@xynogen/pix-gate 0.2.2 → 0.2.6

package/README.md

@@ -4,7 +4,7 @@ Pi extension — permission gate for dangerous bash commands.
 
 ## What it does
 
-Intercepts every `bash` tool call and classifies the command against a set of severity rules before it runs. Two rule sets: **path rules** (block / warn / info) protect the `read` / `write` / `edit` tools from touching private keys, credential files, etc. — `block` is deny-first (15s timeout), `warn` is allow-first (30s), `info` is a blue notify that never blocks. **Command rules** (critical / dangerous / risky) gate `bash` invocations: `critical` (force pushes to main, recursive deletes, `dd` to disks, etc.) is hard-blocked in non-interactive mode and hard-denied via a 15-second auto-deny dialog in TUI mode; `dangerous` commands (including any `sudo` invocation, which is hard-redirected to the `sudo_run` tool — no bypass) show a 30-second auto-deny confirmation dialog; `risky` commands show a 60-second allow-first dialog and silently pass in non-interactive mode. Auto-approve patterns and extra rules can be configured in `~/.pi/agent/pix-gate.json`. Built-in rules can be replaced entirely by setting `disableDefaults: true` in the config file.
+Intercepts every `bash` tool call and classifies the command against a set of severity rules before it runs. Two rule sets: **path rules** (block / warn / info) protect the `read` / `write` / `edit` tools from touching private keys, credential files, etc. — `block` is deny-first (15s timeout), `warn` is allow-first (30s), `info` is a blue notify that never blocks. **Command rules** (critical / dangerous / risky) gate `bash` invocations: `critical` (force pushes to main, recursive deletes, `dd` to disks, etc.) is hard-blocked in non-interactive mode and hard-denied via a 15-second auto-deny dialog in TUI mode; `dangerous` commands (including any `sudo` invocation, which is hard-redirected to the `sudo_run` tool — no bypass) show a 30-second auto-deny confirmation dialog; `risky` commands show a 60-second allow-first dialog and silently pass in non-interactive mode. Auto-approve patterns and extra rules can be configured in the `gate` section of `~/.pi/agent/pix.json`. Built-in rules can be turned off entirely by setting `guardrails: "off"` in that section.
 
 ## Install
 
@@ -42,7 +42,7 @@ Gate rules are read from the **`gate` section of `~/.pi/agent/pix.json`** (the u
 ```jsonc
 {
   "gate": {
-    "disableDefaults": false,
+    "guardrails": "on",
     "extraRules": [
       { "pattern": "rm -rf /my-dir", "severity": "critical", "reason": "Deletes project root" }
     ],

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@xynogen/pix-gate",
-	"version": "0.2.2",
+	"version": "0.2.6",
 	"description": "Pi extension — permission gate for dangerous bash commands (confirm/block with TUI dialog)",
 	"type": "module",
 	"main": "src/index.ts",
@@ -42,9 +42,9 @@
 		"access": "public"
 	},
 	"dependencies": {
-		"@xynogen/pix-pretty": "^1.7.9",
-		"@xynogen/pix-data": "^0.4.0",
-		"@xynogen/pix-runtime": "^0.4.0"
+		"@xynogen/pix-pretty": "^1.11.2",
+		"@xynogen/pix-data": "^0.4.3",
+		"@xynogen/pix-runtime": "^0.5.3"
 	},
 	"peerDependencies": {
 		"@earendil-works/pi-coding-agent": "*",

package/src/gate.test.ts

@@ -110,6 +110,10 @@ describe("extractPathsFromBash", () => {
 		expect(extractPathsFromBash("jq -r '.key' data.json")).toEqual([]);
 	});
 
+	test("does not treat Object.keys as a key file", () => {
+		expect(extractPathsFromBash('node -p "Object.keys(require(x))"')).toEqual([]);
+	});
+
 	test("still extracts key file paths", () => {
 		expect(extractPathsFromBash("cat private.key")).toContain("private.key");
 		expect(extractPathsFromBash("cat .private.key")).toContain(".private.key");

package/src/lib.ts

@@ -280,7 +280,7 @@ export function classifyPath(
 export function extractPathsFromBash(cmd: string): string[] {
 	const out: string[] = [];
 	const re =
-		/(?:^|[\s=><|;&"'`(])((?:\.\.\/|\.\/|\/|~\/)[^\s"'`<>|;&)]+|\.env(?:\.[A-Za-z0-9_-]+)?|[A-Za-z0-9_./-]+\.(?:pem|key|p12|pfx|crt|cer|env|envrc|netrc))/g;
+		/(?:^|[\s=><|;&"'`(])((?:\.\.\/|\.\/|\/|~\/)[^\s"'`<>|;&)]+|(?:\.env(?:\.[A-Za-z0-9_-]+)?|[A-Za-z0-9_./-]+\.(?:pem|key|p12|pfx|crt|cer|env|envrc|netrc))(?![A-Za-z0-9]))/g;
 	for (const m of cmd.matchAll(re)) out.push(m[1] ?? "");
 	return out;
 }