@astrofoundry/pi-astro 0.6.4 → 0.6.6

package/extensions/security-guard/index.test.ts

@@ -0,0 +1,296 @@
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+type Handler = (event: Record<string, unknown>, ctx: unknown) => Promise<unknown>;
+type CommandHandler = (args: string, ctx: unknown) => Promise<void> | void;
+
+interface CapturedPi {
+    commands: Map<string, { description?: string; handler: CommandHandler }>;
+    handlers: Record<string, Handler>;
+    registerCommand: (name: string, opts: { description?: string; handler: CommandHandler }) => void;
+    on: (event: string, handler: Handler) => void;
+}
+
+function makePi(): CapturedPi {
+    const commands = new Map();
+    const handlers: Record<string, Handler> = {};
+    return {
+        commands,
+        handlers,
+        registerCommand: (name, opts) => {
+            commands.set(name, opts);
+        },
+        on: (event, handler) => {
+            handlers[event] = handler;
+        },
+    };
+}
+
+interface Ctx {
+    cwd: string;
+    hasUI: boolean;
+    ui: {
+        notify: ReturnType<typeof vi.fn>;
+        confirm: ReturnType<typeof vi.fn>;
+    };
+}
+
+function makeCtx(opts: { cwd?: string; hasUI?: boolean; allow?: boolean } = {}): Ctx {
+    return {
+        cwd: opts.cwd ?? "/tmp/cwd",
+        hasUI: opts.hasUI ?? true,
+        ui: {
+            notify: vi.fn(),
+            confirm: vi.fn().mockResolvedValue(opts.allow ?? true),
+        },
+    };
+}
+
+describe("security-guard tool_call hook", () => {
+    let root: string;
+    const originalDir = process.env.PI_CODING_AGENT_DIR;
+    const originalDryRun = process.env.PI_SECURITY_GUARD_DRY_RUN;
+
+    beforeEach(() => {
+        root = mkdtempSync(join(tmpdir(), "sg-ext-"));
+        process.env.PI_CODING_AGENT_DIR = root;
+        delete process.env.PI_SECURITY_GUARD_DRY_RUN;
+        vi.resetModules();
+    });
+
+    afterEach(() => {
+        rmSync(root, { recursive: true, force: true });
+        process.env.PI_CODING_AGENT_DIR = originalDir;
+        if (originalDryRun === undefined) delete process.env.PI_SECURITY_GUARD_DRY_RUN;
+        else process.env.PI_SECURITY_GUARD_DRY_RUN = originalDryRun;
+    });
+
+    async function load(rules?: Record<string, unknown>): Promise<{ pi: CapturedPi }> {
+        if (rules) {
+            mkdirSync(root, { recursive: true });
+            writeFileSync(join(root, "security-guard.json"), JSON.stringify(rules), "utf-8");
+        }
+        const mod = await import("./index.ts");
+        const pi = makePi();
+        mod.default(pi as unknown as Parameters<typeof mod.default>[0]);
+        return { pi };
+    }
+
+    it("registers tool_call handler + /security-guard command", async () => {
+        const { pi } = await load();
+        expect(pi.handlers.tool_call).toBeDefined();
+        expect(pi.commands.has("security-guard")).toBe(true);
+    });
+
+    it("blocks bash command matching 'rm -rf /' (default block rule)", async () => {
+        const { pi } = await load();
+        const ctx = makeCtx();
+        const result = (await pi.handlers.tool_call(
+            { toolName: "bash", input: { command: "rm -rf / && echo done" } },
+            ctx,
+        )) as { block?: boolean; reason?: string } | undefined;
+        expect(result?.block).toBe(true);
+        expect(ctx.ui.notify).toHaveBeenCalledWith(expect.stringMatching(/Blocked/), "warning");
+    });
+
+    it("allows benign bash commands (no rule match)", async () => {
+        const { pi } = await load();
+        const ctx = makeCtx();
+        const result = await pi.handlers.tool_call(
+            { toolName: "bash", input: { command: "ls -la" } },
+            ctx,
+        );
+        expect(result).toBeUndefined();
+    });
+
+    it("'> /dev/null' allow rule overrides broader '> /dev/' block rule", async () => {
+        const { pi } = await load();
+        const ctx = makeCtx();
+        const result = await pi.handlers.tool_call(
+            { toolName: "bash", input: { command: "echo hi > /dev/null" } },
+            ctx,
+        );
+        expect(result).toBeUndefined();
+    });
+
+    it("prompt rule: user confirms → allowed", async () => {
+        const { pi } = await load({
+            operations: [{ pattern: "testcmd", action: "prompt" }],
+        });
+        const ctx = makeCtx({ allow: true });
+        const result = await pi.handlers.tool_call(
+            { toolName: "bash", input: { command: "testcmd now" } },
+            ctx,
+        );
+        expect(result).toBeUndefined();
+        expect(ctx.ui.confirm).toHaveBeenCalled();
+    });
+
+    it("prompt rule: user denies → blocked", async () => {
+        const { pi } = await load({
+            operations: [{ pattern: "testcmd", action: "prompt" }],
+        });
+        const ctx = makeCtx({ allow: false });
+        const result = (await pi.handlers.tool_call(
+            { toolName: "bash", input: { command: "testcmd now" } },
+            ctx,
+        )) as { block?: boolean; reason?: string };
+        expect(result?.block).toBe(true);
+    });
+
+    it("prompt rule without UI → blocked with reason", async () => {
+        const { pi } = await load({
+            operations: [{ pattern: "testcmd", action: "prompt" }],
+        });
+        const ctx = makeCtx({ hasUI: false });
+        const result = (await pi.handlers.tool_call(
+            { toolName: "bash", input: { command: "testcmd" } },
+            ctx,
+        )) as { block?: boolean };
+        expect(result?.block).toBe(true);
+    });
+
+    it("write to .env is blocked", async () => {
+        const { pi } = await load();
+        const ctx = makeCtx({ cwd: "/repo" });
+        const result = (await pi.handlers.tool_call(
+            { toolName: "write", input: { path: ".env" } },
+            ctx,
+        )) as { block?: boolean };
+        expect(result?.block).toBe(true);
+    });
+
+    it("edit batch: one entry hits a protected path → whole edit blocked", async () => {
+        const { pi } = await load({
+            writes: [{ pattern: "**/protected.ts", action: "block" }],
+        });
+        const ctx = makeCtx({ cwd: "/repo" });
+        const result = (await pi.handlers.tool_call(
+            {
+                toolName: "edit",
+                input: {
+                    multi: [
+                        { path: "safe.ts", oldText: "a", newText: "b" },
+                        { path: "sub/protected.ts", oldText: "x", newText: "y" },
+                    ],
+                },
+            },
+            ctx,
+        )) as { block?: boolean };
+        expect(result?.block).toBe(true);
+    });
+
+    it("edit patch mode: extracts paths from '*** Add/Update/Delete File:' headers", async () => {
+        const { pi } = await load({
+            writes: [{ pattern: "**/secret.ts", action: "block" }],
+        });
+        const ctx = makeCtx({ cwd: "/repo" });
+        const patch = "*** Begin Patch\n*** Add File: src/secret.ts\n+x\n*** End Patch";
+        const result = (await pi.handlers.tool_call(
+            { toolName: "edit", input: { patch } },
+            ctx,
+        )) as { block?: boolean };
+        expect(result?.block).toBe(true);
+    });
+
+    it("read of ~/.ssh/id_rsa is blocked", async () => {
+        const { pi } = await load();
+        const ctx = makeCtx();
+        const result = (await pi.handlers.tool_call(
+            { toolName: "read", input: { path: "~/.ssh/id_rsa" } },
+            ctx,
+        )) as { block?: boolean };
+        expect(result?.block).toBe(true);
+    });
+
+    it("other tool names pass through untouched", async () => {
+        const { pi } = await load();
+        const ctx = makeCtx();
+        const result = await pi.handlers.tool_call(
+            { toolName: "grep", input: { pattern: "foo" } },
+            ctx,
+        );
+        expect(result).toBeUndefined();
+    });
+
+    it("DRY-RUN mode: would-be-blocked passes through with notify prefix", async () => {
+        process.env.PI_SECURITY_GUARD_DRY_RUN = "1";
+        const { pi } = await load();
+        const ctx = makeCtx();
+        const result = await pi.handlers.tool_call(
+            { toolName: "bash", input: { command: "rm -rf /" } },
+            ctx,
+        );
+        expect(result).toBeUndefined(); // NOT blocked
+        expect(ctx.ui.notify).toHaveBeenCalledWith(expect.stringMatching(/DRY-RUN/), "warning");
+    });
+});
+
+describe("security-guard command", () => {
+    let root: string;
+    const originalDir = process.env.PI_CODING_AGENT_DIR;
+
+    beforeEach(() => {
+        root = mkdtempSync(join(tmpdir(), "sg-cmd-"));
+        process.env.PI_CODING_AGENT_DIR = root;
+        vi.resetModules();
+    });
+
+    afterEach(() => {
+        rmSync(root, { recursive: true, force: true });
+        process.env.PI_CODING_AGENT_DIR = originalDir;
+    });
+
+    it("status sub-command prints rule counts", async () => {
+        const mod = await import("./index.ts");
+        const pi = makePi();
+        mod.default(pi as unknown as Parameters<typeof mod.default>[0]);
+        const ctx = makeCtx();
+        await pi.commands.get("security-guard")!.handler("status", ctx);
+        expect(ctx.ui.notify).toHaveBeenCalledWith(expect.stringMatching(/operations=/), "info");
+    });
+
+    it("reload re-reads config + notifies", async () => {
+        const mod = await import("./index.ts");
+        const pi = makePi();
+        mod.default(pi as unknown as Parameters<typeof mod.default>[0]);
+        mkdirSync(root, { recursive: true });
+        writeFileSync(
+            join(root, "security-guard.json"),
+            JSON.stringify({ operations: [{ pattern: "new-one", action: "block" }] }),
+            "utf-8",
+        );
+        const ctx = makeCtx();
+        await pi.commands.get("security-guard")!.handler("reload", ctx);
+        expect(ctx.ui.notify).toHaveBeenCalledWith(expect.stringMatching(/reloaded/), "info");
+    });
+
+    it("test sub-command reports match", async () => {
+        const mod = await import("./index.ts");
+        const pi = makePi();
+        mod.default(pi as unknown as Parameters<typeof mod.default>[0]);
+        const ctx = makeCtx();
+        await pi.commands.get("security-guard")!.handler("test bash rm -rf /", ctx);
+        expect(ctx.ui.notify).toHaveBeenCalledWith(expect.stringMatching(/block/), "info");
+    });
+
+    it("test with unknown kind warns", async () => {
+        const mod = await import("./index.ts");
+        const pi = makePi();
+        mod.default(pi as unknown as Parameters<typeof mod.default>[0]);
+        const ctx = makeCtx();
+        await pi.commands.get("security-guard")!.handler("test foo bar", ctx);
+        expect(ctx.ui.notify).toHaveBeenCalledWith(expect.stringMatching(/usage/), "warning");
+    });
+
+    it("test reports no match as 'would be allowed'", async () => {
+        const mod = await import("./index.ts");
+        const pi = makePi();
+        mod.default(pi as unknown as Parameters<typeof mod.default>[0]);
+        const ctx = makeCtx();
+        await pi.commands.get("security-guard")!.handler("test bash ls -la", ctx);
+        expect(ctx.ui.notify).toHaveBeenCalledWith(expect.stringMatching(/no match/), "info");
+    });
+});

package/extensions/security-guard/index.ts

@@ -0,0 +1,173 @@
+import type { ExtensionAPI, ExtensionContext, ToolCallEvent } from "@mariozechner/pi-coding-agent";
+import { ensureExampleConfig, isDryRun, loadConfig } from "./config.ts";
+import { findMatchingRule, normalizePath } from "./rules.ts";
+import type { SecurityRule, SecurityRules } from "./types.ts";
+
+interface Decision {
+    block: boolean;
+    reason?: string;
+}
+
+async function evaluate(
+    label: string,
+    target: string,
+    rules: readonly SecurityRule[],
+    ctx: ExtensionContext,
+): Promise<Decision> {
+    const rule = findMatchingRule(target, rules);
+    if (!rule || rule.action === "allow") return { block: false };
+
+    const dryRun = isDryRun();
+    const prefix = dryRun ? "[security-guard DRY-RUN] " : "";
+
+    if (rule.action === "block") {
+        ctx.ui.notify(
+            `${prefix}Blocked ${label}: matched pattern "${rule.pattern}"`,
+            "warning",
+        );
+        if (dryRun) return { block: false };
+        return {
+            block: true,
+            reason: `Blocked by security-guard: pattern "${rule.pattern}"`,
+        };
+    }
+
+    // prompt
+    if (!ctx.hasUI) {
+        if (dryRun) return { block: false };
+        return {
+            block: true,
+            reason: "security-guard: confirmation required but no UI available",
+        };
+    }
+    const confirmed = await ctx.ui.confirm(
+        `Security check — ${label}`,
+        `Matched pattern "${rule.pattern}"\n\nTarget: ${target}\n\nAllow this operation?`,
+    );
+    if (confirmed) return { block: false };
+    ctx.ui.notify(`${prefix}Denied ${label}`, "warning");
+    if (dryRun) return { block: false };
+    return { block: true, reason: "Denied by user via security-guard" };
+}
+
+function extractEditPaths(input: Record<string, unknown>): string[] {
+    const paths: string[] = [];
+    if (typeof input.path === "string") paths.push(input.path);
+    const multi = input.multi;
+    if (Array.isArray(multi)) {
+        for (const item of multi) {
+            if (item && typeof item === "object" && typeof (item as { path?: unknown }).path === "string") {
+                paths.push((item as { path: string }).path);
+            }
+        }
+    }
+    const patch = input.patch;
+    if (typeof patch === "string") {
+        const re = /^\*\*\* (?:Add File|Update File|Delete File):\s+(.+)$/gm;
+        let m: RegExpExecArray | null;
+        while ((m = re.exec(patch)) !== null) {
+            paths.push(m[1].trim());
+        }
+    }
+    return paths;
+}
+
+async function handleToolCall(
+    event: ToolCallEvent,
+    ctx: ExtensionContext,
+    rules: SecurityRules,
+): Promise<{ block?: boolean; reason?: string } | undefined> {
+    switch (event.toolName) {
+        case "bash": {
+            const command = (event.input as { command?: string }).command ?? "";
+            const decision = await evaluate("bash command", command, rules.operations, ctx);
+            if (decision.block) return { block: true, reason: decision.reason };
+            return undefined;
+        }
+        case "write": {
+            const target = normalizePath(String((event.input as { path?: string }).path ?? ""), ctx.cwd);
+            const decision = await evaluate(`write to ${target}`, target, rules.writes, ctx);
+            if (decision.block) return { block: true, reason: decision.reason };
+            return undefined;
+        }
+        case "edit": {
+            const paths = extractEditPaths(event.input as Record<string, unknown>);
+            for (const raw of paths) {
+                const target = normalizePath(raw, ctx.cwd);
+                const decision = await evaluate(`edit of ${target}`, target, rules.writes, ctx);
+                if (decision.block) return { block: true, reason: decision.reason };
+            }
+            return undefined;
+        }
+        case "read": {
+            const target = normalizePath(String((event.input as { path?: string }).path ?? ""), ctx.cwd);
+            const decision = await evaluate(`read of ${target}`, target, rules.reads, ctx);
+            if (decision.block) return { block: true, reason: decision.reason };
+            return undefined;
+        }
+        default:
+            return undefined;
+    }
+}
+
+export default function securityGuardExtension(pi: ExtensionAPI): void {
+    ensureExampleConfig();
+    let loaded = loadConfig();
+
+    pi.registerCommand("security-guard", {
+        description: "Security guard status / reload / test. Usage: /security-guard [status|reload|test <bash|write|read> <input>]",
+        handler: async (args, ctx) => {
+            const parts = args.trim().split(/\s+/).filter(Boolean);
+            const sub = parts[0] ?? "status";
+
+            if (sub === "reload") {
+                loaded = loadConfig();
+                const n =
+                    loaded.rules.operations.length +
+                    loaded.rules.writes.length +
+                    loaded.rules.reads.length;
+                ctx.ui.notify(
+                    `security-guard reloaded: ${n} rules${loaded.errors.length > 0 ? `; ${loaded.errors.length} errors` : ""}`,
+                    loaded.errors.length > 0 ? "warning" : "info",
+                );
+                return;
+            }
+
+            if (sub === "test") {
+                const kind = parts[1];
+                const input = parts.slice(2).join(" ");
+                if (!kind || !input || !["bash", "write", "read"].includes(kind)) {
+                    ctx.ui.notify("usage: /security-guard test <bash|write|read> <input>", "warning");
+                    return;
+                }
+                const rules =
+                    kind === "bash"
+                        ? loaded.rules.operations
+                        : kind === "write"
+                        ? loaded.rules.writes
+                        : loaded.rules.reads;
+                const target = kind === "bash" ? input : normalizePath(input, ctx.cwd);
+                const rule = findMatchingRule(target, rules);
+                ctx.ui.notify(
+                    rule
+                        ? `match: pattern "${rule.pattern}" -> ${rule.action}`
+                        : `no match (would be allowed)`,
+                    "info",
+                );
+                return;
+            }
+
+            // status (default)
+            const { rules, configPath, configExists, errors } = loaded;
+            const lines = [
+                `config: ${configPath}${configExists ? "" : " (not found — using defaults)"}`,
+                `operations=${rules.operations.length} writes=${rules.writes.length} reads=${rules.reads.length}`,
+                isDryRun() ? "dry-run: ON (PI_SECURITY_GUARD_DRY_RUN=1)" : "dry-run: off",
+            ];
+            if (errors.length > 0) lines.push(`errors: ${errors.join("; ")}`);
+            ctx.ui.notify(lines.join(" | "), "info");
+        },
+    });
+
+    pi.on("tool_call", async (event, ctx) => handleToolCall(event, ctx, loaded.rules));
+}

package/extensions/security-guard/rules.test.ts

@@ -0,0 +1,96 @@
+import { homedir } from "node:os";
+import { describe, expect, it } from "vitest";
+import { expandHome, findMatchingRule, matchesPattern, normalizePath } from "./rules.ts";
+
+describe("expandHome", () => {
+    it("expands ~/foo", () => {
+        expect(expandHome("~/foo")).toBe(`${homedir()}/foo`);
+    });
+
+    it("expands bare ~", () => {
+        expect(expandHome("~")).toBe(homedir());
+    });
+
+    it("leaves non-tilde paths unchanged", () => {
+        expect(expandHome("/etc/hosts")).toBe("/etc/hosts");
+        expect(expandHome("foo/bar")).toBe("foo/bar");
+    });
+});
+
+describe("normalizePath", () => {
+    it("resolves relative paths against cwd", () => {
+        expect(normalizePath("foo.txt", "/tmp")).toBe("/tmp/foo.txt");
+    });
+
+    it("keeps absolute paths", () => {
+        expect(normalizePath("/abs/path", "/tmp")).toBe("/abs/path");
+    });
+
+    it("expands ~", () => {
+        expect(normalizePath("~/a", "/tmp")).toBe(`${homedir()}/a`);
+    });
+});
+
+describe("matchesPattern", () => {
+    it("substring match on bash command", () => {
+        expect(matchesPattern("sudo rm -rf /tmp/x", { pattern: "rm -rf", action: "prompt" })).toBe(true);
+    });
+
+    it("substring does NOT match when absent", () => {
+        expect(matchesPattern("ls -la", { pattern: "rm -rf", action: "prompt" })).toBe(false);
+    });
+
+    it("glob ** matches deep paths", () => {
+        expect(matchesPattern("/Users/x/.ssh/id_rsa", { pattern: "~/.ssh/**", action: "block" })).toBe(false);
+        // Reason: the test path's home isn't the CURRENT user's home. Glob is anchored.
+        const real = `${homedir()}/.ssh/id_rsa`;
+        expect(matchesPattern(real, { pattern: "~/.ssh/**", action: "block" })).toBe(true);
+    });
+
+    it("glob * does NOT cross /", () => {
+        expect(matchesPattern("/a/b/c", { pattern: "/a/*", action: "block" })).toBe(false);
+        expect(matchesPattern("/a/b", { pattern: "/a/*", action: "block" })).toBe(true);
+    });
+
+    it("glob ? matches single char", () => {
+        expect(matchesPattern("/tmp/a.env", { pattern: "/tmp/?.env", action: "block" })).toBe(true);
+        expect(matchesPattern("/tmp/ab.env", { pattern: "/tmp/?.env", action: "block" })).toBe(false);
+    });
+
+    it("character class [abc]", () => {
+        expect(matchesPattern("/tmp/a", { pattern: "/tmp/[abc]", action: "block" })).toBe(true);
+        expect(matchesPattern("/tmp/z", { pattern: "/tmp/[abc]", action: "block" })).toBe(false);
+    });
+
+    it("glob **/.env matches any depth", () => {
+        expect(matchesPattern("/src/app/.env", { pattern: "**/.env", action: "block" })).toBe(true);
+        expect(matchesPattern("/.env", { pattern: "**/.env", action: "block" })).toBe(true);
+    });
+
+    it("metacharacters in non-glob pattern are escaped (fall back to substring)", () => {
+        // Pattern has no *, ?, [ — substring path used; no regex injection
+        expect(matchesPattern("something", { pattern: "some(thing)", action: "block" })).toBe(false);
+        expect(matchesPattern("some(thing)", { pattern: "some(thing)", action: "block" })).toBe(true);
+    });
+});
+
+describe("findMatchingRule — longest wins", () => {
+    const rules = [
+        { pattern: "> /dev/", action: "block" as const },
+        { pattern: "> /dev/null", action: "allow" as const },
+    ];
+
+    it("allow /dev/null overrides block /dev/", () => {
+        const r = findMatchingRule("echo hi > /dev/null", rules);
+        expect(r?.action).toBe("allow");
+    });
+
+    it("block /dev/sda still blocks when no narrower rule exists", () => {
+        const r = findMatchingRule("echo hi > /dev/sda", rules);
+        expect(r?.action).toBe("block");
+    });
+
+    it("no match returns null", () => {
+        expect(findMatchingRule("ls -la", rules)).toBeNull();
+    });
+});

package/extensions/security-guard/rules.ts

@@ -0,0 +1,90 @@
+import { homedir } from "node:os";
+import { isAbsolute, resolve } from "node:path";
+import type { SecurityRule } from "./types.ts";
+
+export function expandHome(pattern: string): string {
+    if (pattern === "~") return homedir();
+    if (pattern.startsWith("~/")) return `${homedir()}/${pattern.slice(2)}`;
+    return pattern;
+}
+
+/**
+ * Normalize a filesystem path for matching: expand `~`, resolve relative paths
+ * against cwd. Non-filesystem strings (bash commands) should NOT go through this.
+ */
+export function normalizePath(p: string, cwd: string): string {
+    const expanded = expandHome(p);
+    return isAbsolute(expanded) ? expanded : resolve(cwd, expanded);
+}
+
+/**
+ * Convert a glob pattern to a RegExp source. Supports:
+ *   ?       any single non-separator char
+ *   *       any run of non-separator chars
+ *   **      any run of chars including separators
+ *   [abc]   character class
+ * All other regex metacharacters are escaped.
+ */
+function globToRegex(glob: string): RegExp {
+    let src = "";
+    for (let i = 0; i < glob.length; i++) {
+        const c = glob[i];
+        if (c === "*") {
+            if (glob[i + 1] === "*") {
+                src += ".*";
+                i++;
+            } else {
+                src += "[^/]*";
+            }
+        } else if (c === "?") {
+            src += "[^/]";
+        } else if (c === "[") {
+            const end = glob.indexOf("]", i);
+            if (end === -1) {
+                src += "\\[";
+            } else {
+                src += glob.slice(i, end + 1);
+                i = end;
+            }
+        } else if (/[.+^${}()|\\]/.test(c)) {
+            src += `\\${c}`;
+        } else {
+            src += c;
+        }
+    }
+    return new RegExp(`^${src}$`);
+}
+
+function isGlob(pattern: string): boolean {
+    return /[*?[]/.test(pattern);
+}
+
+/**
+ * Does `text` match `rule.pattern`? For globs, matches as a whole path / whole
+ * string. For non-glob patterns, falls back to substring match (friendlier for
+ * bash commands and filename fragments).
+ */
+export function matchesPattern(text: string, rule: SecurityRule): boolean {
+    const expanded = expandHome(rule.pattern);
+    if (isGlob(rule.pattern)) {
+        const re = globToRegex(expanded);
+        return re.test(text);
+    }
+    return text.includes(expanded) || text.includes(rule.pattern);
+}
+
+/**
+ * Longest-match wins, so narrow `allow` exceptions override broad `block` rules
+ * (e.g. `> /dev/` = block, `> /dev/null` = allow).
+ */
+export function findMatchingRule(text: string, rules: readonly SecurityRule[]): SecurityRule | null {
+    let best: SecurityRule | null = null;
+    for (const rule of rules) {
+        if (matchesPattern(text, rule)) {
+            if (best === null || rule.pattern.length > best.pattern.length) {
+                best = rule;
+            }
+        }
+    }
+    return best;
+}

package/extensions/security-guard/types.ts

@@ -0,0 +1,12 @@
+export type RuleAction = "prompt" | "block" | "allow";
+
+export interface SecurityRule {
+    pattern: string;
+    action: RuleAction;
+}
+
+export interface SecurityRules {
+    operations: SecurityRule[];
+    writes: SecurityRule[];
+    reads: SecurityRule[];
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrofoundry/pi-astro",
-  "version": "0.6.4",
+  "version": "0.6.6",
   "description": "Personal pi customizations (extensions, skills, prompts, themes) for the pi coding agent.",
   "keywords": [
     "pi-package"