@xynogen/pix-gate 0.3.0 → 0.4.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 xynogen
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -35,18 +35,6 @@ Bare `sudo` in bash is always redirected to `sudo_run`, regardless of mode.
 
 **Circuit breaker.** A small set of catastrophic, unrecoverable commands — `rm -rf /` or `~`, `dd`/redirect onto a raw disk, `mkfs` on a device, a fork bomb — can never be auto-approved by any mode, including YOLO. They always fall through to the interactive dialog (or a no-UI block). This mirrors Claude Code's `bypassPermissions` floor, which still prompts on root/home wipes.
 
-## Install
-
-```bash
-pi install npm:@xynogen/pix-gate
-```
-
-> Also included in [`@xynogen/pix-core`](https://www.npmjs.com/package/@xynogen/pix-core):
->
-> ```bash
-> pi install npm:@xynogen/pix-core
-> ```
-
 ## Reusable exports
 
 The gate is split into a pure rule engine and the interactive prompt, so the
@@ -82,16 +70,28 @@ Gate rules are read from the **`gate` section of `~/.pi/agent/pix.json`** (the u
 
 The schema is identical to the old `pix-gate.json` — move your existing config into `pix.json` under the `gate` key.
 
-## Full distro
+## Install
 
-Source: [github.com/xynogen/pix-mono](https://github.com/xynogen/pix-mono)
+```bash
+pi install npm:@xynogen/pix-gate
+```
+
+> Bundled in [`@xynogen/pix-core`](https://www.npmjs.com/package/@xynogen/pix-core). Install it alone only if you do not use pix-core.
 
-To install the complete pix suite (all packages + Pi itself):
+## Full distro
+
+This package is part of [Pix](https://github.com/xynogen/pix-mono). The installer sets up Pi and the full distro. See [Install](https://github.com/xynogen/pix-mono#install) for the notes for each OS.
 
 ```bash
+# Linux / macOS
 curl -fsSL https://raw.githubusercontent.com/xynogen/pix-mono/main/scripts/install.sh | sh
 ```
 
+```powershell
+# Windows
+irm https://raw.githubusercontent.com/xynogen/pix-mono/main/scripts/install.ps1 | iex
+```
+
 ## License
 
 MIT

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@xynogen/pix-gate",
-	"version": "0.3.0",
+	"version": "0.4.0",
 	"description": "Pi extension — permission gate for dangerous bash commands (confirm/block with TUI dialog)",
 	"type": "module",
 	"main": "src/index.ts",
@@ -44,7 +44,7 @@
 	},
 	"dependencies": {
 		"@xynogen/pix-pretty": "^1.11.2",
-		"@xynogen/pix-runtime": "^0.8.0"
+		"@xynogen/pix-runtime": "^0.12.0"
 	},
 	"peerDependencies": {
 		"@earendil-works/pi-coding-agent": "*",

package/src/index.ts

@@ -1,8 +1,9 @@
 /**
  * pix-gate — Pi extension
  *
- * Intercepts bash `tool_call` events and gates dangerous commands behind a
- * TUI confirmation dialog before they run.
+ * Intercepts shell `tool_call` events (bash, powershell, proc) and gates
+ * dangerous commands behind a TUI confirmation dialog before they run. Also
+ * gates secret paths for the read/write/edit/grep/find/ls tools.
  *
  * Severity tiers (user always has final say via dialog):
  *   critical  — red, deny-first dialog
@@ -14,13 +15,15 @@
  * Config: ~/.pi/agent/pix.json (the `gate` section)
  *   guardrails: "off"              — disable built-in rules entirely
  *   extraRules: [{ pattern, flags?, severity?, reason? }]  — append extra rules
- *   autoApprove: ["regex"]         — bypass gate for matching commands
+ *   autoApprove: ["regex"]         — bypass gate for matching simple commands
+ *                                    (never for chained commands or the circuit breaker)
  */
 
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { withAgentBlock } from "@xynogen/pix-runtime";
 import {
 	buildRules,
+	canAutoApprove,
 	classify,
 	classifyPath,
 	extractPathsFromBash,
@@ -39,8 +42,12 @@ import {
 	promptPathDecision,
 	SEVERITY_ICON,
 } from "./prompt.ts";
+import { registerProjectTrust } from "./trust.ts";
 
 export default function (pi: ExtensionAPI): void {
+	// Two-choice project-trust prompt (Trust / Do not trust) replacing Pi's five.
+	registerProjectTrust(pi);
+
 	const { rules, autoApprove, pathRules } = buildRules(loadUserConfig());
 
 	// Is a tool registered (active or gated)? ssh_run/sudo_run are opt-in and
@@ -63,30 +70,35 @@ export default function (pi: ExtensionAPI): void {
 		{ match: isSshCommand, tool: "ssh_run", label: "ssh" },
 	] as const;
 
-	// ── Path protection (read/write/edit tools only — bash handled below) ───
+	// ── Path protection (file tools — shell tools handled below) ───
+	// grep/find/ls take a directory, so `~/.ssh` also tests as `~/.ssh/`.
+	const PATH_TOOLS: Record<string, "read" | "write"> = {
+		read: "read",
+		grep: "read",
+		find: "read",
+		ls: "read",
+		write: "write",
+		edit: "write",
+	};
+	const DIR_TOOLS = new Set(["grep", "find", "ls"]);
+	const PATH_ORDER = { block: 0, warn: 1, info: 2 } as const;
 	pi.on("tool_call", async (event, ctx) => {
 		const tool = String(event.toolName);
+		const op = PATH_TOOLS[tool];
+		if (!op) return undefined;
 		const input = event.input as Record<string, unknown>;
 
-		// bash is handled by the unified gate below
-		if (tool === "bash") return undefined;
-
-		let path: string | undefined;
-		let op: "read" | "write";
-
-		if (tool === "read") {
-			path = String(input.path ?? "");
-			op = "read";
-		} else if (tool === "write" || tool === "edit") {
-			path = String(input.path ?? "");
-			op = "write";
-		} else {
-			return undefined;
-		}
-
-		if (!path) return undefined;
-		const hit = classifyPath(path, op, pathRules);
-		if (!hit) return undefined;
+		// `paths` is the batch form of pix-read / pix-ls.
+		const raw = [input.path, input.file_path, ...(Array.isArray(input.paths) ? input.paths : [])];
+		const targets = raw.filter((p): p is string => typeof p === "string" && p.length > 0);
+		const hits = targets
+			.flatMap((p) => (DIR_TOOLS.has(tool) ? [p, `${p.replace(/[\\/]$/, "")}/`] : [p]))
+			.map((p) => ({ p, h: classifyPath(p, op, pathRules) }))
+			.filter((x): x is { p: string; h: NonNullable<typeof x.h> } => x.h !== undefined)
+			.sort((a, b) => PATH_ORDER[a.h.severity] - PATH_ORDER[b.h.severity]);
+		const top = hits[0];
+		if (!top) return undefined;
+		const { p: path, h: hit } = top;
 
 		if (hit.severity === "info") {
 			ctx.ui.notify(`${PATH_SEVERITY_ICON.info} ${hit.reason}: ${path}`, "info");
@@ -137,19 +149,44 @@ export default function (pi: ExtensionAPI): void {
 		risky: 1,
 	};
 
+	// The unified command gate also covers pix-proc's `proc` tool: its `start`
+	// action carries a shell command in `event.input.command`, identical to bash.
+	// proc's other actions (list/logs/stop/rm) carry no command and pass straight
+	// through. Install pix-proc without pix-gate = ungated, same as bash.
+	// Pi's built-in `powershell` tool uses the same `input.command` shape.
+	const GATED_COMMAND_TOOLS = new Set(["bash", "proc", "powershell"]);
 	pi.on("tool_call", async (event, ctx) => {
-		if (event.toolName !== "bash") return undefined;
+		const toolName = String(event.toolName);
+		if (!GATED_COMMAND_TOOLS.has(toolName)) return undefined;
 
-		const command = String(event.input.command ?? "");
+		const command = String((event.input as Record<string, unknown>).command ?? "");
 		if (!command.trim()) return undefined;
 
 		// Collect all concerns: path hits + command hit
 		const concerns: Concern[] = [];
 
-		// Path concerns
+		// Path concerns. A redirect or `tee` target counts as a write.
 		const candidates = extractPathsFromBash(command);
+		const writeTargets = new Set(
+			[
+				...command
+					.replace(/\\/g, "/")
+					.matchAll(/(?:>>?|\btee\s+(?:-\S+\s+)*)\s*["']?([^\s"'`;&|<>)]+)/g),
+			].map((m) => m[1]),
+		);
+		const opFor = (p: string): "read" | "write" => (writeTargets.has(p) ? "write" : "read");
+
+		// Steer a blocked ssh-config read toward the dedicated `ssh info` tool
+		// (ssh_run action:"info"), which reads the effective config without touching
+		// ~/.ssh directly. Only when ssh_run is installed. Appended to the block
+		// reason so the model reads it and stops retrying with awk/grep/raw ssh.
+		const readsSshConfig = candidates.some((p) => /(^|\/)\.ssh\/config\b/i.test(p));
+		const sshInfoSteer =
+			readsSshConfig && isRegistered("ssh_run")
+				? ' Use the ssh_run tool with action:"info" to read the effective SSH config instead of reading ~/.ssh/config in bash.'
+				: "";
 		for (const p of candidates) {
-			const hit = classifyPath(p, "read", pathRules);
+			const hit = classifyPath(p, opFor(p), pathRules);
 			if (!hit) continue;
 			if (hit.severity === "info") {
 				ctx.ui.notify(`${PATH_SEVERITY_ICON.info} ${hit.reason}: ${p}`, "info");
@@ -174,26 +211,28 @@ export default function (pi: ExtensionAPI): void {
 			});
 		}
 
-		if (concerns.length === 0) return undefined;
-
-		const highest = concerns.reduce((a, b) => (a.tier > b.tier ? a : b));
-
 		// Privileged auth redirect — hard block, no prompt, no bypass. Even YOLO
 		// cannot run bare sudo/ssh in bash (password/passphrase can't be auto-typed);
 		// it must use the dedicated tool. Only fires when that tool is installed.
+		// Runs before the empty-concerns exit: plain `ssh host` matches no rule.
 		for (const redirect of AUTH_REDIRECTS) {
 			if (!redirect.match(command) || !isRegistered(redirect.tool)) continue;
-			if (unattendedGateDecision(pi.events, highest.tier) === "deny") {
+			const tier = Math.max(SEVERITY_TIER.dangerous, ...concerns.map((c) => c.tier));
+			if (unattendedGateDecision(pi.events, tier) === "deny") {
 				return { block: true, reason: `[AFK] ${redirect.label} is denied while user is away.` };
 			}
 			// One surface only: the block reason renders as the tool-error card and
 			// reaches the model. A separate notify would duplicate the warning.
 			return {
 				block: true,
-				reason: `DANGEROUS — use the ${redirect.tool} tool instead of ${redirect.label} in bash (it handles auth securely).`,
+				reason: `DANGEROUS — use the ${redirect.tool} tool instead of ${redirect.label} in ${toolName} (it handles auth securely).`,
 			};
 		}
 
+		if (concerns.length === 0) return undefined;
+
+		const highest = concerns.reduce((a, b) => (a.tier > b.tier ? a : b));
+
 		// Circuit breaker: catastrophic commands never auto-approve, even under YOLO.
 		// They fall through to the interactive dialog (or the no-UI block below).
 		const breaker = isCircuitBreaker(command);
@@ -208,18 +247,18 @@ export default function (pi: ExtensionAPI): void {
 		if (unattended === "deny") {
 			return {
 				block: true,
-				reason: `[AFK][${highest.label}] ${highest.detail}`,
+				reason: `[AFK][${highest.label}] ${highest.detail}${sshInfoSteer}`,
 			};
 		}
 
-		if (autoApprove.some((re) => re.test(command))) return undefined;
+		if (canAutoApprove(command, autoApprove)) return undefined;
 
 		// No UI: auto-block block+ severity, pass anything lower.
 		if (!ctx.hasUI) {
 			if (highest.tier >= SEVERITY_TIER.block) {
 				return {
 					block: true,
-					reason: `[${highest.label}] ${highest.detail} (no UI, auto-blocked)`,
+					reason: `[${highest.label}] ${highest.detail} (no UI, auto-blocked)${sshInfoSteer}`,
 				};
 			}
 			return undefined;
@@ -237,7 +276,7 @@ export default function (pi: ExtensionAPI): void {
 		} else if (concerns.length === 1 && !cmdHit) {
 			// Single path hit — reuse path dialog
 			const ph = candidates
-				.map((p) => ({ p, h: classifyPath(p, "read", pathRules) }))
+				.map((p) => ({ p, h: classifyPath(p, opFor(p), pathRules) }))
 				.find((x) => x.h?.severity !== "info" && x.h);
 			if (ph?.h) {
 				decision = await withAgentBlock(
@@ -260,7 +299,7 @@ export default function (pi: ExtensionAPI): void {
 
 		if (!decision.approved) {
 			ctx.ui.notify(`${highest.icon} ${decision.reason}: ${highest.detail}`, "warning");
-			return { block: true, reason: `[${highest.label}] ${decision.reason}` };
+			return { block: true, reason: `[${highest.label}] ${decision.reason}${sshInfoSteer}` };
 		}
 
 		const severityColor =

package/src/lib.ts

@@ -28,30 +28,49 @@ export interface UserConfig {
 	autoApprove?: string[];
 }
 
+// Recursive delete of a drive root or the user profile (cmd.exe `rd /s`, PowerShell `-Recurse`).
+const WINDOWS_ROOT_WIPE =
+	/\b(?:rd|rmdir|del|erase|Remove-Item|ri|rm)\b(?=[^|;\n]*\s(?:\/s|-r\w*)\b)[^|;\n]*\s["']?(?:[A-Za-z]:|~|\$env:USERPROFILE|%USERPROFILE%|\$HOME)[\\/]?["']?(?=\s|$|[;|&])/i;
+
+// Command position: line start, after an operator / subshell / quote, or after a
+// wrapper (`sudo`, `env`, `xargs`, …). Keeps `grep shutdown src/` and `echo mkfs`
+// from matching. `\|` is an escaped pipe inside a pattern, not an operator. A quote
+// starts a command only after `-c` (`sh -c "…"`), not in `git commit -m "reboot"`.
+const AT_CMD = String.raw`(?:^|(?<!\\)[;&|({\x60!]|\$\(|-c\s+["'])\s*(?:(?:sudo|doas|env|nohup|time|exec|nice|xargs|command|builtin|then|do|else)\s+(?:-\S+\s+)*)*`;
+const at = (body: string, flags = "i"): RegExp => new RegExp(AT_CMD + body, flags);
+
+// One shell segment (stops at the next operator).
+const SEG = String.raw`[^;&|\n]*`;
+// `rm` with a recursive flag (-r, -R, -rf, -fr, --recursive). Force is irrelevant for a non-tty agent.
+const RM_R = String.raw`rm\b(?=${SEG}\s(?:-[a-z]*r[a-z]*|--recursive)(?=\s|$))`;
+// A target that is `/`, `~`, `$HOME`, or everything under them.
+const ROOT_TARGET = String.raw`${SEG}\s["']?(?:\/\*?|~\/?\*?|\$\{?HOME\}?\/?\*?)["']?(?=\s|$|[;&|])`;
+// A target that is a top-level system directory.
+const SYS_TARGET = String.raw`${SEG}\s["']?\/(?:bin|boot|dev|etc|home|lib|lib64|opt|proc|root|sbin|srv|sys|usr|var)\/?\*?["']?(?=\s|$|[;&|])`;
+const RAW_DISK = String.raw`\/dev\/(?:sd|nvme|disk|hd|vd|xvd|mmcblk)`;
+
+const RM_ROOT = at(RM_R + ROOT_TARGET);
+
 export const DEFAULT_RULES: Rule[] = [
 	// CRITICAL — destructive, irreversible, or system-wide
+	{ pattern: RM_ROOT, severity: "critical", reason: "recursive rm on / or $HOME" },
 	{
-		pattern: /\brm\s+(-[a-z]*r[a-z]*f|-[a-z]*f[a-z]*r)\s+\/(\s|$)/i,
+		pattern: at(RM_R + SYS_TARGET),
 		severity: "critical",
-		reason: "rm -rf on /",
+		reason: "recursive rm on a system directory",
 	},
 	{
-		pattern: /\brm\s+(-[a-z]*r[a-z]*f|-[a-z]*f[a-z]*r)\s+(~|\$HOME)(\s|$|\/\s*$)/i,
+		pattern: at(String.raw`(?:mkfs(?:\.\w+)?|wipefs|blkdiscard)\b`),
 		severity: "critical",
-		reason: "rm -rf on $HOME",
+		reason: "filesystem format / wipe",
 	},
 	{
-		pattern: /\bmkfs(\.\w+)?\b/i,
-		severity: "critical",
-		reason: "filesystem formatting",
-	},
-	{
-		pattern: /\bdd\s+.*\bof=\/dev\/(sd[a-z]|nvme|disk)/i,
+		pattern: new RegExp(String.raw`\bdd\b[^\n]*\bof=${RAW_DISK}`, "i"),
 		severity: "critical",
 		reason: "dd to raw block device",
 	},
 	{
-		pattern: />\s*\/dev\/(sd[a-z]|nvme|disk)/i,
+		pattern: new RegExp(String.raw`>\s*${RAW_DISK}`, "i"),
 		severity: "critical",
 		reason: "writing to raw block device",
 	},
@@ -61,59 +80,197 @@ export const DEFAULT_RULES: Rule[] = [
 		reason: "fork bomb",
 	},
 	{
-		pattern: /\bshutdown\b|\breboot\b|\bhalt\b|\bpoweroff\b/i,
+		pattern: at(
+			String.raw`(?:shutdown|reboot|halt|poweroff|systemctl\s+(?:poweroff|reboot|halt|kexec)|init\s+[06])\b`,
+		),
 		severity: "critical",
 		reason: "system power command",
 	},
 
 	// DANGEROUS — destructive or privileged but recoverable in scope
+	{ pattern: at(RM_R), severity: "dangerous", reason: "recursive remove" },
 	{
-		pattern: /\brm\s+(-[a-z]*r[a-z]*f|-[a-z]*f[a-z]*r)\b/i,
-		severity: "dangerous",
-		reason: "recursive force remove",
-	},
-	// Match sudo as a command/operator token, not as a substring of path components like pix-sudo
-	{
-		pattern: /(^|[\s;|&])sudo\b/i,
+		pattern: at(String.raw`(?:sudo|doas|pkexec|su)\b`),
 		severity: "dangerous",
 		reason: "privilege escalation",
 	},
 	{
-		pattern: /\b(chmod|chown)\b[^|;&]*\b(777|-R\s+777)/i,
+		pattern: at(String.raw`chmod\b${SEG}\s(?:[0-7]?0?777|[ugo]*a[ugo]*\+[rx]*w|o\+[rx]*w|a=rwx)`),
 		severity: "dangerous",
 		reason: "world-writable permissions",
 	},
 	{
-		pattern: /\bchmod\s+-R\b/i,
+		pattern: at(
+			String.raw`(?:chmod|chown|chgrp)\s+(?:-\S+\s+)*-[a-z]*R(?:${SYS_TARGET}|${ROOT_TARGET})`,
+		),
 		severity: "dangerous",
-		reason: "recursive chmod",
+		reason: "recursive permission / owner change on a system path",
 	},
 	{
-		pattern: /\b(curl|wget)\b[^|;&]*\|\s*(sudo\s+)?(sh|bash|zsh)\b/i,
+		pattern:
+			/\b(?:curl|wget)\b[^\n]*\|\s*(?:sudo\s+(?:-\S+\s+)*)?(?:sh|bash|zsh|dash|ksh|fish|python[\d.]*|perl|ruby|node|bun|deno)\b|(?:^|\s)(?:sh|bash|zsh|dash|ksh|eval|source|\.)\s[^\n]*(?:\$\(|<\(|\x60)\s*(?:curl|wget)\b/i,
 		severity: "dangerous",
 		reason: "remote script execution (curl|sh)",
 	},
 	{
-		pattern: /\bgit\s+(push\s+(-f|--force)|reset\s+--hard|clean\s+-[a-z]*f)/i,
+		// Case-sensitive: `branch -D` force-deletes, `branch -d` does not.
+		pattern: new RegExp(
+			String.raw`\bgit\b${SEG}\s(?:push\b${SEG}\s(?:-f|--force(?:-with-lease)?|--mirror|--delete|-d|\+\S+|:\S+)(?=\s|$)|reset\s+--hard|clean\s+-[a-zA-Z]*f|branch\s+(?:${SEG}\s)?(?:-D|--delete\s+--force)\b|filter-branch|filter-repo|reflog\s+expire|update-ref\s+-d)`,
+		),
 		severity: "dangerous",
 		reason: "destructive git operation",
 	},
 	{
-		pattern: /\bnpm\s+publish\b/i,
+		pattern: new RegExp(
+			String.raw`\b(?:(?:npm|pnpm|yarn|bun)\s+(?:publish|unpublish|deprecate)|cargo\s+(?:publish|yank)|twine\s+upload|gem\s+push)\b(?!${SEG}--dry-run)`,
+			"i",
+		),
 		severity: "dangerous",
 		reason: "package publish",
 	},
 	{
-		pattern: /\bdocker\s+(system\s+prune|rm\s+-f|volume\s+rm)/i,
+		pattern: new RegExp(
+			String.raw`\bdocker\s+(?:system\s+prune|volume\s+(?:rm|prune)|(?:rm|rmi)\s+-[a-z]*f|image\s+prune\s+-a)|\bdocker(?:\s+compose|-compose)\s+down\b${SEG}\s(?:-v|--volumes)\b`,
+			"i",
+		),
 		severity: "dangerous",
 		reason: "destructive docker operation",
 	},
+	{
+		pattern: new RegExp(String.raw`\bfind\b${SEG}\s(?:-delete\b|-exec(?:dir)?\s+rm\b)`, "i"),
+		severity: "dangerous",
+		reason: "find with delete",
+	},
+	{
+		pattern: at(
+			String.raw`(?:crontab\s+-r|kubectl\s+delete|helm\s+(?:uninstall|delete)|terraform\s+destroy|mv\b${SEG}\s\/dev\/null)\b`,
+		),
+		severity: "dangerous",
+		reason: "destructive infra / scheduler operation",
+	},
+	{
+		pattern: /\b(?:DROP\s+(?:TABLE|DATABASE|SCHEMA)|TRUNCATE\s+TABLE)\b/i,
+		severity: "dangerous",
+		reason: "destructive SQL",
+	},
 	{
 		pattern: /\bkill\s+-9\s+-1\b/i,
 		severity: "dangerous",
 		reason: "kill all processes",
 	},
 
+	// Windows — cmd.exe and PowerShell forms (Pi's built-in `powershell` tool, Git Bash)
+	{
+		pattern: WINDOWS_ROOT_WIPE,
+		severity: "critical",
+		reason: "recursive delete of drive root / profile",
+	},
+	{
+		pattern:
+			/\b(Format-Volume|Clear-Disk|Initialize-Disk|diskpart)\b|\bformat(\.com)?\s+[A-Za-z]:/i,
+		severity: "critical",
+		reason: "disk format / wipe (Windows)",
+	},
+	{
+		pattern: /\bvssadmin\b[^|;\n]*\bdelete\b|\bwmic\b[^|;\n]*\bshadowcopy\b[^|;\n]*\bdelete\b/i,
+		severity: "critical",
+		reason: "delete shadow copies (restore points)",
+	},
+	{
+		pattern: /\b(Stop-Computer|Restart-Computer)\b/i,
+		severity: "critical",
+		reason: "system power command (PowerShell)",
+	},
+	// PowerShell accepts abbreviated params: -r/-rec/-Recurse, -fo/-Force
+	{
+		pattern:
+			/\b(Remove-Item|ri|rm|rmdir|rd|del|erase)\b(?=[^|;\n]*\s-r\w*\b)(?=[^|;\n]*\s-fo\w*\b)/i,
+		severity: "dangerous",
+		reason: "recursive force remove (PowerShell)",
+	},
+	{
+		pattern: /\b(rd|rmdir|del|erase)\b[^|;\n]*\s\/s\b/i,
+		severity: "dangerous",
+		reason: "recursive remove (cmd.exe /s)",
+	},
+	{
+		pattern:
+			/\breg(\.exe)?\s+(delete|add|import|restore)\b|\b(Remove-Item|Remove-ItemProperty|Set-ItemProperty|New-ItemProperty|Set-Item|New-Item)\b[^|;\n]*\bHK(LM|CU|CR|U|CC):/i,
+		severity: "dangerous",
+		reason: "registry write",
+	},
+	{
+		pattern: /\bbcdedit\b|\bcipher\b[^|;\n]*\/w\b/i,
+		severity: "dangerous",
+		reason: "boot config / free-space wipe",
+	},
+	{
+		pattern:
+			/\bSet-MpPreference\b[^|;\n]*-Disable|\bAdd-MpPreference\b[^|;\n]*-Exclusion|\bnetsh\b[^|;\n]*\b(state\s+off|opmode\s+disable)\b|\bSet-NetFirewallProfile\b[^|;\n]*-Enabled\s+(\$?false|0)\b/i,
+		severity: "dangerous",
+		reason: "disable Defender / firewall",
+	},
+	{
+		pattern:
+			/\bicacls\b[^|;\n]*\/grant\b[^|;\n]*\b(Everyone|\*S-1-1-0)\b|\b(takeown|icacls)\b[^|;\n]*\s\/(r|t)\b/i,
+		severity: "dangerous",
+		reason: "recursive / world ACL change (Windows)",
+	},
+	{
+		pattern: /\bnet\s+(user|localgroup)\b[^|;\n]*\/(add|delete)\b/i,
+		severity: "dangerous",
+		reason: "local user / group change",
+	},
+	{
+		pattern: /\bsc(\.exe)?\s+(delete|config)\b|\bRemove-Service\b/i,
+		severity: "dangerous",
+		reason: "service delete / reconfigure",
+	},
+	{
+		pattern: /\bwevtutil\s+cl\b|\bClear-EventLog\b/i,
+		severity: "dangerous",
+		reason: "clear event logs",
+	},
+	{
+		// -e/-ec/-en/-enc/-EncodedCommand; not -ExecutionPolicy
+		pattern: /\b(powershell|pwsh)(\.exe)?\b[^|;\n]*\s-(e|ec|en|enc\w*)\b/i,
+		severity: "dangerous",
+		reason: "encoded PowerShell command",
+	},
+	{
+		pattern:
+			/\bcertutil\b[^|;\n]*-urlcache|\bbitsadmin\b[^|;\n]*\/transfer|\bmshta\b[^|;\n]*https?:/i,
+		severity: "dangerous",
+		reason: "download via system binary (LOLBin)",
+	},
+	{
+		pattern:
+			/\b(iex|Invoke-Expression)\b[^\n]*\b(iwr|irm|Invoke-WebRequest|Invoke-RestMethod|DownloadString)\b|\b(iwr|irm|Invoke-WebRequest|Invoke-RestMethod)\b[^\n]*\|\s*(iex|Invoke-Expression)\b/i,
+		severity: "dangerous",
+		reason: "remote script execution (iwr|iex)",
+	},
+	{
+		// runas.exe and Start-Process -Verb RunAs
+		pattern: /\brunas\b/i,
+		severity: "dangerous",
+		reason: "privilege escalation (RunAs)",
+	},
+	{
+		pattern: /\bSet-ExecutionPolicy\b/i,
+		severity: "risky",
+		reason: "execution policy change",
+	},
+	{
+		pattern: /\btaskkill\b[^|;\n]*\/f\b|\bStop-Process\b[^|;\n]*-fo\w*/i,
+		severity: "risky",
+		reason: "force-kill process",
+	},
+	{
+		pattern: /\bschtasks\b[^|;\n]*\/create\b|\bRegister-ScheduledTask\b/i,
+		severity: "risky",
+		reason: "scheduled task (persistence)",
+	},
+
 	// RISKY — worth a glance but usually fine
 	{
 		pattern: /\bgit\s+checkout\s+(-f|--force)/i,
@@ -121,9 +278,19 @@ export const DEFAULT_RULES: Rule[] = [
 		reason: "force checkout (overwrites local changes)",
 	},
 	{
-		pattern: /\bgit\s+stash\s+drop\b/i,
+		pattern: /\bgit\s+stash\s+(?:drop|clear)\b/i,
 		severity: "risky",
-		reason: "stash drop",
+		reason: "stash drop / clear",
+	},
+	{
+		pattern: /\bgit\s+(?:checkout|restore)\s+(?:--\s+)?\.(?=\s|$|[;&|])/i,
+		severity: "risky",
+		reason: "discard all working-tree changes",
+	},
+	{
+		pattern: at(String.raw`(?:chmod|chown|chgrp)\s+(?:-\S+\s+)*-[a-z]*R\b`),
+		severity: "risky",
+		reason: "recursive permission / owner change",
 	},
 	{
 		pattern: />\s*[^|&;]*\.env\b/i,
@@ -205,7 +372,7 @@ export const DEFAULT_PATH_RULES: PathRule[] = [
 		reason: "SSH private key",
 	},
 	{
-		pattern: /\.(pem|key|p12|pfx|jks|keystore)$/i,
+		pattern: /\.(pem|key|p12|pfx|jks|keystore|ppk)$/i,
 		severity: "block",
 		reason: "private key / keystore",
 	},
@@ -219,6 +386,18 @@ export const DEFAULT_PATH_RULES: PathRule[] = [
 		severity: "block",
 		reason: "netrc credentials",
 	},
+	{
+		pattern: /(^|\/)\.pi\/agent\/auth\.json$/i,
+		severity: "block",
+		reason: "Pi provider API keys",
+	},
+	{
+		pattern:
+			/(^|\/)(\.git-credentials|\.pgpass|\.vault-token|\.kube\/config|\.docker\/config\.json|\.config\/gh\/hosts\.ya?ml)$/i,
+		severity: "block",
+		reason: "stored credentials / tokens",
+	},
+	{ pattern: /(^|\/)\.gnupg\//i, severity: "block", reason: "GnuPG keyring" },
 	{
 		pattern: /(^|\/)(credentials|service-account)\.(json|ya?ml|toml)$/i,
 		severity: "block",
@@ -232,7 +411,35 @@ export const DEFAULT_PATH_RULES: PathRule[] = [
 		reason: ".env file (live secrets)",
 	},
 
+	// Windows secret stores (paths normalized to `/` in classifyPath)
+	{
+		pattern: /(^|\/)(System32\/config\/(SAM|SYSTEM|SECURITY)|NTUSER\.DAT)$/i,
+		severity: "block",
+		reason: "Windows registry hive",
+	},
+	{
+		pattern: /(^|\/)Microsoft\/(Credentials|Protect|Vault)(\/|$)/i,
+		severity: "block",
+		reason: "Windows credential store / DPAPI keys",
+	},
+	{
+		pattern: /(^|\/)(unattend|autounattend|sysprep)\.xml$/i,
+		severity: "block",
+		reason: "Windows answer file (plaintext passwords)",
+	},
+
 	// warn — yellow allow-first
+	{
+		pattern: /(^|\/)ConsoleHost_history\.txt$/i,
+		severity: "warn",
+		reason: "PowerShell history (may hold secrets)",
+	},
+	{
+		pattern: /(^|\/)[A-Za-z]:\/Windows\//i,
+		severity: "warn",
+		reason: "Windows system directory",
+		ops: ["write"],
+	},
 	{ pattern: /(^|\/)\.envrc$/i, severity: "warn", reason: "direnv file" },
 	{
 		pattern: /(^|\/)\.npmrc$/i,
@@ -272,12 +479,14 @@ export function classifyPath(
 	op: "read" | "write",
 	rules: PathRule[],
 ): PathRule | undefined {
+	// Windows paths use `\`. Rules match on `/`.
+	const p = path.replace(/\\/g, "/");
 	const order: PathSeverity[] = ["block", "warn", "info"];
 	for (const sev of order) {
 		const hit = rules.find((r) => {
 			if (r.severity !== sev) return false;
 			if (r.ops && !r.ops.includes(op)) return false;
-			return r.pattern.test(path);
+			return r.pattern.test(p);
 		});
 		if (hit) return hit;
 	}
@@ -285,17 +494,24 @@ export function classifyPath(
 }
 
 /** Extract candidate file paths from a bash command string */
-export function extractPathsFromBash(cmd: string): string[] {
+export function extractPathsFromBash(command: string): string[] {
+	// ponytail: `\` → `/` also rewrites bash escapes (`a\ b`). That only loosens path detection.
+	const cmd = command.replace(/\\/g, "/");
 	const out: string[] = [];
 	const re =
-		/(?:^|[\s=><|;&"'`(])((?:\.\.\/|\.\/|\/|~\/)[^\s"'`<>|;&)]+|(?:\.env(?:\.[A-Za-z0-9_-]+)?|[A-Za-z0-9_./-]+\.(?:pem|key|p12|pfx|crt|cer|env|envrc|netrc))(?![A-Za-z0-9]))/g;
+		/(?:^|[\s=><|;&"'`(])((?:\.\.\/|\.\/|\/|~\/|[A-Za-z]:\/|\$env:\w+\/|%\w+%\/|\$\{?\w+\}?\/|\.[A-Za-z0-9_-]+\/)[^\s"'`<>|;&)]+|(?:\.env(?:\.[A-Za-z0-9_-]+)?|[A-Za-z0-9_./-]+\.(?:pem|key|p12|pfx|ppk|crt|cer|env|envrc|netrc)|(?:[A-Za-z0-9_.-]+\/)*(?:credentials|service-account|secrets?)\.(?:json|ya?ml|toml))(?![A-Za-z0-9]))/g;
 	for (const m of cmd.matchAll(re)) out.push(m[1] ?? "");
 	return out;
 }
 
-/** True when command contains a real sudo invocation (not a path like pix-sudo). */
+/** Blank out quoted strings, so `git commit -m "drop sudo"` holds no `sudo` token. */
+function stripQuoted(command: string): string {
+	return command.replace(/'[^']*'|"(?:[^"\\]|\\.)*"/g, "''");
+}
+
+/** True when command contains a real sudo invocation (not a path like pix-sudo, not quoted text). */
 export function isSudoCommand(command: string): boolean {
-	return /(^|[\s;|&])sudo\b/i.test(command);
+	return /(^|[\s;|&(])sudo\b/i.test(stripQuoted(command));
 }
 
 /**
@@ -305,7 +521,7 @@ export function isSudoCommand(command: string): boolean {
  * matches, e.g. `sshpass -p x ssh host`).
  */
 export function isSshCommand(command: string): boolean {
-	return /(^|[\s;|&])ssh(\s|$)/i.test(command);
+	return /(^|[\s;|&(])ssh(\s|$)/i.test(stripQuoted(command));
 }
 
 // Non-lifting circuit breaker: catastrophic, unrecoverable commands that NO
@@ -313,13 +529,25 @@ export function isSshCommand(command: string): boolean {
 // floor, which still prompts on root/home wipes. These always fall through to
 // the interactive dialog (or a no-UI block).
 const CIRCUIT_BREAKER: RegExp[] = [
-	/\brm\s+-[a-z]*r[a-z]*f?[a-z]*\s+(?:--\s+)?[~/]\s*(?:$|[\s;|&])/i, // rm -rf /  or  rm -rf ~
-	/\bdd\b[^\n]*\bof=\/dev\/(?:sd|nvme|disk|hd|vd)/i, // dd onto a raw disk
+	RM_ROOT, // rm -rf /  rm -rf ~/*  rm -r $HOME
+	new RegExp(String.raw`\bdd\b[^\n]*\bof=${RAW_DISK}`, "i"), // dd onto a raw disk
 	/\bmkfs\.\w+\s+\/dev\//i, // format a device
 	/:\s*\(\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;/, // classic fork bomb
-	/>\s*\/dev\/(?:sd|nvme|disk|hd|vd)[a-z0-9]*\b/i, // redirect over a raw disk
+	new RegExp(String.raw`>\s*${RAW_DISK}`, "i"), // redirect over a raw disk
+	/\b(?:Format-Volume|Clear-Disk|diskpart)\b|\bformat(?:\.com)?\s+[A-Za-z]:/i, // Windows disk format / wipe
+	WINDOWS_ROOT_WIPE, // rd /s C:\  or  Remove-Item -Recurse $env:USERPROFILE
 ];
 
+/**
+ * True when a user `autoApprove` pattern may skip the gate. It covers one simple
+ * command only: `^git status` must not approve `git status; rm -rf ~`. It never
+ * lifts the circuit breaker.
+ */
+export function canAutoApprove(command: string, patterns: RegExp[]): boolean {
+	if (isCircuitBreaker(command) || /[;&|`\n<>]|\$\(/.test(command)) return false;
+	return patterns.some((re) => re.test(command));
+}
+
 /** True when a command is catastrophic enough that no unattended mode may auto-approve it. */
 export function isCircuitBreaker(command: string): boolean {
 	return CIRCUIT_BREAKER.some((re) => re.test(command));

package/src/trust.ts

@@ -0,0 +1,73 @@
+/**
+ * Simplified project-trust prompt.
+ *
+ * Pi's built-in prompt offers five choices (trust, trust parent, trust for
+ * session, do not trust, do not trust for session). This handler replaces it
+ * with two remembered choices: Trust / Do not trust. It only decides when Pi
+ * would otherwise ask — saved decisions, `defaultProjectTrust` other than
+ * "ask", and no-UI runs fall through to Pi unchanged ("undecided").
+ */
+
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import type {
+	ExtensionAPI,
+	ProjectTrustContext,
+	ProjectTrustEvent,
+	ProjectTrustEventResult,
+} from "@earendil-works/pi-coding-agent";
+import { ProjectTrustStore } from "@earendil-works/pi-coding-agent";
+import { agentDir } from "@xynogen/pix-runtime/paths";
+
+export const TRUST_LABEL = "Trust";
+export const DISTRUST_LABEL = "Do not trust";
+
+export interface TrustDeps {
+	/** Saved decision for cwd (nearest ancestor), or null when none. */
+	savedDecision(cwd: string): boolean | null;
+	/** Global `defaultProjectTrust` setting. */
+	defaultProjectTrust(): string;
+}
+
+function readDefaultProjectTrust(dir: string): string {
+	const path = join(dir, "settings.json");
+	if (!existsSync(path)) return "ask";
+	try {
+		const parsed = JSON.parse(readFileSync(path, "utf-8").replace(/^\uFEFF/, ""));
+		const value = parsed?.defaultProjectTrust;
+		return typeof value === "string" ? value : "ask";
+	} catch {
+		return "ask";
+	}
+}
+
+export function defaultTrustDeps(dir: string = agentDir()): TrustDeps {
+	return {
+		savedDecision: (cwd) => new ProjectTrustStore(dir).get(cwd),
+		defaultProjectTrust: () => readDefaultProjectTrust(dir),
+	};
+}
+
+export async function decideProjectTrust(
+	event: ProjectTrustEvent,
+	ctx: ProjectTrustContext,
+	deps: TrustDeps,
+): Promise<ProjectTrustEventResult> {
+	const undecided: ProjectTrustEventResult = { trusted: "undecided" };
+	if (!ctx.hasUI) return undecided;
+	if (deps.savedDecision(event.cwd) !== null) return undecided;
+	if (deps.defaultProjectTrust() !== "ask") return undecided;
+
+	const title =
+		`Trust project folder?\n${event.cwd}\n\n` +
+		"This allows Pi to load .pi settings and resources, install missing project packages, and execute project extensions.";
+	const choice = await ctx.ui.select(title, [TRUST_LABEL, DISTRUST_LABEL]);
+	if (choice === TRUST_LABEL) return { trusted: "yes", remember: true };
+	if (choice === DISTRUST_LABEL) return { trusted: "no", remember: true };
+	// Cancelled: untrusted for this run only, nothing saved (matches Pi).
+	return { trusted: "no" };
+}
+
+export function registerProjectTrust(pi: ExtensionAPI, deps: TrustDeps = defaultTrustDeps()): void {
+	pi.on("project_trust", (event, ctx) => decideProjectTrust(event, ctx, deps));
+}