pi-better-harness 0.16.0 → 0.17.1

package/node_modules/pi-better-plan/README.md

@@ -36,7 +36,7 @@ For a DAG, assign stable ids to prerequisite steps and list those ids in depende
 
 When an explicitly invoked skill declares `workflow-role: coordinator` in its metadata, that skill's task plan takes precedence. The generic checklist stays persisted but is hidden, and `update_plan` refuses generic checklist updates until workflow ownership is released. `/plan` never opens a stale generic checklist during workflow ownership.
 
-For `rush-issues`, call `sync_workflow_plan` once with the absolute `.resolve-issues/rush/<run-id>/task-plan.json` path and its persisted `planRevision`. This binds the run to the session and shows its fleet stages and units in the widget, `/plan`, and `get_plan`; the binding survives Pi session resume, and ownership release restores the prior generic checklist. After that, record every transition with `update_plan` and a `workflow` object instead of editing `task-plan.json` or the profiling log by hand:
+For any workflow using the shared task-plan contract (including `resolve-issues` and `rush-issues`), call `sync_workflow_plan` once with the absolute `.resolve-issues/rush/<run-id>/task-plan.json` path and its persisted `planRevision`. This binds the run to the session and shows its fleet stages and units in the widget, `/plan`, and `get_plan`; the binding survives Pi session resume, and ownership release restores the prior generic checklist. After that, record every transition with `update_plan` and a `workflow` object instead of editing `task-plan.json` or the profiling log by hand:
 
 ```json
 { "workflow": {
@@ -50,7 +50,9 @@ For `rush-issues`, call `sync_workflow_plan` once with the absolute `.resolve-is
 } }
 ```
 
-`changes` addresses units, components, and fleet stages by id (a change without an id sets run-level fields); all changes in one call are one transition. For a scope change, a change with `target` `unit` or `component` and an `add` row appends a new row; existing rows cannot be removed or renamed. The tool checks ids, dependencies (including cycles), worker slots, and status/stage values against the Rush contract (a fleet status of `n/a` is saved as `not-applicable`), refuses a stale `revision`, appends an optional `decision`, then saves the plan atomically with `planRevision + 1` and a new `updatedAt`, and appends one profiling event with the same revision to the log the run already uses (`profiling/run.jsonl` or `profiling.jsonl`). A rejected update changes nothing. The event is appended before the plan is renamed into place, so a crash between the two can leave the log one revision ahead; the next update notices, reuses that revision, and marks its event with `logAheadRevision`. Other workflow-owned skills retain their own planning and have no generic plan view.
+`changes` addresses units, components, and fleet stages by id (a change without an id sets run-level fields); all changes in one call are one transition. For a scope change, a change with `target` `unit` or `component` and an `add` row appends a new row; existing rows cannot be removed or renamed. The tool checks ids, dependencies (including cycles), worker slots, and status/stage values against the shared issue-resolution contract (a fleet status of `n/a` is saved as `not-applicable`), refuses a stale `revision`, appends an optional `decision`, then saves the plan atomically with `planRevision + 1` and a new `updatedAt`, and appends one profiling event with the same revision to the log the run already uses (`profiling/run.jsonl` or `profiling.jsonl`). A rejected update changes nothing. The event is appended before the plan is renamed into place, so a crash between the two can leave the log one revision ahead; the next update notices, reuses that revision, and marks its event with `logAheadRevision`.
+
+The binding records the active workflow's name, which is shown in the plan view. A different workflow cannot read or update that binding; a new invocation or ownership release invalidates it. The skill name is not an allowlist: explicit binding opts a workflow into the shared schema and transition rules, while path confinement to `.resolve-issues/rush/<run-id>/task-plan.json`, run identity, size limits, and revision checks still apply. Workflows using other schemas or storage locations retain their own planning and must not bind incompatible state.
 
 ## Plan Display
 

package/node_modules/pi-better-plan/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-better-plan",
-  "version": "0.5.2",
+  "version": "0.5.3",
   "description": "Structured execution plans with persistent progress for Pi.",
   "license": "MIT",
   "type": "module",

package/node_modules/pi-better-plan/src/index.ts

@@ -134,7 +134,7 @@ export default function planExtension(pi: ExtensionAPI): void {
   const refresh = (force = false): void => refreshWidget?.(force);
 
   const loadRushPlan = (ctx: ExtensionContext): RushPlan | null => {
-    if (!rushBinding || workflowPlanOwner(ctx) !== "rush-issues") return null;
+    if (!rushBinding || workflowPlanOwner(ctx) !== rushBinding.owner) return null;
     try {
       const plan = readRushPlan(rushBinding.path, ctx.cwd);
       if (plan.runId !== rushBinding.runId) throw new Error("Rush run identity changed.");
@@ -181,7 +181,8 @@ export default function planExtension(pi: ExtensionAPI): void {
     const state = reconstructPlanState(ctx.sessionManager.getBranch());
     currentPlan = state.plan;
     displayedWorkflowOwner = workflowPlanOwner(ctx);
-    rushBinding = displayedWorkflowOwner === "rush-issues" ? workflowBinding(ctx.sessionManager.getBranch()) : null;
+    const binding = workflowBinding(ctx.sessionManager.getBranch());
+    rushBinding = binding?.owner === displayedWorkflowOwner ? binding : null;
     rushPlan = null;
     rushError = null;
     if (rushBinding) loadRushPlan(ctx);
@@ -213,13 +214,13 @@ export default function planExtension(pi: ExtensionAPI): void {
         refreshWidget = localRefresh;
         return {
           render(width: number): string[] {
-            if (displayMode === "hidden") return [];
+            if (displayMode === "hidden" || displayedWorkflowOwner !== workflowPlanOwner(ctx)) return [];
             if (displayedWorkflowOwner) {
-              if (displayedWorkflowOwner !== "rush-issues") return [];
+              if (rushBinding?.owner !== displayedWorkflowOwner) return [];
               const fg = typeof theme?.fg === "function"
                 ? (color: string, value: string) => theme.fg(color as never, value)
                 : undefined;
-              return rushPlan ? ["", ...renderRushPlan(rushPlan, width, false, fg)] : [];
+              return rushPlan ? ["", ...renderRushPlan(rushPlan, width, false, fg, displayedWorkflowOwner)] : [];
             }
             if (!currentPlan) return [];
             return ["", ...renderCompactPlan(currentPlan, width, theme as never)];
@@ -237,20 +238,20 @@ export default function planExtension(pi: ExtensionAPI): void {
   const showFullPlan = async (ctx: ExtensionContext): Promise<void> => {
     const owner = workflowPlanOwner(ctx);
     if (owner) {
-      const plan = owner === "rush-issues" ? loadRushPlan(ctx) : null;
+      const plan = loadRushPlan(ctx);
       if (!plan) {
-        ctx.ui.notify(owner === "rush-issues" ? `Rush plan unavailable: ${rushError ?? "not bound"}` : `${owner} owns the task plan.`, "warning");
+        ctx.ui.notify(`${owner} plan unavailable: ${rushError ?? "not bound"}`, "warning");
         return;
       }
       if (ctx.mode !== "tui") {
-        ctx.ui.notify(renderRushPlan(plan, 160, true).join("\n"), "info");
+        ctx.ui.notify(renderRushPlan(plan, 160, true, undefined, owner).join("\n"), "info");
         return;
       }
       await ctx.ui.custom<void>((tui, theme, _keys, done) => {
         const fg = typeof theme?.fg === "function"
           ? (color: string, value: string) => theme.fg(color as never, value)
           : undefined;
-        const component = createRushPlanComponent(plan, () => done(), fg);
+        const component = createRushPlanComponent(plan, () => done(), fg, owner);
         return { render: (width) => component.render(width), handleInput(data) {
           component.handleInput?.(data);
           tui.requestRender();
@@ -284,13 +285,14 @@ export default function planExtension(pi: ExtensionAPI): void {
   pi.registerTool({
     name: "sync_workflow_plan",
     label: "Sync Workflow Plan",
-    description: "Bind and display the persisted rush-issues task plan at its exact checkpoint revision. Record later transitions with update_plan's workflow field.",
+    description: "Bind and display an active workflow's compatible persisted task plan at its exact checkpoint revision. Record later transitions with update_plan's workflow field.",
     parameters: Type.Object({
       path: Type.String({ description: "Absolute path to .resolve-issues/rush/<run-id>/task-plan.json" }),
       revision: Type.Integer({ minimum: 0, description: "Persisted planRevision to display" }),
     }),
     async execute(_id, params, _signal, _onUpdate, ctx) {
-      if (workflowPlanOwner(ctx) !== "rush-issues") throw new Error("Only an active rush-issues workflow can sync its plan.");
+      const owner = workflowPlanOwner(ctx);
+      if (!owner) throw new Error("Only an active workflow can sync its plan.");
       const plan = readRushPlan(params.path, ctx.cwd);
       if (plan.planRevision !== params.revision) {
         rushPlan = null;
@@ -298,22 +300,23 @@ export default function planExtension(pi: ExtensionAPI): void {
         refresh(true);
         throw new Error(`Rush plan ${rushError}.`);
       }
-      const binding: WorkflowPlanBinding = { owner: "rush-issues", path: params.path, runId: plan.runId };
-      if (!rushBinding || rushBinding.path !== binding.path || rushBinding.runId !== binding.runId) {
+      const binding: WorkflowPlanBinding = { owner, path: params.path, runId: plan.runId };
+      if (!rushBinding || rushBinding.owner !== owner || rushBinding.path !== binding.path || rushBinding.runId !== binding.runId) {
         pi.appendEntry(WORKFLOW_PLAN_ENTRY, { version: 1, kind: "set", ...binding });
       }
+      displayedWorkflowOwner = owner;
       rushBinding = binding;
       rushPlan = plan;
       rushError = null;
       refresh(true);
-      return { content: [{ type: "text", text: `Showing rush-issues rev ${plan.planRevision}: ${plan.issues.length} units.` }], details: { runId: plan.runId, revision: plan.planRevision } };
+      return { content: [{ type: "text", text: `Showing ${owner} rev ${plan.planRevision}: ${plan.issues.length} units.` }], details: { runId: plan.runId, revision: plan.planRevision } };
     },
   });
 
   pi.registerTool({
     name: "update_plan",
     label: "Update Plan",
-    description: "Create or atomically replace the current structured execution plan and its step statuses. While rush-issues owns a bound plan, send workflow instead of plan to save one task-plan transition.",
+    description: "Create or atomically replace the current structured execution plan and its step statuses. While a workflow owns a bound plan, send workflow instead of plan to save one task-plan transition.",
     promptSnippet: "Create and update a persistent structured execution plan",
     promptGuidelines: [
       "Use update_plan for work with three or more meaningful steps unless a skill owns planning; update it immediately when a step completes, becomes blocked, or scope changes.",
@@ -322,7 +325,7 @@ export default function planExtension(pi: ExtensionAPI): void {
       "For generic plans, follow the active delegation mode. Manual forbids proactive delegation even in plan mode; adaptive favors substantial independent work; coordinator delegates nontrivial role-owned tasks after agents_catalog discovery.",
       "Use a generic plan as a milestone ledger only when no workflow owns planning. Otherwise follow the workflow's task plan and foreground role.",
       "For generic plans, use separate steps for distinct deliverables, not one step per worker process. Before completing verification or the plan, inspect and integrate every relevant delegated result or failure.",
-      "While rush-issues owns the plan and it is bound with sync_workflow_plan, record every transition with update_plan's workflow field instead of editing task-plan.json or its profiling log; it saves the rows, the next planRevision, and the matching profiling event together.",
+      "While a workflow owns the plan and it is bound with sync_workflow_plan, record every transition with update_plan's workflow field instead of editing task-plan.json or its profiling log; it saves the rows, the next planRevision, and the matching profiling event together.",
     ],
     parameters: UpdatePlanSchema,
     async execute(_toolCallId, params, _signal, _onUpdate, ctx) {
@@ -330,9 +333,8 @@ export default function planExtension(pi: ExtensionAPI): void {
       const input = params as { explanation?: string; plan?: PlanStepInput[]; workflow?: RushPlanUpdate };
       if (input.workflow !== undefined) {
         if (!owner) throw new Error("No workflow owns the task plan; send plan instead of workflow.");
-        if (owner !== "rush-issues") throw new Error(`${owner} owns the task plan and does not accept update_plan workflow changes.`);
         if (input.plan !== undefined) throw new Error("Send either plan or workflow, not both.");
-        if (!rushBinding) throw new Error("No rush-issues plan is bound; call sync_workflow_plan with the task-plan.json path first.");
+        if (!rushBinding || rushBinding.owner !== owner) throw new Error(`No ${owner} plan is bound; call sync_workflow_plan with the task-plan.json path first.`);
         const result = applyRushPlanUpdate(rushBinding.path, ctx.cwd, rushBinding.runId, input.workflow);
         rushPlan = result.plan;
         rushError = null;
@@ -342,7 +344,7 @@ export default function planExtension(pi: ExtensionAPI): void {
         const logNote = result.logAheadRevision === undefined ? ""
           : ` The profiling log already held rev ${result.logAheadRevision} (an earlier write stopped after logging); this event supersedes it.`;
         return {
-          content: [{ type: "text", text: `Saved rush-issues rev ${result.revision} (${input.workflow.event.trim()})${rows.length ? `: ${rows.join(", ")}` : ""}${input.workflow.decision ? `${rows.length ? ";" : ":"} decision ${input.workflow.decision.id}` : ""}. Profiling: ${result.profilingPath}.${logNote}` }],
+          content: [{ type: "text", text: `Saved ${owner} rev ${result.revision} (${input.workflow.event.trim()})${rows.length ? `: ${rows.join(", ")}` : ""}${input.workflow.decision ? `${rows.length ? ";" : ":"} decision ${input.workflow.decision.id}` : ""}. Profiling: ${result.profilingPath}.${logNote}` }],
           details: {
             ok: true, runId: result.plan.runId, revision: result.revision, changed: result.changed, profilingPath: result.profilingPath,
             ...(result.logAheadRevision === undefined ? {} : { logAheadRevision: result.logAheadRevision }),
@@ -350,9 +352,7 @@ export default function planExtension(pi: ExtensionAPI): void {
         };
       }
       if (owner) {
-        throw new Error(owner === "rush-issues"
-          ? "rush-issues owns the task plan. Send workflow (bound with sync_workflow_plan) instead of plan."
-          : `${owner} owns the task plan. Update its workflow plan instead of update_plan.`);
+        throw new Error(`${owner} owns the task plan. Send workflow (bound with sync_workflow_plan) instead of plan.`);
       }
       if (input.plan === undefined) throw new Error("plan is required: send the full list of steps.");
       const plan = replacePlan(currentPlan, input.plan, input.explanation);
@@ -387,10 +387,10 @@ export default function planExtension(pi: ExtensionAPI): void {
     async execute(_toolCallId, _params, _signal, _onUpdate, ctx) {
       const owner = workflowPlanOwner(ctx);
       if (owner) {
-        const workflowPlan = owner === "rush-issues" ? loadRushPlan(ctx) : null;
+        const workflowPlan = loadRushPlan(ctx);
         return {
           content: [{ type: "text", text: workflowPlan
-            ? renderRushPlan(workflowPlan, 160, true).join("\n")
+            ? renderRushPlan(workflowPlan, 160, true, undefined, owner).join("\n")
             : `${owner} owns the task plan; ${rushError ?? "consult its persisted workflow state"}.` }],
           details: { hasPlan: !!workflowPlan, plan: workflowPlan, progress: null, workflowOwner: owner },
         };

package/node_modules/pi-better-plan/src/workflow-plan.ts

@@ -28,7 +28,7 @@ export interface RushPlan {
 }
 
 export interface WorkflowPlanBinding {
-  owner: "rush-issues";
+  owner: string;
   path: string;
   runId: string;
 }
@@ -113,9 +113,9 @@ export function workflowBinding(entries: Iterable<{ type: string; customType?: s
     const data = entry.data;
     if (!isRecord(data) || data.version !== 1) continue;
     if (data.kind === "clear") binding = null;
-    else if (data.kind === "set" && data.owner === "rush-issues" &&
+    else if (data.kind === "set" && typeof data.owner === "string" && data.owner.length > 0 &&
              typeof data.path === "string" && typeof data.runId === "string") {
-      binding = { owner: "rush-issues", path: data.path, runId: data.runId };
+      binding = { owner: data.owner, path: data.path, runId: data.runId };
     }
   }
   return binding;
@@ -133,7 +133,7 @@ function workflowStatus(status: string): DisplayStatus {
   }
 }
 
-function presentRushPlan(plan: RushPlan): PlanPresentation {
+function presentRushPlan(plan: RushPlan, owner: string): PlanPresentation {
   // The warehouse canary only applies to data work; hide it otherwise.
   const stages = ["explore", "implement", "review", "ci", ...(plan.warehouseCanaryRequired ? ["canary"] : [])];
   const fleet = stages.map((stage) => {
@@ -142,7 +142,7 @@ function presentRushPlan(plan: RushPlan): PlanPresentation {
     const style = statusStyle(display);
     return { color: style.color, text: `  ${stage} ${style.glyph}${display === "unknown" ? ` ${planText(status)}` : ""}` };
   });
-  const metadata = [[{ color: "dim", text: `rush-issues · rev ${plan.planRevision}  ·` }, ...fleet]];
+  const metadata = [[{ color: "dim", text: `${planText(owner)} · rev ${plan.planRevision}  ·` }, ...fleet]];
   if (plan.spec?.title) metadata.push([{ color: "dim", text: plan.spec.title }]);
   return {
     metadata,
@@ -164,16 +164,18 @@ export function renderRushPlan(
   width: number,
   full = false,
   fg?: (color: string, value: string) => string,
+  owner = "rush-issues",
 ): string[] {
   const theme = fg ? { fg } : plainPlanTheme;
-  return renderPlanPresentation(presentRushPlan(plan), width, theme, full);
+  return renderPlanPresentation(presentRushPlan(plan, owner), width, theme, full);
 }
 
 export function createRushPlanComponent(
   plan: RushPlan,
   onClose: () => void,
   fg?: (color: string, value: string) => string,
+  owner = "rush-issues",
 ): Component {
   const theme = fg ? { fg } : plainPlanTheme;
-  return createPlanPresentationComponent(presentRushPlan(plan), theme, onClose);
+  return createPlanPresentationComponent(presentRushPlan(plan, owner), theme, onClose);
 }

package/node_modules/pi-better-sandbox/README.md

@@ -11,7 +11,8 @@ pi install npm:pi-better-sandbox
 Either way you keep starting Pi the way you always have — `pi`. There is
 no launcher or wrapper command. Main starts inactive; Subagents start confined.
 Open `/sandbox` to change either column, or use `/sandbox on` for the current
-Main session. **Save as defaults** persists both profiles.
+Main session. Edits apply immediately and are saved to the current session branch.
+**Ctrl+S** saves both profiles as defaults for new sessions.
 
 ```text
 Sandbox permissions               Main             Subagents
@@ -31,8 +32,7 @@ Network access                    -                On
     > [x] @juicesharp/rpiv-web-tools  2/2
     > [ ] <other installed package>  0/1
 
-↑↓ Select row   ←→ Select column / expand / collapse   Enter Fold   Space Change
-Save as defaults
+↑↓ Select · ←→ Column/fold · Space Toggle · ctrl+s Save default · Enter Fold · Esc Back
 ```
 
 **Subagents · Tools** picks the extension tools a confined subagent may use:
@@ -56,7 +56,7 @@ are; the count is selected/total. Right expands a group. Left collapses a group,
 or moves from a child to its parent and collapses it. Enter folds the selected
 group. Space on a group selects all children when none or only some are selected,
 or deselects them all when all are selected. Every toggle applies on one Space;
-saving looser defaults still needs a second Enter. Only individual tool
+Ctrl+S saves defaults and reports anything loosened. Only individual tool
 entries are saved, never a package/provider wildcard or the open/closed state.
 
 Defaults: `apply_patch`, `web_fetch`, and `web_search` on; everything else off.
@@ -123,7 +123,7 @@ Write, those paths are also protected from removal and renaming.
 Space applies every change immediately, including higher permission levels,
 capabilities switched on, and a sandbox switched off. `ctrl+s` saves the
 defaults from any row on the first press, and the note names anything that
-loosened. Enter on the Save row still saves. The focused
+loosened. Enter only folds tool groups; it never saves defaults. The focused
 row has a full-width background and bold text; the selected Main/Subagents cell
 also uses inverse styling. No model
 tool can change these settings. Other rows toggle Off/On. Detail cells under an
@@ -319,7 +319,7 @@ in your rule set but is held out in that project, with a message saying so.
 Nothing is migrated on disk. A saved `pi-better-sandbox-permissions.json` keeps
 its values: a saved `read-write` is now shown as Write & delete, and a saved
 Subagents Outside project = Read stays Read. Only a fresh configuration, or
-**Save as defaults** after you choose Write, uses the new Subagents default. To
+**Ctrl+S** after you choose Write, uses the new Subagents default. To
 adopt it, open `/sandbox`, set Subagents → Outside project to Write, and save.
 
 `~/.pi/agent/sandbox.json` (`filesystem.allowWrite`, `allowRead`,
@@ -328,12 +328,19 @@ package never reads it, and it has no effect on the harness.
 
 ## Lifecycle
 
-The foreground sandbox is inactive by default. Session overrides do not survive
-startup, new session, resume, fork, or reload. Save as defaults writes both
+The foreground sandbox is inactive by default. Permission edits, including
+Sandbox switches and `/sandbox on|off`, auto-persist as Pi custom entries on the
+current session branch, not as global defaults. Resume, fork, reload and session
+tree navigation restore the latest policy on the active branch. A branch with
+no permission entry and a new session inherit saved global settings. Invalid
+persisted session policy fails closed rather than falling back to defaults.
+Ctrl+S writes both
 profiles to `~/.pi/agent/extensions/pi-better-sandbox-permissions.json` (or the
 corresponding `$PI_CODING_AGENT_DIR`). Existing activation preferences in
 `pi-better-sandbox-preferences.json` migrate when no profile file exists.
 `/sandbox default on|off` remains available and updates Main's saved switch.
+Failed default saves leave the current session's edits intact. Write-deny rules
+retain their separate global persistence through `/sandbox deny` and `/sandbox rules`.
 
 Toggles apply to operations launched after the change. A command already running
 keeps the policy it launched with.

package/node_modules/pi-better-sandbox/commands.ts

@@ -55,8 +55,8 @@ const DISABLE_TITLE = "Disable the foreground write sandbox?";
 
 const DISABLE_MESSAGE = [
     "The built-in bash, write, and edit tools and user-entered ! / !! commands",
-    "will run with normal host write access for the rest of this session. The",
-    "next session applies your persisted foreground sandbox default.",
+    "will run with normal host write access on this session branch, including",
+    "after resume or reload. New sessions apply your saved sandbox default.",
 ].join("\n");
 
 const NO_UI_REJECTION =
@@ -80,6 +80,8 @@ export type SandboxCommandDeps = {
     onStateChange: (status: ForegroundSandboxStatus) => void;
     /** Persist a default and apply it to the current session. */
     setDefault: (enabled: boolean) => ForegroundSandboxStatus;
+    /** Persist the session change before mutating enforcement. */
+    setSessionEnabled?: (enabled: boolean) => ForegroundSandboxStatus;
     openPermissions?: (ctx: ExtensionCommandContext) => Promise<void>;
 };
 
@@ -89,6 +91,7 @@ export function createSandboxCommandHandler({
     denyRules,
     onStateChange,
     setDefault,
+    setSessionEnabled,
     openPermissions,
 }: SandboxCommandDeps) {
     return async function handleSandboxCommand(
@@ -112,7 +115,12 @@ export function createSandboxCommandHandler({
         }
 
         if (subcommand === "on") {
-            const status = controller.enable();
+            let status: ForegroundSandboxStatus;
+            try { status = setSessionEnabled ? setSessionEnabled(true) : controller.enable(); }
+            catch (error) {
+                ctx.ui.notify(`Sandbox state unchanged: ${error instanceof Error ? error.message : String(error)}`, "error");
+                return;
+            }
             onStateChange(status);
             ctx.ui.notify(
                 status.state === "enabled"
@@ -140,7 +148,12 @@ export function createSandboxCommandHandler({
                 ctx.ui.notify("Foreground sandbox left on.", "info");
                 return;
             }
-            const status = controller.disable();
+            let status: ForegroundSandboxStatus;
+            try { status = setSessionEnabled ? setSessionEnabled(false) : controller.disable(); }
+            catch (error) {
+                ctx.ui.notify(`Sandbox state unchanged: ${error instanceof Error ? error.message : String(error)}`, "error");
+                return;
+            }
             onStateChange(status);
             ctx.ui.notify(
                 "Foreground sandbox OFF for this session. Shell commands can now write anywhere.",

package/node_modules/pi-better-sandbox/index.ts

@@ -38,6 +38,7 @@ import { writeSandboxDefault } from "./preferences.ts";
 import { readPermissionSettings, writePermissionSettings } from "./permission-settings.ts";
 import { defaultSandboxPermissions, describeLoosening, type SandboxPermissionSettings } from "./permissions.ts";
 import { openPermissionsPage } from "./permissions-page.ts";
+import { appendSessionPermissions, readSessionPermissions } from "./session-permissions.ts";
 
 import { footerTone, formatFooterStatus } from "./status.ts";
 import { ForegroundSandboxController, type ForegroundSandboxStatus } from "./state.ts";
@@ -98,9 +99,7 @@ export default function piBetterSandbox(pi: ExtensionAPI): void {
     // `/sandbox deny ...` and the `/sandbox rules` page.
     const denyRules = new DenyRuleManager({ controller, onStateChange: announce });
 
-    pi.on("session_start", (_event, ctx: ExtensionContext) => {
-        shellPath = resolveShellPath(ctx.cwd);
-        boundary.register(ctx.cwd);
+    const restorePermissions = (ctx: ExtensionContext): void => {
         paintFooter = (status) => {
             ctx.ui.setStatus(
                 FOOTER_KEY,
@@ -108,11 +107,14 @@ export default function piBetterSandbox(pi: ExtensionAPI): void {
             );
         };
 
-        // Re-read saved profiles on each session. Malformed policy blocks protected
-        // operations rather than silently widening a restricted session.
+        // Session policy takes precedence over global defaults. Never skip an
+        // invalid latest entry to recover an older, potentially broader policy.
         let settings = defaultSandboxPermissions();
+        let hasSessionPolicy = false;
         try {
-            settings = readPermissionSettings();
+            const sessionPermissions = readSessionPermissions(ctx);
+            hasSessionPolicy = sessionPermissions !== undefined;
+            settings = sessionPermissions ?? readPermissionSettings();
         } catch (error) {
             controller.beginSession(ctx.cwd, true);
             const message = `Sandbox permissions could not be loaded: ${error instanceof Error ? error.message : String(error)}`;
@@ -130,7 +132,7 @@ export default function piBetterSandbox(pi: ExtensionAPI): void {
             .map((tool) => tool.sourceInfo?.path).filter((path): path is string => typeof path === "string" && isAbsolute(path))
             .map(runtimeCodeRoot));
         controller.setPermissionSettings(settings);
-        controller.applyDefault(settings.main.enabled);
+        if (!hasSessionPolicy) controller.applyDefault(settings.main.enabled);
 
         // Then the rules are re-read and re-resolved, because the same global
         // template set means different absolute paths in a different project.
@@ -154,7 +156,14 @@ export default function piBetterSandbox(pi: ExtensionAPI): void {
                 status.state === "disabled" ? "info" : "warning",
             );
         }
+    };
+
+    pi.on("session_start", (_event, ctx) => {
+        shellPath = resolveShellPath(ctx.cwd);
+        boundary.register(ctx.cwd);
+        restorePermissions(ctx);
     });
+    pi.on("session_tree", (_event, ctx) => restorePermissions(ctx));
 
     pi.on("session_shutdown", () => {
         controller.dispose();
@@ -167,11 +176,18 @@ export default function piBetterSandbox(pi: ExtensionAPI): void {
             controller,
             denyRules,
             onStateChange: announce,
+            setSessionEnabled: (enabled) => {
+                const settings = controller.permissionSettings() ?? defaultSandboxPermissions();
+                settings.main.enabled = enabled;
+                appendSessionPermissions(pi, settings);
+                return enabled ? controller.enable() : controller.disable();
+            },
             setDefault: (enabled) => {
                 const settings = controller.permissionSettings() ?? defaultSandboxPermissions();
                 settings.main.enabled = enabled;
                 writePermissionSettings(settings);
                 writeSandboxDefault(enabled ? "on" : "off");
+                appendSessionPermissions(pi, settings);
                 return controller.setPermissionSettings(settings);
             },
             openPermissions: async (ctx) => {
@@ -179,9 +195,12 @@ export default function piBetterSandbox(pi: ExtensionAPI): void {
                     getConfig: () => controller.permissionSettings() ?? defaultSandboxPermissions(),
                     // Trusted-tool candidates: what this Pi has actually registered, by owning package.
                     discoverTools: () => discoverTrustedTools(pi.getAllTools?.() ?? []),
-                    change: (settings) => announce(controller.setPermissionSettings(settings)),
+                    change: (settings) => {
+                        appendSessionPermissions(pi, settings);
+                        announce(controller.setPermissionSettings(settings));
+                    },
                     save: (settings) => writePermissionSettings(settings),
-                    // Persisting a looser default needs a second, explicit Enter.
+                    // Report every capability loosened by saving these defaults.
                     loosening: (settings) => {
                         let previous: SandboxPermissionSettings;
                         try { previous = readPermissionSettings(); } catch { previous = defaultSandboxPermissions(); }

package/node_modules/pi-better-sandbox/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-better-sandbox",
-  "version": "0.8.2",
+  "version": "0.9.0",
   "description": "Pi extension with independent Main and Subagents permission profiles, file guards, and OS sandbox enforcement.",
   "license": "MIT",
   "type": "module",

package/node_modules/pi-better-sandbox/permissions-page.ts

@@ -124,7 +124,7 @@ export function createPermissionsPage(
     const itemKey = (item: ToolItem) => item.kind === "group" ? item.id
         : item.kind === "guarded" ? "apply_patch" : JSON.stringify([item.name, item.package]);
     let items = toolItems();
-    const saveRow = () => rows.length + items.length;
+    const lastRow = () => rows.length + items.length - 1;
     let row = 0;
     let column = 0;
     let busy = false;
@@ -136,7 +136,7 @@ export function createPermissionsPage(
     }
 
     async function change(): Promise<void> {
-        if (!settings || busy || row === saveRow()) return;
+        if (!settings || busy) return;
         const next = snapshot(settings);
         if (row >= rows.length) {
             const item = items[row - rows.length]!;
@@ -173,15 +173,14 @@ export function createPermissionsPage(
         busy = true;
         try {
             await handlers.change(snapshot(next));
-            const selected = row >= rows.length && row < saveRow() ? items[row - rows.length] : undefined;
-            const wasSave = row === saveRow();
+            const selected = row >= rows.length ? items[row - rows.length] : undefined;
             const successors = selected ? items.slice(row - rows.length + 1).map(itemKey) : [];
             settings = next;
             items = toolItems();
             const index = selected ? items.findIndex((item) => itemKey(item) === itemKey(selected)) : -1;
             const successor = successors.map((key) => items.findIndex((item) => itemKey(item) === key)).find((at) => at >= 0);
-            row = wasSave ? saveRow() : index >= 0 ? rows.length + index
-                : successor !== undefined ? rows.length + successor : Math.min(row, saveRow());
+            row = index >= 0 ? rows.length + index
+                : successor !== undefined ? rows.length + successor : Math.min(row, lastRow());
             message = "";
             isError = false;
             requestRender();
@@ -215,7 +214,7 @@ export function createPermissionsPage(
     }
 
     function fold(open?: boolean): void {
-        const item = row >= rows.length && row < saveRow() ? items[row - rows.length] : undefined;
+        const item = row >= rows.length ? items[row - rows.length] : undefined;
         const id = item?.kind === "group" ? item.id : item?.kind === "trusted" && open === false ? item.group : undefined;
         if (!id) return;
         if (open ?? !expanded.has(id)) expanded.add(id);
@@ -234,22 +233,20 @@ export function createPermissionsPage(
                 row = Math.max(0, row - 1);
                 requestRender();
             } else if (matchesKey(data, Key.down)) {
-                row = Math.min(saveRow(), row + 1);
+                row = Math.min(lastRow(), row + 1);
                 requestRender();
             } else if (matchesKey(data, Key.left)) {
-                if (row >= rows.length && row < saveRow()) fold(false);
+                if (row >= rows.length) fold(false);
                 else column = 0;
                 requestRender();
             } else if (matchesKey(data, Key.right)) {
-                if (row >= rows.length && row < saveRow()) fold(true);
+                if (row >= rows.length) fold(true);
                 else column = 1;
                 requestRender();
             } else if (matchesKey(data, Key.space)) {
                 void change();
             } else if (matchesKey(data, "ctrl+s")) {
                 void save();
-            } else if (matchesKey(data, Key.enter) && row === saveRow()) {
-                void save();
             } else if (matchesKey(data, Key.enter)) {
                 fold();
             }
@@ -315,13 +312,13 @@ export function createPermissionsPage(
                 output.push(theme.fg("dim", truncateToWidth(`${prefix ? "  " : ""}  Trusted (runs outside the file rules)`, w, "")),
                     theme.fg("dim", truncateToWidth(`${prefix ? "  " : ""}    No other extension tools are installed.`, w, "")));
             }
-            output.push("", line("Save as defaults", "", "", row === saveRow()));
+            output.push("");
             const selected = row < rows.length ? rows[row]!.key : undefined;
-            const tool = row >= rows.length && row < saveRow() ? items[row - rows.length] : undefined;
+            const tool = row >= rows.length ? items[row - rows.length] : undefined;
             const contextual = tool ? (tool.kind === "guarded" ? GUARDED_HINT : TRUSTED_HINT)
                 : selected && settings ? cellHint(selected, settings[columns[column]!]) : undefined;
             for (const hint of [
-                "↑↓ Select · ←→ Column/fold · Space Toggle · ctrl+s Save · Enter Fold · Esc Back",
+                "↑↓ Select · ←→ Column/fold · Space Toggle · ctrl+s Save default · Enter Fold · Esc Back",
                 "Changes apply to new launches. Background tasks follow their launcher.",
                 "Stored credentials: known files only; excludes OS vaults and environment tokens.",
                 "Trusted tools run outside the file rules.",

package/node_modules/pi-better-sandbox/session-permissions.ts

@@ -0,0 +1,24 @@
+import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { parseSandboxPermissions, type SandboxPermissionSettings } from "./permissions.ts";
+
+export const SESSION_PERMISSION_ENTRY = "pi-better-sandbox-permissions";
+
+/** Only the active branch contributes policy; the newest entry must validate. */
+export function readSessionPermissions(ctx: ExtensionContext): SandboxPermissionSettings | undefined {
+    const entry = [...ctx.sessionManager.getBranch()].reverse().find((entry) =>
+        entry.type === "custom" && entry.customType === SESSION_PERMISSION_ENTRY);
+    if (!entry || entry.type !== "custom") return undefined;
+    const data = entry.data as { version?: unknown; permissions?: unknown } | undefined;
+    if (!data || data.version !== 1) throw new Error("Unsupported sandbox session permissions version.");
+    // Session snapshots have always included Tools. Unlike old global files,
+    // an incomplete snapshot must not gain the default trusted-tool grants.
+    if (!data.permissions || typeof data.permissions !== "object" ||
+        (data.permissions as { subagentTools?: unknown }).subagentTools === undefined) {
+        throw new Error("Sandbox session permissions require explicit subagent tool settings.");
+    }
+    return parseSandboxPermissions(data.permissions);
+}
+
+export function appendSessionPermissions(pi: ExtensionAPI, settings: SandboxPermissionSettings): void {
+    pi.appendEntry(SESSION_PERMISSION_ENTRY, { version: 1, permissions: parseSandboxPermissions(settings) });
+}

package/node_modules/pi-better-sandbox/state.ts

@@ -6,9 +6,8 @@
  * the *effective* status derived from live runtime evidence (which backend this
  * platform actually resolves, not what the package intended).
  *
- * Session overrides are deliberately in-memory only. Every session start —
- * startup, new, resume, fork, reload — calls `beginSession` with the persisted
- * default and clears the previous override.
+ * The extension persists permission snapshots in Pi custom entries and restores
+ * the active branch after `beginSession` resets this in-memory controller.
  */
 
 import { getAgentDir, getPackageDir } from "@earendil-works/pi-coding-agent";
@@ -132,7 +131,7 @@ export class ForegroundSandboxController {
 
     /**
      * Capture the canonical launch directory and apply the persisted default.
-     * A session override never survives a new, resumed, forked, or reloaded session.
+     * The extension then restores any permissions on the active session branch.
      */
     beginSession(cwd: string, defaultEnabled = false): ForegroundSandboxStatus {
         const projectRoot = canonicalizePath(cwd, this.#seams);
@@ -156,7 +155,7 @@ export class ForegroundSandboxController {
         return this.status();
     }
 
-    /** Turn protection off for this session only. Never persisted. */
+    /** Turn protection off for this session; persistence belongs to the extension. */
     disable(): ForegroundSandboxStatus {
         this.#sessionOverride = false;
         this.#policyProblem = undefined;