project-access

Project Access

Work out which folders outside a project its agents need, and ask the dashboard operator to approve them once, ahead of time, instead of one prompt per denial.

You only ever propose. The operator answers per line in the dashboard. Nothing in this skill grants access, changes configuration, or answers for the operator.

Setup — server URL

Discover the server the way the pi-dashboard skill does (config port, default 8000):

PORT=$(grep -m1 '"port"' ~/.pi/dashboard/config.json 2>/dev/null | grep -o '[0-9]*'); PORT=${PORT:-8000}
BASE="http://localhost:$PORT"
curl -s "$BASE/api/health"

(grep -m1 takes the top-level port; the config also nests other port keys.)

If health does not answer, say the dashboard is not running and stop (every mode needs it, except reading .pi/access.json). When auth is enabled, pass the JWT cookie as the pi-dashboard skill describes (curl -b "pi_dash_token=…").

Project root = git rev-parse --show-toplevel from the cwd; when that fails, the cwd if it holds a .pi directory. A root with neither .git nor .pi is not a project: say so and stop.

Profile — .pi/access.json (format v1)

Optional file in the project root. A proposal only: the dashboard server never reads it, and the file alone grants nothing. Its contents take effect only through an approved provision request.

{
  "version": 1,
  "folders": [{ "path": "../shared-lib", "why": "sibling package used by tests" }],
  "remote": ["lan"]
}

• folders[].path: absolute, ~/-rooted or relative to the project root. why is optional, plain text, shown to the operator (cut at 200 characters).
• remote (optional): any of lan, internet, device. A goal only points the operator at the Remote access dialog; nothing is configured for them.
• At most 32 folder lines.
• An unknown version (or a missing/non-numeric one): refuse. Say the file is not version 1, show the value found, and do not read or send any of it.