@groeponline/pi-wishcraft 0.23.4 → 0.24.0

package/CHANGELOG.md

@@ -2,6 +2,11 @@
 
 ## [Unreleased]
 
+## [0.24.0] - 2026-08-20
+
+### Added
+- Declarative policy engine (`wishcraft.policy`): in-process deny/inject rules in global settings, evaluated before command hooks. No process spawn. `policyEnabled: false` is the kill-switch.
+
 ## [0.23.4] - 2026-08-20
 
 ### Fixed

package/README.md

@@ -171,6 +171,35 @@ PY
 
 Repairs run on custom/extension tools only, before hooks: drop null optionals, parse JSON-string arrays before wrapping, turn `{}` into `[]` on array keys, wrap bare strings, alias `filePath` / `absolutePath` / `target_file` to `path`, unwrap degenerate markdown auto-links. Core tools (`bash`, `read`, `edit`, `write`, `grep`, `find`, `ls`) are never rewritten. `/repairs` prints the counters.
 
+## Policy
+
+Declarative deny/inject rules in the **global** agent settings file. No shell commands — pure in-process regex. Evaluated before command hooks. `wishcraft.policyEnabled: false` disables policy without deleting rules.
+
+```json
+{
+  "wishcraft": {
+    "policy": [
+      {
+        "action": "deny",
+        "tool": "bash",
+        "match": "sudo\\s+rm",
+        "reason": "destructive sudo rm"
+      },
+      {
+        "action": "inject",
+        "tool": "read",
+        "pathMatch": "\\.env",
+        "context": "Do not leak secrets from .env files into the conversation."
+      }
+    ]
+  }
+}
+```
+
+**deny** — regex on tool input (`bash` uses `command`; other tools use JSON-serialized input). First match wins; the tool call is blocked with `reason`.
+
+**inject** — regex on file path after a matching tool completes; context is appended to the tool result (same shape as postToolUse hook `additionalContext`).
+
 ## Limits
 
 - No mouse on the live footer. Pi core owns that surface.

package/docs/configuration.md

@@ -218,6 +218,8 @@ Set `powerline.costAlert` to a USD threshold to get a single warning notificatio
 
 Command hooks live under `wishcraft.hooks` in the **global** agent settings file. `wishcraft.hooksEnabled: false` is the kill-switch. See the README Hooks section for three copy-paste examples (bash-guard, write-audit, SessionStart git-status).
 
+Declarative policy rules (`wishcraft.policy`) live in the same global file. They run in-process before command hooks: **deny** blocks a tool call when input matches a regex; **inject** appends context after a matching read/write path. `wishcraft.policyEnabled: false` disables policy without deleting rules. See the README Policy section for two copy-paste examples.
+
 Tool-input repairs apply to custom/extension tools only (`wishcraft.repairsEnabled`, default on). `/repairs` prints the counters.
 
 ## Token budget

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groeponline/pi-wishcraft",
-  "version": "0.23.4",
+  "version": "0.24.0",
   "description": "Wishcraft cockpit for the pi coding agent — powerline status, vibes, idea inbox, bash mode, and full customization.",
   "type": "module",
   "files": [

package/src/extension/hooks/index.ts

@@ -27,6 +27,14 @@ import {
   runHookCommand,
   type HookPayload,
 } from "./hooks-runner.ts";
+import {
+  parsePolicySettings,
+  type PolicyRule,
+} from "./policy-config.ts";
+import {
+  evalPostToolUsePolicy,
+  evalPreToolUsePolicy,
+} from "./policy-engine.ts";
 import {
   recordRepairs,
   repairToolInput,
@@ -34,6 +42,8 @@ import {
 
 let hooksSettings: WishcraftHooksSettings = {};
 let hooksEnabled = false;
+let policyRules: PolicyRule[] = [];
+let policyEnabled = false;
 let repairsEnabled = true;
 let pendingSessionContext: string | null = null;
 
@@ -46,6 +56,9 @@ function refreshSettings(cwd: string): void {
   const parsed = parseHooksSettings(globalWishcraft);
   hooksSettings = parsed.hooks;
   hooksEnabled = parsed.enabled && hasAnyHook(parsed.hooks);
+  const policy = parsePolicySettings(globalWishcraft);
+  policyRules = policy.rules;
+  policyEnabled = policy.enabled;
   repairsEnabled =
     !merged ||
     typeof merged !== "object" ||
@@ -125,6 +138,12 @@ export function setupHooks(
       const result = repairToolInput(toolName, event.input);
       if (result.repairs.length > 0) recordRepairs(result);
     }
+    if (policyEnabled) {
+      const policyVerdict = evalPreToolUsePolicy(policyRules, toolName, event.input);
+      if (policyVerdict.block) {
+        return { block: true, reason: policyVerdict.reason };
+      }
+    }
     if (!hooksEnabled) return;
     const cmds = commandsFor(hooksSettings, "preToolUse", toolName);
     if (cmds.length === 0) return;
@@ -147,27 +166,33 @@ export function setupHooks(
   });
 
   pi.on("tool_result", async (event: any, ctx: any) => {
-    if (!hooksEnabled) return;
-    const cmds = commandsFor(hooksSettings, "postToolUse", event.toolName);
-    if (cmds.length === 0) return;
-    const payload = basePayload("postToolUse", ctx);
-    payload.tool_use_id = event.toolCallId;
-    payload.tool_name = event.toolName;
-    payload.tool_input = event.input;
-    payload.tool_response =
-      typeof event.content === "string"
-        ? event.content
-        : Array.isArray(event.content)
-          ? event.content.map((c: any) => c.text ?? "").join("\n")
-          : "";
-    // parallel: één crashende hook annuleert de rest niet
-    const outs = await Promise.all(cmds.map((c) => runHookCommand(c, payload)));
     let extra = "";
-    for (const out of outs) {
-      const add = out.parsed?.hookSpecificOutput?.additionalContext;
-      if (add) extra += (extra ? "\n" : "") + add;
-      if (out.parsed?.systemMessage && ctx?.ui?.notify) {
-        ctx.ui.notify(out.parsed.systemMessage, "info");
+    if (policyEnabled) {
+      const inject = evalPostToolUsePolicy(policyRules, event.toolName, event.input);
+      if (inject) extra = inject.additionalContext;
+    }
+    if (hooksEnabled) {
+      const cmds = commandsFor(hooksSettings, "postToolUse", event.toolName);
+      if (cmds.length > 0) {
+        const payload = basePayload("postToolUse", ctx);
+        payload.tool_use_id = event.toolCallId;
+        payload.tool_name = event.toolName;
+        payload.tool_input = event.input;
+        payload.tool_response =
+          typeof event.content === "string"
+            ? event.content
+            : Array.isArray(event.content)
+              ? event.content.map((c: any) => c.text ?? "").join("\n")
+              : "";
+        // parallel: één crashende hook annuleert de rest niet
+        const outs = await Promise.all(cmds.map((c) => runHookCommand(c, payload)));
+        for (const out of outs) {
+          const add = out.parsed?.hookSpecificOutput?.additionalContext;
+          if (add) extra += (extra ? "\n" : "") + add;
+          if (out.parsed?.systemMessage && ctx?.ui?.notify) {
+            ctx.ui.notify(out.parsed.systemMessage, "info");
+          }
+        }
       }
     }
     if (extra && Array.isArray(event.content)) {

package/src/extension/hooks/policy-config.ts

@@ -0,0 +1,98 @@
+/**
+ * policy-config.ts
+ * ---------------------------------------------------------------------------
+ * Declarative policy rules (deny / inject) from global wishcraft settings.
+ * No process spawn — pure regex evaluation in-process.
+ *
+ *   "wishcraft": {
+ *     "policyEnabled": true,
+ *     "policy": [
+ *       { "action": "deny", "tool": "bash", "match": "sudo\\s+rm", "reason": "…" },
+ *       { "action": "inject", "tool": "read", "pathMatch": "\\.env", "context": "…" }
+ *     ]
+ *   }
+ *
+ * policyEnabled defaults to true when policy is non-empty; explicit false
+ * is the kill-switch. Malformed rules are dropped (no throw).
+ * ---------------------------------------------------------------------------
+ */
+
+export interface DenyPolicyRule {
+  action: "deny";
+  tool: string;
+  match: string;
+  reason: string;
+}
+
+export interface InjectPolicyRule {
+  action: "inject";
+  tool: string;
+  pathMatch: string;
+  context: string;
+}
+
+export type PolicyRule = DenyPolicyRule | InjectPolicyRule;
+
+function isRecord(v: unknown): v is Record<string, unknown> {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+
+function validRegex(pattern: string): boolean {
+  try {
+    new RegExp(pattern);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function parseDenyRule(v: unknown): DenyPolicyRule | null {
+  if (!isRecord(v) || v.action !== "deny") return null;
+  if (typeof v.tool !== "string" || !v.tool.trim()) return null;
+  if (typeof v.match !== "string" || !v.match.trim()) return null;
+  if (typeof v.reason !== "string" || !v.reason.trim()) return null;
+  if (!validRegex(v.match)) return null;
+  return {
+    action: "deny",
+    tool: v.tool,
+    match: v.match,
+    reason: v.reason,
+  };
+}
+
+function parseInjectRule(v: unknown): InjectPolicyRule | null {
+  if (!isRecord(v) || v.action !== "inject") return null;
+  if (typeof v.tool !== "string" || !v.tool.trim()) return null;
+  if (typeof v.pathMatch !== "string" || !v.pathMatch.trim()) return null;
+  if (typeof v.context !== "string" || !v.context.trim()) return null;
+  if (!validRegex(v.pathMatch)) return null;
+  return {
+    action: "inject",
+    tool: v.tool,
+    pathMatch: v.pathMatch,
+    context: v.context,
+  };
+}
+
+function parsePolicyRule(v: unknown): PolicyRule | null {
+  if (!isRecord(v)) return null;
+  if (v.action === "deny") return parseDenyRule(v);
+  if (v.action === "inject") return parseInjectRule(v);
+  return null;
+}
+
+/** Parse wishcraft policy settings. Invalid rules are dropped. */
+export function parsePolicySettings(wishcraftSettings: unknown): {
+  enabled: boolean;
+  rules: PolicyRule[];
+} {
+  if (!isRecord(wishcraftSettings)) return { enabled: false, rules: [] };
+  const raw = wishcraftSettings.policy;
+  if (!Array.isArray(raw)) return { enabled: false, rules: [] };
+  const rules = raw
+    .map(parsePolicyRule)
+    .filter((r): r is PolicyRule => r !== null);
+  if (rules.length === 0) return { enabled: false, rules: [] };
+  const enabled = wishcraftSettings.policyEnabled !== false;
+  return { enabled, rules };
+}

package/src/extension/hooks/policy-engine.ts

@@ -0,0 +1,80 @@
+/**
+ * policy-engine.ts
+ * ---------------------------------------------------------------------------
+ * Pure in-process policy evaluation (deny before tool use, inject after).
+ * ---------------------------------------------------------------------------
+ */
+
+import type { PolicyRule } from "./policy-config.ts";
+
+function isRecord(v: unknown): v is Record<string, unknown> {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+
+/** Text to match deny rules against (bash command or serialized input). */
+export function toolInputText(toolName: string, input: unknown): string {
+  if (toolName === "bash" && isRecord(input) && typeof input.command === "string") {
+    return input.command;
+  }
+  try {
+    return JSON.stringify(input ?? {});
+  } catch {
+    return String(input ?? "");
+  }
+}
+
+/** Path from tool input (read/write/edit and common aliases). */
+export function toolPath(input: unknown): string | null {
+  if (!isRecord(input)) return null;
+  for (const key of ["path", "filePath", "absolutePath", "target_file", "file_path"]) {
+    const v = input[key];
+    if (typeof v === "string" && v.length > 0) return v;
+  }
+  return null;
+}
+
+export type PreToolUsePolicyVerdict =
+  | { block: true; reason: string }
+  | { block: false };
+
+/** First matching deny rule wins. */
+export function evalPreToolUsePolicy(
+  rules: PolicyRule[],
+  toolName: string,
+  input: unknown,
+): PreToolUsePolicyVerdict {
+  const text = toolInputText(toolName, input);
+  for (const rule of rules) {
+    if (rule.action !== "deny" || rule.tool !== toolName) continue;
+    try {
+      if (new RegExp(rule.match).test(text)) {
+        return { block: true, reason: rule.reason };
+      }
+    } catch {
+      // invalid regex at runtime — skip
+    }
+  }
+  return { block: false };
+}
+
+/** All matching inject rules contribute context (in order). */
+export function evalPostToolUsePolicy(
+  rules: PolicyRule[],
+  toolName: string,
+  input: unknown,
+): { additionalContext: string } | null {
+  const path = toolPath(input);
+  if (path === null) return null;
+  let extra = "";
+  for (const rule of rules) {
+    if (rule.action !== "inject" || rule.tool !== toolName) continue;
+    try {
+      if (new RegExp(rule.pathMatch).test(path)) {
+        extra += (extra ? "\n" : "") + rule.context;
+      }
+    } catch {
+      // invalid regex at runtime — skip
+    }
+  }
+  return extra ? { additionalContext: extra } : null;
+}