one-code-extension 0.3.1 → 0.4.1

package/extensions/mcp/index.ts

@@ -64,6 +64,7 @@ import {
 	type McpResourceContents,
 	namespacedToolName,
 } from "./schema.ts";
+import { registerLocalCommand } from "../lib/local-command.ts";
 
 /** Anthropic's hard limit on a tool name; a longer one fails the whole request. */
 const MAX_TOOL_NAME_LENGTH = 128;
@@ -842,9 +843,9 @@ export default function mcpExtension(pi: ExtensionAPI) {
 		});
 	};
 
-	pi.registerCommand("mcp", {
+	registerLocalCommand(pi, "mcp", {
 		description: "Manage MCP servers (status, reconnect, authenticate, enable/disable)",
-		handler: async (_args, ctx) => {
+		handler: async (args, ctx) => {
 			if (servers.length === 0) {
 				ctx.ui.notify("No MCP servers configured. Add them to .mcp.json or ~/.claude.json.", "info");
 				return;

package/extensions/memory/entries.ts

@@ -12,7 +12,7 @@
  * concept at all), and the auto-memory folder as the last entry.
  */
 
-import { basename, dirname, join } from "node:path";
+import { basename, dirname, join, relative, resolve } from "node:path";
 import {
 	AGENTS_DESCRIPTOR,
 	ancestorDirs,
@@ -25,6 +25,7 @@ import {
 	ONECODE_GLOBAL_DESCRIPTOR,
 	PROJECT_DESCRIPTOR,
 } from "../lib/claude-context.ts";
+import { forwardSlashes, isRelativeInside, tildify } from "../lib/paths.ts";
 import { tryReadFile } from "../lib/plugins.ts";
 
 export interface MemoryEntry {
@@ -39,12 +40,14 @@ export interface MemoryEntry {
 	exists: boolean;
 }
 
-/** Display form of a path: a file at the cwd as `./name`, under home as `~/…`, else absolute. */
+/**
+ * Display form of a path: a file under the cwd as `./name`, under home as
+ * `~/…`, else as given — always with forward slashes (Claude Code's spelling
+ * in this picker), whatever the platform's separator.
+ */
 function displayPath(path: string, cwd: string, home: string): string {
-	if (path.startsWith(`${cwd}/`)) return `./${path.slice(cwd.length + 1)}`;
-	if (home && path === home) return "~";
-	if (home && path.startsWith(`${home}/`)) return `~${path.slice(home.length)}`;
-	return path;
+	const rel = relative(resolve(cwd), resolve(path));
+	return isRelativeInside(rel) ? `./${forwardSlashes(rel)}` : tildify(path, home);
 }
 
 /**

package/extensions/memory/index.ts

@@ -40,6 +40,7 @@ import { boundedDockHeight, safeThemeBold, safeThemePaint, truncateLine } from "
 import { buildMemoryEntries, entryName, type MemoryEntry } from "./entries.ts";
 import { openPath } from "./open-external.ts";
 import { applyMemoryKey, decodeMemoryKey, initialMemoryState, renderMemoryPanel } from "./panel.ts";
+import { registerLocalCommand } from "../lib/local-command.ts";
 
 const MEMORY_PANEL_MAX_HEIGHT = 20;
 
@@ -144,9 +145,9 @@ export default function memoryExtension(pi: ExtensionAPI) {
 	// ---- /memory: Claude Code's Memory picker --------------------------------
 	// Pick a memory-related file (or the auto-memory folder) and open it in the
 	// external editor, matching CC. Pure panel logic lives in ./panel.ts.
-	pi.registerCommand("memory", {
+	registerLocalCommand(pi, "memory", {
 		description: "View or edit CLAUDE.md and memory files",
-		handler: async (_args, ctx) => {
+		handler: async (args, ctx) => {
 			const entries = memoryEntriesFor(ctx.cwd);
 			if (!ctx.hasUI) {
 				const lines = entries.map(

package/extensions/memory/open-external.ts

@@ -14,6 +14,7 @@
  */
 
 import { spawn } from "node:child_process";
+import { commandLaunch } from "../lib/command-launch.ts";
 
 export interface OpenPlan {
 	command: string;
@@ -78,7 +79,9 @@ export function openPath(path: string, kind: "file" | "folder"): Promise<OpenRes
 		};
 		let child: ReturnType<typeof spawn>;
 		try {
-			child = spawn(command, args, { stdio: "ignore", detached: true });
+			// `$EDITOR=code` is VS Code's `code.cmd` shim on Windows, which a bare spawn cannot start.
+			const launch = commandLaunch(command, args, process.env);
+			child = spawn(launch.command, launch.args, { stdio: "ignore", detached: true, windowsVerbatimArguments: launch.windowsVerbatimArguments });
 		} catch (error) {
 			finish({ message: `Could not open ${path}: ${error instanceof Error ? error.message : error}`, ok: false });
 			return;

package/extensions/model-default/index.ts

@@ -14,10 +14,20 @@
  * startup with its normal precedence (an explicit --model still wins). Safe to
  * write externally: pi's settings save re-reads the file under its lock and
  * merges only the fields pi itself modified, so this key survives pi's writes.
+ *
+ * The switch is also shown to the model the way Claude Code shows `/model`
+ * (a local-command breadcrumb before the next prompt — lib/local-command.ts):
+ * CC's stdout is "Set model to `<name>` and saved as your default for new
+ * sessions", and since persisting is what this extension does, the claim is
+ * true here too (a failed write announces the switch without it). pi handles
+ * `/model` before any extension sees the text, so `model_select` — which also
+ * covers ctrl+p cycling — is the one signal; the debounce means only the model
+ * the user settles on is announced.
  */
 
 import { join } from "node:path";
 import { getAgentDir, type ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { announceLocalCommand } from "../lib/local-command.ts";
 import { readSettingsForWrite, writeSettings } from "../lib/one-code-settings.ts";
 
 /** Pure merge: set the default model, preserving every other settings key. */
@@ -29,11 +39,16 @@ export function applyDefaultModel(
 	return { ...file, defaultProvider: provider, defaultModel: modelId };
 }
 
+/** Claude Code's `/model` stdout line, as captured (2.1.278); without the persisted half when the write failed. */
+export function modelSwitchStdout(displayName: string, saved: boolean): string {
+	return `Set model to \`${displayName}\`${saved ? " and saved as your default for new sessions" : ""}`;
+}
+
 /** Quiet period after the last switch before it is written (ctrl+p cycles fire one event per step). */
 export const PERSIST_DEBOUNCE_MS = 400;
 
 export default function modelDefaultExtension(pi: ExtensionAPI) {
-	let pending: { provider: string; id: string; notify: (message: string) => void } | undefined;
+	let pending: { provider: string; id: string; name: string; notify: (message: string) => void } | undefined;
 	let timer: ReturnType<typeof setTimeout> | undefined;
 
 	const flush = () => {
@@ -43,23 +58,27 @@ export default function modelDefaultExtension(pi: ExtensionAPI) {
 		pending = undefined;
 		if (!choice) return;
 		const path = join(getAgentDir(), "settings.json");
+		let saved = true;
 		try {
 			writeSettings(path, applyDefaultModel(readSettingsForWrite(path), choice.provider, choice.id));
 		} catch (error) {
 			// Persisting a preference must not break the model switch itself, but
 			// say why it will be forgotten (typically a malformed settings.json).
+			saved = false;
 			choice.notify(`Could not save ${choice.provider}/${choice.id} as the default model: ${(error as Error).message}`);
 		}
+		announceLocalCommand(pi, { name: "model", stdout: modelSwitchStdout(choice.name, saved) });
 	};
 
 	// Debounced: a ctrl+p cycle emits model_select per step, and only the model
 	// the user settles on should hit the disk (last one wins).
 	pi.on("model_select", (event, ctx) => {
-		const model = event.model as { provider?: string; id?: string } | undefined;
+		const model = event.model as { provider?: string; id?: string; name?: string } | undefined;
 		if (!model?.provider || !model.id) return;
 		pending = {
 			provider: model.provider,
 			id: model.id,
+			name: model.name || model.id,
 			notify: (message) => {
 				if (ctx.hasUI) ctx.ui.notify(message, "warning");
 			},

package/extensions/permissions/index.ts

@@ -22,9 +22,9 @@ import { join } from "node:path";
 import type { Api, Model } from "@earendil-works/pi-ai";
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { type ChildAction, SUBAGENT_ACTIONS_CHANNEL, type SubagentActionsPayload } from "../auto-mode/actions.ts";
-import { createTaskNotifier } from "../lib/notifications.ts";
+import type { HandBackVerdict } from "../lib/notifications.ts";
 import { MODEL_UNUSABLE_CHANNEL, type ModelUnusableEvent } from "../lib/model-unusable.ts";
-import { customMessageText, notificationComponent } from "../lib/tui-render.ts";
+
 import { classify, createClassifierState } from "../auto-mode/classifier.ts";
 import {
 	type AutoModeConfig,
@@ -52,6 +52,9 @@ import { checkRecoverability } from "../auto-mode/recoverability.ts";
 import { safetyControlWrite } from "../auto-mode/safety-floor.ts";
 import { isExecutionPrimitivePath, isSensitivePath } from "../auto-mode/sensitive.ts";
 import { analyzeShellCommand, type ShellEvidence } from "../auto-mode/shell-analysis.ts";
+import { isGitStatusCommand, powershellReadOnly } from "./powershell-rules.ts";
+import { isShellTool } from "./matcher.ts";
+import { gitStatusClean } from "../lib/git.ts";
 import { projectMemoryDir } from "../lib/memory.ts";
 import { sessionResultsDir } from "../lib/persisted-output.ts";
 import { sessionScratchpadDir } from "../lib/scratchpad.ts";
@@ -67,7 +70,7 @@ import {
 	isPathSubjectTool,
 } from "./matcher.ts";
 import { type SessionGrant, sessionGrant } from "./session-grant.ts";
-import { modeBadge, nextMode, PERMISSION_STATUS_CHANNEL, type PermissionStatus } from "./modes.ts";
+import { modeBadge, nextMode, PERMISSION_STATUS_CHANNEL, type PermissionStatus, CYCLE_KEY } from "./modes.ts";
 import { type ChildToolCall, type ChildGateDecision, SUBAGENT_GATE_CHANNEL } from "./subagent-gate.ts";
 import { trackOriginalCommands } from "../lib/original-command.ts";
 import { MODE_CHANNEL, PLAN_FILE_CHANNEL } from "../lib/plan-mode-channels.ts";
@@ -80,6 +83,7 @@ import { describeProjectAllow, persistProjectAllowApproval, projectAllowApproved
 import { findProjectRoot } from "../lib/git.ts";
 import { oneCodeProjectSettingsPath, oneCodeSettingsPath } from "../lib/one-code-settings.ts";
 import { recordUsage } from "../lib/usage-bus.ts";
+import { registerLocalCommand } from "../lib/local-command.ts";
 
 const DENIED_BY_USER =
 	"The user doesn't want to proceed with this tool use. The tool use was rejected. Adjust your approach based on the user's feedback instead of retrying the same call.";
@@ -169,12 +173,8 @@ const approved = (choice: string | undefined, grant: SessionGrant | undefined) =
 	choice === YES || (grant !== undefined && choice === grant.label);
 
 export default function permissionsExtension(pi: ExtensionAPI) {
-	const notifyTask = createTaskNotifier(pi);
 	// The background hand-back review rides the same steered path as agent
 	// completions; render it the same compact way (full body on ctrl+o).
-	pi.registerMessageRenderer("subagent-review", (message, { expanded }, theme) =>
-		notificationComponent(theme, customMessageText(message.content), expanded),
-	);
 	pi.registerFlag("permission-mode", {
 		description:
 			"Permission mode: default (alias: manual) | acceptEdits | plan | auto | bypassPermissions | dontAsk",
@@ -244,6 +244,14 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 	let scratchpadDirPath: string | undefined;
 	/** Where oversized tool outputs are persisted this session — readable like the cwd. */
 	let resultsDirPath: string | undefined;
+	/** This project's pi session dir: transcripts + auto-mode-decisions.jsonl (readable, never a write root). */
+	let sessionDirPath: string | undefined;
+	/**
+	 * The harness dirs a read may reach besides the cwd, realpath-resolved once
+	 * per session (they never change after session_start) — one list for both
+	 * shell pre-gates, which compare against realpaths.
+	 */
+	let readableRoots: string[] = [];
 	/** The session cwd's own realpath (macOS /var → /private/var), for decide()'s containment check. */
 	let resolvedCwd: string | undefined;
 	/** The per-repo One Code settings file, resolved once per session so the auto-mode floor need not re-walk for the project root on every tool call. */
@@ -502,7 +510,7 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 
 		let evidence: ShellEvidence | undefined;
 		if (normalizeToolName(toolName) === "bash" && subject) {
-			evidence = analyzeShellCommand({ command: subject, cwd, home, protectedDirs });
+			evidence = analyzeShellCommand({ command: subject, cwd, home, protectedDirs, readableRoots });
 			if (evidence.verdict === "safe") {
 				logDecision(ctx, { tool: toolName, subject, outcome: "allow", source: "pre-gate" });
 				return allow();
@@ -523,6 +531,17 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 				}
 				evidence.notes.push(`git recoverability: ${rec.reason}`);
 			}
+		} else if (normalizeToolName(toolName) === "powershell" && subject) {
+			// PowerShell has no pre-gate in v1 beyond Claude Code's read-only cmdlet
+			// allowlist (powershell-rules.ts): a read-only line runs unclassified,
+			// everything else — every write, delete or unknown executable — goes to
+			// the classifier. No containment fast path either: the recoverability
+			// judge understands bash deletes, not `Remove-Item`, so PowerShell
+			// destruction is always classified (docs/decisions/windows.md).
+			if (powershellReadOnly(subject, { cwd, home, readableRoots }).readOnly) {
+				logDecision(ctx, { tool: toolName, subject, outcome: "allow", source: "pre-gate" });
+				return allow();
+			}
 		} else if (containmentEligible && isWritingTool(normalizeToolName(toolName))) {
 			// A write/edit whose target is inside the project and not a credential
 			// path is ordinary sandbox work — Claude Code auto-approves it, and so do
@@ -717,6 +736,8 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 		scratchpadDirPath = sessionScratchpadDir(ctx.cwd, ctx.sessionManager.getSessionId());
 		// Resolved like the subjects compared against it (a symlinked parent, macOS /var).
 		resultsDirPath = resolvedOrSelf(sessionResultsDir(ctx));
+		sessionDirPath = resolvedOrSelf(ctx.sessionManager.getSessionDir());
+		readableRoots = [memoryDirPath, scratchpadDirPath, resultsDirPath, sessionDirPath].filter((d): d is string => !!d).map(resolvedOrSelf);
 		resolvedCwd = resolveForContainment(ctx.cwd);
 		oneCodeProjectSettingsFile = oneCodeProjectSettingsPath(ctx.cwd, os.homedir());
 		protectedDirs = runtimeProtectedDirs();
@@ -771,8 +792,10 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 	// Claude Code cycles permission modes with shift+tab; pi reserves that key
 	// for the thinking dial. ctrl+q is the one ctrl+letter pi leaves unbound
 	// that terminals don't already own (ctrl+m *is* Enter's byte, alt needs
-	// option-as-meta configured on macOS) — see docs/decisions.md.
-	pi.registerShortcut("ctrl+q", {
+	// option-as-meta configured on macOS) — except on Windows and WSL, where
+	// pi binds ctrl+q itself and the key is alt+m (lib/keys.ts) — see
+	// docs/decisions.md.
+	pi.registerShortcut(CYCLE_KEY, {
 		description: "Cycle permission mode",
 		handler: (ctx) => {
 			badgeCtx = ctx;
@@ -823,7 +846,7 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 		// command that actually runs). The lookup is by toolCallId on purpose: a
 		// value inside `event.input` would be the model's to write, and rules would
 		// match a string of its choosing.
-		const original = normalizedTool === "bash" ? originalCommands.get(event.toolCallId) : undefined;
+		const original = isShellTool(normalizedTool) ? originalCommands.get(event.toolCallId) : undefined;
 		const matchSubject = original?.command ?? subject;
 		const callCwd = original?.cwd ?? ctx.cwd;
 
@@ -835,6 +858,14 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 			const recordedInput =
 				original !== undefined ? { command: original.command } : (event.input as Record<string, unknown>);
 			transcript.push({ kind: "tool", tool: normalizedTool, input: recordedInput });
+			// Claude Code follows a `git status` call with a ground-truth line the
+			// classifier can trust over the model's account of the tree
+			// (`{"meta":{"gitStatus":{"clean":…}}}`, captured 2.1.276 — findings §22).
+			const recordedCommand = typeof recordedInput.command === "string" ? recordedInput.command : undefined;
+			if (isShellTool(normalizedTool) && recordedCommand && isGitStatusCommand(recordedCommand)) {
+				const clean = await gitStatusClean(callCwd);
+				if (clean !== undefined) transcript.push({ kind: "meta", gitStatus: { clean } });
+			}
 			capTranscript();
 		}
 
@@ -854,6 +885,7 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 				memoryDirPath,
 				scratchpadDirPath,
 				resultsDirPath,
+				sessionDirPath,
 				protectedDirs,
 			});
 		let result = decideWith([...allow, ...activeSessionAllows(), ...(projectAllowTrusted ? projectAllow : [])]);
@@ -1074,6 +1106,7 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 			memoryDirPath,
 			scratchpadDirPath,
 			resultsDirPath,
+			sessionDirPath,
 			protectedDirs,
 		});
 
@@ -1111,7 +1144,7 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 			const appendEntry: TranscriptEntry = {
 				kind: "tool",
 				tool: normalizedTool,
-				input: normalizedTool === "bash" ? { command: subject } : input,
+				input: isShellTool(normalizedTool) ? { command: subject } : input,
 			};
 			const outcome = await runClassifier(toolName, input, subject, ctx, result.cause !== "protected-path", {
 				cwd,
@@ -1183,9 +1216,9 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 		};
 	};
 
-	pi.registerCommand("permissions", {
+	registerLocalCommand(pi, "permissions", {
 		description: "Show permission mode and loaded rules",
-		handler: async (_args, ctx) => {
+		handler: async (args, ctx) => {
 			const fmt = (rules: PermissionRule[]) => (rules.length ? rules.map((r) => r.raw).join(", ") : "(none)");
 			const denials = pauseTracker.recentDenials();
 			const autoLines =
@@ -1249,7 +1282,7 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 		// there is no harm floor to short-circuit for a run that already happened.
 		const childEntries: TranscriptEntry[] = actions.map((action) => {
 			const tool = normalizeToolName(action.toolName);
-			return { kind: "tool", tool, input: tool === "bash" ? { command: action.subject } : { subject: action.subject } };
+			return { kind: "tool", tool, input: isShellTool(tool) ? { command: action.subject } : { subject: action.subject } };
 		});
 		const verdict = await classify(
 			{
@@ -1307,16 +1340,12 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 		}
 		// Background/resident: the spawning call already returned, so there is no
 		// tool_result to attach to. The emitter holds its completion report until
-		// we answer `onReview`, so the verdict travels with the report (a payload
-		// without the callback gets the older standalone notice instead). Answer
+		// we answer `onReview`, so the verdict travels with the report. Answer
 		// synchronously when no review will run, so the report is never delayed
 		// for nothing. A review that throws fails closed: the report goes out
 		// flagged, not clean.
-		const respond =
-			payload.onReview ??
-			((flag: string | undefined) => {
-				if (flag) notifyTask("subagent-review", flag);
-			});
+		const respond = payload.onReview;
+		if (!respond) return; // every background emitter supplies the callback (hand-back-review.ts)
 		const ctx = lastReviewCtx;
 		if (mode !== "auto" || payload.actions.length === 0 || pauseTracker.isPaused() || !ctx) {
 			respond(undefined);
@@ -1326,12 +1355,12 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 		const epoch = sessionEpoch;
 		// A review that outlives its session (a /clear mid-review) is dropped: the
 		// agents were stopped with the old session and its ctx no longer renders.
-		const respondIfCurrent = (flag: string | undefined) => {
-			if (epoch === sessionEpoch) respond(flag);
+		const respondIfCurrent = (verdict: HandBackVerdict | undefined) => {
+			if (epoch === sessionEpoch) respond(verdict);
 		};
 		reviewCompletedRun(payload.actions, ctx, label, new AbortController().signal)
-			.then((reason) => respondIfCurrent(reason ? reviewFlagged(reason) : undefined))
-			.catch((error) => respondIfCurrent(reviewFlagged(`the review itself failed (${(error as Error).message})`)));
+			.then((reason) => respondIfCurrent(reason ? { kind: "blocked", reason } : undefined))
+			.catch((error) => respondIfCurrent({ kind: "unavailable", reason: `the review itself failed (${(error as Error).message})` }));
 	});
 
 	pi.on("tool_result", async (event, ctx) => {
@@ -1533,7 +1562,7 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 		}
 	};
 
-	pi.registerCommand("auto-mode", {
+	registerLocalCommand(pi, "auto-mode", {
 		description: "Auto-mode classifier: /auto-mode [setup|defaults|config|model [provider/model-id|clear]]",
 		getArgumentCompletions: () =>
 			[
@@ -1619,7 +1648,7 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 		},
 	});
 
-	pi.registerCommand("allow", {
+	registerLocalCommand(pi, "allow", {
 		description: 'Persist an allow rule: /allow Bash(npm test:*) [global]',
 		handler: async (args, ctx) => {
 			const global = /\s+global$/.test(args.trim());