@erichll/pi-auto-review 0.18.1 → 0.18.3

package/CHANGELOG.md

@@ -1,5 +1,39 @@
 # Changelog
 
+## 0.18.3 - 2026-09-20
+
+- Move the `@gotgenes/pi-permission-system` development dependency to
+  `^33.0.1` and refresh the type-check/test surface to Pi `^0.85.1`.
+- Add an MCP rule-semantics regression test that locks the 33.x behavior this
+  package depends on: a prefix-named tool such as `atlassian_getJiraIssue`
+  derives its bare server (`atlassian`) as a candidate instead of an
+  unmatchable double-prefixed alias, and MCP rules are evaluated
+  last-match-wins across those candidates. A ruleset that puts
+  `"*": "allow"` before `"atlassian": "deny"` now denies such a call, and the
+  reviewer is shown the tool name as the boundary value.
+- Sync `examples/pi-permission-system.config.example.json` with the live
+  baseline: add the `mcp__atlassian` namespace-proxy allow and drop the
+  redundant bare `atlassian` allow (after 33.0.0 its only reachable effect was
+  silently allowing `mcp connect atlassian`, which starts the server). Ordinary
+  `atlassian` / `jira` / `confluence` tool calls stay allowed.
+- No runtime behavior change in this package: the public authorizer API it
+  consumes and the normalized evidence shape are unchanged, and the peer range
+  stays `>=30.0.0`. The bump only moves the development surface, so MCP rule
+  semantics come from the installed permission-system (33.0.0 made
+  prefix-named tools resolve to their bare server and evaluated MCP rules
+  last-match-wins).
+
+## 0.18.2 - 2026-09-17
+
+- Treat empty or whitespace-only `.pi/pi-auto-review.json` files as missing
+  configuration instead of throwing `SyntaxError`. This prevents `session_start`
+  from disabling automatic reviews for an entire session when Linux bubblewrap
+  creates a 0-byte mount point stub for deny-write paths (fixes #6).
+- Apply the same empty-file tolerance to the user-global config loader.
+- Remove redundant files from `protectedFiles` in `guards.ts` (`settings.json`,
+  `permissions.json`, and unused `sandbox.json`) so workspaces can configure
+  standard settings without triggering security tampering hard-denials.
+
 ## 0.18.1 - 2026-09-11
 
 - Animate the live `reviewing` label in the above-editor widget with a

package/README.md

@@ -31,7 +31,8 @@ that dependency is a hard prerequisite (see [Install and enable](#install-and-en
 > **Prerequisite:** pi-auto-review is an authorizer inside
 > `@gotgenes/pi-permission-system`. Pi does not auto-install peer packages, so
 > install the permission system separately (once per machine) before this
-> extension. This release line supports permission-system 30.0.0 and later:
+> extension. This release line supports permission-system 30.0.0 and later,
+> validated through 33.0.1:
 
 Node.js 22.13.0 or newer is required. Permission auditing uses Node's built-in
 `node:sqlite`; it does not require a SQLite CLI, system SQLite library, or npm
@@ -117,6 +118,16 @@ read/write/edit, a read-only bash allowlist, an MCP discovery policy, and a
 `path` deny block for secret and credential files — see
 [`examples/pi-permission-system.config.example.json`](examples/pi-permission-system.config.example.json).
 
+MCP rules are evaluated last-match-wins across the candidates derived for one
+call: the tool name, its bare server, and `mcp_call`. Keep `"*"` first in the
+`mcp` block and narrower server or tool entries after it, as the example does,
+so a specific rule cannot be shadowed by the catch-all. A bare server entry
+such as `"atlassian": "allow"` also matches the `mcp connect <server>`
+candidate list, so it auto-allows starting that server — prefer the `server_*`
+and `server:*` forms for tool calls. Any entry meant to narrow a broad allow
+(such as a destructive-tool pattern) must be written after it, or
+last-match-wins shadows it.
+
 Package defaults:
 
 ```json

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@erichll/pi-auto-review",
-  "version": "0.18.1",
+  "version": "0.18.3",
   "description": "Fail-closed, model-backed approval broker for Pi: deterministically hard-denies dangerous operations, reviews dangerous boundaries with a reviewer model, and issues one-shot expiring grants that OS sandbox adapters must consume before retrying.",
   "type": "module",
   "license": "MIT",
@@ -52,10 +52,10 @@
     "@gotgenes/pi-permission-system": ">=30.0.0"
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "^0.85.0",
-    "@earendil-works/pi-coding-agent": "^0.85.0",
-    "@earendil-works/pi-server": "^0.85.0",
-    "@gotgenes/pi-permission-system": "31.1.1",
+    "@earendil-works/pi-ai": "^0.85.1",
+    "@earendil-works/pi-coding-agent": "^0.85.1",
+    "@earendil-works/pi-server": "^0.85.1",
+    "@gotgenes/pi-permission-system": "^33.0.1",
     "@types/node": "^26.2.0",
     "typescript": "^6.0.3"
   }

package/src/review/config.ts

@@ -241,7 +241,13 @@ export function loadTrustedConfig(
   const path = options.userConfigPath ?? userConfigPath();
   let value: unknown;
   try {
-    value = JSON.parse(readFileSync(path, "utf8"));
+    const content = readFileSync(path, "utf8");
+    if (!content.trim()) {
+      // Treat empty/whitespace-only file the same as missing — sandbox
+      // runtime may leave 0-byte mount-point stubs for denyWrite paths.
+      return packageConfig;
+    }
+    value = JSON.parse(content);
   } catch (error) {
     if (
       error &&

package/src/review/guards.ts

@@ -31,12 +31,7 @@ export function protectedWriteHardDeny(
     join(agentDir, "extensions", "pi-auto-review"),
   ];
   const protectedFiles = [
-    join(request.cwd, ".pi", "settings.json"),
-    join(request.cwd, ".pi", "sandbox.json"),
     join(request.cwd, PROJECT_CONFIG_PATH),
-    join(agentDir, "settings.json"),
-    join(agentDir, "permissions.json"),
-    join(agentDir, "sandbox.json"),
     userConfigPath(),
   ];
   if (

package/src/review/input.ts

@@ -39,7 +39,13 @@ export function sessionConfig(
   const projectPath = join(cwd, PROJECT_CONFIG_PATH);
   let raw: unknown;
   try {
-    raw = JSON.parse(readFileSync(projectPath, "utf8"));
+    const content = readFileSync(projectPath, "utf8");
+    if (!content.trim()) {
+      // Treat empty/whitespace-only file the same as missing — sandbox
+      // runtime may leave 0-byte mount-point stubs for denyWrite paths.
+      return Object.freeze({ ...trusted });
+    }
+    raw = JSON.parse(content);
   } catch (error) {
     if (
       error &&