omnirush 0.8.6 → 0.9.1

package/assets/extensions/omnirush/guard-lib.ts

@@ -0,0 +1,230 @@
+// Guarded mode: which tool calls ask first. Pure (no I/O, no UI) so the
+// rules are tested directly; guard.ts does the asking.
+//
+// Same rules as the desktop app's "guarded" approval mode (omnirush-gui
+// managed-policy-rules.ts + git-command-policy.ts, vendored in ./guard, and
+// the desktop engine's default asks):
+//
+//   shell commands, per segment of the command line (&&, ||, ;, |, $(...),
+//   if/while/for bodies, and through bash -c / sh -c / eval / env -S / su -c /
+//   xargs / find -exec):
+//     read         git status/log/diff/fetch, gh pr list ...   -> runs
+//     write        git commit/push/checkout/reset/rebase ...,
+//                  gh pr create/merge ...                       -> asks; "allow
+//                                                                  for this session"
+//                                                                  covers the family
+//     destructive  git push --force/--delete, reset --hard,
+//                  clean -f, branch -D, rebase -i, stash drop,
+//                  filter-branch, gh repo delete, rm -rf ...    -> asks every time
+//     sudo / doas, and shell interpreters (bash -c ...)        -> ask like a write
+//   file tools:
+//     reading .env / .env.* (not .env.example)                 -> asks
+//     any path outside the project folder                      -> asks
+//     (reading skills, omnirush's own docs and the saved output of a
+//     truncated command does not: the agent itself points there)
+//   the same tool call a 3rd time in a row (doom loop)         -> asks
+//
+// Everything else runs, as in the desktop app. Heredoc bodies, comments and
+// quoted strings are data, never commands.
+
+import path from "node:path";
+
+import { classifyShellCommand, splitShellCommand, type ClassifiedCommand } from "./guard/git-command-policy";
+
+export type GateKind = "write" | "destructive" | "env" | "outside" | "loop";
+
+export interface Gate {
+  kind: GateKind;
+  /** What "allow for this session" covers (e.g. "git push", "rm -rf"); null = always asks. */
+  family: string | null;
+  /** One line for the prompt: why it asks. */
+  reason: string;
+}
+
+export interface GateDecision {
+  /** Every reason the call asks; empty = runs without asking. */
+  gates: Gate[];
+  /** True when any gate is destructive: no "allow for this session". */
+  alwaysAsk: boolean;
+}
+
+const SHELL_TOOLS = new Set(["bash", "powershell"]);
+/** Status and polling tools: asking the same thing again is their job, not a loop. */
+const POLLING_TOOLS = new Set(["bash_output", "bash_wait", "agents_status", "agents_wait", "agents_result"]);
+const PATH_TOOLS = new Set(["read", "write", "edit", "grep", "find", "ls"]);
+const INTERPRETERS = new Set(["bash", "sh", "zsh", "dash", "ksh", "mksh", "ash", "fish", "eval", "su"]);
+const PRIVILEGE = new Set(["sudo", "doas"]);
+
+function programOf(token: string | undefined): string {
+  return (token ?? "").replaceAll("\\", "/").split("/").pop()?.toLowerCase().replace(/\.exe$/, "") ?? "";
+}
+
+/** `sudo …`, `doas …` and interpreter wrappers (`bash -c '…'`, `eval …`, `env -S …`) ask like a write command. */
+function wrapperGates(command: string): Gate[] {
+  const gates: Gate[] = [];
+  for (const segment of splitShellCommand(command)) {
+    const tokens = segment.tokens.filter((token) => !/^[A-Za-z_][A-Za-z0-9_]*=/.test(token));
+    const first = programOf(tokens[0]);
+    if (PRIVILEGE.has(first)) {
+      gates.push({ kind: "write", family: first, reason: `runs with ${first} (system-level)` });
+      continue;
+    }
+    const interpreter =
+      (INTERPRETERS.has(first) && (first === "eval" || tokens.slice(1).some((t) => /^-[A-Za-z]*c[A-Za-z]*$/.test(t) || t === "--command" || t.startsWith("--command="))))
+      || (first === "env" && tokens.slice(1).some((t) => t === "-S" || t.startsWith("-S") || t.startsWith("--split-string")));
+    if (interpreter) gates.push({ kind: "write", family: `${first} -c`, reason: `runs a command line through ${first}` });
+  }
+  return gates;
+}
+
+function shellGates(command: string): Gate[] {
+  const gates: Gate[] = [];
+  let classified: ClassifiedCommand[] = [];
+  try {
+    classified = classifyShellCommand(command);
+  } catch {
+    // Unparseable: ask rather than guess.
+    return [{ kind: "write", family: null, reason: "a command line omnirush could not read" }];
+  }
+  for (const entry of classified) {
+    if (entry.kind === "destructive") {
+      gates.push({ kind: "destructive", family: entry.family, reason: `${entry.family ?? "a destructive command"} is destructive (always asks)` });
+    } else if (entry.kind === "write") {
+      gates.push({ kind: "write", family: entry.family, reason: `${entry.family} changes the repository` });
+    }
+  }
+  gates.push(...wrapperGates(command));
+  return gates;
+}
+
+/** The desktop engine's `read *.env` / `read *.env.*` asks, minus `*.env.example`. */
+export function isEnvFile(file: string): boolean {
+  const base = path.basename(file).toLowerCase();
+  if (base.endsWith(".env.example")) return false;
+  return /\.env$/.test(base) || /\.env\./.test(base);
+}
+
+function inside(root: string, target: string): boolean {
+  const relative = path.relative(root, target);
+  return relative === "" || (!relative.startsWith("..") && !path.isAbsolute(relative));
+}
+
+function expandHome(p: string, home: string): string {
+  return p === "~" ? home : p.startsWith("~/") ? path.join(home, p.slice(2)) : p;
+}
+
+const READ_ONLY_TOOLS = new Set(["read", "grep", "find", "ls"]);
+/** The core's saved full output of a truncated shell command (it tells the model to read it). */
+const OUTPUT_LOG = /^(?:omnirush|pi)-bash-[0-9a-f]+\.log$/;
+
+/**
+ * Places the agent itself points the model at, readable without asking:
+ * skills (the agent dir's skills folders), omnirush's own docs (the package
+ * root) and the saved output of truncated commands in the temp folder.
+ */
+export interface ReadRoots {
+  dirs: string[];
+  tmp: string;
+}
+
+function readableOutsideProject(target: string, roots: ReadRoots | undefined): boolean {
+  if (!roots) return false;
+  if (roots.dirs.some((dir) => dir && inside(dir, target))) return true;
+  return path.dirname(target) === path.resolve(roots.tmp) && OUTPUT_LOG.test(path.basename(target));
+}
+
+function pathGates(toolName: string, input: Record<string, unknown>, cwd: string, home: string, readRoots?: ReadRoots): Gate[] {
+  const raw = [input.path, input.file_path, input.filePath].find((value) => typeof value === "string" && value.trim()) as string | undefined;
+  if (!raw) return [];
+  const target = path.resolve(cwd, expandHome(raw.trim(), home));
+  const gates: Gate[] = [];
+  if (!inside(cwd, target) && !(READ_ONLY_TOOLS.has(toolName) && readableOutsideProject(target, readRoots))) {
+    const dir = ["write", "edit", "read"].includes(toolName) ? path.dirname(target) : target;
+    gates.push({ kind: "outside", family: `outside the project: ${dir}`, reason: `${toolName} outside the project folder (${target})` });
+  }
+  if (toolName !== "ls" && toolName !== "find" && isEnvFile(target)) {
+    gates.push({ kind: "env", family: `${toolName} ${path.basename(target)}`, reason: `${toolName} of an environment file (${path.basename(target)})` });
+  }
+  return gates;
+}
+
+/** Stable text of a call, for the doom-loop check. */
+export function callSignature(toolName: string, input: unknown): string {
+  try {
+    return `${toolName}:${JSON.stringify(input)}`;
+  } catch {
+    return `${toolName}:?`;
+  }
+}
+
+/** The command line a shell tool call runs. */
+export function shellCommandOf(toolName: string, input: Record<string, unknown>): string | null {
+  if (!SHELL_TOOLS.has(toolName)) return null;
+  const command = input.command;
+  return typeof command === "string" ? command : null;
+}
+
+/**
+ * Which gates a tool call hits in guarded mode. `recent` is the signatures of
+ * the calls before it, newest last (the third identical call in a row asks).
+ */
+export function evaluateToolCall(
+  toolName: string,
+  input: Record<string, unknown>,
+  { cwd, home, recent = [], readRoots }: { cwd: string; home: string; recent?: string[]; readRoots?: ReadRoots },
+): GateDecision {
+  const gates: Gate[] = [];
+  const command = shellCommandOf(toolName, input);
+  if (command !== null) gates.push(...shellGates(command));
+  if (PATH_TOOLS.has(toolName)) gates.push(...pathGates(toolName, input, cwd, home, readRoots));
+  const signature = callSignature(toolName, input);
+  if (!POLLING_TOOLS.has(toolName) && recent.length >= 2 && recent.at(-1) === signature && recent.at(-2) === signature) {
+    gates.push({ kind: "loop", family: `repeat ${toolName}`, reason: "the same call a third time in a row" });
+  }
+  // One gate per family (a line with two pushes asks once).
+  const seen = new Set<string>();
+  const unique = gates.filter((gate) => {
+    const key = `${gate.kind}:${gate.family}`;
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+  return { gates: unique, alwaysAsk: unique.some((gate) => gate.kind === "destructive" || gate.family === null) };
+}
+
+/** Gates the session already allowed are dropped (destructive ones never are). */
+export function pendingGates(decision: GateDecision, allowed: ReadonlySet<string>): Gate[] {
+  return decision.gates.filter((gate) => gate.kind === "destructive" || gate.family === null || !allowed.has(gate.family));
+}
+
+export const ALLOW_ONCE = "Allow once";
+export const ALLOW_SESSION = "Allow for this session";
+export const DENY = "Deny";
+
+/** Short text of what is about to run, for the prompt. */
+export function describeCall(toolName: string, input: Record<string, unknown>, max = 600): string {
+  const command = shellCommandOf(toolName, input);
+  let text: string;
+  if (command !== null) text = `$ ${command}`;
+  else {
+    const target = [input.path, input.file_path, input.filePath].find((v) => typeof v === "string");
+    text = target ? `${toolName} ${target}` : `${toolName} ${callSignature(toolName, input).slice(toolName.length + 1)}`;
+  }
+  return text.length > max ? `${text.slice(0, max - 1)}…` : text;
+}
+
+/** The prompt title shown in the TUI (and to rpc clients). */
+export function promptTitle(toolName: string, input: Record<string, unknown>, gates: Gate[], agent?: string | null): string {
+  const who = agent ? `Sub-agent ${agent} wants to run:` : "omnirush wants to run:";
+  return [`guarded mode — ${who}`, "", describeCall(toolName, input), "", ...gates.map((gate) => `• ${gate.reason}`)].join("\n");
+}
+
+export const GUARDED_BLOCK_HINT = "blocked in guarded mode; rerun with --yolo to allow";
+
+/** What the model reads when a call is not allowed. */
+export function blockReason(gates: Gate[], how: "denied" | "no-ui"): string {
+  const what = gates.map((gate) => gate.reason).join("; ");
+  return how === "denied"
+    ? `The user denied this call (guarded mode: ${what}). Do not retry it; ask the user how to proceed.`
+    : `${GUARDED_BLOCK_HINT} (${what}). Nobody can approve it in this run; do not retry it.`;
+}

package/assets/extensions/omnirush/guard.ts

@@ -0,0 +1,340 @@
+/**
+ * Approval modes: guarded (default) and yolo.
+ *
+ * Guarded: a tool call that hits one of the desktop app's guarded rules
+ * (guard-lib.ts: git/gh writes, destructive commands, sudo, shell
+ * interpreters, .env reads, paths outside the project, a repeated call) is
+ * paused and the user is asked, with the command shown:
+ *   Allow once / Allow for this session / Deny
+ * (destructive commands always ask: Allow once / Deny).
+ *
+ *   TUI        the prompt shows in the terminal.
+ *   rpc        the prompt goes to the client as an extension_ui_request
+ *              (method "select"; title starts with "guarded mode"); no
+ *              answer within 5 minutes = deny.
+ *   -p / json  nobody can answer: the call is blocked with "blocked in
+ *              guarded mode; rerun with --yolo to allow" (to the model, and
+ *              on stderr for the user).
+ *   sub-agent  a child process asks the nearest interactive omnirush above
+ *              it over a private local socket (OMNIRUSH_APPROVAL_SOCKET); the
+ *              prompt names the sub-agent. With no interactive parent the
+ *              call is blocked as above. Never silently allowed.
+ *
+ * Yolo (--yolo, /yolo on, /mode yolo, OMNIRUSH_YOLO=1): nothing asks.
+ *
+ * /mode [guarded|yolo] and /approvals [reset] show or switch the mode; the
+ * footer shows it; /status has a mode line.
+ */
+
+import crypto from "node:crypto";
+import fs from "node:fs";
+import net from "node:net";
+import os from "node:os";
+import path from "node:path";
+
+import { getAgentDir } from "@earendil-works/pi-coding-agent";
+
+import { omniDir } from "./auth";
+import {
+  ALLOW_ONCE,
+  ALLOW_SESSION,
+  DENY,
+  GUARDED_BLOCK_HINT,
+  blockReason,
+  callSignature,
+  describeCall,
+  evaluateToolCall,
+  pendingGates,
+  promptTitle,
+  type Gate,
+  type ReadRoots,
+} from "./guard-lib";
+import { MODE_STATUS_KEY, currentMode, formatModeStatus, saveYoloSetting, setSessionYolo, yoloBanner } from "./yolo-lib";
+
+export const APPROVAL_SOCKET_ENV = "OMNIRUSH_APPROVAL_SOCKET";
+export const APPROVAL_TOKEN_ENV = "OMNIRUSH_APPROVAL_TOKEN";
+const RPC_TIMEOUT_MS = 5 * 60_000;
+
+export type Answer = "once" | "session" | "deny" | "no-ui";
+
+export interface ApprovalRequest {
+  toolName: string;
+  input: Record<string, unknown>;
+  gates: Gate[];
+  alwaysAsk: boolean;
+  /** Sub-agent label, when a child asks. */
+  agent?: string | null;
+}
+
+export const GUARDED_NOTICE = "guarded mode: git writes, destructive commands and sudo ask first — /mode yolo (or --yolo) allows everything";
+
+/** Ask one question in this process's UI; Esc, a closed dialog or the rpc timeout deny. */
+async function askInUi(ctx: any, request: ApprovalRequest): Promise<Answer> {
+  const options = request.alwaysAsk ? [ALLOW_ONCE, DENY] : [ALLOW_ONCE, ALLOW_SESSION, DENY];
+  const title = promptTitle(request.toolName, request.input, request.gates, request.agent);
+  let choice: string | undefined;
+  try {
+    choice = await ctx.ui.select(title, options, ctx.mode === "rpc" ? { timeout: RPC_TIMEOUT_MS } : undefined);
+  } catch {
+    choice = undefined;
+  }
+  if (choice === ALLOW_ONCE) return "once";
+  if (choice === ALLOW_SESSION) return "session";
+  return "deny";
+}
+
+/** A child's question to the nearest interactive omnirush above it. */
+export function askParent(request: ApprovalRequest, env: NodeJS.ProcessEnv = process.env): Promise<Answer> {
+  const address = (env[APPROVAL_SOCKET_ENV] || "").trim();
+  if (!address) return Promise.resolve("no-ui");
+  return new Promise((resolve) => {
+    let settled = false;
+    let buffer = "";
+    const done = (answer: Answer) => {
+      if (settled) return;
+      settled = true;
+      socket.destroy();
+      resolve(answer);
+    };
+    const socket = net.createConnection(address, () => {
+      socket.write(`${JSON.stringify({ token: env[APPROVAL_TOKEN_ENV] || "", ...request })}\n`);
+    });
+    socket.setEncoding("utf8");
+    socket.on("data", (chunk: string) => {
+      buffer += chunk;
+      const newline = buffer.indexOf("\n");
+      if (newline < 0) return;
+      try {
+        const answer = JSON.parse(buffer.slice(0, newline))?.answer;
+        done(answer === "once" || answer === "session" || answer === "deny" ? answer : answer === "no-ui" ? "no-ui" : "deny");
+      } catch {
+        done("deny");
+      }
+    });
+    // The parent went away: nobody can answer.
+    socket.on("error", () => done("no-ui"));
+    socket.on("close", () => done("no-ui"));
+  });
+}
+
+export interface GuardState {
+  allowed: Set<string>;
+  recent: string[];
+  uiCtx: any;
+  queue: Promise<unknown>;
+}
+
+export function createGuardState(): GuardState {
+  return { allowed: new Set(), recent: [], uiCtx: null, queue: Promise.resolve() };
+}
+
+/**
+ * Decide one request in this process: yolo allows; families the session
+ * allowed pass; otherwise this UI asks (one prompt at a time), or the parent
+ * does, or nobody can.
+ */
+export async function decide(state: GuardState, request: ApprovalRequest, ctx: any, env: NodeJS.ProcessEnv = process.env): Promise<Answer> {
+  if (currentMode(env) === "yolo") return "once";
+  const gates = pendingGates({ gates: request.gates, alwaysAsk: request.alwaysAsk }, state.allowed);
+  if (gates.length === 0) return "session";
+  const pending = { ...request, gates };
+  const ui = ctx?.hasUI && ctx?.ui?.select ? ctx : state.uiCtx?.hasUI ? state.uiCtx : null;
+  let answer: Answer;
+  if (ui) {
+    const turn = state.queue.then(async () => {
+      // Allowed for the session while this one waited in line?
+      if (currentMode(env) === "yolo") return "once" as Answer;
+      const still = pendingGates({ gates: pending.gates, alwaysAsk: pending.alwaysAsk }, state.allowed);
+      if (still.length === 0) return "session" as Answer;
+      return askInUi(ui, { ...pending, gates: still });
+    });
+    state.queue = turn.catch(() => undefined);
+    answer = await turn;
+  } else {
+    answer = await askParent(pending, env);
+  }
+  if (answer === "session") {
+    for (const gate of gates) if (gate.family && gate.kind !== "destructive") state.allowed.add(gate.family);
+  }
+  return answer;
+}
+
+/** Serve sub-agents' questions (children inherit the address and token). */
+function startApprovalServer(state: GuardState): (() => void) | null {
+  const token = crypto.randomBytes(24).toString("hex");
+  let dir: string | null = null;
+  let address: string;
+  if (process.platform === "win32") {
+    address = `\\\\.\\pipe\\omnirush-approval-${process.pid}-${crypto.randomBytes(6).toString("hex")}`;
+  } else {
+    dir = fs.mkdtempSync(path.join(os.tmpdir(), "omnirush-approval-"));
+    fs.chmodSync(dir, 0o700);
+    address = path.join(dir, "s");
+  }
+  const server = net.createServer((socket) => {
+    socket.setEncoding("utf8");
+    let buffer = "";
+    socket.on("data", async (chunk: string) => {
+      buffer += chunk;
+      const newline = buffer.indexOf("\n");
+      if (newline < 0) return;
+      const line = buffer.slice(0, newline);
+      buffer = "";
+      let answer: Answer = "deny";
+      try {
+        const message = JSON.parse(line);
+        if (message?.token === token && typeof message.toolName === "string" && Array.isArray(message.gates)) {
+          const request: ApprovalRequest = {
+            toolName: message.toolName,
+            input: message.input && typeof message.input === "object" ? message.input : {},
+            gates: message.gates,
+            alwaysAsk: message.alwaysAsk === true,
+            agent: typeof message.agent === "string" ? message.agent : "sub-agent",
+          };
+          answer = await decide(state, request, null);
+        }
+      } catch {
+        answer = "deny";
+      }
+      try {
+        socket.end(`${JSON.stringify({ answer })}\n`);
+      } catch {
+        /* the child went away */
+      }
+    });
+    socket.on("error", () => undefined);
+  });
+  server.on("error", () => undefined);
+  try {
+    server.listen(address);
+  } catch {
+    return null;
+  }
+  server.unref();
+  process.env[APPROVAL_SOCKET_ENV] = address;
+  process.env[APPROVAL_TOKEN_ENV] = token;
+  const stop = () => {
+    try {
+      server.close();
+    } catch {
+      /* closed */
+    }
+    if (dir) fs.rmSync(dir, { recursive: true, force: true });
+  };
+  process.once("exit", stop);
+  return stop;
+}
+
+function showMode(ctx: any): void {
+  try {
+    ctx?.ui?.setStatus?.(MODE_STATUS_KEY, currentMode());
+  } catch {
+    /* no UI */
+  }
+}
+
+/** Skills folders, omnirush's own package (docs) and the temp folder's saved command output. */
+function defaultReadRoots(): ReadRoots {
+  let agentDir = "";
+  try {
+    agentDir = getAgentDir();
+  } catch {
+    agentDir = (process.env.OMNIRUSH_CODING_AGENT_DIR || process.env.PI_CODING_AGENT_DIR || "").trim();
+  }
+  const dirs = agentDir ? [path.join(agentDir, "skills"), path.join(agentDir, "omnirush-skills")] : [];
+  const packageRoot = (process.env.OMNIRUSH_PACKAGE_ROOT || "").trim();
+  if (packageRoot) dirs.push(packageRoot);
+  return { dirs, tmp: os.tmpdir() };
+}
+
+export default function (pi: any, options: { home?: string; readRoots?: ReadRoots } = {}) {
+  const state = createGuardState();
+  const home = options.home ?? os.homedir();
+  const readRoots = options.readRoots ?? defaultReadRoots();
+  let server: (() => void) | null = null;
+
+  pi.on("session_start", (_event: any, ctx: any) => {
+    state.allowed.clear();
+    state.recent = [];
+    if (ctx?.hasUI) {
+      state.uiCtx = ctx;
+      // The nearest interactive omnirush answers its sub-agents.
+      server ??= startApprovalServer(state);
+    }
+    showMode(ctx);
+    if (ctx?.hasUI && currentMode() === "guarded") ctx.ui?.notify?.(GUARDED_NOTICE, "info");
+  });
+
+  pi.on("tool_call", async (event: any, ctx: any) => {
+    if (ctx?.hasUI) state.uiCtx = ctx;
+    const toolName = String(event?.toolName ?? "");
+    const input = event?.input && typeof event.input === "object" ? event.input : {};
+    const decision = evaluateToolCall(toolName, input, { cwd: ctx?.cwd || process.cwd(), home, recent: state.recent, readRoots });
+    state.recent = [...state.recent, callSignature(toolName, input)].slice(-2);
+    if (currentMode() === "yolo" || decision.gates.length === 0) return undefined;
+    const agent = (process.env.OMNIRUSH_SUBAGENT_LABEL || "").trim() || null;
+    const answer = await decide(state, { toolName, input, gates: decision.gates, alwaysAsk: decision.alwaysAsk, agent }, ctx);
+    if (answer === "once" || answer === "session") return undefined;
+    const gates = pendingGates(decision, new Set());
+    if (answer === "no-ui") {
+      try {
+        process.stderr.write(`omnirush: ${GUARDED_BLOCK_HINT}: ${describeCall(toolName, input, 200)}\n`);
+      } catch {
+        /* stderr closed */
+      }
+    }
+    return { block: true, reason: blockReason(gates, answer === "deny" ? "denied" : "no-ui") };
+  });
+
+  const modeCommand = async (args: string, ctx: any) => {
+    const sub = String(args ?? "").trim().toLowerCase();
+    const notify = (text: string, level: "info" | "warning" | "error" = "info") => ctx?.ui?.notify?.(text, level);
+    if (sub === "" || sub === "status") {
+      const grants = [...state.allowed];
+      notify(
+        [
+          formatModeStatus(),
+          grants.length ? `allowed for this session: ${grants.join(", ")}` : null,
+          "/mode guarded|yolo switches (saved for the next runs); /approvals reset forgets this session's allows.",
+        ].filter(Boolean).join("\n"),
+      );
+      return;
+    }
+    if (sub === "reset") {
+      state.allowed.clear();
+      notify("Guarded mode: this session's allows are forgotten; those commands ask again.");
+      return;
+    }
+    const yolo = sub === "yolo" || sub === "on" || sub === "full";
+    if (!yolo && sub !== "guarded" && sub !== "off") {
+      notify("Usage: /mode [guarded|yolo|status]  ·  /approvals [reset]", "error");
+      return;
+    }
+    try {
+      saveYoloSetting(omniDir(), yolo);
+    } catch (error: any) {
+      notify(`/mode: could not save the setting (${error?.message ?? error})`, "error");
+      return;
+    }
+    setSessionYolo(yolo);
+    showMode(ctx);
+    notify(yolo ? `${yoloBanner()} (saved)` : `${GUARDED_NOTICE} (saved)`, yolo ? "warning" : "info");
+  };
+  const completions = (prefix: string) => {
+    const typed = prefix.trim();
+    const items = ["guarded", "yolo", "status", "reset"]
+      .filter((value) => value.startsWith(typed) && value !== typed)
+      .map((value) => ({ value, label: value }));
+    return items.length ? items : null;
+  };
+  pi.registerCommand("mode", {
+    description: "Approval mode: /mode [guarded|yolo|status] (guarded asks before git writes and destructive commands)",
+    getArgumentCompletions: completions,
+    handler: modeCommand,
+  });
+  pi.registerCommand("approvals", {
+    description: "Approval mode and this session's allows: /approvals [guarded|yolo|reset]",
+    getArgumentCompletions: completions,
+    handler: modeCommand,
+  });
+}

package/assets/extensions/omnirush/index.ts

@@ -5,26 +5,52 @@
 // extension (without it, none of these files were ever registered).
 // EVERY module that registers commands/tools/handlers must be wired here:
 // a module left out of this list is silently dead in sessions.
+//
+// A sub-agent (a headless spawn_agents child: OMNIRUSH_PARENT_SESSION is
+// set) does not load what only the interactive top agent uses — the slash
+// commands (commands), the session capture (collector: the parent records
+// its children) and voice input (TUI only) — so each of the many child
+// processes a fan-out starts stays smaller. They are imported on demand,
+// in the same order as before, so the top agent registers exactly what it
+// did.
 
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
-import collector from "./collector";
-import commands from "./commands";
-import mcp from "./mcp";
 import recorder from "./recorder";
 import sota from "./sota";
+import mcp from "./mcp";
 import agents from "./agents";
+import bgshell from "./bgshell";
+import subagents from "./subagents";
+import swarm from "./swarm";
 import plan from "./plan";
 import webfetch from "./webfetch";
 import websearch from "./websearch";
+import guard from "./guard";
+import yolo from "./yolo";
+
+/** A spawn_agents child process (the parent session captures it; no TUI). */
+export function isSubagentProcess(env: NodeJS.ProcessEnv = process.env): boolean {
+  return Boolean(String(env.OMNIRUSH_PARENT_SESSION ?? "").trim());
+}
 
-export default function (pi: ExtensionAPI) {
-  commands(pi as any);
+export default async function (pi: ExtensionAPI) {
+  const subagent = isSubagentProcess();
+  if (!subagent) (await import("./commands")).default(pi as any);
   recorder(pi as any);
   sota(pi as any);
-  collector(pi as any);
+  if (!subagent) (await import("./collector")).default(pi as any);
+  // Children still mark their own session as a sub-agent's (the collector
+  // does that for the top agent's sessions; children do not load it).
+  else (await import("./subagent-marker")).default(pi as any);
   mcp(pi as any);
   webfetch(pi as any);
   websearch(pi as any);
   plan(pi as any);
   agents(pi as any);
+  subagents(pi as any);
+  bgshell(pi as any);
+  if (!subagent) (await import("./voice")).default(pi as any);
+  yolo(pi as any);
+  guard(pi as any);
+  swarm(pi as any);
 }