@xynogen/pix-gate 0.2.13 → 0.3.2

package/README.md

@@ -19,9 +19,11 @@ Intercepts every tool call and classifies it against severity rules before it ru
 | Tier | Examples | Behavior |
 |---|---|---|
 | `critical` | force-push to main, recursive delete, `dd` to disk | hard-block (non-interactive) / 15s auto-deny dialog (TUI) |
-| `dangerous` | any `sudo` (hard-redirected to `sudo_run`, no bypass) | 30s auto-deny confirmation |
+| `dangerous` | destructive git, `chmod 777`, `curl … \| sh` | 30s auto-deny confirmation |
 | `risky` | — | 60s allow-first dialog; silently passes non-interactive |
 
+**Privileged auth redirect** — bash `sudo`/`ssh` can't have their password/passphrase auto-typed, so they are hard-blocked and redirected to the dedicated tool (`sudo_run`/`ssh_run`) with no bypass — but *only when that tool is installed* (pix-sudo/pix-ssh are opt-in; without them the bash form is the only path and passes through). This is **guarding** (stop + redirect); the softer **steering** of non-privileged stand-ins (`cat`→`read`, `grep`→`grep`, …) lives in [`pix-nudge`](../pix-nudge).
+
 Auto-approve patterns and extra rules go in the `gate` section of `~/.pi/agent/pix.json`; set `guardrails: "off"` to disable built-in rules entirely.
 
 **Away notifications** — while a dialog is open, the gate holds the shared **agent-state** coordinator `blocked` (via `withAgentBlock` from [`@xynogen/pix-runtime`](https://www.npmjs.com/package/@xynogen/pix-runtime)), so a herdr pane pings an away user. Pairs with pix-commands unattended modes:

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@xynogen/pix-gate",
-	"version": "0.2.13",
+	"version": "0.3.2",
 	"description": "Pi extension — permission gate for dangerous bash commands (confirm/block with TUI dialog)",
 	"type": "module",
 	"main": "src/index.ts",

package/src/index.ts

@@ -25,6 +25,7 @@ import {
 	classifyPath,
 	extractPathsFromBash,
 	isCircuitBreaker,
+	isSshCommand,
 	isSudoCommand,
 	loadUserConfig,
 	unattendedGateDecision,
@@ -42,6 +43,26 @@ import {
 export default function (pi: ExtensionAPI): void {
 	const { rules, autoApprove, pathRules } = buildRules(loadUserConfig());
 
+	// Is a tool registered (active or gated)? ssh_run/sudo_run are opt-in and
+	// absent when pix-ssh/pix-sudo aren't installed — only redirect toward a
+	// tool that actually exists, else the bash form is the only path.
+	const isRegistered = (name: string): boolean => {
+		try {
+			return (pi.getAllTools?.() ?? []).some((t) => t.name === name);
+		} catch {
+			return false;
+		}
+	};
+
+	// Privileged auth tools that must not run raw in bash (interactive password /
+	// passphrase can't be auto-typed there). Each redirects to its dedicated tool
+	// ONLY when that tool is installed. pix-nudge handles the non-privileged
+	// read/ls/grep/find/edit stand-ins.
+	const AUTH_REDIRECTS = [
+		{ match: isSudoCommand, tool: "sudo_run", label: "sudo" },
+		{ match: isSshCommand, tool: "ssh_run", label: "ssh" },
+	] as const;
+
 	// ── Path protection (read/write/edit tools only — bash handled below) ───
 	pi.on("tool_call", async (event, ctx) => {
 		const tool = String(event.toolName);
@@ -116,10 +137,15 @@ export default function (pi: ExtensionAPI): void {
 		risky: 1,
 	};
 
+	// The unified command gate also covers pix-proc's `proc` tool: its `start`
+	// action carries a shell command in `event.input.command`, identical to bash.
+	// proc's other actions (list/logs/stop/rm) carry no command and pass straight
+	// through. Install pix-proc without pix-gate = ungated, same as bash.
+	const GATED_COMMAND_TOOLS = new Set(["bash", "proc"]);
 	pi.on("tool_call", async (event, ctx) => {
-		if (event.toolName !== "bash") return undefined;
+		if (!GATED_COMMAND_TOOLS.has(String(event.toolName))) return undefined;
 
-		const command = String(event.input.command ?? "");
+		const command = String((event.input as Record<string, unknown>).command ?? "");
 		if (!command.trim()) return undefined;
 
 		// Collect all concerns: path hits + command hit
@@ -127,6 +153,16 @@ export default function (pi: ExtensionAPI): void {
 
 		// Path concerns
 		const candidates = extractPathsFromBash(command);
+
+		// Steer a blocked ssh-config read toward the dedicated `ssh info` tool
+		// (ssh_run action:"info"), which reads the effective config without touching
+		// ~/.ssh directly. Only when ssh_run is installed. Appended to the block
+		// reason so the model reads it and stops retrying with awk/grep/raw ssh.
+		const readsSshConfig = candidates.some((p) => /(^|\/)\.ssh\/config\b/i.test(p));
+		const sshInfoSteer =
+			readsSshConfig && isRegistered("ssh_run")
+				? ' Use the ssh_run tool with action:"info" to read the effective SSH config instead of reading ~/.ssh/config in bash.'
+				: "";
 		for (const p of candidates) {
 			const hit = classifyPath(p, "read", pathRules);
 			if (!hit) continue;
@@ -157,19 +193,19 @@ export default function (pi: ExtensionAPI): void {
 
 		const highest = concerns.reduce((a, b) => (a.tier > b.tier ? a : b));
 
-		// sudo: hard redirect — no prompt, no bypass. Even YOLO cannot run bare
-		// `sudo` in bash (the password can't be auto-typed); it must use sudo_run.
-		if (isSudoCommand(command)) {
+		// Privileged auth redirect — hard block, no prompt, no bypass. Even YOLO
+		// cannot run bare sudo/ssh in bash (password/passphrase can't be auto-typed);
+		// it must use the dedicated tool. Only fires when that tool is installed.
+		for (const redirect of AUTH_REDIRECTS) {
+			if (!redirect.match(command) || !isRegistered(redirect.tool)) continue;
 			if (unattendedGateDecision(pi.events, highest.tier) === "deny") {
-				return { block: true, reason: "[AFK] sudo is denied while user is away." };
+				return { block: true, reason: `[AFK] ${redirect.label} is denied while user is away.` };
 			}
-			ctx.ui.notify(
-				`⚠️  ${ctx.ui.theme.fg("warning", "DANGEROUS")} — use sudo_run tool instead (handles auth securely)`,
-				"warning",
-			);
+			// One surface only: the block reason renders as the tool-error card and
+			// reaches the model. A separate notify would duplicate the warning.
 			return {
 				block: true,
-				reason: "Use sudo_run tool instead of sudo in bash.",
+				reason: `DANGEROUS — use the ${redirect.tool} tool instead of ${redirect.label} in bash (it handles auth securely).`,
 			};
 		}
 
@@ -187,7 +223,7 @@ export default function (pi: ExtensionAPI): void {
 		if (unattended === "deny") {
 			return {
 				block: true,
-				reason: `[AFK][${highest.label}] ${highest.detail}`,
+				reason: `[AFK][${highest.label}] ${highest.detail}${sshInfoSteer}`,
 			};
 		}
 
@@ -198,7 +234,7 @@ export default function (pi: ExtensionAPI): void {
 			if (highest.tier >= SEVERITY_TIER.block) {
 				return {
 					block: true,
-					reason: `[${highest.label}] ${highest.detail} (no UI, auto-blocked)`,
+					reason: `[${highest.label}] ${highest.detail} (no UI, auto-blocked)${sshInfoSteer}`,
 				};
 			}
 			return undefined;
@@ -239,7 +275,7 @@ export default function (pi: ExtensionAPI): void {
 
 		if (!decision.approved) {
 			ctx.ui.notify(`${highest.icon} ${decision.reason}: ${highest.detail}`, "warning");
-			return { block: true, reason: `[${highest.label}] ${decision.reason}` };
+			return { block: true, reason: `[${highest.label}] ${decision.reason}${sshInfoSteer}` };
 		}
 
 		const severityColor =

package/src/lib.ts

@@ -298,6 +298,16 @@ export function isSudoCommand(command: string): boolean {
 	return /(^|[\s;|&])sudo\b/i.test(command);
 }
 
+/**
+ * True when a command invokes the `ssh` remote shell as a token. Requires
+ * trailing whitespace/end so it does NOT match `ssh-keygen`, `ssh-add`,
+ * `ssh-copy-id`, or `sshpass` (a later real ` ssh ` in the same line still
+ * matches, e.g. `sshpass -p x ssh host`).
+ */
+export function isSshCommand(command: string): boolean {
+	return /(^|[\s;|&])ssh(\s|$)/i.test(command);
+}
+
 // Non-lifting circuit breaker: catastrophic, unrecoverable commands that NO
 // mode (not even YOLO) may auto-approve. Mirrors Claude Code's bypassPermissions
 // floor, which still prompts on root/home wipes. These always fall through to