@senomas/pi-git-hat 0.1.0 → 0.2.1

package/README.md

@@ -4,6 +4,14 @@
 
 A [pi](https://github.com/earendil-works/pi) extension that maps git branches to roles (planner, implementor, reviewer, admin) and enforces role-based permissions.
 
+## Install
+
+```bash
+pi install npm:@senomas/pi-git-hat
+```
+
+No other dependencies needed. On first startup, role prompts and a default `roles.json` auto-seed into your project's `.pi/`.
+
 ## Features
 
 - **Role-based branch switching** — `/hat` TUI to pick branches grouped by role

package/git-hat.ts

@@ -1289,46 +1289,11 @@ If the user asks you to make changes, tell them to switch to an appropriate bran
         };
       }
       if (isBash) {
-        const cmd = ((event.input as { command?: string }).command ?? "").trim();
-
-        // Allow: read-only commands
-        if (
-          /^(ls|cd|pwd|echo|date|which|whoami|uname|hostname|env|true|false|yes|time|seq|head|tail|wc|sort|uniq|jq|dirname|basename|cat|printf)\b/.test(
-            cmd,
-          )
-        ) {
-          return;
-        }
-
-        // Allow: git read-only commands
-        if (
-          /^git\s+(status|log|diff|branch|show|grep|blame|describe|rev-parse|rev-list|shortlog|config|check-ignore|whatchanged|cherry|name-rev|ls-tree|ls-files|ls-remote|stash\s+list|tag)\b/.test(
-            cmd,
-          )
-        ) {
-          return;
-        }
-
-        // Allow: git branch switching
-        if (/^git\s+(switch|checkout)\b/.test(cmd)) {
-          return;
-        }
-
-        // Allow: git add and git rebase --continue during an active rebase
-        let rebasing = false;
-        try {
-          const gitDirResult = await pi.exec("git", ["rev-parse", "--git-dir"]);
-          rebasing = existsSync(resolve(gitDirResult.stdout.trim(), "rebase-merge"));
-        } catch { /* not a git repo */ }
-        if (rebasing && /^git\s+(add|rebase\s+--continue)\b/.test(cmd)) {
-          return;
-        }
-
         return {
           block: true,
           reason:
             `\u2753 No role matched branch "${currentBranch ?? "no-git"}". ` +
-            `Only read-only commands and git branch-switching are allowed.`,
+            `All bash commands are blocked. Switch to a matching branch via /hat (TUI selector).`,
         };
       }
       return;
@@ -1346,13 +1311,49 @@ If the user asks you to make changes, tell them to switch to an appropriate bran
         }
         if (isBash) {
           const cmd = ((event.input as { command?: string }).command ?? "").trim();
-          if (!/^git\s+(rebase\s+(master|main)|switch|checkout)\b/.test(cmd)) {
-            return {
-              block: true,
-              reason: `\uD83D\uDCCB Planner: branch not based on ${ancestry.branch}. Run \`git rebase ${ancestry.branch}\` first.`,
-            };
+
+          // Require confirmation for git rebase (any target)
+          if (/\bgit\s+rebase\b/.test(cmd)) {
+            const confirmed = await ctx.ui.confirm(
+              `Rebase onto master? Running: \`${cmd}\``,
+            );
+            if (!confirmed) {
+              return { block: true, reason: "Rebase cancelled by user." };
+            }
+            return;
           }
+
+          // Require confirmation for git switch/checkout
+          if (/\bgit\s+(switch|checkout)\b/.test(cmd)) {
+            const confirmed = await ctx.ui.confirm(
+              `Switch branches? Running: \`${cmd}\``,
+            );
+            if (!confirmed) {
+              return { block: true, reason: "Branch switch cancelled by user." };
+            }
+            return;
+          }
+
+          return {
+            block: true,
+            reason: `\uD83D\uDCCB Planner: branch not based on ${ancestry.branch}. Run \`git rebase ${ancestry.branch}\` first.`,
+          };
+        }
+      }
+    }
+
+    // For known roles: require confirmation for git rebase/switch/checkout
+    if (isBash) {
+      const cmd = ((event.input as { command?: string }).command ?? "").trim();
+      if (/\bgit\s+(rebase|switch|checkout)\b/.test(cmd)) {
+        const action = /rebase/.test(cmd) ? "Rebase" : "Switch";
+        const confirmed = await ctx.ui.confirm(
+          `${action} branches? Running: \`${cmd}\``,
+        );
+        if (!confirmed) {
+          return { block: true, reason: `${action} cancelled by user.` };
         }
+        return;
       }
     }
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@senomas/pi-git-hat",
-	"version": "0.1.0",
+	"version": "0.2.1",
 	"description": "Pi extension for role-based Git branch workflows — wear different hats by switching branches",
 	"type": "module",
 	"keywords": ["pi-package", "git", "workflow", "branching", "roles"],