one-code-extension 0.1.3 → 0.3.0

package/extensions/lib/permission-gate.ts

@@ -0,0 +1,192 @@
+/**
+ * Permission gate for in-process agent sessions (pure), shared by the workflow
+ * and subagent runners.
+ *
+ * In-process agent sessions are built with `noExtensions: true`, so One Code's
+ * own permissions extension never loads inside them — without this gate every
+ * subagent bash/edit/write would run unchecked. `DefaultResourceLoader` always
+ * loads explicitly passed `extensionFactories` (even under noExtensions),
+ * which is where this inline factory attaches.
+ *
+ * Primary path: every tool call is routed through the parent's permission
+ * BRIDGE (`permissions/subagent-gate.ts`) — the parent's live mode, rules,
+ * auto-mode classifier and interactive prompts, exactly as the main agent's
+ * calls are judged (Claude Code parity, findings §17.1). Resolving or invoking
+ * the bridge fails CLOSED.
+ *
+ * Local fallback (no bridge — workflow/headless runs, or a parent without the
+ * permissions extension): deny rules always win; explicit allow rules allow;
+ * the mode is the parent session's live mode (published as CC_PERMISSION_MODE,
+ * read per call), else the settings' defaultMode, else acceptEdits (Claude Code
+ * runs these agents in acceptEdits); ask rules are honoured; anything that
+ * would normally *ask* is denied — there is no interactive prompt inside an
+ * in-process agent, and fail-closed beats silently trusting the model. Auto
+ * mode has no classifier here, so it degrades to acceptEdits, which decide()
+ * confines to the cwd (as it does reads); the rest is denied. Project-scope
+ * allow rules apply only with a stored consent (project-trust.ts).
+ *
+ * `neverGate` names tools the runtime itself injects (e.g. `structured_output`,
+ * the child-only `SendMessage`-to-main tool) that must never be gated.
+ */
+
+import { getAgentDir, type InlineExtension } from "@earendil-works/pi-coding-agent";
+import { findProjectRoot } from "./git.ts";
+import { memoryDir } from "./memory.ts";
+import { claudeConfigDir, oneCodeStateDir } from "./paths.ts";
+import { sessionResultsDir } from "./persisted-output.ts";
+import { sessionScratchpadDir } from "./scratchpad.ts";
+import { decide, extractSubject, isPathSubjectTool, normalizeToolName, type PermissionMode, parseRules } from "../permissions/matcher.ts";
+import { projectAllowApproved } from "../permissions/project-trust.ts";
+import { loadPermissionSettings, normalizePermissionMode } from "../permissions/settings.ts";
+import type { PermissionBridge } from "../permissions/subagent-gate.ts";
+import { resolveForContainment, toAbsolute } from "../auto-mode/paths.ts";
+
+/** A directory's realpath for containment, or the path itself when nothing about it resolves. */
+export const resolvedOrSelf = (dir: string) => resolveForContainment(dir) ?? dir;
+
+/**
+ * Directories protected at runtime, beyond protected-paths.ts's static list:
+ * pi's own agent directory (`getAgentDir()` — `~/.pi/agent` for stock pi,
+ * `~/.onecode/agent` bundled), whose extensions, settings and auth are code
+ * and credentials the harness loads; Claude Code's config dir and One Code's
+ * state dir, which hold the permission settings the gate is made of. The
+ * segment list in protected-paths.ts already catches literal `.claude` /
+ * `.onecode`; these absolute roots also catch them when `CLAUDE_CONFIG_DIR` /
+ * `ONECODE_STATE_DIR` relocated the dir (distribution review 2026-09-09, L2).
+ * The memory dir (under the config dir) and the plan file (under the state dir)
+ * are cleared as harness working space *before* the protected check in
+ * `decide()`, so protecting these roots does not block them. Literal and
+ * resolved spelling, so both the raw and the realpath'd subject match. One
+ * definition for both gates (PERMISSIONS-REVIEW-2026-09-05 M7).
+ */
+export function runtimeProtectedDirs(): string[] {
+	const roots = [getAgentDir(), claudeConfigDir(), oneCodeStateDir()];
+	return [...new Set(roots.flatMap((dir) => [dir, resolvedOrSelf(dir)]))];
+}
+
+/** Tools the runtime itself injects; never gate them. */
+const DEFAULT_INTERNAL_TOOLS = new Set(["structured_output"]);
+
+/** The parent permissions extension publishes its live mode here (in-process children read it). */
+export const MODE_ENV = "CC_PERMISSION_MODE";
+
+/**
+ * The mode the local gate judges under: the parent's published live mode, else
+ * the settings' defaultMode, else Claude Code's subagent default. Pure, for tests.
+ */
+export function localGateMode(envValue: string | undefined, defaultMode: PermissionMode | undefined): PermissionMode {
+	return normalizePermissionMode(envValue) ?? defaultMode ?? "acceptEdits";
+}
+
+export function permissionGateFactory(
+	cwd: string,
+	home: string,
+	neverGate: Set<string> = DEFAULT_INTERNAL_TOOLS,
+	/**
+	 * The parent permissions extension's decision closure. When present, a child's
+	 * tool calls are gated through the REAL parent pipeline (mode inheritance,
+	 * auto-mode classifier, prompts bubbled to the user — Claude Code parity,
+	 * findings §17.1) rather than the fail-closed local rules below. A getter so it
+	 * can be read at call time (the bridge may be published after the loader builds);
+	 * absent only for headless runs with no publishing parent, which keep the local gate.
+	 */
+	getBridge?: () => PermissionBridge | undefined,
+): InlineExtension {
+	const settings = loadPermissionSettings(cwd, home);
+	const deny = parseRules(settings.deny);
+	const ask = parseRules(settings.ask);
+	// The repository the run belongs to: an isolation worktree shares its main
+	// checkout's consent and memory (findProjectRoot), not a throwaway slug.
+	const projectRoot = findProjectRoot(cwd) ?? cwd;
+	// Repo-shipped allow rules count only once the user has consented to exactly
+	// this list (the parent session's dialog); there is no one to ask here.
+	const allow = parseRules(
+		projectAllowApproved(projectRoot, settings.projectAllow) ? [...settings.allow, ...settings.projectAllow] : settings.allow,
+	);
+	// Memory writes work inside agent sessions too — otherwise the protected
+	// `.claude` check turns them into "needs interactive approval" and the
+	// harness blocks its own feature (same rationale as in decide()).
+	const memoryDirPath = memoryDir(home, projectRoot);
+	const protectedDirs = runtimeProtectedDirs();
+
+	return {
+		name: "agent-permission-gate",
+		hidden: true,
+		factory: (pi) => {
+			// The scratchpad embeds the *child's* session id, which does not exist
+			// until the session runs — derived on first tool call, then pinned.
+			let scratchpadDirPath: string | undefined;
+			pi.on("tool_call", async (event, ctx) => {
+				if (neverGate.has(event.toolName)) return undefined;
+				const runCwd = ctx?.cwd ?? cwd;
+				const sessionId = ctx?.sessionManager?.getSessionId?.();
+
+				// Preferred path: route the call through the parent's real permission
+				// pipeline. Everything here — resolving the bridge AND invoking it — fails
+				// CLOSED (deny); a broken bridge or getter must never silently open the gate.
+				// The child's own signal rides along so an aborted child turn cancels any
+				// classifier call the bridge makes and dismisses a prompt it bubbled; the
+				// session id lets the runner name the asking agent in that prompt.
+				try {
+					const bridge = getBridge?.();
+					if (bridge) {
+						const input = (event.input ?? {}) as Record<string, unknown>;
+						return await bridge({
+							toolName: event.toolName,
+							input,
+							cwd: runCwd,
+							signal: ctx?.signal,
+							sessionId,
+						});
+					}
+				} catch (error) {
+					return { block: true, reason: `Permission bridge failed (${(error as Error).message}); denied to fail safe.` };
+				}
+
+				if (!scratchpadDirPath && sessionId) scratchpadDirPath = sessionScratchpadDir(runCwd, sessionId);
+				const tool = normalizeToolName(event.toolName);
+				const subject = extractSubject(tool, event.input as Record<string, unknown>);
+				// Path tools (writers and the read tier) are judged by where the path
+				// resolves; both sides resolved (macOS /var → /private/var) so a real
+				// in-cwd path is not misjudged as an escape.
+				const resolvedSubject =
+					isPathSubjectTool(tool) && subject ? resolveForContainment(toAbsolute(runCwd, subject, home)) : undefined;
+				// Read per call: the parent may cycle modes while a child runs.
+				const liveMode = localGateMode(process.env[MODE_ENV], settings.defaultMode);
+				// No classifier is reachable without the bridge, so auto mode is judged
+				// as acceptEdits — which decide() confines to the working directory.
+				const mode = liveMode === "auto" ? "acceptEdits" : liveMode;
+				const result = decide({
+					toolName: event.toolName,
+					subject,
+					cwd: runCwd,
+					mode,
+					deny,
+					ask,
+					allow,
+					resolvedSubject,
+					resolvedCwd: resolveForContainment(runCwd),
+					memoryDirPath,
+					scratchpadDirPath,
+					// The agent's own persisted-output dir: a read of a result it was
+					// handed a path to must not be judged an outside read. Resolved like
+					// the subject (the tmpdir fallback sits under a symlinked /var on macOS).
+					resultsDirPath: resolvedOrSelf(sessionResultsDir(ctx)),
+					protectedDirs,
+				});
+				if (result.decision === "allow") return undefined;
+				const ruleNote = result.rule ? ` (rule: ${result.rule.raw})` : "";
+				const outside = result.cause === "working-dir" ? " outside the working directory" : "";
+				return {
+					block: true,
+					reason:
+						result.decision === "deny"
+							? `Denied by permission rules${ruleNote}.`
+							: liveMode === "auto"
+								? `Auto mode's classifier is only reachable through the parent session, which this agent has no link to; a call${outside} is denied to fail safe.`
+								: `This action${outside} needs interactive approval, which is not available inside an in-process agent. Ask for it to be added to the allow rules, or work around it.`,
+				};
+			});
+		},
+	};
+}

package/extensions/lib/persisted-output.ts

@@ -13,8 +13,26 @@
  */
 
 import { mkdirSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
 import { join } from "node:path";
 
+/**
+ * Where a session's oversized outputs are persisted — the session dir,
+ * matching Claude Code's `<session-dir>/tool-results/<id>.txt`. A session-less
+ * run (`--no-session`) has no such dir, so a temp folder serves; the model gets
+ * the path either way. Shared by every producer that would otherwise truncate:
+ * cutting text loses context, a file keeps it one `read` away.
+ */
+export function sessionResultsDir(ctx: { sessionManager?: { getSessionDir?: () => string | undefined } } | undefined): string {
+	try {
+		const dir = ctx?.sessionManager?.getSessionDir?.();
+		if (dir) return dir;
+	} catch {
+		// fall through to the temp folder
+	}
+	return join(tmpdir(), "one-code");
+}
+
 /** Claude Code persists around this size; pi's bash truncation uses 50KB too. */
 export const PERSIST_MAX_BYTES = 50 * 1024;
 export const PREVIEW_BYTES = 2 * 1024;

package/extensions/lib/pi-ai-estimate.ts

@@ -0,0 +1,160 @@
+/**
+ * Vendored token-estimation and max-tokens clamp helpers from pi-ai.
+ *
+ * The compaction extension needs `clampMaxTokensToContext` (from pi-ai's
+ * `api/simple-options`) and `estimateMessageTokens` (from `utils/estimate`) to
+ * predict the exact `max_tokens` pi's `completeSimple` will send. Importing
+ * those deep subpaths directly breaks under the bundled app: pi's extension
+ * loader takes an `alias` branch when pi is imported as a library (not the CLI),
+ * and jiti aliases match `@earendil-works/pi-ai` by prefix, rewriting every
+ * `@earendil-works/pi-ai/<subpath>` onto pi-ai's compat entry — so
+ * `@earendil-works/pi-ai/api/simple-options` resolves to the nonexistent
+ * `compat.js/api/simple-options` and the app cannot load the extension set
+ * (distribution review 2026-09-09, H1). Only the bare specifier and `/compat`,
+ * `/oauth`, `/providers/all` are aliased exactly; every other subpath is dead
+ * under the app.
+ *
+ * So the two consumed helpers (`clampMaxTokensToContext`, `estimateMessageTokens`)
+ * and the private estimator chain they depend on are copied here from pi-ai
+ * 0.85.0, importing only types from the bare specifier. The two exported helpers
+ * are byte-identical to upstream; the one adaptation is the internal
+ * `estimateContextTokens`, narrowed to accept only `Context` (the sole shape we
+ * call it with) rather than upstream's `Context | Message[]` overload — the
+ * Message[] branch would be dead code here. `test/unit/pi-ai-estimate.test.ts`
+ * imports the real deep paths from node_modules and asserts the two exported
+ * helpers produce identical numbers, so an upstream change is caught rather than
+ * silently drifting.
+ */
+
+import type { Api, Context, ImageContent, Message, Model, TextContent, Tool, Usage } from "@earendil-works/pi-ai";
+
+const CHARS_PER_TOKEN = 4;
+const ESTIMATED_IMAGE_CHARS = 4800;
+const CONTEXT_SAFETY_TOKENS = 4096;
+const MIN_MAX_TOKENS = 1;
+
+function calculateContextTokens(usage: Usage): number {
+	return usage.totalTokens || usage.input + usage.output + usage.cacheRead + usage.cacheWrite;
+}
+
+function safeJsonStringify(value: unknown): string {
+	try {
+		return JSON.stringify(value) ?? "undefined";
+	} catch {
+		return "[unserializable]";
+	}
+}
+
+function estimateTextAndImageContentChars(content: string | Array<TextContent | ImageContent>): number {
+	if (typeof content === "string") return content.length;
+	let chars = 0;
+	for (const block of content) chars += block.type === "text" ? block.text.length : ESTIMATED_IMAGE_CHARS;
+	return chars;
+}
+
+function estimateTextTokens(text: string): number {
+	return Math.ceil(text.length / CHARS_PER_TOKEN);
+}
+
+function estimateTextAndImageContentTokens(content: string | Array<TextContent | ImageContent>): number {
+	return Math.ceil(estimateTextAndImageContentChars(content) / CHARS_PER_TOKEN);
+}
+
+export function estimateMessageTokens(message: Message): number {
+	let chars = 0;
+	if (message.role === "user") return estimateTextAndImageContentTokens(message.content);
+	if (message.role === "toolResult") return estimateTextAndImageContentTokens(message.content);
+	for (const block of message.content) {
+		if (block.type === "text") {
+			chars += block.text.length;
+		} else if (block.type === "thinking") {
+			chars += block.thinking.length;
+		} else {
+			chars += block.name.length + safeJsonStringify(block.arguments).length;
+		}
+	}
+	return Math.ceil(chars / CHARS_PER_TOKEN);
+}
+
+interface ContextUsageEstimate {
+	tokens: number;
+	usageTokens: number;
+	trailingTokens: number;
+	lastUsageIndex: number | null;
+}
+
+function getLastAssistantUsageInfo(messages: readonly Message[]): { usage: Usage; index: number } | undefined {
+	let latestPrefixTimestamp = Number.NEGATIVE_INFINITY;
+	let usageInfo: { usage: Usage; index: number } | undefined;
+	for (let i = 0; i < messages.length; i++) {
+		const message = messages[i];
+		if (message.role === "assistant") {
+			const assistant = message;
+			// A newer prefix message was inserted after this response (for example, a
+			// compaction summary), so its usage cannot describe the current prefix.
+			const usageAppliesToPrefix = assistant.timestamp >= latestPrefixTimestamp;
+			if (
+				usageAppliesToPrefix &&
+				assistant.stopReason !== "aborted" &&
+				assistant.stopReason !== "error" &&
+				calculateContextTokens(assistant.usage) > 0
+			) {
+				usageInfo = { usage: assistant.usage, index: i };
+			}
+		}
+		latestPrefixTimestamp = Math.max(latestPrefixTimestamp, message.timestamp);
+	}
+	return usageInfo;
+}
+
+function estimateMessages(messages: readonly Message[]): ContextUsageEstimate {
+	const usageInfo = getLastAssistantUsageInfo(messages);
+	if (usageInfo) {
+		const usageTokens = calculateContextTokens(usageInfo.usage);
+		let trailingTokens = 0;
+		for (let i = usageInfo.index + 1; i < messages.length; i++) {
+			trailingTokens += estimateMessageTokens(messages[i]);
+		}
+		return { tokens: usageTokens + trailingTokens, usageTokens, trailingTokens, lastUsageIndex: usageInfo.index };
+	}
+	let tokens = 0;
+	for (const message of messages) tokens += estimateMessageTokens(message);
+	return { tokens, usageTokens: 0, trailingTokens: tokens, lastUsageIndex: null };
+}
+
+function estimateToolsTokens(tools: Tool[] | undefined): number {
+	if (!tools || tools.length === 0) return 0;
+	return estimateTextTokens(safeJsonStringify(tools));
+}
+
+function estimateContextTokens(context: Context): ContextUsageEstimate {
+	const estimate = estimateMessages(context.messages);
+	if (estimate.lastUsageIndex !== null) {
+		const addedNames = new Set(
+			context.messages
+				.slice(estimate.lastUsageIndex + 1)
+				.filter((message) => message.role === "toolResult")
+				.flatMap((message) => (message.role === "toolResult" ? message.addedToolNames ?? [] : [])),
+		);
+		const addedToolTokens = estimateToolsTokens(context.tools?.filter((tool) => addedNames.has(tool.name)));
+		return {
+			tokens: estimate.tokens + addedToolTokens,
+			usageTokens: estimate.usageTokens,
+			trailingTokens: estimate.trailingTokens + addedToolTokens,
+			lastUsageIndex: estimate.lastUsageIndex,
+		};
+	}
+	const prefixTokens = (context.systemPrompt ? estimateTextTokens(context.systemPrompt) : 0) + estimateToolsTokens(context.tools);
+	return {
+		tokens: estimate.tokens + prefixTokens,
+		usageTokens: estimate.usageTokens,
+		trailingTokens: estimate.trailingTokens + prefixTokens,
+		lastUsageIndex: estimate.lastUsageIndex,
+	};
+}
+
+export function clampMaxTokensToContext(model: Model<Api>, context: Context, maxTokens: number): number {
+	if (model.contextWindow <= 0) return Math.max(MIN_MAX_TOKENS, maxTokens);
+	const available = model.contextWindow - estimateContextTokens(context).tokens - CONTEXT_SAFETY_TOKENS;
+	return Math.min(maxTokens, Math.max(MIN_MAX_TOKENS, available));
+}

package/extensions/lib/pi-version.ts

@@ -12,7 +12,7 @@
 
 /** Inclusive minimum and exclusive maximum pi version this release is tested against. */
 export const TESTED_PI_MIN = "0.83.0";
-export const TESTED_PI_MAX_EXCLUSIVE = "0.85.0";
+export const TESTED_PI_MAX_EXCLUSIVE = "0.86.0";
 
 /** Dotted-numeric parse; undefined for anything that is not plain x.y.z numbers. */
 export function parseVersion(version: string): number[] | undefined {

package/extensions/lib/plan-mode-channels.ts

@@ -0,0 +1,11 @@
+/**
+ * Bus channels between plan-mode and permissions. They live here, not in
+ * either extension, because permissions cannot import plan-mode (plan-mode
+ * already imports `permissions/modes.ts`) and a string literal typed in two
+ * places is the one way a channel rename silently disconnects a listener.
+ */
+
+/** Request a permission-mode change (`{ mode }`); permissions applies it. */
+export const MODE_CHANNEL = "one-code:set-permission-mode";
+/** Announces plan mode's one writable file (`{ path }`); the permissions matcher consumes it. */
+export const PLAN_FILE_CHANNEL = "one-code:plan-file-path";

package/extensions/lib/plugin-overrides.ts

@@ -0,0 +1,24 @@
+/**
+ * One Code-local enable/disable overrides for Claude Code-installed plugins
+ * (pure fs, no pi imports).
+ *
+ * A plugin installed under ~/.claude keeps its enabled state in Claude Code's
+ * own settings.json, which One Code never writes. Toggling such a plugin from
+ * One Code therefore records an override here (`<plugin root>/overrides.json`,
+ * `{"name@marketplace": boolean}`), applied on top of Claude Code's state
+ * during discovery. Plugins installed by One Code itself store `enabled`
+ * directly on their installed_plugins.json entry and never appear here.
+ */
+
+import { join } from "node:path";
+import { readBooleanMap, setBooleanMapEntry } from "./atomic-write.ts";
+
+const FILE = "overrides.json";
+
+export function readOverrides(root: string): Record<string, boolean> {
+	return readBooleanMap(join(root, FILE));
+}
+
+export function setOverride(root: string, pluginId: string, enabled: boolean): void {
+	setBooleanMapEntry(join(root, FILE), pluginId, enabled);
+}

package/extensions/lib/plugin-root.ts

@@ -0,0 +1,44 @@
+/**
+ * One Code's own plugin state root (pure).
+ *
+ * All plugin state One Code writes — marketplaces, installs, overrides, usage,
+ * favorites — lives under `<agentDir>/plugins`, never under `~/.claude`.
+ * `~/.claude/plugins` is a read-only input (plugins installed by Claude Code
+ * keep working read-through; see lib/plugins.ts).
+ *
+ * Callers pass `getAgentDir()` so the root follows the distribution mode:
+ * `~/.onecode/agent/plugins` under the bundled app (PI_CODING_AGENT_DIR),
+ * `~/.pi/agent/plugins` when running as a plain pi extension.
+ */
+
+import { join, relative, resolve } from "node:path";
+
+export function pluginRoot(agentDir: string): string {
+	return join(agentDir, "plugins");
+}
+
+/**
+ * One path segment safe for any untrusted plugin/marketplace name (matches
+ * Claude Code's sanitizer; versions keep their dots). Never empty — an
+ * all-symbol name must not collapse to the parent directory.
+ */
+export function sanitizePathSegment(value: string, allowDots = false): string {
+	const pattern = allowDots ? /[^a-zA-Z0-9\-_.]/g : /[^a-zA-Z0-9\-_]/g;
+	const cleaned = value.replace(pattern, "-");
+	// A dots-only result (`.`, `..`, `...`) is not a directory name: `join`
+	// normalises it and the segment escapes into the parent — a `version: ".."`
+	// would install into the cache root and wipe siblings (review M4). Treat any
+	// all-dots segment as empty.
+	if (cleaned.length === 0 || /^\.+$/.test(cleaned)) return "unnamed";
+	return cleaned;
+}
+
+/**
+ * True when `target` resolves strictly inside `base` — the containment check
+ * for third-party-authored relative paths (rejects `..` escapes and absolute
+ * overrides).
+ */
+export function pathWithinBase(base: string, target: string): boolean {
+	const rel = relative(resolve(base), resolve(base, target));
+	return rel !== "" && !rel.startsWith("..") && resolve(rel) !== rel;
+}