@diegopetrucci/pi-extensions 0.1.74 → 0.1.78

package/extensions/oracle/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diegopetrucci/pi-oracle",
-  "version": "0.1.29",
+  "version": "0.1.31",
   "description": "An Amp-style oracle extension for pi that consults the strongest reasoning model on your current provider.",
   "keywords": [
     "pi-package",

package/extensions/permission-gate/README.md

@@ -17,6 +17,8 @@ This started from the original `permission-gate.ts` example in [`earendil-works/
 
 Safe `.env` templates/examples such as `.env.example` and `.env.production.template` are allowed.
 
+Write and edit paths are resolved the same way Pi's built-in tools do — including `file:` URL decoding (percent-encoded paths like `file:///…/%2Eenv` are decoded before checking), `~` and `~/` tilde expansion, Unicode space normalisation, and resolution of relative paths against `ctx.cwd`. Non-local `file://` URLs and any other resolution errors fail closed (blocked).
+
 If pi is running without an interactive UI, it blocks matching commands and protected path writes by default.
 
 For Pi's built-in local Windows PowerShell tool, commands that pass the fast lexical checks are also parsed with the same PowerShell installation's AST parser before execution. Malformed input, parser failures, `Remove-Item` parameter splatting, command-resolution changes (aliases/modules/providers/direct function or filter definitions), known script/process/job/member invocation wrappers, computed member calls, and analyzer inputs above 16,000 UTF-8 bytes are treated conservatively and require confirmation (or are blocked when no UI is available). Computed targets passed to provider-capable mutation commands also require confirmation because the target could resolve to `Alias:` or `Function:`. Literal quoted/commented examples, including literal here-strings, stay benign. Definitely enabled `-WhatIf` removals (`-WhatIf`, `-WhatIf:$true`, or `-WhatIf:1`) remain non-destructive and are allowed; computed switch values require confirmation.
@@ -63,4 +65,5 @@ Then reload pi:
 - Inspects `bash`, `powershell`, `write`, and `edit` tool calls.
 - Validates shell timeouts as well as command strings and fails closed on malformed calls.
 - Normalizes relative/absolute paths before matching so traversal tricks do not bypass the guard.
+- Resolves write and edit paths like Pi's built-in tools (file URLs, `~` expansion, cwd) so percent-encoded URLs, tilde paths, and cwd-relative paths inside protected directories are all caught.
 - Prompts with a simple `Yes` / `No` selector before allowing dangerous commands or protected path writes.