pi-open-agents 0.1.13 → 0.1.14

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-open-agents",
-  "version": "0.1.13",
+  "version": "0.1.14",
   "description": "Unified agent and subagent management for pi coding agent, with OpenCode-compatible agent definitions.",
   "keywords": [
     "pi-package",

package/src/config/schema.ts

@@ -183,6 +183,10 @@ function parseToolsAndPermission(
  * Convert OpenCode-style tools map to PermissionConfig.
  *
  * { "read": true, "write": false } → { "read": "allow", "write": "deny" }
+ *
+ * `write` and `edit` are kept as separate keys — in pi they are separate
+ * tools (create/overwrite vs search-and-replace). Only `apply_patch`
+ * (OpenCode-only) is mapped to `edit`.
  */
 function toolsMapToPermission(toolsMap: Record<string, unknown>): PermissionConfig {
   const config: PermissionConfig = {};
@@ -191,8 +195,8 @@ function toolsMapToPermission(toolsMap: Record<string, unknown>): PermissionConf
     // Skip non-boolean values
     if (typeof enabled !== "boolean") continue;
 
-    // Map edit-like tools to "edit" permission (OpenCode convention)
-    const permKey = toolName === "write" || toolName === "edit" || toolName === "apply_patch"
+    // Map OpenCode-only tools to their pi equivalent
+    const permKey = toolName === "apply_patch"
       ? "edit"
       : toolName;
 

package/src/permission/evaluator.ts

@@ -20,15 +20,19 @@ import { matchPattern } from "./matcher.ts";
 /**
  * Map a tool name to its permission category.
  *
- * Multiple tools can share a permission category:
- *   write, edit, apply_patch  → "edit"
+ * Some tools share a permission category with another tool:
+ *   apply_patch → "edit"  (OpenCode-only tool, functionally equivalent to edit)
  *   list_mcp_resources, read_mcp_resource → "read"
  *
+ * In pi, `write` and `edit` are SEPARATE tools (create/overwrite vs
+ * search-and-replace). They must stay as separate permission categories so
+ * that `{edit: true, write: false}` works as expected.
+ *
  * Everything else maps by tool name directly.
  */
 export function toolToPermission(toolName: string): string {
-  // File-editing tools all map to "edit"
-  if (toolName === "write" || toolName === "edit" || toolName === "apply_patch") {
+  // OpenCode's apply_patch maps to pi's edit (no apply_patch tool in pi)
+  if (toolName === "apply_patch") {
     return "edit";
   }
 

package/src/subagent/env.ts

@@ -19,7 +19,6 @@ export type RecursionEnv = Partial<
     | "PI_OPEN_AGENTS_SYSTEM_PROMPT_MODE"
     | "PI_OPEN_AGENTS_ALLOWED"
     | "PI_OPEN_AGENTS_SESSION"
-    | "PI_OPEN_AGENTS_PERMISSION"
     | "PI_OPEN_AGENTS_DEBUG",
     string
   >

package/src/subagent/executor.ts

@@ -143,6 +143,41 @@ const defaultExecutorFs: ExecutorFs = {
 
 // ─── Helpers ─────────────────────────────────────────────────────────────────
 
+/**
+ * Derive a tools whitelist from the agent definition for the child process.
+ *
+ * The `--tools` CLI flag is a whitelist (include only these). It works with:
+ * - Explicit `agent.tools` array (pi-style CSV)
+ * - Simple permission allow-lists (keys with "allow", no wildcard)
+ *
+ * Does NOT work with:
+ * - Wildcard permissions (`*: allow` + specific denies) — can't derive a
+ *   finite whitelist. The child gets all tools. This is a known limitation
+ *   of the `--tools` flag (it's a whitelist, not a deny-list).
+ * - Pattern-based permissions (`edit: { "*.env": deny }`) — patterns can't
+ *   be expressed as a flat tool whitelist.
+ */
+function deriveToolsWhitelist(agent: AgentDefinition): string[] | undefined {
+  // Explicit tools array — use directly
+  if (agent.tools && agent.tools.length > 0) {
+    return agent.tools;
+  }
+
+  // Derive from permission config
+  if (agent.permission) {
+    // Can't derive a finite whitelist when wildcard is present
+    if ("*" in agent.permission) return undefined;
+
+    const allowed = Object.entries(agent.permission)
+      .filter(([, value]) => value === "allow")
+      .map(([key]) => key);
+
+    return allowed.length > 0 ? allowed : undefined;
+  }
+
+  return undefined;
+}
+
 function emptyUsage(): AgentUsage {
   return { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, cost: 0, contextTokens: 0 };
 }
@@ -478,8 +513,9 @@ export async function runSubagent(options: RunSubagentOptions): Promise<AgentRes
     args.push("--thinking", options.agent.thinking);
 
     // Tools whitelist
-    if (options.agent.tools && options.agent.tools.length > 0) {
-      args.push("--tools", options.agent.tools.join(","));
+    const toolsWhitelist = deriveToolsWhitelist(options.agent);
+    if (toolsWhitelist && toolsWhitelist.length > 0) {
+      args.push("--tools", toolsWhitelist.join(","));
     }
 
     // System prompt file (append or replace)