@xynogen/pix-gate 0.2.12 → 0.3.0

package/README.md

@@ -19,9 +19,11 @@ Intercepts every tool call and classifies it against severity rules before it ru
 | Tier | Examples | Behavior |
 |---|---|---|
 | `critical` | force-push to main, recursive delete, `dd` to disk | hard-block (non-interactive) / 15s auto-deny dialog (TUI) |
-| `dangerous` | any `sudo` (hard-redirected to `sudo_run`, no bypass) | 30s auto-deny confirmation |
+| `dangerous` | destructive git, `chmod 777`, `curl … \| sh` | 30s auto-deny confirmation |
 | `risky` | — | 60s allow-first dialog; silently passes non-interactive |
 
+**Privileged auth redirect** — bash `sudo`/`ssh` can't have their password/passphrase auto-typed, so they are hard-blocked and redirected to the dedicated tool (`sudo_run`/`ssh_run`) with no bypass — but *only when that tool is installed* (pix-sudo/pix-ssh are opt-in; without them the bash form is the only path and passes through). This is **guarding** (stop + redirect); the softer **steering** of non-privileged stand-ins (`cat`→`read`, `grep`→`grep`, …) lives in [`pix-nudge`](../pix-nudge).
+
 Auto-approve patterns and extra rules go in the `gate` section of `~/.pi/agent/pix.json`; set `guardrails: "off"` to disable built-in rules entirely.
 
 **Away notifications** — while a dialog is open, the gate holds the shared **agent-state** coordinator `blocked` (via `withAgentBlock` from [`@xynogen/pix-runtime`](https://www.npmjs.com/package/@xynogen/pix-runtime)), so a herdr pane pings an away user. Pairs with pix-commands unattended modes:

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@xynogen/pix-gate",
-	"version": "0.2.12",
+	"version": "0.3.0",
 	"description": "Pi extension — permission gate for dangerous bash commands (confirm/block with TUI dialog)",
 	"type": "module",
 	"main": "src/index.ts",

package/src/index.ts

@@ -25,6 +25,7 @@ import {
 	classifyPath,
 	extractPathsFromBash,
 	isCircuitBreaker,
+	isSshCommand,
 	isSudoCommand,
 	loadUserConfig,
 	unattendedGateDecision,
@@ -42,6 +43,26 @@ import {
 export default function (pi: ExtensionAPI): void {
 	const { rules, autoApprove, pathRules } = buildRules(loadUserConfig());
 
+	// Is a tool registered (active or gated)? ssh_run/sudo_run are opt-in and
+	// absent when pix-ssh/pix-sudo aren't installed — only redirect toward a
+	// tool that actually exists, else the bash form is the only path.
+	const isRegistered = (name: string): boolean => {
+		try {
+			return (pi.getAllTools?.() ?? []).some((t) => t.name === name);
+		} catch {
+			return false;
+		}
+	};
+
+	// Privileged auth tools that must not run raw in bash (interactive password /
+	// passphrase can't be auto-typed there). Each redirects to its dedicated tool
+	// ONLY when that tool is installed. pix-nudge handles the non-privileged
+	// read/ls/grep/find/edit stand-ins.
+	const AUTH_REDIRECTS = [
+		{ match: isSudoCommand, tool: "sudo_run", label: "sudo" },
+		{ match: isSshCommand, tool: "ssh_run", label: "ssh" },
+	] as const;
+
 	// ── Path protection (read/write/edit tools only — bash handled below) ───
 	pi.on("tool_call", async (event, ctx) => {
 		const tool = String(event.toolName);
@@ -157,19 +178,19 @@ export default function (pi: ExtensionAPI): void {
 
 		const highest = concerns.reduce((a, b) => (a.tier > b.tier ? a : b));
 
-		// sudo: hard redirect — no prompt, no bypass. Even YOLO cannot run bare
-		// `sudo` in bash (the password can't be auto-typed); it must use sudo_run.
-		if (isSudoCommand(command)) {
+		// Privileged auth redirect — hard block, no prompt, no bypass. Even YOLO
+		// cannot run bare sudo/ssh in bash (password/passphrase can't be auto-typed);
+		// it must use the dedicated tool. Only fires when that tool is installed.
+		for (const redirect of AUTH_REDIRECTS) {
+			if (!redirect.match(command) || !isRegistered(redirect.tool)) continue;
 			if (unattendedGateDecision(pi.events, highest.tier) === "deny") {
-				return { block: true, reason: "[AFK] sudo is denied while user is away." };
+				return { block: true, reason: `[AFK] ${redirect.label} is denied while user is away.` };
 			}
-			ctx.ui.notify(
-				`⚠️  ${ctx.ui.theme.fg("warning", "DANGEROUS")} — use sudo_run tool instead (handles auth securely)`,
-				"warning",
-			);
+			// One surface only: the block reason renders as the tool-error card and
+			// reaches the model. A separate notify would duplicate the warning.
 			return {
 				block: true,
-				reason: "Use sudo_run tool instead of sudo in bash.",
+				reason: `DANGEROUS — use the ${redirect.tool} tool instead of ${redirect.label} in bash (it handles auth securely).`,
 			};
 		}
 

package/src/lib.ts

@@ -298,6 +298,16 @@ export function isSudoCommand(command: string): boolean {
 	return /(^|[\s;|&])sudo\b/i.test(command);
 }
 
+/**
+ * True when a command invokes the `ssh` remote shell as a token. Requires
+ * trailing whitespace/end so it does NOT match `ssh-keygen`, `ssh-add`,
+ * `ssh-copy-id`, or `sshpass` (a later real ` ssh ` in the same line still
+ * matches, e.g. `sshpass -p x ssh host`).
+ */
+export function isSshCommand(command: string): boolean {
+	return /(^|[\s;|&])ssh(\s|$)/i.test(command);
+}
+
 // Non-lifting circuit breaker: catastrophic, unrecoverable commands that NO
 // mode (not even YOLO) may auto-approve. Mirrors Claude Code's bypassPermissions
 // floor, which still prompts on root/home wipes. These always fall through to

package/src/prompt.ts

@@ -26,6 +26,11 @@ export interface Concern {
 
 export type GatePromptUI = ExtensionContext["ui"];
 
+/** Title Case a severity tier for dialog titles: "critical" → "Critical". */
+function titleCase(word: string): string {
+	return word ? word[0]!.toUpperCase() + word.slice(1).toLowerCase() : word;
+}
+
 const TIMEOUT_MS: Record<Rule["severity"], number> = {
 	critical: 15_000,
 	dangerous: 30_000,
@@ -73,7 +78,7 @@ export async function promptPathDecision(
 	path: string,
 ): Promise<GateDecision> {
 	const icon = PATH_SEVERITY_ICON[hit.severity];
-	const label = hit.severity.toUpperCase();
+	const label = titleCase(hit.severity);
 	const accent = PATH_SEVERITY_COLOR[hit.severity];
 
 	const choices =
@@ -105,7 +110,8 @@ export async function promptPathDecision(
 
 	const result: OverlayResult = await showOverlay(ui as Parameters<typeof showOverlay>[0], {
 		mode: "confirm",
-		title: `${icon} ${label} — ${hit.reason}`,
+		icon,
+		title: `${label} — ${hit.reason}`,
 		body: [`${op.toUpperCase()} ${path}`],
 		accent,
 		timeoutMs: PATH_TIMEOUT_MS[hit.severity],
@@ -231,7 +237,7 @@ export async function promptGateDecision(
 	command: string,
 ): Promise<GateDecision> {
 	const icon = SEVERITY_ICON[hit.severity];
-	const label = hit.severity.toUpperCase();
+	const label = titleCase(hit.severity);
 	const accent = SEVERITY_COLOR[hit.severity];
 
 	// critical: deny listed first so it's the default selected item
@@ -260,7 +266,8 @@ export async function promptGateDecision(
 
 	const result: OverlayResult = await showOverlay(ui as Parameters<typeof showOverlay>[0], {
 		mode: "confirm",
-		title: `${icon} ${label} — ${hit.reason}`,
+		icon,
+		title: `${label} — ${hit.reason}`,
 		body: [command],
 		accent,
 		timeoutMs: TIMEOUT_MS[hit.severity],