@pify/yolo 0.1.0 → 0.2.0

package/README.md

@@ -18,6 +18,25 @@ Part of the [Pify suite](https://github.com/pifydev). Install with [`pify instal
 
 Fail-closed everywhere: rule-evaluation errors block; ASK without a UI (headless/CI) denies.
 
+## Secret files (v0.2)
+
+Credentials are the one thing yolo mode does **not** wave through — auto-approving speed is worth it, auto-approving your AWS keys into a prompt is not. Any `read`/`edit`/`write` on secret material, and any bash command that names it, asks first in both modes:
+
+`.env` (and `.env.*`, but not `.env.example`/`.sample`/`.template`) · `~/.ssh/*` and `id_rsa`/`id_ed25519`-style keys (`.pub` halves are fine) · `.aws/credentials` · `.pi/agent/auth.json`, `.claude/.credentials.json` · `.npmrc`, `.pypirc`, `.netrc`, `.git-credentials` · `~/.config/gh/hosts.yml` · `*.pem`, `*.key`, `*.p12`, `*.pfx` · `secrets.json`/`credentials.yaml`
+
+A user rule opts a project out: `{ "pattern": "*/.env", "action": "allow" }`.
+
+## Checkpoints (v0.2)
+
+Before every risky bash command in a git repo, the trail records a `git stash create` checkpoint — a dangling commit holding the working tree exactly as it was, kept alive under `refs/pify/yolo/`. It writes nothing to your tree, index, or stash list. `/yolo trail` prints the recovery line next to the command:
+
+```
+#7 2026-09-06 11:00:12 bash  git reset --hard @a1b2c3d4
+    ↩ git stash apply 9f8e7d6c5b4a
+```
+
+That covers what `/yolo undo` can't: damage done by a command rather than by an `edit`/`write`.
+
 ## The undo trail
 
 Always on, in both modes:

package/extensions/yolo.ts

@@ -13,6 +13,12 @@
  * headless ASK becomes deny. User rules in .pi/yolo.json (wildcard,
  * last-match-wins) can retune ASK/ALLOW but never the catastrophic floor.
  *
+ * v0.2 adds two things yolo mode deliberately does not stand down for:
+ * secret material (.env, ssh keys, cloud/registry credentials) asks before
+ * any read/edit/write or naming command, and every risky bash command gets a
+ * `git stash create` checkpoint recorded on the trail so command damage —
+ * not just file edits — has a way back.
+ *
  * Design synthesis: three-tier rules (pi-yolo-seatbelt), fail-closed +
  * reject-with-reason + wildcard rules (@zhushanwen/pi-permission),
  * /yolo session toggle (valdo766hi).
@@ -26,7 +32,7 @@ import { execFileSync } from "node:child_process";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 
-import { evaluateCommand, parseUserRules } from "../src/rules.ts";
+import { evaluateCommand, evaluatePath, parseUserRules } from "../src/rules.ts";
 import { formatTrail, readManifest, recordBash, recordPreImage, trailDir, undo } from "../src/trail.ts";
 import { isRecord, type Mode, type UserRule } from "../src/types.ts";
 
@@ -71,6 +77,63 @@ export default function yolo(pi: ExtensionAPI) {
     }
   }
 
+  /**
+   * Snapshot the working tree into a dangling commit before a risky command.
+   * `git stash create` writes nothing to the tree, the index, or the stash
+   * list — it just gives us a sha to come back to. A ref keeps it out of gc's
+   * reach; empty output means there was nothing to save.
+   */
+  function gitCheckpoint(cwd: string, now: number): string | null {
+    try {
+      const sha = execFileSync("git", ["stash", "create"], {
+        cwd,
+        encoding: "utf8",
+        timeout: 5000,
+        windowsHide: true,
+      }).trim();
+      if (!/^[0-9a-f]{7,40}$/.test(sha)) return null;
+      try {
+        execFileSync("git", ["update-ref", `refs/pify/yolo/${now}`, sha], {
+          cwd,
+          timeout: 5000,
+          windowsHide: true,
+        });
+      } catch {
+        // unreachable-but-recent commits still survive the default gc window
+      }
+      return sha;
+    } catch {
+      return null;
+    }
+  }
+
+  /** Confirmation gate for a file path (secret material). */
+  async function guardPath(
+    ctx: UiContext,
+    path: string,
+    rule: string,
+    action: "ask" | "block",
+  ): Promise<{ block: true; reason: string } | undefined> {
+    if (action === "block") {
+      return { block: true, reason: `yolo guard blocked access to ${path} (${rule}).` };
+    }
+    if (!ctx.hasUI) {
+      return {
+        block: true,
+        reason: `yolo guard: ${path} holds secret material (${rule}) and there is no UI to confirm (fail-closed deny).`,
+      };
+    }
+    const approved = await ctx.ui.confirm(
+      "Secret file",
+      `${path}\n\nRule: ${rule}. Allow this access?`,
+    );
+    if (approved) return undefined;
+    return {
+      block: true,
+      reason: `The user declined access to ${path} (${rule}). Continue without its contents; ask for the value you need instead.`,
+    };
+  }
+
   function loadUserRules(cwd: string): void {
     try {
       userRules = parseUserRules(JSON.parse(readFileSync(join(cwd, ".pi", "yolo.json"), "utf8")));
@@ -82,11 +145,18 @@ export default function yolo(pi: ExtensionAPI) {
   // ── The gate + the trail ─────────────────────────────────────────────
 
   pi.on("tool_call", async (event, ctx) => {
-    // Trail: pre-image every file mutation, in both modes.
-    if (event.toolName === "edit" || event.toolName === "write") {
+    // Secret material is checked in BOTH modes: yolo trades safety for speed,
+    // not for handing credentials to a model.
+    if (event.toolName === "read" || event.toolName === "edit" || event.toolName === "write") {
       const path = (event as { input?: { path?: unknown } }).input?.path;
-      if (typeof path === "string" && dir) {
-        recordPreImage(dir, path, Date.now());
+      if (typeof path === "string") {
+        const verdict = evaluatePath(path, userRules);
+        if (verdict.action !== "allow") {
+          const denial = await guardPath(ctx, path, verdict.rule, verdict.action);
+          if (denial) return denial;
+        }
+        // Trail: pre-image every file mutation, in both modes.
+        if (event.toolName !== "read" && dir) recordPreImage(dir, path, Date.now());
       }
       return undefined;
     }
@@ -98,13 +168,16 @@ export default function yolo(pi: ExtensionAPI) {
     }
 
     const verdict = evaluateCommand(command, userRules);
+    const touchesSecret = verdict.rule.startsWith("secret:");
 
-    // Log risky commands (and everything in yolo mode) to the trail.
-    if (dir && (mode === "yolo" ? verdict.action !== "allow" : verdict.action !== "allow")) {
-      recordBash(dir, command, ctx.cwd, gitHead(ctx.cwd), Date.now());
+    // Log risky commands, with a checkpoint of the tree as it was.
+    if (dir && verdict.action !== "allow") {
+      const now = Date.now();
+      recordBash(dir, command, ctx.cwd, gitHead(ctx.cwd), now, gitCheckpoint(ctx.cwd, now));
     }
 
-    if (mode === "yolo") return undefined; // gate stands down; trail recorded
+    // The gate stands down in yolo mode — except for secrets.
+    if (mode === "yolo" && !touchesSecret) return undefined;
 
     if (verdict.action === "allow") return undefined;
 
@@ -123,7 +196,7 @@ export default function yolo(pi: ExtensionAPI) {
       };
     }
     const approved = await ctx.ui.confirm(
-      "Destructive command",
+      touchesSecret ? "Command touches secret material" : "Destructive command",
       `${command}\n\nRule: ${verdict.rule}. Run it?`,
     );
     if (approved) return undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pify/yolo",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "One toggle to auto-approve everything, with an undo trail: three-tier bash guard, file pre-images, fail-closed everywhere",
   "keywords": [
     "pi-package",

package/src/rules.ts

@@ -42,6 +42,70 @@ const DESTRUCTIVE: BuiltinRule[] = [
   { name: "history-rewrite", action: "ask", re: /\bgit\s+(rebase|filter-branch|filter-repo)\b/ },
 ];
 
+/**
+ * Secret material (cc-safety-net's second pillar). Reading these is how a
+ * credential leaves the machine, so the check is on the path, not the verb —
+ * and unlike the destructive tier it still asks in yolo mode.
+ */
+const SECRET_PATHS: BuiltinRule[] = [
+  { name: "env-file", action: "ask", re: /(^|\/)\.env(\.[\w-]+)*$/ },
+  { name: "ssh-key", action: "ask", re: /(^|\/)(\.ssh\/.*|id_(rsa|dsa|ecdsa|ed25519)(_\w+)?)$/ },
+  { name: "aws-credentials", action: "ask", re: /(^|\/)\.aws\/(credentials|config)$/ },
+  { name: "agent-auth", action: "ask", re: /(^|\/)(\.pi\/agent\/auth\.json|\.claude\/\.credentials\.json)$/ },
+  { name: "registry-token", action: "ask", re: /(^|\/)(\.npmrc|\.pypirc|\.netrc|_netrc|\.git-credentials)$/ },
+  { name: "gh-hosts", action: "ask", re: /(^|\/)\.config\/gh\/hosts\.ya?ml$/ },
+  { name: "private-key", action: "ask", re: /\.(pem|key|p12|pfx|keystore|jks)$/ },
+  { name: "secrets-file", action: "ask", re: /(^|\/)(secrets?|credentials)\.(json|ya?ml|toml)$/ },
+];
+
+/** Example/sample templates carry no secrets — never worth a prompt. */
+const SECRET_EXEMPT = /(^|\/)[\w.-]*\.(example|sample|template|dist)$|\.pub$/;
+
+/** Name of the secret class this path belongs to, or null. */
+export function secretPathKind(path: string): string | null {
+  const normalized = path.trim().replace(/\\/g, "/").replace(/^["']|["']$/g, "").toLowerCase();
+  if (!normalized || SECRET_EXEMPT.test(normalized)) return null;
+  for (const rule of SECRET_PATHS) {
+    if (rule.re.test(normalized)) return rule.name;
+  }
+  return null;
+}
+
+/** Secret paths named anywhere in a shell command (cat, cp, curl -T, …). */
+export function secretPathsIn(command: string): string[] {
+  const kinds = new Set<string>();
+  for (const token of command.split(/[\s;|&()<>]+/)) {
+    const kind = secretPathKind(token);
+    if (kind) kinds.add(kind);
+  }
+  return [...kinds];
+}
+
+/**
+ * Verdict for a file path a tool is about to touch. Default is allow; secret
+ * material asks. User rules (matched against the path) get the last word, so
+ * a wildcard rule ending in `/.env` with action "allow" opts a project out.
+ */
+export function evaluatePath(path: string, userRules: UserRule[] = []): RuleHit {
+  try {
+    const kind = secretPathKind(path);
+    let verdict: RuleHit = kind ? { action: "ask", rule: `secret:${kind}` } : { action: "allow", rule: "default" };
+    const normalized = path.replace(/\\/g, "/");
+    for (const rule of userRules) {
+      try {
+        if (wildcardToRegex(rule.pattern).test(normalized)) {
+          verdict = { action: rule.action, rule: `user:${rule.pattern}` };
+        }
+      } catch {
+        // invalid user pattern — ignore that rule
+      }
+    }
+    return verdict;
+  } catch {
+    return { action: "block", rule: "fail-closed" };
+  }
+}
+
 /** Convert a user wildcard pattern (`git push*`) to a regex. */
 export function wildcardToRegex(pattern: string): RegExp {
   const escaped = pattern
@@ -74,6 +138,10 @@ export function evaluateCommand(command: string, userRules: UserRule[] = []): Ru
         break;
       }
     }
+    if (verdict.action === "allow") {
+      const secrets = secretPathsIn(normalized);
+      if (secrets.length > 0) verdict = { action: "ask", rule: `secret:${secrets.join(",")}` };
+    }
     for (const rule of userRules) {
       try {
         if (wildcardToRegex(rule.pattern).test(normalized)) {

package/src/trail.ts

@@ -80,6 +80,7 @@ export function recordBash(
   cwd: string,
   gitHead: string | null,
   now: number,
+  stashSha: string | null = null,
 ): void {
   try {
     append(dir, {
@@ -91,6 +92,7 @@ export function recordBash(
       existed: false,
       cwd,
       ...(gitHead ? { gitHead } : {}),
+      ...(stashSha ? { stashSha } : {}),
     });
   } catch {
     // trail must never break the tool call
@@ -142,7 +144,9 @@ export function formatTrail(entries: TrailEntry[], limit: number): string {
       if (e.type === "file") {
         return `#${e.seq} ${when} file  ${e.target}${e.existed ? "" : " (new file)"}`;
       }
-      return `#${e.seq} ${when} bash  ${e.target}${e.gitHead ? ` @${e.gitHead.slice(0, 8)}` : ""}`;
+      const head = e.gitHead ? ` @${e.gitHead.slice(0, 8)}` : "";
+      const stash = e.stashSha ? `\n    ↩ git stash apply ${e.stashSha}` : "";
+      return `#${e.seq} ${when} bash  ${e.target}${head}${stash}`;
     })
     .join("\n");
 }

package/src/types.ts

@@ -30,6 +30,8 @@ export interface TrailEntry {
   existed: boolean;
   cwd?: string;
   gitHead?: string;
+  /** bash: dangling `git stash create` commit holding the pre-command tree. */
+  stashSha?: string;
 }
 
 export interface BranchEntryLike {