@diegopetrucci/pi-extensions 0.1.55 → 0.1.57

package/extensions/permission-gate/.pi-fleet-tested-version

@@ -1 +1 @@
-0.80.3
+0.80.6

package/extensions/permission-gate/README.md

@@ -1,6 +1,6 @@
 # permission-gate
 
-A small pi extension that prompts for confirmation before running potentially dangerous bash commands.
+A small pi extension that prompts for confirmation before running potentially dangerous bash commands or writing to protected paths.
 
 This is adapted from the original `permission-gate.ts` example in [`earendil-works/pi-mono`](https://github.com/earendil-works/pi-mono/blob/main/packages/coding-agent/examples/extensions/permission-gate.ts) and kept basically the same.
 
@@ -9,8 +9,14 @@ This is adapted from the original `permission-gate.ts` example in [`earendil-wor
 - `rm -rf`
 - `sudo`
 - `chmod` / `chown` with `777`
+- direct `write` / `edit` calls touching normalized protected paths:
+  - exact `.git` path segments
+  - exact `node_modules` path segments
+  - secret-bearing `.env` files such as `.env` and `.env.production`
 
-If pi is running without an interactive UI, it blocks matching commands by default.
+Safe `.env` templates/examples such as `.env.example` and `.env.production.template` are allowed.
+
+If pi is running without an interactive UI, it blocks matching commands and protected path writes by default.
 
 ## Install
 
@@ -41,5 +47,6 @@ Then reload pi:
 ## Notes
 
 - Hooks the `tool_call` event.
-- Only inspects the `bash` tool.
-- Prompts with a simple `Yes` / `No` selector before allowing dangerous commands.
+- Inspects `bash`, `write`, and `edit` tool calls.
+- Normalizes relative/absolute paths before matching so traversal tricks do not bypass the guard.
+- Prompts with a simple `Yes` / `No` selector before allowing dangerous commands or protected path writes.

package/extensions/permission-gate/index.ts

@@ -1,36 +1,175 @@
 /**
  * Permission Gate Extension
  *
- * Prompts for confirmation before running potentially dangerous bash commands.
- * Patterns checked: rm -rf, sudo, chmod/chown 777
+ * Prompts for confirmation before running potentially dangerous bash commands
+ * or modifying protected paths via write/edit.
+ * Protected paths include exact .git and node_modules path segments plus
+ * secret-bearing .env files (excluding example/template variants).
  */
 
+import * as path from "node:path";
+
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 
-export default function (pi: ExtensionAPI) {
-	const dangerousPatterns = [/\brm\s+(-rf?|--recursive)/i, /\bsudo\b/i, /\b(chmod|chown)\b.*777/i];
+const dangerousPatterns = [/\brm\s+(-rf?|--recursive)/i, /\bsudo\b/i, /\b(chmod|chown)\b.*777/i];
+const protectedPathSegments = new Set([".git", "node_modules"]);
+const safeEnvSuffixes = new Set(["example", "examples", "template", "templates"]);
+
+type GuardDecision = { block: true; reason: string } | undefined;
+type NormalizedPath = {
+	original: string;
+	displayPath: string;
+	segments: string[];
+	basename: string;
+};
+
+type WriteInput = { path: string; content: string };
+type EditInput = { path: string; edits: Array<{ oldText: string; newText: string }> };
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+	return !!value && typeof value === "object" && !Array.isArray(value);
+}
+
+function normalizeToolPath(rawPath: string): NormalizedPath | undefined {
+	const trimmed = rawPath.trim();
+	if (!trimmed) return undefined;
+
+	// Pi's built-in path tools treat a leading @ as path syntax and strip it
+	// before execution, so inspect the same effective target.
+	const withoutPathSigil = trimmed.startsWith("@") ? trimmed.slice(1) : trimmed;
+	if (!withoutPathSigil) return undefined;
+
+	const withPosixSeparators = withoutPathSigil.replace(/\\+/g, "/");
+	const normalizedPath = path.posix.normalize(
+		withPosixSeparators.startsWith("/") ? withPosixSeparators : path.posix.join("/", withPosixSeparators),
+	);
+	const segments = normalizedPath.split("/").filter(Boolean);
+	const basename = segments.at(-1) ?? "";
+
+	return {
+		original: rawPath,
+		displayPath: withPosixSeparators,
+		segments,
+		basename,
+	};
+}
+
+function isSafeEnvTemplate(basename: string): boolean {
+	const normalizedBasename = basename.toLowerCase();
+	if (!normalizedBasename.startsWith(".env.")) return false;
+	const terminalSuffix = normalizedBasename.split(".").at(-1) ?? "";
+	return safeEnvSuffixes.has(terminalSuffix);
+}
+
+function isProtectedEnvFile(basename: string): boolean {
+	const normalizedBasename = basename.toLowerCase();
+	if (normalizedBasename === ".env") return true;
+	if (!normalizedBasename.startsWith(".env.")) return false;
+	return !isSafeEnvTemplate(normalizedBasename);
+}
+
+function isProtectedPath(normalizedPath: NormalizedPath): boolean {
+	if (normalizedPath.segments.some((segment) => protectedPathSegments.has(segment.toLowerCase()))) return true;
+	return isProtectedEnvFile(normalizedPath.basename);
+}
+
+function validateWriteInput(input: unknown): WriteInput | undefined {
+	if (!isRecord(input)) return undefined;
+	if (typeof input.path !== "string" || typeof input.content !== "string") return undefined;
+	if (!normalizeToolPath(input.path)) return undefined;
+	return { path: input.path, content: input.content };
+}
+
+function validateEditInput(input: unknown): EditInput | undefined {
+	if (!isRecord(input)) return undefined;
+	if (typeof input.path !== "string" || !Array.isArray(input.edits)) return undefined;
+	if (!normalizeToolPath(input.path)) return undefined;
 
+	const edits = input.edits;
+	if (
+		edits.some(
+			(edit) =>
+				!isRecord(edit) || typeof edit.oldText !== "string" || typeof edit.newText !== "string",
+		)
+	) {
+		return undefined;
+	}
+
+	return {
+		path: input.path,
+		edits: edits as Array<{ oldText: string; newText: string }>,
+	};
+}
+
+async function confirmProtectedPathAction(
+	toolName: "write" | "edit",
+	normalizedPath: NormalizedPath,
+	ctx: { hasUI?: boolean; ui?: { select(prompt: string, options: string[]): Promise<string | undefined> } },
+): Promise<GuardDecision> {
+	if (!isProtectedPath(normalizedPath)) return undefined;
+	if (!ctx.hasUI || !ctx.ui) {
+		return { block: true, reason: `Protected path blocked (${toolName} without UI confirmation): ${normalizedPath.displayPath}` };
+	}
+
+	const choice = await ctx.ui.select(
+		`⚠️ Protected path ${toolName} request:\n\n  ${normalizedPath.displayPath}\n\nAllow?`,
+		["Yes", "No"],
+	);
+
+	if (choice !== "Yes") {
+		return { block: true, reason: "Blocked by user" };
+	}
+
+	return undefined;
+}
+
+export default function (pi: ExtensionAPI) {
 	pi.on("tool_call", async (event, ctx) => {
-		if (event.toolName !== "bash") return undefined;
+		if (event.toolName === "bash") {
+			const command = event.input?.command;
+			if (typeof command !== "string" || command.trim() === "") {
+				return { block: true, reason: "Malformed bash command blocked" };
+			}
 
-		const command = event.input?.command;
-		if (typeof command !== "string" || command.trim() === "") {
-			return { block: true, reason: "Malformed bash command blocked" };
-		}
+			const isDangerous = dangerousPatterns.some((p) => p.test(command));
+
+			if (isDangerous) {
+				if (!ctx.hasUI) {
+					return { block: true, reason: "Dangerous command blocked (no UI for confirmation)" };
+				}
 
-		const isDangerous = dangerousPatterns.some((p) => p.test(command));
+				const choice = await ctx.ui.select(`⚠️ Dangerous command:\n\n  ${command}\n\nAllow?`, ["Yes", "No"]);
 
-		if (isDangerous) {
-			if (!ctx.hasUI) {
-				// In non-interactive mode, block by default
-				return { block: true, reason: "Dangerous command blocked (no UI for confirmation)" };
+				if (choice !== "Yes") {
+					return { block: true, reason: "Blocked by user" };
+				}
 			}
 
-			const choice = await ctx.ui.select(`⚠️ Dangerous command:\n\n  ${command}\n\nAllow?`, ["Yes", "No"]);
+			return undefined;
+		}
 
-			if (choice !== "Yes") {
-				return { block: true, reason: "Blocked by user" };
+		if (event.toolName === "write") {
+			const input = validateWriteInput(event.input);
+			if (!input) {
+				return { block: true, reason: "Malformed write input blocked" };
+			}
+			const normalizedPath = normalizeToolPath(input.path);
+			if (!normalizedPath) {
+				return { block: true, reason: "Malformed write input blocked" };
+			}
+			return confirmProtectedPathAction("write", normalizedPath, ctx);
+		}
+
+		if (event.toolName === "edit") {
+			const input = validateEditInput(event.input);
+			if (!input) {
+				return { block: true, reason: "Malformed edit input blocked" };
+			}
+			const normalizedPath = normalizeToolPath(input.path);
+			if (!normalizedPath) {
+				return { block: true, reason: "Malformed edit input blocked" };
 			}
+			return confirmProtectedPathAction("edit", normalizedPath, ctx);
 		}
 
 		return undefined;

package/extensions/permission-gate/package.json

@@ -1,12 +1,14 @@
 {
   "name": "@diegopetrucci/pi-permission-gate",
-  "version": "0.1.5",
-  "description": "A pi extension that prompts before dangerous bash commands.",
+  "version": "0.1.7",
+  "description": "A pi extension that prompts before dangerous bash commands and protected file writes.",
   "keywords": [
     "pi-package",
     "pi",
     "security",
-    "bash"
+    "bash",
+    "permissions",
+    "file-safety"
   ],
   "license": "MIT",
   "repository": {

package/extensions/quiet-tools/.pi-fleet-tested-version

@@ -1 +1 @@
-0.80.3
+0.80.6

package/extensions/quiet-tools/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diegopetrucci/pi-quiet-tools",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "A pi extension that visually compacts collapsed built-in tool rows in the TUI without changing tool results sent to the model.",
   "keywords": [
     "pi-package",

package/extensions/review/.pi-fleet-tested-version

@@ -1 +1 @@
-0.80.3
+0.80.6

package/extensions/review/README.md

@@ -31,7 +31,7 @@ Then reload pi:
 
 - Behavior is intentionally kept equivalent to the upstream source, with only packaging/attribution changes for this repository.
 - PR review requires `gh` access and a clean working tree for tracked files.
-- If the project is trusted and a `REVIEW_GUIDELINES.md` file exists next to the repo's `.pi` directory, its contents are appended to the review prompt.
+- If the project is trusted and a `REVIEW_GUIDELINES.md` file exists next to the repo's `<pi-config-dir>` directory, its contents are appended to the review prompt. `<pi-config-dir>` is Pi's runtime config directory name (`CONFIG_DIR_NAME`; `.pi` by default).
 
 ## License and attribution
 

package/extensions/review/index.ts

@@ -29,14 +29,14 @@
  * - `/review --extra "focus on performance regressions"` - add extra review instruction (works with any mode)
  *
  * Project-specific review guidelines:
- * - If the project is trusted and a REVIEW_GUIDELINES.md file exists in the
- *   same directory as .pi, its contents are appended to the review prompt.
+ * - If the project is trusted and a REVIEW_GUIDELINES.md file exists next to
+ *   the project config directory, its contents are appended to the review prompt.
  *
  * Note: PR review requires a clean working tree (no uncommitted changes to tracked files).
  */
 
 import type { ExtensionAPI, ExtensionContext, ExtensionCommandContext } from "@earendil-works/pi-coding-agent";
-import { DynamicBorder, BorderedLoader } from "@earendil-works/pi-coding-agent";
+import { CONFIG_DIR_NAME, DynamicBorder, BorderedLoader } from "@earendil-works/pi-coding-agent";
 import {
 	Container,
 	fuzzyFilter,
@@ -49,7 +49,6 @@ import {
 import path from "node:path";
 import { promises as fs } from "node:fs";
 
-const CONFIG_DIR_NAME = ".pi";
 
 // State to track fresh session review (where we branched from).
 // Module-level state means only one review can be active at a time.
@@ -1089,6 +1088,7 @@ export const __test__ = {
 	parsePrReference,
 	parseReviewPaths,
 	REVIEW_SUMMARY_PROMPT,
+	loadProjectReviewGuidelines,
 	resetReviewRuntimeState,
 	tokenizeArgs,
 };

package/extensions/review/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diegopetrucci/pi-review",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "description": "A standalone pi extension that adds /review and /end-review commands adapted from mitsuhiko/agent-stuff.",
   "keywords": [
     "pi-package",

package/extensions/todo/.pi-fleet-tested-version

@@ -1 +1 @@
-0.80.3
+0.80.6

package/extensions/todo/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diegopetrucci/pi-todo",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "description": "A pi extension that adds a branch-aware todo tool and /todos viewer.",
   "keywords": [
     "pi-package",

package/extensions/triage-comments/.pi-fleet-tested-version

@@ -1 +1 @@
-0.80.3
+0.80.6

package/extensions/triage-comments/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diegopetrucci/pi-triage-comments",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "A pi extension that adds /triage-comments and a read-only triage_comments subagent tool for review-comment triage.",
   "keywords": [
     "pi-package",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diegopetrucci/pi-extensions",
-  "version": "0.1.55",
+  "version": "0.1.57",
   "description": "A collection of pi extensions and skills for annotation UIs, context management, workflow audits, contrarian review, review-comment triage, notifications, brrr push alerts, safety guards, GitHub research, repo-local knowledge, todos, tool rendering, model/provider helpers, and Xiaohei-style article illustrations.",
   "keywords": [
     "pi-package",
@@ -71,17 +71,20 @@
     ]
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "^0.80.3",
-    "@earendil-works/pi-coding-agent": "^0.80.3",
-    "@earendil-works/pi-tui": "^0.80.3",
+    "@earendil-works/pi-ai": "^0.80.6",
+    "@earendil-works/pi-coding-agent": "^0.80.6",
+    "@earendil-works/pi-tui": "^0.80.6",
     "@types/node": "^25.9.1",
     "husky": "^9.1.7",
-    "typebox": "^1.1.38",
+    "typebox": "^1.3.6",
     "typescript": "^6.0.3"
   },
   "dependencies": {
-    "@tailwindcss/browser": "^4.3.0",
+    "@tailwindcss/browser": "^4.3.2",
     "glimpseui": "^0.8.1",
     "monaco-editor": "0.52.2"
+  },
+  "overrides": {
+    "protobufjs": "^7.6.4"
   }
 }