pi-daddy 0.27.4 → 0.32.0

package/extensions/work-session.ts

@@ -1,132 +0,0 @@
-import { randomUUID, createHash } from "node:crypto";
-import { join } from "node:path";
-import type { ExtensionCommandContext } from "@earendil-works/pi-coding-agent";
-import { supportedModelEfforts as getSupportedThinkingLevels } from "../src/model-preflight.ts";
-import { workSetup, recordWorkSetup, selectRecordedWork, loadWorkSetup, listWorkSetups, type WorkSetup, type WorkTaskSetup } from "../src/work-setup.ts";
-import { loadDeclaredWork } from "../src/work-command.ts";
-import { intentKey } from "../src/intent-control.ts";
-import { ordinaryChildrenFor } from "../src/ordinary-children.ts";
-import { inspectWorkRun, type WorkRunInitial, type WorkRunResult } from "../src/work-run.ts";
-import type { ControlBinding } from "../src/control-journal.ts";
-import { readProductJson } from "../src/product-files.ts";
-import { dashboardActionFeedback } from "../src/dashboard-cli.ts";
-import { runSelectedWork, showWorkResults } from "./work-run-session.ts";
-import type { GrantsSession } from "./session.ts";
-import type { createDailyDashboardSession } from "./daily-dashboard-session.ts";
-
-const cancelled = () => Error("Work setup cancelled; nothing selected or launched");
-async function ask(ctx: ExtensionCommandContext, title: string, initial = ""): Promise<string> {
-  const value = await ctx.ui.editor(title, initial); if (!value?.trim()) throw cancelled(); return value.trim();
-}
-async function profile(ctx: ExtensionCommandContext, session: GrantsSession, previous?: WorkTaskSetup) {
-  const agents = ["No tools (text-only)", ...session.definitions.keys()];
-  const agent = await ctx.ui.select("Agent definition — existing grants still apply", agents);
-  if (!agent) throw cancelled();
-  const available = ctx.scopedModels?.length ? ctx.scopedModels.map(entry => entry.model) : ctx.modelRegistry.getAvailable();
-  if(!available.length)throw Error("No available Pi models. Configure a model in Pi, then reopen work setup; no fallback is chosen.");
-  const labels = available.map(model => `${model.provider}/${model.id}`);
-  const selected = await ctx.ui.select("Model — no silent fallback", labels);
-  const model = available[labels.indexOf(selected ?? "")]; if (!model) throw cancelled();
-  const thinking = await ctx.ui.select("Requested effort (not proof of provider-internal reasoning)", getSupportedThinkingLevels(model));
-  if (!thinking) throw cancelled();
-  return { agent: agent === agents[0] ? null : agent, model: `${model.provider}/${model.id}`, thinking: thinking as WorkTaskSetup["thinking"] };
-}
-async function author(ctx: ExtensionCommandContext, session: GrantsSession): Promise<WorkSetup> {
-  const outcome = await ask(ctx, "What outcome should this work produce?");
-  const tasks: WorkTaskSetup[] = [];
-  do {
-    const outcome = await ask(ctx, `Task ${tasks.length + 1}: outcome / instructions`);
-    const selected = await profile(ctx, session);
-    const dependencies: string[] = [];
-    while (tasks.length) {
-      const candidates = tasks.filter(t => !dependencies.includes(t.id));
-      const labels = ["Dependencies complete", ...candidates.map((t, i) => `${i + 1}. ${t.outcome}`)];
-      const choice = await ctx.ui.select("Wait for which prior tasks? Failed dependencies block only their branch", labels);
-      if (!choice) throw cancelled(); if (choice === labels[0]) break;
-      dependencies.push(candidates[labels.indexOf(choice) - 1].id);
-    }
-    tasks.push({ id: `task${tasks.length + 1}`, outcome, ...selected, dependencies });
-  } while (tasks.length < 8 && await ctx.ui.confirm("Add another task?", "Independent tasks can run in parallel; dependent tasks receive predecessor results."));
-  const width = await ctx.ui.select("Maximum parallel agents", Array.from({ length: tasks.length }, (_, i) => String(i + 1)));
-  if (!width) throw cancelled();
-  return workSetup({ version: "work-setup-v1", id: `work-${randomUUID().slice(0, 8)}`, outcome, tasks, maxParallel: Number(width) });
-}
-async function revise(ctx: ExtensionCommandContext, session: GrantsSession, previous: WorkSetup): Promise<WorkSetup> {
-  const setup = structuredClone(previous);
-  while (true) {
-    const labels = ["Save revision", "Overall outcome", "Parallel limit", ...setup.tasks.map((t,i) => `${i+1}. ${t.outcome}`)];
-    const choice = await ctx.ui.select("Revise scope/configuration (topology and permissions stay fixed)", labels);
-    if (!choice) throw cancelled();
-    const index = labels.indexOf(choice);
-    if (index === 0) return workSetup(setup);
-    if (index === 1) setup.outcome = await ask(ctx, "Revised outcome", setup.outcome);
-    else if (index === 2) { const width = await ctx.ui.select("Parallel limit", Array.from({ length: setup.tasks.length }, (_, i) => String(i + 1))); if (!width) throw cancelled(); setup.maxParallel = Number(width); }
-    else { const task = setup.tasks[index - 3]; task.outcome = await ask(ctx, "Task outcome", task.outcome); Object.assign(task, await profile(ctx, session, task)); }
-  }
-}
-
-export function createWorkSession(session: GrantsSession, host: ReturnType<typeof createDailyDashboardSession>, rebind: () => void) {
-  let pending: Promise<void> | null = null, owned: Promise<WorkRunResult> | null = null;
-  const shutdown = new AbortController();
-  const run = async (verb: string, ctx: ExtensionCommandContext) => {
-    if (!ctx.hasUI) throw Error("Use /grants work in interactive Pi for setup and explicit run confirmation");
-    const current = await loadDeclaredWork(join(ctx.cwd, ".pi", "work-current.json"));
-    if (current) { session.declaredWork = current; rebind(); }
-    const selected = current ? await loadWorkSetup(current) : null;
-    const menu = ["Run selected work", "Declare new work", "Revise scope / configuration", "Record alternative", "Select saved work", "Select task for ordinary delegation", "Change priority", "Inspect results"];
-    const choice = verb ? ({ run: menu[0], new: menu[1], results: menu[7] } as Record<string, string>)[verb] : await ctx.ui.select(current ? selected?.setup.outcome ?? `Declared work: ${current.id}` : "No work selected", menu);
-    if (!choice) { if (verb) throw Error("Use /grants work, work new, work run or work results"); return; }
-    const guard = () => { if (!ctx.isIdle() || !ordinaryChildrenFor(session).quiescent()) throw Error("Wait for the original active work to settle before changing setup"); };
-    if (choice === menu[0]) {
-      if (!selected) throw Error("Declare multi-task work first; existing ordinary delegation remains available");
-      let priorities: string[] | undefined;
-      if (host.running) {
-        const frame = await host.frame(), controls = frame.controls as { intent?: { priorities: { obligation: { digest: string } }[] } };
-        priorities = controls.intent?.priorities.map(p => selected.tasks.find(t => t.obligation.digest === p.obligation.digest)?.id ?? "");
-      }
-      const result = await runSelectedWork(session, ctx, selected, priorities, { signal: shutdown.signal, started: promise => { owned = promise; } });
-      if (shutdown.signal.aborted) return;
-      if (result) { ctx.ui.notify(`${result.tasks.filter(t => t.state === "finished").length} finished; ${result.tasks.filter(t => t.state !== "finished").length} failed/blocked. No acceptance inferred.`, "info"); await showWorkResults(ctx, result); }
-      return;
-    }
-    if (choice === menu[7]) {
-      const binding = await readProductJson(join(ctx.cwd, ".pi", "work-last-run.json")) as ControlBinding<WorkRunInitial> | null;
-      if (!binding) throw Error("No bounded run result is retained for this project yet");
-      await showWorkResults(ctx, await inspectWorkRun(binding)); return;
-    }
-    if (choice === menu[6]) {
-      if (!host.running) throw Error("Start /grants host to change priority through the current dispatch owner");
-      const frame = await host.frame(), actions = frame.actions.filter(a => a.key.startsWith("priority-"));
-      const labels = actions.map((a, i) => `${i + 1}. ${a.label}`), picked = await ctx.ui.select("Next-work priority (does not rearrange active children)", labels);
-      const action = actions[labels.indexOf(picked ?? "")]; if (action) ctx.ui.notify(dashboardActionFeedback(action.label, await host.choose(action.key,{tip:frame.tip,requestDigest:action.requestDigest})), "info"); return;
-    }
-    guard();
-    if (choice === menu[5]) {
-      if (!selected || !current) throw Error("No multi-task setup selected");
-      const labels = selected.setup.tasks.map((t, i) => `${i + 1}. ${t.outcome}`), picked = await ctx.ui.select("Ordinary delegate binds which task?", labels), task = selected.tasks[labels.indexOf(picked ?? "")];
-      if (!task) return;
-      guard(); session.declaredWork = await selectRecordedWork({ ...selected, state: { ...selected.state, obligation: task.obligation } }, current.selectedSnapshot); rebind();
-      ctx.ui.notify("Task selected for subsequent ordinary delegation. Existing attempts were not rebound.", "info"); return;
-    }
-    if (choice === menu[4]) {
-      const setups = await listWorkSetups(ctx.cwd), labels = setups.map((s, i) => `${i + 1}. ${s.setup.outcome}`), picked = await ctx.ui.select("Select saved setup (existing work stays pinned)", labels), target = setups[labels.indexOf(picked ?? "")];
-      if (!target) return;
-      guard();
-      if (host.running) { if (!await ctx.ui.confirm("Stop the current host and select saved work?", "The old host's evidence remains intact. Start /grants host again for the selected setup.")) return; await host.run("stop"); }
-      session.declaredWork = await selectRecordedWork(target, current?.selectedSnapshot ?? null); rebind(); return;
-    }
-    const mode = choice === menu[1] ? "new" : choice === menu[2] ? "revise" : "alternative";
-    if (mode !== "new" && !selected) throw Error("Existing single-task work remains supported; declare a new multi-task setup to use revisions");
-    const draft = mode === "new" ? await author(ctx, session) : await revise(ctx, session, selected!.setup);
-    if (!await ctx.ui.confirm("Save this work setup?", `${draft.outcome}\n${draft.tasks.length} obligations; up to ${draft.maxParallel} parallel. Outcome/instruction text is retained in private project files, not governance ledgers. Nothing runs now.`)) return;
-    guard();
-    if (mode === "new" && host.running) { if (!await ctx.ui.confirm("Stop current host?", "A new topology needs a new host binding. Old evidence is preserved; no running work changes.")) return; await host.run("stop"); }
-    const recorded = await recordWorkSetup(ctx.cwd, draft, mode, current);
-    if (host.running) {
-      const prefix = mode === "revise" ? "scope" : "alternative", digest = createHash("sha256").update(intentKey(recorded.state.selectedSnapshot)).digest("hex").slice(0, 12);
-      ctx.ui.notify(dashboardActionFeedback("Select recorded work", await host.choose(`${prefix}-${digest}`)), "info");
-    } else { session.declaredWork = await selectRecordedWork(recorded, current?.selectedSnapshot ?? null); rebind(); }
-    ctx.ui.notify("Work saved. /grants work run starts it explicitly; /grants host connects the panel.", "info");
-  };
-  return { async close() { shutdown.abort(); if (owned) await owned.catch(() => undefined); }, async run(verb: string, ctx: ExtensionCommandContext) { shutdown.signal.throwIfAborted(); if (pending) throw Error("A work setup/run command is already active"); pending = run(verb, ctx); try { await pending; } finally { pending = null; owned = null; } } };
-}

package/src/approval-prompt.ts

@@ -1,225 +0,0 @@
-/**
- * The approval dialog — the only place a human enters the capability-governance path.
- *
- * Kept out of `extensions/grants.ts` deliberately: that file is wiring only, and this holds decisions
- * (what to offer, what a dismissal means, what happens with nobody watching) that must be testable
- * without pi. `ApprovalUI` is the minimal slice of pi's `ExtensionUIContext` needed here, so a test can
- * supply a plain object.
- *
- * Everything here denies on uncertainty. pi already agrees: in non-interactive modes it installs a
- * no-op UI context whose `select` resolves undefined, so even a missed `hasUI` check would deny.
- */
-
-import { approvalKey, offeredScopes, type ApprovalPath, type ApprovalScope } from "./approval.ts";
-import type { Capability } from "./resolve.ts";
-
-/** The slice of pi's `ExtensionUIContext` this module needs. */
-export interface ApprovalUI {
-  select(
-    title: string,
-    options: string[],
-    opts?: { timeout?: number; signal?: AbortSignal },
-  ): Promise<string | undefined>;
-  notify(message: string, type?: "info" | "warning" | "error"): void;
-}
-
-export const DENY_LABEL = "Deny";
-
-export const SCOPE_LABELS: Record<ApprovalScope, string> = {
-  once: "Allow once",
-  session: "Allow for this session",
-  always: "Always allow in this project (30 days)",
-};
-
-export interface PromptRequest {
-  capability: Capability;
-  /** Agent type name, or `DELEGATE_SUBJECT` on the delegate path. */
-  subject: string;
-  path: ApprovalPath;
-  /** Shown to the human for context. Never itself part of a key. */
-  task?: string;
-  /** Trusted exact-scope identity; bound requests single-flight only with an identical binding. */
-  bindingKey?: string;
-  signal?: AbortSignal;
-}
-
-/**
- * Which of the five outcomes a request produced.
- *
- * `scope: null` alone conflates four different kinds of no — a caller that needs to know whether a
- * PERSON actually declined (as opposed to nobody being there to ask, a dismissal, or the dialog itself
- * breaking) cannot recover that from `scope` or from parsing `reason`. Only "declined" means a human said
- * no; the other three are absence-of-signal, not a signal.
- */
-export const PROMPT_OUTCOME_KINDS = ["granted", "declined", "dismissed", "no-ui", "error"] as const;
-export type PromptOutcomeKind = typeof PROMPT_OUTCOME_KINDS[number];
-
-export interface PromptOutcome {
-  /** The scope the human chose, or null for any form of no. */
-  scope: ApprovalScope | null;
-  /** Which of the five outcomes this was. Set on every return path. */
-  kind: PromptOutcomeKind;
-  /** Why, when the answer was no. */
-  reason?: string;
-  /**
-   * True when this caller RODE another caller's answer rather than being asked (R-66).
-   *
-   * The single-flight queue shares any non-`once` outcome, which is right — a human approving
-   * `tool:bash` *for this session* authorised the capability, not one child. What is not right is
-   * recording the riders as though each had faced a dialog: the ledger's whole job is answering "did a
-   * human authorise this?", and a fan-out of eight wrote eight lines claiming a prompt where there was
-   * one. The rider's honest source is `session`, and this flag is how the caller can tell.
-   */
-  joined?: boolean;
-}
-
-export interface ApprovalGateOptions {
-  ui: ApprovalUI;
-  /** pi's `ctx.hasUI` — false in print/json mode, and therefore in every governed child. */
-  hasUI: boolean;
-  /** pi's `ctx.mode`, quoted back in the refusal so an operator can see why. */
-  mode: string;
-  timeoutMs?: number;
-}
-
-export interface ApprovalGate {
-  request(request: PromptRequest): Promise<PromptOutcome>;
-}
-
-const DEFAULT_TIMEOUT_MS = 120_000;
-
-/**
- * Read `PI_GRANTS_APPROVAL_TIMEOUT`, in SECONDS, into the milliseconds pi expects.
- *
- * `0` or an unparseable value means no timeout: waiting forever denies nothing, so it is the safe
- * interpretation of a value we do not understand.
- */
-export function timeoutMsFromEnv(raw: string | undefined): number | undefined {
-  if (raw === undefined) return DEFAULT_TIMEOUT_MS;
-  const seconds = Number.parseInt(raw, 10);
-  if (!Number.isFinite(seconds) || seconds <= 0) return undefined;
-  return seconds * 1000;
-}
-
-function labelToScope(label: string, scopes: ApprovalScope[]): ApprovalScope | null {
-  return scopes.find((s) => SCOPE_LABELS[s] === label) ?? null;
-}
-
-/**
- * The single-flight queue: one dialog per approval key at a time.
- *
- * `delegate` sets no `executionMode`, so an orchestrator can fan out several children at once and two can
- * hit the same gate simultaneously — otherwise two stacked dialogs asking the identical question.
- *
- * **R-29 — the key does two jobs, and only one of them may be shared.** `approvalKey` is
- * `capability@subject`, and on the delegate path the subject is the constant `DELEGATE_SUBJECT`, which is
- * deliberate: the only things naming a delegated child are the task and the tool list, both model-chosen,
- * and a key the model controls is not a key (`approval.ts:24-32`). That reasoning governs *approval
- * identity* — what a human said yes to, and what may be persisted — and it is right.
- *
- * It does **not** govern de-duplication. Sharing one dialog's outcome is correct for `session` and
- * `always`, which are genuinely answers about the session or the project, and for a decline or an error,
- * which answer everyone. It is **wrong for `once`**, which means *this spawn*. Measured before the fix:
- * four concurrent delegations gating `tool:bash`, one dialog, one click of *Allow once* → four `granted`
- * outcomes, with the human having seen only the first caller's task. That is a confused deputy, and it
- * falsified ADR-0014's decided property that "`once` stops at the boundary".
- */
-export type InFlightApprovals = Map<string, Promise<PromptOutcome>>;
-
-/**
- * Build gates that SHARE one single-flight queue.
- *
- * This exists because of how the wiring actually calls in. The gate's options depend on the per-call
- * `ExtensionContext` (`ui`, `hasUI`, `mode`), so the extension necessarily builds a gate per invocation —
- * and a gate that owns its queue privately therefore de-duplicates nothing across invocations, which is
- * exactly the case §6.1 exists for (two concurrent `delegate` calls are two separate invocations).
- *
- * The provider separates the two lifetimes: options stay per-call and fresh, the queue is created once and
- * lives as long as the provider. Preferred over a module-level map because that would be shared by every
- * gate in the process — including across tests — for no benefit.
- */
-export function createApprovalGateProvider(): (options: ApprovalGateOptions) => ApprovalGate {
-  const inFlight: InFlightApprovals = new Map();
-  return (options) => createApprovalGate(options, inFlight);
-}
-
-/**
- * @param inFlight optional shared single-flight queue — see `createApprovalGateProvider`. Defaults to one
- * private to this gate, which only de-duplicates requests made through this same gate object.
- */
-export function createApprovalGate(
-  options: ApprovalGateOptions,
-  inFlight: InFlightApprovals = new Map(),
-): ApprovalGate {
-  const ask = async (request: PromptRequest): Promise<PromptOutcome> => {
-    const scopes = offeredScopes(request.path);
-    const title =
-      `grants: approve ${request.capability} for ${request.subject}?` +
-      (request.task ? `\n  task: ${request.task}` : "");
-
-    let chosen: string | undefined;
-    try {
-      chosen = await options.ui.select(title, [DENY_LABEL, ...scopes.map((s) => SCOPE_LABELS[s])], {
-        timeout: options.timeoutMs,
-        signal: request.signal,
-      });
-    } catch (error) {
-      // A governance layer that errors must deny, not permit. This is a dialog malfunction, not a
-      // person's answer — `kind: "error"` keeps it out of "declined".
-      return { scope: null, kind: "error", reason: `approval dialog failed, denying (${String(error)})` };
-    }
-
-    // undefined covers dismissal, timeout, and abort. All are a no, but none is a person saying no.
-    if (chosen === undefined) {
-      return { scope: null, kind: "dismissed", reason: `approval for ${request.capability} was dismissed` };
-    }
-    if (chosen === DENY_LABEL) {
-      return { scope: null, kind: "declined", reason: `${request.capability} was denied by a human` };
-    }
-
-    const scope = labelToScope(chosen, scopes);
-    return scope === null
-      ? { scope: null, kind: "error", reason: `unrecognised approval choice ${JSON.stringify(chosen)}, denying` }
-      : { scope, kind: "granted" };
-  };
-
-  return {
-    async request(request: PromptRequest): Promise<PromptOutcome> {
-      if (!options.hasUI) {
-        // Nobody was there to ask — distinct from a person declining, which is why this is its own kind
-        // rather than being folded into "declined" (see PromptOutcomeKind).
-        return {
-          scope: null,
-          kind: "no-ui",
-          reason:
-            `${request.capability} requires approval and this session has no interactive user ` +
-            `(mode: ${options.mode}). Pre-approve it in an interactive session, or drop it from the request.`,
-        };
-      }
-
-      const key = `${approvalKey(request.capability, request.subject)}${request.bindingKey ? `#${request.bindingKey}` : ""}`;
-
-      // R-29. Join an in-flight dialog, but only *keep* its answer if that answer was about more than one
-      // spawn. A `once` belongs to whichever caller the human was actually looking at — the title shows
-      // that caller's task — so anyone else who joined must ask their own question rather than ride a yes
-      // given for somebody else's work. The loop (rather than a single retry) covers the case where a
-      // fellow waiter started its own dialog first: we join that one instead of opening a third.
-      for (;;) {
-        const existing = inFlight.get(key);
-        if (!existing) break;
-        const outcome = await existing;
-        // **`joined` marks the rider, and the ledger depends on it (R-66).** Sharing a non-`once` outcome
-        // is correct — the human authorised the capability for the session, not for one child — but the
-        // caller then stamped `approvalSource: "prompt"` on every one of them, so a fan-out of eight wrote
-        // eight lines each asserting a human was prompted when exactly one was. That is R-46's defect at
-        // the concurrency level, and `ledger.ts` calls over-claiming in this direction "the worst available
-        // failure". Confirmed by execution: one dialog, eight `granted/session` outcomes.
-        if (outcome.scope !== "once") return { ...outcome, joined: true };
-      }
-
-      const pending = ask(request).finally(() => inFlight.delete(key));
-      inFlight.set(key, pending);
-      return pending;
-    },
-  };
-}