pi-daddy 0.46.0 → 0.47.0

package/extensions/session.ts

@@ -1,3 +1,5 @@
+import type { EcosystemVersions } from "../src/products/ecosystem-versions.ts";
+import type { AutoModeReader } from "../src/kernel/auto-mode.ts";
 /**
  * The session object — the one place this extension's state is named.
  *
@@ -141,6 +143,9 @@ export function activityChildEnv(activity: { rootId: string; path: string; taskI
 }
 /** Keep each child's pane after it finishes, for inspection. Off by default: fan-out would flood it. */
 export interface GrantsSession extends NativeSessionHost {
+  ecosystemVersions?: () => EcosystemVersions;
+  autoMode?: AutoModeReader;
+  autoModeFailure?: string;
   /** Reconciled from the actual owner root on reload; captured call owners stay immutable. */
   publicEvidence?: PublicEvidenceOwner;
   /** Legacy PI_GRANTS_* names adopted at construction (ADR-0076 PR 3b); the session-start warning names them. */
@@ -659,43 +664,47 @@ export function createGrantsSession(
     discovery: Object.freeze({ ...discovery }),
     catalog: emptyCatalog,
     catalogReady: Promise.resolve(emptyCatalog),
-    delegationContext: async (approved?: InheritableApproval[]) => ({
-      ownGrant: session.ownGrant,
-      episodeId: session.episodeId,
-      depth: session.depth,
-      maxDepth: session.maxDepth,
-      gated: session.gated,
-      ledgerPath: session.ledgerPath,
-      extensionPath: session.extensionPath,
-      observerExtensionPath: session.observerExtensionPath,
-      childEnv: activityChildEnv(session.activity),
-      // ADR-0042: the pin this session holds, handed to the kernel so a delegated child inherits a narrowed
-      // one through the same builder `publishChildEnv` uses. Read here rather than in the kernel so there is
-      // one place that knows the environment is where a session's own pin lives.
-      ...(session.workspacePin ? { workspacePin: session.workspacePin } : {}),
-      // Context is staged only after its capability survives the ceiling, grant and gate.
-      stageHandoff: (granted, options) =>
-        createHandoffStager({
-          cwd: session.cwd,
-          forkRoot: join(agentDir(), "context-forks"),
-          ...(session.parentSession ? { parentSession: session.parentSession } : {}),
-        })(granted, options),
-      catalog: await delegationCatalog(session),
-      // R-32: where each granted skill lives, so `planSpawn` can pass `--skill` for those and only those.
-      // Derived from the catalog's own `source`, so it cannot drift from what was discovered.
-      skillPaths: skillPathsFromCatalog(await delegationCatalog(session)),
-      // ADR-0016: operator-authored SKILL.md definitions, so `delegate({agent})` can name one.
-      definitions: session.definitions,
-      // The herdr executor drives the child after starting it, so its plan must NOT carry `--print`.
-      // Threaded through the plan rather than patched afterwards: the argv is what the ledger records, and
-      // an executor quietly rewriting it would make the record describe a spawn that did not happen.
-      //
-      // Read live off `session.executor` (ADR-0031) rather than a boolean captured in the factory: the probe
-      // has not run when this session object is built, so a captured value would plan `--print` for a session
-      // that turns out to use panes — and `runHerdrPane` refuses a plan containing `--print` by design.
-      interactive: false, // Both qualified backends use the same one-shot Pi JSON protocol.
-      ...(approved ? { approved } : {}),
-    }),
+    delegationContext: async (approved?: InheritableApproval[]) => {
+      if (session.autoModeFailure) throw new Error(session.autoModeFailure);
+      return {
+        autoModeRef: session.autoMode?.reference,
+        ownGrant: session.ownGrant,
+        episodeId: session.episodeId,
+        depth: session.depth,
+        maxDepth: session.maxDepth,
+        gated: session.gated,
+        ledgerPath: session.ledgerPath,
+        extensionPath: session.extensionPath,
+        observerExtensionPath: session.observerExtensionPath,
+        childEnv: activityChildEnv(session.activity),
+        // ADR-0042: the pin this session holds, handed to the kernel so a delegated child inherits a narrowed
+        // one through the same builder `publishChildEnv` uses. Read here rather than in the kernel so there is
+        // one place that knows the environment is where a session's own pin lives.
+        ...(session.workspacePin ? { workspacePin: session.workspacePin } : {}),
+        // Context is staged only after its capability survives the ceiling, grant and gate.
+        stageHandoff: (granted, options) =>
+          createHandoffStager({
+            cwd: session.cwd,
+            forkRoot: join(agentDir(), "context-forks"),
+            ...(session.parentSession ? { parentSession: session.parentSession } : {}),
+          })(granted, options),
+        catalog: await delegationCatalog(session),
+        // R-32: where each granted skill lives, so `planSpawn` can pass `--skill` for those and only those.
+        // Derived from the catalog's own `source`, so it cannot drift from what was discovered.
+        skillPaths: skillPathsFromCatalog(await delegationCatalog(session)),
+        // ADR-0016: operator-authored SKILL.md definitions, so `delegate({agent})` can name one.
+        definitions: session.definitions,
+        // The herdr executor drives the child after starting it, so its plan must NOT carry `--print`.
+        // Threaded through the plan rather than patched afterwards: the argv is what the ledger records, and
+        // an executor quietly rewriting it would make the record describe a spawn that did not happen.
+        //
+        // Read live off `session.executor` (ADR-0031) rather than a boolean captured in the factory: the probe
+        // has not run when this session object is built, so a captured value would plan `--print` for a session
+        // that turns out to use panes — and `runHerdrPane` refuses a plan containing `--print` by design.
+        interactive: false, // Both qualified backends use the same one-shot Pi JSON protocol.
+        ...(approved ? { approved } : {}),
+      };
+    },
     storeCwd,
     ...(grantStoreRefusal ? { grantStoreRefusal } : {}),
     adoptGrant: (grant: Capability[], projectLedger?: string) => {
@@ -725,6 +734,7 @@ export function createGrantsSession(
     },
     publishChildEnv: () => {
       const env = childEnv({
+        autoModeRef: session.autoMode?.reference,
         ownGrant: session.ownGrant,
         episodeId: session.episodeId,
         depth: session.depth,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-daddy",
-  "version": "0.46.0",
+  "version": "0.47.0",
   "description": "Capability governance for pi sub-agents: spawn Agent Skills (SKILL.md) definitions whose allowed-tools becomes a grant that can only narrow going down a delegation tree, enforced by pi's own --tools allowlist, with an append-only ledger.",
   "keywords": [
     "pi-package",
@@ -53,7 +53,7 @@
     "typecheck": "tsc -p tsconfig.check.json",
     "test": "node scripts/unit-tests.ts",
     "test:integration": "node --test test-integration/*.it.ts",
-    "test:integration:ci": "node --test test-integration/approval.it.ts test-integration/governance.it.ts test-integration/activity.it.ts",
+    "test:integration:ci": "node --test test-integration/approval.it.ts test-integration/governance.it.ts test-integration/activity.it.ts test-integration/auto-chain.it.ts",
     "contracts:generate": "node scripts/generate-ledger-record-contract.ts",
     "prepack": "npm run build",
     "test:smoke": "node scripts/smoke-installed.mjs",

package/src/governance/approval-prompt.ts

@@ -10,6 +10,8 @@
  * no-op UI context whose `select` resolves undefined, so even a missed `hasUI` check would deny.
  */
 
+import { randomUUID } from "node:crypto";
+import type { AutoModeReader } from "../kernel/auto-mode.ts";
 import { approvalKey, offeredScopes, type ApprovalPath, type ApprovalScope } from "../kernel/approval.ts";
 import type { Capability } from "../kernel/resolve.ts";
 
@@ -43,21 +45,22 @@ export interface PromptRequest {
   signal?: AbortSignal;
 }
 
-/**
- * Which of the five outcomes a request produced.
- *
- * `scope: null` alone conflates four different kinds of no — a caller that needs to know whether a
- * PERSON actually declined (as opposed to nobody being there to ask, a dismissal, or the dialog itself
- * breaking) cannot recover that from `scope` or from parsing `reason`. Only "declined" means a human said
- * no; the other three are absence-of-signal, not a signal.
- */
-export const PROMPT_OUTCOME_KINDS = ["granted", "declined", "dismissed", "no-ui", "error"] as const;
+/** Only declined means a human chose Deny. Expiry, cancellation and dismissal grant nothing. */
+export const PROMPT_OUTCOME_KINDS = [
+  "granted",
+  "declined",
+  "dismissed",
+  "expired",
+  "aborted",
+  "no-ui",
+  "error",
+] as const;
 export type PromptOutcomeKind = (typeof PROMPT_OUTCOME_KINDS)[number];
 
 export interface PromptOutcome {
   /** The scope the human chose, or null for any form of no. */
   scope: ApprovalScope | null;
-  /** Which of the five outcomes this was. Set on every return path. */
+  /** Which outcome this was. Set on every return path. */
   kind: PromptOutcomeKind;
   /** Why, when the answer was no. */
   reason?: string;
@@ -71,6 +74,8 @@ export interface PromptOutcome {
    * one. The rider's honest source is `session`, and this flag is how the caller can tell.
    */
   joined?: boolean;
+  /** Provisional Auto permission; the admission caller must still check the live owner policy. */
+  source?: "auto";
 }
 
 export interface ApprovalGateOptions {
@@ -81,23 +86,21 @@ export interface ApprovalGateOptions {
   mode: string;
   /** Resolve only when this caller must open a new dialog; unused invalid settings cannot revoke authority. */
   timeoutMs?: number | (() => number | undefined);
+  autoMode?: AutoModeReader;
 }
 
 export interface ApprovalGate {
   request(request: PromptRequest): Promise<PromptOutcome>;
 }
 
-const DEFAULT_TIMEOUT_MS = 120_000;
-
 /**
  * Read `PI_DADDY_APPROVAL_TIMEOUT`, in SECONDS, into the milliseconds pi expects.
  *
- * Only literal `0` disables the deadline. Other values must be canonical whole seconds
+ * Absent or literal `0` waits for the human without a deadline. Other values must be canonical whole seconds
  * within Node's signed 32-bit millisecond timer limit; malformed settings refuse a needed prompt.
  */
 export function timeoutMsFromEnv(raw: string | undefined): number | undefined {
-  if (raw === undefined) return DEFAULT_TIMEOUT_MS;
-  if (raw === "0") return undefined;
+  if (raw === undefined || raw === "0") return undefined;
   if (!/^[1-9][0-9]*$/.test(raw) || Number(raw) > 2_147_483)
     throw new Error(
       "PI_DADDY_APPROVAL_TIMEOUT must be literal 0 or whole seconds 1..2147483 without signs, padding or units",
@@ -108,6 +111,101 @@ function labelToScope(label: string, scopes: ApprovalScope[]): ApprovalScope | n
   return scopes.find((s) => SCOPE_LABELS[s] === label) ?? null;
 }
 
+const autoApproval = (): PromptOutcome => ({ scope: "once", kind: "granted", source: "auto" });
+
+const interrupted = (request: PromptRequest, kind: "expired" | "aborted"): PromptOutcome => ({
+  scope: null,
+  kind,
+  reason:
+    `approval for ${request.capability} ${kind === "expired" ? "expired before an answer" : "was canceled"}. ` +
+    "No permission was granted. Retry the delegation to open a new approval prompt.",
+});
+
+/** Own the deadline so Pi's undefined dismissal cannot erase whether our timer or cancellation fired. */
+async function selectApproval(
+  options: ApprovalGateOptions,
+  request: PromptRequest,
+  title: string,
+  labels: string[],
+): Promise<string | undefined | PromptOutcome> {
+  const timeout = typeof options.timeoutMs === "function" ? options.timeoutMs() : options.timeoutMs;
+  const controller = new AbortController();
+  let outcome: PromptOutcome | undefined;
+  let settled = false;
+  let wake!: (value: PromptOutcome) => void;
+  const stopped = new Promise<PromptOutcome>((resolve) => {
+    wake = resolve;
+  });
+  const settle = (next: PromptOutcome) => {
+    if (settled) return;
+    settled = true;
+    outcome = next;
+    // Resolve our tagged outcome before a UI reacts to abort by returning undefined.
+    wake(outcome);
+    controller.abort();
+  };
+  const stop = (kind: "expired" | "aborted") => settle(interrupted(request, kind));
+  const abort = () => stop("aborted");
+  request.signal?.addEventListener("abort", abort, { once: true });
+  const timer = timeout === undefined ? undefined : setTimeout(() => stop("expired"), timeout);
+  let untrack: (() => void) | undefined;
+  try {
+    if (request.signal?.aborted) stop("aborted");
+    if (outcome) return outcome;
+    untrack = options.autoMode?.trackPending({
+      id: randomUUID(),
+      subject: request.subject,
+      capability: request.capability,
+    });
+    const selection = options.ui.select(title, labels, { signal: controller.signal }).then((chosen) => {
+      settled = true;
+      return chosen;
+    });
+    if (options.autoMode) {
+      const auto = options.autoMode;
+      void (async () => {
+        while (!controller.signal.aborted) {
+          await auto.waitEnabled(controller.signal);
+          // A notification is not authority: ON may already have changed back to OFF.
+          if (!controller.signal.aborted && (await auto.read()).enabled) {
+            settle(autoApproval());
+            return;
+          }
+        }
+      })().catch((error) => {
+        if (!controller.signal.aborted)
+          settle({
+            scope: null,
+            kind: "error",
+            reason: `Auto permission policy unavailable, denying (${String(error)})`,
+          });
+      });
+    }
+    const chosen = await Promise.race([selection, stopped]);
+    return outcome ?? chosen;
+  } finally {
+    controller.abort();
+    untrack?.();
+    if (timer !== undefined) clearTimeout(timer);
+    request.signal?.removeEventListener("abort", abort);
+  }
+}
+
+async function joinApproval(pending: Promise<PromptOutcome>, request: PromptRequest): Promise<PromptOutcome> {
+  if (!request.signal) return pending;
+  let abort!: () => void;
+  const stopped = new Promise<PromptOutcome>((resolve) => {
+    abort = () => resolve(interrupted(request, "aborted"));
+    request.signal!.addEventListener("abort", abort, { once: true });
+    if (request.signal!.aborted) abort();
+  });
+  try {
+    return await Promise.race([pending, stopped]);
+  } finally {
+    request.signal.removeEventListener("abort", abort);
+  }
+}
+
 /**
  * The single-flight queue: one dialog per approval key at a time.
  *
@@ -155,29 +253,41 @@ export function createApprovalGate(
   inFlight: InFlightApprovals = new Map(),
 ): ApprovalGate {
   const ask = async (request: PromptRequest): Promise<PromptOutcome> => {
+    // A queued once waiter owns its own decision. Auto may have changed while it joined another dialog.
+    if (options.autoMode) {
+      try {
+        if ((await options.autoMode.read()).enabled)
+          return request.signal?.aborted ? interrupted(request, "aborted") : autoApproval();
+      } catch (error) {
+        return { scope: null, kind: "error", reason: `Auto permission policy unavailable, denying (${String(error)})` };
+      }
+    }
     const scopes = offeredScopes(request.path);
     const title =
       `grants: approve ${request.capability} for ${request.subject}?` +
       (request.task ? `\n  task: ${request.task}` : "");
 
-    let chosen: string | undefined;
+    let chosen: string | undefined | PromptOutcome;
     try {
-      chosen = await options.ui.select(title, [DENY_LABEL, ...scopes.map((s) => SCOPE_LABELS[s])], {
-        timeout: typeof options.timeoutMs === "function" ? options.timeoutMs() : options.timeoutMs,
-        signal: request.signal,
-      });
+      chosen = await selectApproval(options, request, title, [DENY_LABEL, ...scopes.map((s) => SCOPE_LABELS[s])]);
     } catch (error) {
       // A governance layer that errors must deny, not permit. This is a dialog malfunction, not a
       // person's answer — `kind: "error"` keeps it out of "declined".
       return { scope: null, kind: "error", reason: `approval dialog failed, denying (${String(error)})` };
     }
 
-    if (request.signal?.aborted)
-      return { scope: null, kind: "dismissed", reason: `approval for ${request.capability} was canceled` };
+    if (request.signal?.aborted) return interrupted(request, "aborted");
 
-    // undefined covers dismissal, timeout, and abort. All are a no, but none is a person saying no.
+    if (typeof chosen === "object") return chosen;
+    // Only an ordinary UI dismissal reaches undefined; our deadline and abort carry explicit outcomes.
     if (chosen === undefined) {
-      return { scope: null, kind: "dismissed", reason: `approval for ${request.capability} was dismissed` };
+      return {
+        scope: null,
+        kind: "dismissed",
+        reason:
+          `approval for ${request.capability} was dismissed. No permission was granted. ` +
+          "Retry the delegation to open a new approval prompt.",
+      };
     }
     if (chosen === DENY_LABEL) {
       return { scope: null, kind: "declined", reason: `${request.capability} was denied by a human` };
@@ -191,8 +301,14 @@ export function createApprovalGate(
 
   return {
     async request(request: PromptRequest): Promise<PromptOutcome> {
-      if (request.signal?.aborted)
-        return { scope: null, kind: "dismissed", reason: `approval for ${request.capability} was canceled` };
+      if (request.signal?.aborted) return interrupted(request, "aborted");
+      try {
+        if (options.autoMode && (await options.autoMode.read()).enabled) {
+          return request.signal?.aborted ? interrupted(request, "aborted") : autoApproval();
+        }
+      } catch (error) {
+        return { scope: null, kind: "error", reason: `Auto permission policy unavailable, denying (${String(error)})` };
+      }
       if (!options.hasUI) {
         // Nobody was there to ask — distinct from a person declining, which is why this is its own kind
         // rather than being folded into "declined" (see PromptOutcomeKind).
@@ -215,9 +331,8 @@ export function createApprovalGate(
       for (;;) {
         const existing = inFlight.get(key);
         if (!existing) break;
-        const outcome = await existing;
-        if (request.signal?.aborted)
-          return { scope: null, kind: "dismissed", reason: `approval for ${request.capability} was canceled` };
+        const outcome = await joinApproval(existing, request);
+        if (request.signal?.aborted) return interrupted(request, "aborted");
         // **`joined` marks the rider, and the ledger depends on it (R-66).** Sharing a non-`once` outcome
         // is correct — the human authorised the capability for the session, not for one child — but the
         // caller then stamped `approvalSource: "prompt"` on every one of them, so a fan-out of eight wrote