pi-landstrip 0.18.28 → 0.18.30

package/README.md

@@ -160,6 +160,34 @@ read Pi authentication and inherited credential environment variables. Install
 only trusted worker plugins and use credentials appropriate for the sandboxed
 task.
 
+## Permission ask providers
+
+A separate Pi extension can resolve agent permission rules that return `ask` by
+registering one `LandstripPermissionAskProvider`:
+
+```ts
+import type { ExtensionAPI } from '@earendil-works/pi-coding-agent';
+import { provideLandstripPermissionAsk } from 'pi-landstrip/api';
+
+export default function permissionReviewer(pi: ExtensionAPI): void {
+  provideLandstripPermissionAsk(pi, {
+    id: 'example-reviewer',
+    async decide(request) {
+      if (request.toolName === 'bash' && request.input.command === 'git status') {
+        return { decision: 'allow' };
+      }
+      return { decision: 'abstain' };
+    },
+  });
+}
+```
+
+The provider receives the tool name and input, pending permission/resource pairs,
+the primary or subagent context, and an abort signal. `allow` approves that call,
+`deny` blocks it, and `abstain` uses the normal UI prompt or headless denial.
+Provider errors also fall back safely. Only one provider may be registered at a
+time; the helper works regardless of extension load order and returns a disposer.
+
 ## License
 
 `pi-landstrip` is licensed under `Apache-2.0`. The bundled Landstrip package is

package/api.ts

@@ -56,6 +56,33 @@ export interface LandstripShellProvider {
   ): LandstripShellInvocation | Promise<LandstripShellInvocation>;
 }
 
+export interface LandstripPermissionAsk {
+  readonly permission: string;
+  readonly resource: string;
+}
+
+export interface LandstripPermissionAskRequest {
+  readonly context: LandstripContextV2;
+  readonly toolName: string;
+  readonly input: Readonly<Record<string, unknown>>;
+  readonly permissions: readonly LandstripPermissionAsk[];
+  /** Description of the subagent task that originated the request, when applicable. */
+  readonly taskDescription?: string;
+  readonly signal?: AbortSignal;
+}
+
+export type LandstripPermissionAskDecision =
+  | { readonly decision: 'allow' }
+  | { readonly decision: 'deny'; readonly reason?: string }
+  | { readonly decision: 'abstain' };
+
+export interface LandstripPermissionAskProvider {
+  readonly id: string;
+  decide(
+    request: LandstripPermissionAskRequest,
+  ): LandstripPermissionAskDecision | Promise<LandstripPermissionAskDecision>;
+}
+
 export interface LandstripProcessOptions {
   readonly command: string;
   readonly args: readonly string[];
@@ -112,6 +139,7 @@ export interface PiLandstripRuntimeV2 {
   readonly version: 2;
   getContext(ctx?: ExtensionContext): LandstripContextV2;
   registerShellProvider(provider: LandstripShellProvider): () => void;
+  registerPermissionAskProvider(provider: LandstripPermissionAskProvider): () => void;
   prepareProcess(options: LandstripProcessOptions): Promise<LandstripPreparedProcess>;
   registerWorkerExtension(extension: LandstripWorkerExtension): () => void;
   getWorkerExtensions(): readonly LandstripWorkerExtension[];
@@ -150,6 +178,7 @@ function isRuntime(value: unknown): value is PiLandstripRuntimeV2 {
     value.version === LANDSTRIP_RUNTIME_VERSION &&
     typeof value.getContext === 'function' &&
     typeof value.registerShellProvider === 'function' &&
+    typeof value.registerPermissionAskProvider === 'function' &&
     typeof value.prepareProcess === 'function' &&
     typeof value.registerWorkerExtension === 'function' &&
     typeof value.getWorkerExtensions === 'function' &&
@@ -202,6 +231,22 @@ export function provideLandstripShell(
   };
 }
 
+export function provideLandstripPermissionAsk(
+  pi: ExtensionAPI,
+  provider: LandstripPermissionAskProvider,
+): () => void {
+  let unregisterProvider: (() => void) | undefined;
+  const stopDiscovery = useLandstrip(pi, (runtime) => {
+    const unregisterNext = runtime.registerPermissionAskProvider(provider);
+    unregisterProvider?.();
+    unregisterProvider = unregisterNext;
+  });
+  return () => {
+    stopDiscovery();
+    unregisterProvider?.();
+  };
+}
+
 export function publishLandstripRuntime(
   pi: ExtensionAPI,
   runtime: PiLandstripRuntimeV2,

package/dist/index.ts

@@ -2215,27 +2215,49 @@ class Semaphore {
 
 class PermissionBroker {
   prompts;
+  resolveAsk;
   grants = new Set;
   resetController = new AbortController;
-  constructor(prompts) {
+  constructor(prompts, resolveAsk = async () => ({ decision: "abstain" })) {
     this.prompts = prompts;
+    this.resolveAsk = resolveAsk;
   }
-  async ask(ctx, task, permission, resource, signal) {
-    await this.askMany(ctx, task, [{ permission, resource }], signal);
+  async ask(ctx, task, permission, resource, signal, details) {
+    await this.askMany(ctx, task, [{ permission, resource }], signal, details);
   }
-  async askMany(ctx, task, requests, signal) {
+  async askMany(ctx, task, requests, signal, details) {
     const unique = [
       ...new Map(requests.map((request) => [`${request.permission}\x00${request.resource}`, request])).values()
     ];
     const pending = () => unique.filter(({ permission, resource }) => !this.grants.has(`${permission}\x00${resource}`));
     if (pending().length === 0)
       return;
-    if (!ctx.hasUI) {
-      const request = pending()[0];
-      throw new Error(`Permission required: ${request.permission} ${request.resource}`);
-    }
     const combined = combineAbortSignals(signal, this.resetController.signal);
     try {
+      if (details) {
+        let decision = { decision: "abstain" };
+        try {
+          decision = await this.resolveWithSignal({ ...details, permissions: pending(), signal: combined.signal }, combined.signal);
+        } catch (error) {
+          if (combined.signal.aborted)
+            throw new Error("Permission request cancelled");
+          console.error(`pi-landstrip: permission ask provider failed: ${formatError(error)}`);
+        }
+        if (combined.signal.aborted)
+          throw new Error("Permission request cancelled");
+        if (pending().length === 0)
+          return;
+        if (decision.decision === "allow")
+          return;
+        if (decision.decision === "deny") {
+          const request = pending()[0];
+          throw new Error(decision.reason ?? `Permission denied: ${request.permission} ${request.resource}`);
+        }
+      }
+      if (!ctx.hasUI) {
+        const request = pending()[0];
+        throw new Error(`Permission required: ${request.permission} ${request.resource}`);
+      }
       await this.prompts.resolve(() => pending().length === 0 ? true : undefined, async (promptSignal) => {
         const requested = pending();
         const choice = await ctx.ui.select(`${task}: permission required
@@ -2264,6 +2286,23 @@ ${requested.map(({ permission, resource }) => `${permission}: ${resource}`).join
     this.grants.clear();
     controller.abort();
   }
+  async resolveWithSignal(request, signal) {
+    if (signal.aborted)
+      throw new Error("Permission request cancelled");
+    let abort;
+    try {
+      return await Promise.race([
+        this.resolveAsk(request),
+        new Promise((_resolve, reject) => {
+          abort = () => reject(new Error("Permission request cancelled"));
+          signal.addEventListener("abort", abort, { once: true });
+        })
+      ]);
+    } finally {
+      if (abort)
+        signal.removeEventListener("abort", abort);
+    }
+  }
 }
 function renderTaskResult(id, state, value) {
   const tag = state === "error" ? "task_error" : "task_result";
@@ -2488,7 +2527,13 @@ function registerSubagentWorker(pi, config) {
       }
       if (decision !== "ask")
         continue;
-      const value = await ctx.ui.input(CONTROL_TITLE, JSON.stringify({ type: "permission", permission, resource }), { signal: ctx.signal });
+      const value = await ctx.ui.input(CONTROL_TITLE, JSON.stringify({
+        type: "permission",
+        permission,
+        resource,
+        toolName: event.toolName,
+        toolInput: input
+      }), { signal: ctx.signal });
       try {
         parseControlResponse(value);
       } catch (error) {
@@ -2559,7 +2604,10 @@ class SubagentRuntime {
     this.integration = integration;
     this.createWorker = createWorker;
     this.loadCatalog = loadCatalog;
-    this.broker = new PermissionBroker(permissionPrompts);
+    this.broker = new PermissionBroker(permissionPrompts, (request) => {
+      const resolveAsk = this.integration.resolvePermissionAsk;
+      return typeof resolveAsk === "function" ? resolveAsk.call(this.integration, request) : Promise.resolve({ decision: "abstain" });
+    });
   }
   register() {
     this.pi.registerTool(this.createTaskTool());
@@ -2649,7 +2697,11 @@ ${this.primaryAgent.prompt}` };
       }
       if (requests.length > 0 && this.primaryAgent) {
         try {
-          await this.broker.askMany(ctx, `@${this.primaryAgent.name}`, requests, ctx.signal);
+          await this.broker.askMany(ctx, `@${this.primaryAgent.name}`, requests, ctx.signal, {
+            context: this.permissionContext(ctx),
+            toolName: event.toolName,
+            input
+          });
         } catch (error) {
           return { block: true, reason: formatError(error) };
         }
@@ -3409,7 +3461,12 @@ ${catalog.diagnostics.join(`
     if (taskPermission === "deny")
       throw new Error(`Task permission denied for ${agent.name}`);
     if (taskPermission === "ask") {
-      await this.broker.ask(ctx, input.description, "task", agent.name, signal);
+      await this.broker.ask(ctx, input.description, "task", agent.name, signal, {
+        context: parentTask ? this.taskContext(parentTask, ctx) : this.permissionContext(ctx),
+        toolName: "task",
+        input: { ...input },
+        taskDescription: parentTask?.description
+      });
     }
     const depth = (parentTask?.depth ?? -1) + 1;
     if (depth > MAX_DEPTH)
@@ -3868,6 +3925,18 @@ ${catalog.diagnostics.join(`
       depth: task.depth
     };
   }
+  permissionContext(ctx) {
+    const context = this.integration.getContext?.(ctx) ?? {
+      version: 2,
+      host: "pi",
+      role: "primary",
+      sandbox: "unavailable",
+      cwd: ctx.cwd,
+      sessionId: ctx.sessionManager.getSessionId(),
+      depth: 0
+    };
+    return { ...context, agent: this.primaryAgent?.name };
+  }
   piInvocation() {
     const argvEntry = process.argv[1];
     if (argvEntry && /(?:^|[/\\])cli\.(?:js|mjs|cjs|ts)$/.test(argvEntry)) {
@@ -3897,10 +3966,20 @@ ${catalog.diagnostics.join(`
           throw new Error("Invalid worker control request");
         }
         if (control.type === "permission") {
-          if (typeof control.permission !== "string" || typeof control.resource !== "string") {
+          if (typeof control.permission !== "string" || typeof control.resource !== "string" || typeof control.toolName !== "string" || !isRecord2(control.toolInput)) {
             throw new Error("Invalid permission request");
           }
-          await this.broker.ask(ctx, task.description, control.permission, control.resource, this.controllers.get(task.id)?.signal);
+          const derivedPermission = permissionName(control.toolName);
+          const derivedResources = permissionResources(control.toolName, control.toolInput, ctx.cwd);
+          if (control.permission !== derivedPermission || !derivedResources.includes(control.resource) || permissionDecision(rules, control.permission, control.resource) !== "ask") {
+            throw new Error("Invalid permission request");
+          }
+          await this.broker.ask(ctx, task.description, control.permission, control.resource, this.controllers.get(task.id)?.signal, {
+            context: this.taskContext(task, ctx),
+            toolName: control.toolName,
+            input: control.toolInput,
+            taskDescription: task.description
+          });
           response = { ok: true };
         } else {
           if (!isRecord2(control.input))
@@ -5066,6 +5145,7 @@ function createLandstripIntegrationWithPrompts(options, permissionPrompts) {
   let unpublishRuntime;
   const defaultShellProvider = createPosixShellProvider();
   let externalShellProvider;
+  let externalPermissionAskProvider;
   const eventHandlers = new Set;
   const workerExtensions = new Map;
   const sessionAllowedDomains = [];
@@ -5126,6 +5206,33 @@ function createLandstripIntegrationWithPrompts(options, permissionPrompts) {
         externalShellProvider = undefined;
     };
   }
+  function registerPermissionAskProvider(provider) {
+    const id = provider.id.trim();
+    if (!id)
+      throw new Error("Permission ask provider id must not be empty");
+    if (externalPermissionAskProvider) {
+      throw new Error(`Permission ask provider "${externalPermissionAskProvider.id}" is already registered; cannot register "${id}"`);
+    }
+    externalPermissionAskProvider = provider;
+    let disposed = false;
+    return () => {
+      if (disposed)
+        return;
+      disposed = true;
+      if (externalPermissionAskProvider === provider)
+        externalPermissionAskProvider = undefined;
+    };
+  }
+  async function resolvePermissionAsk(request) {
+    const provider = externalPermissionAskProvider;
+    if (!provider)
+      return { decision: "abstain" };
+    const result = await provider.decide(request);
+    if (typeof result !== "object" || result === null || !("decision" in result) || !["allow", "deny", "abstain"].includes(String(result.decision)) || "reason" in result && result.reason !== undefined && typeof result.reason !== "string") {
+      throw new Error(`Permission ask provider "${provider.id}" returned an invalid decision`);
+    }
+    return result;
+  }
   function activeShellProvider() {
     return externalShellProvider ?? defaultShellProvider;
   }
@@ -6568,6 +6675,8 @@ ${target.path}`);
     version: LANDSTRIP_RUNTIME_VERSION,
     getContext,
     registerShellProvider,
+    registerPermissionAskProvider,
+    resolvePermissionAsk,
     prepareProcess,
     prepareRpcWorker,
     authorizeFilesystemToolAccess,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-landstrip",
-  "version": "0.18.28",
+  "version": "0.18.30",
   "description": "Sandboxed Bash and process-backed agents for Pi",
   "keywords": [
     "landstrip",
@@ -39,7 +39,7 @@
     "ci:test": "npm run test"
   },
   "dependencies": {
-    "@landstrip/landstrip": "^0.18.28",
+    "@landstrip/landstrip": "^0.18.30",
     "jsonc-parser": "^3.3.1",
     "minimatch": "^10.2.5",
     "yaml": "^2.9.0"