pi-claude-supervisor 0.5.4 → 0.6.0

package/src/index.ts

@@ -252,9 +252,10 @@ export default function piClaudeSupervisor(pi: ExtensionAPI): void {
             throw new Error("An active, starting, or unreaped worker uses an overlapping cwd; use a separate worktree for concurrent sessions");
           }
           const taskId = randomUUID();
-          const lease = await cwdLeaseStore.acquire(cwdKey, taskId, adapter.capabilities().transport, tmuxSession
-            ? { handoff: { sessionName: tmuxSession, tmuxSocket: process.env.PI_CLAUDE_SUPERVISOR_TMUX_SOCKET } }
-            : {});
+          const lease = await cwdLeaseStore.acquire(cwdKey, taskId, adapter.capabilities().transport, {
+            startup: taskAutomation,
+            ...(tmuxSession ? { handoff: { sessionName: tmuxSession, tmuxSocket: process.env.PI_CLAUDE_SUPERVISOR_TMUX_SOCKET } } : {}),
+          });
           cwdLeases.set(taskId, lease);
           if (shuttingDown) {
             await releaseLease(taskId);
@@ -286,6 +287,42 @@ export default function piClaudeSupervisor(pi: ExtensionAPI): void {
                 env: selectedWorkerEnvironment(taskAutomation),
                 approval,
                 automation: taskAutomation,
+                retainCgroupUntilLeaseRelease: taskAutomation,
+                onWorkerStartup: taskAutomation
+                  ? async (startupHandle) => {
+                      await lease.updateWorker({
+                        transport: adapter.capabilities().transport,
+                        workerId: startupHandle.id,
+                        cgroupPath: startupHandle.cgroupPath,
+                        sessionName: startupHandle.sessionName,
+                        tmuxSocket: startupHandle.tmuxSocket,
+                        ownership: startupHandle.ownership,
+                        retainCgroupUntilLeaseRelease: startupHandle.retainCgroupUntilLeaseRelease,
+                      }, { preserveStartup: true });
+                    }
+                  : undefined,
+                onWorkerPrepared: taskAutomation
+                  ? async (preparedHandle) => {
+                      await lease.updateWorker({
+                        transport: adapter.capabilities().transport,
+                        ...(await workerIdentity(preparedHandle)),
+                        sessionName: preparedHandle.sessionName,
+                        tmuxSocket: preparedHandle.tmuxSocket,
+                        ownership: preparedHandle.ownership,
+                      }, { preserveStartup: true });
+                    }
+                  : undefined,
+                onWorkerPreSpawn: taskAutomation
+                  ? async (preSpawnHandle) => {
+                      await lease.updateWorker({
+                        transport: adapter.capabilities().transport,
+                        ...(await workerIdentity(preSpawnHandle)),
+                        sessionName: preSpawnHandle.sessionName,
+                        tmuxSocket: preSpawnHandle.tmuxSocket,
+                        ownership: preSpawnHandle.ownership,
+                      });
+                    }
+                  : undefined,
                 tmuxSession,
                 tmuxSocket: process.env.PI_CLAUDE_SUPERVISOR_TMUX_SOCKET,
                 tmuxExpectedIdentity: tmuxSession && lease.record.worker ? {
@@ -453,14 +490,15 @@ export default function piClaudeSupervisor(pi: ExtensionAPI): void {
           const automaticRecovery = record.spec?.autonomy.unattended !== false;
           if (automaticRecovery && !record.resolvedExecutable) throw new Error("automatic recovery requires a persisted resolved Claude executable identity");
           const approval = record.approval;
-          const lease = await cwdLeaseStore.acquire(cwdKey, record.taskId, adapter.capabilities().transport, takeover
-            ? {
+          const lease = await cwdLeaseStore.acquire(cwdKey, record.taskId, adapter.capabilities().transport, {
+            startup: automaticRecovery,
+            ...(takeover ? {
               takeover: {
                 taskId: record.taskId,
                 ...(staleRecovery ? { beforeReplace: () => decisionStore.reconcileStaleRecovery(record.taskId) } : {}),
               },
-            }
-            : {});
+            } : {}),
+          });
           if (staleRecovery && lease.replacedTaskId !== record.taskId) {
             await lease.release();
             throw new Error(`Stale Decision Worker recovery has no verified old lease to take over: ${record.taskId}`);
@@ -507,6 +545,42 @@ export default function piClaudeSupervisor(pi: ExtensionAPI): void {
                 env: selectedWorkerEnvironment(automaticRecovery),
                 approval,
                 automation: automaticRecovery,
+                retainCgroupUntilLeaseRelease: automaticRecovery,
+                onWorkerStartup: automaticRecovery
+                  ? async (startupHandle) => {
+                      await lease.updateWorker({
+                        transport: adapter.capabilities().transport,
+                        workerId: startupHandle.id,
+                        cgroupPath: startupHandle.cgroupPath,
+                        sessionName: startupHandle.sessionName,
+                        tmuxSocket: startupHandle.tmuxSocket,
+                        ownership: startupHandle.ownership,
+                        retainCgroupUntilLeaseRelease: startupHandle.retainCgroupUntilLeaseRelease,
+                      }, { preserveStartup: true });
+                    }
+                  : undefined,
+                onWorkerPrepared: automaticRecovery
+                  ? async (preparedHandle) => {
+                      await lease.updateWorker({
+                        transport: adapter.capabilities().transport,
+                        ...(await workerIdentity(preparedHandle)),
+                        sessionName: preparedHandle.sessionName,
+                        tmuxSocket: preparedHandle.tmuxSocket,
+                        ownership: preparedHandle.ownership,
+                      }, { preserveStartup: true });
+                    }
+                  : undefined,
+                onWorkerPreSpawn: automaticRecovery
+                  ? async (preSpawnHandle) => {
+                      await lease.updateWorker({
+                        transport: adapter.capabilities().transport,
+                        ...(await workerIdentity(preSpawnHandle)),
+                        sessionName: preSpawnHandle.sessionName,
+                        tmuxSocket: preSpawnHandle.tmuxSocket,
+                        ownership: preSpawnHandle.ownership,
+                      });
+                    }
+                  : undefined,
                 ...(automaticRecovery && record.resolvedExecutable ? { expectedClaudeExecutable: record.resolvedExecutable } : {}),
                 maxTurns: record.maxTurns,
                 deadlineMs: record.deadlineMs,
@@ -768,6 +842,7 @@ function formatSessions(sessions: Map<string, Supervisor>, recoverable: Decision
 }
 
 function selectedWorkerEnvironment(automatic = false): NodeJS.ProcessEnv {
+  if (automatic) return automaticWorkerEnvironment(process.env);
   const result: NodeJS.ProcessEnv = {};
   const names = (process.env.PI_CLAUDE_SUPERVISOR_WORKER_ENV ?? "")
     .split(",")
@@ -776,7 +851,7 @@ function selectedWorkerEnvironment(automatic = false): NodeJS.ProcessEnv {
   for (const name of names) {
     if (process.env[name] !== undefined) result[name] = process.env[name];
   }
-  return automatic ? automaticWorkerEnvironment(result) : result;
+  return result;
 }
 
 async function readTaskSpecFile(path: string, cwd: string): Promise<TaskSpec> {

package/src/policy.ts

@@ -11,14 +11,12 @@ export interface PolicyResult {
 /**
  * Permission decisions are autonomous for local development. A denial is a
  * hard capability boundary, not a request for a human to approve the next
- * turn. AskUserQuestion is denied so the Worker can restate the question as
- * ordinary text and the Decision Worker can answer it from task evidence.
+ * turn. Claude's built-in tools, agents, background tasks and MCP tools are
+ * allowed; only the explicit unattended interaction and repository/remote
+ * authority boundaries below remain special-cased.
  */
-const allowedWorkerTools = new Set(["Bash", "Edit", "Glob", "Grep", "Read", "Write", "NotebookEdit"]);
-
 export function evaluatePermission(toolName: string, input: unknown, cwd = process.cwd()): PolicyResult {
   if (toolName === "AskUserQuestion") return { decision: "deny", reason: "interactive questions are converted to ordinary Worker text" };
-  if (!allowedWorkerTools.has(toolName)) return { decision: "deny", reason: `Worker tool is outside the automatic allowlist: ${toolName}` };
   if (toolName === "Edit" || toolName === "Write" || toolName === "NotebookEdit") {
     const paths = fileToolPaths(input);
     if (paths.length === 0) return { decision: "deny", reason: `${toolName} request has no recognizable file path` };
@@ -30,9 +28,6 @@ export function evaluatePermission(toolName: string, input: unknown, cwd = proce
     ? (input as { command: string }).command
     : "";
   if (!command) return { decision: "deny", reason: "Bash request has no recognizable command" };
-  if (containsNestedClaude(command)) {
-    return { decision: "deny", reason: "Worker cannot start a nested Claude or background Reviewer" };
-  }
   return evaluateCommand("bash", ["-lc", command]);
 }
 
@@ -95,8 +90,7 @@ function isGitMetadataPath(value: string, cwd: string): boolean {
 
 const deniedPatterns = [
   /\b(?:npm|pnpm|yarn)\b[\s\S]*\bpublish\b/iu,
-  /\b(?:ssh|scp|sftp|rsync)\b/iu,
-  /\b(?:curl|wget)\b[\s\S]*(?:-X\s*(?:POST|PUT|PATCH|DELETE)|--method(?:=|\s+)(?:POST|PUT|PATCH|DELETE)|https?:\/\/(?:api\.)?(?:github|gitlab|bitbucket|registry\.npmjs)\.)/iu,
+  /\b(?:curl|wget)\b[\s\S]*(?:-X\s*(?:POST|PUT|PATCH|DELETE)|--request(?:=|\s+)(?:POST|PUT|PATCH|DELETE)|--method(?:=|\s+)(?:POST|PUT|PATCH|DELETE)|(?:^|\s)(?:-d|--data(?:[-a-z]*)(?:=|\s+)|--post-data(?:=|\s+)|--body-data(?:=|\s+)))[\s\S]*https?:\/\/(?:api\.)?(?:github|gitlab|bitbucket|registry\.npmjs)\b/iu,
   /(?:\$\{?[^\s`}]+\}?|`[^`]*`|\$\([^)]*\))[\s\S]*\b(?:push|merge|publish)\b|\b(?:push|merge|publish)\b[\s\S]*(?:\$\{?[^\s`}]+\}?|`[^`]*`|\$\([^)]*\))/iu,
   /--(?:allow-)?dangerously-skip-permissions\b/iu,
   /--permission-mode\s+(?:bypasspermissions|dontask)\b/iu,
@@ -117,6 +111,18 @@ const protectedBranches = new Set(["main", "master", "trunk", "integration", "de
 const protectedBranchOperations = new Set(["checkout", "switch", "branch", "reset", "restore", "worktree", "update-ref", "symbolic-ref"]);
 const remoteOperations = new Set(["push", "merge", "send-pack", "receive-pack", "update-ref"]);
 
+function containsRemoteCliMutation(command: string): boolean {
+  return /\b(?:gh|glab|hub)\b[\s\S]*(?:\b(?:pr|mr|pull-request)\s+(?:merge|create|close|delete|edit|comment)\b|\b(?:release)\s+(?:create|delete|edit|upload)\b|\bapi\b[\s\S]*(?:-X|--request|--method(?:=|\s+))(?:\s*=?)\s*(?:POST|PUT|PATCH|DELETE)\b)/iu.test(command);
+}
+
+function containsRemoteHttpMutation(command: string): boolean {
+  const hasHttpClient = /\b(?:curl|wget)\b/iu.test(command);
+  const hasMutationFlag = /(?:-X\s*(?:POST|PUT|PATCH|DELETE)\b|--request(?:=|\s+)(?:POST|PUT|PATCH|DELETE)\b|--method(?:=|\s+)(?:POST|PUT|PATCH|DELETE)\b)/iu.test(command)
+    || /(?:^|\s)(?:-d\b|--data(?:[-a-z]*)(?:=|\s+)|--post-data(?:=|\s+)|--body-data(?:=|\s+))/iu.test(command);
+  const hasProtectedEndpoint = /https:\/\/(?:api\.)?(?:github|gitlab|bitbucket|registry\.npmjs)\b/iu.test(command);
+  return hasHttpClient && hasMutationFlag && hasProtectedEndpoint;
+}
+
 export function evaluateCommand(command: string, args: readonly string[] = []): PolicyResult {
   const normalized = command.trim();
   if (!normalized) return { decision: "deny", reason: "empty command" };
@@ -132,8 +138,7 @@ function evaluateRepositoryBoundary(tokens: readonly ShellToken[], canonical: st
   const hasGit = values.some((value) => /(?:^|[\\/])git$/iu.test(value) || /^(?:git-(?:send|receive|upload)-pack)$/iu.test(value));
   const hasGitTransport = lower.some((value) => /^(?:git-(?:send|receive|upload)-pack)$/u.test(value));
   const hasRemoteOperation = lower.some((value) => remoteOperations.has(value));
-  const hasGhRemote = lower.some((value) => value === "gh" || value === "glab" || value === "hub")
-    && lower.some((value) => value === "api" || value === "release" || value === "pull-request" || value === "pr" || value === "mr");
+  const hasGhRemote = containsRemoteCliMutation(canonical);
   const hasPackagePublication = lower.some((value) => value === "npm" || value === "pnpm" || value === "yarn") && lower.includes("publish");
   const hasGitAliasConfiguration = hasGit && lower.some((value) => /^alias\.[^=]*(?:=|$)/u.test(value));
   if (depth < 4) {
@@ -152,7 +157,7 @@ function evaluateRepositoryBoundary(tokens: readonly ShellToken[], canonical: st
   }
   if (/\bgit\b[\s\S]*\b(?:push|merge|send-pack|receive-pack|update-ref)\b/iu.test(canonical)
     || /\bgit-(?:send|receive|upload)-pack\b/iu.test(canonical)
-    || /\b(?:gh|glab|hub)\b[\s\S]*\b(?:api|pr|mr|pull-request|release)\b/iu.test(canonical)) {
+    || containsRemoteCliMutation(canonical)) {
     return { decision: "deny", reason: "Worker has no remote repository or main/integration merge authority" };
   }
   if (hasGit && (hasRemoteOperation || hasGitTransport) || hasGhRemote) {
@@ -181,27 +186,6 @@ function evaluateRepositoryBoundary(tokens: readonly ShellToken[], canonical: st
   return undefined;
 }
 
-function containsNestedClaude(command: string, depth = 0): boolean {
-  // Bash can hand an opaque quoted program to Python, Node, eval, env,
-  // command, or another interpreter. Once this permission boundary sees a
-  // Claude executable reference, fail closed rather than trying to prove which
-  // wrapper will eventually exec it. This intentionally rejects harmless prose
-  // mentions too; false positives cannot grant a nested Worker capability.
-  if (/\b(?:claude(?:\.exe)?|review(?:er)?|code[-_ ]?review|read[-_ ]?only[-_ ]?review|independent[-_ ]?review|codex|cursor(?:-agent)?|aider|opencode|gemini)\b/iu.test(command)) return true;
-  if (depth > 4) return false;
-  const lexical = lexShell(command);
-  if (lexical.error) return true;
-  for (const token of lexical.tokens) {
-    if (token.operator) continue;
-    const executable = token.value.split(/[\\/]/u).at(-1)?.toLowerCase();
-    if (executable === "claude" || executable === "claude.exe") return true;
-    // Quote concatenation such as c'l'a'u'd'e is normalized by the shell
-    // lexer into one token. Recurse into quoted interpreter payloads too.
-    if (/\s/u.test(token.value) && containsNestedClaude(token.value, depth + 1)) return true;
-  }
-  return false;
-}
-
 function nestedShellCommands(lower: readonly string[], values: readonly string[]): string[] {
   const nested: string[] = [];
   const shellNames = new Set(["sh", "bash", "dash", "zsh", "fish", "ksh"]);
@@ -237,6 +221,9 @@ function evaluateTokens(tokens: readonly ShellToken[], depth: number): PolicyRes
   if (!canonical) return { decision: "deny", reason: "empty command" };
   const boundary = evaluateRepositoryBoundary(tokens, canonical, depth);
   if (boundary) return boundary;
+  if (containsRemoteHttpMutation(canonical)) {
+    return { decision: "deny", reason: "Worker has no remote repository or main/integration merge authority" };
+  }
   if (deniedPatterns.some((pattern) => pattern.test(canonical))) {
     if (/\b(?:curl|wget)\b[\s\S]*(?:github|gitlab|bitbucket|registry\.npmjs)\b/iu.test(canonical)) {
       return { decision: "deny", reason: "Worker has no remote repository or main/integration merge authority" };

package/src/supervisor.ts

@@ -7,7 +7,7 @@ import { PiDecisionWorker, type DecisionAction, type DecisionWorkerFactory, type
 import { collectRepositoryEvidence, repositoryBranch, repositoryCommitExists, repositoryHead, repositoryWorkTree, verifyAll, type RepositoryEvidence, type VerificationCommand } from "./verifier.ts";
 import { normalizeTaskSpec } from "./acceptance.ts";
 import { redactSensitive } from "./redaction.ts";
-import { assertTrustedAutomaticClaudeExecutable, automaticClaudeArgs, automaticWorkerEnvironment } from "./worker/environment.ts";
+import { assertAutomaticClaudePermissionConfiguration, assertTrustedAutomaticClaudeExecutable, automaticClaudeArgs, automaticWorkerEnvironment } from "./worker/environment.ts";
 import { normalizeReviewReport, type ReviewInput, type TaskReviewer } from "./reviewer.ts";
 import type {
   AcceptanceReport,
@@ -93,6 +93,14 @@ export interface SupervisorStartOptions {
   sendInitialInput?: boolean;
   /** Enable the event-driven Pi Decision Worker. Automatic mode requires claude-jsonl. */
   automation?: boolean;
+  /** Index-owned cwd leases retain the empty automatic cgroup until release. */
+  retainCgroupUntilLeaseRelease?: boolean;
+  /** Persist the planned adapter resource identity before resource creation. */
+  onWorkerStartup?: (handle: WorkerHandle) => Promise<void> | void;
+  /** Persist the cgroup identity before creating external Worker resources. */
+  onWorkerPrepared?: (handle: WorkerHandle) => Promise<void> | void;
+  /** Persist the adapter's final resource identity before Worker spawn. */
+  onWorkerPreSpawn?: (handle: WorkerHandle) => Promise<void> | void;
   /** Persistent Pi session location for the Decision Worker. */
   decisionSessionFile?: string;
   decisionSessionDir?: string;
@@ -267,10 +275,13 @@ export class Supervisor {
       if (this.#automation && !["jsonl", "tmux"].includes(this.#adapter.capabilities().transport)) {
         throw new Error("automatic supervision requires the claude-jsonl or automated tmux transport");
       }
-      const workerEnvironment = this.#automation ? automaticWorkerEnvironment(options.env) : options.env;
+      const workerEnvironment = this.#automation
+        ? automaticWorkerEnvironment(options.env)
+        : options.env;
       if (this.#automation) {
         trustedWorkerCommand = await assertTrustedAutomaticClaudeExecutable(options.command, options.expectedClaudeExecutable);
         workerArgs = automaticClaudeArgs(options.command, options.args);
+        await assertAutomaticClaudePermissionConfiguration(options.cwd, workerArgs, workerEnvironment);
         await this.#appendEvent({ type: "worker_executable_pinned", taskId, data: { command: options.command, resolvedExecutable: trustedWorkerCommand } });
       }
       await this.#adapter.preflight?.({
@@ -330,13 +341,18 @@ export class Supervisor {
         tmuxExpectedIdentity: options.tmuxExpectedIdentity,
         sendInitialInput: options.sendInitialInput,
         automatic: this.#automation,
+        retainCgroupUntilLeaseRelease: this.#automation && options.retainCgroupUntilLeaseRelease === true,
         eventListener: (event) => this.#receiveWorkerEvent(event),
         env: workerEnvironment,
         abortSignal: startAbortController.signal,
         startupToken: this.#startToken,
+        onWorkerStartup: this.#automation ? options.onWorkerStartup : undefined,
+        onWorkerPrepared: this.#automation ? options.onWorkerPrepared : undefined,
         preSpawnCheck: this.#automation
-          ? async () => {
+          ? async (provisionalHandle) => {
+              if (provisionalHandle) await options.onWorkerPreSpawn?.(provisionalHandle);
               await automaticRepositoryBoundary(options.cwd, this.#task!.baseCommit, this.#task!.baseBranch, startAbortController.signal, startupHead);
+              await assertAutomaticClaudePermissionConfiguration(options.cwd, workerArgs ?? [], workerEnvironment);
               this.#assertStartNotAborted(startAbortController.signal);
             }
           : undefined,

package/src/types.ts

@@ -54,15 +54,23 @@ export interface WorkerStartInput {
   sendInitialInput?: boolean;
   /** Automatic mode selects the structured tmux bridge instead of the manual TUI transport. */
   automatic?: boolean;
+  /** Keep an empty automatic cgroup until the owning cwd lease is finalized. */
+  retainCgroupUntilLeaseRelease?: boolean;
+  /** Persist the planned automatic resource identity before adapter setup. */
+  onWorkerStartup?: (provisionalHandle: WorkerHandle) => Promise<void> | void;
+  /** Persist the cgroup identity before creating any external Worker resource. */
+  onWorkerPrepared?: (provisionalHandle: WorkerHandle) => Promise<void> | void;
   /** Cancel startup before a worker is fully returned to the supervisor. */
   abortSignal?: AbortSignal;
   /** Internal token that scopes out-of-band startup cancellation. */
   startupToken?: string;
   /**
-   * Automatic-start repository assertion. Built-in adapters invoke this after
-   * all asynchronous setup and immediately before spawning the Worker.
+   * Automatic-start repository/settings assertion. Built-in adapters invoke
+   * this after asynchronous setup; the tmux bridge repeats its permission
+   * check immediately before spawning the Claude child. The provisional
+   * handle contains the cgroup identity before Worker spawn.
    */
-  preSpawnCheck?: () => Promise<void>;
+  preSpawnCheck?: (provisionalHandle?: WorkerHandle) => Promise<void>;
 }
 
 export interface WorkerHandle {
@@ -76,6 +84,11 @@ export interface WorkerHandle {
   ownership?: "owned" | "adopted";
   /** Verified process-boundary metadata persisted in the cwd lease registry. */
   cgroupPath?: string;
+  cgroupIdentity?: { device: string; inode: string };
+  /** Automatic adapters retain the empty cgroup until the cwd lease is released. */
+  retainCgroupUntilLeaseRelease?: boolean;
+  tmuxServerPid?: number;
+  tmuxServerStartTime?: string;
   tmuxTarget?: string;
   tmuxPaneId?: string;
   paneStartTime?: string;