Commit 6e9c5a851c92c52e2f4a8a80c655e60db133f9ac | the-knife

author	Wout Stiens <71498452+StiensWout@users.noreply.github.com> 2026-10-11 00:49:04+02:00
committer	GitHub <noreply@github.com> 2026-10-10 17:49:04-05:00
log	6e9c5a851c92c52e2f4a8a80c655e60db133f9ac
tree	704f8a986c17fc684e4e061da490ff3bd8205a5c
parent	62da1cd48bb43def11a79cd6aa033dbc478e4dfd
signature	Signed by PGP key B5690EEEBB952194

fix(pi): expire and cancel extension approvals (#17840)

4 files changed, 172 insertions(+), 6 deletions(-)

packages
- provider-pi
  - src
    server
    adapter.test.ts
    adapter.ts
    mcpExtensionSource.test.ts
    mcpExtensionSource.ts

packages/provider-pi/src/server/adapter.test.ts+104

...	@@ -2912,6 +2912,110 @@ describe("PiAdapterV2", () => {	...	@@ -2912,6 +2912,110 @@ describe("PiAdapterV2", () => {
2912	}).pipe(Effect.scoped, Effect.provide(layerTest)),	2912	}).pipe(Effect.scoped, Effect.provide(layerTest)),
2913	);	2913	);
2914		2914
		2915	it.effect("expires native dialogs and rejects stale answers without caching approval", () =>
		2916	Effect.gen(function* () {
		2917	const fake = yield* makeFakePi;
		2918	const { runtime, takeEvent } = yield* openRuntime(fake);
		2919	yield* runtime.ensureThread({
		2920	threadId: THREAD_ID,
		2921	modelSelection: modelSelection("default"),
		2922	runtimePolicy,
		2923	});
		2924	const dialog = {
		2925	type: "extension_ui_request",
		2926	method: "confirm",
		2927	title: "Allow extension?",
		2928	message: "Approve this operation",
		2929	};
		2930	yield* fake.emit({ ...dialog, id: "timed-dialog", timeout: 1000 });
		2931	const pending = yield* takeEvent(
		2932	(event) => event.type === "turn_item.updated" && event.turnItem.type === "approval_request",
		2933	);
		2934	assert.isTrue(
		2935	pending.type === "turn_item.updated" && pending.turnItem.type === "approval_request",
		2936	);
		2937	if (pending.type !== "turn_item.updated" \|\| pending.turnItem.type !== "approval_request")
		2938	return;
		2939	const requestId = pending.turnItem.requestId;
		2940	yield* TestClock.adjust(Duration.seconds(1));
		2941	yield* takeEvent(
		2942	(event) =>
		2943	event.type === "runtime_request.updated" &&
		2944	event.runtimeRequest.id === requestId &&
		2945	event.runtimeRequest.status === "cancelled",
		2946	);
		2947	assert.equal((yield* fake.takeRequest("extension_ui_response"))["cancelled"], true);
		2948	const late = yield* Effect.result(
		2949	runtime.respondToRuntimeRequest({
		2950	requestId: pending.turnItem.requestId,
		2951	decision: "acceptForSession",
		2952	}),
		2953	);
		2954	assert.equal(late._tag, "Failure");
		2955	yield* fake.emit({ ...dialog, id: "fresh-dialog", timeout: 1000 });
		2956	const fresh = yield* takeEvent(
		2957	(event) =>
		2958	event.type === "runtime_request.updated" &&
		2959	event.runtimeRequest.status === "pending" &&
		2960	event.runtimeRequest.nativeRequestRef?.nativeId === "fresh-dialog",
		2961	);
		2962	if (fresh.type !== "runtime_request.updated") return;
		2963	yield* runtime.respondToRuntimeRequest({
		2964	requestId: fresh.runtimeRequest.id,
		2965	decision: "accept",
		2966	});
		2967	assert.equal((yield* fake.takeRequest("extension_ui_response"))["id"], "fresh-dialog");
		2968	// The old expiry must not cancel an already answered request, and zero disables expiry.
		2969	yield* fake.emit({ ...dialog, id: "zero-timeout", timeout: 0 });
		2970	const zero = yield* takeEvent(
		2971	(event) =>
		2972	event.type === "runtime_request.updated" &&
		2973	event.runtimeRequest.status === "pending" &&
		2974	event.runtimeRequest.nativeRequestRef?.nativeId === "zero-timeout",
		2975	);
		2976	yield* TestClock.adjust(Duration.seconds(60));
		2977	if (zero.type !== "runtime_request.updated") return;
		2978	yield* runtime.respondToRuntimeRequest({
		2979	requestId: zero.runtimeRequest.id,
		2980	decision: "decline",
		2981	});
		2982	const response = yield* fake.takeRequest("extension_ui_response");
		2983	assert.equal(response["id"], "zero-timeout");
		2984	assert.equal(response["confirmed"], false);
		2985	}).pipe(Effect.scoped, Effect.provide(layerTest)),
		2986	);
		2987
		2988	it.effect("cancels startup dialogs when Pi exits before a turn exists", () =>
		2989	Effect.gen(function* () {
		2990	const fake = yield* makeFakePi;
		2991	const { runtime, takeEvent } = yield* openRuntime(fake);
		2992	yield* runtime.ensureThread({
		2993	threadId: THREAD_ID,
		2994	modelSelection: modelSelection("default"),
		2995	runtimePolicy,
		2996	});
		2997	yield* fake.emit({
		2998	type: "extension_ui_request",
		2999	id: "startup",
		3000	method: "confirm",
		3001	title: "Trust project?",
		3002	});
		3003	const pending = yield* takeEvent(
		3004	(event) =>
		3005	event.type === "runtime_request.updated" && event.runtimeRequest.status === "pending",
		3006	);
		3007	if (pending.type !== "runtime_request.updated") return;
		3008	yield* fake.closeStdout;
		3009	const cancelled = yield* takeEvent(
		3010	(event) =>
		3011	event.type === "runtime_request.updated" &&
		3012	event.runtimeRequest.id === pending.runtimeRequest.id &&
		3013	event.runtimeRequest.status === "cancelled",
		3014	);
		3015	assert.isTrue(cancelled.type === "runtime_request.updated");
		3016	}).pipe(Effect.scoped, Effect.provide(layerTest)),
		3017	);
		3018
2915	it.effect("remembers session approvals only for identical confirmation content", () =>	3019	it.effect("remembers session approvals only for identical confirmation content", () =>
2916	Effect.gen(function* () {	3020	Effect.gen(function* () {
2917	const fake = yield* makeFakePi;	3021	const fake = yield* makeFakePi;

packages/provider-pi/src/server/adapter.ts+53-4

 @@ -56,6 +56,7 @@ import * as Option from "effect/Option";
 import * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
+import * as Fiber from "effect/Fiber";
 import * as Layer from "effect/Layer";
 import * as Queue from "effect/Queue";
 import * as Schema from "effect/Schema";
 @@ -456,6 +457,8 @@ interface PendingPiPrompt {
   readonly method: "select" | "confirm" | "input" | "editor";
   readonly questionId: string;
   readonly approvalKey: string;
+  readonly expiresAt: number | null;
+  expirationFiber: Fiber.Fiber<void> | null;
   runtimeRequest: OrchestrationV2RuntimeRequest;
   readonly node: OrchestrationV2ExecutionNode;
   readonly turnItem: OrchestrationV2TurnItem;
 @@ -1270,6 +1273,7 @@ export const makePiAdapterV2 = Effect.fn("makePiAdapterV2")(function* (
       const cancelPrompt = (pending: PendingPiPrompt, resolvedAt: DateTime.Utc) =>
         Effect.gen(function* () {
+          if (pending.expirationFiber !== null) yield* Fiber.interrupt(pending.expirationFiber);
           yield* connection
             .send({
               type: "extension_ui_response",
 @@ -1368,6 +1372,12 @@ export const makePiAdapterV2 = Effect.fn("makePiAdapterV2")(function* (
         const state = threadState;
         const turn = state?.activeTurn ?? null;
         const createdAt = yield* DateTime.now;
+        const timeout = recordNumber(event, "timeout");
+        // Pi treats zero as no timeout and negative durations as immediate expiry.
+        const expiresAt =
+          timeout === undefined || timeout === 0
+            ? null
+            : DateTime.toEpochMillis(createdAt) + Math.max(0, timeout);
         const requestId = yield* idAllocator.allocate.runtimeRequest({
           driver: PI_PROVIDER,
           ...(turn === null ? {} : { providerTurnId: turn.providerTurn.id }),
 @@ -1440,15 +1450,18 @@ export const makePiAdapterV2 = Effect.fn("makePiAdapterV2")(function* (
                 requestId,
                 questions: [piQuestion(nativeRequestId, method, title, event)],
               };
-        pendingPrompts.set(String(requestId), {
+        const pending: PendingPiPrompt = {
           nativeRequestId,
           method,
           questionId: nativeRequestId,
           approvalKey,
+          expiresAt,
+          expirationFiber: null,
           runtimeRequest,
           node,
           turnItem,
-        });
+        };
+        pendingPrompts.set(String(requestId), pending);
         yield* emit({
           type: "runtime_request.updated",
           driver: PI_PROVIDER,
 @@ -1457,6 +1470,22 @@ export const makePiAdapterV2 = Effect.fn("makePiAdapterV2")(function* (
         });
         yield* emit({ type: "node.updated", driver: PI_PROVIDER, node });
         yield* emit({ type: "turn_item.updated", driver: PI_PROVIDER, turnItem });
+        if (expiresAt !== null) {
+          const now = yield* DateTime.now;
+          pending.expirationFiber = yield* Effect.sleep(
+            Duration.millis(Math.max(0, expiresAt - DateTime.toEpochMillis(now))),
+          ).pipe(
+            Effect.andThen(
+              Queue.offer(connection.events, {
+                type: "t3.ui_request_expired",
+                requestId: String(requestId),
+                pending,
+              }),
+            ),
+            Effect.asVoid,
+            Effect.forkIn(scope),
+          );
+        }
       });
       const emitExtensionError = Effect.fnUntraced(function* (event: PiRpcRecord) {
 @@ -2132,6 +2161,15 @@ export const makePiAdapterV2 = Effect.fn("makePiAdapterV2")(function* (
             }
             return;
           }
+          case "t3.ui_request_expired": {
+            const requestId = recordString(event, "requestId");
+            if (requestId === undefined) return;
+            const pending = pendingPrompts.get(requestId);
+            if (pending === undefined || pending !== event["pending"]) return;
+            pendingPrompts.delete(requestId);
+            yield* cancelPrompt(pending, yield* DateTime.now);
+            return;
+          }
           case "t3.flush_extension_errors": {
             // Startup extension failures are informational and do not block
             // Pi, so attach them to the next real turn instead of creating a
 @@ -2211,7 +2249,6 @@ export const makePiAdapterV2 = Effect.fn("makePiAdapterV2")(function* (
                   rollbackBarrier,
                   protocolError("Pi transport closed during rollback"),
                 );
-              const hadPendingWake = pendingWake !== null;
               pendingWake = null;
               const interrupted = state?.activeTurn?.interrupted === true;
               if (state?.activeTurn != null) {
 @@ -2223,7 +2260,7 @@ export const makePiAdapterV2 = Effect.fn("makePiAdapterV2")(function* (
                       class: "transport_error",
                     });
                 yield* finalizeTurn(state, false);
-              } else if (hadPendingWake) {
+              } else {
                 yield* cancelPendingPrompts(yield* DateTime.now);
               }
               if (unsolicitedActivityDetected) {
 @@ -2844,6 +2881,17 @@ export const makePiAdapterV2 = Effect.fn("makePiAdapterV2")(function* (
                 `No pending Pi extension request ${requestInput.requestId}`,
               );
             }
+            const answeredAt = yield* DateTime.now;
+            if (
+              pending.expiresAt !== null &&
+              DateTime.toEpochMillis(answeredAt) >= pending.expiresAt
+            ) {
+              pendingPrompts.delete(String(requestInput.requestId));
+              yield* cancelPrompt(pending, answeredAt);
+              return yield* protocolError(
+                `Pi extension request ${requestInput.requestId} has expired`,
+              );
+            }
             const response = piUiResponse(pending, requestInput.decision, requestInput.answers);
             yield* connection.send({
               type: "extension_ui_response",
 @@ -2853,6 +2901,7 @@ export const makePiAdapterV2 = Effect.fn("makePiAdapterV2")(function* (
             // Dropped only once Pi has the answer, so a failed send leaves the
             // request retryable and still cancellable during teardown.
             pendingPrompts.delete(String(requestInput.requestId));
+            if (pending.expirationFiber !== null) yield* Fiber.interrupt(pending.expirationFiber);
             if (pending.method === "confirm" && requestInput.decision === "acceptForSession") {
               sessionApprovals.add(pending.approvalKey);
             }

packages/provider-pi/src/server/mcpExtensionSource.test.ts+14-2

 @@ -249,7 +249,16 @@ describe("Pi tool discovery permissions", () => {
   it("allows discovery without confirmation and still gates the discovered tool", async () => {
     type ToolCallHook = (
       event: { toolName: string; input: unknown },
-      ctx: { ui: { confirm: (title: string, detail: string) => Promise<boolean> } },
+      ctx: {
+        signal: AbortSignal;
+        ui: {
+          confirm: (
+            title: string,
+            detail: string,
+            options: { signal: AbortSignal },
+          ) => Promise<boolean>;
+        };
+      },
     ) => Promise<{ block: true; reason: string } | undefined>;
     let toolCall: ToolCallHook | undefined;
     let searchPath = "builtin:tool-search";
 @@ -270,9 +279,12 @@ describe("Pi tool discovery permissions", () => {
     });
     assert.isDefined(toolCall);
     const confirmations: string[] = [];
+    const controller = new AbortController();
     const ctx = {
+      signal: controller.signal,
       ui: {
-        confirm: async (title: string) => {
+        confirm: async (title: string, _detail: string, options: { signal: AbortSignal }) => {
+          assert.strictEqual(options.signal, controller.signal);
           confirmations.push(title);
           return false;
         },

packages/provider-pi/src/server/mcpExtensionSource.ts+1

...	@@ -318,6 +318,7 @@ export default async function t3McpExtension(pi: ExtensionAPI) {	...	@@ -318,6 +318,7 @@ export default async function t3McpExtension(pi: ExtensionAPI) {
318	const approved = await ctx.ui.confirm(	318	const approved = await ctx.ui.confirm(
319	\`Allow \${event.toolName}?\`,	319	\`Allow \${event.toolName}?\`,
320	toolInputSummary(event.input),	320	toolInputSummary(event.input),
		321	{ signal: ctx.signal },
321	);	322	);
322	if (!approved) {	323	if (!approved) {
323	return { block: true, reason: \`\${event.toolName} was declined in T3 Code.\` };	324	return { block: true, reason: \`\${event.toolName} was declined in T3 Code.\` };