@pify/yolo 0.3.0 → 0.4.0

package/README.md

@@ -1,26 +1,35 @@
 # @pify/yolo
 
-One toggle to auto-approve everything in [pi](https://github.com/earendil-works/pi) — with an undo trail so YOLO never means unrecoverable.
+A safety gradient for [pi](https://github.com/earendil-works/pi), from auto-approve-everything to ask-about-anything — with an undo trail so YOLO never means unrecoverable.
 
 Part of the [Pify suite](https://github.com/pifydev). Install with [`pify install yolo`](https://github.com/pifydev/cli) or `pi install npm:@pify/yolo`.
 
-## Two modes, one toggle
+## Four modes, one command (v0.4)
 
-**🛡 guard** (default) — every bash call runs through a three-tier gate:
+`/yolo <mode>` moves along a gradient. Two things hold in **every** mode, which is what makes the gradient safe to move along: catastrophic commands block, and secret material asks.
+
+| Mode | Catastrophic | Built-in destructive | Your `.pi/yolo.json` ask-rules | Everything else |
+|---|---|---|---|---|
+| `⚡ yolo` | blocked | runs | runs | runs |
+| `⚙ auto` | blocked | runs | asks | runs |
+| `🛡 approve` *(default)* | blocked | asks | asks | runs |
+| `🔒 strict` | blocked | asks | asks | asks unless plainly read-only |
+
+Bare `/yolo` still flips between `yolo` and `approve` — the two ends people actually toggle between. Sessions saved before v0.4 carried `guard`; that is what `approve` is now called, and they reopen there.
+
+**Behaviour change in v0.4**: `yolo` used to stand the *whole* gate down, catastrophic patterns included, which contradicted the rules' own claim that the floor is never overridable. The floor now holds in yolo mode too. If you were relying on `rm -rf /` auto-approving, you were relying on a bug.
 
 | Tier | Examples | Behavior |
 |---|---|---|
-| **BLOCK** | `rm -rf /`, `rm -rf ~`, `rm -rf .git`, `mkfs`, `dd of=/dev/…`, fork bomb, `> /dev/sda` | Refused outright. Never overridable — not even by user rules. |
+| **BLOCK** | `rm -rf /`, `rm -rf ~`, `rm -rf .git`, `mkfs`, `dd of=/dev/…`, fork bomb, `> /dev/sda` | Refused outright, in every mode. Never overridable — not by user rules, not by a mode. |
 | **ASK** | `rm -rf <path>`, `git push --force`, `git reset --hard`, `git clean -f`, `curl \| sh`, `find -delete`, `chmod 777`, history rewrites | Confirmation dialog with the command shown. Denials can carry your reason back to the agent. |
-| ALLOW | everything else | Runs untouched. |
-
-**⚡ yolo** (`/yolo`) — the gate stands down and everything auto-approves. The trail keeps recording.
+| ALLOW | everything else | Runs untouched (unless you are in `strict`). |
 
 Fail-closed everywhere: rule-evaluation errors block; ASK without a UI (headless/CI) denies.
 
 ## Secret files (v0.2)
 
-Credentials are the one thing yolo mode does **not** wave through — auto-approving speed is worth it, auto-approving your AWS keys into a prompt is not. Any `read`/`edit`/`write` on secret material, and any bash command that names it, asks first in both modes:
+Credentials are the one thing no mode waves through — auto-approving speed is worth it, auto-approving your AWS keys into a prompt is not. Any `read`/`edit`/`write` on secret material, and any bash command that names it, asks first in every mode:
 
 `.env` (and `.env.*`, but not `.env.example`/`.sample`/`.template`) · `~/.ssh/*` and `id_rsa`/`id_ed25519`-style keys (`.pub` halves are fine) · `.aws/credentials` · `.pi/agent/auth.json`, `.claude/.credentials.json` · `.npmrc`, `.pypirc`, `.netrc`, `.git-credentials` · `~/.config/gh/hosts.yml` · `*.pem`, `*.key`, `*.p12`, `*.pfx` · `secrets.json`/`credentials.yaml`
 
@@ -39,7 +48,7 @@ That covers what `/yolo undo` can't: damage done by a command rather than by an
 
 ## The undo trail
 
-Always on, in both modes:
+Always on, in every mode:
 
 - Every `edit`/`write` saves the file's **pre-image** first (per-project trail under the agent dir — survives restarts).
 - Risky bash commands are logged with cwd, timestamp, and git HEAD.
@@ -66,7 +75,7 @@ Measured over OpenRouter on six commands (three genuinely destructive, three rea
 | GPT-5.6 terra / sol | 5/6 | 1 |
 | Claude Opus 5 | 4/6 | 1 |
 | Gemini 3.1 Pro | 2/6 | 4 |
-| Qwen3 235B | 3/6 | 3 |
+| Qwen3 235B | 2/6 | 4 |
 
 Every miss fell back to *allow* — no run ever downgraded a command the rules had already flagged. Weaker models simply give you less extra protection.
 
@@ -86,8 +95,9 @@ Every miss fell back to *allow* — no run ever downgraded a command the rules h
 ## Commands
 
 ```
-/yolo            # toggle guard ↔ yolo
-/yolo status     # mode, rule count, trail size
+/yolo            # flip between yolo and approve
+/yolo strict     # or: yolo | auto | approve | strict (v0.4)
+/yolo status     # mode, the other modes, rule count, trail size
 /yolo trail      # recent trail entries
 /yolo undo 3     # restore the newest 3 file pre-images
 /yolo classifier on   # let a model flag unfamiliar commands (v0.3)

package/extensions/yolo.ts

@@ -1,11 +1,12 @@
 /**
  * @pify/yolo — one toggle to auto-approve everything, with an undo trail.
  *
- * Two modes. guard (default): bash runs through a three-tier safety gate —
- * catastrophic patterns BLOCK outright (never overridable), destructive
- * ones ASK with the command shown (denial reasons flow back to the agent),
- * everything else runs. yolo: the gate stands down and everything
- * auto-approves — but the trail keeps recording. In BOTH modes every
+ * A four-mode gradient (v0.4): yolo · auto · approve (default) · strict.
+ * Bash runs through a three-tier rule set — catastrophic patterns BLOCK,
+ * destructive ones ASK with the command shown (denial reasons flow back to
+ * the agent), everything else runs — and the mode decides how much of that
+ * to relax or tighten. Two invariants hold in every mode: the catastrophic
+ * floor blocks, and secret material asks. In EVERY mode
  * edit/write saves a pre-image first and risky bash commands are logged,
  * so /yolo undo can walk file changes back even after a restart.
  *
@@ -13,7 +14,7 @@
  * headless ASK becomes deny. User rules in .pi/yolo.json (wildcard,
  * last-match-wins) can retune ASK/ALLOW but never the catastrophic floor.
  *
- * v0.2 adds two things yolo mode deliberately does not stand down for:
+ * v0.2 adds two things no mode stands down for:
  * secret material (.env, ssh keys, cloud/registry credentials) asks before
  * any read/edit/write or naming command, and every risky bash command gets a
  * `git stash create` checkpoint recorded on the trail so command damage —
@@ -46,8 +47,19 @@ import {
 } from "../src/classify.ts";
 import { evaluateCommand, evaluatePath, parseUserRules } from "../src/rules.ts";
 import { formatTrail, readManifest, recordBash, recordPreImage, trailDir, undo } from "../src/trail.ts";
+import {
+  MODES,
+  MODE_BADGES,
+  MODE_LABELS,
+  askTitle,
+  normalizeMode,
+  resolveAction,
+} from "../src/modes.ts";
 import { isRecord, type Mode, type UserRule } from "../src/types.ts";
 
+/** Today's guard, under its new name. */
+const DEFAULT_MODE: Mode = "approve";
+
 const MODE_ENTRY = "yolo-mode";
 const CLASSIFIER_ENTRY = "yolo-classifier";
 /** In front of every bash call: a slow answer costs seconds, not minutes. */
@@ -56,7 +68,7 @@ const CLASSIFY_TIMEOUT_MS = 20_000;
 type UiContext = ExtensionContext;
 
 export default function yolo(pi: ExtensionAPI) {
-  let mode: Mode = "guard";
+  let mode: Mode = DEFAULT_MODE;
   /** Opt-in: layer 3 costs a model call on unfamiliar commands. */
   let classifierEnabled = false;
   let userRules: UserRule[] = [];
@@ -64,7 +76,7 @@ export default function yolo(pi: ExtensionAPI) {
 
   function updateFooter(ctx: UiContext): void {
     if (!ctx.hasUI) return;
-    ctx.ui.setStatus("yolo", mode === "yolo" ? "⚡ YOLO" : undefined);
+    ctx.ui.setStatus("yolo", MODE_BADGES[mode]);
   }
 
   function setMode(ctx: UiContext, next: Mode): void {
@@ -73,9 +85,10 @@ export default function yolo(pi: ExtensionAPI) {
     updateFooter(ctx);
     if (ctx.hasUI) {
       ctx.ui.notify(
-        next === "yolo"
-          ? "⚡ YOLO on — everything auto-approves. The undo trail keeps recording; /yolo to turn the guard back on."
-          : "🛡 Guard on — catastrophic commands block, destructive ones ask.",
+        [
+          MODE_LABELS[next],
+          "Catastrophic commands block and secrets ask in every mode. The undo trail keeps recording.",
+        ].join("\n"),
         next === "yolo" ? "warning" : "info",
       );
     }
@@ -245,7 +258,14 @@ export default function yolo(pi: ExtensionAPI) {
       if (escalated.rule) verdict = { action: "ask", rule: escalated.rule };
     }
 
-    const touchesSecret = verdict.rule.startsWith("secret:");
+    // The mode decides what the verdict means: it may relax the destructive
+    // tier (auto/yolo) or tighten the allow tier (strict), but never touches
+    // the catastrophic floor or the secret gate.
+    const action = resolveAction({
+      mode,
+      verdict,
+      obviouslySafe: !needsClassification(command),
+    });
 
     // Log risky commands, with a checkpoint of the tree as it was.
     if (dir && verdict.action !== "allow") {
@@ -253,12 +273,9 @@ export default function yolo(pi: ExtensionAPI) {
       recordBash(dir, command, ctx.cwd, gitHead(ctx.cwd), now, gitCheckpoint(ctx.cwd, now));
     }
 
-    // The gate stands down in yolo mode — except for secrets.
-    if (mode === "yolo" && !touchesSecret) return undefined;
-
-    if (verdict.action === "allow") return undefined;
+    if (action === "allow") return undefined;
 
-    if (verdict.action === "block") {
+    if (action === "block") {
       return {
         block: true,
         reason: `yolo guard blocked this command (${verdict.rule}) — catastrophic patterns are never auto-approved. Do not retry it; choose a safer approach.`,
@@ -273,7 +290,7 @@ export default function yolo(pi: ExtensionAPI) {
       };
     }
     const approved = await ctx.ui.confirm(
-      touchesSecret ? "Command touches secret material" : "Destructive command",
+      askTitle(mode, verdict),
       `${command}\n\nRule: ${verdict.rule}. Run it?`,
     );
     if (approved) return undefined;
@@ -293,12 +310,13 @@ export default function yolo(pi: ExtensionAPI) {
   pi.on("session_start", async (_event, ctx) => {
     dir = trailDir(getAgentDir(), ctx.cwd);
     loadUserRules(ctx.cwd);
-    mode = "guard";
+    mode = DEFAULT_MODE;
     classifierEnabled = false;
     for (const entry of ctx.sessionManager.getBranch()) {
       const e = entry as { type?: string; customType?: string; data?: unknown };
       if (e.type === "custom" && e.customType === MODE_ENTRY && isRecord(e.data)) {
-        if (e.data.mode === "yolo" || e.data.mode === "guard") mode = e.data.mode;
+        const restored = normalizeMode(e.data.mode);
+        if (restored) mode = restored;
       }
       if (e.type === "custom" && e.customType === CLASSIFIER_ENTRY && isRecord(e.data)) {
         if (typeof e.data.enabled === "boolean") classifierEnabled = e.data.enabled;
@@ -308,12 +326,13 @@ export default function yolo(pi: ExtensionAPI) {
   });
 
   pi.on("session_tree", async (_event, ctx) => {
-    mode = "guard";
+    mode = DEFAULT_MODE;
     classifierEnabled = false;
     for (const entry of ctx.sessionManager.getBranch()) {
       const e = entry as { type?: string; customType?: string; data?: unknown };
       if (e.type === "custom" && e.customType === MODE_ENTRY && isRecord(e.data)) {
-        if (e.data.mode === "yolo" || e.data.mode === "guard") mode = e.data.mode;
+        const restored = normalizeMode(e.data.mode);
+        if (restored) mode = restored;
       }
       if (e.type === "custom" && e.customType === CLASSIFIER_ENTRY && isRecord(e.data)) {
         if (typeof e.data.enabled === "boolean") classifierEnabled = e.data.enabled;
@@ -329,25 +348,34 @@ export default function yolo(pi: ExtensionAPI) {
   // ── Command ──────────────────────────────────────────────────────────
 
   pi.registerCommand("yolo", {
-    description: "Toggle auto-approve: /yolo [on|off|status|trail|undo [n]|classifier on|off]",
+    description: "Safety gradient: /yolo [yolo|auto|approve|strict|status|trail|undo [n]|classifier on|off]",
     handler: async (args, ctx) => {
       const [route, countRaw] = (args ?? "").trim().toLowerCase().split(/\s+/);
       switch (route || "toggle") {
         case "toggle":
-          setMode(ctx, mode === "yolo" ? "guard" : "yolo");
+          // The bare command still flips between the two ends people use.
+          setMode(ctx, mode === "yolo" ? DEFAULT_MODE : "yolo");
           return;
         case "on":
           setMode(ctx, "yolo");
           return;
         case "off":
-          setMode(ctx, "guard");
+        case "guard":
+          setMode(ctx, DEFAULT_MODE);
+          return;
+        case "yolo":
+        case "auto":
+        case "approve":
+        case "strict":
+          setMode(ctx, route as Mode);
           return;
         case "status": {
           if (!ctx.hasUI) return;
           const entries = readManifest(dir);
           ctx.ui.notify(
             [
-              `Mode: ${mode === "yolo" ? "⚡ YOLO (gate off)" : "🛡 guard"}`,
+              `Mode: ${MODE_LABELS[mode]}`,
+              `Other modes: ${MODES.filter((m) => m !== mode).join(" · ")} (/yolo <mode>)`,
               `User rules: ${userRules.length} (.pi/yolo.json)`,
               `AI classifier: ${classifierEnabled ? "on" : "off"} (/yolo classifier on)`,
               `Trail: ${entries.length} entries — /yolo trail to view, /yolo undo [n] to restore`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pify/yolo",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "One toggle to auto-approve everything, with an undo trail: three-tier bash guard, file pre-images, fail-closed everywhere",
   "keywords": [
     "pi-package",

package/src/modes.ts

@@ -0,0 +1,78 @@
+/**
+ * The four-mode gradient (zhushanwen). One toggle was too blunt: "guard"
+ * asked about every `rm -rf build`, and "yolo" stood the whole gate down,
+ * including the catastrophic floor the rules call non-negotiable. These are
+ * the four positions people actually want between those extremes.
+ *
+ * Two invariants hold in every mode, which is what makes the gradient safe
+ * to move along: the catastrophic tier always blocks, and secret material
+ * always asks.
+ */
+import type { GuardAction } from "./classify.ts";
+import type { Mode, RuleHit } from "./types.ts";
+
+export const MODES: readonly Mode[] = ["yolo", "auto", "approve", "strict"];
+
+export const MODE_LABELS: Record<Mode, string> = {
+  yolo: "⚡ YOLO — only catastrophic commands and secrets stop you",
+  auto: "⚙ auto — built-in destructive commands run; your own ask-rules still ask",
+  approve: "🛡 approve — catastrophic blocks, destructive asks (default)",
+  strict: "🔒 strict — anything not plainly read-only asks first",
+};
+
+export const MODE_BADGES: Record<Mode, string | undefined> = {
+  yolo: "⚡ YOLO",
+  auto: "⚙ auto",
+  // The default needs no badge; a permanent one just becomes furniture.
+  approve: undefined,
+  strict: "🔒 strict",
+};
+
+export function isMode(value: unknown): value is Mode {
+  return typeof value === "string" && (MODES as readonly string[]).includes(value);
+}
+
+/** Pre-v0.4 sessions stored "guard"; it is what "approve" is now called. */
+export function normalizeMode(value: unknown): Mode | null {
+  if (value === "guard") return "approve";
+  return isMode(value) ? value : null;
+}
+
+export interface ResolveInput {
+  mode: Mode;
+  verdict: RuleHit;
+  /** The command is on the read-only list (see classify.ts). */
+  obviouslySafe: boolean;
+}
+
+/**
+ * The effective action for a command, given the deterministic verdict and the
+ * current mode. Modes may relax the destructive tier and tighten the allow
+ * tier; they can never touch the two invariants.
+ */
+export function resolveAction({ mode, verdict, obviouslySafe }: ResolveInput): GuardAction {
+  // Invariant 1: catastrophic patterns block everywhere, yolo included. The
+  // rules call this floor non-negotiable, so a mode must not be a way under it.
+  if (verdict.action === "block") return "block";
+  // Invariant 2: credentials are never auto-approved (cc-safety-net pillar 2).
+  if (verdict.rule.startsWith("secret:")) return "ask";
+
+  switch (mode) {
+    case "yolo":
+      return "allow";
+    case "auto":
+      // A rule the user wrote by hand is an instruction, not a default.
+      return verdict.action === "ask" && verdict.rule.startsWith("user:") ? "ask" : "allow";
+    case "approve":
+      return verdict.action;
+    case "strict":
+      return verdict.action === "allow" && obviouslySafe ? "allow" : "ask";
+  }
+}
+
+/** Explains a mode-driven decision in the confirmation dialog. */
+export function askTitle(mode: Mode, verdict: RuleHit): string {
+  if (verdict.rule.startsWith("secret:")) return "Command touches secret material";
+  if (mode === "strict" && verdict.action === "allow") return "Strict mode — unrecognised command";
+  return "Destructive command";
+}

package/src/types.ts

@@ -3,7 +3,8 @@
  * No imports from pi packages: src/ typechecks and runs standalone.
  */
 
-export type Mode = "guard" | "yolo";
+/** Four positions on the safety gradient; see src/modes.ts (v0.4). */
+export type Mode = "yolo" | "auto" | "approve" | "strict";
 
 export type RuleAction = "allow" | "ask" | "block";