pi-harness-delegate 0.6.0 → 0.6.1

package/README.md

@@ -134,7 +134,7 @@ You are a senior engineer delegated by the pi coding agent.
 
 Custom templates are just files dropped in the above dirs — any registered name becomes a valid `mode`.
 
-**Project trust:** project-local templates (`.pi/delegate/templates/`) load only when pi itself considers the current project trusted (`ctx.isProjectTrusted()`, backed by pi's own trust store outside the project — the same trust that gates other project-scoped behavior). Trust it via pi's own trust prompt (shown the first time you open an untrusted directory) or your `defaultProjectTrust` setting; `/delegate status` reports whether the current project is trusted and, if not, that project-local templates are being skipped. There is **no way to grant trust from inside the project** — no `.pi/trusted` file, no environment variable. Earlier versions supported both (`.pi/trusted` containing `1`, or `PI_TRUSTED=1`/`PI_DELEGATE_TRUSTED=1` in the environment); both were removed as a security fix — a repo could commit `.pi/trusted` and declare itself trusted, letting a cloned hostile repo's templates silently override a builtin (e.g. widening `review` from `readonly` to `edit` and attaching a `verify:` command that runs host-side). If you relied on either, switch to pi's trust prompt or `defaultProjectTrust`.
+**Project trust:** project-local templates (`.pi/delegate/templates/`) load only when pi itself considers the current project trusted (`ctx.isProjectTrusted()`, backed by pi's own trust store outside the project — the same trust that gates other project-scoped behavior). Trust it via pi's own trust prompt (shown the first time you open an untrusted directory) or your `defaultProjectTrust` setting; `/delegate status` reports whether the current project is trusted and, if not, that project-local templates are being skipped. There is **no way to grant trust from inside the project** — no `.pi/trusted` file, no environment variable. Earlier versions supported both (`.pi/trusted` containing `1`, or `PI_TRUSTED=1`/`PI_DELEGATE_TRUSTED=1` in the environment); both were removed as a security fix — a repo could commit `.pi/trusted` and declare itself trusted, letting a cloned hostile repo's templates silently override a builtin (e.g. widening `review` from `readonly` to `edit` and attaching a `verify:` command that runs host-side). If you relied on either, switch to pi's trust prompt or `defaultProjectTrust`. **On upgrade this is otherwise silent** — a project override shares its name with the builtin it replaces, so the run just uses the builtin and looks fine — so a delegation in an untrusted project that actually has `.pi/delegate/templates/` now prints a one-time warning saying they were skipped, and points out a leftover `.pi/trusted` file if one is present (it no longer does anything and can be deleted).
 
 ## How the main session consumes the output
 

package/extensions/index.ts

@@ -86,7 +86,13 @@ import { NotifyBatcher } from './notify.ts';
 import { type FeedEntry, progressWindow } from './progress.ts';
 import { formatFanoutChip, multiProgressWindow, type RunRow } from './progress-multi.ts';
 import { runHarness } from './runner.ts';
-import { type DelegateTemplate, loadTemplates, resolveNativePermission } from './templates.ts';
+import {
+  type DelegateTemplate,
+  describeSkippedProjectTemplates,
+  loadTemplates,
+  projectTemplatePresence,
+  resolveNativePermission,
+} from './templates.ts';
 import { mapClaudeUsage } from './usage.ts';
 
 /** Render a possibly-unknown cost — `null` means the harness didn't report one, not a measured $0. */
@@ -188,6 +194,28 @@ function outputsDirFor(harness: string): string {
  * project-local delegate templates load — see the trust-tier comment on `loadTemplates`. Fails
  * closed (untrusted) if the host is old enough not to expose the method, or if it throws.
  */
+/**
+ * Warn once per project when trusted-only content was silently skipped.
+ *
+ * Before 0.6.0 a committed `.pi/trusted` file (or `PI_TRUSTED=1`) granted trust; both were removed as
+ * a security fix. A user who relied on either loses their project-local templates on upgrade with no
+ * visible signal — an override shares its name with the builtin it replaces, so the run just uses the
+ * builtin and looks fine. `/delegate status` reports trust state, but nobody runs it unless something
+ * already looks wrong, so this fires on an actual delegation instead — and only when the project
+ * demonstrably has the content being skipped, so it never nags anyone unaffected.
+ */
+const warnedUntrustedProjects = new Set<string>();
+
+function warnIfProjectTemplatesSkipped(ctx: ExtensionContext, trusted: boolean): void {
+  if (trusted || warnedUntrustedProjects.has(ctx.cwd)) return;
+  const lines = describeSkippedProjectTemplates(projectTemplatePresence(ctx.cwd));
+  if (lines.length === 0) return;
+  warnedUntrustedProjects.add(ctx.cwd);
+  const msg = lines.join('\n');
+  if (ctx.hasUI) ctx.ui.notify?.(msg, 'warning');
+  else process.stderr.write(`${msg}\n`);
+}
+
 function isProjectTrusted(ctx: ExtensionContext): boolean {
   try {
     return typeof ctx.isProjectTrusted === 'function' && ctx.isProjectTrusted() === true;
@@ -611,7 +639,9 @@ async function delegate(
     throw new Error(
       `unknown harness "${harnessName}". Available: ${HARNESS_NAMES.join(', ')} (aliases: ${Object.keys(ALIASES).join(', ')})`,
     );
-  const templates = loadTemplates(ctx.cwd, harnessName, isProjectTrusted(ctx));
+  const projectTrusted = isProjectTrusted(ctx);
+  warnIfProjectTemplatesSkipped(ctx, projectTrusted);
+  const templates = loadTemplates(ctx.cwd, harnessName, projectTrusted);
   const mode = opts.mode || config.defaultMode;
   const template = templates.get(mode);
   if (!template)

package/extensions/templates.ts

@@ -201,3 +201,56 @@ export function resolveNativePermission(
   if (!nativePermission) return undefined;
   return effectivePermission === templatePermission ? nativePermission : undefined;
 }
+
+/**
+ * What a project has on disk that only loads when the project is trusted.
+ *
+ * Used to warn a user whose project-local templates stopped loading after the 0.6.0 security fix
+ * (§19 of ROADMAP) — before it, a committed `.pi/trusted` file or `PI_TRUSTED=1` granted trust, and
+ * both were removed. The failure is otherwise invisible: an override shares its name with the
+ * builtin it replaces, so the run silently uses the builtin and produces plausible output.
+ *
+ * Pure filesystem inspection — no trust logic. The caller supplies the trust decision.
+ */
+export function projectTemplatePresence(cwd: string): {
+  /** Template dirs that exist and would load if the project were trusted. */
+  dirs: string[];
+  /** A leftover `.pi/trusted` file — strong evidence the user relied on the removed mechanism. */
+  staleTrustFile: boolean;
+} {
+  const candidates = [projectTemplatesDir(cwd), legacyProjectTemplatesDir(cwd)];
+  const dirs: string[] = [];
+  for (const dir of candidates) {
+    try {
+      if (readdirSync(dir).some(f => f.endsWith('.md'))) dirs.push(dir);
+    } catch {
+      // absent or unreadable — nothing to warn about
+    }
+  }
+  let staleTrustFile = false;
+  try {
+    staleTrustFile = existsSync(join(cwd, '.pi', 'trusted'));
+  } catch {
+    staleTrustFile = false;
+  }
+  return { dirs, staleTrustFile };
+}
+
+/** One-line notices for a project whose trusted-only content was skipped. Empty when nothing applies. */
+export function describeSkippedProjectTemplates(presence: { dirs: string[]; staleTrustFile: boolean }): string[] {
+  if (presence.dirs.length === 0 && !presence.staleTrustFile) return [];
+  const out: string[] = [];
+  if (presence.dirs.length > 0) {
+    out.push(
+      `⚠ project-local templates were NOT loaded — this project is untrusted (${presence.dirs.join(', ')})`,
+      "  trust it via pi's trust prompt or defaultProjectTrust; /delegate status shows trust state",
+    );
+  }
+  if (presence.staleTrustFile) {
+    out.push(
+      '  a leftover .pi/trusted file was found — it no longer grants trust (removed in 0.6.0 as a',
+      '  security fix, since a repo could use it to trust itself) and can be deleted',
+    );
+  }
+  return out;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-harness-delegate",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Delegate work to any harness (Claude Code, Muse, OpenCode, Amp) from the pi coding agent \u2014 code reviews, plans, implementation, security audits, docs, or your own custom templates.",
   "type": "module",
   "packageManager": "bun@1.3.14",