@czottmann/pi-automode 1.12.0 → 1.14.0

package/CHANGELOG.md

@@ -2,6 +2,30 @@
 
 All notable changes to this project are documented in this file.
 
+## [Unreleased]
+
+## [1.14.0] - 2026-08-27
+
+## Bug fixes
+
+- **Classifier stream timeout** — Apply `classifierTimeoutMs` to the full response stream. Provider behavior cannot keep classifier calls pending after the deadline. Parent cancellation remains active. Reject values above the Node.js timer limit. (#30)
+- **OS temp-directory deletes** — Stop hard-denying recursive-delete subtrees under `os.tmpdir()` and `/tmp`. On macOS these resolve into `/private/tmp` and `/private/var/folders`, which matched the `/private` system root and blocked every temp cleanup. Deleting a temp root itself stays blocked. (#31)
+- **Validated temp-root declarations** — Derive the exempt temp roots only from launcher-declared values that stay safe: reject values such as `/`, empty strings, aliases of `HOME`, `/`, or a system root, and ancestors of `HOME`. Without validation, a malformed `TMPDIR` could disable deterministic denials for protected targets, and a broad `permissions.allow` rule could then allow the action without classifier review. Recompute candidates when the effective tmpdir changes. (#31)
+
+## [1.13.0] - 2026-08-25
+
+## New features
+
+- **Bash AST analysis** — Replace handwritten shell parsing with `unbash`. Permission and hard-deny checks now inspect command structure, nested commands, wrappers, redirects, and malformed input. Bash allow rules require complete structural coverage and fail closed when analysis is unsafe. (#26)
+- **Extension-owned global config** — Store global settings at `~/.pi/agent/extensions/pi-automode/config.json`. Migrate the legacy file automatically, preserve a safe fallback after migration errors, and report conflicts through notifications and diagnostics. (#27)
+
+## Bug fixes
+
+- **Conservative permission rules** — Malformed deny and ask patterns block actions. Malformed patterns do not expand allow rules. Permission checks examine each Bash subcommand and normalize whitespace. Path checks resolve symlinks and normalize `file://` and Windows paths. (#22)
+- **Recursive deletion hard-deny** — Detect uppercase flags and GNU abbreviations for recursive `rm`, including commands behind `command`, `exec`, and `env`. Parse the `--` delimiter and shell tilde expansion. Protect Linux and macOS system roots without blocking active-home subdirectories, `/opt`, or `/srv`. (#23)
+- **Global Pi safety-control paths** — Hard-deny direct writes and edits to `~/.pi/agent/extensions/`, `~/.pi/agent/settings.json`, and `~/.pi/agent/settings/`. Resolve case variants and symlink targets before matching. (#24)
+- **Case-insensitive protected paths** — Match protected paths without case distinctions and normalize Unicode spellings. This closes path bypasses on case-insensitive filesystems. (#25)
+
 ## [1.12.0] - 2026-08-23
 
 ## New features
@@ -21,4 +45,7 @@ All notable changes to this project are documented in this file.
 - **Project config trust gate** — Ignore `.pi/automode.local.json` and `.pi/automode.json` until Pi trusts the project. Apply the trust gate during startup and config reloads. (#16)
 - **In-memory observability logs** — Write logs to an extension-owned directory (`~/.pi/agent/extensions/pi-automode/logs/`) instead of the launching project directory. Thanks, @HerbertGao! (#13)
 
+[Unreleased]: https://github.com/czottmann/pi-automode/compare/v1.14.0...HEAD
+[1.14.0]: https://github.com/czottmann/pi-automode/compare/v1.13.0...v1.14.0
+[1.13.0]: https://github.com/czottmann/pi-automode/compare/v1.12.0...v1.13.0
 [1.12.0]: https://github.com/czottmann/pi-automode/compare/v1.11.0...v1.12.0

package/README.md

@@ -39,8 +39,8 @@ pi -e ./extensions/auto-mode.ts
 /automode defaults  # print the built-in rule lists
 /automode config    # effective config, resolved log file path, + diagnostics
 /automode denials   # denial history for this session
-/automode model     # open classifier model selector and save to ~/.pi/agent/automode.json
-/automode model provider/model-id # save classifier model to ~/.pi/agent/automode.json
+/automode model     # open classifier model selector and save to ~/.pi/agent/extensions/pi-automode/config.json
+/automode model provider/model-id # save classifier model to ~/.pi/agent/extensions/pi-automode/config.json
 ```
 
 `/auto-mode` is an alias.
@@ -101,7 +101,7 @@ The extension blocks these before any allow or classifier decision:
 - SSH `authorized_keys` writes
 - cron, launch agent, and system service persistence
 - TLS/certificate/auth weakening patterns
-- root, home, and system-path destructive deletes
+- root, home, and system-path destructive deletes. Subtrees of validated launcher-declared temp directories are treated as disposable. Declared roots that alias `HOME`, `/`, or a system root, or that contain `HOME`, are rejected instead.
 - edits to `.pi/automode*`, `.pi` auto-mode files, and this extension's safety-control files
 
 After these checks, pi-automode applies `permissions.allow`. Protected `write` and `edit` targets continue to the classifier.
@@ -124,6 +124,8 @@ Both stages receive the complete current tool input in a dedicated message. Tran
 
 Both stages use a classifier-specific session key. They request short cache retention from providers that support it. A missing model, provider failure, or malformed response blocks the action.
 
+Pi-automode parses Bash structure with `unbash` before permission and deterministic hard-deny checks. The analysis includes nested commands and literal shell-wrapper scripts. A Bash parse error blocks the action.
+
 ## Examples
 
 - `examples/automode.local.json`: copy to `.pi/automode.local.json` in a project and edit the domains, buckets, and source-control org.
@@ -146,7 +148,7 @@ The tests cover these safety-sensitive areas:
 - the `permissions.allow` tier and its precedence
 - configuration-source precedence and diagnostics
 - `$defaults` behavior
-- deterministic hard-deny checks and shell parsing
+- deterministic hard-deny checks and Bash AST analysis
 - classifier routing for `write` and `edit`
 - symlink-aware safety-control checks
 - token-budgeted transcript selection

package/docs/adr/ADR-001-permission-precedence-and-trust-boundaries.md

@@ -31,6 +31,8 @@ Pi-automode reads `permissions.allow` only from user-owned configuration sources
 
 Shared `.pi/automode.json` can add deny and ask rules after project trust. It cannot add allow rules.
 
+[ADR-002](ADR-002-global-config-in-extension-data-directory.md) replaces only the global configuration path. Permission precedence and trust boundaries stay unchanged.
+
 For an oversized matcher input, deny and ask rules return a match. Allow rules return no match. This behavior keeps denial rules fail-closed without broadening allow rules.
 
 ## Consequences

package/docs/adr/ADR-002-global-config-in-extension-data-directory.md

@@ -0,0 +1,60 @@
+# ADR-002: Store the global config in the extension data directory
+
+**Date:** 2026-08-25
+
+## Context
+
+Pi-automode stores its global configuration at `~/.pi/agent/automode.json`. The extension stores application-owned logs below `~/.pi/agent/extensions/pi-automode/logs/`.
+
+The separate global configuration path makes extension-owned data harder to identify and manage. The global configuration belongs beside the existing log directory.
+
+An existing installation can contain the legacy file. Migration must not discard configuration data or create different read and write sources.
+
+This decision refines the global user-owned configuration source from [ADR-001](ADR-001-permission-precedence-and-trust-boundaries.md). It does not change permission precedence or project trust boundaries.
+
+Tracking issue: [#27](https://github.com/czottmann/pi-automode/issues/27)
+
+## Decision
+
+Pi-automode stores the global configuration at:
+
+```text
+~/.pi/agent/extensions/pi-automode/config.json
+```
+
+The existing log directory stays at:
+
+```text
+~/.pi/agent/extensions/pi-automode/logs/
+```
+
+Project configuration files keep their current paths and semantics:
+
+- `.pi/automode.local.json`
+- `.pi/automode.json`
+
+At startup, pi-automode selects one active global configuration path for the session:
+
+1. If only the new file is present, pi-automode uses the new file.
+2. If only the legacy file is present, pi-automode moves it to the new path before loading configuration.
+3. If the two files are present, pi-automode uses the new file and does not change the legacy file.
+4. If migration fails, pi-automode uses the legacy file for reads and writes during that session.
+5. If neither file is present, pi-automode uses the new path for the next write.
+
+Pi-automode attempts migration once per session. A later session retries a failed migration.
+
+A successful migration produces one UI notification. A path conflict produces a warning during every startup. A migration error produces one warning per session.
+
+Conflict and migration error details also appear in configuration diagnostics. This behavior makes the details available in headless sessions.
+
+## Consequences
+
+All extension-owned global data has one identifiable root directory. Configuration backups and extension cleanup become easier to understand.
+
+The new configuration inherits the deterministic protection for `~/.pi/agent/extensions/`. Direct agent file tools cannot modify the configuration.
+
+The extension must pass the selected active path to configuration reads and writes. This requirement prevents split-brain configuration during migration errors.
+
+The migration is one-way. A downgraded pi-automode version does not automatically find the new configuration path.
+
+Startup gains a small filesystem operation and migration state. Tests must cover migration, conflicts, errors, notifications, diagnostics, and unchanged project precedence.

package/docs/adr/INDEX.md

@@ -3,3 +3,4 @@
 | # | Decision | Date |
 |---|----------|------|
 | [ADR-001](ADR-001-permission-precedence-and-trust-boundaries.md) | Permission precedence and configuration trust boundaries | 2026-08-23 |
+| [ADR-002](ADR-002-global-config-in-extension-data-directory.md) | Store the global config in the extension data directory | 2026-08-25 |

package/docs/automode-classifier-flow.md

@@ -89,7 +89,7 @@ Pi-automode loads global and inline configuration during extension initializatio
 
 The effective configuration combines these sources:
 
-- `~/.pi/agent/automode.json`
+- `~/.pi/agent/extensions/pi-automode/config.json`
 - `.pi/automode.local.json` for trusted projects
 - `PI_AUTOMODE_SETTINGS_JSON`
 - shared `.pi/automode.json` for trusted projects, but only for `permissions.deny` and `permissions.ask`
@@ -195,7 +195,7 @@ Current deterministic blocks include these actions:
 - dangerous recursive deletes of root, home, or system paths
 - selected system or SSH permission mutations
 
-The `bash` checks use a small shell lexer. It handles quotes, redirects, pipes, `&&`, `||`, and `;`. This catches common "safe prefix, risky suffix" patterns.
+The `bash` checks use the `unbash` abstract syntax tree. They inspect chains, pipelines, compound commands, substitutions, redirects, and literal shell-wrapper scripts.
 
 Recursive-delete checks hard-deny `/`, the user home root, and top-level system roots. They exempt subpaths of the user home because these paths contain user data.
 
@@ -324,7 +324,7 @@ Pi-automode selects the classifier model in this order:
 1. `autoMode.classifierModel` from configuration
 2. the current Pi session model.
 
-`/automode model provider/model-id` and the interactive model picker save `autoMode.classifierModel` to `~/.pi/agent/automode.json`. Project-local `.pi/automode.local.json` can still override that global choice.
+`/automode model provider/model-id` and the interactive model picker save `autoMode.classifierModel` to `~/.pi/agent/extensions/pi-automode/config.json`. Project-local `.pi/automode.local.json` can still override that global choice.
 
 `autoMode.classifierReasoningLevel` can request `low`, `medium`, `high`, `xhigh`, or `max` reasoning for both stages.
 
@@ -424,4 +424,4 @@ The classifier flow can be inspected or changed through slash commands:
 
 `/auto-mode` is an alias.
 
-`/automode off` disables the whole flow for the current session. `/automode on` re-enables it. `/automode model` saves the classifier model to `~/.pi/agent/automode.json`.
+`/automode off` disables the whole flow for the current session. `/automode on` re-enables it. `/automode model` saves the classifier model to `~/.pi/agent/extensions/pi-automode/config.json`.

package/docs/configuration.md

@@ -4,10 +4,12 @@ The extension follows the documented Claude Code configuration model where Pi su
 
 It reads `autoMode` only from Pi-owned configuration sources:
 
-- `~/.pi/agent/automode.json`
+- `~/.pi/agent/extensions/pi-automode/config.json`
 - `.pi/automode.local.json` for trusted projects
 - `PI_AUTOMODE_SETTINGS_JSON`
 
+At startup, pi-automode moves a legacy `~/.pi/agent/automode.json` file to the new global path. If both files exist, it uses the new file and reports the conflict. If migration fails, it uses the legacy file for that session and reports the error.
+
 It does not read project configuration until Pi trusts the project. For an untrusted project, it ignores `.pi/automode.local.json` and `.pi/automode.json`. `/automode config` reports each ignored file that exists.
 
 Shared project `.pi/automode.json` cannot weaken auto mode. For a trusted project, it can add `permissions.deny` and `permissions.ask` rules.
@@ -26,7 +28,7 @@ To disable pi-automode for the current project, create or edit `.pi/automode.loc
 
 This file is project-local. Pi reads it only after project trust. Do not commit this file. Shared project `.pi/automode.json` cannot disable auto mode.
 
-Set a global default classifier model in `~/.pi/agent/automode.json`. For a trusted project, override it in `.pi/automode.local.json`.
+Set a global default classifier model in `~/.pi/agent/extensions/pi-automode/config.json`. For a trusted project, override it in `.pi/automode.local.json`.
 
 `classifierReasoningLevel` requests `low`, `medium`, `high`, `xhigh`, or `max` reasoning for both classifier stages. If the key is absent, pi-automode sends no reasoning preference. The server then selects the level.
 
@@ -140,7 +142,19 @@ Permission patterns use Pi tool names. Examples include `bash(...)`, `write(...)
 
 Use this tier for a narrow command such as `bash(git status*)`. You can also use it for a side-effect-free extension or MCP tool.
 
-The matcher understands primary arguments for `bash`, the file tools, and `grep`. For `bash`, it uses `input.command`. For file tools, it uses the resolved `input.path`. For `grep`, it uses `input.pattern`.
+The matcher understands primary arguments for `bash`, the file tools, and `grep`. For file tools, it uses the resolved `input.path`. For `grep`, it uses `input.pattern`.
+
+For `bash`, pi-automode parses `input.command` with `unbash`. Deny and ask rules inspect each executable command in the Bash syntax tree. This includes pipelines, logical chains, compound commands, substitutions, and literal scripts passed to `bash -c`, `sh -c`, or `eval`. The analysis also follows these literal shell scripts through transparent `command`, `exec`, and `env` dispatch.
+
+The matcher normalizes whitespace between Bash tokens. It preserves whitespace and quoting inside each token. Thus, `bash(git push*)` matches `git  push origin main`. Quoted operators do not create extra commands.
+
+A Bash allow decision requires coverage for each executable command. A multi-command pattern must match the same AST structure and operators. This structure check also applies to one command inside a group, wrapper, control structure, or background statement. Separate single-command patterns only cover top-level foreground chains and plain pipelines. Other supported structure requires one matching structural pattern. A multi-command pattern must match the same number of commands in the same order. Each pattern command must match its corresponding input command. One wildcard cannot hide an additional command or a different operator.
+
+A redirect requires explicit coverage in the allow pattern. The redirect operator, file descriptor, variable name, and target pattern must match. Here-documents and dynamic redirect targets continue to the classifier. Parser errors, dynamic command names, and dynamic wrapper scripts cannot use `permissions.allow`.
+
+Control nodes with unrepresented semantic values cannot use `permissions.allow`. This includes loops, functions, coprocesses, case statements, test commands, and arithmetic commands. These scripts continue to the classifier.
+
+Pi-automode does not execute shell expansions. It cannot resolve aliases, variables, generated scripts, or dynamic `eval` input. These calls continue to the classifier unless a deterministic rule blocks them.
 
 For other tools, the matcher uses the serialized input object. Use a bare tool name for an MCP or extension tool. For example, `example-extension-tool` matches every call to that tool.
 
@@ -150,6 +164,8 @@ A match skips only the classifier call. It cannot skip `permissions.deny`, deter
 
 Pi-automode reads `permissions.allow` only from global configuration, trusted `.pi/automode.local.json`, and `PI_AUTOMODE_SETTINGS_JSON`. Shared `.pi/automode.json` cannot add allow rules.
 
-A pattern can contain at most 4,096 UTF-16 code units. For allow matching, an input can contain at most 1,048,576 UTF-16 code units. A longer input returns no match. Deny and ask patterns match the same oversized input so that they fail closed.
+A pattern can contain at most 4,096 UTF-16 code units. Bash analysis accepts at most 1,048,576 UTF-16 code units. A longer Bash input is blocked before parsing.
+
+For other allow matching, an input can contain at most 1,048,576 UTF-16 code units. A longer input returns no match. Deny and ask patterns match the same oversized input so that they fail closed.
 
 `write` and `edit` calls whose resolved target is a protected path are never covered by `permissions.allow`. This includes protected targets reached through symlink aliases.

package/docs/observability-logging.md

@@ -6,7 +6,7 @@ Logging is off by default. Logging fails open, so a write error never changes an
 
 ## Enabling
 
-Set `autoMode.log` in a Pi-owned configuration source. These sources include `~/.pi/agent/automode.json`, trusted `.pi/automode.local.json`, and `PI_AUTOMODE_SETTINGS_JSON`.
+Set `autoMode.log` in a Pi-owned configuration source. These sources include `~/.pi/agent/extensions/pi-automode/config.json`, trusted `.pi/automode.local.json`, and `PI_AUTOMODE_SETTINGS_JSON`.
 
 ```json
 {