@czottmann/pi-automode 1.9.0 → 1.11.0

package/README.md

@@ -88,7 +88,11 @@ This is project-local and should not be committed. Shared project `.pi/automode.
 
 Set a global default classifier model in `~/.pi/agent/automode.json`; override it per project in `.pi/automode.local.json`.
 
-`classifierReasoningLevel` optionally requests `low`, `medium`, `high`, `xhigh`, or `max` reasoning for both classifier stages. If the key is absent, pi-automode sends no reasoning preference and leaves the choice to the server. Pi AI clamps unsupported values to the nearest level supported by the selected model; a non-reasoning model resolves to `off`. `low` matches Codex Auto Review's reasoning effort and is the practical default when an explicit value is needed. Higher levels can consume the existing 512/1200-token stage limits before producing visible output, which causes the classifier to fail closed.
+`classifierReasoningLevel` optionally requests `low`, `medium`, `high`, `xhigh`, or `max` reasoning for both classifier stages. If the key is absent, pi-automode sends no reasoning preference and leaves the choice to the server. Pi AI clamps unsupported values to the nearest level supported by the selected model; a non-reasoning model resolves to `off`. `low` matches Codex Auto Review's reasoning effort and the practical default when an explicit value is needed. Higher levels can consume the existing 512/1200-token stage limits before producing visible output, which causes the classifier to fail closed. Raise `fastClassifierMaxTokens` (default 512, integer ≥ 16) if you run a reasoning model whose fast-stage budget is truncated before it emits the required `0`/`1` digit.
+
+`allowInsideWorkingDirectory` (default `false`) adds a deterministic silent-allow tier for the file tools (`read`, `write`, `edit`, `grep`, `find`, `ls`): when `true`, a call whose resolved path is inside the working directory is allowed without any classifier call, and file access outside the working directory is routed to the classifier (including reads, which would otherwise take the read-only fast path). This matches the Codex/Claude Code "inside the sandbox = silent, outside = review" model. The tier takes precedence over `classifyReadOnlyTools`: with both enabled, in-tree file access is still allowed without a classifier call, and out-of-tree file access is classified. `classifyReadOnlyTools: true` only routes in-tree reads to the classifier when `allowInsideWorkingDirectory` is `false`. Writes and edits to protected in-tree paths (`.git/hooks`, `.pi` controls, shell profiles, config files) are exempt from the silent-allow tier and still go to the classifier.
+
+`deniedPaths` (default `[]`) is a list of path glob patterns that are hard-denied before the classifier and before the inside-working-directory tier — the file-tool equivalent of a secret/system deny list. Patterns support `~`, `$HOME`, and `${HOME}` expansion and `*` (which matches any characters, including `/`, so `**/id_rsa` matches a private key at any depth). Matching checks both the path as typed and its symlink-resolved form, so a `~/.ssh/*` rule still matches when `~/.ssh` is a symlink. A matching path blocks the call unconditionally (no classifier, no override). The deny list applies to file tools only; `bash` path access is governed by the classifier. Both keys follow the normal scalar/array precedence.
 
 The setting follows the normal scalar precedence: global, then project-local, then `PI_AUTOMODE_SETTINGS_JSON`. Shared project `.pi/automode.json` cannot set it. Omitting the key at a higher-precedence scope does not clear a lower-precedence value.
 
@@ -99,6 +103,10 @@ Example:
   "autoMode": {
     "classifierModel": "provider/model-id",
     "classifierReasoningLevel": "low",
+    "classifyReadOnlyTools": false,
+    "fastClassifierMaxTokens": 512,
+    "allowInsideWorkingDirectory": false,
+    "deniedPaths": [],
     "maxUserTranscriptTokens": 4000,
     "maxToolTranscriptTokens": 4000,
     "environment": [
@@ -125,6 +133,10 @@ Example:
 
 `maxUserTranscriptTokens` and `maxToolTranscriptTokens` are approximate per-category budgets; both default to 4000 and accept integers of at least 32. The former `maxTranscriptLines` setting is no longer supported because evidence selection is token-budgeted rather than line-based.
 
+### Ask-user tools and explicit authorization
+
+Classifier evidence includes normal user messages and assistant tool-call inputs, but excludes assistant prose and all tool results. This includes answers returned by ask-user tools such as `@vanillagreen/pi-questions`. Selecting "Yes" there helps the agent decide what to do next, but pi-automode does not treat that tool result as explicit authorization to override a soft deny. Send the authorization as a normal chat message instead; the agent can then retry the action. Tool results are excluded because they may contain untrusted or prompt-injected content.
+
 ### `$defaults`
 
 See [Defaults and rule-list behavior](docs/defaults.md) for built-in `environment`, `allow`, `protectedPaths`, `soft_deny`, and `hard_deny` entries, plus replacement behavior when `$defaults` is omitted.
@@ -165,7 +177,9 @@ The extension blocks these before any allow or classifier decision:
 - root, home, and system-path destructive deletes
 - edits to `.pi/automode*`, `.pi` auto-mode files, and this extension's safety-control files
 
-Read-only Pi tools (`read`, `grep`, `find`, `ls`) are allowed after those checks. Every side-effecting action goes to the classifier, including all `write` and `edit` calls, `bash`, MCP, subagent, network-capable tools, and unknown tools. This keeps classifier hard-deny rules unconditional; direct file writes cannot bypass them.
+Read-only Pi tools (`read`, `grep`, `find`, `ls`) are allowed after those checks. Every side-effecting action goes to the classifier, including all `write` and `edit` calls, `bash`, MCP, subagent, network-capable tools, and unknown tools. This keeps classifier hard-deny rules unconditional; direct file writes cannot bypass them. Set `classifyReadOnlyTools: true` (default `false`) to route read-only tools through the classifier as well, so reads outside the trusted working tree can be denied by policy. With it enabled, every `read`, `grep`, `find`, and `ls` call runs the two-stage classifier, which raises the number of model calls, the latency, and the cost per session.
+
+Path matches in `deniedPaths` are blocked before every classifier and fast-path decision, so secret and system paths never reach the model through the file tools. The deny list does not govern `bash`; shell access to those paths is handled by the classifier and the deterministic hard-deny checks. With `allowInsideWorkingDirectory: true`, file tools inside the working directory are allowed without a classifier call, and outside-working-directory file access (reads included) goes to the classifier.
 
 Classification starts with a one-token conservative filter and runs structured review only when that filter requests it. Both stages use a classifier-specific session key and short provider cache retention where the provider supports it. Missing models, provider failures, or malformed responses block the action.
 

package/docs/GLOSSARY.md

@@ -0,0 +1,35 @@
+# Glossary
+
+Canonical vocabulary for `@czottmann/pi-automode`. Project-specific terms only — standard technical words appear here only when this project uses them in a specific way. Longer explanations live in the docs linked from each entry.
+
+## Enforcement flow
+
+The ordered pipeline that runs on every agent tool call before execution. See [Auto-mode classifier flow](automode-classifier-flow.md).
+
+**Auto mode** — Claude Code-style guardrail posture: a pre-execution classifier allows routine, reversible actions and blocks risky ones, replacing routine permission prompts.
+
+**Deterministic hard-deny** — Local code checks that block high-risk actions before any classifier call and cannot be overridden. Distinct from the config-level [hard_deny](#classifier-policy-and-rules); independent of the model.
+
+**Read-only bypass** — The default fast path where the read-only tools (`read`, `grep`, `find`, `ls`) are allowed without classifier review once permission and deterministic checks pass. `classifyReadOnlyTools` routes them through the classifier instead.
+
+**Staged classifier** — The two-stage safety classifier: a conservative one-token filter gates an optional structured review. See [Fast stage](#enforcement-flow) and [Detailed stage](#enforcement-flow).
+
+**Fast stage** — The first classifier stage: a one-token filter that returns `0` (clearly allowed) or `1` (may need review).
+
+**Detailed stage** — The second classifier stage, run when the fast stage requests review, that returns a structured allow/block decision.
+
+## Classifier policy and rules
+
+The classifier's deny tiers and rule-list syntax. See [Defaults and rule-list behavior](defaults.md).
+
+**hard_deny** — Unconditional classifier rules that cannot be overridden. Distinct from the code-level [deterministic hard-deny](#enforcement-flow) checks.
+
+**soft_deny** — Overridable classifier block rules, unlike [hard_deny](#classifier-policy-and-rules).
+
+**explicit_intent** — A classifier tier meaning the allow was justified because the user's latest instruction directly and specifically authorized an otherwise [soft-denied](#classifier-policy-and-rules) action.
+
+**`$defaults`** — A section-local marker in a rule list that expands to the built-in entries for that list.
+
+## Status
+
+**AM status line** — The persistent TUI footer (prefixed `AM`) that reports auto-mode status: enabled/disabled and action/classifier counts.

package/docs/automode-classifier-flow.md

@@ -12,10 +12,11 @@ For each Pi `tool_call` event, the extension does this:
 4. Check `permissions.deny` rules.
 5. Check `permissions.ask` rules and ask the user when needed.
 6. Run deterministic hard-deny checks.
-7. Allow read-only built-in tools without a classifier call.
-8. Send every remaining action, including all writes and edits, through a one-token conservative filter.
-9. Run structured classifier review only when the filter requests it, then allow or block.
-10. Persist state and update the UI status/denial history.
+7. Run the path gate: `deniedPaths` matches block locally; with `allowInsideWorkingDirectory`, in-tree non-protected file access is allowed without a classifier call.
+8. Allow read-only built-in tools without a classifier call, unless `classifyReadOnlyTools` routes them through the classifier.
+9. Send every remaining action, including all writes and edits, through a one-token conservative filter.
+10. Run structured classifier review only when the filter requests it, then allow or block.
+11. Persist state and update the UI status/denial history.
 
 The default posture is fail-closed. If the classifier cannot be resolved, has no API key, errors, or returns an invalid stage response, the action is blocked.
 
@@ -43,7 +44,11 @@ flowchart TD
 
   J --> K{Deterministic hard-deny?}
   K -- yes --> K1[Block locally]
-  K -- no --> L{Read-only built-in tool?}
+  K -- no --> K2{Path gate: deniedPaths match or in-tree allow tier?}
+
+  K2 -- denied --> K1[Block locally]
+  K2 -- in-tree, non-protected --> L1[Allow locally]
+  K2 -- no match or tier off --> L{Read-only built-in tool?}
 
   L -- yes --> L1[Allow locally]
   L -- no --> N[Run one-token filter]
@@ -145,9 +150,11 @@ Current deterministic blocks include:
 
 The `bash` checks use a small shell lexer. It handles quotes, redirects, pipes, `&&`, `||`, and `;` well enough to catch common "safe prefix, risky suffix" patterns.
 
-### Read-only bypass
+Recursive-delete checks treat `/`, the user's home root, and top-level system roots as hard-denied, but exempt the home *subtree*: subpaths of the user's home are user data, not system paths. On distros where `HOME` lives under `/var` (e.g. Fedora Silverblue with `/var/home/<user>`), `rm -rf` on home subpaths is therefore not hard-denied as a system-path delete, while `rm -rf ~` stays blocked.
+
+### Read-only bypass and the path gate
 
-Read-only built-in tools are allowed without classifier review after the checks above pass.
+Read-only built-in tools are allowed without classifier review after the checks above pass, unless `classifyReadOnlyTools: true` routes them through the classifier instead.
 
 The read-only tool set is:
 
@@ -155,11 +162,13 @@ The read-only tool set is:
 read, grep, find, ls
 ```
 
-Reads to protected paths are still allowed. Every write and edit is classifier-reviewed, whether or not its target is protected.
+Reads to protected paths are still allowed.
+
+Two opt-in settings change the deterministic tier. `deniedPaths` blocks matching file-tool paths locally, before the classifier and any fast path. `allowInsideWorkingDirectory: true` allows file access inside the working directory without a classifier call — writes and edits included — while out-of-tree file access is routed to the classifier (reads included). Writes and edits to protected in-tree paths are exempt from the silent-allow tier and still reach the classifier. In the default configuration (both settings off), every write and edit is classifier-reviewed, whether or not its target is protected.
 
 ## Protected paths
 
-The protected-path configuration identifies safety-sensitive targets such as `.git`, `.pi`, editor config directories, shell profiles, package-manager config files, hook configs, and similar files. All writes and edits now go to the classifier, so there is no direct-write allow path that can bypass classifier policy for these or any other target.
+The protected-path configuration identifies safety-sensitive targets such as `.git`, `.pi`, editor config directories, shell profiles, package-manager config files, hook configs, and similar files. In the default configuration every write and edit goes to the classifier, so there is no direct-write allow path that can bypass classifier policy. With `allowInsideWorkingDirectory: true`, non-protected in-tree writes take the deterministic allow tier, but protected targets still route to the classifier. `deniedPaths` can hard-deny any of these targets before the classifier.
 
 Deterministic safety-control checks still resolve paths canonically before classification. This catches writes through symlinks to auto-mode controls, shell profiles, and SSH authorization files without relying on the model.
 

package/docs/defaults.md

@@ -46,13 +46,17 @@ These are exceptions to `soft_deny`, not to `hard_deny`.
 
 ### `protectedPaths`
 
-`$defaults` expands to safety-sensitive paths. Every `write` and `edit` call now goes to the classifier, so `protectedPaths` no longer changes whether a model call occurs; it remains part of the resolved configuration for compatibility and inspection. No path can be reached through a direct-write allow path, and `allow` rules cannot override a classifier hard-deny decision.
+`$defaults` expands to safety-sensitive paths. In the default configuration every `write` and `edit` call goes to the classifier, so `protectedPaths` does not change whether a model call occurs; it remains part of the resolved configuration for compatibility and inspection. With `allowInsideWorkingDirectory: true`, non-protected in-tree file access takes the deterministic allow tier, but writes and edits to these protected paths still reach the classifier; `allow` rules cannot override a classifier hard-deny decision.
 
 Protected directories: `.git`, `.config/git`, `.vscode`, `.idea`, `.husky`, `.cargo`, `.devcontainer`, `.yarn`, `.mvn`, `.pi`.
 
 Protected files: `.gitconfig`, `.gitmodules`, `.gitignore`, `.gitattributes`, shell profiles (`.bashrc`, `.zshrc`, `.profile`, etc.), `.envrc`, package manager configs (`.npmrc`, `.yarnrc`, `.yarnrc.yml`, `.pnp.cjs`, `bunfig.toml`, etc.), Bazel configs (`.bazelrc`, `.bazelversion`, `.bazeliskrc`), hook configs (`.pre-commit-config.yaml`, `lefthook.yml`), Gradle/Maven wrappers, `.devcontainer.json`, `.ripgreprc`, `pyrightconfig.json`, `.mcp.json`.
 
-Read-only tools (`read`, `grep`, `find`, `ls`) remain locally allowed after permission and deterministic checks. Writes and edits always require classification, regardless of their target.
+Read-only tools (`read`, `grep`, `find`, `ls`) remain locally allowed after permission and deterministic checks. In the default configuration writes and edits always require classification, regardless of their target; with `allowInsideWorkingDirectory` enabled, only protected targets still require it.
+
+### `deniedPaths`
+
+`deniedPaths` is a separate opt-in list (default `[]`, no built-in entries, so `$defaults` is a no-op; it is accepted for consistency with the other rule lists) of path glob patterns that are hard-denied for the file tools (`read`, `write`, `edit`, `grep`, `find`, `ls`) before any classifier or fast-path decision. Use it for secrets and system paths that must never reach the model through the file tools; `bash` access to such paths remains classifier-governed. Patterns support `~`/`$HOME`/`${HOME}` expansion and `*` (matches any characters, including `/`). Matching checks both the typed path and its symlink-resolved form. `deniedPaths` only restricts; it never grants access.
 
 ### `soft_deny`
 

package/examples/automode.local.json

@@ -1,6 +1,12 @@
 {
   "autoMode": {
     "classifierReasoningLevel": "low",
+    "allowInsideWorkingDirectory": false,
+    "deniedPaths": [
+      "*.env",
+      "~/.ssh/*",
+      "/etc/*"
+    ],
     "environment": [
       "$defaults",
       "Source control: github.example.com/acme-corp and all repos under it",

package/extensions/auto-mode/classifier.ts

@@ -7,6 +7,7 @@ import {
 import type {
   AssistantMessage,
   Model,
+  ProviderHeaders,
   UserMessage,
 } from "@earendil-works/pi-ai";
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
@@ -14,6 +15,7 @@ import {
   CLASSIFIER_DETAILED_INSTRUCTION,
   CLASSIFIER_FAST_INSTRUCTION,
   CLASSIFIER_SYSTEM_PROMPT,
+  DEFAULT_FAST_CLASSIFIER_MAX_TOKENS,
 } from "./constants.ts";
 import { formatModelSpec, parseModelSpec } from "./model.ts";
 import { buildClassifierTranscript } from "./transcript.ts";
@@ -53,7 +55,7 @@ type ClassifierResolution = {
   classifier?: {
     model: Model<any>;
     apiKey?: string;
-    headers?: Record<string, string>;
+    headers?: ProviderHeaders;
   };
   completionPlan?: ClassifierCompletionPlan;
 };
@@ -107,7 +109,7 @@ export type ClassifierCompletionFn = (
   options: { systemPrompt: string; messages: UserMessage[] },
   callOptions: {
     apiKey?: string;
-    headers?: Record<string, string>;
+    headers?: ProviderHeaders;
     signal?: AbortSignal;
     maxTokens: number;
     temperature?: number;
@@ -129,10 +131,10 @@ export type RetryOptions = {
   onAttempt?: (attempt: ClassifierIoAttempt) => void;
 };
 
-const FAST_CLASSIFIER_MAX_TOKENS = 512;
-
 export type StagedClassifierOptions = {
   sessionId: string;
+  /** Override the fast-stage token budget; falls back to the default (512). */
+  fastClassifierMaxTokens?: number;
   reasoningLevel?: Exclude<EffectiveClassifierReasoningLevel, "off">;
   onAttempt?: (attempt: ClassifierIoAttempt) => void;
 };
@@ -303,7 +305,7 @@ export async function classifyWithRetry(
   classifier: {
     model: Model<any>;
     apiKey?: string;
-    headers?: Record<string, string>;
+    headers?: ProviderHeaders;
   },
   prompt: { systemPrompt: string; messages: UserMessage[] },
   signal: AbortSignal | undefined,
@@ -374,7 +376,7 @@ export async function classifyInStages(
   classifier: {
     model: Model<any>;
     apiKey?: string;
-    headers?: Record<string, string>;
+    headers?: ProviderHeaders;
   },
   prompt: { systemPrompt: string; contextMessage: UserMessage },
   signal: AbortSignal | undefined,
@@ -398,7 +400,8 @@ export async function classifyInStages(
         signal,
         // Reasoning and OpenAI-compatible models may consume hidden reasoning,
         // control, and EOS tokens before emitting the required visible digit.
-        maxTokens: FAST_CLASSIFIER_MAX_TOKENS,
+        maxTokens: options.fastClassifierMaxTokens ??
+          DEFAULT_FAST_CLASSIFIER_MAX_TOKENS,
         ...(options.reasoningLevel === undefined
           ? {}
           : { reasoning: options.reasoningLevel }),
@@ -521,6 +524,7 @@ export const defaultClassifyAction: ClassifyAction = async (
     ctx.signal,
     {
       sessionId: classifierCacheSessionId(ctx),
+      fastClassifierMaxTokens: config.fastClassifierMaxTokens,
       reasoningLevel: completionPlan.reasoningLevel,
       onAttempt: (attempt) => attempts.push(attempt),
     },

package/extensions/auto-mode/config.ts

@@ -2,7 +2,11 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import {
   DEFAULT_ALLOW,
+  DEFAULT_ALLOW_INSIDE_WORKING_DIRECTORY,
+  DEFAULT_CLASSIFY_READ_ONLY_TOOLS,
+  DEFAULT_DENIED_PATHS,
   DEFAULT_ENVIRONMENT,
+  DEFAULT_FAST_CLASSIFIER_MAX_TOKENS,
   DEFAULT_HARD_DENY,
   DEFAULT_LOG_CONFIG,
   DEFAULT_MAX_TOOL_TRANSCRIPT_TOKENS,
@@ -99,6 +103,10 @@ export function validateSettingsFile(
         "enabled",
         "classifierModel",
         "classifierReasoningLevel",
+        "classifyReadOnlyTools",
+        "fastClassifierMaxTokens",
+        "allowInsideWorkingDirectory",
+        "deniedPaths",
         "maxUserTranscriptTokens",
         "maxToolTranscriptTokens",
         "environment",
@@ -136,6 +144,36 @@ export function validateSettingsFile(
           `${source}: autoMode.classifierReasoningLevel must be one of low, medium, high, xhigh, max`,
         );
       }
+      if (
+        hasOwn(autoMode, "classifyReadOnlyTools") &&
+        typeof autoMode.classifyReadOnlyTools !== "boolean"
+      ) {
+        diagnostics.push(
+          `${source}: autoMode.classifyReadOnlyTools must be a boolean`,
+        );
+      }
+      if (
+        hasOwn(autoMode, "fastClassifierMaxTokens") &&
+        (!Number.isInteger(autoMode.fastClassifierMaxTokens) ||
+          (autoMode.fastClassifierMaxTokens as number) < 16)
+      ) {
+        diagnostics.push(
+          `${source}: autoMode.fastClassifierMaxTokens must be an integer of at least 16`,
+        );
+      }
+      if (
+        hasOwn(autoMode, "allowInsideWorkingDirectory") &&
+        typeof autoMode.allowInsideWorkingDirectory !== "boolean"
+      ) {
+        diagnostics.push(
+          `${source}: autoMode.allowInsideWorkingDirectory must be a boolean`,
+        );
+      }
+      validateDeniedPathsSetting(
+        autoMode.deniedPaths,
+        source,
+        diagnostics,
+      );
       for (
         const key of [
           "maxUserTranscriptTokens",
@@ -283,6 +321,48 @@ function mergeLog(
   };
 }
 
+/**
+ * Validate `deniedPaths`: an array of non-empty path patterns. Unlike the
+ * `$defaults` rule lists there is no built-in default list, so `$defaults` is
+ * a no-op (accepted for consistency with the other rule lists) and omitting
+ * it is not a diagnostic.
+ */
+function validateDeniedPathsSetting(
+  value: unknown,
+  source: string,
+  diagnostics: string[],
+): void {
+  if (value === undefined) return;
+  if (!Array.isArray(value)) {
+    diagnostics.push(`${source}: deniedPaths must be an array of strings`);
+    return;
+  }
+  for (const [index, entry] of value.entries()) {
+    if (entry === "$defaults") continue;
+    if (typeof entry !== "string" || entry.trim() === "") {
+      diagnostics.push(
+        `${source}: deniedPaths[${index}] must be a non-empty path pattern`,
+      );
+      continue;
+    }
+    if (!DENIED_PATH_PATTERN_PREFIX.test(entry)) {
+      diagnostics.push(
+        `${source}: deniedPaths[${index}] "${entry}" can never match a resolved absolute path; start it with *, ~, $HOME, \${HOME}, or / (e.g. "**/${entry}")`,
+      );
+    }
+  }
+}
+
+/**
+ * A pattern can only match a resolved absolute path when it starts with a
+ * form that anchors it: a leading `/`, a home expansion (`~`, `$HOME`,
+ * `${HOME}`), or a `*` wildcard that absorbs the leading slash. Anything else
+ * (e.g. `config.json` or `src/secret.txt`) matches only against the bare
+ * relative name, which the matcher never sees.
+ */
+const DENIED_PATH_PATTERN_PREFIX =
+  /^(?:\/|~(?:\/|$)|\$HOME(?:\/|$)|\$\{HOME\}(?:\/|$)|\*)/;
+
 const CLASSIFIER_REASONING_LEVELS = new Set<ClassifierReasoningLevel>([
   "low",
   "medium",
@@ -302,6 +382,10 @@ function validTranscriptBudget(value: unknown): value is number {
   return Number.isInteger(value) && Number(value) >= 32;
 }
 
+function validFastClassifierBudget(value: unknown): value is number {
+  return Number.isInteger(value) && Number(value) >= 16;
+}
+
 function applyAutoModeScalars(
   base: EffectiveConfig,
   settings: AutoModeSettings | undefined,
@@ -316,6 +400,15 @@ function applyAutoModeScalars(
       )
       ? settings.classifierReasoningLevel
       : base.classifierReasoningLevel,
+    classifyReadOnlyTools: settings.classifyReadOnlyTools ??
+      base.classifyReadOnlyTools,
+    allowInsideWorkingDirectory:
+      settings.allowInsideWorkingDirectory ?? base.allowInsideWorkingDirectory,
+    fastClassifierMaxTokens: validFastClassifierBudget(
+        settings.fastClassifierMaxTokens,
+      )
+      ? settings.fastClassifierMaxTokens
+      : base.fastClassifierMaxTokens,
     maxUserTranscriptTokens: validTranscriptBudget(
         settings.maxUserTranscriptTokens,
       )
@@ -357,6 +450,10 @@ export function buildEffectiveConfigFromSources(
 ): EffectiveConfig {
   let config: EffectiveConfig = {
     enabled: true,
+    classifyReadOnlyTools: DEFAULT_CLASSIFY_READ_ONLY_TOOLS,
+    allowInsideWorkingDirectory: DEFAULT_ALLOW_INSIDE_WORKING_DIRECTORY,
+    deniedPaths: [...DEFAULT_DENIED_PATHS],
+    fastClassifierMaxTokens: DEFAULT_FAST_CLASSIFIER_MAX_TOKENS,
     maxUserTranscriptTokens: DEFAULT_MAX_USER_TRANSCRIPT_TOKENS,
     maxToolTranscriptTokens: DEFAULT_MAX_TOOL_TRANSCRIPT_TOKENS,
     environment: [...DEFAULT_ENVIRONMENT],
@@ -382,6 +479,7 @@ export function buildEffectiveConfigFromSources(
   const environment = createRuleAccumulator(DEFAULT_ENVIRONMENT);
   const allow = createRuleAccumulator(DEFAULT_ALLOW);
   const protectedPaths = createRuleAccumulator(DEFAULT_PROTECTED_PATHS);
+  const deniedPaths = createRuleAccumulator(DEFAULT_DENIED_PATHS);
   const softDeny = createRuleAccumulator(DEFAULT_SOFT_DENY);
   const hardDeny = createRuleAccumulator(DEFAULT_HARD_DENY);
 
@@ -390,6 +488,7 @@ export function buildEffectiveConfigFromSources(
     applyRuleSetting(environment, settings.autoMode?.environment);
     applyRuleSetting(allow, settings.autoMode?.allow);
     applyRuleSetting(protectedPaths, settings.autoMode?.protectedPaths);
+    applyRuleSetting(deniedPaths, settings.autoMode?.deniedPaths);
     applyRuleSetting(
       softDeny,
       settings.autoMode?.soft_deny ?? settings.autoMode?.softDeny,
@@ -405,6 +504,7 @@ export function buildEffectiveConfigFromSources(
     environment: finalizeRuleSetting(environment),
     allow: finalizeRuleSetting(allow),
     protectedPaths: finalizeRuleSetting(protectedPaths),
+    deniedPaths: finalizeRuleSetting(deniedPaths),
     softDeny: finalizeRuleSetting(softDeny),
     hardDeny: finalizeRuleSetting(hardDeny),
   };

package/extensions/auto-mode/constants.ts

@@ -179,6 +179,38 @@ export const PROFILE_FILES = new Set([
 
 export const READ_ONLY_TOOLS = new Set(["read", "grep", "find", "ls"]);
 
+/** File tools that expose a target path via `input.path` (for path gating). */
+export const PATH_BEARING_TOOLS = new Set([
+  "read",
+  "write",
+  "edit",
+  "grep",
+  "find",
+  "ls",
+]);
+
+/**
+ * Default behavior: read-only tools bypass the classifier entirely (the
+ * original auto-mode fast path). When set to true via config, read-only tools
+ * are routed through the classifier like any other action, so e.g. reads
+ * outside the trusted working tree can be denied by policy.
+ */
+export const DEFAULT_CLASSIFY_READ_ONLY_TOOLS = false;
+
+/** Default upper bound on fast-stage completion tokens (see PR note). */
+export const DEFAULT_FAST_CLASSIFIER_MAX_TOKENS = 512;
+
+/**
+ * Default behavior: no deterministic inside-working-directory tier; every
+ * non-read-only action is classified. When enabled, file tools whose resolved
+ * path is inside the working directory are allowed deterministically, and
+ * outside-CWD file access is routed to the classifier.
+ */
+export const DEFAULT_ALLOW_INSIDE_WORKING_DIRECTORY = false;
+
+/** Default path deny list: empty (no built-in secrets list). */
+export const DEFAULT_DENIED_PATHS: string[] = [];
+
 /** Default observability log config: off, classifier I/O off. */
 export const DEFAULT_LOG_CONFIG = {
   enabled: false,

package/extensions/auto-mode/extension.ts

@@ -14,6 +14,7 @@ import {
   DEFAULT_HARD_DENY,
   DEFAULT_PROTECTED_PATHS,
   DEFAULT_SOFT_DENY,
+  PATH_BEARING_TOOLS,
   READ_ONLY_TOOLS,
 } from "./constants.ts";
 import {
@@ -30,7 +31,15 @@ import {
 } from "./log.ts";
 import { formatModelSpec, parseModelSpec } from "./model.ts";
 import { promptForClassifierModel } from "./model-selector.ts";
-import { matchesToolPattern } from "./permissions.ts";
+import { matchesDeniedPath, matchesToolPattern } from "./permissions.ts";
+import {
+  expandHomePattern,
+  extractInputPath,
+  isInside,
+  isProtectedPath,
+  resolveInputPath,
+  resolvePathForPolicy,
+} from "./paths.ts";
 import {
   actionSummary,
   formatDenials,
@@ -242,7 +251,7 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
       // Enforcement order:
       // 1. permission deny/ask rules,
       // 2. deterministic hard-deny checks that never consult the model,
-      // 3. read-only built-in fast path,
+      // 3. read-only built-in fast path (skipped when classifyReadOnlyTools is set),
       // 4. classifier for every remaining action, fail-closed on setup/parse errors.
       const cfg = effectiveConfig();
       if (!cfg.enabled) return undefined;
@@ -321,7 +330,73 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
         }, logCtx);
       }
 
-      if (READ_ONLY_TOOLS.has(event.toolName)) {
+      // Deterministic path gate for file tools.
+      //
+      // `deniedPaths` always applies: a matching path is hard-denied before any
+      // classifier or fast path, so secrets and system dirs never reach the
+      // model. `allowInsideWorkingDirectory` adds a deterministic silent-allow
+      // tier for file tools whose resolved path is inside the working
+      // directory, and routes outside-CWD file access to the classifier
+      // (bypassing the read-only fast path so reads outside the tree are
+      // reviewed too).
+      //
+      // The gate is skipped entirely when both features are off, so the
+      // default configuration costs no extra filesystem calls.
+      let readOnlyFastPath =
+        !cfg.classifyReadOnlyTools && READ_ONLY_TOOLS.has(event.toolName);
+      if (
+        (cfg.deniedPaths.length > 0 || cfg.allowInsideWorkingDirectory) &&
+        PATH_BEARING_TOOLS.has(event.toolName)
+      ) {
+        const inputPath = extractInputPath(event.toolName, input);
+        if (inputPath !== undefined) {
+          const expanded = expandHomePattern(inputPath);
+          const resolved = resolveInputPath(ctx.cwd, expanded) ?? expanded;
+          const policyPath = resolvePathForPolicy(resolved) ?? resolved;
+          const denied =
+            cfg.deniedPaths.length > 0 &&
+            (matchesDeniedPath(resolved, cfg.deniedPaths) ||
+              matchesDeniedPath(policyPath, cfg.deniedPaths));
+          if (denied) {
+            return block(ctx, {
+              timestamp: Date.now(),
+              toolName: event.toolName,
+              reason: `Path denied by policy: ${policyPath}`,
+              action: summary,
+              kind: "deterministic-path-deny",
+            }, logCtx);
+          }
+          if (cfg.allowInsideWorkingDirectory) {
+            const policyCwd = resolvePathForPolicy(ctx.cwd) ?? ctx.cwd;
+            if (isInside(policyPath, policyCwd)) {
+              // Protected in-tree writes must still reach the classifier;
+              // otherwise the allow tier bypasses the protected-path policy
+              // for sensitive repository content such as .git/hooks/*, .pi/*,
+              // .husky/*, or .gitignore.
+              if (
+                (event.toolName === "write" || event.toolName === "edit") &&
+                isProtectedPath(policyPath, policyCwd, cfg.protectedPaths)
+              ) {
+                readOnlyFastPath = false;
+              } else {
+                return allow(
+                  ctx,
+                  "inside-working-directory",
+                  `Path inside working directory: ${policyPath}`,
+                  event.toolName,
+                  summary,
+                  logCtx,
+                );
+              }
+            }
+            // Outside the working directory: the read-only fast path must not
+            // apply; the classifier reviews this call.
+            readOnlyFastPath = false;
+          }
+        }
+      }
+
+      if (readOnlyFastPath) {
         return allow(
           ctx,
           "read-only",

package/extensions/auto-mode/hard-deny.ts

@@ -156,7 +156,18 @@ function isRecursiveRmArg(arg: string): boolean {
   );
 }
 
-function isRootHomeOrSystemPath(path: string): boolean {
+/**
+ * True for `/`, the user's home root, or a top-level system root such as
+ * `/etc`, `/usr`, or `/var`. Excludes the home *subtree*.
+ *
+ * On some distros (e.g. Fedora Silverblue) HOME lives under `/var`, which is
+ * in `systemRoots`. Without the subtree exemption, `path.startsWith("/var/")`
+ * would treat every path under HOME as a system root and hard-deny routine
+ * `rm -rf ~/...`. HOME itself is still matched below, so `rm -rf ~` stays
+ * blocked. `home` is a parameter so this can be unit-tested with a synthetic
+ * `/var/home/...` value.
+ */
+export function isRootHomeOrSystemPath(path: string, home: string): boolean {
   const systemRoots = [
     "/bin",
     "/boot",
@@ -170,9 +181,10 @@ function isRootHomeOrSystemPath(path: string): boolean {
     "/usr",
     "/var",
   ];
+  if (path.startsWith(`${home}/`)) return false;
   return (
     path === "/" ||
-    path === HOME ||
+    path === home ||
     systemRoots.some((root) => path === root || path.startsWith(`${root}/`))
   );
 }
@@ -261,7 +273,7 @@ function segmentHardDeny(
   if (name === "rm" && args.some(isRecursiveRmArg)) {
     for (const arg of args.filter((arg) => !arg.startsWith("-"))) {
       const path = shellPathTokenToPath(arg, cwd);
-      if (path && isRootHomeOrSystemPath(path)) {
+      if (path && isRootHomeOrSystemPath(path, HOME)) {
         return "irreversible deletion of home/root/system paths is hard-denied";
       }
     }
@@ -269,7 +281,7 @@ function segmentHardDeny(
 
   if (name === "find" && lowerArgs.includes("-delete")) {
     const root = shellPathTokenToPath(args[0] ?? "", cwd);
-    if (root && isRootHomeOrSystemPath(root) && root !== HOME) {
+    if (root && isRootHomeOrSystemPath(root, HOME) && root !== HOME) {
       return "system-wide delete is hard-denied";
     }
   }

package/extensions/auto-mode/paths.ts

@@ -7,7 +7,7 @@ import {
   relative,
   resolve,
 } from "node:path";
-import { HOME, PROFILE_FILES } from "./constants.ts";
+import { HOME, PATH_BEARING_TOOLS, PROFILE_FILES } from "./constants.ts";
 
 function stripLeadingAt(value: string): string {
   return value.startsWith("@") ? value.slice(1) : value;
@@ -22,6 +22,28 @@ export function resolveInputPath(
   return isAbsolute(raw) ? resolve(raw) : resolve(cwd, raw);
 }
 
+/** The target path a file tool operates on, from `input.path` (or undefined). */
+export function extractInputPath(
+  toolName: string,
+  input: Record<string, unknown>,
+): string | undefined {
+  if (!PATH_BEARING_TOOLS.has(toolName)) return undefined;
+  const value = input.path;
+  return typeof value === "string" && value.trim() !== "" ? value : undefined;
+}
+
+/** Expand a leading `~`, `$HOME`, or `${HOME}` in a path-denial pattern. */
+export function expandHomePattern(pattern: string): string {
+  const home = HOME.replace(/\\/g, "/");
+  if (pattern === "~" || pattern === "$HOME" || pattern === "${HOME}") {
+    return home;
+  }
+  if (pattern.startsWith("~/")) return `${home}/${pattern.slice(2)}`;
+  if (pattern.startsWith("$HOME/")) return `${home}/${pattern.slice(6)}`;
+  if (pattern.startsWith("${HOME}/")) return `${home}/${pattern.slice(8)}`;
+  return pattern;
+}
+
 export function normalizePathForMatch(path: string, cwd: string): string {
   const normalized = normalize(path);
   const rel = relative(cwd, normalized);

package/extensions/auto-mode/permissions.ts

@@ -1,5 +1,9 @@
 import type { ToolPattern } from "./types.ts";
-import { normalizePathForMatch, resolveInputPath } from "./paths.ts";
+import {
+  expandHomePattern,
+  normalizePathForMatch,
+  resolveInputPath,
+} from "./paths.ts";
 
 function normalizeToolName(name: string): string {
   const lower = name.trim().replace(/^@/, "").toLowerCase();
@@ -75,6 +79,23 @@ function getPrimaryArgument(
   return JSON.stringify(input);
 }
 
+/**
+ * Whether a resolved absolute path matches a configured path-denial pattern.
+ * Patterns support `~`/`$HOME` expansion and `*` globs, where `*` matches any
+ * characters, including `/`. Matching is case-insensitive and
+ * conservative-safe: over-matching only blocks more.
+ */
+export function matchesDeniedPath(
+  resolvedPath: string,
+  deniedPaths: string[],
+): boolean {
+  const normalized = resolvedPath.replace(/\\/g, "/");
+  return deniedPaths.some((pattern) => {
+    const expanded = expandHomePattern(pattern).replace(/\\/g, "/");
+    return wildcardToRegExp(expanded).test(normalized);
+  });
+}
+
 /** Match a scoped permission rule against a concrete tool call. */
 export function matchesToolPattern(
   pattern: ToolPattern,

package/extensions/auto-mode/types.ts

@@ -40,6 +40,14 @@ export type AutoModeSettings = {
   enabled?: boolean;
   classifierModel?: string;
   classifierReasoningLevel?: ClassifierReasoningLevel;
+  /** When true, read-only tools (read/grep/find/ls) are classified instead of auto-allowed. */
+  classifyReadOnlyTools?: boolean;
+  /** Override the fast-stage completion token budget (default 512). */
+  fastClassifierMaxTokens?: number;
+  /** When true, file tools whose resolved path is inside the working directory are allowed deterministically (no classifier), and outside-CWD file access is classified. */
+  allowInsideWorkingDirectory?: boolean;
+  /** Path glob patterns (file tools) that are always denied before the classifier. Supports `~` and `*` (matches any characters, including `/`). */
+  deniedPaths?: unknown;
   maxUserTranscriptTokens?: number;
   maxToolTranscriptTokens?: number;
   environment?: unknown;
@@ -76,6 +84,10 @@ export type EffectiveConfig = {
   enabled: boolean;
   classifierModel?: string;
   classifierReasoningLevel?: ClassifierReasoningLevel;
+  classifyReadOnlyTools: boolean;
+  fastClassifierMaxTokens: number;
+  allowInsideWorkingDirectory: boolean;
+  deniedPaths: string[];
   maxUserTranscriptTokens: number;
   maxToolTranscriptTokens: number;
   environment: string[];
@@ -108,12 +120,16 @@ export type DenialRecord = {
     | "permissions.deny"
     | "permissions.ask"
     | "deterministic-hard-deny"
+    | "deterministic-path-deny"
     | "classifier"
     | "setup";
 };
 
-/** Denial kind plus the read-only fast path, used for decision log entries. */
-export type DecisionKind = DenialRecord["kind"] | "read-only";
+/** Denial kind plus the deterministic allow fast paths, used for decision log entries. */
+export type DecisionKind =
+  | DenialRecord["kind"]
+  | "read-only"
+  | "inside-working-directory";
 
 export type ClassificationDecision = {
   decision: "allow" | "block";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@czottmann/pi-automode",
-  "version": "1.9.0",
+  "version": "1.11.0",
   "description": "Claude Code-style auto mode guardrail for pi.",
   "repository": {
     "url": "https://github.com/czottmann/pi-automode"
@@ -41,9 +41,9 @@
     "@earendil-works/pi-tui": "*"
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "^0.81.1",
-    "@earendil-works/pi-coding-agent": "^0.81.1",
-    "@earendil-works/pi-tui": "^0.81.1",
+    "@earendil-works/pi-ai": "^0.84.1",
+    "@earendil-works/pi-coding-agent": "^0.84.1",
+    "@earendil-works/pi-tui": "^0.84.1",
     "@types/node": "^24.0.0",
     "tsx": "^4.22.4",
     "typescript": "^5.8.0"