auto-permission-system 3.0.1 → 3.7.8

package/README.md

@@ -11,7 +11,7 @@ It puts allow/deny rules, interactive ask prompts, secret detection and an audit
 
 Enforcement happens in three layers:
 
-- **Layer 1** — OS-level bash sandbox (`sandbox-exec` on macOS, `bubblewrap` on Linux) that blocks filesystem writes outside an allow-list, reads of sensitive paths, reads outside the project when `outsideProject.read` gates them, and network egress to unlisted domains.
+- **Layer 1** — OS-level bash sandbox (`sandbox-exec` on macOS, `bubblewrap` on Linux) that blocks filesystem writes outside an allow-list, reads of sensitive paths, reads outside the project when `outsideProject.read` gates them, and network egress to unlisted domains — an unknown host asks first (a host in `deniedDomains` never does), with the same once/session/remember options as Layer 2.
 - **Layer 2** — In-process tool guard applying the same policy to the tools the OS sandbox can't reach: `read`, `grep`, `find`, `ls`, `write`, `edit`, `fetch_content`, `web_search`, `get_search_content`. `grep` output lines from denied files beneath an allowed search root are removed before the model sees them.
 - **Layer 3** — Subagent posture: optionally drop or restrict network access when running headless (`-p`, JSON mode, subagents).
 
@@ -72,11 +72,12 @@ A higher layer only states what it changes; absent keys keep the layer below. A
   "enabled": true,                      // set false to disable Layer 2 without --yolo
   "mode": "default",                   // "default" (rules) | "advanced-secure" (secret detection, ADR-018)
   "network": {
-    "allowedDomains": [                 // domains fetch_content / get_search_content may reach
+    "allowedDomains": [                 // domains the URL tools and bash may reach
       "github.com", "*.github.com",
       "registry.npmjs.org"
     ],
-    "deniedDomains": []                 // explicit block-list (checked before allowedDomains)
+    "deniedDomains": [],                // hard deny, checked first, never ask-able
+    "strictAllowlist": false            // true = deny unknown hosts instead of asking
   },
   "filesystem": {
     "denyRead": ["~/.ssh", "~/.aws", "~/.pi/agent"],  // Layer 1 + Layer 2: no read at all
@@ -88,6 +89,14 @@ A higher layer only states what it changes; absent keys keep the layer below. A
   "subagent": {
     "network": "allow"                  // "allow" | "deny" | "research-only"
   },
+  "mcp": {                              // Advanced Secure MCP gate tuning (ADR-032)
+    "allowTools": ["mcp__diffusion_studio__context"],  // exact names that never ask
+    "allowPrefixes": ["mcp__ticktick__get_"],          // name prefixes that never ask
+    "askTools": [],                    // exact names that always ask
+    "trustAnnotations": false,         // true = a server's readOnlyHint allows without asking
+    "allowSimpleUpdates": true,        // narrow field updates skip the ask
+    "askThreshold": 30                 // risk score at which a call asks (lower = stricter)
+  },
   "commands": {
     "ask": ["printenv", "env", "/proc/*/environ"]  // bash: ask before these (they can print env tokens)
   }
@@ -123,9 +132,9 @@ Never asked about: the project itself, your `allowWrite` roots, pi's own package
 
 ### Ask-tier prompt
 
-`no — block` is pre-selected, so Enter alone blocks. Besides `yes — this once` and the persistent `always` options there is `yes — for this session` (this file, its folder, or this domain), kept in memory until the session ends and never saved (ADR-010). For a bash write that the sandbox refused after the command already ran, `yes — this once` re-runs the command once with that folder allowed for the one invocation only (never saved), and `denyWrite` still wins. The refusal is read from the command's own error text — `EPERM` / `Operation not permitted` on macOS, `EROFS` / `Read-only file system` on Linux (ADR-022) — so a Linux EROFS gets the same prompt instead of a silent read-only failure; a refused write is never mistaken for an outside-project read.
+`no — block` is pre-selected, so Enter alone blocks. **Network (domain) asks are the exception** (ADR-024): the countdown default is `Allow once` — the footer reads `Default: Yes, just this once (15s)` — so an unanswered countdown counts as allow-once for that bash command, while Enter and Esc still block/deny. Once you press ↑/↓ the `Default:` line disappears and the 15s activity timer restarts (ADR-031). The prompt is keyboard-only (ADR-036): ↑/↓ move the highlight, Enter selects, Esc cancels — a mouse click or wheel over the prompt does nothing. Besides `yes — this once` and the persistent `always` options there is `yes — for this session` (this file, its folder, or this domain), kept in memory until the session ends and never saved (ADR-010). A bash command that reaches a domain outside `allowedDomains` gets the same prompt (ADR-023); because the sandbox proxy asks per connection, `yes — this once` covers that command's connections to the host, and a remembered host is written to `overrides.allowDomains` and applies immediately. Hosts in `deniedDomains`, or with `strictAllowlist: true`, are blocked without a prompt. Prompts are shown one at a time: the extension serializes them, because pi's selector is a singleton and two overlapping prompts can orphan each other and hang the waiting connection. For a bash write that the sandbox refused after the command already ran, `yes — this once` re-runs the command once with that folder allowed for the one invocation only (never saved), and `denyWrite` still wins. The refusal is read from the command's own error text — `EPERM` / `Operation not permitted` on macOS, `EROFS` / `Read-only file system` on Linux (ADR-022) — so a Linux EROFS gets the same prompt instead of a silent read-only failure; a refused write is never mistaken for an outside-project read.
 
-Every prompt waits **10 seconds** by default. If you do not answer, it resolves to the safe default: **block / deny**.
+Every prompt waits **10 seconds** by default. For file reads and writes, no answer resolves to the safe default: **block / deny**. For a network ask, no answer resolves to **allow once** (ADR-024); Esc still denies.
 
 ### File-name patterns
 
@@ -138,7 +147,7 @@ An entry without `/` or `~` (`.env`, `*.key`) is a file name. pi's own tools (La
 - **`default`** (shipped) — rules only: sandbox.json paths, domains, and commands. Nothing inspects file contents.
 - **`advanced-secure`** (recommended) — adds secret/credential detection:
   - **File reads:** a filename that looks like a credential store asks before the read.
-  - **MCP calls:** `mcp__<server>__<tool>` calls are classified; a risky (mutating/destructive) call asks before it runs.
+  - **MCP calls:** `mcp__<server>__<tool>` calls are classified; a risky call asks before it runs. The gate ignores the server namespace, reads the operation from the head verb of the tool name (or the first verb of the description), and asks for destructive names, mutating names (`update_*`, `create_*`, `run_*`, `evaluate_*`), and destructive arguments (SQL `DELETE`, `rm -rf`, `*` targets, HTTP `DELETE`, production targets). A documented tool with an unclassified name (`context`, `capture`, `logs`) does not ask; a tool with no description counts as opaque and does. Tune it under `mcp` in `sandbox.json` — `allowTools` / `allowPrefixes` skip asks, `askTools` forces them, `trustAnnotations` trusts a server's `readOnlyHint`, `askThreshold` moves the score line (ADR-032).
   - **Tool/command/file output:** before any output reaches the model, a secret-like hit shows `⚠ Sensitive information detected`, the file, and each detected line as `lineNo: text`, and the question **Should the AI be allowed to see it?** with two choices — **No, keep private** or **Yes, allow**. A bare `key` counts only when the value looks machine-generated: `key=<random>` asks, while `key=value`, `key=subagent.network`, and code such as `const key = x` stay clean. No, keep private withholds the output and tells the model plainly that the output was withheld because it may contain sensitive information, so the model does not mistake it for a failure or an empty result. Esc or timeout keeps it private.
 
 Detection can only **add** asks or blocks; it never loosens a rule. The mode is layered like every other key: an untrusted project may opt *in* to `advanced-secure`, but only a trusted project (or the global file) may turn it off.
@@ -200,7 +209,7 @@ Every block/allow/always decision is appended to `~/.pi/agent/audit.log` as a JS
 ## FAQ
 
 ### How do I allow the agent to reach a new domain?
-Add it to `network.allowedDomains` in a policy file (global `~/.pi/agent/extensions/sandbox.json` or project `<cwd>/.pi/sandbox.json`), or just run the tool once and pick an **always** option in the ask prompt — that writes the domain to the project file for you.
+Add it to `network.allowedDomains` in a policy file (global `~/.pi/agent/extensions/sandbox.json` or project `<cwd>/.pi/sandbox.json`), or just run the tool (or a bash `curl`) once and pick an **always** option in the ask prompt — that writes the domain to the project file for you.
 
 ### How do I allow writes to another folder?
 Add the folder to `filesystem.allowWrite`. Relative paths (`.`, `/tmp`) resolve from the project root.

package/extensions/guard.ts

@@ -11,15 +11,18 @@ import { isAbsolute, join, resolve } from "node:path";
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { isToolCallEventType, getAgentDir } from "@earendil-works/pi-coding-agent";
 import { filterGrepOutput, policyFileError, forgetProjectTrust, isProjectFileDeclined, recordProjectDeclined, recordProjectTrust } from "../src/core/index";
-import { classifyFilename, evaluateMcpCall, type JsonSchemaLike, type McpToolAnnotations } from "../src/detect/index";
+import { classifyFilename, evaluateMcpCall, type JsonSchemaLike, type McpPolicy, type McpToolAnnotations } from "../src/detect/index";
 import { collectExposure } from "../src/l2-guard/exposure";
 import { askExposure, askMain, withheldNotice } from "../src/ui/ask-flow";
 import { loadPolicy, projectPolicyPath, projectTrusted, setPiDeclinedTrust, untrustedProjectChanges, bullets, TRUST_STORE } from "../src/l2-guard/policy";
 import { canonicalize, expandHome, isAbsoluteDeny, isAskRead, isDeniedRead, isDeniedWrite, outsideProjectReason } from "../src/l2-guard/matching";
-import { hostnameOf, isAllowedUrl } from "../src/l2-guard/url";
+import { deniedUrlReason, hostnameOf, isAllowedUrl } from "../src/l2-guard/url";
 import { audit, AUDIT_PATH } from "../src/shared/audit";
 import { askOrBlock, clearSessionGrants, sessionGrantSummary, type UICtx } from "../src/l2-guard/prompts";
-import { denyMessage } from "../src/l2-guard/ask";
+import { grantProgramOutputSession, isProgramOutputGranted, clearProgramOutputSessionGrants, programOutputSessionGrantSummary } from "../src/l2-guard/program-grants";
+import { programIdForToolCall } from "../src/l2-guard/program-id";
+import { denyMessage } from "../src/ui/ask";
+import { emitDomainGrant } from "../src/shared/network-grants";
 import { subagentNetworkBlock } from "../src/l2-guard/subagent";
 import { onYolo } from "../src/shared/yolo";
 
@@ -35,6 +38,11 @@ function detectionBlock(action: "read" | "tool", why: string): string {
 	return `Tool call blocked by policy: ${why}. Nothing was run — ask the user.`;
 }
 
+/** Maps each in-flight tool call to the program id we'll show in the
+ *  Advanced Secure output gate. Populated at `tool_call`, consumed at
+ *  `tool_result`, cleared at `session_start`. */
+const programIdByCallId = new Map<string, string>();
+
 async function askDetection(
 	ctx: UICtx,
 	kind: "read" | "tool",
@@ -69,6 +77,7 @@ async function detectMcpAsk(
 	toolName: string,
 	input: Record<string, unknown>,
 	ctx: UICtx,
+	mcpPolicy?: McpPolicy,
 ): Promise<{ block: true; reason: string } | null> {
 	const info = pi.getAllTools().find((t) => t.name === toolName);
 	const result = evaluateMcpCall({
@@ -79,6 +88,7 @@ async function detectMcpAsk(
 			annotations: /* SAFETY: pi's ToolAnnotations mirrors the MCP hints McpToolAnnotations names. */ info?.annotations as McpToolAnnotations | undefined,
 		},
 		call: { name: toolName, arguments: input },
+		policy: mcpPolicy,
 	});
 	if (result.decision !== "ask") return null;
 	return askDetection(ctx, "tool", toolName, result.summary);
@@ -93,10 +103,6 @@ export default function (pi: ExtensionAPI) {
 		active = policyEnabled && !runtimeYolo;
 	};
 
-	// `--yolo` and the `/permission-mode` toggle both arrive on pi's process-wide
-	// bus; `sandbox.ts` is the only extension that registers the CLI flags and
-	// broadcasts the state (ADR-020). The entrypoints share no memory, so this is
-	// the only channel that reaches Layer 2.
 	onYolo(pi.events, (enabled) => {
 		runtimeYolo = enabled;
 		applyActive();
@@ -104,8 +110,6 @@ export default function (pi: ExtensionAPI) {
 	});
 
 	pi.on("session_start", (_event, ctx) => {
-		// A policy file that does not parse is skipped and the defaults apply.
-		// Say so loudly: otherwise one trailing comma silently disables the whole file.
 		for (const p of [`${getAgentDir()}/extensions/sandbox.json`, `${ctx.cwd}/.pi/sandbox.json`]) {
 			const err = policyFileError(p);
 			if (!err) continue;
@@ -135,14 +139,17 @@ export default function (pi: ExtensionAPI) {
 		applyActive();
 		clearSessionGrants();
 		detectionGrants.clear();
+		clearProgramOutputSessionGrants();
+		programIdByCallId.clear();
 	});
 
 	pi.on("tool_call", async (event, ctx) => {
 		if (!active) return;
 		const policy = loadPolicy(ctx.cwd);
 
-		// --- Path-based gates (with ask-tier prompt) ---
-		// One gate for every read: the read policy first, then the project boundary.
+		const programId = programIdForToolCall(event.toolName, event.input);
+		if (event.toolCallId && programId) programIdByCallId.set(event.toolCallId, programId);
+
 		const gateRead = async (rawPath: string, tool: string) => {
 			const abs = canonicalize(rawPath, ctx.cwd);
 			let reason = isDeniedRead(rawPath, ctx.cwd, policy);
@@ -174,10 +181,6 @@ export default function (pi: ExtensionAPI) {
 				}
 			}
 		}
-		// Read-only search tools. grep returns file contents and runs ripgrep in
-		// process, so neither the bash sandbox nor the read gate saw it before.
-		// Gate the search root here; tool_result below drops output lines from
-		// denied files beneath the root.
 		const searchRoot = isToolCallEventType("grep", event) || isToolCallEventType("find", event) || isToolCallEventType("ls", event)
 			? (event.input.path ?? ".")
 			: null;
@@ -202,7 +205,6 @@ export default function (pi: ExtensionAPI) {
 			}
 		}
 
-		// --- URL/domain gates (best-effort by tool name; tools are extension-defined) ---
 		const input = event.input as Record<string, unknown> | undefined;
 		const collectUrls = (): string[] => {
 			if (!input) return [];
@@ -218,10 +220,17 @@ export default function (pi: ExtensionAPI) {
 			const saReason = subagentNetworkBlock(ctx as { hasUI?: boolean; sessionManager?: unknown }, policy);
 			if (saReason) return { block: true, reason: saReason };
 			for (const u of collectUrls()) {
+				const denied = deniedUrlReason(u, policy);
+				if (denied) {
+					audit({ layer: 2, tool: event.toolName, subject: u, reason: denied, decision: "no", note: "denied-domain", cwd: ctx.cwd });
+					return { block: true, reason: denyMessage("allowDomains", denied) };
+				}
 				const reason = isAllowedUrl(u, policy);
 				if (!reason) continue;
 				const host = hostnameOf(u) ?? u;
-				const result = await askOrBlock(/* SAFETY: pi's ctx carries cwd/UI at runtime. */ ctx as unknown as UICtx, { layer: 2, tool: event.toolName, subject: u, reason, overrideKind: "allowDomains", overrideValue: host }, null);
+				const result = await askOrBlock(/* SAFETY: pi's ctx carries cwd/UI at runtime. */ ctx as unknown as UICtx, { layer: 2, tool: event.toolName, subject: u, reason, overrideKind: "allowDomains", overrideValue: host }, null, (kind, value) => {
+					if (kind === "allowDomains") emitDomainGrant(pi.events, value);
+				});
 				if (result) return result;
 			}
 		}
@@ -229,22 +238,14 @@ export default function (pi: ExtensionAPI) {
 		if (event.toolName === "web_search") {
 			const saReason = subagentNetworkBlock(ctx as { hasUI?: boolean; sessionManager?: unknown }, policy);
 			if (saReason) return { block: true, reason: saReason };
-			// web_search itself goes to the search provider (out of scope for v1
-			// allowlist). The follow-on fetch_content for individual results is
-			// the catchable surface.
 		}
 
-		// Advanced Secure (ADR-018): classify MCP tool calls before they run.
 		if (policy.mode === "advanced-secure" && event.toolName.startsWith("mcp__")) {
-			const det = await detectMcpAsk(pi, event.toolName, (event.input ?? {}) as Record<string, unknown>, /* SAFETY: pi's ctx carries cwd/UI at runtime. */ ctx as unknown as UICtx);
+			const det = await detectMcpAsk(pi, event.toolName, (event.input ?? {}) as Record<string, unknown>, /* SAFETY: pi's ctx carries cwd/UI at runtime. */ ctx as unknown as UICtx, policy.mcp);
 			if (det) return det;
 		}
 	});
 
-	// grep output filter. A root that passed the gate can still contain denied
-	// files (`.env`, `*.pem`, `~/.ssh` under a search of `~`). Approving the
-	// root does not approve the denied files beneath it. Runs before the
-	// result reaches the model.
 	pi.on("tool_result", (event, ctx) => {
 		if (!active || event.toolName !== "grep" || event.isError) return;
 		const input = event.input as { path?: string } | undefined;
@@ -256,7 +257,6 @@ export default function (pi: ExtensionAPI) {
 		} catch {
 			return;
 		}
-		// A single-file search prints only the basename; its root gate already decided.
 		if (!rootIsDir) return;
 		let removedLines = 0;
 		const removedFiles = new Set<string>();
@@ -273,25 +273,39 @@ export default function (pi: ExtensionAPI) {
 		return { content };
 	});
 
-	// Advanced Secure (ADR-018): before any tool output reaches the model, ask
-	// the user when it looks like it carries a secret. Block withholds it and
-	// tells the model plainly, so the model does not read it as a failure or an
-	// empty result; Allow send passes the real values through.
 	pi.on("tool_result", async (event, ctx) => {
 		if (!active || event.isError) return;
 		const policy = loadPolicy(ctx.cwd);
 		if (policy.mode !== "advanced-secure") return;
+		const programId = event.toolCallId ? programIdByCallId.get(event.toolCallId) : undefined;
+		if (programId && isProgramOutputGranted(programId)) {
+			audit({ layer: 2, tool: event.toolName, decision: "session-grant", grant: programId, note: "advanced-secure-output", cwd: ctx.cwd });
+			return;
+		}
 		const rawInput = event.input ?? {};
 		const rawPath = rawInput.path ?? rawInput.file_path;
-		const subject = typeof rawPath === "string" && rawPath ? rawPath : event.toolName;
+		const subject = (() => {
+			if (typeof rawPath === "string" && rawPath) return rawPath;
+			if (event.toolName === "bash") {
+				const cmd = (event.input as { command?: string } | undefined)?.command;
+				return cmd ? `bash: ${cmd}` : "bash";
+			}
+			return event.toolName;
+		})();
 		const { types, hits } = collectExposure(event.content, subject);
 		if (!types.length) return;
 		const findings = types;
 		const ui = /* SAFETY: pi's ctx carries cwd/UI at runtime; the local type only names the members used. */ ctx as unknown as UICtx;
-		const allow = ui.hasUI !== false && (await askExposure(ui, hits)) === "allow";
-		if (allow) {
-			audit({ layer: 2, tool: event.toolName, decision: "yes", note: "advanced-secure-output", findings, cwd: ctx.cwd });
-			ctx.ui.notify(`🛡 Advanced Secure: you allowed ${event.toolName} output to be sent.`, "warning");
+		const choice = ui.hasUI !== false ? await askExposure(ui, hits, programId) : "block";
+		if (choice === "allow" || choice === "program-session") {
+			if (choice === "program-session" && programId) {
+				grantProgramOutputSession(programId);
+				audit({ layer: 2, tool: event.toolName, decision: "session", grant: programId, note: "advanced-secure-output", findings, cwd: ctx.cwd });
+				ctx.ui.notify(`🛡 Advanced Secure: you allowed all ${programId} output for the rest of this session.`, "info");
+			} else {
+				audit({ layer: 2, tool: event.toolName, decision: "yes", note: "advanced-secure-output", findings, cwd: ctx.cwd });
+				ctx.ui.notify(`🛡 Advanced Secure: you allowed ${event.toolName} output to be sent.`, "warning");
+			}
 			return;
 		}
 		audit({ layer: 2, tool: event.toolName, decision: "no", note: "advanced-secure-output", findings, cwd: ctx.cwd });
@@ -371,6 +385,19 @@ export default function (pi: ExtensionAPI) {
 				`  allowWrite:   ${(overrides.allowWrite ?? []).join(", ") || "(none)"}`,
 				`  allowDomains: ${(overrides.allowDomains ?? []).join(", ") || "(none)"}`,
 			];
+			if (policy.mode === "advanced-secure") {
+				const mcp = policy.mcp ?? {};
+				lines.push(
+					"",
+					"Advanced Secure (MCP gate, ADR-032):",
+					`  allowTools:       ${(mcp.allowTools ?? []).join(", ") || "(none)"}`,
+					`  allowPrefixes:    ${(mcp.allowPrefixes ?? []).join(", ") || "(none)"}`,
+					`  askTools:         ${(mcp.askTools ?? []).join(", ") || "(none)"}`,
+					`  trustAnnotations: ${mcp.trustAnnotations === true}`,
+					`  allowSimpleUpdates: ${mcp.allowSimpleUpdates !== false}`,
+					`  askThreshold:     ${mcp.askThreshold ?? 30}`,
+				);
+			}
 			try {
 				const tail = readFileSync(AUDIT_PATH, "utf-8").trim().split("\n").slice(-10);
 				if (tail.length && tail[0]) {
@@ -378,7 +405,6 @@ export default function (pi: ExtensionAPI) {
 					for (const l of tail) lines.push(`  ${l}`);
 				}
 			} catch {
-				/* no audit log yet */
 			}
 			ctx.ui.notify(lines.join("\n"), "info");
 		},

package/extensions/permission-mode.ts

@@ -84,9 +84,17 @@ async function pickMode(pi: ExtensionAPI, ctx: ExtensionContext, yolo: { active:
 		MODES.map((m) => m.label),
 		{ timeout: 120_000 },
 	);
-	if (picked === undefined) return; // Esc / timeout → keep the current mode
+	if (picked === undefined) return;
 	const next = MODES.find((m) => m.label === picked)?.value ?? current;
 	if (next === current) {
+		if (next === "yolo" && !yolo.active) {
+			yolo.active = true;
+			emitYolo(pi.events, true);
+			audit({ layer: 0, event: "permission-mode", mode: "yolo", cwd: ctx.cwd, note: "runtime-sync" });
+			renderSandboxChip(ctx);
+			ctx.ui.notify("⚠️  YOLO — all security layers disabled for this session.", "warning");
+			return;
+		}
 		ctx.ui.notify(`Permission mode is already ${modeLabel(next)}.`, "info");
 		return;
 	}
@@ -98,8 +106,6 @@ async function pickMode(pi: ExtensionAPI, ctx: ExtensionContext, yolo: { active:
 		return;
 	}
 	yolo.active = next === "yolo";
-	// Layers off/on in place, without a restart. `--yolo` keeps its own flag
-	// value; this only flips the runtime state.
 	emitYolo(pi.events, yolo.active);
 	audit({ layer: 0, event: "permission-mode", mode: next, cwd: ctx.cwd });
 	renderSandboxChip(ctx);
@@ -109,8 +115,6 @@ async function pickMode(pi: ExtensionAPI, ctx: ExtensionContext, yolo: { active:
 
 export default function (pi: ExtensionAPI) {
 	const yolo = { active: false };
-	// `sandbox.ts` owns the CLI flags and broadcasts the startup state, so the
-	// menu shows the truth even when `--yolo` was passed for this run only.
 	onYolo(pi.events, (enabled) => {
 		yolo.active = enabled;
 	});

package/extensions/sandbox.ts

@@ -30,16 +30,19 @@
 
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { createBashTool } from "@earendil-works/pi-coding-agent";
-import { createSandboxedBashOps } from "../src/l1-sandbox/bash-ops";
-import { initSandbox, persistLayer1Override, reloadSandbox, resetSandbox } from "../src/l1-sandbox/manager";
-import { loadConfig, setPiDeclinedTrust } from "../src/l1-sandbox/config";
+import { clearFilesystemSessionGrants, createSandboxedBashOps, filesystemSessionGrantSummary } from "../src/l1-sandbox/bash-ops";
+import { applyNetworkGrant, initSandbox, persistLayer1Override, reloadSandbox, resetSandbox, writeNetworkOverride } from "../src/l1-sandbox/manager";
+import { clearNetworkSessionGrants, type NetworkAskCtx, type NetworkAskDeps } from "../src/l1-sandbox/network-ask";
+import { loadConfig, projectTrusted, setPiDeclinedTrust } from "../src/l1-sandbox/config";
+import { audit } from "../src/shared/audit";
+import { onDomainGrant } from "../src/shared/network-grants";
 import { emitYolo, onYolo, registerYoloFlags, yoloFromFlags, YOLO_STATUS } from "../src/shared/yolo";
 
 export default function (pi: ExtensionAPI) {
-	// pi scopes flags per extension (ADR-020); registering here makes
-	// `yoloFromFlags(pi)` below read the real CLI value.
 	registerYoloFlags(pi);
 
+	onDomainGrant(pi.events, applyNetworkGrant);
+
 	const localCwd = process.cwd();
 	const localBash = createBashTool(localCwd);
 
@@ -48,10 +51,22 @@ export default function (pi: ExtensionAPI) {
 	let runtimeYolo = false;
 	let sandboxStarting: Promise<void> | null = null;
 	let latestCtx: ExtensionContext | undefined;
+	let latestBashCommand: string | undefined;
 	let activeCtx: { cwd: string; hasUI?: boolean; ui?: { select?: (t: string, o: string[], op?: { timeout?: number }) => Promise<string | undefined>; notify?: (m: string, l?: string) => void } } | undefined;
 
-	const persistAndReload = (absPath: string, scope: "cwd" | "global") => persistLayer1Override(localCwd, "allowWrite", absPath, scope);
-	const persistAndReloadRead = (absPath: string, scope: "cwd" | "global") => persistLayer1Override(localCwd, "allowRead", absPath, scope);
+	const persistAndReload = (absPath: string, scope: "cwd" | "global") => persistLayer1Override(localCwd, "allowWrite", absPath, scope, networkDeps(localCwd));
+	const persistAndReloadRead = (absPath: string, scope: "cwd" | "global") => persistLayer1Override(localCwd, "allowRead", absPath, scope, networkDeps(localCwd));
+
+	/** Layer 1 network ask wiring (ADR-023): the proxy asks for unknown hosts and applies grants live. */
+	const networkDeps = (cwd: string): NetworkAskDeps => ({
+		cwd,
+		getCtx: () => /* SAFETY: pi's runtime ctx carries ui.select/ui.notify; the local type names only the members used. */ activeCtx as unknown as NetworkAskCtx | undefined,
+		persist: (host, scope) => writeNetworkOverride(cwd, host, scope),
+		applyLive: applyNetworkGrant,
+		audit,
+		get projectTrusted() { return projectTrusted(cwd); },
+		get command() { return latestBashCommand; },
+	});
 
 	/** Bring the bash sandbox down; safe when it was never up. */
 	const stopSandbox = async (): Promise<void> => {
@@ -77,7 +92,7 @@ export default function (pi: ExtensionAPI) {
 			return;
 		}
 		try {
-			await initSandbox(ctx.cwd, config);
+			await initSandbox(ctx.cwd, config, networkDeps(ctx.cwd));
 			sandboxEnabled = true;
 			sandboxInitialized = true;
 			const networkCount = config.network?.allowedDomains?.length ?? 0;
@@ -97,17 +112,12 @@ export default function (pi: ExtensionAPI) {
 		}
 	};
 
-	// Runtime YOLO from `/permission-mode` (ADR-020): stop or restart the
-	// sandbox in place, without a session restart.
 	onYolo(pi.events, (enabled) => {
-		// The startup broadcast originates here; ignore our own echo.
 		if (enabled === runtimeYolo) return;
 		runtimeYolo = enabled;
 		const ctx = latestCtx;
 		if (!ctx) return;
 		if (!enabled) {
-			// Gate bash until the sandbox is back up, so turning YOLO off cannot
-			// leave a window where a command runs unfenced (ADR-020 follow-up).
 			sandboxStarting = startSandbox(ctx).finally(() => {
 				sandboxStarting = null;
 			});
@@ -140,13 +150,20 @@ export default function (pi: ExtensionAPI) {
 		return { operations: createSandboxedBashOps({ ctx: activeCtx, onAlways: persistAndReload, onAlwaysRead: persistAndReloadRead }) };
 	});
 
+	pi.on("tool_call", (event, _ctx) => {
+		if (event.toolName === "bash") {
+			const input = event.input as { command?: string };
+			if (typeof input.command === "string") latestBashCommand = input.command;
+		}
+	});
+
 	pi.on("session_start", async (_event, ctx) => {
 		latestCtx = ctx;
 		activeCtx = /* SAFETY: pi's runtime ctx carries cwd/hasUI/ui; the local type only names the fields we use. */ ctx as unknown as typeof activeCtx;
+		clearNetworkSessionGrants();
+		clearFilesystemSessionGrants();
 		setPiDeclinedTrust((ctx as { isProjectTrusted?: () => boolean }).isProjectTrusted?.() === false);
 		runtimeYolo = yoloFromFlags(pi) || loadConfig(ctx.cwd).mode === "yolo";
-		// Broadcast before any await: guard.ts consumes this on the same bus to
-		// learn YOLO is on (ADR-020).
 		emitYolo(pi.events, runtimeYolo);
 
 		if (runtimeYolo) {
@@ -175,7 +192,7 @@ export default function (pi: ExtensionAPI) {
 					return;
 				}
 				try {
-					await reloadSandbox(localCwd);
+					await reloadSandbox(localCwd, networkDeps(localCwd));
 					ctx.ui.notify("🔄 Sandbox reloaded from disk (global + project sandbox.json)", "info");
 				} catch (e) {
 					ctx.ui.notify(`Sandbox reload failed: ${e instanceof Error ? e.message : e}`, "error");
@@ -201,6 +218,7 @@ export default function (pi: ExtensionAPI) {
 				`  Allow Write: ${config.filesystem?.allowWrite?.join(", ") || "(none)"}`,
 				`  Deny Write: ${config.filesystem?.denyWrite?.join(", ") || "(none)"}`,
 				`  Outside project reads: ${config.filesystem?.outsideProject?.read ?? "allow"}`,
+				`  Session grants: ${filesystemSessionGrantSummary() || "(none)"}`,
 			];
 			ctx.ui.notify(lines.join("\n"), "info");
 		},

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auto-permission-system",
-  "version": "3.0.1",
+  "version": "3.7.8",
   "description": "Security sandbox, permission system and tool guard for the Pi coding agent (pi): enforce filesystem allow/deny lists and network domain allowlists on read, write, edit, bash, grep, find, ls, fetch_content and web_search, with interactive ask prompts, secret detection and an audit log.",
   "type": "module",
   "author": "Navin Kumar",
@@ -39,7 +39,8 @@
     "@anthropic-ai/sandbox-runtime": "^0.0.78"
   },
   "peerDependencies": {
-    "@earendil-works/pi-coding-agent": "*"
+    "@earendil-works/pi-coding-agent": "*",
+    "@earendil-works/pi-tui": "*"
   },
   "devDependencies": {
     "@commitlint/cli": "^21.2.3",

package/sandbox.example.json

@@ -119,6 +119,16 @@
     "network": "allow"
   },
 
+  "_comment_mcp": "Advanced Secure only. Tune the MCP tool-call gate (ADR-032). allowTools = exact tool names that never ask; allowPrefixes = name prefixes that never ask (e.g. 'mcp__ticktick__get_'); askTools = tool names that always ask; trustAnnotations = a server's readOnlyHint allows the call without asking; allowSimpleUpdates = narrow field updates skip the ask (default true); askThreshold = risk score at which calls ask (default 30, lower = stricter). Detected destructive calls always ask, unless an allowTools/allowPrefixes entry covers them (an explicit override). Unclassified names with a real description start at 25; a tool with no description counts as opaque and still asks. An untrusted project file may only tighten: it may add askTools, lower askThreshold, and turn allowSimpleUpdates/trustAnnotations off; allow lists need /security trust.",
+  "mcp": {
+    "allowTools": [],
+    "allowPrefixes": [],
+    "askTools": [],
+    "trustAnnotations": false,
+    "allowSimpleUpdates": true,
+    "askThreshold": 30
+  },
+
   "_comment_overrides": "Additive overrides written by ask-tier prompts. You can also edit by hand. These are merged on top of the main policy.",
   "overrides": {
     "allowRead": [],

package/skills/auto-permission-system/SKILL.md

@@ -14,7 +14,7 @@ Wraps the `bash` tool with `sandbox-exec` (macOS) or `bubblewrap` (Linux). Block
 - Filesystem writes outside `allowWrite`
 - Filesystem reads of `denyRead` paths (defaults include `~/.ssh`, `~/.aws`, `~/.gnupg`, `~/.pi/agent`)
 - Filesystem reads outside the project when `outsideProject.read` is `"ask"` or `"deny"` — when set, the home dir (and the project's parent) is fenced with `denyRead` and the project plus `allowWrite`/`outsideProject.allowRead` are re-exposed (ADR-014). With `"ask"`, a bash command that *plainly* names an outside path is confirmed with you **before it runs** (ADR-015): allow (`yes — this once`, or a persistent `always` grant) → the real, complete output; deny → the command is not run at all (no silently trimmed output). `install`/`npm` under `~/.pi/agent` are pre-allowed via `outsideProject.allowRead`, so they never prompt. Obfuscated reads still hit the fence and stay masked.
-- Network egress to domains not in `allowedDomains`
+- Network egress to domains not in `allowedDomains`: a host in neither list asks before the proxy decides (ADR-023) — `yes — this once` covers that bash command's connections to the host, `yes — for this session` lasts until the session ends, and `always` writes `overrides.allowDomains` and applies live. A host in `deniedDomains`, or `network.strictAllowlist: true`, is a hard deny that is never ask-able; headless blocks.
 
 **Layer 2 — In-process tool guard**
 Hooks `tool_call` for `read`, `grep`, `find`, `ls`, `write`, `edit`, `fetch_content`, `web_search`, `get_search_content`. Applies the same policy file as Layer 1. For `grep`, `find` and `ls` the search root is checked like a `read` path. A `tool_result` hook also removes `grep` output lines from denied files beneath an allowed root (for example a `.env` deep in the tree); approving the root does not approve those files. When a call is blocked, shows an interactive prompt with persistence options.
@@ -39,7 +39,8 @@ A higher layer only states what it changes; absent keys keep the layer below. A
   "mode": "default",                     // "default" (rules) | "advanced-secure" (secret detection, ADR-018)
   "network": {
     "allowedDomains": ["github.com", "*.github.com"],  // empty = allow all
-    "deniedDomains": []
+    "deniedDomains": [],                   // hard deny, never ask-able
+    "strictAllowlist": false               // true = deny unknown hosts instead of asking
   },
   "filesystem": {
     "denyRead": ["~/.ssh", "~/.pi/agent"],  // Layer 1 + 2: hard block (defaults add ~/.aws, ~/.gnupg)
@@ -49,6 +50,14 @@ A higher layer only states what it changes; absent keys keep the layer below. A
     "denyWrite": [".env", "*.pem"]   // Layer 1 + 2: always blocked
   },
   "subagent": { "network": "allow" },
+  "mcp": {                           // Advanced Secure MCP gate tuning (ADR-032)
+    "allowTools": ["mcp__diffusion_studio__context"],  // exact names that never ask
+    "allowPrefixes": ["mcp__ticktick__get_"],          // name prefixes that never ask
+    "askTools": [],                   // exact names that always ask
+    "trustAnnotations": false,        // true = a server's readOnlyHint allows without asking
+    "allowSimpleUpdates": true,       // narrow field updates skip the ask
+    "askThreshold": 30                // risk score at which a call asks (lower = stricter)
+  },
   "commands": {
     "ask": ["printenv", "env", "/proc/*/environ"]  // bash: ask before these (they can print env tokens)
   },
@@ -83,9 +92,13 @@ When a normal (non-absolute-deny) call is blocked:
 - **always for ALL projects** — whitelist in `~/.pi/agent/extensions/sandbox.json`
 - **always for ALL projects (folder)** — whitelist parent directory globally
 
+A **network** (domain) ask keeps the same rows, but the *unanswered* default flips (ADR-024): the footer reads `Default: Yes, just this once (15s)`, and a countdown that runs out counts as **allow once for this bash command**. `No` is still preselected (Enter blocks) and Esc still denies. A domain in `deniedDomains` (or `network.strictAllowlist: true`) never prompts.
+
 For a Layer 1 bash **write** blocked after the command already ran, `yes — this once` re-runs the command once with the offending path's parent folder allowed for that invocation only (never saved); the same folder is not offered again within that invocation, and `denyWrite` still wins over the grant. The block is recognized from the error output either way it is reported — `EPERM`/`Operation not permitted` on macOS, `EROFS`/`Read-only file system` on Linux (ADR-022) — and a refused write is never offered as a read grant. If the output never names the operand, there is nothing to attribute and no prompt, so the command is simply refused.
 
-Every prompt waits **10 seconds** by default; no answer means the safe default: **block / deny**. Esc on any screen also blocks.
+Every prompt waits **15 seconds** by default and shows it live as `Default: … (Ns)` under the body. For file reads/writes no answer means the safe default: **block / deny**, and Esc blocks. For a network ask, an unanswered countdown means **allow once** (Esc still denies) — ADR-024. In the TUI the `Default:` line disappears as soon as you press ↑/↓ and the timer restarts, so the hint never competes with an active choice (ADR-031). The prompt is keyboard-only (ADR-036): ↑/↓ move the highlight, Enter selects, Esc cancels — a mouse click or wheel over the prompt does nothing.
+
+The same options apply to a bash command whose network request reaches a host outside `allowedDomains` (ADR-023), with the countdown default and live footer from ADR-024/ADR-031: `No` / `Yes, just this once` / `Yes, all in group for this session` / `Yes, always…`, and an untouched countdown counts as allow-once. Because the sandbox proxy asks per connection, `Allow (default)` covers that bash command rather than one connection — redirects and parallel connections to the same host do not re-prompt. A host in `deniedDomains`, or `network.strictAllowlist: true`, is blocked outright: the prompt never appears. A remembered host is written to `overrides.allowDomains` and takes effect immediately, so the waiting request completes without a retry. Prompts from both layers are serialized through one queue (`src/ui/ask-flow.ts`), so two unknown hosts cannot replace each other's selector and hang the waiting connection.
 
 ## Sensitive reads ask
 
@@ -98,7 +111,7 @@ Every prompt waits **10 seconds** by default; no answer means the safe default:
 - **`default`** (shipped) — rules only. No content inspection.
 - **`advanced-secure`** (recommended) — adds secret/credential detection, and **only adds asks or blocks** (never loosens):
   - file reads whose name looks like a credential store ask before the read;
-  - risky `mcp__<server>__<tool>` calls ask before they run;
+  - risky `mcp__<server>__<tool>` calls ask before they run. The gate ignores the `mcp__<server>__` namespace, takes the operation from the head verb of the name (or the first verb of the description), and asks for destructive names, mutating names (`update_*`, `create_*`, `run_*`, `evaluate_*`), and destructive arguments (SQL `DELETE`/`UPDATE` without `WHERE`, `rm -rf`, `*` targets, HTTP `DELETE`, production targets). A documented tool with an unclassified name (`context`, `capture`, `logs`) does not ask; a tool with **no description** counts as opaque and does. Tune it under `mcp` in `sandbox.json` (ADR-032): `allowTools` / `allowPrefixes` skip asks, `askTools` forces them, `trustAnnotations` lets a server's `readOnlyHint` allow the call, `askThreshold` moves the score line (default 30). An untrusted project file may only tighten it (add `askTools`, lower `askThreshold`, turn `allowSimpleUpdates`/`trustAnnotations` off).
   - before any tool/command/file output reaches the model, a secret-like hit shows the file and each detected line as `lineNo: text`, with two choices — **No, keep private** or **Yes, allow**. No, keep private withholds the output and tells the model it was withheld because it may contain sensitive information (not a failure, not an empty result).
 
 Switch with `/permission-mode`; all three modes are saved to the global `sandbox.json` and reflected in the footer's sandbox chip (`Sandbox: 🧠 N domains, M paths` for advanced-secure, `Sandbox: 🔒 …` for default). An untrusted project may move the mode **up** (toward stricter), never down: it cannot turn on YOLO or turn off Advanced Secure. The third choice, **YOLO**, disables every layer; the chip reads `⚠️ YOLO — all security layers disabled` until you pick another mode (ADR-020).
@@ -129,7 +142,7 @@ Without restarting, `/permission-mode` → **YOLO** turns every layer off in one
 
 ## Common tasks
 
-**Allow a new domain** — either answer "always" in the prompt when the block fires, or add it manually:
+**Allow a new domain** — either answer "always" in the prompt when the block fires (from a bash command or a URL tool), or add it manually:
 ```json
 // ~/.pi/agent/extensions/sandbox.json  (global)
 // or <cwd>/.pi/sandbox.json  (project-local)
@@ -138,6 +151,13 @@ Without restarting, `/permission-mode` → **YOLO** turns every layer off in one
 
 **Allow writes to a new path** — same pattern with `allowWrite`.
 
+**Allow an MCP tool** — in Advanced Secure mode, a `mcp__<server>__<tool>` call that keeps asking can be allowed without weakening anything else:
+```json
+// ~/.pi/agent/extensions/sandbox.json  (global)
+{ "mcp": { "allowPrefixes": ["mcp__ticktick__get_"], "allowTools": ["mcp__diffusion_studio__export"] } }
+```
+`allowTools` matches exact names, `allowPrefixes` matches the start (case-insensitive). Detected destructive calls still ask unless an exact `allowTools` entry names them. `"trustAnnotations": true` lets servers that mark a tool `readOnlyHint` skip the ask, and a project's `mcp` file may only tighten (add `askTools`, lower `askThreshold`, turn `allowSimpleUpdates`/`trustAnnotations` off) until you trust it.
+
 **View recent blocks** — run `/security` and read the audit section, or:
 ```bash
 tail -20 ~/.pi/agent/audit.log | python3 -m json.tool

package/src/core/grep-filter.ts

@@ -3,7 +3,7 @@
  * `path-N- text` for a context line. The separator is the same on both sides
  * of the line number, which keeps paths containing `-` or `:` parseable.
  */
-const GREP_LINE = /^(.+?)([:-])(\d+)\2 /;
+const GREP_LINE_RE = /^(.+?)([:-])(\d+)\2 /;
 
 export interface GrepFilterResult {
 	text: string;
@@ -20,26 +20,26 @@ export interface GrepFilterResult {
  * per path.
  */
 export function filterGrepOutput(text: string, isDenied: (printedPath: string) => boolean): GrepFilterResult {
-	const cache = new Map<string, boolean>();
+	const deniedByPath = new Map<string, boolean>();
 	const removedFiles = new Set<string>();
 	let removedLines = 0;
-	const kept: string[] = [];
+	const keptLines: string[] = [];
 	for (const line of text.split("\n")) {
-		const m = GREP_LINE.exec(line);
-		if (m) {
-			const file = m[1];
-			let denied = cache.get(file);
+		const match = GREP_LINE_RE.exec(line);
+		if (match) {
+			const printedPath = match[1];
+			let denied = deniedByPath.get(printedPath);
 			if (denied === undefined) {
-				denied = isDenied(file);
-				cache.set(file, denied);
+				denied = isDenied(printedPath);
+				deniedByPath.set(printedPath, denied);
 			}
 			if (denied) {
 				removedLines++;
-				removedFiles.add(file);
+				removedFiles.add(printedPath);
 				continue;
 			}
 		}
-		kept.push(line);
+		keptLines.push(line);
 	}
-	return { text: kept.join("\n"), removedLines, removedFiles: [...removedFiles] };
+	return { text: keptLines.join("\n"), removedLines, removedFiles: [...removedFiles] };
 }