@xynogen/pix-gate 0.1.5 → 0.1.6

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@xynogen/pix-gate",
-	"version": "0.1.5",
+	"version": "0.1.6",
 	"description": "Pi extension — permission gate for dangerous bash commands (confirm/block with TUI dialog)",
 	"type": "module",
 	"main": "src/index.ts",

package/src/index.ts

@@ -4,10 +4,12 @@
  * Intercepts bash `tool_call` events and gates dangerous commands behind a
  * TUI confirmation dialog before they run.
  *
- * Severity tiers:
- *   critical  — blocked outright in non-interactive mode; hard deny-first in UI
- *   dangerous — 30 s auto-deny dialog; sudo fast-blocked with redirect to sudo_run
- *   risky     — 60 s allow-first dialog; silently passes in non-interactive mode
+ * Severity tiers (user always has final say via dialog):
+ *   critical  — red, deny-first dialog
+ *   dangerous — yellow, deny-first dialog
+ *   risky     — allow-first dialog
+ *   sudo      — hard block, must use sudo_run tool instead (no bypass)
+ *   No-UI fallback: critical/dangerous auto-block (can't show dialog)
  *
  * Config: ~/.pi/agent/pix-gate.json
  *   disableDefaults: true          — replace built-in rules entirely
@@ -16,11 +18,93 @@
  */
 
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
-import { buildRules, classify, isSudoCommand, loadUserConfig } from "./lib.ts";
-import { promptGateDecision, SEVERITY_ICON } from "./prompt.ts";
+import {
+	buildRules,
+	classify,
+	classifyPath,
+	extractPathsFromBash,
+	isSudoCommand,
+	loadUserConfig,
+} from "./lib.ts";
+import {
+	PATH_SEVERITY_ICON,
+	promptGateDecision,
+	promptPathDecision,
+	SEVERITY_ICON,
+} from "./prompt.ts";
 
 export default function (pi: ExtensionAPI): void {
-	const { rules, autoApprove } = buildRules(loadUserConfig());
+	const { rules, autoApprove, pathRules } = buildRules(loadUserConfig());
+
+	// ── Path protection ──────────────────────────────────────────────────────
+	pi.on("tool_call", async (event, ctx) => {
+		const tool = String(event.toolName);
+		const input = event.input as Record<string, unknown>;
+		let path: string | undefined;
+		let op: "read" | "write";
+
+		if (tool === "read") {
+			path = String(input.path ?? "");
+			op = "read";
+		} else if (tool === "write" || tool === "edit") {
+			path = String(input.path ?? "");
+			op = "write";
+		} else if (tool === "bash") {
+			const cmd = String(input.command ?? "");
+			const candidates = extractPathsFromBash(cmd);
+			for (const p of candidates) {
+				const hit = classifyPath(p, "read", pathRules);
+				if (!hit) continue;
+				if (hit.severity === "info") {
+					ctx.ui.notify(
+						`${PATH_SEVERITY_ICON.info} ${hit.reason}: ${p}`,
+						"info",
+					);
+					continue;
+				}
+				if (!ctx.hasUI)
+					return {
+						block: true,
+						reason: `[PATH:${hit.severity.toUpperCase()}] ${hit.reason} (no UI)`,
+					};
+				const decision = await promptPathDecision(ctx.ui, hit, "bash read", p);
+				if (!decision.approved)
+					return {
+						block: true,
+						reason: `[PATH] ${decision.reason}: ${hit.reason}`,
+					};
+			}
+			return undefined;
+		} else {
+			return undefined;
+		}
+
+		if (!path) return undefined;
+		const hit = classifyPath(path, op, pathRules);
+		if (!hit) return undefined;
+
+		if (hit.severity === "info") {
+			ctx.ui.notify(
+				`${PATH_SEVERITY_ICON.info} ${hit.reason}: ${path}`,
+				"info",
+			);
+			return undefined;
+		}
+
+		if (!ctx.hasUI)
+			return {
+				block: true,
+				reason: `[PATH:${hit.severity.toUpperCase()}] ${hit.reason} (no UI)`,
+			};
+
+		const decision = await promptPathDecision(ctx.ui, hit, op, path);
+		if (!decision.approved)
+			return {
+				block: true,
+				reason: `[PATH] ${decision.reason}: ${hit.reason}`,
+			};
+		return undefined;
+	});
 
 	pi.on("tool_call", async (event, ctx) => {
 		if (event.toolName !== "bash") return undefined;
@@ -33,41 +117,31 @@ export default function (pi: ExtensionAPI): void {
 		const hit = classify(command, rules);
 		if (!hit) return undefined;
 
-		// sudo: fast-block with redirect to sudo_run — no dialog needed.
+		const icon = SEVERITY_ICON[hit.severity];
+		const label = hit.severity.toUpperCase();
+
+		// No UI: can't show dialog — auto-block critical/dangerous, pass risky.
+		if (!ctx.hasUI) {
+			if (hit.severity === "risky") return undefined;
+			return {
+				block: true,
+				reason: `[${label}] ${hit.reason} (no UI, auto-blocked)`,
+			};
+		}
+
+		// sudo: hard redirect to sudo_run — no prompt, no bypass.
 		if (isSudoCommand(command)) {
 			ctx.ui.notify(
-				`⚠️  ${ctx.ui.theme.fg("warning", "DANGEROUS")} — privilege escalation blocked\n` +
-					`${ctx.ui.theme.fg("dim", "Use")} ${ctx.ui.theme.fg("accent", "sudo_run")} ` +
-					`${ctx.ui.theme.fg("dim", "tool instead — handles auth securely")}`,
+				`⚠️  ${ctx.ui.theme.fg("warning", "DANGEROUS")} — use sudo_run tool instead (handles auth securely)`,
 				"warning",
 			);
 			return {
 				block: true,
 				reason:
-					"[DANGEROUS] privilege escalation — use sudo_run tool instead, it handles authentication securely.",
+					"[DANGEROUS] privilege escalation — use sudo_run tool, it handles authentication securely.",
 			};
 		}
 
-		const icon = SEVERITY_ICON[hit.severity];
-		const label = hit.severity.toUpperCase();
-
-		// Non-interactive: block critical + dangerous outright; allow risky silently.
-		if (!ctx.hasUI) {
-			if (hit.severity === "critical") {
-				return {
-					block: true,
-					reason: `[${label}] ${hit.reason} (no UI, auto-blocked)`,
-				};
-			}
-			if (hit.severity === "dangerous") {
-				return {
-					block: true,
-					reason: `[${label}] ${hit.reason} (no UI for confirmation)`,
-				};
-			}
-			return undefined;
-		}
-
 		const decision = await promptGateDecision(ctx.ui, hit, command);
 
 		if (!decision.approved) {

package/src/lib.ts

@@ -144,6 +144,7 @@ export function loadUserConfig(): UserConfig {
 export function buildRules(cfg: UserConfig): {
 	rules: Rule[];
 	autoApprove: RegExp[];
+	pathRules: PathRule[];
 } {
 	const base = cfg.disableDefaults ? [] : DEFAULT_RULES.slice();
 	const extra = (cfg.extraRules ?? []).map((r) => ({
@@ -152,7 +153,9 @@ export function buildRules(cfg: UserConfig): {
 		reason: r.reason ?? "user-defined rule",
 	}));
 	const autoApprove = (cfg.autoApprove ?? []).map((s) => new RegExp(s));
-	return { rules: [...base, ...extra], autoApprove };
+	// ponytail: path rule config extension skipped for now — add extraPathRules/disablePathDefaults to UserConfig when needed
+	const pathRules = cfg.disableDefaults ? [] : DEFAULT_PATH_RULES.slice();
+	return { rules: [...base, ...extra], autoApprove, pathRules };
 }
 
 /**
@@ -170,6 +173,114 @@ export function classify(command: string, rules: Rule[]): Rule | undefined {
 	return undefined;
 }
 
+// ── Path rules ───────────────────────────────────────────────────────────────
+
+export type PathSeverity = "block" | "warn" | "info";
+
+export interface PathRule {
+	pattern: RegExp;
+	severity: PathSeverity;
+	reason: string;
+	/** Which ops to intercept: "read" | "write" | both (default both) */
+	ops?: ("read" | "write")[];
+}
+
+/**
+ * block — red, deny-first dialog (user can still allow)
+ * warn  — yellow, allow-first dialog
+ * info  — blue notify only, always passes through
+ */
+export const DEFAULT_PATH_RULES: PathRule[] = [
+	// block — red deny-first
+	{
+		pattern: /(^|\/)id_(rsa|dsa|ecdsa|ed25519)$/i,
+		severity: "block",
+		reason: "SSH private key",
+	},
+	{
+		pattern: /\.(pem|key|p12|pfx|jks|keystore)$/i,
+		severity: "block",
+		reason: "private key / keystore",
+	},
+	{
+		pattern: /(^|\/)\.aws\/credentials$/i,
+		severity: "block",
+		reason: "AWS credentials",
+	},
+	{
+		pattern: /(^|\/)\.netrc$/i,
+		severity: "block",
+		reason: "netrc credentials",
+	},
+	{
+		pattern: /(^|\/)(credentials|service-account)\.(json|ya?ml|toml)$/i,
+		severity: "block",
+		reason: "credentials file",
+	},
+
+	// warn — yellow allow-first
+	{ pattern: /(^|\/)\.env(\.|$)/i, severity: "warn", reason: ".env file" },
+	{ pattern: /(^|\/)\.envrc$/i, severity: "warn", reason: "direnv file" },
+	{
+		pattern: /(^|\/)\.npmrc$/i,
+		severity: "warn",
+		reason: ".npmrc (may contain auth tokens)",
+	},
+	{
+		pattern: /(^|\/)\.pypirc$/i,
+		severity: "warn",
+		reason: ".pypirc (may contain tokens)",
+	},
+	{ pattern: /\.(crt|cer)$/i, severity: "warn", reason: "certificate file" },
+	{
+		pattern: /(^|\/)(secrets?)\.(json|ya?ml|toml)$/i,
+		severity: "warn",
+		reason: "secrets file",
+	},
+	{ pattern: /(^|\/)\.ssh\//i, severity: "warn", reason: ".ssh directory" },
+
+	// info — notify only (write-only guard)
+	{
+		pattern: /(^|\/)\.git\//,
+		severity: "info",
+		reason: ".git directory",
+		ops: ["write"],
+	},
+	{
+		pattern: /(^|\/)node_modules\//,
+		severity: "info",
+		reason: "node_modules",
+		ops: ["write"],
+	},
+];
+
+export function classifyPath(
+	path: string,
+	op: "read" | "write",
+	rules: PathRule[],
+): PathRule | undefined {
+	const order: PathSeverity[] = ["block", "warn", "info"];
+	for (const sev of order) {
+		const hit = rules.find((r) => {
+			if (r.severity !== sev) return false;
+			if (r.ops && !r.ops.includes(op)) return false;
+			return r.pattern.test(path);
+		});
+		if (hit) return hit;
+	}
+	return undefined;
+}
+
+/** Extract candidate file paths from a bash command string */
+export function extractPathsFromBash(cmd: string): string[] {
+	const out: string[] = [];
+	const re =
+		/(?:^|[\s=><|;&"'`(])((?:\.\.\/|\/|~\/|\.)[^\s"'`<>|;&)]+|\.env(?:\.[A-Za-z0-9_-]+)?|[A-Za-z0-9_./-]+\.(?:pem|key|p12|pfx|crt|cer|env|envrc|netrc))/g;
+	let m: RegExpExecArray | null;
+	while ((m = re.exec(cmd)) !== null) out.push(m[1]);
+	return out;
+}
+
 /** True when command contains a real sudo invocation (not a path like pix-sudo). */
 export function isSudoCommand(command: string): boolean {
 	return /(^|[\s;|&])sudo\b/i.test(command);

package/src/prompt.ts

@@ -10,7 +10,7 @@ import {
 	type OverlayResult,
 	showOverlay,
 } from "@xynogen/pix-pretty/gate-overlay";
-import type { Rule } from "./lib.ts";
+import type { PathRule, Rule } from "./lib.ts";
 
 export interface GateDecision {
 	approved: boolean;
@@ -38,6 +38,84 @@ export const SEVERITY_ICON: Record<Rule["severity"], string> = {
 	risky: "❓",
 };
 
+const PATH_SEVERITY_COLOR: Record<PathRule["severity"], string> = {
+	block: "error",
+	warn: "warning",
+	info: "accent",
+};
+
+export const PATH_SEVERITY_ICON: Record<PathRule["severity"], string> = {
+	block: "🔴",
+	warn: "🟡",
+	info: "🔵",
+};
+
+const PATH_TIMEOUT_MS: Record<PathRule["severity"], number> = {
+	block: 15_000,
+	warn: 30_000,
+	info: 0, // info never shows a dialog
+};
+
+/**
+ * Show confirm/deny dialog for a path access.
+ * block: deny-first. warn: allow-first. info: never called (notify only).
+ */
+export async function promptPathDecision(
+	ui: GatePromptUI,
+	hit: PathRule,
+	op: string,
+	path: string,
+): Promise<GateDecision> {
+	const icon = PATH_SEVERITY_ICON[hit.severity];
+	const label = hit.severity.toUpperCase();
+	const accent = PATH_SEVERITY_COLOR[hit.severity];
+
+	const choices =
+		hit.severity === "block"
+			? [
+					{
+						value: "no",
+						label: "No, block it",
+						description: "Deny this file access",
+					},
+					{
+						value: "yes",
+						label: "Yes, I know what I'm doing",
+						description: "Allow once",
+					},
+				]
+			: [
+					{
+						value: "yes",
+						label: "Yes, allow",
+						description: "Proceed with file access",
+					},
+					{
+						value: "no",
+						label: "No, block it",
+						description: "Deny this file access",
+					},
+				];
+
+	const result: OverlayResult = await showOverlay(
+		ui as Parameters<typeof showOverlay>[0],
+		{
+			mode: "confirm",
+			title: `${icon} ${label} — ${hit.reason}`,
+			body: [`${op.toUpperCase()} ${path}`],
+			accent,
+			timeoutMs: PATH_TIMEOUT_MS[hit.severity],
+			choices,
+		},
+	);
+
+	if (result.action === "approved")
+		return { approved: true, reason: "Approved" };
+	if (result.action === "timeout")
+		return { approved: false, reason: "Timed out" };
+	return { approved: false, reason: "Blocked by user" };
+}
+
 /**
  * Show the confirm/deny dialog for a matched command.
  * Critical is deny-first; dangerous/risky are allow-first.