@davisliu2006/pi-permission-system 0.3.0 → 0.4.0

package/CHANGELOG.md

@@ -0,0 +1,35 @@
+# Changelog
+
+## [0.4.0] — 2026-11-11
+
+### Added
+
+- Added experimental auto-classifier, `auto` permission, and `settings.auto_allow_criteria`.
+- Added `settings.ignore_global` to the local config to ignore global permission rules.
+
+## [0.3.0] — 2026-11-07
+
+### Added
+
+- Added `settings` to the config schema for non-permission settings.
+- Added `settings.ai_model` config field to optionally override the model for small helper completions.
+
+### Changed
+
+- `deny` rules can now check complex bash segments.
+
+## [0.2.0] — 2026-11-03
+
+### Added
+
+- Added bash splitting. A chained command like `cd dir && git status` now checks `cd dir` and `git status` separately. Bash wildcard can now generate multiple patterns at once (eg. `cd *; git status`).
+
+### Changed
+
+- Local permission config now loads from `.pi/pi-permissions.jsonc` instead of the project root, which is consistent with Pi local config conventions.
+- Made `ai-purpose` responses more concise by adding examples to the prompt.
+- Improved permission dialog UI by putting details in a custom TUI display instead of the selector title.
+
+## [0.1.0] — 2026-11-01
+
+Initial version.

package/README.md

@@ -4,6 +4,13 @@ Permissions management for the `pi` coding agent.
 
 Roughly based on [MasuRii/pi-permission-system](https://github.com/MasuRii/pi-permission-system).
 
+<img src="https://raw.githubusercontent.com/davisliu2006/pi-permission-system/main/images/image.webp">
+
+### Key Features
+
+- [Bash splitting](#bash-matching-safeguards). Splits chained commands (eg. `cd ~ && pwd`) into parts and matches rules for each segment.
+- AI-generated request purpose and bash rule wildcard.
+- Experimental auto-classifier. Supports configurable auto-allow critera.
 
 ## Permissions Overview
 
@@ -11,8 +18,9 @@ A permission can be one of the following:
 
 ```jsonc
 "allow"  // allows the action
-"ask"  // asks the user for permission
-"deny"  // automatically denies the action
+"auto"   // uses an AI classifier to choose between allow and ask
+"ask"    // asks the user for permission
+"deny"   // automatically denies the action
 ```
 
 Ask states the purpose of the request and gives the following options:
@@ -106,16 +114,24 @@ Located in the local Pi config folder:
 
 Local configuration overrides global configuration, including `deny` rules.
 
+Set `settings.ignore_global` to `true` in the local config to ignore global permission sections entirely.
+
 ### Optional Settings
 
 ```jsonc
 {
     "settings": {
-        "ai-model": "provider/model-id"
+        "ignore_global": true,
+        "ai_model": "provider/model-id",
+        "auto_allow_criteria": "read-only or easily reversible"
     }
 }
 ```
 
+- `ignore_global: boolean`: Skips global permission sections if placed in a local config. Has no effect if placed in a global config.
+- `ai_model: string`: Overrides the model used for helper completions.
+- `auto_allow_criteria: string`: Specify the auto-classifer criteria. Defaults to `"read-only or easily reversible"`.
+
 ## "Allow Always" Matching
 
 Matching is done as `(tool, body)`.
@@ -135,8 +151,8 @@ Body matching rules:
 
 Bash matching safeguards against unsafe shell syntax.
 
-Sequences separated by `;`, `&&`, `||`, or newlines are split and each segment is matched against `bash` rules. The strictest result wins (`deny` > `ask` > `allow`).
+Sequences separated by `;`, `&&`, `||`, or newlines are split and each segment is matched against `bash` rules. The strictest result wins (`deny` > `ask` > `auto` > `allow`).
 
-If a command contains other chaining (`|`, `&`, command/process substitution, or parentheses), `bash` pattern rules (except for `deny`) are skipped and the `tools.bash` policy is used instead, falling back to `default`.
+If a command contains other chaining (`|`, `&`, command/process substitution, or parentheses), `bash` pattern rules for `allow` are skipped, allowing other segments to take priority and successively falling back to `tools.bash` and `default`.
 
 "Allow always" for complex sequences saves the exact command, not a wildcard.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davisliu2006/pi-permission-system",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Permission enforcement extension for the Pi coding agent.",
   "type": "module",
   "main": "./index.ts",
@@ -11,7 +11,8 @@
     "index.ts",
     "src",
     "README.md",
-    "LICENSE"
+    "LICENSE",
+    "CHANGELOG.md"
   ],
   "scripts": {
     "typecheck": "tsc -p tsconfig.json --noEmit",
@@ -34,7 +35,8 @@
   "pi": {
     "extensions": [
       "./index.ts"
-    ]
+    ],
+    "image": "https://raw.githubusercontent.com/davisliu2006/pi-permission-system/main/images/image.webp"
   },
   "engines": {
     "node": ">=20"

package/src/ai-classifier.ts

@@ -0,0 +1,53 @@
+import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { completeText } from "./ai-gen.ts";
+import { ALLOW, ASK, DEFAULT_AUTO_ALLOW_CRITERIA } from "./constants.ts";
+import {
+  buildClassifierInstructions,
+  buildClassifierPromptContext,
+  CLASSIFIER_SYSTEM_PROMPT,
+} from "./prompts.ts";
+import type { PermissionRequest } from "./types.ts";
+
+const CLASSIFIER_TIMEOUT_MS = 5000;
+const MAX_CLASSIFIER_TOKENS = 16;
+
+export type AutoDecision = typeof ALLOW | typeof ASK;
+
+/**
+ * Parses a classifier reply.
+ * Sanitizes against escape sequences, newlines, and punctuation.
+ */
+export function parseAutoDecision(text: string | undefined): AutoDecision {
+  if (!text) {return ASK;}
+  const line = text
+    .replace(/\u001b\[[0-9;]*m/g, "")
+    .replace(/\s+/g, " ")
+    .trim()
+    .toLowerCase()
+    .replace(/^["'`]+|["'`.,!:;]+$/g, "");
+  return line === ALLOW ? ALLOW : ASK;
+}
+
+/**
+ * Classifies whether an "auto" request should auto-allow or ask the user.
+ * Leans towards "ask" in case of uncertainty.
+ */
+export async function classifyAutoPermission(
+  ctx: ExtensionContext,
+  request: PermissionRequest,
+  aiModel?: string,
+  allowCriteria?: string
+): Promise<AutoDecision> {
+  const criteria = allowCriteria?.trim() || DEFAULT_AUTO_ALLOW_CRITERIA;
+  const text = await completeText(ctx, {
+    systemPrompt: CLASSIFIER_SYSTEM_PROMPT,
+    userText: buildClassifierInstructions(
+      buildClassifierPromptContext(request),
+      criteria
+    ),
+    maxTokens: MAX_CLASSIFIER_TOKENS,
+    timeoutMs: CLASSIFIER_TIMEOUT_MS,
+    aiModel,
+  });
+  return parseAutoDecision(text);
+}

package/src/config.ts

@@ -19,7 +19,10 @@ import {
   formatIgnoredSectionEntryWarning,
   formatIgnoredSectionWarning,
   IGNORED_AI_MODEL_WARNING,
+  IGNORED_AUTO_ALLOW_CRITERIA_WARNING,
   IGNORED_DEFAULT_WARNING,
+  IGNORED_IGNORE_GLOBAL_LOCAL_ONLY_WARNING,
+  IGNORED_IGNORE_GLOBAL_WARNING,
   IGNORED_SETTINGS_WARNING,
 } from "./warning-strings.ts";
 
@@ -68,7 +71,8 @@ function normalizeSection(
 function normalizeSettings(
   raw: unknown,
   configPath: string | undefined,
-  warnings: ConfigWarning[]
+  warnings: ConfigWarning[],
+  isLocal: boolean
 ): PermissionSettings {
   if (raw === undefined) {return {};}
   const record = toRecord(raw);
@@ -81,6 +85,21 @@ function normalizeSettings(
   }
 
   const settings: PermissionSettings = {};
+  if (record.ignore_global !== undefined) {
+    if (!isLocal) {
+      warnings.push({
+        path: configPath,
+        message: IGNORED_IGNORE_GLOBAL_LOCAL_ONLY_WARNING,
+      });
+    } else if (typeof record.ignore_global === "boolean") {
+      settings.ignore_global = record.ignore_global;
+    } else {
+      warnings.push({
+        path: configPath,
+        message: IGNORED_IGNORE_GLOBAL_WARNING,
+      });
+    }
+  }
   if (record.ai_model !== undefined) {
     if (typeof record.ai_model === "string" && parseAiModelRef(record.ai_model)) {
       settings.ai_model = record.ai_model.trim();
@@ -91,6 +110,19 @@ function normalizeSettings(
       });
     }
   }
+  if (record.auto_allow_criteria !== undefined) {
+    if (
+      typeof record.auto_allow_criteria === "string"
+      && record.auto_allow_criteria.trim()
+    ) {
+      settings.auto_allow_criteria = record.auto_allow_criteria.trim();
+    } else {
+      warnings.push({
+        path: configPath,
+        message: IGNORED_AUTO_ALLOW_CRITERIA_WARNING,
+      });
+    }
+  }
   return settings;
 }
 
@@ -101,7 +133,8 @@ function normalizeSettings(
 export function normalizeConfig(
   rawConfig: unknown,
   configPath: string | undefined,
-  warnings: ConfigWarning[]
+  warnings: ConfigWarning[],
+  isLocal: boolean
 ): PermissionConfig {
   const config = toRecord(rawConfig);
   if (!config) {
@@ -131,7 +164,7 @@ export function normalizeConfig(
       configPath,
       warnings
     ),
-    settings: normalizeSettings(config.settings, configPath, warnings),
+    settings: normalizeSettings(config.settings, configPath, warnings, isLocal),
   };
 }
 
@@ -140,7 +173,8 @@ export function normalizeConfig(
  */
 async function loadConfigFile(
   path: string,
-  warnings: ConfigWarning[]
+  warnings: ConfigWarning[],
+  isLocal: boolean
 ): Promise<PermissionConfig | undefined> {
   let raw: string;
   try {
@@ -156,7 +190,7 @@ async function loadConfigFile(
   }
 
   try {
-    return normalizeConfig(parseJsonc(raw), path, warnings);
+    return normalizeConfig(parseJsonc(raw), path, warnings, isLocal);
   } catch (error) {
     warnings.push({
       path,
@@ -186,6 +220,8 @@ function mergeBashSections(
 
 /**
  * Merges configs such that local config overrides global config.
+ * If local `settings.ignore_global` is true, global permission
+ * sections are ignored.
  */
 export function mergeConfigs(
   globalConfig: PermissionConfig | undefined,
@@ -196,6 +232,20 @@ export function mergeConfigs(
   }
 
   globalConfig = globalConfig ?? createDefaultPermissionConfig();
+  const mergedSettings: PermissionSettings = {
+    ...globalConfig.settings,
+    ...(localConfig?.settings ?? {}),
+  };
+
+  if (localConfig?.settings.ignore_global === true) {
+    return {
+      default: localConfig.default,
+      tools: { ...localConfig.tools },
+      bash: { ...localConfig.bash },
+      external_directory: { ...localConfig.external_directory },
+      settings: mergedSettings,
+    };
+  }
 
   return {
     default: localConfig?.default ?? globalConfig.default,
@@ -205,10 +255,7 @@ export function mergeConfigs(
       ...globalConfig.external_directory,
       ...(localConfig?.external_directory ?? {}),
     },
-    settings: {
-      ...globalConfig.settings,
-      ...(localConfig?.settings ?? {}),
-    },
+    settings: mergedSettings,
   };
 }
 
@@ -220,8 +267,8 @@ export async function loadMergedConfig(
   localPath: string
 ): Promise<{ config: PermissionConfig; warnings: ConfigWarning[] }> {
   const warnings: ConfigWarning[] = [];
-  const globalConfig = await loadConfigFile(globalPath, warnings);
-  const localConfig = await loadConfigFile(localPath, warnings);
+  const globalConfig = await loadConfigFile(globalPath, warnings, false);
+  const localConfig = await loadConfigFile(localPath, warnings, true);
   return {
     config: mergeConfigs(globalConfig, localConfig),
     warnings,

package/src/constants.ts

@@ -7,10 +7,14 @@ export const CONFIG_FILENAME = "pi-permissions.jsonc";
 export const LOCAL_CONFIG_DIR_SEGMENTS = [".pi"] as const;
 
 export const ALLOW = "allow";
+export const AUTO = "auto";
 export const ASK = "ask";
 export const DENY = "deny";
-export const PERMISSION_STATES = [ALLOW, ASK, DENY] as const;
-export const PERMISSION_STATES_DESCRIPTION = "allow, ask, or deny";
+export const PERMISSION_STATES = [ALLOW, AUTO, ASK, DENY] as const;
+export const PERMISSION_STATES_DESCRIPTION = "allow, auto, ask, or deny";
+
+/** Default criteria used by "auto" classifier. */
+export const DEFAULT_AUTO_ALLOW_CRITERIA = "read-only or easily reversible";
 
 export const ALLOW_ONCE = "Allow Once";
 export const ALLOW_ALWAYS_EXACT = "Allow Always (exact match)";

package/src/extension.ts

@@ -1,10 +1,12 @@
 import { getAgentDir, type ExtensionAPI, type ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { join } from "node:path";
 
+import { classifyAutoPermission } from "./ai-classifier.ts";
 import { clearPurposeCache, generateRequestPurpose } from "./ai-purpose.ts";
 import { clearWildcardCache } from "./matcher.ts";
 import {
   ALLOW,
+  AUTO,
   CONFIG_FILENAME,
   DENY,
   LOCAL_CONFIG_DIR_SEGMENTS,
@@ -22,7 +24,10 @@ import {
 } from "./prompts.ts";
 import { buildRequest } from "./request-builder.ts";
 import { SessionApprovalStore } from "./session-approvals.ts";
-import { STATUS_SUMMARIZING_REQUEST } from "./ui-strings.ts";
+import {
+  STATUS_CLASSIFYING_REQUEST,
+  STATUS_SUMMARIZING_REQUEST,
+} from "./ui-strings.ts";
 import {
   CONFIG_WARNING_PREFIX,
   formatSuppressedConfigWarnings,
@@ -115,14 +120,34 @@ export function registerPermissionSystem(pi: ExtensionAPI): void {
     if (policy.state === ALLOW) { // auto allow
       return undefined;
     }
-    if (!ctx.hasUI) { // no ui, auto deny
-      return { block: true, reason: formatNoUiReason(request, policy) };
-    }
 
     // check session approval
     const approval = findSessionApproval(state.approvals.getRules(), request);
     if (approval) {return undefined;} // approved, proceed
 
+    if (policy.state === AUTO) { // use ai classifier
+      if (ctx.hasUI) {
+        ctx.ui.setStatus(STATUS_KEY, STATUS_CLASSIFYING_REQUEST);
+      }
+      try {
+        const decision = await classifyAutoPermission(
+          ctx,
+          request,
+          config.settings.ai_model,
+          config.settings.auto_allow_criteria
+        );
+        if (decision === ALLOW) {return undefined;}
+      } finally {
+        if (ctx.hasUI) {
+          ctx.ui.setStatus(STATUS_KEY, undefined);
+        }
+      }
+    }
+
+    if (!ctx.hasUI) { // no ui, deny (same path as ask)
+      return { block: true, reason: formatNoUiReason(request, policy) };
+    }
+
     ctx.ui.setStatus(STATUS_KEY, STATUS_SUMMARIZING_REQUEST);
     let purpose: string | undefined;
     try {

package/src/policy-bash.ts

@@ -11,10 +11,15 @@ import type {
 
 const STATE_RANK: Record<PermissionState, number> = {
   allow: 0,
-  ask: 1,
-  deny: 2,
+  auto: 1,
+  ask: 2,
+  deny: 3,
 };
 
+function appliesWhenComplex(state: PermissionState): boolean {
+  return state === "deny" || state === "ask" || state === "auto";
+}
+
 /**
  * Prefers the analysis stored on the request.
  * Falls back for hand-built fixtures.
@@ -41,30 +46,37 @@ function bashFallbackResolution(config: PermissionConfig): PolicyResolution {
 }
 
 /**
- * Resolves one simple bash segment against bash rules, then tools.bash / default.
+ * Resolves one bash segment against bash rules.
+ * Returns undefined if a complex segment fails to match a rule.
  */
 function resolveBashSegment(
   config: PermissionConfig,
-  segment: string
-): PolicyResolution {
+  segment: string,
+  isComplex: boolean
+): PolicyResolution | undefined {
   const match = findLastWildcardMatch(config.bash, segment);
-  if (match) {
-    return {
-      state: match.state,
-      source: "bash",
-      matchedPattern: match.pattern,
-    };
+  if (!match) {
+    return isComplex ? undefined : bashFallbackResolution(config);
   }
-  return bashFallbackResolution(config);
+  if (isComplex && !appliesWhenComplex(match.state)) {
+    return undefined;
+  }
+  return {
+    state: match.state,
+    source: "bash",
+    matchedPattern: match.pattern,
+  };
 }
 
 /**
- * Worst state wins across simple list segments.
+ * Worst state wins across segment resolutions.
  * When ranks tie, keep the later segment's resolution.
+ * Returns undefined when there are no votes.
  */
 function combineBashSegmentResolutions(
-  resolutions: PolicyResolution[]
-): PolicyResolution {
+  resolutions: readonly PolicyResolution[]
+): PolicyResolution | undefined {
+  if (resolutions.length === 0) {return undefined;}
   let worst = resolutions[0]!;
   for (let index = 1; index < resolutions.length; index++) {
     const next = resolutions[index]!;
@@ -76,43 +88,19 @@ function combineBashSegmentResolutions(
 }
 
 /**
- * "Deny" rule can do raw wildcard matching on complex segments.
- */
-function resolveComplexBashDeny(
-  config: PermissionConfig,
-  segments: readonly string[]
-): PolicyResolution | undefined {
-  let denied: PolicyResolution | undefined;
-  for (const segment of segments) {
-    const match = findLastWildcardMatch(config.bash, segment);
-    if (match?.state !== "deny") {continue;}
-    denied = {
-      state: "deny",
-      source: "bash",
-      matchedPattern: match.pattern,
-    };
-  }
-  return denied;
-}
-
-/**
- * Resolves bash policy, including simple list splitting.
+ * Resolves bash policy, including command splitting.
  */
 export function resolveBashPolicy(
   config: PermissionConfig,
   request: PermissionRequest
 ): PolicyResolution {
   const analysis = bashAnalysisOf(request);
-  if (analysis.isComplex) {
-    return (
-      resolveComplexBashDeny(config, analysis.segments) ??
-      bashFallbackResolution(config)
-    );
+  const votes: PolicyResolution[] = [];
+  for (const segment of analysis.segments) {
+    const resolution = resolveBashSegment(config, segment, analysis.isComplex);
+    if (resolution) {votes.push(resolution);}
   }
-  const resolutions = analysis.segments.map((segment) =>
-    resolveBashSegment(config, segment)
-  );
-  return combineBashSegmentResolutions(resolutions);
+  return combineBashSegmentResolutions(votes) ?? bashFallbackResolution(config);
 }
 
 /**

package/src/prompts.ts

@@ -1,7 +1,6 @@
 import { describePolicy } from "./policy.ts";
 import type { PermissionRequest, PolicyResolution } from "./types.ts";
 
-const CHAINED_BASH_NOTE = "Shell chaining detected: bash pattern rules were skipped.";
 const EXTERNAL_DIRECTORY_NOTE = "Outside the working directory.";
 
 function preview(value: string, limit: number): string {
@@ -27,6 +26,32 @@ export function describeBlockedSubject(
     : `tool ${JSON.stringify(request.toolName)}`;
 }
 
+/**
+ * Builds context for the "auto" permission classifier.
+ */
+export function buildClassifierPromptContext(request: PermissionRequest): string {
+  const lines = [
+    `Tool: ${request.toolName}`,
+    `Working directory: ${request.cwd}`,
+  ];
+
+  if (request.bodyKind === "command") {
+    lines.push(`Command:\n${preview(request.body, 600)}`);
+  } else if (request.bodyKind === "path") {
+    lines.push(`Path: ${preview(request.body, 400)}`);
+  } else {
+    lines.push(`Input: ${preview(request.body, 600)}`);
+  }
+
+  if (request.isExternalDirectory !== undefined) {
+    lines.push(
+      `Outside working directory: ${request.isExternalDirectory ? "yes" : "no"}`
+    );
+  }
+
+  return lines.join("\n");
+}
+
 /**
  * Builds context for the ai-generated purpose.
  */
@@ -49,6 +74,23 @@ export function buildPurposePromptContext(request: PermissionRequest): string {
   return lines.join("\n");
 }
 
+export const CLASSIFIER_SYSTEM_PROMPT = [
+  "You decide whether a coding-agent tool request can be auto-allowed.",
+  "Reply with exactly one word, with no punctuation: \"allow\" or \"ask\".",
+  "If uncertain, reply \"ask\".",
+].join(" ");
+
+export function buildClassifierInstructions(
+  context: string,
+  allowCriteria: string
+): string {
+  return [
+    `A request can be \"allow\" if it meets this criteria: ${allowCriteria}.`,
+    "",
+    `Classify the following request:\n${context}`,
+  ].join("\n");
+}
+
 export const PURPOSE_SYSTEM_PROMPT = [
   "You summarize the purpose of coding-agent tool requests for a permission prompt.",
   "Be as concise and neutral as possible.",
@@ -102,9 +144,6 @@ export function buildWildcardInstructions(command: string): string {
   ].join("\n");
 }
 
-/**
- * Builds instructions for generating one wildcard per command in a simple list.
- */
 export function buildWildcardListInstructions(commands: readonly string[]): string {
   return [
     "Create a permission wildcard for each command below.",
@@ -123,9 +162,7 @@ export function buildWildcardListInstructions(commands: readonly string[]): stri
  */
 export function formatDenyReason(request: PermissionRequest, policy: PolicyResolution): string {
   const subject = describeBlockedSubject(request, true);
-  const chainedNote = request.bashAnalysis?.isComplex ? ` ${CHAINED_BASH_NOTE}` : "";
-
-  return `Permission denied for ${subject}. Policy: ${describePolicy(policy)}.${chainedNote} Hard stop: do not retry or investigate a bypass. Report the denial to the user.`;
+  return `Permission denied for ${subject}. Policy: ${describePolicy(policy)}. Hard stop: do not retry or investigate a bypass. Report the denial to the user.`;
 }
 
 /**

package/src/types.ts

@@ -22,8 +22,12 @@ export function toPermissionState(value: unknown): PermissionState | undefined {
 export type PermissionSection = Record<string, PermissionState>;
 
 export interface PermissionSettings {
+  /** Tells the local config to ignore global permission sections. */
+  ignore_global?: boolean;
   /** `provider/model-id` override for small helper completions. */
   ai_model?: string;
+  /** Criteria prompt override for what "auto" may allow. */
+  auto_allow_criteria?: string;
 }
 
 export interface PermissionConfig {

package/src/ui-strings.ts

@@ -7,6 +7,7 @@ import { resolveAllowAlwaysMode } from "./policy-bash.ts";
 import type { PermissionRequest, PolicyResolution } from "./types.ts";
 
 export const STATUS_SUMMARIZING_REQUEST = "Summarizing permission request...";
+export const STATUS_CLASSIFYING_REQUEST = "Classifying permission request...";
 export const STATUS_GENERATING_WILDCARD = "Generating bash wildcard...";
 
 export const PERMISSION_DIALOG_TITLE = "Permission Required";

package/src/warning-strings.ts

@@ -11,6 +11,12 @@ export const IGNORED_SETTINGS_WARNING =
   'Ignoring "settings": expected an object.';
 export const IGNORED_AI_MODEL_WARNING =
   'Ignoring "settings.ai_model": expected a string like "provider/model-id".';
+export const IGNORED_AUTO_ALLOW_CRITERIA_WARNING =
+  'Ignoring "settings.auto_allow_criteria": expected a non-empty string.';
+export const IGNORED_IGNORE_GLOBAL_WARNING =
+  'Ignoring "settings.ignore_global": expected a boolean.';
+export const IGNORED_IGNORE_GLOBAL_LOCAL_ONLY_WARNING =
+  'Ignoring "settings.ignore_global": this setting is only valid in local config.';
 
 export const WILDCARD_LENGTH_REASON =
   "Pattern must be between 1 and 500 characters.";