@giuseppe.trisciuoglio/pi-prevent-destructive-commands 1.2.2 → 1.4.0

package/CHANGELOG.md

@@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- New per-project read-only mode (`/read-only on|off|status`): when enabled, every mutating tool call is blocked — `write`, `edit`, any patch-style tool (`*apply_patch`), `bash`, and `powershell` — while read-only tools (`read`, `grep`, `find`, `ls`) keep working. The flag lives in `.pi/prevent-destructive-commands.json` under `readOnly` (default `false` when the file is missing or invalid), `/read-only` toggles it while preserving unrelated JSON keys, and it is independent of the destructive-command, git, migration, Nx, and comment guards. Adds `test/read-only-command-test.ts` (`npm run test:read-only-command`) and `docs/adr/0001-read-only-mode.md`.
 - New guard: new comments in source files are blocked. Any tool call that would introduce a new comment into a source file (Java, TypeScript/JavaScript, Dart, Go, Rust, C/C++, C#, Swift, Kotlin, Scala, PHP, CSS/SCSS, Python, Ruby, shell, YAML, TOML, Terraform, GraphQL, SQL, Lua, Haskell, Elm, HTML/XML/SVG/Markdown) is stopped, covering `write`, `edit`, `apply_patch` (unified diff and `*** Begin Patch` formats), and bash write vectors (`cat > a.ts <<EOF`, `tee b.py <<EOF`, `echo "// x" >> c.ts`). Detection is string-aware (comment markers inside string literals are not comments), comments a file already contains may be carried over untouched, and shebang lines, tooling directives (`@ts-ignore`, `eslint-disable`, `biome-ignore`, `noqa`, …) and purely decorative lines are exempt. Opt out per project with `{"disableCommentGuard": true}` in the opt-out file. Adds `test/comment-guard-test.ts` (`npm run test:comment-guard`).
 - New guard: interactive `git commit` without a message option (bare `git commit`, `git commit -a`, `git commit --amend`, ...) is blocked because it opens the editor and hangs the session when the agent runs unattended. Applies unconditionally, even on projects that opted out of the git add/commit/push guards; commits with a message (`git commit -m x`, `-F file`, `--amend --no-edit`, ...) are unaffected.
 

package/README.md

@@ -19,9 +19,11 @@ A faithful port of Claude's [`prevent-destructive-commands.py`](https://github.c
 - **Recursive analysis** — Traverses command wrappers, shell invocations, pipelines, and nested commands to catch obfuscated attacks.
 - **Nx configuration guard** — In Nx workspaces, existing `package.json` and TypeScript configuration files are immutable to the agent; missing ones can still be created.
 - **Source comment guard** — The agent cannot introduce new comments into source files (Java, TypeScript, Dart, Python, SQL, HTML, and more) through writing tools or bash write vectors; existing comments may be carried over untouched and tooling directives (`@ts-ignore`, `eslint-disable`, …) stay allowed.
+- **Read-only mode** — `/read-only on` turns the project into an inspection-only workspace: `write`, `edit`, patch tools, `bash`, and `powershell` are blocked while `read`, `grep`, `find`, and `ls` keep working.
+- **Workdir boundary guard** — Every file read, write, edit, and delete is confined to the working directory where pi runs. System temp directories (`/tmp`, `os.tmpdir()`) are the only exception; the temp root itself stays protected.
 - **Configurable** — Tune protection levels via simple flags in `src/config.ts`.
 - **Zero dependencies** — Lightweight, fast, and self-contained.
-- **79+ test cases** — Comprehensive smoke test suite validates all blocking rules.
+- **Extensive test suite** — Smoke tests plus guard-specific and slash-command tests validate every blocking rule.
 
 ## What Gets Blocked
 
@@ -37,6 +39,7 @@ All rules are defined in [`src/config.ts`](src/config.ts) and can be customized.
 | **Destructive Docker** | `docker rm` / `rmi`, `docker container/image/volume/network rm`, `docker * prune`, `docker compose down -v`, `docker compose rm`, `docker context rm`, `docker swarm leave --force` |
 | **Destructive GitHub CLI** | `gh api -X DELETE` / `gh api --method DELETE`, `gh repo delete` / `rename`, `gh release delete`, `gh gist delete`, `gh secret delete`, `gh variable delete`, `gh label delete`, `gh workflow disable`, `gh run delete` |
 | **Destructive AWS CLI** | `aws s3 rm`, `aws ec2 terminate-instances`, `aws rds delete-db-instance`, `aws cloudformation delete-stack`, and 50+ more subcommands (full list in `src/config.ts`) |
+| **Paths outside the workdir** | Any tool or bash command touching a path that resolves outside the working directory: `cat /etc/passwd`, `cp ~/.ssh/id_rsa ./`, `write`/`edit` to `../outside.ts`, `apply_patch` creating files outside cwd, `cd /etc && cat passwd`. Paths under a system temp directory (`/tmp`, `os.tmpdir()`) are allowed; the temp root itself is not *(see the per-project opt-out below)* |
 | **Sensitive file reads** | `cat`, `grep`, etc. on `.env`, SSH keys, `.pem` files — **disabled by default** via `ENABLE_SENSITIVE_FILE_CHECK` *(see Configuration)* |
 | **Existing Nx configuration** | `package.json`, `tsconfig.json`, `tsconfig.base.json`, `tsconfig.lib.json`, and `tsconfig.spec.json` anywhere below a workspace containing `nx.json`. Creating a missing file is allowed; changing or deleting an existing file is blocked. |
 | **New comments in source files** | Any tool call that introduces a **new** comment into a source file: `write`/`edit`/`apply_patch` touching Java, TypeScript/JavaScript, Dart, Go, Rust, C/C++, C#, Swift, Kotlin, Scala, PHP, CSS/SCSS, Python, Ruby, shell, YAML, TOML, Terraform, GraphQL, SQL, Lua, Haskell, Elm, HTML/XML/SVG/Markdown files, plus bash write vectors (`cat > a.ts <<EOF`, `tee b.py <<EOF`, `echo "// x" >> c.ts`). Comments already in the file may be carried over; shebang lines, tooling directives (`@ts-ignore`, `eslint-disable`, `biome-ignore`, `noqa`, …) and purely decorative lines are exempt *(see the per-project opt-out below)* |
@@ -112,7 +115,9 @@ Create `.pi/prevent-destructive-commands.json` in the project root to tune the g
 ```json
 {
 	"disableGitGuards": true,
-	"disableCommentGuard": true
+	"disableCommentGuard": true,
+	"readOnly": false,
+	"disableWorkdirGuard": false
 }
 ```
 
@@ -120,6 +125,8 @@ Create `.pi/prevent-destructive-commands.json` in the project root to tune the g
 |------|---------|--------|
 | `disableGitGuards` | `false` | Disables the `git add` / `git commit` / `git push` guards. |
 | `disableCommentGuard` | `false` | Disables the source comment guard, allowing the agent to write comments into source files again. |
+| `readOnly` | `false` | When `true`, blocks every mutating tool call (`write`, `edit`, patch tools, `bash`, `powershell`) while read-only tools keep working. |
+| `disableWorkdirGuard` | `false` | Disables the workdir boundary guard, allowing the agent to touch paths outside the working directory again. |
 
 Or use the `/git-guards` slash command from the pi TUI:
 
@@ -129,6 +136,37 @@ Or use the `/git-guards` slash command from the pi TUI:
 | `/git-guards off` | Write `{"disableGitGuards": true}` (unrelated JSON keys are preserved). |
 | `/git-guards on` | Write `{"disableGitGuards": false}`. |
 
+### Read-Only Mode
+
+Use the `/read-only` slash command to make the project inspection-only:
+
+| Command | Effect |
+|---------|--------|
+| `/read-only` | Show whether read-only mode is active for the current project, and the state of the configuration file. |
+| `/read-only on` | Write `{"readOnly": true}` (unrelated JSON keys are preserved). |
+| `/read-only off` | Write `{"readOnly": false}`. |
+
+While read-only mode is active, the agent can inspect files with `read`, `grep`, `find`, and `ls`, but `write`, `edit`, every patch-style tool, `bash`, and `powershell` are blocked with a clear reason. Read-only mode is independent of the destructive-command, git, migration, Nx, and comment guards, and it defaults to off when the configuration file is missing or invalid.
+
+### Workdir Boundary Guard
+
+The workdir boundary guard keeps every filesystem operation inside the working directory where pi is running. It covers bash commands (including `cd` tracking inside a command chain) and the file tools (`read`, `write`, `edit`, `apply_patch`).
+
+Allowed without any opt-out:
+
+- paths inside the working directory, relative or absolute;
+- paths under a system temp directory (`/tmp`, `os.tmpdir()`), so temp files keep working.
+
+Blocked: any path resolving outside the workdir — parent traversals (`../..`), absolute paths such as `/etc/passwd`, home-directory shortcuts (`~/file`), unresolvable variables (`$HOME/x`), `cd` out of the boundary, and the temp root itself (`rm -rf /tmp`).
+
+| Command | Effect |
+|---------|--------|
+| `/workdir-guard` | Show whether the guard is active for the current project, and the state of the configuration file. |
+| `/workdir-guard off` | Write `{"disableWorkdirGuard": true}` (unrelated JSON keys are preserved). |
+| `/workdir-guard on` | Write `{"disableWorkdirGuard": false}`. |
+
+The exception for system temp directories applies to every guard, so `rm /tmp/scratch.log` and `tee /tmp/out.txt` keep working while the workdir boundary stays enforced.
+
 Notes:
 
 - Forceful and deleting push variants (`--force`, `-f`, `--force-with-lease`, `-d`, `--delete`) are **always blocked** and cannot be opted out.
@@ -147,6 +185,8 @@ prevent-destructive-commands/
 │   ├── config.ts         # Blacklists and behavior flags — tune protection here
 │   ├── tokenizer.ts      # Shell tokenizer (shlex-like)
 │   ├── checker.ts        # Recursive command walker (wrappers/shell/find/xargs)
+│   ├── read-only-command.ts # /read-only toggle and read-only tool-call gate
+│   ├── workdir-guard-command.ts # /workdir-guard toggle
 │   ├── migration-guard.ts
 │   ├── nx-guard.ts       # Protects existing Nx package and TypeScript configuration files
 │   ├── comment-guard.ts  # Blocks new comments written into source files
@@ -160,7 +200,8 @@ prevent-destructive-commands/
 │       ├── docker.ts          # docker rm, system prune, ...
 │       ├── aws.ts             # aws s3 rm, ec2 terminate-instances, ...
 │       ├── file-reading.ts    # sensitive file read detection
-│       └── path-sensitive.ts  # rm/rmdir/... outside-cwd detection
+│       ├── path-sensitive.ts  # rm/rmdir/... outside-cwd detection
+│       └── workdir-guard.ts   # workdir boundary guard (filesystem tools + bash)
 ├── test/
 │   ├── smoke-test.ts        # Standalone test suite (79+ cases)
 │   ├── helpers.ts           # Shared test utilities (check, makeProject, runCheckCases, ...)
@@ -177,7 +218,7 @@ prevent-destructive-commands/
 
 ## Testing
 
-Run the full test suite (command safety, migration, Nx, and end-to-end checks):
+Run the full test suite (command safety, migration, Nx, workdir boundary, slash commands, and end-to-end checks):
 
 ```bash
 npm test
@@ -192,12 +233,14 @@ npm run test:smoke
 npm run test:heredoc
 npm run test:nx-guard
 npm run test:comment-guard
+npm run test:workdir-guard
+npm run test:workdir-guard-command
 ```
 
-# Or directly with tsx
-npx tsx test/smoke-test.ts
+Or run a single file directly with tsx or jiti:
 
-# Or with jiti
+```bash
+npx tsx test/smoke-test.ts
 npx jiti test/smoke-test.ts
 ```
 

package/docs/adr/0001-read-only-mode.md

@@ -0,0 +1,53 @@
+# ADR 0001: Read-only mode blocks shell execution wholesale
+
+- Status: accepted
+- Date: 2026-10-23
+- Author: Giuseppe Trisciuoglio
+
+## Context
+
+The extension guards against destructive commands and protected paths, but there
+is no way to declare a project inspection-only. Users wanted a per-project flag
+that lets the agent read files and explore the codebase while preventing any
+modification. The natural home for the flag is the existing per-project
+configuration file, `.pi/prevent-destructive-commands.json`, and the `/git-guards`
+command already established the pattern of a user-invoked toggle that writes that
+file from the extension process.
+
+Tools that can mutate state are `write`, `edit`, any patch-style variant such as
+`apply_patch`, `bash`, and `powershell`. Read-only tools are `read`, `grep`,
+`find`, `ls`, and similar non-mutating tools.
+
+The open design question was whether read-only mode should keep allowing
+"obviously read-only" shell commands such as `cat`, `ls`, or `grep` invoked
+through `bash`. Classifying a shell command line as read-only is the same
+unsolved problem the destructive-command checker already deals with: commands
+can hide mutations behind wrappers, redirects, command substitution, heredocs,
+and arbitrary binaries.
+
+## Decision
+
+Read-only mode blocks `bash` and `powershell` entirely, without attempting to
+classify individual shell commands as safe. It also blocks `write`, `edit`, and
+every tool whose name ends with `apply_patch`. Read-only tools keep working.
+
+The mode is stored as a `readOnly` boolean in
+`.pi/prevent-destructive-commands.json`. It defaults to `false` when the file is
+missing or invalid, so the agent stays writable until the user explicitly turns
+it on. The `/read-only on|off|status` slash command toggles the flag while
+preserving unrelated JSON keys, mirroring `/git-guards`.
+
+When read-only mode is active, the `tool_call` handler checks it first and
+short-circuits the other write-related guards: a rejected write needs no further
+analysis.
+
+## Consequences
+
+- Inspection-only projects are safe: no shell invocation can mutate the
+  workspace while the mode is on.
+- Users lose the convenience of running read-only shell commands through `bash`
+  in read-only mode; they use `read`, `grep`, `find`, and `ls` instead.
+- The mode is per project, so different projects can be in different modes at
+  the same time.
+- Read-only mode is independent of the destructive-command, git, migration, Nx,
+  and comment guards; those behaviors are unchanged when the mode is off.

package/docs/adr/0002-workdir-guard.md

@@ -0,0 +1,70 @@
+# ADR 0002: Workdir boundary guard blocks path access outside the working directory
+
+- Status: accepted
+- Date: 2026-10-26
+- Author: Giuseppe Trisciuoglio
+- Issue: [#24](https://github.com/giuseppe-trisciuoglio/pi-prevent-destructive-commands/issues/24)
+
+## Context
+
+The extension guards against destructive commands and protected paths, but it
+does not prevent the agent from reading, writing, modifying, or deleting files
+outside the working directory where pi runs. Users need a guard that confines
+all file operations to the workdir, with a single exception for system temp
+files (e.g. `/tmp`).
+
+Two constraints shaped the design:
+
+1. The exception must be coherent across the whole extension. Allow the agent
+   to `cat /tmp/x` while the older destructive-command checker still blocks
+   `rm /tmp/x` would produce contradictory messages from a single extension.
+2. The configuration is per project and user-managed, so the guard needs an
+   opt-out and a discoverable way to toggle it, like the existing `/git-guards`
+   and `/read-only` commands.
+
+## Decision
+
+The workdir boundary guard lives in `src/rules/workdir-guard.ts`. It checks
+every path used by bash commands and by file tools (`read`, `write`, `edit`,
+`apply_patch`) and blocks any path that resolves outside the working directory.
+
+The system temp exception is implemented once, in `src/rules/path-utils.ts`
+(`isSystemTempPath` / `isSystemTempRoot`), and shared by every path-based rule.
+Both the raw and the realpath form of each temp root are recorded because path
+resolution here is textual: on macOS `os.tmpdir()` is `/var/folders/...` with
+realpath `/private/var/folders/...`, and `/tmp` is a symlink to `/private/tmp`.
+
+The temp root itself is not a temp file: `rm -rf /tmp` stays blocked. Copying
+into it (`cp file /tmp/`) is allowed, since the trailing slash states the
+destination is the directory.
+
+Bash analysis tracks `cd` inside a command chain: `cd` must stay inside the
+boundary, and relative paths after it resolve against the tracked directory.
+A `cd` that escapes, a bare `cd` (home directory), and `cd -` are blocked
+because their effect cannot be verified against the boundary.
+
+The guard is configurable per project via `.pi/prevent-destructive-commands.json`
+using the `disableWorkdirGuard` boolean, defaulting to `false` (guard active),
+and toggled from the pi TUI with `/workdir-guard [on|off|status]`.
+
+Integration points:
+
+- `src/rules/path-utils.ts`: shared system temp helpers.
+- `src/rules/path-sensitive.ts`: rejects the temp root as a deletion target.
+- `src/index.ts`: `checkToolInputWorkdir` runs for non-bash tools;
+  `checkCommandWorkdir` runs for bash commands.
+- `src/project-config.ts`: `disableWorkdirGuard` in the project configuration.
+- `src/workdir-guard-command.ts`: the `/workdir-guard` slash command.
+
+## Consequences
+
+- File operations outside the workdir are blocked for both bash and file tools,
+  while temp files keep working everywhere in the extension.
+- The guard shifts behaviour of the existing destructive checker: `/tmp` targets
+  are no longer rejected. Tests that relied on `/tmp` being outside the boundary
+  were rewritten to use non-temp paths so they keep asserting what they meant to.
+- Paths with variables or globs cannot be resolved statically and are blocked,
+  which is conservative but predictable.
+- The guard is opt-out per project through the JSON file or `/workdir-guard off`.
+- Operating inside a workdir that itself lives under a temp root weakens the
+  boundary, because the whole temp root is trusted by design.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@giuseppe.trisciuoglio/pi-prevent-destructive-commands",
-  "version": "1.2.2",
+  "version": "1.4.0",
   "description": "Unconditionally blocks destructive bash commands before execution. A pi extension that guards against rm, git reset --hard, docker rm, aws delete operations, and more.",
   "keywords": [
     "pi-package",
@@ -32,7 +32,7 @@
     "node": ">=18.0.0"
   },
   "scripts": {
-    "test": "npm run test:smoke && npm run test:heredoc && npm run test:migration-guard && npm run test:nx-guard && npm run test:project-config && npm run test:find-start-path && npm run test:git-guards-command && npm run test:gh-guard && npm run test:comment-guard && npm run test:e2e",
+    "test": "npm run test:smoke && npm run test:heredoc && npm run test:migration-guard && npm run test:nx-guard && npm run test:project-config && npm run test:find-start-path && npm run test:git-guards-command && npm run test:read-only-command && npm run test:gh-guard && npm run test:comment-guard && npm run test:workdir-guard && npm run test:workdir-guard-command && npm run test:e2e",
     "test:smoke": "npx tsx test/smoke-test.ts",
     "test:heredoc": "npx tsx test/heredoc-test.ts",
     "test:e2e": "npx tsx test/e2e-install-test.ts",
@@ -41,8 +41,11 @@
     "test:project-config": "npx tsx test/project-config-test.ts",
     "test:find-start-path": "npx tsx test/find-start-path-test.ts",
     "test:git-guards-command": "npx tsx test/git-guards-command-test.ts",
+    "test:read-only-command": "npx tsx test/read-only-command-test.ts",
     "test:gh-guard": "npx tsx test/gh-guard-test.ts",
     "test:comment-guard": "npx tsx test/comment-guard-test.ts",
+    "test:workdir-guard": "npx tsx test/workdir-guard-test.ts",
+    "test:workdir-guard-command": "npx tsx test/workdir-guard-command-test.ts",
     "lint": "tsc --noEmit",
     "typecheck": "tsc --noEmit"
   },

package/src/git-guards-command.ts

@@ -9,14 +9,12 @@
  */
 
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
-import { mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
-import { dirname } from "node:path";
 import { ENABLE_GIT_ADD_COMMIT_BLOCK } from "./config";
 import {
 	loadProjectConfig,
-	projectConfigPath,
 	PROJECT_CONFIG_RELATIVE_PATH,
-	resetProjectConfigCache,
+	projectConfigFileStatus,
+	writeProjectConfigFlag,
 } from "./project-config";
 
 export type GitGuardsAction = "status" | "off" | "on" | "usage";
@@ -48,26 +46,7 @@ export interface GitGuardsStatus {
 }
 
 export function gitGuardsStatus(cwd: string): GitGuardsStatus {
-	const path = projectConfigPath(cwd);
-
-	let fileExists = false;
-	try {
-		statSync(path);
-		fileExists = true;
-	} catch {
-		// No file: guards active by default.
-	}
-
-	let fileValid = !fileExists; // A missing file is not an invalid file.
-	if (fileExists) {
-		try {
-			const raw: unknown = JSON.parse(readFileSync(path, "utf8"));
-			fileValid = typeof raw === "object" && raw !== null && !Array.isArray(raw);
-		} catch {
-			fileValid = false;
-		}
-	}
-
+	const { fileExists, fileValid } = projectConfigFileStatus(cwd);
 	const disabledByFile = loadProjectConfig(cwd).disableGitGuards;
 
 	return {
@@ -84,34 +63,9 @@ export function gitGuardsStatus(cwd: string): GitGuardsStatus {
  * file content was invalid (and therefore replaced).
  */
 export function applyGitGuards(cwd: string, disable: boolean): boolean {
-	const path = projectConfigPath(cwd);
-
-	let previous: Record<string, unknown> = {};
-	let replacedInvalid = false;
-	try {
-		const raw: unknown = JSON.parse(readFileSync(path, "utf8"));
-		if (typeof raw === "object" && raw !== null && !Array.isArray(raw)) {
-			previous = raw as Record<string, unknown>;
-		} else {
-			replacedInvalid = true;
-		}
-	} catch {
-		// Missing file or unparseable content: start from a clean object.
-		try {
-			statSync(path);
-			replacedInvalid = true;
-		} catch {
-			// File simply absent: nothing lost.
-		}
-	}
-
-	previous.disableGitGuards = disable;
-
-	mkdirSync(dirname(path), { recursive: true });
-	writeFileSync(path, `${JSON.stringify(previous, null, "\t")}\n`, "utf8");
-	resetProjectConfigCache();
-
-	return replacedInvalid;
+	return writeProjectConfigFlag(cwd, (config) => {
+		config.disableGitGuards = disable;
+	});
 }
 
 function statusMessage(cwd: string): { text: string; level: "info" | "warning" | "error" } {

package/src/index.ts

@@ -20,7 +20,10 @@ import {
 	loadProjectConfig,
 } from "./project-config";
 import { tokenize } from "./tokenizer";
+import { checkCommandWorkdir, checkToolInputWorkdir } from "./rules/workdir-guard";
 import { registerGitGuardsCommand } from "./git-guards-command";
+import { readOnlyBlockResult, registerReadOnlyCommand } from "./read-only-command";
+import { registerWorkdirGuardCommand } from "./workdir-guard-command";
 
 function pathsFromPatch(patch: string): string[] {
 	return extractPatchPaths(patch, [
@@ -52,8 +55,19 @@ function commandReferencesMigrationPath(command: string, cwd: string, migrationD
 
 export default function (pi: ExtensionAPI) {
 	registerGitGuardsCommand(pi);
+	registerReadOnlyCommand(pi);
+	registerWorkdirGuardCommand(pi);
 
 	pi.on("tool_call", async (event, ctx) => {
+		const projectConfig = ctx.cwd
+			? loadProjectConfig(ctx.cwd)
+			: DEFAULT_PROJECT_CONFIG;
+
+		const readOnlyBlock = readOnlyBlockResult(event.toolName, projectConfig);
+		if (readOnlyBlock) {
+			return readOnlyBlock;
+		}
+
 		// The per-project opt-out file is user-only: the agent must never create
 		// or edit it, neither through the writing tools nor through bash.
 		if (isToolCallEventType("bash", event)) {
@@ -84,10 +98,6 @@ export default function (pi: ExtensionAPI) {
 			return { block: true, reason: NX_CONFIG_BLOCK_REASON };
 		}
 
-		const projectConfig = ctx.cwd
-			? loadProjectConfig(ctx.cwd)
-			: DEFAULT_PROJECT_CONFIG;
-
 		if (!projectConfig.disableCommentGuard) {
 			const commentViolation = await findNewSourceComments(
 				event.toolName,
@@ -122,6 +132,24 @@ export default function (pi: ExtensionAPI) {
 			}
 		}
 
+		if (!projectConfig.disableWorkdirGuard && !isToolCallEventType("bash", event)) {
+			const input = event.input as Record<string, unknown>;
+			const extraPaths: string[] = [];
+			if (typeof input.path === "string") {
+				extraPaths.push(input.path);
+			}
+			const workdirBlock = checkToolInputWorkdir(
+				event.toolName,
+				input,
+				pathsFromPatch,
+				ctx.cwd,
+				extraPaths,
+			);
+			if (workdirBlock.dangerous) {
+				return { block: true, reason: `[prevent-destructive-commands] Blocked: ${workdirBlock.reason}` };
+			}
+		}
+
 		if (!isToolCallEventType("bash", event)) return undefined;
 
 		const command = event.input.command;
@@ -135,6 +163,13 @@ export default function (pi: ExtensionAPI) {
 		});
 		if (!dangerous) return undefined;
 
+		if (!projectConfig.disableWorkdirGuard) {
+			const workdirBlock = checkCommandWorkdir(command, ctx.cwd);
+			if (workdirBlock.dangerous) {
+				return { block: true, reason: `[prevent-destructive-commands] Blocked: ${workdirBlock.reason}` };
+			}
+		}
+
 		return {
 			block: true,
 			reason: `[prevent-destructive-commands] Blocked: ${reason}`,

package/src/project-config.ts

@@ -8,21 +8,23 @@
  * user — the extension itself blocks the agent from writing to it.
  */
 
-import { readFileSync, statSync } from "node:fs";
-import { join } from "node:path";
+import { mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
 
 export const PROJECT_CONFIG_RELATIVE_PATH = ".pi/prevent-destructive-commands.json";
 
 export interface ProjectConfig {
-	/** When true, the `git add` / `git commit` / `git push` guards are disabled. */
 	disableGitGuards: boolean;
-	/** When true, the source comment guard is disabled. */
 	disableCommentGuard: boolean;
+	readOnly: boolean;
+	disableWorkdirGuard: boolean;
 }
 
 export const DEFAULT_PROJECT_CONFIG: ProjectConfig = {
 	disableGitGuards: false,
 	disableCommentGuard: false,
+	readOnly: false,
+	disableWorkdirGuard: false,
 };
 
 /** Absolute path of the project configuration file for a given cwd. */
@@ -60,9 +62,12 @@ export function loadProjectConfig(cwd: string): ProjectConfig {
 	try {
 		const raw: unknown = JSON.parse(readFileSync(path, "utf8"));
 		if (typeof raw === "object" && raw !== null) {
+			const fields = raw as Record<string, unknown>;
 			config = {
-				disableGitGuards: (raw as Record<string, unknown>).disableGitGuards === true,
-				disableCommentGuard: (raw as Record<string, unknown>).disableCommentGuard === true,
+				disableGitGuards: fields.disableGitGuards === true,
+				disableCommentGuard: fields.disableCommentGuard === true,
+				readOnly: fields.readOnly === true,
+				disableWorkdirGuard: fields.disableWorkdirGuard === true,
 			};
 		}
 	} catch {
@@ -92,3 +97,63 @@ export function commandReferencesProjectConfig(command: string): boolean {
 export function resetProjectConfigCache(): void {
 	cache.clear();
 }
+
+export interface ProjectConfigFileStatus {
+	fileExists: boolean;
+	fileValid: boolean;
+}
+
+export function projectConfigFileStatus(cwd: string): ProjectConfigFileStatus {
+	const path = projectConfigPath(cwd);
+
+	let fileExists = false;
+	try {
+		statSync(path);
+		fileExists = true;
+	} catch {
+	}
+
+	let fileValid = !fileExists;
+	if (fileExists) {
+		try {
+			const raw: unknown = JSON.parse(readFileSync(path, "utf8"));
+			fileValid = typeof raw === "object" && raw !== null && !Array.isArray(raw);
+		} catch {
+			fileValid = false;
+		}
+	}
+
+	return { fileExists, fileValid };
+}
+
+export function writeProjectConfigFlag(
+	cwd: string,
+	mutate: (config: Record<string, unknown>) => void,
+): boolean {
+	const path = projectConfigPath(cwd);
+
+	let previous: Record<string, unknown> = {};
+	let replacedInvalid = false;
+	try {
+		const raw: unknown = JSON.parse(readFileSync(path, "utf8"));
+		if (typeof raw === "object" && raw !== null && !Array.isArray(raw)) {
+			previous = raw as Record<string, unknown>;
+		} else {
+			replacedInvalid = true;
+		}
+	} catch {
+		try {
+			statSync(path);
+			replacedInvalid = true;
+		} catch {
+		}
+	}
+
+	mutate(previous);
+
+	mkdirSync(dirname(path), { recursive: true });
+	writeFileSync(path, `${JSON.stringify(previous, null, "\t")}\n`, "utf8");
+	resetProjectConfigCache();
+
+	return replacedInvalid;
+}