@xynogen/pix-gate 0.1.4 → 0.1.6

package/README.md

@@ -26,7 +26,9 @@ classification logic can be reused without the TUI:
 - `@xynogen/pix-gate/lib` — pure rules: `DEFAULT_RULES`, `buildRules`,
   `classify`, `loadUserConfig`, `isSudoCommand`. No Pi/TUI dependency.
 - `@xynogen/pix-gate/prompt` — `promptGateDecision()`, the confirm/deny dialog
-  (depends on `pi-tui`).
+  (depends on `pi-tui`). This is now a thin adapter over the shared
+  `@xynogen/pix-pretty/gate-overlay` component, so the gate and `sudo_run`
+  dialogs share one implementation.
 
 `pix-skills` imports `./lib` to gate skill `` !`cmd` `` directives with the same
 rules as the bash tool (auto-deny on match, no prompt).

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@xynogen/pix-gate",
-	"version": "0.1.4",
+	"version": "0.1.6",
 	"description": "Pi extension — permission gate for dangerous bash commands (confirm/block with TUI dialog)",
 	"type": "module",
 	"main": "src/index.ts",
@@ -41,6 +41,9 @@
 	"publishConfig": {
 		"access": "public"
 	},
+	"dependencies": {
+		"@xynogen/pix-pretty": "*"
+	},
 	"peerDependencies": {
 		"@earendil-works/pi-coding-agent": "*",
 		"@earendil-works/pi-tui": "*"

package/src/index.ts

@@ -4,10 +4,12 @@
  * Intercepts bash `tool_call` events and gates dangerous commands behind a
  * TUI confirmation dialog before they run.
  *
- * Severity tiers:
- *   critical  — blocked outright in non-interactive mode; hard deny-first in UI
- *   dangerous — 30 s auto-deny dialog; sudo fast-blocked with redirect to sudo_run
- *   risky     — 60 s allow-first dialog; silently passes in non-interactive mode
+ * Severity tiers (user always has final say via dialog):
+ *   critical  — red, deny-first dialog
+ *   dangerous — yellow, deny-first dialog
+ *   risky     — allow-first dialog
+ *   sudo      — hard block, must use sudo_run tool instead (no bypass)
+ *   No-UI fallback: critical/dangerous auto-block (can't show dialog)
  *
  * Config: ~/.pi/agent/pix-gate.json
  *   disableDefaults: true          — replace built-in rules entirely
@@ -16,11 +18,93 @@
  */
 
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
-import { buildRules, classify, isSudoCommand, loadUserConfig } from "./lib.ts";
-import { promptGateDecision, SEVERITY_ICON } from "./prompt.ts";
+import {
+	buildRules,
+	classify,
+	classifyPath,
+	extractPathsFromBash,
+	isSudoCommand,
+	loadUserConfig,
+} from "./lib.ts";
+import {
+	PATH_SEVERITY_ICON,
+	promptGateDecision,
+	promptPathDecision,
+	SEVERITY_ICON,
+} from "./prompt.ts";
 
 export default function (pi: ExtensionAPI): void {
-	const { rules, autoApprove } = buildRules(loadUserConfig());
+	const { rules, autoApprove, pathRules } = buildRules(loadUserConfig());
+
+	// ── Path protection ──────────────────────────────────────────────────────
+	pi.on("tool_call", async (event, ctx) => {
+		const tool = String(event.toolName);
+		const input = event.input as Record<string, unknown>;
+		let path: string | undefined;
+		let op: "read" | "write";
+
+		if (tool === "read") {
+			path = String(input.path ?? "");
+			op = "read";
+		} else if (tool === "write" || tool === "edit") {
+			path = String(input.path ?? "");
+			op = "write";
+		} else if (tool === "bash") {
+			const cmd = String(input.command ?? "");
+			const candidates = extractPathsFromBash(cmd);
+			for (const p of candidates) {
+				const hit = classifyPath(p, "read", pathRules);
+				if (!hit) continue;
+				if (hit.severity === "info") {
+					ctx.ui.notify(
+						`${PATH_SEVERITY_ICON.info} ${hit.reason}: ${p}`,
+						"info",
+					);
+					continue;
+				}
+				if (!ctx.hasUI)
+					return {
+						block: true,
+						reason: `[PATH:${hit.severity.toUpperCase()}] ${hit.reason} (no UI)`,
+					};
+				const decision = await promptPathDecision(ctx.ui, hit, "bash read", p);
+				if (!decision.approved)
+					return {
+						block: true,
+						reason: `[PATH] ${decision.reason}: ${hit.reason}`,
+					};
+			}
+			return undefined;
+		} else {
+			return undefined;
+		}
+
+		if (!path) return undefined;
+		const hit = classifyPath(path, op, pathRules);
+		if (!hit) return undefined;
+
+		if (hit.severity === "info") {
+			ctx.ui.notify(
+				`${PATH_SEVERITY_ICON.info} ${hit.reason}: ${path}`,
+				"info",
+			);
+			return undefined;
+		}
+
+		if (!ctx.hasUI)
+			return {
+				block: true,
+				reason: `[PATH:${hit.severity.toUpperCase()}] ${hit.reason} (no UI)`,
+			};
+
+		const decision = await promptPathDecision(ctx.ui, hit, op, path);
+		if (!decision.approved)
+			return {
+				block: true,
+				reason: `[PATH] ${decision.reason}: ${hit.reason}`,
+			};
+		return undefined;
+	});
 
 	pi.on("tool_call", async (event, ctx) => {
 		if (event.toolName !== "bash") return undefined;
@@ -33,41 +117,31 @@ export default function (pi: ExtensionAPI): void {
 		const hit = classify(command, rules);
 		if (!hit) return undefined;
 
-		// sudo: fast-block with redirect to sudo_run — no dialog needed.
+		const icon = SEVERITY_ICON[hit.severity];
+		const label = hit.severity.toUpperCase();
+
+		// No UI: can't show dialog — auto-block critical/dangerous, pass risky.
+		if (!ctx.hasUI) {
+			if (hit.severity === "risky") return undefined;
+			return {
+				block: true,
+				reason: `[${label}] ${hit.reason} (no UI, auto-blocked)`,
+			};
+		}
+
+		// sudo: hard redirect to sudo_run — no prompt, no bypass.
 		if (isSudoCommand(command)) {
 			ctx.ui.notify(
-				`⚠️  ${ctx.ui.theme.fg("warning", "DANGEROUS")} — privilege escalation blocked\n` +
-					`${ctx.ui.theme.fg("dim", "Use")} ${ctx.ui.theme.fg("accent", "sudo_run")} ` +
-					`${ctx.ui.theme.fg("dim", "tool instead — handles auth securely")}`,
+				`⚠️  ${ctx.ui.theme.fg("warning", "DANGEROUS")} — use sudo_run tool instead (handles auth securely)`,
 				"warning",
 			);
 			return {
 				block: true,
 				reason:
-					"[DANGEROUS] privilege escalation — use sudo_run tool instead, it handles authentication securely.",
+					"[DANGEROUS] privilege escalation — use sudo_run tool, it handles authentication securely.",
 			};
 		}
 
-		const icon = SEVERITY_ICON[hit.severity];
-		const label = hit.severity.toUpperCase();
-
-		// Non-interactive: block critical + dangerous outright; allow risky silently.
-		if (!ctx.hasUI) {
-			if (hit.severity === "critical") {
-				return {
-					block: true,
-					reason: `[${label}] ${hit.reason} (no UI, auto-blocked)`,
-				};
-			}
-			if (hit.severity === "dangerous") {
-				return {
-					block: true,
-					reason: `[${label}] ${hit.reason} (no UI for confirmation)`,
-				};
-			}
-			return undefined;
-		}
-
 		const decision = await promptGateDecision(ctx.ui, hit, command);
 
 		if (!decision.approved) {

package/src/lib.ts

@@ -144,6 +144,7 @@ export function loadUserConfig(): UserConfig {
 export function buildRules(cfg: UserConfig): {
 	rules: Rule[];
 	autoApprove: RegExp[];
+	pathRules: PathRule[];
 } {
 	const base = cfg.disableDefaults ? [] : DEFAULT_RULES.slice();
 	const extra = (cfg.extraRules ?? []).map((r) => ({
@@ -152,7 +153,9 @@ export function buildRules(cfg: UserConfig): {
 		reason: r.reason ?? "user-defined rule",
 	}));
 	const autoApprove = (cfg.autoApprove ?? []).map((s) => new RegExp(s));
-	return { rules: [...base, ...extra], autoApprove };
+	// ponytail: path rule config extension skipped for now — add extraPathRules/disablePathDefaults to UserConfig when needed
+	const pathRules = cfg.disableDefaults ? [] : DEFAULT_PATH_RULES.slice();
+	return { rules: [...base, ...extra], autoApprove, pathRules };
 }
 
 /**
@@ -170,6 +173,114 @@ export function classify(command: string, rules: Rule[]): Rule | undefined {
 	return undefined;
 }
 
+// ── Path rules ───────────────────────────────────────────────────────────────
+
+export type PathSeverity = "block" | "warn" | "info";
+
+export interface PathRule {
+	pattern: RegExp;
+	severity: PathSeverity;
+	reason: string;
+	/** Which ops to intercept: "read" | "write" | both (default both) */
+	ops?: ("read" | "write")[];
+}
+
+/**
+ * block — red, deny-first dialog (user can still allow)
+ * warn  — yellow, allow-first dialog
+ * info  — blue notify only, always passes through
+ */
+export const DEFAULT_PATH_RULES: PathRule[] = [
+	// block — red deny-first
+	{
+		pattern: /(^|\/)id_(rsa|dsa|ecdsa|ed25519)$/i,
+		severity: "block",
+		reason: "SSH private key",
+	},
+	{
+		pattern: /\.(pem|key|p12|pfx|jks|keystore)$/i,
+		severity: "block",
+		reason: "private key / keystore",
+	},
+	{
+		pattern: /(^|\/)\.aws\/credentials$/i,
+		severity: "block",
+		reason: "AWS credentials",
+	},
+	{
+		pattern: /(^|\/)\.netrc$/i,
+		severity: "block",
+		reason: "netrc credentials",
+	},
+	{
+		pattern: /(^|\/)(credentials|service-account)\.(json|ya?ml|toml)$/i,
+		severity: "block",
+		reason: "credentials file",
+	},
+
+	// warn — yellow allow-first
+	{ pattern: /(^|\/)\.env(\.|$)/i, severity: "warn", reason: ".env file" },
+	{ pattern: /(^|\/)\.envrc$/i, severity: "warn", reason: "direnv file" },
+	{
+		pattern: /(^|\/)\.npmrc$/i,
+		severity: "warn",
+		reason: ".npmrc (may contain auth tokens)",
+	},
+	{
+		pattern: /(^|\/)\.pypirc$/i,
+		severity: "warn",
+		reason: ".pypirc (may contain tokens)",
+	},
+	{ pattern: /\.(crt|cer)$/i, severity: "warn", reason: "certificate file" },
+	{
+		pattern: /(^|\/)(secrets?)\.(json|ya?ml|toml)$/i,
+		severity: "warn",
+		reason: "secrets file",
+	},
+	{ pattern: /(^|\/)\.ssh\//i, severity: "warn", reason: ".ssh directory" },
+
+	// info — notify only (write-only guard)
+	{
+		pattern: /(^|\/)\.git\//,
+		severity: "info",
+		reason: ".git directory",
+		ops: ["write"],
+	},
+	{
+		pattern: /(^|\/)node_modules\//,
+		severity: "info",
+		reason: "node_modules",
+		ops: ["write"],
+	},
+];
+
+export function classifyPath(
+	path: string,
+	op: "read" | "write",
+	rules: PathRule[],
+): PathRule | undefined {
+	const order: PathSeverity[] = ["block", "warn", "info"];
+	for (const sev of order) {
+		const hit = rules.find((r) => {
+			if (r.severity !== sev) return false;
+			if (r.ops && !r.ops.includes(op)) return false;
+			return r.pattern.test(path);
+		});
+		if (hit) return hit;
+	}
+	return undefined;
+}
+
+/** Extract candidate file paths from a bash command string */
+export function extractPathsFromBash(cmd: string): string[] {
+	const out: string[] = [];
+	const re =
+		/(?:^|[\s=><|;&"'`(])((?:\.\.\/|\/|~\/|\.)[^\s"'`<>|;&)]+|\.env(?:\.[A-Za-z0-9_-]+)?|[A-Za-z0-9_./-]+\.(?:pem|key|p12|pfx|crt|cer|env|envrc|netrc))/g;
+	let m: RegExpExecArray | null;
+	while ((m = re.exec(cmd)) !== null) out.push(m[1]);
+	return out;
+}
+
 /** True when command contains a real sudo invocation (not a path like pix-sudo). */
 export function isSudoCommand(command: string): boolean {
 	return /(^|[\s;|&])sudo\b/i.test(command);

package/src/prompt.ts

@@ -1,15 +1,16 @@
 /**
- * pix-gate — Part 2: the prompt.
+ * pix-gate — prompt.ts
  *
- * The interactive confirm/deny dialog, decoupled from the rule engine (lib.ts).
- * Returns a pure decision; the caller maps it to a tool-call result and emits
- * any notifications. This lets the rule engine be reused without the TUI dep.
+ * Thin adapter: maps gate severity/rule → showOverlay (pix-pretty).
+ * All dialog logic lives in @xynogen/pix-pretty/gate-overlay.
  */
 
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
-import { DynamicBorder } from "@earendil-works/pi-coding-agent";
-import { Box, type SelectItem, SelectList, Text } from "@earendil-works/pi-tui";
-import type { Rule } from "./lib.ts";
+import {
+	type OverlayResult,
+	showOverlay,
+} from "@xynogen/pix-pretty/gate-overlay";
+import type { PathRule, Rule } from "./lib.ts";
 
 export interface GateDecision {
 	approved: boolean;
@@ -17,7 +18,6 @@ export interface GateDecision {
 	reason: string;
 }
 
-/** The UI surface the dialog needs — the extension context's `ui`. */
 export type GatePromptUI = ExtensionContext["ui"];
 
 const TIMEOUT_MS: Record<Rule["severity"], number> = {
@@ -26,34 +26,111 @@ const TIMEOUT_MS: Record<Rule["severity"], number> = {
 	risky: 60_000,
 };
 
-const SEVERITY_COLOR = {
+const SEVERITY_COLOR: Record<Rule["severity"], string> = {
 	critical: "error",
 	dangerous: "warning",
 	risky: "accent",
-} as const satisfies Record<Rule["severity"], string>;
+};
 
-const SEVERITY_ICON: Record<Rule["severity"], string> = {
+export const SEVERITY_ICON: Record<Rule["severity"], string> = {
 	critical: "🛑",
 	dangerous: "⚠️ ",
 	risky: "❓",
 };
 
+const PATH_SEVERITY_COLOR: Record<PathRule["severity"], string> = {
+	block: "error",
+	warn: "warning",
+	info: "accent",
+};
+
+export const PATH_SEVERITY_ICON: Record<PathRule["severity"], string> = {
+	block: "🔴",
+	warn: "🟡",
+	info: "🔵",
+};
+
+const PATH_TIMEOUT_MS: Record<PathRule["severity"], number> = {
+	block: 15_000,
+	warn: 30_000,
+	info: 0, // info never shows a dialog
+};
+
 /**
- * Show the confirm/deny dialog for a matched command and resolve the decision.
- * Critical defaults to deny-first; dangerous/risky default to allow-first.
- * Times out to a denial after a severity-scaled deadline.
+ * Show confirm/deny dialog for a path access.
+ * block: deny-first. warn: allow-first. info: never called (notify only).
+ */
+export async function promptPathDecision(
+	ui: GatePromptUI,
+	hit: PathRule,
+	op: string,
+	path: string,
+): Promise<GateDecision> {
+	const icon = PATH_SEVERITY_ICON[hit.severity];
+	const label = hit.severity.toUpperCase();
+	const accent = PATH_SEVERITY_COLOR[hit.severity];
+
+	const choices =
+		hit.severity === "block"
+			? [
+					{
+						value: "no",
+						label: "No, block it",
+						description: "Deny this file access",
+					},
+					{
+						value: "yes",
+						label: "Yes, I know what I'm doing",
+						description: "Allow once",
+					},
+				]
+			: [
+					{
+						value: "yes",
+						label: "Yes, allow",
+						description: "Proceed with file access",
+					},
+					{
+						value: "no",
+						label: "No, block it",
+						description: "Deny this file access",
+					},
+				];
+
+	const result: OverlayResult = await showOverlay(
+		ui as Parameters<typeof showOverlay>[0],
+		{
+			mode: "confirm",
+			title: `${icon} ${label} — ${hit.reason}`,
+			body: [`${op.toUpperCase()} ${path}`],
+			accent,
+			timeoutMs: PATH_TIMEOUT_MS[hit.severity],
+			choices,
+		},
+	);
+
+	if (result.action === "approved")
+		return { approved: true, reason: "Approved" };
+	if (result.action === "timeout")
+		return { approved: false, reason: "Timed out" };
+	return { approved: false, reason: "Blocked by user" };
+}
+
+/**
+ * Show the confirm/deny dialog for a matched command.
+ * Critical is deny-first; dangerous/risky are allow-first.
  */
 export async function promptGateDecision(
 	ui: GatePromptUI,
 	hit: Rule,
 	command: string,
 ): Promise<GateDecision> {
-	const timeoutMs = TIMEOUT_MS[hit.severity];
-	const severityColor = SEVERITY_COLOR[hit.severity];
 	const icon = SEVERITY_ICON[hit.severity];
 	const label = hit.severity.toUpperCase();
+	const accent = SEVERITY_COLOR[hit.severity];
 
-	const choices: SelectItem[] =
+	// critical: deny listed first so it's the default selected item
+	const choices =
 		hit.severity === "critical"
 			? [
 					{
@@ -68,11 +145,7 @@ export async function promptGateDecision(
 					},
 				]
 			: [
-					{
-						value: "yes",
-						label: "Yes, allow",
-						description: "Run the command",
-					},
+					{ value: "yes", label: "Yes, allow", description: "Run the command" },
 					{
 						value: "no",
 						label: "No, block it",
@@ -80,97 +153,21 @@ export async function promptGateDecision(
 					},
 				];
 
-	const controller = new AbortController();
-	const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
-
-	const choice = await ui.custom<string | null>(
-		(tui, theme, _kb, done) => {
-			const container = new Box(0, 0, (s) => theme.bg("customMessageBg", s));
-
-			container.addChild(
-				new DynamicBorder((s: string) => theme.fg(severityColor, s)),
-			);
-
-			container.addChild(
-				new Text(
-					`${icon} ` +
-						theme.fg(severityColor, theme.bold(label)) +
-						theme.fg("muted", ` — ${hit.reason}`),
-					1,
-					0,
-				),
-			);
-
-			container.addChild(new Text(theme.fg("toolOutput", command), 2, 0));
-
-			const deadlineMs = Date.now() + timeoutMs;
-			const countdownText = new Text("", 1, 0);
-			const updateCountdown = () => {
-				const remaining = Math.max(
-					0,
-					Math.ceil((deadlineMs - Date.now()) / 1000),
-				);
-				countdownText.setText(
-					theme.fg("dim", "Auto-deny in ") +
-						theme.fg(remaining <= 5 ? severityColor : "muted", `${remaining}s`),
-				);
-			};
-			updateCountdown();
-			const ticker = setInterval(() => {
-				updateCountdown();
-				tui.requestRender();
-			}, 1000);
-			container.addChild(countdownText);
-
-			const list = new SelectList(choices, choices.length, {
-				selectedPrefix: (t) => theme.fg(severityColor, t),
-				selectedText: (t) => theme.fg(severityColor, t),
-				description: (t) => theme.fg("muted", t),
-				scrollInfo: (t) => theme.fg("dim", t),
-				noMatch: (t) => theme.fg("warning", t),
-			});
-			const finish = (v: string | null) => {
-				clearInterval(ticker);
-				done(v);
-			};
-			list.onSelect = (item) => finish(item.value);
-			list.onCancel = () => finish(null);
-			container.addChild(list);
-
-			container.addChild(
-				new Text(
-					theme.fg("dim", "↑↓ navigate • enter select • esc cancel"),
-					1,
-					0,
-				),
-			);
-
-			container.addChild(
-				new DynamicBorder((s: string) => theme.fg(severityColor, s)),
-			);
-
-			controller.signal.addEventListener("abort", () => finish(null));
-
-			return {
-				render: (w: number) => container.render(w),
-				invalidate: () => container.invalidate(),
-				handleInput: (data: string) => {
-					list.handleInput(data);
-					tui.requestRender();
-				},
-			};
+	const result: OverlayResult = await showOverlay(
+		ui as Parameters<typeof showOverlay>[0],
+		{
+			mode: "confirm",
+			title: `${icon} ${label} — ${hit.reason}`,
+			body: [command],
+			accent,
+			timeoutMs: TIMEOUT_MS[hit.severity],
+			choices,
 		},
-		{ overlay: true },
 	);
 
-	clearTimeout(timeoutId);
-
-	const approved = choice === "yes";
-	if (approved) return { approved: true, reason: "Approved" };
-	return {
-		approved: false,
-		reason: controller.signal.aborted ? "Timed out" : "Blocked by user",
-	};
+	if (result.action === "approved")
+		return { approved: true, reason: "Approved" };
+	if (result.action === "timeout")
+		return { approved: false, reason: "Timed out" };
+	return { approved: false, reason: "Blocked by user" };
 }
-
-export { SEVERITY_ICON };