pi-daddy 0.46.1 → 0.47.0

package/extensions/reload-environment.ts

@@ -1,9 +1,11 @@
+import { ENV_AUTO_MODE, ENV_AUTO_MODE_REF } from "../src/kernel/env-names.ts";
 import type { OwnerCapacity } from "./session-capacity.ts";
 import { GRANT_ENV_KEYS } from "../src/kernel/propagation.ts";
 import type { BoundedReadCleanupError } from "../src/kernel/bounded-read.ts";
 
 /** The root baseline and latest child publication for one real Pi session owner. */
 export interface ReloadLifecycle {
+  autoMode?: import("./session-auto-mode.ts").SessionAutoLifecycle;
   runtimeSnapshotUnsubscribe?: () => void;
   runtimeSnapshotGeneration?: object;
   runtimeSettlements?: Map<string, import("../src/governance/runtime-settlement.ts").RuntimeSettlement>;
@@ -59,7 +61,19 @@ function withRoot(root: Record<string, string | undefined>): NodeJS.ProcessEnv {
 
 /** Factory-time state is provisional: ExtensionAPI is recreated before the stable session owner is known. */
 export function beginExtensionLifecycle(): { environment: NodeJS.ProcessEnv; lifecycle: ReloadLifecycle } {
-  return { environment: process.env, lifecycle: { root: snapshot() } };
+  const root = snapshot();
+  const publication = state().latestChildPublication;
+  if (
+    publication?.environment[ENV_AUTO_MODE_REF] &&
+    root[ENV_AUTO_MODE_REF] === publication.environment[ENV_AUTO_MODE_REF]
+  ) {
+    // Recognize our own published Auto reference independently of unrelated grant setting changes.
+    // A new SDK owner must not adopt another local owner; a real descendant has no local publication.
+    if (root[ENV_AUTO_MODE] === publication.environment[ENV_AUTO_MODE])
+      root[ENV_AUTO_MODE] = publication.lifecycle.root[ENV_AUTO_MODE];
+    root[ENV_AUTO_MODE_REF] = publication.lifecycle.root[ENV_AUTO_MODE_REF];
+  }
+  return { environment: withRoot(root), lifecycle: { root } };
 }
 
 /**
@@ -100,6 +114,7 @@ export function bindReloadLifecycle(
       // Pending old-root operations keep THEIR original owner; they cannot publish/fault this replacement.
       existing = {
         root: current,
+        autoMode: existing.autoMode,
         activityRootId: existing.activityRootId,
         episodeId: existing.episodeId,
         capacity: existing.capacity,

package/extensions/run-delegation.ts

@@ -79,6 +79,13 @@ export interface GatedPlan {
   approval?: ApprovalOutcome;
 }
 
+/** Discard provisional Auto facts when OFF or a policy error requires a fresh decision. */
+function forgetAutoApprovals(outcome: ApprovalOutcome, capabilities: string[]): void {
+  outcome.approved = outcome.approved.filter((capability) => !capabilities.includes(capability));
+  for (const field of ["sources", "scopes", "recordedScopes", "bindings", "expiresAt", "uses"] as const)
+    for (const capability of capabilities) delete outcome[field][capability];
+}
+
 /**
  * Plan a delegation and satisfy its gate as far as approvals allow.
  *
@@ -143,12 +150,13 @@ export async function planWithApprovals(
       plan.approvalBinding,
     );
     const outcome = approval;
-    if (outcome.approved.length > 0) {
-      plan = observedPlan({
+    while (outcome.approved.length > 0) {
+      const context = {
         // The scope is the REAL one: a `once` approval still authorises this spawn, and
         // `inheritApprovals` then keeps it from reaching the child. See ADR-0014. R-29 is what makes
         // this safe under fan-out: a `once` is consumed by exactly one concurrent caller.
         ...(await session.delegationContext([
+          ...(preApproved ?? []),
           ...republishable(session),
           ...outcome.approved.map((capability) => ({
             capability,
@@ -167,7 +175,35 @@ export async function planWithApprovals(
           })),
         ])),
         ...extra,
-      });
+      };
+      const automatic = outcome.approved.filter((capability) => outcome.sources[capability] === "auto");
+      // The owner serializes this check with OFF. Permission is admitted here, after context preparation;
+      // a later OFF does not cancel a delegation already admitted to its load-bearing ledger write.
+      if (automatic.length > 0 && !(await session.autoMode?.admit(signal))) {
+        const renewed = await obtainApprovals(
+          session,
+          automatic,
+          approvalSubject,
+          request.agent ? "definition" : "delegate",
+          ctx,
+          request.task,
+          signal,
+          plan.approvalBinding,
+        );
+        forgetAutoApprovals(outcome, automatic);
+        outcome.approved.push(...renewed.approved);
+        for (const field of ["sources", "scopes", "recordedScopes", "bindings", "expiresAt", "uses"] as const)
+          Object.assign(outcome[field], renewed[field]);
+        outcome.banked = [...(outcome.banked ?? []), ...(renewed.banked ?? [])];
+        outcome.humanDenied ||= renewed.humanDenied;
+        outcome.gateOutcome = renewed.gateOutcome;
+        outcome.refusalCode = renewed.refusalCode;
+        outcome.reason = renewed.reason;
+        if (automatic.some((capability) => !renewed.approved.includes(capability))) break;
+        continue;
+      }
+      plan = observedPlan(context);
+      break;
     }
     if (!plan.ok && approval.reason) {
       plan = {
@@ -178,6 +214,16 @@ export async function planWithApprovals(
     }
   } catch (error) {
     const message = `grants: approval flow failed, denying (${String(error)})`;
+    if (approval) {
+      const failed = approval;
+      forgetAutoApprovals(
+        failed,
+        failed.approved.filter((capability) => failed.sources[capability] === "auto"),
+      );
+      approval.gateOutcome = "error";
+      approval.refusalCode = "APPROVAL_FLOW_FAILED";
+      approval.reason = message;
+    }
     plan = { ...plan, reason: message, refusal: structuredRefusal("APPROVAL_FLOW_FAILED", message) };
   }
 

package/extensions/session-auto-mode.ts

@@ -0,0 +1,132 @@
+/** Session-owned Auto policy. Dashboard mutations never become banked or inherited approvals. */
+import type { AutoModeReader, AutoModeSource } from "../src/kernel/auto-mode.ts";
+import { parseAutoModeDefault, parseAutoModeRef } from "../src/kernel/auto-mode.ts";
+import { ENV_AUTO_MODE, ENV_AUTO_MODE_REF } from "../src/kernel/env-names.ts";
+import {
+  createAutoModeAuthority,
+  connectAutoMode,
+  type AutoModeAuthority,
+} from "../src/governance/auto-mode-policy.ts";
+import { appendLedgerEvent, buildAutoModeConfigEvent } from "../src/governance/ledger.ts";
+import type { GrantsSession } from "./session.ts";
+
+export interface SessionAutoLifecycle {
+  nativeSessionId: string;
+  reader: AutoModeReader;
+  authority?: AutoModeAuthority;
+  updates: Promise<unknown>;
+}
+const stale = () => new Error("Daddy Auto controls are unavailable for this session owner");
+function current(session: GrantsSession): SessionAutoLifecycle {
+  const state = session.reloadLifecycle.autoMode;
+  if (!session.ownerBound || !state || session.autoMode !== state.reader) throw stale();
+  return state;
+}
+async function record(
+  session: GrantsSession,
+  enabled: boolean,
+  source: AutoModeSource,
+  revision: number,
+): Promise<void> {
+  if (!session.ledgerPath) return;
+  await appendLedgerEvent(
+    { path: session.ledgerPath, strict: true },
+    buildAutoModeConfigEvent({
+      episodeId: session.episodeId,
+      enabled,
+      source,
+      revision,
+      now: new Date(),
+    }),
+  );
+}
+
+export async function initializeSessionAutoMode(
+  session: GrantsSession,
+  environment: NodeJS.ProcessEnv,
+  nativeSessionId: string,
+): Promise<void> {
+  const lifecycle = session.reloadLifecycle;
+  let state = lifecycle.autoMode;
+  if (session.autoMode && session.autoMode !== state?.reader) await session.autoMode.close();
+  if (state && state.nativeSessionId !== nativeSessionId) {
+    await state.reader.close();
+    delete lifecycle.autoMode;
+    state = undefined;
+  }
+  if (state) {
+    session.autoMode = state.reader;
+    return;
+  }
+  const rawRef = environment[ENV_AUTO_MODE_REF];
+  if (rawRef !== undefined) {
+    // A descendant always consults its actual owner. A dead/malformed owner must not mint a new root.
+    const reader = connectAutoMode(parseAutoModeRef(rawRef));
+    try {
+      await reader.read();
+    } catch (error) {
+      await reader.close();
+      throw error;
+    }
+    state = { nativeSessionId, reader, updates: Promise.resolve() };
+  } else {
+    const initial = parseAutoModeDefault(environment[ENV_AUTO_MODE]);
+    const authority = await createAutoModeAuthority({ enabled: false, source: initial.source });
+    try {
+      if (initial.enabled) {
+        await record(session, true, initial.source, 1);
+        authority.set(true, initial.source);
+      }
+    } catch (error) {
+      await authority.close();
+      throw error;
+    }
+    state = { nativeSessionId, reader: authority, authority, updates: Promise.resolve() };
+  }
+  if (session.reloadLifecycle !== lifecycle) {
+    await state.reader.close();
+    throw stale();
+  }
+  lifecycle.autoMode = state;
+  session.autoMode = state.reader;
+  delete session.autoModeFailure;
+}
+
+export async function getDashboardControlState(session: GrantsSession) {
+  const state = current(session);
+  const value = await state.reader.read();
+  if (current(session) !== state) throw stale();
+  return { auto: { enabled: value.enabled, source: value.source }, pendingApprovals: value.pendingApprovals };
+}
+
+export async function setAutoApproval(session: GrantsSession, enabled: boolean, source: "dashboard" | "command") {
+  if (typeof enabled !== "boolean" || (source !== "dashboard" && source !== "command"))
+    throw new Error("Invalid Daddy Auto mode edit");
+  const state = current(session);
+  if (!state.authority) throw new Error("Only the owning root session may change Daddy Auto mode");
+  // Serialize operator edits. OFF remains effective even if its audit write fails; failed ON never enables.
+  const update = state.updates
+    .catch(() => {})
+    .then(async () => {
+      if (current(session) !== state) throw stale();
+      const before = state.authority!.snapshot();
+      if (enabled) {
+        await record(session, true, "session", before.revision + 1);
+        if (current(session) !== state) throw stale();
+        state.authority!.set(true, "session");
+      } else {
+        const after = state.authority!.set(false, "session");
+        await record(session, false, "session", after.revision);
+      }
+      return getDashboardControlState(session);
+    });
+  state.updates = update;
+  return update;
+}
+
+export async function closeSessionAutoMode(session: GrantsSession): Promise<void> {
+  const reader = session.autoMode;
+  delete session.autoMode;
+  if (reader && session.reloadLifecycle.autoMode?.reader === reader) delete session.reloadLifecycle.autoMode;
+  await reader?.close();
+}

package/extensions/session.ts

@@ -1,3 +1,5 @@
+import type { EcosystemVersions } from "../src/products/ecosystem-versions.ts";
+import type { AutoModeReader } from "../src/kernel/auto-mode.ts";
 /**
  * The session object — the one place this extension's state is named.
  *
@@ -141,6 +143,9 @@ export function activityChildEnv(activity: { rootId: string; path: string; taskI
 }
 /** Keep each child's pane after it finishes, for inspection. Off by default: fan-out would flood it. */
 export interface GrantsSession extends NativeSessionHost {
+  ecosystemVersions?: () => EcosystemVersions;
+  autoMode?: AutoModeReader;
+  autoModeFailure?: string;
   /** Reconciled from the actual owner root on reload; captured call owners stay immutable. */
   publicEvidence?: PublicEvidenceOwner;
   /** Legacy PI_GRANTS_* names adopted at construction (ADR-0076 PR 3b); the session-start warning names them. */
@@ -659,43 +664,47 @@ export function createGrantsSession(
     discovery: Object.freeze({ ...discovery }),
     catalog: emptyCatalog,
     catalogReady: Promise.resolve(emptyCatalog),
-    delegationContext: async (approved?: InheritableApproval[]) => ({
-      ownGrant: session.ownGrant,
-      episodeId: session.episodeId,
-      depth: session.depth,
-      maxDepth: session.maxDepth,
-      gated: session.gated,
-      ledgerPath: session.ledgerPath,
-      extensionPath: session.extensionPath,
-      observerExtensionPath: session.observerExtensionPath,
-      childEnv: activityChildEnv(session.activity),
-      // ADR-0042: the pin this session holds, handed to the kernel so a delegated child inherits a narrowed
-      // one through the same builder `publishChildEnv` uses. Read here rather than in the kernel so there is
-      // one place that knows the environment is where a session's own pin lives.
-      ...(session.workspacePin ? { workspacePin: session.workspacePin } : {}),
-      // Context is staged only after its capability survives the ceiling, grant and gate.
-      stageHandoff: (granted, options) =>
-        createHandoffStager({
-          cwd: session.cwd,
-          forkRoot: join(agentDir(), "context-forks"),
-          ...(session.parentSession ? { parentSession: session.parentSession } : {}),
-        })(granted, options),
-      catalog: await delegationCatalog(session),
-      // R-32: where each granted skill lives, so `planSpawn` can pass `--skill` for those and only those.
-      // Derived from the catalog's own `source`, so it cannot drift from what was discovered.
-      skillPaths: skillPathsFromCatalog(await delegationCatalog(session)),
-      // ADR-0016: operator-authored SKILL.md definitions, so `delegate({agent})` can name one.
-      definitions: session.definitions,
-      // The herdr executor drives the child after starting it, so its plan must NOT carry `--print`.
-      // Threaded through the plan rather than patched afterwards: the argv is what the ledger records, and
-      // an executor quietly rewriting it would make the record describe a spawn that did not happen.
-      //
-      // Read live off `session.executor` (ADR-0031) rather than a boolean captured in the factory: the probe
-      // has not run when this session object is built, so a captured value would plan `--print` for a session
-      // that turns out to use panes — and `runHerdrPane` refuses a plan containing `--print` by design.
-      interactive: false, // Both qualified backends use the same one-shot Pi JSON protocol.
-      ...(approved ? { approved } : {}),
-    }),
+    delegationContext: async (approved?: InheritableApproval[]) => {
+      if (session.autoModeFailure) throw new Error(session.autoModeFailure);
+      return {
+        autoModeRef: session.autoMode?.reference,
+        ownGrant: session.ownGrant,
+        episodeId: session.episodeId,
+        depth: session.depth,
+        maxDepth: session.maxDepth,
+        gated: session.gated,
+        ledgerPath: session.ledgerPath,
+        extensionPath: session.extensionPath,
+        observerExtensionPath: session.observerExtensionPath,
+        childEnv: activityChildEnv(session.activity),
+        // ADR-0042: the pin this session holds, handed to the kernel so a delegated child inherits a narrowed
+        // one through the same builder `publishChildEnv` uses. Read here rather than in the kernel so there is
+        // one place that knows the environment is where a session's own pin lives.
+        ...(session.workspacePin ? { workspacePin: session.workspacePin } : {}),
+        // Context is staged only after its capability survives the ceiling, grant and gate.
+        stageHandoff: (granted, options) =>
+          createHandoffStager({
+            cwd: session.cwd,
+            forkRoot: join(agentDir(), "context-forks"),
+            ...(session.parentSession ? { parentSession: session.parentSession } : {}),
+          })(granted, options),
+        catalog: await delegationCatalog(session),
+        // R-32: where each granted skill lives, so `planSpawn` can pass `--skill` for those and only those.
+        // Derived from the catalog's own `source`, so it cannot drift from what was discovered.
+        skillPaths: skillPathsFromCatalog(await delegationCatalog(session)),
+        // ADR-0016: operator-authored SKILL.md definitions, so `delegate({agent})` can name one.
+        definitions: session.definitions,
+        // The herdr executor drives the child after starting it, so its plan must NOT carry `--print`.
+        // Threaded through the plan rather than patched afterwards: the argv is what the ledger records, and
+        // an executor quietly rewriting it would make the record describe a spawn that did not happen.
+        //
+        // Read live off `session.executor` (ADR-0031) rather than a boolean captured in the factory: the probe
+        // has not run when this session object is built, so a captured value would plan `--print` for a session
+        // that turns out to use panes — and `runHerdrPane` refuses a plan containing `--print` by design.
+        interactive: false, // Both qualified backends use the same one-shot Pi JSON protocol.
+        ...(approved ? { approved } : {}),
+      };
+    },
     storeCwd,
     ...(grantStoreRefusal ? { grantStoreRefusal } : {}),
     adoptGrant: (grant: Capability[], projectLedger?: string) => {
@@ -725,6 +734,7 @@ export function createGrantsSession(
     },
     publishChildEnv: () => {
       const env = childEnv({
+        autoModeRef: session.autoMode?.reference,
         ownGrant: session.ownGrant,
         episodeId: session.episodeId,
         depth: session.depth,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-daddy",
-  "version": "0.46.1",
+  "version": "0.47.0",
   "description": "Capability governance for pi sub-agents: spawn Agent Skills (SKILL.md) definitions whose allowed-tools becomes a grant that can only narrow going down a delegation tree, enforced by pi's own --tools allowlist, with an append-only ledger.",
   "keywords": [
     "pi-package",
@@ -53,7 +53,7 @@
     "typecheck": "tsc -p tsconfig.check.json",
     "test": "node scripts/unit-tests.ts",
     "test:integration": "node --test test-integration/*.it.ts",
-    "test:integration:ci": "node --test test-integration/approval.it.ts test-integration/governance.it.ts test-integration/activity.it.ts",
+    "test:integration:ci": "node --test test-integration/approval.it.ts test-integration/governance.it.ts test-integration/activity.it.ts test-integration/auto-chain.it.ts",
     "contracts:generate": "node scripts/generate-ledger-record-contract.ts",
     "prepack": "npm run build",
     "test:smoke": "node scripts/smoke-installed.mjs",

package/src/governance/approval-prompt.ts

@@ -10,6 +10,8 @@
  * no-op UI context whose `select` resolves undefined, so even a missed `hasUI` check would deny.
  */
 
+import { randomUUID } from "node:crypto";
+import type { AutoModeReader } from "../kernel/auto-mode.ts";
 import { approvalKey, offeredScopes, type ApprovalPath, type ApprovalScope } from "../kernel/approval.ts";
 import type { Capability } from "../kernel/resolve.ts";
 
@@ -72,6 +74,8 @@ export interface PromptOutcome {
    * one. The rider's honest source is `session`, and this flag is how the caller can tell.
    */
   joined?: boolean;
+  /** Provisional Auto permission; the admission caller must still check the live owner policy. */
+  source?: "auto";
 }
 
 export interface ApprovalGateOptions {
@@ -82,6 +86,7 @@ export interface ApprovalGateOptions {
   mode: string;
   /** Resolve only when this caller must open a new dialog; unused invalid settings cannot revoke authority. */
   timeoutMs?: number | (() => number | undefined);
+  autoMode?: AutoModeReader;
 }
 
 export interface ApprovalGate {
@@ -106,6 +111,8 @@ function labelToScope(label: string, scopes: ApprovalScope[]): ApprovalScope | n
   return scopes.find((s) => SCOPE_LABELS[s] === label) ?? null;
 }
 
+const autoApproval = (): PromptOutcome => ({ scope: "once", kind: "granted", source: "auto" });
+
 const interrupted = (request: PromptRequest, kind: "expired" | "aborted"): PromptOutcome => ({
   scope: null,
   kind,
@@ -124,26 +131,61 @@ async function selectApproval(
   const timeout = typeof options.timeoutMs === "function" ? options.timeoutMs() : options.timeoutMs;
   const controller = new AbortController();
   let outcome: PromptOutcome | undefined;
+  let settled = false;
   let wake!: (value: PromptOutcome) => void;
   const stopped = new Promise<PromptOutcome>((resolve) => {
     wake = resolve;
   });
-  const stop = (kind: "expired" | "aborted") => {
-    if (outcome) return;
-    outcome = interrupted(request, kind);
+  const settle = (next: PromptOutcome) => {
+    if (settled) return;
+    settled = true;
+    outcome = next;
     // Resolve our tagged outcome before a UI reacts to abort by returning undefined.
     wake(outcome);
     controller.abort();
   };
+  const stop = (kind: "expired" | "aborted") => settle(interrupted(request, kind));
   const abort = () => stop("aborted");
   request.signal?.addEventListener("abort", abort, { once: true });
   const timer = timeout === undefined ? undefined : setTimeout(() => stop("expired"), timeout);
+  let untrack: (() => void) | undefined;
   try {
     if (request.signal?.aborted) stop("aborted");
     if (outcome) return outcome;
-    const chosen = await Promise.race([options.ui.select(title, labels, { signal: controller.signal }), stopped]);
+    untrack = options.autoMode?.trackPending({
+      id: randomUUID(),
+      subject: request.subject,
+      capability: request.capability,
+    });
+    const selection = options.ui.select(title, labels, { signal: controller.signal }).then((chosen) => {
+      settled = true;
+      return chosen;
+    });
+    if (options.autoMode) {
+      const auto = options.autoMode;
+      void (async () => {
+        while (!controller.signal.aborted) {
+          await auto.waitEnabled(controller.signal);
+          // A notification is not authority: ON may already have changed back to OFF.
+          if (!controller.signal.aborted && (await auto.read()).enabled) {
+            settle(autoApproval());
+            return;
+          }
+        }
+      })().catch((error) => {
+        if (!controller.signal.aborted)
+          settle({
+            scope: null,
+            kind: "error",
+            reason: `Auto permission policy unavailable, denying (${String(error)})`,
+          });
+      });
+    }
+    const chosen = await Promise.race([selection, stopped]);
     return outcome ?? chosen;
   } finally {
+    controller.abort();
+    untrack?.();
     if (timer !== undefined) clearTimeout(timer);
     request.signal?.removeEventListener("abort", abort);
   }
@@ -211,6 +253,15 @@ export function createApprovalGate(
   inFlight: InFlightApprovals = new Map(),
 ): ApprovalGate {
   const ask = async (request: PromptRequest): Promise<PromptOutcome> => {
+    // A queued once waiter owns its own decision. Auto may have changed while it joined another dialog.
+    if (options.autoMode) {
+      try {
+        if ((await options.autoMode.read()).enabled)
+          return request.signal?.aborted ? interrupted(request, "aborted") : autoApproval();
+      } catch (error) {
+        return { scope: null, kind: "error", reason: `Auto permission policy unavailable, denying (${String(error)})` };
+      }
+    }
     const scopes = offeredScopes(request.path);
     const title =
       `grants: approve ${request.capability} for ${request.subject}?` +
@@ -251,6 +302,13 @@ export function createApprovalGate(
   return {
     async request(request: PromptRequest): Promise<PromptOutcome> {
       if (request.signal?.aborted) return interrupted(request, "aborted");
+      try {
+        if (options.autoMode && (await options.autoMode.read()).enabled) {
+          return request.signal?.aborted ? interrupted(request, "aborted") : autoApproval();
+        }
+      } catch (error) {
+        return { scope: null, kind: "error", reason: `Auto permission policy unavailable, denying (${String(error)})` };
+      }
       if (!options.hasUI) {
         // Nobody was there to ask — distinct from a person declining, which is why this is its own kind
         // rather than being folded into "declined" (see PromptOutcomeKind).