@czottmann/pi-automode 1.13.0 → 1.14.0

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 All notable changes to this project are documented in this file.
 
+## [Unreleased]
+
+## [1.14.0] - 2026-08-27
+
+## Bug fixes
+
+- **Classifier stream timeout** — Apply `classifierTimeoutMs` to the full response stream. Provider behavior cannot keep classifier calls pending after the deadline. Parent cancellation remains active. Reject values above the Node.js timer limit. (#30)
+- **OS temp-directory deletes** — Stop hard-denying recursive-delete subtrees under `os.tmpdir()` and `/tmp`. On macOS these resolve into `/private/tmp` and `/private/var/folders`, which matched the `/private` system root and blocked every temp cleanup. Deleting a temp root itself stays blocked. (#31)
+- **Validated temp-root declarations** — Derive the exempt temp roots only from launcher-declared values that stay safe: reject values such as `/`, empty strings, aliases of `HOME`, `/`, or a system root, and ancestors of `HOME`. Without validation, a malformed `TMPDIR` could disable deterministic denials for protected targets, and a broad `permissions.allow` rule could then allow the action without classifier review. Recompute candidates when the effective tmpdir changes. (#31)
+
 ## [1.13.0] - 2026-08-25
 
 ## New features
@@ -35,5 +45,7 @@ All notable changes to this project are documented in this file.
 - **Project config trust gate** — Ignore `.pi/automode.local.json` and `.pi/automode.json` until Pi trusts the project. Apply the trust gate during startup and config reloads. (#16)
 - **In-memory observability logs** — Write logs to an extension-owned directory (`~/.pi/agent/extensions/pi-automode/logs/`) instead of the launching project directory. Thanks, @HerbertGao! (#13)
 
+[Unreleased]: https://github.com/czottmann/pi-automode/compare/v1.14.0...HEAD
+[1.14.0]: https://github.com/czottmann/pi-automode/compare/v1.13.0...v1.14.0
 [1.13.0]: https://github.com/czottmann/pi-automode/compare/v1.12.0...v1.13.0
 [1.12.0]: https://github.com/czottmann/pi-automode/compare/v1.11.0...v1.12.0

package/README.md

@@ -101,7 +101,7 @@ The extension blocks these before any allow or classifier decision:
 - SSH `authorized_keys` writes
 - cron, launch agent, and system service persistence
 - TLS/certificate/auth weakening patterns
-- root, home, and system-path destructive deletes
+- root, home, and system-path destructive deletes. Subtrees of validated launcher-declared temp directories are treated as disposable. Declared roots that alias `HOME`, `/`, or a system root, or that contain `HOME`, are rejected instead.
 - edits to `.pi/automode*`, `.pi` auto-mode files, and this extension's safety-control files
 
 After these checks, pi-automode applies `permissions.allow`. Protected `write` and `edit` targets continue to the classifier.

package/extensions/auto-mode/classifier.ts

@@ -155,6 +155,55 @@ export type ClassifierCompletionPlan = {
   reasoningLevel?: Exclude<EffectiveClassifierReasoningLevel, "off">;
 };
 
+async function completeClassifierAttempt(
+  completeFn: ClassifierCompletionFn,
+  model: Model<any>,
+  prompt: Parameters<ClassifierCompletionFn>[1],
+  parentSignal: AbortSignal | undefined,
+  options: Omit<Parameters<ClassifierCompletionFn>[2], "signal">,
+): Promise<AssistantMessage> {
+  if (options.timeoutMs === undefined) {
+    return completeFn(model, prompt, {
+      ...options,
+      ...(parentSignal === undefined ? {} : { signal: parentSignal }),
+    });
+  }
+
+  const controller = new AbortController();
+  const onParentAbort = () => controller.abort(parentSignal?.reason);
+  if (parentSignal?.aborted) onParentAbort();
+  else parentSignal?.addEventListener("abort", onParentAbort, { once: true });
+
+  let onAbort: (() => void) | undefined;
+  const aborted = new Promise<never>((_resolve, reject) => {
+    onAbort = () => {
+      const reason = controller.signal.reason;
+      reject(reason instanceof Error ? reason : new Error("Classifier request aborted."));
+    };
+    if (controller.signal.aborted) onAbort();
+    else controller.signal.addEventListener("abort", onAbort, { once: true });
+  });
+  const timer = setTimeout(() => {
+    controller.abort(
+      new Error(`Classifier request timed out after ${options.timeoutMs} ms.`),
+    );
+  }, options.timeoutMs);
+
+  try {
+    return await Promise.race([
+      completeFn(model, prompt, {
+        ...options,
+        signal: controller.signal,
+      }),
+      aborted,
+    ]);
+  } finally {
+    clearTimeout(timer);
+    if (onAbort) controller.signal.removeEventListener("abort", onAbort);
+    parentSignal?.removeEventListener("abort", onParentAbort);
+  }
+}
+
 /**
  * Run normalized Pi AI completion through the provider in Pi's runtime registry.
  * This temporary bridge is only valid until Pi exposes
@@ -435,14 +484,15 @@ export async function classifyWithRetry(
     const started = Date.now();
     let response: AssistantMessage;
     try {
-      response = await completeFn(
+      response = await completeClassifierAttempt(
+        completeFn,
         classifier.model,
         prompt,
+        signal,
         {
           apiKey: classifier.apiKey,
           headers: classifier.headers,
           env: classifier.env,
-          signal,
           maxTokens,
           ...(temperature === undefined ? {} : { temperature }),
           ...(options.timeoutMs === undefined ? {} : { timeoutMs: options.timeoutMs }),
@@ -505,7 +555,8 @@ export async function classifyInStages(
   const fastStarted = Date.now();
   let fastResponse: AssistantMessage;
   try {
-    fastResponse = await completeFn(
+    fastResponse = await completeClassifierAttempt(
+      completeFn,
       classifier.model,
       {
         systemPrompt: prompt.systemPrompt,
@@ -515,11 +566,11 @@ export async function classifyInStages(
           stageMessage(CLASSIFIER_FAST_INSTRUCTION),
         ],
       },
+      signal,
       {
         apiKey: classifier.apiKey,
         headers: classifier.headers,
         env: classifier.env,
-        signal,
         // Reasoning and OpenAI-compatible models may consume hidden reasoning,
         // control, and EOS tokens before emitting the required visible digit.
         maxTokens: options.fastClassifierMaxTokens ??

package/extensions/auto-mode/config.ts

@@ -22,6 +22,7 @@ import {
   DEFAULT_MAX_USER_TRANSCRIPT_TOKENS,
   DEFAULT_PROTECTED_PATHS,
   DEFAULT_SOFT_DENY,
+  MAX_CLASSIFIER_TIMEOUT_MS,
   PI_GLOBAL_SETTINGS,
   PI_LEGACY_GLOBAL_SETTINGS,
   PI_PROJECT_LOCAL_SETTINGS,
@@ -324,10 +325,11 @@ export function validateSettingsFile(
       if (
         hasOwn(autoMode, "classifierTimeoutMs") &&
         (!Number.isInteger(autoMode.classifierTimeoutMs) ||
-          (autoMode.classifierTimeoutMs as number) < 1000)
+          (autoMode.classifierTimeoutMs as number) < 1000 ||
+          (autoMode.classifierTimeoutMs as number) > MAX_CLASSIFIER_TIMEOUT_MS)
       ) {
         diagnostics.push(
-          `${source}: autoMode.classifierTimeoutMs must be an integer of at least 1000`,
+          `${source}: autoMode.classifierTimeoutMs must be an integer from 1000 through ${MAX_CLASSIFIER_TIMEOUT_MS}`,
         );
       }
       if (
@@ -591,7 +593,9 @@ function validFastClassifierBudget(value: unknown): value is number {
 }
 
 function validClassifierTimeout(value: unknown): value is number {
-  return Number.isInteger(value) && Number(value) >= 1000;
+  return Number.isInteger(value) &&
+    Number(value) >= 1000 &&
+    Number(value) <= MAX_CLASSIFIER_TIMEOUT_MS;
 }
 
 function applyAutoModeScalars(

package/extensions/auto-mode/constants.ts

@@ -61,6 +61,8 @@ export const DENIAL_HISTORY_LIMIT = 12;
 
 /** Per-request timeout for classifier completions (fast and detailed stages). */
 export const DEFAULT_CLASSIFIER_TIMEOUT_MS = 20_000;
+/** Largest timeout that Node can represent without reducing it to 1 ms. */
+export const MAX_CLASSIFIER_TIMEOUT_MS = 2_147_483_647;
 
 /** Built-in trusted environment. Users extend this with `$defaults`. */
 export const DEFAULT_ENVIRONMENT = [

package/extensions/auto-mode/hard-deny.ts

@@ -1,4 +1,5 @@
 import { statSync } from "node:fs";
+import { tmpdir } from "node:os";
 import { resolve } from "node:path";
 import {
   analyzeBash,
@@ -77,9 +78,115 @@ function matchesPathRoot(path: string, root: string): boolean {
   return isSameExistingPath(path.slice(0, root.length), root);
 }
 
+/**
+ * Top-level directories whose deletion or wholesale modification is a
+ * system-wide event. Shared between candidate validation and path
+ * classification; do not inline copies.
+ */
+const SYSTEM_ROOTS: ReadonlyArray<string> = [
+  "/bin",
+  "/boot",
+  "/dev",
+  "/etc",
+  "/home",
+  "/lib",
+  "/lib64",
+  "/Library",
+  "/private",
+  "/proc",
+  "/root",
+  "/run",
+  "/sbin",
+  "/sys",
+  "/System",
+  "/usr",
+  "/var",
+];
+
+/**
+ * Normalize a proposed temp-root value into a comparable absolute path.
+ * Returns undefined for values that cannot denote a subdirectory: the
+ * empty string, `/`, and slash-only artifacts.
+ */
+function normalizeRootCandidate(value: string): string | undefined {
+  const stripped = value.replace(/\/+$/, "");
+  // An empty stripped value must not fall through to `resolve()`, which
+  // would silently turn `/` into the process working directory.
+  if (!stripped) return undefined;
+  const normalized = resolve(stripped);
+  if (normalized === "/") return undefined;
+  return normalized;
+}
+
+/**
+ * True when a candidate temp root would weaken the deterministic deny tiers:
+ * it aliases (exact, case-folded, or dev/inode) `HOME`, `/`, or any system
+ * root, or it is a proper ancestor of the canonical home directory.
+ *
+ * Dev/inode identity covers symlinked spellings of existing directories;
+ * string comparison alone handles candidates that do not exist yet. See
+ * issue #31: without these guards, `TMPDIR=/` reduced every absolute path
+ * below an empty-string prefix match, and `TMPDIR=/private` made
+ * `/private/etc/**` disposable.
+ */
+function conflictsWithProtectedRoots(candidate: string, home: string): boolean {
+  if (candidate === "/") return true;
+  for (const protectedRoot of ["/", home, ...SYSTEM_ROOTS]) {
+    const canonical = resolve(protectedRoot);
+    if (
+      candidate === canonical ||
+      candidate.toLowerCase() === canonical.toLowerCase()
+    ) {
+      return true;
+    }
+    if (isSameExistingPath(candidate, canonical)) return true;
+  }
+  const homeCanonical = resolvePathForPolicy(home) ?? resolve(home);
+  return homeCanonical.toLowerCase().startsWith(`${candidate.toLowerCase()}/`);
+}
+
+let cachedTempRoots: ReadonlyArray<string> | undefined;
+let cachedTmpdirValue: string | undefined;
+
+/**
+ * Validated launcher-declared temp-dir roots whose subtrees are treated as
+ * disposable by `isRootHomeOrSystemPath`: the platform tmpdir, plus `/tmp` on
+ * macOS where it exists independently of `os.tmpdir()`. Each root appears in
+ * canonical and resolved spelling because callers pass symlink-resolved
+ * policy paths (`/tmp` → `/private/tmp` on macOS) and unresolved fallbacks
+ * alike. Values from `os.tmpdir()` are not trusted blindly; see
+ * `conflictsWithProtectedRoots`. The roots themselves are never exempt:
+ * deleting one is a system-wide delete.
+ *
+ * The memoization keys on the effective `os.tmpdir()` return value so tests
+ * can mutate `TMPDIR`, `TMP`, or `TEMP` between calls.
+ */
+export function tempRootCandidates(): ReadonlyArray<string> {
+  const currentTmpdir = tmpdir();
+  if (cachedTempRoots && cachedTmpdirValue === currentTmpdir) {
+    return cachedTempRoots;
+  }
+  cachedTmpdirValue = currentTmpdir;
+  cachedTempRoots = (() => {
+    const roots = new Set<string>();
+    const consider = (value: string) => {
+      const candidate = normalizeRootCandidate(value);
+      if (!candidate || conflictsWithProtectedRoots(candidate, HOME)) return;
+      roots.add(candidate);
+      const resolved = resolvePathForPolicy(candidate);
+      if (resolved) roots.add(resolved);
+    };
+    consider(currentTmpdir);
+    if (process.platform === "darwin") consider("/tmp");
+    return [...roots];
+  })();
+  return cachedTempRoots;
+}
+
 /**
  * True for `/`, the user's home root, or a top-level system root such as
- * `/etc`, `/usr`, or `/var`. Excludes the home *subtree*.
+ * `/etc`, `/usr`, or `/var`. Excludes the home *subtree* and the subtrees of
+ * platform temp directories (`os.tmpdir()` and `/tmp` on macOS).
  *
  * On some distros (e.g. Fedora Silverblue) HOME lives under `/var`, which is
  * in `systemRoots`. Without the subtree exemption, `path.startsWith("/var/")`
@@ -87,32 +194,36 @@ function matchesPathRoot(path: string, root: string): boolean {
  * `rm -rf ~/...`. HOME itself is still matched below, so `rm -rf ~` stays
  * blocked. `home` is a parameter so this can be unit-tested with a synthetic
  * `/var/home/...` value.
+ *
+ * The temp exemption mirrors the home one and covers cleanup of directories
+ * created with `mktemp`, `os.tmpdir()`, or plain `/tmp` paths. On macOS these
+ * resolve into `/private/tmp` or `/private/var/folders`, which used to match
+ * the `/private` system root and hard-deny every temp cleanup. Deleting a
+ * temp root itself still returns true; `tempRoots` is injectable for tests.
+ *
+ * Protection order matters (issue #31): exact `/`, the exact home root, and
+ * system roots win over every exemption. Injected `tempRoots` values are
+ * validated per call so hostile or malformed candidates cannot weaken the
+ * deterministic tiers.
  */
-export function isRootHomeOrSystemPath(path: string, home: string): boolean {
-  const systemRoots = [
-    "/bin",
-    "/boot",
-    "/dev",
-    "/etc",
-    "/home",
-    "/lib",
-    "/lib64",
-    "/Library",
-    "/private",
-    "/proc",
-    "/root",
-    "/run",
-    "/sbin",
-    "/sys",
-    "/System",
-    "/usr",
-    "/var",
-  ];
+export function isRootHomeOrSystemPath(
+  path: string,
+  home: string,
+  tempRoots: ReadonlyArray<string> = tempRootCandidates(),
+): boolean {
+  if (path === "/") return true;
+  if (path === home || isSameExistingPath(path, home)) return true;
   if (matchesPathRoot(path, home) && path.length > home.length) return false;
+  for (const root of tempRoots) {
+    const candidate = normalizeRootCandidate(root);
+    if (!candidate || conflictsWithProtectedRoots(candidate, home)) continue;
+    if (!matchesPathRoot(path, candidate)) continue;
+    // Subtree: disposable. Exact match: the temp root stays protected.
+    return path.length > candidate.length ? false : true;
+  }
   return (
-    path === "/" ||
     matchesPathRoot(path, home) ||
-    systemRoots.some((root) => matchesPathRoot(path, root))
+    SYSTEM_ROOTS.some((root) => matchesPathRoot(path, root))
   );
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@czottmann/pi-automode",
-  "version": "1.13.0",
+  "version": "1.14.0",
   "description": "Claude Code-style auto mode guardrail for pi.",
   "repository": {
     "url": "https://github.com/czottmann/pi-automode"