pi-better-harness 0.18.0 → 0.19.0

package/README.md

@@ -1,5 +1,7 @@
 # pi-better-harness
 
+<img src="https://raw.githubusercontent.com/1aboveio/pi-better-harness/main/docs/images/brand/logo.png" alt="Pi Better Harness logo" width="128" height="128" />
+
 `pi-better-harness` is a Pi meta package that installs the core Pi Better Harness extensions: an opt-in foreground write sandbox, delegated subagents, durable background tasks, synchronous SSH commands, goal tracking, and structured plans.
 
 ## Quick Answer

package/node_modules/pi-better-background-tasks/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-better-background-tasks",
-  "version": "0.6.4",
+  "version": "0.6.5",
   "description": "Pi extension for durable background shell tasks, watchers, logs, and status inspection.",
   "license": "MIT",
   "type": "module",

package/node_modules/pi-better-background-tasks/src/shared-sandbox-core.ts

@@ -60,6 +60,8 @@ export type SandboxPermissions = {
     storedCredentials: "off" | "read" | "read-write";
     commands: boolean;
     network: boolean;
+    /** Fixed process_list adapter only; omitted legacy profiles keep it Off. */
+    processAccess?: "off" | "read";
 };
 
 /** Whether a file access level allows creating and overwriting files. */

package/node_modules/pi-better-goal/README.md

@@ -13,8 +13,8 @@ Use `pi-better-goal` when a Pi session should keep an explicit objective visible
 ## Core Features
 
 - `/goal` runtime for starting, pausing, resuming, completing, and clearing the current objective.
-- `/goal settings` opens an interactive settings page in the TUI. Select a row with Up/Down and toggle with Space/Enter; changes save immediately, and Escape closes the page. Both controls default to `on`. Automatic continuation controls idle and background-drain wakes; conversational resume controls the agent's Escape-pause resume tool. Goal kickoff, `/goal resume`, and `alt+g` remain available with either control off. For scripts or non-interactive sessions, use `/goal settings auto-continue on|off` and `/goal settings conversational-resume on|off`; bare `/goal settings` prints the saved values outside the TUI.
-- `escape` pauses the active goal, and it stays paused while you talk to the agent. With conversational resume enabled, say "go" (the agent then calls `goal_resume`), or use `/goal resume` or `alt+g`. `/goal pause` resumes only through `/goal resume` or `alt+g`. The status line shows the available resume path, and paused goals are never poked. On a macOS terminal without Option-as-Meta, `alt+g` types `©`; use `/goal resume` there.
+- `/goal settings` opens an interactive settings page in the TUI. Select a row with Up/Down and toggle with Space/Enter; changes save immediately, and Escape closes the page. All three controls default to `on`. Automatic continuation controls idle and background-drain wakes; conversational resume controls the agent's Escape-pause resume tool; **Pause on Esc** controls whether editor Escape pauses the active goal. Goal kickoff, `/goal resume`, and `alt+g` remain available with these controls off. For scripts or non-interactive sessions, use `/goal settings auto-continue on|off`, `/goal settings conversational-resume on|off`, and `/goal settings pause-on-escape on|off`; bare `/goal settings` prints the saved values outside the TUI.
+- `escape` pauses the active goal by default, and it stays paused while you talk to the agent. With **Pause on Esc** off, observed editor Escape leaves the goal active while preserving native streaming interruption and menu/dialog cancellation. Automatic continuation remains independent. Hosts without terminal/focus inspection and unknown custom editors retain generic abort-to-pause behavior because they cannot identify Escape reliably. With conversational resume enabled, say "go" (the agent then calls `goal_resume`), or use `/goal resume` or `alt+g`. `/goal pause` resumes only through `/goal resume` or `alt+g`. The status line shows the available resume path, and paused goals are never poked. On a macOS terminal without Option-as-Meta, `alt+g` types `©`; use `/goal resume` there.
 - Background work that finishes while an `ask_user_question` is pending is handed to the agent right after the answer.
 - A compact goal widget that does not replace Pi's footer.
 - Background activity tracking for subagents and other registered providers.

package/node_modules/pi-better-goal/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-better-goal",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "Pi extension for goal tracking with background-aware continuation.",
   "license": "MIT",
   "type": "module",

package/node_modules/pi-better-goal/src/index.ts

@@ -1,5 +1,6 @@
-import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
+import type { CustomEditor, ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import type { AutocompleteItem } from "@earendil-works/pi-tui";
+import { isKeyRelease, matchesKey } from "@earendil-works/pi-tui";
 import { readFileSync } from "node:fs";
 import { Type } from "typebox";
 import { commandAvailable, commandInvocation, resolveGoalCommand } from "./command-binding.js";
@@ -108,10 +109,10 @@ const GOAL_ACTIONS: readonly AutocompleteItem[] = [
   { value: "resume", label: "resume", description: "Resume the paused goal" },
   { value: "clear", label: "clear", description: "Remove the current goal" },
   { value: "complete", label: "complete", description: "Mark the current goal complete" },
-  { value: "settings", label: "settings", description: "Inspect or persist goal continuation and conversational resume controls" },
+  { value: "settings", label: "settings", description: "Inspect or persist goal continuation, conversational resume, and Escape pause controls" },
 ];
 
-const GOAL_SETTINGS = ["auto-continue", "conversational-resume"] as const;
+const GOAL_SETTINGS = ["auto-continue", "conversational-resume", "pause-on-escape"] as const;
 
 export function goalArgumentCompletions(argumentPrefix: string): AutocompleteItem[] | null {
   const prefix = argumentPrefix.trimStart().toLowerCase();
@@ -227,7 +228,7 @@ function formatGoal(
   goal: GoalSnapshot | null,
   continuation: ReturnType<typeof currentContinuationState> = null,
   stall = observeGoalStall(goal, continuation),
-  preferences: GoalPreferences = { autoContinue: true, conversationalResume: true },
+  preferences: GoalPreferences = { autoContinue: true, conversationalResume: true, pauseOnEscape: true },
 ): string {
   const settings = formatPreferences(preferences);
   if (!goal) {
@@ -260,6 +261,7 @@ function formatPreferences(preferences: GoalPreferences): string {
   return [
     `Automatic continuation setting: ${preferences.autoContinue ? "on" : "off"}${WAKE_DISABLED ? " (disabled by environment)" : ""}`,
     `Conversational resume setting: ${preferences.conversationalResume ? "on" : "off"}`,
+    `Pause on Esc setting: ${preferences.pauseOnEscape ? "on" : "off"}`,
   ].join("\n");
 }
 
@@ -291,6 +293,8 @@ export default function (pi: ExtensionAPI): void {
   let currentCtx: ExtensionContext | undefined;
   let executionGeneration = 0;
   let agentGeneration = -1;
+  let turnGeneration = 0;
+  let escapeAbortSuppression: { session: number; turn: number; execution: number } | undefined;
   let sessionGeneration = 0;
   let wakeGeneration = 0;
   let snapshotSequence = 0;
@@ -306,8 +310,11 @@ export default function (pi: ExtensionAPI): void {
   let idleContinuationTimer: ReturnType<typeof setTimeout> | undefined;
   let idleContinuationSignature = "";
   let refreshGoalWidget: ((force?: boolean) => void) | undefined;
+  let terminalInputUnsubscribe: (() => void) | undefined;
+  let terminalInputIsEditor: (() => boolean) | undefined;
+  let uiPromptDepth = 0;
   let lastAgentEvidence: ContinuationEvidence | null = null;
-  let preferences: GoalPreferences = { autoContinue: true, conversationalResume: true };
+  let preferences: GoalPreferences = { autoContinue: true, conversationalResume: true, pauseOnEscape: true };
   /** Background items active when each pending blocking question started, keyed by tool call id. */
   const pendingQuestions = new Map<string, Map<string, BackgroundWorkItem>>();
 
@@ -416,6 +423,11 @@ export default function (pi: ExtensionAPI): void {
       : "Goal paused. Use /goal resume or alt+g to resume it.");
   };
 
+  const escapeAbortIsSuppressed = (): boolean =>
+    escapeAbortSuppression?.session === sessionGeneration &&
+    escapeAbortSuppression.turn === turnGeneration &&
+    escapeAbortSuppression.execution === executionGeneration;
+
   /** Why a paused goal cannot become active again, or null when it can. */
   const resumeBlocker = (goal: GoalSnapshot): string | null => {
     if (!goal.command && skillCommandName(goal.objective)) {
@@ -723,6 +735,16 @@ export default function (pi: ExtensionAPI): void {
     ctx.ui.setWidget(
       EXTENSION_NAME,
       (tui, theme) => {
+        const inputIsEditor = (): boolean => {
+          const focus = tui as typeof tui & { getFocusedComponent?(): Partial<CustomEditor> | null };
+          if (typeof focus.getFocusedComponent !== "function" || tui.hasOverlay()) return false;
+          // Duck typing survives Pi's bundled/jiti module boundaries. Unknown
+          // custom editors and dialog components keep ownership of Escape.
+          const editor = focus.getFocusedComponent();
+          return typeof editor?.onEscape === "function" &&
+            typeof editor.isShowingAutocomplete === "function" && !editor.isShowingAutocomplete();
+        };
+        terminalInputIsEditor = inputIsEditor;
         const requestRender = (force = false): void => {
           try {
             tui.requestRender(force);
@@ -746,6 +768,7 @@ export default function (pi: ExtensionAPI): void {
         return {
           dispose() {
             scheduler.dispose();
+            if (terminalInputIsEditor === inputIsEditor) terminalInputIsEditor = undefined;
             if (refreshGoalWidget === refresh) {
               refreshGoalWidget = undefined;
             }
@@ -818,12 +841,14 @@ export default function (pi: ExtensionAPI): void {
         const [, setting, mode, ...extra] = trimmed.split(/\s+/);
         if (setting !== undefined && (!GOAL_SETTINGS.includes(setting as typeof GOAL_SETTINGS[number]) ||
             (mode !== "on" && mode !== "off") || extra.length > 0)) {
-          notifyGoal(ctx, "Usage: /goal settings [auto-continue|conversational-resume on|off]", "warning");
+          notifyGoal(ctx, "Usage: /goal settings [auto-continue|conversational-resume|pause-on-escape on|off]", "warning");
           return;
         }
         if (setting !== undefined) {
           try {
-            await changePreference(setting === "auto-continue" ? "autoContinue" : "conversationalResume", mode === "on");
+            const key = setting === "auto-continue" ? "autoContinue"
+              : setting === "conversational-resume" ? "conversationalResume" : "pauseOnEscape";
+            await changePreference(key, mode === "on");
           } catch (error) {
             notifyGoal(ctx, error instanceof Error ? error.message : String(error), "error");
             return;
@@ -1058,8 +1083,13 @@ export default function (pi: ExtensionAPI): void {
   });
 
   pi.on("session_start", async (_event, ctx) => {
+    terminalInputUnsubscribe?.();
+    terminalInputUnsubscribe = undefined;
+    terminalInputIsEditor = undefined;
+    uiPromptDepth = 0;
     executionGeneration += 1;
     sessionGeneration += 1;
+    escapeAbortSuppression = undefined;
     clearIdleContinuation();
     continuationQueuedFor = null;
     backgroundDrainTracker = null;
@@ -1081,6 +1111,23 @@ export default function (pi: ExtensionAPI): void {
     pi.events.emit(EVENT_READY, { version: EXTENSION_VERSION });
     syncResumeTool(getGoal(ctx));
     installGoalWidget(ctx);
+    if (ctx.mode === "tui" && ctx.hasUI && typeof ctx.ui.onTerminalInput === "function") {
+      const session = sessionGeneration;
+      terminalInputUnsubscribe = ctx.ui.onTerminalInput((data) => {
+        if (session === sessionGeneration && uiPromptDepth === 0 &&
+            !isKeyRelease(data) && matchesKey(data, "escape") && terminalInputIsEditor?.()) {
+          if (preferences.pauseOnEscape) {
+            pauseGoalOnInterrupt(ctx);
+          } else if (foregroundRunning) {
+            // The original key reaches Pi next and may abort this run. Preserve
+            // this keypress's choice through both abort notifications only.
+            escapeAbortSuppression = { session, turn: turnGeneration, execution: executionGeneration };
+          }
+        }
+        // Observe only: Pi must still interrupt streams or handle editor Escape.
+        return undefined;
+      });
+    }
     const snapshot = await publishSnapshot(ctx);
     if (!snapshot) return;
     syncPollingState();
@@ -1089,6 +1136,9 @@ export default function (pi: ExtensionAPI): void {
     }
   });
 
+  pi.on("ui_prompt_start", () => { uiPromptDepth += 1; });
+  pi.on("ui_prompt_end", () => { uiPromptDepth = Math.max(0, uiPromptDepth - 1); });
+
   pi.on("input", async (event, ctx) => {
     if (event.source === "extension") {
       return;
@@ -1170,6 +1220,8 @@ export default function (pi: ExtensionAPI): void {
 
   pi.on("agent_start", async (_event, ctx) => {
     executionGeneration += 1;
+    turnGeneration += 1;
+    escapeAbortSuppression = undefined;
     agentGeneration = executionGeneration;
     currentCtx = ctx;
     foregroundRunning = true;
@@ -1178,10 +1230,16 @@ export default function (pi: ExtensionAPI): void {
     lastAgentEvidence = null;
     const turnSignal = ctx.signal;
     if (turnSignal) {
+      const session = sessionGeneration;
+      const turn = turnGeneration;
+      const onAbort = (): void => {
+        if (session !== sessionGeneration || turn !== turnGeneration) return;
+        if (!escapeAbortIsSuppressed()) pauseGoalOnInterrupt(ctx);
+      };
       if (turnSignal.aborted) {
-        pauseGoalOnInterrupt(ctx);
+        onAbort();
       } else {
-        turnSignal.addEventListener("abort", () => pauseGoalOnInterrupt(ctx), { once: true });
+        turnSignal.addEventListener("abort", onAbort, { once: true });
       }
     }
     await publishSnapshot(ctx);
@@ -1189,13 +1247,12 @@ export default function (pi: ExtensionAPI): void {
 
   pi.on("agent_end", async (event, ctx) => {
     lastAgentEvidence = agentGeneration === executionGeneration ? continuationEvidence(event.messages) : null;
-    // `escape` is a pi-reserved built-in shortcut (`app.interrupt`), so extensions
-    // cannot register it. Observe the interrupt instead: when a running turn is
-    // aborted (escape / ctrl+c while streaming), pause the active goal so it does
-    // not auto-continue after the user stopped the agent.
-    if (wasTurnAborted(event.messages)) {
+    // Only an observed editor Escape with pause disabled exempts this abort.
+    // Unknown interrupt sources retain the safety fallback on every host.
+    if (wasTurnAborted(event.messages) && !escapeAbortIsSuppressed()) {
       pauseGoalOnInterrupt(ctx);
     }
+    escapeAbortSuppression = undefined;
   });
 
   pi.on("tool_execution_start", async (event, ctx) => {
@@ -1228,6 +1285,7 @@ export default function (pi: ExtensionAPI): void {
 
   pi.on("agent_settled", async (_event, ctx) => {
     executionGeneration += 1;
+    escapeAbortSuppression = undefined;
     currentCtx = ctx;
     foregroundRunning = false;
     const snapshot = await publishSnapshot(ctx);
@@ -1274,6 +1332,11 @@ export default function (pi: ExtensionAPI): void {
   pi.on("session_shutdown", async (_event, ctx) => {
     executionGeneration += 1;
     sessionGeneration += 1;
+    escapeAbortSuppression = undefined;
+    terminalInputUnsubscribe?.();
+    terminalInputUnsubscribe = undefined;
+    terminalInputIsEditor = undefined;
+    uiPromptDepth = 0;
     stopPolling();
     foregroundRunning = false;
     pendingQuestions.clear();

package/node_modules/pi-better-goal/src/preferences.ts

@@ -5,6 +5,7 @@ import { dirname, join } from "node:path";
 export interface GoalPreferences {
   autoContinue: boolean;
   conversationalResume: boolean;
+  pauseOnEscape: boolean;
 }
 
 export interface GoalPreferenceSeams {
@@ -22,7 +23,7 @@ export function readGoalPreferences(seams: GoalPreferenceSeams = {}): GoalPrefer
     raw = readFileSync(path, "utf8");
   } catch (error) {
     if ((error as NodeJS.ErrnoException).code === "ENOENT") {
-      return { autoContinue: true, conversationalResume: true };
+      return { autoContinue: true, conversationalResume: true, pauseOnEscape: true };
     }
     throw new Error(`Goal preferences at ${path} could not be read: ${messageOf(error)}`);
   }
@@ -35,16 +36,18 @@ export function readGoalPreferences(seams: GoalPreferenceSeams = {}): GoalPrefer
   const value = parsed as Partial<GoalPreferences> & { version?: unknown } | null;
   if (value?.version !== 1 ||
       (value.autoContinue !== undefined && typeof value.autoContinue !== "boolean") ||
-      (value.conversationalResume !== undefined && typeof value.conversationalResume !== "boolean")) {
-    throw new Error(`Goal preferences at ${path} must contain version 1 and boolean autoContinue/conversationalResume settings.`);
+      (value.conversationalResume !== undefined && typeof value.conversationalResume !== "boolean") ||
+      (value.pauseOnEscape !== undefined && typeof value.pauseOnEscape !== "boolean")) {
+    throw new Error(`Goal preferences at ${path} must contain version 1 and boolean autoContinue/conversationalResume/pauseOnEscape settings.`);
   }
   return {
     autoContinue: value.autoContinue ?? true,
     conversationalResume: value.conversationalResume ?? true,
+    pauseOnEscape: value.pauseOnEscape ?? true,
   };
 }
 
-/** Persist one control without replacing the other session's saved choice. */
+/** Persist one control without replacing another session's saved choices. */
 export function writeGoalPreference(
   key: keyof GoalPreferences,
   enabled: boolean,

package/node_modules/pi-better-goal/src/settings-page.ts

@@ -5,6 +5,7 @@ import type { GoalPreferences } from "./preferences.js";
 const rows: { key: keyof GoalPreferences; label: string }[] = [
   { key: "autoContinue", label: "Automatic continuation" },
   { key: "conversationalResume", label: "Conversational resume" },
+  { key: "pauseOnEscape", label: "Pause on Esc" },
 ];
 
 export function createGoalSettingsPage(

package/node_modules/pi-better-sandbox/README.md

@@ -23,9 +23,10 @@ Sandbox                           Off              On
 
 Project files                     -                Write & delete
 Outside project                   -                Write
-Stored credentials                -                Read
+Stored credentials                -                Write & delete
 Run commands & applications       -                On
 Network access                    -                On
+Process access                    -                Off
 
   Subagents · Tools
     Guarded (follows the file rules)
@@ -70,9 +71,14 @@ Project files and Outside project cycle through four levels:
 | ----- | ------- |
 | Off | No access. |
 | Read | Read only. |
-| Write | Read, create, and overwrite in place. Nothing can be removed or renamed away. |
+| Write | Read, create, and overwrite in place; removal is restricted, with the exceptions below. |
 | Write & delete | Full access, including removal. This was called "Read / write"; saved settings keep it. |
 
+Stored credentials uses the same labels but offers only **Off**, **Read**, and
+**Write & delete**. Subagents default to Write & delete; Main retains Read.
+Explicit saved defaults and session profiles are preserved, including Read and
+Off. Changing the built-in default does not upgrade existing profiles.
+
 Whatever these rows say, removal is always allowed in **temp**, **hidden
 directories and files directly under your home** (`~/.cache`, `~/.gradle`,
 `~/.npm`, …), and **git worktree folders** (`.worktrees/`, `*-worktrees/`). The
@@ -89,12 +95,16 @@ select the row.
 home directory and temp, so tool caches just work with no per-tool setup. It
 retains fixed protections that are not configurable per tool:
 
-- **Credentials** follow the independent Stored credentials row. The default
-  `Read` setting exposes the files listed below plus `~/Library/Keychains`,
+- **Credentials** follow the independent Stored credentials row. The Subagents
+  `Write & delete` default permits reading, modifying, and removing the files
+  listed below plus `~/Library/Keychains`,
   `~/.claude/.credentials.json`, `~/.claude.json`, `~/.gnupg`,
   `~/.codex/auth.json`, `~/.cargo/credentials(.toml)`, `~/.pgpass`, and
-  `~/.config/rclone` to confined subagents, while denying writes. Set the row to
-  Off to hide them or Read / write when a CLI must refresh credential state.
+  `~/.config/rclone`, subject to stricter protected-path rules. Set the row to
+  Read to deny credential writes or Off to hide them. Writable credentials let
+  CLIs such as `gcloud` update database permissions and refresh token state even
+  for read-only cloud queries. This also lets tasks alter or delete credentials;
+  it is not a read-only authentication capability.
 - **Code that runs later** cannot be written, removed, or renamed: shell startup
   files (`.bashrc`, `.zshrc`, `.profile`, and the rest), `~/.config/fish`,
   `~/.gitconfig`, `~/.config/git`, `~/.config/systemd/user`,
@@ -108,7 +118,7 @@ retains fixed protections that are not configurable per tool:
   control directories, and task-runtime provenance) cannot be written, removed,
   or renamed.
 
-Every entry is protected under the literal path under home, every symlink hop
+Every protected entry is guarded under the literal path under home, every symlink hop
 on the way to its target, and the target itself. So a dotfiles manager's links
 (stow, chezmoi), including chains of links, can't be swapped or retargeted. A
 link whose target is missing protects that target too: it can't be created.
@@ -166,10 +176,30 @@ could likely delete these snapshots. Restore from one with Time Machine or
 AWS, GitHub CLI, Google Cloud CLI, Azure, Kubernetes, Docker, npm, netrc, Git
 credentials, and Pi's file-based auth. These rules override ordinary file access.
 OS vault services such as Keychain and Secret Service, and tokens inherited in
-environment variables, are excluded. Read / write may be needed by a CLI that
+environment variables, are excluded. Write & delete may be needed by a CLI that
 refreshes a token or updates its credential database. This row applies
 independently of Project files and Outside project.
 
+**Process access** controls the fixed `process_list` tool: **Off** (default) or
+**Read**. Read returns current-user process IDs and names only, with optional
+literal name filtering and a bounded result limit. It does not expose command
+arguments, environment variables, debugger attachment, signals, termination,
+or emulator/ADB operations. Legacy saved profiles stay Off until a human
+enables Read; subagents snapshot the setting at launch.
+
+The inventory helper uses a fixed system `pgrep` command under the existing
+kernel policy, without a shell or model-controlled arguments. It can work with
+Run commands & applications Off because it is a fixed read-only adapter, not
+general command execution. No sandbox restrictions are relaxed. The control
+governs this adapter only: it does not make arbitrary shell process inspection
+impossible when commands are enabled. Windows has no supported inventory backend.
+Linux still requires a supported permission profile with visible process metadata;
+hidden-root profiles without `/proc` fail rather than gaining a new host mount.
+
+On macOS, `/bin/ps` is setuid and can be refused at execution by Seatbelt even
+when process information reads are allowed. Enabling Process access provides
+`process_list`; it does not authorize raw `/bin/ps` or an unconfined workaround.
+
 File and shell operations use the kernel: macOS uses Seatbelt (`sandbox-exec`)
 and Linux uses Bubblewrap (`bwrap`). `read`, `write`, and `edit` keep Pi's normal
 tool behavior and mutation queues, while a fixed worker performs filesystem
@@ -187,7 +217,7 @@ commands & applications Off. The fixed file worker remains available according
 to the file permissions even when task commands are Off.
 
 The task executor provides private scratch through `TMPDIR`, `TMP`, and `TEMP`.
-Outside Read and Read/write also retain explicit runtime write exceptions for
+Outside Read and Write & delete also retain explicit runtime write exceptions for
 `/tmp` (canonical `/private/tmp` on macOS), the current user's macOS temporary
 directory, and that user's Security.framework MDS cache. MDS access lets CLI
 Keychain retrieval initialize and refresh its cache; it does not restrict the

package/node_modules/pi-better-sandbox/index.ts

@@ -53,6 +53,7 @@ export default function piBetterSandbox(pi: ExtensionAPI): void {
     let shellPath: string | undefined;
     const ownEntry = fileURLToPath(import.meta.url);
     const boundary = installTaskTools(pi, { controller, cwd: process.cwd(), shellPath: () => shellPath,
+        processAccess: () => controller.permissionSettings()?.main.processAccess ?? "off",
         trustedSources: [ownEntry,
             join(dirname(ownEntry), "../../extensions/sandbox/index.ts"),
             join(dirname(ownEntry), "../pi-better-harness/extensions/sandbox/index.ts")],

package/node_modules/pi-better-sandbox/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-better-sandbox",
-  "version": "0.9.1",
+  "version": "0.10.0",
   "description": "Pi extension with independent Main and Subagents permission profiles, file guards, and OS sandbox enforcement.",
   "license": "MIT",
   "type": "module",

package/node_modules/pi-better-sandbox/permissions-page.ts

@@ -34,11 +34,11 @@ const rows = [
     { label: "Stored credentials", key: "storedCredentials" },
     { label: "Run commands & applications", key: "commands" },
     { label: "Network access", key: "network" },
+    { label: "Process access", key: "processAccess" },
 ] as const;
 const fileValues: readonly FileAccess[] = ["off", "read", "write", "read-write"];
 const credentialValues: readonly CredentialAccess[] = ["off", "read", "read-write"];
 const FILE_LABELS: Record<FileAccess, string> = { off: "Off", read: "Read", write: "Write", "read-write": "Write & delete" };
-const CREDENTIAL_LABELS: Record<CredentialAccess, string> = { off: "Off", read: "Read", "read-write": "Read / write" };
 
 /** The context line for the highlighted cell, or undefined. */
 function cellHint(key: string, profile: PermissionProfile | undefined): string | undefined {
@@ -50,6 +50,7 @@ function cellHint(key: string, profile: PermissionProfile | undefined): string |
             : "Always deletable: temp, hidden ~/.directories and worktree folders (.worktrees/, *-worktrees/).";
     }
     if (key === "storedCredentials") return "Known credential files follow this row independently of Outside project.";
+    if (key === "processAccess") return "process_list only: current-user PIDs and names. No process control; shell access is unchanged.";
     return undefined;
 }
 const columns = ["main", "subagents"] as const;
@@ -158,6 +159,8 @@ export function createPermissionsPage(
         if (key !== "enabled" && !settings[profile].enabled) return;
         if (key === "enabled" || key === "commands" || key === "network") {
             next[profile][key] = !next[profile][key];
+        } else if (key === "processAccess") {
+            next[profile][key] = next[profile][key] === "off" ? "read" : "off";
         } else if (key === "storedCredentials") {
             const current = next[profile][key];
             next[profile][key] = credentialValues[(credentialValues.indexOf(current) + 1) % credentialValues.length]!;
@@ -276,9 +279,6 @@ export function createPermissionsPage(
                 const entry = rows[i]!;
                 const value = (profile: PermissionProfile): string => {
                     if (entry.key !== "enabled" && !profile.enabled) return "-";
-                    if (entry.key === "storedCredentials") {
-                        return CREDENTIAL_LABELS[profile.storedCredentials];
-                    }
                     const current = profile[entry.key];
                     return typeof current === "boolean" ? (current ? "On" : "Off") : FILE_LABELS[current];
                 };

package/node_modules/pi-better-sandbox/permissions.ts

@@ -9,7 +9,7 @@ export type { SubagentToolSettings } from "./shared-task-tools.ts";
  */
 export type FileAccess = "off" | "read" | "write" | "read-write";
 /** Stored credentials keeps its three levels. */
-export type CredentialAccess = "off" | "read" | "read-write";
+export type CredentialAccess = Exclude<FileAccess, "write">;
 export interface SandboxPermissionProfile {
     enabled: boolean;
     projectFiles: FileAccess;
@@ -17,6 +17,7 @@ export interface SandboxPermissionProfile {
     storedCredentials: CredentialAccess;
     commands: boolean;
     network: boolean;
+    processAccess: "off" | "read";
 }
 export interface SandboxPermissionSettings {
     main: SandboxPermissionProfile;
@@ -27,7 +28,8 @@ export interface SandboxPermissionSettings {
 
 /**
  * Return fresh profiles so changing one column never changes the other.
- * Subagents default to Outside project = Write; Main keeps Read.
+ * Subagents default to Outside project = Write and credentials = Write & delete.
+ * Main keeps Read for both rows. Explicit saved profiles retain their values.
  */
 export function defaultSandboxPermissions(): SandboxPermissionSettings {
     const profile = (): SandboxPermissionProfile => ({
@@ -37,8 +39,9 @@ export function defaultSandboxPermissions(): SandboxPermissionSettings {
         storedCredentials: "read",
         commands: true,
         network: true,
+        processAccess: "off",
     });
-    return { main: profile(), subagents: { ...profile(), enabled: true, outsideProject: "write" }, subagentTools: defaultSubagentTools() };
+    return { main: profile(), subagents: { ...profile(), enabled: true, outsideProject: "write", storedCredentials: "read-write" }, subagentTools: defaultSubagentTools() };
 }
 
 function isProfile(value: unknown): value is SandboxPermissionProfile {
@@ -48,7 +51,8 @@ function isProfile(value: unknown): value is SandboxPermissionProfile {
     const access = (v: unknown): boolean => credential(v) || v === "write";
     return typeof p.enabled === "boolean" && typeof p.commands === "boolean" &&
         typeof p.network === "boolean" && access(p.projectFiles) &&
-        access(p.outsideProject) && credential(p.storedCredentials);
+        access(p.outsideProject) && credential(p.storedCredentials) &&
+        (p.processAccess === undefined || p.processAccess === "off" || p.processAccess === "read");
 }
 
 const FILE_RANK: Record<FileAccess, number> = { off: 0, read: 1, write: 2, "read-write": 3 };
@@ -71,6 +75,7 @@ export function describeLoosening(previous: SandboxPermissionSettings, next: San
         for (const key of ["commands", "network"] as const) {
             if (b[key] && !a[key]) changes.push(`${label}: ${key} on`);
         }
+        if (a.processAccess !== "read" && b.processAccess === "read") changes.push(`${label}: processAccess off → read`);
     }
     // A trusted tool runs outside the file rules: ticking one loosens the profile.
     for (const tool of next.subagentTools.trusted) {
@@ -91,6 +96,7 @@ export function parseSandboxPermissions(value: unknown): SandboxPermissionSettin
     const copy = (p: SandboxPermissionProfile): SandboxPermissionProfile => ({
         enabled: p.enabled, projectFiles: p.projectFiles, outsideProject: p.outsideProject,
         storedCredentials: p.storedCredentials, commands: p.commands, network: p.network,
+        processAccess: p.processAccess ?? "off",
     });
     // Files written before the Tools section existed get the default tool set.
     return { main: copy(settings.main), subagents: copy(settings.subagents), subagentTools: parseSubagentTools(settings.subagentTools) };

package/node_modules/pi-better-sandbox/shared-sandbox-core.ts

@@ -60,6 +60,8 @@ export type SandboxPermissions = {
     storedCredentials: "off" | "read" | "read-write";
     commands: boolean;
     network: boolean;
+    /** Fixed process_list adapter only; omitted legacy profiles keep it Off. */
+    processAccess?: "off" | "read";
 };
 
 /** Whether a file access level allows creating and overwriting files. */