@piagent/platform 1.2.8 → 1.2.10

package/packages/piagent-core/extensions/context-index-policy.js

@@ -0,0 +1,136 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+
+import { resolveProjectProfileDocument } from "../capabilities/project-profile.js";
+
+const DEFAULT_CONTEXT_INDEX_PATH = ".pi/context-index.json";
+const CONTEXT_ENGINE_STATE_PATTERN = ".pi/piagent-state/**";
+const EXCLUDE_POLICY_VERSION = 2;
+
+function stringArray(value) {
+  return Array.isArray(value)
+    ? value.filter((item) => typeof item === "string" && item.trim().length > 0)
+    : [];
+}
+
+function uniqueStrings(values) {
+  return [...new Set(values.map((value) => value.trim()).filter(Boolean))];
+}
+
+function compareCodePoints(left, right) {
+  return left < right ? -1 : left > right ? 1 : 0;
+}
+
+function normalizePattern(value) {
+  return String(value ?? "")
+    .trim()
+    .replaceAll("\\", "/")
+    .replace(/^\.\/+/, "")
+    .replace(/\/+/g, "/");
+}
+
+function readJsonObject(file, label, { optional = false } = {}) {
+  if (!fs.existsSync(file)) {
+    if (optional) return undefined;
+    throw new Error(`${label} is missing at ${file}`);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(fs.readFileSync(file, "utf8"));
+  } catch {
+    throw new Error(`${label} is not valid JSON: ${file}`);
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error(`${label} must contain a JSON object: ${file}`);
+  }
+  return parsed;
+}
+
+export function contextIndexStatePath(profile) {
+  const configured = profile?.contextIndex?.path;
+  return typeof configured === "string" && configured.trim()
+    ? configured.trim()
+    : DEFAULT_CONTEXT_INDEX_PATH;
+}
+
+export function effectiveProtectedPaths(policy = {}, profile = {}) {
+  const policyProtectedPaths = stringArray(policy.protectedPaths);
+  const baseReadProtectedPaths = Array.isArray(policy.shellProtectedPaths)
+    ? stringArray(policy.shellProtectedPaths)
+    : policyProtectedPaths;
+  const profileProtectedPaths = stringArray(profile.protectedPaths);
+  const profileShellProtectedPaths = Array.isArray(profile.shellProtectedPaths)
+    ? stringArray(profile.shellProtectedPaths)
+    : profileProtectedPaths;
+  const readOnlyPaths = stringArray(profile.readOnlyPaths);
+  const contextIndexPath = contextIndexStatePath(profile);
+  return {
+    readProtectedPaths: uniqueStrings([
+      ...baseReadProtectedPaths,
+      ...profileProtectedPaths,
+      contextIndexPath
+    ]),
+    writeProtectedPaths: uniqueStrings([
+      ...policyProtectedPaths,
+      ...profileProtectedPaths,
+      ...readOnlyPaths,
+      contextIndexPath
+    ]),
+    shellProtectedPaths: uniqueStrings([
+      ...baseReadProtectedPaths,
+      ...profileShellProtectedPaths,
+      ...readOnlyPaths,
+      contextIndexPath
+    ]),
+    readOnlyPaths: uniqueStrings(readOnlyPaths)
+  };
+}
+
+export function normalizeContextIndexExcludePatterns(patterns) {
+  return uniqueStrings(stringArray(patterns).map(normalizePattern)).sort(compareCodePoints);
+}
+
+export function contextIndexExcludePatterns(policy, profile) {
+  const effective = effectiveProtectedPaths(policy, profile);
+  return normalizeContextIndexExcludePatterns([
+    ...effective.readProtectedPaths,
+    ...effective.writeProtectedPaths,
+    ...effective.shellProtectedPaths,
+    CONTEXT_ENGINE_STATE_PATTERN
+  ]);
+}
+
+export function contextIndexExcludeDigest(patterns) {
+  return crypto
+    .createHash("sha256")
+    .update(JSON.stringify({
+      version: EXCLUDE_POLICY_VERSION,
+      patterns: normalizeContextIndexExcludePatterns(patterns)
+    }))
+    .digest("hex");
+}
+
+export function contextIndexExcludePolicyVersion() {
+  return EXCLUDE_POLICY_VERSION;
+}
+
+export function loadProjectContextIndexPolicy(platformRoot, projectPath, options = {}) {
+  const policyPath = path.join(platformRoot, "packages", "piagent-core", "policies", "base-policy.json");
+  const policy = readJsonObject(policyPath, "Piagent base policy");
+  const explicitProfilePath = typeof options.profilePath === "string" && options.profilePath.trim()
+    ? path.resolve(options.profilePath)
+    : undefined;
+  const profilePath = explicitProfilePath ?? path.join(projectPath, ".pi", "piagent-profile.json");
+  const stored = readJsonObject(profilePath, "Piagent project profile", { optional: !explicitProfilePath });
+  const profile = stored
+    ? resolveProjectProfileDocument(platformRoot, stored).profile
+    : {};
+  return {
+    policy,
+    profile,
+    profilePath,
+    profileSource: explicitProfilePath ? "env" : stored ? "project" : "fallback",
+    excludePatterns: contextIndexExcludePatterns(policy, profile)
+  };
+}

package/packages/piagent-core/extensions/piagent-guard.ts

@@ -81,10 +81,15 @@ import {
   buildTestImpact,
   classifyContextTask,
   contextIndexV2Status,
+  ensureContextIndexV2,
   estimateContextTokens,
   searchContextIndexV2,
   toolResultFingerprint
 } from "./context-engine.js";
+import {
+  contextIndexExcludePatterns,
+  effectiveProtectedPaths
+} from "./context-index-policy.js";
 
 import type { ActionClassification } from "./guard-shell-analysis.ts";
 
@@ -99,7 +104,6 @@ import type {
   ContextIndexNodeKind,
   ContextIndexSettings,
   ContextPreflight,
-  EffectiveProtectedPaths,
   ExecPolicyConfig,
   ExternalActionPolicyConfig,
   FinalGateConfig,
@@ -259,6 +263,14 @@ type ChatImageAttachmentResult = {
   skipped: Array<{ path: string; reason: string }>;
 };
 
+type ChatImageAccessPolicy = {
+  roots: ReturnType<typeof resolveDocumentRoots>;
+  readProtectedPaths: string[];
+  filesystemRead?: string[];
+  enforceFilesystemRead: boolean;
+  onImageInspected?: (path: string) => void;
+};
+
 const DEFAULT_MEMORY_SETTINGS: Required<MemorySettings> = {
   enabled: true,
   mode: "manual",
@@ -1921,34 +1933,6 @@ function uniqueStrings(values: string[]): string[] {
   return [...new Set(values.filter((value) => typeof value === "string" && value.trim().length > 0))];
 }
 
-function effectiveProtectedPaths(policy: BasePolicy, profile: ProjectProfile): EffectiveProtectedPaths {
-  const baseReadProtectedPaths = policy.shellProtectedPaths ?? policy.protectedPaths;
-  const profileProtectedPaths = profile.protectedPaths ?? [];
-  const profileShellProtectedPaths = profile.shellProtectedPaths ?? profile.protectedPaths ?? [];
-  const readOnlyPaths = profile.readOnlyPaths ?? [];
-  const contextIndexStatePath = resolveContextIndexSettings(profile).path;
-  return {
-    readProtectedPaths: uniqueStrings([
-      ...baseReadProtectedPaths,
-      ...profileProtectedPaths,
-      contextIndexStatePath
-    ]),
-    writeProtectedPaths: uniqueStrings([
-      ...policy.protectedPaths,
-      ...profileProtectedPaths,
-      ...readOnlyPaths,
-      contextIndexStatePath
-    ]),
-    shellProtectedPaths: uniqueStrings([
-      ...baseReadProtectedPaths,
-      ...profileShellProtectedPaths,
-      ...readOnlyPaths,
-      contextIndexStatePath
-    ]),
-    readOnlyPaths: uniqueStrings(readOnlyPaths)
-  };
-}
-
 function classifyExternalAction(toolName: string, input: Record<string, unknown>, policy: BasePolicy): {
   decision: "not-external" | "safe-read" | "confirm";
   provider?: string;
@@ -4009,29 +3993,55 @@ function escapeRegExp(input: string): string {
   return input.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
-function supportedImageMimeType(filePath: string, bytes: Buffer): string | undefined {
-  if (bytes.length >= 8 && bytes.subarray(0, 8).equals(Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]))) {
+function supportedImageMimeType(bytes: Buffer): string | undefined {
+  if (
+    bytes.length >= 24
+    && bytes.subarray(0, 8).equals(Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]))
+    && bytes.readUInt32BE(8) === 13
+    && bytes.subarray(12, 16).toString("ascii") === "IHDR"
+    && bytes.readUInt32BE(16) > 0
+    && bytes.readUInt32BE(20) > 0
+  ) {
     return "image/png";
   }
-  if (bytes.length >= 3 && bytes[0] === 0xff && bytes[1] === 0xd8 && bytes[2] === 0xff) {
+  if (
+    bytes.length >= 4
+    && bytes[0] === 0xff
+    && bytes[1] === 0xd8
+    && bytes[2] === 0xff
+    && bytes[bytes.length - 2] === 0xff
+    && bytes[bytes.length - 1] === 0xd9
+  ) {
     return "image/jpeg";
   }
-  if (bytes.length >= 6) {
+  if (bytes.length >= 10) {
     const head = bytes.subarray(0, 6).toString("ascii");
-    if (head === "GIF87a" || head === "GIF89a") return "image/gif";
+    if (
+      (head === "GIF87a" || head === "GIF89a")
+      && bytes.readUInt16LE(6) > 0
+      && bytes.readUInt16LE(8) > 0
+    ) {
+      return "image/gif";
+    }
   }
-  if (bytes.length >= 12 && bytes.subarray(0, 4).toString("ascii") === "RIFF" && bytes.subarray(8, 12).toString("ascii") === "WEBP") {
+  if (
+    bytes.length >= 16
+    && bytes.subarray(0, 4).toString("ascii") === "RIFF"
+    && bytes.subarray(8, 12).toString("ascii") === "WEBP"
+    && ["VP8 ", "VP8L", "VP8X"].includes(bytes.subarray(12, 16).toString("ascii"))
+    && bytes.readUInt32LE(4) + 8 <= bytes.length
+  ) {
     return "image/webp";
   }
-  if (bytes.length >= 2 && bytes[0] === 0x42 && bytes[1] === 0x4d) {
+  if (
+    bytes.length >= 26
+    && bytes[0] === 0x42
+    && bytes[1] === 0x4d
+    && bytes.readUInt32LE(2) <= bytes.length
+    && bytes.readUInt32LE(14) >= 12
+  ) {
     return "image/bmp";
   }
-  const ext = path.extname(filePath).toLowerCase().replace(/^\./, "");
-  if (ext === "png") return "image/png";
-  if (ext === "jpg" || ext === "jpeg") return "image/jpeg";
-  if (ext === "gif") return "image/gif";
-  if (ext === "webp") return "image/webp";
-  if (ext === "bmp") return "image/bmp";
   return undefined;
 }
 
@@ -4085,9 +4095,131 @@ function extractLocalImagePathCandidates(text: string, cwd: string): string[] {
   return [...candidates];
 }
 
-function attachLocalImagesFromText(text: string, existingImages: unknown[] | undefined, cwd: string): ChatImageAttachmentResult | undefined {
+type ResolvedChatImage =
+  | { status: "ok"; absolutePath: string; bytes: Buffer; mimeType: string }
+  | { status: "error"; reason: string };
+
+function pathContainedBy(root: string, candidate: string): boolean {
+  if (candidate === root) return true;
+  const relative = path.relative(root, candidate);
+  return relative.length > 0
+    && relative !== ".."
+    && !relative.startsWith(`..${path.sep}`)
+    && !path.isAbsolute(relative);
+}
+
+export function readChatImage(
+  requestedPath: string,
+  cwd: string,
+  access: ChatImageAccessPolicy
+): ResolvedChatImage {
+  const lexicalRequestedPath = path.isAbsolute(requestedPath)
+    ? path.normalize(requestedPath)
+    : path.resolve(cwd, requestedPath);
+  const lexicalProjectRoot = path.resolve(cwd);
+  const requestedProjectLexicalRelative = pathContainedBy(lexicalProjectRoot, lexicalRequestedPath)
+    ? path.relative(lexicalProjectRoot, lexicalRequestedPath).split(path.sep).join("/") || "."
+    : undefined;
+  let canonicalPath: string;
+  let inspected: fs.Stats;
+  try {
+    canonicalPath = fs.realpathSync.native(requestedPath);
+    inspected = fs.statSync(canonicalPath);
+  } catch {
+    return { status: "error", reason: "file does not exist or cannot be inspected" };
+  }
+  if (!inspected.isFile()) return { status: "error", reason: "not a regular file" };
+  if (inspected.size <= 0) return { status: "error", reason: "empty file" };
+  if (inspected.size > MAX_CHAT_IMAGE_BYTES) {
+    return {
+      status: "error",
+      reason: `image is ${formatCount(inspected.size)} bytes > ${formatCount(MAX_CHAT_IMAGE_BYTES)} byte limit`
+    };
+  }
+
+  const root = access.roots.find((candidate) => pathContainedBy(candidate.path, canonicalPath));
+  if (!root) return { status: "error", reason: "outside the project and every granted additionalReadRoots directory" };
+
+  const rootRelative = path.relative(root.path, canonicalPath).split(path.sep).join("/") || ".";
+  const projectRoot = access.roots.find((candidate) => candidate.source === "project");
+  let canonicalRequestedLocation = requestedPath;
+  try {
+    canonicalRequestedLocation = path.join(
+      fs.realpathSync.native(path.dirname(requestedPath)),
+      path.basename(requestedPath)
+    );
+  } catch {
+    // The full target already resolved. This location form only preserves the
+    // final symlink's policy position, so failure falls back to the raw path.
+  }
+  const requestedProjectRelative = projectRoot && pathContainedBy(projectRoot.path, canonicalRequestedLocation)
+    ? path.relative(projectRoot.path, canonicalRequestedLocation).split(path.sep).join("/") || "."
+    : undefined;
+  const protectedMatch = matchesProtectedPath(canonicalPath, access.readProtectedPaths)
+    ?? matchesProtectedPath(rootRelative, access.readProtectedPaths)
+    ?? matchesProtectedPath(canonicalRequestedLocation, access.readProtectedPaths)
+    ?? matchesProtectedPath(requestedPath, access.readProtectedPaths)
+    ?? (requestedProjectLexicalRelative
+      ? matchesProtectedPath(requestedProjectLexicalRelative, access.readProtectedPaths)
+      : undefined)
+    ?? (requestedProjectRelative ? matchesProtectedPath(requestedProjectRelative, access.readProtectedPaths) : undefined);
+  if (protectedMatch) return { status: "error", reason: `matches protected path ${protectedMatch}` };
+
+  if (
+    root.source === "project"
+    && access.enforceFilesystemRead
+    && access.filesystemRead
+    && !matchesAnyPath(rootRelative, access.filesystemRead)
+  ) {
+    return {
+      status: "error",
+      reason: `outside the resolved filesystem read scope (${access.filesystemRead.join(", ")})`
+    };
+  }
+
+  access.onImageInspected?.(canonicalPath);
+  const openFlags = fs.constants.O_RDONLY | fs.constants.O_NONBLOCK | fs.constants.O_NOFOLLOW;
+  let fd: number;
+  try {
+    fd = fs.openSync(canonicalPath, openFlags);
+  } catch {
+    return { status: "error", reason: "file changed before it could be opened" };
+  }
+  try {
+    const opened = fs.fstatSync(fd);
+    if (
+      !opened.isFile()
+      || opened.dev !== inspected.dev
+      || opened.ino !== inspected.ino
+      || opened.size !== inspected.size
+    ) {
+      return { status: "error", reason: "file changed between the safety checks and the read" };
+    }
+    const bytes = Buffer.alloc(opened.size);
+    let offset = 0;
+    while (offset < bytes.length) {
+      const read = fs.readSync(fd, bytes, offset, bytes.length - offset, offset);
+      if (read <= 0) break;
+      offset += read;
+    }
+    if (offset !== bytes.length) return { status: "error", reason: "file changed while it was being read" };
+    const mimeType = supportedImageMimeType(bytes);
+    if (!mimeType) return { status: "error", reason: "file bytes are not a supported image" };
+    return { status: "ok", absolutePath: canonicalPath, bytes, mimeType };
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+
+function attachLocalImagesFromText(
+  text: string,
+  existingImages: unknown[] | undefined,
+  cwd: string,
+  resolveAccess: () => ChatImageAccessPolicy
+): ChatImageAttachmentResult | undefined {
   const imagePaths = extractLocalImagePathCandidates(text, cwd);
   if (imagePaths.length === 0) return undefined;
+  const access = resolveAccess();
 
   const existing = Array.isArray(existingImages) ? existingImages : [];
   const images: ChatImageAttachmentResult["images"] = [];
@@ -4101,28 +4233,14 @@ function attachLocalImagesFromText(text: string, existingImages: unknown[] | und
       continue;
     }
     try {
-      const stat = fs.statSync(imagePath);
-      if (!stat.isFile()) {
-        skipped.push({ path: imagePath, reason: "not a file" });
-        continue;
-      }
-      if (stat.size <= 0) {
-        skipped.push({ path: imagePath, reason: "empty file" });
-        continue;
-      }
-      if (stat.size > MAX_CHAT_IMAGE_BYTES) {
-        skipped.push({ path: imagePath, reason: `image is ${formatCount(stat.size)} bytes > ${formatCount(MAX_CHAT_IMAGE_BYTES)} byte limit; use read on the file so Pi can resize it` });
-        continue;
-      }
-      const bytes = fs.readFileSync(imagePath);
-      const mimeType = supportedImageMimeType(imagePath, bytes);
-      if (!mimeType) {
-        skipped.push({ path: imagePath, reason: "unsupported image type" });
+      const resolved = readChatImage(imagePath, cwd, access);
+      if (resolved.status === "error") {
+        skipped.push({ path: imagePath, reason: resolved.reason });
         continue;
       }
       const marker = `[image${existing.length + images.length + 1}]`;
-      images.push({ type: "image", mimeType, data: bytes.toString("base64") });
-      attached.push({ marker, path: imagePath, mimeType, bytes: stat.size });
+      images.push({ type: "image", mimeType: resolved.mimeType, data: resolved.bytes.toString("base64") });
+      attached.push({ marker, path: imagePath, mimeType: resolved.mimeType, bytes: resolved.bytes.length });
       nextText = nextText.replace(new RegExp(escapeRegExp(imagePath), "g"), marker);
       nextText = nextText.replace(new RegExp(escapeRegExp(`file://${imagePath}`), "g"), marker);
     } catch (error) {
@@ -4480,7 +4598,9 @@ export default function piagentGuard(pi: ExtensionAPI) {
     if (updateNotice) ctx.ui.notify(updateNotice, "info");
     let engineStatus: unknown;
     try {
-      engineStatus = await contextIndexV2Status(ctx.cwd);
+      engineStatus = await contextIndexV2Status(ctx.cwd, {
+        excludePatterns: contextIndexExcludePatterns(policy, profile)
+      });
     } catch (error) {
       engineStatus = { exists: false, error: error instanceof Error ? error.message : String(error) };
     }
@@ -4506,7 +4626,22 @@ export default function piagentGuard(pi: ExtensionAPI) {
       termCount: taskSignal.terms.length
     });
 
-    const imageAttachment = attachLocalImagesFromText(text, event.images, ctx.cwd);
+    const imageAttachment = attachLocalImagesFromText(text, event.images, ctx.cwd, () => {
+      const projectTrusted = ctx.isProjectTrusted();
+      const profile = loadProfileFromContext(ctx);
+      const permissionProfile = resolvePermissionProfile(profile, policy, permissionOverrideFromContext(ctx));
+      const capabilityState = verifyProjectCapabilityState(extensionDir, ctx.cwd, projectTrusted);
+      return {
+        roots: resolveDocumentRoots({
+          cwd: ctx.cwd,
+          profileRoots: profile.additionalReadRoots,
+          environmentRoots: process.env.PIAGENT_ADDITIONAL_READ_ROOTS
+        }),
+        readProtectedPaths: effectiveProtectedPaths(policy, profile).readProtectedPaths,
+        filesystemRead: capabilityState.filesystemRead,
+        enforceFilesystemRead: permissionProfile.mode !== "trusted-full-access"
+      };
+    });
     if (imageAttachment?.attached.length) {
       ctx.ui.notify(`Piagent image input: attached ${imageAttachment.attached.map((item) => item.marker).join(", ")}`, "info");
     } else if (imageAttachment?.skipped.length) {
@@ -4590,7 +4725,12 @@ export default function piagentGuard(pi: ExtensionAPI) {
     autoPackedPrompts.add(signal.promptHash);
     if (autoPackedPrompts.size > 50) autoPackedPrompts.delete(autoPackedPrompts.values().next().value as string);
     try {
-      const status = await contextIndexV2Status(ctx.cwd);
+      const excludePatterns = contextIndexExcludePatterns(policy, loadProfileFromContext(ctx));
+      const ensured = await ensureContextIndexV2(ctx.cwd, {
+        excludePatterns,
+        rebuildMissing: false
+      });
+      const status = ensured.status;
       if (!status.exists || status.stale) {
         telemetry(ctx, {
           event: "context_pack",
@@ -4603,7 +4743,12 @@ export default function piagentGuard(pi: ExtensionAPI) {
         return;
       }
       const budgetTokens = signal.lane === "high-risk" ? 1_200 : signal.lane === "tiny" ? 500 : 900;
-      const pack = await buildContextPack(ctx.cwd, query, { budgetTokens, includeCode: false, limit: 12 });
+      const pack = await buildContextPack(ctx.cwd, query, {
+        budgetTokens,
+        includeCode: false,
+        limit: 12,
+        excludePatterns
+      });
       telemetry(ctx, {
         event: "context_pack",
         queryHash: pack.queryHash,
@@ -5029,17 +5174,11 @@ export default function piagentGuard(pi: ExtensionAPI) {
     }),
     async execute(_toolCallId, params, _signal, _onUpdate, ctx) {
       const profile = loadProfileFromContext(ctx);
-      const pathPolicy = effectiveProtectedPaths(policy, profile);
-      const excludePatterns = Array.from(new Set([
-        ...pathPolicy.readProtectedPaths,
-        ...pathPolicy.writeProtectedPaths,
-        ".pi/context-index.json",
-        ".pi/piagent-state/**"
-      ]));
+      const excludePatterns = contextIndexExcludePatterns(policy, profile);
       let result: unknown;
       let text: string;
       if (params.action === "status") {
-        result = await contextIndexV2Status(ctx.cwd);
+        result = await contextIndexV2Status(ctx.cwd, { excludePatterns });
         const status = result as Awaited<ReturnType<typeof contextIndexV2Status>>;
         text = [
           `indexV2: ${status.exists ? "ready" : "missing"}`,
@@ -5062,12 +5201,13 @@ export default function piagentGuard(pi: ExtensionAPI) {
         ].join("\n");
       } else if (params.action === "search") {
         if (!params.query?.trim()) throw new Error("query is required for context search");
-        let status = await contextIndexV2Status(ctx.cwd);
-        if (params.refresh || !status.exists) {
-          await buildContextIndexV2(ctx.cwd, { excludePatterns });
-          status = await contextIndexV2Status(ctx.cwd);
-        }
-        result = await searchContextIndexV2(ctx.cwd, params.query, { limit: 15 });
+        const ensured = await ensureContextIndexV2(ctx.cwd, {
+          excludePatterns,
+          refresh: params.refresh,
+          rebuildMissing: true
+        });
+        const status = ensured.status;
+        result = await searchContextIndexV2(ctx.cwd, params.query, { limit: 15, excludePatterns });
         const search = result as Awaited<ReturnType<typeof searchContextIndexV2>>;
         text = [
           `confidence: ${search.confidence}`,
@@ -5076,20 +5216,23 @@ export default function piagentGuard(pi: ExtensionAPI) {
         ].join("\n");
       } else if (params.action === "pack") {
         if (!params.query?.trim()) throw new Error("query is required for a context pack");
-        let status = await contextIndexV2Status(ctx.cwd);
-        if (params.refresh || !status.exists) {
-          await buildContextIndexV2(ctx.cwd, { excludePatterns });
-          status = await contextIndexV2Status(ctx.cwd);
-        }
+        const ensured = await ensureContextIndexV2(ctx.cwd, {
+          excludePatterns,
+          refresh: params.refresh,
+          rebuildMissing: true
+        });
+        const status = ensured.status;
         const pack = await buildContextPack(ctx.cwd, params.query, {
           budgetTokens: params.budgetTokens ?? 6_000,
           includeCode: true,
-          limit: 18
+          limit: 18,
+          excludePatterns
         });
         result = { ...pack, text: undefined, status };
         text = pack.text;
       } else if (params.action === "impact") {
-        result = await buildTestImpact(ctx.cwd, params.files ?? []);
+        await ensureContextIndexV2(ctx.cwd, { excludePatterns, rebuildMissing: false });
+        result = await buildTestImpact(ctx.cwd, params.files ?? [], { excludePatterns });
         const impact = result as Awaited<ReturnType<typeof buildTestImpact>>;
         text = [
           `changed: ${impact.changedFiles.join(", ") || "none"}`,
@@ -5139,7 +5282,9 @@ export default function piagentGuard(pi: ExtensionAPI) {
       const contextIndex = buildContextIndexStatus(ctx.cwd, profile);
       let contextEngine: Awaited<ReturnType<typeof contextIndexV2Status>> | { exists: false; warnings: string[] };
       try {
-        contextEngine = await contextIndexV2Status(ctx.cwd);
+        contextEngine = await contextIndexV2Status(ctx.cwd, {
+          excludePatterns: contextIndexExcludePatterns(policy, profile)
+        });
       } catch (error) {
         contextEngine = { exists: false, warnings: [error instanceof Error ? error.message : String(error)] };
       }
@@ -7232,7 +7377,9 @@ export default function piagentGuard(pi: ExtensionAPI) {
 
   async function emitContextEngineStatus(ctx: ExtensionContext): Promise<void> {
     try {
-      const status = await contextIndexV2Status(ctx.cwd);
+      const status = await contextIndexV2Status(ctx.cwd, {
+        excludePatterns: contextIndexExcludePatterns(policy, loadProfileFromContext(ctx))
+      });
       emitRuntimeMessage(ctx, "piagent-context-engine-status", [
         `contextEngine: ${status.exists ? "ready" : "missing"}`,
         `path: ${status.path}`,
@@ -7251,15 +7398,10 @@ export default function piagentGuard(pi: ExtensionAPI) {
 
   async function rebuildContextEngine(ctx: ExtensionContext): Promise<void> {
     const profile = loadProfileFromContext(ctx);
-    const pathPolicy = effectiveProtectedPaths(policy, profile);
+    const excludePatterns = contextIndexExcludePatterns(policy, profile);
     try {
       const result = await buildContextIndexV2(ctx.cwd, {
-        excludePatterns: Array.from(new Set([
-          ...pathPolicy.readProtectedPaths,
-          ...pathPolicy.writeProtectedPaths,
-          ".pi/context-index.json",
-          ".pi/piagent-state/**"
-        ]))
+        excludePatterns
       });
       telemetry(ctx, { event: "context_engine_action", action: "rebuild", ...result });
       emitRuntimeMessage(ctx, "piagent-context-engine-rebuild", [
@@ -7275,9 +7417,13 @@ export default function piagentGuard(pi: ExtensionAPI) {
   }
 
   async function emitContextEngineSearch(ctx: ExtensionContext, query: string): Promise<boolean> {
-    const status = await contextIndexV2Status(ctx.cwd);
+    const excludePatterns = contextIndexExcludePatterns(policy, loadProfileFromContext(ctx));
+    const { status } = await ensureContextIndexV2(ctx.cwd, {
+      excludePatterns,
+      rebuildMissing: false
+    });
     if (!status.exists || !query.trim()) return false;
-    const search = await searchContextIndexV2(ctx.cwd, query, { limit: 12 });
+    const search = await searchContextIndexV2(ctx.cwd, query, { limit: 12, excludePatterns });
     emitRuntimeMessage(ctx, "piagent-context-engine-search", [
       `confidence: ${search.confidence}`,
       `stale: ${status.stale ? "yes" : "no"}`,
@@ -7291,12 +7437,21 @@ export default function piagentGuard(pi: ExtensionAPI) {
       emitRuntimeMessage(ctx, "piagent-context-pack-help", "Usage: /context pack <task or symbol>");
       return;
     }
-    const status = await contextIndexV2Status(ctx.cwd);
+    const excludePatterns = contextIndexExcludePatterns(policy, loadProfileFromContext(ctx));
+    const { status } = await ensureContextIndexV2(ctx.cwd, {
+      excludePatterns,
+      rebuildMissing: false
+    });
     if (!status.exists) {
       emitRuntimeMessage(ctx, "piagent-context-pack-help", "Context Engine index is missing. Run /context rebuild first.");
       return;
     }
-    const pack = await buildContextPack(ctx.cwd, query, { budgetTokens: 1_500, includeCode: false, limit: 15 });
+    const pack = await buildContextPack(ctx.cwd, query, {
+      budgetTokens: 1_500,
+      includeCode: false,
+      limit: 15,
+      excludePatterns
+    });
     telemetry(ctx, {
       event: "context_pack",
       queryHash: pack.queryHash,
@@ -7318,7 +7473,9 @@ export default function piagentGuard(pi: ExtensionAPI) {
 
   async function emitTestImpact(ctx: ExtensionContext, raw: string): Promise<void> {
     const files = raw.split(/\s+/).map((file) => file.trim()).filter(Boolean);
-    const impact = await buildTestImpact(ctx.cwd, files);
+    const excludePatterns = contextIndexExcludePatterns(policy, loadProfileFromContext(ctx));
+    await ensureContextIndexV2(ctx.cwd, { excludePatterns, rebuildMissing: false });
+    const impact = await buildTestImpact(ctx.cwd, files, { excludePatterns });
     emitRuntimeMessage(ctx, "piagent-context-impact", [
       `changed: ${impact.changedFiles.join(", ") || "none"}`,
       `impacted: ${impact.impactedFiles.map((item) => `${item.path} via ${item.via}`).join(", ") || "none"}`,