opencode-agent-skill 15.1.0 → 15.1.2

package/pi/extensions/ues-child-runtime.ts

@@ -1,11 +1,16 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
 import { readFile, stat } from "node:fs/promises";
+import path from "node:path";
 import { compactReversibleOutput } from "../../lib/performance-fabric.mjs";
 import { getEvidenceSelected } from "../../lib/evidence-store.mjs";
 import { recordVerification } from "../../lib/verification-broker.mjs";
 import { runtimeWorkspaceFingerprint } from "../../lib/workspace-fingerprint.mjs";
 import { destructiveShellRisk } from "../../lib/safety.mjs";
+import { getUesConfigDir } from "../../lib/runtime-config.mjs";
+import { PermissionPolicyStore, permissionRecoveryHint, toolPermissionRequest } from "../../lib/permission-policy.mjs";
+import { analyzeUntrustedOutput, renderUntrustedOutputWarning } from "../../lib/untrusted-output.mjs";
+import { mcpExecutionPolicy } from "../../lib/mcp-tool-policy.mjs";
 import { crossToolTempPathRisk, isLocalEnvPath, localEnvWriteRisk } from "../../lib/execution-contract.mjs";
 import {
   canonicalVerificationCommand,
@@ -18,6 +23,7 @@ import {
   probeCodeIntelligence,
   readAnchoredCode,
   searchCodeIntelligence,
+  shutdownLspPool,
 } from "../../lib/code-intelligence/index.mjs";
 import { ingestDocument } from "../../lib/document-ingestion.mjs";
 import { compactContext, expandContext, searchContext } from "../../lib/reversible-context.mjs";
@@ -32,6 +38,16 @@ import {
   waitForService,
 } from "../../lib/service-manager.mjs";
 
+const PERMISSION_POLICY = new PermissionPolicyStore(
+  path.join(getUesConfigDir(), ".ues", "permissions.json"),
+);
+const EXTERNAL_TOOL_NAMES = new Set(
+  String(process.env.UES_CHILD_EXTERNAL_TOOL_NAMES || "")
+    .split(",")
+    .map((value) => value.trim())
+    .filter(Boolean),
+);
+
 const toolExecutionState = new Map<string, {
   startedAt: number;
   workspaceBefore?: string;
@@ -102,12 +118,45 @@ export default function (pi: ExtensionAPI) {
   pi.on("session_start", clearExecutionState);
   pi.on("session_shutdown", async (_event, ctx) => {
     clearExecutionState();
-    await stopAllServices(ctx.cwd).catch(() => []);
+    await Promise.all([
+      stopAllServices(ctx.cwd).catch(() => []),
+      shutdownLspPool(ctx.cwd).catch(() => ({ stopped: 0, remaining: 0 })),
+    ]);
   });
 
   pi.on("tool_call", async (event, ctx) => {
     const toolName = String(event.toolName || "");
     const input: any = event.input || {};
+    const permissionRequest = toolPermissionRequest(toolName, input);
+    const configuredPermission: any = await PERMISSION_POLICY.evaluate(
+      permissionRequest,
+      { agent: String(process.env.UES_CHILD_AGENT || "ues-child") },
+    ).catch((error) => ({
+      configured: true,
+      decision: null,
+      error: error instanceof Error ? error.message : String(error),
+    }));
+    if (configuredPermission.error) {
+      toolExecutionState.delete(String(event.toolCallId || ""));
+      return {
+        block: true,
+        reason: "UES permission policy is invalid: " + configuredPermission.error,
+      };
+    }
+    if (configuredPermission?.decision?.effect === "deny") {
+      toolExecutionState.delete(String(event.toolCallId || ""));
+      return {
+        block: true,
+        reason: permissionRecoveryHint(permissionRequest, configuredPermission.decision, { effect: "deny" }),
+      };
+    }
+    if (configuredPermission?.decision?.effect === "ask") {
+      toolExecutionState.delete(String(event.toolCallId || ""));
+      return {
+        block: true,
+        reason: permissionRecoveryHint(permissionRequest, configuredPermission.decision, { effect: "ask" }),
+      };
+    }
     const localEnvAllowed = String(process.env.UES_CHILD_ALLOW_LOCAL_ENV_WRITE || "") === "1";
     const writeTool = ["edit", "write", "write_file", "apply_patch", "ues_code_edit"].includes(toolName);
     const fileTool = ["read", "edit", "write", "write_file", "apply_patch", "ues_code", "ues_code_edit"].includes(toolName);
@@ -186,11 +235,37 @@ export default function (pi: ExtensionAPI) {
 
   pi.on("tool_result", async (event, ctx) => {
     const toolName = String(event.toolName || "");
+    const shownText = visibleText(event);
+    const allTools = typeof (pi as any).getAllTools === "function" ? (pi as any).getAllTools() : [];
+    const descriptor = allTools.find((tool: any) => String(tool?.name || "") === toolName);
+    const externalPolicy = mcpExecutionPolicy(descriptor || { name: toolName });
+    const externalBoundary =
+      EXTERNAL_TOOL_NAMES.has(toolName) ||
+      externalPolicy.externalEvidenceBoundary === true;
+    if (externalBoundary && shownText) {
+      const analysis = analyzeUntrustedOutput(shownText, { source: toolName });
+      if (analysis.flagged) {
+        const originalContent = Array.isArray(event.content)
+          ? event.content
+          : [{ type: "text", text: shownText }];
+        return {
+          content: [
+            { type: "text", text: renderUntrustedOutputWarning(analysis, { source: toolName }) },
+            ...originalContent,
+          ],
+          details: {
+            ...(event.details && typeof event.details === "object" ? event.details : {}),
+            uesUntrustedOutputBoundary: analysis,
+          },
+          isError: event.isError,
+          usage: event.usage,
+        };
+      }
+    }
+
     if (!["bash", "powershell", "grep", "find", "ls"].includes(toolName)) {
       return undefined;
     }
-
-    const shownText = visibleText(event);
     const capture = await capturedText(event, shownText);
     const rawText = capture.text;
     const images = (event.content || []).filter((part: any) => part?.type !== "text");
@@ -375,9 +450,45 @@ export default function (pi: ExtensionAPI) {
           throw new Error("unsupported ues_code action");
         }
         const encoded = JSON.stringify(result, null, 2);
+        const bounded = encoded.length > 32000;
+        let contextRef: string | null = null;
+        let visible = encoded;
+        if (bounded) {
+          const preserved = await compactContext(ctx.cwd, encoded, {
+            kind: "ues-code-result",
+            source: `ues_code:${params.action}`,
+            summary: `Full child code-intelligence result for ${params.action}; preserve exact JSON before model-visible bounding`,
+          }).catch(() => null);
+          contextRef = preserved?.ref || null;
+          const metadataFirst = {
+            schemaVersion: result?.schemaVersion || 1,
+            action: params.action,
+            file: result?.file || null,
+            available: result?.available ?? null,
+            provider: result?.provider || null,
+            operation: result?.operation || null,
+            reason: result?.reason || null,
+            persistent: result?.persistent ?? null,
+            pool: result?.pool || result?.lsp?.persistentPool || null,
+            bounded: true,
+            originalChars: encoded.length,
+            contextRef,
+            preview: encoded.slice(0, 22000),
+          };
+          visible = JSON.stringify(metadataFirst, null, 2) +
+            "\n...[full result preserved; use ues_code context-expand with contextRef when more evidence is needed]";
+        }
         return {
-          content: [{ type: "text", text: encoded.length <= 32000 ? encoded : encoded.slice(0, 32000) + "\n...[bounded by ues_code]" }],
-          details: { action: params.action, bounded: encoded.length > 32000 },
+          content: [{ type: "text", text: visible }],
+          details: {
+            action: params.action,
+            bounded,
+            originalChars: encoded.length,
+            contextRef,
+            provider: result?.provider || null,
+            persistent: result?.persistent ?? null,
+            pool: result?.pool || result?.lsp?.persistentPool || null,
+          },
         };
       } catch (error) {
         return {