@aefree/pi-plastic 0.5.1 → 0.5.2

package/CHANGELOG.md

@@ -5,6 +5,13 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project follows semantic versioning for public package releases.
 
+## [0.5.2] - 2026-08-05
+
+### Fixed
+
+- Hardened the Bash GUI-diff guard for Plastic's `differences` alias, quoted subcommands, common CMD and PowerShell wrappers, `call`/`start`, `Start-Process`, CMD caret escaping, and direct `!`/`!!` shell commands; the internal process guard now rejects the alias too.
+- Added runtime-handler coverage and documented that user-scope installation is required to protect delegated Pi processes whose working directory does not load the originating project's package settings.
+
 ## [0.5.1] - 2026-08-05
 
 ### Changed

package/README.md

@@ -70,6 +70,8 @@ Pi 0.82 and newer use canonical `sourceInfo` provenance to identify this package
 
 ## Safety behavior
 
+The Bash guards run only in Pi processes that actually load this package. A project-local install does not protect a delegated child process whose working directory resolves different project settings. Install `pi-plastic` at user scope (the default `pi install`, without `-l`) when subagents and sessions in arbitrary workspaces must inherit the guards. Restart existing Pi processes after installation or source changes.
+
 - `plastic_branchCreate` supports an explicit parent branch independent of the loaded workspace branch, defaults relative names to the current branch when no parent is supplied, and rejects top-level paths unless `allowRootBranch=true` is explicit.
 - `plastic_diff` remains a disabled alias by design. Use `plastic_status` for changed-path listing; do not diff as routine post-edit validation or checkin preflight. When change-boundary evidence is needed, use `plastic_diffFile` for one exact file, `plastic_workspaceDiff` with selected paths or explicit `allPending=true`, or `plastic_diffRevisions` for an explicit historical pair. Diff responses use small defaults and caller-controlled `maxChars` bounds.
 - Preflight is not routine confirmation. Use it for ambiguous or broad mutation scope, moved/deleted path rewriting, compound operations, or explicit preview requests; otherwise rely on exact targets and the tools' runtime guards.
@@ -96,16 +98,22 @@ If `output` is omitted, Plastic prints patch content to stdout. If `output` is p
 
 ## Install
 
-Install the stable GitHub release over HTTPS:
+Install the latest stable npm release at user scope so the safety guards also load for delegated child processes in other workspaces:
+
+```bash
+pi install npm:@aefree/pi-plastic
+```
+
+Install a pinned GitHub release over HTTPS:
 
 ```bash
-pi install git:github.com/aefreedman/pi-plastic@v0.4.0
+pi install git:github.com/aefreedman/pi-plastic@v0.5.1
 ```
 
 Equivalent SSH install:
 
 ```bash
-pi install git:git@github.com:aefreedman/pi-plastic@v0.4.0
+pi install git:git@github.com:aefreedman/pi-plastic@v0.5.1
 ```
 
 To intentionally track the moving default branch instead of a release tag:
@@ -126,6 +134,8 @@ Project-local install:
 pi install -l <path-to-pi-plastic>
 ```
 
+Project-local installation protects only Pi processes that load those project settings. It is insufficient as a global Bash safety rail when a subagent launches with another working directory.
+
 ## Requirements
 
 - Node.js 22.19.0 or newer

package/extensions/bash-cm-diff-guard.ts

@@ -8,15 +8,24 @@ import {
 const BLOCK_MESSAGE =
   "`cm diff` is blocked in Pi because it can launch a GUI window and hang CLI automation. Use `plastic_status` when only changed paths are needed. Do not diff routinely; when change-boundary evidence is necessary, use a focused `plastic_diffFile`, explicitly scoped `plastic_workspaceDiff`, or `plastic_diffRevisions`.";
 
-const DIRECT_CM_DIFF = /^(?:[A-Za-z_][A-Za-z0-9_]*=\S+\s+)*(?:(?:"[^"]*[\\/]cm(?:\.exe)?"|'[^']*[\\/]cm(?:\.exe)?')|(?:[^"'\s]*[\\/])?cm(?:\.exe)?)\s+diff(?:\s|$)/i;
+const CM_EXECUTABLE = String.raw`(?:"(?:[^"]*[\\/])?cm(?:\.exe)?"|'(?:[^']*[\\/])?cm(?:\.exe)?'|(?:[^"'\s]*[\\/])?cm(?:\.exe)?)`;
+const DIFF_SUBCOMMAND = String.raw`(?:diff|differences)`;
+const DIRECT_CM_DIFF = new RegExp(String.raw`^(?:[A-Za-z_][A-Za-z0-9_]*=\S+\s+)*${CM_EXECUTABLE}\s+["']?${DIFF_SUBCOMMAND}["']?(?:\s|$)`, "i");
+const POWERSHELL_START_PROCESS_CM_DIFF = new RegExp(String.raw`^(?:start-process|saps|start)\s+(?:-filepath\s+)?${CM_EXECUTABLE}(?=[\s;]|$)[\s\S]*?-argumentlist\s+(?:["'][^"']*${DIFF_SUBCOMMAND}[^"']*["']|${DIFF_SUBCOMMAND}(?:\s|,|$))`, "i");
+const POWERSHELL_INVOKE_EXPRESSION_CM_DIFF = new RegExp(String.raw`^(?:invoke-expression|iex)\s+["'][^"']*${CM_EXECUTABLE}\s+${DIFF_SUBCOMMAND}(?:\s|["'])`, "i");
 
 function isBashToolCall(event: { toolName?: string }): event is { toolName: "bash"; input: { command?: string } } {
   return event.toolName === "bash";
 }
 
 function segmentRunsCmDiff(segment: string): boolean {
-  const stripped = stripLeadingWrappers(stripAssignments(segment));
-  return DIRECT_CM_DIFF.test(stripped);
+  // cmd.exe removes caret escaping before dispatching the command.
+  const normalized = segment.replace(/\^(?=.)/g, "");
+  const stripped = stripLeadingWrappers(stripAssignments(normalized));
+  return DIRECT_CM_DIFF.test(stripped)
+    || POWERSHELL_START_PROCESS_CM_DIFF.test(normalized)
+    || POWERSHELL_START_PROCESS_CM_DIFF.test(stripped)
+    || POWERSHELL_INVOKE_EXPRESSION_CM_DIFF.test(stripped);
 }
 
 function commandRunsCmDiff(command: string): boolean {
@@ -47,4 +56,21 @@ export default function bashCmDiffGuard(pi: ExtensionAPI) {
       reason: BLOCK_MESSAGE,
     };
   });
+
+  pi.on("user_bash", async (event, ctx) => {
+    if (!event.command || !commandRunsCmDiff(event.command)) return;
+
+    if (ctx.hasUI) {
+      ctx.ui.notify("Blocked user shell command invoking cm diff", "warning");
+    }
+
+    return {
+      result: {
+        output: BLOCK_MESSAGE,
+        exitCode: 1,
+        cancelled: false,
+        truncated: false,
+      },
+    };
+  });
 }

package/extensions/shared/bash-command-guards.ts

@@ -1,10 +1,10 @@
 export const WRAPPED_COMMAND_PATTERNS = [
   /^(?:[A-Za-z_][A-Za-z0-9_]*=\S+\s+)*(?:["']?[^"'\s]*[\\/])?(?:bash|sh|zsh)(?:\.exe)?\s+-lc\s+(["'])([\s\S]*)\1$/i,
   /^(?:[A-Za-z_][A-Za-z0-9_]*=\S+\s+)*(?:["']?[^"'\s]*[\\/])?(?:bash|sh|zsh)(?:\.exe)?\s+-c\s+(["'])([\s\S]*)\1$/i,
-  /^(?:[A-Za-z_][A-Za-z0-9_]*=\S+\s+)*(?:["']?[^"'\s]*[\\/])?cmd(?:\.exe)?\s+\/[ck]\s+(["'])([\s\S]*)\1$/i,
-  /^(?:[A-Za-z_][A-Za-z0-9_]*=\S+\s+)*(?:["']?[^"'\s]*[\\/])?cmd(?:\.exe)?\s+\/[ck]\s+()([\s\S]+)$/i,
-  /^(?:[A-Za-z_][A-Za-z0-9_]*=\S+\s+)*(?:["']?[^"'\s]*[\\/])?(?:pwsh|powershell)(?:\.exe)?\s+-command\s+(["'])([\s\S]*)\1$/i,
-  /^(?:[A-Za-z_][A-Za-z0-9_]*=\S+\s+)*(?:["']?[^"'\s]*[\\/])?(?:pwsh|powershell)(?:\.exe)?\s+-command\s+()([\s\S]+)$/i,
+  /^(?:[A-Za-z_][A-Za-z0-9_]*=\S+\s+)*(?:["']?[^"'\s]*[\\/])?cmd(?:\.exe)?(?:\s+\/[dqsvu](?::\S+)*)*\s+\/[ck]\s+(["'])([\s\S]*)\1$/i,
+  /^(?:[A-Za-z_][A-Za-z0-9_]*=\S+\s+)*(?:["']?[^"'\s]*[\\/])?cmd(?:\.exe)?(?:\s+\/[dqsvu](?::\S+)*)*\s+\/[ck]\s+()([\s\S]+)$/i,
+  /^(?:[A-Za-z_][A-Za-z0-9_]*=\S+\s+)*(?:["']?[^"'\s]*[\\/])?(?:pwsh|powershell)(?:\.exe)?(?:(?:\s+-(?:noprofile|noninteractive|nologo|sta|mta))|(?:\s+-executionpolicy\s+\S+))*\s+-(?:command|c)\s+(["'])([\s\S]*)\1$/i,
+  /^(?:[A-Za-z_][A-Za-z0-9_]*=\S+\s+)*(?:["']?[^"'\s]*[\\/])?(?:pwsh|powershell)(?:\.exe)?(?:(?:\s+-(?:noprofile|noninteractive|nologo|sta|mta))|(?:\s+-executionpolicy\s+\S+))*\s+-(?:command|c)\s+()([\s\S]+)$/i,
 ];
 
 export function splitSegments(command: string): string[] {
@@ -25,6 +25,8 @@ export function stripLeadingWrappers(segment: string): string {
     const next = value
       .replace(/^sudo\s+/i, "")
       .replace(/^command\s+/i, "")
+      .replace(/^call\s+/i, "")
+      .replace(/^start\s+(?:["'][^"']*["']\s+)?(?:(?:\/wait|\/b|\/min|\/max|\/i|\/low|\/normal|\/high|\/realtime|\/abovenormal|\/belownormal)\s+)*/i, "")
       .replace(/^time\s+/i, "")
       .replace(/^nice(?:\s+(?:-n\s+)?-?\d+)?\s+/i, "");
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aefree/pi-plastic",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "type": "module",
   "engines": {
     "node": ">=22.19.0"

package/src/plastic-core.ts

@@ -250,7 +250,7 @@ const BLOCKED_CM_DIFF_MESSAGE = "`cm diff` is blocked in Pi because it may launc
 const ensureCmCommandAllowed = (args: string[]): void =>
 {
     const command = (args[0] ?? "").trim().toLowerCase();
-    if (command === "diff")
+    if (command === "diff" || command === "differences")
     {
         throw new Error(BLOCKED_CM_DIFF_MESSAGE);
     }