pi-code 0.2.0 → 0.2.1

package/extensions/hooks.ts

@@ -27,6 +27,8 @@ import * as os from 'node:os'
 import * as path from 'node:path'
 import type { ExtensionAPI } from '@earendil-works/pi-coding-agent'
 
+import { isProjectApproved } from './project-approval.js'
+
 const DEFAULT_TIMEOUT_S = 60
 
 interface HookCommand {
@@ -159,7 +161,7 @@ export default function hooksExtension(pi: ExtensionAPI) {
   let config: HooksConfig = {}
 
   pi.on('session_start', async (event, ctx) => {
-    const trusted = ctx.isProjectTrusted?.() ?? false
+    const trusted = await isProjectApproved(ctx)
     config = loadHooks(hookFiles(ctx.cwd, os.homedir(), trusted))
     // Only fire SessionStart hooks on a genuine session begin, matched by source (Claude uses
     // "startup"/"resume"/...). "reload" and "fork" re-fire in-process and would double-run hooks.

package/extensions/mcp.ts

@@ -24,10 +24,11 @@ import { SSEClientTransport } from '@modelcontextprotocol/sdk/client/sse.js' //
 import { getDefaultEnvironment, StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js'
 import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js'
 import { Type } from 'typebox'
+import { capForContext } from './output-guard.js'
+import { isProjectApproved } from './project-approval.js'
 
 const CONNECT_TIMEOUT_MS = 10_000
 const CALL_TIMEOUT_MS = 120_000
-const MAX_INLINE_RESULT = 50_000
 // Tool names an MCP server must never take over. formatToolName always emits
 // `<server>_<tool>`, so only names containing an underscore are actually reachable:
 // pi's own built-ins (read, bash, edit, ...) cannot be produced and are not listed.
@@ -114,8 +115,7 @@ export function mapContent(content: McpContentBlock[] | undefined, structured?:
   }
   return content.map((block) => {
     if (block.type === 'text') {
-      const text = block.text ?? ''
-      return text.length > MAX_INLINE_RESULT ? { type: 'text', text: `${text.slice(0, MAX_INLINE_RESULT)}\n[truncated ${text.length - MAX_INLINE_RESULT} chars]` } : { type: 'text', text }
+      return { type: 'text', text: capForContext(block.text ?? '') }
     }
     if (block.type === 'image' && block.data) {
       return { type: 'image', data: block.data, mimeType: block.mimeType ?? 'image/png' }
@@ -249,7 +249,8 @@ export default async function mcpExtension(pi: ExtensionAPI) {
       await connectServers(loadConfigFrom(userConfigPaths(os.homedir())))
     }
     // A project .mcp.json can run arbitrary commands on connect, so only honor it once the project is trusted.
-    if (!projectConnected && ctx.isProjectTrusted?.()) {
+    // isProjectTrusted alone is true for a repo pi never asked about; see project-approval.
+    if (!projectConnected && (await isProjectApproved(ctx))) {
       projectConnected = true
       await connectServers(loadConfigFrom(projectConfigPaths(ctx.cwd)))
     }

package/extensions/memory.ts

@@ -11,8 +11,9 @@ import * as fs from 'node:fs'
 import * as os from 'node:os'
 import * as path from 'node:path'
 import { StringEnum } from '@earendil-works/pi-ai'
-import { DEFAULT_MAX_BYTES, DEFAULT_MAX_LINES, type ExtensionAPI, formatSize, truncateHead } from '@earendil-works/pi-coding-agent'
+import type { ExtensionAPI } from '@earendil-works/pi-coding-agent'
 import { Type } from 'typebox'
+import { capForContext } from './output-guard.js'
 
 const INDEX_FILE = 'MEMORY.md'
 
@@ -63,17 +64,6 @@ function readIndex(dir: string): string {
   }
 }
 
-/**
- * Keep a memory inside pi's context budget. truncateHead keeps whole lines, so a
- * single oversized line yields nothing; fall back to a hard slice in that case.
- */
-function capForContext(body: string): string {
-  const cut = truncateHead(body, { maxLines: DEFAULT_MAX_LINES, maxBytes: DEFAULT_MAX_BYTES })
-  if (!cut.truncated) return body
-  const kept = cut.content || body.slice(0, DEFAULT_MAX_BYTES)
-  return `${kept}\n\n[truncated: ${formatSize(cut.totalBytes)} total]`
-}
-
 export default function memoryExtension(pi: ExtensionAPI) {
   let dir = memoryDir(process.cwd())
 

package/extensions/output-guard.ts

@@ -0,0 +1,23 @@
+/**
+ * Output Guard
+ *
+ * pi requires every tool to truncate its output, at 50KB or 2000 lines, whichever is hit
+ * first (docs/extensions.md, "Tool output"). Each tool used to decide that for itself, so
+ * the budgets and the truncation notices diverged and a byte-only cap let thousands of
+ * short lines through. This is the single place that decision lives.
+ *
+ * `truncateHead` keeps whole lines, which means a single line over the budget yields no
+ * content at all. That trap is handled here once rather than at each call site.
+ */
+
+import { DEFAULT_MAX_BYTES, DEFAULT_MAX_LINES, formatSize, truncateHead } from '@earendil-works/pi-coding-agent'
+
+/** Trim `text` to pi's documented tool-output budget, noting what was dropped. */
+export function capForContext(text: string): string {
+  const cut = truncateHead(text, { maxLines: DEFAULT_MAX_LINES, maxBytes: DEFAULT_MAX_BYTES })
+  if (!cut.truncated) return text
+  const kept = cut.content || text.slice(0, DEFAULT_MAX_BYTES)
+  const capped = `${kept}\n\n[truncated: ${formatSize(cut.totalBytes)} total, ${cut.totalLines} lines]`
+  // Just over the budget, the notice can cost more than the trim saves.
+  return capped.length < text.length ? capped : text
+}

package/extensions/plan-mode/utils.ts

@@ -94,9 +94,54 @@ const SAFE_PATTERNS = [
 // outright rather than parsed.
 const SUBSTITUTION = /\$\(|`|<\(|>\(/
 
-// Claude Code's separator set (code.claude.com/docs/en/permissions): every subcommand
-// must qualify on its own, otherwise an allowlisted first token buys the rest of the line.
-const SEPARATORS = /\|\||&&|\|&|[;|&\n]/
+/**
+ * Split on the shell separators Claude Code documents (`&&`, `||`, `;`, `|`, `|&`, `&`,
+ * newline) so every subcommand is checked on its own, ignoring separators inside quotes:
+ * `grep 'a|b'` is one read, not a pipe. Returns nothing on an unbalanced quote, which
+ * fails the caller closed rather than guessing at the intended split.
+ *
+ * A shell AST would be exact; this is the honest approximation for a quoting-only concern.
+ */
+function splitSegments(command: string): string[] {
+  const segments: string[] = []
+  let current = ''
+  let quote: "'" | '"' | undefined
+
+  for (let i = 0; i < command.length; i++) {
+    const ch = command[i]
+    if (quote !== undefined) {
+      current += ch
+      if (ch === quote) quote = undefined
+      continue
+    }
+    if (ch === "'" || ch === '"') {
+      quote = ch
+      current += ch
+      continue
+    }
+    if (ch === '\\' && i + 1 < command.length) {
+      current += ch + command[++i]
+      continue
+    }
+    const pair = command.slice(i, i + 2)
+    if (pair === '&&' || pair === '||' || pair === '|&') {
+      segments.push(current)
+      current = ''
+      i++
+      continue
+    }
+    if (ch === ';' || ch === '|' || ch === '&' || ch === '\n') {
+      segments.push(current)
+      current = ''
+      continue
+    }
+    current += ch
+  }
+
+  if (quote !== undefined) return []
+  segments.push(current)
+  return segments.map((segment) => segment.trim()).filter(Boolean)
+}
 
 // find is allowlisted for traversal only; these actions run commands or delete.
 const FIND_ACTIONS = /\s-(exec|execdir|ok|okdir|delete|fls|fprint|fprintf)\b/
@@ -116,10 +161,7 @@ function isSafeSegment(segment: string): boolean {
  */
 export function isSafeCommand(command: string): boolean {
   if (SUBSTITUTION.test(command)) return false
-  const segments = command
-    .split(SEPARATORS)
-    .map((s) => s.trim())
-    .filter(Boolean)
+  const segments = splitSegments(command)
   return segments.length > 0 && segments.every(isSafeSegment)
 }
 

package/extensions/project-approval.ts

@@ -0,0 +1,73 @@
+/**
+ * Project Approval
+ *
+ * `ctx.isProjectTrusted()` is not sufficient on its own. pi decides whether to ask for
+ * trust in `hasTrustRequiringProjectResources`, which looks only under `cwd/.pi` and for
+ * `.agents/skills`. A repository shipping just `.claude/` and `.mcp.json` matches neither,
+ * so `resolveProjectTrusted` short-circuits to `true` before it ever emits `project_trust`:
+ *
+ *     if (!hasTrustRequiringProjectResources(cwd)) return true
+ *     if (extensionsResult) { ...emitProjectTrustEvent... }
+ *
+ * A `project_trust` handler therefore cannot cover this case; the event only fires for
+ * projects pi was already going to prompt about. The decision has to be made where the
+ * project config is consumed instead, which is what this module does.
+ *
+ * Answers are stored in pi's own trust store, so approving here also satisfies pi if the
+ * project later grows `.pi` resources, and a decision recorded on a parent directory applies.
+ */
+
+import * as fs from 'node:fs'
+import * as path from 'node:path'
+import { getAgentDir, hasTrustRequiringProjectResources, ProjectTrustStore } from '@earendil-works/pi-coding-agent'
+
+/** Project files pi-code acts on that pi's own trust check does not look for. */
+const CLAUDE_SHAPED = [path.join('.claude', 'settings.json'), path.join('.claude', 'settings.local.json'), path.join('.claude', 'agents'), path.join('.claude', 'hooks'), path.join('.claude', 'output-styles'), '.mcp.json', path.join('.pi', 'mcp.json'), path.join('.pi', 'agents')]
+
+export function hasClaudeShapedConfig(cwd: string): boolean {
+  return CLAUDE_SHAPED.some((entry) => fs.existsSync(path.join(cwd, entry)))
+}
+
+export interface ApprovalContext {
+  cwd: string
+  hasUI: boolean
+  isProjectTrusted?: () => boolean
+  ui: { confirm: (title: string, body: string) => Promise<boolean> }
+}
+
+export interface ApprovalDeps {
+  hasClaudeShaped: (cwd: string) => boolean
+  piWouldAsk: (cwd: string) => boolean
+  savedDecision: (cwd: string) => boolean | null
+  remember: (cwd: string, trusted: boolean) => void
+}
+
+const defaultDeps: ApprovalDeps = {
+  hasClaudeShaped: hasClaudeShapedConfig,
+  piWouldAsk: hasTrustRequiringProjectResources,
+  savedDecision: (cwd) => new ProjectTrustStore(getAgentDir()).get(cwd),
+  remember: (cwd, trusted) => new ProjectTrustStore(getAgentDir()).set(cwd, trusted),
+}
+
+const APPROVAL_BODY = 'It ships Claude Code configuration that pi-code loads. MCP servers, hooks and agents can run commands from this repository.'
+
+/**
+ * Whether project-controlled config may be acted on.
+ *
+ * Refuses without a UI rather than deferring: pi reached this point without consulting
+ * `defaultProjectTrust` at all, so there is no user preference to fall back on. A run
+ * that cannot ask has not been approved.
+ */
+export async function isProjectApproved(ctx: ApprovalContext, deps: ApprovalDeps = defaultDeps): Promise<boolean> {
+  if (ctx.isProjectTrusted?.() !== true) return false // pi already declined, or never trusted
+  if (!deps.hasClaudeShaped(ctx.cwd)) return true // nothing here pi's own check would miss
+  if (deps.piWouldAsk(ctx.cwd)) return true // pi genuinely prompted for this project
+
+  const stored = deps.savedDecision(ctx.cwd)
+  if (stored !== null) return stored
+  if (!ctx.hasUI) return false
+
+  const approved = await ctx.ui.confirm('Trust this project?', `${ctx.cwd}\n\n${APPROVAL_BODY}`)
+  deps.remember(ctx.cwd, approved)
+  return approved
+}

package/extensions/subagent/index.ts

@@ -22,6 +22,7 @@ import { StringEnum } from '@earendil-works/pi-ai'
 import { type ExtensionAPI, type ExtensionContext, getMarkdownTheme, type Theme, withFileMutationQueue } from '@earendil-works/pi-coding-agent'
 import { Container, Markdown, Spacer, Text } from '@earendil-works/pi-tui'
 import { type Static, Type } from 'typebox'
+import { isProjectApproved } from '../project-approval.js'
 import { type AgentConfig, type AgentScope, discoverAgents } from './agents.js'
 import { backgroundStatusText, startBackgroundRun } from './background.js'
 
@@ -484,7 +485,9 @@ async function checkProjectAgentGate(params: SubagentParamsStatic, agents: Agent
   for (const t of params.tasks ?? []) requestedAgentNames.add(t.agent)
   const requestedProjectAgents = [...requestedAgentNames].map((name) => agents.find((a) => a.name === name)).filter((a): a is AgentConfig => a?.source === 'project')
 
-  const gate = projectAgentGate(requestedProjectAgents.length, ctx.isProjectTrusted?.() ?? false, ctx.hasUI, params.confirmProjectAgents ?? true)
+  // isProjectTrusted alone is true for a repo pi never asked about; see project-approval.
+  const approved = await isProjectApproved(ctx)
+  const gate = projectAgentGate(requestedProjectAgents.length, approved, ctx.hasUI, params.confirmProjectAgents ?? true)
   const names = requestedProjectAgents.map((a) => a.name).join(', ')
   if (gate === 'refuse') {
     return { content: [{ type: 'text', text: `Project-local agents (${names}) require a trusted project; refusing in non-interactive mode.` }], details: makeDetails(gateMode)([]) }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-code",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Claude Code experience for the pi coding agent: reads your .claude config (rules, commands, skills, hooks, output styles, MCP servers, agents) and adds todo, checkpoints, memory, web, and subagents",
   "keywords": [
     "pi-package"

package/extensions/project-trust.ts

@@ -1,65 +0,0 @@
-/**
- * Project Trust Extension
- *
- * pi decides whether to prompt for trust from `hasTrustRequiringProjectResources`,
- * which looks only at entries under `cwd/.pi` and at `.agents/skills`. A repository
- * that ships only Claude Code shaped config, `.claude/` plus `.mcp.json`, matches
- * none of them, so pi trusts it without asking.
- *
- * That is exactly the shape pi-code exists to load, and the other extensions gate
- * their project input on `ctx.isProjectTrusted()`. Without this handler that flag is
- * true for a freshly cloned repo nobody was asked about, and a project `.mcp.json`
- * server command, project hooks and project agents all run.
- *
- * Only user/global and CLI extensions receive `project_trust`, so this works when
- * pi-code is installed with `pi install npm:pi-code`. A project-local install
- * (`pi install -l`) is not loaded until trust is already resolved.
- *
- * Docs: node_modules/@earendil-works/pi-coding-agent/docs/extensions.md (project_trust)
- */
-
-import * as fs from 'node:fs'
-import * as path from 'node:path'
-import { type ExtensionAPI, getAgentDir, hasTrustRequiringProjectResources, ProjectTrustStore } from '@earendil-works/pi-coding-agent'
-
-/** Project files pi-code acts on that pi's own trust check does not look for. */
-const CLAUDE_SHAPED = [path.join('.claude', 'settings.json'), path.join('.claude', 'settings.local.json'), path.join('.claude', 'agents'), path.join('.claude', 'hooks'), path.join('.claude', 'output-styles'), '.mcp.json', path.join('.pi', 'mcp.json'), path.join('.pi', 'agents')]
-
-export function hasClaudeShapedConfig(cwd: string): boolean {
-  return CLAUDE_SHAPED.some((entry) => fs.existsSync(path.join(cwd, entry)))
-}
-
-export type TrustDecision = { trusted: 'yes' | 'no' | 'undecided'; remember?: boolean }
-
-interface TrustDeps {
-  hasClaudeShaped: (cwd: string) => boolean
-  piWouldAsk: (cwd: string) => boolean
-  savedDecision: (cwd: string) => boolean | null
-}
-
-const defaultDeps: TrustDeps = {
-  hasClaudeShaped: hasClaudeShapedConfig,
-  piWouldAsk: hasTrustRequiringProjectResources,
-  savedDecision: (cwd) => new ProjectTrustStore(getAgentDir()).get(cwd),
-}
-
-/**
- * Whether to take over the trust decision for this project.
- *
- * Returns `undecided` wherever pi already resolves things correctly, so a remembered
- * decision is never overridden and a headless run keeps whatever `defaultProjectTrust`
- * says rather than being forced closed.
- */
-export async function decideTrust(cwd: string, hasUI: boolean, confirm: (title: string, body: string) => Promise<boolean>, deps: TrustDeps = defaultDeps): Promise<TrustDecision> {
-  if (!deps.hasClaudeShaped(cwd)) return { trusted: 'undecided' }
-  if (deps.piWouldAsk(cwd)) return { trusted: 'undecided' } // pi prompts on its own
-  if (deps.savedDecision(cwd) !== null) return { trusted: 'undecided' } // apply the stored answer
-  if (!hasUI) return { trusted: 'undecided' } // cannot ask; leave pi's default in charge
-
-  const approved = await confirm('Trust this project?', `${cwd}\n\nIt ships Claude Code configuration that pi-code loads: MCP servers, hooks and agents can run commands from this repository.`)
-  return { trusted: approved ? 'yes' : 'no', remember: true }
-}
-
-export default function projectTrustExtension(pi: ExtensionAPI) {
-  pi.on('project_trust', async (event, ctx) => decideTrust(event.cwd, ctx.hasUI, (title, body) => ctx.ui.confirm(title, body)))
-}