@davisliu2006/pi-permission-system 0.1.0 → 0.2.0

package/README.md

@@ -49,7 +49,7 @@ More specific rules override less specific rules:
 
 ### Global Configuration
 
-Located in `.pi/agent/pi-permissions.jsonc`.
+Located in `~/.pi/agent/pi-permissions.jsonc`.
 
 Example:
 
@@ -97,9 +97,9 @@ Example:
 
 ### Local Configuration
 
-Located in a file in the local project directory root:
+Located in the local Pi config folder:
 
-`pi-permissions.jsonc`
+`<project-root>/.pi/pi-permissions.jsonc`
 
 Local configuration overrides global configuration, including `deny` rules.
 
@@ -120,8 +120,10 @@ Body matching rules:
 
 ## Bash Matching Safeguards
 
-Bash matching safeguards against chaining.
+Bash matching safeguards against unsafe shell syntax.
 
-If a bash command contains shell chaining or control syntax (`;`, `&&`, `||`, `|`, `&`, newlines, command substitution, or process substitution), `bash` pattern rules are skipped and the `tools.bash` policy is used instead, falling back to `default`.
+Simple sequences separated only by `;`, `&&`, `||`, or newlines are split and each segment is matched against `bash` rules. The strictest result wins (`deny` > `ask` > `allow`).
 
-"Allow always" for a chained command saves the exact command, not a wildcard.
+If a command contains other chaining or control syntax (`|`, `&`, command substitution, process substitution, or parentheses), `bash` pattern rules are skipped and the `tools.bash` policy is used instead, falling back to `default`.
+
+"Allow always" for complex or multi-command sequences saves the exact command, not a wildcard.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davisliu2006/pi-permission-system",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Permission enforcement extension for the Pi coding agent.",
   "type": "module",
   "main": "./index.ts",
@@ -39,11 +39,13 @@
   },
   "peerDependencies": {
     "@earendil-works/pi-ai": ">=0.78.0",
-    "@earendil-works/pi-coding-agent": ">=0.78.0"
+    "@earendil-works/pi-coding-agent": ">=0.78.0",
+    "@earendil-works/pi-tui": ">=0.78.0"
   },
   "devDependencies": {
     "@earendil-works/pi-ai": "^0.78.1",
     "@earendil-works/pi-coding-agent": "^0.78.1",
+    "@earendil-works/pi-tui": "^0.78.1",
     "@types/node": "^22.10.0",
     "typescript": "^5.7.3"
   }

package/src/ai-wildcard.ts

@@ -1,10 +1,19 @@
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { completeText } from "./ai-gen.ts";
-import { buildWildcardInstructions, WILDCARD_SYSTEM_PROMPT } from "./prompts.ts";
-import { validateWildcardSuggestion } from "./wildcard-validation.ts";
+import {
+  buildWildcardInstructions,
+  buildWildcardListInstructions,
+  WILDCARD_LIST_SYSTEM_PROMPT,
+  WILDCARD_SYSTEM_PROMPT,
+} from "./prompts.ts";
+import {
+  validateWildcardSuggestion,
+  validateWildcardSuggestionList,
+} from "./wildcard-validation.ts";
 
 const WILDCARD_TIMEOUT_MS = 8000;
 const MAX_WILDCARD_TOKENS = 120;
+const MAX_WILDCARD_LIST_TOKENS = 240;
 
 /**
  * Sanitizes against:
@@ -26,7 +35,7 @@ function sanitizeWildcard(value: string): string | undefined {
 }
 
 /**
- * Generates the bash wildcard recommendation.
+ * Generates one bash wildcard recommendation.
  */
 export async function generateBashWildcard(
   ctx: ExtensionContext,
@@ -49,3 +58,31 @@ export async function generateBashWildcard(
 
   return pattern;
 }
+
+/**
+ * Generates a list of bash wildcards.
+ * Expects semicolon-separated patterns back.
+ */
+export async function generateBashWildcards(
+  ctx: ExtensionContext,
+  commands: readonly string[]
+): Promise<string[] | undefined> {
+  if (commands.length === 0) {return undefined;}
+
+  const text = await completeText(ctx, {
+    systemPrompt: WILDCARD_LIST_SYSTEM_PROMPT,
+    userText: buildWildcardListInstructions(commands),
+    maxTokens: MAX_WILDCARD_LIST_TOKENS,
+    timeoutMs: WILDCARD_TIMEOUT_MS,
+    joinWith: "\n",
+  });
+  if (!text) {return undefined;}
+
+  const sanitized = sanitizeWildcard(text);
+  if (!sanitized) {return undefined;}
+
+  const validation = validateWildcardSuggestionList(sanitized, commands);
+  if (!validation.valid) {return undefined;}
+
+  return validation.patterns;
+}

package/src/config.ts

@@ -1,8 +1,7 @@
 import { readFile } from "node:fs/promises";
-import { ASK, PERMISSION_STATES_DESCRIPTION } from "./constants.ts";
+import { ASK } from "./constants.ts";
 import { parseJsonc } from "./jsonc.ts";
 import {
-  DEFAULT_PERMISSION_CONFIG,
   createDefaultPermissionConfig,
   toPermissionState,
   toRecord,
@@ -11,6 +10,14 @@ import {
   type PermissionSection,
   type PermissionState,
 } from "./types.ts";
+import {
+  CONFIG_MUST_BE_OBJECT,
+  formatConfigParseFailure,
+  formatConfigReadFailure,
+  formatIgnoredSectionEntryWarning,
+  formatIgnoredSectionWarning,
+  IGNORED_DEFAULT_WARNING,
+} from "./warning-strings.ts";
 
 const UNSAFE_KEYS = new Set(["__proto__", "constructor", "prototype"]);
 
@@ -29,7 +36,7 @@ function normalizeSection(
   if (!record) {
     warnings.push({
       path: configPath,
-      message: `Ignoring "${sectionName}": expected an object mapping names to ${PERMISSION_STATES_DESCRIPTION}.`,
+      message: formatIgnoredSectionWarning(sectionName),
     });
     return {};
   }
@@ -43,7 +50,7 @@ function normalizeSection(
     } else {
       warnings.push({
         path: configPath,
-        message: `Ignoring "${sectionName}.${key}": expected ${PERMISSION_STATES_DESCRIPTION}.`,
+        message: formatIgnoredSectionEntryWarning(sectionName, key),
       });
     }
   }
@@ -63,7 +70,7 @@ function normalizeConfig(
   if (!config) {
     warnings.push({
       path: configPath,
-      message: "Permission config must be a JSON object; using defaults.",
+      message: CONFIG_MUST_BE_OBJECT,
     });
     return createDefaultPermissionConfig();
   }
@@ -72,7 +79,7 @@ function normalizeConfig(
   if (config.default !== undefined && parsedDefault === undefined) {
     warnings.push({
       path: configPath,
-      message: `Ignoring "default": expected ${PERMISSION_STATES_DESCRIPTION}.`,
+      message: IGNORED_DEFAULT_WARNING,
     });
   }
   const defaultState = parsedDefault ?? ASK;
@@ -105,7 +112,7 @@ async function loadConfigFile(
     if (code === "ENOENT") {return undefined;} // file does not exist
     warnings.push({
       path,
-      message: `Failed to read permission config: ${error instanceof Error ? error.message : String(error)}`,
+      message: formatConfigReadFailure(error),
     });
     return undefined;
   }
@@ -115,7 +122,7 @@ async function loadConfigFile(
   } catch (error) {
     warnings.push({
       path,
-      message: `Failed to parse permission config: ${error instanceof Error ? error.message : String(error)}`,
+      message: formatConfigParseFailure(error),
     });
     return undefined;
   }
@@ -150,7 +157,7 @@ export function mergeConfigs(
     return createDefaultPermissionConfig();
   }
 
-  globalConfig = globalConfig ?? DEFAULT_PERMISSION_CONFIG;
+  globalConfig = globalConfig ?? createDefaultPermissionConfig();
 
   return {
     default: localConfig?.default ?? globalConfig.default,

package/src/constants.ts

@@ -1,9 +1,10 @@
 export const EXTENSION_NAME = "pi-permission-system";
 export const STATUS_KEY = EXTENSION_NAME;
-export const CONFIG_WARNING_PREFIX = `${EXTENSION_NAME}: `;
 export const MAX_CONFIG_WARNINGS = 5;
 
 export const CONFIG_FILENAME = "pi-permissions.jsonc";
+/** Local config directory under the cwd. */
+export const LOCAL_CONFIG_DIR_SEGMENTS = [".pi"] as const;
 
 export const ALLOW = "allow";
 export const ASK = "ask";

package/src/extension.ts

@@ -2,19 +2,18 @@ import { getAgentDir, type ExtensionAPI, type ExtensionContext } from "@earendil
 import { join } from "node:path";
 
 import { clearPurposeCache, generateRequestPurpose } from "./ai-purpose.ts";
-import { generateBashWildcard } from "./ai-wildcard.ts";
 import { clearWildcardCache } from "./matcher.ts";
 import {
   ALLOW,
   CONFIG_FILENAME,
-  CONFIG_WARNING_PREFIX,
   DENY,
+  LOCAL_CONFIG_DIR_SEGMENTS,
   MAX_CONFIG_WARNINGS,
   STATUS_KEY,
 } from "./constants.ts";
 import { loadMergedConfig } from "./config.ts";
 import { promptForPermission } from "./permission-dialog.ts";
-import { findSessionApproval, resolvePolicy, willGenerateBashWildcard } from "./policy.ts";
+import { findSessionApproval, resolvePolicy } from "./policy.ts";
 import {
   buildPurposePromptContext,
   formatDenyReason,
@@ -24,21 +23,15 @@ import {
 import { buildRequest } from "./request-builder.ts";
 import { SessionApprovalStore } from "./session-approvals.ts";
 import {
-  BROAD_WILDCARD_TITLE,
   buildSelectorSummary,
-  formatBroadWildcardConfirm,
-  INVALID_WILDCARD_PREFIX,
-  STATUS_GENERATING_WILDCARD,
   STATUS_SUMMARIZING_REQUEST,
-  WILDCARD_EDITOR_TITLE,
 } from "./ui-strings.ts";
-import { validateWildcardSuggestion } from "./wildcard-validation.ts";
 import {
-  type PermissionConfig,
-  type PermissionRequest,
-  type PolicyResolution,
-  type AllowAlwaysRule,
-} from "./types.ts";
+  CONFIG_WARNING_PREFIX,
+  formatSuppressedConfigWarnings,
+} from "./warning-strings.ts";
+import { chooseAlwaysRules } from "./wildcard-editor.ts";
+import type { PermissionConfig } from "./types.ts";
 
 interface ExtensionState {
   config?: PermissionConfig;
@@ -60,7 +53,7 @@ function createNewState(): ExtensionState {
 async function loadConfig(ctx: ExtensionContext): Promise<PermissionConfig> {
   const { config, warnings } = await loadMergedConfig(
     join(getAgentDir(), CONFIG_FILENAME),
-    join(ctx.cwd, CONFIG_FILENAME)
+    join(ctx.cwd, ...LOCAL_CONFIG_DIR_SEGMENTS, CONFIG_FILENAME)
   );
 
   if (ctx.hasUI) {
@@ -70,7 +63,7 @@ async function loadConfig(ctx: ExtensionContext): Promise<PermissionConfig> {
     if (warnings.length > MAX_CONFIG_WARNINGS) {
       const suppressed = warnings.length - MAX_CONFIG_WARNINGS;
       ctx.ui.notify(
-        `${CONFIG_WARNING_PREFIX}${suppressed} additional config warning(s) suppressed.`,
+        `${CONFIG_WARNING_PREFIX}${formatSuppressedConfigWarnings(suppressed)}`,
         "warning"
       );
     }
@@ -79,71 +72,6 @@ async function loadConfig(ctx: ExtensionContext): Promise<PermissionConfig> {
   return config;
 }
 
-/**
- * Selects the "allow always" matching rule for the request.
- */
-async function chooseAlwaysRule(
-  ctx: ExtensionContext,
-  request: PermissionRequest,
-  policy: PolicyResolution
-): Promise<AllowAlwaysRule | undefined> {
-  if (request.isExternalDirectory && policy.source === "external") {
-    return {
-      scope: "external_directory",
-      tool: request.toolName,
-      kind: "exact",
-      body: request.body,
-    };
-  }
-
-  // no wildcard
-  if (!willGenerateBashWildcard(request, policy)) {
-    return { scope: "tool", tool: request.toolName, kind: "exact", body: request.body };
-  }
-
-  // generate wildcard
-  ctx.ui.setStatus(STATUS_KEY, STATUS_GENERATING_WILDCARD);
-  let suggestion: string | undefined;
-  try {
-    suggestion = await generateBashWildcard(ctx, request.body);
-  } finally {
-    ctx.ui.setStatus(STATUS_KEY, undefined);
-  }
-
-  // show wildcard editor
-  let initial = suggestion ?? request.body;
-  while (true) {
-    const edited = await ctx.ui.editor(WILDCARD_EDITOR_TITLE, initial);
-    if (edited === undefined) {return undefined;}
-
-    const pattern = edited.trim();
-    const validation = validateWildcardSuggestion(pattern, request.body);
-    if (!validation.valid) {
-      ctx.ui.notify(`${INVALID_WILDCARD_PREFIX}${validation.reason}`, "warning");
-      initial = pattern || request.body;
-      continue;
-    }
-
-    if (validation.broad) {
-      const confirmed = await ctx.ui.confirm(
-        BROAD_WILDCARD_TITLE,
-        formatBroadWildcardConfirm(pattern)
-      );
-      if (!confirmed) {
-        initial = pattern;
-        continue;
-      }
-    }
-
-    return {
-      scope: "tool",
-      tool: "bash",
-      kind: "wildcard",
-      body: pattern,
-    };
-  }
-}
-
 /**
  * Registers the extension.
  */
@@ -195,15 +123,7 @@ export function registerPermissionSystem(pi: ExtensionAPI): void {
     }
 
     // check session approval
-    const sessionRequest =
-      policy.source === "external"
-        ? request
-        : { ...request, isExternalDirectory: false };
-    const approval = findSessionApproval(
-      state.approvals.getRules(),
-      sessionRequest,
-      policy.isChainedBash
-    );
+    const approval = findSessionApproval(state.approvals.getRules(), request);
     if (approval) {return undefined;} // approved, proceed
 
     const summary = buildSelectorSummary(request);
@@ -213,7 +133,7 @@ export function registerPermissionSystem(pi: ExtensionAPI): void {
       purpose = await generateRequestPurpose(
         ctx,
         request,
-        buildPurposePromptContext(request, policy)
+        buildPurposePromptContext(request)
       );
     } finally {
       ctx.ui.setStatus(STATUS_KEY, undefined);
@@ -229,12 +149,14 @@ export function registerPermissionSystem(pi: ExtensionAPI): void {
       }
 
       // "allow always"
-      const rule = await chooseAlwaysRule(ctx, request, policy);
-      if (!rule) {
+      const rules = await chooseAlwaysRules(ctx, request, policy);
+      if (!rules) {
         // the user cancelled the wildcard editor, return to the permission dialog
         continue;
       }
-      state.approvals.add(rule);
+      for (const rule of rules) {
+        state.approvals.add(rule);
+      }
       return undefined;
     }
   });

package/src/permission-dialog.ts

@@ -1,4 +1,6 @@
-import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+import type { ExtensionContext, Theme } from "@earendil-works/pi-coding-agent";
+import { ExtensionSelectorComponent } from "@earendil-works/pi-coding-agent";
+import { Container, Text } from "@earendil-works/pi-tui";
 import {
   ALLOW_ALWAYS_EXACT,
   ALLOW_ALWAYS_WILDCARD,
@@ -17,6 +19,22 @@ import {
   PURPOSE_PREFIX,
 } from "./ui-strings.ts";
 
+function mapChoice(choice: string | undefined | null): PermissionDialogSelection {
+  if (choice === ALLOW_ONCE) {return { kind: "once" };}
+  if (choice === ALLOW_ALWAYS_EXACT || choice === ALLOW_ALWAYS_WILDCARD) {
+    return { kind: "always" };
+  }
+  return { kind: "reject" };
+}
+
+/** Bold + color the `Label:` prefix; warning color for note lines. */
+function styleSummaryLine(theme: Theme, line: string): string {
+  const sep = line.indexOf(": ");
+  if (sep === -1) {return theme.fg("text", line);}
+  return theme.fg("accent", theme.bold(line.slice(0, sep + 1)))
+    + theme.fg("text", line.slice(sep + 1));
+}
+
 /**
  * Shows permission dialog and gets input.
  */
@@ -27,23 +45,49 @@ export async function promptForPermission(
   summary: string,
   purpose?: string
 ): Promise<PermissionDialogSelection> {
-  // if there's no ui, just reject
-  if (!ctx.hasUI) {return { kind: "reject" };}
-
-  const purposeLine = purpose ? `\n${PURPOSE_PREFIX}${purpose}` : "";
-  const title = `${PERMISSION_DIALOG_TITLE}\n${summary}${purposeLine}\n${PERMISSION_DIALOG_QUESTION}`;
   const options = [ALLOW_ONCE, formatAllowAlwaysOption(request, policy), REJECT];
 
-  let choice: string | undefined;
   try {
-    choice = await ctx.ui.select(title, options);
+    // non-tui mode fallback
+    if (ctx.mode !== "tui") {
+      const purposeLine = purpose ? `\n${PURPOSE_PREFIX}${purpose}` : "";
+      const title = `${PERMISSION_DIALOG_TITLE}\n${summary}${purposeLine}\n${PERMISSION_DIALOG_QUESTION}`;
+      return mapChoice(await ctx.ui.select(title, options));
+    }
+
+    // build custom tui
+    const choice = await ctx.ui.custom<string | null>((tui, theme, _kb, done) => {
+      const container = new Container();
+      container.addChild(new Text(theme.fg("accent", theme.bold(PERMISSION_DIALOG_TITLE)), 1, 0));
+      for (const line of summary.split("\n")) {
+        container.addChild(new Text(styleSummaryLine(theme, line), 1, 0));
+      }
+      if (purpose) {
+        container.addChild(new Text(styleSummaryLine(theme, `${PURPOSE_PREFIX}${purpose}`), 1, 0));
+      }
+
+      const selector = new ExtensionSelectorComponent(
+        PERMISSION_DIALOG_QUESTION,
+        options,
+        (option) => done(option),
+        () => done(null),
+        { tui }
+      );
+      container.addChild(selector);
+
+      return {
+        render: (width: number) => container.render(width),
+        invalidate: () => container.invalidate(),
+        handleInput: (data: string) => {
+          selector.handleInput(data);
+          tui.requestRender();
+        },
+        dispose: () => selector.dispose(),
+      };
+    });
+
+    return mapChoice(choice);
   } catch {
     return { kind: "reject" };
   }
-
-  if (choice === ALLOW_ONCE) {return { kind: "once" };}
-  if (choice === ALLOW_ALWAYS_EXACT || choice === ALLOW_ALWAYS_WILDCARD) {
-    return { kind: "always" };
-  }
-  return { kind: "reject" };
 }

package/src/policy-bash.ts

@@ -0,0 +1,157 @@
+import { findLastWildcardMatch, matchesWildcard } from "./matcher.ts";
+import { analyzeShellCommand, type ShellCommandAnalysis } from "./shell.ts";
+import type {
+  AllowAlwaysMode,
+  AllowAlwaysRule,
+  PermissionConfig,
+  PermissionRequest,
+  PermissionState,
+  PolicyResolution,
+} from "./types.ts";
+
+const STATE_RANK: Record<PermissionState, number> = {
+  allow: 0,
+  ask: 1,
+  deny: 2,
+};
+
+/**
+ * Prefers the analysis stored on the request.
+ * Falls back for hand-built fixtures.
+ */
+function bashAnalysisOf(request: PermissionRequest): ShellCommandAnalysis {
+  return request.bashAnalysis ?? analyzeShellCommand(request.body);
+}
+
+/**
+ * The general permission state for bash.
+ */
+function generalBashToolState(
+  config: PermissionConfig
+): PermissionState | undefined {
+  return Object.hasOwn(config.tools, "bash") ? config.tools.bash : undefined;
+}
+
+function bashFallbackResolution(config: PermissionConfig): PolicyResolution {
+  const toolState = generalBashToolState(config);
+  return {
+    state: toolState ?? config.default,
+    source: toolState ? "tool" : "default",
+  };
+}
+
+/**
+ * Resolves one simple bash segment against bash rules, then tools.bash / default.
+ */
+function resolveBashSegment(
+  config: PermissionConfig,
+  segment: string
+): PolicyResolution {
+  const match = findLastWildcardMatch(config.bash, segment);
+  if (match) {
+    return {
+      state: match.state,
+      source: "bash",
+      matchedPattern: match.pattern,
+    };
+  }
+  return bashFallbackResolution(config);
+}
+
+/**
+ * Worst state wins across simple list segments.
+ * When ranks tie, keep the later segment's resolution.
+ */
+function combineBashSegmentResolutions(
+  resolutions: PolicyResolution[]
+): PolicyResolution {
+  let worst = resolutions[0]!;
+  for (let index = 1; index < resolutions.length; index++) {
+    const next = resolutions[index]!;
+    if (STATE_RANK[next.state] >= STATE_RANK[worst.state]) {
+      worst = next;
+    }
+  }
+  return worst;
+}
+
+/**
+ * Resolves bash policy, including simple list splitting.
+ */
+export function resolveBashPolicy(
+  config: PermissionConfig,
+  request: PermissionRequest
+): PolicyResolution {
+  const analysis = bashAnalysisOf(request);
+  if (analysis.isComplex) {
+    return bashFallbackResolution(config);
+  }
+  const resolutions = analysis.segments.map((segment) =>
+    resolveBashSegment(config, segment)
+  );
+  return combineBashSegmentResolutions(resolutions);
+}
+
+/**
+ * Newest matching bash rule for one command segment.
+ */
+function findBashSegmentSessionApproval(
+  rules: readonly AllowAlwaysRule[],
+  segment: string
+): AllowAlwaysRule | undefined {
+  for (let index = rules.length - 1; index >= 0; index--) {
+    const rule = rules[index]!;
+    if (rule.tool !== "bash") {continue;}
+    if (rule.kind === "exact") {
+      if (rule.body === segment) {return rule;}
+      continue;
+    }
+    if (matchesWildcard(rule.body, segment)) {return rule;}
+  }
+  return undefined;
+}
+
+/**
+ * Session approval for bash, including per-segment matching for simple lists.
+ */
+export function findBashSessionApproval(
+  rules: readonly AllowAlwaysRule[],
+  request: PermissionRequest
+): AllowAlwaysRule | undefined {
+  // check full exact match first
+  for (let index = rules.length - 1; index >= 0; index--) {
+    const rule = rules[index]!;
+    if (rule.tool === "bash" && rule.kind === "exact" && rule.body === request.body) {
+      return rule;
+    }
+  }
+
+  const analysis = bashAnalysisOf(request);
+  if (analysis.isComplex) {return undefined;} // complex only has full exact match
+
+  // check segments with wildcard / exact
+  let lastMatch: AllowAlwaysRule | undefined;
+  for (const segment of analysis.segments) {
+    const match = findBashSegmentSessionApproval(rules, segment);
+    if (!match) {return undefined;}
+    lastMatch = match;
+  }
+  return lastMatch;
+}
+
+/**
+ * How "allow always" should persist this request for the session.
+ */
+export function resolveAllowAlwaysMode(
+  request: PermissionRequest,
+  policy: PolicyResolution
+): AllowAlwaysMode {
+  if (request.isExternalDirectory && policy.source === "external") {return "exact";}
+  if (request.toolName !== "bash") {return "exact";}
+
+  const analysis = bashAnalysisOf(request);
+  if (analysis.isComplex) {return "exact";}
+  if (analysis.segments.length > 1) {return "wildcard-list";}
+  if (analysis.segments.length === 1) {return "wildcard";}
+  return "exact";
+}