@xynogen/pix-gate 0.2.9 → 0.2.11

package/README.md

@@ -4,9 +4,32 @@ Pi extension — permission gate for dangerous bash commands.
 
 ## What it does
 
-Intercepts every `bash` tool call and classifies the command against a set of severity rules before it runs. Two rule sets: **path rules** (block / warn / info) protect the `read` / `write` / `edit` tools from touching private keys, credential files, etc. — `block` is deny-first (15s timeout), `warn` is allow-first (30s), `info` is a blue notify that never blocks. **Command rules** (critical / dangerous / risky) gate `bash` invocations: `critical` (force pushes to main, recursive deletes, `dd` to disks, etc.) is hard-blocked in non-interactive mode and hard-denied via a 15-second auto-deny dialog in TUI mode; `dangerous` commands (including any `sudo` invocation, which is hard-redirected to the `sudo_run` tool — no bypass) show a 30-second auto-deny confirmation dialog; `risky` commands show a 60-second allow-first dialog and silently pass in non-interactive mode. Auto-approve patterns and extra rules can be configured in the `gate` section of `~/.pi/agent/pix.json`. Built-in rules can be turned off entirely by setting `guardrails: "off"` in that section.
+Intercepts every tool call and classifies it against severity rules before it runs. Two rule sets:
 
-While an approval dialog is open, the gate holds the shared **agent-state** coordinator in the `blocked` state (via `withAgentBlock` from [`@xynogen/pix-runtime`](https://www.npmjs.com/package/@xynogen/pix-runtime)). Inside a herdr pane that fires a "needs attention" notification, so an away user is pinged when a command is waiting on approval. Pairs with the unattended modes in pix-commands: with `/afk` on, yellow gates auto-allow and red/root auto-deny, so only genuine stops surface; with `/yolo` on, every tier including red auto-approves (capable models only). Bare `sudo` in bash is always redirected to `sudo_run` regardless of mode.
+**Path rules** — protect `read`/`write`/`edit` from private keys, credential files, etc.
+
+| Tier | Behavior |
+|---|---|
+| `block` | deny-first, 15s timeout |
+| `warn` | allow-first, 30s |
+| `info` | blue notify, never blocks |
+
+**Command rules** — gate `bash` invocations.
+
+| Tier | Examples | Behavior |
+|---|---|---|
+| `critical` | force-push to main, recursive delete, `dd` to disk | hard-block (non-interactive) / 15s auto-deny dialog (TUI) |
+| `dangerous` | any `sudo` (hard-redirected to `sudo_run`, no bypass) | 30s auto-deny confirmation |
+| `risky` | — | 60s allow-first dialog; silently passes non-interactive |
+
+Auto-approve patterns and extra rules go in the `gate` section of `~/.pi/agent/pix.json`; set `guardrails: "off"` to disable built-in rules entirely.
+
+**Away notifications** — while a dialog is open, the gate holds the shared **agent-state** coordinator `blocked` (via `withAgentBlock` from [`@xynogen/pix-runtime`](https://www.npmjs.com/package/@xynogen/pix-runtime)), so a herdr pane pings an away user. Pairs with pix-commands unattended modes:
+
+- `/afk` — yellow gates auto-allow, red/root auto-deny, so only genuine stops surface.
+- `/yolo` — every tier including red auto-approves (capable models only).
+
+Bare `sudo` in bash is always redirected to `sudo_run`, regardless of mode.
 
 **Circuit breaker.** A small set of catastrophic, unrecoverable commands — `rm -rf /` or `~`, `dd`/redirect onto a raw disk, `mkfs` on a device, a fork bomb — can never be auto-approved by any mode, including YOLO. They always fall through to the interactive dialog (or a no-UI block). This mirrors Claude Code's `bypassPermissions` floor, which still prompts on root/home wipes.
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@xynogen/pix-gate",
-	"version": "0.2.9",
+	"version": "0.2.11",
 	"description": "Pi extension — permission gate for dangerous bash commands (confirm/block with TUI dialog)",
 	"type": "module",
 	"main": "src/index.ts",
@@ -43,8 +43,7 @@
 	},
 	"dependencies": {
 		"@xynogen/pix-pretty": "^1.11.2",
-		"@xynogen/pix-data": "^0.4.3",
-		"@xynogen/pix-runtime": "^0.7.0"
+		"@xynogen/pix-runtime": "^0.8.0"
 	},
 	"peerDependencies": {
 		"@earendil-works/pi-coding-agent": "*",

package/src/gate.test.ts

@@ -1,4 +1,6 @@
 import { describe, expect, test } from "bun:test";
+import { createEventBus } from "@earendil-works/pi-coding-agent";
+import { setUnattendedMode } from "@xynogen/pix-runtime";
 import {
 	buildRules,
 	classify,
@@ -66,43 +68,26 @@ describe("isSudoCommand", () => {
 // ── AFK behavior ──────────────────────────────────────────────────────────────
 
 describe("unattendedGateDecision", () => {
-	type G = { __pixAfk?: boolean; __pixYolo?: boolean };
-	const reset = () => {
-		delete (globalThis as G).__pixAfk;
-		delete (globalThis as G).__pixYolo;
-	};
-
 	test("does nothing while every mode is off", () => {
-		reset();
-		expect(unattendedGateDecision(5)).toBeUndefined();
+		expect(unattendedGateDecision(createEventBus(), 5)).toBeUndefined();
 	});
 
 	test("AFK allows yellow concerns and denies red concerns", () => {
-		reset();
-		(globalThis as G).__pixAfk = true;
-		expect(unattendedGateDecision(1)).toBe("allow");
-		expect(unattendedGateDecision(2)).toBe("allow");
-		expect(unattendedGateDecision(3)).toBe("allow");
-		expect(unattendedGateDecision(4)).toBe("deny");
-		expect(unattendedGateDecision(5)).toBe("deny");
-		reset();
+		const events = createEventBus();
+		setUnattendedMode(events, "afk");
+		expect(unattendedGateDecision(events, 1)).toBe("allow");
+		expect(unattendedGateDecision(events, 2)).toBe("allow");
+		expect(unattendedGateDecision(events, 3)).toBe("allow");
+		expect(unattendedGateDecision(events, 4)).toBe("deny");
+		expect(unattendedGateDecision(events, 5)).toBe("deny");
 	});
 
 	test("YOLO allows every tier including red/critical", () => {
-		reset();
-		(globalThis as G).__pixYolo = true;
-		expect(unattendedGateDecision(1)).toBe("allow");
-		expect(unattendedGateDecision(4)).toBe("allow");
-		expect(unattendedGateDecision(5)).toBe("allow");
-		reset();
-	});
-
-	test("YOLO wins when both flags are somehow set", () => {
-		reset();
-		(globalThis as G).__pixAfk = true;
-		(globalThis as G).__pixYolo = true;
-		expect(unattendedGateDecision(5)).toBe("allow");
-		reset();
+		const events = createEventBus();
+		setUnattendedMode(events, "yolo");
+		expect(unattendedGateDecision(events, 1)).toBe("allow");
+		expect(unattendedGateDecision(events, 4)).toBe("allow");
+		expect(unattendedGateDecision(events, 5)).toBe("allow");
 	});
 });
 

package/src/index.ts

@@ -72,7 +72,7 @@ export default function (pi: ExtensionAPI): void {
 			return undefined;
 		}
 
-		const unattended = unattendedGateDecision(hit.severity === "block" ? 4 : 2);
+		const unattended = unattendedGateDecision(pi.events, hit.severity === "block" ? 4 : 2);
 		if (unattended === "allow") return undefined;
 		if (unattended === "deny") {
 			return {
@@ -160,7 +160,7 @@ export default function (pi: ExtensionAPI): void {
 		// sudo: hard redirect — no prompt, no bypass. Even YOLO cannot run bare
 		// `sudo` in bash (the password can't be auto-typed); it must use sudo_run.
 		if (isSudoCommand(command)) {
-			if (unattendedGateDecision(highest.tier) === "deny") {
+			if (unattendedGateDecision(pi.events, highest.tier) === "deny") {
 				return { block: true, reason: "[AFK] sudo is denied while user is away." };
 			}
 			ctx.ui.notify(
@@ -176,13 +176,13 @@ export default function (pi: ExtensionAPI): void {
 		// Circuit breaker: catastrophic commands never auto-approve, even under YOLO.
 		// They fall through to the interactive dialog (or the no-UI block below).
 		const breaker = isCircuitBreaker(command);
-		if (breaker && unattendedGateDecision(highest.tier) === "allow") {
+		if (breaker && unattendedGateDecision(pi.events, highest.tier) === "allow") {
 			ctx.ui.notify(
 				`⛔ ${ctx.ui.theme.fg("error", "CIRCUIT BREAKER")} — refused even under YOLO; confirm manually`,
 				"error",
 			);
 		}
-		const unattended = breaker ? undefined : unattendedGateDecision(highest.tier);
+		const unattended = breaker ? undefined : unattendedGateDecision(pi.events, highest.tier);
 		if (unattended === "allow") return undefined;
 		if (unattended === "deny") {
 			return {

package/src/lib.ts

@@ -2,6 +2,8 @@
  * Pure helpers for pix-gate — no Pi API deps, fully unit-testable.
  */
 
+import type { EventBus } from "@earendil-works/pi-coding-agent";
+import { getUnattendedMode } from "@xynogen/pix-runtime";
 import { config } from "@xynogen/pix-runtime/config";
 import { type GateRuleConfig, gateSection } from "@xynogen/pix-runtime/sections";
 
@@ -318,11 +320,13 @@ export function isCircuitBreaker(command: string): boolean {
  *   yolo — auto-allow every tier, including red/critical.
  *   afk  — auto-allow yellow (tier < 4), auto-deny red (tier >= 4).
  *   off  — undefined (fall through to the interactive dialog).
- * Mutually exclusive globals set by pix-commands' /afk and /yolo.
  */
-export function unattendedGateDecision(tier: number): "allow" | "deny" | undefined {
-	const g = globalThis as { __pixAfk?: boolean; __pixYolo?: boolean };
-	if (g.__pixYolo === true) return "allow";
-	if (g.__pixAfk === true) return tier >= 4 ? "deny" : "allow";
+export function unattendedGateDecision(
+	events: EventBus,
+	tier: number,
+): "allow" | "deny" | undefined {
+	const mode = getUnattendedMode(events);
+	if (mode === "yolo") return "allow";
+	if (mode === "afk") return tier >= 4 ? "deny" : "allow";
 	return undefined;
 }