[yuanhao]

Asked for by yobuild (M3b step 3; spec in yobuild PR #44, docs/design.md §12). Additive config for the pi adapter; ships as yoagent-rutis 0.8.0.

• exec / execFor[file] = "gate" — each pi.exec goes to host_approval.judge([command, ...args], cwd?) (options.cwd resolved against the adapter's cwd; omitted without one). {free: true} runs it; otherwise host_approval.ask(question, details | null, file), and only "allow" runs it. Block / unanswered / host error / cancel / no service → the existing refusal (126, reason in stderr, warn once per extension + command). The call runs in the same resolved cwd that was judged. judge bounded at 30 s; ask is the host's to time out; both race the call's signal.
• projectTrustedFor: {file: bool} — ctx.isProjectTrusted() per extension (handlers and tools), over projectTrusted.
• wakeFor: {file: bool} — pi.sendUserMessage and a turn-starting pi.sendMessage → host_session.wake(text, file), on one ordered chain (steering arrives in the order sent); the message is still recorded. pi's API returns void, so a refusal is a warn line (once per extension), not an error to the extension. Without the grant: unchanged.
• Every per-file key resolves like extensions; an unknown key or a bad value refuses the load (one keyed helper).
• host-approval.ts, host-session.ts — re-provide host_approval / host_session as pi-host-approval / pi-host-session (as host-ui.ts does ui), looked up per call, so rows without these grants need neither.
• Fixed-answer log lines name the extension: [pi] fixed answer (<file>): …, once per extension, question and answer. context() now takes the handler's / tool's extension file.

Tests (tests/pi_test.rs): exec_gate_asks_the_host — free / allow / block / judge error / ungranted neighbour, judge and ask arguments (resolved cwd, none without one, file last), and the no-service case; a bad exec value refuses the load. trust_and_wake_per_extension — per-file trust, wakes with text and file in order (a refused one does not surface), the ungranted neighbour still throws; unknown keys and bad values refuse. Full yoagent-rutis suite (node,loader,probe), clippy, docs, fmt clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_01T7iq5hpndSiHQcnAsywKuG

[yuanhao]

Second review round (code re-check, tests, comments) addressed in 7fd74a6: sparse args / options read once / abort between judge and ask / Symbol on the non-gate path / warning keys by kind; docs corrected (judge gets no file; a call without options.cwd runs in the adapter's cwd; wake order caveat; unloading); new tests for every non-allow answer, cancels before judge and during ask (a late allow runs nothing), projectTrustedFor false reaching handlers, where gated calls run, deliverAs, wakes while unloading, and the fixed-answer file in the log. pi_test 33 passed, pi_log_test passed, full suite clean.