@zeldrisho/pi-gate 0.7.0 → 0.7.1

package/CHANGELOG.md

@@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.7.1] - 2026-10-25
+
+### Changed
+
+- Create starter configuration when a session starts rather than when the extension is loaded.
+
+### Fixed
+
+- Cancel active approval dialogs and reject queued calls during shutdown, reload, and session replacement.
+
 ## [0.7.0] - 2026-10-24
 
 ### Changed
@@ -95,7 +105,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - support `prompt`, `block`, and `allow` actions, with longest-pattern-wins resolution
 - block rather than auto-approve in non-UI modes
 
-[Unreleased]: https://github.com/zeldrisho/pi-packages/compare/pi-gate-v0.7.0...HEAD
+[Unreleased]: https://github.com/zeldrisho/pi-packages/compare/pi-gate-v0.7.1...HEAD
+[0.7.1]: https://github.com/zeldrisho/pi-packages/compare/pi-gate-v0.7.0...pi-gate-v0.7.1
 [0.7.0]: https://github.com/zeldrisho/pi-packages/compare/pi-gate-v0.6.1...pi-gate-v0.7.0
 [0.6.1]: https://github.com/zeldrisho/pi-packages/compare/pi-gate-v0.6.0...pi-gate-v0.6.1
 [0.6.0]: https://github.com/zeldrisho/pi-packages/compare/pi-gate-v0.5.0...pi-gate-v0.6.0

package/README.md

@@ -15,7 +15,7 @@ Use `pi config` to enable or disable this extension interactively. Run `pi list`
 
 ## Configure
 
-Edit `~/.pi/agent/gate.json` to choose which commands need approval. The extension creates this file with starter rules on first load. Changes apply before the next gated call, without restarting Pi. Add the optional `$schema` below for editor completion and validation:
+Edit `~/.pi/agent/gate.json` to choose which commands need approval. The extension creates this file with starter rules when the first session starts. Changes apply before the next gated call, without restarting Pi. Add the optional `$schema` below for editor completion and validation:
 
 ```json
 {
@@ -46,7 +46,7 @@ pi-gate is a guard rail, not a sandbox. Complex shell syntax, pipelines, redirec
 
 The built-in `bash` tool is gated, and `write`/`edit` calls targeting the gate config require approval. Prompt dialogs offer `Allow` and `Deny`; approvals are never remembered. To stop repeated prompts, add a specific `allow` rule to `gate.json`.
 
-Approval dialogs are serialized for concurrent tool calls; cancellation, session replacement, or a policy change while a dialog is open denies the pending call.
+Approval dialogs are serialized for concurrent tool calls; cancellation, shutdown, reload, session replacement, or a policy change while a dialog is open denies the pending call. Calls queued before shutdown or session replacement are also denied.
 
 Long commands are truncated in approval dialogs, but an approved command executes in full. Denied, dismissed, blocked, and timed-out calls stop the turn; other allowed calls in a parallel batch may still run. In non-interactive modes (`-p`, JSON), commands requiring approval are denied.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zeldrisho/pi-gate",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Pi extension that gates bash commands and protects its configuration from tool edits",
   "keywords": [
     "command-blocking",
@@ -33,6 +33,7 @@
   },
   "devDependencies": {
     "@earendil-works/pi-coding-agent": "^1.4.0",
+    "typebox": "^1.4.2",
     "typescript": "^7.0.2",
     "vite": "npm:@voidzero-dev/vite-plus-core@1.3.0",
     "vite-plus": "1.3.0"

package/src/index.ts

@@ -19,7 +19,7 @@
  * Matching is case-insensitive and whitespace-normalized. Allow occurrences
  * suppress contained restrictions in the same command; surviving blocks win.
  *
- * On first run, a configuration with the default prompt timeout and starter
+ * On first session start, a configuration with the default prompt timeout and starter
  * operation rules is written to `~/.pi/agent/gate.json` when neither file exists.
  *
  * Non-UI modes (print, JSON) never auto-approve. A `prompt` or `block` rule
@@ -112,14 +112,16 @@ export {
 
 /**
  * Gates `bash` calls against user rules and requires approval for protected
- * configuration writes and edits. Attempts to create a starter configuration if absent.
+ * configuration writes and edits. Attempts to create a starter configuration
+ * at session start if absent.
  * Reloads rules before gating and after each prompt; approvals apply per call.
- * Dialogs are serialized, and cancellation, session starts, or policy changes
- * invalidate an active approval. UI failures reject the affected tool call.
+ * Dialogs are serialized. Cancellation, shutdown, and session replacement deny
+ * active and queued gated calls; policy changes invalidate an active approval.
+ * UI failures reject the affected tool call.
  */
 export default function piGate(pi: ExtensionAPI): void {
-  ensureConfig();
   let loadResult = loadConfigResult();
+  let session = new AbortController();
   let policy = JSON.stringify(loadResult);
   let revision = 0;
   let pending = Promise.resolve();
@@ -135,8 +137,16 @@ export default function piGate(pi: ExtensionAPI): void {
     }
   };
 
+  pi.on("session_shutdown", () => {
+    session.abort();
+    revision += 1;
+  });
+
   pi.on("session_start", (_event, ctx) => {
+    session.abort();
+    session = new AbortController();
     revision += 1;
+    ensureConfig();
     refreshConfig();
     const path = configPath();
     const ruleCount = Object.keys(loadResult.config.operations).length;
@@ -160,7 +170,14 @@ export default function piGate(pi: ExtensionAPI): void {
   });
 
   pi.on("tool_call", (event, ctx) => {
+    // Capture ownership before queueing so old calls cannot enter a replacement session.
+    const signal = ctx.signal ? AbortSignal.any([ctx.signal, session.signal]) : session.signal;
+
     // Pi can dispatch sibling tools concurrently; never overlap approval dialogs.
+    /**
+     * Returns a terminating block result for denied calls, or undefined to allow;
+     * UI errors propagate.
+     */
     const run = async (): Promise<ToolCallEventResult | undefined> => {
       let command: string;
       let configChange = false;
@@ -181,6 +198,14 @@ export default function piGate(pi: ExtensionAPI): void {
         return undefined;
       }
 
+      if (signal.aborted) {
+        return {
+          block: true,
+          reason: "pi-gate: approval cancelled; command not run.",
+          terminate: true,
+        };
+      }
+
       refreshConfig();
 
       const match = configChange
@@ -210,14 +235,6 @@ export default function piGate(pi: ExtensionAPI): void {
         };
       }
 
-      if (ctx.signal?.aborted) {
-        return {
-          block: true,
-          reason: "pi-gate: approval cancelled; command not run.",
-          terminate: true,
-        };
-      }
-
       const promptRevision = revision;
 
       reportHerdrBlocked(pi, ctx, true);
@@ -234,7 +251,7 @@ export default function piGate(pi: ExtensionAPI): void {
         choice = await ctx.ui.select(
           `pi-gate: allow this command?\n\n${promptCommand}\n\nMatched rule: ${rule}${configChange ? "" : "\nMatched command text is wrapped in »…«"}`,
           ["Allow", "Deny"],
-          { timeout: timeoutMs, signal: ctx.signal },
+          { timeout: timeoutMs, signal },
         );
         // Pi returns undefined for both dismissal and timeout; elapsed time separates the timeout case.
         timedOut = choice === undefined && Date.now() - promptStartedAt >= timeoutMs;
@@ -244,7 +261,7 @@ export default function piGate(pi: ExtensionAPI): void {
 
       refreshConfig();
 
-      if (ctx.signal?.aborted || revision !== promptRevision) {
+      if (signal.aborted || revision !== promptRevision) {
         return {
           block: true,
           reason: