@yaosu/pi-path-guard 1.0.0 → 1.1.0

package/README.md

@@ -33,32 +33,35 @@ After installing, run `/reload` or restart pi. 安装后 `/reload` 或重启 pi
 ### `/guard` command
 
 - `/guard` — interactive mode picker (title shows the full decision matrix; choices are bilingual) 交互式选择防护模式（标题展示完整判定矩阵，选项中英双语）
-- `/guard <strict|normal|loose|trusted>` — quick switch (trusted requires a warning confirmation) 快捷切换（trusted 需警告确认）
+- `/guard <strict|normal|loose|trusted|naked>` — quick switch (trusted requires a warning; naked requires a double warning) 快捷切换（trusted 需警告确认；naked 需两级确认）
 - Invalid argument → falls back to the interactive picker 非法参数 → 兜底弹出交互选择
 - Every new session resets to `normal` 每次新会话自动回到 `normal`
 
 ### Guard mode matrix / 防护模式矩阵
 
-| Checkpoint / 判定点 | strict | normal | loose | trusted |
-| --- | --- | --- | --- | --- |
-| Protected paths (.env/.ssh/keys/credentials) / 受保护路径 | block | block | block | block |
-| Block group (mkfs/reboot/block-device writes/bulk delete) / Block 组危险命令 | block | block | block | block |
-| Confirm group (sudo/ssh/chmod 777 …) / Confirm 组 | block | confirm | confirm | confirm |
-| git destructive (reset --hard/clean -f …) / git 破坏性 | confirm | confirm | confirm | confirm |
-| In-project write/edit/new / 项目内写/改/新建 | confirm | pass | pass | pass |
-| In-project delete / 项目内删除 | confirm | confirm | pass | pass |
-| Outside write (new file) / 项目外写新文件 | confirm | confirm | pass | pass |
-| Outside overwrite existing / 项目外覆盖已存在 | block | block | confirm | pass |
-| Outside delete ordinary / 项目外删除普通文件 | block | block | confirm | pass |
-| `>` truncate existing file / 截断已有文件 | confirm | confirm | confirm | confirm |
-| cwd=HOME write / HOME 目录写 | confirm | confirm | pass | pass |
-| No UI (headless) / 无交互界面 | block* | block* | block* | block* |
+| Checkpoint / 判定点 | strict | normal | loose | trusted | naked |
+| --- | --- | --- | --- | --- | --- |
+| Protected paths (.env/.ssh/keys/credentials) / 受保护路径 | block | block | block | block | pass |
+| Block group (mkfs/reboot/block-device writes/bulk delete) / Block 组危险命令 | block | block | block | block | confirm |
+| Confirm group (sudo/ssh/chmod 777 …) / Confirm 组 | block | confirm | confirm | confirm | pass |
+| git destructive (reset --hard/clean -f …) / git 破坏性 | confirm | confirm | confirm | confirm | pass |
+| In-project write/edit/new / 项目内写/改/新建 | confirm | pass | pass | pass | pass |
+| In-project delete / 项目内删除 | confirm | confirm | pass | pass | pass |
+| Outside write (new file) / 项目外写新文件 | confirm | confirm | pass | pass | pass |
+| Outside overwrite existing / 项目外覆盖已存在 | block | block | confirm | pass | pass |
+| Outside delete ordinary / 项目外删除普通文件 | block | block | confirm | pass | pass |
+| `>` truncate existing file / 截断已有文件 | confirm | confirm | confirm | confirm | pass |
+| cwd=HOME write / HOME 目录写 | confirm | confirm | pass | pass | pass |
+| No UI (headless) / 无交互界面 | block* | block* | block* | block* | pass |
 
 *block = denied directly, no confirmation opportunity / 直接阻止，无确认机会；confirm = prompt / 弹窗询问；pass = allow / 放行；\*headless: items that would be confirmed are blocked instead / 无 UI 时需确认项一律阻止
 
+> ⚠️ **naked mode / 裸奔模式**: passes almost everything — protected paths, the write/edit tool checks, git destructive, truncation, outside deletes/overwrites all pass even with no UI. Only system-destructive commands (mkfs/reboot/bulk-delete/block-device writes) are still **confirmed**. Switching requires a **double confirmation** (two prompts). Use only when you want minimal path-guard interference.
+> ⚠️ **裸奔模式**：除系统级破坏命令外几乎全部放行——受保护路径、write/edit 工具检查、git 破坏性、截断、外部删除/覆盖均放行，无 UI 下也放行；但系统级破坏命令（mkfs/reboot/批量删除/写块设备）仍会**弹窗询问**。切换需要**两级确认**（两次弹窗）。仅当你需要最少的路径守护干扰时使用。
+
 ### Core capabilities / 核心能力
 
-- **Protected-path interception / 受保护路径拦截**: `.env` / `.ssh` / `.aws` / `.kube` / private keys (`*.pem`/`*.key`) / credentials / shell configs (`.bashrc` …) / `node_modules` / `dist` / `build` … blocked hard in every mode — 任何模式下硬性阻止
+- **Protected-path interception / 受保护路径拦截**: `.env` / `.ssh` / `.aws` / `.kube` / private keys (`*.pem`/`*.key`) / credentials / shell configs (`.bashrc` …) / `node_modules` / `dist` / `build` … blocked hard in every mode (except naked) — 任何模式下硬性阻止（naked 除外）
 - **Block group / Block 组危险命令**: `mkfs.*` / `mkswap` / `poweroff` / `reboot` / `shutdown` / `dd` to block devices / `> /dev/sdX` / `find -delete` / `find -exec rm` / `xargs rm`
 - **Confirm group / Confirm 组**: `sudo` / `doas` / `pkexec` / `chmod 777` / `ssh` / `scp` / `sftp` / `rsh` / `telnet` / `wget -O /dev/null`
 - **Overwrite detection / 覆盖检测**: `mv` / `cp` / `install` / `tee` / `ln -f` / `rsync --delete` on existing targets, classified by in/out project — 目标已存在时按内外策略处理
@@ -69,13 +72,13 @@ After installing, run `/reload` or restart pi. 安装后 `/reload` 或重启 pi
 
 ## Development / 开发与测试
 
-Automated tests (83 assertions) load the real extension with a mocked pi API, covering the 4 modes × protected paths / dangerous commands / truncation / git destructive matrix, plus `/guard` command interaction and trusted-mode confirmation flow:
+Automated tests (96 assertions) load the real extension with a mocked pi API, covering the 5 modes × protected paths / dangerous commands / truncation / git destructive matrix, plus `/guard` command interaction, trusted-mode confirmation, and naked-mode double confirmation:
 
 ```bash
 cd tests && node --experimental-strip-types test-pathguard.ts
 ```
 
-自动化测试（83 断言）模拟 pi API 加载真实扩展，覆盖 4 种模式 × 受保护路径 / 危险命令 / 截断 / git 破坏性等判定矩阵，以及 `/guard` 命令交互与 trusted 确认流程：
+自动化测试（96 断言）模拟 pi API 加载真实扩展，覆盖 5 种模式 × 受保护路径 / 危险命令 / 截断 / git 破坏性等判定矩阵，以及 `/guard` 命令交互、trusted 确认与 naked 两级确认流程：
 
 ```bash
 cd tests && node --experimental-strip-types test-pathguard.ts

package/extensions/path-guard.ts

@@ -37,6 +37,11 @@
  *   - trusted  most permissive: overwrites and ordinary-file deletes pass too
  *   - Protected paths (credentials/config/keys) and the Block group (format/shutdown/bulk-delete/
  *     block-device writes) are blocked directly in every mode, with no confirmation opportunity
+ *
+ * v3.1 adds (upgrade from v3): naked mode — passes almost everything (protected paths, write/edit
+ *   checks, git destructive, truncate, outside deletes/overwrites); only system-destructive
+ *   Block-group commands (mkfs/reboot/block-device writes/bulk delete) are still confirmed.
+ *   Switching to naked requires a double confirmation (stronger than trusted's single warning).
  */
 
 import type {
@@ -185,8 +190,8 @@ const HOME = homedir();
 
 // ─── Guard Modes ─────────────────────────────────────────────────────
 
-/** Guard mode: strict (full) / normal (default) / loose (relaxed) / trusted (most permissive) */
-type GuardMode = "strict" | "normal" | "loose" | "trusted";
+/** Guard mode: strict (full) / normal (default) / loose (relaxed) / trusted (most permissive) / naked (no protection) */
+type GuardMode = "strict" | "normal" | "loose" | "trusted" | "naked";
 
 /** Current session guard mode (switched via /guard; reset to normal on session_start) */
 let currentMode: GuardMode = "normal";
@@ -197,6 +202,7 @@ const GUARD_MODES: readonly GuardMode[] = [
 	"normal",
 	"loose",
 	"trusted",
+	"naked",
 ];
 
 /** Whether a string is a valid guard mode (for /guard argument validation) */
@@ -214,24 +220,26 @@ const MODE_DESCRIPTIONS: Record<GuardMode, string> = {
 		"Loose: pass new-file writes & deletes, confirm overwrites / 放宽：新建/删除免问，覆盖需确认",
 	trusted:
 		"Trusted: pass overwrites & ordinary-file deletes / 最宽松：覆盖/删除普通文件也免问",
+	naked:
+		"Naked: pass everything except system-destructive cmds (confirmed) / 裸奔：除系统级破坏命令外全部放行（破坏命令弹窗询问）",
 };
 
 /** Full decision matrix (shown as the /guard picker title, English only) */
 const MODE_MATRIX = [
 	"Path Guard Mode Matrix (B=block / ?=confirm / .=pass)",
-	"  Checkpoint                          strict  normal  loose  trusted",
-	"  Protected paths .env/.ssh/keys         B       B       B       B",
-	"  System-destructive mkfs/reboot         B       B       B       B",
-	"  Privilege/remote sudo/ssh/chmod777     B       ?       ?       ?",
-	"  Git destructive reset --hard           ?       ?       ?       ?",
-	"  In-project write/edit/new              ?       .       .       .",
-	"  In-project delete                      ?       ?       .       .",
-	"  Outside write (new file)               ?       ?       .       .",
-	"  Outside overwrite existing             B       B       ?       .",
-	"  Outside delete ordinary                B       B       ?       .",
-	"  Truncate existing > file               ?       ?       ?       ?",
-	"  HOME dir write                         ?       ?       .       .",
-	"  No UI (headless)                       B       B       B       B",
+	"  Checkpoint                          strict  normal  loose  trusted  naked",
+	"  Protected paths .env/.ssh/keys         B       B       B       B       .",
+	"  System-destructive mkfs/reboot         B       B       B       B       ?",
+	"  Privilege/remote sudo/ssh/chmod777     B       ?       ?       ?       .",
+	"  Git destructive reset --hard           ?       ?       ?       ?       .",
+	"  In-project write/edit/new              ?       .       .       .       .",
+	"  In-project delete                      ?       ?       .       .       .",
+	"  Outside write (new file)               ?       ?       .       .       .",
+	"  Outside overwrite existing             B       B       ?       .       .",
+	"  Outside delete ordinary                B       B       ?       .       .",
+	"  Truncate existing > file               ?       ?       ?       ?       .",
+	"  HOME dir write                         ?       ?       .       .       .",
+	"  No UI (headless)                       B       B       B       B       .",
 ].join("\n");
 
 /** Guard verdict: { block, reason } to block / undefined to allow (askConfirm returns a Promise) */
@@ -251,15 +259,15 @@ export default function (pi: ExtensionAPI) {
 	// /guard slash command: view / switch guard mode
 	pi.registerCommand("guard", {
 		description:
-			"Path Guard modes: /guard shows the current mode, /guard <strict|normal|loose|trusted> switches",
+			"Path Guard modes: /guard shows the current mode, /guard <strict|normal|loose|trusted|naked> switches",
 		handler: async (args, ctx) => {
 			const m = args?.trim().toLowerCase() ?? "";
 
-			// Valid argument → switch directly (shortcut, no picker); trusted requires a warning confirmation
+			// Valid argument → switch directly (shortcut, no picker); trusted/naked require a warning confirmation
 			if (isGuardMode(m)) {
-				if (m === "trusted" && !(await confirmTrustedSwitch(ctx))) {
+				if (!(await confirmModeSwitch(m, ctx))) {
 					ctx.ui.notify(
-						"Cancelled: switching to trusted requires confirmation",
+						`Cancelled: switching to ${m} requires confirmation`,
 						"info",
 					);
 					return;
@@ -293,9 +301,9 @@ export default function (pi: ExtensionAPI) {
 			}
 			const picked = chosen.split(/\s+/)[0] as GuardMode;
 			if (isGuardMode(picked)) {
-				if (picked === "trusted" && !(await confirmTrustedSwitch(ctx))) {
+				if (!(await confirmModeSwitch(picked, ctx))) {
 					ctx.ui.notify(
-						"Cancelled: switching to trusted requires confirmation",
+						`Cancelled: switching to ${picked} requires confirmation`,
 						"info",
 					);
 					return;
@@ -330,6 +338,9 @@ function checkWriteEdit(
 	const path = input.path;
 	if (!path) return;
 
+	// naked disables ALL checks (incl. protected paths & the write/edit tools) → pass everything
+	if (currentMode === "naked") return;
+
 	// Resolve the real cwd first (cwd may itself be a symlink), then the real target path,
 	// preventing symlink escape to protected locations and symlink-cwd false positives
 	const realCwd = resolveReal(ctx.cwd);
@@ -434,6 +445,14 @@ function classifySegment(
 	// Recursion depth guard (bash -c / eval nested too deep to statically check → conservative confirm)
 	if (depth > 4) return { kind: "confirm" };
 
+	// naked: pass everything EXCEPT system-destructive Block-group commands, which are confirmed
+	// (protected paths, write/edit, git destructive, truncate, etc. all pass in naked mode)
+	if (currentMode === "naked") {
+		return dangerousLevel(trimmed) === "block"
+			? { kind: "confirm" }
+			: { kind: "pass" };
+	}
+
 	// ① Redirect check:
 	//    - Write to a protected path (echo x > .env etc.) → block
 	//    - "> existing file" (truncate, not >> append, not a device) → confirm
@@ -1270,6 +1289,34 @@ async function confirmTrustedSwitch(
 	);
 }
 
+/** Double confirmation before switching to naked: disables ALL protection (incl. protected paths, destructive commands, and write/edit checks) */
+async function confirmNakedSwitch(
+	ctx: ExtensionCommandContext,
+): Promise<boolean> {
+	// No UI (headless) cannot confirm → conservatively refuse the switch
+	if (!ctx.hasUI) return false;
+	const first = await ctx.ui.confirm(
+		"⚠️ Switch to NAKED mode?",
+		"naked passes nearly everything: protected paths (.env/.ssh/keys), write/edit tool checks, git\ndestructive ops, truncation, and outside deletes/overwrites are no longer blocked or prompted.\nOnly system-destructive commands (mkfs/reboot/bulk-delete/block-device writes) are still\nconfirmed — everything else is allowed without a prompt.",
+	);
+	if (!first) return false;
+	// Second, final confirmation — makes an accidental /guard naked far less likely
+	return ctx.ui.confirm(
+		"⚠️⚠️ FINAL confirmation — disable ALL protection?",
+		"This is the final step. After this, path-guard passes nearly every operation with no blocking and\nno confirmation, including writes to protected paths and git destructive / truncate / outside\ndelete operations. Only system-destructive commands (mkfs/reboot/bulk-delete/block-device\nwrites) will still prompt for confirmation.\n\nOnly switch if you are certain you want minimal protection.",
+	);
+}
+
+/** Mode-switch confirmation: trusted → single warn; naked → double warn; others → no confirmation */
+async function confirmModeSwitch(
+	mode: GuardMode,
+	ctx: ExtensionCommandContext,
+): Promise<boolean> {
+	if (mode === "trusted") return confirmTrustedSwitch(ctx);
+	if (mode === "naked") return confirmNakedSwitch(ctx);
+	return true;
+}
+
 async function askConfirm(
 	ctx: ExtensionContext,
 	message: string,

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@yaosu/pi-path-guard",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "type": "module",
-  "description": "Path Guard for pi — blocks destructive commands & path overwrites, protects .env/keys, with strict/normal/loose/trusted guard modes (/guard). pi 防误删/防误覆盖扩展，支持 4 种防护模式。",
+  "description": "Path Guard for pi — blocks destructive commands & path overwrites, protects .env/keys, with strict/normal/loose/trusted/naked guard modes (/guard). pi 防误删/防误覆盖扩展，支持 5 种防护模式。",
   "keywords": [
     "pi-package",
     "pi-extension",