@xynogen/pix-gate 0.1.11 → 0.1.13

package/README.md

@@ -35,18 +35,24 @@ rules as the bash tool (auto-deny on match, no prompt).
 
 ## Configuration
 
-`~/.pi/agent/pix-gate.json`:
+Gate rules are read from the **`gate` section of `~/.pi/agent/pix.json`** (the unified config file). The legacy `~/.pi/agent/pix-gate.json` file is no longer used.
 
-```json
+`~/.pi/agent/pix.json` — `gate` section:
+
+```jsonc
 {
-  "disableDefaults": false,
-  "extraRules": [
-    { "pattern": "rm -rf /my-dir", "severity": "critical", "reason": "Deletes project root" }
-  ],
-  "autoApprove": ["^echo "]
+  "gate": {
+    "disableDefaults": false,
+    "extraRules": [
+      { "pattern": "rm -rf /my-dir", "severity": "critical", "reason": "Deletes project root" }
+    ],
+    "autoApprove": ["^echo "]
+  }
 }
 ```
 
+The schema is identical to the old `pix-gate.json` — move your existing config into `pix.json` under the `gate` key.
+
 ## Full distro
 
 Source: [github.com/xynogen/pix-mono](https://github.com/xynogen/pix-mono)

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@xynogen/pix-gate",
-	"version": "0.1.11",
+	"version": "0.1.13",
 	"description": "Pi extension — permission gate for dangerous bash commands (confirm/block with TUI dialog)",
 	"type": "module",
 	"main": "src/index.ts",
@@ -42,7 +42,8 @@
 		"access": "public"
 	},
 	"dependencies": {
-		"@xynogen/pix-pretty": "^1.7.9"
+		"@xynogen/pix-pretty": "^1.7.9",
+		"@xynogen/pix-data": "workspace:*"
 	},
 	"peerDependencies": {
 		"@earendil-works/pi-coding-agent": "*",

package/src/gate.test.ts

@@ -131,8 +131,9 @@ describe("buildRules", () => {
 
 	test("autoApprove strings compile to regexes", () => {
 		const { autoApprove } = buildRules({ autoApprove: ["^npm publish"] });
-		expect(autoApprove[0].test("npm publish --access public")).toBe(true);
-		expect(autoApprove[0].test("yarn publish")).toBe(false);
+		const rule0 = autoApprove[0] as RegExp;
+		expect(rule0.test("npm publish --access public")).toBe(true);
+		expect(rule0.test("yarn publish")).toBe(false);
 	});
 
 	test("defaults included when disableDefaults absent", () => {

package/src/index.ts

@@ -88,7 +88,13 @@ export default function (pi: ExtensionAPI): void {
 	});
 
 	// ── Unified bash gate (path + command concerns in ONE dialog) ───────────
-	const SEVERITY_TIER: Record<string, number> = {
+	const SEVERITY_TIER: {
+		critical: number;
+		block: number;
+		dangerous: number;
+		warn: number;
+		risky: number;
+	} = {
 		critical: 5,
 		block: 4,
 		dangerous: 3,

package/src/lib.ts

@@ -2,9 +2,7 @@
  * Pure helpers for pix-gate — no Pi API deps, fully unit-testable.
  */
 
-import { existsSync, readFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
+import { type GateRuleConfig, pixConfig } from "@xynogen/pix-data/pix-config";
 
 export type Severity = "critical" | "dangerous" | "risky";
 
@@ -132,13 +130,21 @@ export const DEFAULT_RULES: Rule[] = [
 ];
 
 export function loadUserConfig(): UserConfig {
-	const path = join(homedir(), ".pi", "agent", "pix-gate.json");
-	if (!existsSync(path)) return {};
-	try {
-		return JSON.parse(readFileSync(path, "utf-8")) as UserConfig;
-	} catch {
-		return {};
-	}
+	// Read from ~/.pi/agent/pix.json gate section
+	const pix = pixConfig().gate;
+	return {
+		disableDefaults: pix.disableDefaults || undefined,
+		autoApprove: pix.autoApprove.length > 0 ? pix.autoApprove : undefined,
+		extraRules:
+			pix.extraRules.length > 0
+				? pix.extraRules.map((r: GateRuleConfig) => ({
+						pattern: r.pattern,
+						flags: r.flags,
+						severity: r.severity as Severity | undefined,
+						reason: r.reason,
+					}))
+				: undefined,
+	};
 }
 
 export function buildRules(cfg: UserConfig): {
@@ -276,7 +282,7 @@ export function extractPathsFromBash(cmd: string): string[] {
 	const out: string[] = [];
 	const re =
 		/(?:^|[\s=><|;&"'`(])((?:\.\.\/|\/|~\/|\.)[^\s"'`<>|;&)]+|\.env(?:\.[A-Za-z0-9_-]+)?|[A-Za-z0-9_./-]+\.(?:pem|key|p12|pfx|crt|cer|env|envrc|netrc))/g;
-	for (const m of cmd.matchAll(re)) out.push(m[1] as string);
+	for (const m of cmd.matchAll(re)) out.push(m[1] ?? "");
 	return out;
 }
 

package/src/prompt.ts

@@ -126,7 +126,13 @@ export async function promptPathDecision(
 }
 
 /** Tier for dialog behavior — higher = more restrictive (deny-first, shorter timeout). */
-const SEVERITY_TIER: Record<string, number> = {
+const SEVERITY_TIER: {
+	critical: number;
+	block: number;
+	dangerous: number;
+	warn: number;
+	risky: number;
+} = {
 	critical: 5,
 	block: 4,
 	dangerous: 3,
@@ -146,6 +152,8 @@ export async function promptMergedGateDecision(
 	// Sort by tier desc so the highest-severity concern drives dialog behavior.
 	const sorted = [...concerns].sort((a, b) => b.tier - a.tier);
 	const highest = sorted[0];
+	if (!highest)
+		throw new Error("promptMergedGateDecision requires at least one concern");
 	const isRestrictive = highest.tier >= SEVERITY_TIER.block; // block or critical
 
 	// Title: unique severity types, joined with " + "