feat(permission): prompt for confirmation in manual mode

[marek2901]

Summary

In manual permission mode, little-coder now prompts the user before executing any shell command instead of blocking outright.

Behavior

Mode	Before	After
auto (default)	Block non-whitelisted commands	Unchanged
accept-all	Allow all commands	Unchanged
manual	Block non-whitelisted commands	Prompt for every command

In manual mode:

1. Show the exact command to execute
2. Ask: Execute this command?
3. User confirms (y) → execute
4. User cancels (n) → block with "command cancelled by user"

Usage

export LITTLE_CODER_PERMISSION_MODE=manual
little-coder

Implementation

• Minimal change: reuse existingctx.ui.confirm() API
• No new dependencies or abstractions
• All 536 tests pass

Files changed

• .pi/extensions/permission-gate/index.ts — add confirmation prompt for manual mode
• .pi/extensions/permission-gate/permission.test.ts — add tests for manual mode
• README.md — updateLITTLE_CODER_PERMISSION_MODE table

[itayinbarr]

Approved. manual mode has been the odd one out since it landed: it blocked exactly what auto blocks and only changed the wording of the refusal, which is not what anyone reading "manual" expects. Prompting per command is the behavior the name promises.

I checked the parts that worried me before approving:

• ctx.ui.confirm is on the plain ExtensionContext in pi 0.83 (ui: Pick<ExtensionUIContext, "select" | "confirm" | "input" | "notify">), so the tool_call handler really does have it. Not every session does: pi's noOpUIContext.confirm resolves false, so a headless run in manual mode refuses everything. That is the right default for a mode whose whole point is a human in the loop, and it cannot bite sub-coders because buildChildEnv pins children to LITTLE_CODER_PERMISSION_MODE=auto.
• Confirming skips isSafeBash entirely, including for whitelisted commands. Correct: in manual mode the user is the whitelist. write-guard is a separate tool_call handler and still runs, so a confirmed cat > existing.py is still caught by the guard that exists for that.
• Full suite green on your branch (633 passed), typecheck clean, and the branch is not behind main.

Thanks for keeping it to ctx.ui.confirm rather than inventing an abstraction.