undefined) env[REQUESTED_TOOLS_ENV] = tools;
+		else delete env[REQUESTED_TOOLS_ENV];
 		let instructionsTransportDir: string | undefined;
 		let instructionsTransportPath: string | undefined;
 		if (Buffer.byteLength(request.agent.instructions, "utf8") > MAX_INLINE_INSTRUCTIONS_BYTES) {
@@ -503,6 +569,7 @@ export class AgentRunner {
 				cwd: request.cwd,
 				env,
 				detached,
+				windowsHide: true,
 				stdio: hasParentPermissionChannel ? ["pipe", "pipe", "pipe", permissionChannelStdio, "ipc"] : ["pipe", "pipe", "pipe", "ipc"],
 			});
 		} catch (error) {
@@ -528,7 +595,7 @@ export class AgentRunner {
 		}
 		this.live.set(id, live);
 		const permissionPipe = child.stdio?.[3];
-		if (hasParentPermissionChannel && permissionPipe !== undefined && permissionPipe !== null) {
+		if (hasParentPermissionChannel && permissionPipe instanceof Duplex) {
 			live.permissionBroker = new ParentStandingReviewPermissionBroker(
 				{ readable: permissionPipe, writable: permissionPipe },
 				(repositoryIdentity) => this.live.get(id) === live && !live.terminal && request.authorizeParentStandingReviewPermission?.(repositoryIdentity) === true,
@@ -546,6 +613,11 @@ export class AgentRunner {
 			try { request.onLaunch?.(); }
 			catch (error) { this.requestStop(id, TASK_STATUS.FAILED, `could not register launched worktree: ${error instanceof Error ? error.message : String(error)}`); }
 		});
+		child.on("exit", (code, signal) => this.exited(id, code, signal));
+		if (!child.stdin || !child.stdout) {
+			this.requestStop(id, TASK_STATUS.FAILED, "could not start pi: missing RPC streams");
+			return;
+		}
 		child.stdin.on("error", () => {});
 		this.armStall(id, live);
 		const lines = new JsonLines((value) => this.receive(id, request, value));
@@ -556,7 +628,6 @@ export class AgentRunner {
 			const tail = live.stderrTail + chunk;
 			live.stderrTail = tail.length > STDERR_TAIL_MAX ? tail.slice(-STDERR_TAIL_MAX) : tail;
 		});
-		child.on("exit", (code, signal) => this.exited(id, code, signal));
 		void this.send(id, { type: "get_state" }).then((response) => {
 			const data = response.data as { sessionFile?: unknown; model?: { provider?: unknown; id?: unknown } | null; thinkingLevel?: unknown } | undefined;
 			if (response.success !== true || live.terminal || this.live.get(id) !== live || !data) return;
@@ -726,7 +797,7 @@ export class AgentRunner {
 
 	private write(live: LiveTask, payload: Record<string, unknown>): void {
 		try {
-			live.child.stdin.write(`${JSON.stringify(payload)}\n`);
+			live.child.stdin?.write(`${JSON.stringify(payload)}\n`);
 		} catch {
 			// the child is gone; the exit handler settles the task
 		}
@@ -969,6 +1040,7 @@ export class AgentRunner {
 		this.live.delete(id);
 		// Quarantine already notified completion, but its retained slot is now free.
 		if (live.quarantined) {
+			this.writers.release(id);
 			queueMicrotask(() => this.pump());
 			return;
 		}
@@ -978,6 +1050,9 @@ export class AgentRunner {
 	}
 
 	private finish(id: string, status: TaskRecord["status"], error: string | null, live?: LiveTask): void {
+		// A quarantined child may still be writing: its claim lives as long as its
+		// reserved slot and is released in completeExit on proven exit.
+		if (!live?.quarantined) this.writers.release(id);
 		const current = this.store.get(id);
 		if (!current || isFinished(current.status)) return;
 		const finished = this.store.update(id, { status, endedAt: this.deps.now(), error, lastStep: error ?? "done" });

package/lib/auto-permission-answers.ts

@@ -0,0 +1,133 @@
+import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+import type { QuestionParams } from "./questionnaire/schema.ts";
+import type { AnswerRow } from "./questionnaire/questionnaire-view.ts";
+import { isInteractiveMode } from "./rpc-host.ts";
+
+type AnswerContext = Pick<ExtensionContext, "sessionManager" | "cwd" | "mode" | "hasUI">;
+export type HumanAnswer =
+	| { readonly kind: "option" | "custom"; readonly text: string; readonly selected?: readonly string[] }
+	| { readonly kind: "multi"; readonly selected: readonly string[] };
+export interface HumanAnswerReceipt {
+	readonly sessionManager: ExtensionContext["sessionManager"];
+	readonly sessionId: string;
+	readonly cwd: string;
+	readonly branchAnchor: string | null;
+	readonly toolName: "ask_user_choice" | "ask_user_question";
+	readonly toolCallId: string;
+	readonly questionIndex: number;
+	/** Untrusted referent, never an instruction or an authorization. */
+	readonly question: string;
+	/** Full original prompt context, untrusted and inseparable from its answer. */
+	readonly prompt: string;
+	/** Authenticated human response; opaque tokens and previews are excluded. */
+	readonly answer: HumanAnswer;
+}
+interface Subscription {
+	ctx: AnswerContext;
+	sessionId: string;
+	cwd: string;
+	callback: (receipt: HumanAnswerReceipt) => void;
+}
+const subscriptions = new WeakMap<object, Set<Subscription>>();
+
+/** Subscribe from a trusted host context; dispose on session shutdown/replacement. */
+export function subscribeHumanAnswers(ctx: AnswerContext, callback: (receipt: HumanAnswerReceipt) => void): () => void {
+	if (!ctx.sessionManager || !isInteractiveMode(ctx.mode, process.env) || ctx.hasUI === false) return () => {};
+	const sessionId = ctx.sessionManager.getSessionId();
+	if (!sessionId || !ctx.cwd) return () => {};
+	let listeners = subscriptions.get(ctx.sessionManager);
+	if (!listeners) subscriptions.set(ctx.sessionManager, listeners = new Set());
+	const subscription = { ctx, sessionId, cwd: ctx.cwd, callback };
+	listeners.add(subscription);
+	return () => { listeners.delete(subscription); };
+}
+
+/** Host-only capture seam. Call before mounting UI, never from tool_result. */
+function beginCapture(ctx: AnswerContext, toolName: HumanAnswerReceipt["toolName"], toolCallId: string, questions: ReadonlyArray<{ question: string; prompt: string }>, signal?: AbortSignal) {
+	const manager = ctx.sessionManager;
+	const sessionId = manager?.getSessionId();
+	const cwd = ctx.cwd;
+	const branchAnchor = manager?.getLeafId?.();
+	const listeners = manager ? subscriptions.get(manager) : undefined;
+	const eligible = [...(listeners ?? [])].filter((entry) => entry.sessionId === sessionId && entry.cwd === cwd);
+	const interactive = isInteractiveMode(ctx.mode, process.env) && ctx.hasUI !== false;
+	let finished = false;
+	return (answers: ReadonlyArray<{ questionIndex: number; answer: HumanAnswer }>) => {
+		if (finished) return;
+		finished = true;
+		if (!interactive || !isInteractiveMode(ctx.mode, process.env) || ctx.hasUI === false ||
+			!manager || !sessionId || signal?.aborted || ctx.sessionManager !== manager ||
+			manager.getSessionId() !== sessionId || ctx.cwd !== cwd || branchAnchor === undefined || manager.getLeafId() !== branchAnchor) return;
+		for (const { questionIndex, answer } of answers) {
+			const referent = questions[questionIndex];
+			if (referent === undefined) continue;
+			const { question, prompt } = referent;
+			const receipt = Object.freeze({ sessionManager: manager, sessionId, cwd, branchAnchor, toolName, toolCallId, questionIndex, question, prompt,
+				answer: Object.freeze({ ...answer, ...(answer.selected ? { selected: Object.freeze([...answer.selected]) } : {}) }) });
+			for (const entry of eligible) {
+				if (!listeners?.has(entry) || !isInteractiveMode(entry.ctx.mode, process.env) || entry.ctx.hasUI === false ||
+					entry.ctx.sessionManager !== manager || entry.ctx.cwd !== cwd ||
+					manager.getSessionId() !== sessionId || manager.getLeafId() !== branchAnchor || signal?.aborted) continue;
+				// Observers must not change the existing public tool outcome.
+				try { entry.callback(receipt); } catch { /* Isolate host observer failures. */ }
+			}
+		}
+	};
+}
+
+interface ChoicePrompt {
+	question: string;
+	options: Array<{ label: string; description?: string; value: string }>;
+	allowCustomResponse?: boolean;
+}
+export function captureChoiceAnswer(ctx: AnswerContext, toolCallId: string, params: ChoicePrompt, signal?: AbortSignal) {
+	const options = params.options.map((option) => ({ ...option }));
+	const allowCustom = params.allowCustomResponse === true;
+	const prompt = JSON.stringify({ question: params.question,
+		options: options.map(({ label, description }) => ({ label, description })), allowCustomResponse: allowCustom });
+	const publish = beginCapture(ctx, "ask_user_choice", toolCallId, [{ question: params.question, prompt }], signal);
+	return (selection: { value: string; label: string; index: number } | { customResponse: string } | undefined) => {
+		if (!selection) return;
+		if ("customResponse" in selection) {
+			if (allowCustom && typeof selection.customResponse === "string" && selection.customResponse.trim())
+				publish([{ questionIndex: 0, answer: { kind: "custom", text: selection.customResponse } }]);
+			return;
+		}
+		const option = options[selection.index - 1];
+		if (Number.isInteger(selection.index) && option && selection.label === option.label && selection.value === option.value)
+			publish([{ questionIndex: 0, answer: { kind: "option", text: option.label } }]);
+	};
+}
+
+export function captureQuestionnaireAnswers(ctx: AnswerContext, toolCallId: string, params: QuestionParams, signal?: AbortSignal) {
+	const questions = params.questions.map((question) => ({ ...question, options: question.options.map((option) => ({ ...option })) }));
+	const referents = questions.map((question) => ({ question: question.question, prompt: JSON.stringify({
+		question: question.question, header: question.header, multiSelect: question.multiSelect === true,
+		options: question.options.map(({ label, description, preview }) => ({ label, description,
+			...(ctx.mode === "tui" && preview !== undefined ? { preview } : {}) })),
+	}) }));
+	const publish = beginCapture(ctx, "ask_user_question", toolCallId, referents, signal);
+	return (rows: AnswerRow[] | undefined) => {
+		if (!rows?.length) return;
+		const seen = new Set<number>();
+		const answers: Array<{ questionIndex: number; answer: HumanAnswer }> = [];
+		for (const row of rows) {
+			const question = questions[row.questionIndex];
+			if (!Number.isInteger(row.questionIndex) || !question || seen.has(row.questionIndex) || row.question !== question.question) return;
+			seen.add(row.questionIndex);
+			const labels = question.options.map((option) => option.label);
+			const selected = row.selected;
+			if (selected && (!question.multiSelect || new Set(selected).size !== selected.length || selected.some((label) => !labels.includes(label)))) return;
+			let answer: HumanAnswer;
+			if (row.kind === "option" && typeof row.answer === "string" && labels.includes(row.answer) && !question.multiSelect && !selected)
+				answer = { kind: "option", text: row.answer };
+			else if (row.kind === "custom" && typeof row.answer === "string" && row.answer.trim())
+				answer = { kind: "custom", text: row.answer, ...(selected ? { selected } : {}) };
+			else if (row.kind === "multi" && question.multiSelect && selected && row.answer === null)
+				answer = { kind: "multi", selected };
+			else return;
+			answers.push({ questionIndex: row.questionIndex, answer });
+		}
+		publish(answers);
+	};
+}