@itc-steve/pi-ask-complete 0.1.0 → 0.2.0

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.2.0
+
+- Path allows now act like directory-scoped YOLO for bash, write, and edit asks
+- Any matching bash or path deny now takes priority over every allow
+
 ## 0.1.0
 
 First public release.

package/README.md

@@ -16,8 +16,8 @@ Seeded `permission.json` allows non-destructive **explore / troubleshoot** comma
 out of the box (listing, read/print text, search, process/system info, network
 diagnostics, checksums, git read-only subcommands). `find`/`awk`/`curl`/`fd` etc are
 **ask** (not allow) — they are general exec engines.
-Path **deny** rules still block secret files even when the binary is allowed
-(`cat .env` → deny).
+Path **deny** rules still block secret files even when the binary or project
+directory is allowed (`cat .env` → deny).
 
 Still **ask** (not pre-allowed): writers and mutators — `rm`, `mv`, `cp`, `mkdir`,
 `touch`, `sed`, `tee`, `chmod`, package managers, `git push` / `commit` / `reset`,
@@ -40,9 +40,12 @@ Panel options: **Allow this** · **Allow for this session** · **Allow permanent
 ?     one char except /
 ```
 
-**Most-specific pattern wins.** The pattern that pins more of the filename tail
-takes precedence regardless of allow/deny, so `**/.env` **deny** beats a broad
-`Projects/**` **allow** for `Projects/app/.env`. Exact-specificity ties → deny wins.
+**Deny always wins.** If any matching path rule is `deny`, no `allow` can
+override it. Otherwise, a matching directory `allow` acts like path-scoped YOLO:
+bash asks running in that directory, plus writes and edits there, are approved
+automatically. A command that starts with `cd` into an allowed directory is also
+approved when all detected path arguments are allowed. Bash deny rules and path
+deny rules still block it.
 
 Bash commands are decomposed for **policy**: chains (`;` `|` `&&`) and substitutions
 each become a unit that must independently pass. Path-like args are checked against
@@ -103,15 +106,13 @@ Full starter list: `permission.json.example`.
 pi install npm:@itc-steve/pi-ask-complete
 ```
 
-Or from a local checkout:
+From a local checkout:
 
 ```bash
 pi install /path/to/pi-ask-complete
-# packages entry: "npm:@itc-steve/pi-ask-complete"
-# or: "../../Projects/pi-ask-complete"
 ```
 
-`/reload` after changes. `/permissions` shows current allows.
+Then `/reload`. `/permissions` shows current allows.
 
 ## `/yolo`
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@itc-steve/pi-ask-complete",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Pi extension: bottom-panel ask_user + bash permission gate (Allow / Allow permanently / Deny with reason) writing ~/.pi/agent/permission.json",
   "keywords": [
     "pi-package",

package/src/bash-scan.ts

@@ -280,6 +280,8 @@ export function cleanPathToken(token: string): string {
  */
 export function isUnresolvedPath(token: string): boolean {
   if (!token) return false;
+  // Bash expands ~user, but this gate only resolves the current user's ~/.
+  if (/^~[^/\s]+(?:\/|$)/.test(token)) return true;
   let i = 0;
   while (i < token.length) {
     const c = token[i]!;
@@ -361,6 +363,12 @@ export function pathArgs(command: string): string[] {
   // bare tokens (and if=/.git pathspec forms via cleanPathToken)
   for (const rawTok of src.split(/\s+/)) {
     if (!rawTok) continue;
+    // Attached option values commonly carry paths (`--file=.env`, `--chdir=/tmp`).
+    const optionValue = rawTok.match(/^--?[A-Za-z][A-Za-z0-9-]*=(.+)$/)?.[1];
+    if (optionValue) {
+      push(optionValue);
+      continue;
+    }
     // Keep if=.env visible to cleanPathToken (looksLikePath alone would skip `=`).
     if (/^(?:if|of|in|out|file|path|filename|dest|source)=/i.test(rawTok)) {
       push(rawTok);

package/src/permission-store.ts

@@ -26,6 +26,7 @@ import {
   wrapperHasArgs,
 } from "./base-command.ts";
 import {
+  cleanPathToken,
   hasUnresolvedExpansion,
   isUnresolvedPath,
   pathArgs,
@@ -51,6 +52,24 @@ function resolvePathArg(arg: string, cwd: string): string {
   return resolve(cwd, arg);
 }
 
+type ExecutionScope = { cwd: string; cdTarget?: string };
+
+/** Resolve one simple leading `cd path &&`; multiple/mid-chain cds are ambiguous. */
+function executionScope(command: string, cwd: string, units: string[]): ExecutionScope | undefined {
+  const cdUnits = units.filter((unit) => {
+    const effective = stripWrappers(unit) || unit;
+    return /^cd(?:\s|$)/.test(effective);
+  });
+  if (cdUnits.length === 0) return { cwd: resolve(cwd) };
+  if (cdUnits.length !== 1 || cdUnits[0] !== units[0]) return undefined;
+
+  const match = command.match(/^\s*cd\s+("[^"]*"|'[^']*'|[^\s;&|]+)\s*&&/);
+  if (!match?.[1]) return undefined;
+  const target = cleanPathToken(match[1]);
+  if (!target || target.startsWith("-") || isUnresolvedPath(target)) return undefined;
+  return { cwd: resolvePathArg(target, cwd), cdTarget: target };
+}
+
 function agentDir(): string {
   const fromEnv = process.env.PI_CODING_AGENT_DIR?.trim();
   if (fromEnv) return fromEnv;
@@ -251,19 +270,26 @@ export class PermissionStore {
       }
     }
 
-    // Path deny on the full line AND every unit (covers substitution bodies).
+    // Path deny on the full line and every unit (covers substitution bodies).
+    const scope = executionScope(command, cwd, units);
+    const effectiveCwd = normalizePath(scope?.cwd ?? resolve(cwd));
+    const cwdState = scope ? this.checkPath(effectiveCwd) : undefined;
     const pathCandidates = new Set<string>([
       ...pathArgs(command),
       ...units.flatMap((u) => pathArgs(u)),
     ]);
+    const actualPath = (arg: string): string => {
+      const base = scope?.cdTarget === cleanPathToken(arg) ? cwd : effectiveCwd;
+      return normalizePath(resolvePathArg(arg, base));
+    };
+    const pathIsAllowed = (arg: string): boolean =>
+      this.checkPath(actualPath(arg)) === "allow";
     for (const arg of pathCandidates) {
       // Literal token first (`$HOME/.env` matches **/.env as typed).
       if (this.checkPath(normalizePath(arg)) === "deny") {
         return { action: "deny", label: arg, kind: "path" };
       }
-      // Resolve ~/ and relative/`..` against cwd so `/etc/shadow` denies still hit.
-      const abs = resolvePathArg(arg, cwd);
-      if (normalizePath(abs) !== normalizePath(arg) && this.checkPath(normalizePath(abs)) === "deny") {
+      if (this.checkPath(actualPath(arg)) === "deny") {
         return { action: "deny", label: arg, kind: "path" };
       }
     }
@@ -292,6 +318,12 @@ export class PermissionStore {
       };
     }
 
+    // An allowed execution cwd acts like directory-scoped yolo only when every
+    // detected path stays allowed. Explicit path/bash denies above still win.
+    if (cwdState === "allow" && [...pathCandidates].every(pathIsAllowed)) {
+      return { action: "allow" };
+    }
+
     if (ask.length) {
       if (this.yoloOn) return { action: "allow" };
       return { action: "ask", units: ask };
@@ -315,7 +347,15 @@ export class PermissionStore {
 
   /** Rule lookup for a SINGLE command unit (no operators/substitutions). */
   checkUnit(command: string): RuleState {
-    const trimmed = command.trim();
+    let trimmed = command.trim();
+    for (let i = 0; i < 8; i++) {
+      const next = trimmed
+        .replace(/^(?:[!({]\s*|(?:then|do|else|if|while|until)\s+)/, "")
+        .replace(/\s*[)}]\s*$/, "")
+        .trim();
+      if (next === trimmed) break;
+      trimmed = next;
+    }
     // Peel env/strace/timeout/… so an allow-listed wrapper cannot launder the inner binary.
     // Bare `env` peels to "" → keep original so the wrapper itself can still allow.
     const peeled = stripWrappers(trimmed);
@@ -332,41 +372,27 @@ export class PermissionStore {
     // Never classify sudo/doas via the stripped inner binary (true; sudo id → id allow).
     if (/^(sudo|doas)$/i.test(rawBase)) return "deny";
 
-    if (rawBase && this.bash.has(rawBase)) {
-      const s = this.bash.get(rawBase)!;
-      if (s !== "ask") return s;
-    }
-
-    // Full-command subjects: resolved + normalized (e.g. strip `git -C path`)
+    // Full-command subjects: resolved + normalized (e.g. strip `git -C path`).
     const normalized = normalizeCommandForMatch(effective);
     const subjects =
       normalized !== effective ? [effective, normalized] : [effective];
-
-    for (const sub of subjects) {
-      if (this.bash.has(sub)) {
-        const s = this.bash.get(sub)!;
-        if (s !== "ask") return s;
-      }
-    }
-
     const base = baseCommand(effective);
-    if (base && base !== rawBase && this.bash.has(base)) {
-      const s = this.bash.get(base)!;
-      if (s !== "ask") return s;
-    }
 
-    // Wildcard patterns against full/normalized command, raw first token, base
+    // Check every matching rule so deny always beats allow, regardless of order
+    // or whether the allow matched a base and the deny matched a full command.
+    let configuredAllow = false;
     for (const [pattern, state] of this.bash) {
-      if (!pattern.includes("*") && !pattern.includes("?")) continue;
-      const hit =
-        subjects.some((sub) => matchGlob(pattern, sub)) ||
-        (rawBase ? matchGlob(pattern, rawBase) : false) ||
-        (base ? matchGlob(pattern, base) : false);
-      if (hit) {
-        if (state === "allow") return "allow";
-        if (state === "deny") return "deny";
-      }
+      const wildcard = pattern.includes("*") || pattern.includes("?");
+      const hit = wildcard
+        ? subjects.some((sub) => matchGlob(pattern, sub)) ||
+          (rawBase ? matchGlob(pattern, rawBase) : false) ||
+          (base ? matchGlob(pattern, base) : false)
+        : subjects.includes(pattern) || pattern === rawBase || pattern === base;
+      if (!hit) continue;
+      if (state === "deny") return "deny";
+      if (state === "allow") configuredAllow = true;
     }
+    if (configuredAllow) return "allow";
 
     // Session allow only upgrades ask → allow (never overrides deny).
     if ((base && this.sessionBash.has(base)) || (rawBase && this.sessionBash.has(rawBase))) {
@@ -390,18 +416,21 @@ export class PermissionStore {
     subject: string,
     filePath?: string,
   ): { state: RuleState; matched?: string } {
-    if (filePath) {
-      const pathState = this.checkPath(filePath);
-      if (pathState === "allow") return { state: "allow", matched: filePath };
-      if (pathState === "deny") return { state: "deny", matched: filePath };
-      if (this.sessionPaths.has(normalizePath(filePath))) {
-        return { state: "allow", matched: filePath };
-      }
-    }
-    const state =
+    const pathState = filePath ? this.checkPath(filePath) : undefined;
+    if (pathState === "deny") return { state: "deny", matched: filePath };
+
+    const toolState =
       toolName === "bash" ? this.checkBash(subject) : this.checkTool(toolName);
+    if (toolState === "deny") return { state: "deny" };
+
+    if (
+      filePath &&
+      (pathState === "allow" || this.sessionPaths.has(normalizePath(filePath)))
+    ) {
+      return { state: "allow", matched: filePath };
+    }
     // yolo already applied inside checkBash/checkTool (including glob asks).
-    return { state };
+    return { state: toolState };
   }
 
   isAllowed(toolName: string, subject: string, filePath?: string): boolean {

package/src/permission.ts

@@ -1,5 +1,5 @@
 // ask_permission + automatic gate for bash / write / edit / sudo_run / sensitive reads.
-// Path wildcards: most-specific wins; equal score → deny.
+// Path wildcards: any matching deny wins; directory allows act like scoped yolo.
 // Prompt: Allow this | Allow for this session | Allow permanently | Deny with reason
 // Bash: every unit is checked; one prompt per tool call (not per unit).
 // Session remembers all ask-bases; permanent writes the primary base only.
@@ -54,12 +54,12 @@ function blockReason(
   if (kind === "path") {
     return (
       `Blocked by path rule for \`${label}\`. ` +
-      `Add a paths allow entry in permission.json to override.`
+      `Remove or narrow the matching deny in permission.json.`
     );
   }
   return (
     `Blocked by permission rule for \`${label}\`. ` +
-    `Add an allow entry in permission.json to override.` +
+    `Remove or narrow the matching deny in permission.json.` +
     (extra ? ` ${extra}` : "")
   );
 }

package/src/wildcard.ts

@@ -76,27 +76,16 @@ export function globSpecificity(pattern: string): number {
   return suffix.replace(/[*?]/g, "").length;
 }
 
-/**
- * Most-specific matching rule wins, regardless of allow/deny. On an exact
- * specificity tie, deny wins (fail closed). Returns undefined when nothing
- * matches.
- */
+/** Any matching deny wins. Otherwise, any matching allow wins. */
 export function resolveRules(
   rules: ReadonlyArray<{ pattern: string; state: "allow" | "deny" }>,
   value: string,
 ): "allow" | "deny" | undefined {
-  let best: { state: "allow" | "deny"; score: number } | undefined;
+  let allowed = false;
   for (const rule of rules) {
     if (!matchGlob(rule.pattern, value)) continue;
-    const score = globSpecificity(rule.pattern);
-    if (
-      !best ||
-      score > best.score ||
-      // equal score → deny wins
-      (score === best.score && rule.state === "deny")
-    ) {
-      best = { state: rule.state, score };
-    }
+    if (rule.state === "deny") return "deny";
+    allowed = true;
   }
-  return best?.state;
+  return allowed ? "allow" : undefined;
 }