@aliou/pi-guardrails 0.6.0 → 0.6.1

package/{settings-command.ts → commands/settings-command.ts}

@@ -7,14 +7,14 @@ import {
 } from "@aliou/pi-utils-settings";
 import type { ExtensionAPI } from "@mariozechner/pi-coding-agent";
 import { getSettingsListTheme } from "@mariozechner/pi-coding-agent";
-import { configLoader } from "./config";
+import { PatternEditor } from "../components/pattern-editor";
 import type {
   DangerousPattern,
   GuardrailsConfig,
   PatternConfig,
   ResolvedConfig,
-} from "./config-schema";
-import { PatternEditor } from "./pattern-editor";
+} from "../config";
+import { configLoader } from "../config";
 
 type FeatureKey = keyof ResolvedConfig["features"];
 
@@ -31,8 +31,6 @@ const FEATURE_UI: Record<FeatureKey, { label: string; description: string }> = {
 };
 
 export function registerGuardrailsSettings(pi: ExtensionAPI): void {
-  const settingsTheme = getSettingsListTheme();
-
   registerSettingsCommand<GuardrailsConfig, ResolvedConfig>(pi, {
     commandName: "guardrails:settings",
     title: "Guardrails Settings",
@@ -42,6 +40,7 @@ export function registerGuardrailsSettings(pi: ExtensionAPI): void {
       resolved: ResolvedConfig,
       { setDraft },
     ): SettingsSection[] => {
+      const settingsTheme = getSettingsListTheme();
       // --- Helpers ---
 
       function count(id: string): string {

package/config.ts

@@ -1,11 +1,87 @@
+/**
+ * Configuration schema for the guardrails extension.
+ *
+ * GuardrailsConfig is the user-facing schema (all fields optional).
+ * ResolvedConfig is the internal schema (all fields required, defaults applied).
+ */
+
+/**
+ * A pattern with explicit matching mode.
+ * Default: glob for files, substring for commands.
+ * regex: true means full regex matching.
+ */
+export interface PatternConfig {
+  pattern: string;
+  regex?: boolean;
+}
+
+/**
+ * Permission gate pattern. When regex is false (default), the pattern
+ * is matched as substring against the raw command string.
+ * When regex is true, uses full regex against the raw string.
+ */
+export interface DangerousPattern extends PatternConfig {
+  description: string;
+}
+
+export interface GuardrailsConfig {
+  version?: string;
+  enabled?: boolean;
+  features?: {
+    protectEnvFiles?: boolean;
+    permissionGate?: boolean;
+  };
+  envFiles?: {
+    protectedPatterns?: PatternConfig[];
+    allowedPatterns?: PatternConfig[];
+    protectedDirectories?: PatternConfig[];
+    protectedTools?: string[];
+    onlyBlockIfExists?: boolean;
+    blockMessage?: string;
+  };
+  permissionGate?: {
+    patterns?: DangerousPattern[];
+    /** If set, replaces the default patterns entirely. */
+    customPatterns?: DangerousPattern[];
+    requireConfirmation?: boolean;
+    allowedPatterns?: PatternConfig[];
+    autoDenyPatterns?: PatternConfig[];
+  };
+}
+
+export interface ResolvedConfig {
+  version: string;
+  enabled: boolean;
+  features: {
+    protectEnvFiles: boolean;
+    permissionGate: boolean;
+  };
+  envFiles: {
+    protectedPatterns: PatternConfig[];
+    allowedPatterns: PatternConfig[];
+    protectedDirectories: PatternConfig[];
+    protectedTools: string[];
+    onlyBlockIfExists: boolean;
+    blockMessage: string;
+  };
+  permissionGate: {
+    patterns: DangerousPattern[];
+    /** When true, use hardcoded structural matchers for built-in patterns.
+     *  Set to false when customPatterns replaces the defaults. */
+    useBuiltinMatchers: boolean;
+    requireConfirmation: boolean;
+    allowedPatterns: PatternConfig[];
+    autoDenyPatterns: PatternConfig[];
+  };
+}
+
 import { ConfigLoader, type Migration } from "@aliou/pi-utils-settings";
-import type { GuardrailsConfig, ResolvedConfig } from "./config-schema";
 import {
   backupConfig,
   CURRENT_VERSION,
   migrateV0,
   needsMigration,
-} from "./migration";
+} from "./utils/migration";
 
 /**
  * Config fields removed in the toolchain extraction.

package/hooks/index.ts

@@ -1,5 +1,5 @@
 import type { ExtensionAPI } from "@mariozechner/pi-coding-agent";
-import type { ResolvedConfig } from "../config-schema";
+import type { ResolvedConfig } from "../config";
 import { setupPermissionGateHook } from "./permission-gate";
 import { setupProtectEnvFilesHook } from "./protect-env-files";
 

package/hooks/permission-gate.ts

@@ -9,10 +9,13 @@ import {
   Text,
   wrapTextWithAnsi,
 } from "@mariozechner/pi-tui";
-import type { DangerousPattern, ResolvedConfig } from "../config-schema";
-import { emitBlocked, emitDangerous } from "../events";
-import { type CompiledPattern, compileCommandPatterns } from "../matching";
-import { walkCommands, wordToString } from "../shell-utils";
+import type { DangerousPattern, ResolvedConfig } from "../config";
+import { emitBlocked, emitDangerous } from "../utils/events";
+import {
+  type CompiledPattern,
+  compileCommandPatterns,
+} from "../utils/matching";
+import { walkCommands, wordToString } from "../utils/shell-utils";
 
 /**
  * Permission gate that prompts user confirmation for dangerous commands.

package/hooks/protect-env-files.ts

@@ -2,11 +2,11 @@ import { stat } from "node:fs/promises";
 import { resolve } from "node:path";
 import { parse } from "@aliou/sh";
 import type { ExtensionAPI } from "@mariozechner/pi-coding-agent";
-import type { ResolvedConfig } from "../config-schema";
-import { emitBlocked } from "../events";
-import { expandGlob, hasGlobChars } from "../glob-expander";
-import { type CompiledPattern, compileFilePatterns } from "../matching";
-import { walkCommands, wordToString } from "../shell-utils";
+import type { ResolvedConfig } from "../config";
+import { emitBlocked } from "../utils/events";
+import { expandGlob, hasGlobChars } from "../utils/glob-expander";
+import { type CompiledPattern, compileFilePatterns } from "../utils/matching";
+import { walkCommands, wordToString } from "../utils/shell-utils";
 
 /**
  * Prevents accessing .env files unless they match an allowed pattern.

package/index.ts

@@ -1,7 +1,7 @@
 import type { ExtensionAPI } from "@mariozechner/pi-coding-agent";
+import { registerGuardrailsSettings } from "./commands/settings-command";
 import { configLoader } from "./config";
 import { setupGuardrailsHooks } from "./hooks";
-import { registerGuardrailsSettings } from "./settings-command";
 
 /**
  * Guardrails Extension

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aliou/pi-guardrails",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "type": "module",
   "private": false,
   "keywords": [
@@ -26,11 +26,14 @@
   "files": [
     "*.ts",
     "hooks",
+    "commands",
+    "components",
+    "utils",
     "README.md"
   ],
   "dependencies": {
     "@aliou/pi-utils-settings": "^0.1.0",
-    "@aliou/sh": "github:aliou/sh#v0.1.0"
+    "@aliou/sh": "^0.1.0"
   },
   "peerDependencies": {
     "@mariozechner/pi-coding-agent": ">=0.51.0"

package/{matching.ts → utils/matching.ts}

@@ -8,7 +8,7 @@
  * Both support `regex: true` for full regex matching.
  */
 
-import type { PatternConfig } from "./config-schema";
+import type { PatternConfig } from "../config";
 
 export interface CompiledPattern {
   test: (input: string) => boolean;

package/{migration.ts → utils/migration.ts}

@@ -12,7 +12,7 @@ import type {
   DangerousPattern,
   GuardrailsConfig,
   PatternConfig,
-} from "./config-schema";
+} from "../config";
 
 export const CURRENT_VERSION = "0.6.0-20260204";
 

package/config-schema.ts

@@ -1,76 +0,0 @@
-/**
- * Configuration schema for the guardrails extension.
- *
- * GuardrailsConfig is the user-facing schema (all fields optional).
- * ResolvedConfig is the internal schema (all fields required, defaults applied).
- */
-
-/**
- * A pattern with explicit matching mode.
- * Default: glob for files, substring for commands.
- * regex: true means full regex matching.
- */
-export interface PatternConfig {
-  pattern: string;
-  regex?: boolean;
-}
-
-/**
- * Permission gate pattern. When regex is false (default), the pattern
- * is matched as substring against the raw command string.
- * When regex is true, uses full regex against the raw string.
- */
-export interface DangerousPattern extends PatternConfig {
-  description: string;
-}
-
-export interface GuardrailsConfig {
-  version?: string;
-  enabled?: boolean;
-  features?: {
-    protectEnvFiles?: boolean;
-    permissionGate?: boolean;
-  };
-  envFiles?: {
-    protectedPatterns?: PatternConfig[];
-    allowedPatterns?: PatternConfig[];
-    protectedDirectories?: PatternConfig[];
-    protectedTools?: string[];
-    onlyBlockIfExists?: boolean;
-    blockMessage?: string;
-  };
-  permissionGate?: {
-    patterns?: DangerousPattern[];
-    /** If set, replaces the default patterns entirely. */
-    customPatterns?: DangerousPattern[];
-    requireConfirmation?: boolean;
-    allowedPatterns?: PatternConfig[];
-    autoDenyPatterns?: PatternConfig[];
-  };
-}
-
-export interface ResolvedConfig {
-  version: string;
-  enabled: boolean;
-  features: {
-    protectEnvFiles: boolean;
-    permissionGate: boolean;
-  };
-  envFiles: {
-    protectedPatterns: PatternConfig[];
-    allowedPatterns: PatternConfig[];
-    protectedDirectories: PatternConfig[];
-    protectedTools: string[];
-    onlyBlockIfExists: boolean;
-    blockMessage: string;
-  };
-  permissionGate: {
-    patterns: DangerousPattern[];
-    /** When true, use hardcoded structural matchers for built-in patterns.
-     *  Set to false when customPatterns replaces the defaults. */
-    useBuiltinMatchers: boolean;
-    requireConfirmation: boolean;
-    allowedPatterns: PatternConfig[];
-    autoDenyPatterns: PatternConfig[];
-  };
-}