pi-code 0.1.0 → 0.2.0

package/extensions/plan-mode/utils.ts

@@ -27,7 +27,7 @@ const DESTRUCTIVE_PATTERNS = [
   /\bpip\s+(install|uninstall)/i,
   /\bapt(-get)?\s+(install|remove|purge|update|upgrade)/i,
   /\bbrew\s+(install|uninstall|upgrade)/i,
-  /\bgit\s+(add|commit|push|pull|merge|rebase|reset|checkout|branch\s+-[dD]|stash|cherry-pick|revert|tag|init|clone)/i,
+  /\bgit\s+(add|commit|push|pull|merge|rebase|reset|checkout|branch\s+-d|stash|cherry-pick|revert|tag|init|clone)/i,
   /\bsudo\b/i,
   /\bsu\b/i,
   /\bkill\b/i,
@@ -40,7 +40,9 @@ const DESTRUCTIVE_PATTERNS = [
   /\b(vim?|nano|emacs|code|subl)\b/i,
 ]
 
-// Safe read-only commands allowed in plan mode
+// Safe read-only commands allowed in plan mode. Deliberately excludes env/printenv
+// (secret disclosure, and env is an exec wrapper), curl/wget (fetch plus -o writes),
+// awk (system()) and sed (w/W/e write even under -n).
 const SAFE_PATTERNS = [
   /^\s*cat\b/,
   /^\s*head\b/,
@@ -65,8 +67,6 @@ const SAFE_PATTERNS = [
   /^\s*which\b/,
   /^\s*whereis\b/,
   /^\s*type\b/,
-  /^\s*env\b/,
-  /^\s*printenv\b/,
   /^\s*uname\b/,
   /^\s*whoami\b/,
   /^\s*id\b/,
@@ -83,21 +83,44 @@ const SAFE_PATTERNS = [
   /^\s*yarn\s+(list|info|why|audit)/i,
   /^\s*node\s+--version/i,
   /^\s*python\s+--version/i,
-  /^\s*curl\s/i,
-  /^\s*wget\s+-O\s*-/i,
   /^\s*jq\b/,
-  /^\s*sed\s+-n/i,
-  /^\s*awk\b/,
   /^\s*rg\b/,
   /^\s*fd\b/,
   /^\s*bat\b/,
   /^\s*eza\b/,
 ]
 
+// The shell can hide an arbitrary command inside any of these, so they are refused
+// outright rather than parsed.
+const SUBSTITUTION = /\$\(|`|<\(|>\(/
+
+// Claude Code's separator set (code.claude.com/docs/en/permissions): every subcommand
+// must qualify on its own, otherwise an allowlisted first token buys the rest of the line.
+const SEPARATORS = /\|\||&&|\|&|[;|&\n]/
+
+// find is allowlisted for traversal only; these actions run commands or delete.
+const FIND_ACTIONS = /\s-(exec|execdir|ok|okdir|delete|fls|fprint|fprintf)\b/
+
+function isSafeSegment(segment: string): boolean {
+  if (DESTRUCTIVE_PATTERNS.some((p) => p.test(segment))) return false
+  if (!SAFE_PATTERNS.some((p) => p.test(segment))) return false
+  return !(/^\s*find\b/.test(segment) && FIND_ACTIONS.test(segment))
+}
+
+/**
+ * Whether plan mode should let this bash command run.
+ *
+ * Model steering, not a sandbox: an allowlisted interpreter can still read and write
+ * whatever the user can, so this narrows the blast radius of a wrong turn rather than
+ * containing a determined one. Only OS-level isolation would be a boundary.
+ */
 export function isSafeCommand(command: string): boolean {
-  const isDestructive = DESTRUCTIVE_PATTERNS.some((p) => p.test(command))
-  const isSafe = SAFE_PATTERNS.some((p) => p.test(command))
-  return !isDestructive && isSafe
+  if (SUBSTITUTION.test(command)) return false
+  const segments = command
+    .split(SEPARATORS)
+    .map((s) => s.trim())
+    .filter(Boolean)
+  return segments.length > 0 && segments.every(isSafeSegment)
 }
 
 export interface TodoItem {
@@ -123,16 +146,53 @@ export function cleanStepText(text: string): string {
   return cleaned
 }
 
+// Horizontal whitespace before the newline: \s would include \n itself and overlap
+// the following \n, which is what backtracks super-linearly.
+const PLAN_HEADER = /\*{0,2}Plan:\*{0,2}[^\S\n]*\n/i
+
+const isBlank = (ch: string | undefined): boolean => ch !== undefined && ch !== '\n' && ch.trim() === ''
+
+/**
+ * Text of a `1. step` / `2) step` line, stopping at an inline `*`, or undefined when
+ * the line is not a numbered step. Scanned rather than matched: the equivalent
+ * pattern needs adjacent quantifiers over overlapping classes, which backtracks
+ * super-linearly on a long line that turns out not to be a step.
+ */
+function numberedStepText(line: string): string | undefined {
+  let i = 0
+  while (isBlank(line[i])) i++
+
+  const digitsStart = i
+  while (line[i] >= '0' && line[i] <= '9') i++
+  if (i === digitsStart) return undefined
+
+  if (line[i] !== '.' && line[i] !== ')') return undefined
+  i++
+
+  const spaceStart = i
+  while (isBlank(line[i])) i++
+  if (i === spaceStart) return undefined // the marker must be followed by whitespace
+
+  for (let stars = 0; stars < 2 && line[i] === '*'; stars++) i++
+  const first = line[i]
+  if (first === undefined || first === '*' || isBlank(first)) return undefined
+
+  const rest = line.slice(i)
+  const star = rest.indexOf('*')
+  return star === -1 ? rest : rest.slice(0, star)
+}
+
 export function extractTodoItems(message: string): TodoItem[] {
   const items: TodoItem[] = []
-  const headerMatch = message.match(/\*{0,2}Plan:\*{0,2}\s*\n/i)
+  const headerMatch = PLAN_HEADER.exec(message)
   if (!headerMatch) return items
 
   const planSection = message.slice(message.indexOf(headerMatch[0]) + headerMatch[0].length)
-  const numberedPattern = /^\s*(\d+)[.)]\s+\*{0,2}([^*\n]+)/gm
 
-  for (const match of planSection.matchAll(numberedPattern)) {
-    const text = match[2]
+  for (const line of planSection.split('\n')) {
+    const captured = numberedStepText(line)
+    if (captured === undefined) continue
+    const text = captured
       .trim()
       .replace(/\*{1,2}$/, '')
       .trim()
@@ -170,6 +230,6 @@ export function markCompletedSteps(text: string, items: TodoItem[]): number {
  * the tool input is already known to be the plan itself.
  */
 export function planToTodos(plan: string): TodoItem[] {
-  const withHeader = /\*{0,2}Plan:\*{0,2}\s*\n/i.test(plan) ? plan : `Plan:\n${plan}`
+  const withHeader = PLAN_HEADER.test(plan) ? plan : `Plan:\n${plan}`
   return extractTodoItems(withHeader)
 }

package/extensions/project-trust.ts

@@ -0,0 +1,65 @@
+/**
+ * Project Trust Extension
+ *
+ * pi decides whether to prompt for trust from `hasTrustRequiringProjectResources`,
+ * which looks only at entries under `cwd/.pi` and at `.agents/skills`. A repository
+ * that ships only Claude Code shaped config, `.claude/` plus `.mcp.json`, matches
+ * none of them, so pi trusts it without asking.
+ *
+ * That is exactly the shape pi-code exists to load, and the other extensions gate
+ * their project input on `ctx.isProjectTrusted()`. Without this handler that flag is
+ * true for a freshly cloned repo nobody was asked about, and a project `.mcp.json`
+ * server command, project hooks and project agents all run.
+ *
+ * Only user/global and CLI extensions receive `project_trust`, so this works when
+ * pi-code is installed with `pi install npm:pi-code`. A project-local install
+ * (`pi install -l`) is not loaded until trust is already resolved.
+ *
+ * Docs: node_modules/@earendil-works/pi-coding-agent/docs/extensions.md (project_trust)
+ */
+
+import * as fs from 'node:fs'
+import * as path from 'node:path'
+import { type ExtensionAPI, getAgentDir, hasTrustRequiringProjectResources, ProjectTrustStore } from '@earendil-works/pi-coding-agent'
+
+/** Project files pi-code acts on that pi's own trust check does not look for. */
+const CLAUDE_SHAPED = [path.join('.claude', 'settings.json'), path.join('.claude', 'settings.local.json'), path.join('.claude', 'agents'), path.join('.claude', 'hooks'), path.join('.claude', 'output-styles'), '.mcp.json', path.join('.pi', 'mcp.json'), path.join('.pi', 'agents')]
+
+export function hasClaudeShapedConfig(cwd: string): boolean {
+  return CLAUDE_SHAPED.some((entry) => fs.existsSync(path.join(cwd, entry)))
+}
+
+export type TrustDecision = { trusted: 'yes' | 'no' | 'undecided'; remember?: boolean }
+
+interface TrustDeps {
+  hasClaudeShaped: (cwd: string) => boolean
+  piWouldAsk: (cwd: string) => boolean
+  savedDecision: (cwd: string) => boolean | null
+}
+
+const defaultDeps: TrustDeps = {
+  hasClaudeShaped: hasClaudeShapedConfig,
+  piWouldAsk: hasTrustRequiringProjectResources,
+  savedDecision: (cwd) => new ProjectTrustStore(getAgentDir()).get(cwd),
+}
+
+/**
+ * Whether to take over the trust decision for this project.
+ *
+ * Returns `undecided` wherever pi already resolves things correctly, so a remembered
+ * decision is never overridden and a headless run keeps whatever `defaultProjectTrust`
+ * says rather than being forced closed.
+ */
+export async function decideTrust(cwd: string, hasUI: boolean, confirm: (title: string, body: string) => Promise<boolean>, deps: TrustDeps = defaultDeps): Promise<TrustDecision> {
+  if (!deps.hasClaudeShaped(cwd)) return { trusted: 'undecided' }
+  if (deps.piWouldAsk(cwd)) return { trusted: 'undecided' } // pi prompts on its own
+  if (deps.savedDecision(cwd) !== null) return { trusted: 'undecided' } // apply the stored answer
+  if (!hasUI) return { trusted: 'undecided' } // cannot ask; leave pi's default in charge
+
+  const approved = await confirm('Trust this project?', `${cwd}\n\nIt ships Claude Code configuration that pi-code loads: MCP servers, hooks and agents can run commands from this repository.`)
+  return { trusted: approved ? 'yes' : 'no', remember: true }
+}
+
+export default function projectTrustExtension(pi: ExtensionAPI) {
+  pi.on('project_trust', async (event, ctx) => decideTrust(event.cwd, ctx.hasUI, (title, body) => ctx.ui.confirm(title, body)))
+}

package/extensions/question.ts

@@ -4,7 +4,7 @@
  * Escape in editor returns to options, Escape in options cancels
  */
 
-import type { ExtensionAPI } from '@earendil-works/pi-coding-agent'
+import type { ExtensionAPI, Theme } from '@earendil-works/pi-coding-agent'
 import { Editor, type EditorTheme, Key, matchesKey, Text, truncateToWidth } from '@earendil-works/pi-tui'
 import { Type } from 'typebox'
 
@@ -33,6 +33,60 @@ const QuestionParams = Type.Object({
   options: Type.Array(OptionSchema, { description: 'Options for the user to choose from' }),
 })
 
+function optionLine(opt: DisplayOption, index: number, selected: boolean, editMode: boolean, theme: Theme): string {
+  const label = `${index + 1}. ${opt.label}`
+  const prefix = selected ? theme.fg('accent', '> ') : '  '
+  if (opt.isOther === true && editMode) {
+    return prefix + theme.fg('accent', `${label} ✎`)
+  }
+  if (selected) {
+    return prefix + theme.fg('accent', label)
+  }
+  return `  ${theme.fg('text', label)}`
+}
+
+interface QuestionView {
+  width: number
+  question: string
+  options: DisplayOption[]
+  optionIndex: number
+  editMode: boolean
+  editor: Editor
+  theme: Theme
+}
+
+function buildQuestionLines(view: QuestionView): string[] {
+  const { width, question, options, optionIndex, editMode, editor, theme } = view
+  const lines: string[] = []
+  const add = (s: string) => lines.push(truncateToWidth(s, width))
+
+  add(theme.fg('accent', '─'.repeat(width)))
+  add(theme.fg('text', ` ${question}`))
+  lines.push('')
+
+  for (let i = 0; i < options.length; i++) {
+    const opt = options[i]
+    add(optionLine(opt, i, i === optionIndex, editMode, theme))
+    if (opt.description) {
+      add(`     ${theme.fg('muted', opt.description)}`)
+    }
+  }
+
+  if (editMode) {
+    lines.push('')
+    add(theme.fg('muted', ' Your answer:'))
+    for (const line of editor.render(width - 2)) {
+      add(` ${line}`)
+    }
+  }
+
+  lines.push('')
+  add(theme.fg('dim', editMode ? ' Enter to submit • Esc to go back' : ' ↑↓ navigate • Enter to select • Esc to cancel'))
+  add(theme.fg('accent', '─'.repeat(width)))
+
+  return lines
+}
+
 export default function question(pi: ExtensionAPI) {
   pi.registerTool({
     name: 'question',
@@ -65,6 +119,7 @@ export default function question(pi: ExtensionAPI) {
         let optionIndex = 0
         let editMode = false
         let cachedLines: string[] | undefined
+        let cachedWidth: number | undefined
 
         const editorTheme: EditorTheme = {
           borderColor: (s) => theme.fg('accent', s),
@@ -135,58 +190,16 @@ export default function question(pi: ExtensionAPI) {
         }
 
         function render(width: number): string[] {
-          if (cachedLines) return cachedLines
-
-          const lines: string[] = []
-          const add = (s: string) => lines.push(truncateToWidth(s, width))
-
-          add(theme.fg('accent', '─'.repeat(width)))
-          add(theme.fg('text', ` ${params.question}`))
-          lines.push('')
-
-          for (let i = 0; i < allOptions.length; i++) {
-            const opt = allOptions[i]
-            const selected = i === optionIndex
-            const isOther = opt.isOther === true
-            const prefix = selected ? theme.fg('accent', '> ') : '  '
-
-            if (isOther && editMode) {
-              add(prefix + theme.fg('accent', `${i + 1}. ${opt.label} ✎`))
-            } else if (selected) {
-              add(prefix + theme.fg('accent', `${i + 1}. ${opt.label}`))
-            } else {
-              add(`  ${theme.fg('text', `${i + 1}. ${opt.label}`)}`)
-            }
-
-            // Show description if present
-            if (opt.description) {
-              add(`     ${theme.fg('muted', opt.description)}`)
-            }
-          }
-
-          if (editMode) {
-            lines.push('')
-            add(theme.fg('muted', ' Your answer:'))
-            for (const line of editor.render(width - 2)) {
-              add(` ${line}`)
-            }
-          }
-
-          lines.push('')
-          if (editMode) {
-            add(theme.fg('dim', ' Enter to submit • Esc to go back'))
-          } else {
-            add(theme.fg('dim', ' ↑↓ navigate • Enter to select • Esc to cancel'))
-          }
-          add(theme.fg('accent', '─'.repeat(width)))
-
-          cachedLines = lines
-          return lines
+          if (cachedLines && cachedWidth === width) return cachedLines
+          cachedWidth = width
+          cachedLines = buildQuestionLines({ width, question: params.question, options: allOptions, optionIndex, editMode, editor, theme })
+          return cachedLines
         }
 
         return {
           render,
           invalidate: () => {
+            cachedWidth = undefined
             cachedLines = undefined
           },
           handleInput,
@@ -231,7 +244,8 @@ export default function question(pi: ExtensionAPI) {
       if (opts.length) {
         const labels = opts.map((o: OptionWithDesc) => o.label)
         const numbered = [...labels, 'Type something.'].map((o, i) => `${i + 1}. ${o}`)
-        text += `\n${theme.fg('dim', `  Options: ${numbered.join(', ')}`)}`
+        const optionsLine = `  Options: ${numbered.join(', ')}`
+        text += `\n${theme.fg('dim', optionsLine)}`
       }
       return new Text(text, 0, 0)
     },

package/extensions/subagent/agents.ts

@@ -111,6 +111,17 @@ function findNearestDir(cwd: string, relative: string): string | null {
   }
 }
 
+function buildAgentMap(userAgents: AgentConfig[], projectAgents: AgentConfig[], scope: AgentScope): Map<string, AgentConfig> {
+  const agentMap = new Map<string, AgentConfig>()
+  const register = (agents: AgentConfig[]): void => {
+    for (const agent of agents) agentMap.set(agent.name, agent)
+  }
+  // user agents first so project agents win on name conflicts
+  if (scope !== 'project') register(userAgents)
+  if (scope !== 'user') register(projectAgents)
+  return agentMap
+}
+
 export function discoverAgents(cwd: string, scope: AgentScope): AgentDiscoveryResult {
   const userDir = path.join(getAgentDir(), 'agents')
   const claudeUserDir = path.join(os.homedir(), '.claude', 'agents')
@@ -122,17 +133,7 @@ export function discoverAgents(cwd: string, scope: AgentScope): AgentDiscoveryRe
   // project .claude/agents loads first so project .pi/agents wins on name conflicts
   const projectAgents = scope === 'user' ? [] : [...(projectClaudeDir ? loadAgentsFromDir(projectClaudeDir, 'project') : []), ...(projectPiDir ? loadAgentsFromDir(projectPiDir, 'project') : [])]
 
-  const agentMap = new Map<string, AgentConfig>()
-
-  if (scope === 'both') {
-    for (const agent of userAgents) agentMap.set(agent.name, agent)
-    for (const agent of projectAgents) agentMap.set(agent.name, agent)
-  } else if (scope === 'user') {
-    for (const agent of userAgents) agentMap.set(agent.name, agent)
-  } else {
-    for (const agent of projectAgents) agentMap.set(agent.name, agent)
-  }
-
+  const agentMap = buildAgentMap(userAgents, projectAgents, scope)
   return { agents: Array.from(agentMap.values()), projectAgentsDir: projectPiDir }
 }