@hank-warren/pi-auto-permissions 0.23.0 → 0.24.0

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # @hank-warren/pi-auto-permissions
 
+## 0.24.0
+
+### Minor Changes
+
+- Approval mode in the `/auto-permissions` menu, and multi-line deny matches go to review.
+
+  - **Approval mode row.** The `/auto-permissions` menu has an **Approval mode** row that sets `approvalMode` (auto, careful, afk) like the other rows, with `auto` removing the key. The session it is changed from drops its own `/auto-permissions <mode>` switch, and every session refreshes its mode status at its next prompt. Unattended sessions stay afk.
+  - **A deny match in a multi-line command is reviewed.** Rules match raw text, so a deny pattern could match across lines the shell runs separately: a delete on one line plus a quoted `/^##` sed address on the next matched the hard-deny **Delete of a critical path**, which nothing could lift. A deny match on a command containing a newline now goes to the guardian under that rule's label instead; single-line matches stay hard denies.
+
 ## 0.23.0
 
 ### Minor Changes

package/README.md

@@ -45,7 +45,7 @@ What happens when the guardian cannot approve a command (an `ask_user` verdict,
 | `careful` | You are prompted as soon as the guardian cannot approve a command, and the agent waits for your answer. |
 | `afk` | Nothing prompts. Blocked commands are refused, the agent gets a short system prompt section saying you are away, and it lists what it needs approved in its final message. |
 
-Set the default with `"approvalMode": "auto" | "careful" | "afk"` in the config, and switch one session with `/auto-permissions auto`, `/auto-permissions careful` or `/auto-permissions afk`. A session switch lasts until the session ends or switches again, and a new or resumed session starts in the configured default. A blocked command lands in the denial log, so **Recent denials → Allow on retry** clears it too.
+Set the default with the **Approval mode** row in `/auto-permissions` or `"approvalMode": "auto" | "careful" | "afk"` in the config, and switch one session with `/auto-permissions auto`, `/auto-permissions careful` or `/auto-permissions afk`. A session switch lasts until the session ends, switches again, or the default changes in the menu, and a new or resumed session starts in the configured default. A blocked command lands in the denial log, so **Recent denials → Allow on retry** clears it too.
 
 To keep the agent working while being careful about specific things, say so in your message ("don't push", "treat vistra as read-only"): the guardian blocks matching actions until a later message lifts the boundary. Boundaries you state live in the transcript, so a compaction can drop them; for anything that must always hold, use `guardianPolicy.softDeny` / `hardDeny` or a deny rule.
 
@@ -145,7 +145,7 @@ Rule fields are:
 - `label`: short description shown during review
 - `message`: optional feedback; required for deny rules
 
-A deny rule is a hard policy boundary: it blocks immediately with its message, is evaluated before every other level, and nothing lifts it — not a trusted group, not user approval at a prompt. Reserve it for operations that should never happen in an agent session (disabling agent oversight, deleting critical paths), and use `guarded` where a human judgment call is legitimate.
+A deny rule is a hard policy boundary: it blocks immediately with its message, is evaluated before every other level, and nothing lifts it — not a trusted group, not user approval at a prompt. Reserve it for operations that should never happen in an agent session (disabling agent oversight, deleting critical paths), and use `guarded` where a human judgment call is legitimate. One exception: rules match raw text, so in a multi-line command a deny pattern can match across lines the shell runs as separate commands. A deny match on a command containing a newline is therefore sent to the guardian under that rule's label instead of blocked outright; it is still reviewed, never passed. Single-line matches stay hard denies.
 
 When several rules match one command, the most severe level wins (deny, then guarded) regardless of their order in the list.
 
@@ -234,6 +234,7 @@ The reviewer settings that change most often are editable from a settings menu i
 | Row | What it edits |
 | --- | --- |
 | Enabled | `enabled` — off disables all gating, including deny rules; every command runs unreviewed |
+| Approval mode | `approvalMode`, cycling through `auto`, `careful` and `afk` (see [Approval modes](#approval-modes)); the session you change it from drops its own `/auto-permissions <mode>` switch |
 | Reviewer model | `reviewer.provider` / `reviewer.model`, picked from the models you are signed in to |
 | Thinking level | `reviewer.reasoningEffort` |
 | Review timeout | `reviewer.timeoutMs`, entered as `30s` or `45000ms` |

package/classify.ts

@@ -20,6 +20,13 @@ export type CommandClassification =
  * Deny rules are hard policy boundaries: a project-scoped trusted-ops file
  * must not be able to lift one, or a checked-in file could disarm the
  * circuit breaker. Only guarded matches honor the bypass.
+ *
+ * Rules match raw text, so in a multi-line command a deny can match across
+ * lines that the shell runs as separate commands (an `rm` on one line, a
+ * quoted `/^##` on the next). Telling those apart takes a shell parser, so a
+ * deny match on a multi-line command goes to the guardian instead, which
+ * reads the real commands; it is reviewed, never waved through. A
+ * single-line match stays a hard deny.
  */
 export function classifyCommand(
   command: string,
@@ -32,7 +39,7 @@ export function classifyCommand(
   );
 
   const deny = matches.find((gate) => gate.level === "deny");
-  if (deny) return { kind: "deny", gate: deny };
+  if (deny) return { kind: /[\r\n]/.test(command) ? "review" : "deny", gate: deny };
 
   let gate = matches.find((candidate) => candidate.level === "guarded");
   // With reviewAllShell on, a command no rule names at all still gets a

package/config-writer.ts

@@ -11,14 +11,17 @@
 import { mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
 import { pid } from "node:process";
-import { DEFAULT_REVIEW_CONCURRENCY, type ReviewerConfig } from "./config.js";
+import { type ApprovalMode, DEFAULT_REVIEW_CONCURRENCY, type ReviewerConfig } from "./config.js";
 
 interface ConfigPatch {
   enabled?: boolean;
+  approvalMode?: ApprovalMode;
   reviewer?: ReviewerConfig;
   reviewConcurrency?: number;
 }
 
+const DEFAULT_APPROVAL_MODE: ApprovalMode = "auto";
+
 const DEFAULT_INDENT = "  ";
 
 /**
@@ -56,8 +59,8 @@ function parseObject(text: string): Record<string, unknown> {
  * Sparse `enabled`: the loader reads a missing key as enabled, so turning the
  * guardian back on deletes the key rather than writing `true`. That keeps a
  * default flip reaching hosts that never touched the setting, matching how
- * pi-statusline serializes its settings. `reviewConcurrency` is sparse the
- * same way: setting it back to the default deletes the key.
+ * pi-statusline serializes its settings. `approvalMode` and `reviewConcurrency`
+ * are sparse the same way: setting either back to its default deletes the key.
  *
  * Throws on an unparsable or non-object file rather than clobbering it; the
  * caller surfaces that as a notification.
@@ -70,6 +73,10 @@ export function patchAutoPermissionsConfig(path: string, patch: ConfigPatch): vo
     if (patch.enabled) delete merged.enabled;
     else merged.enabled = false;
   }
+  if (patch.approvalMode !== undefined) {
+    if (patch.approvalMode === DEFAULT_APPROVAL_MODE) delete merged.approvalMode;
+    else merged.approvalMode = patch.approvalMode;
+  }
   if (patch.reviewConcurrency !== undefined) {
     if (patch.reviewConcurrency === DEFAULT_REVIEW_CONCURRENCY) delete merged.reviewConcurrency;
     else merged.reviewConcurrency = patch.reviewConcurrency;

package/index.ts

@@ -919,10 +919,12 @@ export default function autoPermissionsExtension(pi: ExtensionAPI) {
     return decide(scope, input, lifecycleSignal, early ?? runReview(scope, input, lifecycleSignal));
   });
 
-  pi.on("before_agent_start", (event) => {
+  pi.on("before_agent_start", (event, ctx) => {
     let config: AutoPermissionsConfig | undefined;
     try {
       config = loadAutoPermissionsConfig();
+      // Another session's menu may have changed the configured mode since this one started.
+      showApprovalMode(ctx, approvalModeOf(config));
       if (!config.enabled) return;
     } catch {
       // An invalid config fails closed on the first bash call; the guidance still applies.
@@ -962,6 +964,12 @@ export default function autoPermissionsExtension(pi: ExtensionAPI) {
         showApprovalMode(ctx, mode);
         return undefined;
       },
+      followConfig(mode, ctx) {
+        if (unattendedSession) return;
+        sessionApprovalMode = undefined;
+        blocks.reset();
+        showApprovalMode(ctx, mode);
+      },
     },
   });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hank-warren/pi-auto-permissions",
-  "version": "0.23.0",
+  "version": "0.24.0",
   "description": "Fork of @ogulcancelik/pi-auto-permissions with dialog-answer user evidence: context-aware Bash permissions for Pi with automated guardian review.",
   "type": "module",
   "keywords": [

package/settings-command.ts

@@ -48,6 +48,8 @@ const MODE_NOTICES: Record<ApprovalMode, string> = {
 export interface ApprovalModeControl {
   /** Switch this session's mode; returns why it cannot, or undefined. */
   set(mode: ApprovalMode, ctx: ExtensionContext): string | undefined;
+  /** The configured mode changed in the menu: drop this session's override and follow it. */
+  followConfig(mode: ApprovalMode, ctx: ExtensionContext): void;
 }
 
 export function registerSettingsCommand(
@@ -105,6 +107,7 @@ export function registerSettingsCommand(
         const config = loadAutoPermissionsConfig(path);
         settings = {
           enabled: config.enabled,
+          approvalMode: config.approvalMode,
           reviewer: config.reviewer,
           reviewConcurrency: config.reviewConcurrency,
           systemPromptSource: config.systemPromptSource,
@@ -131,7 +134,8 @@ export function registerSettingsCommand(
           patchAutoPermissionsConfig(path, {
             enabled: settings.enabled,
             reviewer: settings.reviewer,
-            // Only when this edit changed it, so a hand-written value is never rewritten by an unrelated save.
+            // Only when this edit changed them, so a hand-written value is never rewritten by an unrelated save.
+            ...(settings.approvalMode !== previous.approvalMode ? { approvalMode: settings.approvalMode } : {}),
             ...(settings.reviewConcurrency !== previous.reviewConcurrency
               ? { reviewConcurrency: settings.reviewConcurrency }
               : {}),
@@ -143,6 +147,7 @@ export function registerSettingsCommand(
           return;
         }
         if (change.kind === "warn") ctx.ui.notify(change.message, "warning");
+        if (settings.approvalMode !== previous.approvalMode) approvalMode.followConfig(settings.approvalMode, ctx);
         // A breakage elsewhere in the file would otherwise surface at the next
         // bash call, looking like this edit caused it.
         try {

package/settings-menu.ts

@@ -18,6 +18,8 @@ import {
   truncateToWidth,
 } from "@earendil-works/pi-tui";
 import {
+  APPROVAL_MODES,
+  type ApprovalMode,
   DEFAULT_REVIEWER_REASONING_EFFORT,
   DEFAULT_REVIEWER_TIMEOUT_MS,
   MAX_REVIEW_CONCURRENCY,
@@ -30,6 +32,7 @@ import {
 } from "./config.js";
 
 const ENABLED_ID = "enabled";
+const APPROVAL_MODE_ID = "approvalMode";
 const REVIEWER_MODEL_ID = "reviewerModel";
 const THINKING_LEVEL_ID = "reasoningEffort";
 const TIMEOUT_ID = "timeoutMs";
@@ -48,6 +51,7 @@ const NO_REVIEWER_MESSAGE = "Select a reviewer model first";
 /** The slice of the config the menu edits, plus the read-only prompt source. */
 export interface ReviewerSettings {
   enabled: boolean;
+  approvalMode: ApprovalMode;
   reviewer?: ReviewerConfig;
   reviewConcurrency: number;
   systemPromptSource: SystemPromptSource;
@@ -169,6 +173,14 @@ export function buildSettingItems(
       currentValue: toggleValue(settings.enabled),
       values: TOGGLE_VALUES,
     },
+    {
+      id: APPROVAL_MODE_ID,
+      label: "Approval mode",
+      description:
+        "When the guardian can't approve a command: auto blocks it and prompts only after repeated blocks, careful prompts at once, afk never prompts. Applies to every session; /auto-permissions <mode> overrides one session. Unattended sessions are always afk.",
+      currentValue: settings.approvalMode,
+      values: [...APPROVAL_MODES],
+    },
     {
       id: REVIEWER_MODEL_ID,
       label: "Reviewer model",
@@ -241,6 +253,14 @@ export function applySettingChange(
     return { kind: "settings", settings: { ...settings, enabled } };
   }
 
+  if (id === APPROVAL_MODE_ID) {
+    if (!(APPROVAL_MODES as readonly string[]).includes(value)) {
+      return { kind: "error", message: `Unknown approval mode: ${value}` };
+    }
+    if (value === settings.approvalMode) return { kind: "ignored" };
+    return { kind: "settings", settings: { ...settings, approvalMode: value as ApprovalMode } };
+  }
+
   if (id === THINKING_LEVEL_ID) {
     if (!REASONING_EFFORTS.includes(value as ReasoningEffort)) {
       return { kind: "error", message: `Unknown thinking level: ${value}` };