pi-codex-auto-review 0.1.3 → 0.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/NOTICE +4 -2
- package/README.ko.md +85 -0
- package/README.md +51 -52
- package/dist/approval-commands.d.ts +3 -3
- package/dist/approval-commands.js +161 -34
- package/dist/approval-commands.js.map +1 -1
- package/dist/approval-settings.d.ts +1 -1
- package/dist/approval-settings.js +17 -10
- package/dist/approval-settings.js.map +1 -1
- package/dist/approvals.d.ts +10 -9
- package/dist/approvals.js +196 -75
- package/dist/approvals.js.map +1 -1
- package/dist/audit.d.ts +1 -1
- package/dist/audit.js +37 -13
- package/dist/audit.js.map +1 -1
- package/dist/cli.js +63 -34
- package/dist/cli.js.map +1 -1
- package/dist/context-files.d.ts +2 -2
- package/dist/context-files.js +40 -19
- package/dist/context-files.js.map +1 -1
- package/dist/contracts.d.ts +39 -39
- package/dist/contracts.js +117 -51
- package/dist/contracts.js.map +1 -1
- package/dist/index.d.ts +9 -9
- package/dist/index.js +147 -43
- package/dist/index.js.map +1 -1
- package/dist/pi-host.js +3 -3
- package/dist/pi-host.js.map +1 -1
- package/dist/policy/domains.js +17 -7
- package/dist/policy/domains.js.map +1 -1
- package/dist/policy/index.d.ts +7 -7
- package/dist/policy/index.js +382 -139
- package/dist/policy/index.js.map +1 -1
- package/dist/policy/paths.js +31 -18
- package/dist/policy/paths.js.map +1 -1
- package/dist/policy/rule-engine.d.ts +2 -0
- package/dist/policy/rule-engine.js +283 -0
- package/dist/policy/rule-engine.js.map +1 -0
- package/dist/policy/rule-types.d.ts +30 -0
- package/dist/policy/rule-types.js +2 -0
- package/dist/policy/rule-types.js.map +1 -0
- package/dist/policy/rules-sync.d.ts +1 -0
- package/dist/policy/rules-sync.js +14 -0
- package/dist/policy/rules-sync.js.map +1 -0
- package/dist/policy/rules-worker.d.ts +1 -0
- package/dist/policy/rules-worker.js +14 -0
- package/dist/policy/rules-worker.js.map +1 -0
- package/dist/policy/rules.d.ts +4 -31
- package/dist/policy/rules.js +126 -38
- package/dist/policy/rules.js.map +1 -1
- package/dist/policy/shell.js +70 -41
- package/dist/policy/shell.js.map +1 -1
- package/dist/policy/starlark/builtins.d.ts +6 -0
- package/dist/policy/starlark/builtins.js +764 -0
- package/dist/policy/starlark/builtins.js.map +1 -0
- package/dist/policy/starlark/evaluator.d.ts +18 -0
- package/dist/policy/starlark/evaluator.js +518 -0
- package/dist/policy/starlark/evaluator.js.map +1 -0
- package/dist/policy/starlark/lexer.d.ts +14 -0
- package/dist/policy/starlark/lexer.js +189 -0
- package/dist/policy/starlark/lexer.js.map +1 -0
- package/dist/policy/starlark/parser.d.ts +140 -0
- package/dist/policy/starlark/parser.js +508 -0
- package/dist/policy/starlark/parser.js.map +1 -0
- package/dist/policy/starlark/validation.d.ts +4 -0
- package/dist/policy/starlark/validation.js +183 -0
- package/dist/policy/starlark/validation.js.map +1 -0
- package/dist/policy/starlark/values.d.ts +46 -0
- package/dist/policy/starlark/values.js +363 -0
- package/dist/policy/starlark/values.js.map +1 -0
- package/dist/reports.d.ts +1 -1
- package/dist/reports.js +66 -30
- package/dist/reports.js.map +1 -1
- package/dist/review/context.d.ts +16 -3
- package/dist/review/context.js +254 -48
- package/dist/review/context.js.map +1 -1
- package/dist/review/investigation.d.ts +2 -2
- package/dist/review/investigation.js +57 -16
- package/dist/review/investigation.js.map +1 -1
- package/dist/review/lifecycle.d.ts +1 -1
- package/dist/review/lifecycle.js +72 -29
- package/dist/review/lifecycle.js.map +1 -1
- package/dist/review/policy.js +27 -5
- package/dist/review/policy.js.map +1 -1
- package/dist/review/upstream-policy.js +1 -1
- package/dist/review/upstream-policy.js.map +1 -1
- package/dist/review/user-input.d.ts +5 -0
- package/dist/review/user-input.js +54 -0
- package/dist/review/user-input.js.map +1 -0
- package/dist/reviewer.d.ts +16 -6
- package/dist/reviewer.js +258 -70
- package/dist/reviewer.js.map +1 -1
- package/dist/signals.js +24 -9
- package/dist/signals.js.map +1 -1
- package/dist/startup.d.ts +4 -4
- package/dist/startup.js +139 -41
- package/dist/startup.js.map +1 -1
- package/dist/tools/controller.d.ts +19 -13
- package/dist/tools/controller.js +460 -118
- package/dist/tools/controller.js.map +1 -1
- package/dist/tools/environment.d.ts +1 -0
- package/dist/tools/environment.js +5 -0
- package/dist/tools/environment.js.map +1 -1
- package/dist/tools/executor.d.ts +1 -1
- package/dist/tools/executor.js +45 -28
- package/dist/tools/executor.js.map +1 -1
- package/dist/tools/external.d.ts +9 -8
- package/dist/tools/external.js +22 -11
- package/dist/tools/external.js.map +1 -1
- package/dist/tools/mcp.d.ts +6 -6
- package/dist/tools/mcp.js +208 -79
- package/dist/tools/mcp.js.map +1 -1
- package/dist/tools/mutation-queue.js.map +1 -1
- package/docs/publishing.ko.md +114 -0
- package/docs/publishing.md +49 -47
- package/docs/security/dependencies.ko.md +54 -0
- package/docs/security/dependencies.md +27 -26
- package/docs/testing/auto-review-protection.ko.md +158 -0
- package/docs/testing/auto-review-protection.md +105 -97
- package/docs/usage.ko.md +242 -0
- package/docs/usage.md +127 -111
- package/package.json +106 -95
- package/dist/native/darwin-arm64/artifact.json +0 -5
- package/dist/native/darwin-arm64/pi-guard-execpolicy +0 -0
- package/dist/native/linux-x64/artifact.json +0 -5
- package/dist/native/linux-x64/pi-guard-execpolicy +0 -0
- package/native/execpolicy/LICENSE +0 -201
- package/native/execpolicy/NOTICE +0 -6
package/dist/startup.js
CHANGED
|
@@ -1,19 +1,19 @@
|
|
|
1
|
-
import { readFile } from
|
|
2
|
-
import { dirname, join, resolve } from
|
|
3
|
-
import { createAgentSessionRuntime, createAgentSessionServices,
|
|
4
|
-
import {
|
|
5
|
-
import {
|
|
6
|
-
import {
|
|
7
|
-
import {
|
|
8
|
-
import { guardedExternalExtension } from
|
|
1
|
+
import { readFile } from "node:fs/promises";
|
|
2
|
+
import { dirname, join, resolve } from "node:path";
|
|
3
|
+
import { createAgentSessionFromServices, createAgentSessionRuntime, createAgentSessionServices, createCodemodeExtension, ProjectTrustStore, SessionManager, SettingsManager, } from "@earendil-works/pi-coding-agent";
|
|
4
|
+
import { loadContextFiles } from "./context-files.js";
|
|
5
|
+
import { GuardError } from "./contracts.js";
|
|
6
|
+
import { createGuardExtension } from "./index.js";
|
|
7
|
+
import { getPiSDKEntryPath } from "./pi-host.js";
|
|
8
|
+
import { guardedExternalExtension, } from "./tools/mcp.js";
|
|
9
9
|
export async function assertSupportedPi() {
|
|
10
10
|
let path = dirname(getPiSDKEntryPath());
|
|
11
11
|
for (let i = 0; i < 8; i++) {
|
|
12
12
|
try {
|
|
13
|
-
const pkg = JSON.parse(await readFile(join(path,
|
|
14
|
-
if (pkg.name ===
|
|
15
|
-
if (![
|
|
16
|
-
throw new GuardError(
|
|
13
|
+
const pkg = JSON.parse(await readFile(join(path, "package.json"), "utf8"));
|
|
14
|
+
if (pkg.name === "@earendil-works/pi-coding-agent") {
|
|
15
|
+
if (!["0.99.1", "1.0.0"].includes(pkg.version))
|
|
16
|
+
throw new GuardError("UNSUPPORTED_PI", "Pi APIs are not qualified for this version");
|
|
17
17
|
return pkg.version;
|
|
18
18
|
}
|
|
19
19
|
}
|
|
@@ -23,49 +23,128 @@ export async function assertSupportedPi() {
|
|
|
23
23
|
}
|
|
24
24
|
path = dirname(path);
|
|
25
25
|
}
|
|
26
|
-
throw new GuardError(
|
|
26
|
+
throw new GuardError("UNSUPPORTED_PI", "Host Pi version could not be verified");
|
|
27
27
|
}
|
|
28
28
|
export async function createGuardedRuntime(options) {
|
|
29
29
|
await assertSupportedPi();
|
|
30
30
|
if (options.model && options.modelSelection)
|
|
31
|
-
throw new GuardError(
|
|
32
|
-
if (options.isProjectTrusted !== undefined &&
|
|
33
|
-
|
|
31
|
+
throw new GuardError("CONFLICTING_MODEL_SELECTION", "Provide either a model object or a provider/model selection");
|
|
32
|
+
if (options.isProjectTrusted !== undefined &&
|
|
33
|
+
typeof options.isProjectTrusted !== "boolean")
|
|
34
|
+
throw new GuardError("INVALID_PROJECT_TRUST", "Project trust must be an explicit boolean");
|
|
34
35
|
const initialCwd = resolve(options.cwd), agentDir = resolve(options.agentDir);
|
|
35
|
-
const trustedExtensionPaths = (options.trustedExtensionPaths ?? []).map(path => resolve(initialCwd, path));
|
|
36
|
+
const trustedExtensionPaths = (options.trustedExtensionPaths ?? []).map((path) => resolve(initialCwd, path));
|
|
36
37
|
const createRuntime = async (input) => {
|
|
37
|
-
const settingsManager = options.settingsManager ??
|
|
38
|
-
|
|
38
|
+
const settingsManager = options.settingsManager ??
|
|
39
|
+
SettingsManager.create(input.cwd, input.agentDir, {
|
|
40
|
+
projectTrusted: false,
|
|
41
|
+
});
|
|
42
|
+
const explicitTrust = resolve(input.cwd) === initialCwd
|
|
43
|
+
? options.isProjectTrusted
|
|
44
|
+
: undefined;
|
|
39
45
|
if (options.settingsManager) {
|
|
40
|
-
if (explicitTrust !== undefined &&
|
|
41
|
-
|
|
46
|
+
if (explicitTrust !== undefined &&
|
|
47
|
+
settingsManager.isProjectTrusted() !== explicitTrust)
|
|
48
|
+
throw new GuardError("CONFLICTING_PROJECT_TRUST", "Explicit project trust conflicts with the supplied settings manager");
|
|
42
49
|
}
|
|
43
50
|
else {
|
|
44
51
|
const storedTrust = new ProjectTrustStore(input.agentDir).get(input.cwd);
|
|
45
|
-
settingsManager.setProjectTrusted(explicitTrust ??
|
|
52
|
+
settingsManager.setProjectTrusted(explicitTrust ??
|
|
53
|
+
storedTrust ??
|
|
54
|
+
settingsManager.getDefaultProjectTrust() === "always");
|
|
46
55
|
}
|
|
47
|
-
const guard = createGuardExtension({
|
|
56
|
+
const guard = createGuardExtension({
|
|
57
|
+
...options,
|
|
58
|
+
trustedExtensionPaths,
|
|
59
|
+
cwd: input.cwd,
|
|
60
|
+
agentDir: input.agentDir,
|
|
61
|
+
bashOptions: {
|
|
62
|
+
commandPrefix: settingsManager.getShellCommandPrefix(),
|
|
63
|
+
shellPath: settingsManager.getShellPath(),
|
|
64
|
+
...options.bashOptions,
|
|
65
|
+
},
|
|
66
|
+
readOptions: {
|
|
67
|
+
autoResizeImages: settingsManager.getImageAutoResize(),
|
|
68
|
+
...options.readOptions,
|
|
69
|
+
},
|
|
70
|
+
});
|
|
48
71
|
try {
|
|
49
|
-
const external = (options.externalExtensions ?? []).map(extension => guardedExternalExtension(extension, () => guard.assertReady()));
|
|
50
|
-
const services = await createAgentSessionServices({
|
|
51
|
-
|
|
52
|
-
|
|
72
|
+
const external = (options.externalExtensions ?? []).map((extension) => guardedExternalExtension(extension, () => guard.assertReady()));
|
|
73
|
+
const services = await createAgentSessionServices({
|
|
74
|
+
cwd: input.cwd,
|
|
75
|
+
agentDir: input.agentDir,
|
|
76
|
+
modelRuntime: options.modelRuntime,
|
|
77
|
+
settingsManager,
|
|
78
|
+
resourceLoaderOptions: {
|
|
79
|
+
additionalExtensionPaths: trustedExtensionPaths,
|
|
80
|
+
extensionFactories: [
|
|
81
|
+
{
|
|
82
|
+
name: "pi-codex-auto-review",
|
|
83
|
+
factory: guard.factory,
|
|
84
|
+
},
|
|
85
|
+
createCodemodeExtension({ models: false }),
|
|
86
|
+
...external,
|
|
87
|
+
...(options.trustedExtensions ?? []),
|
|
88
|
+
],
|
|
89
|
+
noExtensions: true,
|
|
90
|
+
noContextFiles: true,
|
|
91
|
+
agentsFilesOverride: () => {
|
|
92
|
+
const controller = guard.assertReady();
|
|
93
|
+
return {
|
|
94
|
+
agentsFiles: loadContextFiles({
|
|
95
|
+
cwd: input.cwd,
|
|
96
|
+
agentDir: input.agentDir,
|
|
97
|
+
profile: controller.policy.profile,
|
|
98
|
+
settings: controller.options.settings,
|
|
99
|
+
isProjectTrusted: settingsManager.isProjectTrusted(),
|
|
100
|
+
}),
|
|
101
|
+
};
|
|
102
|
+
},
|
|
103
|
+
},
|
|
104
|
+
});
|
|
53
105
|
const loaded = services.resourceLoader.getExtensions();
|
|
54
|
-
if (loaded.errors.length ||
|
|
55
|
-
|
|
106
|
+
if (loaded.errors.length ||
|
|
107
|
+
services.diagnostics.some((item) => item.type === "error"))
|
|
108
|
+
throw new GuardError("GUARDED_STARTUP_FAILED", "An extension or runtime service failed to load");
|
|
56
109
|
guard.assertReady();
|
|
57
|
-
const selectedModel = options.modelSelection
|
|
110
|
+
const selectedModel = options.modelSelection
|
|
111
|
+
? services.modelRuntime.getModel(options.modelSelection.provider, options.modelSelection.id)
|
|
112
|
+
: options.model;
|
|
58
113
|
if (options.modelSelection && !selectedModel)
|
|
59
|
-
throw new GuardError(
|
|
114
|
+
throw new GuardError("MODEL_UNAVAILABLE", `Registered model not found: ${options.modelSelection.provider}/${options.modelSelection.id}`);
|
|
60
115
|
// A fixed SDK `tools` list is a permanent allowlist and discards later MCP registrations.
|
|
61
116
|
// Local tools still have final execution guards; unknown tools are blocked by the guard hook.
|
|
62
|
-
const result = await createAgentSessionFromServices({
|
|
63
|
-
|
|
117
|
+
const result = await createAgentSessionFromServices({
|
|
118
|
+
services,
|
|
119
|
+
sessionManager: input.sessionManager,
|
|
120
|
+
model: selectedModel,
|
|
121
|
+
sessionStartEvent: input.sessionStartEvent,
|
|
122
|
+
excludeTools: ["powershell"],
|
|
123
|
+
});
|
|
124
|
+
await result.session.bindExtensions({ mode: "print" });
|
|
64
125
|
guard.assertReady();
|
|
65
126
|
const session = result.session;
|
|
66
|
-
session.setActiveToolsByName(session
|
|
127
|
+
session.setActiveToolsByName(session
|
|
128
|
+
.getAllTools()
|
|
129
|
+
.filter((tool) => [
|
|
130
|
+
"read",
|
|
131
|
+
"bash",
|
|
132
|
+
"edit",
|
|
133
|
+
"write",
|
|
134
|
+
"grep",
|
|
135
|
+
"find",
|
|
136
|
+
"ls",
|
|
137
|
+
"codemode",
|
|
138
|
+
...(options.settings?.trustedTools ?? []),
|
|
139
|
+
].includes(tool.name) ||
|
|
140
|
+
guard.assertReady().isExternalTool(tool.name))
|
|
141
|
+
.filter((tool) => ["direct", "model-only"].includes(tool.exposure))
|
|
142
|
+
.map((tool) => tool.name));
|
|
67
143
|
const prompt = session.prompt.bind(session);
|
|
68
|
-
session.prompt = async (...args) => {
|
|
144
|
+
session.prompt = async (...args) => {
|
|
145
|
+
guard.assertReady();
|
|
146
|
+
return prompt(...args);
|
|
147
|
+
};
|
|
69
148
|
const reload = session.reload.bind(session);
|
|
70
149
|
session.reload = async (...args) => {
|
|
71
150
|
await reload(...args);
|
|
@@ -73,17 +152,31 @@ export async function createGuardedRuntime(options) {
|
|
|
73
152
|
// Pi omits session_start after reload when print/SDK mode has no UI or command bindings.
|
|
74
153
|
if (!controller.isBoundToSession(session.sessionManager.getSessionId())) {
|
|
75
154
|
await args[0]?.beforeSessionStart?.();
|
|
76
|
-
await session.extensionRunner.emit({
|
|
155
|
+
await session.extensionRunner.emit({
|
|
156
|
+
type: "session_start",
|
|
157
|
+
reason: "reload",
|
|
158
|
+
});
|
|
77
159
|
}
|
|
78
160
|
guard.assertReady();
|
|
79
161
|
};
|
|
80
162
|
const executeBash = session.executeBash.bind(session);
|
|
81
163
|
session.executeBash = async (command, onChunk, options) => {
|
|
82
164
|
const controller = guard.assertReady();
|
|
83
|
-
const handled = options?.operations
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
165
|
+
const handled = options?.operations
|
|
166
|
+
? { operations: options.operations }
|
|
167
|
+
: await session.extensionRunner.emitUserBash({
|
|
168
|
+
type: "user_bash",
|
|
169
|
+
command,
|
|
170
|
+
cwd: session.sessionManager.getCwd(),
|
|
171
|
+
excludeFromContext: options?.excludeFromContext ?? false,
|
|
172
|
+
});
|
|
173
|
+
if (!handled?.operations ||
|
|
174
|
+
!controller.isGuardedOperations(handled.operations))
|
|
175
|
+
throw new GuardError("UNGUARDED_OPERATIONS", "Protected sessions require guarded shell operations");
|
|
176
|
+
return executeBash(command, onChunk, {
|
|
177
|
+
...options,
|
|
178
|
+
operations: handled.operations,
|
|
179
|
+
});
|
|
87
180
|
};
|
|
88
181
|
return { ...result, services, diagnostics: services.diagnostics };
|
|
89
182
|
}
|
|
@@ -95,6 +188,11 @@ export async function createGuardedRuntime(options) {
|
|
|
95
188
|
throw error;
|
|
96
189
|
}
|
|
97
190
|
};
|
|
98
|
-
return createAgentSessionRuntime(createRuntime, {
|
|
191
|
+
return createAgentSessionRuntime(createRuntime, {
|
|
192
|
+
cwd: initialCwd,
|
|
193
|
+
agentDir,
|
|
194
|
+
sessionManager: options.sessionManager ??
|
|
195
|
+
SessionManager.create(initialCwd, join(agentDir, "sessions")),
|
|
196
|
+
});
|
|
99
197
|
}
|
|
100
198
|
//# sourceMappingURL=startup.js.map
|
package/dist/startup.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"startup.js","sourceRoot":"","sources":["../src/startup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;
|
|
1
|
+
{"version":3,"file":"startup.js","sourceRoot":"","sources":["../src/startup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAEH,8BAA8B,EAC9B,yBAAyB,EACzB,0BAA0B,EAC1B,uBAAuB,EAGvB,iBAAiB,EACjB,cAAc,EACd,eAAe,GAClB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,oBAAoB,EAAqB,MAAM,YAAY,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAEH,wBAAwB,GAC3B,MAAM,gBAAgB,CAAC;AAExB,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACnC,IAAI,IAAI,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACzB,IAAI,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAClB,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CACrD,CAAC;YACF,IAAI,GAAG,CAAC,IAAI,KAAK,iCAAiC,EAAE,CAAC;gBACjD,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;oBAC1C,MAAM,IAAI,UAAU,CAChB,gBAAgB,EAChB,4CAA4C,CAC/C,CAAC;gBACN,OAAO,GAAG,CAAC,OAAiB,CAAC;YACjC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,KAAK,YAAY,UAAU;gBAAE,MAAM,KAAK,CAAC;QACjD,CAAC;QACD,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IACD,MAAM,IAAI,UAAU,CAChB,gBAAgB,EAChB,uCAAuC,CAC1C,CAAC;AACN,CAAC;AAeD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAA8B;IACrE,MAAM,iBAAiB,EAAE,CAAC;IAC1B,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,cAAc;QACvC,MAAM,IAAI,UAAU,CAChB,6BAA6B,EAC7B,6DAA6D,CAChE,CAAC;IACN,IACI,OAAO,CAAC,gBAAgB,KAAK,SAAS;QACtC,OAAO,OAAO,CAAC,gBAAgB,KAAK,SAAS;QAE7C,MAAM,IAAI,UAAU,CAChB,uBAAuB,EACvB,2CAA2C,CAC9C,CAAC;IACN,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EACnC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,qBAAqB,GAAG,CAAC,OAAO,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC,GAAG,CACnE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CACtC,CAAC;IACF,MAAM,aAAa,GAAG,KAAK,EAAE,KAK5B,EAAE,EAAE;QACD,MAAM,eAAe,GACjB,OAAO,CAAC,eAAe;YACvB,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,QAAQ,EAAE;gBAC9C,cAAc,EAAE,KAAK;aACxB,CAAC,CAAC;QACP,MAAM,aAAa,GACf,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,UAAU;YAC7B,CAAC,CAAC,OAAO,CAAC,gBAAgB;YAC1B,CAAC,CAAC,SAAS,CAAC;QACpB,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;YAC1B,IACI,aAAa,KAAK,SAAS;gBAC3B,eAAe,CAAC,gBAAgB,EAAE,KAAK,aAAa;gBAEpD,MAAM,IAAI,UAAU,CAChB,2BAA2B,EAC3B,qEAAqE,CACxE,CAAC;QACV,CAAC;aAAM,CAAC;YACJ,MAAM,WAAW,GAAG,IAAI,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,CACzD,KAAK,CAAC,GAAG,CACZ,CAAC;YACF,eAAe,CAAC,iBAAiB,CAC7B,aAAa;gBACT,WAAW;gBACX,eAAe,CAAC,sBAAsB,EAAE,KAAK,QAAQ,CAC5D,CAAC;QACN,CAAC;QACD,MAAM,KAAK,GAAG,oBAAoB,CAAC;YAC/B,GAAG,OAAO;YACV,qBAAqB;YACrB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE;gBACT,aAAa,EAAE,eAAe,CAAC,qBAAqB,EAAE;gBACtD,SAAS,EAAE,eAAe,CAAC,YAAY,EAAE;gBACzC,GAAG,OAAO,CAAC,WAAW;aACzB;YACD,WAAW,EAAE;gBACT,gBAAgB,EAAE,eAAe,CAAC,kBAAkB,EAAE;gBACtD,GAAG,OAAO,CAAC,WAAW;aACzB;SACJ,CAAC,CAAC;QACH,IAAI,CAAC;YACD,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,GAAG,CACnD,CAAC,SAAS,EAAE,EAAE,CACV,wBAAwB,CAAC,SAAS,EAAE,GAAG,EAAE,CACrC,KAAK,CAAC,WAAW,EAAE,CACtB,CACR,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAAC;gBAC9C,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,eAAe;gBACf,qBAAqB,EAAE;oBACnB,wBAAwB,EAAE,qBAAqB;oBAC/C,kBAAkB,EAAE;wBAChB;4BACI,IAAI,EAAE,sBAAsB;4BAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;yBACzB;wBACD,uBAAuB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;wBAC1C,GAAG,QAAQ;wBACX,GAAG,CAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC;qBACvC;oBACD,YAAY,EAAE,IAAI;oBAClB,cAAc,EAAE,IAAI;oBACpB,mBAAmB,EAAE,GAAG,EAAE;wBACtB,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;wBACvC,OAAO;4BACH,WAAW,EAAE,gBAAgB,CAAC;gCAC1B,GAAG,EAAE,KAAK,CAAC,GAAG;gCACd,QAAQ,EAAE,KAAK,CAAC,QAAQ;gCACxB,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,OAAO;gCAClC,QAAQ,EAAE,UAAU,CAAC,OAAO,CAAC,QAAQ;gCACrC,gBAAgB,EACZ,eAAe,CAAC,gBAAgB,EAAE;6BACzC,CAAC;yBACL,CAAC;oBACN,CAAC;iBACJ;aACJ,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,QAAQ,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;YACvD,IACI,MAAM,CAAC,MAAM,CAAC,MAAM;gBACpB,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC;gBAE1D,MAAM,IAAI,UAAU,CAChB,wBAAwB,EACxB,gDAAgD,CACnD,CAAC;YACN,KAAK,CAAC,WAAW,EAAE,CAAC;YACpB,MAAM,aAAa,GAAG,OAAO,CAAC,cAAc;gBACxC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAC1B,OAAO,CAAC,cAAc,CAAC,QAAQ,EAC/B,OAAO,CAAC,cAAc,CAAC,EAAE,CAC5B;gBACH,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;YACpB,IAAI,OAAO,CAAC,cAAc,IAAI,CAAC,aAAa;gBACxC,MAAM,IAAI,UAAU,CAChB,mBAAmB,EACnB,+BAA+B,OAAO,CAAC,cAAc,CAAC,QAAQ,IAAI,OAAO,CAAC,cAAc,CAAC,EAAE,EAAE,CAChG,CAAC;YACN,0FAA0F;YAC1F,8FAA8F;YAC9F,MAAM,MAAM,GAAG,MAAM,8BAA8B,CAAC;gBAChD,QAAQ;gBACR,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,KAAK,EAAE,aAAa;gBACpB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBAC1C,YAAY,EAAE,CAAC,YAAY,CAAC;aAC/B,CAAC,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YACvD,KAAK,CAAC,WAAW,EAAE,CAAC;YACpB,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;YAC/B,OAAO,CAAC,oBAAoB,CACxB,OAAO;iBACF,WAAW,EAAE;iBACb,MAAM,CACH,CAAC,IAAI,EAAE,EAAE,CACL;gBACI,MAAM;gBACN,MAAM;gBACN,MAAM;gBACN,OAAO;gBACP,MAAM;gBACN,MAAM;gBACN,IAAI;gBACJ,UAAU;gBACV,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,YAAY,IAAI,EAAE,CAAC;aAC5C,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;gBACrB,KAAK,CAAC,WAAW,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CACpD;iBACA,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACb,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CACnD;iBACA,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAChC,CAAC;YACF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC5C,OAAO,CAAC,MAAM,GAAG,KAAK,EAAE,GAAG,IAAI,EAAE,EAAE;gBAC/B,KAAK,CAAC,WAAW,EAAE,CAAC;gBACpB,OAAO,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;YAC3B,CAAC,CAAC;YACF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC5C,OAAO,CAAC,MAAM,GAAG,KAAK,EAAE,GAAG,IAAI,EAAE,EAAE;gBAC/B,MAAM,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;gBACtB,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;gBACvC,yFAAyF;gBACzF,IACI,CAAC,UAAU,CAAC,gBAAgB,CACxB,OAAO,CAAC,cAAc,CAAC,YAAY,EAAE,CACxC,EACH,CAAC;oBACC,MAAM,IAAI,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,EAAE,CAAC;oBACtC,MAAM,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC;wBAC/B,IAAI,EAAE,eAAe;wBACrB,MAAM,EAAE,QAAQ;qBACnB,CAAC,CAAC;gBACP,CAAC;gBACD,KAAK,CAAC,WAAW,EAAE,CAAC;YACxB,CAAC,CAAC;YACF,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACtD,OAAO,CAAC,WAAW,GAAG,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;gBACtD,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;gBACvC,MAAM,OAAO,GAAG,OAAO,EAAE,UAAU;oBAC/B,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE;oBACpC,CAAC,CAAC,MAAM,OAAO,CAAC,eAAe,CAAC,YAAY,CAAC;wBACvC,IAAI,EAAE,WAAW;wBACjB,OAAO;wBACP,GAAG,EAAE,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE;wBACpC,kBAAkB,EACd,OAAO,EAAE,kBAAkB,IAAI,KAAK;qBAC3C,CAAC,CAAC;gBACT,IACI,CAAC,OAAO,EAAE,UAAU;oBACpB,CAAC,UAAU,CAAC,mBAAmB,CAAC,OAAO,CAAC,UAAU,CAAC;oBAEnD,MAAM,IAAI,UAAU,CAChB,sBAAsB,EACtB,qDAAqD,CACxD,CAAC;gBACN,OAAO,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE;oBACjC,GAAG,OAAO;oBACV,UAAU,EAAE,OAAO,CAAC,UAAU;iBACjC,CAAC,CAAC;YACP,CAAC,CAAC;YACF,OAAO,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC;QACtE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,CAAC;gBACD,MAAM,KAAK,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,CAAC;YACtC,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;YACV,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC,CAAC;IACF,OAAO,yBAAyB,CAAC,aAAa,EAAE;QAC5C,GAAG,EAAE,UAAU;QACf,QAAQ;QACR,cAAc,EACV,OAAO,CAAC,cAAc;YACtB,cAAc,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;KACpE,CAAC,CAAC;AACP,CAAC"}
|
|
@@ -1,12 +1,13 @@
|
|
|
1
|
-
import { type
|
|
2
|
-
import
|
|
3
|
-
import {
|
|
4
|
-
import {
|
|
5
|
-
import { type
|
|
6
|
-
import {
|
|
7
|
-
import type
|
|
8
|
-
import {
|
|
9
|
-
import { type ExternalToolIdentity } from
|
|
1
|
+
import { type BashOperations, type BashToolOptions, type ExtensionContext, type ReadToolOptions, type ToolCallEvent, type ToolDefinition } from "@earendil-works/pi-coding-agent";
|
|
2
|
+
import type { ApprovalManager } from "../approvals.js";
|
|
3
|
+
import { type AuditLog } from "../audit.js";
|
|
4
|
+
import { type GuardAction, type Json, type PermissionProfile, type ReviewContextItem } from "../contracts.js";
|
|
5
|
+
import { type GuardSettings, PolicyEngine } from "../policy/index.js";
|
|
6
|
+
import { ReviewContextStore } from "../review/context.js";
|
|
7
|
+
import { type ReviewProvider } from "../reviewer.js";
|
|
8
|
+
import type { ToolExecutor } from "./executor.js";
|
|
9
|
+
import { type ExternalToolIdentity } from "./external.js";
|
|
10
|
+
type ToolSchema = ToolDefinition["parameters"];
|
|
10
11
|
export declare class GuardController {
|
|
11
12
|
readonly options: {
|
|
12
13
|
profile: PermissionProfile;
|
|
@@ -16,6 +17,7 @@ export declare class GuardController {
|
|
|
16
17
|
audit: AuditLog;
|
|
17
18
|
provider?: ReviewProvider;
|
|
18
19
|
shellPath?: string;
|
|
20
|
+
persistContext?: (item: ReviewContextItem) => void;
|
|
19
21
|
};
|
|
20
22
|
private currentPolicy;
|
|
21
23
|
get policy(): PolicyEngine;
|
|
@@ -38,13 +40,14 @@ export declare class GuardController {
|
|
|
38
40
|
audit: AuditLog;
|
|
39
41
|
provider?: ReviewProvider;
|
|
40
42
|
shellPath?: string;
|
|
43
|
+
persistContext?: (item: ReviewContextItem) => void;
|
|
41
44
|
});
|
|
42
45
|
initialize(cwd: string): Promise<void>;
|
|
43
46
|
updateSettings(select: (current: GuardSettings) => GuardSettings, cwd: string, persist: (settings: GuardSettings) => Promise<void>): Promise<void>;
|
|
44
47
|
assertReady(): void;
|
|
45
48
|
isBoundToSession(sessionId: string): boolean;
|
|
46
|
-
reset(sessionId: string, manager?: ExtensionContext[
|
|
47
|
-
startTurn(): void;
|
|
49
|
+
reset(sessionId: string, manager?: ExtensionContext["sessionManager"]): void;
|
|
50
|
+
startTurn(context?: ExtensionContext): void;
|
|
48
51
|
authorizeRetry(id: string, context: ExtensionContext): Promise<{
|
|
49
52
|
denial: import("../contracts.js").RecentDenial;
|
|
50
53
|
args: Readonly<Record<string, Json>>;
|
|
@@ -58,9 +61,12 @@ export declare class GuardController {
|
|
|
58
61
|
private requestAdmission;
|
|
59
62
|
private denied;
|
|
60
63
|
isExternalTool(name: string): boolean;
|
|
61
|
-
wrapExternalTool(definition: ToolDefinition<
|
|
64
|
+
wrapExternalTool<TParameters extends ToolSchema, TDetails, TState>(definition: ToolDefinition<TParameters, TDetails, TState>, identify: () => ExternalToolIdentity): ToolDefinition<TParameters, TDetails, TState>;
|
|
62
65
|
private admitAndExecute;
|
|
63
|
-
wrapTool
|
|
66
|
+
wrapTool<TParameters extends ToolSchema & {
|
|
67
|
+
properties: Record<string, ToolSchema>;
|
|
68
|
+
}, TDetails, TState>(definition: ToolDefinition<TParameters, TDetails, TState>, toolOptions?: ReadToolOptions | BashToolOptions): ToolDefinition<TParameters, TDetails, TState>;
|
|
64
69
|
userBashOperations(context: ExtensionContext, trustedCommand?: string): BashOperations;
|
|
65
70
|
isGuardedOperations(operations: BashOperations): boolean;
|
|
66
71
|
}
|
|
72
|
+
export {};
|