@chrischow/pi-lockdown 0.1.0

package/README.md

@@ -0,0 +1,149 @@
+# Lockdown
+
+A [Pi](https://pi.dev/) extension that adds security constraints to the agent's tool usage. It intercepts every tool call and enforces fine-grained read/edit/write permissions based on whether files are inside or outside the project, and whether they match protected patterns (e.g., `.env`, `.git/`, `node_modules/`).
+
+## Installation
+
+```bash
+pi install npm:@chrischow/pi-lockdown
+```
+
+## Configuration
+Add a `lockdown` property in your project or global `settings.json` with one or more of the keys as outlined in the default settings below. Configuration is optional: any omitted fields fall back to the built-in defaults.
+
+```json
+{
+  "lockdown": {
+    // No Bash
+    "tools": ["read", "edit", "write", "grep", "find", "ls"],
+    "customTools": [],
+    "protectedPatterns": [
+      "**/.env*",
+      "**/.git/**",
+      "**/node_modules/**"
+    ],
+    "external": {
+      "protected": {
+        "read": "block",
+        "write": "block",
+        "edit": "block"
+      },
+      "unprotected": {
+        "read": "warn",
+        "write": "block",
+        "edit": "block"
+      }
+    },
+    "internal": {
+      "protected": {
+        "read": "warn",
+        "write": "warn",
+        "edit": "warn"
+      },
+      "unprotected": {
+        "read": "allow",
+        "write": "warn",
+        "edit": "warn"
+      }
+    }
+  }
+}
+```
+
+Default protected patterns:
+
+```
+**/.env*
+**/.git/**
+**/node_modules/**
+```
+
+
+## Usage
+
+## What It Does
+When you start Pi, Lockdown automatically sets the 
+
+## Features
+
+- **Bash blocking** — All `bash` tool calls are blocked by default
+- **Granular permissions** — Three modes per permission: `allow`, `warn`, `block`
+- **Two dimensions of control**:
+  - **Location**: internal (within the project) vs. external (outside the project)
+  - **Protection level**: protected (matching `protectedPatterns`) vs. unprotected (everything else)
+- **Interactive session configuration** — Adjust permissions mid-session via a TUI dialog
+- **Settings persistence** — Per-project or global settings via `settings.json`
+- **Quick reset** — One command to restore all permissions to defaults
+
+## Default Permissions
+
+| Location | Protection | Read | Edit | Write |
+|----------|------------|------|------|-------|
+| **External** | Protected | `block` | `block` | `block` |
+| **External** | Unprotected | `warn` | `block` | `block` |
+| **Internal** | Protected | `warn` | `warn` | `warn` |
+| **Internal** | Unprotected | `allow` | `warn` | `warn` |
+
+
+
+
+### Per-session override
+
+Run the `/lockdown:session-permissions` command to open an interactive TUI where you can toggle any of the 12 permission slots on the fly. Changes apply immediately and last for the current session only.
+
+## Commands
+
+| Command | Description |
+|---------|-------------|
+| `/lockdown:session-permissions` | Open the interactive session permissions dialog |
+| `/lockdown:reset` | Reset all permissions to settings/default values |
+
+## How it Works
+
+1. On `session_start`, lockdown sets the agent's active tool list to the safe subset: `read`, `edit`, `write`, `grep`, `find`, `ls`
+2. On every `tool_call`, the extension evaluates:
+   - **Is the target path internal or external?** — Resolved relative to the project CWD
+   - **Does the path match a protected pattern?** — Uses glob matching
+   - **What is the action type?** — `read`, `edit`, `write`, `grep`, `list`, etc.
+3. The permission is looked up in the 4×3 permission matrix (2 locations × 2 protection levels × 3 action types)
+4. Depending on the permission level:
+   - **`block`** — The call is denied with a `[LOCKDOWN]` reason
+   - **`warn`** — A select dialog prompts the user to allow or deny
+   - **`allow`** — The call proceeds normally
+
+### Empty write protection
+
+Lockdown also blocks empty writes (`write` with empty content) as a safeguard against file soft-deletion workarounds.
+
+## Installation
+
+Place the extension in your extensions directory for auto-discovery:
+
+**Project-local:**
+
+```bash
+cp -r .pi/extensions/lockdown .pi/extensions/lockdown
+```
+
+**Global:**
+
+```bash
+cp -r .pi/extensions/lockdown ~/.pi/agent/extensions/lockdown
+```
+
+Or load manually for testing:
+
+```bash
+pi --extension .pi/extensions/lockdown
+```
+
+## Extension Structure
+
+```
+lockdown/
+├── index.ts        # Entry point — event handlers, commands, TUI
+├── schema.ts       # Zod schemas for settings validation
+├── utils.ts        # Path resolution helpers (isInside, loadSettings)
+├── package.json    # Dependencies (zod)
+└── README.md       # This file
+```

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+import { type ExtensionAPI } from '@earendil-works/pi-coding-agent';
+/**
+ * Lockdown: A Pi extension to add security constraints to agents' tool usage.
+ */
+export default function (pi: ExtensionAPI): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,YAAY,EAA6C,MAAM,iCAAiC,CAAA;AAY9G;;GAEG;AACH,MAAM,CAAC,OAAO,WAAW,EAAE,EAAE,YAAY,QAuNxC"}

package/dist/index.js

@@ -0,0 +1,201 @@
+import path from 'node:path';
+import { getSettingsListTheme, isToolCallEventType } from '@earendil-works/pi-coding-agent';
+import { Box, Container, SettingsList, Text } from '@earendil-works/pi-tui';
+import { lockdownLevelOptions, LockdownLevelSchema, LockdownSettingsSchema } from './schema';
+import loadSettings, { isInside } from './utils';
+// Settings
+let lockdownSettings = LockdownSettingsSchema.parse({
+    external: { protected: {}, unprotected: {} },
+    internal: { protected: {}, unprotected: {} },
+});
+/**
+ * Lockdown: A Pi extension to add security constraints to agents' tool usage.
+ */
+export default function (pi) {
+    // Set allowed tools
+    pi.on('session_start', (_, ctx) => {
+        // Load settings
+        lockdownSettings = loadSettings(ctx);
+        // Set tools
+        const tools = lockdownSettings.tools.concat(lockdownSettings.customTools);
+        pi.setActiveTools(Array.from(new Set(tools)));
+    });
+    pi.on('tool_call', async (event, ctx) => {
+        // Block bash
+        if (isToolCallEventType('bash', event)) {
+            return { block: true, reason: '[LOCKDOWN] Bash usage blocked.' };
+        }
+        const isRead = isToolCallEventType('read', event);
+        const isEdit = isToolCallEventType('edit', event);
+        const isWrite = isToolCallEventType('write', event);
+        const isGrep = isToolCallEventType('grep', event);
+        const isFind = isToolCallEventType('find', event);
+        const isLs = isToolCallEventType('ls', event);
+        // Special case: Prevent deletion workaround
+        if (isWrite && event.input.content.trim().length === 0) {
+            return {
+                block: true,
+                reason: '[LOCKDOWN] Not allowed to soft-remove file by writing empty content to file.',
+            };
+        }
+        // Compute permissions
+        const hasPath = isRead || isEdit || isWrite;
+        let inputPath = '.';
+        if (hasPath) {
+            inputPath = event.input.path;
+        }
+        else if (isGrep || isFind || isLs) {
+            inputPath = event.input.path ?? '.';
+        }
+        const location = isInside(ctx.cwd, inputPath) ? 'internal' : 'external';
+        const isProtected = lockdownSettings.protectedPatterns.some((pattern) => path.matchesGlob(inputPath, pattern));
+        const protection = isProtected ? 'protected' : 'unprotected';
+        let permAction;
+        if (isRead) {
+            permAction = 'read';
+        }
+        else if (isGrep) {
+            permAction = 'read';
+        }
+        else if (isFind || isLs) {
+            permAction = 'read';
+        }
+        else if (isEdit) {
+            permAction = 'edit';
+        }
+        else if (isWrite) {
+            permAction = 'write';
+        }
+        else {
+            permAction = 'other';
+        }
+        const permission = lockdownSettings[location][protection][permAction];
+        switch (permission) {
+            case 'block':
+                return {
+                    block: true,
+                    reason: `[LOCKDOWN] Not allowed to perform action:\n\n${event.toolName}: ${inputPath}.`,
+                };
+            case 'warn': {
+                const choice = await ctx.ui.select(`[LOCKDOWN]\n⚠️ Allow agent to perform action?\n\n${event.toolName}: ${inputPath}`, ['Yes', 'No']);
+                if (choice !== 'Yes') {
+                    return {
+                        block: true,
+                        reason: '[LOCKDOWN] Action blocked by user.',
+                    };
+                }
+                return;
+            }
+            case 'allow':
+                return;
+        }
+    });
+    // Reset permissions
+    pi.registerCommand('lockdown:reset', {
+        description: 'Reset permissions to those specified in settings.json and/or defaults.',
+        handler: async (_, ctx) => {
+            lockdownSettings = loadSettings(ctx);
+            ctx.ui.notify('Permissions have been reset.', 'info');
+        },
+    });
+    // Temporarily update permissions
+    pi.registerCommand('lockdown:session-permissions', {
+        description: 'Configure file access permissions for session.',
+        handler: async (_args, ctx) => {
+            const items = [
+                {
+                    id: 'external-protected-read',
+                    label: 'Read   external  protected   files',
+                    currentValue: lockdownSettings.external.protected.read,
+                    values: lockdownLevelOptions,
+                },
+                {
+                    id: 'external-protected-edit',
+                    label: 'Edit   external  protected   files',
+                    currentValue: lockdownSettings.external.protected.edit,
+                    values: lockdownLevelOptions,
+                },
+                {
+                    id: 'external-protected-write',
+                    label: 'Write  external  protected   files',
+                    currentValue: lockdownSettings.external.protected.write,
+                    values: lockdownLevelOptions,
+                },
+                {
+                    id: 'external-unprotected-read',
+                    label: 'Read   external  unprotected files',
+                    currentValue: lockdownSettings.external.unprotected.read,
+                    values: lockdownLevelOptions,
+                },
+                {
+                    id: 'external-unprotected-edit',
+                    label: 'Edit   external  unprotected files',
+                    currentValue: lockdownSettings.external.unprotected.edit,
+                    values: lockdownLevelOptions,
+                },
+                {
+                    id: 'external-unprotected-write',
+                    label: 'Write  external  unprotected files',
+                    currentValue: lockdownSettings.external.unprotected.write,
+                    values: lockdownLevelOptions,
+                },
+                {
+                    id: 'internal-protected-read',
+                    label: 'Read   internal  protected   files',
+                    currentValue: lockdownSettings.internal.protected.read,
+                    values: lockdownLevelOptions,
+                },
+                {
+                    id: 'internal-protected-edit',
+                    label: 'Edit   internal  protected   files',
+                    currentValue: lockdownSettings.internal.protected.edit,
+                    values: lockdownLevelOptions,
+                },
+                {
+                    id: 'internal-protected-write',
+                    label: 'Write  internal  protected   files',
+                    currentValue: lockdownSettings.internal.protected.write,
+                    values: lockdownLevelOptions,
+                },
+                {
+                    id: 'internal-unprotected-read',
+                    label: 'Read   internal  unprotected files',
+                    currentValue: lockdownSettings.internal.unprotected.read,
+                    values: lockdownLevelOptions,
+                },
+                {
+                    id: 'internal-unprotected-edit',
+                    label: 'Edit   internal  unprotected files',
+                    currentValue: lockdownSettings.internal.unprotected.edit,
+                    values: lockdownLevelOptions,
+                },
+                {
+                    id: 'internal-unprotected-write',
+                    label: 'Write  internal  unprotected files',
+                    currentValue: lockdownSettings.internal.unprotected.write,
+                    values: lockdownLevelOptions,
+                },
+            ];
+            await ctx.ui.custom((_tui, theme, _kb, done) => {
+                const container = new Container();
+                const titleBox = new Box(0, 1);
+                titleBox.addChild(new Text(theme.fg('accent', theme.bold('Session Permissions')), 0, 0));
+                titleBox.addChild(new Text(theme.fg('dim', 'Toggle file access permissions for the session. Changes are immediately applied.'), 0, 0));
+                container.addChild(titleBox);
+                const settingsList = new SettingsList(items, Math.min(items.length + 2, 15), getSettingsListTheme(), (id, newValue) => {
+                    // Handle value change
+                    const [location, protection, perm] = id.split('-');
+                    lockdownSettings[location][protection][perm] = LockdownLevelSchema.parse(newValue);
+                }, () => done(undefined), // On close
+                { enableSearch: true });
+                container.addChild(settingsList);
+                return {
+                    render: (w) => container.render(w),
+                    invalidate: () => container.invalidate(),
+                    handleInput: (data) => settingsList.handleInput?.(data),
+                };
+            });
+        },
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAA;AAE5B,OAAO,EAAqB,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAA;AAC9G,OAAO,EAAE,GAAG,EAAE,SAAS,EAAoB,YAAY,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAA;AAE7F,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAA;AAC5F,OAAO,YAAY,EAAE,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAEhD,WAAW;AACX,IAAI,gBAAgB,GAAG,sBAAsB,CAAC,KAAK,CAAC;IAClD,QAAQ,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE;IAC5C,QAAQ,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE;CAC7C,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,CAAC,OAAO,WAAW,EAAgB;IACvC,oBAAoB;IACpB,EAAE,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;QAChC,gBAAgB;QAChB,gBAAgB,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;QAEpC,YAAY;QACZ,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAA;QACzE,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC/C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACtC,aAAa;QACb,IAAI,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;YACvC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAA;QAClE,CAAC;QAED,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;QACjD,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;QACjD,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QACnD,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;QACjD,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;QACjD,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QAE7C,4CAA4C;QAC5C,IAAI,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvD,OAAO;gBACL,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,8EAA8E;aACvF,CAAA;QACH,CAAC;QAED,sBAAsB;QACtB,MAAM,OAAO,GAAG,MAAM,IAAI,MAAM,IAAI,OAAO,CAAA;QAC3C,IAAI,SAAS,GAAG,GAAG,CAAA;QACnB,IAAI,OAAO,EAAE,CAAC;YACZ,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAA;QAC9B,CAAC;aAAM,IAAI,MAAM,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YACpC,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,CAAA;QACrC,CAAC;QAED,MAAM,QAAQ,GAA4B,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAA;QAChG,MAAM,WAAW,GAAG,gBAAgB,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAA;QAC9G,MAAM,UAAU,GAAgC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAA;QAEzF,IAAI,UAA+C,CAAA;QAEnD,IAAI,MAAM,EAAE,CAAC;YACX,UAAU,GAAG,MAAM,CAAA;QACrB,CAAC;aAAM,IAAI,MAAM,EAAE,CAAC;YAClB,UAAU,GAAG,MAAM,CAAA;QACrB,CAAC;aAAM,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YAC1B,UAAU,GAAG,MAAM,CAAA;QACrB,CAAC;aAAM,IAAI,MAAM,EAAE,CAAC;YAClB,UAAU,GAAG,MAAM,CAAA;QACrB,CAAC;aAAM,IAAI,OAAO,EAAE,CAAC;YACnB,UAAU,GAAG,OAAO,CAAA;QACtB,CAAC;aAAM,CAAC;YACN,UAAU,GAAG,OAAO,CAAA;QACtB,CAAC;QAED,MAAM,UAAU,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC,CAAA;QAErE,QAAQ,UAAU,EAAE,CAAC;YACnB,KAAK,OAAO;gBACV,OAAO;oBACL,KAAK,EAAE,IAAI;oBACX,MAAM,EAAE,gDAAgD,KAAK,CAAC,QAAQ,KAAK,SAAS,GAAG;iBACxF,CAAA;YACH,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAChC,oDAAoD,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,EAClF,CAAC,KAAK,EAAE,IAAI,CAAC,CACd,CAAA;gBAED,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;oBACrB,OAAO;wBACL,KAAK,EAAE,IAAI;wBACX,MAAM,EAAE,oCAAoC;qBAC7C,CAAA;gBACH,CAAC;gBACD,OAAM;YACR,CAAC;YACD,KAAK,OAAO;gBACV,OAAM;QACV,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,oBAAoB;IACpB,EAAE,CAAC,eAAe,CAAC,gBAAgB,EAAE;QACnC,WAAW,EAAE,wEAAwE;QACrF,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE;YACxB,gBAAgB,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;YACpC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,8BAA8B,EAAE,MAAM,CAAC,CAAA;QACvD,CAAC;KACF,CAAC,CAAA;IAEF,iCAAiC;IACjC,EAAE,CAAC,eAAe,CAAC,8BAA8B,EAAE;QACjD,WAAW,EAAE,gDAAgD;QAC7D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC5B,MAAM,KAAK,GAAkB;gBAC3B;oBACE,EAAE,EAAE,yBAAyB;oBAC7B,KAAK,EAAE,oCAAoC;oBAC3C,YAAY,EAAE,gBAAgB,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI;oBACtD,MAAM,EAAE,oBAAoB;iBAC7B;gBACD;oBACE,EAAE,EAAE,yBAAyB;oBAC7B,KAAK,EAAE,oCAAoC;oBAC3C,YAAY,EAAE,gBAAgB,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI;oBACtD,MAAM,EAAE,oBAAoB;iBAC7B;gBACD;oBACE,EAAE,EAAE,0BAA0B;oBAC9B,KAAK,EAAE,oCAAoC;oBAC3C,YAAY,EAAE,gBAAgB,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK;oBACvD,MAAM,EAAE,oBAAoB;iBAC7B;gBACD;oBACE,EAAE,EAAE,2BAA2B;oBAC/B,KAAK,EAAE,oCAAoC;oBAC3C,YAAY,EAAE,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI;oBACxD,MAAM,EAAE,oBAAoB;iBAC7B;gBACD;oBACE,EAAE,EAAE,2BAA2B;oBAC/B,KAAK,EAAE,oCAAoC;oBAC3C,YAAY,EAAE,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI;oBACxD,MAAM,EAAE,oBAAoB;iBAC7B;gBACD;oBACE,EAAE,EAAE,4BAA4B;oBAChC,KAAK,EAAE,oCAAoC;oBAC3C,YAAY,EAAE,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK;oBACzD,MAAM,EAAE,oBAAoB;iBAC7B;gBACD;oBACE,EAAE,EAAE,yBAAyB;oBAC7B,KAAK,EAAE,oCAAoC;oBAC3C,YAAY,EAAE,gBAAgB,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI;oBACtD,MAAM,EAAE,oBAAoB;iBAC7B;gBACD;oBACE,EAAE,EAAE,yBAAyB;oBAC7B,KAAK,EAAE,oCAAoC;oBAC3C,YAAY,EAAE,gBAAgB,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI;oBACtD,MAAM,EAAE,oBAAoB;iBAC7B;gBACD;oBACE,EAAE,EAAE,0BAA0B;oBAC9B,KAAK,EAAE,oCAAoC;oBAC3C,YAAY,EAAE,gBAAgB,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK;oBACvD,MAAM,EAAE,oBAAoB;iBAC7B;gBACD;oBACE,EAAE,EAAE,2BAA2B;oBAC/B,KAAK,EAAE,oCAAoC;oBAC3C,YAAY,EAAE,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI;oBACxD,MAAM,EAAE,oBAAoB;iBAC7B;gBACD;oBACE,EAAE,EAAE,2BAA2B;oBAC/B,KAAK,EAAE,oCAAoC;oBAC3C,YAAY,EAAE,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI;oBACxD,MAAM,EAAE,oBAAoB;iBAC7B;gBACD;oBACE,EAAE,EAAE,4BAA4B;oBAChC,KAAK,EAAE,oCAAoC;oBAC3C,YAAY,EAAE,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK;oBACzD,MAAM,EAAE,oBAAoB;iBAC7B;aACF,CAAA;YAED,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;gBAC7C,MAAM,SAAS,GAAG,IAAI,SAAS,EAAE,CAAA;gBAEjC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;gBAC9B,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;gBACxF,QAAQ,CAAC,QAAQ,CACf,IAAI,IAAI,CACN,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,kFAAkF,CAAC,EACnG,CAAC,EACD,CAAC,CACF,CACF,CAAA;gBAED,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;gBAE5B,MAAM,YAAY,GAAG,IAAI,YAAY,CACnC,KAAK,EACL,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,EAAE,CAAC,EAC9B,oBAAoB,EAAE,EACtB,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE;oBACf,sBAAsB;oBACtB,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;oBAClD,gBAAgB,CAAC,QAAmC,CAAC,CAAC,UAAyC,CAAC,CAC9F,IAAiC,CAClC,GAAG,mBAAmB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;gBACzC,CAAC,EACD,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW;gBAClC,EAAE,YAAY,EAAE,IAAI,EAAE,CACvB,CAAA;gBACD,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;gBAEhC,OAAO;oBACL,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;oBAClC,UAAU,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE;oBACxC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC;iBACxD,CAAA;YACH,CAAC,CAAC,CAAA;QACJ,CAAC;KACF,CAAC,CAAA;AACJ,CAAC"}

package/dist/schema.d.ts

@@ -0,0 +1,73 @@
+import z from 'zod';
+export declare const lockdownLevelOptions: string[];
+export declare const LockdownLevelSchema: z.ZodEnum<{
+    [x: string]: string;
+}>;
+export type LockdownLevel = z.infer<typeof LockdownLevelSchema>;
+export declare const LockdownSettingsSchema: z.ZodObject<{
+    tools: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    customTools: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    protectedPatterns: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    external: z.ZodObject<{
+        protected: z.ZodObject<{
+            read: z.ZodDefault<z.ZodEnum<{
+                [x: string]: string;
+            }>>;
+            write: z.ZodDefault<z.ZodEnum<{
+                [x: string]: string;
+            }>>;
+            edit: z.ZodDefault<z.ZodEnum<{
+                [x: string]: string;
+            }>>;
+            other: z.ZodDefault<z.ZodEnum<{
+                [x: string]: string;
+            }>>;
+        }, z.core.$strip>;
+        unprotected: z.ZodObject<{
+            read: z.ZodDefault<z.ZodEnum<{
+                [x: string]: string;
+            }>>;
+            write: z.ZodDefault<z.ZodEnum<{
+                [x: string]: string;
+            }>>;
+            edit: z.ZodDefault<z.ZodEnum<{
+                [x: string]: string;
+            }>>;
+            other: z.ZodDefault<z.ZodEnum<{
+                [x: string]: string;
+            }>>;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+    internal: z.ZodObject<{
+        protected: z.ZodObject<{
+            read: z.ZodDefault<z.ZodEnum<{
+                [x: string]: string;
+            }>>;
+            write: z.ZodDefault<z.ZodEnum<{
+                [x: string]: string;
+            }>>;
+            edit: z.ZodDefault<z.ZodEnum<{
+                [x: string]: string;
+            }>>;
+            other: z.ZodDefault<z.ZodEnum<{
+                [x: string]: string;
+            }>>;
+        }, z.core.$strip>;
+        unprotected: z.ZodObject<{
+            read: z.ZodDefault<z.ZodEnum<{
+                [x: string]: string;
+            }>>;
+            write: z.ZodDefault<z.ZodEnum<{
+                [x: string]: string;
+            }>>;
+            edit: z.ZodDefault<z.ZodEnum<{
+                [x: string]: string;
+            }>>;
+            other: z.ZodDefault<z.ZodEnum<{
+                [x: string]: string;
+            }>>;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type LockdownSettings = z.infer<typeof LockdownSettingsSchema>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAA;AAEnB,eAAO,MAAM,oBAAoB,UAA6B,CAAA;AAC9D,eAAO,MAAM,mBAAmB;;EAA+B,CAAA;AAC/D,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAI/D,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAgCjC,CAAA;AACF,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAA"}

package/dist/schema.js

@@ -0,0 +1,38 @@
+import z from 'zod';
+export const lockdownLevelOptions = ['allow', 'warn', 'block'];
+export const LockdownLevelSchema = z.enum(lockdownLevelOptions);
+const defaultTools = ['read', 'edit', 'write', 'grep', 'find', 'ls'];
+export const LockdownSettingsSchema = z.object({
+    tools: z.array(z.string()).default(defaultTools),
+    customTools: z.array(z.string()).default([]),
+    protectedPatterns: z.array(z.string()).default(['**/.env*', '**/.git/**', '**/node_modules/**']),
+    external: z.object({
+        protected: z.object({
+            read: LockdownLevelSchema.default('block'),
+            write: LockdownLevelSchema.default('block'),
+            edit: LockdownLevelSchema.default('block'),
+            other: LockdownLevelSchema.default('block'),
+        }),
+        unprotected: z.object({
+            read: LockdownLevelSchema.default('allow'),
+            write: LockdownLevelSchema.default('block'),
+            edit: LockdownLevelSchema.default('block'),
+            other: LockdownLevelSchema.default('block'),
+        }),
+    }),
+    internal: z.object({
+        protected: z.object({
+            read: LockdownLevelSchema.default('warn'),
+            write: LockdownLevelSchema.default('warn'),
+            edit: LockdownLevelSchema.default('warn'),
+            other: LockdownLevelSchema.default('warn'),
+        }),
+        unprotected: z.object({
+            read: LockdownLevelSchema.default('allow'),
+            write: LockdownLevelSchema.default('warn'),
+            edit: LockdownLevelSchema.default('warn'),
+            other: LockdownLevelSchema.default('warn'),
+        }),
+    }),
+});
+//# sourceMappingURL=schema.js.map

package/dist/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAA;AAEnB,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;AAC9D,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAA;AAG/D,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;AAEpE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IAChD,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5C,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,YAAY,EAAE,oBAAoB,CAAC,CAAC;IAChG,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;YAClB,IAAI,EAAE,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC;YAC1C,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC;YAC3C,IAAI,EAAE,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC;YAC1C,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC;SAC5C,CAAC;QACF,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,IAAI,EAAE,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC;YAC1C,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC;YAC3C,IAAI,EAAE,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC;YAC1C,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC;SAC5C,CAAC;KACH,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;YAClB,IAAI,EAAE,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC;YACzC,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC;YAC1C,IAAI,EAAE,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC;YACzC,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC;SAC3C,CAAC;QACF,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,IAAI,EAAE,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC;YAC1C,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC;YAC1C,IAAI,EAAE,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC;YACzC,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC;SAC3C,CAAC;KACH,CAAC;CACH,CAAC,CAAA"}

package/dist/utils.d.ts

@@ -0,0 +1,5 @@
+import { type ExtensionContext } from '@earendil-works/pi-coding-agent';
+import { type LockdownSettings } from './schema';
+export declare function isInside(root: string, value: string): boolean;
+export default function loadSettings(ctx: ExtensionContext): LockdownSettings;
+//# sourceMappingURL=utils.d.ts.map

package/dist/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,gBAAgB,EAAmB,MAAM,iCAAiC,CAAA;AAExF,OAAO,EAAE,KAAK,gBAAgB,EAA0B,MAAM,UAAU,CAAA;AAExE,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAY7D;AAED,MAAM,CAAC,OAAO,UAAU,YAAY,CAAC,GAAG,EAAE,gBAAgB,GAAG,gBAAgB,CA4B5E"}

package/dist/utils.js

@@ -0,0 +1,35 @@
+import path from 'node:path';
+import { SettingsManager } from '@earendil-works/pi-coding-agent';
+import { LockdownSettingsSchema } from './schema';
+export function isInside(root, value) {
+    // Resolve `value` relative to `root`, NOT the process CWD.
+    // This prevents a bug where a relative `value` resolves differently
+    // depending on the process's current directory.
+    const resolvedValue = path.resolve(root, value);
+    // Normalize trailing separators so "root" and "root/" are treated identically.
+    const normalizedRoot = root.replace(/[/\\]+$/, '') + path.sep;
+    const normalizedValue = resolvedValue.replace(/[/\\]+$/, '');
+    // Allow value == root itself (no trailing separator needed).
+    return normalizedValue === root || normalizedValue.startsWith(normalizedRoot);
+}
+export default function loadSettings(ctx) {
+    const sm = SettingsManager.create(ctx.cwd);
+    const projectSettings = sm.getProjectSettings();
+    const globalSettings = sm.getGlobalSettings();
+    // Read project settings first
+    const { success, data: projectLockdownSettings } = LockdownSettingsSchema.safeParse(projectSettings.lockdown);
+    if (success && projectLockdownSettings) {
+        return projectLockdownSettings;
+    }
+    // Global settings fallback
+    const { success: globalSuccess, data: globalLockdownSettings } = LockdownSettingsSchema.safeParse(globalSettings.lockdown);
+    if (globalSuccess && globalLockdownSettings) {
+        return globalLockdownSettings;
+    }
+    // Use defaults
+    return LockdownSettingsSchema.parse({
+        external: { protected: {}, unprotected: {} },
+        internal: { protected: {}, unprotected: {} },
+    });
+}
+//# sourceMappingURL=utils.js.map

package/dist/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAA;AAE5B,OAAO,EAAyB,eAAe,EAAE,MAAM,iCAAiC,CAAA;AAExF,OAAO,EAAyB,sBAAsB,EAAE,MAAM,UAAU,CAAA;AAExE,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,KAAa;IAClD,2DAA2D;IAC3D,oEAAoE;IACpE,gDAAgD;IAChD,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IAE/C,+EAA+E;IAC/E,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAA;IAC7D,MAAM,eAAe,GAAG,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;IAE5D,6DAA6D;IAC7D,OAAO,eAAe,KAAK,IAAI,IAAI,eAAe,CAAC,UAAU,CAAC,cAAc,CAAC,CAAA;AAC/E,CAAC;AAED,MAAM,CAAC,OAAO,UAAU,YAAY,CAAC,GAAqB;IACxD,MAAM,EAAE,GAAG,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC1C,MAAM,eAAe,GAAG,EAAE,CAAC,kBAAkB,EAAE,CAAA;IAC/C,MAAM,cAAc,GAAG,EAAE,CAAC,iBAAiB,EAAE,CAAA;IAE7C,8BAA8B;IAC9B,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,sBAAsB,CAAC,SAAS,CAChF,eAA2C,CAAC,QAAQ,CACtD,CAAA;IAED,IAAI,OAAO,IAAI,uBAAuB,EAAE,CAAC;QACvC,OAAO,uBAAuB,CAAA;IAChC,CAAC;IAED,2BAA2B;IAC3B,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,sBAAsB,CAAC,SAAS,CAC9F,cAA0C,CAAC,QAAQ,CACrD,CAAA;IAED,IAAI,aAAa,IAAI,sBAAsB,EAAE,CAAC;QAC5C,OAAO,sBAAsB,CAAA;IAC/B,CAAC;IAED,eAAe;IACf,OAAO,sBAAsB,CAAC,KAAK,CAAC;QAClC,QAAQ,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE;QAC5C,QAAQ,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE;KAC7C,CAAC,CAAA;AACJ,CAAC"}

package/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "@chrischow/pi-lockdown",
+  "version": "0.1.0",
+  "description": "A Pi extension to add security constraints to agent tool usage.",
+  "author": "Chris Chow",
+  "license": "MIT",
+  "keywords": [
+    "pi-package",
+    "pi-extension",
+    "pi-coding-agent",
+    "lockdown",
+    "security"
+  ],
+  "scripts": {
+    "format": "prettier --write './src/*.{ts,js}'",
+    "lint": "eslint 'src/**/*.ts' --fix",
+    "check": "tsc --noEmit",
+    "build": "tsc -p tsconfig.build.json",
+    "prepublishOnly": "npm run build"
+  },
+  "files": [
+    "dist"
+  ],
+  "pi": {
+    "extensions": [
+      "dist/index.js"
+    ]
+  },
+  "peerDependencies": {
+    "@earendil-works/pi-coding-agent": "*",
+    "@earendil-works/pi-tui": "*",
+    "typebox": "*"
+  },
+  "dependencies": {
+    "zod": "^4.4.3"
+  },
+  "devDependencies": {
+    "@earendil-works/pi-coding-agent": "^0.79.1",
+    "@earendil-works/pi-tui": "^0.79.1",
+    "@types/node": "^25.9.3"
+  }
+}