@xynogen/pix-gate 0.2.6 → 0.2.8

package/README.md

@@ -6,6 +6,10 @@ Pi extension — permission gate for dangerous bash commands.
 
 Intercepts every `bash` tool call and classifies the command against a set of severity rules before it runs. Two rule sets: **path rules** (block / warn / info) protect the `read` / `write` / `edit` tools from touching private keys, credential files, etc. — `block` is deny-first (15s timeout), `warn` is allow-first (30s), `info` is a blue notify that never blocks. **Command rules** (critical / dangerous / risky) gate `bash` invocations: `critical` (force pushes to main, recursive deletes, `dd` to disks, etc.) is hard-blocked in non-interactive mode and hard-denied via a 15-second auto-deny dialog in TUI mode; `dangerous` commands (including any `sudo` invocation, which is hard-redirected to the `sudo_run` tool — no bypass) show a 30-second auto-deny confirmation dialog; `risky` commands show a 60-second allow-first dialog and silently pass in non-interactive mode. Auto-approve patterns and extra rules can be configured in the `gate` section of `~/.pi/agent/pix.json`. Built-in rules can be turned off entirely by setting `guardrails: "off"` in that section.
 
+While an approval dialog is open, the gate holds the shared **agent-state** coordinator in the `blocked` state (via `withAgentBlock` from [`@xynogen/pix-runtime`](https://www.npmjs.com/package/@xynogen/pix-runtime)). Inside a herdr pane that fires a "needs attention" notification, so an away user is pinged when a command is waiting on approval. Pairs with the unattended modes in pix-commands: with `/afk` on, yellow gates auto-allow and red/root auto-deny, so only genuine stops surface; with `/yolo` on, every tier including red auto-approves (capable models only). Bare `sudo` in bash is always redirected to `sudo_run` regardless of mode.
+
+**Circuit breaker.** A small set of catastrophic, unrecoverable commands — `rm -rf /` or `~`, `dd`/redirect onto a raw disk, `mkfs` on a device, a fork bomb — can never be auto-approved by any mode, including YOLO. They always fall through to the interactive dialog (or a no-UI block). This mirrors Claude Code's `bypassPermissions` floor, which still prompts on root/home wipes.
+
 ## Install
 
 ```bash

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@xynogen/pix-gate",
-	"version": "0.2.6",
+	"version": "0.2.8",
 	"description": "Pi extension — permission gate for dangerous bash commands (confirm/block with TUI dialog)",
 	"type": "module",
 	"main": "src/index.ts",
@@ -44,7 +44,7 @@
 	"dependencies": {
 		"@xynogen/pix-pretty": "^1.11.2",
 		"@xynogen/pix-data": "^0.4.3",
-		"@xynogen/pix-runtime": "^0.5.3"
+		"@xynogen/pix-runtime": "^0.6.0"
 	},
 	"peerDependencies": {
 		"@earendil-works/pi-coding-agent": "*",

package/src/gate.test.ts

@@ -1,5 +1,13 @@
 import { describe, expect, test } from "bun:test";
-import { buildRules, classify, DEFAULT_RULES, extractPathsFromBash, isSudoCommand } from "./lib.ts";
+import {
+	buildRules,
+	classify,
+	DEFAULT_RULES,
+	extractPathsFromBash,
+	isCircuitBreaker,
+	isSudoCommand,
+	unattendedGateDecision,
+} from "./lib.ts";
 
 // ── isSudoCommand ─────────────────────────────────────────────────────────────
 
@@ -36,6 +44,77 @@ describe("isSudoCommand", () => {
 	});
 });
 
+// ── AFK behavior ──────────────────────────────────────────────────────────────
+
+describe("unattendedGateDecision", () => {
+	type G = { __pixAfk?: boolean; __pixYolo?: boolean };
+	const reset = () => {
+		delete (globalThis as G).__pixAfk;
+		delete (globalThis as G).__pixYolo;
+	};
+
+	test("does nothing while every mode is off", () => {
+		reset();
+		expect(unattendedGateDecision(5)).toBeUndefined();
+	});
+
+	test("AFK allows yellow concerns and denies red concerns", () => {
+		reset();
+		(globalThis as G).__pixAfk = true;
+		expect(unattendedGateDecision(1)).toBe("allow");
+		expect(unattendedGateDecision(2)).toBe("allow");
+		expect(unattendedGateDecision(3)).toBe("allow");
+		expect(unattendedGateDecision(4)).toBe("deny");
+		expect(unattendedGateDecision(5)).toBe("deny");
+		reset();
+	});
+
+	test("YOLO allows every tier including red/critical", () => {
+		reset();
+		(globalThis as G).__pixYolo = true;
+		expect(unattendedGateDecision(1)).toBe("allow");
+		expect(unattendedGateDecision(4)).toBe("allow");
+		expect(unattendedGateDecision(5)).toBe("allow");
+		reset();
+	});
+
+	test("YOLO wins when both flags are somehow set", () => {
+		reset();
+		(globalThis as G).__pixAfk = true;
+		(globalThis as G).__pixYolo = true;
+		expect(unattendedGateDecision(5)).toBe("allow");
+		reset();
+	});
+});
+
+// ── circuit breaker ───────────────────────────────────────────────────────────
+
+describe("isCircuitBreaker", () => {
+	test("catches root and home wipes", () => {
+		expect(isCircuitBreaker("rm -rf /")).toBe(true);
+		expect(isCircuitBreaker("rm -rf ~")).toBe(true);
+		expect(isCircuitBreaker("rm -fr / --no-preserve-root")).toBe(true);
+		expect(isCircuitBreaker("cd /tmp && rm -rf /")).toBe(true);
+	});
+
+	test("catches raw-disk writes and format", () => {
+		expect(isCircuitBreaker("dd if=/dev/zero of=/dev/sda")).toBe(true);
+		expect(isCircuitBreaker("mkfs.ext4 /dev/nvme0n1")).toBe(true);
+		expect(isCircuitBreaker("echo x > /dev/sdb")).toBe(true);
+	});
+
+	test("catches the classic fork bomb", () => {
+		expect(isCircuitBreaker(":(){ :|:& };:")).toBe(true);
+	});
+
+	test("does NOT trip on ordinary destructive-but-scoped commands", () => {
+		expect(isCircuitBreaker("rm -rf ./build")).toBe(false);
+		expect(isCircuitBreaker("rm -rf node_modules")).toBe(false);
+		expect(isCircuitBreaker("dd if=in.img of=out.img")).toBe(false);
+		expect(isCircuitBreaker("echo hi > /tmp/x")).toBe(false);
+	});
+});
+
 // ── classify ──────────────────────────────────────────────────────────────────
 
 describe("classify", () => {

package/src/index.test.ts

@@ -0,0 +1,38 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import { createEventBus } from "@earendil-works/pi-coding-agent";
+import registerGate from "./index.ts";
+
+afterEach(() => {
+	delete (globalThis as { __pixAgentState?: WeakMap<object, unknown> }).__pixAgentState;
+});
+
+describe("gate agent state", () => {
+	test("reports blocked while waiting for command approval", async () => {
+		const events = createEventBus();
+		const states: string[] = [];
+		events.on("pix:agent-state", (event) => states.push((event as { state: string }).state));
+		const handlers: Array<(event: any, ctx: any) => Promise<unknown>> = [];
+		const pi = {
+			events,
+			on(event: string, handler: (event: any, ctx: any) => Promise<unknown>) {
+				if (event === "tool_call") handlers.push(handler);
+			},
+		};
+		registerGate(pi as never);
+
+		const ctx = {
+			hasUI: true,
+			ui: {
+				custom: async () => ({ action: "denied" }),
+				notify() {},
+				theme: { fg: (_color: string, text: string) => text },
+			},
+		};
+		for (const handler of handlers) {
+			await handler({ toolName: "bash", input: { command: "git push --force" } }, ctx);
+		}
+
+		expect(states).toContain("blocked");
+		expect(states.at(-1)).toBe("idle");
+	});
+});

package/src/index.ts

@@ -18,13 +18,16 @@
  */
 
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { withAgentBlock } from "@xynogen/pix-runtime";
 import {
 	buildRules,
 	classify,
 	classifyPath,
 	extractPathsFromBash,
+	isCircuitBreaker,
 	isSudoCommand,
 	loadUserConfig,
+	unattendedGateDecision,
 } from "./lib.ts";
 import {
 	type Concern,
@@ -69,13 +72,27 @@ export default function (pi: ExtensionAPI): void {
 			return undefined;
 		}
 
+		const unattended = unattendedGateDecision(hit.severity === "block" ? 4 : 2);
+		if (unattended === "allow") return undefined;
+		if (unattended === "deny") {
+			return {
+				block: true,
+				reason: `[AFK][PATH:${hit.severity.toUpperCase()}] ${hit.reason}`,
+			};
+		}
+
 		if (!ctx.hasUI)
 			return {
 				block: true,
 				reason: `[PATH:${hit.severity.toUpperCase()}] ${hit.reason} (no UI)`,
 			};
 
-		const decision = await promptPathDecision(ctx.ui, hit, op, path);
+		const decision = await withAgentBlock(
+			pi.events,
+			"gate",
+			`${hit.severity.toUpperCase()} path approval required`,
+			() => promptPathDecision(ctx.ui, hit, op, path),
+		);
 		if (!decision.approved)
 			return {
 				block: true,
@@ -105,8 +122,6 @@ export default function (pi: ExtensionAPI): void {
 		const command = String(event.input.command ?? "");
 		if (!command.trim()) return undefined;
 
-		if (autoApprove.some((re) => re.test(command))) return undefined;
-
 		// Collect all concerns: path hits + command hit
 		const concerns: Concern[] = [];
 
@@ -142,8 +157,12 @@ export default function (pi: ExtensionAPI): void {
 
 		const highest = concerns.reduce((a, b) => (a.tier > b.tier ? a : b));
 
-		// sudo: hard redirect — no prompt, no bypass.
+		// sudo: hard redirect — no prompt, no bypass. Even YOLO cannot run bare
+		// `sudo` in bash (the password can't be auto-typed); it must use sudo_run.
 		if (isSudoCommand(command)) {
+			if (unattendedGateDecision(highest.tier) === "deny") {
+				return { block: true, reason: "[AFK] sudo is denied while user is away." };
+			}
 			ctx.ui.notify(
 				`⚠️  ${ctx.ui.theme.fg("warning", "DANGEROUS")} — use sudo_run tool instead (handles auth securely)`,
 				"warning",
@@ -154,6 +173,26 @@ export default function (pi: ExtensionAPI): void {
 			};
 		}
 
+		// Circuit breaker: catastrophic commands never auto-approve, even under YOLO.
+		// They fall through to the interactive dialog (or the no-UI block below).
+		const breaker = isCircuitBreaker(command);
+		if (breaker && unattendedGateDecision(highest.tier) === "allow") {
+			ctx.ui.notify(
+				`⛔ ${ctx.ui.theme.fg("error", "CIRCUIT BREAKER")} — refused even under YOLO; confirm manually`,
+				"error",
+			);
+		}
+		const unattended = breaker ? undefined : unattendedGateDecision(highest.tier);
+		if (unattended === "allow") return undefined;
+		if (unattended === "deny") {
+			return {
+				block: true,
+				reason: `[AFK][${highest.label}] ${highest.detail}`,
+			};
+		}
+
+		if (autoApprove.some((re) => re.test(command))) return undefined;
+
 		// No UI: auto-block block+ severity, pass anything lower.
 		if (!ctx.hasUI) {
 			if (highest.tier >= SEVERITY_TIER.block) {
@@ -168,19 +207,34 @@ export default function (pi: ExtensionAPI): void {
 		// Single concern → use existing targeted dialog. Multiple → merged.
 		let decision: GateDecision;
 		if (concerns.length === 1 && cmdHit) {
-			decision = await promptGateDecision(ctx.ui, cmdHit, command);
+			decision = await withAgentBlock(
+				pi.events,
+				"gate",
+				`${highest.label} command approval required`,
+				() => promptGateDecision(ctx.ui, cmdHit, command),
+			);
 		} else if (concerns.length === 1 && !cmdHit) {
 			// Single path hit — reuse path dialog
 			const ph = candidates
 				.map((p) => ({ p, h: classifyPath(p, "read", pathRules) }))
 				.find((x) => x.h?.severity !== "info" && x.h);
 			if (ph?.h) {
-				decision = await promptPathDecision(ctx.ui, ph.h, "bash read", ph.p);
+				decision = await withAgentBlock(
+					pi.events,
+					"gate",
+					`${highest.label} path approval required`,
+					() => promptPathDecision(ctx.ui, ph.h as NonNullable<typeof ph.h>, "bash read", ph.p),
+				);
 			} else {
 				return undefined;
 			}
 		} else {
-			decision = await promptMergedGateDecision(ctx.ui, concerns, command);
+			decision = await withAgentBlock(
+				pi.events,
+				"gate",
+				`${highest.label} command approval required`,
+				() => promptMergedGateDecision(ctx.ui, concerns, command),
+			);
 		}
 
 		if (!decision.approved) {

package/src/lib.ts

@@ -289,3 +289,34 @@ export function extractPathsFromBash(cmd: string): string[] {
 export function isSudoCommand(command: string): boolean {
 	return /(^|[\s;|&])sudo\b/i.test(command);
 }
+
+// Non-lifting circuit breaker: catastrophic, unrecoverable commands that NO
+// mode (not even YOLO) may auto-approve. Mirrors Claude Code's bypassPermissions
+// floor, which still prompts on root/home wipes. These always fall through to
+// the interactive dialog (or a no-UI block).
+const CIRCUIT_BREAKER: RegExp[] = [
+	/\brm\s+-[a-z]*r[a-z]*f?[a-z]*\s+(?:--\s+)?[~/]\s*(?:$|[\s;|&])/i, // rm -rf /  or  rm -rf ~
+	/\bdd\b[^\n]*\bof=\/dev\/(?:sd|nvme|disk|hd|vd)/i, // dd onto a raw disk
+	/\bmkfs\.\w+\s+\/dev\//i, // format a device
+	/:\s*\(\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;/, // classic fork bomb
+	/>\s*\/dev\/(?:sd|nvme|disk|hd|vd)[a-z0-9]*\b/i, // redirect over a raw disk
+];
+
+/** True when a command is catastrophic enough that no unattended mode may auto-approve it. */
+export function isCircuitBreaker(command: string): boolean {
+	return CIRCUIT_BREAKER.some((re) => re.test(command));
+}
+
+/**
+ * Unattended-mode gate decision for a concern tier (1 risky … 5 critical).
+ *   yolo — auto-allow every tier, including red/critical.
+ *   afk  — auto-allow yellow (tier < 4), auto-deny red (tier >= 4).
+ *   off  — undefined (fall through to the interactive dialog).
+ * Mutually exclusive globals set by pix-commands' /afk and /yolo.
+ */
+export function unattendedGateDecision(tier: number): "allow" | "deny" | undefined {
+	const g = globalThis as { __pixAfk?: boolean; __pixYolo?: boolean };
+	if (g.__pixYolo === true) return "allow";
+	if (g.__pixAfk === true) return tier >= 4 ? "deny" : "allow";
+	return undefined;
+}