@melihmucuk/leash 1.0.7 → 1.0.8

package/dist/claude-code/leash.js

@@ -347,7 +347,11 @@ var CommandAnalyzer = class {
             reason: `Command "${name}" targets path outside working directory: ${path}`
           };
         }
-        const result = this.checkProtectedPath(path, `Command "${name}"`, resolveBase);
+        const result = this.checkProtectedPath(
+          path,
+          `Command "${name}"`,
+          resolveBase
+        );
         if (result.blocked) return result;
       }
     }
@@ -359,7 +363,10 @@ var CommandAnalyzer = class {
     if (!this.isPathAllowed(dest, true, resolveBase)) {
       return {
         blocked: true,
-        reason: `Command "cp" targets path outside working directory: ${this.resolvePath(dest, resolveBase)}`
+        reason: `Command "cp" targets path outside working directory: ${this.resolvePath(
+          dest,
+          resolveBase
+        )}`
       };
     }
     return this.checkProtectedPath(dest, 'Command "cp"', resolveBase);
@@ -371,7 +378,10 @@ var CommandAnalyzer = class {
     if (!this.isPathAllowed(dest, true, resolveBase)) {
       return {
         blocked: true,
-        reason: `Command "dd" targets path outside working directory: ${this.resolvePath(dest, resolveBase)}`
+        reason: `Command "dd" targets path outside working directory: ${this.resolvePath(
+          dest,
+          resolveBase
+        )}`
       };
     }
     return this.checkProtectedPath(dest, 'Command "dd"', resolveBase);
@@ -383,7 +393,10 @@ var CommandAnalyzer = class {
     if (!this.isPathAllowed(dest, true, resolveBase)) {
       return {
         blocked: true,
-        reason: `Command "mv" targets path outside working directory: ${this.resolvePath(dest, resolveBase)}`
+        reason: `Command "mv" targets path outside working directory: ${this.resolvePath(
+          dest,
+          resolveBase
+        )}`
       };
     }
     const destResult = this.checkProtectedPath(
@@ -396,7 +409,10 @@ var CommandAnalyzer = class {
       if (!this.isPathAllowed(source, false, resolveBase)) {
         return {
           blocked: true,
-          reason: `Command "mv" targets path outside working directory: ${this.resolvePath(source, resolveBase)}`
+          reason: `Command "mv" targets path outside working directory: ${this.resolvePath(
+            source,
+            resolveBase
+          )}`
         };
       }
       const sourceResult = this.checkProtectedPath(
@@ -413,7 +429,10 @@ var CommandAnalyzer = class {
       if (!this.isPathAllowed(path, false, resolveBase)) {
         return {
           blocked: true,
-          reason: `Command "${baseCmd}" targets path outside working directory: ${this.resolvePath(path, resolveBase)}`
+          reason: `Command "${baseCmd}" targets path outside working directory: ${this.resolvePath(
+            path,
+            resolveBase
+          )}`
         };
       }
       const result = this.checkProtectedPath(
@@ -431,7 +450,10 @@ var CommandAnalyzer = class {
       if (!this.isPathAllowed(path, allowDevicePaths, resolveBase)) {
         return {
           blocked: true,
-          reason: `Command "${baseCmd}" targets path outside working directory: ${this.resolvePath(path, resolveBase)}`
+          reason: `Command "${baseCmd}" targets path outside working directory: ${this.resolvePath(
+            path,
+            resolveBase
+          )}`
         };
       }
       const result = this.checkProtectedPath(

package/dist/factory/leash.js

@@ -347,7 +347,11 @@ var CommandAnalyzer = class {
             reason: `Command "${name}" targets path outside working directory: ${path}`
           };
         }
-        const result = this.checkProtectedPath(path, `Command "${name}"`, resolveBase);
+        const result = this.checkProtectedPath(
+          path,
+          `Command "${name}"`,
+          resolveBase
+        );
         if (result.blocked) return result;
       }
     }
@@ -359,7 +363,10 @@ var CommandAnalyzer = class {
     if (!this.isPathAllowed(dest, true, resolveBase)) {
       return {
         blocked: true,
-        reason: `Command "cp" targets path outside working directory: ${this.resolvePath(dest, resolveBase)}`
+        reason: `Command "cp" targets path outside working directory: ${this.resolvePath(
+          dest,
+          resolveBase
+        )}`
       };
     }
     return this.checkProtectedPath(dest, 'Command "cp"', resolveBase);
@@ -371,7 +378,10 @@ var CommandAnalyzer = class {
     if (!this.isPathAllowed(dest, true, resolveBase)) {
       return {
         blocked: true,
-        reason: `Command "dd" targets path outside working directory: ${this.resolvePath(dest, resolveBase)}`
+        reason: `Command "dd" targets path outside working directory: ${this.resolvePath(
+          dest,
+          resolveBase
+        )}`
       };
     }
     return this.checkProtectedPath(dest, 'Command "dd"', resolveBase);
@@ -383,7 +393,10 @@ var CommandAnalyzer = class {
     if (!this.isPathAllowed(dest, true, resolveBase)) {
       return {
         blocked: true,
-        reason: `Command "mv" targets path outside working directory: ${this.resolvePath(dest, resolveBase)}`
+        reason: `Command "mv" targets path outside working directory: ${this.resolvePath(
+          dest,
+          resolveBase
+        )}`
       };
     }
     const destResult = this.checkProtectedPath(
@@ -396,7 +409,10 @@ var CommandAnalyzer = class {
       if (!this.isPathAllowed(source, false, resolveBase)) {
         return {
           blocked: true,
-          reason: `Command "mv" targets path outside working directory: ${this.resolvePath(source, resolveBase)}`
+          reason: `Command "mv" targets path outside working directory: ${this.resolvePath(
+            source,
+            resolveBase
+          )}`
         };
       }
       const sourceResult = this.checkProtectedPath(
@@ -413,7 +429,10 @@ var CommandAnalyzer = class {
       if (!this.isPathAllowed(path, false, resolveBase)) {
         return {
           blocked: true,
-          reason: `Command "${baseCmd}" targets path outside working directory: ${this.resolvePath(path, resolveBase)}`
+          reason: `Command "${baseCmd}" targets path outside working directory: ${this.resolvePath(
+            path,
+            resolveBase
+          )}`
         };
       }
       const result = this.checkProtectedPath(
@@ -431,7 +450,10 @@ var CommandAnalyzer = class {
       if (!this.isPathAllowed(path, allowDevicePaths, resolveBase)) {
         return {
           blocked: true,
-          reason: `Command "${baseCmd}" targets path outside working directory: ${this.resolvePath(path, resolveBase)}`
+          reason: `Command "${baseCmd}" targets path outside working directory: ${this.resolvePath(
+            path,
+            resolveBase
+          )}`
         };
       }
       const result = this.checkProtectedPath(

package/dist/opencode/leash.js

@@ -345,7 +345,11 @@ var CommandAnalyzer = class {
             reason: `Command "${name}" targets path outside working directory: ${path}`
           };
         }
-        const result = this.checkProtectedPath(path, `Command "${name}"`, resolveBase);
+        const result = this.checkProtectedPath(
+          path,
+          `Command "${name}"`,
+          resolveBase
+        );
         if (result.blocked) return result;
       }
     }
@@ -357,7 +361,10 @@ var CommandAnalyzer = class {
     if (!this.isPathAllowed(dest, true, resolveBase)) {
       return {
         blocked: true,
-        reason: `Command "cp" targets path outside working directory: ${this.resolvePath(dest, resolveBase)}`
+        reason: `Command "cp" targets path outside working directory: ${this.resolvePath(
+          dest,
+          resolveBase
+        )}`
       };
     }
     return this.checkProtectedPath(dest, 'Command "cp"', resolveBase);
@@ -369,7 +376,10 @@ var CommandAnalyzer = class {
     if (!this.isPathAllowed(dest, true, resolveBase)) {
       return {
         blocked: true,
-        reason: `Command "dd" targets path outside working directory: ${this.resolvePath(dest, resolveBase)}`
+        reason: `Command "dd" targets path outside working directory: ${this.resolvePath(
+          dest,
+          resolveBase
+        )}`
       };
     }
     return this.checkProtectedPath(dest, 'Command "dd"', resolveBase);
@@ -381,7 +391,10 @@ var CommandAnalyzer = class {
     if (!this.isPathAllowed(dest, true, resolveBase)) {
       return {
         blocked: true,
-        reason: `Command "mv" targets path outside working directory: ${this.resolvePath(dest, resolveBase)}`
+        reason: `Command "mv" targets path outside working directory: ${this.resolvePath(
+          dest,
+          resolveBase
+        )}`
       };
     }
     const destResult = this.checkProtectedPath(
@@ -394,7 +407,10 @@ var CommandAnalyzer = class {
       if (!this.isPathAllowed(source, false, resolveBase)) {
         return {
           blocked: true,
-          reason: `Command "mv" targets path outside working directory: ${this.resolvePath(source, resolveBase)}`
+          reason: `Command "mv" targets path outside working directory: ${this.resolvePath(
+            source,
+            resolveBase
+          )}`
         };
       }
       const sourceResult = this.checkProtectedPath(
@@ -411,7 +427,10 @@ var CommandAnalyzer = class {
       if (!this.isPathAllowed(path, false, resolveBase)) {
         return {
           blocked: true,
-          reason: `Command "${baseCmd}" targets path outside working directory: ${this.resolvePath(path, resolveBase)}`
+          reason: `Command "${baseCmd}" targets path outside working directory: ${this.resolvePath(
+            path,
+            resolveBase
+          )}`
         };
       }
       const result = this.checkProtectedPath(
@@ -429,7 +448,10 @@ var CommandAnalyzer = class {
       if (!this.isPathAllowed(path, allowDevicePaths, resolveBase)) {
         return {
           blocked: true,
-          reason: `Command "${baseCmd}" targets path outside working directory: ${this.resolvePath(path, resolveBase)}`
+          reason: `Command "${baseCmd}" targets path outside working directory: ${this.resolvePath(
+            path,
+            resolveBase
+          )}`
         };
       }
       const result = this.checkProtectedPath(

package/dist/pi/leash.js

@@ -345,7 +345,11 @@ var CommandAnalyzer = class {
             reason: `Command "${name}" targets path outside working directory: ${path}`
           };
         }
-        const result = this.checkProtectedPath(path, `Command "${name}"`, resolveBase);
+        const result = this.checkProtectedPath(
+          path,
+          `Command "${name}"`,
+          resolveBase
+        );
         if (result.blocked) return result;
       }
     }
@@ -357,7 +361,10 @@ var CommandAnalyzer = class {
     if (!this.isPathAllowed(dest, true, resolveBase)) {
       return {
         blocked: true,
-        reason: `Command "cp" targets path outside working directory: ${this.resolvePath(dest, resolveBase)}`
+        reason: `Command "cp" targets path outside working directory: ${this.resolvePath(
+          dest,
+          resolveBase
+        )}`
       };
     }
     return this.checkProtectedPath(dest, 'Command "cp"', resolveBase);
@@ -369,7 +376,10 @@ var CommandAnalyzer = class {
     if (!this.isPathAllowed(dest, true, resolveBase)) {
       return {
         blocked: true,
-        reason: `Command "dd" targets path outside working directory: ${this.resolvePath(dest, resolveBase)}`
+        reason: `Command "dd" targets path outside working directory: ${this.resolvePath(
+          dest,
+          resolveBase
+        )}`
       };
     }
     return this.checkProtectedPath(dest, 'Command "dd"', resolveBase);
@@ -381,7 +391,10 @@ var CommandAnalyzer = class {
     if (!this.isPathAllowed(dest, true, resolveBase)) {
       return {
         blocked: true,
-        reason: `Command "mv" targets path outside working directory: ${this.resolvePath(dest, resolveBase)}`
+        reason: `Command "mv" targets path outside working directory: ${this.resolvePath(
+          dest,
+          resolveBase
+        )}`
       };
     }
     const destResult = this.checkProtectedPath(
@@ -394,7 +407,10 @@ var CommandAnalyzer = class {
       if (!this.isPathAllowed(source, false, resolveBase)) {
         return {
           blocked: true,
-          reason: `Command "mv" targets path outside working directory: ${this.resolvePath(source, resolveBase)}`
+          reason: `Command "mv" targets path outside working directory: ${this.resolvePath(
+            source,
+            resolveBase
+          )}`
         };
       }
       const sourceResult = this.checkProtectedPath(
@@ -411,7 +427,10 @@ var CommandAnalyzer = class {
       if (!this.isPathAllowed(path, false, resolveBase)) {
         return {
           blocked: true,
-          reason: `Command "${baseCmd}" targets path outside working directory: ${this.resolvePath(path, resolveBase)}`
+          reason: `Command "${baseCmd}" targets path outside working directory: ${this.resolvePath(
+            path,
+            resolveBase
+          )}`
         };
       }
       const result = this.checkProtectedPath(
@@ -429,7 +448,10 @@ var CommandAnalyzer = class {
       if (!this.isPathAllowed(path, allowDevicePaths, resolveBase)) {
         return {
           blocked: true,
-          reason: `Command "${baseCmd}" targets path outside working directory: ${this.resolvePath(path, resolveBase)}`
+          reason: `Command "${baseCmd}" targets path outside working directory: ${this.resolvePath(
+            path,
+            resolveBase
+          )}`
         };
       }
       const result = this.checkProtectedPath(
@@ -544,17 +566,15 @@ async function checkForUpdates() {
 // packages/pi/leash.ts
 function leash_default(pi) {
   let analyzer = null;
-  pi.on("session", async (event, ctx) => {
-    if (event.reason === "start") {
-      analyzer = new CommandAnalyzer(ctx.cwd);
-      ctx.ui.notify("\u{1F512} Leash active", "info");
-      const update = await checkForUpdates();
-      if (update.hasUpdate) {
-        ctx.ui.notify(
-          `\u{1F504} Leash ${update.latestVersion} available. Run: leash --update (restart required)`,
-          "warning"
-        );
-      }
+  pi.on("session_start", async (_event, ctx) => {
+    analyzer = new CommandAnalyzer(ctx.cwd);
+    ctx.ui.notify("\u{1F512} Leash active", "info");
+    const update = await checkForUpdates();
+    if (update.hasUpdate) {
+      ctx.ui.notify(
+        `\u{1F504} Leash ${update.latestVersion} available. Run: leash --update (restart required)`,
+        "warning"
+      );
     }
   });
   pi.on("tool_call", async (event, ctx) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@melihmucuk/leash",
-  "version": "1.0.7",
+  "version": "1.0.8",
   "type": "module",
   "description": "Security guardrails for AI coding agents",
   "bin": {
@@ -49,8 +49,8 @@
     "build:factory": "esbuild packages/factory/leash.ts --bundle --outfile=dist/factory/leash.js --platform=node --format=esm"
   },
   "devDependencies": {
-    "@mariozechner/pi-coding-agent": "^0.27.2",
-    "@opencode-ai/plugin": "^1.0.191",
+    "@mariozechner/pi-coding-agent": "^0.31.0",
+    "@opencode-ai/plugin": "^1.0.224",
     "@types/node": "^22.19.3",
     "esbuild": "^0.27.2",
     "typescript": "^5.9.3"