tau-all-agent 0.3.0 → 0.4.0

package/extensions/sandbox/index.ts

@@ -54,17 +54,12 @@
  */
 
 import { fileURLToPath } from "node:url";
-import {
-  createBashToolDefinition,
-  type ExtensionAPI,
-  type ExtensionContext,
-} from "@earendil-works/pi-coding-agent";
-import { Type } from "typebox";
+import type { Usage } from "@earendil-works/pi-ai";
+import { createBashToolDefinition, type ExtensionAPI } from "@earendil-works/pi-coding-agent";
 
-import { createSandboxedBashOps, createUnsandboxedBashOps } from "./bash.js";
+import { createSandboxedBashOps } from "./bash.js";
 import { registerSandboxCommand } from "./command.js";
-import { isUnsandboxedApproval } from "./permissions/unsandboxed.js";
-import { createSandboxRuntime, getSandboxRunMode } from "./runtime.js";
+import { createSandboxRuntime, getSandboxRunMode, type SandboxInvocation } from "./runtime.js";
 
 export default function sandboxExtension(pi: ExtensionAPI): void {
   pi.registerFlag("no-sandbox", {
@@ -80,44 +75,14 @@ export default function sandboxExtension(pi: ExtensionAPI): void {
   });
 
   const runtime = createSandboxRuntime(pi);
-  pi.events.on("subagent:unsandboxed-approval", (data) => {
-    const request = data as {
-      ctx?: ExtensionContext;
-      title?: unknown;
-      choices?: unknown;
-      signal?: AbortSignal;
-      result?: Promise<string | undefined>;
-    };
-    if (
-      !request?.ctx ||
-      typeof request.title !== "string" ||
-      !Array.isArray(request.choices) ||
-      !isUnsandboxedApproval(request.choices)
-    ) {
-      return;
-    }
-    const { ctx, title } = request;
-    const choices = [...request.choices];
-    request.result = runtime
-      .withPermissionContext(ctx, request.signal, async (_ctx, signal) => {
-        if (
-          !ctx.hasUI ||
-          !["tui", "rpc"].includes(ctx.mode) ||
-          runtime.state.status !== "active" ||
-          runtime.promptMode !== "interactive"
-        ) {
-          return undefined;
-        }
-        // The subagent already owns the parent's permission queue. Use the original UI,
-        // not the invocation wrapper, to avoid recursively entering that queue.
-        const choice = await ctx.ui.select(title, choices, { signal });
-        return signal.aborted ||
-          runtime.state.status !== "active" ||
-          runtime.promptMode !== "interactive"
-          ? undefined
-          : choice;
-      })
-      .catch(() => undefined);
+  const failedUsage = new Map<string, Usage>();
+  // Pi converts thrown tool errors to results. Restore already-incurred review usage at
+  // that public boundary without changing native Bash's cancellation/error behavior.
+  pi.on("tool_result", (event) => {
+    if (event.toolName !== "bash") return;
+    const usage = failedUsage.get(event.toolCallId);
+    failedUsage.delete(event.toolCallId);
+    if (usage) return { usage: event.usage ? sumUsage([event.usage, usage]) : usage };
   });
   pi.events.on("subagent:sandbox", (data) => {
     const handoff = data as { config?: unknown; extension?: string; error?: string };
@@ -141,54 +106,11 @@ export default function sandboxExtension(pi: ExtensionAPI): void {
     }
     handoff.extension = fileURLToPath(import.meta.url);
   });
-  const sandboxedOps = createSandboxedBashOps({
-    getContext: () => runtime.context,
-    getSandboxConfig: () => runtime.config,
-    getRuntimeConfig: () => runtime.getRuntimeConfig(),
-    getPromptMode: () => runtime.promptMode,
-    applyRuntimeConfigForSession: runtime.applyRuntimeConfigForSession,
-    recordEvent: runtime.recordEvent,
-  });
-
   const localBashTool = createBashToolDefinition(process.cwd());
   pi.registerTool({
     ...localBashTool,
     label: "bash (sandbox-aware)",
-    description:
-      localBashTool.description +
-      " Set requestUnsandboxed to true to request fresh human approval for this invocation outside the sandbox. Requires an active sandbox, interactive permission mode, and human UI. Never retries or changes sandbox policy.",
-    parameters: Type.Object({
-      ...localBashTool.parameters.properties,
-      requestUnsandboxed: Type.Optional(
-        Type.Boolean({
-          description:
-            "Request human approval to run this command and its descendants once outside Tau's OS sandbox restrictions (default false).",
-        }),
-      ),
-    }),
     async execute(id, params, signal, onUpdate, ctx) {
-      const { command, timeout, requestUnsandboxed } = params;
-      if (requestUnsandboxed !== undefined && typeof requestUnsandboxed !== "boolean") {
-        throw new Error("requestUnsandboxed must be a boolean.");
-      }
-      if (requestUnsandboxed === true) {
-        return runtime.withPermissionContext(ctx, signal, (invocationContext, invocationSignal) => {
-          const operations = createUnsandboxedBashOps(
-            runtime,
-            sandboxedOps,
-            invocationContext,
-            invocationSignal,
-          );
-          const tool = createBashToolDefinition(ctx.cwd, { operations });
-          return tool.execute(
-            id,
-            { command, timeout },
-            invocationSignal,
-            onUpdate,
-            invocationContext,
-          );
-        });
-      }
       const state = runtime.state;
       if (state.status !== "active") {
         const allowsUnsandboxed = state.status === "bypassed" || state.status === "suspended";
@@ -216,34 +138,77 @@ export default function sandboxExtension(pi: ExtensionAPI): void {
         return localBashTool.execute(id, params, signal, onUpdate, ctx);
       }
 
-      return runtime.withPermissionContext(ctx, signal, (invocationContext, invocationSignal) => {
+      return runtime.withPermissionLifetime(ctx, signal, async (toolSignal) => {
+        let invocation: SandboxInvocation | undefined;
         const tool = createBashToolDefinition(ctx.cwd, {
           operations: {
             exec(command, cwd, options) {
-              return sandboxedOps.runSerially(
-                () =>
-                  runtime.withBashContext(ctx, invocationSignal, async () => {
-                    const result = await sandboxedOps.exec(command, cwd, options);
-                    if (invocationSignal.aborted) throw new Error("aborted");
-                    return result;
-                  }),
-                invocationSignal,
+              // Keep queue rejection and cancellation inside native Bash's output/error handling.
+              return runtime.runBash(
+                ctx,
+                toolSignal,
+                (owner) => {
+                  invocation = owner;
+                  owner.activeCommand = { text: command, cwd };
+                  return createSandboxedBashOps({
+                    ctx: owner.ctx,
+                    getSandboxConfig: () => runtime.config,
+                    getRuntimeConfig: () => runtime.getRuntimeConfig(),
+                    applyRuntimeConfigForSession: runtime.applyRuntimeConfigForSession,
+                    recordEvent: runtime.recordEvent,
+                    resolvePermission: (proposal) => runtime.resolvePermission(proposal, owner),
+                  }).exec(command, cwd, { ...options, signal: owner.signal });
+                },
+                id,
               );
             },
           },
         });
-        return tool.execute(id, params, invocationSignal, onUpdate, invocationContext);
+        try {
+          const result = await tool.execute(id, params, toolSignal, onUpdate, ctx);
+          return invocation?.usages.length
+            ? { ...result, usage: sumUsage(invocation.usages) }
+            : result;
+        } catch (error) {
+          if (invocation?.usages.length) failedUsage.set(id, sumUsage(invocation.usages));
+          throw error;
+        }
       });
     },
   });
 
   pi.on("session_start", async (_event, ctx) => {
     await runtime.start(ctx);
+    failedUsage.clear();
   });
 
   pi.on("session_shutdown", async (_event, ctx) => {
     await runtime.shutdown(ctx);
+    failedUsage.clear();
   });
 
   registerSandboxCommand(pi, runtime);
 }
+
+function sumUsage(usages: Usage[]): Usage {
+  const total: Usage = {
+    input: 0,
+    output: 0,
+    cacheRead: 0,
+    cacheWrite: 0,
+    totalTokens: 0,
+    cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 },
+  };
+  for (const usage of usages) {
+    for (const key of ["input", "output", "cacheRead", "cacheWrite", "totalTokens"] as const) {
+      total[key] += usage[key];
+    }
+    for (const key of ["input", "output", "cacheRead", "cacheWrite", "total"] as const) {
+      total.cost[key] += usage.cost[key];
+    }
+    for (const key of ["cacheWrite1h", "reasoning"] as const) {
+      if (usage[key] !== undefined) total[key] = (total[key] ?? 0) + usage[key];
+    }
+  }
+  return total;
+}

package/extensions/sandbox/macos-sandbox-shell.mjs

@@ -7,8 +7,8 @@
  * its SOCKS5 proxy. This shell preserves normal bash execution while replacing
  * that transport with an authenticated HTTP CONNECT tunnel.
  *
- * Remove once the upstream fix ships:
- * https://github.com/anthropic-experimental/sandbox-runtime/pull/385
+ * Remove once the upstream fix ships (not included in 0.0.79):
+ * https://github.com/anthropics/sandbox-runtime/pull/681
  */
 
 import { spawn } from "node:child_process";