@xynogen/pix-gate 0.2.6 → 0.2.7

package/README.md

@@ -6,6 +6,8 @@ Pi extension — permission gate for dangerous bash commands.
 
 Intercepts every `bash` tool call and classifies the command against a set of severity rules before it runs. Two rule sets: **path rules** (block / warn / info) protect the `read` / `write` / `edit` tools from touching private keys, credential files, etc. — `block` is deny-first (15s timeout), `warn` is allow-first (30s), `info` is a blue notify that never blocks. **Command rules** (critical / dangerous / risky) gate `bash` invocations: `critical` (force pushes to main, recursive deletes, `dd` to disks, etc.) is hard-blocked in non-interactive mode and hard-denied via a 15-second auto-deny dialog in TUI mode; `dangerous` commands (including any `sudo` invocation, which is hard-redirected to the `sudo_run` tool — no bypass) show a 30-second auto-deny confirmation dialog; `risky` commands show a 60-second allow-first dialog and silently pass in non-interactive mode. Auto-approve patterns and extra rules can be configured in the `gate` section of `~/.pi/agent/pix.json`. Built-in rules can be turned off entirely by setting `guardrails: "off"` in that section.
 
+While an approval dialog is open, the gate holds the shared **agent-state** coordinator in the `blocked` state (via `withAgentBlock` from [`@xynogen/pix-runtime`](https://www.npmjs.com/package/@xynogen/pix-runtime)). Inside a herdr pane that fires a "needs attention" notification, so an away user is pinged when a command is waiting on approval. Pairs with `/afk` (pix-commands): with AFK on, yellow gates auto-allow and red/sudo auto-deny, so only genuine stops surface.
+
 ## Install
 
 ```bash

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@xynogen/pix-gate",
-	"version": "0.2.6",
+	"version": "0.2.7",
 	"description": "Pi extension — permission gate for dangerous bash commands (confirm/block with TUI dialog)",
 	"type": "module",
 	"main": "src/index.ts",
@@ -44,7 +44,7 @@
 	"dependencies": {
 		"@xynogen/pix-pretty": "^1.11.2",
 		"@xynogen/pix-data": "^0.4.3",
-		"@xynogen/pix-runtime": "^0.5.3"
+		"@xynogen/pix-runtime": "^0.6.0"
 	},
 	"peerDependencies": {
 		"@earendil-works/pi-coding-agent": "*",

package/src/gate.test.ts

@@ -1,5 +1,12 @@
 import { describe, expect, test } from "bun:test";
-import { buildRules, classify, DEFAULT_RULES, extractPathsFromBash, isSudoCommand } from "./lib.ts";
+import {
+	afkGateDecision,
+	buildRules,
+	classify,
+	DEFAULT_RULES,
+	extractPathsFromBash,
+	isSudoCommand,
+} from "./lib.ts";
 
 // ── isSudoCommand ─────────────────────────────────────────────────────────────
 
@@ -36,6 +43,25 @@ describe("isSudoCommand", () => {
 	});
 });
 
+// ── AFK behavior ──────────────────────────────────────────────────────────────
+
+describe("afkGateDecision", () => {
+	test("does nothing while AFK mode is off", () => {
+		delete (globalThis as { __pixAfk?: boolean }).__pixAfk;
+		expect(afkGateDecision(5)).toBeUndefined();
+	});
+
+	test("allows yellow concerns and denies red concerns while AFK", () => {
+		(globalThis as { __pixAfk?: boolean }).__pixAfk = true;
+		expect(afkGateDecision(1)).toBe("allow");
+		expect(afkGateDecision(2)).toBe("allow");
+		expect(afkGateDecision(3)).toBe("allow");
+		expect(afkGateDecision(4)).toBe("deny");
+		expect(afkGateDecision(5)).toBe("deny");
+		delete (globalThis as { __pixAfk?: boolean }).__pixAfk;
+	});
+});
+
 // ── classify ──────────────────────────────────────────────────────────────────
 
 describe("classify", () => {

package/src/index.test.ts

@@ -0,0 +1,38 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import { createEventBus } from "@earendil-works/pi-coding-agent";
+import registerGate from "./index.ts";
+
+afterEach(() => {
+	delete (globalThis as { __pixAgentState?: WeakMap<object, unknown> }).__pixAgentState;
+});
+
+describe("gate agent state", () => {
+	test("reports blocked while waiting for command approval", async () => {
+		const events = createEventBus();
+		const states: string[] = [];
+		events.on("pix:agent-state", (event) => states.push((event as { state: string }).state));
+		const handlers: Array<(event: any, ctx: any) => Promise<unknown>> = [];
+		const pi = {
+			events,
+			on(event: string, handler: (event: any, ctx: any) => Promise<unknown>) {
+				if (event === "tool_call") handlers.push(handler);
+			},
+		};
+		registerGate(pi as never);
+
+		const ctx = {
+			hasUI: true,
+			ui: {
+				custom: async () => ({ action: "denied" }),
+				notify() {},
+				theme: { fg: (_color: string, text: string) => text },
+			},
+		};
+		for (const handler of handlers) {
+			await handler({ toolName: "bash", input: { command: "git push --force" } }, ctx);
+		}
+
+		expect(states).toContain("blocked");
+		expect(states.at(-1)).toBe("idle");
+	});
+});

package/src/index.ts

@@ -18,7 +18,9 @@
  */
 
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { withAgentBlock } from "@xynogen/pix-runtime";
 import {
+	afkGateDecision,
 	buildRules,
 	classify,
 	classifyPath,
@@ -69,13 +71,27 @@ export default function (pi: ExtensionAPI): void {
 			return undefined;
 		}
 
+		const afkDecision = afkGateDecision(hit.severity === "block" ? 4 : 2);
+		if (afkDecision === "allow") return undefined;
+		if (afkDecision === "deny") {
+			return {
+				block: true,
+				reason: `[AFK][PATH:${hit.severity.toUpperCase()}] ${hit.reason}`,
+			};
+		}
+
 		if (!ctx.hasUI)
 			return {
 				block: true,
 				reason: `[PATH:${hit.severity.toUpperCase()}] ${hit.reason} (no UI)`,
 			};
 
-		const decision = await promptPathDecision(ctx.ui, hit, op, path);
+		const decision = await withAgentBlock(
+			pi.events,
+			"gate",
+			`${hit.severity.toUpperCase()} path approval required`,
+			() => promptPathDecision(ctx.ui, hit, op, path),
+		);
 		if (!decision.approved)
 			return {
 				block: true,
@@ -105,8 +121,6 @@ export default function (pi: ExtensionAPI): void {
 		const command = String(event.input.command ?? "");
 		if (!command.trim()) return undefined;
 
-		if (autoApprove.some((re) => re.test(command))) return undefined;
-
 		// Collect all concerns: path hits + command hit
 		const concerns: Concern[] = [];
 
@@ -144,6 +158,9 @@ export default function (pi: ExtensionAPI): void {
 
 		// sudo: hard redirect — no prompt, no bypass.
 		if (isSudoCommand(command)) {
+			if (afkGateDecision(highest.tier)) {
+				return { block: true, reason: "[AFK] sudo is denied while user is away." };
+			}
 			ctx.ui.notify(
 				`⚠️  ${ctx.ui.theme.fg("warning", "DANGEROUS")} — use sudo_run tool instead (handles auth securely)`,
 				"warning",
@@ -154,6 +171,17 @@ export default function (pi: ExtensionAPI): void {
 			};
 		}
 
+		const afkDecision = afkGateDecision(highest.tier);
+		if (afkDecision === "allow") return undefined;
+		if (afkDecision === "deny") {
+			return {
+				block: true,
+				reason: `[AFK][${highest.label}] ${highest.detail}`,
+			};
+		}
+
+		if (autoApprove.some((re) => re.test(command))) return undefined;
+
 		// No UI: auto-block block+ severity, pass anything lower.
 		if (!ctx.hasUI) {
 			if (highest.tier >= SEVERITY_TIER.block) {
@@ -168,19 +196,34 @@ export default function (pi: ExtensionAPI): void {
 		// Single concern → use existing targeted dialog. Multiple → merged.
 		let decision: GateDecision;
 		if (concerns.length === 1 && cmdHit) {
-			decision = await promptGateDecision(ctx.ui, cmdHit, command);
+			decision = await withAgentBlock(
+				pi.events,
+				"gate",
+				`${highest.label} command approval required`,
+				() => promptGateDecision(ctx.ui, cmdHit, command),
+			);
 		} else if (concerns.length === 1 && !cmdHit) {
 			// Single path hit — reuse path dialog
 			const ph = candidates
 				.map((p) => ({ p, h: classifyPath(p, "read", pathRules) }))
 				.find((x) => x.h?.severity !== "info" && x.h);
 			if (ph?.h) {
-				decision = await promptPathDecision(ctx.ui, ph.h, "bash read", ph.p);
+				decision = await withAgentBlock(
+					pi.events,
+					"gate",
+					`${highest.label} path approval required`,
+					() => promptPathDecision(ctx.ui, ph.h as NonNullable<typeof ph.h>, "bash read", ph.p),
+				);
 			} else {
 				return undefined;
 			}
 		} else {
-			decision = await promptMergedGateDecision(ctx.ui, concerns, command);
+			decision = await withAgentBlock(
+				pi.events,
+				"gate",
+				`${highest.label} command approval required`,
+				() => promptMergedGateDecision(ctx.ui, concerns, command),
+			);
 		}
 
 		if (!decision.approved) {

package/src/lib.ts

@@ -289,3 +289,8 @@ export function extractPathsFromBash(cmd: string): string[] {
 export function isSudoCommand(command: string): boolean {
 	return /(^|[\s;|&])sudo\b/i.test(command);
 }
+
+export function afkGateDecision(tier: number): "allow" | "deny" | undefined {
+	if ((globalThis as { __pixAfk?: boolean }).__pixAfk !== true) return undefined;
+	return tier >= 4 ? "deny" : "allow";
+}