feat: package Pi extensions as Bun workspaces
This commit is contained in:
@@ -94,7 +94,7 @@ Node/Bun Python/Rust/Go/Java local integrations child isol
|
||||
| | | |
|
||||
+--------------------+--------------------------+---------------------+
|
||||
v
|
||||
Slice 6B2: pi-workflow/toolchain broker
|
||||
Slice 6B2: workflow/toolchain broker
|
||||
|
|
||||
v
|
||||
Slice 7A: Docker/browser Slice 7B: release/production Slice 7C: maintenance
|
||||
@@ -155,7 +155,7 @@ Slices in the same row may proceed in parallel after their listed dependencies a
|
||||
- one selected provider route;
|
||||
- no package registries, SSH, Docker, browser, microphone, deployment credentials, or broad localhost access.
|
||||
4. Separate extension source from extension state. Confirm that normal sessions cannot modify global instructions, installed extension code, authentication state, other Pi profiles, or sibling repositories.
|
||||
5. Materialize the normal in-process extension allowlist as a generated, isolated Pi `settings.json` under the selected personal/work state root. Its package/extension entries come only from `config/pi-package-lock.json` and the trusted repository map. Disable `pi-ask` arbitrary notification commands, `/update`, `pi-workflow`, background shell jobs, and any privileged direct spawn path until a controlled subprocess policy exists.
|
||||
5. Materialize the normal in-process extension allowlist as a generated, isolated Pi `settings.json` under the selected personal/work state root. Its package/extension entries come only from `config/pi-package-lock.json` and the trusted repository map. Disable `pi-ask` arbitrary notification commands, `/update`, `workflow`, background shell jobs, and any privileged direct spawn path until a controlled subprocess policy exists.
|
||||
6. Import the unmanaged `~/.pi/agent/extensions/lm-studio.ts` implementation into a repository-managed extension at `extensions/lm-studio/index.ts`, lock its source revision, and change its fixed base URL contract to `http://127.0.0.1:1234/v1`. Maintenance moves the old extension to the quarantined state store and removes its active settings entry. A duplicate-provider test fails if the old source, another `lm-studio` registration, or `localhost` base URL remains loadable.
|
||||
7. Define and own stable profile fragments for `provider-lm-studio`, `provider-openai`, `provider-anthropic`, and `provider-morph`, granting only one route at launch. Prove nono 0.74's `tcp_connect_ports` behavior with real loopback fixtures listening on ports 1234 and 1235: the selected provider must connect to 1234 while 1235 and every other loopback port fail. Do not use hostname-only `allow_domain` as evidence of port restriction. If the fixture cannot prove exact enforcement, `provider-lm-studio` remains unavailable until a separately reviewed mediated relay is designed.
|
||||
|
||||
@@ -165,7 +165,7 @@ Slices in the same row may proceed in parallel after their listed dependencies a
|
||||
- The selected provider works while non-selected provider hosts, raw key environment names, and credentials are absent from the environment and process table.
|
||||
- Reads outside the exact Pi state, declared active-worktree access, and per-launch temporary paths fail; writes to a read-only active worktree fail; another session's temporary directory is inaccessible.
|
||||
- LM Studio, when selected, reaches only `127.0.0.1:1234`.
|
||||
- `/update`, `pi-workflow`, arbitrary notification commands, and unbrokered background shell jobs are unavailable.
|
||||
- `/update`, `workflow`, arbitrary notification commands, and unbrokered background shell jobs are unavailable.
|
||||
- The repository-managed LM Studio provider uses only the exact `127.0.0.1:1234` base URL, the old unmanaged source is quarantined, duplicate registration fails, and a real two-port fixture proves all other loopback ports are denied.
|
||||
- All base and provider profiles pass strict validation and resolved-policy review.
|
||||
|
||||
@@ -342,7 +342,7 @@ A failed pilot returns to the owning slice. Do not compensate by broadening the
|
||||
|
||||
**Owner surfaces:** `profiles/nono/{node-npm,pnpm,bun}.json` and disjoint tests under `tests/nono/capabilities/{node-npm,pnpm,bun}/`.
|
||||
|
||||
**Work:** grant each command the active repository, exact cache/store paths, required registry and artifact hosts, and a token-free normal configuration. Separate install/build/test from publish. Cover lockfile-respecting commands used by the mapped repositories. Treat npm/pnpm/Bun lifecycle scripts and `npm test`, `npm run`, `pnpm run`, and equivalents as shell-spawning paths: prove their children inherit the package-manager command sandbox and cannot invoke SSH, Docker, browsers, deployment tools, sibling repositories, raw credentials, or an alternate package binary. Keep `pi-workflow` disabled until Slice 6B2 integrates its executor with these completed policies.
|
||||
**Work:** grant each command the active repository, exact cache/store paths, required registry and artifact hosts, and a token-free normal configuration. Separate install/build/test from publish. Cover lockfile-respecting commands used by the mapped repositories. Treat npm/pnpm/Bun lifecycle scripts and `npm test`, `npm run`, `pnpm run`, and equivalents as shell-spawning paths: prove their children inherit the package-manager command sandbox and cannot invoke SSH, Docker, browsers, deployment tools, sibling repositories, raw credentials, or an alternate package binary. Keep `workflow` disabled until Slice 6B2 integrates its executor with these completed policies.
|
||||
|
||||
**Acceptance criteria:** installs, builds, and tests work in representative npm, pnpm, and Bun fixtures; adversarial lifecycle/run scripts remain inside the command policy; sibling repositories, unrelated caches, privileged commands, and raw credentials remain unavailable; publish credentials and commands are absent outside release mode.
|
||||
|
||||
@@ -381,32 +381,32 @@ A failed pilot returns to the owning slice. Do not compensate by broadening the
|
||||
|
||||
## Slice 6B1: Child-agent and background-task isolation
|
||||
|
||||
**Goal:** isolate spawned Pi, Claude, Codex, bounded background jobs, Herdr panes, and tmux panes without enabling repository toolchain execution or `pi-workflow`.
|
||||
**Goal:** isolate spawned Pi, Claude, Codex, bounded background jobs, Herdr panes, and tmux panes without enabling repository toolchain execution or `workflow`.
|
||||
|
||||
**Owner surfaces:** `profiles/nono/{child-pi,child-claude,child-codex,background-jobs}.json`, new spawn-wrapper sources under `scripts/nono/child-agents/`, isolated child-state configuration, and `tests/nono/capabilities/child-agents/`. Coordinate with extension owners but avoid editing Slice 6A's socket fragments or shared extension files concurrently.
|
||||
|
||||
**Work:**
|
||||
|
||||
1. Inventory every spawn path in active subagent, `pi-ask`, update, and background-task extensions. Classify each in-process operation as safe UI/state access, disabled behavior, or a brokered subprocess. Keep `pi-workflow` absent from generated settings.
|
||||
1. Inventory every spawn path in active subagent, `pi-ask`, update, and background-task extensions. Classify each in-process operation as safe UI/state access, disabled behavior, or a brokered subprocess. Keep `workflow` absent from generated settings.
|
||||
2. Route child Pi, Claude, and Codex through command policies with isolated child state and the immutable provider selected by Slice 3.
|
||||
3. Broker only named background jobs and notification commands that do not invoke repository toolchains; keep arbitrary commands, package updates, and direct privileged spawn paths disabled.
|
||||
4. Define caller relationships and prohibit privileged-command escalation through child commands.
|
||||
5. Verify Herdr and tmux targets launch under equivalent or narrower generated policies before enabling command delivery.
|
||||
6. Add containment tests for nested children, background completion, cancellation, inherited environment, provider override denial, notification commands, package-update denial, and artifact paths.
|
||||
|
||||
**Acceptance criteria:** child commands receive no broader filesystem, network, credential, socket, environment, or provider access than declared; nested child tests prove containment; unsandboxed Herdr/tmux targets are rejected; bounded extension behavior remains functional without `pi-workflow` or toolchain execution.
|
||||
**Acceptance criteria:** child commands receive no broader filesystem, network, credential, socket, environment, or provider access than declared; nested child tests prove containment; unsandboxed Herdr/tmux targets are rejected; bounded extension behavior remains functional without `workflow` or toolchain execution.
|
||||
|
||||
**Dependencies:** pilot acceptance. May run in parallel with Slices 5A, 5B, and 6A.
|
||||
|
||||
## Slice 6B2: `pi-workflow` and toolchain integration
|
||||
## Slice 6B2: `workflow` and toolchain integration
|
||||
|
||||
**Goal:** enable `pi-workflow` only after every toolchain command it can invoke has a completed command policy.
|
||||
**Goal:** enable `workflow` only after every toolchain command it can invoke has a completed command policy.
|
||||
|
||||
**Owner surfaces:** `profiles/nono/pi-workflow.json`, workflow spawn-wrapper sources under `scripts/nono/child-agents/pi-workflow/`, the generated extension allowlist entry, and `tests/nono/capabilities/pi-workflow/`.
|
||||
**Owner surfaces:** `profiles/nono/workflow.json`, workflow spawn-wrapper sources under `scripts/nono/child-agents/workflow/`, the generated extension allowlist entry, and `tests/nono/capabilities/workflow/`.
|
||||
|
||||
**Work:** route `pi-workflow` executable resolution and every npm/pnpm/Bun/Python/Rust/Go/Maven/Gradle task through the completed Slice 5 policies. Include lifecycle/run scripts, nested package executables, verification commands, and cancellation. Any unmodeled executable or repository without the required toolchain fragment fails before workflow execution.
|
||||
**Work:** route `workflow` executable resolution and every npm/pnpm/Bun/Python/Rust/Go/Maven/Gradle task through the completed Slice 5 policies. Include lifecycle/run scripts, nested package executables, verification commands, and cancellation. Any unmodeled executable or repository without the required toolchain fragment fails before workflow execution.
|
||||
|
||||
**Acceptance criteria:** adversarial workflow tasks cannot bypass toolchain policies, select another provider, invoke high-risk commands, read sibling repositories, or access raw credentials; repositories lacking a required toolchain capability do not load `pi-workflow`.
|
||||
**Acceptance criteria:** adversarial workflow tasks cannot bypass toolchain policies, select another provider, invoke high-risk commands, read sibling repositories, or access raw credentials; repositories lacking a required toolchain capability do not load `workflow`.
|
||||
|
||||
**Dependencies:** Slices 5A, all applicable 5B language fragments, and Slice 6B1. It does not run in parallel with the toolchain policy it consumes.
|
||||
|
||||
@@ -479,7 +479,7 @@ To keep parallel work mergeable:
|
||||
| Base filesystem | Active registered worktree has exactly its mapped read-only or read/write access; exact mutable Pi state and the per-launch temporary directory are writable | A read-only worktree cannot be written; broad `/tmp`, runtime parents, other sessions, sibling or unregistered worktrees, global instructions, extension source, other Pi state, `~/.ssh`, and `~/.config/gh` are inaccessible or read-only as designed |
|
||||
| Temporary lifecycle | Normal exit and cancellation remove the private runtime directory; approved active use remains within its aggregate bound | Cleanup preserves a held lease, matching PID/start time, populated cgroup, live unit, or inconclusive identity; proven crash leftovers expire, unsafe paths survive for review, and an active session cannot exhaust `/run` |
|
||||
| Worktree lifecycle | Broker creates, registers, resolves, and safely removes an external clean worktree | Broad worktree-root access, age-only deletion, dirty/untracked/unpushed removal, active-worktree removal, and linked-worktree confidentiality claims fail |
|
||||
| Environment/extensions | Reviewed extensions and selected mediated provider credential work | Raw credential variables, old LM Studio source, duplicate providers, `/update`, `pi-workflow` before 6B2, arbitrary notification commands, and unbrokered shell jobs are absent |
|
||||
| Environment/extensions | Reviewed extensions and selected mediated provider credential work | Raw credential variables, old LM Studio source, duplicate providers, `/update`, `workflow` before 6B2, arbitrary notification commands, and unbrokered shell jobs are absent |
|
||||
| Provider | Trusted default or one pre-boundary approved flag selects the route; LM Studio reaches port 1234 | Ambiguous/post-boundary/child overrides, non-selected providers, LM Studio port 1235, and broad localhost fail |
|
||||
| Git/SSH | Fetch/push uses the correct provisioned agent and immutable wrapper | Direct SSH, stale/substituted agent, bypass config, alternate binary, same-port host, wrong agent, wrong host, and wrong port fail |
|
||||
| GitHub CLI | Active-repository operation succeeds through proxy | Real token exposure, cross-repository API, and unapproved endpoints fail |
|
||||
|
||||
Reference in New Issue
Block a user