@diegopetrucci/pi-review 0.1.2 → 0.1.4

package/.pi-fleet-tested-version

@@ -1 +1 @@
-0.78.0
+0.79.10

package/README.md

@@ -31,7 +31,7 @@ Then reload pi:
 
 - Behavior is intentionally kept equivalent to the upstream source, with only packaging/attribution changes for this repository.
 - PR review requires `gh` access and a clean working tree for tracked files.
-- If a `REVIEW_GUIDELINES.md` file exists next to the repo's `.pi` directory, its contents are appended to the review prompt.
+- If the project is trusted and a `REVIEW_GUIDELINES.md` file exists next to the repo's `.pi` directory, its contents are appended to the review prompt.
 
 ## License and attribution
 

package/index.ts

@@ -29,8 +29,8 @@
  * - `/review --extra "focus on performance regressions"` - add extra review instruction (works with any mode)
  *
  * Project-specific review guidelines:
- * - If a REVIEW_GUIDELINES.md file exists in the same directory as .pi,
- *   its contents are appended to the review prompt.
+ * - If the project is trusted and a REVIEW_GUIDELINES.md file exists in the
+ *   same directory as .pi, its contents are appended to the review prompt.
  *
  * Note: PR review requires a clean working tree (no uncommitted changes to tracked files).
  */
@@ -49,6 +49,8 @@ import {
 import path from "node:path";
 import { promises as fs } from "node:fs";
 
+const CONFIG_DIR_NAME = ".pi";
+
 // State to track fresh session review (where we branched from).
 // Module-level state means only one review can be active at a time.
 // This is intentional - the UI and /end-review command assume a single active review.
@@ -75,6 +77,15 @@ type ReviewSettingsState = {
 	customInstructions?: string;
 };
 
+type ProjectConfigContext = {
+	cwd: string;
+	isProjectTrusted?: () => boolean;
+};
+
+function canReadProjectConfig(ctx: ProjectConfigContext): boolean {
+	return typeof ctx.isProjectTrusted === "function" && ctx.isProjectTrusted();
+}
+
 function setReviewWidget(ctx: ExtensionContext, active: boolean) {
 	if (!ctx.hasUI) return;
 	if (!active) {
@@ -501,7 +512,7 @@ async function loadProjectReviewGuidelines(cwd: string): Promise<string | null>
 	let currentDir = path.resolve(cwd);
 
 	while (true) {
-		const piDir = path.join(currentDir, ".pi");
+		const piDir = path.join(currentDir, CONFIG_DIR_NAME);
 		const guidelinesPath = path.join(currentDir, "REVIEW_GUIDELINES.md");
 
 		const piStats = await fs.stat(piDir).catch(() => null);
@@ -1420,7 +1431,7 @@ export default function reviewExtension(pi: ExtensionAPI) {
 			includeLocalChanges: options?.includeLocalChanges === true,
 		});
 		const hint = getUserFacingHint(target);
-		const projectGuidelines = await loadProjectReviewGuidelines(ctx.cwd);
+		const projectGuidelines = canReadProjectConfig(ctx) ? await loadProjectReviewGuidelines(ctx.cwd) : null;
 
 		// Combine the review rubric with the specific prompt
 		let fullPrompt = `${REVIEW_RUBRIC}\n\n---\n\nPlease perform a code review with the following focus:\n\n${prompt}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diegopetrucci/pi-review",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "A standalone pi extension that adds /review and /end-review commands adapted from mitsuhiko/agent-stuff.",
   "keywords": [
     "pi-package",