@dreki-gg/pi-plan-mode 0.14.5 → 0.15.0

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # @dreki-gg/pi-plan-mode
 
+## 0.15.0
+
+### Minor Changes
+
+- Restrict write/edit tools to .plans/ directory only during plan phase. Add isPlanPath utility. Update prompt to document --help/man support and write restrictions.
+
+### Patch Changes
+
+- Updated dependencies []:
+  - @dreki-gg/pi-command-sandbox@0.3.0
+
 ## 0.14.5
 
 ### Patch Changes

package/extensions/plan-mode/__tests__/utils.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from 'bun:test';
-import { isSafeCommand } from '../utils.js';
+import { isSafeCommand, isPlanPath } from '../utils.js';
 
 describe('isSafeCommand', () => {
   // ── Commands that SHOULD be allowed ──────────────────────────────────────
@@ -113,4 +113,61 @@ describe('isSafeCommand', () => {
       expect(isSafeCommand('touch newfile.ts')).toBe(false);
     });
   });
+
+  // ── Help/version commands via command-sandbox ────────────────────────────
+  describe('help and version commands', () => {
+    test('bun --help is allowed', () => {
+      expect(isSafeCommand('bun --help')).toBe(true);
+    });
+
+    test('man git is allowed', () => {
+      expect(isSafeCommand('man git')).toBe(true);
+    });
+
+    test('npm --version is allowed', () => {
+      expect(isSafeCommand('npm --version')).toBe(true);
+    });
+
+    test('rm --help is still blocked', () => {
+      expect(isSafeCommand('rm --help')).toBe(false);
+    });
+  });
+});
+
+describe('isPlanPath', () => {
+  test('relative .plans/ path', () => {
+    expect(isPlanPath('.plans/my-plan/context.md')).toBe(true);
+  });
+
+  test('absolute path containing .plans/', () => {
+    expect(isPlanPath('/Users/me/project/.plans/my-plan/context.md')).toBe(true);
+  });
+
+  test('just .plans/', () => {
+    expect(isPlanPath('.plans/foo')).toBe(true);
+  });
+
+  test('windows-style backslashes', () => {
+    expect(isPlanPath('.plans\\my-plan\\context.md')).toBe(true);
+  });
+
+  test('src/ path is blocked', () => {
+    expect(isPlanPath('src/index.ts')).toBe(false);
+  });
+
+  test('root file is blocked', () => {
+    expect(isPlanPath('README.md')).toBe(false);
+  });
+
+  test('package.json is blocked', () => {
+    expect(isPlanPath('package.json')).toBe(false);
+  });
+
+  test('path with plans but not .plans is blocked', () => {
+    expect(isPlanPath('src/plans/something.ts')).toBe(false);
+  });
+
+  test('path ending in .plans without slash is blocked', () => {
+    expect(isPlanPath('.plans')).toBe(false);
+  });
 });

package/extensions/plan-mode/index.ts

@@ -31,7 +31,7 @@ import { enterPlanMode, exitPlanMode, switchModel } from './phase-transitions.js
 import { resumePlan, executeInNewSession } from './resume.js';
 import { registerSubmitPlanTool } from './tools/submit-plan.js';
 import { registerUpdateTaskTool } from './tools/update-task.js';
-import { isSafeCommand } from './utils.js';
+import { isSafeCommand, isPlanPath } from './utils.js';
 
 export default function planMode(pi: ExtensionAPI): void {
   const state = new PlanModeState();
@@ -128,9 +128,11 @@ export default function planMode(pi: ExtensionAPI): void {
     },
   });
 
-  // ── Event: block destructive bash in plan mode ────────────────────────────
+  // ── Event: block destructive bash + restrict writes in plan mode ──────────
   pi.on('tool_call', async (event) => {
     if (!state.planEnabled) return;
+
+    // Block destructive bash commands
     if (event.toolName === 'bash') {
       const command = event.input.command as string;
       if (!isSafeCommand(command)) {
@@ -140,6 +142,17 @@ export default function planMode(pi: ExtensionAPI): void {
         };
       }
     }
+
+    // Restrict write to .plans/ directory only
+    if (event.toolName === 'write' || event.toolName === 'edit') {
+      const path = event.input.path as string;
+      if (!isPlanPath(path)) {
+        return {
+          block: true,
+          reason: `Plan mode: writes are restricted to .plans/ directory only.\nPath: ${path}`,
+        };
+      }
+    }
   });
 
   // ── Event: filter context ─────────────────────────────────────────────────

package/extensions/plan-mode/prompts.ts

@@ -11,7 +11,8 @@ You are in conversational plan mode — a planning dialogue with strict bash res
 
 Restrictions:
 - Available tools: ${PLAN_TOOLS.join(', ')}
-- Bash is restricted to read-only commands (ls, grep, git status, etc.)
+- Bash is restricted to read-only commands (ls, grep, git status, etc.) and info commands (--help, -h, --version, man)
+- The write tool is restricted to .plans/ directory only — no codebase file creation or modification
 - Do NOT make product code changes during planning.
 
 Your job is to reach shared understanding before formalizing a plan:

package/extensions/plan-mode/utils.ts

@@ -23,6 +23,16 @@ function isMkdirPlans(command: string): boolean {
   return /^\s*mkdir\s+(-p\s+)?\.plans(\/|\\|\s|$)/.test(command);
 }
 
+/**
+ * Check if a file path is inside the .plans/ directory.
+ *
+ * Accepts both relative (.plans/foo) and absolute paths containing .plans/.
+ */
+export function isPlanPath(filePath: string): boolean {
+  const normalized = filePath.replace(/\\/g, '/');
+  return /(?:^|\/)?\.plans\//.test(normalized);
+}
+
 // ── Plan name utilities ─────────────────────────────────────────────────────
 
 export function toKebabCase(name: string): string {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dreki-gg/pi-plan-mode",
-  "version": "0.14.5",
+  "version": "0.15.0",
   "description": "Two-phase planning workflow for pi — plan with claude-opus-4-6:medium, execute with gpt-5.5:low, with .plans/ file-based handoff",
   "keywords": [
     "pi-package"
@@ -40,7 +40,7 @@
     ]
   },
   "dependencies": {
-    "@dreki-gg/pi-command-sandbox": "^0.2.0",
+    "@dreki-gg/pi-command-sandbox": "^0.3.0",
     "pug": "^3.0.3"
   },
   "devDependencies": {