@erichll/pi-auto-review 0.18.2 → 0.18.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +23 -0
- package/README.md +12 -1
- package/package.json +5 -5
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,28 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## 0.18.3 - 2026-09-20
|
|
4
|
+
|
|
5
|
+
- Move the `@gotgenes/pi-permission-system` development dependency to
|
|
6
|
+
`^33.0.1` and refresh the type-check/test surface to Pi `^0.85.1`.
|
|
7
|
+
- Add an MCP rule-semantics regression test that locks the 33.x behavior this
|
|
8
|
+
package depends on: a prefix-named tool such as `atlassian_getJiraIssue`
|
|
9
|
+
derives its bare server (`atlassian`) as a candidate instead of an
|
|
10
|
+
unmatchable double-prefixed alias, and MCP rules are evaluated
|
|
11
|
+
last-match-wins across those candidates. A ruleset that puts
|
|
12
|
+
`"*": "allow"` before `"atlassian": "deny"` now denies such a call, and the
|
|
13
|
+
reviewer is shown the tool name as the boundary value.
|
|
14
|
+
- Sync `examples/pi-permission-system.config.example.json` with the live
|
|
15
|
+
baseline: add the `mcp__atlassian` namespace-proxy allow and drop the
|
|
16
|
+
redundant bare `atlassian` allow (after 33.0.0 its only reachable effect was
|
|
17
|
+
silently allowing `mcp connect atlassian`, which starts the server). Ordinary
|
|
18
|
+
`atlassian` / `jira` / `confluence` tool calls stay allowed.
|
|
19
|
+
- No runtime behavior change in this package: the public authorizer API it
|
|
20
|
+
consumes and the normalized evidence shape are unchanged, and the peer range
|
|
21
|
+
stays `>=30.0.0`. The bump only moves the development surface, so MCP rule
|
|
22
|
+
semantics come from the installed permission-system (33.0.0 made
|
|
23
|
+
prefix-named tools resolve to their bare server and evaluated MCP rules
|
|
24
|
+
last-match-wins).
|
|
25
|
+
|
|
3
26
|
## 0.18.2 - 2026-09-17
|
|
4
27
|
|
|
5
28
|
- Treat empty or whitespace-only `.pi/pi-auto-review.json` files as missing
|
package/README.md
CHANGED
|
@@ -31,7 +31,8 @@ that dependency is a hard prerequisite (see [Install and enable](#install-and-en
|
|
|
31
31
|
> **Prerequisite:** pi-auto-review is an authorizer inside
|
|
32
32
|
> `@gotgenes/pi-permission-system`. Pi does not auto-install peer packages, so
|
|
33
33
|
> install the permission system separately (once per machine) before this
|
|
34
|
-
> extension. This release line supports permission-system 30.0.0 and later
|
|
34
|
+
> extension. This release line supports permission-system 30.0.0 and later,
|
|
35
|
+
> validated through 33.0.1:
|
|
35
36
|
|
|
36
37
|
Node.js 22.13.0 or newer is required. Permission auditing uses Node's built-in
|
|
37
38
|
`node:sqlite`; it does not require a SQLite CLI, system SQLite library, or npm
|
|
@@ -117,6 +118,16 @@ read/write/edit, a read-only bash allowlist, an MCP discovery policy, and a
|
|
|
117
118
|
`path` deny block for secret and credential files — see
|
|
118
119
|
[`examples/pi-permission-system.config.example.json`](examples/pi-permission-system.config.example.json).
|
|
119
120
|
|
|
121
|
+
MCP rules are evaluated last-match-wins across the candidates derived for one
|
|
122
|
+
call: the tool name, its bare server, and `mcp_call`. Keep `"*"` first in the
|
|
123
|
+
`mcp` block and narrower server or tool entries after it, as the example does,
|
|
124
|
+
so a specific rule cannot be shadowed by the catch-all. A bare server entry
|
|
125
|
+
such as `"atlassian": "allow"` also matches the `mcp connect <server>`
|
|
126
|
+
candidate list, so it auto-allows starting that server — prefer the `server_*`
|
|
127
|
+
and `server:*` forms for tool calls. Any entry meant to narrow a broad allow
|
|
128
|
+
(such as a destructive-tool pattern) must be written after it, or
|
|
129
|
+
last-match-wins shadows it.
|
|
130
|
+
|
|
120
131
|
Package defaults:
|
|
121
132
|
|
|
122
133
|
```json
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@erichll/pi-auto-review",
|
|
3
|
-
"version": "0.18.
|
|
3
|
+
"version": "0.18.3",
|
|
4
4
|
"description": "Fail-closed, model-backed approval broker for Pi: deterministically hard-denies dangerous operations, reviews dangerous boundaries with a reviewer model, and issues one-shot expiring grants that OS sandbox adapters must consume before retrying.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"license": "MIT",
|
|
@@ -52,10 +52,10 @@
|
|
|
52
52
|
"@gotgenes/pi-permission-system": ">=30.0.0"
|
|
53
53
|
},
|
|
54
54
|
"devDependencies": {
|
|
55
|
-
"@earendil-works/pi-ai": "^0.85.
|
|
56
|
-
"@earendil-works/pi-coding-agent": "^0.85.
|
|
57
|
-
"@earendil-works/pi-server": "^0.85.
|
|
58
|
-
"@gotgenes/pi-permission-system": "
|
|
55
|
+
"@earendil-works/pi-ai": "^0.85.1",
|
|
56
|
+
"@earendil-works/pi-coding-agent": "^0.85.1",
|
|
57
|
+
"@earendil-works/pi-server": "^0.85.1",
|
|
58
|
+
"@gotgenes/pi-permission-system": "^33.0.1",
|
|
59
59
|
"@types/node": "^26.2.0",
|
|
60
60
|
"typescript": "^6.0.3"
|
|
61
61
|
}
|