@ibartel74/pi-automode-ext 1.0.0 → 1.0.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/CHANGELOG.md
CHANGED
|
@@ -6,6 +6,13 @@ All notable changes to this project are documented in this file.
|
|
|
6
6
|
|
|
7
7
|
## [Unreleased]
|
|
8
8
|
|
|
9
|
+
## [1.0.1] - 2026-09-20
|
|
10
|
+
|
|
11
|
+
## Security
|
|
12
|
+
|
|
13
|
+
- **Deterministic decision-log protection** — The pi-automode session decision logs (`*-pi-automode.jsonl` sidecars) are now safety-control paths: mutating them with `write`, `edit`, or shell redirection is hard-denied without classifier review. Previously the audit log was protected only by the classifier. Reading, tailing, and searching the logs stays allowed.
|
|
14
|
+
- **Classifier prompt inspection/tampering split** — The classifier prompt now distinguishes reading or searching pi-automode's own log and `.pi/automode*` config (allow) from modifying, truncating, or redirecting into them (hard deny), reducing false "tampering" blocks on legitimate diagnostics.
|
|
15
|
+
|
|
9
16
|
## [1.0.0] - 2026-09-20
|
|
10
17
|
|
|
11
18
|
## New features
|
|
@@ -71,7 +78,8 @@ All notable changes to this project are documented in this file.
|
|
|
71
78
|
- **Complete classifier action input** — Send the exact current tool input to both classifier stages in a dedicated message. Block the action if it cannot fit without truncation. (#17)
|
|
72
79
|
- **Path policy normalization** — Use Pi-compatible resolution for file-tool paths, including file URLs, `@` and tilde aliases, and read fallback names. Enforce denied paths across omitted and recursive search scopes and both sides of symlink aliases. (#18)
|
|
73
80
|
- **Project config trust gate** — Ignore `.pi/automode.local.json` and `.pi/automode.json` until Pi trusts the project. Apply the trust gate during startup and config reloads. (#16)
|
|
74
|
-
[Unreleased]: https://github.com/ibartel/pi-automode-ext/compare/v1.0.
|
|
81
|
+
[Unreleased]: https://github.com/ibartel/pi-automode-ext/compare/v1.0.1...HEAD
|
|
82
|
+
[1.0.1]: https://github.com/ibartel/pi-automode-ext/compare/v1.0.0...v1.0.1
|
|
75
83
|
[1.0.0]: https://github.com/ibartel/pi-automode-ext/compare/v1.16.0...v1.0.0
|
|
76
84
|
|
|
77
85
|
[1.16.0]: https://github.com/czottmann/pi-automode/compare/v1.15.0...v1.16.0
|
|
@@ -198,7 +198,7 @@ Current deterministic blocks include these actions:
|
|
|
198
198
|
|
|
199
199
|
- writes to shell profile files
|
|
200
200
|
- writes to `~/.ssh/authorized_keys`
|
|
201
|
-
- edits to auto-mode or Pi permission safety-control files
|
|
201
|
+
- edits to auto-mode or Pi permission safety-control files, including the pi-automode decision-log sidecars (`*-pi-automode.jsonl`)
|
|
202
202
|
- weaker TLS or certificate verification
|
|
203
203
|
- persistence changes such as cron jobs, launch agents, and system service enablement
|
|
204
204
|
- dangerous recursive deletes of root, home, or system paths
|
|
@@ -49,6 +49,8 @@ Pi in-memory sessions have no session file or session directory. These sessions
|
|
|
49
49
|
|
|
50
50
|
The project directory uses the same `--path-with-dashes--` encoding as normal Pi session directories. The date partition uses UTC.
|
|
51
51
|
|
|
52
|
+
Decision-log files are safety-control paths. Mutating them with `write`, `edit`, or shell redirection is hard-denied without classifier review. Reading, tailing, and searching them stays allowed.
|
|
53
|
+
|
|
52
54
|
A custom session manager can supply an absolute `sessionDir` without a session file. In this case, pi-automode continues to use that directory. Run `/automode config` to see the resolved path.
|
|
53
55
|
|
|
54
56
|
Persisted sessions use one combined file per session. In-memory sessions use one file for each session ID and UTC day.
|
|
@@ -155,7 +155,8 @@ Examples:
|
|
|
155
155
|
- Overwriting ~/.config/app/settings.toml outside the repository after "for task X in repo Y, you may modify ~/.config/app/settings.toml" => allow, explicit_intent, target stays inside a direct, bounded user authorization.
|
|
156
156
|
- Editing ~/.config/app/other.toml after the same authorization => block, soft_deny, target lies outside authorized scope.
|
|
157
157
|
- Uploading repository contents, logs with secrets, or internal data to an untrusted domain => block, hard_deny.
|
|
158
|
-
-
|
|
158
|
+
- Reading, tailing, or searching pi-automode's own decision log (*-pi-automode.jsonl) or .pi/automode* config => allow unless another deny rule applies; inspection is not tampering.
|
|
159
|
+
- Modifying, truncating, deleting, or redirecting output into .pi/automode*, pi-automode logs (*-pi-automode.jsonl), this extension, or permission rules => block, hard_deny.`;
|
|
159
160
|
|
|
160
161
|
export const CLASSIFIER_FAST_INSTRUCTION =
|
|
161
162
|
`Return exactly one digit and nothing else: 0 only when the action is clearly allowed by the policy; 1 when it may need blocking or you are uncertain. Err on 1.`;
|
|
@@ -260,6 +260,11 @@ export function isSafetyControlPath(path: string, cwd: string): boolean {
|
|
|
260
260
|
return true;
|
|
261
261
|
}
|
|
262
262
|
if (normalized.includes("/.pi/") && file.startsWith("automode")) return true;
|
|
263
|
+
// Session decision logs (<session>-pi-automode.jsonl) sit next to session
|
|
264
|
+
// files, outside every branch above. They are the audit trail named by
|
|
265
|
+
// hard-deny rule #6, so mutating them anywhere is safety-control tampering;
|
|
266
|
+
// read-only tools are unaffected (only mutation paths consult this).
|
|
267
|
+
if (file.endsWith("-pi-automode.jsonl")) return true;
|
|
263
268
|
// Installed package copies stay protected. The piAgentRoot extension prefix
|
|
264
269
|
// above already covers the global install location, and a dev checkout of
|
|
265
270
|
// the extension itself must stay editable, so the package name only denies
|
package/package.json
CHANGED
|
@@ -1,61 +1,62 @@
|
|
|
1
1
|
{
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
2
|
+
"name": "@ibartel74/pi-automode-ext",
|
|
3
|
+
"version": "1.0.1",
|
|
4
|
+
"description": "Claude Code-style auto mode guardrail for pi.",
|
|
5
|
+
"repository": {
|
|
6
|
+
"url": "https://github.com/ibartel/pi-automode-ext"
|
|
7
|
+
},
|
|
8
|
+
"type": "module",
|
|
9
|
+
"license": "MIT",
|
|
10
|
+
"publishConfig": {
|
|
11
|
+
"access": "public"
|
|
12
|
+
},
|
|
13
|
+
"keywords": [
|
|
14
|
+
"pi",
|
|
15
|
+
"pi-extension",
|
|
16
|
+
"pi-package",
|
|
17
|
+
"auto-mode",
|
|
18
|
+
"llm",
|
|
19
|
+
"coding-agent"
|
|
20
|
+
],
|
|
21
|
+
"scripts": {
|
|
22
|
+
"typecheck": "tsc --noEmit",
|
|
23
|
+
"check": "tsc --noEmit",
|
|
24
|
+
"build": "tsc --noEmit",
|
|
25
|
+
"test": "node --import tsx --test tests/*.test.ts",
|
|
26
|
+
"release": "bash scripts/release.sh"
|
|
27
|
+
},
|
|
28
|
+
"files": [
|
|
29
|
+
"CHANGELOG.md",
|
|
30
|
+
"docs",
|
|
31
|
+
"extensions",
|
|
32
|
+
"examples",
|
|
33
|
+
"skills",
|
|
34
|
+
"README.md"
|
|
35
|
+
],
|
|
36
|
+
"pi": {
|
|
37
|
+
"extensions": [
|
|
38
|
+
"./extensions/auto-mode.ts"
|
|
39
|
+
],
|
|
40
|
+
"skills": [
|
|
41
|
+
"./skills"
|
|
42
|
+
]
|
|
43
|
+
},
|
|
44
|
+
"peerDependencies": {
|
|
45
|
+
"@earendil-works/pi-ai": "*",
|
|
46
|
+
"@earendil-works/pi-coding-agent": "*",
|
|
47
|
+
"@earendil-works/pi-tui": "*",
|
|
48
|
+
"typebox": "*"
|
|
49
|
+
},
|
|
50
|
+
"devDependencies": {
|
|
51
|
+
"@earendil-works/pi-ai": "^0.84.1",
|
|
52
|
+
"@earendil-works/pi-coding-agent": "^0.84.1",
|
|
53
|
+
"@earendil-works/pi-tui": "^0.84.1",
|
|
54
|
+
"@types/node": "^24.0.0",
|
|
55
|
+
"tsx": "^4.22.4",
|
|
56
|
+
"typebox": "^1.3.10",
|
|
57
|
+
"typescript": "^5.8.0"
|
|
58
|
+
},
|
|
59
|
+
"dependencies": {
|
|
60
|
+
"unbash": "4.0.10"
|
|
61
|
+
}
|
|
61
62
|
}
|