@xynogen/pix-gate 0.2.7 → 0.2.9

package/README.md

@@ -6,7 +6,9 @@ Pi extension — permission gate for dangerous bash commands.
 
 Intercepts every `bash` tool call and classifies the command against a set of severity rules before it runs. Two rule sets: **path rules** (block / warn / info) protect the `read` / `write` / `edit` tools from touching private keys, credential files, etc. — `block` is deny-first (15s timeout), `warn` is allow-first (30s), `info` is a blue notify that never blocks. **Command rules** (critical / dangerous / risky) gate `bash` invocations: `critical` (force pushes to main, recursive deletes, `dd` to disks, etc.) is hard-blocked in non-interactive mode and hard-denied via a 15-second auto-deny dialog in TUI mode; `dangerous` commands (including any `sudo` invocation, which is hard-redirected to the `sudo_run` tool — no bypass) show a 30-second auto-deny confirmation dialog; `risky` commands show a 60-second allow-first dialog and silently pass in non-interactive mode. Auto-approve patterns and extra rules can be configured in the `gate` section of `~/.pi/agent/pix.json`. Built-in rules can be turned off entirely by setting `guardrails: "off"` in that section.
 
-While an approval dialog is open, the gate holds the shared **agent-state** coordinator in the `blocked` state (via `withAgentBlock` from [`@xynogen/pix-runtime`](https://www.npmjs.com/package/@xynogen/pix-runtime)). Inside a herdr pane that fires a "needs attention" notification, so an away user is pinged when a command is waiting on approval. Pairs with `/afk` (pix-commands): with AFK on, yellow gates auto-allow and red/sudo auto-deny, so only genuine stops surface.
+While an approval dialog is open, the gate holds the shared **agent-state** coordinator in the `blocked` state (via `withAgentBlock` from [`@xynogen/pix-runtime`](https://www.npmjs.com/package/@xynogen/pix-runtime)). Inside a herdr pane that fires a "needs attention" notification, so an away user is pinged when a command is waiting on approval. Pairs with the unattended modes in pix-commands: with `/afk` on, yellow gates auto-allow and red/root auto-deny, so only genuine stops surface; with `/yolo` on, every tier including red auto-approves (capable models only). Bare `sudo` in bash is always redirected to `sudo_run` regardless of mode.
+
+**Circuit breaker.** A small set of catastrophic, unrecoverable commands — `rm -rf /` or `~`, `dd`/redirect onto a raw disk, `mkfs` on a device, a fork bomb — can never be auto-approved by any mode, including YOLO. They always fall through to the interactive dialog (or a no-UI block). This mirrors Claude Code's `bypassPermissions` floor, which still prompts on root/home wipes.
 
 ## Install
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@xynogen/pix-gate",
-	"version": "0.2.7",
+	"version": "0.2.9",
 	"description": "Pi extension — permission gate for dangerous bash commands (confirm/block with TUI dialog)",
 	"type": "module",
 	"main": "src/index.ts",
@@ -44,7 +44,7 @@
 	"dependencies": {
 		"@xynogen/pix-pretty": "^1.11.2",
 		"@xynogen/pix-data": "^0.4.3",
-		"@xynogen/pix-runtime": "^0.6.0"
+		"@xynogen/pix-runtime": "^0.7.0"
 	},
 	"peerDependencies": {
 		"@earendil-works/pi-coding-agent": "*",

package/src/gate.test.ts

@@ -1,13 +1,33 @@
 import { describe, expect, test } from "bun:test";
 import {
-	afkGateDecision,
 	buildRules,
 	classify,
+	classifyPath,
+	DEFAULT_PATH_RULES,
 	DEFAULT_RULES,
 	extractPathsFromBash,
+	isCircuitBreaker,
 	isSudoCommand,
+	unattendedGateDecision,
 } from "./lib.ts";
 
+// ── .env path gating ─────────────────────────────────────────────
+describe("classifyPath .env", () => {
+	const blocked = [".env", ".env.local", ".env.production", "path/to/.env", "src/.env.staging"];
+	const allowed = [".env.example", ".env.sample", ".env.template", ".env.dist"];
+
+	for (const p of blocked) {
+		test(`reading ${p} is blocked`, () => {
+			expect(classifyPath(p, "read", DEFAULT_PATH_RULES)?.severity).toBe("block");
+		});
+	}
+	for (const p of allowed) {
+		test(`reading ${p} is not blocked`, () => {
+			expect(classifyPath(p, "read", DEFAULT_PATH_RULES)).toBeUndefined();
+		});
+	}
+});
+
 // ── isSudoCommand ─────────────────────────────────────────────────────────────
 
 describe("isSudoCommand", () => {
@@ -45,20 +65,72 @@ describe("isSudoCommand", () => {
 
 // ── AFK behavior ──────────────────────────────────────────────────────────────
 
-describe("afkGateDecision", () => {
-	test("does nothing while AFK mode is off", () => {
-		delete (globalThis as { __pixAfk?: boolean }).__pixAfk;
-		expect(afkGateDecision(5)).toBeUndefined();
+describe("unattendedGateDecision", () => {
+	type G = { __pixAfk?: boolean; __pixYolo?: boolean };
+	const reset = () => {
+		delete (globalThis as G).__pixAfk;
+		delete (globalThis as G).__pixYolo;
+	};
+
+	test("does nothing while every mode is off", () => {
+		reset();
+		expect(unattendedGateDecision(5)).toBeUndefined();
+	});
+
+	test("AFK allows yellow concerns and denies red concerns", () => {
+		reset();
+		(globalThis as G).__pixAfk = true;
+		expect(unattendedGateDecision(1)).toBe("allow");
+		expect(unattendedGateDecision(2)).toBe("allow");
+		expect(unattendedGateDecision(3)).toBe("allow");
+		expect(unattendedGateDecision(4)).toBe("deny");
+		expect(unattendedGateDecision(5)).toBe("deny");
+		reset();
+	});
+
+	test("YOLO allows every tier including red/critical", () => {
+		reset();
+		(globalThis as G).__pixYolo = true;
+		expect(unattendedGateDecision(1)).toBe("allow");
+		expect(unattendedGateDecision(4)).toBe("allow");
+		expect(unattendedGateDecision(5)).toBe("allow");
+		reset();
+	});
+
+	test("YOLO wins when both flags are somehow set", () => {
+		reset();
+		(globalThis as G).__pixAfk = true;
+		(globalThis as G).__pixYolo = true;
+		expect(unattendedGateDecision(5)).toBe("allow");
+		reset();
+	});
+});
+
+// ── circuit breaker ───────────────────────────────────────────────────────────
+
+describe("isCircuitBreaker", () => {
+	test("catches root and home wipes", () => {
+		expect(isCircuitBreaker("rm -rf /")).toBe(true);
+		expect(isCircuitBreaker("rm -rf ~")).toBe(true);
+		expect(isCircuitBreaker("rm -fr / --no-preserve-root")).toBe(true);
+		expect(isCircuitBreaker("cd /tmp && rm -rf /")).toBe(true);
+	});
+
+	test("catches raw-disk writes and format", () => {
+		expect(isCircuitBreaker("dd if=/dev/zero of=/dev/sda")).toBe(true);
+		expect(isCircuitBreaker("mkfs.ext4 /dev/nvme0n1")).toBe(true);
+		expect(isCircuitBreaker("echo x > /dev/sdb")).toBe(true);
+	});
+
+	test("catches the classic fork bomb", () => {
+		expect(isCircuitBreaker(":(){ :|:& };:")).toBe(true);
 	});
 
-	test("allows yellow concerns and denies red concerns while AFK", () => {
-		(globalThis as { __pixAfk?: boolean }).__pixAfk = true;
-		expect(afkGateDecision(1)).toBe("allow");
-		expect(afkGateDecision(2)).toBe("allow");
-		expect(afkGateDecision(3)).toBe("allow");
-		expect(afkGateDecision(4)).toBe("deny");
-		expect(afkGateDecision(5)).toBe("deny");
-		delete (globalThis as { __pixAfk?: boolean }).__pixAfk;
+	test("does NOT trip on ordinary destructive-but-scoped commands", () => {
+		expect(isCircuitBreaker("rm -rf ./build")).toBe(false);
+		expect(isCircuitBreaker("rm -rf node_modules")).toBe(false);
+		expect(isCircuitBreaker("dd if=in.img of=out.img")).toBe(false);
+		expect(isCircuitBreaker("echo hi > /tmp/x")).toBe(false);
 	});
 });
 

package/src/index.ts

@@ -20,13 +20,14 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { withAgentBlock } from "@xynogen/pix-runtime";
 import {
-	afkGateDecision,
 	buildRules,
 	classify,
 	classifyPath,
 	extractPathsFromBash,
+	isCircuitBreaker,
 	isSudoCommand,
 	loadUserConfig,
+	unattendedGateDecision,
 } from "./lib.ts";
 import {
 	type Concern,
@@ -71,9 +72,9 @@ export default function (pi: ExtensionAPI): void {
 			return undefined;
 		}
 
-		const afkDecision = afkGateDecision(hit.severity === "block" ? 4 : 2);
-		if (afkDecision === "allow") return undefined;
-		if (afkDecision === "deny") {
+		const unattended = unattendedGateDecision(hit.severity === "block" ? 4 : 2);
+		if (unattended === "allow") return undefined;
+		if (unattended === "deny") {
 			return {
 				block: true,
 				reason: `[AFK][PATH:${hit.severity.toUpperCase()}] ${hit.reason}`,
@@ -156,9 +157,10 @@ export default function (pi: ExtensionAPI): void {
 
 		const highest = concerns.reduce((a, b) => (a.tier > b.tier ? a : b));
 
-		// sudo: hard redirect — no prompt, no bypass.
+		// sudo: hard redirect — no prompt, no bypass. Even YOLO cannot run bare
+		// `sudo` in bash (the password can't be auto-typed); it must use sudo_run.
 		if (isSudoCommand(command)) {
-			if (afkGateDecision(highest.tier)) {
+			if (unattendedGateDecision(highest.tier) === "deny") {
 				return { block: true, reason: "[AFK] sudo is denied while user is away." };
 			}
 			ctx.ui.notify(
@@ -171,9 +173,18 @@ export default function (pi: ExtensionAPI): void {
 			};
 		}
 
-		const afkDecision = afkGateDecision(highest.tier);
-		if (afkDecision === "allow") return undefined;
-		if (afkDecision === "deny") {
+		// Circuit breaker: catastrophic commands never auto-approve, even under YOLO.
+		// They fall through to the interactive dialog (or the no-UI block below).
+		const breaker = isCircuitBreaker(command);
+		if (breaker && unattendedGateDecision(highest.tier) === "allow") {
+			ctx.ui.notify(
+				`⛔ ${ctx.ui.theme.fg("error", "CIRCUIT BREAKER")} — refused even under YOLO; confirm manually`,
+				"error",
+			);
+		}
+		const unattended = breaker ? undefined : unattendedGateDecision(highest.tier);
+		if (unattended === "allow") return undefined;
+		if (unattended === "deny") {
 			return {
 				block: true,
 				reason: `[AFK][${highest.label}] ${highest.detail}`,

package/src/lib.ts

@@ -222,9 +222,15 @@ export const DEFAULT_PATH_RULES: PathRule[] = [
 		severity: "block",
 		reason: "credentials file",
 	},
+	// Real .env files hold live secrets — block. Placeholder variants
+	// (.env.example/.sample/.template/.dist) carry no secrets, so exclude them.
+	{
+		pattern: /(^|\/)\.env(?:$|\.(?!example|sample|template|dist)[A-Za-z0-9_-]+)/i,
+		severity: "block",
+		reason: ".env file (live secrets)",
+	},
 
 	// warn — yellow allow-first
-	{ pattern: /(^|\/)\.env(\.|$)/i, severity: "warn", reason: ".env file" },
 	{ pattern: /(^|\/)\.envrc$/i, severity: "warn", reason: "direnv file" },
 	{
 		pattern: /(^|\/)\.npmrc$/i,
@@ -290,7 +296,33 @@ export function isSudoCommand(command: string): boolean {
 	return /(^|[\s;|&])sudo\b/i.test(command);
 }
 
-export function afkGateDecision(tier: number): "allow" | "deny" | undefined {
-	if ((globalThis as { __pixAfk?: boolean }).__pixAfk !== true) return undefined;
-	return tier >= 4 ? "deny" : "allow";
+// Non-lifting circuit breaker: catastrophic, unrecoverable commands that NO
+// mode (not even YOLO) may auto-approve. Mirrors Claude Code's bypassPermissions
+// floor, which still prompts on root/home wipes. These always fall through to
+// the interactive dialog (or a no-UI block).
+const CIRCUIT_BREAKER: RegExp[] = [
+	/\brm\s+-[a-z]*r[a-z]*f?[a-z]*\s+(?:--\s+)?[~/]\s*(?:$|[\s;|&])/i, // rm -rf /  or  rm -rf ~
+	/\bdd\b[^\n]*\bof=\/dev\/(?:sd|nvme|disk|hd|vd)/i, // dd onto a raw disk
+	/\bmkfs\.\w+\s+\/dev\//i, // format a device
+	/:\s*\(\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;/, // classic fork bomb
+	/>\s*\/dev\/(?:sd|nvme|disk|hd|vd)[a-z0-9]*\b/i, // redirect over a raw disk
+];
+
+/** True when a command is catastrophic enough that no unattended mode may auto-approve it. */
+export function isCircuitBreaker(command: string): boolean {
+	return CIRCUIT_BREAKER.some((re) => re.test(command));
+}
+
+/**
+ * Unattended-mode gate decision for a concern tier (1 risky … 5 critical).
+ *   yolo — auto-allow every tier, including red/critical.
+ *   afk  — auto-allow yellow (tier < 4), auto-deny red (tier >= 4).
+ *   off  — undefined (fall through to the interactive dialog).
+ * Mutually exclusive globals set by pix-commands' /afk and /yolo.
+ */
+export function unattendedGateDecision(tier: number): "allow" | "deny" | undefined {
+	const g = globalThis as { __pixAfk?: boolean; __pixYolo?: boolean };
+	if (g.__pixYolo === true) return "allow";
+	if (g.__pixAfk === true) return tier >= 4 ? "deny" : "allow";
+	return undefined;
 }